/mandos/release : revision 237.7.329

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

import SocketServer as socketserver

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

40

43

import socket

41

44

import argparse

42

45

import datetime

47

50

import gnutls.library.functions

48

51

import gnutls.library.constants

49

52

import gnutls.library.types

50

import ConfigParser as configparser

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

51

57

import sys

52

58

import re

53

59

import os

62

68

import struct

63

69

import fcntl

64

70

import functools

65

import cPickle as pickle

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

66

75

import multiprocessing

67

76

import types

68

77

import binascii

69

78

import tempfile

70

79

import itertools

80

import collections

81

import codecs

71

82

72

83

import dbus

73

84

import dbus.service

74

import gobject

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

75

89

import avahi

76

90

from dbus.mainloop.glib import DBusGMainLoop

77

91

import ctypes

78

92

import ctypes.util

79

93

import xml.dom.minidom

80

94

import inspect

81

import GnuPGInterface

82

95

83

96

try:

84

97

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

88

101

except ImportError:

89

102

SO_BINDTODEVICE = None

90

103

91

version = "1.6.0"

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

92

108

stored_state_file = "clients.pickle"

93

109

94

110

logger = logging.getLogger()

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

111

syslogger = None

98

112

99

113

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

103

116

except (OSError, AttributeError):

117

104

118

def if_nametoindex(interface):

105

119

"Get an interface index the hard way, i.e. using fcntl()"

106

120

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

121

with contextlib.closing(socket.socket()) as s:

108

122

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

113

125

return interface_index

114

126

115

127

116

128

def initlogger(debug, level=logging.WARNING):

117

129

"""init logger and add loglevel"""

118

130

131

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

119

135

syslogger.setFormatter(logging.Formatter

120

136

('Mandos [%(process)d]: %(levelname)s:'

121

137

' %(message)s'))

138

154

139

155

class PGPEngine(object):

140

156

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

141

158

def __init__(self):

142

self.gnupg = GnuPGInterface.GnuPG()

143

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

144

self.gnupg = GnuPGInterface.GnuPG()

145

self.gnupg.options.meta_interactive = False

146

self.gnupg.options.homedir = self.tempdir

147

self.gnupg.options.extra_args.extend(['--force-mdc',

148

'--quiet',

149

'--no-use-agent'])

160

self.gnupgargs = ['--batch',

161

'--home', self.tempdir,

162

'--force-mdc',

163

'--quiet',

164

'--no-use-agent']

150

165

151

166

def __enter__(self):

152

167

return self

174

189

def password_encode(self, password):

175

190

# Passphrase can not be empty and can not contain newlines or

176

191

# NUL bytes. So we prefix it and hex encode it.

177

return b"mandos" + binascii.hexlify(password)

192

encoded = b"mandos" + binascii.hexlify(password)

193

if len(encoded) > 2048:

194

# GnuPG can't handle long passwords, so encode differently

195

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

196

.replace(b"\n", b"\\n")

197

.replace(b"\0", b"\\x00"))

198

return encoded

178

199

179

200

def encrypt(self, data, password):

180

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

182

try:

183

proc = self.gnupg.run(['--symmetric'],

184

create_fhs=['stdin', 'stdout'],

185

attach_fhs={'stderr': devnull})

186

with contextlib.closing(proc.handles['stdin']) as f:

187

f.write(data)

188

with contextlib.closing(proc.handles['stdout']) as f:

189

ciphertext = f.read()

190

proc.wait()

191

except IOError as e:

192

raise PGPError(e)

193

self.gnupg.passphrase = None

201

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

204

passfile.write(passphrase)

205

passfile.flush()

206

proc = subprocess.Popen(['gpg', '--symmetric',

207

'--passphrase-file',

208

passfile.name]

209

+ self.gnupgargs,

210

stdin = subprocess.PIPE,

211

stdout = subprocess.PIPE,

212

stderr = subprocess.PIPE)

213

ciphertext, err = proc.communicate(input = data)

214

if proc.returncode != 0:

215

raise PGPError(err)

194

216

return ciphertext

195

217

196

218

def decrypt(self, data, password):

197

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

199

try:

200

proc = self.gnupg.run(['--decrypt'],

201

create_fhs=['stdin', 'stdout'],

202

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

204

f.write(data)

205

with contextlib.closing(proc.handles['stdout']) as f:

206

decrypted_plaintext = f.read()

207

proc.wait()

208

except IOError as e:

209

raise PGPError(e)

210

self.gnupg.passphrase = None

219

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

222

passfile.write(passphrase)

223

passfile.flush()

224

proc = subprocess.Popen(['gpg', '--decrypt',

225

'--passphrase-file',

226

passfile.name]

227

+ self.gnupgargs,

228

stdin = subprocess.PIPE,

229

stdout = subprocess.PIPE,

230

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

232

if proc.returncode != 0:

233

raise PGPError(err)

211

234

return decrypted_plaintext

212

235

213

236

214

237

class AvahiError(Exception):

215

238

def __init__(self, value, *args, **kwargs):

216

239

self.value = value

217

super(AvahiError, self).__init__(value, *args, **kwargs)

218

def __unicode__(self):

219

return unicode(repr(self.value))

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

220

243

221

244

class AvahiServiceError(AvahiError):

222

245

pass

223

246

247

224

248

class AvahiGroupError(AvahiError):

225

249

pass

226

250

233

257

Used to optionally bind to the specified interface.

234

258

name: string; Example: 'Mandos'

235

259

type: string; Example: '_mandos._tcp'.

236

See <http://www.dns-sd.org/ServiceTypes.html>

260

See <https://www.iana.org/assignments/service-names-port-numbers>

237

261

port: integer; what port to announce

238

262

TXT: list of strings; TXT record for the service

239

263

domain: string; Domain to publish on, default to .local if empty.

246

270

bus: dbus.SystemBus()

247

271

"""

248

272

249

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

250

servicetype = None, port = None, TXT = None,

251

domain = "", host = "", max_renames = 32768,

252

protocol = avahi.PROTO_UNSPEC, bus = None):

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

253

284

self.interface = interface

254

285

self.name = name

255

286

self.type = servicetype

265

296

self.bus = bus

266

297

self.entry_group_state_changed_match = None

267

298

268

def rename(self):

299

def rename(self, remove=True):

269

300

"""Derived from the Avahi example code"""

270

301

if self.rename_count >= self.max_renames:

271

302

logger.critical("No suitable Zeroconf service name found"

272

303

" after %i retries, exiting.",

273

304

self.rename_count)

274

305

raise AvahiServiceError("Too many renames")

275

self.name = unicode(self.server

276

.GetAlternativeServiceName(self.name))

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

277

309

logger.info("Changing Zeroconf service name to %r ...",

278

310

self.name)

279

self.remove()

311

if remove:

312

self.remove()

280

313

try:

281

314

self.add()

282

315

except dbus.exceptions.DBusException as error:

283

logger.critical("D-Bus Exception", exc_info=error)

284

self.cleanup()

285

os._exit(1)

286

self.rename_count += 1

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

287

324

288

325

def remove(self):

289

326

"""Derived from the Avahi example code"""

327

364

self.rename()

328

365

elif state == avahi.ENTRY_GROUP_FAILURE:

329

366

logger.critical("Avahi: Error in group state changed %s",

330

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

333

369

334

370

def cleanup(self):

335

371

"""Derived from the Avahi example code"""

345

381

def server_state_changed(self, state, error=None):

346

382

"""Derived from the Avahi example code"""

347

383

logger.debug("Avahi server state change: %i", state)

348

bad_states = { avahi.SERVER_INVALID:

349

"Zeroconf server invalid",

350

avahi.SERVER_REGISTERING: None,

351

avahi.SERVER_COLLISION:

352

"Zeroconf server name collision",

353

avahi.SERVER_FAILURE:

354

"Zeroconf server failure" }

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

355

390

if state in bad_states:

356

391

if bad_states[state] is not None:

357

392

if error is None:

360

395

logger.error(bad_states[state] + ": %r", error)

361

396

self.cleanup()

362

397

elif state == avahi.SERVER_RUNNING:

363

self.add()

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

364

410

else:

365

411

if error is None:

366

412

logger.debug("Unknown state: %r", state)

376

422

follow_name_owner_changes=True),

377

423

avahi.DBUS_INTERFACE_SERVER)

378

424

self.server.connect_to_signal("StateChanged",

379

self.server_state_changed)

425

self.server_state_changed)

380

426

self.server_state_changed(self.server.GetState())

381

427

382

428

383

429

class AvahiServiceToSyslog(AvahiService):

384

def rename(self):

430

def rename(self, *args, **kwargs):

385

431

"""Add the new name to the syslog messages"""

386

ret = AvahiService.rename(self)

387

syslogger.setFormatter(logging.Formatter

388

('Mandos ({0}) [%(process)d]:'

389

' %(levelname)s: %(message)s'

390

.format(self.name)))

432

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

391

436

return ret

392

437

393

394

def timedelta_to_milliseconds(td):

395

"Convert a datetime.timedelta() to milliseconds"

396

return ((td.days * 24 * 60 * 60 * 1000)

397

+ (td.seconds * 1000)

398

+ (td.microseconds // 1000))

399

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

400

447

401

448

class Client(object):

402

449

"""A representation of a client host served by this server.

429

476

last_checker_status: integer between 0 and 255 reflecting exit

430

477

status of last checker. -1 reflects crashed

431

478

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

432

481

last_enabled: datetime.datetime(); (UTC) or None

433

482

name: string; from the config file, used in log messages and

434

483

D-Bus identifiers

439

488

runtime_expansions: Allowed attributes for runtime expansion.

440

489

expires: datetime.datetime(); time (UTC) when a client will be

441

490

disabled, or None

491

server_settings: The server_settings dict from main()

442

492

"""

443

493

444

494

runtime_expansions = ("approval_delay", "approval_duration",

446

496

"fingerprint", "host", "interval",

447

497

"last_approval_request", "last_checked_ok",

448

498

"last_enabled", "name", "timeout")

449

client_defaults = { "timeout": "5m",

450

"extended_timeout": "15m",

451

"interval": "2m",

452

"checker": "fping -q -- %%(host)s",

453

"host": "",

454

"approval_delay": "0s",

455

"approval_duration": "1s",

456

"approved_by_default": "True",

457

"enabled": "True",

458

}

459

460

def timeout_milliseconds(self):

461

"Return the 'timeout' attribute in milliseconds"

462

return timedelta_to_milliseconds(self.timeout)

463

464

def extended_timeout_milliseconds(self):

465

"Return the 'extended_timeout' attribute in milliseconds"

466

return timedelta_to_milliseconds(self.extended_timeout)

467

468

def interval_milliseconds(self):

469

"Return the 'interval' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.interval)

471

472

def approval_delay_milliseconds(self):

473

return timedelta_to_milliseconds(self.approval_delay)

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

474

510

475

511

@staticmethod

476

512

def config_parser(config):

492

528

client["enabled"] = config.getboolean(client_name,

493

529

"enabled")

494

530

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

495

534

client["fingerprint"] = (section["fingerprint"].upper()

496

535

.replace(" ", ""))

497

536

if "secret" in section:

502

541

"rb") as secfile:

503

542

client["secret"] = secfile.read()

504

543

else:

505

raise TypeError("No secret or secfile for section {0}"

544

raise TypeError("No secret or secfile for section {}"

506

545

.format(section))

507

546

client["timeout"] = string_to_delta(section["timeout"])

508

547

client["extended_timeout"] = string_to_delta(

519

558

520

559

return settings

521

560

522

def __init__(self, settings, name = None):

561

def __init__(self, settings, name = None, server_settings=None):

523

562

self.name = name

563

if server_settings is None:

564

server_settings = {}

565

self.server_settings = server_settings

524

566

# adding all client settings

525

for setting, value in settings.iteritems():

567

for setting, value in settings.items():

526

568

setattr(self, setting, value)

527

569

528

570

if self.enabled:

536

578

self.expires = None

537

579

538

580

logger.debug("Creating client %r", self.name)

539

# Uppercase and remove spaces from fingerprint for later

540

# comparison purposes with return value from the fingerprint()

541

# function

542

581

logger.debug(" Fingerprint: %s", self.fingerprint)

543

582

self.created = settings.get("created",

544

583

datetime.datetime.utcnow())

551

590

self.current_checker_command = None

552

591

self.approved = None

553

592

self.approvals_pending = 0

554

self.changedstate = (multiprocessing_manager

555

.Condition(multiprocessing_manager

556

.Lock()))

557

self.client_structure = [attr for attr in

558

self.__dict__.iterkeys()

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

559

597

if not attr.startswith("_")]

560

598

self.client_structure.append("client_structure")

561

599

562

for name, t in inspect.getmembers(type(self),

563

lambda obj:

564

isinstance(obj,

565

property)):

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

566

602

if not name.startswith("_"):

567

603

self.client_structure.append(name)

568

604

610

646

# and every interval from then on.

611

647

if self.checker_initiator_tag is not None:

612

648

gobject.source_remove(self.checker_initiator_tag)

613

self.checker_initiator_tag = (gobject.timeout_add

614

(self.interval_milliseconds(),

615

self.start_checker))

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

616

652

# Schedule a disable() when 'timeout' has passed

617

653

if self.disable_initiator_tag is not None:

618

654

gobject.source_remove(self.disable_initiator_tag)

619

self.disable_initiator_tag = (gobject.timeout_add

620

(self.timeout_milliseconds(),

621

self.disable))

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

622

657

# Also start a new checker *right now*.

623

658

self.start_checker()

624

659

625

def checker_callback(self, pid, condition, command):

660

def checker_callback(self, source, condition, connection,

661

command):

626

662

"""The checker has completed, so take appropriate actions."""

627

663

self.checker_callback_tag = None

628

664

self.checker = None

629

if os.WIFEXITED(condition):

630

self.last_checker_status = os.WEXITSTATUS(condition)

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

631

672

if self.last_checker_status == 0:

632

673

logger.info("Checker for %(name)s succeeded",

633

674

vars(self))

634

675

self.checked_ok()

635

676

else:

636

logger.info("Checker for %(name)s failed",

637

vars(self))

677

logger.info("Checker for %(name)s failed", vars(self))

638

678

else:

639

679

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

640

681

logger.warning("Checker for %(name)s crashed?",

641

682

vars(self))

683

return False

642

684

643

685

def checked_ok(self):

644

686

"""Assert that the client has been seen, alive and well."""

645

687

self.last_checked_ok = datetime.datetime.utcnow()

646

688

self.last_checker_status = 0

689

self.last_checker_signal = None

647

690

self.bump_timeout()

648

691

649

692

def bump_timeout(self, timeout=None):

654

697

gobject.source_remove(self.disable_initiator_tag)

655

698

self.disable_initiator_tag = None

656

699

if getattr(self, "enabled", False):

657

self.disable_initiator_tag = (gobject.timeout_add

658

(timedelta_to_milliseconds

659

(timeout), self.disable))

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

660

702

self.expires = datetime.datetime.utcnow() + timeout

661

703

662

704

def need_approval(self):

676

718

# than 'timeout' for the client to be disabled, which is as it

677

719

# should be.

678

720

679

# If a checker exists, make sure it is not a zombie

680

try:

681

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

682

except (AttributeError, OSError) as error:

683

if (isinstance(error, OSError)

684

and error.errno != errno.ECHILD):

685

raise error

686

else:

687

if pid:

688

logger.warning("Checker was a zombie")

689

gobject.source_remove(self.checker_callback_tag)

690

self.checker_callback(pid, status,

691

self.current_checker_command)

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

692

725

# Start a new checker if needed

693

726

if self.checker is None:

694

727

# Escape attributes for the shell

695

escaped_attrs = dict(

696

(attr, re.escape(unicode(getattr(self, attr))))

697

for attr in

698

self.runtime_expansions)

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

699

731

try:

700

732

command = self.checker_command % escaped_attrs

701

733

except TypeError as error:

702

734

logger.error('Could not format string "%s"',

703

self.checker_command, exc_info=error)

704

return True # Try again later

735

self.checker_command,

736

exc_info=error)

737

return True # Try again later

705

738

self.current_checker_command = command

706

try:

707

logger.info("Starting checker %r for %s",

708

command, self.name)

709

# We don't need to redirect stdout and stderr, since

710

# in normal mode, that is already done by daemon(),

711

# and in debug mode we don't want to. (Stdin is

712

# always replaced by /dev/null.)

713

self.checker = subprocess.Popen(command,

714

close_fds=True,

715

shell=True, cwd="/")

716

except OSError as error:

717

logger.error("Failed to start subprocess",

718

exc_info=error)

719

self.checker_callback_tag = (gobject.child_watch_add

720

(self.checker.pid,

721

self.checker_callback,

722

data=command))

723

# The checker may have completed before the gobject

724

# watch was added. Check for this.

725

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

726

if pid:

727

gobject.source_remove(self.checker_callback_tag)

728

self.checker_callback(pid, status, command)

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

729

764

# Re-run this periodically if run by gobject.timeout_add

730

765

return True

731

766

737

772

if getattr(self, "checker", None) is None:

738

773

return

739

774

logger.debug("Stopping checker for %(name)s", vars(self))

740

try:

741

self.checker.terminate()

742

#time.sleep(0.5)

743

#if self.checker.poll() is None:

744

# self.checker.kill()

745

except OSError as error:

746

if error.errno != errno.ESRCH: # No such process

747

raise

775

self.checker.terminate()

748

776

self.checker = None

749

777

750

778

751

def dbus_service_property(dbus_interface, signature="v",

752

access="readwrite", byte_arrays=False):

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

753

783

"""Decorators for marking methods of a DBusObjectWithProperties to

754

784

become properties on the D-Bus.

755

785

764

794

# "Set" method, so we fail early here:

765

795

if byte_arrays and signature != "ay":

766

796

raise ValueError("Byte arrays not supported for non-'ay'"

767

" signature {0!r}".format(signature))

797

" signature {!r}".format(signature))

798

768

799

def decorator(func):

769

800

func._dbus_is_property = True

770

801

func._dbus_interface = dbus_interface

775

806

func._dbus_name = func._dbus_name[:-14]

776

807

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

777

808

return func

809

778

810

return decorator

779

811

780

812

789

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

790

822

"false"}

791

823

"""

824

792

825

def decorator(func):

793

826

func._dbus_is_interface = True

794

827

func._dbus_interface = dbus_interface

795

828

func._dbus_name = dbus_interface

796

829

return func

830

797

831

return decorator

798

832

799

833

801

835

"""Decorator to annotate D-Bus methods, signals or properties

802

836

Usage:

803

837

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

804

841

@dbus_service_property("org.example.Interface", signature="b",

805

842

access="r")

806

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

807

"org.freedesktop.DBus.Property."

808

"EmitsChangedSignal": "false"})

809

843

def Property_dbus_property(self):

810

844

return dbus.Boolean(False)

811

845

"""

846

812

847

def decorator(func):

813

848

func._dbus_annotations = annotations

814

849

return func

850

815

851

return decorator

816

852

817

853

818

854

class DBusPropertyException(dbus.exceptions.DBusException):

819

855

"""A base class for D-Bus property-related exceptions

820

856

"""

821

def __unicode__(self):

822

return unicode(str(self))

857

pass

823

858

824

859

825

860

class DBusPropertyAccessException(DBusPropertyException):

849

884

If called like _is_dbus_thing("method") it returns a function

850

885

suitable for use as predicate to inspect.getmembers().

851

886

"""

852

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

887

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

853

888

False)

854

889

855

890

def _get_all_dbus_things(self, thing):

856

891

"""Returns a generator of (name, attribute) pairs

857

892

"""

858

return ((getattr(athing.__get__(self), "_dbus_name",

859

name),

893

return ((getattr(athing.__get__(self), "_dbus_name", name),

860

894

athing.__get__(self))

861

895

for cls in self.__class__.__mro__

862

896

for name, athing in

863

inspect.getmembers(cls,

864

self._is_dbus_thing(thing)))

897

inspect.getmembers(cls, self._is_dbus_thing(thing)))

865

898

866

899

def _get_dbus_property(self, interface_name, property_name):

867

900

"""Returns a bound method if one exists which is a D-Bus

868

901

property with the specified name and interface.

869

902

"""

870

for cls in self.__class__.__mro__:

871

for name, value in (inspect.getmembers

872

(cls,

873

self._is_dbus_thing("property"))):

903

for cls in self.__class__.__mro__:

904

for name, value in inspect.getmembers(

905

cls, self._is_dbus_thing("property")):

874

906

if (value._dbus_name == property_name

875

907

and value._dbus_interface == interface_name):

876

908

return value.__get__(self)

877

909

878

910

# No such property

879

raise DBusPropertyNotFound(self.dbus_object_path + ":"

880

+ interface_name + "."

881

+ property_name)

911

raise DBusPropertyNotFound("{}:{}.{}".format(

912

self.dbus_object_path, interface_name, property_name))

882

913

883

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

914

@dbus.service.method(dbus.PROPERTIES_IFACE,

915

in_signature="ss",

884

916

out_signature="v")

885

917

def Get(self, interface_name, property_name):

886

918

"""Standard D-Bus property Get() method, see D-Bus standard.

904

936

# The byte_arrays option is not supported yet on

905

937

# signatures other than "ay".

906

938

if prop._dbus_signature != "ay":

907

raise ValueError

939

raise ValueError("Byte arrays not supported for non-"

940

"'ay' signature {!r}"

941

.format(prop._dbus_signature))

908

942

value = dbus.ByteArray(b''.join(chr(byte)

909

943

for byte in value))

910

944

prop(value)

911

945

912

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

946

@dbus.service.method(dbus.PROPERTIES_IFACE,

947

in_signature="s",

913

948

out_signature="a{sv}")

914

949

def GetAll(self, interface_name):

915

950

"""Standard D-Bus property GetAll() method, see D-Bus

930

965

if not hasattr(value, "variant_level"):

931

966

properties[name] = value

932

967

continue

933

properties[name] = type(value)(value, variant_level=

934

value.variant_level+1)

968

properties[name] = type(value)(

969

value, variant_level = value.variant_level + 1)

935

970

return dbus.Dictionary(properties, signature="sv")

936

971

972

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

973

def PropertiesChanged(self, interface_name, changed_properties,

974

invalidated_properties):

975

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

976

standard.

977

"""

978

pass

979

937

980

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

938

981

out_signature="s",

939

982

path_keyword='object_path',

947

990

connection)

948

991

try:

949

992

document = xml.dom.minidom.parseString(xmlstring)

993

950

994

def make_tag(document, name, prop):

951

995

e = document.createElement("property")

952

996

e.setAttribute("name", name)

953

997

e.setAttribute("type", prop._dbus_signature)

954

998

e.setAttribute("access", prop._dbus_access)

955

999

return e

1000

956

1001

for if_tag in document.getElementsByTagName("interface"):

957

1002

# Add property tags

958

1003

for tag in (make_tag(document, name, prop)

970

1015

if (name == tag.getAttribute("name")

971

1016

and prop._dbus_interface

972

1017

== if_tag.getAttribute("name")):

973

annots.update(getattr

974

(prop,

975

"_dbus_annotations",

976

{}))

977

for name, value in annots.iteritems():

1018

annots.update(getattr(

1019

prop, "_dbus_annotations", {}))

1020

for name, value in annots.items():

978

1021

ann_tag = document.createElement(

979

1022

"annotation")

980

1023

ann_tag.setAttribute("name", name)

983

1026

# Add interface annotation tags

984

1027

for annotation, value in dict(

985

1028

itertools.chain.from_iterable(

986

annotations().iteritems()

987

for name, annotations in

988

self._get_all_dbus_things("interface")

1029

annotations().items()

1030

for name, annotations

1031

in self._get_all_dbus_things("interface")

989

1032

if name == if_tag.getAttribute("name")

990

)).iteritems():

1033

)).items():

991

1034

ann_tag = document.createElement("annotation")

992

1035

ann_tag.setAttribute("name", annotation)

993

1036

ann_tag.setAttribute("value", value)

1020

1063

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1021

1064

if dt is None:

1022

1065

return dbus.String("", variant_level = variant_level)

1023

return dbus.String(dt.isoformat(),

1024

variant_level=variant_level)

1066

return dbus.String(dt.isoformat(), variant_level=variant_level)

1025

1067

1026

1068

1027

1069

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1047

1089

(from DBusObjectWithProperties) and interfaces (from the

1048

1090

dbus_interface_annotations decorator).

1049

1091

"""

1092

1050

1093

def wrapper(cls):

1051

1094

for orig_interface_name, alt_interface_name in (

1052

alt_interface_names.iteritems()):

1095

alt_interface_names.items()):

1053

1096

attr = {}

1054

1097

interface_names = set()

1055

1098

# Go though all attributes of the class

1057

1100

# Ignore non-D-Bus attributes, and D-Bus attributes

1058

1101

# with the wrong interface name

1059

1102

if (not hasattr(attribute, "_dbus_interface")

1060

or not attribute._dbus_interface

1061

.startswith(orig_interface_name)):

1103

or not attribute._dbus_interface.startswith(

1104

orig_interface_name)):

1062

1105

continue

1063

1106

# Create an alternate D-Bus interface name based on

1064

1107

# the current name

1065

alt_interface = (attribute._dbus_interface

1066

.replace(orig_interface_name,

1067

alt_interface_name))

1108

alt_interface = attribute._dbus_interface.replace(

1109

orig_interface_name, alt_interface_name)

1068

1110

interface_names.add(alt_interface)

1069

1111

# Is this a D-Bus signal?

1070

1112

if getattr(attribute, "_dbus_is_signal", False):

1071

# Extract the original non-method function by

1072

# black magic

1073

nonmethod_func = (dict(

1113

if sys.version_info.major == 2:

1114

# Extract the original non-method undecorated

1115

# function by black magic

1116

nonmethod_func = (dict(

1074

1117

zip(attribute.func_code.co_freevars,

1075

attribute.__closure__))["func"]

1076

.cell_contents)

1118

attribute.__closure__))

1119

["func"].cell_contents)

1120

else:

1121

nonmethod_func = attribute

1077

1122

# Create a new, but exactly alike, function

1078

1123

# object, and decorate it to be a new D-Bus signal

1079

1124

# with the alternate D-Bus interface name

1080

new_function = (dbus.service.signal

1081

(alt_interface,

1082

attribute._dbus_signature)

1083

(types.FunctionType(

1084

nonmethod_func.func_code,

1085

nonmethod_func.func_globals,

1086

nonmethod_func.func_name,

1087

nonmethod_func.func_defaults,

1088

nonmethod_func.func_closure)))

1125

if sys.version_info.major == 2:

1126

new_function = types.FunctionType(

1127

nonmethod_func.func_code,

1128

nonmethod_func.func_globals,

1129

nonmethod_func.func_name,

1130

nonmethod_func.func_defaults,

1131

nonmethod_func.func_closure)

1132

else:

1133

new_function = types.FunctionType(

1134

nonmethod_func.__code__,

1135

nonmethod_func.__globals__,

1136

nonmethod_func.__name__,

1137

nonmethod_func.__defaults__,

1138

nonmethod_func.__closure__)

1139

new_function = (dbus.service.signal(

1140

alt_interface,

1141

attribute._dbus_signature)(new_function))

1089

1142

# Copy annotations, if any

1090

1143

try:

1091

new_function._dbus_annotations = (

1092

dict(attribute._dbus_annotations))

1144

new_function._dbus_annotations = dict(

1145

attribute._dbus_annotations)

1093

1146

except AttributeError:

1094

1147

pass

1095

1148

# Define a creator of a function to call both the

1100

1153

"""This function is a scope container to pass

1101

1154

func1 and func2 to the "call_both" function

1102

1155

outside of its arguments"""

1156

1103

1157

def call_both(*args, **kwargs):

1104

1158

"""This function will emit two D-Bus

1105

1159

signals by calling func1 and func2"""

1106

1160

func1(*args, **kwargs)

1107

1161

func2(*args, **kwargs)

1162

1108

1163

return call_both

1109

1164

# Create the "call_both" function and add it to

1110

1165

# the class

1115

1170

# object. Decorate it to be a new D-Bus method

1116

1171

# with the alternate D-Bus interface name. Add it

1117

1172

# to the class.

1118

attr[attrname] = (dbus.service.method

1119

(alt_interface,

1120

attribute._dbus_in_signature,

1121

attribute._dbus_out_signature)

1122

(types.FunctionType

1123

(attribute.func_code,

1124

attribute.func_globals,

1125

attribute.func_name,

1126

attribute.func_defaults,

1127

attribute.func_closure)))

1173

attr[attrname] = (

1174

dbus.service.method(

1175

alt_interface,

1176

attribute._dbus_in_signature,

1177

attribute._dbus_out_signature)

1178

(types.FunctionType(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1128

1183

# Copy annotations, if any

1129

1184

try:

1130

attr[attrname]._dbus_annotations = (

1131

dict(attribute._dbus_annotations))

1185

attr[attrname]._dbus_annotations = dict(

1186

attribute._dbus_annotations)

1132

1187

except AttributeError:

1133

1188

pass

1134

1189

# Is this a D-Bus property?

1137

1192

# object, and decorate it to be a new D-Bus

1138

1193

# property with the alternate D-Bus interface

1139

1194

# name. Add it to the class.

1140

attr[attrname] = (dbus_service_property

1141

(alt_interface,

1142

attribute._dbus_signature,

1143

attribute._dbus_access,

1144

attribute

1145

._dbus_get_args_options

1146

["byte_arrays"])

1147

(types.FunctionType

1148

(attribute.func_code,

1149

attribute.func_globals,

1150

attribute.func_name,

1151

attribute.func_defaults,

1152

attribute.func_closure)))

1195

attr[attrname] = (dbus_service_property(

1196

alt_interface, attribute._dbus_signature,

1197

attribute._dbus_access,

1198

attribute._dbus_get_args_options

1199

["byte_arrays"])

1200

(types.FunctionType(

1201

attribute.func_code,

1202

attribute.func_globals,

1203

attribute.func_name,

1204

attribute.func_defaults,

1205

attribute.func_closure)))

1153

1206

# Copy annotations, if any

1154

1207

try:

1155

attr[attrname]._dbus_annotations = (

1156

dict(attribute._dbus_annotations))

1208

attr[attrname]._dbus_annotations = dict(

1209

attribute._dbus_annotations)

1157

1210

except AttributeError:

1158

1211

pass

1159

1212

# Is this a D-Bus interface?

1162

1215

# object. Decorate it to be a new D-Bus interface

1163

1216

# with the alternate D-Bus interface name. Add it

1164

1217

# to the class.

1165

attr[attrname] = (dbus_interface_annotations

1166

(alt_interface)

1167

(types.FunctionType

1168

(attribute.func_code,

1169

attribute.func_globals,

1170

attribute.func_name,

1171

attribute.func_defaults,

1172

attribute.func_closure)))

1218

attr[attrname] = (

1219

dbus_interface_annotations(alt_interface)

1220

(types.FunctionType(attribute.func_code,

1221

attribute.func_globals,

1222

attribute.func_name,

1223

attribute.func_defaults,

1224

attribute.func_closure)))

1173

1225

if deprecate:

1174

1226

# Deprecate all alternate interfaces

1175

iname="_AlternateDBusNames_interface_annotation{0}"

1227

iname="_AlternateDBusNames_interface_annotation{}"

1176

1228

for interface_name in interface_names:

1229

1177

1230

@dbus_interface_annotations(interface_name)

1178

1231

def func(self):

1179

1232

return { "org.freedesktop.DBus.Deprecated":

1180

"true" }

1233

"true" }

1181

1234

# Find an unused name

1182

1235

for aname in (iname.format(i)

1183

1236

for i in itertools.count()):

1187

1240

if interface_names:

1188

1241

# Replace the class with a new subclass of it with

1189

1242

# methods, signals, etc. as created above.

1190

cls = type(b"{0}Alternate".format(cls.__name__),

1191

(cls,), attr)

1243

cls = type(b"{}Alternate".format(cls.__name__),

1244

(cls, ), attr)

1192

1245

return cls

1246

1193

1247

return wrapper

1194

1248

1195

1249

1196

1250

@alternate_dbus_interfaces({"se.recompile.Mandos":

1197

"se.bsnet.fukt.Mandos"})

1251

"se.bsnet.fukt.Mandos"})

1198

1252

class ClientDBus(Client, DBusObjectWithProperties):

1199

1253

"""A Client class using D-Bus

1200

1254

1204

1258

"""

1205

1259

1206

1260

runtime_expansions = (Client.runtime_expansions

1207

+ ("dbus_object_path",))

1261

+ ("dbus_object_path", ))

1262

1263

_interface = "se.recompile.Mandos.Client"

1208

1264

1209

1265

# dbus.service.Object doesn't use super(), so we can't either.

1210

1266

1213

1269

Client.__init__(self, *args, **kwargs)

1214

1270

# Only now, when this client is initialized, can it show up on

1215

1271

# the D-Bus

1216

client_object_name = unicode(self.name).translate(

1272

client_object_name = str(self.name).translate(

1217

1273

{ord("."): ord("_"),

1218

1274

ord("-"): ord("_")})

1219

self.dbus_object_path = (dbus.ObjectPath

1220

("/clients/" + client_object_name))

1275

self.dbus_object_path = dbus.ObjectPath(

1276

"/clients/" + client_object_name)

1221

1277

DBusObjectWithProperties.__init__(self, self.bus,

1222

1278

self.dbus_object_path)

1223

1279

1224

def notifychangeproperty(transform_func,

1225

dbus_name, type_func=lambda x: x,

1226

variant_level=1):

1280

def notifychangeproperty(transform_func, dbus_name,

1281

type_func=lambda x: x,

1282

variant_level=1,

1283

invalidate_only=False,

1284

_interface=_interface):

1227

1285

""" Modify a variable so that it's a property which announces

1228

1286

its changes to DBus.

1229

1287

1234

1292

to the D-Bus. Default: no transform

1235

1293

variant_level: D-Bus variant level. Default: 1

1236

1294

"""

1237

attrname = "_{0}".format(dbus_name)

1295

attrname = "_{}".format(dbus_name)

1296

1238

1297

def setter(self, value):

1239

1298

if hasattr(self, "dbus_object_path"):

1240

1299

if (not hasattr(self, attrname) or

1241

1300

type_func(getattr(self, attrname, None))

1242

1301

!= type_func(value)):

1243

dbus_value = transform_func(type_func(value),

1244

variant_level

1245

=variant_level)

1246

self.PropertyChanged(dbus.String(dbus_name),

1247

dbus_value)

1302

if invalidate_only:

1303

self.PropertiesChanged(

1304

_interface, dbus.Dictionary(),

1305

dbus.Array((dbus_name, )))

1306

else:

1307

dbus_value = transform_func(

1308

type_func(value),

1309

variant_level = variant_level)

1310

self.PropertyChanged(dbus.String(dbus_name),

1311

dbus_value)

1312

self.PropertiesChanged(

1313

_interface,

1314

dbus.Dictionary({ dbus.String(dbus_name):

1315

dbus_value }),

1316

dbus.Array())

1248

1317

setattr(self, attrname, value)

1249

1318

1250

1319

return property(lambda self: getattr(self, attrname), setter)

1256

1325

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1257

1326

last_enabled = notifychangeproperty(datetime_to_dbus,

1258

1327

"LastEnabled")

1259

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1260

type_func = lambda checker:

1261

checker is not None)

1328

checker = notifychangeproperty(

1329

dbus.Boolean, "CheckerRunning",

1330

type_func = lambda checker: checker is not None)

1262

1331

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1263

1332

"LastCheckedOK")

1264

1333

last_checker_status = notifychangeproperty(dbus.Int16,

1267

1336

datetime_to_dbus, "LastApprovalRequest")

1268

1337

approved_by_default = notifychangeproperty(dbus.Boolean,

1269

1338

"ApprovedByDefault")

1270

approval_delay = notifychangeproperty(dbus.UInt64,

1271

"ApprovalDelay",

1272

type_func =

1273

timedelta_to_milliseconds)

1339

approval_delay = notifychangeproperty(

1340

dbus.UInt64, "ApprovalDelay",

1341

type_func = lambda td: td.total_seconds() * 1000)

1274

1342

approval_duration = notifychangeproperty(

1275

1343

dbus.UInt64, "ApprovalDuration",

1276

type_func = timedelta_to_milliseconds)

1344

type_func = lambda td: td.total_seconds() * 1000)

1277

1345

host = notifychangeproperty(dbus.String, "Host")

1278

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1279

type_func =

1280

timedelta_to_milliseconds)

1346

timeout = notifychangeproperty(

1347

dbus.UInt64, "Timeout",

1348

type_func = lambda td: td.total_seconds() * 1000)

1281

1349

extended_timeout = notifychangeproperty(

1282

1350

dbus.UInt64, "ExtendedTimeout",

1283

type_func = timedelta_to_milliseconds)

1284

interval = notifychangeproperty(dbus.UInt64,

1285

"Interval",

1286

type_func =

1287

timedelta_to_milliseconds)

1351

type_func = lambda td: td.total_seconds() * 1000)

1352

interval = notifychangeproperty(

1353

dbus.UInt64, "Interval",

1354

type_func = lambda td: td.total_seconds() * 1000)

1288

1355

checker_command = notifychangeproperty(dbus.String, "Checker")

1356

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1357

invalidate_only=True)

1289

1358

1290

1359

del notifychangeproperty

1291

1360

1298

1367

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1299

1368

Client.__del__(self, *args, **kwargs)

1300

1369

1301

def checker_callback(self, pid, condition, command,

1302

*args, **kwargs):

1303

self.checker_callback_tag = None

1304

self.checker = None

1305

if os.WIFEXITED(condition):

1306

exitstatus = os.WEXITSTATUS(condition)

1370

def checker_callback(self, source, condition,

1371

connection, command, *args, **kwargs):

1372

ret = Client.checker_callback(self, source, condition,

1373

connection, command, *args,

1374

**kwargs)

1375

exitstatus = self.last_checker_status

1376

if exitstatus >= 0:

1307

1377

# Emit D-Bus signal

1308

1378

self.CheckerCompleted(dbus.Int16(exitstatus),

1309

dbus.Int64(condition),

1379

dbus.Int64(0),

1310

1380

dbus.String(command))

1311

1381

else:

1312

1382

# Emit D-Bus signal

1313

1383

self.CheckerCompleted(dbus.Int16(-1),

1314

dbus.Int64(condition),

1384

dbus.Int64(

1385

self.last_checker_signal),

1315

1386

dbus.String(command))

1316

1317

return Client.checker_callback(self, pid, condition, command,

1318

*args, **kwargs)

1387

return ret

1319

1388

1320

1389

def start_checker(self, *args, **kwargs):

1321

old_checker = self.checker

1322

if self.checker is not None:

1323

old_checker_pid = self.checker.pid

1324

else:

1325

old_checker_pid = None

1390

old_checker_pid = getattr(self.checker, "pid", None)

1326

1391

r = Client.start_checker(self, *args, **kwargs)

1327

1392

# Only if new checker process was started

1328

1393

if (self.checker is not None

1337

1402

1338

1403

def approve(self, value=True):

1339

1404

self.approved = value

1340

gobject.timeout_add(timedelta_to_milliseconds

1341

(self.approval_duration),

1342

self._reset_approved)

1405

gobject.timeout_add(int(self.approval_duration.total_seconds()

1406

* 1000), self._reset_approved)

1343

1407

self.send_changedstate()

1344

1408

1345

1409

## D-Bus methods, signals & properties

1346

_interface = "se.recompile.Mandos.Client"

1347

1410

1348

1411

## Interfaces

1349

1412

1350

@dbus_interface_annotations(_interface)

1351

def _foo(self):

1352

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1353

"false"}

1354

1355

1413

## Signals

1356

1414

1357

1415

# CheckerCompleted - signal

1367

1425

pass

1368

1426

1369

1427

# PropertyChanged - signal

1428

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1370

1429

@dbus.service.signal(_interface, signature="sv")

1371

1430

def PropertyChanged(self, property, value):

1372

1431

"D-Bus signal"

1406

1465

self.checked_ok()

1407

1466

1408

1467

# Enable - method

1468

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1409

1469

@dbus.service.method(_interface)

1410

1470

def Enable(self):

1411

1471

"D-Bus method"

1412

1472

self.enable()

1413

1473

1414

1474

# StartChecker - method

1475

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1415

1476

@dbus.service.method(_interface)

1416

1477

def StartChecker(self):

1417

1478

"D-Bus method"

1418

1479

self.start_checker()

1419

1480

1420

1481

# Disable - method

1482

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1421

1483

@dbus.service.method(_interface)

1422

1484

def Disable(self):

1423

1485

"D-Bus method"

1424

1486

self.disable()

1425

1487

1426

1488

# StopChecker - method

1489

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1427

1490

@dbus.service.method(_interface)

1428

1491

def StopChecker(self):

1429

1492

self.stop_checker()

1436

1499

return dbus.Boolean(bool(self.approvals_pending))

1437

1500

1438

1501

# ApprovedByDefault - property

1439

@dbus_service_property(_interface, signature="b",

1502

@dbus_service_property(_interface,

1503

signature="b",

1440

1504

access="readwrite")

1441

1505

def ApprovedByDefault_dbus_property(self, value=None):

1442

1506

if value is None: # get

1444

1508

self.approved_by_default = bool(value)

1445

1509

1446

1510

# ApprovalDelay - property

1447

@dbus_service_property(_interface, signature="t",

1511

@dbus_service_property(_interface,

1512

signature="t",

1448

1513

access="readwrite")

1449

1514

def ApprovalDelay_dbus_property(self, value=None):

1450

1515

if value is None: # get

1451

return dbus.UInt64(self.approval_delay_milliseconds())

1516

return dbus.UInt64(self.approval_delay.total_seconds()

1517

* 1000)

1452

1518

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1453

1519

1454

1520

# ApprovalDuration - property

1455

@dbus_service_property(_interface, signature="t",

1521

@dbus_service_property(_interface,

1522

signature="t",

1456

1523

access="readwrite")

1457

1524

def ApprovalDuration_dbus_property(self, value=None):

1458

1525

if value is None: # get

1459

return dbus.UInt64(timedelta_to_milliseconds(

1460

self.approval_duration))

1526

return dbus.UInt64(self.approval_duration.total_seconds()

1527

* 1000)

1461

1528

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1462

1529

1463

1530

# Name - property

1531

@dbus_annotations(

1532

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1464

1533

@dbus_service_property(_interface, signature="s", access="read")

1465

1534

def Name_dbus_property(self):

1466

1535

return dbus.String(self.name)

1467

1536

1468

1537

# Fingerprint - property

1538

@dbus_annotations(

1539

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1469

1540

@dbus_service_property(_interface, signature="s", access="read")

1470

1541

def Fingerprint_dbus_property(self):

1471

1542

return dbus.String(self.fingerprint)

1472

1543

1473

1544

# Host - property

1474

@dbus_service_property(_interface, signature="s",

1545

@dbus_service_property(_interface,

1546

signature="s",

1475

1547

access="readwrite")

1476

1548

def Host_dbus_property(self, value=None):

1477

1549

if value is None: # get

1478

1550

return dbus.String(self.host)

1479

self.host = unicode(value)

1551

self.host = str(value)

1480

1552

1481

1553

# Created - property

1554

@dbus_annotations(

1555

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1482

1556

@dbus_service_property(_interface, signature="s", access="read")

1483

1557

def Created_dbus_property(self):

1484

1558

return datetime_to_dbus(self.created)

1489

1563

return datetime_to_dbus(self.last_enabled)

1490

1564

1491

1565

# Enabled - property

1492

@dbus_service_property(_interface, signature="b",

1566

@dbus_service_property(_interface,

1567

signature="b",

1493

1568

access="readwrite")

1494

1569

def Enabled_dbus_property(self, value=None):

1495

1570

if value is None: # get

1500

1575

self.disable()

1501

1576

1502

1577

# LastCheckedOK - property

1503

@dbus_service_property(_interface, signature="s",

1578

@dbus_service_property(_interface,

1579

signature="s",

1504

1580

access="readwrite")

1505

1581

def LastCheckedOK_dbus_property(self, value=None):

1506

1582

if value is not None:

1509

1585

return datetime_to_dbus(self.last_checked_ok)

1510

1586

1511

1587

# LastCheckerStatus - property

1512

@dbus_service_property(_interface, signature="n",

1513

access="read")

1588

@dbus_service_property(_interface, signature="n", access="read")

1514

1589

def LastCheckerStatus_dbus_property(self):

1515

1590

return dbus.Int16(self.last_checker_status)

1516

1591

1525

1600

return datetime_to_dbus(self.last_approval_request)

1526

1601

1527

1602

# Timeout - property

1528

@dbus_service_property(_interface, signature="t",

1603

@dbus_service_property(_interface,

1604

signature="t",

1529

1605

access="readwrite")

1530

1606

def Timeout_dbus_property(self, value=None):

1531

1607

if value is None: # get

1532

return dbus.UInt64(self.timeout_milliseconds())

1608

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1533

1609

old_timeout = self.timeout

1534

1610

self.timeout = datetime.timedelta(0, 0, 0, value)

1535

1611

# Reschedule disabling

1544

1620

is None):

1545

1621

return

1546

1622

gobject.source_remove(self.disable_initiator_tag)

1547

self.disable_initiator_tag = (

1548

gobject.timeout_add(

1549

timedelta_to_milliseconds(self.expires - now),

1550

self.disable))

1623

self.disable_initiator_tag = gobject.timeout_add(

1624

int((self.expires - now).total_seconds() * 1000),

1625

self.disable)

1551

1626

1552

1627

# ExtendedTimeout - property

1553

@dbus_service_property(_interface, signature="t",

1628

@dbus_service_property(_interface,

1629

signature="t",

1554

1630

access="readwrite")

1555

1631

def ExtendedTimeout_dbus_property(self, value=None):

1556

1632

if value is None: # get

1557

return dbus.UInt64(self.extended_timeout_milliseconds())

1633

return dbus.UInt64(self.extended_timeout.total_seconds()

1634

* 1000)

1558

1635

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1559

1636

1560

1637

# Interval - property

1561

@dbus_service_property(_interface, signature="t",

1638

@dbus_service_property(_interface,

1639

signature="t",

1562

1640

access="readwrite")

1563

1641

def Interval_dbus_property(self, value=None):

1564

1642

if value is None: # get

1565

return dbus.UInt64(self.interval_milliseconds())

1643

return dbus.UInt64(self.interval.total_seconds() * 1000)

1566

1644

self.interval = datetime.timedelta(0, 0, 0, value)

1567

1645

if getattr(self, "checker_initiator_tag", None) is None:

1568

1646

return

1569

1647

if self.enabled:

1570

1648

# Reschedule checker run

1571

1649

gobject.source_remove(self.checker_initiator_tag)

1572

self.checker_initiator_tag = (gobject.timeout_add

1573

(value, self.start_checker))

1574

self.start_checker() # Start one now, too

1650

self.checker_initiator_tag = gobject.timeout_add(

1651

value, self.start_checker)

1652

self.start_checker() # Start one now, too

1575

1653

1576

1654

# Checker - property

1577

@dbus_service_property(_interface, signature="s",

1655

@dbus_service_property(_interface,

1656

signature="s",

1578

1657

access="readwrite")

1579

1658

def Checker_dbus_property(self, value=None):

1580

1659

if value is None: # get

1581

1660

return dbus.String(self.checker_command)

1582

self.checker_command = unicode(value)

1661

self.checker_command = str(value)

1583

1662

1584

1663

# CheckerRunning - property

1585

@dbus_service_property(_interface, signature="b",

1664

@dbus_service_property(_interface,

1665

signature="b",

1586

1666

access="readwrite")

1587

1667

def CheckerRunning_dbus_property(self, value=None):

1588

1668

if value is None: # get

1593

1673

self.stop_checker()

1594

1674

1595

1675

# ObjectPath - property

1676

@dbus_annotations(

1677

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1596

1678

@dbus_service_property(_interface, signature="o", access="read")

1597

1679

def ObjectPath_dbus_property(self):

1598

1680

return self.dbus_object_path # is already a dbus.ObjectPath

1599

1681

1600

1682

# Secret = property

1601

@dbus_service_property(_interface, signature="ay",

1602

access="write", byte_arrays=True)

1683

@dbus_annotations(

1684

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

1685

"invalidates"})

1686

@dbus_service_property(_interface,

1687

signature="ay",

1688

access="write",

1689

byte_arrays=True)

1603

1690

def Secret_dbus_property(self, value):

1604

self.secret = str(value)

1691

self.secret = bytes(value)

1605

1692

1606

1693

del _interface

1607

1694

1611

1698

self._pipe = child_pipe

1612

1699

self._pipe.send(('init', fpr, address))

1613

1700

if not self._pipe.recv():

1614

raise KeyError()

1701

raise KeyError(fpr)

1615

1702

1616

1703

def __getattribute__(self, name):

1617

1704

if name == '_pipe':

1621

1708

if data[0] == 'data':

1622

1709

return data[1]

1623

1710

if data[0] == 'function':

1711

1624

1712

def func(*args, **kwargs):

1625

1713

self._pipe.send(('funcall', name, args, kwargs))

1626

1714

return self._pipe.recv()[1]

1715

1627

1716

return func

1628

1717

1629

1718

def __setattr__(self, name, value):

1641

1730

def handle(self):

1642

1731

with contextlib.closing(self.server.child_pipe) as child_pipe:

1643

1732

logger.info("TCP connection from: %s",

1644

unicode(self.client_address))

1733

str(self.client_address))

1645

1734

logger.debug("Pipe FD: %d",

1646

1735

self.server.child_pipe.fileno())

1647

1736

1648

session = (gnutls.connection

1649

.ClientSession(self.request,

1650

gnutls.connection

1651

.X509Credentials()))

1737

session = gnutls.connection.ClientSession(

1738

self.request, gnutls.connection .X509Credentials())

1652

1739

1653

1740

# Note: gnutls.connection.X509Credentials is really a

1654

1741

# generic GnuTLS certificate credentials object so long as

1663

1750

priority = self.server.gnutls_priority

1664

1751

if priority is None:

1665

1752

priority = "NORMAL"

1666

(gnutls.library.functions

1667

.gnutls_priority_set_direct(session._c_object,

1668

priority, None))

1753

gnutls.library.functions.gnutls_priority_set_direct(

1754

session._c_object, priority, None)

1669

1755

1670

1756

# Start communication using the Mandos protocol

1671

1757

# Get protocol number

1673

1759

logger.debug("Protocol version: %r", line)

1674

1760

try:

1675

1761

if int(line.strip().split()[0]) > 1:

1676

raise RuntimeError

1762

raise RuntimeError(line)

1677

1763

except (ValueError, IndexError, RuntimeError) as error:

1678

1764

logger.error("Unknown protocol version: %s", error)

1679

1765

return

1691

1777

approval_required = False

1692

1778

try:

1693

1779

try:

1694

fpr = self.fingerprint(self.peer_certificate

1695

(session))

1780

fpr = self.fingerprint(

1781

self.peer_certificate(session))

1696

1782

except (TypeError,

1697

1783

gnutls.errors.GNUTLSError) as error:

1698

1784

logger.warning("Bad certificate: %s", error)

1713

1799

while True:

1714

1800

if not client.enabled:

1715

1801

logger.info("Client %s is disabled",

1716

client.name)

1802

client.name)

1717

1803

if self.server.use_dbus:

1718

1804

# Emit D-Bus signal

1719

1805

client.Rejected("Disabled")

1728

1814

if self.server.use_dbus:

1729

1815

# Emit D-Bus signal

1730

1816

client.NeedApproval(

1731

client.approval_delay_milliseconds(),

1732

client.approved_by_default)

1817

client.approval_delay.total_seconds()

1818

* 1000, client.approved_by_default)

1733

1819

else:

1734

1820

logger.warning("Client %s was not approved",

1735

1821

client.name)

1741

1827

#wait until timeout or approved

1742

1828

time = datetime.datetime.now()

1743

1829

client.changedstate.acquire()

1744

client.changedstate.wait(

1745

float(timedelta_to_milliseconds(delay)

1746

/ 1000))

1830

client.changedstate.wait(delay.total_seconds())

1747

1831

client.changedstate.release()

1748

1832

time2 = datetime.datetime.now()

1749

1833

if (time2 - time) >= delay:

1768

1852

logger.warning("gnutls send failed",

1769

1853

exc_info=error)

1770

1854

return

1771

logger.debug("Sent: %d, remaining: %d",

1772

sent, len(client.secret)

1773

- (sent_size + sent))

1855

logger.debug("Sent: %d, remaining: %d", sent,

1856

len(client.secret) - (sent_size

1857

+ sent))

1774

1858

sent_size += sent

1775

1859

1776

1860

logger.info("Sending secret to %s", client.name)

1793

1877

def peer_certificate(session):

1794

1878

"Return the peer's OpenPGP certificate as a bytestring"

1795

1879

# If not an OpenPGP certificate...

1796

if (gnutls.library.functions

1797

.gnutls_certificate_type_get(session._c_object)

1880

if (gnutls.library.functions.gnutls_certificate_type_get(

1881

session._c_object)

1798

1882

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1799

1883

# ...do the normal thing

1800

1884

return session.peer_certificate

1814

1898

def fingerprint(openpgp):

1815

1899

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1816

1900

# New GnuTLS "datum" with the OpenPGP public key

1817

datum = (gnutls.library.types

1818

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1819

ctypes.POINTER

1820

(ctypes.c_ubyte)),

1821

ctypes.c_uint(len(openpgp))))

1901

datum = gnutls.library.types.gnutls_datum_t(

1902

ctypes.cast(ctypes.c_char_p(openpgp),

1903

ctypes.POINTER(ctypes.c_ubyte)),

1904

ctypes.c_uint(len(openpgp)))

1822

1905

# New empty GnuTLS certificate

1823

1906

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1824

(gnutls.library.functions

1825

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1907

gnutls.library.functions.gnutls_openpgp_crt_init(

1908

ctypes.byref(crt))

1826

1909

# Import the OpenPGP public key into the certificate

1827

(gnutls.library.functions

1828

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1829

gnutls.library.constants

1830

.GNUTLS_OPENPGP_FMT_RAW))

1910

gnutls.library.functions.gnutls_openpgp_crt_import(

1911

crt, ctypes.byref(datum),

1912

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1831

1913

# Verify the self signature in the key

1832

1914

crtverify = ctypes.c_uint()

1833

(gnutls.library.functions

1834

.gnutls_openpgp_crt_verify_self(crt, 0,

1835

ctypes.byref(crtverify)))

1915

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1916

crt, 0, ctypes.byref(crtverify))

1836

1917

if crtverify.value != 0:

1837

1918

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1838

raise (gnutls.errors.CertificateSecurityError

1839

("Verify failed"))

1919

raise gnutls.errors.CertificateSecurityError(

1920

"Verify failed")

1840

1921

# New buffer for the fingerprint

1841

1922

buf = ctypes.create_string_buffer(20)

1842

1923

buf_len = ctypes.c_size_t()

1843

1924

# Get the fingerprint from the certificate into the buffer

1844

(gnutls.library.functions

1845

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1846

ctypes.byref(buf_len)))

1925

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1926

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1847

1927

# Deinit the certificate

1848

1928

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1849

1929

# Convert the buffer to a Python bytestring

1855

1935

1856

1936

class MultiprocessingMixIn(object):

1857

1937

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1938

1858

1939

def sub_process_main(self, request, address):

1859

1940

try:

1860

1941

self.finish_request(request, address)

1872

1953

1873

1954

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1874

1955

""" adds a pipe to the MixIn """

1956

1875

1957

def process_request(self, request, client_address):

1876

1958

"""Overrides and wraps the original process_request().

1877

1959

1886

1968

1887

1969

def add_pipe(self, parent_pipe, proc):

1888

1970

"""Dummy function; override as necessary"""

1889

raise NotImplementedError

1971

raise NotImplementedError()

1890

1972

1891

1973

1892

1974

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1898

1980

interface: None or a network interface name (string)

1899

1981

use_ipv6: Boolean; to use IPv6 or not

1900

1982

"""

1983

1901

1984

def __init__(self, server_address, RequestHandlerClass,

1902

interface=None, use_ipv6=True, socketfd=None):

1985

interface=None,

1986

use_ipv6=True,

1987

socketfd=None):

1903

1988

"""If socketfd is set, use that file descriptor instead of

1904

1989

creating a new one with socket.socket().

1905

1990

"""

1946

2031

self.interface)

1947

2032

else:

1948

2033

try:

1949

self.socket.setsockopt(socket.SOL_SOCKET,

1950

SO_BINDTODEVICE,

1951

str(self.interface + '\0'))

2034

self.socket.setsockopt(

2035

socket.SOL_SOCKET, SO_BINDTODEVICE,

2036

(self.interface + "\0").encode("utf-8"))

1952

2037

except socket.error as error:

1953

2038

if error.errno == errno.EPERM:

1954

2039

logger.error("No permission to bind to"

1968

2053

if self.address_family == socket.AF_INET6:

1969

2054

any_address = "::" # in6addr_any

1970

2055

else:

1971

any_address = socket.INADDR_ANY

2056

any_address = "0.0.0.0" # INADDR_ANY

1972

2057

self.server_address = (any_address,

1973

2058

self.server_address[1])

1974

2059

elif not self.server_address[1]:

1975

self.server_address = (self.server_address[0],

1976

0)

2060

self.server_address = (self.server_address[0], 0)

1977

2061

# if self.interface:

1978

2062

# self.server_address = (self.server_address[0],

1979

2063

# 0, # port

1993

2077

1994

2078

Assumes a gobject.MainLoop event loop.

1995

2079

"""

2080

1996

2081

def __init__(self, server_address, RequestHandlerClass,

1997

interface=None, use_ipv6=True, clients=None,

1998

gnutls_priority=None, use_dbus=True, socketfd=None):

2082

interface=None,

2083

use_ipv6=True,

2084

clients=None,

2085

gnutls_priority=None,

2086

use_dbus=True,

2087

socketfd=None):

1999

2088

self.enabled = False

2000

2089

self.clients = clients

2001

2090

if self.clients is None:

2007

2096

interface = interface,

2008

2097

use_ipv6 = use_ipv6,

2009

2098

socketfd = socketfd)

2099

2010

2100

def server_activate(self):

2011

2101

if self.enabled:

2012

2102

return socketserver.TCPServer.server_activate(self)

2016

2106

2017

2107

def add_pipe(self, parent_pipe, proc):

2018

2108

# Call "handle_ipc" for both data and EOF events

2019

gobject.io_add_watch(parent_pipe.fileno(),

2020

gobject.IO_IN | gobject.IO_HUP,

2021

functools.partial(self.handle_ipc,

2022

parent_pipe =

2023

parent_pipe,

2024

proc = proc))

2109

gobject.io_add_watch(

2110

parent_pipe.fileno(),

2111

gobject.IO_IN | gobject.IO_HUP,

2112

functools.partial(self.handle_ipc,

2113

parent_pipe = parent_pipe,

2114

proc = proc))

2025

2115

2026

def handle_ipc(self, source, condition, parent_pipe=None,

2027

proc = None, client_object=None):

2116

def handle_ipc(self, source, condition,

2117

parent_pipe=None,

2118

proc = None,

2119

client_object=None):

2028

2120

# error, or the other end of multiprocessing.Pipe has closed

2029

2121

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2030

2122

# Wait for other process to exit

2053

2145

parent_pipe.send(False)

2054

2146

return False

2055

2147

2056

gobject.io_add_watch(parent_pipe.fileno(),

2057

gobject.IO_IN | gobject.IO_HUP,

2058

functools.partial(self.handle_ipc,

2059

parent_pipe =

2060

parent_pipe,

2061

proc = proc,

2062

client_object =

2063

client))

2148

gobject.io_add_watch(

2149

parent_pipe.fileno(),

2150

gobject.IO_IN | gobject.IO_HUP,

2151

functools.partial(self.handle_ipc,

2152

parent_pipe = parent_pipe,

2153

proc = proc,

2154

client_object = client))

2064

2155

parent_pipe.send(True)

2065

2156

# remove the old hook in favor of the new above hook on

2066

2157

# same fileno

2072

2163

2073

2164

parent_pipe.send(('data', getattr(client_object,

2074

2165

funcname)(*args,

2075

**kwargs)))

2166

**kwargs)))

2076

2167

2077

2168

if command == 'getattr':

2078

2169

attrname = request[1]

2079

if callable(client_object.__getattribute__(attrname)):

2080

parent_pipe.send(('function',))

2170

if isinstance(client_object.__getattribute__(attrname),

2171

collections.Callable):

2172

parent_pipe.send(('function', ))

2081

2173

else:

2082

parent_pipe.send(('data', client_object

2083

.__getattribute__(attrname)))

2174

parent_pipe.send((

2175

'data', client_object.__getattribute__(attrname)))

2084

2176

2085

2177

if command == 'setattr':

2086

2178

attrname = request[1]

2090

2182

return True

2091

2183

2092

2184

2185

def rfc3339_duration_to_delta(duration):

2186

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2187

2188

>>> rfc3339_duration_to_delta("P7D")

2189

datetime.timedelta(7)

2190

>>> rfc3339_duration_to_delta("PT60S")

2191

datetime.timedelta(0, 60)

2192

>>> rfc3339_duration_to_delta("PT60M")

2193

datetime.timedelta(0, 3600)

2194

>>> rfc3339_duration_to_delta("PT24H")

2195

datetime.timedelta(1)

2196

>>> rfc3339_duration_to_delta("P1W")

2197

datetime.timedelta(7)

2198

>>> rfc3339_duration_to_delta("PT5M30S")

2199

datetime.timedelta(0, 330)

2200

>>> rfc3339_duration_to_delta("P1DT3M20S")

2201

datetime.timedelta(1, 200)

2202

"""

2203

2204

# Parsing an RFC 3339 duration with regular expressions is not

2205

# possible - there would have to be multiple places for the same

2206

# values, like seconds. The current code, while more esoteric, is

2207

# cleaner without depending on a parsing library. If Python had a

2208

# built-in library for parsing we would use it, but we'd like to

2209

# avoid excessive use of external libraries.

2210

2211

# New type for defining tokens, syntax, and semantics all-in-one

2212

Token = collections.namedtuple("Token", (

2213

"regexp", # To match token; if "value" is not None, must have

2214

# a "group" containing digits

2215

"value", # datetime.timedelta or None

2216

"followers")) # Tokens valid after this token

2217

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2218

# the "duration" ABNF definition in RFC 3339, Appendix A.

2219

token_end = Token(re.compile(r"$"), None, frozenset())

2220

token_second = Token(re.compile(r"(\d+)S"),

2221

datetime.timedelta(seconds=1),

2222

frozenset((token_end, )))

2223

token_minute = Token(re.compile(r"(\d+)M"),

2224

datetime.timedelta(minutes=1),

2225

frozenset((token_second, token_end)))

2226

token_hour = Token(re.compile(r"(\d+)H"),

2227

datetime.timedelta(hours=1),

2228

frozenset((token_minute, token_end)))

2229

token_time = Token(re.compile(r"T"),

2230

None,

2231

frozenset((token_hour, token_minute,

2232

token_second)))

2233

token_day = Token(re.compile(r"(\d+)D"),

2234

datetime.timedelta(days=1),

2235

frozenset((token_time, token_end)))

2236

token_month = Token(re.compile(r"(\d+)M"),

2237

datetime.timedelta(weeks=4),

2238

frozenset((token_day, token_end)))

2239

token_year = Token(re.compile(r"(\d+)Y"),

2240

datetime.timedelta(weeks=52),

2241

frozenset((token_month, token_end)))

2242

token_week = Token(re.compile(r"(\d+)W"),

2243

datetime.timedelta(weeks=1),

2244

frozenset((token_end, )))

2245

token_duration = Token(re.compile(r"P"), None,

2246

frozenset((token_year, token_month,

2247

token_day, token_time,

2248

token_week)))

2249

# Define starting values

2250

value = datetime.timedelta() # Value so far

2251

found_token = None

2252

followers = frozenset((token_duration, )) # Following valid tokens

2253

s = duration # String left to parse

2254

# Loop until end token is found

2255

while found_token is not token_end:

2256

# Search for any currently valid tokens

2257

for token in followers:

2258

match = token.regexp.match(s)

2259

if match is not None:

2260

# Token found

2261

if token.value is not None:

2262

# Value found, parse digits

2263

factor = int(match.group(1), 10)

2264

# Add to value so far

2265

value += factor * token.value

2266

# Strip token from string

2267

s = token.regexp.sub("", s, 1)

2268

# Go to found token

2269

found_token = token

2270

# Set valid next tokens

2271

followers = found_token.followers

2272

break

2273

else:

2274

# No currently valid tokens were found

2275

raise ValueError("Invalid RFC 3339 duration: {!r}"

2276

.format(duration))

2277

# End token found

2278

return value

2279

2280

2093

2281

def string_to_delta(interval):

2094

2282

"""Parse a string and return a datetime.timedelta

2095

2283

2106

2294

>>> string_to_delta('5m 30s')

2107

2295

datetime.timedelta(0, 330)

2108

2296

"""

2297

2298

try:

2299

return rfc3339_duration_to_delta(interval)

2300

except ValueError:

2301

pass

2302

2109

2303

timevalue = datetime.timedelta(0)

2110

2304

for s in interval.split():

2111

2305

try:

2112

suffix = unicode(s[-1])

2306

suffix = s[-1]

2113

2307

value = int(s[:-1])

2114

2308

if suffix == "d":

2115

2309

delta = datetime.timedelta(value)

2122

2316

elif suffix == "w":

2123

2317

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2124

2318

else:

2125

raise ValueError("Unknown suffix {0!r}"

2126

.format(suffix))

2127

except (ValueError, IndexError) as e:

2319

raise ValueError("Unknown suffix {!r}".format(suffix))

2320

except IndexError as e:

2128

2321

raise ValueError(*(e.args))

2129

2322

timevalue += delta

2130

2323

return timevalue

2146

2339

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2147

2340

if not stat.S_ISCHR(os.fstat(null).st_mode):

2148

2341

raise OSError(errno.ENODEV,

2149

"{0} not a character device"

2342

"{} not a character device"

2150

2343

.format(os.devnull))

2151

2344

os.dup2(null, sys.stdin.fileno())

2152

2345

os.dup2(null, sys.stdout.fileno())

2162

2355

2163

2356

parser = argparse.ArgumentParser()

2164

2357

parser.add_argument("-v", "--version", action="version",

2165

version = "%(prog)s {0}".format(version),

2358

version = "%(prog)s {}".format(version),

2166

2359

help="show version number and exit")

2167

2360

parser.add_argument("-i", "--interface", metavar="IF",

2168

2361

help="Bind to interface IF")

2174

2367

help="Run self-test")

2175

2368

parser.add_argument("--debug", action="store_true",

2176

2369

help="Debug mode; run in foreground and log"

2177

" to terminal")

2370

" to terminal", default=None)

2178

2371

parser.add_argument("--debuglevel", metavar="LEVEL",

2179

2372

help="Debug level for stdout output")

2180

2373

parser.add_argument("--priority", help="GnuTLS"

2187

2380

" files")

2188

2381

parser.add_argument("--no-dbus", action="store_false",

2189

2382

dest="use_dbus", help="Do not provide D-Bus"

2190

" system bus interface")

2383

" system bus interface", default=None)

2191

2384

parser.add_argument("--no-ipv6", action="store_false",

2192

dest="use_ipv6", help="Do not use IPv6")

2385

dest="use_ipv6", help="Do not use IPv6",

2386

default=None)

2193

2387

parser.add_argument("--no-restore", action="store_false",

2194

2388

dest="restore", help="Do not restore stored"

2195

" state")

2389

" state", default=None)

2196

2390

parser.add_argument("--socket", type=int,

2197

2391

help="Specify a file descriptor to a network"

2198

2392

" socket to use instead of creating one")

2199

2393

parser.add_argument("--statedir", metavar="DIR",

2200

2394

help="Directory to save/restore state in")

2201

2395

parser.add_argument("--foreground", action="store_true",

2202

help="Run in foreground")

2396

help="Run in foreground", default=None)

2397

parser.add_argument("--no-zeroconf", action="store_false",

2398

dest="zeroconf", help="Do not use Zeroconf",

2399

default=None)

2203

2400

2204

2401

options = parser.parse_args()

2205

2402

2206

2403

if options.check:

2207

2404

import doctest

2208

doctest.testmod()

2209

sys.exit()

2405

fail_count, test_count = doctest.testmod()

2406

sys.exit(os.EX_OK if fail_count == 0 else 1)

2210

2407

2211

2408

# Default values for config file for server-global settings

2212

2409

server_defaults = { "interface": "",

2214

2411

"port": "",

2215

2412

"debug": "False",

2216

2413

"priority":

2217

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2414

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2415

":+SIGN-DSA-SHA256",

2218

2416

"servicename": "Mandos",

2219

2417

"use_dbus": "True",

2220

2418

"use_ipv6": "True",

2223

2421

"socket": "",

2224

2422

"statedir": "/var/lib/mandos",

2225

2423

"foreground": "False",

2226

}

2424

"zeroconf": "True",

2425

}

2227

2426

2228

2427

# Parse config file for server-global settings

2229

2428

server_config = configparser.SafeConfigParser(server_defaults)

2230

2429

del server_defaults

2231

server_config.read(os.path.join(options.configdir,

2232

"mandos.conf"))

2430

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2233

2431

# Convert the SafeConfigParser object to a dict

2234

2432

server_settings = server_config.defaults()

2235

2433

# Use the appropriate methods on the non-string config options

2253

2451

# Override the settings from the config file with command line

2254

2452

# options, if set.

2255

2453

for option in ("interface", "address", "port", "debug",

2256

"priority", "servicename", "configdir",

2257

"use_dbus", "use_ipv6", "debuglevel", "restore",

2258

"statedir", "socket", "foreground"):

2454

"priority", "servicename", "configdir", "use_dbus",

2455

"use_ipv6", "debuglevel", "restore", "statedir",

2456

"socket", "foreground", "zeroconf"):

2259

2457

value = getattr(options, option)

2260

2458

if value is not None:

2261

2459

server_settings[option] = value

2262

2460

del options

2263

2461

# Force all strings to be unicode

2264

2462

for option in server_settings.keys():

2265

if type(server_settings[option]) is str:

2266

server_settings[option] = unicode(server_settings[option])

2463

if isinstance(server_settings[option], bytes):

2464

server_settings[option] = (server_settings[option]

2465

.decode("utf-8"))

2466

# Force all boolean options to be boolean

2467

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2468

"foreground", "zeroconf"):

2469

server_settings[option] = bool(server_settings[option])

2267

2470

# Debug implies foreground

2268

2471

if server_settings["debug"]:

2269

2472

server_settings["foreground"] = True

2271

2474

2272

2475

##################################################################

2273

2476

2477

if (not server_settings["zeroconf"]

2478

and not (server_settings["port"]

2479

or server_settings["socket"] != "")):

2480

parser.error("Needs port or socket to work without Zeroconf")

2481

2274

2482

# For convenience

2275

2483

debug = server_settings["debug"]

2276

2484

debuglevel = server_settings["debuglevel"]

2279

2487

stored_state_path = os.path.join(server_settings["statedir"],

2280

2488

stored_state_file)

2281

2489

foreground = server_settings["foreground"]

2490

zeroconf = server_settings["zeroconf"]

2282

2491

2283

2492

if debug:

2284

2493

initlogger(debug, logging.DEBUG)

2290

2499

initlogger(debug, level)

2291

2500

2292

2501

if server_settings["servicename"] != "Mandos":

2293

syslogger.setFormatter(logging.Formatter

2294

('Mandos ({0}) [%(process)d]:'

2295

' %(levelname)s: %(message)s'

2296

.format(server_settings

2297

["servicename"])))

2502

syslogger.setFormatter(

2503

logging.Formatter('Mandos ({}) [%(process)d]:'

2504

' %(levelname)s: %(message)s'.format(

2505

server_settings["servicename"])))

2298

2506

2299

2507

# Parse config file with clients

2300

2508

client_config = configparser.SafeConfigParser(Client

2305

2513

global mandos_dbus_service

2306

2514

mandos_dbus_service = None

2307

2515

2308

tcp_server = MandosServer((server_settings["address"],

2309

server_settings["port"]),

2310

ClientHandler,

2311

interface=(server_settings["interface"]

2312

or None),

2313

use_ipv6=use_ipv6,

2314

gnutls_priority=

2315

server_settings["priority"],

2316

use_dbus=use_dbus,

2317

socketfd=(server_settings["socket"]

2318

or None))

2516

socketfd = None

2517

if server_settings["socket"] != "":

2518

socketfd = server_settings["socket"]

2519

tcp_server = MandosServer(

2520

(server_settings["address"], server_settings["port"]),

2521

ClientHandler,

2522

interface=(server_settings["interface"] or None),

2523

use_ipv6=use_ipv6,

2524

gnutls_priority=server_settings["priority"],

2525

use_dbus=use_dbus,

2526

socketfd=socketfd)

2319

2527

if not foreground:

2320

pidfilename = "/var/run/mandos.pid"

2528

pidfilename = "/run/mandos.pid"

2529

if not os.path.isdir("/run/."):

2530

pidfilename = "/var/run/mandos.pid"

2321

2531

pidfile = None

2322

2532

try:

2323

pidfile = open(pidfilename, "w")

2533

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2324

2534

except IOError as e:

2325

2535

logger.error("Could not open file %r", pidfilename,

2326

2536

exc_info=e)

2340

2550

os.setuid(uid)

2341

2551

except OSError as error:

2342

2552

if error.errno != errno.EPERM:

2343

raise error

2553

raise

2344

2554

2345

2555

if debug:

2346

2556

# Enable all possible GnuTLS debugging

2353

2563

def debug_gnutls(level, string):

2354

2564

logger.debug("GnuTLS: %s", string[:-1])

2355

2565

2356

(gnutls.library.functions

2357

.gnutls_global_set_log_function(debug_gnutls))

2566

gnutls.library.functions.gnutls_global_set_log_function(

2567

debug_gnutls)

2358

2568

2359

2569

# Redirect stdin so all checkers get /dev/null

2360

2570

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2380

2590

if use_dbus:

2381

2591

try:

2382

2592

bus_name = dbus.service.BusName("se.recompile.Mandos",

2383

bus, do_not_queue=True)

2384

old_bus_name = (dbus.service.BusName

2385

("se.bsnet.fukt.Mandos", bus,

2386

do_not_queue=True))

2387

except dbus.exceptions.NameExistsException as e:

2593

bus,

2594

do_not_queue=True)

2595

old_bus_name = dbus.service.BusName(

2596

"se.bsnet.fukt.Mandos", bus,

2597

do_not_queue=True)

2598

except dbus.exceptions.DBusException as e:

2388

2599

logger.error("Disabling D-Bus:", exc_info=e)

2389

2600

use_dbus = False

2390

2601

server_settings["use_dbus"] = False

2391

2602

tcp_server.use_dbus = False

2392

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2393

service = AvahiServiceToSyslog(name =

2394

server_settings["servicename"],

2395

servicetype = "_mandos._tcp",

2396

protocol = protocol, bus = bus)

2397

if server_settings["interface"]:

2398

service.interface = (if_nametoindex

2399

(str(server_settings["interface"])))

2603

if zeroconf:

2604

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2605

service = AvahiServiceToSyslog(

2606

name = server_settings["servicename"],

2607

servicetype = "_mandos._tcp",

2608

protocol = protocol,

2609

bus = bus)

2610

if server_settings["interface"]:

2611

service.interface = if_nametoindex(

2612

server_settings["interface"].encode("utf-8"))

2400

2613

2401

2614

global multiprocessing_manager

2402

2615

multiprocessing_manager = multiprocessing.Manager()

2409

2622

old_client_settings = {}

2410

2623

clients_data = {}

2411

2624

2625

# This is used to redirect stdout and stderr for checker processes

2626

global wnull

2627

wnull = open(os.devnull, "w") # A writable /dev/null

2628

# Only used if server is running in foreground but not in debug

2629

# mode

2630

if debug or not foreground:

2631

wnull.close()

2632

2412

2633

# Get client data and settings from last running state.

2413

2634

if server_settings["restore"]:

2414

2635

try:

2415

2636

with open(stored_state_path, "rb") as stored_state:

2416

clients_data, old_client_settings = (pickle.load

2417

(stored_state))

2637

clients_data, old_client_settings = pickle.load(

2638

stored_state)

2418

2639

os.remove(stored_state_path)

2419

2640

except IOError as e:

2420

2641

if e.errno == errno.ENOENT:

2421

logger.warning("Could not load persistent state: {0}"

2422

.format(os.strerror(e.errno)))

2642

logger.warning("Could not load persistent state:"

2643

" {}".format(os.strerror(e.errno)))

2423

2644

else:

2424

2645

logger.critical("Could not load persistent state:",

2425

2646

exc_info=e)

2426

2647

raise

2427

2648

except EOFError as e:

2428

2649

logger.warning("Could not load persistent state: "

2429

"EOFError:", exc_info=e)

2650

"EOFError:",

2651

exc_info=e)

2430

2652

2431

2653

with PGPEngine() as pgp:

2432

for client_name, client in clients_data.iteritems():

2654

for client_name, client in clients_data.items():

2655

# Skip removed clients

2656

if client_name not in client_settings:

2657

continue

2658

2433

2659

# Decide which value to use after restoring saved state.

2434

2660

# We have three different values: Old config file,

2435

2661

# new config file, and saved state.

2440

2666

# For each value in new config, check if it

2441

2667

# differs from the old config value (Except for

2442

2668

# the "secret" attribute)

2443

if (name != "secret" and

2444

value != old_client_settings[client_name]

2445

[name]):

2669

if (name != "secret"

2670

and (value !=

2671

old_client_settings[client_name][name])):

2446

2672

client[name] = value

2447

2673

except KeyError:

2448

2674

pass

2449

2675

2450

2676

# Clients who has passed its expire date can still be

2451

# enabled if its last checker was successful. Clients

2677

# enabled if its last checker was successful. A Client

2452

2678

# whose checker succeeded before we stored its state is

2453

2679

# assumed to have successfully run all checkers during

2454

2680

# downtime.

2456

2682

if datetime.datetime.utcnow() >= client["expires"]:

2457

2683

if not client["last_checked_ok"]:

2458

2684

logger.warning(

2459

"disabling client {0} - Client never "

2460

"performed a successful checker"

2461

.format(client_name))

2685

"disabling client {} - Client never "

2686

"performed a successful checker".format(

2687

client_name))

2462

2688

client["enabled"] = False

2463

2689

elif client["last_checker_status"] != 0:

2464

2690

logger.warning(

2465

"disabling client {0} - Client "

2466

"last checker failed with error code {1}"

2467

.format(client_name,

2468

client["last_checker_status"]))

2691

"disabling client {} - Client last"

2692

" checker failed with error code"

2693

" {}".format(

2694

client_name,

2695

client["last_checker_status"]))

2469

2696

client["enabled"] = False

2470

2697

else:

2471

client["expires"] = (datetime.datetime

2472

.utcnow()

2473

+ client["timeout"])

2698

client["expires"] = (

2699

datetime.datetime.utcnow()

2700

+ client["timeout"])

2474

2701

logger.debug("Last checker succeeded,"

2475

" keeping {0} enabled"

2476

.format(client_name))

2702

" keeping {} enabled".format(

2703

client_name))

2477

2704

try:

2478

client["secret"] = (

2479

pgp.decrypt(client["encrypted_secret"],

2480

client_settings[client_name]

2481

["secret"]))

2705

client["secret"] = pgp.decrypt(

2706

client["encrypted_secret"],

2707

client_settings[client_name]["secret"])

2482

2708

except PGPError:

2483

2709

# If decryption fails, we use secret from new settings

2484

logger.debug("Failed to decrypt {0} old secret"

2485

.format(client_name))

2486

client["secret"] = (

2487

client_settings[client_name]["secret"])

2710

logger.debug("Failed to decrypt {} old secret".format(

2711

client_name))

2712

client["secret"] = (client_settings[client_name]

2713

["secret"])

2488

2714

2489

2715

# Add/remove clients based on new changes made to config

2490

2716

for client_name in (set(old_client_settings)

2495

2721

clients_data[client_name] = client_settings[client_name]

2496

2722

2497

2723

# Create all client objects

2498

for client_name, client in clients_data.iteritems():

2724

for client_name, client in clients_data.items():

2499

2725

tcp_server.clients[client_name] = client_class(

2500

name = client_name, settings = client)

2726

name = client_name,

2727

settings = client,

2728

server_settings = server_settings)

2501

2729

2502

2730

if not tcp_server.clients:

2503

2731

logger.warning("No clients defined")

2504

2732

2505

2733

if not foreground:

2506

2734

if pidfile is not None:

2735

pid = os.getpid()

2507

2736

try:

2508

2737

with pidfile:

2509

pid = os.getpid()

2510

pidfile.write(str(pid) + "\n".encode("utf-8"))

2738

print(pid, file=pidfile)

2511

2739

except IOError:

2512

2740

logger.error("Could not write to file %r with PID %d",

2513

2741

pidfilename, pid)

2518

2746

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2519

2747

2520

2748

if use_dbus:

2521

@alternate_dbus_interfaces({"se.recompile.Mandos":

2522

"se.bsnet.fukt.Mandos"})

2749

2750

@alternate_dbus_interfaces(

2751

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2523

2752

class MandosDBusService(DBusObjectWithProperties):

2524

2753

"""A D-Bus proxy object"""

2754

2525

2755

def __init__(self):

2526

2756

dbus.service.Object.__init__(self, bus, "/")

2757

2527

2758

_interface = "se.recompile.Mandos"

2528

2759

2529

2760

@dbus_interface_annotations(_interface)

2530

2761

def _foo(self):

2531

return { "org.freedesktop.DBus.Property"

2532

".EmitsChangedSignal":

2533

"false"}

2762

return {

2763

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2764

"false" }

2534

2765

2535

2766

@dbus.service.signal(_interface, signature="o")

2536

2767

def ClientAdded(self, objpath):

2550

2781

@dbus.service.method(_interface, out_signature="ao")

2551

2782

def GetAllClients(self):

2552

2783

"D-Bus method"

2553

return dbus.Array(c.dbus_object_path

2554

for c in

2784

return dbus.Array(c.dbus_object_path for c in

2555

2785

tcp_server.clients.itervalues())

2556

2786

2557

2787

@dbus.service.method(_interface,

2559

2789

def GetAllClientsWithProperties(self):

2560

2790

"D-Bus method"

2561

2791

return dbus.Dictionary(

2562

((c.dbus_object_path, c.GetAll(""))

2563

for c in tcp_server.clients.itervalues()),

2792

{ c.dbus_object_path: c.GetAll("")

2793

for c in tcp_server.clients.itervalues() },

2564

2794

signature="oa{sv}")

2565

2795

2566

2796

@dbus.service.method(_interface, in_signature="o")

2583

2813

2584

2814

def cleanup():

2585

2815

"Cleanup function; run on exit"

2586

service.cleanup()

2816

if zeroconf:

2817

service.cleanup()

2587

2818

2588

2819

multiprocessing.active_children()

2820

wnull.close()

2589

2821

if not (tcp_server.clients or client_settings):

2590

2822

return

2591

2823

2602

2834

2603

2835

# A list of attributes that can not be pickled

2604

2836

# + secret.

2605

exclude = set(("bus", "changedstate", "secret",

2606

"checker"))

2607

for name, typ in (inspect.getmembers

2608

(dbus.service.Object)):

2837

exclude = { "bus", "changedstate", "secret",

2838

"checker", "server_settings" }

2839

for name, typ in inspect.getmembers(dbus.service

2840

.Object):

2609

2841

exclude.add(name)

2610

2842

2611

2843

client_dict["encrypted_secret"] = (client

2618

2850

del client_settings[client.name]["secret"]

2619

2851

2620

2852

try:

2621

with (tempfile.NamedTemporaryFile

2622

(mode='wb', suffix=".pickle", prefix='clients-',

2623

dir=os.path.dirname(stored_state_path),

2624

delete=False)) as stored_state:

2853

with tempfile.NamedTemporaryFile(

2854

mode='wb',

2855

suffix=".pickle",

2856

prefix='clients-',

2857

dir=os.path.dirname(stored_state_path),

2858

delete=False) as stored_state:

2625

2859

pickle.dump((clients, client_settings), stored_state)

2626

tempname=stored_state.name

2860

tempname = stored_state.name

2627

2861

os.rename(tempname, stored_state_path)

2628

2862

except (IOError, OSError) as e:

2629

2863

if not debug:

2632

2866

except NameError:

2633

2867

pass

2634

2868

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2635

logger.warning("Could not save persistent state: {0}"

2869

logger.warning("Could not save persistent state: {}"

2636

2870

.format(os.strerror(e.errno)))

2637

2871

else:

2638

2872

logger.warning("Could not save persistent state:",

2639

2873

exc_info=e)

2640

raise e

2874

raise

2641

2875

2642

2876

# Delete all clients, and settings from config

2643

2877

while tcp_server.clients:

2648

2882

client.disable(quiet=True)

2649

2883

if use_dbus:

2650

2884

# Emit D-Bus signal

2651

mandos_dbus_service.ClientRemoved(client

2652

.dbus_object_path,

2653

client.name)

2885

mandos_dbus_service.ClientRemoved(

2886

client.dbus_object_path, client.name)

2654

2887

client_settings.clear()

2655

2888

2656

2889

atexit.register(cleanup)

2667

2900

tcp_server.server_activate()

2668

2901

2669

2902

# Find out what port we got

2670

service.port = tcp_server.socket.getsockname()[1]

2903

if zeroconf:

2904

service.port = tcp_server.socket.getsockname()[1]

2671

2905

if use_ipv6:

2672

2906

logger.info("Now listening on address %r, port %d,"

2673

2907

" flowinfo %d, scope_id %d",

2679

2913

#service.interface = tcp_server.socket.getsockname()[3]

2680

2914

2681

2915

try:

2682

# From the Avahi example code

2683

try:

2684

service.activate()

2685

except dbus.exceptions.DBusException as error:

2686

logger.critical("D-Bus Exception", exc_info=error)

2687

cleanup()

2688

sys.exit(1)

2689

# End of Avahi example code

2916

if zeroconf:

2917

# From the Avahi example code

2918

try:

2919

service.activate()

2920

except dbus.exceptions.DBusException as error:

2921

logger.critical("D-Bus Exception", exc_info=error)

2922

cleanup()

2923

sys.exit(1)

2924

# End of Avahi example code

2690

2925

2691

2926

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2692

2927

lambda *args, **kwargs:

2707

2942

# Must run before the D-Bus bus name gets deregistered

2708

2943

cleanup()

2709

2944

2945

2710

2946

if __name__ == '__main__':

2711

2947

main()