/mandos/release : revision 237.7.302

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

19

# the Free Software Foundation, either version 3 of the License, or

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

25

# GNU General Public License for more details.

26

#

26

#

27

# You should have received a copy of the GNU General Public License

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

30

#

31

# Contact the authors at <mandos@recompile.se>.

32

#

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

37

from future_builtins import *

41

38

42

39

try:

43

40

import SocketServer as socketserver

47

44

import argparse

48

45

import datetime

49

46

import errno

47

import gnutls.crypto

48

import gnutls.connection

49

import gnutls.errors

50

import gnutls.library.functions

51

import gnutls.library.constants

52

import gnutls.library.types

50

53

try:

51

54

import ConfigParser as configparser

52

55

except ImportError:

79

82

80

83

import dbus

81

84

import dbus.service

82

from gi.repository import GLib

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

89

import avahi

83

90

from dbus.mainloop.glib import DBusGMainLoop

84

91

import ctypes

85

92

import ctypes.util

86

93

import xml.dom.minidom

87

94

import inspect

88

95

89

# Try to find the value of SO_BINDTODEVICE:

90

96

try:

91

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

92

# newer, and it is also the most natural place for it:

93

97

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

94

98

except AttributeError:

95

99

try:

96

# This is where SO_BINDTODEVICE was up to and including Python

97

# 2.6, and also 3.2:

98

100

from IN import SO_BINDTODEVICE

99

101

except ImportError:

100

# In Python 2.7 it seems to have been removed entirely.

101

# Try running the C preprocessor:

102

try:

103

cc = subprocess.Popen(["cc", "--language=c", "-E",

104

"/dev/stdin"],

105

stdin=subprocess.PIPE,

106

stdout=subprocess.PIPE)

107

stdout = cc.communicate(

108

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

109

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

110

except (OSError, ValueError, IndexError):

111

# No value found

112

SO_BINDTODEVICE = None

102

SO_BINDTODEVICE = None

113

103

114

104

if sys.version_info.major == 2:

115

105

str = unicode

116

106

117

version = "1.7.13"

107

version = "1.6.9"

118

108

stored_state_file = "clients.pickle"

119

109

120

110

logger = logging.getLogger()

124

114

if_nametoindex = ctypes.cdll.LoadLibrary(

125

115

ctypes.util.find_library("c")).if_nametoindex

126

116

except (OSError, AttributeError):

127

117

128

118

def if_nametoindex(interface):

129

119

"Get an interface index the hard way, i.e. using fcntl()"

130

120

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

135

125

return interface_index

136

126

137

127

138

def copy_function(func):

139

"""Make a copy of a function"""

140

if sys.version_info.major == 2:

141

return types.FunctionType(func.func_code,

142

func.func_globals,

143

func.func_name,

144

func.func_defaults,

145

func.func_closure)

146

else:

147

return types.FunctionType(func.__code__,

148

func.__globals__,

149

func.__name__,

150

func.__defaults__,

151

func.__closure__)

152

153

154

128

def initlogger(debug, level=logging.WARNING):

155

129

"""init logger and add loglevel"""

156

130

157

131

global syslogger

158

132

syslogger = (logging.handlers.SysLogHandler(

159

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

160

address="/dev/log"))

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

161

135

syslogger.setFormatter(logging.Formatter

162

136

('Mandos [%(process)d]: %(levelname)s:'

163

137

' %(message)s'))

164

138

logger.addHandler(syslogger)

165

139

166

140

if debug:

167

141

console = logging.StreamHandler()

168

142

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

180

154

181

155

class PGPEngine(object):

182

156

"""A simple class for OpenPGP symmetric encryption & decryption"""

183

157

184

158

def __init__(self):

185

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

186

self.gpg = "gpg"

187

try:

188

output = subprocess.check_output(["gpgconf"])

189

for line in output.splitlines():

190

name, text, path = line.split(b":")

191

if name == "gpg":

192

self.gpg = path

193

break

194

except OSError as e:

195

if e.errno != errno.ENOENT:

196

raise

197

160

self.gnupgargs = ['--batch',

198

'--homedir', self.tempdir,

161

'--home', self.tempdir,

199

162

'--force-mdc',

200

'--quiet']

201

# Only GPG version 1 has the --no-use-agent option.

202

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

203

self.gnupgargs.append("--no-use-agent")

204

163

'--quiet',

164

'--no-use-agent']

165

205

166

def __enter__(self):

206

167

return self

207

168

208

169

def __exit__(self, exc_type, exc_value, traceback):

209

170

self._cleanup()

210

171

return False

211

172

212

173

def __del__(self):

213

174

self._cleanup()

214

175

215

176

def _cleanup(self):

216

177

if self.tempdir is not None:

217

178

# Delete contents of tempdir

218

179

for root, dirs, files in os.walk(self.tempdir,

219

topdown=False):

180

topdown = False):

220

181

for filename in files:

221

182

os.remove(os.path.join(root, filename))

222

183

for dirname in dirs:

224

185

# Remove tempdir

225

186

os.rmdir(self.tempdir)

226

187

self.tempdir = None

227

188

228

189

def password_encode(self, password):

229

190

# Passphrase can not be empty and can not contain newlines or

230

191

# NUL bytes. So we prefix it and hex encode it.

235

196

.replace(b"\n", b"\\n")

236

197

.replace(b"\0", b"\\x00"))

237

198

return encoded

238

199

239

200

def encrypt(self, data, password):

240

201

passphrase = self.password_encode(password)

241

202

with tempfile.NamedTemporaryFile(

242

203

dir=self.tempdir) as passfile:

243

204

passfile.write(passphrase)

244

205

passfile.flush()

245

proc = subprocess.Popen([self.gpg, '--symmetric',

206

proc = subprocess.Popen(['gpg', '--symmetric',

246

207

'--passphrase-file',

247

208

passfile.name]

248

209

+ self.gnupgargs,

249

stdin=subprocess.PIPE,

250

stdout=subprocess.PIPE,

251

stderr=subprocess.PIPE)

252

ciphertext, err = proc.communicate(input=data)

210

stdin = subprocess.PIPE,

211

stdout = subprocess.PIPE,

212

stderr = subprocess.PIPE)

213

ciphertext, err = proc.communicate(input = data)

253

214

if proc.returncode != 0:

254

215

raise PGPError(err)

255

216

return ciphertext

256

217

257

218

def decrypt(self, data, password):

258

219

passphrase = self.password_encode(password)

259

220

with tempfile.NamedTemporaryFile(

260

dir=self.tempdir) as passfile:

221

dir = self.tempdir) as passfile:

261

222

passfile.write(passphrase)

262

223

passfile.flush()

263

proc = subprocess.Popen([self.gpg, '--decrypt',

224

proc = subprocess.Popen(['gpg', '--decrypt',

264

225

'--passphrase-file',

265

226

passfile.name]

266

227

+ self.gnupgargs,

267

stdin=subprocess.PIPE,

268

stdout=subprocess.PIPE,

269

stderr=subprocess.PIPE)

270

decrypted_plaintext, err = proc.communicate(input=data)

228

stdin = subprocess.PIPE,

229

stdout = subprocess.PIPE,

230

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

271

232

if proc.returncode != 0:

272

233

raise PGPError(err)

273

234

return decrypted_plaintext

274

235

275

236

276

# Pretend that we have an Avahi module

277

class Avahi(object):

278

"""This isn't so much a class as it is a module-like namespace.

279

It is instantiated once, and simulates having an Avahi module."""

280

IF_UNSPEC = -1 # avahi-common/address.h

281

PROTO_UNSPEC = -1 # avahi-common/address.h

282

PROTO_INET = 0 # avahi-common/address.h

283

PROTO_INET6 = 1 # avahi-common/address.h

284

DBUS_NAME = "org.freedesktop.Avahi"

285

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

286

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

287

DBUS_PATH_SERVER = "/"

288

289

def string_array_to_txt_array(self, t):

290

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

291

for s in t), signature="ay")

292

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

293

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

294

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

295

SERVER_INVALID = 0 # avahi-common/defs.h

296

SERVER_REGISTERING = 1 # avahi-common/defs.h

297

SERVER_RUNNING = 2 # avahi-common/defs.h

298

SERVER_COLLISION = 3 # avahi-common/defs.h

299

SERVER_FAILURE = 4 # avahi-common/defs.h

300

avahi = Avahi()

301

302

303

237

class AvahiError(Exception):

304

238

def __init__(self, value, *args, **kwargs):

305

239

self.value = value

317

251

318

252

class AvahiService(object):

319

253

"""An Avahi (Zeroconf) service.

320

254

321

255

Attributes:

322

256

interface: integer; avahi.IF_UNSPEC or an interface index.

323

257

Used to optionally bind to the specified interface.

335

269

server: D-Bus Server

336

270

bus: dbus.SystemBus()

337

271

"""

338

272

339

273

def __init__(self,

340

interface=avahi.IF_UNSPEC,

341

name=None,

342

servicetype=None,

343

port=None,

344

TXT=None,

345

domain="",

346

host="",

347

max_renames=32768,

348

protocol=avahi.PROTO_UNSPEC,

349

bus=None):

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

350

284

self.interface = interface

351

285

self.name = name

352

286

self.type = servicetype

361

295

self.server = None

362

296

self.bus = bus

363

297

self.entry_group_state_changed_match = None

364

298

365

299

def rename(self, remove=True):

366

300

"""Derived from the Avahi example code"""

367

301

if self.rename_count >= self.max_renames:

387

321

logger.critical("D-Bus Exception", exc_info=error)

388

322

self.cleanup()

389

323

os._exit(1)

390

324

391

325

def remove(self):

392

326

"""Derived from the Avahi example code"""

393

327

if self.entry_group_state_changed_match is not None:

395

329

self.entry_group_state_changed_match = None

396

330

if self.group is not None:

397

331

self.group.Reset()

398

332

399

333

def add(self):

400

334

"""Derived from the Avahi example code"""

401

335

self.remove()

418

352

dbus.UInt16(self.port),

419

353

avahi.string_array_to_txt_array(self.TXT))

420

354

self.group.Commit()

421

355

422

356

def entry_group_state_changed(self, state, error):

423

357

"""Derived from the Avahi example code"""

424

358

logger.debug("Avahi entry group state change: %i", state)

425

359

426

360

if state == avahi.ENTRY_GROUP_ESTABLISHED:

427

361

logger.debug("Zeroconf service established.")

428

362

elif state == avahi.ENTRY_GROUP_COLLISION:

432

366

logger.critical("Avahi: Error in group state changed %s",

433

367

str(error))

434

368

raise AvahiGroupError("State changed: {!s}".format(error))

435

369

436

370

def cleanup(self):

437

371

"""Derived from the Avahi example code"""

438

372

if self.group is not None:

443

377

pass

444

378

self.group = None

445

379

self.remove()

446

380

447

381

def server_state_changed(self, state, error=None):

448

382

"""Derived from the Avahi example code"""

449

383

logger.debug("Avahi server state change: %i", state)

461

395

logger.error(bad_states[state] + ": %r", error)

462

396

self.cleanup()

463

397

elif state == avahi.SERVER_RUNNING:

464

try:

465

self.add()

466

except dbus.exceptions.DBusException as error:

467

if (error.get_dbus_name()

468

== "org.freedesktop.Avahi.CollisionError"):

469

logger.info("Local Zeroconf service name"

470

" collision.")

471

return self.rename(remove=False)

472

else:

473

logger.critical("D-Bus Exception", exc_info=error)

474

self.cleanup()

475

os._exit(1)

398

self.add()

476

399

else:

477

400

if error is None:

478

401

logger.debug("Unknown state: %r", state)

479

402

else:

480

403

logger.debug("Unknown state: %r: %r", state, error)

481

404

482

405

def activate(self):

483

406

"""Derived from the Avahi example code"""

484

407

if self.server is None:

502

425

return ret

503

426

504

427

505

# Pretend that we have a GnuTLS module

506

class GnuTLS(object):

507

"""This isn't so much a class as it is a module-like namespace.

508

It is instantiated once, and simulates having a GnuTLS module."""

509

510

library = ctypes.util.find_library("gnutls")

511

if library is None:

512

library = ctypes.util.find_library("gnutls-deb0")

513

_library = ctypes.cdll.LoadLibrary(library)

514

del library

515

_need_version = b"3.3.0"

516

517

def __init__(self):

518

# Need to use "self" here, since this method is called before

519

# the assignment to the "gnutls" global variable happens.

520

if self.check_version(self._need_version) is None:

521

raise self.Error("Needs GnuTLS {} or later"

522

.format(self._need_version))

523

524

# Unless otherwise indicated, the constants and types below are

525

# all from the gnutls/gnutls.h C header file.

526

527

# Constants

528

E_SUCCESS = 0

529

E_INTERRUPTED = -52

530

E_AGAIN = -28

531

CRT_OPENPGP = 2

532

CLIENT = 2

533

SHUT_RDWR = 0

534

CRD_CERTIFICATE = 1

535

E_NO_CERTIFICATE_FOUND = -49

536

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

537

538

# Types

539

class session_int(ctypes.Structure):

540

_fields_ = []

541

session_t = ctypes.POINTER(session_int)

542

543

class certificate_credentials_st(ctypes.Structure):

544

_fields_ = []

545

certificate_credentials_t = ctypes.POINTER(

546

certificate_credentials_st)

547

certificate_type_t = ctypes.c_int

548

549

class datum_t(ctypes.Structure):

550

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

551

('size', ctypes.c_uint)]

552

553

class openpgp_crt_int(ctypes.Structure):

554

_fields_ = []

555

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

556

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

557

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

558

credentials_type_t = ctypes.c_int

559

transport_ptr_t = ctypes.c_void_p

560

close_request_t = ctypes.c_int

561

562

# Exceptions

563

class Error(Exception):

564

# We need to use the class name "GnuTLS" here, since this

565

# exception might be raised from within GnuTLS.__init__,

566

# which is called before the assignment to the "gnutls"

567

# global variable has happened.

568

def __init__(self, message=None, code=None, args=()):

569

# Default usage is by a message string, but if a return

570

# code is passed, convert it to a string with

571

# gnutls.strerror()

572

self.code = code

573

if message is None and code is not None:

574

message = GnuTLS.strerror(code)

575

return super(GnuTLS.Error, self).__init__(

576

message, *args)

577

578

class CertificateSecurityError(Error):

579

pass

580

581

# Classes

582

class Credentials(object):

583

def __init__(self):

584

self._c_object = gnutls.certificate_credentials_t()

585

gnutls.certificate_allocate_credentials(

586

ctypes.byref(self._c_object))

587

self.type = gnutls.CRD_CERTIFICATE

588

589

def __del__(self):

590

gnutls.certificate_free_credentials(self._c_object)

591

592

class ClientSession(object):

593

def __init__(self, socket, credentials=None):

594

self._c_object = gnutls.session_t()

595

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

596

gnutls.set_default_priority(self._c_object)

597

gnutls.transport_set_ptr(self._c_object, socket.fileno())

598

gnutls.handshake_set_private_extensions(self._c_object,

599

True)

600

self.socket = socket

601

if credentials is None:

602

credentials = gnutls.Credentials()

603

gnutls.credentials_set(self._c_object, credentials.type,

604

ctypes.cast(credentials._c_object,

605

ctypes.c_void_p))

606

self.credentials = credentials

607

608

def __del__(self):

609

gnutls.deinit(self._c_object)

610

611

def handshake(self):

612

return gnutls.handshake(self._c_object)

613

614

def send(self, data):

615

data = bytes(data)

616

data_len = len(data)

617

while data_len > 0:

618

data_len -= gnutls.record_send(self._c_object,

619

data[-data_len:],

620

data_len)

621

622

def bye(self):

623

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

624

625

# Error handling functions

626

def _error_code(result):

627

"""A function to raise exceptions on errors, suitable

628

for the 'restype' attribute on ctypes functions"""

629

if result >= 0:

630

return result

631

if result == gnutls.E_NO_CERTIFICATE_FOUND:

632

raise gnutls.CertificateSecurityError(code=result)

633

raise gnutls.Error(code=result)

634

635

def _retry_on_error(result, func, arguments):

636

"""A function to retry on some errors, suitable

637

for the 'errcheck' attribute on ctypes functions"""

638

while result < 0:

639

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

640

return _error_code(result)

641

result = func(*arguments)

642

return result

643

644

# Unless otherwise indicated, the function declarations below are

645

# all from the gnutls/gnutls.h C header file.

646

647

# Functions

648

priority_set_direct = _library.gnutls_priority_set_direct

649

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

650

ctypes.POINTER(ctypes.c_char_p)]

651

priority_set_direct.restype = _error_code

652

653

init = _library.gnutls_init

654

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

655

init.restype = _error_code

656

657

set_default_priority = _library.gnutls_set_default_priority

658

set_default_priority.argtypes = [session_t]

659

set_default_priority.restype = _error_code

660

661

record_send = _library.gnutls_record_send

662

record_send.argtypes = [session_t, ctypes.c_void_p,

663

ctypes.c_size_t]

664

record_send.restype = ctypes.c_ssize_t

665

record_send.errcheck = _retry_on_error

666

667

certificate_allocate_credentials = (

668

_library.gnutls_certificate_allocate_credentials)

669

certificate_allocate_credentials.argtypes = [

670

ctypes.POINTER(certificate_credentials_t)]

671

certificate_allocate_credentials.restype = _error_code

672

673

certificate_free_credentials = (

674

_library.gnutls_certificate_free_credentials)

675

certificate_free_credentials.argtypes = [

676

certificate_credentials_t]

677

certificate_free_credentials.restype = None

678

679

handshake_set_private_extensions = (

680

_library.gnutls_handshake_set_private_extensions)

681

handshake_set_private_extensions.argtypes = [session_t,

682

ctypes.c_int]

683

handshake_set_private_extensions.restype = None

684

685

credentials_set = _library.gnutls_credentials_set

686

credentials_set.argtypes = [session_t, credentials_type_t,

687

ctypes.c_void_p]

688

credentials_set.restype = _error_code

689

690

strerror = _library.gnutls_strerror

691

strerror.argtypes = [ctypes.c_int]

692

strerror.restype = ctypes.c_char_p

693

694

certificate_type_get = _library.gnutls_certificate_type_get

695

certificate_type_get.argtypes = [session_t]

696

certificate_type_get.restype = _error_code

697

698

certificate_get_peers = _library.gnutls_certificate_get_peers

699

certificate_get_peers.argtypes = [session_t,

700

ctypes.POINTER(ctypes.c_uint)]

701

certificate_get_peers.restype = ctypes.POINTER(datum_t)

702

703

global_set_log_level = _library.gnutls_global_set_log_level

704

global_set_log_level.argtypes = [ctypes.c_int]

705

global_set_log_level.restype = None

706

707

global_set_log_function = _library.gnutls_global_set_log_function

708

global_set_log_function.argtypes = [log_func]

709

global_set_log_function.restype = None

710

711

deinit = _library.gnutls_deinit

712

deinit.argtypes = [session_t]

713

deinit.restype = None

714

715

handshake = _library.gnutls_handshake

716

handshake.argtypes = [session_t]

717

handshake.restype = _error_code

718

handshake.errcheck = _retry_on_error

719

720

transport_set_ptr = _library.gnutls_transport_set_ptr

721

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

722

transport_set_ptr.restype = None

723

724

bye = _library.gnutls_bye

725

bye.argtypes = [session_t, close_request_t]

726

bye.restype = _error_code

727

bye.errcheck = _retry_on_error

728

729

check_version = _library.gnutls_check_version

730

check_version.argtypes = [ctypes.c_char_p]

731

check_version.restype = ctypes.c_char_p

732

733

# All the function declarations below are from gnutls/openpgp.h

734

735

openpgp_crt_init = _library.gnutls_openpgp_crt_init

736

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

737

openpgp_crt_init.restype = _error_code

738

739

openpgp_crt_import = _library.gnutls_openpgp_crt_import

740

openpgp_crt_import.argtypes = [openpgp_crt_t,

741

ctypes.POINTER(datum_t),

742

openpgp_crt_fmt_t]

743

openpgp_crt_import.restype = _error_code

744

745

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

746

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

747

ctypes.POINTER(ctypes.c_uint)]

748

openpgp_crt_verify_self.restype = _error_code

749

750

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

751

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

752

openpgp_crt_deinit.restype = None

753

754

openpgp_crt_get_fingerprint = (

755

_library.gnutls_openpgp_crt_get_fingerprint)

756

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

757

ctypes.c_void_p,

758

ctypes.POINTER(

759

ctypes.c_size_t)]

760

openpgp_crt_get_fingerprint.restype = _error_code

761

762

# Remove non-public functions

763

del _error_code, _retry_on_error

764

# Create the global "gnutls" object, simulating a module

765

gnutls = GnuTLS()

766

767

768

def call_pipe(connection, # : multiprocessing.Connection

769

func, *args, **kwargs):

770

"""This function is meant to be called by multiprocessing.Process

771

772

This function runs func(*args, **kwargs), and writes the resulting

773

return value on the provided multiprocessing.Connection.

774

"""

775

connection.send(func(*args, **kwargs))

776

connection.close()

777

778

779

428

class Client(object):

780

429

"""A representation of a client host served by this server.

781

430

782

431

Attributes:

783

432

approved: bool(); 'None' if not yet approved/disapproved

784

433

approval_delay: datetime.timedelta(); Time to wait for approval

786

435

checker: subprocess.Popen(); a running checker process used

787

436

to see if the client lives.

788

437

'None' if no process is running.

789

checker_callback_tag: a GLib event source tag, or None

438

checker_callback_tag: a gobject event source tag, or None

790

439

checker_command: string; External command which is run to check

791

440

if client lives. %() expansions are done at

792

441

runtime with vars(self) as dict, so that for

793

442

instance %(name)s can be used in the command.

794

checker_initiator_tag: a GLib event source tag, or None

443

checker_initiator_tag: a gobject event source tag, or None

795

444

created: datetime.datetime(); (UTC) object creation

796

445

client_structure: Object describing what attributes a client has

797

446

and is used for storing the client at exit

798

447

current_checker_command: string; current running checker_command

799

disable_initiator_tag: a GLib event source tag, or None

448

disable_initiator_tag: a gobject event source tag, or None

800

449

enabled: bool()

801

450

fingerprint: string (40 or 32 hexadecimal digits); used to

802

451

uniquely identify the client

807

456

last_checker_status: integer between 0 and 255 reflecting exit

808

457

status of last checker. -1 reflects crashed

809

458

checker, -2 means no checker completed yet.

810

last_checker_signal: The signal which killed the last checker, if

811

last_checker_status is -1

812

459

last_enabled: datetime.datetime(); (UTC) or None

813

460

name: string; from the config file, used in log messages and

814

461

D-Bus identifiers

821

468

disabled, or None

822

469

server_settings: The server_settings dict from main()

823

470

"""

824

471

825

472

runtime_expansions = ("approval_delay", "approval_duration",

826

473

"created", "enabled", "expires",

827

474

"fingerprint", "host", "interval",

838

485

"approved_by_default": "True",

839

486

"enabled": "True",

840

487

}

841

488

842

489

@staticmethod

843

490

def config_parser(config):

844

491

"""Construct a new dict of client settings of this form:

851

498

for client_name in config.sections():

852

499

section = dict(config.items(client_name))

853

500

client = settings[client_name] = {}

854

501

855

502

client["host"] = section["host"]

856

503

# Reformat values from string types to Python types

857

504

client["approved_by_default"] = config.getboolean(

858

505

client_name, "approved_by_default")

859

506

client["enabled"] = config.getboolean(client_name,

860

507

"enabled")

861

508

862

509

# Uppercase and remove spaces from fingerprint for later

863

510

# comparison purposes with return value from the

864

511

# fingerprint() function

865

512

client["fingerprint"] = (section["fingerprint"].upper()

866

513

.replace(" ", ""))

867

514

if "secret" in section:

868

client["secret"] = codecs.decode(section["secret"]

869

.encode("utf-8"),

870

"base64")

515

client["secret"] = section["secret"].decode("base64")

871

516

elif "secfile" in section:

872

517

with open(os.path.expanduser(os.path.expandvars

873

518

(section["secfile"])),

888

533

client["last_approval_request"] = None

889

534

client["last_checked_ok"] = None

890

535

client["last_checker_status"] = -2

891

536

892

537

return settings

893

894

def __init__(self, settings, name=None, server_settings=None):

538

539

def __init__(self, settings, name = None, server_settings=None):

895

540

self.name = name

896

541

if server_settings is None:

897

542

server_settings = {}

899

544

# adding all client settings

900

545

for setting, value in settings.items():

901

546

setattr(self, setting, value)

902

547

903

548

if self.enabled:

904

549

if not hasattr(self, "last_enabled"):

905

550

self.last_enabled = datetime.datetime.utcnow()

909

554

else:

910

555

self.last_enabled = None

911

556

self.expires = None

912

557

913

558

logger.debug("Creating client %r", self.name)

914

559

logger.debug(" Fingerprint: %s", self.fingerprint)

915

560

self.created = settings.get("created",

916

561

datetime.datetime.utcnow())

917

562

918

563

# attributes specific for this server instance

919

564

self.checker = None

920

565

self.checker_initiator_tag = None

926

571

self.changedstate = multiprocessing_manager.Condition(

927

572

multiprocessing_manager.Lock())

928

573

self.client_structure = [attr

929

for attr in self.__dict__.keys()

574

for attr in self.__dict__.iterkeys()

930

575

if not attr.startswith("_")]

931

576

self.client_structure.append("client_structure")

932

577

933

578

for name, t in inspect.getmembers(

934

579

type(self), lambda obj: isinstance(obj, property)):

935

580

if not name.startswith("_"):

936

581

self.client_structure.append(name)

937

582

938

583

# Send notice to process children that client state has changed

939

584

def send_changedstate(self):

940

585

with self.changedstate:

941

586

self.changedstate.notify_all()

942

587

943

588

def enable(self):

944

589

"""Start this client's checker and timeout hooks"""

945

590

if getattr(self, "enabled", False):

950

595

self.last_enabled = datetime.datetime.utcnow()

951

596

self.init_checker()

952

597

self.send_changedstate()

953

598

954

599

def disable(self, quiet=True):

955

600

"""Disable this client."""

956

601

if not getattr(self, "enabled", False):

958

603

if not quiet:

959

604

logger.info("Disabling client %s", self.name)

960

605

if getattr(self, "disable_initiator_tag", None) is not None:

961

GLib.source_remove(self.disable_initiator_tag)

606

gobject.source_remove(self.disable_initiator_tag)

962

607

self.disable_initiator_tag = None

963

608

self.expires = None

964

609

if getattr(self, "checker_initiator_tag", None) is not None:

965

GLib.source_remove(self.checker_initiator_tag)

610

gobject.source_remove(self.checker_initiator_tag)

966

611

self.checker_initiator_tag = None

967

612

self.stop_checker()

968

613

self.enabled = False

969

614

if not quiet:

970

615

self.send_changedstate()

971

# Do not run this again if called by a GLib.timeout_add

616

# Do not run this again if called by a gobject.timeout_add

972

617

return False

973

618

974

619

def __del__(self):

975

620

self.disable()

976

621

977

622

def init_checker(self):

978

623

# Schedule a new checker to be started an 'interval' from now,

979

624

# and every interval from then on.

980

625

if self.checker_initiator_tag is not None:

981

GLib.source_remove(self.checker_initiator_tag)

982

self.checker_initiator_tag = GLib.timeout_add(

626

gobject.source_remove(self.checker_initiator_tag)

627

self.checker_initiator_tag = gobject.timeout_add(

983

628

int(self.interval.total_seconds() * 1000),

984

629

self.start_checker)

985

630

# Schedule a disable() when 'timeout' has passed

986

631

if self.disable_initiator_tag is not None:

987

GLib.source_remove(self.disable_initiator_tag)

988

self.disable_initiator_tag = GLib.timeout_add(

632

gobject.source_remove(self.disable_initiator_tag)

633

self.disable_initiator_tag = gobject.timeout_add(

989

634

int(self.timeout.total_seconds() * 1000), self.disable)

990

635

# Also start a new checker *right now*.

991

636

self.start_checker()

992

993

def checker_callback(self, source, condition, connection,

994

command):

637

638

def checker_callback(self, pid, condition, command):

995

639

"""The checker has completed, so take appropriate actions."""

996

640

self.checker_callback_tag = None

997

641

self.checker = None

998

# Read return code from connection (see call_pipe)

999

returncode = connection.recv()

1000

connection.close()

1001

1002

if returncode >= 0:

1003

self.last_checker_status = returncode

1004

self.last_checker_signal = None

642

if os.WIFEXITED(condition):

643

self.last_checker_status = os.WEXITSTATUS(condition)

1005

644

if self.last_checker_status == 0:

1006

645

logger.info("Checker for %(name)s succeeded",

1007

646

vars(self))

1010

649

logger.info("Checker for %(name)s failed", vars(self))

1011

650

else:

1012

651

self.last_checker_status = -1

1013

self.last_checker_signal = -returncode

1014

652

logger.warning("Checker for %(name)s crashed?",

1015

653

vars(self))

1016

return False

1017

654

1018

655

def checked_ok(self):

1019

656

"""Assert that the client has been seen, alive and well."""

1020

657

self.last_checked_ok = datetime.datetime.utcnow()

1021

658

self.last_checker_status = 0

1022

self.last_checker_signal = None

1023

659

self.bump_timeout()

1024

660

1025

661

def bump_timeout(self, timeout=None):

1026

662

"""Bump up the timeout for this client."""

1027

663

if timeout is None:

1028

664

timeout = self.timeout

1029

665

if self.disable_initiator_tag is not None:

1030

GLib.source_remove(self.disable_initiator_tag)

666

gobject.source_remove(self.disable_initiator_tag)

1031

667

self.disable_initiator_tag = None

1032

668

if getattr(self, "enabled", False):

1033

self.disable_initiator_tag = GLib.timeout_add(

669

self.disable_initiator_tag = gobject.timeout_add(

1034

670

int(timeout.total_seconds() * 1000), self.disable)

1035

671

self.expires = datetime.datetime.utcnow() + timeout

1036

672

1037

673

def need_approval(self):

1038

674

self.last_approval_request = datetime.datetime.utcnow()

1039

675

1040

676

def start_checker(self):

1041

677

"""Start a new checker subprocess if one is not running.

1042

678

1043

679

If a checker already exists, leave it running and do

1044

680

nothing."""

1045

681

# The reason for not killing a running checker is that if we

1050

686

# checkers alone, the checker would have to take more time

1051

687

# than 'timeout' for the client to be disabled, which is as it

1052

688

# should be.

1053

1054

if self.checker is not None and not self.checker.is_alive():

1055

logger.warning("Checker was not alive; joining")

1056

self.checker.join()

1057

self.checker = None

689

690

# If a checker exists, make sure it is not a zombie

691

try:

692

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

693

except AttributeError:

694

pass

695

except OSError as error:

696

if error.errno != errno.ECHILD:

697

raise

698

else:

699

if pid:

700

logger.warning("Checker was a zombie")

701

gobject.source_remove(self.checker_callback_tag)

702

self.checker_callback(pid, status,

703

self.current_checker_command)

1058

704

# Start a new checker if needed

1059

705

if self.checker is None:

1060

706

# Escape attributes for the shell

1061

707

escaped_attrs = {

1062

708

attr: re.escape(str(getattr(self, attr)))

1063

for attr in self.runtime_expansions}

709

for attr in self.runtime_expansions }

1064

710

try:

1065

711

command = self.checker_command % escaped_attrs

1066

712

except TypeError as error:

1069

715

exc_info=error)

1070

716

return True # Try again later

1071

717

self.current_checker_command = command

1072

logger.info("Starting checker %r for %s", command,

1073

self.name)

1074

# We don't need to redirect stdout and stderr, since

1075

# in normal mode, that is already done by daemon(),

1076

# and in debug mode we don't want to. (Stdin is

1077

# always replaced by /dev/null.)

1078

# The exception is when not debugging but nevertheless

1079

# running in the foreground; use the previously

1080

# created wnull.

1081

popen_args = {"close_fds": True,

1082

"shell": True,

1083

"cwd": "/"}

1084

if (not self.server_settings["debug"]

1085

and self.server_settings["foreground"]):

1086

popen_args.update({"stdout": wnull,

1087

"stderr": wnull})

1088

pipe = multiprocessing.Pipe(duplex=False)

1089

self.checker = multiprocessing.Process(

1090

target=call_pipe,

1091

args=(pipe[1], subprocess.call, command),

1092

kwargs=popen_args)

1093

self.checker.start()

1094

self.checker_callback_tag = GLib.io_add_watch(

1095

pipe[0].fileno(), GLib.IO_IN,

1096

self.checker_callback, pipe[0], command)

1097

# Re-run this periodically if run by GLib.timeout_add

718

try:

719

logger.info("Starting checker %r for %s", command,

720

self.name)

721

# We don't need to redirect stdout and stderr, since

722

# in normal mode, that is already done by daemon(),

723

# and in debug mode we don't want to. (Stdin is

724

# always replaced by /dev/null.)

725

# The exception is when not debugging but nevertheless

726

# running in the foreground; use the previously

727

# created wnull.

728

popen_args = {}

729

if (not self.server_settings["debug"]

730

and self.server_settings["foreground"]):

731

popen_args.update({"stdout": wnull,

732

"stderr": wnull })

733

self.checker = subprocess.Popen(command,

734

close_fds=True,

735

shell=True,

736

cwd="/",

737

**popen_args)

738

except OSError as error:

739

logger.error("Failed to start subprocess",

740

exc_info=error)

741

return True

742

self.checker_callback_tag = gobject.child_watch_add(

743

self.checker.pid, self.checker_callback, data=command)

744

# The checker may have completed before the gobject

745

# watch was added. Check for this.

746

try:

747

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

748

except OSError as error:

749

if error.errno == errno.ECHILD:

750

# This should never happen

751

logger.error("Child process vanished",

752

exc_info=error)

753

return True

754

raise

755

if pid:

756

gobject.source_remove(self.checker_callback_tag)

757

self.checker_callback(pid, status, command)

758

# Re-run this periodically if run by gobject.timeout_add

1098

759

return True

1099

760

1100

761

def stop_checker(self):

1101

762

"""Force the checker process, if any, to stop."""

1102

763

if self.checker_callback_tag:

1103

GLib.source_remove(self.checker_callback_tag)

764

gobject.source_remove(self.checker_callback_tag)

1104

765

self.checker_callback_tag = None

1105

766

if getattr(self, "checker", None) is None:

1106

767

return

1107

768

logger.debug("Stopping checker for %(name)s", vars(self))

1108

self.checker.terminate()

769

try:

770

self.checker.terminate()

771

#time.sleep(0.5)

772

#if self.checker.poll() is None:

773

# self.checker.kill()

774

except OSError as error:

775

if error.errno != errno.ESRCH: # No such process

776

raise

1109

777

self.checker = None

1110

778

1111

779

1115

783

byte_arrays=False):

1116

784

"""Decorators for marking methods of a DBusObjectWithProperties to

1117

785

become properties on the D-Bus.

1118

786

1119

787

The decorated method will be called with no arguments by "Get"

1120

788

and with one argument by "Set".

1121

789

1122

790

The parameters, where they are supported, are the same as

1123

791

dbus.service.method, except there is only "signature", since the

1124

792

type from Get() and the type sent to Set() is the same.

1128

796

if byte_arrays and signature != "ay":

1129

797

raise ValueError("Byte arrays not supported for non-'ay'"

1130

798

" signature {!r}".format(signature))

1131

799

1132

800

def decorator(func):

1133

801

func._dbus_is_property = True

1134

802

func._dbus_interface = dbus_interface

1137

805

func._dbus_name = func.__name__

1138

806

if func._dbus_name.endswith("_dbus_property"):

1139

807

func._dbus_name = func._dbus_name[:-14]

1140

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

808

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1141

809

return func

1142

810

1143

811

return decorator

1144

812

1145

813

1146

814

def dbus_interface_annotations(dbus_interface):

1147

815

"""Decorator for marking functions returning interface annotations

1148

816

1149

817

Usage:

1150

818

1151

819

@dbus_interface_annotations("org.example.Interface")

1152

820

def _foo(self): # Function name does not matter

1153

821

return {"org.freedesktop.DBus.Deprecated": "true",

1154

822

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1155

823

"false"}

1156

824

"""

1157

825

1158

826

def decorator(func):

1159

827

func._dbus_is_interface = True

1160

828

func._dbus_interface = dbus_interface

1161

829

func._dbus_name = dbus_interface

1162

830

return func

1163

831

1164

832

return decorator

1165

833

1166

834

1167

835

def dbus_annotations(annotations):

1168

836

"""Decorator to annotate D-Bus methods, signals or properties

1169

837

Usage:

1170

838

1171

839

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1172

840

"org.freedesktop.DBus.Property."

1173

841

"EmitsChangedSignal": "false"})

1175

843

access="r")

1176

844

def Property_dbus_property(self):

1177

845

return dbus.Boolean(False)

1178

1179

See also the DBusObjectWithAnnotations class.

1180

846

"""

1181

847

1182

848

def decorator(func):

1183

849

func._dbus_annotations = annotations

1184

850

return func

1185

851

1186

852

return decorator

1187

853

1188

854

1204

870

pass

1205

871

1206

872

1207

class DBusObjectWithAnnotations(dbus.service.Object):

1208

"""A D-Bus object with annotations.

1209

1210

Classes inheriting from this can use the dbus_annotations

1211

decorator to add annotations to methods or signals.

873

class DBusObjectWithProperties(dbus.service.Object):

874

"""A D-Bus object with properties.

875

876

Classes inheriting from this can use the dbus_service_property

877

decorator to expose methods as D-Bus properties. It exposes the

878

standard Get(), Set(), and GetAll() methods on the D-Bus.

1212

879

"""

1213

880

1214

881

@staticmethod

1215

882

def _is_dbus_thing(thing):

1216

883

"""Returns a function testing if an attribute is a D-Bus thing

1217

884

1218

885

If called like _is_dbus_thing("method") it returns a function

1219

886

suitable for use as predicate to inspect.getmembers().

1220

887

"""

1221

888

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1222

889

False)

1223

890

1224

891

def _get_all_dbus_things(self, thing):

1225

892

"""Returns a generator of (name, attribute) pairs

1226

893

"""

1229

896

for cls in self.__class__.__mro__

1230

897

for name, athing in

1231

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1232

1233

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1234

out_signature="s",

1235

path_keyword='object_path',

1236

connection_keyword='connection')

1237

def Introspect(self, object_path, connection):

1238

"""Overloading of standard D-Bus method.

1239

1240

Inserts annotation tags on methods and signals.

1241

"""

1242

xmlstring = dbus.service.Object.Introspect(self, object_path,

1243

connection)

1244

try:

1245

document = xml.dom.minidom.parseString(xmlstring)

1246

1247

for if_tag in document.getElementsByTagName("interface"):

1248

# Add annotation tags

1249

for typ in ("method", "signal"):

1250

for tag in if_tag.getElementsByTagName(typ):

1251

annots = dict()

1252

for name, prop in (self.

1253

_get_all_dbus_things(typ)):

1254

if (name == tag.getAttribute("name")

1255

and prop._dbus_interface

1256

== if_tag.getAttribute("name")):

1257

annots.update(getattr(

1258

prop, "_dbus_annotations", {}))

1259

for name, value in annots.items():

1260

ann_tag = document.createElement(

1261

"annotation")

1262

ann_tag.setAttribute("name", name)

1263

ann_tag.setAttribute("value", value)

1264

tag.appendChild(ann_tag)

1265

# Add interface annotation tags

1266

for annotation, value in dict(

1267

itertools.chain.from_iterable(

1268

annotations().items()

1269

for name, annotations

1270

in self._get_all_dbus_things("interface")

1271

if name == if_tag.getAttribute("name")

1272

)).items():

1273

ann_tag = document.createElement("annotation")

1274

ann_tag.setAttribute("name", annotation)

1275

ann_tag.setAttribute("value", value)

1276

if_tag.appendChild(ann_tag)

1277

# Fix argument name for the Introspect method itself

1278

if (if_tag.getAttribute("name")

1279

== dbus.INTROSPECTABLE_IFACE):

1280

for cn in if_tag.getElementsByTagName("method"):

1281

if cn.getAttribute("name") == "Introspect":

1282

for arg in cn.getElementsByTagName("arg"):

1283

if (arg.getAttribute("direction")

1284

== "out"):

1285

arg.setAttribute("name",

1286

"xml_data")

1287

xmlstring = document.toxml("utf-8")

1288

document.unlink()

1289

except (AttributeError, xml.dom.DOMException,

1290

xml.parsers.expat.ExpatError) as error:

1291

logger.error("Failed to override Introspection method",

1292

exc_info=error)

1293

return xmlstring

1294

1295

1296

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1297

"""A D-Bus object with properties.

1298

1299

Classes inheriting from this can use the dbus_service_property

1300

decorator to expose methods as D-Bus properties. It exposes the

1301

standard Get(), Set(), and GetAll() methods on the D-Bus.

1302

"""

1303

899

1304

900

def _get_dbus_property(self, interface_name, property_name):

1305

901

"""Returns a bound method if one exists which is a D-Bus

1306

902

property with the specified name and interface.

1311

907

if (value._dbus_name == property_name

1312

908

and value._dbus_interface == interface_name):

1313

909

return value.__get__(self)

1314

910

1315

911

# No such property

1316

912

raise DBusPropertyNotFound("{}:{}.{}".format(

1317

913

self.dbus_object_path, interface_name, property_name))

1318

1319

@classmethod

1320

def _get_all_interface_names(cls):

1321

"""Get a sequence of all interfaces supported by an object"""

1322

return (name for name in set(getattr(getattr(x, attr),

1323

"_dbus_interface", None)

1324

for x in (inspect.getmro(cls))

1325

for attr in dir(x))

1326

if name is not None)

1327

914

1328

915

@dbus.service.method(dbus.PROPERTIES_IFACE,

1329

916

in_signature="ss",

1330

917

out_signature="v")

1338

925

if not hasattr(value, "variant_level"):

1339

926

return value

1340

927

return type(value)(value, variant_level=value.variant_level+1)

1341

928

1342

929

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1343

930

def Set(self, interface_name, property_name, value):

1344

931

"""Standard D-Bus property Set() method, see D-Bus standard.

1356

943

value = dbus.ByteArray(b''.join(chr(byte)

1357

944

for byte in value))

1358

945

prop(value)

1359

946

1360

947

@dbus.service.method(dbus.PROPERTIES_IFACE,

1361

948

in_signature="s",

1362

949

out_signature="a{sv}")

1363

950

def GetAll(self, interface_name):

1364

951

"""Standard D-Bus property GetAll() method, see D-Bus

1365

952

standard.

1366

953

1367

954

Note: Will not include properties with access="write".

1368

955

"""

1369

956

properties = {}

1380

967

properties[name] = value

1381

968

continue

1382

969

properties[name] = type(value)(

1383

value, variant_level=value.variant_level + 1)

970

value, variant_level = value.variant_level + 1)

1384

971

return dbus.Dictionary(properties, signature="sv")

1385

972

1386

973

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1387

974

def PropertiesChanged(self, interface_name, changed_properties,

1388

975

invalidated_properties):

1390

977

standard.

1391

978

"""

1392

979

pass

1393

980

1394

981

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1395

982

out_signature="s",

1396

983

path_keyword='object_path',

1397

984

connection_keyword='connection')

1398

985

def Introspect(self, object_path, connection):

1399

986

"""Overloading of standard D-Bus method.

1400

987

1401

988

Inserts property tags and interface annotation tags.

1402

989

"""

1403

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1404

object_path,

1405

connection)

990

xmlstring = dbus.service.Object.Introspect(self, object_path,

991

connection)

1406

992

try:

1407

993

document = xml.dom.minidom.parseString(xmlstring)

1408

994

1409

995

def make_tag(document, name, prop):

1410

996

e = document.createElement("property")

1411

997

e.setAttribute("name", name)

1412

998

e.setAttribute("type", prop._dbus_signature)

1413

999

e.setAttribute("access", prop._dbus_access)

1414

1000

return e

1415

1001

1416

1002

for if_tag in document.getElementsByTagName("interface"):

1417

1003

# Add property tags

1418

1004

for tag in (make_tag(document, name, prop)

1421

1007

if prop._dbus_interface

1422

1008

== if_tag.getAttribute("name")):

1423

1009

if_tag.appendChild(tag)

1424

# Add annotation tags for properties

1425

for tag in if_tag.getElementsByTagName("property"):

1426

annots = dict()

1427

for name, prop in self._get_all_dbus_things(

1428

"property"):

1429

if (name == tag.getAttribute("name")

1430

and prop._dbus_interface

1431

== if_tag.getAttribute("name")):

1432

annots.update(getattr(

1433

prop, "_dbus_annotations", {}))

1434

for name, value in annots.items():

1435

ann_tag = document.createElement(

1436

"annotation")

1437

ann_tag.setAttribute("name", name)

1438

ann_tag.setAttribute("value", value)

1439

tag.appendChild(ann_tag)

1010

# Add annotation tags

1011

for typ in ("method", "signal", "property"):

1012

for tag in if_tag.getElementsByTagName(typ):

1013

annots = dict()

1014

for name, prop in (self.

1015

_get_all_dbus_things(typ)):

1016

if (name == tag.getAttribute("name")

1017

and prop._dbus_interface

1018

== if_tag.getAttribute("name")):

1019

annots.update(getattr(

1020

prop, "_dbus_annotations", {}))

1021

for name, value in annots.items():

1022

ann_tag = document.createElement(

1023

"annotation")

1024

ann_tag.setAttribute("name", name)

1025

ann_tag.setAttribute("value", value)

1026

tag.appendChild(ann_tag)

1027

# Add interface annotation tags

1028

for annotation, value in dict(

1029

itertools.chain.from_iterable(

1030

annotations().items()

1031

for name, annotations

1032

in self._get_all_dbus_things("interface")

1033

if name == if_tag.getAttribute("name")

1034

)).items():

1035

ann_tag = document.createElement("annotation")

1036

ann_tag.setAttribute("name", annotation)

1037

ann_tag.setAttribute("value", value)

1038

if_tag.appendChild(ann_tag)

1440

1039

# Add the names to the return values for the

1441

1040

# "org.freedesktop.DBus.Properties" methods

1442

1041

if (if_tag.getAttribute("name")

1460

1059

exc_info=error)

1461

1060

return xmlstring

1462

1061

1463

try:

1464

dbus.OBJECT_MANAGER_IFACE

1465

except AttributeError:

1466

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1467

1468

1469

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1470

"""A D-Bus object with an ObjectManager.

1471

1472

Classes inheriting from this exposes the standard

1473

GetManagedObjects call and the InterfacesAdded and

1474

InterfacesRemoved signals on the standard

1475

"org.freedesktop.DBus.ObjectManager" interface.

1476

1477

Note: No signals are sent automatically; they must be sent

1478

manually.

1479

"""

1480

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1481

out_signature="a{oa{sa{sv}}}")

1482

def GetManagedObjects(self):

1483

"""This function must be overridden"""

1484

raise NotImplementedError()

1485

1486

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1487

signature="oa{sa{sv}}")

1488

def InterfacesAdded(self, object_path, interfaces_and_properties):

1489

pass

1490

1491

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1492

def InterfacesRemoved(self, object_path, interfaces):

1493

pass

1494

1495

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1496

out_signature="s",

1497

path_keyword='object_path',

1498

connection_keyword='connection')

1499

def Introspect(self, object_path, connection):

1500

"""Overloading of standard D-Bus method.

1501

1502

Override return argument name of GetManagedObjects to be

1503

"objpath_interfaces_and_properties"

1504

"""

1505

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1506

object_path,

1507

connection)

1508

try:

1509

document = xml.dom.minidom.parseString(xmlstring)

1510

1511

for if_tag in document.getElementsByTagName("interface"):

1512

# Fix argument name for the GetManagedObjects method

1513

if (if_tag.getAttribute("name")

1514

== dbus.OBJECT_MANAGER_IFACE):

1515

for cn in if_tag.getElementsByTagName("method"):

1516

if (cn.getAttribute("name")

1517

== "GetManagedObjects"):

1518

for arg in cn.getElementsByTagName("arg"):

1519

if (arg.getAttribute("direction")

1520

== "out"):

1521

arg.setAttribute(

1522

"name",

1523

"objpath_interfaces"

1524

"_and_properties")

1525

xmlstring = document.toxml("utf-8")

1526

document.unlink()

1527

except (AttributeError, xml.dom.DOMException,

1528

xml.parsers.expat.ExpatError) as error:

1529

logger.error("Failed to override Introspection method",

1530

exc_info=error)

1531

return xmlstring

1532

1533

1062

1534

1063

def datetime_to_dbus(dt, variant_level=0):

1535

1064

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1536

1065

if dt is None:

1537

return dbus.String("", variant_level=variant_level)

1066

return dbus.String("", variant_level = variant_level)

1538

1067

return dbus.String(dt.isoformat(), variant_level=variant_level)

1539

1068

1540

1069

1543

1072

dbus.service.Object, it will add alternate D-Bus attributes with

1544

1073

interface names according to the "alt_interface_names" mapping.

1545

1074

Usage:

1546

1075

1547

1076

@alternate_dbus_interfaces({"org.example.Interface":

1548

1077

"net.example.AlternateInterface"})

1549

1078

class SampleDBusObject(dbus.service.Object):

1550

1079

@dbus.service.method("org.example.Interface")

1551

1080

def SampleDBusMethod():

1552

1081

pass

1553

1082

1554

1083

The above "SampleDBusMethod" on "SampleDBusObject" will be

1555

1084

reachable via two interfaces: "org.example.Interface" and

1556

1085

"net.example.AlternateInterface", the latter of which will have

1557

1086

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1558

1087

"true", unless "deprecate" is passed with a False value.

1559

1088

1560

1089

This works for methods and signals, and also for D-Bus properties

1561

1090

(from DBusObjectWithProperties) and interfaces (from the

1562

1091

dbus_interface_annotations decorator).

1563

1092

"""

1564

1093

1565

1094

def wrapper(cls):

1566

1095

for orig_interface_name, alt_interface_name in (

1567

1096

alt_interface_names.items()):

1582

1111

interface_names.add(alt_interface)

1583

1112

# Is this a D-Bus signal?

1584

1113

if getattr(attribute, "_dbus_is_signal", False):

1585

# Extract the original non-method undecorated

1586

# function by black magic

1587

if sys.version_info.major == 2:

1114

if sys.version == 2:

1115

# Extract the original non-method undecorated

1116

# function by black magic

1588

1117

nonmethod_func = (dict(

1589

1118

zip(attribute.func_code.co_freevars,

1590

1119

attribute.__closure__))

1591

1120

["func"].cell_contents)

1592

1121

else:

1593

nonmethod_func = (dict(

1594

zip(attribute.__code__.co_freevars,

1595

attribute.__closure__))

1596

["func"].cell_contents)

1122

nonmethod_func = attribute

1597

1123

# Create a new, but exactly alike, function

1598

1124

# object, and decorate it to be a new D-Bus signal

1599

1125

# with the alternate D-Bus interface name

1600

new_function = copy_function(nonmethod_func)

1126

if sys.version == 2:

1127

new_function = types.FunctionType(

1128

nonmethod_func.func_code,

1129

nonmethod_func.func_globals,

1130

nonmethod_func.func_name,

1131

nonmethod_func.func_defaults,

1132

nonmethod_func.func_closure)

1133

else:

1134

new_function = types.FunctionType(

1135

nonmethod_func.__code__,

1136

nonmethod_func.__globals__,

1137

nonmethod_func.__name__,

1138

nonmethod_func.__defaults__,

1139

nonmethod_func.__closure__)

1601

1140

new_function = (dbus.service.signal(

1602

1141

alt_interface,

1603

1142

attribute._dbus_signature)(new_function))

1607

1146

attribute._dbus_annotations)

1608

1147

except AttributeError:

1609

1148

pass

1610

1611

1149

# Define a creator of a function to call both the

1612

1150

# original and alternate functions, so both the

1613

1151

# original and alternate signals gets sent when

1616

1154

"""This function is a scope container to pass

1617

1155

func1 and func2 to the "call_both" function

1618

1156

outside of its arguments"""

1619

1620

@functools.wraps(func2)

1157

1621

1158

def call_both(*args, **kwargs):

1622

1159

"""This function will emit two D-Bus

1623

1160

signals by calling func1 and func2"""

1624

1161

func1(*args, **kwargs)

1625

1162

func2(*args, **kwargs)

1626

# Make wrapper function look like a D-Bus

1627

# signal

1628

for name, attr in inspect.getmembers(func2):

1629

if name.startswith("_dbus_"):

1630

setattr(call_both, name, attr)

1631

1163

1632

1164

return call_both

1633

1165

# Create the "call_both" function and add it to

1634

1166

# the class

1644

1176

alt_interface,

1645

1177

attribute._dbus_in_signature,

1646

1178

attribute._dbus_out_signature)

1647

(copy_function(attribute)))

1179

(types.FunctionType(attribute.func_code,

1180

attribute.func_globals,

1181

attribute.func_name,

1182

attribute.func_defaults,

1183

attribute.func_closure)))

1648

1184

# Copy annotations, if any

1649

1185

try:

1650

1186

attr[attrname]._dbus_annotations = dict(

1662

1198

attribute._dbus_access,

1663

1199

attribute._dbus_get_args_options

1664

1200

["byte_arrays"])

1665

(copy_function(attribute)))

1201

(types.FunctionType(

1202

attribute.func_code,

1203

attribute.func_globals,

1204

attribute.func_name,

1205

attribute.func_defaults,

1206

attribute.func_closure)))

1666

1207

# Copy annotations, if any

1667

1208

try:

1668

1209

attr[attrname]._dbus_annotations = dict(

1677

1218

# to the class.

1678

1219

attr[attrname] = (

1679

1220

dbus_interface_annotations(alt_interface)

1680

(copy_function(attribute)))

1221

(types.FunctionType(attribute.func_code,

1222

attribute.func_globals,

1223

attribute.func_name,

1224

attribute.func_defaults,

1225

attribute.func_closure)))

1681

1226

if deprecate:

1682

1227

# Deprecate all alternate interfaces

1683

iname = "_AlternateDBusNames_interface_annotation{}"

1228

iname="_AlternateDBusNames_interface_annotation{}"

1684

1229

for interface_name in interface_names:

1685

1230

1686

1231

@dbus_interface_annotations(interface_name)

1687

1232

def func(self):

1688

return {"org.freedesktop.DBus.Deprecated":

1689

"true"}

1233

return { "org.freedesktop.DBus.Deprecated":

1234

"true" }

1690

1235

# Find an unused name

1691

1236

for aname in (iname.format(i)

1692

1237

for i in itertools.count()):

1696

1241

if interface_names:

1697

1242

# Replace the class with a new subclass of it with

1698

1243

# methods, signals, etc. as created above.

1699

if sys.version_info.major == 2:

1700

cls = type(b"{}Alternate".format(cls.__name__),

1701

(cls, ), attr)

1702

else:

1703

cls = type("{}Alternate".format(cls.__name__),

1704

(cls, ), attr)

1244

cls = type(b"{}Alternate".format(cls.__name__),

1245

(cls, ), attr)

1705

1246

return cls

1706

1247

1707

1248

return wrapper

1708

1249

1709

1250

1711

1252

"se.bsnet.fukt.Mandos"})

1712

1253

class ClientDBus(Client, DBusObjectWithProperties):

1713

1254

"""A Client class using D-Bus

1714

1255

1715

1256

Attributes:

1716

1257

dbus_object_path: dbus.ObjectPath

1717

1258

bus: dbus.SystemBus()

1718

1259

"""

1719

1260

1720

1261

runtime_expansions = (Client.runtime_expansions

1721

1262

+ ("dbus_object_path", ))

1722

1263

1723

1264

_interface = "se.recompile.Mandos.Client"

1724

1265

1725

1266

# dbus.service.Object doesn't use super(), so we can't either.

1726

1727

def __init__(self, bus=None, *args, **kwargs):

1267

1268

def __init__(self, bus = None, *args, **kwargs):

1728

1269

self.bus = bus

1729

1270

Client.__init__(self, *args, **kwargs)

1730

1271

# Only now, when this client is initialized, can it show up on

1736

1277

"/clients/" + client_object_name)

1737

1278

DBusObjectWithProperties.__init__(self, self.bus,

1738

1279

self.dbus_object_path)

1739

1280

1740

1281

def notifychangeproperty(transform_func, dbus_name,

1741

1282

type_func=lambda x: x,

1742

1283

variant_level=1,

1744

1285

_interface=_interface):

1745

1286

""" Modify a variable so that it's a property which announces

1746

1287

its changes to DBus.

1747

1288

1748

1289

transform_fun: Function that takes a value and a variant_level

1749

1290

and transforms it to a D-Bus type.

1750

1291

dbus_name: D-Bus name of the variable

1753

1294

variant_level: D-Bus variant level. Default: 1

1754

1295

"""

1755

1296

attrname = "_{}".format(dbus_name)

1756

1297

1757

1298

def setter(self, value):

1758

1299

if hasattr(self, "dbus_object_path"):

1759

1300

if (not hasattr(self, attrname) or

1766

1307

else:

1767

1308

dbus_value = transform_func(

1768

1309

type_func(value),

1769

variant_level=variant_level)

1310

variant_level = variant_level)

1770

1311

self.PropertyChanged(dbus.String(dbus_name),

1771

1312

dbus_value)

1772

1313

self.PropertiesChanged(

1773

1314

_interface,

1774

dbus.Dictionary({dbus.String(dbus_name):

1775

dbus_value}),

1315

dbus.Dictionary({ dbus.String(dbus_name):

1316

dbus_value }),

1776

1317

dbus.Array())

1777

1318

setattr(self, attrname, value)

1778

1319

1779

1320

return property(lambda self: getattr(self, attrname), setter)

1780

1321

1781

1322

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1782

1323

approvals_pending = notifychangeproperty(dbus.Boolean,

1783

1324

"ApprovalPending",

1784

type_func=bool)

1325

type_func = bool)

1785

1326

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1786

1327

last_enabled = notifychangeproperty(datetime_to_dbus,

1787

1328

"LastEnabled")

1788

1329

checker = notifychangeproperty(

1789

1330

dbus.Boolean, "CheckerRunning",

1790

type_func=lambda checker: checker is not None)

1331

type_func = lambda checker: checker is not None)

1791

1332

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1792

1333

"LastCheckedOK")

1793

1334

last_checker_status = notifychangeproperty(dbus.Int16,

1798

1339

"ApprovedByDefault")

1799

1340

approval_delay = notifychangeproperty(

1800

1341

dbus.UInt64, "ApprovalDelay",

1801

type_func=lambda td: td.total_seconds() * 1000)

1342

type_func = lambda td: td.total_seconds() * 1000)

1802

1343

approval_duration = notifychangeproperty(

1803

1344

dbus.UInt64, "ApprovalDuration",

1804

type_func=lambda td: td.total_seconds() * 1000)

1345

type_func = lambda td: td.total_seconds() * 1000)

1805

1346

host = notifychangeproperty(dbus.String, "Host")

1806

1347

timeout = notifychangeproperty(

1807

1348

dbus.UInt64, "Timeout",

1808

type_func=lambda td: td.total_seconds() * 1000)

1349

type_func = lambda td: td.total_seconds() * 1000)

1809

1350

extended_timeout = notifychangeproperty(

1810

1351

dbus.UInt64, "ExtendedTimeout",

1811

type_func=lambda td: td.total_seconds() * 1000)

1352

type_func = lambda td: td.total_seconds() * 1000)

1812

1353

interval = notifychangeproperty(

1813

1354

dbus.UInt64, "Interval",

1814

type_func=lambda td: td.total_seconds() * 1000)

1355

type_func = lambda td: td.total_seconds() * 1000)

1815

1356

checker_command = notifychangeproperty(dbus.String, "Checker")

1816

1357

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1817

1358

invalidate_only=True)

1818

1359

1819

1360

del notifychangeproperty

1820

1361

1821

1362

def __del__(self, *args, **kwargs):

1822

1363

try:

1823

1364

self.remove_from_connection()

1826

1367

if hasattr(DBusObjectWithProperties, "__del__"):

1827

1368

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1828

1369

Client.__del__(self, *args, **kwargs)

1829

1830

def checker_callback(self, source, condition,

1831

connection, command, *args, **kwargs):

1832

ret = Client.checker_callback(self, source, condition,

1833

connection, command, *args,

1834

**kwargs)

1835

exitstatus = self.last_checker_status

1836

if exitstatus >= 0:

1370

1371

def checker_callback(self, pid, condition, command,

1372

*args, **kwargs):

1373

self.checker_callback_tag = None

1374

self.checker = None

1375

if os.WIFEXITED(condition):

1376

exitstatus = os.WEXITSTATUS(condition)

1837

1377

# Emit D-Bus signal

1838

1378

self.CheckerCompleted(dbus.Int16(exitstatus),

1839

# This is specific to GNU libC

1840

dbus.Int64(exitstatus << 8),

1379

dbus.Int64(condition),

1841

1380

dbus.String(command))

1842

1381

else:

1843

1382

# Emit D-Bus signal

1844

1383

self.CheckerCompleted(dbus.Int16(-1),

1845

dbus.Int64(

1846

# This is specific to GNU libC

1847

(exitstatus << 8)

1848

| self.last_checker_signal),

1384

dbus.Int64(condition),

1849

1385

dbus.String(command))

1850

return ret

1851

1386

1387

return Client.checker_callback(self, pid, condition, command,

1388

*args, **kwargs)

1389

1852

1390

def start_checker(self, *args, **kwargs):

1853

1391

old_checker_pid = getattr(self.checker, "pid", None)

1854

1392

r = Client.start_checker(self, *args, **kwargs)

1858

1396

# Emit D-Bus signal

1859

1397

self.CheckerStarted(self.current_checker_command)

1860

1398

return r

1861

1399

1862

1400

def _reset_approved(self):

1863

1401

self.approved = None

1864

1402

return False

1865

1403

1866

1404

def approve(self, value=True):

1867

1405

self.approved = value

1868

GLib.timeout_add(int(self.approval_duration.total_seconds()

1869

* 1000), self._reset_approved)

1406

gobject.timeout_add(int(self.approval_duration.total_seconds()

1407

* 1000), self._reset_approved)

1870

1408

self.send_changedstate()

1871

1872

# D-Bus methods, signals & properties

1873

1874

# Interfaces

1875

1876

# Signals

1877

1409

1410

## D-Bus methods, signals & properties

1411

1412

## Interfaces

1413

1414

## Signals

1415

1878

1416

# CheckerCompleted - signal

1879

1417

@dbus.service.signal(_interface, signature="nxs")

1880

1418

def CheckerCompleted(self, exitcode, waitstatus, command):

1881

1419

"D-Bus signal"

1882

1420

pass

1883

1421

1884

1422

# CheckerStarted - signal

1885

1423

@dbus.service.signal(_interface, signature="s")

1886

1424

def CheckerStarted(self, command):

1887

1425

"D-Bus signal"

1888

1426

pass

1889

1427

1890

1428

# PropertyChanged - signal

1891

1429

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1892

1430

@dbus.service.signal(_interface, signature="sv")

1893

1431

def PropertyChanged(self, property, value):

1894

1432

"D-Bus signal"

1895

1433

pass

1896

1434

1897

1435

# GotSecret - signal

1898

1436

@dbus.service.signal(_interface)

1899

1437

def GotSecret(self):

1902

1440

server to mandos-client

1903

1441

"""

1904

1442

pass

1905

1443

1906

1444

# Rejected - signal

1907

1445

@dbus.service.signal(_interface, signature="s")

1908

1446

def Rejected(self, reason):

1909

1447

"D-Bus signal"

1910

1448

pass

1911

1449

1912

1450

# NeedApproval - signal

1913

1451

@dbus.service.signal(_interface, signature="tb")

1914

1452

def NeedApproval(self, timeout, default):

1915

1453

"D-Bus signal"

1916

1454

return self.need_approval()

1917

1918

# Methods

1919

1455

1456

## Methods

1457

1920

1458

# Approve - method

1921

1459

@dbus.service.method(_interface, in_signature="b")

1922

1460

def Approve(self, value):

1923

1461

self.approve(value)

1924

1462

1925

1463

# CheckedOK - method

1926

1464

@dbus.service.method(_interface)

1927

1465

def CheckedOK(self):

1928

1466

self.checked_ok()

1929

1467

1930

1468

# Enable - method

1931

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1932

1469

@dbus.service.method(_interface)

1933

1470

def Enable(self):

1934

1471

"D-Bus method"

1935

1472

self.enable()

1936

1473

1937

1474

# StartChecker - method

1938

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1939

1475

@dbus.service.method(_interface)

1940

1476

def StartChecker(self):

1941

1477

"D-Bus method"

1942

1478

self.start_checker()

1943

1479

1944

1480

# Disable - method

1945

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1946

1481

@dbus.service.method(_interface)

1947

1482

def Disable(self):

1948

1483

"D-Bus method"

1949

1484

self.disable()

1950

1485

1951

1486

# StopChecker - method

1952

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1953

1487

@dbus.service.method(_interface)

1954

1488

def StopChecker(self):

1955

1489

self.stop_checker()

1956

1957

# Properties

1958

1490

1491

## Properties

1492

1959

1493

# ApprovalPending - property

1960

1494

@dbus_service_property(_interface, signature="b", access="read")

1961

1495

def ApprovalPending_dbus_property(self):

1962

1496

return dbus.Boolean(bool(self.approvals_pending))

1963

1497

1964

1498

# ApprovedByDefault - property

1965

1499

@dbus_service_property(_interface,

1966

1500

signature="b",

1969

1503

if value is None: # get

1970

1504

return dbus.Boolean(self.approved_by_default)

1971

1505

self.approved_by_default = bool(value)

1972

1506

1973

1507

# ApprovalDelay - property

1974

1508

@dbus_service_property(_interface,

1975

1509

signature="t",

1979

1513

return dbus.UInt64(self.approval_delay.total_seconds()

1980

1514

* 1000)

1981

1515

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1982

1516

1983

1517

# ApprovalDuration - property

1984

1518

@dbus_service_property(_interface,

1985

1519

signature="t",

1989

1523

return dbus.UInt64(self.approval_duration.total_seconds()

1990

1524

* 1000)

1991

1525

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1992

1526

1993

1527

# Name - property

1994

@dbus_annotations(

1995

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1996

1528

@dbus_service_property(_interface, signature="s", access="read")

1997

1529

def Name_dbus_property(self):

1998

1530

return dbus.String(self.name)

1999

1531

2000

1532

# Fingerprint - property

2001

@dbus_annotations(

2002

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2003

1533

@dbus_service_property(_interface, signature="s", access="read")

2004

1534

def Fingerprint_dbus_property(self):

2005

1535

return dbus.String(self.fingerprint)

2006

1536

2007

1537

# Host - property

2008

1538

@dbus_service_property(_interface,

2009

1539

signature="s",

2012

1542

if value is None: # get

2013

1543

return dbus.String(self.host)

2014

1544

self.host = str(value)

2015

1545

2016

1546

# Created - property

2017

@dbus_annotations(

2018

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2019

1547

@dbus_service_property(_interface, signature="s", access="read")

2020

1548

def Created_dbus_property(self):

2021

1549

return datetime_to_dbus(self.created)

2022

1550

2023

1551

# LastEnabled - property

2024

1552

@dbus_service_property(_interface, signature="s", access="read")

2025

1553

def LastEnabled_dbus_property(self):

2026

1554

return datetime_to_dbus(self.last_enabled)

2027

1555

2028

1556

# Enabled - property

2029

1557

@dbus_service_property(_interface,

2030

1558

signature="b",

2036

1564

self.enable()

2037

1565

else:

2038

1566

self.disable()

2039

1567

2040

1568

# LastCheckedOK - property

2041

1569

@dbus_service_property(_interface,

2042

1570

signature="s",

2046

1574

self.checked_ok()

2047

1575

return

2048

1576

return datetime_to_dbus(self.last_checked_ok)

2049

1577

2050

1578

# LastCheckerStatus - property

2051

1579

@dbus_service_property(_interface, signature="n", access="read")

2052

1580

def LastCheckerStatus_dbus_property(self):

2053

1581

return dbus.Int16(self.last_checker_status)

2054

1582

2055

1583

# Expires - property

2056

1584

@dbus_service_property(_interface, signature="s", access="read")

2057

1585

def Expires_dbus_property(self):

2058

1586

return datetime_to_dbus(self.expires)

2059

1587

2060

1588

# LastApprovalRequest - property

2061

1589

@dbus_service_property(_interface, signature="s", access="read")

2062

1590

def LastApprovalRequest_dbus_property(self):

2063

1591

return datetime_to_dbus(self.last_approval_request)

2064

1592

2065

1593

# Timeout - property

2066

1594

@dbus_service_property(_interface,

2067

1595

signature="t",

2082

1610

if (getattr(self, "disable_initiator_tag", None)

2083

1611

is None):

2084

1612

return

2085

GLib.source_remove(self.disable_initiator_tag)

2086

self.disable_initiator_tag = GLib.timeout_add(

1613

gobject.source_remove(self.disable_initiator_tag)

1614

self.disable_initiator_tag = gobject.timeout_add(

2087

1615

int((self.expires - now).total_seconds() * 1000),

2088

1616

self.disable)

2089

1617

2090

1618

# ExtendedTimeout - property

2091

1619

@dbus_service_property(_interface,

2092

1620

signature="t",

2096

1624

return dbus.UInt64(self.extended_timeout.total_seconds()

2097

1625

* 1000)

2098

1626

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2099

1627

2100

1628

# Interval - property

2101

1629

@dbus_service_property(_interface,

2102

1630

signature="t",

2109

1637

return

2110

1638

if self.enabled:

2111

1639

# Reschedule checker run

2112

GLib.source_remove(self.checker_initiator_tag)

2113

self.checker_initiator_tag = GLib.timeout_add(

1640

gobject.source_remove(self.checker_initiator_tag)

1641

self.checker_initiator_tag = gobject.timeout_add(

2114

1642

value, self.start_checker)

2115

self.start_checker() # Start one now, too

2116

1643

self.start_checker() # Start one now, too

1644

2117

1645

# Checker - property

2118

1646

@dbus_service_property(_interface,

2119

1647

signature="s",

2122

1650

if value is None: # get

2123

1651

return dbus.String(self.checker_command)

2124

1652

self.checker_command = str(value)

2125

1653

2126

1654

# CheckerRunning - property

2127

1655

@dbus_service_property(_interface,

2128

1656

signature="b",

2134

1662

self.start_checker()

2135

1663

else:

2136

1664

self.stop_checker()

2137

1665

2138

1666

# ObjectPath - property

2139

@dbus_annotations(

2140

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2141

"org.freedesktop.DBus.Deprecated": "true"})

2142

1667

@dbus_service_property(_interface, signature="o", access="read")

2143

1668

def ObjectPath_dbus_property(self):

2144

return self.dbus_object_path # is already a dbus.ObjectPath

2145

1669

return self.dbus_object_path # is already a dbus.ObjectPath

1670

2146

1671

# Secret = property

2147

@dbus_annotations(

2148

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2149

"invalidates"})

2150

1672

@dbus_service_property(_interface,

2151

1673

signature="ay",

2152

1674

access="write",

2153

1675

byte_arrays=True)

2154

1676

def Secret_dbus_property(self, value):

2155

1677

self.secret = bytes(value)

2156

1678

2157

1679

del _interface

2158

1680

2159

1681

2163

1685

self._pipe.send(('init', fpr, address))

2164

1686

if not self._pipe.recv():

2165

1687

raise KeyError(fpr)

2166

1688

2167

1689

def __getattribute__(self, name):

2168

1690

if name == '_pipe':

2169

1691

return super(ProxyClient, self).__getattribute__(name)

2172

1694

if data[0] == 'data':

2173

1695

return data[1]

2174

1696

if data[0] == 'function':

2175

1697

2176

1698

def func(*args, **kwargs):

2177

1699

self._pipe.send(('funcall', name, args, kwargs))

2178

1700

return self._pipe.recv()[1]

2179

1701

2180

1702

return func

2181

1703

2182

1704

def __setattr__(self, name, value):

2183

1705

if name == '_pipe':

2184

1706

return super(ProxyClient, self).__setattr__(name, value)

2187

1709

2188

1710

class ClientHandler(socketserver.BaseRequestHandler, object):

2189

1711

"""A class to handle client connections.

2190

1712

2191

1713

Instantiated once for each connection to handle it.

2192

1714

Note: This will run in its own forked process."""

2193

1715

2194

1716

def handle(self):

2195

1717

with contextlib.closing(self.server.child_pipe) as child_pipe:

2196

1718

logger.info("TCP connection from: %s",

2197

1719

str(self.client_address))

2198

1720

logger.debug("Pipe FD: %d",

2199

1721

self.server.child_pipe.fileno())

2200

2201

session = gnutls.ClientSession(self.request)

2202

2203

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2204

# "+AES-256-CBC", "+SHA1",

2205

# "+COMP-NULL", "+CTYPE-OPENPGP",

2206

# "+DHE-DSS"))

1722

1723

session = gnutls.connection.ClientSession(

1724

self.request, gnutls.connection .X509Credentials())

1725

1726

# Note: gnutls.connection.X509Credentials is really a

1727

# generic GnuTLS certificate credentials object so long as

1728

# no X.509 keys are added to it. Therefore, we can use it

1729

# here despite using OpenPGP certificates.

1730

1731

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1732

# "+AES-256-CBC", "+SHA1",

1733

# "+COMP-NULL", "+CTYPE-OPENPGP",

1734

# "+DHE-DSS"))

2207

1735

# Use a fallback default, since this MUST be set.

2208

1736

priority = self.server.gnutls_priority

2209

1737

if priority is None:

2210

1738

priority = "NORMAL"

2211

gnutls.priority_set_direct(session._c_object,

2212

priority.encode("utf-8"),

2213

None)

2214

1739

gnutls.library.functions.gnutls_priority_set_direct(

1740

session._c_object, priority, None)

1741

2215

1742

# Start communication using the Mandos protocol

2216

1743

# Get protocol number

2217

1744

line = self.request.makefile().readline()

2222

1749

except (ValueError, IndexError, RuntimeError) as error:

2223

1750

logger.error("Unknown protocol version: %s", error)

2224

1751

return

2225

1752

2226

1753

# Start GnuTLS connection

2227

1754

try:

2228

1755

session.handshake()

2229

except gnutls.Error as error:

1756

except gnutls.errors.GNUTLSError as error:

2230

1757

logger.warning("Handshake failed: %s", error)

2231

1758

# Do not run session.bye() here: the session is not

2232

1759

# established. Just abandon the request.

2233

1760

return

2234

1761

logger.debug("Handshake succeeded")

2235

1762

2236

1763

approval_required = False

2237

1764

try:

2238

1765

try:

2239

1766

fpr = self.fingerprint(

2240

1767

self.peer_certificate(session))

2241

except (TypeError, gnutls.Error) as error:

1768

except (TypeError,

1769

gnutls.errors.GNUTLSError) as error:

2242

1770

logger.warning("Bad certificate: %s", error)

2243

1771

return

2244

1772

logger.debug("Fingerprint: %s", fpr)

2245

1773

2246

1774

try:

2247

1775

client = ProxyClient(child_pipe, fpr,

2248

1776

self.client_address)

2249

1777

except KeyError:

2250

1778

return

2251

1779

2252

1780

if client.approval_delay:

2253

1781

delay = client.approval_delay

2254

1782

client.approvals_pending += 1

2255

1783

approval_required = True

2256

1784

2257

1785

while True:

2258

1786

if not client.enabled:

2259

1787

logger.info("Client %s is disabled",

2262

1790

# Emit D-Bus signal

2263

1791

client.Rejected("Disabled")

2264

1792

return

2265

1793

2266

1794

if client.approved or not client.approval_delay:

2267

# We are approved or approval is disabled

1795

#We are approved or approval is disabled

2268

1796

break

2269

1797

elif client.approved is None:

2270

1798

logger.info("Client %s needs approval",

2281

1809

# Emit D-Bus signal

2282

1810

client.Rejected("Denied")

2283

1811

return

2284

2285

# wait until timeout or approved

1812

1813

#wait until timeout or approved

2286

1814

time = datetime.datetime.now()

2287

1815

client.changedstate.acquire()

2288

1816

client.changedstate.wait(delay.total_seconds())

2301

1829

break

2302

1830

else:

2303

1831

delay -= time2 - time

2304

2305

try:

2306

session.send(client.secret)

2307

except gnutls.Error as error:

2308

logger.warning("gnutls send failed",

2309

exc_info=error)

2310

return

2311

1832

1833

sent_size = 0

1834

while sent_size < len(client.secret):

1835

try:

1836

sent = session.send(client.secret[sent_size:])

1837

except gnutls.errors.GNUTLSError as error:

1838

logger.warning("gnutls send failed",

1839

exc_info=error)

1840

return

1841

logger.debug("Sent: %d, remaining: %d", sent,

1842

len(client.secret) - (sent_size

1843

+ sent))

1844

sent_size += sent

1845

2312

1846

logger.info("Sending secret to %s", client.name)

2313

1847

# bump the timeout using extended_timeout

2314

1848

client.bump_timeout(client.extended_timeout)

2315

1849

if self.server.use_dbus:

2316

1850

# Emit D-Bus signal

2317

1851

client.GotSecret()

2318

1852

2319

1853

finally:

2320

1854

if approval_required:

2321

1855

client.approvals_pending -= 1

2322

1856

try:

2323

1857

session.bye()

2324

except gnutls.Error as error:

1858

except gnutls.errors.GNUTLSError as error:

2325

1859

logger.warning("GnuTLS bye failed",

2326

1860

exc_info=error)

2327

1861

2328

1862

@staticmethod

2329

1863

def peer_certificate(session):

2330

1864

"Return the peer's OpenPGP certificate as a bytestring"

2331

1865

# If not an OpenPGP certificate...

2332

if (gnutls.certificate_type_get(session._c_object)

2333

!= gnutls.CRT_OPENPGP):

2334

# ...return invalid data

2335

return b""

1866

if (gnutls.library.functions.gnutls_certificate_type_get(

1867

session._c_object)

1868

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1869

# ...do the normal thing

1870

return session.peer_certificate

2336

1871

list_size = ctypes.c_uint(1)

2337

cert_list = (gnutls.certificate_get_peers

1872

cert_list = (gnutls.library.functions

1873

.gnutls_certificate_get_peers

2338

1874

(session._c_object, ctypes.byref(list_size)))

2339

1875

if not bool(cert_list) and list_size.value != 0:

2340

raise gnutls.Error("error getting peer certificate")

1876

raise gnutls.errors.GNUTLSError("error getting peer"

1877

" certificate")

2341

1878

if list_size.value == 0:

2342

1879

return None

2343

1880

cert = cert_list[0]

2344

1881

return ctypes.string_at(cert.data, cert.size)

2345

1882

2346

1883

@staticmethod

2347

1884

def fingerprint(openpgp):

2348

1885

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2349

1886

# New GnuTLS "datum" with the OpenPGP public key

2350

datum = gnutls.datum_t(

1887

datum = gnutls.library.types.gnutls_datum_t(

2351

1888

ctypes.cast(ctypes.c_char_p(openpgp),

2352

1889

ctypes.POINTER(ctypes.c_ubyte)),

2353

1890

ctypes.c_uint(len(openpgp)))

2354

1891

# New empty GnuTLS certificate

2355

crt = gnutls.openpgp_crt_t()

2356

gnutls.openpgp_crt_init(ctypes.byref(crt))

1892

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1893

gnutls.library.functions.gnutls_openpgp_crt_init(

1894

ctypes.byref(crt))

2357

1895

# Import the OpenPGP public key into the certificate

2358

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2359

gnutls.OPENPGP_FMT_RAW)

1896

gnutls.library.functions.gnutls_openpgp_crt_import(

1897

crt, ctypes.byref(datum),

1898

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

2360

1899

# Verify the self signature in the key

2361

1900

crtverify = ctypes.c_uint()

2362

gnutls.openpgp_crt_verify_self(crt, 0,

2363

ctypes.byref(crtverify))

1901

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1902

crt, 0, ctypes.byref(crtverify))

2364

1903

if crtverify.value != 0:

2365

gnutls.openpgp_crt_deinit(crt)

2366

raise gnutls.CertificateSecurityError("Verify failed")

1904

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1905

raise gnutls.errors.CertificateSecurityError(

1906

"Verify failed")

2367

1907

# New buffer for the fingerprint

2368

1908

buf = ctypes.create_string_buffer(20)

2369

1909

buf_len = ctypes.c_size_t()

2370

1910

# Get the fingerprint from the certificate into the buffer

2371

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2372

ctypes.byref(buf_len))

1911

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1912

crt, ctypes.byref(buf), ctypes.byref(buf_len))

2373

1913

# Deinit the certificate

2374

gnutls.openpgp_crt_deinit(crt)

1914

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2375

1915

# Convert the buffer to a Python bytestring

2376

1916

fpr = ctypes.string_at(buf, buf_len.value)

2377

1917

# Convert the bytestring to hexadecimal notation

2381

1921

2382

1922

class MultiprocessingMixIn(object):

2383

1923

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2384

1924

2385

1925

def sub_process_main(self, request, address):

2386

1926

try:

2387

1927

self.finish_request(request, address)

2388

1928

except Exception:

2389

1929

self.handle_error(request, address)

2390

1930

self.close_request(request)

2391

1931

2392

1932

def process_request(self, request, address):

2393

1933

"""Start a new process to process the request."""

2394

proc = multiprocessing.Process(target=self.sub_process_main,

2395

args=(request, address))

1934

proc = multiprocessing.Process(target = self.sub_process_main,

1935

args = (request, address))

2396

1936

proc.start()

2397

1937

return proc

2398

1938

2399

1939

2400

1940

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2401

1941

""" adds a pipe to the MixIn """

2402

1942

2403

1943

def process_request(self, request, client_address):

2404

1944

"""Overrides and wraps the original process_request().

2405

1945

2406

1946

This function creates a new pipe in self.pipe

2407

1947

"""

2408

1948

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2409

1949

2410

1950

proc = MultiprocessingMixIn.process_request(self, request,

2411

1951

client_address)

2412

1952

self.child_pipe.close()

2413

1953

self.add_pipe(parent_pipe, proc)

2414

1954

2415

1955

def add_pipe(self, parent_pipe, proc):

2416

1956

"""Dummy function; override as necessary"""

2417

1957

raise NotImplementedError()

2420

1960

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2421

1961

socketserver.TCPServer, object):

2422

1962

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2423

1963

2424

1964

Attributes:

2425

1965

enabled: Boolean; whether this server is activated yet

2426

1966

interface: None or a network interface name (string)

2427

1967

use_ipv6: Boolean; to use IPv6 or not

2428

1968

"""

2429

1969

2430

1970

def __init__(self, server_address, RequestHandlerClass,

2431

1971

interface=None,

2432

1972

use_ipv6=True,

2442

1982

self.socketfd = socketfd

2443

1983

# Save the original socket.socket() function

2444

1984

self.socket_socket = socket.socket

2445

2446

1985

# To implement --socket, we monkey patch socket.socket.

2447

#

1986

#

2448

1987

# (When socketserver.TCPServer is a new-style class, we

2449

1988

# could make self.socket into a property instead of monkey

2450

1989

# patching socket.socket.)

2451

#

1990

#

2452

1991

# Create a one-time-only replacement for socket.socket()

2453

1992

@functools.wraps(socket.socket)

2454

1993

def socket_wrapper(*args, **kwargs):

2466

2005

# socket_wrapper(), if socketfd was set.

2467

2006

socketserver.TCPServer.__init__(self, server_address,

2468

2007

RequestHandlerClass)

2469

2008

2470

2009

def server_bind(self):

2471

2010

"""This overrides the normal server_bind() function

2472

2011

to bind to an interface if one was specified, and also NOT to

2473

2012

bind to an address or port if they were not specified."""

2474

global SO_BINDTODEVICE

2475

2013

if self.interface is not None:

2476

2014

if SO_BINDTODEVICE is None:

2477

# Fall back to a hard-coded value which seems to be

2478

# common enough.

2479

logger.warning("SO_BINDTODEVICE not found, trying 25")

2480

SO_BINDTODEVICE = 25

2481

try:

2482

self.socket.setsockopt(

2483

socket.SOL_SOCKET, SO_BINDTODEVICE,

2484

(self.interface + "\0").encode("utf-8"))

2485

except socket.error as error:

2486

if error.errno == errno.EPERM:

2487

logger.error("No permission to bind to"

2488

" interface %s", self.interface)

2489

elif error.errno == errno.ENOPROTOOPT:

2490

logger.error("SO_BINDTODEVICE not available;"

2491

" cannot bind to interface %s",

2492

self.interface)

2493

elif error.errno == errno.ENODEV:

2494

logger.error("Interface %s does not exist,"

2495

" cannot bind", self.interface)

2496

else:

2497

raise

2015

logger.error("SO_BINDTODEVICE does not exist;"

2016

" cannot bind to interface %s",

2017

self.interface)

2018

else:

2019

try:

2020

self.socket.setsockopt(

2021

socket.SOL_SOCKET, SO_BINDTODEVICE,

2022

(self.interface + "\0").encode("utf-8"))

2023

except socket.error as error:

2024

if error.errno == errno.EPERM:

2025

logger.error("No permission to bind to"

2026

" interface %s", self.interface)

2027

elif error.errno == errno.ENOPROTOOPT:

2028

logger.error("SO_BINDTODEVICE not available;"

2029

" cannot bind to interface %s",

2030

self.interface)

2031

elif error.errno == errno.ENODEV:

2032

logger.error("Interface %s does not exist,"

2033

" cannot bind", self.interface)

2034

else:

2035

raise

2498

2036

# Only bind(2) the socket if we really need to.

2499

2037

if self.server_address[0] or self.server_address[1]:

2500

2038

if not self.server_address[0]:

2501

2039

if self.address_family == socket.AF_INET6:

2502

any_address = "::" # in6addr_any

2040

any_address = "::" # in6addr_any

2503

2041

else:

2504

any_address = "0.0.0.0" # INADDR_ANY

2042

any_address = "0.0.0.0" # INADDR_ANY

2505

2043

self.server_address = (any_address,

2506

2044

self.server_address[1])

2507

2045

elif not self.server_address[1]:

2517

2055

2518

2056

class MandosServer(IPv6_TCPServer):

2519

2057

"""Mandos server.

2520

2058

2521

2059

Attributes:

2522

2060

clients: set of Client objects

2523

2061

gnutls_priority GnuTLS priority string

2524

2062

use_dbus: Boolean; to emit D-Bus signals or not

2525

2526

Assumes a GLib.MainLoop event loop.

2063

2064

Assumes a gobject.MainLoop event loop.

2527

2065

"""

2528

2066

2529

2067

def __init__(self, server_address, RequestHandlerClass,

2530

2068

interface=None,

2531

2069

use_ipv6=True,

2541

2079

self.gnutls_priority = gnutls_priority

2542

2080

IPv6_TCPServer.__init__(self, server_address,

2543

2081

RequestHandlerClass,

2544

interface=interface,

2545

use_ipv6=use_ipv6,

2546

socketfd=socketfd)

2547

2082

interface = interface,

2083

use_ipv6 = use_ipv6,

2084

socketfd = socketfd)

2085

2548

2086

def server_activate(self):

2549

2087

if self.enabled:

2550

2088

return socketserver.TCPServer.server_activate(self)

2551

2089

2552

2090

def enable(self):

2553

2091

self.enabled = True

2554

2092

2555

2093

def add_pipe(self, parent_pipe, proc):

2556

2094

# Call "handle_ipc" for both data and EOF events

2557

GLib.io_add_watch(

2095

gobject.io_add_watch(

2558

2096

parent_pipe.fileno(),

2559

GLib.IO_IN | GLib.IO_HUP,

2097

gobject.IO_IN | gobject.IO_HUP,

2560

2098

functools.partial(self.handle_ipc,

2561

parent_pipe=parent_pipe,

2562

proc=proc))

2563

2099

parent_pipe = parent_pipe,

2100

proc = proc))

2101

2564

2102

def handle_ipc(self, source, condition,

2565

2103

parent_pipe=None,

2566

proc=None,

2104

proc = None,

2567

2105

client_object=None):

2568

2106

# error, or the other end of multiprocessing.Pipe has closed

2569

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2107

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2570

2108

# Wait for other process to exit

2571

2109

proc.join()

2572

2110

return False

2573

2111

2574

2112

# Read a request from the child

2575

2113

request = parent_pipe.recv()

2576

2114

command = request[0]

2577

2115

2578

2116

if command == 'init':

2579

2117

fpr = request[1]

2580

2118

address = request[2]

2581

2582

for c in self.clients.values():

2119

2120

for c in self.clients.itervalues():

2583

2121

if c.fingerprint == fpr:

2584

2122

client = c

2585

2123

break

2592

2130

address[0])

2593

2131

parent_pipe.send(False)

2594

2132

return False

2595

2596

GLib.io_add_watch(

2133

2134

gobject.io_add_watch(

2597

2135

parent_pipe.fileno(),

2598

GLib.IO_IN | GLib.IO_HUP,

2136

gobject.IO_IN | gobject.IO_HUP,

2599

2137

functools.partial(self.handle_ipc,

2600

parent_pipe=parent_pipe,

2601

proc=proc,

2602

client_object=client))

2138

parent_pipe = parent_pipe,

2139

proc = proc,

2140

client_object = client))

2603

2141

parent_pipe.send(True)

2604

2142

# remove the old hook in favor of the new above hook on

2605

2143

# same fileno

2608

2146

funcname = request[1]

2609

2147

args = request[2]

2610

2148

kwargs = request[3]

2611

2149

2612

2150

parent_pipe.send(('data', getattr(client_object,

2613

2151

funcname)(*args,

2614

2152

**kwargs)))

2615

2153

2616

2154

if command == 'getattr':

2617

2155

attrname = request[1]

2618

if isinstance(client_object.__getattribute__(attrname),

2619

collections.Callable):

2156

if callable(client_object.__getattribute__(attrname)):

2620

2157

parent_pipe.send(('function', ))

2621

2158

else:

2622

2159

parent_pipe.send((

2623

2160

'data', client_object.__getattribute__(attrname)))

2624

2161

2625

2162

if command == 'setattr':

2626

2163

attrname = request[1]

2627

2164

value = request[2]

2628

2165

setattr(client_object, attrname, value)

2629

2166

2630

2167

return True

2631

2168

2632

2169

2633

2170

def rfc3339_duration_to_delta(duration):

2634

2171

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2635

2172

2636

2173

>>> rfc3339_duration_to_delta("P7D")

2637

2174

datetime.timedelta(7)

2638

2175

>>> rfc3339_duration_to_delta("PT60S")

2648

2185

>>> rfc3339_duration_to_delta("P1DT3M20S")

2649

2186

datetime.timedelta(1, 200)

2650

2187

"""

2651

2188

2652

2189

# Parsing an RFC 3339 duration with regular expressions is not

2653

2190

# possible - there would have to be multiple places for the same

2654

2191

# values, like seconds. The current code, while more esoteric, is

2655

2192

# cleaner without depending on a parsing library. If Python had a

2656

2193

# built-in library for parsing we would use it, but we'd like to

2657

2194

# avoid excessive use of external libraries.

2658

2195

2659

2196

# New type for defining tokens, syntax, and semantics all-in-one

2660

2197

Token = collections.namedtuple("Token", (

2661

2198

"regexp", # To match token; if "value" is not None, must have

2694

2231

frozenset((token_year, token_month,

2695

2232

token_day, token_time,

2696

2233

token_week)))

2697

# Define starting values:

2698

# Value so far

2699

value = datetime.timedelta()

2234

# Define starting values

2235

value = datetime.timedelta() # Value so far

2700

2236

found_token = None

2701

# Following valid tokens

2702

followers = frozenset((token_duration, ))

2703

# String left to parse

2704

s = duration

2237

followers = frozenset((token_duration, )) # Following valid tokens

2238

s = duration # String left to parse

2705

2239

# Loop until end token is found

2706

2240

while found_token is not token_end:

2707

2241

# Search for any currently valid tokens

2731

2265

2732

2266

def string_to_delta(interval):

2733

2267

"""Parse a string and return a datetime.timedelta

2734

2268

2735

2269

>>> string_to_delta('7d')

2736

2270

datetime.timedelta(7)

2737

2271

>>> string_to_delta('60s')

2745

2279

>>> string_to_delta('5m 30s')

2746

2280

datetime.timedelta(0, 330)

2747

2281

"""

2748

2282

2749

2283

try:

2750

2284

return rfc3339_duration_to_delta(interval)

2751

2285

except ValueError:

2752

2286

pass

2753

2287

2754

2288

timevalue = datetime.timedelta(0)

2755

2289

for s in interval.split():

2756

2290

try:

2774

2308

return timevalue

2775

2309

2776

2310

2777

def daemon(nochdir=False, noclose=False):

2311

def daemon(nochdir = False, noclose = False):

2778

2312

"""See daemon(3). Standard BSD Unix function.

2779

2313

2780

2314

This should really exist as os.daemon, but it doesn't (yet)."""

2781

2315

if os.fork():

2782

2316

sys.exit()

2800

2334

2801

2335

2802

2336

def main():

2803

2337

2804

2338

##################################################################

2805

2339

# Parsing of options, both command line and config file

2806

2340

2807

2341

parser = argparse.ArgumentParser()

2808

2342

parser.add_argument("-v", "--version", action="version",

2809

version="%(prog)s {}".format(version),

2343

version = "%(prog)s {}".format(version),

2810

2344

help="show version number and exit")

2811

2345

parser.add_argument("-i", "--interface", metavar="IF",

2812

2346

help="Bind to interface IF")

2848

2382

parser.add_argument("--no-zeroconf", action="store_false",

2849

2383

dest="zeroconf", help="Do not use Zeroconf",

2850

2384

default=None)

2851

2385

2852

2386

options = parser.parse_args()

2853

2387

2854

2388

if options.check:

2855

2389

import doctest

2856

2390

fail_count, test_count = doctest.testmod()

2857

2391

sys.exit(os.EX_OK if fail_count == 0 else 1)

2858

2392

2859

2393

# Default values for config file for server-global settings

2860

server_defaults = {"interface": "",

2861

"address": "",

2862

"port": "",

2863

"debug": "False",

2864

"priority":

2865

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2866

":+SIGN-DSA-SHA256",

2867

"servicename": "Mandos",

2868

"use_dbus": "True",

2869

"use_ipv6": "True",

2870

"debuglevel": "",

2871

"restore": "True",

2872

"socket": "",

2873

"statedir": "/var/lib/mandos",

2874

"foreground": "False",

2875

"zeroconf": "True",

2876

}

2877

2394

server_defaults = { "interface": "",

2395

"address": "",

2396

"port": "",

2397

"debug": "False",

2398

"priority":

2399

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2400

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2401

"servicename": "Mandos",

2402

"use_dbus": "True",

2403

"use_ipv6": "True",

2404

"debuglevel": "",

2405

"restore": "True",

2406

"socket": "",

2407

"statedir": "/var/lib/mandos",

2408

"foreground": "False",

2409

"zeroconf": "True",

2410

}

2411

2878

2412

# Parse config file for server-global settings

2879

2413

server_config = configparser.SafeConfigParser(server_defaults)

2880

2414

del server_defaults

2898

2432

server_settings["socket"] = os.dup(server_settings

2899

2433

["socket"])

2900

2434

del server_config

2901

2435

2902

2436

# Override the settings from the config file with command line

2903

2437

# options, if set.

2904

2438

for option in ("interface", "address", "port", "debug",

2922

2456

if server_settings["debug"]:

2923

2457

server_settings["foreground"] = True

2924

2458

# Now we have our good server settings in "server_settings"

2925

2459

2926

2460

##################################################################

2927

2461

2928

2462

if (not server_settings["zeroconf"]

2929

2463

and not (server_settings["port"]

2930

2464

or server_settings["socket"] != "")):

2931

2465

parser.error("Needs port or socket to work without Zeroconf")

2932

2466

2933

2467

# For convenience

2934

2468

debug = server_settings["debug"]

2935

2469

debuglevel = server_settings["debuglevel"]

2939

2473

stored_state_file)

2940

2474

foreground = server_settings["foreground"]

2941

2475

zeroconf = server_settings["zeroconf"]

2942

2476

2943

2477

if debug:

2944

2478

initlogger(debug, logging.DEBUG)

2945

2479

else:

2948

2482

else:

2949

2483

level = getattr(logging, debuglevel.upper())

2950

2484

initlogger(debug, level)

2951

2485

2952

2486

if server_settings["servicename"] != "Mandos":

2953

2487

syslogger.setFormatter(

2954

2488

logging.Formatter('Mandos ({}) [%(process)d]:'

2955

2489

' %(levelname)s: %(message)s'.format(

2956

2490

server_settings["servicename"])))

2957

2491

2958

2492

# Parse config file with clients

2959

2493

client_config = configparser.SafeConfigParser(Client

2960

2494

.client_defaults)

2961

2495

client_config.read(os.path.join(server_settings["configdir"],

2962

2496

"clients.conf"))

2963

2497

2964

2498

global mandos_dbus_service

2965

2499

mandos_dbus_service = None

2966

2500

2967

2501

socketfd = None

2968

2502

if server_settings["socket"] != "":

2969

2503

socketfd = server_settings["socket"]

2985

2519

except IOError as e:

2986

2520

logger.error("Could not open file %r", pidfilename,

2987

2521

exc_info=e)

2988

2989

for name, group in (("_mandos", "_mandos"),

2990

("mandos", "mandos"),

2991

("nobody", "nogroup")):

2522

2523

for name in ("_mandos", "mandos", "nobody"):

2992

2524

try:

2993

2525

uid = pwd.getpwnam(name).pw_uid

2994

gid = pwd.getpwnam(group).pw_gid

2526

gid = pwd.getpwnam(name).pw_gid

2995

2527

break

2996

2528

except KeyError:

2997

2529

continue

3001

2533

try:

3002

2534

os.setgid(gid)

3003

2535

os.setuid(uid)

3004

if debug:

3005

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3006

gid))

3007

2536

except OSError as error:

3008

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3009

.format(uid, gid, os.strerror(error.errno)))

3010

2537

if error.errno != errno.EPERM:

3011

2538

raise

3012

2539

3013

2540

if debug:

3014

2541

# Enable all possible GnuTLS debugging

3015

2542

3016

2543

# "Use a log level over 10 to enable all debugging options."

3017

2544

# - GnuTLS manual

3018

gnutls.global_set_log_level(11)

3019

3020

@gnutls.log_func

2545

gnutls.library.functions.gnutls_global_set_log_level(11)

2546

2547

@gnutls.library.types.gnutls_log_func

3021

2548

def debug_gnutls(level, string):

3022

2549

logger.debug("GnuTLS: %s", string[:-1])

3023

3024

gnutls.global_set_log_function(debug_gnutls)

3025

2550

2551

gnutls.library.functions.gnutls_global_set_log_function(

2552

debug_gnutls)

2553

3026

2554

# Redirect stdin so all checkers get /dev/null

3027

2555

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3028

2556

os.dup2(null, sys.stdin.fileno())

3029

2557

if null > 2:

3030

2558

os.close(null)

3031

2559

3032

2560

# Need to fork before connecting to D-Bus

3033

2561

if not foreground:

3034

2562

# Close all input and output, do double fork, etc.

3035

2563

daemon()

3036

3037

# multiprocessing will use threads, so before we use GLib we need

3038

# to inform GLib that threads will be used.

3039

GLib.threads_init()

3040

2564

2565

# multiprocessing will use threads, so before we use gobject we

2566

# need to inform gobject that threads will be used.

2567

gobject.threads_init()

2568

3041

2569

global main_loop

3042

2570

# From the Avahi example code

3043

2571

DBusGMainLoop(set_as_default=True)

3044

main_loop = GLib.MainLoop()

2572

main_loop = gobject.MainLoop()

3045

2573

bus = dbus.SystemBus()

3046

2574

# End of Avahi example code

3047

2575

if use_dbus:

3060

2588

if zeroconf:

3061

2589

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3062

2590

service = AvahiServiceToSyslog(

3063

name=server_settings["servicename"],

3064

servicetype="_mandos._tcp",

3065

protocol=protocol,

3066

bus=bus)

2591

name = server_settings["servicename"],

2592

servicetype = "_mandos._tcp",

2593

protocol = protocol,

2594

bus = bus)

3067

2595

if server_settings["interface"]:

3068

2596

service.interface = if_nametoindex(

3069

2597

server_settings["interface"].encode("utf-8"))

3070

2598

3071

2599

global multiprocessing_manager

3072

2600

multiprocessing_manager = multiprocessing.Manager()

3073

2601

3074

2602

client_class = Client

3075

2603

if use_dbus:

3076

client_class = functools.partial(ClientDBus, bus=bus)

3077

2604

client_class = functools.partial(ClientDBus, bus = bus)

2605

3078

2606

client_settings = Client.config_parser(client_config)

3079

2607

old_client_settings = {}

3080

2608

clients_data = {}

3081

2609

3082

2610

# This is used to redirect stdout and stderr for checker processes

3083

2611

global wnull

3084

wnull = open(os.devnull, "w") # A writable /dev/null

2612

wnull = open(os.devnull, "w") # A writable /dev/null

3085

2613

# Only used if server is running in foreground but not in debug

3086

2614

# mode

3087

2615

if debug or not foreground:

3088

2616

wnull.close()

3089

2617

3090

2618

# Get client data and settings from last running state.

3091

2619

if server_settings["restore"]:

3092

2620

try:

3093

2621

with open(stored_state_path, "rb") as stored_state:

3094

if sys.version_info.major == 2:

3095

clients_data, old_client_settings = pickle.load(

3096

stored_state)

3097

else:

3098

bytes_clients_data, bytes_old_client_settings = (

3099

pickle.load(stored_state, encoding="bytes"))

3100

# Fix bytes to strings

3101

# clients_data

3102

# .keys()

3103

clients_data = {(key.decode("utf-8")

3104

if isinstance(key, bytes)

3105

else key): value

3106

for key, value in

3107

bytes_clients_data.items()}

3108

del bytes_clients_data

3109

for key in clients_data:

3110

value = {(k.decode("utf-8")

3111

if isinstance(k, bytes) else k): v

3112

for k, v in

3113

clients_data[key].items()}

3114

clients_data[key] = value

3115

# .client_structure

3116

value["client_structure"] = [

3117

(s.decode("utf-8")

3118

if isinstance(s, bytes)

3119

else s) for s in

3120

value["client_structure"]]

3121

# .name & .host

3122

for k in ("name", "host"):

3123

if isinstance(value[k], bytes):

3124

value[k] = value[k].decode("utf-8")

3125

# old_client_settings

3126

# .keys()

3127

old_client_settings = {

3128

(key.decode("utf-8")

3129

if isinstance(key, bytes)

3130

else key): value

3131

for key, value in

3132

bytes_old_client_settings.items()}

3133

del bytes_old_client_settings

3134

# .host

3135

for value in old_client_settings.values():

3136

if isinstance(value["host"], bytes):

3137

value["host"] = (value["host"]

3138

.decode("utf-8"))

2622

clients_data, old_client_settings = pickle.load(

2623

stored_state)

3139

2624

os.remove(stored_state_path)

3140

2625

except IOError as e:

3141

2626

if e.errno == errno.ENOENT:

3149

2634

logger.warning("Could not load persistent state: "

3150

2635

"EOFError:",

3151

2636

exc_info=e)

3152

2637

3153

2638

with PGPEngine() as pgp:

3154

2639

for client_name, client in clients_data.items():

3155

2640

# Skip removed clients

3156

2641

if client_name not in client_settings:

3157

2642

continue

3158

2643

3159

2644

# Decide which value to use after restoring saved state.

3160

2645

# We have three different values: Old config file,

3161

2646

# new config file, and saved state.

3172

2657

client[name] = value

3173

2658

except KeyError:

3174

2659

pass

3175

2660

3176

2661

# Clients who has passed its expire date can still be

3177

# enabled if its last checker was successful. A Client

2662

# enabled if its last checker was successful. Clients

3178

2663

# whose checker succeeded before we stored its state is

3179

2664

# assumed to have successfully run all checkers during

3180

2665

# downtime.

3211

2696

client_name))

3212

2697

client["secret"] = (client_settings[client_name]

3213

2698

["secret"])

3214

2699

3215

2700

# Add/remove clients based on new changes made to config

3216

2701

for client_name in (set(old_client_settings)

3217

2702

- set(client_settings)):

3219

2704

for client_name in (set(client_settings)

3220

2705

- set(old_client_settings)):

3221

2706

clients_data[client_name] = client_settings[client_name]

3222

2707

3223

2708

# Create all client objects

3224

2709

for client_name, client in clients_data.items():

3225

2710

tcp_server.clients[client_name] = client_class(

3226

name=client_name,

3227

settings=client,

3228

server_settings=server_settings)

3229

2711

name = client_name,

2712

settings = client,

2713

server_settings = server_settings)

2714

3230

2715

if not tcp_server.clients:

3231

2716

logger.warning("No clients defined")

3232

2717

3233

2718

if not foreground:

3234

2719

if pidfile is not None:

3235

2720

pid = os.getpid()

3241

2726

pidfilename, pid)

3242

2727

del pidfile

3243

2728

del pidfilename

3244

3245

for termsig in (signal.SIGHUP, signal.SIGTERM):

3246

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3247

lambda: main_loop.quit() and False)

3248

2729

2730

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2731

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2732

3249

2733

if use_dbus:

3250

2734

3251

2735

@alternate_dbus_interfaces(

3252

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3253

class MandosDBusService(DBusObjectWithObjectManager):

2736

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2737

class MandosDBusService(DBusObjectWithProperties):

3254

2738

"""A D-Bus proxy object"""

3255

2739

3256

2740

def __init__(self):

3257

2741

dbus.service.Object.__init__(self, bus, "/")

3258

2742

3259

2743

_interface = "se.recompile.Mandos"

3260

2744

2745

@dbus_interface_annotations(_interface)

2746

def _foo(self):

2747

return {

2748

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2749

"false" }

2750

3261

2751

@dbus.service.signal(_interface, signature="o")

3262

2752

def ClientAdded(self, objpath):

3263

2753

"D-Bus signal"

3264

2754

pass

3265

2755

3266

2756

@dbus.service.signal(_interface, signature="ss")

3267

2757

def ClientNotFound(self, fingerprint, address):

3268

2758

"D-Bus signal"

3269

2759

pass

3270

3271

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3272

"true"})

2760

3273

2761

@dbus.service.signal(_interface, signature="os")

3274

2762

def ClientRemoved(self, objpath, name):

3275

2763

"D-Bus signal"

3276

2764

pass

3277

3278

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3279

"true"})

2765

3280

2766

@dbus.service.method(_interface, out_signature="ao")

3281

2767

def GetAllClients(self):

3282

2768

"D-Bus method"

3283

2769

return dbus.Array(c.dbus_object_path for c in

3284

tcp_server.clients.values())

3285

3286

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3287

"true"})

2770

tcp_server.clients.itervalues())

2771

3288

2772

@dbus.service.method(_interface,

3289

2773

out_signature="a{oa{sv}}")

3290

2774

def GetAllClientsWithProperties(self):

3291

2775

"D-Bus method"

3292

2776

return dbus.Dictionary(

3293

{c.dbus_object_path: c.GetAll(

3294

"se.recompile.Mandos.Client")

3295

for c in tcp_server.clients.values()},

2777

{ c.dbus_object_path: c.GetAll("")

2778

for c in tcp_server.clients.itervalues() },

3296

2779

signature="oa{sv}")

3297

2780

3298

2781

@dbus.service.method(_interface, in_signature="o")

3299

2782

def RemoveClient(self, object_path):

3300

2783

"D-Bus method"

3301

for c in tcp_server.clients.values():

2784

for c in tcp_server.clients.itervalues():

3302

2785

if c.dbus_object_path == object_path:

3303

2786

del tcp_server.clients[c.name]

3304

2787

c.remove_from_connection()

3305

# Don't signal the disabling

2788

# Don't signal anything except ClientRemoved

3306

2789

c.disable(quiet=True)

3307

# Emit D-Bus signal for removal

3308

self.client_removed_signal(c)

2790

# Emit D-Bus signal

2791

self.ClientRemoved(object_path, c.name)

3309

2792

return

3310

2793

raise KeyError(object_path)

3311

2794

3312

2795

del _interface

3313

3314

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3315

out_signature="a{oa{sa{sv}}}")

3316

def GetManagedObjects(self):

3317

"""D-Bus method"""

3318

return dbus.Dictionary(

3319

{client.dbus_object_path:

3320

dbus.Dictionary(

3321

{interface: client.GetAll(interface)

3322

for interface in

3323

client._get_all_interface_names()})

3324

for client in tcp_server.clients.values()})

3325

3326

def client_added_signal(self, client):

3327

"""Send the new standard signal and the old signal"""

3328

if use_dbus:

3329

# New standard signal

3330

self.InterfacesAdded(

3331

client.dbus_object_path,

3332

dbus.Dictionary(

3333

{interface: client.GetAll(interface)

3334

for interface in

3335

client._get_all_interface_names()}))

3336

# Old signal

3337

self.ClientAdded(client.dbus_object_path)

3338

3339

def client_removed_signal(self, client):

3340

"""Send the new standard signal and the old signal"""

3341

if use_dbus:

3342

# New standard signal

3343

self.InterfacesRemoved(

3344

client.dbus_object_path,

3345

client._get_all_interface_names())

3346

# Old signal

3347

self.ClientRemoved(client.dbus_object_path,

3348

client.name)

3349

2796

3350

2797

mandos_dbus_service = MandosDBusService()

3351

3352

# Save modules to variables to exempt the modules from being

3353

# unloaded before the function registered with atexit() is run.

3354

mp = multiprocessing

3355

wn = wnull

3356

2798

3357

2799

def cleanup():

3358

2800

"Cleanup function; run on exit"

3359

2801

if zeroconf:

3360

2802

service.cleanup()

3361

3362

mp.active_children()

3363

wn.close()

2803

2804

multiprocessing.active_children()

2805

wnull.close()

3364

2806

if not (tcp_server.clients or client_settings):

3365

2807

return

3366

2808

3367

2809

# Store client before exiting. Secrets are encrypted with key

3368

2810

# based on what config file has. If config file is

3369

2811

# removed/edited, old secret will thus be unrecovable.

3370

2812

clients = {}

3371

2813

with PGPEngine() as pgp:

3372

for client in tcp_server.clients.values():

2814

for client in tcp_server.clients.itervalues():

3373

2815

key = client_settings[client.name]["secret"]

3374

2816

client.encrypted_secret = pgp.encrypt(client.secret,

3375

2817

key)

3376

2818

client_dict = {}

3377

2819

3378

2820

# A list of attributes that can not be pickled

3379

2821

# + secret.

3380

exclude = {"bus", "changedstate", "secret",

3381

"checker", "server_settings"}

2822

exclude = { "bus", "changedstate", "secret",

2823

"checker", "server_settings" }

3382

2824

for name, typ in inspect.getmembers(dbus.service

3383

2825

.Object):

3384

2826

exclude.add(name)

3385

2827

3386

2828

client_dict["encrypted_secret"] = (client

3387

2829

.encrypted_secret)

3388

2830

for attr in client.client_structure:

3389

2831

if attr not in exclude:

3390

2832

client_dict[attr] = getattr(client, attr)

3391

2833

3392

2834

clients[client.name] = client_dict

3393

2835

del client_settings[client.name]["secret"]

3394

2836

3395

2837

try:

3396

2838

with tempfile.NamedTemporaryFile(

3397

2839

mode='wb',

3399

2841

prefix='clients-',

3400

2842

dir=os.path.dirname(stored_state_path),

3401

2843

delete=False) as stored_state:

3402

pickle.dump((clients, client_settings), stored_state,

3403

protocol=2)

2844

pickle.dump((clients, client_settings), stored_state)

3404

2845

tempname = stored_state.name

3405

2846

os.rename(tempname, stored_state_path)

3406

2847

except (IOError, OSError) as e:

3416

2857

logger.warning("Could not save persistent state:",

3417

2858

exc_info=e)

3418

2859

raise

3419

2860

3420

2861

# Delete all clients, and settings from config

3421

2862

while tcp_server.clients:

3422

2863

name, client = tcp_server.clients.popitem()

3423

2864

if use_dbus:

3424

2865

client.remove_from_connection()

3425

# Don't signal the disabling

2866

# Don't signal anything except ClientRemoved

3426

2867

client.disable(quiet=True)

3427

# Emit D-Bus signal for removal

3428

2868

if use_dbus:

3429

mandos_dbus_service.client_removed_signal(client)

2869

# Emit D-Bus signal

2870

mandos_dbus_service.ClientRemoved(

2871

client.dbus_object_path, client.name)

3430

2872

client_settings.clear()

3431

2873

3432

2874

atexit.register(cleanup)

3433

3434

for client in tcp_server.clients.values():

2875

2876

for client in tcp_server.clients.itervalues():

3435

2877

if use_dbus:

3436

# Emit D-Bus signal for adding

3437

mandos_dbus_service.client_added_signal(client)

2878

# Emit D-Bus signal

2879

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3438

2880

# Need to initiate checking of clients

3439

2881

if client.enabled:

3440

2882

client.init_checker()

3441

2883

3442

2884

tcp_server.enable()

3443

2885

tcp_server.server_activate()

3444

2886

3445

2887

# Find out what port we got

3446

2888

if zeroconf:

3447

2889

service.port = tcp_server.socket.getsockname()[1]

3452

2894

else: # IPv4

3453

2895

logger.info("Now listening on address %r, port %d",

3454

2896

*tcp_server.socket.getsockname())

3455

3456

# service.interface = tcp_server.socket.getsockname()[3]

3457

2897

2898

#service.interface = tcp_server.socket.getsockname()[3]

2899

3458

2900

try:

3459

2901

if zeroconf:

3460

2902

# From the Avahi example code

3465

2907

cleanup()

3466

2908

sys.exit(1)

3467

2909

# End of Avahi example code

3468

3469

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3470

lambda *args, **kwargs:

3471

(tcp_server.handle_request

3472

(*args[2:], **kwargs) or True))

3473

2910

2911

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2912

lambda *args, **kwargs:

2913

(tcp_server.handle_request

2914

(*args[2:], **kwargs) or True))

2915

3474

2916

logger.debug("Starting main loop")

3475

2917

main_loop.run()

3476

2918

except AvahiError as error: