/mandos/release : revision 237.7.297

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

import SocketServer as socketserver

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

38

43

import socket

39

import optparse

44

import argparse

40

45

import datetime

41

46

import errno

42

47

import gnutls.crypto

45

50

import gnutls.library.functions

46

51

import gnutls.library.constants

47

52

import gnutls.library.types

48

import ConfigParser as configparser

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

49

57

import sys

50

58

import re

51

59

import os

60

68

import struct

61

69

import fcntl

62

70

import functools

63

import cPickle as pickle

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

64

75

import multiprocessing

76

import types

77

import binascii

78

import tempfile

79

import itertools

80

import collections

65

81

66

82

import dbus

67

83

import dbus.service

68

import gobject

84

try:

85

import gobject

86

except ImportError:

87

from gi.repository import GObject as gobject

69

88

import avahi

70

89

from dbus.mainloop.glib import DBusGMainLoop

71

90

import ctypes

81

100

except ImportError:

82

101

SO_BINDTODEVICE = None

83

102

84

85

version = "1.3.0"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

89

syslogger = (logging.handlers.SysLogHandler

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

address = str("/dev/log")))

92

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

95

logger.addHandler(syslogger)

96

97

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

101

logger.addHandler(console)

103

if sys.version_info.major == 2:

104

str = unicode

105

106

version = "1.6.9"

107

stored_state_file = "clients.pickle"

108

109

logger = logging.getLogger()

110

syslogger = None

111

112

try:

113

if_nametoindex = ctypes.cdll.LoadLibrary(

114

ctypes.util.find_library("c")).if_nametoindex

115

except (OSError, AttributeError):

116

117

def if_nametoindex(interface):

118

"Get an interface index the hard way, i.e. using fcntl()"

119

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

120

with contextlib.closing(socket.socket()) as s:

121

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

122

struct.pack(b"16s16x", interface))

123

interface_index = struct.unpack("I", ifreq[16:20])[0]

124

return interface_index

125

126

127

def initlogger(debug, level=logging.WARNING):

128

"""init logger and add loglevel"""

129

130

global syslogger

131

syslogger = (logging.handlers.SysLogHandler(

132

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

133

address = "/dev/log"))

134

syslogger.setFormatter(logging.Formatter

135

('Mandos [%(process)d]: %(levelname)s:'

136

' %(message)s'))

137

logger.addHandler(syslogger)

138

139

if debug:

140

console = logging.StreamHandler()

141

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

142

' [%(process)d]:'

143

' %(levelname)s:'

144

' %(message)s'))

145

logger.addHandler(console)

146

logger.setLevel(level)

147

148

149

class PGPError(Exception):

150

"""Exception if encryption/decryption fails"""

151

pass

152

153

154

class PGPEngine(object):

155

"""A simple class for OpenPGP symmetric encryption & decryption"""

156

157

def __init__(self):

158

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

159

self.gnupgargs = ['--batch',

160

'--home', self.tempdir,

161

'--force-mdc',

162

'--quiet',

163

'--no-use-agent']

164

165

def __enter__(self):

166

return self

167

168

def __exit__(self, exc_type, exc_value, traceback):

169

self._cleanup()

170

return False

171

172

def __del__(self):

173

self._cleanup()

174

175

def _cleanup(self):

176

if self.tempdir is not None:

177

# Delete contents of tempdir

178

for root, dirs, files in os.walk(self.tempdir,

179

topdown = False):

180

for filename in files:

181

os.remove(os.path.join(root, filename))

182

for dirname in dirs:

183

os.rmdir(os.path.join(root, dirname))

184

# Remove tempdir

185

os.rmdir(self.tempdir)

186

self.tempdir = None

187

188

def password_encode(self, password):

189

# Passphrase can not be empty and can not contain newlines or

190

# NUL bytes. So we prefix it and hex encode it.

191

encoded = b"mandos" + binascii.hexlify(password)

192

if len(encoded) > 2048:

193

# GnuPG can't handle long passwords, so encode differently

194

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

195

.replace(b"\n", b"\\n")

196

.replace(b"\0", b"\\x00"))

197

return encoded

198

199

def encrypt(self, data, password):

200

passphrase = self.password_encode(password)

201

with tempfile.NamedTemporaryFile(

202

dir=self.tempdir) as passfile:

203

passfile.write(passphrase)

204

passfile.flush()

205

proc = subprocess.Popen(['gpg', '--symmetric',

206

'--passphrase-file',

207

passfile.name]

208

+ self.gnupgargs,

209

stdin = subprocess.PIPE,

210

stdout = subprocess.PIPE,

211

stderr = subprocess.PIPE)

212

ciphertext, err = proc.communicate(input = data)

213

if proc.returncode != 0:

214

raise PGPError(err)

215

return ciphertext

216

217

def decrypt(self, data, password):

218

passphrase = self.password_encode(password)

219

with tempfile.NamedTemporaryFile(

220

dir = self.tempdir) as passfile:

221

passfile.write(passphrase)

222

passfile.flush()

223

proc = subprocess.Popen(['gpg', '--decrypt',

224

'--passphrase-file',

225

passfile.name]

226

+ self.gnupgargs,

227

stdin = subprocess.PIPE,

228

stdout = subprocess.PIPE,

229

stderr = subprocess.PIPE)

230

decrypted_plaintext, err = proc.communicate(input = data)

231

if proc.returncode != 0:

232

raise PGPError(err)

233

return decrypted_plaintext

234

102

235

103

236

class AvahiError(Exception):

104

237

def __init__(self, value, *args, **kwargs):

105

238

self.value = value

106

super(AvahiError, self).__init__(value, *args, **kwargs)

107

def __unicode__(self):

108

return unicode(repr(self.value))

239

return super(AvahiError, self).__init__(value, *args,

240

**kwargs)

241

109

242

110

243

class AvahiServiceError(AvahiError):

111

244

pass

112

245

246

113

247

class AvahiGroupError(AvahiError):

114

248

pass

115

249

122

256

Used to optionally bind to the specified interface.

123

257

name: string; Example: 'Mandos'

124

258

type: string; Example: '_mandos._tcp'.

125

See <http://www.dns-sd.org/ServiceTypes.html>

259

See <https://www.iana.org/assignments/service-names-port-numbers>

126

260

port: integer; what port to announce

127

261

TXT: list of strings; TXT record for the service

128

262

domain: string; Domain to publish on, default to .local if empty.

134

268

server: D-Bus Server

135

269

bus: dbus.SystemBus()

136

270

"""

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

138

servicetype = None, port = None, TXT = None,

139

domain = "", host = "", max_renames = 32768,

140

protocol = avahi.PROTO_UNSPEC, bus = None):

271

272

def __init__(self,

273

interface = avahi.IF_UNSPEC,

274

name = None,

275

servicetype = None,

276

port = None,

277

TXT = None,

278

domain = "",

279

host = "",

280

max_renames = 32768,

281

protocol = avahi.PROTO_UNSPEC,

282

bus = None):

141

283

self.interface = interface

142

284

self.name = name

143

285

self.type = servicetype

151

293

self.group = None # our entry group

152

294

self.server = None

153

295

self.bus = bus

154

def rename(self):

296

self.entry_group_state_changed_match = None

297

298

def rename(self, remove=True):

155

299

"""Derived from the Avahi example code"""

156

300

if self.rename_count >= self.max_renames:

157

301

logger.critical("No suitable Zeroconf service name found"

158

302

" after %i retries, exiting.",

159

303

self.rename_count)

160

304

raise AvahiServiceError("Too many renames")

161

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

305

self.name = str(

306

self.server.GetAlternativeServiceName(self.name))

307

self.rename_count += 1

162

308

logger.info("Changing Zeroconf service name to %r ...",

163

309

self.name)

164

syslogger.setFormatter(logging.Formatter

165

('Mandos (%s) [%%(process)d]:'

166

' %%(levelname)s: %%(message)s'

167

% self.name))

168

self.remove()

310

if remove:

311

self.remove()

169

312

try:

170

313

self.add()

171

except dbus.exceptions.DBusException, error:

172

logger.critical("DBusException: %s", error)

173

self.cleanup()

174

os._exit(1)

175

self.rename_count += 1

314

except dbus.exceptions.DBusException as error:

315

if (error.get_dbus_name()

316

== "org.freedesktop.Avahi.CollisionError"):

317

logger.info("Local Zeroconf service name collision.")

318

return self.rename(remove=False)

319

else:

320

logger.critical("D-Bus Exception", exc_info=error)

321

self.cleanup()

322

os._exit(1)

323

176

324

def remove(self):

177

325

"""Derived from the Avahi example code"""

326

if self.entry_group_state_changed_match is not None:

327

self.entry_group_state_changed_match.remove()

328

self.entry_group_state_changed_match = None

178

329

if self.group is not None:

179

330

self.group.Reset()

331

180

332

def add(self):

181

333

"""Derived from the Avahi example code"""

334

self.remove()

182

335

if self.group is None:

183

336

self.group = dbus.Interface(

184

337

self.bus.get_object(avahi.DBUS_NAME,

185

338

self.server.EntryGroupNew()),

186

339

avahi.DBUS_INTERFACE_ENTRY_GROUP)

187

self.group.connect_to_signal('StateChanged',

188

self

189

.entry_group_state_changed)

340

self.entry_group_state_changed_match = (

341

self.group.connect_to_signal(

342

'StateChanged', self.entry_group_state_changed))

190

343

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

191

344

self.name, self.type)

192

345

self.group.AddService(

198

351

dbus.UInt16(self.port),

199

352

avahi.string_array_to_txt_array(self.TXT))

200

353

self.group.Commit()

354

201

355

def entry_group_state_changed(self, state, error):

202

356

"""Derived from the Avahi example code"""

203

357

logger.debug("Avahi entry group state change: %i", state)

209

363

self.rename()

210

364

elif state == avahi.ENTRY_GROUP_FAILURE:

211

365

logger.critical("Avahi: Error in group state changed %s",

212

unicode(error))

213

raise AvahiGroupError("State changed: %s"

214

% unicode(error))

366

str(error))

367

raise AvahiGroupError("State changed: {!s}".format(error))

368

215

369

def cleanup(self):

216

370

"""Derived from the Avahi example code"""

217

371

if self.group is not None:

218

self.group.Free()

372

try:

373

self.group.Free()

374

except (dbus.exceptions.UnknownMethodException,

375

dbus.exceptions.DBusException):

376

pass

219

377

self.group = None

220

def server_state_changed(self, state):

378

self.remove()

379

380

def server_state_changed(self, state, error=None):

221

381

"""Derived from the Avahi example code"""

222

382

logger.debug("Avahi server state change: %i", state)

223

if state == avahi.SERVER_COLLISION:

224

logger.error("Zeroconf server name collision")

225

self.remove()

383

bad_states = {

384

avahi.SERVER_INVALID: "Zeroconf server invalid",

385

avahi.SERVER_REGISTERING: None,

386

avahi.SERVER_COLLISION: "Zeroconf server name collision",

387

avahi.SERVER_FAILURE: "Zeroconf server failure",

388

}

389

if state in bad_states:

390

if bad_states[state] is not None:

391

if error is None:

392

logger.error(bad_states[state])

393

else:

394

logger.error(bad_states[state] + ": %r", error)

395

self.cleanup()

226

396

elif state == avahi.SERVER_RUNNING:

227

397

self.add()

398

else:

399

if error is None:

400

logger.debug("Unknown state: %r", state)

401

else:

402

logger.debug("Unknown state: %r: %r", state, error)

403

228

404

def activate(self):

229

405

"""Derived from the Avahi example code"""

230

406

if self.server is None:

231

407

self.server = dbus.Interface(

232

408

self.bus.get_object(avahi.DBUS_NAME,

233

avahi.DBUS_PATH_SERVER),

409

avahi.DBUS_PATH_SERVER,

410

follow_name_owner_changes=True),

234

411

avahi.DBUS_INTERFACE_SERVER)

235

412

self.server.connect_to_signal("StateChanged",

236

self.server_state_changed)

413

self.server_state_changed)

237

414

self.server_state_changed(self.server.GetState())

238

415

239

416

417

class AvahiServiceToSyslog(AvahiService):

418

def rename(self, *args, **kwargs):

419

"""Add the new name to the syslog messages"""

420

ret = AvahiService.rename(self, *args, **kwargs)

421

syslogger.setFormatter(logging.Formatter(

422

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

423

.format(self.name)))

424

return ret

425

426

240

427

class Client(object):

241

428

"""A representation of a client host served by this server.

242

429

243

430

Attributes:

244

_approved: bool(); 'None' if not yet approved/disapproved

431

approved: bool(); 'None' if not yet approved/disapproved

245

432

approval_delay: datetime.timedelta(); Time to wait for approval

246

433

approval_duration: datetime.timedelta(); Duration of one approval

247

434

checker: subprocess.Popen(); a running checker process used

254

441

instance %(name)s can be used in the command.

255

442

checker_initiator_tag: a gobject event source tag, or None

256

443

created: datetime.datetime(); (UTC) object creation

444

client_structure: Object describing what attributes a client has

445

and is used for storing the client at exit

257

446

current_checker_command: string; current running checker_command

258

disable_hook: If set, called by disable() as disable_hook(self)

259

447

disable_initiator_tag: a gobject event source tag, or None

260

448

enabled: bool()

261

449

fingerprint: string (40 or 32 hexadecimal digits); used to

264

452

interval: datetime.timedelta(); How often to start a new checker

265

453

last_approval_request: datetime.datetime(); (UTC) or None

266

454

last_checked_ok: datetime.datetime(); (UTC) or None

267

last_enabled: datetime.datetime(); (UTC)

455

last_checker_status: integer between 0 and 255 reflecting exit

456

status of last checker. -1 reflects crashed

457

checker, -2 means no checker completed yet.

458

last_enabled: datetime.datetime(); (UTC) or None

268

459

name: string; from the config file, used in log messages and

269

460

D-Bus identifiers

270

461

secret: bytestring; sent verbatim (over TLS) to client

271

462

timeout: datetime.timedelta(); How long from last_checked_ok

272

463

until this client is disabled

464

extended_timeout: extra long timeout when secret has been sent

273

465

runtime_expansions: Allowed attributes for runtime expansion.

466

expires: datetime.datetime(); time (UTC) when a client will be

467

disabled, or None

468

server_settings: The server_settings dict from main()

274

469

"""

275

470

276

471

runtime_expansions = ("approval_delay", "approval_duration",

277

"created", "enabled", "fingerprint",

278

"host", "interval", "last_checked_ok",

472

"created", "enabled", "expires",

473

"fingerprint", "host", "interval",

474

"last_approval_request", "last_checked_ok",

279

475

"last_enabled", "name", "timeout")

476

client_defaults = {

477

"timeout": "PT5M",

478

"extended_timeout": "PT15M",

479

"interval": "PT2M",

480

"checker": "fping -q -- %%(host)s",

481

"host": "",

482

"approval_delay": "PT0S",

483

"approval_duration": "PT1S",

484

"approved_by_default": "True",

485

"enabled": "True",

486

}

280

487

281

488

@staticmethod

282

def _timedelta_to_milliseconds(td):

283

"Convert a datetime.timedelta() to milliseconds"

284

return ((td.days * 24 * 60 * 60 * 1000)

285

+ (td.seconds * 1000)

286

+ (td.microseconds // 1000))

287

288

def timeout_milliseconds(self):

289

"Return the 'timeout' attribute in milliseconds"

290

return self._timedelta_to_milliseconds(self.timeout)

291

292

def interval_milliseconds(self):

293

"Return the 'interval' attribute in milliseconds"

294

return self._timedelta_to_milliseconds(self.interval)

295

296

def approval_delay_milliseconds(self):

297

return self._timedelta_to_milliseconds(self.approval_delay)

298

299

def __init__(self, name = None, disable_hook=None, config=None):

300

"""Note: the 'checker' key in 'config' sets the

301

'checker_command' attribute and *not* the 'checker'

302

attribute."""

489

def config_parser(config):

490

"""Construct a new dict of client settings of this form:

491

{ client_name: {setting_name: value, ...}, ...}

492

with exceptions for any special settings as defined above.

493

NOTE: Must be a pure function. Must return the same result

494

value given the same arguments.

495

"""

496

settings = {}

497

for client_name in config.sections():

498

section = dict(config.items(client_name))

499

client = settings[client_name] = {}

500

501

client["host"] = section["host"]

502

# Reformat values from string types to Python types

503

client["approved_by_default"] = config.getboolean(

504

client_name, "approved_by_default")

505

client["enabled"] = config.getboolean(client_name,

506

"enabled")

507

508

# Uppercase and remove spaces from fingerprint for later

509

# comparison purposes with return value from the

510

# fingerprint() function

511

client["fingerprint"] = (section["fingerprint"].upper()

512

.replace(" ", ""))

513

if "secret" in section:

514

client["secret"] = section["secret"].decode("base64")

515

elif "secfile" in section:

516

with open(os.path.expanduser(os.path.expandvars

517

(section["secfile"])),

518

"rb") as secfile:

519

client["secret"] = secfile.read()

520

else:

521

raise TypeError("No secret or secfile for section {}"

522

.format(section))

523

client["timeout"] = string_to_delta(section["timeout"])

524

client["extended_timeout"] = string_to_delta(

525

section["extended_timeout"])

526

client["interval"] = string_to_delta(section["interval"])

527

client["approval_delay"] = string_to_delta(

528

section["approval_delay"])

529

client["approval_duration"] = string_to_delta(

530

section["approval_duration"])

531

client["checker_command"] = section["checker"]

532

client["last_approval_request"] = None

533

client["last_checked_ok"] = None

534

client["last_checker_status"] = -2

535

536

return settings

537

538

def __init__(self, settings, name = None, server_settings=None):

303

539

self.name = name

304

if config is None:

305

config = {}

540

if server_settings is None:

541

server_settings = {}

542

self.server_settings = server_settings

543

# adding all client settings

544

for setting, value in settings.items():

545

setattr(self, setting, value)

546

547

if self.enabled:

548

if not hasattr(self, "last_enabled"):

549

self.last_enabled = datetime.datetime.utcnow()

550

if not hasattr(self, "expires"):

551

self.expires = (datetime.datetime.utcnow()

552

+ self.timeout)

553

else:

554

self.last_enabled = None

555

self.expires = None

556

306

557

logger.debug("Creating client %r", self.name)

307

# Uppercase and remove spaces from fingerprint for later

308

# comparison purposes with return value from the fingerprint()

309

# function

310

self.fingerprint = (config["fingerprint"].upper()

311

.replace(" ", ""))

312

558

logger.debug(" Fingerprint: %s", self.fingerprint)

313

if "secret" in config:

314

self.secret = config["secret"].decode("base64")

315

elif "secfile" in config:

316

with open(os.path.expanduser(os.path.expandvars

317

(config["secfile"])),

318

"rb") as secfile:

319

self.secret = secfile.read()

320

else:

321

raise TypeError("No secret or secfile for client %s"

322

% self.name)

323

self.host = config.get("host", "")

324

self.created = datetime.datetime.utcnow()

325

self.enabled = False

326

self.last_approval_request = None

327

self.last_enabled = None

328

self.last_checked_ok = None

329

self.timeout = string_to_delta(config["timeout"])

330

self.interval = string_to_delta(config["interval"])

331

self.disable_hook = disable_hook

559

self.created = settings.get("created",

560

datetime.datetime.utcnow())

561

562

# attributes specific for this server instance

332

563

self.checker = None

333

564

self.checker_initiator_tag = None

334

565

self.disable_initiator_tag = None

335

566

self.checker_callback_tag = None

336

self.checker_command = config["checker"]

337

567

self.current_checker_command = None

338

self.last_connect = None

339

self._approved = None

340

self.approved_by_default = config.get("approved_by_default",

341

True)

568

self.approved = None

342

569

self.approvals_pending = 0

343

self.approval_delay = string_to_delta(

344

config["approval_delay"])

345

self.approval_duration = string_to_delta(

346

config["approval_duration"])

347

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

570

self.changedstate = multiprocessing_manager.Condition(

571

multiprocessing_manager.Lock())

572

self.client_structure = [attr

573

for attr in self.__dict__.iterkeys()

574

if not attr.startswith("_")]

575

self.client_structure.append("client_structure")

576

577

for name, t in inspect.getmembers(

578

type(self), lambda obj: isinstance(obj, property)):

579

if not name.startswith("_"):

580

self.client_structure.append(name)

348

581

582

# Send notice to process children that client state has changed

349

583

def send_changedstate(self):

350

self.changedstate.acquire()

351

self.changedstate.notify_all()

352

self.changedstate.release()

353

584

with self.changedstate:

585

self.changedstate.notify_all()

586

354

587

def enable(self):

355

588

"""Start this client's checker and timeout hooks"""

356

589

if getattr(self, "enabled", False):

357

590

# Already enabled

358

591

return

359

self.send_changedstate()

592

self.expires = datetime.datetime.utcnow() + self.timeout

593

self.enabled = True

360

594

self.last_enabled = datetime.datetime.utcnow()

361

# Schedule a new checker to be started an 'interval' from now,

362

# and every interval from then on.

363

self.checker_initiator_tag = (gobject.timeout_add

364

(self.interval_milliseconds(),

365

self.start_checker))

366

# Schedule a disable() when 'timeout' has passed

367

self.disable_initiator_tag = (gobject.timeout_add

368

(self.timeout_milliseconds(),

369

self.disable))

370

self.enabled = True

371

# Also start a new checker *right now*.

372

self.start_checker()

595

self.init_checker()

596

self.send_changedstate()

373

597

374

598

def disable(self, quiet=True):

375

599

"""Disable this client."""

376

600

if not getattr(self, "enabled", False):

377

601

return False

378

602

if not quiet:

379

self.send_changedstate()

380

if not quiet:

381

603

logger.info("Disabling client %s", self.name)

382

if getattr(self, "disable_initiator_tag", False):

604

if getattr(self, "disable_initiator_tag", None) is not None:

383

605

gobject.source_remove(self.disable_initiator_tag)

384

606

self.disable_initiator_tag = None

385

if getattr(self, "checker_initiator_tag", False):

607

self.expires = None

608

if getattr(self, "checker_initiator_tag", None) is not None:

386

609

gobject.source_remove(self.checker_initiator_tag)

387

610

self.checker_initiator_tag = None

388

611

self.stop_checker()

389

if self.disable_hook:

390

self.disable_hook(self)

391

612

self.enabled = False

613

if not quiet:

614

self.send_changedstate()

392

615

# Do not run this again if called by a gobject.timeout_add

393

616

return False

394

617

395

618

def __del__(self):

396

self.disable_hook = None

397

619

self.disable()

398

620

621

def init_checker(self):

622

# Schedule a new checker to be started an 'interval' from now,

623

# and every interval from then on.

624

if self.checker_initiator_tag is not None:

625

gobject.source_remove(self.checker_initiator_tag)

626

self.checker_initiator_tag = gobject.timeout_add(

627

int(self.interval.total_seconds() * 1000),

628

self.start_checker)

629

# Schedule a disable() when 'timeout' has passed

630

if self.disable_initiator_tag is not None:

631

gobject.source_remove(self.disable_initiator_tag)

632

self.disable_initiator_tag = gobject.timeout_add(

633

int(self.timeout.total_seconds() * 1000), self.disable)

634

# Also start a new checker *right now*.

635

self.start_checker()

636

399

637

def checker_callback(self, pid, condition, command):

400

638

"""The checker has completed, so take appropriate actions."""

401

639

self.checker_callback_tag = None

402

640

self.checker = None

403

641

if os.WIFEXITED(condition):

404

exitstatus = os.WEXITSTATUS(condition)

405

if exitstatus == 0:

642

self.last_checker_status = os.WEXITSTATUS(condition)

643

if self.last_checker_status == 0:

406

644

logger.info("Checker for %(name)s succeeded",

407

645

vars(self))

408

646

self.checked_ok()

409

647

else:

410

logger.info("Checker for %(name)s failed",

411

vars(self))

648

logger.info("Checker for %(name)s failed", vars(self))

412

649

else:

650

self.last_checker_status = -1

413

651

logger.warning("Checker for %(name)s crashed?",

414

652

vars(self))

415

653

416

654

def checked_ok(self):

417

"""Bump up the timeout for this client.

418

419

This should only be called when the client has been seen,

420

alive and well.

421

"""

655

"""Assert that the client has been seen, alive and well."""

422

656

self.last_checked_ok = datetime.datetime.utcnow()

423

gobject.source_remove(self.disable_initiator_tag)

424

self.disable_initiator_tag = (gobject.timeout_add

425

(self.timeout_milliseconds(),

426

self.disable))

657

self.last_checker_status = 0

658

self.bump_timeout()

659

660

def bump_timeout(self, timeout=None):

661

"""Bump up the timeout for this client."""

662

if timeout is None:

663

timeout = self.timeout

664

if self.disable_initiator_tag is not None:

665

gobject.source_remove(self.disable_initiator_tag)

666

self.disable_initiator_tag = None

667

if getattr(self, "enabled", False):

668

self.disable_initiator_tag = gobject.timeout_add(

669

int(timeout.total_seconds() * 1000), self.disable)

670

self.expires = datetime.datetime.utcnow() + timeout

427

671

428

672

def need_approval(self):

429

673

self.last_approval_request = datetime.datetime.utcnow()

434

678

If a checker already exists, leave it running and do

435

679

nothing."""

436

680

# The reason for not killing a running checker is that if we

437

# did that, then if a checker (for some reason) started

438

# running slowly and taking more than 'interval' time, the

439

# client would inevitably timeout, since no checker would get

440

# a chance to run to completion. If we instead leave running

681

# did that, and if a checker (for some reason) started running

682

# slowly and taking more than 'interval' time, then the client

683

# would inevitably timeout, since no checker would get a

684

# chance to run to completion. If we instead leave running

441

685

# checkers alone, the checker would have to take more time

442

686

# than 'timeout' for the client to be disabled, which is as it

443

687

# should be.

445

689

# If a checker exists, make sure it is not a zombie

446

690

try:

447

691

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

448

except (AttributeError, OSError), error:

449

if (isinstance(error, OSError)

450

and error.errno != errno.ECHILD):

451

raise error

692

except AttributeError:

693

pass

694

except OSError as error:

695

if error.errno != errno.ECHILD:

696

raise

452

697

else:

453

698

if pid:

454

699

logger.warning("Checker was a zombie")

457

702

self.current_checker_command)

458

703

# Start a new checker if needed

459

704

if self.checker is None:

705

# Escape attributes for the shell

706

escaped_attrs = {

707

attr: re.escape(str(getattr(self, attr)))

708

for attr in self.runtime_expansions }

460

709

try:

461

# In case checker_command has exactly one % operator

462

command = self.checker_command % self.host

463

except TypeError:

464

# Escape attributes for the shell

465

escaped_attrs = dict(

466

(attr,

467

re.escape(unicode(str(getattr(self, attr, "")),

468

errors=

469

'replace')))

470

for attr in

471

self.runtime_expansions)

472

473

try:

474

command = self.checker_command % escaped_attrs

475

except TypeError, error:

476

logger.error('Could not format string "%s":'

477

' %s', self.checker_command, error)

478

return True # Try again later

710

command = self.checker_command % escaped_attrs

711

except TypeError as error:

712

logger.error('Could not format string "%s"',

713

self.checker_command,

714

exc_info=error)

715

return True # Try again later

479

716

self.current_checker_command = command

480

717

try:

481

logger.info("Starting checker %r for %s",

482

command, self.name)

718

logger.info("Starting checker %r for %s", command,

719

self.name)

483

720

# We don't need to redirect stdout and stderr, since

484

721

# in normal mode, that is already done by daemon(),

485

722

# and in debug mode we don't want to. (Stdin is

486

723

# always replaced by /dev/null.)

724

# The exception is when not debugging but nevertheless

725

# running in the foreground; use the previously

726

# created wnull.

727

popen_args = {}

728

if (not self.server_settings["debug"]

729

and self.server_settings["foreground"]):

730

popen_args.update({"stdout": wnull,

731

"stderr": wnull })

487

732

self.checker = subprocess.Popen(command,

488

733

close_fds=True,

489

shell=True, cwd="/")

490

self.checker_callback_tag = (gobject.child_watch_add

491

(self.checker.pid,

492

self.checker_callback,

493

data=command))

494

# The checker may have completed before the gobject

495

# watch was added. Check for this.

734

shell=True,

735

cwd="/",

736

**popen_args)

737

except OSError as error:

738

logger.error("Failed to start subprocess",

739

exc_info=error)

740

return True

741

self.checker_callback_tag = gobject.child_watch_add(

742

self.checker.pid, self.checker_callback, data=command)

743

# The checker may have completed before the gobject

744

# watch was added. Check for this.

745

try:

496

746

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

497

if pid:

498

gobject.source_remove(self.checker_callback_tag)

499

self.checker_callback(pid, status, command)

500

except OSError, error:

501

logger.error("Failed to start subprocess: %s",

502

error)

747

except OSError as error:

748

if error.errno == errno.ECHILD:

749

# This should never happen

750

logger.error("Child process vanished",

751

exc_info=error)

752

return True

753

raise

754

if pid:

755

gobject.source_remove(self.checker_callback_tag)

756

self.checker_callback(pid, status, command)

503

757

# Re-run this periodically if run by gobject.timeout_add

504

758

return True

505

759

512

766

return

513

767

logger.debug("Stopping checker for %(name)s", vars(self))

514

768

try:

515

os.kill(self.checker.pid, signal.SIGTERM)

769

self.checker.terminate()

516

770

#time.sleep(0.5)

517

771

#if self.checker.poll() is None:

518

# os.kill(self.checker.pid, signal.SIGKILL)

519

except OSError, error:

772

# self.checker.kill()

773

except OSError as error:

520

774

if error.errno != errno.ESRCH: # No such process

521

775

raise

522

776

self.checker = None

523

777

524

def dbus_service_property(dbus_interface, signature="v",

525

access="readwrite", byte_arrays=False):

778

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

526

783

"""Decorators for marking methods of a DBusObjectWithProperties to

527

784

become properties on the D-Bus.

528

785

537

794

# "Set" method, so we fail early here:

538

795

if byte_arrays and signature != "ay":

539

796

raise ValueError("Byte arrays not supported for non-'ay'"

540

" signature %r" % signature)

797

" signature {!r}".format(signature))

798

541

799

def decorator(func):

542

800

func._dbus_is_property = True

543

801

func._dbus_interface = dbus_interface

548

806

func._dbus_name = func._dbus_name[:-14]

549

807

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

550

808

return func

809

810

return decorator

811

812

813

def dbus_interface_annotations(dbus_interface):

814

"""Decorator for marking functions returning interface annotations

815

816

Usage:

817

818

@dbus_interface_annotations("org.example.Interface")

819

def _foo(self): # Function name does not matter

820

return {"org.freedesktop.DBus.Deprecated": "true",

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

822

"false"}

823

"""

824

825

def decorator(func):

826

func._dbus_is_interface = True

827

func._dbus_interface = dbus_interface

828

func._dbus_name = dbus_interface

829

return func

830

831

return decorator

832

833

834

def dbus_annotations(annotations):

835

"""Decorator to annotate D-Bus methods, signals or properties

836

Usage:

837

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

841

@dbus_service_property("org.example.Interface", signature="b",

842

access="r")

843

def Property_dbus_property(self):

844

return dbus.Boolean(False)

845

"""

846

847

def decorator(func):

848

func._dbus_annotations = annotations

849

return func

850

551

851

return decorator

552

852

553

853

554

854

class DBusPropertyException(dbus.exceptions.DBusException):

555

855

"""A base class for D-Bus property-related exceptions

556

856

"""

557

def __unicode__(self):

558

return unicode(str(self))

857

pass

559

858

560

859

561

860

class DBusPropertyAccessException(DBusPropertyException):

572

871

573

872

class DBusObjectWithProperties(dbus.service.Object):

574

873

"""A D-Bus object with properties.

575

874

576

875

Classes inheriting from this can use the dbus_service_property

577

876

decorator to expose methods as D-Bus properties. It exposes the

578

877

standard Get(), Set(), and GetAll() methods on the D-Bus.

579

878

"""

580

879

581

880

@staticmethod

582

def _is_dbus_property(obj):

583

return getattr(obj, "_dbus_is_property", False)

881

def _is_dbus_thing(thing):

882

"""Returns a function testing if an attribute is a D-Bus thing

883

884

If called like _is_dbus_thing("method") it returns a function

885

suitable for use as predicate to inspect.getmembers().

886

"""

887

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

888

False)

584

889

585

def _get_all_dbus_properties(self):

890

def _get_all_dbus_things(self, thing):

586

891

"""Returns a generator of (name, attribute) pairs

587

892

"""

588

return ((prop._dbus_name, prop)

589

for name, prop in

590

inspect.getmembers(self, self._is_dbus_property))

893

return ((getattr(athing.__get__(self), "_dbus_name", name),

894

athing.__get__(self))

895

for cls in self.__class__.__mro__

896

for name, athing in

897

inspect.getmembers(cls, self._is_dbus_thing(thing)))

591

898

592

899

def _get_dbus_property(self, interface_name, property_name):

593

900

"""Returns a bound method if one exists which is a D-Bus

594

901

property with the specified name and interface.

595

902

"""

596

for name in (property_name,

597

property_name + "_dbus_property"):

598

prop = getattr(self, name, None)

599

if (prop is None

600

or not self._is_dbus_property(prop)

601

or prop._dbus_name != property_name

602

or (interface_name and prop._dbus_interface

603

and interface_name != prop._dbus_interface)):

604

continue

605

return prop

903

for cls in self.__class__.__mro__:

904

for name, value in inspect.getmembers(

905

cls, self._is_dbus_thing("property")):

906

if (value._dbus_name == property_name

907

and value._dbus_interface == interface_name):

908

return value.__get__(self)

909

606

910

# No such property

607

raise DBusPropertyNotFound(self.dbus_object_path + ":"

608

+ interface_name + "."

609

+ property_name)

911

raise DBusPropertyNotFound("{}:{}.{}".format(

912

self.dbus_object_path, interface_name, property_name))

610

913

611

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

914

@dbus.service.method(dbus.PROPERTIES_IFACE,

915

in_signature="ss",

612

916

out_signature="v")

613

917

def Get(self, interface_name, property_name):

614

918

"""Standard D-Bus property Get() method, see D-Bus standard.

632

936

# The byte_arrays option is not supported yet on

633

937

# signatures other than "ay".

634

938

if prop._dbus_signature != "ay":

635

raise ValueError

636

value = dbus.ByteArray(''.join(unichr(byte)

637

for byte in value))

939

raise ValueError("Byte arrays not supported for non-"

940

"'ay' signature {!r}"

941

.format(prop._dbus_signature))

942

value = dbus.ByteArray(b''.join(chr(byte)

943

for byte in value))

638

944

prop(value)

639

945

640

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

946

@dbus.service.method(dbus.PROPERTIES_IFACE,

947

in_signature="s",

641

948

out_signature="a{sv}")

642

949

def GetAll(self, interface_name):

643

950

"""Standard D-Bus property GetAll() method, see D-Bus

644

951

standard.

645

952

646

953

Note: Will not include properties with access="write".

647

954

"""

648

all = {}

649

for name, prop in self._get_all_dbus_properties():

955

properties = {}

956

for name, prop in self._get_all_dbus_things("property"):

650

957

if (interface_name

651

958

and interface_name != prop._dbus_interface):

652

959

# Interface non-empty but did not match

656

963

continue

657

964

value = prop()

658

965

if not hasattr(value, "variant_level"):

659

all[name] = value

966

properties[name] = value

660

967

continue

661

all[name] = type(value)(value, variant_level=

662

value.variant_level+1)

663

return dbus.Dictionary(all, signature="sv")

968

properties[name] = type(value)(

969

value, variant_level = value.variant_level + 1)

970

return dbus.Dictionary(properties, signature="sv")

971

972

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

973

def PropertiesChanged(self, interface_name, changed_properties,

974

invalidated_properties):

975

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

976

standard.

977

"""

978

pass

664

979

665

980

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

666

981

out_signature="s",

667

982

path_keyword='object_path',

668

983

connection_keyword='connection')

669

984

def Introspect(self, object_path, connection):

670

"""Standard D-Bus method, overloaded to insert property tags.

985

"""Overloading of standard D-Bus method.

986

987

Inserts property tags and interface annotation tags.

671

988

"""

672

989

xmlstring = dbus.service.Object.Introspect(self, object_path,

673

990

connection)

674

991

try:

675

992

document = xml.dom.minidom.parseString(xmlstring)

993

676

994

def make_tag(document, name, prop):

677

995

e = document.createElement("property")

678

996

e.setAttribute("name", name)

679

997

e.setAttribute("type", prop._dbus_signature)

680

998

e.setAttribute("access", prop._dbus_access)

681

999

return e

1000

682

1001

for if_tag in document.getElementsByTagName("interface"):

1002

# Add property tags

683

1003

for tag in (make_tag(document, name, prop)

684

1004

for name, prop

685

in self._get_all_dbus_properties()

1005

in self._get_all_dbus_things("property")

686

1006

if prop._dbus_interface

687

1007

== if_tag.getAttribute("name")):

688

1008

if_tag.appendChild(tag)

1009

# Add annotation tags

1010

for typ in ("method", "signal", "property"):

1011

for tag in if_tag.getElementsByTagName(typ):

1012

annots = dict()

1013

for name, prop in (self.

1014

_get_all_dbus_things(typ)):

1015

if (name == tag.getAttribute("name")

1016

and prop._dbus_interface

1017

== if_tag.getAttribute("name")):

1018

annots.update(getattr(

1019

prop, "_dbus_annotations", {}))

1020

for name, value in annots.items():

1021

ann_tag = document.createElement(

1022

"annotation")

1023

ann_tag.setAttribute("name", name)

1024

ann_tag.setAttribute("value", value)

1025

tag.appendChild(ann_tag)

1026

# Add interface annotation tags

1027

for annotation, value in dict(

1028

itertools.chain.from_iterable(

1029

annotations().items()

1030

for name, annotations

1031

in self._get_all_dbus_things("interface")

1032

if name == if_tag.getAttribute("name")

1033

)).items():

1034

ann_tag = document.createElement("annotation")

1035

ann_tag.setAttribute("name", annotation)

1036

ann_tag.setAttribute("value", value)

1037

if_tag.appendChild(ann_tag)

689

1038

# Add the names to the return values for the

690

1039

# "org.freedesktop.DBus.Properties" methods

691

1040

if (if_tag.getAttribute("name")

704

1053

xmlstring = document.toxml("utf-8")

705

1054

document.unlink()

706

1055

except (AttributeError, xml.dom.DOMException,

707

xml.parsers.expat.ExpatError), error:

1056

xml.parsers.expat.ExpatError) as error:

708

1057

logger.error("Failed to override Introspection method",

709

error)

1058

exc_info=error)

710

1059

return xmlstring

711

1060

712

1061

1062

def datetime_to_dbus(dt, variant_level=0):

1063

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1064

if dt is None:

1065

return dbus.String("", variant_level = variant_level)

1066

return dbus.String(dt.isoformat(), variant_level=variant_level)

1067

1068

1069

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1070

"""A class decorator; applied to a subclass of

1071

dbus.service.Object, it will add alternate D-Bus attributes with

1072

interface names according to the "alt_interface_names" mapping.

1073

Usage:

1074

1075

@alternate_dbus_interfaces({"org.example.Interface":

1076

"net.example.AlternateInterface"})

1077

class SampleDBusObject(dbus.service.Object):

1078

@dbus.service.method("org.example.Interface")

1079

def SampleDBusMethod():

1080

pass

1081

1082

The above "SampleDBusMethod" on "SampleDBusObject" will be

1083

reachable via two interfaces: "org.example.Interface" and

1084

"net.example.AlternateInterface", the latter of which will have

1085

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1086

"true", unless "deprecate" is passed with a False value.

1087

1088

This works for methods and signals, and also for D-Bus properties

1089

(from DBusObjectWithProperties) and interfaces (from the

1090

dbus_interface_annotations decorator).

1091

"""

1092

1093

def wrapper(cls):

1094

for orig_interface_name, alt_interface_name in (

1095

alt_interface_names.items()):

1096

attr = {}

1097

interface_names = set()

1098

# Go though all attributes of the class

1099

for attrname, attribute in inspect.getmembers(cls):

1100

# Ignore non-D-Bus attributes, and D-Bus attributes

1101

# with the wrong interface name

1102

if (not hasattr(attribute, "_dbus_interface")

1103

or not attribute._dbus_interface.startswith(

1104

orig_interface_name)):

1105

continue

1106

# Create an alternate D-Bus interface name based on

1107

# the current name

1108

alt_interface = attribute._dbus_interface.replace(

1109

orig_interface_name, alt_interface_name)

1110

interface_names.add(alt_interface)

1111

# Is this a D-Bus signal?

1112

if getattr(attribute, "_dbus_is_signal", False):

1113

# Extract the original non-method undecorated

1114

# function by black magic

1115

nonmethod_func = (dict(

1116

zip(attribute.func_code.co_freevars,

1117

attribute.__closure__))

1118

["func"].cell_contents)

1119

# Create a new, but exactly alike, function

1120

# object, and decorate it to be a new D-Bus signal

1121

# with the alternate D-Bus interface name

1122

new_function = (dbus.service.signal(

1123

alt_interface, attribute._dbus_signature)

1124

(types.FunctionType(

1125

nonmethod_func.func_code,

1126

nonmethod_func.func_globals,

1127

nonmethod_func.func_name,

1128

nonmethod_func.func_defaults,

1129

nonmethod_func.func_closure)))

1130

# Copy annotations, if any

1131

try:

1132

new_function._dbus_annotations = dict(

1133

attribute._dbus_annotations)

1134

except AttributeError:

1135

pass

1136

# Define a creator of a function to call both the

1137

# original and alternate functions, so both the

1138

# original and alternate signals gets sent when

1139

# the function is called

1140

def fixscope(func1, func2):

1141

"""This function is a scope container to pass

1142

func1 and func2 to the "call_both" function

1143

outside of its arguments"""

1144

1145

def call_both(*args, **kwargs):

1146

"""This function will emit two D-Bus

1147

signals by calling func1 and func2"""

1148

func1(*args, **kwargs)

1149

func2(*args, **kwargs)

1150

1151

return call_both

1152

# Create the "call_both" function and add it to

1153

# the class

1154

attr[attrname] = fixscope(attribute, new_function)

1155

# Is this a D-Bus method?

1156

elif getattr(attribute, "_dbus_is_method", False):

1157

# Create a new, but exactly alike, function

1158

# object. Decorate it to be a new D-Bus method

1159

# with the alternate D-Bus interface name. Add it

1160

# to the class.

1161

attr[attrname] = (

1162

dbus.service.method(

1163

alt_interface,

1164

attribute._dbus_in_signature,

1165

attribute._dbus_out_signature)

1166

(types.FunctionType(attribute.func_code,

1167

attribute.func_globals,

1168

attribute.func_name,

1169

attribute.func_defaults,

1170

attribute.func_closure)))

1171

# Copy annotations, if any

1172

try:

1173

attr[attrname]._dbus_annotations = dict(

1174

attribute._dbus_annotations)

1175

except AttributeError:

1176

pass

1177

# Is this a D-Bus property?

1178

elif getattr(attribute, "_dbus_is_property", False):

1179

# Create a new, but exactly alike, function

1180

# object, and decorate it to be a new D-Bus

1181

# property with the alternate D-Bus interface

1182

# name. Add it to the class.

1183

attr[attrname] = (dbus_service_property(

1184

alt_interface, attribute._dbus_signature,

1185

attribute._dbus_access,

1186

attribute._dbus_get_args_options

1187

["byte_arrays"])

1188

(types.FunctionType(

1189

attribute.func_code,

1190

attribute.func_globals,

1191

attribute.func_name,

1192

attribute.func_defaults,

1193

attribute.func_closure)))

1194

# Copy annotations, if any

1195

try:

1196

attr[attrname]._dbus_annotations = dict(

1197

attribute._dbus_annotations)

1198

except AttributeError:

1199

pass

1200

# Is this a D-Bus interface?

1201

elif getattr(attribute, "_dbus_is_interface", False):

1202

# Create a new, but exactly alike, function

1203

# object. Decorate it to be a new D-Bus interface

1204

# with the alternate D-Bus interface name. Add it

1205

# to the class.

1206

attr[attrname] = (

1207

dbus_interface_annotations(alt_interface)

1208

(types.FunctionType(attribute.func_code,

1209

attribute.func_globals,

1210

attribute.func_name,

1211

attribute.func_defaults,

1212

attribute.func_closure)))

1213

if deprecate:

1214

# Deprecate all alternate interfaces

1215

iname="_AlternateDBusNames_interface_annotation{}"

1216

for interface_name in interface_names:

1217

1218

@dbus_interface_annotations(interface_name)

1219

def func(self):

1220

return { "org.freedesktop.DBus.Deprecated":

1221

"true" }

1222

# Find an unused name

1223

for aname in (iname.format(i)

1224

for i in itertools.count()):

1225

if aname not in attr:

1226

attr[aname] = func

1227

break

1228

if interface_names:

1229

# Replace the class with a new subclass of it with

1230

# methods, signals, etc. as created above.

1231

cls = type(b"{}Alternate".format(cls.__name__),

1232

(cls, ), attr)

1233

return cls

1234

1235

return wrapper

1236

1237

1238

@alternate_dbus_interfaces({"se.recompile.Mandos":

1239

"se.bsnet.fukt.Mandos"})

713

1240

class ClientDBus(Client, DBusObjectWithProperties):

714

1241

"""A Client class using D-Bus

715

1242

719

1246

"""

720

1247

721

1248

runtime_expansions = (Client.runtime_expansions

722

+ ("dbus_object_path",))

1249

+ ("dbus_object_path", ))

1250

1251

_interface = "se.recompile.Mandos.Client"

723

1252

724

1253

# dbus.service.Object doesn't use super(), so we can't either.

725

1254

726

1255

def __init__(self, bus = None, *args, **kwargs):

727

self._approvals_pending = 0

728

1256

self.bus = bus

729

1257

Client.__init__(self, *args, **kwargs)

730

1258

# Only now, when this client is initialized, can it show up on

731

1259

# the D-Bus

732

client_object_name = unicode(self.name).translate(

1260

client_object_name = str(self.name).translate(

733

1261

{ord("."): ord("_"),

734

1262

ord("-"): ord("_")})

735

self.dbus_object_path = (dbus.ObjectPath

736

("/clients/" + client_object_name))

1263

self.dbus_object_path = dbus.ObjectPath(

1264

"/clients/" + client_object_name)

737

1265

DBusObjectWithProperties.__init__(self, self.bus,

738

1266

self.dbus_object_path)

739

740

def _get_approvals_pending(self):

741

return self._approvals_pending

742

def _set_approvals_pending(self, value):

743

old_value = self._approvals_pending

744

self._approvals_pending = value

745

bval = bool(value)

746

if (hasattr(self, "dbus_object_path")

747

and bval is not bool(old_value)):

748

dbus_bool = dbus.Boolean(bval, variant_level=1)

749

self.PropertyChanged(dbus.String("ApprovalPending"),

750

dbus_bool)

751

752

approvals_pending = property(_get_approvals_pending,

753

_set_approvals_pending)

754

del _get_approvals_pending, _set_approvals_pending

755

756

@staticmethod

757

def _datetime_to_dbus(dt, variant_level=0):

758

"""Convert a UTC datetime.datetime() to a D-Bus type."""

759

return dbus.String(dt.isoformat(),

760

variant_level=variant_level)

761

762

def enable(self):

763

oldstate = getattr(self, "enabled", False)

764

r = Client.enable(self)

765

if oldstate != self.enabled:

766

# Emit D-Bus signals

767

self.PropertyChanged(dbus.String("Enabled"),

768

dbus.Boolean(True, variant_level=1))

769

self.PropertyChanged(

770

dbus.String("LastEnabled"),

771

self._datetime_to_dbus(self.last_enabled,

772

variant_level=1))

773

return r

774

775

def disable(self, quiet = False):

776

oldstate = getattr(self, "enabled", False)

777

r = Client.disable(self, quiet=quiet)

778

if not quiet and oldstate != self.enabled:

779

# Emit D-Bus signal

780

self.PropertyChanged(dbus.String("Enabled"),

781

dbus.Boolean(False, variant_level=1))

782

return r

1267

1268

def notifychangeproperty(transform_func, dbus_name,

1269

type_func=lambda x: x,

1270

variant_level=1,

1271

invalidate_only=False,

1272

_interface=_interface):

1273

""" Modify a variable so that it's a property which announces

1274

its changes to DBus.

1275

1276

transform_fun: Function that takes a value and a variant_level

1277

and transforms it to a D-Bus type.

1278

dbus_name: D-Bus name of the variable

1279

type_func: Function that transform the value before sending it

1280

to the D-Bus. Default: no transform

1281

variant_level: D-Bus variant level. Default: 1

1282

"""

1283

attrname = "_{}".format(dbus_name)

1284

1285

def setter(self, value):

1286

if hasattr(self, "dbus_object_path"):

1287

if (not hasattr(self, attrname) or

1288

type_func(getattr(self, attrname, None))

1289

!= type_func(value)):

1290

if invalidate_only:

1291

self.PropertiesChanged(

1292

_interface, dbus.Dictionary(),

1293

dbus.Array((dbus_name, )))

1294

else:

1295

dbus_value = transform_func(

1296

type_func(value),

1297

variant_level = variant_level)

1298

self.PropertyChanged(dbus.String(dbus_name),

1299

dbus_value)

1300

self.PropertiesChanged(

1301

_interface,

1302

dbus.Dictionary({ dbus.String(dbus_name):

1303

dbus_value }),

1304

dbus.Array())

1305

setattr(self, attrname, value)

1306

1307

return property(lambda self: getattr(self, attrname), setter)

1308

1309

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1310

approvals_pending = notifychangeproperty(dbus.Boolean,

1311

"ApprovalPending",

1312

type_func = bool)

1313

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1314

last_enabled = notifychangeproperty(datetime_to_dbus,

1315

"LastEnabled")

1316

checker = notifychangeproperty(

1317

dbus.Boolean, "CheckerRunning",

1318

type_func = lambda checker: checker is not None)

1319

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1320

"LastCheckedOK")

1321

last_checker_status = notifychangeproperty(dbus.Int16,

1322

"LastCheckerStatus")

1323

last_approval_request = notifychangeproperty(

1324

datetime_to_dbus, "LastApprovalRequest")

1325

approved_by_default = notifychangeproperty(dbus.Boolean,

1326

"ApprovedByDefault")

1327

approval_delay = notifychangeproperty(

1328

dbus.UInt64, "ApprovalDelay",

1329

type_func = lambda td: td.total_seconds() * 1000)

1330

approval_duration = notifychangeproperty(

1331

dbus.UInt64, "ApprovalDuration",

1332

type_func = lambda td: td.total_seconds() * 1000)

1333

host = notifychangeproperty(dbus.String, "Host")

1334

timeout = notifychangeproperty(

1335

dbus.UInt64, "Timeout",

1336

type_func = lambda td: td.total_seconds() * 1000)

1337

extended_timeout = notifychangeproperty(

1338

dbus.UInt64, "ExtendedTimeout",

1339

type_func = lambda td: td.total_seconds() * 1000)

1340

interval = notifychangeproperty(

1341

dbus.UInt64, "Interval",

1342

type_func = lambda td: td.total_seconds() * 1000)

1343

checker_command = notifychangeproperty(dbus.String, "Checker")

1344

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1345

invalidate_only=True)

1346

1347

del notifychangeproperty

783

1348

784

1349

def __del__(self, *args, **kwargs):

785

1350

try:

794

1359

*args, **kwargs):

795

1360

self.checker_callback_tag = None

796

1361

self.checker = None

797

# Emit D-Bus signal

798

self.PropertyChanged(dbus.String("CheckerRunning"),

799

dbus.Boolean(False, variant_level=1))

800

1362

if os.WIFEXITED(condition):

801

1363

exitstatus = os.WEXITSTATUS(condition)

802

1364

# Emit D-Bus signal

812

1374

return Client.checker_callback(self, pid, condition, command,

813

1375

*args, **kwargs)

814

1376

815

def checked_ok(self, *args, **kwargs):

816

r = Client.checked_ok(self, *args, **kwargs)

817

# Emit D-Bus signal

818

self.PropertyChanged(

819

dbus.String("LastCheckedOK"),

820

(self._datetime_to_dbus(self.last_checked_ok,

821

variant_level=1)))

822

return r

823

824

def need_approval(self, *args, **kwargs):

825

r = Client.need_approval(self, *args, **kwargs)

826

# Emit D-Bus signal

827

self.PropertyChanged(

828

dbus.String("LastApprovalRequest"),

829

(self._datetime_to_dbus(self.last_approval_request,

830

variant_level=1)))

831

return r

832

833

1377

def start_checker(self, *args, **kwargs):

834

old_checker = self.checker

835

if self.checker is not None:

836

old_checker_pid = self.checker.pid

837

else:

838

old_checker_pid = None

1378

old_checker_pid = getattr(self.checker, "pid", None)

839

1379

r = Client.start_checker(self, *args, **kwargs)

840

1380

# Only if new checker process was started

841

1381

if (self.checker is not None

842

1382

and old_checker_pid != self.checker.pid):

843

1383

# Emit D-Bus signal

844

1384

self.CheckerStarted(self.current_checker_command)

845

self.PropertyChanged(

846

dbus.String("CheckerRunning"),

847

dbus.Boolean(True, variant_level=1))

848

1385

return r

849

1386

850

def stop_checker(self, *args, **kwargs):

851

old_checker = getattr(self, "checker", None)

852

r = Client.stop_checker(self, *args, **kwargs)

853

if (old_checker is not None

854

and getattr(self, "checker", None) is None):

855

self.PropertyChanged(dbus.String("CheckerRunning"),

856

dbus.Boolean(False, variant_level=1))

857

return r

858

859

1387

def _reset_approved(self):

860

self._approved = None

1388

self.approved = None

861

1389

return False

862

1390

863

1391

def approve(self, value=True):

1392

self.approved = value

1393

gobject.timeout_add(int(self.approval_duration.total_seconds()

1394

* 1000), self._reset_approved)

864

1395

self.send_changedstate()

865

self._approved = value

866

gobject.timeout_add(self._timedelta_to_milliseconds

867

(self.approval_duration),

868

self._reset_approved)

869

870

1396

871

1397

## D-Bus methods, signals & properties

872

_interface = "se.bsnet.fukt.Mandos.Client"

1398

1399

## Interfaces

873

1400

874

1401

## Signals

875

1402

886

1413

pass

887

1414

888

1415

# PropertyChanged - signal

1416

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

889

1417

@dbus.service.signal(_interface, signature="sv")

890

1418

def PropertyChanged(self, property, value):

891

1419

"D-Bus signal"

922

1450

# CheckedOK - method

923

1451

@dbus.service.method(_interface)

924

1452

def CheckedOK(self):

925

return self.checked_ok()

1453

self.checked_ok()

926

1454

927

1455

# Enable - method

928

1456

@dbus.service.method(_interface)

955

1483

return dbus.Boolean(bool(self.approvals_pending))

956

1484

957

1485

# ApprovedByDefault - property

958

@dbus_service_property(_interface, signature="b",

1486

@dbus_service_property(_interface,

1487

signature="b",

959

1488

access="readwrite")

960

1489

def ApprovedByDefault_dbus_property(self, value=None):

961

1490

if value is None: # get

962

1491

return dbus.Boolean(self.approved_by_default)

963

1492

self.approved_by_default = bool(value)

964

# Emit D-Bus signal

965

self.PropertyChanged(dbus.String("ApprovedByDefault"),

966

dbus.Boolean(value, variant_level=1))

967

1493

968

1494

# ApprovalDelay - property

969

@dbus_service_property(_interface, signature="t",

1495

@dbus_service_property(_interface,

1496

signature="t",

970

1497

access="readwrite")

971

1498

def ApprovalDelay_dbus_property(self, value=None):

972

1499

if value is None: # get

973

return dbus.UInt64(self.approval_delay_milliseconds())

1500

return dbus.UInt64(self.approval_delay.total_seconds()

1501

* 1000)

974

1502

self.approval_delay = datetime.timedelta(0, 0, 0, value)

975

# Emit D-Bus signal

976

self.PropertyChanged(dbus.String("ApprovalDelay"),

977

dbus.UInt64(value, variant_level=1))

978

1503

979

1504

# ApprovalDuration - property

980

@dbus_service_property(_interface, signature="t",

1505

@dbus_service_property(_interface,

1506

signature="t",

981

1507

access="readwrite")

982

1508

def ApprovalDuration_dbus_property(self, value=None):

983

1509

if value is None: # get

984

return dbus.UInt64(self._timedelta_to_milliseconds(

985

self.approval_duration))

1510

return dbus.UInt64(self.approval_duration.total_seconds()

1511

* 1000)

986

1512

self.approval_duration = datetime.timedelta(0, 0, 0, value)

987

# Emit D-Bus signal

988

self.PropertyChanged(dbus.String("ApprovalDuration"),

989

dbus.UInt64(value, variant_level=1))

990

1513

991

1514

# Name - property

992

1515

@dbus_service_property(_interface, signature="s", access="read")

999

1522

return dbus.String(self.fingerprint)

1000

1523

1001

1524

# Host - property

1002

@dbus_service_property(_interface, signature="s",

1525

@dbus_service_property(_interface,

1526

signature="s",

1003

1527

access="readwrite")

1004

1528

def Host_dbus_property(self, value=None):

1005

1529

if value is None: # get

1006

1530

return dbus.String(self.host)

1007

self.host = value

1008

# Emit D-Bus signal

1009

self.PropertyChanged(dbus.String("Host"),

1010

dbus.String(value, variant_level=1))

1531

self.host = str(value)

1011

1532

1012

1533

# Created - property

1013

1534

@dbus_service_property(_interface, signature="s", access="read")

1014

1535

def Created_dbus_property(self):

1015

return dbus.String(self._datetime_to_dbus(self.created))

1536

return datetime_to_dbus(self.created)

1016

1537

1017

1538

# LastEnabled - property

1018

1539

@dbus_service_property(_interface, signature="s", access="read")

1019

1540

def LastEnabled_dbus_property(self):

1020

if self.last_enabled is None:

1021

return dbus.String("")

1022

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1541

return datetime_to_dbus(self.last_enabled)

1023

1542

1024

1543

# Enabled - property

1025

@dbus_service_property(_interface, signature="b",

1544

@dbus_service_property(_interface,

1545

signature="b",

1026

1546

access="readwrite")

1027

1547

def Enabled_dbus_property(self, value=None):

1028

1548

if value is None: # get

1033

1553

self.disable()

1034

1554

1035

1555

# LastCheckedOK - property

1036

@dbus_service_property(_interface, signature="s",

1556

@dbus_service_property(_interface,

1557

signature="s",

1037

1558

access="readwrite")

1038

1559

def LastCheckedOK_dbus_property(self, value=None):

1039

1560

if value is not None:

1040

1561

self.checked_ok()

1041

1562

return

1042

if self.last_checked_ok is None:

1043

return dbus.String("")

1044

return dbus.String(self._datetime_to_dbus(self

1045

.last_checked_ok))

1563

return datetime_to_dbus(self.last_checked_ok)

1564

1565

# LastCheckerStatus - property

1566

@dbus_service_property(_interface, signature="n", access="read")

1567

def LastCheckerStatus_dbus_property(self):

1568

return dbus.Int16(self.last_checker_status)

1569

1570

# Expires - property

1571

@dbus_service_property(_interface, signature="s", access="read")

1572

def Expires_dbus_property(self):

1573

return datetime_to_dbus(self.expires)

1046

1574

1047

1575

# LastApprovalRequest - property

1048

1576

@dbus_service_property(_interface, signature="s", access="read")

1049

1577

def LastApprovalRequest_dbus_property(self):

1050

if self.last_approval_request is None:

1051

return dbus.String("")

1052

return dbus.String(self.

1053

_datetime_to_dbus(self

1054

.last_approval_request))

1578

return datetime_to_dbus(self.last_approval_request)

1055

1579

1056

1580

# Timeout - property

1057

@dbus_service_property(_interface, signature="t",

1581

@dbus_service_property(_interface,

1582

signature="t",

1058

1583

access="readwrite")

1059

1584

def Timeout_dbus_property(self, value=None):

1060

1585

if value is None: # get

1061

return dbus.UInt64(self.timeout_milliseconds())

1586

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1587

old_timeout = self.timeout

1062

1588

self.timeout = datetime.timedelta(0, 0, 0, value)

1063

# Emit D-Bus signal

1064

self.PropertyChanged(dbus.String("Timeout"),

1065

dbus.UInt64(value, variant_level=1))

1066

if getattr(self, "disable_initiator_tag", None) is None:

1067

return

1068

# Reschedule timeout

1069

gobject.source_remove(self.disable_initiator_tag)

1070

self.disable_initiator_tag = None

1071

time_to_die = (self.

1072

_timedelta_to_milliseconds((self

1073

.last_checked_ok

1074

+ self.timeout)

1075

- datetime.datetime

1076

.utcnow()))

1077

if time_to_die <= 0:

1078

# The timeout has passed

1079

self.disable()

1080

else:

1081

self.disable_initiator_tag = (gobject.timeout_add

1082

(time_to_die, self.disable))

1589

# Reschedule disabling

1590

if self.enabled:

1591

now = datetime.datetime.utcnow()

1592

self.expires += self.timeout - old_timeout

1593

if self.expires <= now:

1594

# The timeout has passed

1595

self.disable()

1596

else:

1597

if (getattr(self, "disable_initiator_tag", None)

1598

is None):

1599

return

1600

gobject.source_remove(self.disable_initiator_tag)

1601

self.disable_initiator_tag = gobject.timeout_add(

1602

int((self.expires - now).total_seconds() * 1000),

1603

self.disable)

1604

1605

# ExtendedTimeout - property

1606

@dbus_service_property(_interface,

1607

signature="t",

1608

access="readwrite")

1609

def ExtendedTimeout_dbus_property(self, value=None):

1610

if value is None: # get

1611

return dbus.UInt64(self.extended_timeout.total_seconds()

1612

* 1000)

1613

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1083

1614

1084

1615

# Interval - property

1085

@dbus_service_property(_interface, signature="t",

1616

@dbus_service_property(_interface,

1617

signature="t",

1086

1618

access="readwrite")

1087

1619

def Interval_dbus_property(self, value=None):

1088

1620

if value is None: # get

1089

return dbus.UInt64(self.interval_milliseconds())

1621

return dbus.UInt64(self.interval.total_seconds() * 1000)

1090

1622

self.interval = datetime.timedelta(0, 0, 0, value)

1091

# Emit D-Bus signal

1092

self.PropertyChanged(dbus.String("Interval"),

1093

dbus.UInt64(value, variant_level=1))

1094

1623

if getattr(self, "checker_initiator_tag", None) is None:

1095

1624

return

1096

# Reschedule checker run

1097

gobject.source_remove(self.checker_initiator_tag)

1098

self.checker_initiator_tag = (gobject.timeout_add

1099

(value, self.start_checker))

1100

self.start_checker() # Start one now, too

1101

1625

if self.enabled:

1626

# Reschedule checker run

1627

gobject.source_remove(self.checker_initiator_tag)

1628

self.checker_initiator_tag = gobject.timeout_add(

1629

value, self.start_checker)

1630

self.start_checker() # Start one now, too

1631

1102

1632

# Checker - property

1103

@dbus_service_property(_interface, signature="s",

1633

@dbus_service_property(_interface,

1634

signature="s",

1104

1635

access="readwrite")

1105

1636

def Checker_dbus_property(self, value=None):

1106

1637

if value is None: # get

1107

1638

return dbus.String(self.checker_command)

1108

self.checker_command = value

1109

# Emit D-Bus signal

1110

self.PropertyChanged(dbus.String("Checker"),

1111

dbus.String(self.checker_command,

1112

variant_level=1))

1639

self.checker_command = str(value)

1113

1640

1114

1641

# CheckerRunning - property

1115

@dbus_service_property(_interface, signature="b",

1642

@dbus_service_property(_interface,

1643

signature="b",

1116

1644

access="readwrite")

1117

1645

def CheckerRunning_dbus_property(self, value=None):

1118

1646

if value is None: # get

1128

1656

return self.dbus_object_path # is already a dbus.ObjectPath

1129

1657

1130

1658

# Secret = property

1131

@dbus_service_property(_interface, signature="ay",

1132

access="write", byte_arrays=True)

1659

@dbus_service_property(_interface,

1660

signature="ay",

1661

access="write",

1662

byte_arrays=True)

1133

1663

def Secret_dbus_property(self, value):

1134

self.secret = str(value)

1664

self.secret = bytes(value)

1135

1665

1136

1666

del _interface

1137

1667

1142

1672

self._pipe.send(('init', fpr, address))

1143

1673

if not self._pipe.recv():

1144

1674

raise KeyError()

1145

1675

1146

1676

def __getattribute__(self, name):

1147

if(name == '_pipe'):

1677

if name == '_pipe':

1148

1678

return super(ProxyClient, self).__getattribute__(name)

1149

1679

self._pipe.send(('getattr', name))

1150

1680

data = self._pipe.recv()

1151

1681

if data[0] == 'data':

1152

1682

return data[1]

1153

1683

if data[0] == 'function':

1684

1154

1685

def func(*args, **kwargs):

1155

1686

self._pipe.send(('funcall', name, args, kwargs))

1156

1687

return self._pipe.recv()[1]

1688

1157

1689

return func

1158

1690

1159

1691

def __setattr__(self, name, value):

1160

if(name == '_pipe'):

1692

if name == '_pipe':

1161

1693

return super(ProxyClient, self).__setattr__(name, value)

1162

1694

self._pipe.send(('setattr', name, value))

1163

1695

1171

1703

def handle(self):

1172

1704

with contextlib.closing(self.server.child_pipe) as child_pipe:

1173

1705

logger.info("TCP connection from: %s",

1174

unicode(self.client_address))

1706

str(self.client_address))

1175

1707

logger.debug("Pipe FD: %d",

1176

1708

self.server.child_pipe.fileno())

1177

1178

session = (gnutls.connection

1179

.ClientSession(self.request,

1180

gnutls.connection

1181

.X509Credentials()))

1182

1709

1710

session = gnutls.connection.ClientSession(

1711

self.request, gnutls.connection .X509Credentials())

1712

1183

1713

# Note: gnutls.connection.X509Credentials is really a

1184

1714

# generic GnuTLS certificate credentials object so long as

1185

1715

# no X.509 keys are added to it. Therefore, we can use it

1186

1716

# here despite using OpenPGP certificates.

1187

1717

1188

1718

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1189

1719

# "+AES-256-CBC", "+SHA1",

1190

1720

# "+COMP-NULL", "+CTYPE-OPENPGP",

1193

1723

priority = self.server.gnutls_priority

1194

1724

if priority is None:

1195

1725

priority = "NORMAL"

1196

(gnutls.library.functions

1197

.gnutls_priority_set_direct(session._c_object,

1198

priority, None))

1199

1726

gnutls.library.functions.gnutls_priority_set_direct(

1727

session._c_object, priority, None)

1728

1200

1729

# Start communication using the Mandos protocol

1201

1730

# Get protocol number

1202

1731

line = self.request.makefile().readline()

1203

1732

logger.debug("Protocol version: %r", line)

1204

1733

try:

1205

1734

if int(line.strip().split()[0]) > 1:

1206

raise RuntimeError

1207

except (ValueError, IndexError, RuntimeError), error:

1735

raise RuntimeError(line)

1736

except (ValueError, IndexError, RuntimeError) as error:

1208

1737

logger.error("Unknown protocol version: %s", error)

1209

1738

return

1210

1739

1211

1740

# Start GnuTLS connection

1212

1741

try:

1213

1742

session.handshake()

1214

except gnutls.errors.GNUTLSError, error:

1743

except gnutls.errors.GNUTLSError as error:

1215

1744

logger.warning("Handshake failed: %s", error)

1216

1745

# Do not run session.bye() here: the session is not

1217

1746

# established. Just abandon the request.

1218

1747

return

1219

1748

logger.debug("Handshake succeeded")

1220

1749

1221

1750

approval_required = False

1222

1751

try:

1223

1752

try:

1224

fpr = self.fingerprint(self.peer_certificate

1225

(session))

1226

except (TypeError, gnutls.errors.GNUTLSError), error:

1753

fpr = self.fingerprint(

1754

self.peer_certificate(session))

1755

except (TypeError,

1756

gnutls.errors.GNUTLSError) as error:

1227

1757

logger.warning("Bad certificate: %s", error)

1228

1758

return

1229

1759

logger.debug("Fingerprint: %s", fpr)

1230

1760

1231

1761

try:

1232

1762

client = ProxyClient(child_pipe, fpr,

1233

1763

self.client_address)

1241

1771

1242

1772

while True:

1243

1773

if not client.enabled:

1244

logger.warning("Client %s is disabled",

1245

client.name)

1774

logger.info("Client %s is disabled",

1775

client.name)

1246

1776

if self.server.use_dbus:

1247

1777

# Emit D-Bus signal

1248

client.Rejected("Disabled")

1778

client.Rejected("Disabled")

1249

1779

return

1250

1780

1251

if client._approved or not client.approval_delay:

1781

if client.approved or not client.approval_delay:

1252

1782

#We are approved or approval is disabled

1253

1783

break

1254

elif client._approved is None:

1784

elif client.approved is None:

1255

1785

logger.info("Client %s needs approval",

1256

1786

client.name)

1257

1787

if self.server.use_dbus:

1258

1788

# Emit D-Bus signal

1259

1789

client.NeedApproval(

1260

client.approval_delay_milliseconds(),

1261

client.approved_by_default)

1790

client.approval_delay.total_seconds()

1791

* 1000, client.approved_by_default)

1262

1792

else:

1263

1793

logger.warning("Client %s was not approved",

1264

1794

client.name)

1268

1798

return

1269

1799

1270

1800

#wait until timeout or approved

1271

#x = float(client._timedelta_to_milliseconds(delay))

1272

1801

time = datetime.datetime.now()

1273

1802

client.changedstate.acquire()

1274

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1803

client.changedstate.wait(delay.total_seconds())

1275

1804

client.changedstate.release()

1276

1805

time2 = datetime.datetime.now()

1277

1806

if (time2 - time) >= delay:

1292

1821

while sent_size < len(client.secret):

1293

1822

try:

1294

1823

sent = session.send(client.secret[sent_size:])

1295

except (gnutls.errors.GNUTLSError), error:

1296

logger.warning("gnutls send failed")

1824

except gnutls.errors.GNUTLSError as error:

1825

logger.warning("gnutls send failed",

1826

exc_info=error)

1297

1827

return

1298

logger.debug("Sent: %d, remaining: %d",

1299

sent, len(client.secret)

1300

- (sent_size + sent))

1828

logger.debug("Sent: %d, remaining: %d", sent,

1829

len(client.secret) - (sent_size

1830

+ sent))

1301

1831

sent_size += sent

1302

1832

1303

1833

logger.info("Sending secret to %s", client.name)

1304

# bump the timeout as if seen

1305

client.checked_ok()

1834

# bump the timeout using extended_timeout

1835

client.bump_timeout(client.extended_timeout)

1306

1836

if self.server.use_dbus:

1307

1837

# Emit D-Bus signal

1308

1838

client.GotSecret()

1312

1842

client.approvals_pending -= 1

1313

1843

try:

1314

1844

session.bye()

1315

except (gnutls.errors.GNUTLSError), error:

1316

logger.warning("GnuTLS bye failed")

1845

except gnutls.errors.GNUTLSError as error:

1846

logger.warning("GnuTLS bye failed",

1847

exc_info=error)

1317

1848

1318

1849

@staticmethod

1319

1850

def peer_certificate(session):

1320

1851

"Return the peer's OpenPGP certificate as a bytestring"

1321

1852

# If not an OpenPGP certificate...

1322

if (gnutls.library.functions

1323

.gnutls_certificate_type_get(session._c_object)

1853

if (gnutls.library.functions.gnutls_certificate_type_get(

1854

session._c_object)

1324

1855

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1325

1856

# ...do the normal thing

1326

1857

return session.peer_certificate

1340

1871

def fingerprint(openpgp):

1341

1872

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1342

1873

# New GnuTLS "datum" with the OpenPGP public key

1343

datum = (gnutls.library.types

1344

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1345

ctypes.POINTER

1346

(ctypes.c_ubyte)),

1347

ctypes.c_uint(len(openpgp))))

1874

datum = gnutls.library.types.gnutls_datum_t(

1875

ctypes.cast(ctypes.c_char_p(openpgp),

1876

ctypes.POINTER(ctypes.c_ubyte)),

1877

ctypes.c_uint(len(openpgp)))

1348

1878

# New empty GnuTLS certificate

1349

1879

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1350

(gnutls.library.functions

1351

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1880

gnutls.library.functions.gnutls_openpgp_crt_init(

1881

ctypes.byref(crt))

1352

1882

# Import the OpenPGP public key into the certificate

1353

(gnutls.library.functions

1354

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1355

gnutls.library.constants

1356

.GNUTLS_OPENPGP_FMT_RAW))

1883

gnutls.library.functions.gnutls_openpgp_crt_import(

1884

crt, ctypes.byref(datum),

1885

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1357

1886

# Verify the self signature in the key

1358

1887

crtverify = ctypes.c_uint()

1359

(gnutls.library.functions

1360

.gnutls_openpgp_crt_verify_self(crt, 0,

1361

ctypes.byref(crtverify)))

1888

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1889

crt, 0, ctypes.byref(crtverify))

1362

1890

if crtverify.value != 0:

1363

1891

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1364

raise (gnutls.errors.CertificateSecurityError

1365

("Verify failed"))

1892

raise gnutls.errors.CertificateSecurityError(

1893

"Verify failed")

1366

1894

# New buffer for the fingerprint

1367

1895

buf = ctypes.create_string_buffer(20)

1368

1896

buf_len = ctypes.c_size_t()

1369

1897

# Get the fingerprint from the certificate into the buffer

1370

(gnutls.library.functions

1371

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1372

ctypes.byref(buf_len)))

1898

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1899

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1373

1900

# Deinit the certificate

1374

1901

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1375

1902

# Convert the buffer to a Python bytestring

1376

1903

fpr = ctypes.string_at(buf, buf_len.value)

1377

1904

# Convert the bytestring to hexadecimal notation

1378

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1905

hex_fpr = binascii.hexlify(fpr).upper()

1379

1906

return hex_fpr

1380

1907

1381

1908

1382

1909

class MultiprocessingMixIn(object):

1383

1910

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1911

1384

1912

def sub_process_main(self, request, address):

1385

1913

try:

1386

1914

self.finish_request(request, address)

1387

except:

1915

except Exception:

1388

1916

self.handle_error(request, address)

1389

1917

self.close_request(request)

1390

1918

1391

1919

def process_request(self, request, address):

1392

1920

"""Start a new process to process the request."""

1393

multiprocessing.Process(target = self.sub_process_main,

1394

args = (request, address)).start()

1921

proc = multiprocessing.Process(target = self.sub_process_main,

1922

args = (request, address))

1923

proc.start()

1924

return proc

1925

1395

1926

1396

1927

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1397

1928

""" adds a pipe to the MixIn """

1929

1398

1930

def process_request(self, request, client_address):

1399

1931

"""Overrides and wraps the original process_request().

1400

1932

1401

1933

This function creates a new pipe in self.pipe

1402

1934

"""

1403

1935

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1404

1405

super(MultiprocessingMixInWithPipe,

1406

self).process_request(request, client_address)

1936

1937

proc = MultiprocessingMixIn.process_request(self, request,

1938

client_address)

1407

1939

self.child_pipe.close()

1408

self.add_pipe(parent_pipe)

1409

1410

def add_pipe(self, parent_pipe):

1940

self.add_pipe(parent_pipe, proc)

1941

1942

def add_pipe(self, parent_pipe, proc):

1411

1943

"""Dummy function; override as necessary"""

1412

raise NotImplementedError

1944

raise NotImplementedError()

1945

1413

1946

1414

1947

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1415

1948

socketserver.TCPServer, object):

1420

1953

interface: None or a network interface name (string)

1421

1954

use_ipv6: Boolean; to use IPv6 or not

1422

1955

"""

1956

1423

1957

def __init__(self, server_address, RequestHandlerClass,

1424

interface=None, use_ipv6=True):

1958

interface=None,

1959

use_ipv6=True,

1960

socketfd=None):

1961

"""If socketfd is set, use that file descriptor instead of

1962

creating a new one with socket.socket().

1963

"""

1425

1964

self.interface = interface

1426

1965

if use_ipv6:

1427

1966

self.address_family = socket.AF_INET6

1967

if socketfd is not None:

1968

# Save the file descriptor

1969

self.socketfd = socketfd

1970

# Save the original socket.socket() function

1971

self.socket_socket = socket.socket

1972

# To implement --socket, we monkey patch socket.socket.

1973

#

1974

# (When socketserver.TCPServer is a new-style class, we

1975

# could make self.socket into a property instead of monkey

1976

# patching socket.socket.)

1977

#

1978

# Create a one-time-only replacement for socket.socket()

1979

@functools.wraps(socket.socket)

1980

def socket_wrapper(*args, **kwargs):

1981

# Restore original function so subsequent calls are

1982

# not affected.

1983

socket.socket = self.socket_socket

1984

del self.socket_socket

1985

# This time only, return a new socket object from the

1986

# saved file descriptor.

1987

return socket.fromfd(self.socketfd, *args, **kwargs)

1988

# Replace socket.socket() function with wrapper

1989

socket.socket = socket_wrapper

1990

# The socketserver.TCPServer.__init__ will call

1991

# socket.socket(), which might be our replacement,

1992

# socket_wrapper(), if socketfd was set.

1428

1993

socketserver.TCPServer.__init__(self, server_address,

1429

1994

RequestHandlerClass)

1995

1430

1996

def server_bind(self):

1431

1997

"""This overrides the normal server_bind() function

1432

1998

to bind to an interface if one was specified, and also NOT to

1438

2004

self.interface)

1439

2005

else:

1440

2006

try:

1441

self.socket.setsockopt(socket.SOL_SOCKET,

1442

SO_BINDTODEVICE,

1443

str(self.interface

1444

+ '\0'))

1445

except socket.error, error:

1446

if error[0] == errno.EPERM:

1447

logger.error("No permission to"

1448

" bind to interface %s",

1449

self.interface)

1450

elif error[0] == errno.ENOPROTOOPT:

2007

self.socket.setsockopt(

2008

socket.SOL_SOCKET, SO_BINDTODEVICE,

2009

(self.interface + "\0").encode("utf-8"))

2010

except socket.error as error:

2011

if error.errno == errno.EPERM:

2012

logger.error("No permission to bind to"

2013

" interface %s", self.interface)

2014

elif error.errno == errno.ENOPROTOOPT:

1451

2015

logger.error("SO_BINDTODEVICE not available;"

1452

2016

" cannot bind to interface %s",

1453

2017

self.interface)

2018

elif error.errno == errno.ENODEV:

2019

logger.error("Interface %s does not exist,"

2020

" cannot bind", self.interface)

1454

2021

else:

1455

2022

raise

1456

2023

# Only bind(2) the socket if we really need to.

1459

2026

if self.address_family == socket.AF_INET6:

1460

2027

any_address = "::" # in6addr_any

1461

2028

else:

1462

any_address = socket.INADDR_ANY

2029

any_address = "0.0.0.0" # INADDR_ANY

1463

2030

self.server_address = (any_address,

1464

2031

self.server_address[1])

1465

2032

elif not self.server_address[1]:

1466

self.server_address = (self.server_address[0],

1467

0)

2033

self.server_address = (self.server_address[0], 0)

1468

2034

# if self.interface:

1469

2035

# self.server_address = (self.server_address[0],

1470

2036

# 0, # port

1484

2050

1485

2051

Assumes a gobject.MainLoop event loop.

1486

2052

"""

2053

1487

2054

def __init__(self, server_address, RequestHandlerClass,

1488

interface=None, use_ipv6=True, clients=None,

1489

gnutls_priority=None, use_dbus=True):

2055

interface=None,

2056

use_ipv6=True,

2057

clients=None,

2058

gnutls_priority=None,

2059

use_dbus=True,

2060

socketfd=None):

1490

2061

self.enabled = False

1491

2062

self.clients = clients

1492

2063

if self.clients is None:

1493

self.clients = set()

2064

self.clients = {}

1494

2065

self.use_dbus = use_dbus

1495

2066

self.gnutls_priority = gnutls_priority

1496

2067

IPv6_TCPServer.__init__(self, server_address,

1497

2068

RequestHandlerClass,

1498

2069

interface = interface,

1499

use_ipv6 = use_ipv6)

2070

use_ipv6 = use_ipv6,

2071

socketfd = socketfd)

2072

1500

2073

def server_activate(self):

1501

2074

if self.enabled:

1502

2075

return socketserver.TCPServer.server_activate(self)

2076

1503

2077

def enable(self):

1504

2078

self.enabled = True

1505

def add_pipe(self, parent_pipe):

2079

2080

def add_pipe(self, parent_pipe, proc):

1506

2081

# Call "handle_ipc" for both data and EOF events

1507

gobject.io_add_watch(parent_pipe.fileno(),

1508

gobject.IO_IN | gobject.IO_HUP,

1509

functools.partial(self.handle_ipc,

1510

parent_pipe = parent_pipe))

1511

1512

def handle_ipc(self, source, condition, parent_pipe=None,

2082

gobject.io_add_watch(

2083

parent_pipe.fileno(),

2084

gobject.IO_IN | gobject.IO_HUP,

2085

functools.partial(self.handle_ipc,

2086

parent_pipe = parent_pipe,

2087

proc = proc))

2088

2089

def handle_ipc(self, source, condition,

2090

parent_pipe=None,

2091

proc = None,

1513

2092

client_object=None):

1514

condition_names = {

1515

gobject.IO_IN: "IN", # There is data to read.

1516

gobject.IO_OUT: "OUT", # Data can be written (without

1517

# blocking).

1518

gobject.IO_PRI: "PRI", # There is urgent data to read.

1519

gobject.IO_ERR: "ERR", # Error condition.

1520

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1521

# broken, usually for pipes and

1522

# sockets).

1523

}

1524

conditions_string = ' | '.join(name

1525

for cond, name in

1526

condition_names.iteritems()

1527

if cond & condition)

1528

# error or the other end of multiprocessing.Pipe has closed

1529

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2093

# error, or the other end of multiprocessing.Pipe has closed

2094

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2095

# Wait for other process to exit

2096

proc.join()

1530

2097

return False

1531

2098

1532

2099

# Read a request from the child

1537

2104

fpr = request[1]

1538

2105

address = request[2]

1539

2106

1540

for c in self.clients:

2107

for c in self.clients.itervalues():

1541

2108

if c.fingerprint == fpr:

1542

2109

client = c

1543

2110

break

1544

2111

else:

1545

logger.warning("Client not found for fingerprint: %s, ad"

1546

"dress: %s", fpr, address)

2112

logger.info("Client not found for fingerprint: %s, ad"

2113

"dress: %s", fpr, address)

1547

2114

if self.use_dbus:

1548

2115

# Emit D-Bus signal

1549

mandos_dbus_service.ClientNotFound(fpr, address[0])

2116

mandos_dbus_service.ClientNotFound(fpr,

2117

address[0])

1550

2118

parent_pipe.send(False)

1551

2119

return False

1552

2120

1553

gobject.io_add_watch(parent_pipe.fileno(),

1554

gobject.IO_IN | gobject.IO_HUP,

1555

functools.partial(self.handle_ipc,

1556

parent_pipe = parent_pipe,

1557

client_object = client))

2121

gobject.io_add_watch(

2122

parent_pipe.fileno(),

2123

gobject.IO_IN | gobject.IO_HUP,

2124

functools.partial(self.handle_ipc,

2125

parent_pipe = parent_pipe,

2126

proc = proc,

2127

client_object = client))

1558

2128

parent_pipe.send(True)

1559

# remove the old hook in favor of the new above hook on same fileno

2129

# remove the old hook in favor of the new above hook on

2130

# same fileno

1560

2131

return False

1561

2132

if command == 'funcall':

1562

2133

funcname = request[1]

1563

2134

args = request[2]

1564

2135

kwargs = request[3]

1565

2136

1566

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1567

2137

parent_pipe.send(('data', getattr(client_object,

2138

funcname)(*args,

2139

**kwargs)))

2140

1568

2141

if command == 'getattr':

1569

2142

attrname = request[1]

1570

2143

if callable(client_object.__getattribute__(attrname)):

1571

parent_pipe.send(('function',))

2144

parent_pipe.send(('function', ))

1572

2145

else:

1573

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2146

parent_pipe.send((

2147

'data', client_object.__getattribute__(attrname)))

1574

2148

1575

2149

if command == 'setattr':

1576

2150

attrname = request[1]

1577

2151

value = request[2]

1578

2152

setattr(client_object, attrname, value)

1579

2153

1580

2154

return True

1581

2155

1582

2156

2157

def rfc3339_duration_to_delta(duration):

2158

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2159

2160

>>> rfc3339_duration_to_delta("P7D")

2161

datetime.timedelta(7)

2162

>>> rfc3339_duration_to_delta("PT60S")

2163

datetime.timedelta(0, 60)

2164

>>> rfc3339_duration_to_delta("PT60M")

2165

datetime.timedelta(0, 3600)

2166

>>> rfc3339_duration_to_delta("PT24H")

2167

datetime.timedelta(1)

2168

>>> rfc3339_duration_to_delta("P1W")

2169

datetime.timedelta(7)

2170

>>> rfc3339_duration_to_delta("PT5M30S")

2171

datetime.timedelta(0, 330)

2172

>>> rfc3339_duration_to_delta("P1DT3M20S")

2173

datetime.timedelta(1, 200)

2174

"""

2175

2176

# Parsing an RFC 3339 duration with regular expressions is not

2177

# possible - there would have to be multiple places for the same

2178

# values, like seconds. The current code, while more esoteric, is

2179

# cleaner without depending on a parsing library. If Python had a

2180

# built-in library for parsing we would use it, but we'd like to

2181

# avoid excessive use of external libraries.

2182

2183

# New type for defining tokens, syntax, and semantics all-in-one

2184

Token = collections.namedtuple("Token",

2185

("regexp", # To match token; if

2186

# "value" is not None,

2187

# must have a "group"

2188

# containing digits

2189

"value", # datetime.timedelta or

2190

# None

2191

"followers")) # Tokens valid after

2192

# this token

2193

Token = collections.namedtuple("Token", (

2194

"regexp", # To match token; if "value" is not None, must have

2195

# a "group" containing digits

2196

"value", # datetime.timedelta or None

2197

"followers")) # Tokens valid after this token

2198

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2199

# the "duration" ABNF definition in RFC 3339, Appendix A.

2200

token_end = Token(re.compile(r"$"), None, frozenset())

2201

token_second = Token(re.compile(r"(\d+)S"),

2202

datetime.timedelta(seconds=1),

2203

frozenset((token_end, )))

2204

token_minute = Token(re.compile(r"(\d+)M"),

2205

datetime.timedelta(minutes=1),

2206

frozenset((token_second, token_end)))

2207

token_hour = Token(re.compile(r"(\d+)H"),

2208

datetime.timedelta(hours=1),

2209

frozenset((token_minute, token_end)))

2210

token_time = Token(re.compile(r"T"),

2211

None,

2212

frozenset((token_hour, token_minute,

2213

token_second)))

2214

token_day = Token(re.compile(r"(\d+)D"),

2215

datetime.timedelta(days=1),

2216

frozenset((token_time, token_end)))

2217

token_month = Token(re.compile(r"(\d+)M"),

2218

datetime.timedelta(weeks=4),

2219

frozenset((token_day, token_end)))

2220

token_year = Token(re.compile(r"(\d+)Y"),

2221

datetime.timedelta(weeks=52),

2222

frozenset((token_month, token_end)))

2223

token_week = Token(re.compile(r"(\d+)W"),

2224

datetime.timedelta(weeks=1),

2225

frozenset((token_end, )))

2226

token_duration = Token(re.compile(r"P"), None,

2227

frozenset((token_year, token_month,

2228

token_day, token_time,

2229

token_week)))

2230

# Define starting values

2231

value = datetime.timedelta() # Value so far

2232

found_token = None

2233

followers = frozenset((token_duration,)) # Following valid tokens

2234

s = duration # String left to parse

2235

# Loop until end token is found

2236

while found_token is not token_end:

2237

# Search for any currently valid tokens

2238

for token in followers:

2239

match = token.regexp.match(s)

2240

if match is not None:

2241

# Token found

2242

if token.value is not None:

2243

# Value found, parse digits

2244

factor = int(match.group(1), 10)

2245

# Add to value so far

2246

value += factor * token.value

2247

# Strip token from string

2248

s = token.regexp.sub("", s, 1)

2249

# Go to found token

2250

found_token = token

2251

# Set valid next tokens

2252

followers = found_token.followers

2253

break

2254

else:

2255

# No currently valid tokens were found

2256

raise ValueError("Invalid RFC 3339 duration")

2257

# End token found

2258

return value

2259

2260

1583

2261

def string_to_delta(interval):

1584

2262

"""Parse a string and return a datetime.timedelta

1585

2263

1596

2274

>>> string_to_delta('5m 30s')

1597

2275

datetime.timedelta(0, 330)

1598

2276

"""

2277

2278

try:

2279

return rfc3339_duration_to_delta(interval)

2280

except ValueError:

2281

pass

2282

1599

2283

timevalue = datetime.timedelta(0)

1600

2284

for s in interval.split():

1601

2285

try:

1602

suffix = unicode(s[-1])

2286

suffix = s[-1]

1603

2287

value = int(s[:-1])

1604

2288

if suffix == "d":

1605

2289

delta = datetime.timedelta(value)

1612

2296

elif suffix == "w":

1613

2297

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1614

2298

else:

1615

raise ValueError("Unknown suffix %r" % suffix)

1616

except (ValueError, IndexError), e:

2299

raise ValueError("Unknown suffix {!r}".format(suffix))

2300

except IndexError as e:

1617

2301

raise ValueError(*(e.args))

1618

2302

timevalue += delta

1619

2303

return timevalue

1620

2304

1621

2305

1622

def if_nametoindex(interface):

1623

"""Call the C function if_nametoindex(), or equivalent

1624

1625

Note: This function cannot accept a unicode string."""

1626

global if_nametoindex

1627

try:

1628

if_nametoindex = (ctypes.cdll.LoadLibrary

1629

(ctypes.util.find_library("c"))

1630

.if_nametoindex)

1631

except (OSError, AttributeError):

1632

logger.warning("Doing if_nametoindex the hard way")

1633

def if_nametoindex(interface):

1634

"Get an interface index the hard way, i.e. using fcntl()"

1635

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1636

with contextlib.closing(socket.socket()) as s:

1637

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1638

struct.pack(str("16s16x"),

1639

interface))

1640

interface_index = struct.unpack(str("I"),

1641

ifreq[16:20])[0]

1642

return interface_index

1643

return if_nametoindex(interface)

1644

1645

1646

2306

def daemon(nochdir = False, noclose = False):

1647

2307

"""See daemon(3). Standard BSD Unix function.

1648

2308

1656

2316

sys.exit()

1657

2317

if not noclose:

1658

2318

# Close all standard open file descriptors

1659

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2319

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1660

2320

if not stat.S_ISCHR(os.fstat(null).st_mode):

1661

2321

raise OSError(errno.ENODEV,

1662

"%s not a character device"

1663

% os.path.devnull)

2322

"{} not a character device"

2323

.format(os.devnull))

1664

2324

os.dup2(null, sys.stdin.fileno())

1665

2325

os.dup2(null, sys.stdout.fileno())

1666

2326

os.dup2(null, sys.stderr.fileno())

1673

2333

##################################################################

1674

2334

# Parsing of options, both command line and config file

1675

2335

1676

parser = optparse.OptionParser(version = "%%prog %s" % version)

1677

parser.add_option("-i", "--interface", type="string",

1678

metavar="IF", help="Bind to interface IF")

1679

parser.add_option("-a", "--address", type="string",

1680

help="Address to listen for requests on")

1681

parser.add_option("-p", "--port", type="int",

1682

help="Port number to receive requests on")

1683

parser.add_option("--check", action="store_true",

1684

help="Run self-test")

1685

parser.add_option("--debug", action="store_true",

1686

help="Debug mode; run in foreground and log to"

1687

" terminal")

1688

parser.add_option("--debuglevel", type="string", metavar="LEVEL",

1689

help="Debug level for stdout output")

1690

parser.add_option("--priority", type="string", help="GnuTLS"

1691

" priority string (see GnuTLS documentation)")

1692

parser.add_option("--servicename", type="string",

1693

metavar="NAME", help="Zeroconf service name")

1694

parser.add_option("--configdir", type="string",

1695

default="/etc/mandos", metavar="DIR",

1696

help="Directory to search for configuration"

1697

" files")

1698

parser.add_option("--no-dbus", action="store_false",

1699

dest="use_dbus", help="Do not provide D-Bus"

1700

" system bus interface")

1701

parser.add_option("--no-ipv6", action="store_false",

1702

dest="use_ipv6", help="Do not use IPv6")

1703

options = parser.parse_args()[0]

2336

parser = argparse.ArgumentParser()

2337

parser.add_argument("-v", "--version", action="version",

2338

version = "%(prog)s {}".format(version),

2339

help="show version number and exit")

2340

parser.add_argument("-i", "--interface", metavar="IF",

2341

help="Bind to interface IF")

2342

parser.add_argument("-a", "--address",

2343

help="Address to listen for requests on")

2344

parser.add_argument("-p", "--port", type=int,

2345

help="Port number to receive requests on")

2346

parser.add_argument("--check", action="store_true",

2347

help="Run self-test")

2348

parser.add_argument("--debug", action="store_true",

2349

help="Debug mode; run in foreground and log"

2350

" to terminal", default=None)

2351

parser.add_argument("--debuglevel", metavar="LEVEL",

2352

help="Debug level for stdout output")

2353

parser.add_argument("--priority", help="GnuTLS"

2354

" priority string (see GnuTLS documentation)")

2355

parser.add_argument("--servicename",

2356

metavar="NAME", help="Zeroconf service name")

2357

parser.add_argument("--configdir",

2358

default="/etc/mandos", metavar="DIR",

2359

help="Directory to search for configuration"

2360

" files")

2361

parser.add_argument("--no-dbus", action="store_false",

2362

dest="use_dbus", help="Do not provide D-Bus"

2363

" system bus interface", default=None)

2364

parser.add_argument("--no-ipv6", action="store_false",

2365

dest="use_ipv6", help="Do not use IPv6",

2366

default=None)

2367

parser.add_argument("--no-restore", action="store_false",

2368

dest="restore", help="Do not restore stored"

2369

" state", default=None)

2370

parser.add_argument("--socket", type=int,

2371

help="Specify a file descriptor to a network"

2372

" socket to use instead of creating one")

2373

parser.add_argument("--statedir", metavar="DIR",

2374

help="Directory to save/restore state in")

2375

parser.add_argument("--foreground", action="store_true",

2376

help="Run in foreground", default=None)

2377

parser.add_argument("--no-zeroconf", action="store_false",

2378

dest="zeroconf", help="Do not use Zeroconf",

2379

default=None)

2380

2381

options = parser.parse_args()

1704

2382

1705

2383

if options.check:

1706

2384

import doctest

1707

doctest.testmod()

1708

sys.exit()

2385

fail_count, test_count = doctest.testmod()

2386

sys.exit(os.EX_OK if fail_count == 0 else 1)

1709

2387

1710

2388

# Default values for config file for server-global settings

1711

2389

server_defaults = { "interface": "",

1713

2391

"port": "",

1714

2392

"debug": "False",

1715

2393

"priority":

1716

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2394

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2395

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

1717

2396

"servicename": "Mandos",

1718

2397

"use_dbus": "True",

1719

2398

"use_ipv6": "True",

1720

2399

"debuglevel": "",

1721

}

2400

"restore": "True",

2401

"socket": "",

2402

"statedir": "/var/lib/mandos",

2403

"foreground": "False",

2404

"zeroconf": "True",

2405

}

1722

2406

1723

2407

# Parse config file for server-global settings

1724

2408

server_config = configparser.SafeConfigParser(server_defaults)

1725

2409

del server_defaults

1726

server_config.read(os.path.join(options.configdir,

1727

"mandos.conf"))

2410

server_config.read(os.path.join(options.configdir, "mandos.conf"))

1728

2411

# Convert the SafeConfigParser object to a dict

1729

2412

server_settings = server_config.defaults()

1730

2413

# Use the appropriate methods on the non-string config options

1731

for option in ("debug", "use_dbus", "use_ipv6"):

2414

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

1732

2415

server_settings[option] = server_config.getboolean("DEFAULT",

1733

2416

option)

1734

2417

if server_settings["port"]:

1735

2418

server_settings["port"] = server_config.getint("DEFAULT",

1736

2419

"port")

2420

if server_settings["socket"]:

2421

server_settings["socket"] = server_config.getint("DEFAULT",

2422

"socket")

2423

# Later, stdin will, and stdout and stderr might, be dup'ed

2424

# over with an opened os.devnull. But we don't want this to

2425

# happen with a supplied network socket.

2426

if 0 <= server_settings["socket"] <= 2:

2427

server_settings["socket"] = os.dup(server_settings

2428

["socket"])

1737

2429

del server_config

1738

2430

1739

2431

# Override the settings from the config file with command line

1740

2432

# options, if set.

1741

2433

for option in ("interface", "address", "port", "debug",

1742

"priority", "servicename", "configdir",

1743

"use_dbus", "use_ipv6", "debuglevel"):

2434

"priority", "servicename", "configdir", "use_dbus",

2435

"use_ipv6", "debuglevel", "restore", "statedir",

2436

"socket", "foreground", "zeroconf"):

1744

2437

value = getattr(options, option)

1745

2438

if value is not None:

1746

2439

server_settings[option] = value

1747

2440

del options

1748

2441

# Force all strings to be unicode

1749

2442

for option in server_settings.keys():

1750

if type(server_settings[option]) is str:

1751

server_settings[option] = unicode(server_settings[option])

2443

if isinstance(server_settings[option], bytes):

2444

server_settings[option] = (server_settings[option]

2445

.decode("utf-8"))

2446

# Force all boolean options to be boolean

2447

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2448

"foreground", "zeroconf"):

2449

server_settings[option] = bool(server_settings[option])

2450

# Debug implies foreground

2451

if server_settings["debug"]:

2452

server_settings["foreground"] = True

1752

2453

# Now we have our good server settings in "server_settings"

1753

2454

1754

2455

##################################################################

1755

2456

2457

if (not server_settings["zeroconf"]

2458

and not (server_settings["port"]

2459

or server_settings["socket"] != "")):

2460

parser.error("Needs port or socket to work without Zeroconf")

2461

1756

2462

# For convenience

1757

2463

debug = server_settings["debug"]

1758

2464

debuglevel = server_settings["debuglevel"]

1759

2465

use_dbus = server_settings["use_dbus"]

1760

2466

use_ipv6 = server_settings["use_ipv6"]

1761

2467

stored_state_path = os.path.join(server_settings["statedir"],

2468

stored_state_file)

2469

foreground = server_settings["foreground"]

2470

zeroconf = server_settings["zeroconf"]

2471

2472

if debug:

2473

initlogger(debug, logging.DEBUG)

2474

else:

2475

if not debuglevel:

2476

initlogger(debug)

2477

else:

2478

level = getattr(logging, debuglevel.upper())

2479

initlogger(debug, level)

2480

1762

2481

if server_settings["servicename"] != "Mandos":

1763

syslogger.setFormatter(logging.Formatter

1764

('Mandos (%s) [%%(process)d]:'

1765

' %%(levelname)s: %%(message)s'

1766

% server_settings["servicename"]))

2482

syslogger.setFormatter(

2483

logging.Formatter('Mandos ({}) [%(process)d]:'

2484

' %(levelname)s: %(message)s'.format(

2485

server_settings["servicename"])))

1767

2486

1768

2487

# Parse config file with clients

1769

client_defaults = { "timeout": "1h",

1770

"interval": "5m",

1771

"checker": "fping -q -- %%(host)s",

1772

"host": "",

1773

"approval_delay": "0s",

1774

"approval_duration": "1s",

1775

}

1776

client_config = configparser.SafeConfigParser(client_defaults)

2488

client_config = configparser.SafeConfigParser(Client

2489

.client_defaults)

1777

2490

client_config.read(os.path.join(server_settings["configdir"],

1778

2491

"clients.conf"))

1779

2492

1780

2493

global mandos_dbus_service

1781

2494

mandos_dbus_service = None

1782

2495

1783

tcp_server = MandosServer((server_settings["address"],

1784

server_settings["port"]),

1785

ClientHandler,

1786

interface=(server_settings["interface"]

1787

or None),

1788

use_ipv6=use_ipv6,

1789

gnutls_priority=

1790

server_settings["priority"],

1791

use_dbus=use_dbus)

1792

if not debug:

1793

pidfilename = "/var/run/mandos.pid"

2496

socketfd = None

2497

if server_settings["socket"] != "":

2498

socketfd = server_settings["socket"]

2499

tcp_server = MandosServer(

2500

(server_settings["address"], server_settings["port"]),

2501

ClientHandler,

2502

interface=(server_settings["interface"] or None),

2503

use_ipv6=use_ipv6,

2504

gnutls_priority=server_settings["priority"],

2505

use_dbus=use_dbus,

2506

socketfd=socketfd)

2507

if not foreground:

2508

pidfilename = "/run/mandos.pid"

2509

if not os.path.isdir("/run/."):

2510

pidfilename = "/var/run/mandos.pid"

2511

pidfile = None

1794

2512

try:

1795

2513

pidfile = open(pidfilename, "w")

1796

except IOError:

1797

logger.error("Could not open file %r", pidfilename)

2514

except IOError as e:

2515

logger.error("Could not open file %r", pidfilename,

2516

exc_info=e)

1798

2517

1799

try:

1800

uid = pwd.getpwnam("_mandos").pw_uid

1801

gid = pwd.getpwnam("_mandos").pw_gid

1802

except KeyError:

2518

for name in ("_mandos", "mandos", "nobody"):

1803

2519

try:

1804

uid = pwd.getpwnam("mandos").pw_uid

1805

gid = pwd.getpwnam("mandos").pw_gid

2520

uid = pwd.getpwnam(name).pw_uid

2521

gid = pwd.getpwnam(name).pw_gid

2522

break

1806

2523

except KeyError:

1807

try:

1808

uid = pwd.getpwnam("nobody").pw_uid

1809

gid = pwd.getpwnam("nobody").pw_gid

1810

except KeyError:

1811

uid = 65534

1812

gid = 65534

2524

continue

2525

else:

2526

uid = 65534

2527

gid = 65534

1813

2528

try:

1814

2529

os.setgid(gid)

1815

2530

os.setuid(uid)

1816

except OSError, error:

1817

if error[0] != errno.EPERM:

1818

raise error

2531

except OSError as error:

2532

if error.errno != errno.EPERM:

2533

raise

1819

2534

1820

if not debug and not debuglevel:

1821

syslogger.setLevel(logging.WARNING)

1822

console.setLevel(logging.WARNING)

1823

if debuglevel:

1824

level = getattr(logging, debuglevel.upper())

1825

syslogger.setLevel(level)

1826

console.setLevel(level)

1827

1828

2535

if debug:

1829

2536

# Enable all possible GnuTLS debugging

1830

2537

1836

2543

def debug_gnutls(level, string):

1837

2544

logger.debug("GnuTLS: %s", string[:-1])

1838

2545

1839

(gnutls.library.functions

1840

.gnutls_global_set_log_function(debug_gnutls))

2546

gnutls.library.functions.gnutls_global_set_log_function(

2547

debug_gnutls)

1841

2548

1842

2549

# Redirect stdin so all checkers get /dev/null

1843

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2550

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1844

2551

os.dup2(null, sys.stdin.fileno())

1845

2552

if null > 2:

1846

2553

os.close(null)

1847

else:

1848

# No console logging

1849

logger.removeHandler(console)

1850

2554

1851

2555

# Need to fork before connecting to D-Bus

1852

if not debug:

2556

if not foreground:

1853

2557

# Close all input and output, do double fork, etc.

1854

2558

daemon()

1855

2559

2560

# multiprocessing will use threads, so before we use gobject we

2561

# need to inform gobject that threads will be used.

2562

gobject.threads_init()

2563

1856

2564

global main_loop

1857

2565

# From the Avahi example code

1858

DBusGMainLoop(set_as_default=True )

2566

DBusGMainLoop(set_as_default=True)

1859

2567

main_loop = gobject.MainLoop()

1860

2568

bus = dbus.SystemBus()

1861

2569

# End of Avahi example code

1862

2570

if use_dbus:

1863

2571

try:

1864

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1865

bus, do_not_queue=True)

1866

except dbus.exceptions.NameExistsException, e:

1867

logger.error(unicode(e) + ", disabling D-Bus")

2572

bus_name = dbus.service.BusName("se.recompile.Mandos",

2573

bus,

2574

do_not_queue=True)

2575

old_bus_name = dbus.service.BusName(

2576

"se.bsnet.fukt.Mandos", bus,

2577

do_not_queue=True)

2578

except dbus.exceptions.NameExistsException as e:

2579

logger.error("Disabling D-Bus:", exc_info=e)

1868

2580

use_dbus = False

1869

2581

server_settings["use_dbus"] = False

1870

2582

tcp_server.use_dbus = False

1871

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1872

service = AvahiService(name = server_settings["servicename"],

1873

servicetype = "_mandos._tcp",

1874

protocol = protocol, bus = bus)

1875

if server_settings["interface"]:

1876

service.interface = (if_nametoindex

1877

(str(server_settings["interface"])))

2583

if zeroconf:

2584

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2585

service = AvahiServiceToSyslog(

2586

name = server_settings["servicename"],

2587

servicetype = "_mandos._tcp",

2588

protocol = protocol,

2589

bus = bus)

2590

if server_settings["interface"]:

2591

service.interface = if_nametoindex(

2592

server_settings["interface"].encode("utf-8"))

1878

2593

1879

2594

global multiprocessing_manager

1880

2595

multiprocessing_manager = multiprocessing.Manager()

1882

2597

client_class = Client

1883

2598

if use_dbus:

1884

2599

client_class = functools.partial(ClientDBus, bus = bus)

1885

def client_config_items(config, section):

1886

special_settings = {

1887

"approved_by_default":

1888

lambda: config.getboolean(section,

1889

"approved_by_default"),

1890

}

1891

for name, value in config.items(section):

2600

2601

client_settings = Client.config_parser(client_config)

2602

old_client_settings = {}

2603

clients_data = {}

2604

2605

# This is used to redirect stdout and stderr for checker processes

2606

global wnull

2607

wnull = open(os.devnull, "w") # A writable /dev/null

2608

# Only used if server is running in foreground but not in debug

2609

# mode

2610

if debug or not foreground:

2611

wnull.close()

2612

2613

# Get client data and settings from last running state.

2614

if server_settings["restore"]:

2615

try:

2616

with open(stored_state_path, "rb") as stored_state:

2617

clients_data, old_client_settings = pickle.load(

2618

stored_state)

2619

os.remove(stored_state_path)

2620

except IOError as e:

2621

if e.errno == errno.ENOENT:

2622

logger.warning("Could not load persistent state:"

2623

" {}".format(os.strerror(e.errno)))

2624

else:

2625

logger.critical("Could not load persistent state:",

2626

exc_info=e)

2627

raise

2628

except EOFError as e:

2629

logger.warning("Could not load persistent state: "

2630

"EOFError:",

2631

exc_info=e)

2632

2633

with PGPEngine() as pgp:

2634

for client_name, client in clients_data.items():

2635

# Skip removed clients

2636

if client_name not in client_settings:

2637

continue

2638

2639

# Decide which value to use after restoring saved state.

2640

# We have three different values: Old config file,

2641

# new config file, and saved state.

2642

# New config value takes precedence if it differs from old

2643

# config value, otherwise use saved state.

2644

for name, value in client_settings[client_name].items():

2645

try:

2646

# For each value in new config, check if it

2647

# differs from the old config value (Except for

2648

# the "secret" attribute)

2649

if (name != "secret"

2650

and (value !=

2651

old_client_settings[client_name][name])):

2652

client[name] = value

2653

except KeyError:

2654

pass

2655

2656

# Clients who has passed its expire date can still be

2657

# enabled if its last checker was successful. Clients

2658

# whose checker succeeded before we stored its state is

2659

# assumed to have successfully run all checkers during

2660

# downtime.

2661

if client["enabled"]:

2662

if datetime.datetime.utcnow() >= client["expires"]:

2663

if not client["last_checked_ok"]:

2664

logger.warning(

2665

"disabling client {} - Client never "

2666

"performed a successful checker".format(

2667

client_name))

2668

client["enabled"] = False

2669

elif client["last_checker_status"] != 0:

2670

logger.warning(

2671

"disabling client {} - Client last"

2672

" checker failed with error code"

2673

" {}".format(

2674

client_name,

2675

client["last_checker_status"]))

2676

client["enabled"] = False

2677

else:

2678

client["expires"] = (

2679

datetime.datetime.utcnow()

2680

+ client["timeout"])

2681

logger.debug("Last checker succeeded,"

2682

" keeping {} enabled".format(

2683

client_name))

1892

2684

try:

1893

yield (name, special_settings[name]())

1894

except KeyError:

1895

yield (name, value)

1896

1897

tcp_server.clients.update(set(

1898

client_class(name = section,

1899

config= dict(client_config_items(

1900

client_config, section)))

1901

for section in client_config.sections()))

2685

client["secret"] = pgp.decrypt(

2686

client["encrypted_secret"],

2687

client_settings[client_name]["secret"])

2688

except PGPError:

2689

# If decryption fails, we use secret from new settings

2690

logger.debug("Failed to decrypt {} old secret".format(

2691

client_name))

2692

client["secret"] = (client_settings[client_name]

2693

["secret"])

2694

2695

# Add/remove clients based on new changes made to config

2696

for client_name in (set(old_client_settings)

2697

- set(client_settings)):

2698

del clients_data[client_name]

2699

for client_name in (set(client_settings)

2700

- set(old_client_settings)):

2701

clients_data[client_name] = client_settings[client_name]

2702

2703

# Create all client objects

2704

for client_name, client in clients_data.items():

2705

tcp_server.clients[client_name] = client_class(

2706

name = client_name,

2707

settings = client,

2708

server_settings = server_settings)

2709

1902

2710

if not tcp_server.clients:

1903

2711

logger.warning("No clients defined")

1904

1905

if not debug:

1906

try:

1907

with pidfile:

1908

pid = os.getpid()

1909

pidfile.write(str(pid) + "\n".encode("utf-8"))

1910

del pidfile

1911

except IOError:

1912

logger.error("Could not write to file %r with PID %d",

1913

pidfilename, pid)

1914

except NameError:

1915

# "pidfile" was never created

1916

pass

2712

2713

if not foreground:

2714

if pidfile is not None:

2715

try:

2716

with pidfile:

2717

pid = os.getpid()

2718

pidfile.write("{}\n".format(pid).encode("utf-8"))

2719

except IOError:

2720

logger.error("Could not write to file %r with PID %d",

2721

pidfilename, pid)

2722

del pidfile

1917

2723

del pidfilename

1918

1919

signal.signal(signal.SIGINT, signal.SIG_IGN)

1920

2724

1921

2725

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1922

2726

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1923

2727

1924

2728

if use_dbus:

1925

class MandosDBusService(dbus.service.Object):

2729

2730

@alternate_dbus_interfaces(

2731

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2732

class MandosDBusService(DBusObjectWithProperties):

1926

2733

"""A D-Bus proxy object"""

2734

1927

2735

def __init__(self):

1928

2736

dbus.service.Object.__init__(self, bus, "/")

1929

_interface = "se.bsnet.fukt.Mandos"

2737

2738

_interface = "se.recompile.Mandos"

2739

2740

@dbus_interface_annotations(_interface)

2741

def _foo(self):

2742

return {

2743

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2744

"false" }

1930

2745

1931

2746

@dbus.service.signal(_interface, signature="o")

1932

2747

def ClientAdded(self, objpath):

1946

2761

@dbus.service.method(_interface, out_signature="ao")

1947

2762

def GetAllClients(self):

1948

2763

"D-Bus method"

1949

return dbus.Array(c.dbus_object_path

1950

for c in tcp_server.clients)

2764

return dbus.Array(c.dbus_object_path for c in

2765

tcp_server.clients.itervalues())

1951

2766

1952

2767

@dbus.service.method(_interface,

1953

2768

out_signature="a{oa{sv}}")

1954

2769

def GetAllClientsWithProperties(self):

1955

2770

"D-Bus method"

1956

2771

return dbus.Dictionary(

1957

((c.dbus_object_path, c.GetAll(""))

1958

for c in tcp_server.clients),

2772

{ c.dbus_object_path: c.GetAll("")

2773

for c in tcp_server.clients.itervalues() },

1959

2774

signature="oa{sv}")

1960

2775

1961

2776

@dbus.service.method(_interface, in_signature="o")

1962

2777

def RemoveClient(self, object_path):

1963

2778

"D-Bus method"

1964

for c in tcp_server.clients:

2779

for c in tcp_server.clients.itervalues():

1965

2780

if c.dbus_object_path == object_path:

1966

tcp_server.clients.remove(c)

2781

del tcp_server.clients[c.name]

1967

2782

c.remove_from_connection()

1968

2783

# Don't signal anything except ClientRemoved

1969

2784

c.disable(quiet=True)

1978

2793

1979

2794

def cleanup():

1980

2795

"Cleanup function; run on exit"

1981

service.cleanup()

1982

2796

if zeroconf:

2797

service.cleanup()

2798

2799

multiprocessing.active_children()

2800

wnull.close()

2801

if not (tcp_server.clients or client_settings):

2802

return

2803

2804

# Store client before exiting. Secrets are encrypted with key

2805

# based on what config file has. If config file is

2806

# removed/edited, old secret will thus be unrecovable.

2807

clients = {}

2808

with PGPEngine() as pgp:

2809

for client in tcp_server.clients.itervalues():

2810

key = client_settings[client.name]["secret"]

2811

client.encrypted_secret = pgp.encrypt(client.secret,

2812

key)

2813

client_dict = {}

2814

2815

# A list of attributes that can not be pickled

2816

# + secret.

2817

exclude = { "bus", "changedstate", "secret",

2818

"checker", "server_settings" }

2819

for name, typ in inspect.getmembers(dbus.service

2820

.Object):

2821

exclude.add(name)

2822

2823

client_dict["encrypted_secret"] = (client

2824

.encrypted_secret)

2825

for attr in client.client_structure:

2826

if attr not in exclude:

2827

client_dict[attr] = getattr(client, attr)

2828

2829

clients[client.name] = client_dict

2830

del client_settings[client.name]["secret"]

2831

2832

try:

2833

with tempfile.NamedTemporaryFile(

2834

mode='wb',

2835

suffix=".pickle",

2836

prefix='clients-',

2837

dir=os.path.dirname(stored_state_path),

2838

delete=False) as stored_state:

2839

pickle.dump((clients, client_settings), stored_state)

2840

tempname = stored_state.name

2841

os.rename(tempname, stored_state_path)

2842

except (IOError, OSError) as e:

2843

if not debug:

2844

try:

2845

os.remove(tempname)

2846

except NameError:

2847

pass

2848

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2849

logger.warning("Could not save persistent state: {}"

2850

.format(os.strerror(e.errno)))

2851

else:

2852

logger.warning("Could not save persistent state:",

2853

exc_info=e)

2854

raise

2855

2856

# Delete all clients, and settings from config

1983

2857

while tcp_server.clients:

1984

client = tcp_server.clients.pop()

2858

name, client = tcp_server.clients.popitem()

1985

2859

if use_dbus:

1986

2860

client.remove_from_connection()

1987

client.disable_hook = None

1988

2861

# Don't signal anything except ClientRemoved

1989

2862

client.disable(quiet=True)

1990

2863

if use_dbus:

1991

2864

# Emit D-Bus signal

1992

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

1993

client.name)

2865

mandos_dbus_service.ClientRemoved(

2866

client.dbus_object_path, client.name)

2867

client_settings.clear()

1994

2868

1995

2869

atexit.register(cleanup)

1996

2870

1997

for client in tcp_server.clients:

2871

for client in tcp_server.clients.itervalues():

1998

2872

if use_dbus:

1999

2873

# Emit D-Bus signal

2000

2874

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2001

client.enable()

2875

# Need to initiate checking of clients

2876

if client.enabled:

2877

client.init_checker()

2002

2878

2003

2879

tcp_server.enable()

2004

2880

tcp_server.server_activate()

2005

2881

2006

2882

# Find out what port we got

2007

service.port = tcp_server.socket.getsockname()[1]

2883

if zeroconf:

2884

service.port = tcp_server.socket.getsockname()[1]

2008

2885

if use_ipv6:

2009

2886

logger.info("Now listening on address %r, port %d,"

2010

" flowinfo %d, scope_id %d"

2011

% tcp_server.socket.getsockname())

2887

" flowinfo %d, scope_id %d",

2888

*tcp_server.socket.getsockname())

2012

2889

else: # IPv4

2013

logger.info("Now listening on address %r, port %d"

2014

% tcp_server.socket.getsockname())

2890

logger.info("Now listening on address %r, port %d",

2891

*tcp_server.socket.getsockname())

2015

2892

2016

2893

#service.interface = tcp_server.socket.getsockname()[3]

2017

2894

2018

2895

try:

2019

# From the Avahi example code

2020

try:

2021

service.activate()

2022

except dbus.exceptions.DBusException, error:

2023

logger.critical("DBusException: %s", error)

2024

cleanup()

2025

sys.exit(1)

2026

# End of Avahi example code

2896

if zeroconf:

2897

# From the Avahi example code

2898

try:

2899

service.activate()

2900

except dbus.exceptions.DBusException as error:

2901

logger.critical("D-Bus Exception", exc_info=error)

2902

cleanup()

2903

sys.exit(1)

2904

# End of Avahi example code

2027

2905

2028

2906

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2029

2907

lambda *args, **kwargs:

2032

2910

2033

2911

logger.debug("Starting main loop")

2034

2912

main_loop.run()

2035

except AvahiError, error:

2036

logger.critical("AvahiError: %s", error)

2913

except AvahiError as error:

2914

logger.critical("Avahi Error", exc_info=error)

2037

2915

cleanup()

2038

2916

sys.exit(1)

2039

2917

except KeyboardInterrupt:

2044

2922

# Must run before the D-Bus bus name gets deregistered

2045

2923

cleanup()

2046

2924

2925

2047

2926

if __name__ == '__main__':

2048

2927

main()