To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.1.1
- compare with another revision
- download diff
- download tarball
- view history from revision 237.1.1
- Committer: Teddy Hogeborn
- Date: 2008-11-09 06:40:29 UTC
- mto: (237.2.1 mandos) (24.1.113 mandos)
- mto: This revision was merged to the branch mainline in revision 238.
- Revision ID: teddy@fukt.bsnet.se-20081109064029-df71jpoce308cq3v
First steps of a D-Bus interface to the server.
* mandos: Also import "dbus.service".
(Client): Inherit from "dbus.service.Object", which is a new-style
class, so inheriting from "object" is no longer necessary.
(Client.interface): New temporary variable which only exists during
class definition.
(Client.getName, Client.getFingerprint): New D-Bus getter methods.
(Client.setSecret): New D-Bus setter method.
(Client._set_timeout): Emit D-Bus signal "TimeoutChanged".
(Client.getTimeout): New D-Bus getter method.
(Client.TimeoutChanged): New D-Bus signal.
(Client._set_interval): Emit D-Bus signal "IntervalChanged".
(Client.getInterval): New D-Bus getter method.
(Client.intervalChanged): New D-Bus signal.
(Client.__init__): Also call "dbus.service.Object.__init__".
(Client.started): New boolean attribute.
(Client.start, Client.stop): Update "self.started", and emit D-Bus
signal "StateChanged".
(Client.StateChanged): New D-Bus signal.
(Client.stop): Use "self.started" instead of misusing "self.secret".
Also simplify code by using "getattr" instead of
"hasattr".
(Client.checker_callback): Emit D-Bus signal "CheckerCompleted".
(Client.CheckerCompleted): New D-Bus signal.
(Client.bumpTimeout): D-Bus method name for "bump_timeout".
(Client.start_checker): Emit D-Bus signal "CheckerStarted".
(Client.CheckerStarted): New D-Bus signal.
(Client.checkerIsRunning): New D-Bus method.
(Client.StopChecker): D-Bus method name for "stop_checker".
(Client.still_valid): First check "self.started".
(Client.stillValid): D-Bus method name for "still_valid".
* mandos: Also import "dbus.service".
(Client): Inherit from "dbus.service.Object", which is a new-style
class, so inheriting from "object" is no longer necessary.
(Client.interface): New temporary variable which only exists during
class definition.
(Client.getName, Client.getFingerprint): New D-Bus getter methods.
(Client.setSecret): New D-Bus setter method.
(Client._set_timeout): Emit D-Bus signal "TimeoutChanged".
(Client.getTimeout): New D-Bus getter method.
(Client.TimeoutChanged): New D-Bus signal.
(Client._set_interval): Emit D-Bus signal "IntervalChanged".
(Client.getInterval): New D-Bus getter method.
(Client.intervalChanged): New D-Bus signal.
(Client.__init__): Also call "dbus.service.Object.__init__".
(Client.started): New boolean attribute.
(Client.start, Client.stop): Update "self.started", and emit D-Bus
signal "StateChanged".
(Client.StateChanged): New D-Bus signal.
(Client.stop): Use "self.started" instead of misusing "self.secret".
Also simplify code by using "getattr" instead of
"hasattr".
(Client.checker_callback): Emit D-Bus signal "CheckerCompleted".
(Client.CheckerCompleted): New D-Bus signal.
(Client.bumpTimeout): D-Bus method name for "bump_timeout".
(Client.start_checker): Emit D-Bus signal "CheckerStarted".
(Client.CheckerStarted): New D-Bus signal.
(Client.checkerIsRunning): New D-Bus method.
(Client.StopChecker): D-Bus method name for "stop_checker".
(Client.still_valid): First check "self.started".
(Client.stillValid): D-Bus method name for "still_valid".
- files added:
- debian/mandos-client.config
- files removed:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
33
from __future__ import division, with_statement, absolute_import
36
34
37
import SocketServer as socketserver
35
import SocketServer
38
36
import socket
39
import argparse
37
from optparse import OptionParser
40
38
import datetime
41
39
import errno
42
40
import gnutls.crypto
45
43
import gnutls.library.functions
46
44
import gnutls.library.constants
47
45
import gnutls.library.types
48
import ConfigParser as configparser
46
import ConfigParser
49
47
import sys
50
48
import re
51
49
import os
52
50
import signal
51
from sets import Set
53
52
import subprocess
54
53
import atexit
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
59
import contextlib
60
import struct
61
import fcntl
62
import functools
63
import cPickle as pickle
64
import multiprocessing
58
from contextlib import closing
65
59
66
60
import dbus
67
61
import dbus.service
70
64
from dbus.mainloop.glib import DBusGMainLoop
71
65
import ctypes
72
66
import ctypes.util
73
import xml.dom.minidom
74
import inspect
75
76
try:
77
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
78
except AttributeError:
79
try:
80
from IN import SO_BINDTODEVICE
81
except ImportError:
82
SO_BINDTODEVICE = None
83
84
85
version = "1.3.0"
86
87
#logger = logging.getLogger('mandos')
67
68
version = "1.0.2"
69
88
70
logger = logging.Logger('mandos')
89
syslogger = (logging.handlers.SysLogHandler
90
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
address = str("/dev/log")))
92
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
71
syslogger = logging.handlers.SysLogHandler\
72
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
73
address = "/dev/log")
74
syslogger.setFormatter(logging.Formatter\
75
('Mandos: %(levelname)s: %(message)s'))
95
76
logger.addHandler(syslogger)
96
77
97
78
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
79
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
100
80
' %(message)s'))
101
81
logger.addHandler(console)
102
82
103
83
class AvahiError(Exception):
104
def __init__(self, value, *args, **kwargs):
84
def __init__(self, value):
105
85
self.value = value
106
super(AvahiError, self).__init__(value, *args, **kwargs)
107
def __unicode__(self):
108
return unicode(repr(self.value))
86
super(AvahiError, self).__init__()
87
def __str__(self):
88
return repr(self.value)
109
89
110
90
class AvahiServiceError(AvahiError):
111
91
pass
116
96
117
97
class AvahiService(object):
118
98
"""An Avahi (Zeroconf) service.
119
120
99
Attributes:
121
100
interface: integer; avahi.IF_UNSPEC or an interface index.
122
101
Used to optionally bind to the specified interface.
130
109
max_renames: integer; maximum number of renames
131
110
rename_count: integer; counter so we only rename after collisions
132
111
a sensible number of times
133
group: D-Bus Entry Group
134
server: D-Bus Server
135
bus: dbus.SystemBus()
136
112
"""
137
113
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
servicetype = None, port = None, TXT = None,
139
domain = "", host = "", max_renames = 32768,
140
protocol = avahi.PROTO_UNSPEC, bus = None):
114
servicetype = None, port = None, TXT = None, domain = "",
115
host = "", max_renames = 32768):
141
116
self.interface = interface
142
117
self.name = name
143
118
self.type = servicetype
144
119
self.port = port
145
self.TXT = TXT if TXT is not None else []
120
if TXT is None:
121
self.TXT = []
122
else:
123
self.TXT = TXT
146
124
self.domain = domain
147
125
self.host = host
148
126
self.rename_count = 0
149
127
self.max_renames = max_renames
150
self.protocol = protocol
151
self.group = None # our entry group
152
self.server = None
153
self.bus = bus
154
128
def rename(self):
155
129
"""Derived from the Avahi example code"""
156
130
if self.rename_count >= self.max_renames:
157
logger.critical("No suitable Zeroconf service name found"
158
" after %i retries, exiting.",
131
logger.critical(u"No suitable Zeroconf service name found"
132
u" after %i retries, exiting.",
159
133
self.rename_count)
160
134
raise AvahiServiceError("Too many renames")
161
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
162
logger.info("Changing Zeroconf service name to %r ...",
163
self.name)
164
syslogger.setFormatter(logging.Formatter
165
('Mandos (%s) [%%(process)d]:'
166
' %%(levelname)s: %%(message)s'
167
% self.name))
135
self.name = server.GetAlternativeServiceName(self.name)
136
logger.info(u"Changing Zeroconf service name to %r ...",
137
str(self.name))
138
syslogger.setFormatter(logging.Formatter\
139
('Mandos (%s): %%(levelname)s:'
140
' %%(message)s' % self.name))
168
141
self.remove()
169
try:
170
self.add()
171
except dbus.exceptions.DBusException, error:
172
logger.critical("DBusException: %s", error)
173
self.cleanup()
174
os._exit(1)
142
self.add()
175
143
self.rename_count += 1
176
144
def remove(self):
177
145
"""Derived from the Avahi example code"""
178
if self.group is not None:
179
self.group.Reset()
146
if group is not None:
147
group.Reset()
180
148
def add(self):
181
149
"""Derived from the Avahi example code"""
182
if self.group is None:
183
self.group = dbus.Interface(
184
self.bus.get_object(avahi.DBUS_NAME,
185
self.server.EntryGroupNew()),
186
avahi.DBUS_INTERFACE_ENTRY_GROUP)
187
self.group.connect_to_signal('StateChanged',
188
self
189
.entry_group_state_changed)
190
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
191
self.name, self.type)
192
self.group.AddService(
193
self.interface,
194
self.protocol,
195
dbus.UInt32(0), # flags
196
self.name, self.type,
197
self.domain, self.host,
198
dbus.UInt16(self.port),
199
avahi.string_array_to_txt_array(self.TXT))
200
self.group.Commit()
201
def entry_group_state_changed(self, state, error):
202
"""Derived from the Avahi example code"""
203
logger.debug("Avahi entry group state change: %i", state)
204
205
if state == avahi.ENTRY_GROUP_ESTABLISHED:
206
logger.debug("Zeroconf service established.")
207
elif state == avahi.ENTRY_GROUP_COLLISION:
208
logger.info("Zeroconf service name collision.")
209
self.rename()
210
elif state == avahi.ENTRY_GROUP_FAILURE:
211
logger.critical("Avahi: Error in group state changed %s",
212
unicode(error))
213
raise AvahiGroupError("State changed: %s"
214
% unicode(error))
215
def cleanup(self):
216
"""Derived from the Avahi example code"""
217
if self.group is not None:
218
self.group.Free()
219
self.group = None
220
def server_state_changed(self, state):
221
"""Derived from the Avahi example code"""
222
logger.debug("Avahi server state change: %i", state)
223
if state == avahi.SERVER_COLLISION:
224
logger.error("Zeroconf server name collision")
225
self.remove()
226
elif state == avahi.SERVER_RUNNING:
227
self.add()
228
def activate(self):
229
"""Derived from the Avahi example code"""
230
if self.server is None:
231
self.server = dbus.Interface(
232
self.bus.get_object(avahi.DBUS_NAME,
233
avahi.DBUS_PATH_SERVER),
234
avahi.DBUS_INTERFACE_SERVER)
235
self.server.connect_to_signal("StateChanged",
236
self.server_state_changed)
237
self.server_state_changed(self.server.GetState())
238
239
240
class Client(object):
150
global group
151
if group is None:
152
group = dbus.Interface\
153
(bus.get_object(avahi.DBUS_NAME,
154
server.EntryGroupNew()),
155
avahi.DBUS_INTERFACE_ENTRY_GROUP)
156
group.connect_to_signal('StateChanged',
157
entry_group_state_changed)
158
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
159
service.name, service.type)
160
group.AddService(
161
self.interface, # interface
162
avahi.PROTO_INET6, # protocol
163
dbus.UInt32(0), # flags
164
self.name, self.type,
165
self.domain, self.host,
166
dbus.UInt16(self.port),
167
avahi.string_array_to_txt_array(self.TXT))
168
group.Commit()
169
170
# From the Avahi example code:
171
group = None # our entry group
172
# End of Avahi example code
173
174
175
class Client(dbus.service.Object):
241
176
"""A representation of a client host served by this server.
242
243
177
Attributes:
244
_approved: bool(); 'None' if not yet approved/disapproved
245
approval_delay: datetime.timedelta(); Time to wait for approval
246
approval_duration: datetime.timedelta(); Duration of one approval
247
checker: subprocess.Popen(); a running checker process used
248
to see if the client lives.
249
'None' if no process is running.
250
checker_callback_tag: a gobject event source tag, or None
251
checker_command: string; External command which is run to check
252
if client lives. %() expansions are done at
178
name: string; from the config file, used in log messages
179
fingerprint: string (40 or 32 hexadecimal digits); used to
180
uniquely identify the client
181
secret: bytestring; sent verbatim (over TLS) to client
182
host: string; available for use by the checker command
183
created: datetime.datetime(); object creation, not client host
184
started: bool()
185
last_checked_ok: datetime.datetime() or None if not yet checked OK
186
timeout: datetime.timedelta(); How long from last_checked_ok
187
until this client is invalid
188
interval: datetime.timedelta(); How often to start a new checker
189
stop_hook: If set, called by stop() as stop_hook(self)
190
checker: subprocess.Popen(); a running checker process used
191
to see if the client lives.
192
'None' if no process is running.
193
checker_initiator_tag: a gobject event source tag, or None
194
stop_initiator_tag: - '' -
195
checker_callback_tag: - '' -
196
checker_command: string; External command which is run to check if
197
client lives. %() expansions are done at
253
198
runtime with vars(self) as dict, so that for
254
199
instance %(name)s can be used in the command.
255
checker_initiator_tag: a gobject event source tag, or None
256
created: datetime.datetime(); (UTC) object creation
257
current_checker_command: string; current running checker_command
258
disable_hook: If set, called by disable() as disable_hook(self)
259
disable_initiator_tag: a gobject event source tag, or None
260
enabled: bool()
261
fingerprint: string (40 or 32 hexadecimal digits); used to
262
uniquely identify the client
263
host: string; available for use by the checker command
264
interval: datetime.timedelta(); How often to start a new checker
265
last_approval_request: datetime.datetime(); (UTC) or None
266
last_checked_ok: datetime.datetime(); (UTC) or None
267
last_enabled: datetime.datetime(); (UTC)
268
name: string; from the config file, used in log messages and
269
D-Bus identifiers
270
secret: bytestring; sent verbatim (over TLS) to client
271
timeout: datetime.timedelta(); How long from last_checked_ok
272
until this client is disabled
273
runtime_expansions: Allowed attributes for runtime expansion.
200
Private attibutes:
201
_timeout: Real variable for 'timeout'
202
_interval: Real variable for 'interval'
203
_timeout_milliseconds: Used when calling gobject.timeout_add()
204
_interval_milliseconds: - '' -
274
205
"""
275
276
runtime_expansions = ("approval_delay", "approval_duration",
277
"created", "enabled", "fingerprint",
278
"host", "interval", "last_checked_ok",
279
"last_enabled", "name", "timeout")
280
281
@staticmethod
282
def _timedelta_to_milliseconds(td):
283
"Convert a datetime.timedelta() to milliseconds"
284
return ((td.days * 24 * 60 * 60 * 1000)
285
+ (td.seconds * 1000)
286
+ (td.microseconds // 1000))
287
288
def timeout_milliseconds(self):
289
"Return the 'timeout' attribute in milliseconds"
290
return self._timedelta_to_milliseconds(self.timeout)
291
292
def interval_milliseconds(self):
293
"Return the 'interval' attribute in milliseconds"
294
return self._timedelta_to_milliseconds(self.interval)
295
296
def approval_delay_milliseconds(self):
297
return self._timedelta_to_milliseconds(self.approval_delay)
298
299
def __init__(self, name = None, disable_hook=None, config=None):
206
interface = u"org.mandos_system.Mandos.Clients"
207
208
@dbus.service.method(interface, out_signature="s")
209
def getName(self):
210
"D-Bus getter method"
211
return self.name
212
213
@dbus.service.method(interface, out_signature="s")
214
def getFingerprint(self):
215
"D-Bus getter method"
216
return self.fingerprint
217
218
@dbus.service.method(interface, in_signature="ay",
219
byte_arrays=True)
220
def setSecret(self, secret):
221
"D-Bus setter method"
222
self.secret = secret
223
224
def _set_timeout(self, timeout):
225
"Setter function for the 'timeout' attribute"
226
self._timeout = timeout
227
self._timeout_milliseconds = ((self.timeout.days
228
* 24 * 60 * 60 * 1000)
229
+ (self.timeout.seconds * 1000)
230
+ (self.timeout.microseconds
231
// 1000))
232
# Emit D-Bus signal
233
self.TimeoutChanged(self._timeout_milliseconds)
234
timeout = property(lambda self: self._timeout, _set_timeout)
235
del _set_timeout
236
237
@dbus.service.method(interface, out_signature="t")
238
def getTimeout(self):
239
"D-Bus getter method"
240
return self._timeout_milliseconds
241
242
@dbus.service.signal(interface, signature="t")
243
def TimeoutChanged(self, t):
244
"D-Bus signal"
245
pass
246
247
def _set_interval(self, interval):
248
"Setter function for the 'interval' attribute"
249
self._interval = interval
250
self._interval_milliseconds = ((self.interval.days
251
* 24 * 60 * 60 * 1000)
252
+ (self.interval.seconds
253
* 1000)
254
+ (self.interval.microseconds
255
// 1000))
256
# Emit D-Bus signal
257
self.IntervalChanged(self._interval_milliseconds)
258
interval = property(lambda self: self._interval, _set_interval)
259
del _set_interval
260
261
@dbus.service.method(interface, out_signature="t")
262
def getInterval(self):
263
"D-Bus getter method"
264
return self._interval_milliseconds
265
266
@dbus.service.signal(interface, signature="t")
267
def IntervalChanged(self, t):
268
"D-Bus signal"
269
pass
270
271
def __init__(self, name = None, stop_hook=None, config=None):
300
272
"""Note: the 'checker' key in 'config' sets the
301
273
'checker_command' attribute and *not* the 'checker'
302
274
attribute."""
303
self.name = name
275
dbus.service.Object.__init__(self, bus,
276
"/Mandos/Clients/%s"
277
% name.replace(".", "_"))
304
278
if config is None:
305
279
config = {}
306
logger.debug("Creating client %r", self.name)
280
self.name = name
281
logger.debug(u"Creating client %r", self.name)
307
282
# Uppercase and remove spaces from fingerprint for later
308
283
# comparison purposes with return value from the fingerprint()
309
284
# function
310
self.fingerprint = (config["fingerprint"].upper()
311
.replace(" ", ""))
312
logger.debug(" Fingerprint: %s", self.fingerprint)
285
self.fingerprint = config["fingerprint"].upper()\
286
.replace(u" ", u"")
287
logger.debug(u" Fingerprint: %s", self.fingerprint)
313
288
if "secret" in config:
314
self.secret = config["secret"].decode("base64")
289
self.secret = config["secret"].decode(u"base64")
315
290
elif "secfile" in config:
316
with open(os.path.expanduser(os.path.expandvars
317
(config["secfile"])),
318
"rb") as secfile:
291
with closing(open(os.path.expanduser
292
(os.path.expandvars
293
(config["secfile"])))) \
294
as secfile:
319
295
self.secret = secfile.read()
320
296
else:
321
raise TypeError("No secret or secfile for client %s"
297
raise TypeError(u"No secret or secfile for client %s"
322
298
% self.name)
323
299
self.host = config.get("host", "")
324
self.created = datetime.datetime.utcnow()
325
self.enabled = False
326
self.last_approval_request = None
327
self.last_enabled = None
300
self.created = datetime.datetime.now()
301
self.started = False
328
302
self.last_checked_ok = None
329
303
self.timeout = string_to_delta(config["timeout"])
330
304
self.interval = string_to_delta(config["interval"])
331
self.disable_hook = disable_hook
305
self.stop_hook = stop_hook
332
306
self.checker = None
333
307
self.checker_initiator_tag = None
334
self.disable_initiator_tag = None
308
self.stop_initiator_tag = None
335
309
self.checker_callback_tag = None
336
self.checker_command = config["checker"]
337
self.current_checker_command = None
338
self.last_connect = None
339
self._approved = None
340
self.approved_by_default = config.get("approved_by_default",
341
True)
342
self.approvals_pending = 0
343
self.approval_delay = string_to_delta(
344
config["approval_delay"])
345
self.approval_duration = string_to_delta(
346
config["approval_duration"])
347
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
310
self.check_command = config["checker"]
348
311
349
def send_changedstate(self):
350
self.changedstate.acquire()
351
self.changedstate.notify_all()
352
self.changedstate.release()
353
354
def enable(self):
312
def start(self):
355
313
"""Start this client's checker and timeout hooks"""
356
if getattr(self, "enabled", False):
357
# Already enabled
358
return
359
self.send_changedstate()
360
self.last_enabled = datetime.datetime.utcnow()
314
self.started = True
361
315
# Schedule a new checker to be started an 'interval' from now,
362
316
# and every interval from then on.
363
self.checker_initiator_tag = (gobject.timeout_add
364
(self.interval_milliseconds(),
365
self.start_checker))
366
# Schedule a disable() when 'timeout' has passed
367
self.disable_initiator_tag = (gobject.timeout_add
368
(self.timeout_milliseconds(),
369
self.disable))
370
self.enabled = True
317
self.checker_initiator_tag = gobject.timeout_add\
318
(self._interval_milliseconds,
319
self.start_checker)
371
320
# Also start a new checker *right now*.
372
321
self.start_checker()
373
374
def disable(self, quiet=True):
375
"""Disable this client."""
376
if not getattr(self, "enabled", False):
322
# Schedule a stop() when 'timeout' has passed
323
self.stop_initiator_tag = gobject.timeout_add\
324
(self._timeout_milliseconds,
325
self.stop)
326
# Emit D-Bus signal
327
self.StateChanged(True)
328
329
@dbus.service.signal(interface, signature="b")
330
def StateChanged(self, started):
331
"D-Bus signal"
332
pass
333
334
def stop(self):
335
"""Stop this client."""
336
if getattr(self, "started", False):
337
logger.info(u"Stopping client %s", self.name)
338
else:
377
339
return False
378
if not quiet:
379
self.send_changedstate()
380
if not quiet:
381
logger.info("Disabling client %s", self.name)
382
if getattr(self, "disable_initiator_tag", False):
383
gobject.source_remove(self.disable_initiator_tag)
384
self.disable_initiator_tag = None
340
if getattr(self, "stop_initiator_tag", False):
341
gobject.source_remove(self.stop_initiator_tag)
342
self.stop_initiator_tag = None
385
343
if getattr(self, "checker_initiator_tag", False):
386
344
gobject.source_remove(self.checker_initiator_tag)
387
345
self.checker_initiator_tag = None
388
346
self.stop_checker()
389
if self.disable_hook:
390
self.disable_hook(self)
391
self.enabled = False
347
if self.stop_hook:
348
self.stop_hook(self)
349
# Emit D-Bus signal
350
self.StateChanged(False)
392
351
# Do not run this again if called by a gobject.timeout_add
393
352
return False
353
# D-Bus variant
354
Stop = dbus.service.method(interface)(stop)
394
355
395
356
def __del__(self):
396
self.disable_hook = None
397
self.disable()
357
self.stop_hook = None
358
self.stop()
398
359
399
def checker_callback(self, pid, condition, command):
360
def checker_callback(self, pid, condition):
400
361
"""The checker has completed, so take appropriate actions."""
401
362
self.checker_callback_tag = None
402
363
self.checker = None
403
if os.WIFEXITED(condition):
404
exitstatus = os.WEXITSTATUS(condition)
405
if exitstatus == 0:
406
logger.info("Checker for %(name)s succeeded",
407
vars(self))
408
self.checked_ok()
409
else:
410
logger.info("Checker for %(name)s failed",
411
vars(self))
412
else:
413
logger.warning("Checker for %(name)s crashed?",
364
if os.WIFEXITED(condition) \
365
and (os.WEXITSTATUS(condition) == 0):
366
logger.info(u"Checker for %(name)s succeeded",
367
vars(self))
368
# Emit D-Bus signal
369
self.CheckerCompleted(True)
370
self.bump_timeout()
371
elif not os.WIFEXITED(condition):
372
logger.warning(u"Checker for %(name)s crashed?",
414
373
vars(self))
415
416
def checked_ok(self):
374
# Emit D-Bus signal
375
self.CheckerCompleted(False)
376
else:
377
logger.info(u"Checker for %(name)s failed",
378
vars(self))
379
# Emit D-Bus signal
380
self.CheckerCompleted(False)
381
382
@dbus.service.signal(interface, signature="b")
383
def CheckerCompleted(self, success):
384
"D-Bus signal"
385
pass
386
387
def bump_timeout(self):
417
388
"""Bump up the timeout for this client.
418
419
389
This should only be called when the client has been seen,
420
390
alive and well.
421
391
"""
422
self.last_checked_ok = datetime.datetime.utcnow()
423
gobject.source_remove(self.disable_initiator_tag)
424
self.disable_initiator_tag = (gobject.timeout_add
425
(self.timeout_milliseconds(),
426
self.disable))
427
428
def need_approval(self):
429
self.last_approval_request = datetime.datetime.utcnow()
392
self.last_checked_ok = datetime.datetime.now()
393
gobject.source_remove(self.stop_initiator_tag)
394
self.stop_initiator_tag = gobject.timeout_add\
395
(self._timeout_milliseconds, self.stop)
396
# D-Bus variant
397
bumpTimeout = dbus.service.method(interface)(bump_timeout)
430
398
431
399
def start_checker(self):
432
400
"""Start a new checker subprocess if one is not running.
433
434
401
If a checker already exists, leave it running and do
435
402
nothing."""
436
403
# The reason for not killing a running checker is that if we
439
406
# client would inevitably timeout, since no checker would get
440
407
# a chance to run to completion. If we instead leave running
441
408
# checkers alone, the checker would have to take more time
442
# than 'timeout' for the client to be disabled, which is as it
443
# should be.
444
445
# If a checker exists, make sure it is not a zombie
446
try:
447
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
448
except (AttributeError, OSError), error:
449
if (isinstance(error, OSError)
450
and error.errno != errno.ECHILD):
451
raise error
452
else:
453
if pid:
454
logger.warning("Checker was a zombie")
455
gobject.source_remove(self.checker_callback_tag)
456
self.checker_callback(pid, status,
457
self.current_checker_command)
458
# Start a new checker if needed
409
# than 'timeout' for the client to be declared invalid, which
410
# is as it should be.
459
411
if self.checker is None:
460
412
try:
461
# In case checker_command has exactly one % operator
462
command = self.checker_command % self.host
413
# In case check_command has exactly one % operator
414
command = self.check_command % self.host
463
415
except TypeError:
464
416
# Escape attributes for the shell
465
escaped_attrs = dict(
466
(attr,
467
re.escape(unicode(str(getattr(self, attr, "")),
468
errors=
469
'replace')))
470
for attr in
471
self.runtime_expansions)
472
417
escaped_attrs = dict((key, re.escape(str(val)))
418
for key, val in
419
vars(self).iteritems())
473
420
try:
474
command = self.checker_command % escaped_attrs
421
command = self.check_command % escaped_attrs
475
422
except TypeError, error:
476
logger.error('Could not format string "%s":'
477
' %s', self.checker_command, error)
423
logger.error(u'Could not format string "%s":'
424
u' %s', self.check_command, error)
478
425
return True # Try again later
479
self.current_checker_command = command
480
426
try:
481
logger.info("Starting checker %r for %s",
427
logger.info(u"Starting checker %r for %s",
482
428
command, self.name)
483
429
# We don't need to redirect stdout and stderr, since
484
430
# in normal mode, that is already done by daemon(),
487
433
self.checker = subprocess.Popen(command,
488
434
close_fds=True,
489
435
shell=True, cwd="/")
490
self.checker_callback_tag = (gobject.child_watch_add
491
(self.checker.pid,
492
self.checker_callback,
493
data=command))
494
# The checker may have completed before the gobject
495
# watch was added. Check for this.
496
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
497
if pid:
498
gobject.source_remove(self.checker_callback_tag)
499
self.checker_callback(pid, status, command)
436
self.checker_callback_tag = gobject.child_watch_add\
437
(self.checker.pid,
438
self.checker_callback)
439
# Emit D-Bus signal
440
self.CheckerStarted(command)
500
441
except OSError, error:
501
logger.error("Failed to start subprocess: %s",
442
logger.error(u"Failed to start subprocess: %s",
502
443
error)
503
444
# Re-run this periodically if run by gobject.timeout_add
504
445
return True
505
446
447
@dbus.service.signal(interface, signature="s")
448
def CheckerStarted(self, command):
449
pass
450
451
@dbus.service.method(interface, out_signature="b")
452
def checkerIsRunning(self):
453
"D-Bus getter method"
454
return self.checker is not None
455
506
456
def stop_checker(self):
507
457
"""Force the checker process, if any, to stop."""
508
458
if self.checker_callback_tag:
510
460
self.checker_callback_tag = None
511
461
if getattr(self, "checker", None) is None:
512
462
return
513
logger.debug("Stopping checker for %(name)s", vars(self))
463
logger.debug(u"Stopping checker for %(name)s", vars(self))
514
464
try:
515
465
os.kill(self.checker.pid, signal.SIGTERM)
516
#time.sleep(0.5)
466
#os.sleep(0.5)
517
467
#if self.checker.poll() is None:
518
468
# os.kill(self.checker.pid, signal.SIGKILL)
519
469
except OSError, error:
520
470
if error.errno != errno.ESRCH: # No such process
521
471
raise
522
472
self.checker = None
523
524
def dbus_service_property(dbus_interface, signature="v",
525
access="readwrite", byte_arrays=False):
526
"""Decorators for marking methods of a DBusObjectWithProperties to
527
become properties on the D-Bus.
528
529
The decorated method will be called with no arguments by "Get"
530
and with one argument by "Set".
531
532
The parameters, where they are supported, are the same as
533
dbus.service.method, except there is only "signature", since the
534
type from Get() and the type sent to Set() is the same.
535
"""
536
# Encoding deeply encoded byte arrays is not supported yet by the
537
# "Set" method, so we fail early here:
538
if byte_arrays and signature != "ay":
539
raise ValueError("Byte arrays not supported for non-'ay'"
540
" signature %r" % signature)
541
def decorator(func):
542
func._dbus_is_property = True
543
func._dbus_interface = dbus_interface
544
func._dbus_signature = signature
545
func._dbus_access = access
546
func._dbus_name = func.__name__
547
if func._dbus_name.endswith("_dbus_property"):
548
func._dbus_name = func._dbus_name[:-14]
549
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
550
return func
551
return decorator
552
553
554
class DBusPropertyException(dbus.exceptions.DBusException):
555
"""A base class for D-Bus property-related exceptions
556
"""
557
def __unicode__(self):
558
return unicode(str(self))
559
560
561
class DBusPropertyAccessException(DBusPropertyException):
562
"""A property's access permissions disallows an operation.
563
"""
564
pass
565
566
567
class DBusPropertyNotFound(DBusPropertyException):
568
"""An attempt was made to access a non-existing property.
569
"""
570
pass
571
572
573
class DBusObjectWithProperties(dbus.service.Object):
574
"""A D-Bus object with properties.
575
576
Classes inheriting from this can use the dbus_service_property
577
decorator to expose methods as D-Bus properties. It exposes the
578
standard Get(), Set(), and GetAll() methods on the D-Bus.
579
"""
580
581
@staticmethod
582
def _is_dbus_property(obj):
583
return getattr(obj, "_dbus_is_property", False)
584
585
def _get_all_dbus_properties(self):
586
"""Returns a generator of (name, attribute) pairs
587
"""
588
return ((prop._dbus_name, prop)
589
for name, prop in
590
inspect.getmembers(self, self._is_dbus_property))
591
592
def _get_dbus_property(self, interface_name, property_name):
593
"""Returns a bound method if one exists which is a D-Bus
594
property with the specified name and interface.
595
"""
596
for name in (property_name,
597
property_name + "_dbus_property"):
598
prop = getattr(self, name, None)
599
if (prop is None
600
or not self._is_dbus_property(prop)
601
or prop._dbus_name != property_name
602
or (interface_name and prop._dbus_interface
603
and interface_name != prop._dbus_interface)):
604
continue
605
return prop
606
# No such property
607
raise DBusPropertyNotFound(self.dbus_object_path + ":"
608
+ interface_name + "."
609
+ property_name)
610
611
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
612
out_signature="v")
613
def Get(self, interface_name, property_name):
614
"""Standard D-Bus property Get() method, see D-Bus standard.
615
"""
616
prop = self._get_dbus_property(interface_name, property_name)
617
if prop._dbus_access == "write":
618
raise DBusPropertyAccessException(property_name)
619
value = prop()
620
if not hasattr(value, "variant_level"):
621
return value
622
return type(value)(value, variant_level=value.variant_level+1)
623
624
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
625
def Set(self, interface_name, property_name, value):
626
"""Standard D-Bus property Set() method, see D-Bus standard.
627
"""
628
prop = self._get_dbus_property(interface_name, property_name)
629
if prop._dbus_access == "read":
630
raise DBusPropertyAccessException(property_name)
631
if prop._dbus_get_args_options["byte_arrays"]:
632
# The byte_arrays option is not supported yet on
633
# signatures other than "ay".
634
if prop._dbus_signature != "ay":
635
raise ValueError
636
value = dbus.ByteArray(''.join(unichr(byte)
637
for byte in value))
638
prop(value)
639
640
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
641
out_signature="a{sv}")
642
def GetAll(self, interface_name):
643
"""Standard D-Bus property GetAll() method, see D-Bus
644
standard.
645
646
Note: Will not include properties with access="write".
647
"""
648
all = {}
649
for name, prop in self._get_all_dbus_properties():
650
if (interface_name
651
and interface_name != prop._dbus_interface):
652
# Interface non-empty but did not match
653
continue
654
# Ignore write-only properties
655
if prop._dbus_access == "write":
656
continue
657
value = prop()
658
if not hasattr(value, "variant_level"):
659
all[name] = value
660
continue
661
all[name] = type(value)(value, variant_level=
662
value.variant_level+1)
663
return dbus.Dictionary(all, signature="sv")
664
665
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
666
out_signature="s",
667
path_keyword='object_path',
668
connection_keyword='connection')
669
def Introspect(self, object_path, connection):
670
"""Standard D-Bus method, overloaded to insert property tags.
671
"""
672
xmlstring = dbus.service.Object.Introspect(self, object_path,
673
connection)
674
try:
675
document = xml.dom.minidom.parseString(xmlstring)
676
def make_tag(document, name, prop):
677
e = document.createElement("property")
678
e.setAttribute("name", name)
679
e.setAttribute("type", prop._dbus_signature)
680
e.setAttribute("access", prop._dbus_access)
681
return e
682
for if_tag in document.getElementsByTagName("interface"):
683
for tag in (make_tag(document, name, prop)
684
for name, prop
685
in self._get_all_dbus_properties()
686
if prop._dbus_interface
687
== if_tag.getAttribute("name")):
688
if_tag.appendChild(tag)
689
# Add the names to the return values for the
690
# "org.freedesktop.DBus.Properties" methods
691
if (if_tag.getAttribute("name")
692
== "org.freedesktop.DBus.Properties"):
693
for cn in if_tag.getElementsByTagName("method"):
694
if cn.getAttribute("name") == "Get":
695
for arg in cn.getElementsByTagName("arg"):
696
if (arg.getAttribute("direction")
697
== "out"):
698
arg.setAttribute("name", "value")
699
elif cn.getAttribute("name") == "GetAll":
700
for arg in cn.getElementsByTagName("arg"):
701
if (arg.getAttribute("direction")
702
== "out"):
703
arg.setAttribute("name", "props")
704
xmlstring = document.toxml("utf-8")
705
document.unlink()
706
except (AttributeError, xml.dom.DOMException,
707
xml.parsers.expat.ExpatError), error:
708
logger.error("Failed to override Introspection method",
709
error)
710
return xmlstring
711
712
713
class ClientDBus(Client, DBusObjectWithProperties):
714
"""A Client class using D-Bus
715
716
Attributes:
717
dbus_object_path: dbus.ObjectPath
718
bus: dbus.SystemBus()
719
"""
720
721
runtime_expansions = (Client.runtime_expansions
722
+ ("dbus_object_path",))
723
724
# dbus.service.Object doesn't use super(), so we can't either.
725
726
def __init__(self, bus = None, *args, **kwargs):
727
self._approvals_pending = 0
728
self.bus = bus
729
Client.__init__(self, *args, **kwargs)
730
# Only now, when this client is initialized, can it show up on
731
# the D-Bus
732
client_object_name = unicode(self.name).translate(
733
{ord("."): ord("_"),
734
ord("-"): ord("_")})
735
self.dbus_object_path = (dbus.ObjectPath
736
("/clients/" + client_object_name))
737
DBusObjectWithProperties.__init__(self, self.bus,
738
self.dbus_object_path)
739
740
def _get_approvals_pending(self):
741
return self._approvals_pending
742
def _set_approvals_pending(self, value):
743
old_value = self._approvals_pending
744
self._approvals_pending = value
745
bval = bool(value)
746
if (hasattr(self, "dbus_object_path")
747
and bval is not bool(old_value)):
748
dbus_bool = dbus.Boolean(bval, variant_level=1)
749
self.PropertyChanged(dbus.String("ApprovalPending"),
750
dbus_bool)
751
752
approvals_pending = property(_get_approvals_pending,
753
_set_approvals_pending)
754
del _get_approvals_pending, _set_approvals_pending
755
756
@staticmethod
757
def _datetime_to_dbus(dt, variant_level=0):
758
"""Convert a UTC datetime.datetime() to a D-Bus type."""
759
return dbus.String(dt.isoformat(),
760
variant_level=variant_level)
761
762
def enable(self):
763
oldstate = getattr(self, "enabled", False)
764
r = Client.enable(self)
765
if oldstate != self.enabled:
766
# Emit D-Bus signals
767
self.PropertyChanged(dbus.String("Enabled"),
768
dbus.Boolean(True, variant_level=1))
769
self.PropertyChanged(
770
dbus.String("LastEnabled"),
771
self._datetime_to_dbus(self.last_enabled,
772
variant_level=1))
773
return r
774
775
def disable(self, quiet = False):
776
oldstate = getattr(self, "enabled", False)
777
r = Client.disable(self, quiet=quiet)
778
if not quiet and oldstate != self.enabled:
779
# Emit D-Bus signal
780
self.PropertyChanged(dbus.String("Enabled"),
781
dbus.Boolean(False, variant_level=1))
782
return r
783
784
def __del__(self, *args, **kwargs):
785
try:
786
self.remove_from_connection()
787
except LookupError:
788
pass
789
if hasattr(DBusObjectWithProperties, "__del__"):
790
DBusObjectWithProperties.__del__(self, *args, **kwargs)
791
Client.__del__(self, *args, **kwargs)
792
793
def checker_callback(self, pid, condition, command,
794
*args, **kwargs):
795
self.checker_callback_tag = None
796
self.checker = None
797
# Emit D-Bus signal
798
self.PropertyChanged(dbus.String("CheckerRunning"),
799
dbus.Boolean(False, variant_level=1))
800
if os.WIFEXITED(condition):
801
exitstatus = os.WEXITSTATUS(condition)
802
# Emit D-Bus signal
803
self.CheckerCompleted(dbus.Int16(exitstatus),
804
dbus.Int64(condition),
805
dbus.String(command))
806
else:
807
# Emit D-Bus signal
808
self.CheckerCompleted(dbus.Int16(-1),
809
dbus.Int64(condition),
810
dbus.String(command))
811
812
return Client.checker_callback(self, pid, condition, command,
813
*args, **kwargs)
814
815
def checked_ok(self, *args, **kwargs):
816
r = Client.checked_ok(self, *args, **kwargs)
817
# Emit D-Bus signal
818
self.PropertyChanged(
819
dbus.String("LastCheckedOK"),
820
(self._datetime_to_dbus(self.last_checked_ok,
821
variant_level=1)))
822
return r
823
824
def need_approval(self, *args, **kwargs):
825
r = Client.need_approval(self, *args, **kwargs)
826
# Emit D-Bus signal
827
self.PropertyChanged(
828
dbus.String("LastApprovalRequest"),
829
(self._datetime_to_dbus(self.last_approval_request,
830
variant_level=1)))
831
return r
832
833
def start_checker(self, *args, **kwargs):
834
old_checker = self.checker
835
if self.checker is not None:
836
old_checker_pid = self.checker.pid
837
else:
838
old_checker_pid = None
839
r = Client.start_checker(self, *args, **kwargs)
840
# Only if new checker process was started
841
if (self.checker is not None
842
and old_checker_pid != self.checker.pid):
843
# Emit D-Bus signal
844
self.CheckerStarted(self.current_checker_command)
845
self.PropertyChanged(
846
dbus.String("CheckerRunning"),
847
dbus.Boolean(True, variant_level=1))
848
return r
849
850
def stop_checker(self, *args, **kwargs):
851
old_checker = getattr(self, "checker", None)
852
r = Client.stop_checker(self, *args, **kwargs)
853
if (old_checker is not None
854
and getattr(self, "checker", None) is None):
855
self.PropertyChanged(dbus.String("CheckerRunning"),
856
dbus.Boolean(False, variant_level=1))
857
return r
858
859
def _reset_approved(self):
860
self._approved = None
861
return False
862
863
def approve(self, value=True):
864
self.send_changedstate()
865
self._approved = value
866
gobject.timeout_add(self._timedelta_to_milliseconds
867
(self.approval_duration),
868
self._reset_approved)
869
870
871
## D-Bus methods, signals & properties
872
_interface = "se.bsnet.fukt.Mandos.Client"
873
874
## Signals
875
876
# CheckerCompleted - signal
877
@dbus.service.signal(_interface, signature="nxs")
878
def CheckerCompleted(self, exitcode, waitstatus, command):
879
"D-Bus signal"
880
pass
881
882
# CheckerStarted - signal
883
@dbus.service.signal(_interface, signature="s")
884
def CheckerStarted(self, command):
885
"D-Bus signal"
886
pass
887
888
# PropertyChanged - signal
889
@dbus.service.signal(_interface, signature="sv")
890
def PropertyChanged(self, property, value):
891
"D-Bus signal"
892
pass
893
894
# GotSecret - signal
895
@dbus.service.signal(_interface)
896
def GotSecret(self):
897
"""D-Bus signal
898
Is sent after a successful transfer of secret from the Mandos
899
server to mandos-client
900
"""
901
pass
902
903
# Rejected - signal
904
@dbus.service.signal(_interface, signature="s")
905
def Rejected(self, reason):
906
"D-Bus signal"
907
pass
908
909
# NeedApproval - signal
910
@dbus.service.signal(_interface, signature="tb")
911
def NeedApproval(self, timeout, default):
912
"D-Bus signal"
913
return self.need_approval()
914
915
## Methods
916
917
# Approve - method
918
@dbus.service.method(_interface, in_signature="b")
919
def Approve(self, value):
920
self.approve(value)
921
922
# CheckedOK - method
923
@dbus.service.method(_interface)
924
def CheckedOK(self):
925
return self.checked_ok()
926
927
# Enable - method
928
@dbus.service.method(_interface)
929
def Enable(self):
930
"D-Bus method"
931
self.enable()
932
933
# StartChecker - method
934
@dbus.service.method(_interface)
935
def StartChecker(self):
936
"D-Bus method"
937
self.start_checker()
938
939
# Disable - method
940
@dbus.service.method(_interface)
941
def Disable(self):
942
"D-Bus method"
943
self.disable()
944
945
# StopChecker - method
946
@dbus.service.method(_interface)
947
def StopChecker(self):
948
self.stop_checker()
949
950
## Properties
951
952
# ApprovalPending - property
953
@dbus_service_property(_interface, signature="b", access="read")
954
def ApprovalPending_dbus_property(self):
955
return dbus.Boolean(bool(self.approvals_pending))
956
957
# ApprovedByDefault - property
958
@dbus_service_property(_interface, signature="b",
959
access="readwrite")
960
def ApprovedByDefault_dbus_property(self, value=None):
961
if value is None: # get
962
return dbus.Boolean(self.approved_by_default)
963
self.approved_by_default = bool(value)
964
# Emit D-Bus signal
965
self.PropertyChanged(dbus.String("ApprovedByDefault"),
966
dbus.Boolean(value, variant_level=1))
967
968
# ApprovalDelay - property
969
@dbus_service_property(_interface, signature="t",
970
access="readwrite")
971
def ApprovalDelay_dbus_property(self, value=None):
972
if value is None: # get
973
return dbus.UInt64(self.approval_delay_milliseconds())
974
self.approval_delay = datetime.timedelta(0, 0, 0, value)
975
# Emit D-Bus signal
976
self.PropertyChanged(dbus.String("ApprovalDelay"),
977
dbus.UInt64(value, variant_level=1))
978
979
# ApprovalDuration - property
980
@dbus_service_property(_interface, signature="t",
981
access="readwrite")
982
def ApprovalDuration_dbus_property(self, value=None):
983
if value is None: # get
984
return dbus.UInt64(self._timedelta_to_milliseconds(
985
self.approval_duration))
986
self.approval_duration = datetime.timedelta(0, 0, 0, value)
987
# Emit D-Bus signal
988
self.PropertyChanged(dbus.String("ApprovalDuration"),
989
dbus.UInt64(value, variant_level=1))
990
991
# Name - property
992
@dbus_service_property(_interface, signature="s", access="read")
993
def Name_dbus_property(self):
994
return dbus.String(self.name)
995
996
# Fingerprint - property
997
@dbus_service_property(_interface, signature="s", access="read")
998
def Fingerprint_dbus_property(self):
999
return dbus.String(self.fingerprint)
1000
1001
# Host - property
1002
@dbus_service_property(_interface, signature="s",
1003
access="readwrite")
1004
def Host_dbus_property(self, value=None):
1005
if value is None: # get
1006
return dbus.String(self.host)
1007
self.host = value
1008
# Emit D-Bus signal
1009
self.PropertyChanged(dbus.String("Host"),
1010
dbus.String(value, variant_level=1))
1011
1012
# Created - property
1013
@dbus_service_property(_interface, signature="s", access="read")
1014
def Created_dbus_property(self):
1015
return dbus.String(self._datetime_to_dbus(self.created))
1016
1017
# LastEnabled - property
1018
@dbus_service_property(_interface, signature="s", access="read")
1019
def LastEnabled_dbus_property(self):
1020
if self.last_enabled is None:
1021
return dbus.String("")
1022
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1023
1024
# Enabled - property
1025
@dbus_service_property(_interface, signature="b",
1026
access="readwrite")
1027
def Enabled_dbus_property(self, value=None):
1028
if value is None: # get
1029
return dbus.Boolean(self.enabled)
1030
if value:
1031
self.enable()
1032
else:
1033
self.disable()
1034
1035
# LastCheckedOK - property
1036
@dbus_service_property(_interface, signature="s",
1037
access="readwrite")
1038
def LastCheckedOK_dbus_property(self, value=None):
1039
if value is not None:
1040
self.checked_ok()
1041
return
473
# D-Bus variant
474
StopChecker = dbus.service.method(interface)(stop_checker)
475
476
def still_valid(self):
477
"""Has the timeout not yet passed for this client?"""
478
if not self.started:
479
return False
480
now = datetime.datetime.now()
1042
481
if self.last_checked_ok is None:
1043
return dbus.String("")
1044
return dbus.String(self._datetime_to_dbus(self
1045
.last_checked_ok))
1046
1047
# LastApprovalRequest - property
1048
@dbus_service_property(_interface, signature="s", access="read")
1049
def LastApprovalRequest_dbus_property(self):
1050
if self.last_approval_request is None:
1051
return dbus.String("")
1052
return dbus.String(self.
1053
_datetime_to_dbus(self
1054
.last_approval_request))
1055
1056
# Timeout - property
1057
@dbus_service_property(_interface, signature="t",
1058
access="readwrite")
1059
def Timeout_dbus_property(self, value=None):
1060
if value is None: # get
1061
return dbus.UInt64(self.timeout_milliseconds())
1062
self.timeout = datetime.timedelta(0, 0, 0, value)
1063
# Emit D-Bus signal
1064
self.PropertyChanged(dbus.String("Timeout"),
1065
dbus.UInt64(value, variant_level=1))
1066
if getattr(self, "disable_initiator_tag", None) is None:
1067
return
1068
# Reschedule timeout
1069
gobject.source_remove(self.disable_initiator_tag)
1070
self.disable_initiator_tag = None
1071
time_to_die = (self.
1072
_timedelta_to_milliseconds((self
1073
.last_checked_ok
1074
+ self.timeout)
1075
- datetime.datetime
1076
.utcnow()))
1077
if time_to_die <= 0:
1078
# The timeout has passed
1079
self.disable()
1080
else:
1081
self.disable_initiator_tag = (gobject.timeout_add
1082
(time_to_die, self.disable))
1083
1084
# Interval - property
1085
@dbus_service_property(_interface, signature="t",
1086
access="readwrite")
1087
def Interval_dbus_property(self, value=None):
1088
if value is None: # get
1089
return dbus.UInt64(self.interval_milliseconds())
1090
self.interval = datetime.timedelta(0, 0, 0, value)
1091
# Emit D-Bus signal
1092
self.PropertyChanged(dbus.String("Interval"),
1093
dbus.UInt64(value, variant_level=1))
1094
if getattr(self, "checker_initiator_tag", None) is None:
1095
return
1096
# Reschedule checker run
1097
gobject.source_remove(self.checker_initiator_tag)
1098
self.checker_initiator_tag = (gobject.timeout_add
1099
(value, self.start_checker))
1100
self.start_checker() # Start one now, too
1101
1102
# Checker - property
1103
@dbus_service_property(_interface, signature="s",
1104
access="readwrite")
1105
def Checker_dbus_property(self, value=None):
1106
if value is None: # get
1107
return dbus.String(self.checker_command)
1108
self.checker_command = value
1109
# Emit D-Bus signal
1110
self.PropertyChanged(dbus.String("Checker"),
1111
dbus.String(self.checker_command,
1112
variant_level=1))
1113
1114
# CheckerRunning - property
1115
@dbus_service_property(_interface, signature="b",
1116
access="readwrite")
1117
def CheckerRunning_dbus_property(self, value=None):
1118
if value is None: # get
1119
return dbus.Boolean(self.checker is not None)
1120
if value:
1121
self.start_checker()
1122
else:
1123
self.stop_checker()
1124
1125
# ObjectPath - property
1126
@dbus_service_property(_interface, signature="o", access="read")
1127
def ObjectPath_dbus_property(self):
1128
return self.dbus_object_path # is already a dbus.ObjectPath
1129
1130
# Secret = property
1131
@dbus_service_property(_interface, signature="ay",
1132
access="write", byte_arrays=True)
1133
def Secret_dbus_property(self, value):
1134
self.secret = str(value)
1135
1136
del _interface
1137
1138
1139
class ProxyClient(object):
1140
def __init__(self, child_pipe, fpr, address):
1141
self._pipe = child_pipe
1142
self._pipe.send(('init', fpr, address))
1143
if not self._pipe.recv():
1144
raise KeyError()
1145
1146
def __getattribute__(self, name):
1147
if(name == '_pipe'):
1148
return super(ProxyClient, self).__getattribute__(name)
1149
self._pipe.send(('getattr', name))
1150
data = self._pipe.recv()
1151
if data[0] == 'data':
1152
return data[1]
1153
if data[0] == 'function':
1154
def func(*args, **kwargs):
1155
self._pipe.send(('funcall', name, args, kwargs))
1156
return self._pipe.recv()[1]
1157
return func
1158
1159
def __setattr__(self, name, value):
1160
if(name == '_pipe'):
1161
return super(ProxyClient, self).__setattr__(name, value)
1162
self._pipe.send(('setattr', name, value))
1163
1164
1165
class ClientHandler(socketserver.BaseRequestHandler, object):
1166
"""A class to handle client connections.
1167
1168
Instantiated once for each connection to handle it.
482
return now < (self.created + self.timeout)
483
else:
484
return now < (self.last_checked_ok + self.timeout)
485
# D-Bus variant
486
stillValid = dbus.service.method(interface, out_signature="b")\
487
(still_valid)
488
489
del interface
490
491
492
def peer_certificate(session):
493
"Return the peer's OpenPGP certificate as a bytestring"
494
# If not an OpenPGP certificate...
495
if gnutls.library.functions.gnutls_certificate_type_get\
496
(session._c_object) \
497
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
498
# ...do the normal thing
499
return session.peer_certificate
500
list_size = ctypes.c_uint()
501
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
502
(session._c_object, ctypes.byref(list_size))
503
if list_size.value == 0:
504
return None
505
cert = cert_list[0]
506
return ctypes.string_at(cert.data, cert.size)
507
508
509
def fingerprint(openpgp):
510
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
511
# New GnuTLS "datum" with the OpenPGP public key
512
datum = gnutls.library.types.gnutls_datum_t\
513
(ctypes.cast(ctypes.c_char_p(openpgp),
514
ctypes.POINTER(ctypes.c_ubyte)),
515
ctypes.c_uint(len(openpgp)))
516
# New empty GnuTLS certificate
517
crt = gnutls.library.types.gnutls_openpgp_crt_t()
518
gnutls.library.functions.gnutls_openpgp_crt_init\
519
(ctypes.byref(crt))
520
# Import the OpenPGP public key into the certificate
521
gnutls.library.functions.gnutls_openpgp_crt_import\
522
(crt, ctypes.byref(datum),
523
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
524
# Verify the self signature in the key
525
crtverify = ctypes.c_uint()
526
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
527
(crt, 0, ctypes.byref(crtverify))
528
if crtverify.value != 0:
529
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
530
raise gnutls.errors.CertificateSecurityError("Verify failed")
531
# New buffer for the fingerprint
532
buf = ctypes.create_string_buffer(20)
533
buf_len = ctypes.c_size_t()
534
# Get the fingerprint from the certificate into the buffer
535
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
536
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
537
# Deinit the certificate
538
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
539
# Convert the buffer to a Python bytestring
540
fpr = ctypes.string_at(buf, buf_len.value)
541
# Convert the bytestring to hexadecimal notation
542
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
543
return hex_fpr
544
545
546
class TCP_handler(SocketServer.BaseRequestHandler, object):
547
"""A TCP request handler class.
548
Instantiated by IPv6_TCPServer for each request to handle it.
1169
549
Note: This will run in its own forked process."""
1170
550
1171
551
def handle(self):
1172
with contextlib.closing(self.server.child_pipe) as child_pipe:
1173
logger.info("TCP connection from: %s",
1174
unicode(self.client_address))
1175
logger.debug("Pipe FD: %d",
1176
self.server.child_pipe.fileno())
1177
1178
session = (gnutls.connection
1179
.ClientSession(self.request,
1180
gnutls.connection
1181
.X509Credentials()))
1182
1183
# Note: gnutls.connection.X509Credentials is really a
1184
# generic GnuTLS certificate credentials object so long as
1185
# no X.509 keys are added to it. Therefore, we can use it
1186
# here despite using OpenPGP certificates.
1187
1188
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1189
# "+AES-256-CBC", "+SHA1",
1190
# "+COMP-NULL", "+CTYPE-OPENPGP",
1191
# "+DHE-DSS"))
1192
# Use a fallback default, since this MUST be set.
1193
priority = self.server.gnutls_priority
1194
if priority is None:
1195
priority = "NORMAL"
1196
(gnutls.library.functions
1197
.gnutls_priority_set_direct(session._c_object,
1198
priority, None))
1199
1200
# Start communication using the Mandos protocol
1201
# Get protocol number
1202
line = self.request.makefile().readline()
1203
logger.debug("Protocol version: %r", line)
1204
try:
1205
if int(line.strip().split()[0]) > 1:
1206
raise RuntimeError
1207
except (ValueError, IndexError, RuntimeError), error:
1208
logger.error("Unknown protocol version: %s", error)
1209
return
1210
1211
# Start GnuTLS connection
1212
try:
1213
session.handshake()
1214
except gnutls.errors.GNUTLSError, error:
1215
logger.warning("Handshake failed: %s", error)
1216
# Do not run session.bye() here: the session is not
1217
# established. Just abandon the request.
1218
return
1219
logger.debug("Handshake succeeded")
1220
1221
approval_required = False
1222
try:
1223
try:
1224
fpr = self.fingerprint(self.peer_certificate
1225
(session))
1226
except (TypeError, gnutls.errors.GNUTLSError), error:
1227
logger.warning("Bad certificate: %s", error)
1228
return
1229
logger.debug("Fingerprint: %s", fpr)
1230
1231
try:
1232
client = ProxyClient(child_pipe, fpr,
1233
self.client_address)
1234
except KeyError:
1235
return
1236
1237
if client.approval_delay:
1238
delay = client.approval_delay
1239
client.approvals_pending += 1
1240
approval_required = True
1241
1242
while True:
1243
if not client.enabled:
1244
logger.warning("Client %s is disabled",
1245
client.name)
1246
if self.server.use_dbus:
1247
# Emit D-Bus signal
1248
client.Rejected("Disabled")
1249
return
1250
1251
if client._approved or not client.approval_delay:
1252
#We are approved or approval is disabled
1253
break
1254
elif client._approved is None:
1255
logger.info("Client %s needs approval",
1256
client.name)
1257
if self.server.use_dbus:
1258
# Emit D-Bus signal
1259
client.NeedApproval(
1260
client.approval_delay_milliseconds(),
1261
client.approved_by_default)
1262
else:
1263
logger.warning("Client %s was not approved",
1264
client.name)
1265
if self.server.use_dbus:
1266
# Emit D-Bus signal
1267
client.Rejected("Denied")
1268
return
1269
1270
#wait until timeout or approved
1271
#x = float(client._timedelta_to_milliseconds(delay))
1272
time = datetime.datetime.now()
1273
client.changedstate.acquire()
1274
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1275
client.changedstate.release()
1276
time2 = datetime.datetime.now()
1277
if (time2 - time) >= delay:
1278
if not client.approved_by_default:
1279
logger.warning("Client %s timed out while"
1280
" waiting for approval",
1281
client.name)
1282
if self.server.use_dbus:
1283
# Emit D-Bus signal
1284
client.Rejected("Approval timed out")
1285
return
1286
else:
1287
break
1288
else:
1289
delay -= time2 - time
1290
1291
sent_size = 0
1292
while sent_size < len(client.secret):
1293
try:
1294
sent = session.send(client.secret[sent_size:])
1295
except (gnutls.errors.GNUTLSError), error:
1296
logger.warning("gnutls send failed")
1297
return
1298
logger.debug("Sent: %d, remaining: %d",
1299
sent, len(client.secret)
1300
- (sent_size + sent))
1301
sent_size += sent
1302
1303
logger.info("Sending secret to %s", client.name)
1304
# bump the timeout as if seen
1305
client.checked_ok()
1306
if self.server.use_dbus:
1307
# Emit D-Bus signal
1308
client.GotSecret()
1309
1310
finally:
1311
if approval_required:
1312
client.approvals_pending -= 1
1313
try:
1314
session.bye()
1315
except (gnutls.errors.GNUTLSError), error:
1316
logger.warning("GnuTLS bye failed")
1317
1318
@staticmethod
1319
def peer_certificate(session):
1320
"Return the peer's OpenPGP certificate as a bytestring"
1321
# If not an OpenPGP certificate...
1322
if (gnutls.library.functions
1323
.gnutls_certificate_type_get(session._c_object)
1324
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1325
# ...do the normal thing
1326
return session.peer_certificate
1327
list_size = ctypes.c_uint(1)
1328
cert_list = (gnutls.library.functions
1329
.gnutls_certificate_get_peers
1330
(session._c_object, ctypes.byref(list_size)))
1331
if not bool(cert_list) and list_size.value != 0:
1332
raise gnutls.errors.GNUTLSError("error getting peer"
1333
" certificate")
1334
if list_size.value == 0:
1335
return None
1336
cert = cert_list[0]
1337
return ctypes.string_at(cert.data, cert.size)
1338
1339
@staticmethod
1340
def fingerprint(openpgp):
1341
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1342
# New GnuTLS "datum" with the OpenPGP public key
1343
datum = (gnutls.library.types
1344
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1345
ctypes.POINTER
1346
(ctypes.c_ubyte)),
1347
ctypes.c_uint(len(openpgp))))
1348
# New empty GnuTLS certificate
1349
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1350
(gnutls.library.functions
1351
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1352
# Import the OpenPGP public key into the certificate
1353
(gnutls.library.functions
1354
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1355
gnutls.library.constants
1356
.GNUTLS_OPENPGP_FMT_RAW))
1357
# Verify the self signature in the key
1358
crtverify = ctypes.c_uint()
1359
(gnutls.library.functions
1360
.gnutls_openpgp_crt_verify_self(crt, 0,
1361
ctypes.byref(crtverify)))
1362
if crtverify.value != 0:
1363
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1364
raise (gnutls.errors.CertificateSecurityError
1365
("Verify failed"))
1366
# New buffer for the fingerprint
1367
buf = ctypes.create_string_buffer(20)
1368
buf_len = ctypes.c_size_t()
1369
# Get the fingerprint from the certificate into the buffer
1370
(gnutls.library.functions
1371
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1372
ctypes.byref(buf_len)))
1373
# Deinit the certificate
1374
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1375
# Convert the buffer to a Python bytestring
1376
fpr = ctypes.string_at(buf, buf_len.value)
1377
# Convert the bytestring to hexadecimal notation
1378
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1379
return hex_fpr
1380
1381
1382
class MultiprocessingMixIn(object):
1383
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1384
def sub_process_main(self, request, address):
1385
try:
1386
self.finish_request(request, address)
1387
except:
1388
self.handle_error(request, address)
1389
self.close_request(request)
1390
1391
def process_request(self, request, address):
1392
"""Start a new process to process the request."""
1393
multiprocessing.Process(target = self.sub_process_main,
1394
args = (request, address)).start()
1395
1396
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1397
""" adds a pipe to the MixIn """
1398
def process_request(self, request, client_address):
1399
"""Overrides and wraps the original process_request().
1400
1401
This function creates a new pipe in self.pipe
1402
"""
1403
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1404
1405
super(MultiprocessingMixInWithPipe,
1406
self).process_request(request, client_address)
1407
self.child_pipe.close()
1408
self.add_pipe(parent_pipe)
1409
1410
def add_pipe(self, parent_pipe):
1411
"""Dummy function; override as necessary"""
1412
raise NotImplementedError
1413
1414
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1415
socketserver.TCPServer, object):
1416
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1417
552
logger.info(u"TCP connection from: %s",
553
unicode(self.client_address))
554
session = gnutls.connection.ClientSession\
555
(self.request, gnutls.connection.X509Credentials())
556
557
line = self.request.makefile().readline()
558
logger.debug(u"Protocol version: %r", line)
559
try:
560
if int(line.strip().split()[0]) > 1:
561
raise RuntimeError
562
except (ValueError, IndexError, RuntimeError), error:
563
logger.error(u"Unknown protocol version: %s", error)
564
return
565
566
# Note: gnutls.connection.X509Credentials is really a generic
567
# GnuTLS certificate credentials object so long as no X.509
568
# keys are added to it. Therefore, we can use it here despite
569
# using OpenPGP certificates.
570
571
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
572
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
573
# "+DHE-DSS"))
574
# Use a fallback default, since this MUST be set.
575
priority = self.server.settings.get("priority", "NORMAL")
576
gnutls.library.functions.gnutls_priority_set_direct\
577
(session._c_object, priority, None)
578
579
try:
580
session.handshake()
581
except gnutls.errors.GNUTLSError, error:
582
logger.warning(u"Handshake failed: %s", error)
583
# Do not run session.bye() here: the session is not
584
# established. Just abandon the request.
585
return
586
try:
587
fpr = fingerprint(peer_certificate(session))
588
except (TypeError, gnutls.errors.GNUTLSError), error:
589
logger.warning(u"Bad certificate: %s", error)
590
session.bye()
591
return
592
logger.debug(u"Fingerprint: %s", fpr)
593
client = None
594
for c in self.server.clients:
595
if c.fingerprint == fpr:
596
client = c
597
break
598
if not client:
599
logger.warning(u"Client not found for fingerprint: %s",
600
fpr)
601
session.bye()
602
return
603
# Have to check if client.still_valid(), since it is possible
604
# that the client timed out while establishing the GnuTLS
605
# session.
606
if not client.still_valid():
607
logger.warning(u"Client %(name)s is invalid",
608
vars(client))
609
session.bye()
610
return
611
## This won't work here, since we're in a fork.
612
# client.bump_timeout()
613
sent_size = 0
614
while sent_size < len(client.secret):
615
sent = session.send(client.secret[sent_size:])
616
logger.debug(u"Sent: %d, remaining: %d",
617
sent, len(client.secret)
618
- (sent_size + sent))
619
sent_size += sent
620
session.bye()
621
622
623
class IPv6_TCPServer(SocketServer.ForkingMixIn,
624
SocketServer.TCPServer, object):
625
"""IPv6 TCP server. Accepts 'None' as address and/or port.
1418
626
Attributes:
627
settings: Server settings
628
clients: Set() of Client objects
1419
629
enabled: Boolean; whether this server is activated yet
1420
interface: None or a network interface name (string)
1421
use_ipv6: Boolean; to use IPv6 or not
1422
630
"""
1423
def __init__(self, server_address, RequestHandlerClass,
1424
interface=None, use_ipv6=True):
1425
self.interface = interface
1426
if use_ipv6:
1427
self.address_family = socket.AF_INET6
1428
socketserver.TCPServer.__init__(self, server_address,
1429
RequestHandlerClass)
631
address_family = socket.AF_INET6
632
def __init__(self, *args, **kwargs):
633
if "settings" in kwargs:
634
self.settings = kwargs["settings"]
635
del kwargs["settings"]
636
if "clients" in kwargs:
637
self.clients = kwargs["clients"]
638
del kwargs["clients"]
639
self.enabled = False
640
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1430
641
def server_bind(self):
1431
642
"""This overrides the normal server_bind() function
1432
643
to bind to an interface if one was specified, and also NOT to
1433
644
bind to an address or port if they were not specified."""
1434
if self.interface is not None:
1435
if SO_BINDTODEVICE is None:
1436
logger.error("SO_BINDTODEVICE does not exist;"
1437
" cannot bind to interface %s",
1438
self.interface)
1439
else:
1440
try:
1441
self.socket.setsockopt(socket.SOL_SOCKET,
1442
SO_BINDTODEVICE,
1443
str(self.interface
1444
+ '\0'))
1445
except socket.error, error:
1446
if error[0] == errno.EPERM:
1447
logger.error("No permission to"
1448
" bind to interface %s",
1449
self.interface)
1450
elif error[0] == errno.ENOPROTOOPT:
1451
logger.error("SO_BINDTODEVICE not available;"
1452
" cannot bind to interface %s",
1453
self.interface)
1454
else:
1455
raise
645
if self.settings["interface"]:
646
# 25 is from /usr/include/asm-i486/socket.h
647
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
648
try:
649
self.socket.setsockopt(socket.SOL_SOCKET,
650
SO_BINDTODEVICE,
651
self.settings["interface"])
652
except socket.error, error:
653
if error[0] == errno.EPERM:
654
logger.error(u"No permission to"
655
u" bind to interface %s",
656
self.settings["interface"])
657
else:
658
raise error
1456
659
# Only bind(2) the socket if we really need to.
1457
660
if self.server_address[0] or self.server_address[1]:
1458
661
if not self.server_address[0]:
1459
if self.address_family == socket.AF_INET6:
1460
any_address = "::" # in6addr_any
1461
else:
1462
any_address = socket.INADDR_ANY
1463
self.server_address = (any_address,
662
in6addr_any = "::"
663
self.server_address = (in6addr_any,
1464
664
self.server_address[1])
1465
665
elif not self.server_address[1]:
1466
666
self.server_address = (self.server_address[0],
1467
667
0)
1468
# if self.interface:
668
# if self.settings["interface"]:
1469
669
# self.server_address = (self.server_address[0],
1470
670
# 0, # port
1471
671
# 0, # flowinfo
1472
672
# if_nametoindex
1473
# (self.interface))
1474
return socketserver.TCPServer.server_bind(self)
1475
1476
1477
class MandosServer(IPv6_TCPServer):
1478
"""Mandos server.
1479
1480
Attributes:
1481
clients: set of Client objects
1482
gnutls_priority GnuTLS priority string
1483
use_dbus: Boolean; to emit D-Bus signals or not
1484
1485
Assumes a gobject.MainLoop event loop.
1486
"""
1487
def __init__(self, server_address, RequestHandlerClass,
1488
interface=None, use_ipv6=True, clients=None,
1489
gnutls_priority=None, use_dbus=True):
1490
self.enabled = False
1491
self.clients = clients
1492
if self.clients is None:
1493
self.clients = set()
1494
self.use_dbus = use_dbus
1495
self.gnutls_priority = gnutls_priority
1496
IPv6_TCPServer.__init__(self, server_address,
1497
RequestHandlerClass,
1498
interface = interface,
1499
use_ipv6 = use_ipv6)
673
# (self.settings
674
# ["interface"]))
675
return super(IPv6_TCPServer, self).server_bind()
1500
676
def server_activate(self):
1501
677
if self.enabled:
1502
return socketserver.TCPServer.server_activate(self)
678
return super(IPv6_TCPServer, self).server_activate()
1503
679
def enable(self):
1504
680
self.enabled = True
1505
def add_pipe(self, parent_pipe):
1506
# Call "handle_ipc" for both data and EOF events
1507
gobject.io_add_watch(parent_pipe.fileno(),
1508
gobject.IO_IN | gobject.IO_HUP,
1509
functools.partial(self.handle_ipc,
1510
parent_pipe = parent_pipe))
1511
1512
def handle_ipc(self, source, condition, parent_pipe=None,
1513
client_object=None):
1514
condition_names = {
1515
gobject.IO_IN: "IN", # There is data to read.
1516
gobject.IO_OUT: "OUT", # Data can be written (without
1517
# blocking).
1518
gobject.IO_PRI: "PRI", # There is urgent data to read.
1519
gobject.IO_ERR: "ERR", # Error condition.
1520
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1521
# broken, usually for pipes and
1522
# sockets).
1523
}
1524
conditions_string = ' | '.join(name
1525
for cond, name in
1526
condition_names.iteritems()
1527
if cond & condition)
1528
# error or the other end of multiprocessing.Pipe has closed
1529
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1530
return False
1531
1532
# Read a request from the child
1533
request = parent_pipe.recv()
1534
command = request[0]
1535
1536
if command == 'init':
1537
fpr = request[1]
1538
address = request[2]
1539
1540
for c in self.clients:
1541
if c.fingerprint == fpr:
1542
client = c
1543
break
1544
else:
1545
logger.warning("Client not found for fingerprint: %s, ad"
1546
"dress: %s", fpr, address)
1547
if self.use_dbus:
1548
# Emit D-Bus signal
1549
mandos_dbus_service.ClientNotFound(fpr, address[0])
1550
parent_pipe.send(False)
1551
return False
1552
1553
gobject.io_add_watch(parent_pipe.fileno(),
1554
gobject.IO_IN | gobject.IO_HUP,
1555
functools.partial(self.handle_ipc,
1556
parent_pipe = parent_pipe,
1557
client_object = client))
1558
parent_pipe.send(True)
1559
# remove the old hook in favor of the new above hook on same fileno
1560
return False
1561
if command == 'funcall':
1562
funcname = request[1]
1563
args = request[2]
1564
kwargs = request[3]
1565
1566
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1567
1568
if command == 'getattr':
1569
attrname = request[1]
1570
if callable(client_object.__getattribute__(attrname)):
1571
parent_pipe.send(('function',))
1572
else:
1573
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1574
1575
if command == 'setattr':
1576
attrname = request[1]
1577
value = request[2]
1578
setattr(client_object, attrname, value)
1579
1580
return True
1581
681
1582
682
1583
683
def string_to_delta(interval):
1584
684
"""Parse a string and return a datetime.timedelta
1585
685
1586
686
>>> string_to_delta('7d')
1587
687
datetime.timedelta(7)
1588
688
>>> string_to_delta('60s')
1591
691
datetime.timedelta(0, 3600)
1592
692
>>> string_to_delta('24h')
1593
693
datetime.timedelta(1)
1594
>>> string_to_delta('1w')
694
>>> string_to_delta(u'1w')
1595
695
datetime.timedelta(7)
1596
696
>>> string_to_delta('5m 30s')
1597
697
datetime.timedelta(0, 330)
1601
701
try:
1602
702
suffix = unicode(s[-1])
1603
703
value = int(s[:-1])
1604
if suffix == "d":
704
if suffix == u"d":
1605
705
delta = datetime.timedelta(value)
1606
elif suffix == "s":
706
elif suffix == u"s":
1607
707
delta = datetime.timedelta(0, value)
1608
elif suffix == "m":
708
elif suffix == u"m":
1609
709
delta = datetime.timedelta(0, 0, 0, 0, value)
1610
elif suffix == "h":
710
elif suffix == u"h":
1611
711
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1612
elif suffix == "w":
712
elif suffix == u"w":
1613
713
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1614
714
else:
1615
raise ValueError("Unknown suffix %r" % suffix)
1616
except (ValueError, IndexError), e:
1617
raise ValueError(*(e.args))
715
raise ValueError
716
except (ValueError, IndexError):
717
raise ValueError
1618
718
timevalue += delta
1619
719
return timevalue
1620
720
1621
721
722
def server_state_changed(state):
723
"""Derived from the Avahi example code"""
724
if state == avahi.SERVER_COLLISION:
725
logger.error(u"Zeroconf server name collision")
726
service.remove()
727
elif state == avahi.SERVER_RUNNING:
728
service.add()
729
730
731
def entry_group_state_changed(state, error):
732
"""Derived from the Avahi example code"""
733
logger.debug(u"Avahi state change: %i", state)
734
735
if state == avahi.ENTRY_GROUP_ESTABLISHED:
736
logger.debug(u"Zeroconf service established.")
737
elif state == avahi.ENTRY_GROUP_COLLISION:
738
logger.warning(u"Zeroconf service name collision.")
739
service.rename()
740
elif state == avahi.ENTRY_GROUP_FAILURE:
741
logger.critical(u"Avahi: Error in group state changed %s",
742
unicode(error))
743
raise AvahiGroupError("State changed: %s", str(error))
744
1622
745
def if_nametoindex(interface):
1623
"""Call the C function if_nametoindex(), or equivalent
1624
1625
Note: This function cannot accept a unicode string."""
746
"""Call the C function if_nametoindex(), or equivalent"""
1626
747
global if_nametoindex
1627
748
try:
1628
if_nametoindex = (ctypes.cdll.LoadLibrary
1629
(ctypes.util.find_library("c"))
1630
.if_nametoindex)
749
if_nametoindex = ctypes.cdll.LoadLibrary\
750
(ctypes.util.find_library("c")).if_nametoindex
1631
751
except (OSError, AttributeError):
1632
logger.warning("Doing if_nametoindex the hard way")
752
if "struct" not in sys.modules:
753
import struct
754
if "fcntl" not in sys.modules:
755
import fcntl
1633
756
def if_nametoindex(interface):
1634
757
"Get an interface index the hard way, i.e. using fcntl()"
1635
758
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1636
with contextlib.closing(socket.socket()) as s:
759
with closing(socket.socket()) as s:
1637
760
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1638
struct.pack(str("16s16x"),
1639
interface))
1640
interface_index = struct.unpack(str("I"),
1641
ifreq[16:20])[0]
761
struct.pack("16s16x", interface))
762
interface_index = struct.unpack("I", ifreq[16:20])[0]
1642
763
return interface_index
1643
764
return if_nametoindex(interface)
1644
765
1645
766
1646
767
def daemon(nochdir = False, noclose = False):
1647
768
"""See daemon(3). Standard BSD Unix function.
1648
1649
769
This should really exist as os.daemon, but it doesn't (yet)."""
1650
770
if os.fork():
1651
771
sys.exit()
1659
779
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1660
780
if not stat.S_ISCHR(os.fstat(null).st_mode):
1661
781
raise OSError(errno.ENODEV,
1662
"%s not a character device"
1663
% os.path.devnull)
782
"/dev/null not a character device")
1664
783
os.dup2(null, sys.stdin.fileno())
1665
784
os.dup2(null, sys.stdout.fileno())
1666
785
os.dup2(null, sys.stderr.fileno())
1669
788
1670
789
1671
790
def main():
1672
1673
##################################################################
1674
# Parsing of options, both command line and config file
1675
1676
parser = argparse.ArgumentParser()
1677
parser.add_argument("-v", "--version", action="version",
1678
version = "%%(prog)s %s" % version,
1679
help="show version number and exit")
1680
parser.add_argument("-i", "--interface", metavar="IF",
1681
help="Bind to interface IF")
1682
parser.add_argument("-a", "--address",
1683
help="Address to listen for requests on")
1684
parser.add_argument("-p", "--port", type=int,
1685
help="Port number to receive requests on")
1686
parser.add_argument("--check", action="store_true",
1687
help="Run self-test")
1688
parser.add_argument("--debug", action="store_true",
1689
help="Debug mode; run in foreground and log"
1690
" to terminal")
1691
parser.add_argument("--debuglevel", metavar="LEVEL",
1692
help="Debug level for stdout output")
1693
parser.add_argument("--priority", help="GnuTLS"
1694
" priority string (see GnuTLS documentation)")
1695
parser.add_argument("--servicename",
1696
metavar="NAME", help="Zeroconf service name")
1697
parser.add_argument("--configdir",
1698
default="/etc/mandos", metavar="DIR",
1699
help="Directory to search for configuration"
1700
" files")
1701
parser.add_argument("--no-dbus", action="store_false",
1702
dest="use_dbus", help="Do not provide D-Bus"
1703
" system bus interface")
1704
parser.add_argument("--no-ipv6", action="store_false",
1705
dest="use_ipv6", help="Do not use IPv6")
1706
options = parser.parse_args()
791
parser = OptionParser(version = "%%prog %s" % version)
792
parser.add_option("-i", "--interface", type="string",
793
metavar="IF", help="Bind to interface IF")
794
parser.add_option("-a", "--address", type="string",
795
help="Address to listen for requests on")
796
parser.add_option("-p", "--port", type="int",
797
help="Port number to receive requests on")
798
parser.add_option("--check", action="store_true", default=False,
799
help="Run self-test")
800
parser.add_option("--debug", action="store_true",
801
help="Debug mode; run in foreground and log to"
802
" terminal")
803
parser.add_option("--priority", type="string", help="GnuTLS"
804
" priority string (see GnuTLS documentation)")
805
parser.add_option("--servicename", type="string", metavar="NAME",
806
help="Zeroconf service name")
807
parser.add_option("--configdir", type="string",
808
default="/etc/mandos", metavar="DIR",
809
help="Directory to search for configuration"
810
" files")
811
options = parser.parse_args()[0]
1707
812
1708
813
if options.check:
1709
814
import doctest
1718
823
"priority":
1719
824
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1720
825
"servicename": "Mandos",
1721
"use_dbus": "True",
1722
"use_ipv6": "True",
1723
"debuglevel": "",
1724
826
}
1725
827
1726
828
# Parse config file for server-global settings
1727
server_config = configparser.SafeConfigParser(server_defaults)
829
server_config = ConfigParser.SafeConfigParser(server_defaults)
1728
830
del server_defaults
1729
server_config.read(os.path.join(options.configdir,
1730
"mandos.conf"))
831
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1731
832
# Convert the SafeConfigParser object to a dict
1732
833
server_settings = server_config.defaults()
1733
# Use the appropriate methods on the non-string config options
1734
for option in ("debug", "use_dbus", "use_ipv6"):
1735
server_settings[option] = server_config.getboolean("DEFAULT",
1736
option)
1737
if server_settings["port"]:
1738
server_settings["port"] = server_config.getint("DEFAULT",
1739
"port")
834
# Use getboolean on the boolean config option
835
server_settings["debug"] = server_config.getboolean\
836
("DEFAULT", "debug")
1740
837
del server_config
1741
838
1742
839
# Override the settings from the config file with command line
1743
840
# options, if set.
1744
841
for option in ("interface", "address", "port", "debug",
1745
"priority", "servicename", "configdir",
1746
"use_dbus", "use_ipv6", "debuglevel"):
842
"priority", "servicename", "configdir"):
1747
843
value = getattr(options, option)
1748
844
if value is not None:
1749
845
server_settings[option] = value
1750
846
del options
1751
# Force all strings to be unicode
1752
for option in server_settings.keys():
1753
if type(server_settings[option]) is str:
1754
server_settings[option] = unicode(server_settings[option])
1755
847
# Now we have our good server settings in "server_settings"
1756
848
1757
##################################################################
1758
1759
# For convenience
1760
849
debug = server_settings["debug"]
1761
debuglevel = server_settings["debuglevel"]
1762
use_dbus = server_settings["use_dbus"]
1763
use_ipv6 = server_settings["use_ipv6"]
1764
850
851
if not debug:
852
syslogger.setLevel(logging.WARNING)
853
console.setLevel(logging.WARNING)
854
1765
855
if server_settings["servicename"] != "Mandos":
1766
syslogger.setFormatter(logging.Formatter
1767
('Mandos (%s) [%%(process)d]:'
1768
' %%(levelname)s: %%(message)s'
856
syslogger.setFormatter(logging.Formatter\
857
('Mandos (%s): %%(levelname)s:'
858
' %%(message)s'
1769
859
% server_settings["servicename"]))
1770
860
1771
861
# Parse config file with clients
1772
862
client_defaults = { "timeout": "1h",
1773
863
"interval": "5m",
1774
"checker": "fping -q -- %%(host)s",
864
"checker": "fping -q -- %(host)s",
1775
865
"host": "",
1776
"approval_delay": "0s",
1777
"approval_duration": "1s",
1778
866
}
1779
client_config = configparser.SafeConfigParser(client_defaults)
867
client_config = ConfigParser.SafeConfigParser(client_defaults)
1780
868
client_config.read(os.path.join(server_settings["configdir"],
1781
869
"clients.conf"))
1782
870
1783
global mandos_dbus_service
1784
mandos_dbus_service = None
1785
1786
tcp_server = MandosServer((server_settings["address"],
1787
server_settings["port"]),
1788
ClientHandler,
1789
interface=(server_settings["interface"]
1790
or None),
1791
use_ipv6=use_ipv6,
1792
gnutls_priority=
1793
server_settings["priority"],
1794
use_dbus=use_dbus)
1795
if not debug:
1796
pidfilename = "/var/run/mandos.pid"
1797
try:
1798
pidfile = open(pidfilename, "w")
1799
except IOError:
1800
logger.error("Could not open file %r", pidfilename)
1801
1802
try:
1803
uid = pwd.getpwnam("_mandos").pw_uid
1804
gid = pwd.getpwnam("_mandos").pw_gid
1805
except KeyError:
1806
try:
1807
uid = pwd.getpwnam("mandos").pw_uid
1808
gid = pwd.getpwnam("mandos").pw_gid
1809
except KeyError:
1810
try:
1811
uid = pwd.getpwnam("nobody").pw_uid
1812
gid = pwd.getpwnam("nobody").pw_gid
1813
except KeyError:
1814
uid = 65534
1815
gid = 65534
1816
try:
871
clients = Set()
872
tcp_server = IPv6_TCPServer((server_settings["address"],
873
server_settings["port"]),
874
TCP_handler,
875
settings=server_settings,
876
clients=clients)
877
pidfilename = "/var/run/mandos.pid"
878
try:
879
pidfile = open(pidfilename, "w")
880
except IOError, error:
881
logger.error("Could not open file %r", pidfilename)
882
883
uid = 65534
884
gid = 65534
885
try:
886
uid = pwd.getpwnam("mandos").pw_uid
887
except KeyError:
888
try:
889
uid = pwd.getpwnam("nobody").pw_uid
890
except KeyError:
891
pass
892
try:
893
gid = pwd.getpwnam("mandos").pw_gid
894
except KeyError:
895
try:
896
gid = pwd.getpwnam("nogroup").pw_gid
897
except KeyError:
898
pass
899
try:
900
os.setuid(uid)
1817
901
os.setgid(gid)
1818
os.setuid(uid)
1819
902
except OSError, error:
1820
903
if error[0] != errno.EPERM:
1821
904
raise error
1822
905
1823
if not debug and not debuglevel:
1824
syslogger.setLevel(logging.WARNING)
1825
console.setLevel(logging.WARNING)
1826
if debuglevel:
1827
level = getattr(logging, debuglevel.upper())
1828
syslogger.setLevel(level)
1829
console.setLevel(level)
1830
906
global service
907
service = AvahiService(name = server_settings["servicename"],
908
servicetype = "_mandos._tcp", )
909
if server_settings["interface"]:
910
service.interface = if_nametoindex\
911
(server_settings["interface"])
912
913
global main_loop
914
global bus
915
global server
916
# From the Avahi example code
917
DBusGMainLoop(set_as_default=True )
918
main_loop = gobject.MainLoop()
919
bus = dbus.SystemBus()
920
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
921
avahi.DBUS_PATH_SERVER),
922
avahi.DBUS_INTERFACE_SERVER)
923
# End of Avahi example code
924
925
def remove_from_clients(client):
926
clients.remove(client)
927
if not clients:
928
logger.critical(u"No clients left, exiting")
929
sys.exit()
930
931
clients.update(Set(Client(name = section,
932
stop_hook = remove_from_clients,
933
config
934
= dict(client_config.items(section)))
935
for section in client_config.sections()))
936
if not clients:
937
logger.critical(u"No clients defined")
938
sys.exit(1)
939
1831
940
if debug:
1832
# Enable all possible GnuTLS debugging
1833
1834
# "Use a log level over 10 to enable all debugging options."
1835
# - GnuTLS manual
1836
gnutls.library.functions.gnutls_global_set_log_level(11)
1837
1838
@gnutls.library.types.gnutls_log_func
1839
def debug_gnutls(level, string):
1840
logger.debug("GnuTLS: %s", string[:-1])
1841
1842
(gnutls.library.functions
1843
.gnutls_global_set_log_function(debug_gnutls))
1844
1845
941
# Redirect stdin so all checkers get /dev/null
1846
942
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1847
943
os.dup2(null, sys.stdin.fileno())
1850
946
else:
1851
947
# No console logging
1852
948
logger.removeHandler(console)
1853
1854
# Need to fork before connecting to D-Bus
1855
if not debug:
1856
949
# Close all input and output, do double fork, etc.
1857
950
daemon()
1858
951
1859
global main_loop
1860
# From the Avahi example code
1861
DBusGMainLoop(set_as_default=True )
1862
main_loop = gobject.MainLoop()
1863
bus = dbus.SystemBus()
1864
# End of Avahi example code
1865
if use_dbus:
1866
try:
1867
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1868
bus, do_not_queue=True)
1869
except dbus.exceptions.NameExistsException, e:
1870
logger.error(unicode(e) + ", disabling D-Bus")
1871
use_dbus = False
1872
server_settings["use_dbus"] = False
1873
tcp_server.use_dbus = False
1874
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1875
service = AvahiService(name = server_settings["servicename"],
1876
servicetype = "_mandos._tcp",
1877
protocol = protocol, bus = bus)
1878
if server_settings["interface"]:
1879
service.interface = (if_nametoindex
1880
(str(server_settings["interface"])))
1881
1882
global multiprocessing_manager
1883
multiprocessing_manager = multiprocessing.Manager()
1884
1885
client_class = Client
1886
if use_dbus:
1887
client_class = functools.partial(ClientDBus, bus = bus)
1888
def client_config_items(config, section):
1889
special_settings = {
1890
"approved_by_default":
1891
lambda: config.getboolean(section,
1892
"approved_by_default"),
1893
}
1894
for name, value in config.items(section):
1895
try:
1896
yield (name, special_settings[name]())
1897
except KeyError:
1898
yield (name, value)
1899
1900
tcp_server.clients.update(set(
1901
client_class(name = section,
1902
config= dict(client_config_items(
1903
client_config, section)))
1904
for section in client_config.sections()))
1905
if not tcp_server.clients:
1906
logger.warning("No clients defined")
952
try:
953
pid = os.getpid()
954
pidfile.write(str(pid) + "\n")
955
pidfile.close()
956
del pidfile
957
except IOError:
958
logger.error(u"Could not write to file %r with PID %d",
959
pidfilename, pid)
960
except NameError:
961
# "pidfile" was never created
962
pass
963
del pidfilename
964
965
def cleanup():
966
"Cleanup function; run on exit"
967
global group
968
# From the Avahi example code
969
if not group is None:
970
group.Free()
971
group = None
972
# End of Avahi example code
1907
973
974
while clients:
975
client = clients.pop()
976
client.stop_hook = None
977
client.stop()
978
979
atexit.register(cleanup)
980
1908
981
if not debug:
1909
try:
1910
with pidfile:
1911
pid = os.getpid()
1912
pidfile.write(str(pid) + "\n".encode("utf-8"))
1913
del pidfile
1914
except IOError:
1915
logger.error("Could not write to file %r with PID %d",
1916
pidfilename, pid)
1917
except NameError:
1918
# "pidfile" was never created
1919
pass
1920
del pidfilename
1921
1922
982
signal.signal(signal.SIGINT, signal.SIG_IGN)
1923
1924
983
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1925
984
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1926
985
1927
if use_dbus:
1928
class MandosDBusService(dbus.service.Object):
1929
"""A D-Bus proxy object"""
1930
def __init__(self):
1931
dbus.service.Object.__init__(self, bus, "/")
1932
_interface = "se.bsnet.fukt.Mandos"
1933
1934
@dbus.service.signal(_interface, signature="o")
1935
def ClientAdded(self, objpath):
1936
"D-Bus signal"
1937
pass
1938
1939
@dbus.service.signal(_interface, signature="ss")
1940
def ClientNotFound(self, fingerprint, address):
1941
"D-Bus signal"
1942
pass
1943
1944
@dbus.service.signal(_interface, signature="os")
1945
def ClientRemoved(self, objpath, name):
1946
"D-Bus signal"
1947
pass
1948
1949
@dbus.service.method(_interface, out_signature="ao")
1950
def GetAllClients(self):
1951
"D-Bus method"
1952
return dbus.Array(c.dbus_object_path
1953
for c in tcp_server.clients)
1954
1955
@dbus.service.method(_interface,
1956
out_signature="a{oa{sv}}")
1957
def GetAllClientsWithProperties(self):
1958
"D-Bus method"
1959
return dbus.Dictionary(
1960
((c.dbus_object_path, c.GetAll(""))
1961
for c in tcp_server.clients),
1962
signature="oa{sv}")
1963
1964
@dbus.service.method(_interface, in_signature="o")
1965
def RemoveClient(self, object_path):
1966
"D-Bus method"
1967
for c in tcp_server.clients:
1968
if c.dbus_object_path == object_path:
1969
tcp_server.clients.remove(c)
1970
c.remove_from_connection()
1971
# Don't signal anything except ClientRemoved
1972
c.disable(quiet=True)
1973
# Emit D-Bus signal
1974
self.ClientRemoved(object_path, c.name)
1975
return
1976
raise KeyError(object_path)
1977
1978
del _interface
1979
1980
mandos_dbus_service = MandosDBusService()
1981
1982
def cleanup():
1983
"Cleanup function; run on exit"
1984
service.cleanup()
1985
1986
while tcp_server.clients:
1987
client = tcp_server.clients.pop()
1988
if use_dbus:
1989
client.remove_from_connection()
1990
client.disable_hook = None
1991
# Don't signal anything except ClientRemoved
1992
client.disable(quiet=True)
1993
if use_dbus:
1994
# Emit D-Bus signal
1995
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
1996
client.name)
1997
1998
atexit.register(cleanup)
1999
2000
for client in tcp_server.clients:
2001
if use_dbus:
2002
# Emit D-Bus signal
2003
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2004
client.enable()
986
for client in clients:
987
client.start()
2005
988
2006
989
tcp_server.enable()
2007
990
tcp_server.server_activate()
2008
991
2009
992
# Find out what port we got
2010
993
service.port = tcp_server.socket.getsockname()[1]
2011
if use_ipv6:
2012
logger.info("Now listening on address %r, port %d,"
2013
" flowinfo %d, scope_id %d"
2014
% tcp_server.socket.getsockname())
2015
else: # IPv4
2016
logger.info("Now listening on address %r, port %d"
2017
% tcp_server.socket.getsockname())
994
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
995
u" scope_id %d" % tcp_server.socket.getsockname())
2018
996
2019
997
#service.interface = tcp_server.socket.getsockname()[3]
2020
998
2021
999
try:
2022
1000
# From the Avahi example code
1001
server.connect_to_signal("StateChanged", server_state_changed)
2023
1002
try:
2024
service.activate()
1003
server_state_changed(server.GetState())
2025
1004
except dbus.exceptions.DBusException, error:
2026
logger.critical("DBusException: %s", error)
2027
cleanup()
1005
logger.critical(u"DBusException: %s", error)
2028
1006
sys.exit(1)
2029
1007
# End of Avahi example code
2030
1008
2031
1009
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2032
1010
lambda *args, **kwargs:
2033
(tcp_server.handle_request
2034
(*args[2:], **kwargs) or True))
1011
tcp_server.handle_request\
1012
(*args[2:], **kwargs) or True)
2035
1013
2036
logger.debug("Starting main loop")
1014
logger.debug(u"Starting main loop")
2037
1015
main_loop.run()
2038
1016
except AvahiError, error:
2039
logger.critical("AvahiError: %s", error)
2040
cleanup()
1017
logger.critical(u"AvahiError: %s" + unicode(error))
2041
1018
sys.exit(1)
2042
1019
except KeyboardInterrupt:
2043
1020
if debug:
2044
print("", file=sys.stderr)
2045
logger.debug("Server received KeyboardInterrupt")
2046
logger.debug("Server exiting")
2047
# Must run before the D-Bus bus name gets deregistered
2048
cleanup()
1021
print
2049
1022
2050
1023
if __name__ == '__main__':
2051
1024
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0