237
104
max_renames: integer; maximum number of renames
238
105
rename_count: integer; counter so we only rename after collisions
239
106
a sensible number of times
240
group: D-Bus Entry Group
242
bus: dbus.SystemBus()
244
108
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
245
servicetype = None, port = None, TXT = None,
246
domain = "", host = "", max_renames = 32768,
247
protocol = avahi.PROTO_UNSPEC, bus = None):
109
type = None, port = None, TXT = None, domain = "",
110
host = "", max_renames = 32768):
248
111
self.interface = interface
250
self.type = servicetype
252
self.TXT = TXT if TXT is not None else []
253
119
self.domain = domain
255
121
self.rename_count = 0
256
122
self.max_renames = max_renames
257
self.protocol = protocol
258
self.group = None # our entry group
261
self.entry_group_state_changed_match = None
262
123
def rename(self):
263
124
"""Derived from the Avahi example code"""
264
125
if self.rename_count >= self.max_renames:
265
logger.critical("No suitable Zeroconf service name found"
266
" after %i retries, exiting.",
126
logger.critical(u"No suitable service name found after %i"
127
u" retries, exiting.", rename_count)
268
128
raise AvahiServiceError("Too many renames")
269
self.name = unicode(self.server
270
.GetAlternativeServiceName(self.name))
271
logger.info("Changing Zeroconf service name to %r ...",
129
self.name = server.GetAlternativeServiceName(self.name)
130
logger.info(u"Changing name to %r ...", str(self.name))
131
syslogger.setFormatter(logging.Formatter\
132
('Mandos (%s): %%(levelname)s:'
133
' %%(message)s' % self.name))
276
except dbus.exceptions.DBusException as error:
277
logger.critical("DBusException: %s", error)
280
136
self.rename_count += 1
281
137
def remove(self):
282
138
"""Derived from the Avahi example code"""
283
if self.entry_group_state_changed_match is not None:
284
self.entry_group_state_changed_match.remove()
285
self.entry_group_state_changed_match = None
286
if self.group is not None:
139
if group is not None:
289
142
"""Derived from the Avahi example code"""
291
if self.group is None:
292
self.group = dbus.Interface(
293
self.bus.get_object(avahi.DBUS_NAME,
294
self.server.EntryGroupNew()),
295
avahi.DBUS_INTERFACE_ENTRY_GROUP)
296
self.entry_group_state_changed_match = (
297
self.group.connect_to_signal(
298
'StateChanged', self.entry_group_state_changed))
299
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
300
self.name, self.type)
301
self.group.AddService(
304
dbus.UInt32(0), # flags
305
self.name, self.type,
306
self.domain, self.host,
307
dbus.UInt16(self.port),
308
avahi.string_array_to_txt_array(self.TXT))
310
def entry_group_state_changed(self, state, error):
311
"""Derived from the Avahi example code"""
312
logger.debug("Avahi entry group state change: %i", state)
314
if state == avahi.ENTRY_GROUP_ESTABLISHED:
315
logger.debug("Zeroconf service established.")
316
elif state == avahi.ENTRY_GROUP_COLLISION:
317
logger.info("Zeroconf service name collision.")
319
elif state == avahi.ENTRY_GROUP_FAILURE:
320
logger.critical("Avahi: Error in group state changed %s",
322
raise AvahiGroupError("State changed: %s"
325
"""Derived from the Avahi example code"""
326
if self.group is not None:
329
except (dbus.exceptions.UnknownMethodException,
330
dbus.exceptions.DBusException):
334
def server_state_changed(self, state, error=None):
335
"""Derived from the Avahi example code"""
336
logger.debug("Avahi server state change: %i", state)
337
bad_states = { avahi.SERVER_INVALID:
338
"Zeroconf server invalid",
339
avahi.SERVER_REGISTERING: None,
340
avahi.SERVER_COLLISION:
341
"Zeroconf server name collision",
342
avahi.SERVER_FAILURE:
343
"Zeroconf server failure" }
344
if state in bad_states:
345
if bad_states[state] is not None:
347
logger.error(bad_states[state])
349
logger.error(bad_states[state] + ": %r", error)
351
elif state == avahi.SERVER_RUNNING:
355
logger.debug("Unknown state: %r", state)
357
logger.debug("Unknown state: %r: %r", state, error)
359
"""Derived from the Avahi example code"""
360
if self.server is None:
361
self.server = dbus.Interface(
362
self.bus.get_object(avahi.DBUS_NAME,
363
avahi.DBUS_PATH_SERVER,
364
follow_name_owner_changes=True),
365
avahi.DBUS_INTERFACE_SERVER)
366
self.server.connect_to_signal("StateChanged",
367
self.server_state_changed)
368
self.server_state_changed(self.server.GetState())
370
class AvahiServiceToSyslog(AvahiService):
372
"""Add the new name to the syslog messages"""
373
ret = AvahiService.rename(self)
374
syslogger.setFormatter(logging.Formatter
375
('Mandos (%s) [%%(process)d]:'
376
' %%(levelname)s: %%(message)s'
380
def timedelta_to_milliseconds(td):
381
"Convert a datetime.timedelta() to milliseconds"
382
return ((td.days * 24 * 60 * 60 * 1000)
383
+ (td.seconds * 1000)
384
+ (td.microseconds // 1000))
145
group = dbus.Interface\
146
(bus.get_object(avahi.DBUS_NAME,
147
server.EntryGroupNew()),
148
avahi.DBUS_INTERFACE_ENTRY_GROUP)
149
group.connect_to_signal('StateChanged',
150
entry_group_state_changed)
151
logger.debug(u"Adding service '%s' of type '%s' ...",
152
service.name, service.type)
154
self.interface, # interface
155
avahi.PROTO_INET6, # protocol
156
dbus.UInt32(0), # flags
157
self.name, self.type,
158
self.domain, self.host,
159
dbus.UInt16(self.port),
160
avahi.string_array_to_txt_array(self.TXT))
163
# From the Avahi example code:
164
group = None # our entry group
165
# End of Avahi example code
386
168
class Client(object):
387
169
"""A representation of a client host served by this server.
390
approved: bool(); 'None' if not yet approved/disapproved
391
approval_delay: datetime.timedelta(); Time to wait for approval
392
approval_duration: datetime.timedelta(); Duration of one approval
393
checker: subprocess.Popen(); a running checker process used
394
to see if the client lives.
395
'None' if no process is running.
396
checker_callback_tag: a gobject event source tag, or None
397
checker_command: string; External command which is run to check
398
if client lives. %() expansions are done at
171
name: string; from the config file, used in log messages
172
fingerprint: string (40 or 32 hexadecimal digits); used to
173
uniquely identify the client
174
secret: bytestring; sent verbatim (over TLS) to client
175
host: string; available for use by the checker command
176
created: datetime.datetime(); object creation, not client host
177
last_checked_ok: datetime.datetime() or None if not yet checked OK
178
timeout: datetime.timedelta(); How long from last_checked_ok
179
until this client is invalid
180
interval: datetime.timedelta(); How often to start a new checker
181
stop_hook: If set, called by stop() as stop_hook(self)
182
checker: subprocess.Popen(); a running checker process used
183
to see if the client lives.
184
'None' if no process is running.
185
checker_initiator_tag: a gobject event source tag, or None
186
stop_initiator_tag: - '' -
187
checker_callback_tag: - '' -
188
checker_command: string; External command which is run to check if
189
client lives. %() expansions are done at
399
190
runtime with vars(self) as dict, so that for
400
191
instance %(name)s can be used in the command.
401
checker_initiator_tag: a gobject event source tag, or None
402
created: datetime.datetime(); (UTC) object creation
403
client_structure: Object describing what attributes a client has
404
and is used for storing the client at exit
405
current_checker_command: string; current running checker_command
406
disable_initiator_tag: a gobject event source tag, or None
408
fingerprint: string (40 or 32 hexadecimal digits); used to
409
uniquely identify the client
410
host: string; available for use by the checker command
411
interval: datetime.timedelta(); How often to start a new checker
412
last_approval_request: datetime.datetime(); (UTC) or None
413
last_checked_ok: datetime.datetime(); (UTC) or None
414
last_checker_status: integer between 0 and 255 reflecting exit
415
status of last checker. -1 reflects crashed
417
last_enabled: datetime.datetime(); (UTC) or None
418
name: string; from the config file, used in log messages and
420
secret: bytestring; sent verbatim (over TLS) to client
421
timeout: datetime.timedelta(); How long from last_checked_ok
422
until this client is disabled
423
extended_timeout: extra long timeout when password has been sent
424
runtime_expansions: Allowed attributes for runtime expansion.
425
expires: datetime.datetime(); time (UTC) when a client will be
193
_timeout: Real variable for 'timeout'
194
_interval: Real variable for 'interval'
195
_timeout_milliseconds: Used when calling gobject.timeout_add()
196
_interval_milliseconds: - '' -
429
runtime_expansions = ("approval_delay", "approval_duration",
430
"created", "enabled", "fingerprint",
431
"host", "interval", "last_checked_ok",
432
"last_enabled", "name", "timeout")
433
client_defaults = { "timeout": "5m",
434
"extended_timeout": "15m",
436
"checker": "fping -q -- %%(host)s",
438
"approval_delay": "0s",
439
"approval_duration": "1s",
440
"approved_by_default": "True",
444
def timeout_milliseconds(self):
445
"Return the 'timeout' attribute in milliseconds"
446
return timedelta_to_milliseconds(self.timeout)
448
def extended_timeout_milliseconds(self):
449
"Return the 'extended_timeout' attribute in milliseconds"
450
return timedelta_to_milliseconds(self.extended_timeout)
452
def interval_milliseconds(self):
453
"Return the 'interval' attribute in milliseconds"
454
return timedelta_to_milliseconds(self.interval)
456
def approval_delay_milliseconds(self):
457
return timedelta_to_milliseconds(self.approval_delay)
460
def config_parser(config):
461
""" Construct a new dict of client settings of this form:
462
{ client_name: {setting_name: value, ...}, ...}
463
with exceptions for any special settings as defined above"""
465
for client_name in config.sections():
466
section = dict(config.items(client_name))
467
client = settings[client_name] = {}
469
client["host"] = section["host"]
470
# Reformat values from string types to Python types
471
client["approved_by_default"] = config.getboolean(
472
client_name, "approved_by_default")
473
client["enabled"] = config.getboolean(client_name, "enabled")
475
client["fingerprint"] = (section["fingerprint"].upper()
477
if "secret" in section:
478
client["secret"] = section["secret"].decode("base64")
479
elif "secfile" in section:
480
with open(os.path.expanduser(os.path.expandvars
481
(section["secfile"])),
483
client["secret"] = secfile.read()
485
raise TypeError("No secret or secfile for section %s"
487
client["timeout"] = string_to_delta(section["timeout"])
488
client["extended_timeout"] = string_to_delta(
489
section["extended_timeout"])
490
client["interval"] = string_to_delta(section["interval"])
491
client["approval_delay"] = string_to_delta(
492
section["approval_delay"])
493
client["approval_duration"] = string_to_delta(
494
section["approval_duration"])
495
client["checker_command"] = section["checker"]
496
client["last_approval_request"] = None
497
client["last_checked_ok"] = None
498
client["last_checker_status"] = None
499
if client["enabled"]:
500
client["last_enabled"] = datetime.datetime.utcnow()
501
client["expires"] = (datetime.datetime.utcnow()
504
client["last_enabled"] = None
505
client["expires"] = None
510
def __init__(self, settings, name = None):
198
def _set_timeout(self, timeout):
199
"Setter function for 'timeout' attribute"
200
self._timeout = timeout
201
self._timeout_milliseconds = ((self.timeout.days
202
* 24 * 60 * 60 * 1000)
203
+ (self.timeout.seconds * 1000)
204
+ (self.timeout.microseconds
206
timeout = property(lambda self: self._timeout,
209
def _set_interval(self, interval):
210
"Setter function for 'interval' attribute"
211
self._interval = interval
212
self._interval_milliseconds = ((self.interval.days
213
* 24 * 60 * 60 * 1000)
214
+ (self.interval.seconds
216
+ (self.interval.microseconds
218
interval = property(lambda self: self._interval,
221
def __init__(self, name = None, stop_hook=None, config={}):
511
222
"""Note: the 'checker' key in 'config' sets the
512
223
'checker_command' attribute and *not* the 'checker'
515
# adding all client settings
516
for setting, value in settings.iteritems():
517
setattr(self, setting, value)
519
logger.debug("Creating client %r", self.name)
226
logger.debug(u"Creating client %r", self.name)
520
227
# Uppercase and remove spaces from fingerprint for later
521
228
# comparison purposes with return value from the fingerprint()
523
logger.debug(" Fingerprint: %s", self.fingerprint)
524
self.created = settings.get("created", datetime.datetime.utcnow())
526
# attributes specific for this server instance
230
self.fingerprint = config["fingerprint"].upper()\
232
logger.debug(u" Fingerprint: %s", self.fingerprint)
233
if "secret" in config:
234
self.secret = config["secret"].decode(u"base64")
235
elif "secfile" in config:
236
sf = open(config["secfile"])
237
self.secret = sf.read()
240
raise TypeError(u"No secret or secfile for client %s"
242
self.host = config.get("host", "")
243
self.created = datetime.datetime.now()
244
self.last_checked_ok = None
245
self.timeout = string_to_delta(config["timeout"])
246
self.interval = string_to_delta(config["interval"])
247
self.stop_hook = stop_hook
527
248
self.checker = None
528
249
self.checker_initiator_tag = None
529
self.disable_initiator_tag = None
250
self.stop_initiator_tag = None
530
251
self.checker_callback_tag = None
531
self.current_checker_command = None
533
self.approvals_pending = 0
534
self.changedstate = (multiprocessing_manager
535
.Condition(multiprocessing_manager
537
self.client_structure = [attr for attr in
538
self.__dict__.iterkeys()
539
if not attr.startswith("_")]
540
self.client_structure.append("client_structure")
542
for name, t in inspect.getmembers(type(self),
546
if not name.startswith("_"):
547
self.client_structure.append(name)
549
# Send notice to process children that client state has changed
550
def send_changedstate(self):
551
with self.changedstate:
552
self.changedstate.notify_all()
252
self.check_command = config["checker"]
555
254
"""Start this client's checker and timeout hooks"""
556
if getattr(self, "enabled", False):
559
self.send_changedstate()
560
self.expires = datetime.datetime.utcnow() + self.timeout
562
self.last_enabled = datetime.datetime.utcnow()
565
def disable(self, quiet=True):
566
"""Disable this client."""
567
if not getattr(self, "enabled", False):
255
# Schedule a new checker to be started an 'interval' from now,
256
# and every interval from then on.
257
self.checker_initiator_tag = gobject.timeout_add\
258
(self._interval_milliseconds,
260
# Also start a new checker *right now*.
262
# Schedule a stop() when 'timeout' has passed
263
self.stop_initiator_tag = gobject.timeout_add\
264
(self._timeout_milliseconds,
268
The possibility that a client might be restarted is left open,
269
but not currently used."""
270
# If this client doesn't have a secret, it is already stopped.
271
if hasattr(self, "secret") and self.secret:
272
logger.info(u"Stopping client %s", self.name)
570
self.send_changedstate()
572
logger.info("Disabling client %s", self.name)
573
if getattr(self, "disable_initiator_tag", False):
574
gobject.source_remove(self.disable_initiator_tag)
575
self.disable_initiator_tag = None
276
if getattr(self, "stop_initiator_tag", False):
277
gobject.source_remove(self.stop_initiator_tag)
278
self.stop_initiator_tag = None
577
279
if getattr(self, "checker_initiator_tag", False):
578
280
gobject.source_remove(self.checker_initiator_tag)
579
281
self.checker_initiator_tag = None
580
282
self.stop_checker()
582
285
# Do not run this again if called by a gobject.timeout_add
585
287
def __del__(self):
588
def init_checker(self):
589
# Schedule a new checker to be started an 'interval' from now,
590
# and every interval from then on.
591
self.checker_initiator_tag = (gobject.timeout_add
592
(self.interval_milliseconds(),
594
# Schedule a disable() when 'timeout' has passed
595
self.disable_initiator_tag = (gobject.timeout_add
596
(self.timeout_milliseconds(),
598
# Also start a new checker *right now*.
601
def checker_callback(self, pid, condition, command):
288
self.stop_hook = None
290
def checker_callback(self, pid, condition):
602
291
"""The checker has completed, so take appropriate actions."""
292
now = datetime.datetime.now()
603
293
self.checker_callback_tag = None
604
294
self.checker = None
605
if os.WIFEXITED(condition):
606
self.last_checker_status = os.WEXITSTATUS(condition)
607
if self.last_checker_status == 0:
608
logger.info("Checker for %(name)s succeeded",
612
logger.info("Checker for %(name)s failed",
615
self.last_checker_status = -1
616
logger.warning("Checker for %(name)s crashed?",
295
if os.WIFEXITED(condition) \
296
and (os.WEXITSTATUS(condition) == 0):
297
logger.info(u"Checker for %(name)s succeeded",
299
self.last_checked_ok = now
300
gobject.source_remove(self.stop_initiator_tag)
301
self.stop_initiator_tag = gobject.timeout_add\
302
(self._timeout_milliseconds,
304
elif not os.WIFEXITED(condition):
305
logger.warning(u"Checker for %(name)s crashed?",
619
def checked_ok(self, timeout=None):
620
"""Bump up the timeout for this client.
622
This should only be called when the client has been seen,
626
timeout = self.timeout
627
self.last_checked_ok = datetime.datetime.utcnow()
628
if self.disable_initiator_tag is not None:
629
gobject.source_remove(self.disable_initiator_tag)
630
if getattr(self, "enabled", False):
631
self.disable_initiator_tag = (gobject.timeout_add
632
(timedelta_to_milliseconds
633
(timeout), self.disable))
634
self.expires = datetime.datetime.utcnow() + timeout
636
def need_approval(self):
637
self.last_approval_request = datetime.datetime.utcnow()
308
logger.info(u"Checker for %(name)s failed",
639
310
def start_checker(self):
640
311
"""Start a new checker subprocess if one is not running.
642
312
If a checker already exists, leave it running and do
644
314
# The reason for not killing a running checker is that if we
718
355
self.checker_callback_tag = None
719
356
if getattr(self, "checker", None) is None:
721
logger.debug("Stopping checker for %(name)s", vars(self))
358
logger.debug(u"Stopping checker for %(name)s", vars(self))
723
360
os.kill(self.checker.pid, signal.SIGTERM)
725
362
#if self.checker.poll() is None:
726
363
# os.kill(self.checker.pid, signal.SIGKILL)
727
except OSError as error:
364
except OSError, error:
728
365
if error.errno != errno.ESRCH: # No such process
730
367
self.checker = None
733
def dbus_service_property(dbus_interface, signature="v",
734
access="readwrite", byte_arrays=False):
735
"""Decorators for marking methods of a DBusObjectWithProperties to
736
become properties on the D-Bus.
738
The decorated method will be called with no arguments by "Get"
739
and with one argument by "Set".
741
The parameters, where they are supported, are the same as
742
dbus.service.method, except there is only "signature", since the
743
type from Get() and the type sent to Set() is the same.
745
# Encoding deeply encoded byte arrays is not supported yet by the
746
# "Set" method, so we fail early here:
747
if byte_arrays and signature != "ay":
748
raise ValueError("Byte arrays not supported for non-'ay'"
749
" signature %r" % signature)
751
func._dbus_is_property = True
752
func._dbus_interface = dbus_interface
753
func._dbus_signature = signature
754
func._dbus_access = access
755
func._dbus_name = func.__name__
756
if func._dbus_name.endswith("_dbus_property"):
757
func._dbus_name = func._dbus_name[:-14]
758
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
763
class DBusPropertyException(dbus.exceptions.DBusException):
764
"""A base class for D-Bus property-related exceptions
766
def __unicode__(self):
767
return unicode(str(self))
770
class DBusPropertyAccessException(DBusPropertyException):
771
"""A property's access permissions disallows an operation.
776
class DBusPropertyNotFound(DBusPropertyException):
777
"""An attempt was made to access a non-existing property.
782
class DBusObjectWithProperties(dbus.service.Object):
783
"""A D-Bus object with properties.
785
Classes inheriting from this can use the dbus_service_property
786
decorator to expose methods as D-Bus properties. It exposes the
787
standard Get(), Set(), and GetAll() methods on the D-Bus.
791
def _is_dbus_property(obj):
792
return getattr(obj, "_dbus_is_property", False)
794
def _get_all_dbus_properties(self):
795
"""Returns a generator of (name, attribute) pairs
797
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
798
for cls in self.__class__.__mro__
800
inspect.getmembers(cls, self._is_dbus_property))
802
def _get_dbus_property(self, interface_name, property_name):
803
"""Returns a bound method if one exists which is a D-Bus
804
property with the specified name and interface.
806
for cls in self.__class__.__mro__:
807
for name, value in (inspect.getmembers
808
(cls, self._is_dbus_property)):
809
if (value._dbus_name == property_name
810
and value._dbus_interface == interface_name):
811
return value.__get__(self)
814
raise DBusPropertyNotFound(self.dbus_object_path + ":"
815
+ interface_name + "."
818
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
820
def Get(self, interface_name, property_name):
821
"""Standard D-Bus property Get() method, see D-Bus standard.
823
prop = self._get_dbus_property(interface_name, property_name)
824
if prop._dbus_access == "write":
825
raise DBusPropertyAccessException(property_name)
827
if not hasattr(value, "variant_level"):
829
return type(value)(value, variant_level=value.variant_level+1)
831
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
832
def Set(self, interface_name, property_name, value):
833
"""Standard D-Bus property Set() method, see D-Bus standard.
835
prop = self._get_dbus_property(interface_name, property_name)
836
if prop._dbus_access == "read":
837
raise DBusPropertyAccessException(property_name)
838
if prop._dbus_get_args_options["byte_arrays"]:
839
# The byte_arrays option is not supported yet on
840
# signatures other than "ay".
841
if prop._dbus_signature != "ay":
843
value = dbus.ByteArray(''.join(unichr(byte)
847
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
848
out_signature="a{sv}")
849
def GetAll(self, interface_name):
850
"""Standard D-Bus property GetAll() method, see D-Bus
853
Note: Will not include properties with access="write".
856
for name, prop in self._get_all_dbus_properties():
858
and interface_name != prop._dbus_interface):
859
# Interface non-empty but did not match
861
# Ignore write-only properties
862
if prop._dbus_access == "write":
865
if not hasattr(value, "variant_level"):
866
properties[name] = value
868
properties[name] = type(value)(value, variant_level=
869
value.variant_level+1)
870
return dbus.Dictionary(properties, signature="sv")
872
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
874
path_keyword='object_path',
875
connection_keyword='connection')
876
def Introspect(self, object_path, connection):
877
"""Standard D-Bus method, overloaded to insert property tags.
879
xmlstring = dbus.service.Object.Introspect(self, object_path,
882
document = xml.dom.minidom.parseString(xmlstring)
883
def make_tag(document, name, prop):
884
e = document.createElement("property")
885
e.setAttribute("name", name)
886
e.setAttribute("type", prop._dbus_signature)
887
e.setAttribute("access", prop._dbus_access)
889
for if_tag in document.getElementsByTagName("interface"):
890
for tag in (make_tag(document, name, prop)
892
in self._get_all_dbus_properties()
893
if prop._dbus_interface
894
== if_tag.getAttribute("name")):
895
if_tag.appendChild(tag)
896
# Add the names to the return values for the
897
# "org.freedesktop.DBus.Properties" methods
898
if (if_tag.getAttribute("name")
899
== "org.freedesktop.DBus.Properties"):
900
for cn in if_tag.getElementsByTagName("method"):
901
if cn.getAttribute("name") == "Get":
902
for arg in cn.getElementsByTagName("arg"):
903
if (arg.getAttribute("direction")
905
arg.setAttribute("name", "value")
906
elif cn.getAttribute("name") == "GetAll":
907
for arg in cn.getElementsByTagName("arg"):
908
if (arg.getAttribute("direction")
910
arg.setAttribute("name", "props")
911
xmlstring = document.toxml("utf-8")
913
except (AttributeError, xml.dom.DOMException,
914
xml.parsers.expat.ExpatError) as error:
915
logger.error("Failed to override Introspection method",
920
def datetime_to_dbus (dt, variant_level=0):
921
"""Convert a UTC datetime.datetime() to a D-Bus type."""
923
return dbus.String("", variant_level = variant_level)
924
return dbus.String(dt.isoformat(),
925
variant_level=variant_level)
928
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
930
"""Applied to an empty subclass of a D-Bus object, this metaclass
931
will add additional D-Bus attributes matching a certain pattern.
933
def __new__(mcs, name, bases, attr):
934
# Go through all the base classes which could have D-Bus
935
# methods, signals, or properties in them
936
for base in (b for b in bases
937
if issubclass(b, dbus.service.Object)):
938
# Go though all attributes of the base class
939
for attrname, attribute in inspect.getmembers(base):
940
# Ignore non-D-Bus attributes, and D-Bus attributes
941
# with the wrong interface name
942
if (not hasattr(attribute, "_dbus_interface")
943
or not attribute._dbus_interface
944
.startswith("se.recompile.Mandos")):
946
# Create an alternate D-Bus interface name based on
948
alt_interface = (attribute._dbus_interface
949
.replace("se.recompile.Mandos",
950
"se.bsnet.fukt.Mandos"))
951
# Is this a D-Bus signal?
952
if getattr(attribute, "_dbus_is_signal", False):
953
# Extract the original non-method function by
955
nonmethod_func = (dict(
956
zip(attribute.func_code.co_freevars,
957
attribute.__closure__))["func"]
959
# Create a new, but exactly alike, function
960
# object, and decorate it to be a new D-Bus signal
961
# with the alternate D-Bus interface name
962
new_function = (dbus.service.signal
964
attribute._dbus_signature)
966
nonmethod_func.func_code,
967
nonmethod_func.func_globals,
968
nonmethod_func.func_name,
969
nonmethod_func.func_defaults,
970
nonmethod_func.func_closure)))
971
# Define a creator of a function to call both the
972
# old and new functions, so both the old and new
973
# signals gets sent when the function is called
974
def fixscope(func1, func2):
975
"""This function is a scope container to pass
976
func1 and func2 to the "call_both" function
977
outside of its arguments"""
978
def call_both(*args, **kwargs):
979
"""This function will emit two D-Bus
980
signals by calling func1 and func2"""
981
func1(*args, **kwargs)
982
func2(*args, **kwargs)
984
# Create the "call_both" function and add it to
986
attr[attrname] = fixscope(attribute,
988
# Is this a D-Bus method?
989
elif getattr(attribute, "_dbus_is_method", False):
990
# Create a new, but exactly alike, function
991
# object. Decorate it to be a new D-Bus method
992
# with the alternate D-Bus interface name. Add it
994
attr[attrname] = (dbus.service.method
996
attribute._dbus_in_signature,
997
attribute._dbus_out_signature)
999
(attribute.func_code,
1000
attribute.func_globals,
1001
attribute.func_name,
1002
attribute.func_defaults,
1003
attribute.func_closure)))
1004
# Is this a D-Bus property?
1005
elif getattr(attribute, "_dbus_is_property", False):
1006
# Create a new, but exactly alike, function
1007
# object, and decorate it to be a new D-Bus
1008
# property with the alternate D-Bus interface
1009
# name. Add it to the class.
1010
attr[attrname] = (dbus_service_property
1012
attribute._dbus_signature,
1013
attribute._dbus_access,
1015
._dbus_get_args_options
1018
(attribute.func_code,
1019
attribute.func_globals,
1020
attribute.func_name,
1021
attribute.func_defaults,
1022
attribute.func_closure)))
1023
return type.__new__(mcs, name, bases, attr)
1026
class ClientDBus(Client, DBusObjectWithProperties):
1027
"""A Client class using D-Bus
1030
dbus_object_path: dbus.ObjectPath
1031
bus: dbus.SystemBus()
1034
runtime_expansions = (Client.runtime_expansions
1035
+ ("dbus_object_path",))
1037
# dbus.service.Object doesn't use super(), so we can't either.
1039
def __init__(self, bus = None, *args, **kwargs):
1041
Client.__init__(self, *args, **kwargs)
1042
self._approvals_pending = 0
1044
self._approvals_pending = 0
1045
# Only now, when this client is initialized, can it show up on
1047
client_object_name = unicode(self.name).translate(
1048
{ord("."): ord("_"),
1049
ord("-"): ord("_")})
1050
self.dbus_object_path = (dbus.ObjectPath
1051
("/clients/" + client_object_name))
1052
DBusObjectWithProperties.__init__(self, self.bus,
1053
self.dbus_object_path)
1055
def notifychangeproperty(transform_func,
1056
dbus_name, type_func=lambda x: x,
1058
""" Modify a variable so that it's a property which announces
1059
its changes to DBus.
1061
transform_fun: Function that takes a value and a variant_level
1062
and transforms it to a D-Bus type.
1063
dbus_name: D-Bus name of the variable
1064
type_func: Function that transform the value before sending it
1065
to the D-Bus. Default: no transform
1066
variant_level: D-Bus variant level. Default: 1
1068
attrname = "_{0}".format(dbus_name)
1069
def setter(self, value):
1070
if hasattr(self, "dbus_object_path"):
1071
if (not hasattr(self, attrname) or
1072
type_func(getattr(self, attrname, None))
1073
!= type_func(value)):
1074
dbus_value = transform_func(type_func(value),
1077
self.PropertyChanged(dbus.String(dbus_name),
1079
setattr(self, attrname, value)
1081
return property(lambda self: getattr(self, attrname), setter)
1084
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1085
approvals_pending = notifychangeproperty(dbus.Boolean,
1088
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1089
last_enabled = notifychangeproperty(datetime_to_dbus,
1091
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1092
type_func = lambda checker:
1093
checker is not None)
1094
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1096
last_approval_request = notifychangeproperty(
1097
datetime_to_dbus, "LastApprovalRequest")
1098
approved_by_default = notifychangeproperty(dbus.Boolean,
1099
"ApprovedByDefault")
1100
approval_delay = notifychangeproperty(dbus.UInt64,
1103
timedelta_to_milliseconds)
1104
approval_duration = notifychangeproperty(
1105
dbus.UInt64, "ApprovalDuration",
1106
type_func = timedelta_to_milliseconds)
1107
host = notifychangeproperty(dbus.String, "Host")
1108
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1110
timedelta_to_milliseconds)
1111
extended_timeout = notifychangeproperty(
1112
dbus.UInt64, "ExtendedTimeout",
1113
type_func = timedelta_to_milliseconds)
1114
interval = notifychangeproperty(dbus.UInt64,
1117
timedelta_to_milliseconds)
1118
checker_command = notifychangeproperty(dbus.String, "Checker")
1120
del notifychangeproperty
1122
def __del__(self, *args, **kwargs):
1124
self.remove_from_connection()
1127
if hasattr(DBusObjectWithProperties, "__del__"):
1128
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1129
Client.__del__(self, *args, **kwargs)
1131
def checker_callback(self, pid, condition, command,
1133
self.checker_callback_tag = None
1135
if os.WIFEXITED(condition):
1136
exitstatus = os.WEXITSTATUS(condition)
1138
self.CheckerCompleted(dbus.Int16(exitstatus),
1139
dbus.Int64(condition),
1140
dbus.String(command))
1143
self.CheckerCompleted(dbus.Int16(-1),
1144
dbus.Int64(condition),
1145
dbus.String(command))
1147
return Client.checker_callback(self, pid, condition, command,
1150
def start_checker(self, *args, **kwargs):
1151
old_checker = self.checker
1152
if self.checker is not None:
1153
old_checker_pid = self.checker.pid
1155
old_checker_pid = None
1156
r = Client.start_checker(self, *args, **kwargs)
1157
# Only if new checker process was started
1158
if (self.checker is not None
1159
and old_checker_pid != self.checker.pid):
1161
self.CheckerStarted(self.current_checker_command)
1164
def _reset_approved(self):
1165
self.approved = None
1168
def approve(self, value=True):
1169
self.send_changedstate()
1170
self.approved = value
1171
gobject.timeout_add(timedelta_to_milliseconds
1172
(self.approval_duration),
1173
self._reset_approved)
1176
## D-Bus methods, signals & properties
1177
_interface = "se.recompile.Mandos.Client"
1181
# CheckerCompleted - signal
1182
@dbus.service.signal(_interface, signature="nxs")
1183
def CheckerCompleted(self, exitcode, waitstatus, command):
1187
# CheckerStarted - signal
1188
@dbus.service.signal(_interface, signature="s")
1189
def CheckerStarted(self, command):
1193
# PropertyChanged - signal
1194
@dbus.service.signal(_interface, signature="sv")
1195
def PropertyChanged(self, property, value):
1199
# GotSecret - signal
1200
@dbus.service.signal(_interface)
1201
def GotSecret(self):
1203
Is sent after a successful transfer of secret from the Mandos
1204
server to mandos-client
1209
@dbus.service.signal(_interface, signature="s")
1210
def Rejected(self, reason):
1214
# NeedApproval - signal
1215
@dbus.service.signal(_interface, signature="tb")
1216
def NeedApproval(self, timeout, default):
1218
return self.need_approval()
1220
# NeRwequest - signal
1221
@dbus.service.signal(_interface, signature="s")
1222
def NewRequest(self, ip):
1224
Is sent after a client request a password.
1231
@dbus.service.method(_interface, in_signature="b")
1232
def Approve(self, value):
1235
# CheckedOK - method
1236
@dbus.service.method(_interface)
1237
def CheckedOK(self):
1241
@dbus.service.method(_interface)
1246
# StartChecker - method
1247
@dbus.service.method(_interface)
1248
def StartChecker(self):
1250
self.start_checker()
1253
@dbus.service.method(_interface)
1258
# StopChecker - method
1259
@dbus.service.method(_interface)
1260
def StopChecker(self):
1265
# ApprovalPending - property
1266
@dbus_service_property(_interface, signature="b", access="read")
1267
def ApprovalPending_dbus_property(self):
1268
return dbus.Boolean(bool(self.approvals_pending))
1270
# ApprovedByDefault - property
1271
@dbus_service_property(_interface, signature="b",
1273
def ApprovedByDefault_dbus_property(self, value=None):
1274
if value is None: # get
1275
return dbus.Boolean(self.approved_by_default)
1276
self.approved_by_default = bool(value)
1278
# ApprovalDelay - property
1279
@dbus_service_property(_interface, signature="t",
1281
def ApprovalDelay_dbus_property(self, value=None):
1282
if value is None: # get
1283
return dbus.UInt64(self.approval_delay_milliseconds())
1284
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1286
# ApprovalDuration - property
1287
@dbus_service_property(_interface, signature="t",
1289
def ApprovalDuration_dbus_property(self, value=None):
1290
if value is None: # get
1291
return dbus.UInt64(timedelta_to_milliseconds(
1292
self.approval_duration))
1293
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1296
@dbus_service_property(_interface, signature="s", access="read")
1297
def Name_dbus_property(self):
1298
return dbus.String(self.name)
1300
# Fingerprint - property
1301
@dbus_service_property(_interface, signature="s", access="read")
1302
def Fingerprint_dbus_property(self):
1303
return dbus.String(self.fingerprint)
1306
@dbus_service_property(_interface, signature="s",
1308
def Host_dbus_property(self, value=None):
1309
if value is None: # get
1310
return dbus.String(self.host)
1311
self.host = unicode(value)
1313
# Created - property
1314
@dbus_service_property(_interface, signature="s", access="read")
1315
def Created_dbus_property(self):
1316
return datetime_to_dbus(self.created)
1318
# LastEnabled - property
1319
@dbus_service_property(_interface, signature="s", access="read")
1320
def LastEnabled_dbus_property(self):
1321
return datetime_to_dbus(self.last_enabled)
1323
# Enabled - property
1324
@dbus_service_property(_interface, signature="b",
1326
def Enabled_dbus_property(self, value=None):
1327
if value is None: # get
1328
return dbus.Boolean(self.enabled)
1334
# LastCheckedOK - property
1335
@dbus_service_property(_interface, signature="s",
1337
def LastCheckedOK_dbus_property(self, value=None):
1338
if value is not None:
1341
return datetime_to_dbus(self.last_checked_ok)
1343
# Expires - property
1344
@dbus_service_property(_interface, signature="s", access="read")
1345
def Expires_dbus_property(self):
1346
return datetime_to_dbus(self.expires)
1348
# LastApprovalRequest - property
1349
@dbus_service_property(_interface, signature="s", access="read")
1350
def LastApprovalRequest_dbus_property(self):
1351
return datetime_to_dbus(self.last_approval_request)
1353
# Timeout - property
1354
@dbus_service_property(_interface, signature="t",
1356
def Timeout_dbus_property(self, value=None):
1357
if value is None: # get
1358
return dbus.UInt64(self.timeout_milliseconds())
1359
self.timeout = datetime.timedelta(0, 0, 0, value)
1360
if getattr(self, "disable_initiator_tag", None) is None:
1362
# Reschedule timeout
1363
gobject.source_remove(self.disable_initiator_tag)
1364
self.disable_initiator_tag = None
1366
time_to_die = timedelta_to_milliseconds((self
1371
if time_to_die <= 0:
1372
# The timeout has passed
1375
self.expires = (datetime.datetime.utcnow()
1376
+ datetime.timedelta(milliseconds =
1378
self.disable_initiator_tag = (gobject.timeout_add
1379
(time_to_die, self.disable))
1381
# ExtendedTimeout - property
1382
@dbus_service_property(_interface, signature="t",
1384
def ExtendedTimeout_dbus_property(self, value=None):
1385
if value is None: # get
1386
return dbus.UInt64(self.extended_timeout_milliseconds())
1387
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1389
# Interval - property
1390
@dbus_service_property(_interface, signature="t",
1392
def Interval_dbus_property(self, value=None):
1393
if value is None: # get
1394
return dbus.UInt64(self.interval_milliseconds())
1395
self.interval = datetime.timedelta(0, 0, 0, value)
1396
if getattr(self, "checker_initiator_tag", None) is None:
1399
# Reschedule checker run
1400
gobject.source_remove(self.checker_initiator_tag)
1401
self.checker_initiator_tag = (gobject.timeout_add
1402
(value, self.start_checker))
1403
self.start_checker() # Start one now, too
1405
# Checker - property
1406
@dbus_service_property(_interface, signature="s",
1408
def Checker_dbus_property(self, value=None):
1409
if value is None: # get
1410
return dbus.String(self.checker_command)
1411
self.checker_command = unicode(value)
1413
# CheckerRunning - property
1414
@dbus_service_property(_interface, signature="b",
1416
def CheckerRunning_dbus_property(self, value=None):
1417
if value is None: # get
1418
return dbus.Boolean(self.checker is not None)
1420
self.start_checker()
1424
# ObjectPath - property
1425
@dbus_service_property(_interface, signature="o", access="read")
1426
def ObjectPath_dbus_property(self):
1427
return self.dbus_object_path # is already a dbus.ObjectPath
1430
@dbus_service_property(_interface, signature="ay",
1431
access="write", byte_arrays=True)
1432
def Secret_dbus_property(self, value):
1433
self.secret = str(value)
1438
class ProxyClient(object):
1439
def __init__(self, child_pipe, fpr, address):
1440
self._pipe = child_pipe
1441
self._pipe.send(('init', fpr, address))
1442
if not self._pipe.recv():
1445
def __getattribute__(self, name):
1447
return super(ProxyClient, self).__getattribute__(name)
1448
self._pipe.send(('getattr', name))
1449
data = self._pipe.recv()
1450
if data[0] == 'data':
1452
if data[0] == 'function':
1453
def func(*args, **kwargs):
1454
self._pipe.send(('funcall', name, args, kwargs))
1455
return self._pipe.recv()[1]
1458
def __setattr__(self, name, value):
1460
return super(ProxyClient, self).__setattr__(name, value)
1461
self._pipe.send(('setattr', name, value))
1464
class ClientDBusTransitional(ClientDBus):
1465
__metaclass__ = AlternateDBusNamesMetaclass
1468
class ClientHandler(socketserver.BaseRequestHandler, object):
1469
"""A class to handle client connections.
1471
Instantiated once for each connection to handle it.
368
def still_valid(self):
369
"""Has the timeout not yet passed for this client?"""
370
now = datetime.datetime.now()
371
if self.last_checked_ok is None:
372
return now < (self.created + self.timeout)
374
return now < (self.last_checked_ok + self.timeout)
377
def peer_certificate(session):
378
"Return the peer's OpenPGP certificate as a bytestring"
379
# If not an OpenPGP certificate...
380
if gnutls.library.functions.gnutls_certificate_type_get\
381
(session._c_object) \
382
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
383
# ...do the normal thing
384
return session.peer_certificate
385
list_size = ctypes.c_uint()
386
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
387
(session._c_object, ctypes.byref(list_size))
388
if list_size.value == 0:
391
return ctypes.string_at(cert.data, cert.size)
394
def fingerprint(openpgp):
395
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
396
# New GnuTLS "datum" with the OpenPGP public key
397
datum = gnutls.library.types.gnutls_datum_t\
398
(ctypes.cast(ctypes.c_char_p(openpgp),
399
ctypes.POINTER(ctypes.c_ubyte)),
400
ctypes.c_uint(len(openpgp)))
401
# New empty GnuTLS certificate
402
crt = gnutls.library.types.gnutls_openpgp_crt_t()
403
gnutls.library.functions.gnutls_openpgp_crt_init\
405
# Import the OpenPGP public key into the certificate
406
gnutls.library.functions.gnutls_openpgp_crt_import\
407
(crt, ctypes.byref(datum),
408
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
409
# New buffer for the fingerprint
410
buffer = ctypes.create_string_buffer(20)
411
buffer_length = ctypes.c_size_t()
412
# Get the fingerprint from the certificate into the buffer
413
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
414
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
415
# Deinit the certificate
416
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
417
# Convert the buffer to a Python bytestring
418
fpr = ctypes.string_at(buffer, buffer_length.value)
419
# Convert the bytestring to hexadecimal notation
420
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
424
class tcp_handler(SocketServer.BaseRequestHandler, object):
425
"""A TCP request handler class.
426
Instantiated by IPv6_TCPServer for each request to handle it.
1472
427
Note: This will run in its own forked process."""
1474
429
def handle(self):
1475
with contextlib.closing(self.server.child_pipe) as child_pipe:
1476
logger.info("TCP connection from: %s",
1477
unicode(self.client_address))
1478
logger.debug("Pipe FD: %d",
1479
self.server.child_pipe.fileno())
1481
session = (gnutls.connection
1482
.ClientSession(self.request,
1484
.X509Credentials()))
1486
# Note: gnutls.connection.X509Credentials is really a
1487
# generic GnuTLS certificate credentials object so long as
1488
# no X.509 keys are added to it. Therefore, we can use it
1489
# here despite using OpenPGP certificates.
1491
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1492
# "+AES-256-CBC", "+SHA1",
1493
# "+COMP-NULL", "+CTYPE-OPENPGP",
1495
# Use a fallback default, since this MUST be set.
1496
priority = self.server.gnutls_priority
1497
if priority is None:
1499
(gnutls.library.functions
1500
.gnutls_priority_set_direct(session._c_object,
1503
# Start communication using the Mandos protocol
1504
# Get protocol number
1505
line = self.request.makefile().readline()
1506
logger.debug("Protocol version: %r", line)
1508
if int(line.strip().split()[0]) > 1:
1510
except (ValueError, IndexError, RuntimeError) as error:
1511
logger.error("Unknown protocol version: %s", error)
1514
# Start GnuTLS connection
1517
except gnutls.errors.GNUTLSError as error:
1518
logger.warning("Handshake failed: %s", error)
1519
# Do not run session.bye() here: the session is not
1520
# established. Just abandon the request.
1522
logger.debug("Handshake succeeded")
1524
approval_required = False
1527
fpr = self.fingerprint(self.peer_certificate
1530
gnutls.errors.GNUTLSError) as error:
1531
logger.warning("Bad certificate: %s", error)
1533
logger.debug("Fingerprint: %s", fpr)
1536
client = ProxyClient(child_pipe, fpr,
1537
self.client_address)
1541
if self.server.use_dbus:
1543
client.NewRequest(str(self.client_address))
1545
if client.approval_delay:
1546
delay = client.approval_delay
1547
client.approvals_pending += 1
1548
approval_required = True
1551
if not client.enabled:
1552
logger.info("Client %s is disabled",
1554
if self.server.use_dbus:
1556
client.Rejected("Disabled")
1559
if client.approved or not client.approval_delay:
1560
#We are approved or approval is disabled
1562
elif client.approved is None:
1563
logger.info("Client %s needs approval",
1565
if self.server.use_dbus:
1567
client.NeedApproval(
1568
client.approval_delay_milliseconds(),
1569
client.approved_by_default)
1571
logger.warning("Client %s was not approved",
1573
if self.server.use_dbus:
1575
client.Rejected("Denied")
1578
#wait until timeout or approved
1579
time = datetime.datetime.now()
1580
client.changedstate.acquire()
1581
(client.changedstate.wait
1582
(float(client.timedelta_to_milliseconds(delay)
1584
client.changedstate.release()
1585
time2 = datetime.datetime.now()
1586
if (time2 - time) >= delay:
1587
if not client.approved_by_default:
1588
logger.warning("Client %s timed out while"
1589
" waiting for approval",
1591
if self.server.use_dbus:
1593
client.Rejected("Approval timed out")
1598
delay -= time2 - time
1601
while sent_size < len(client.secret):
1603
sent = session.send(client.secret[sent_size:])
1604
except gnutls.errors.GNUTLSError as error:
1605
logger.warning("gnutls send failed")
1607
logger.debug("Sent: %d, remaining: %d",
1608
sent, len(client.secret)
1609
- (sent_size + sent))
1612
logger.info("Sending secret to %s", client.name)
1613
# bump the timeout using extended_timeout
1614
client.checked_ok(client.extended_timeout)
1615
if self.server.use_dbus:
1620
if approval_required:
1621
client.approvals_pending -= 1
1624
except gnutls.errors.GNUTLSError as error:
1625
logger.warning("GnuTLS bye failed")
1628
def peer_certificate(session):
1629
"Return the peer's OpenPGP certificate as a bytestring"
1630
# If not an OpenPGP certificate...
1631
if (gnutls.library.functions
1632
.gnutls_certificate_type_get(session._c_object)
1633
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1634
# ...do the normal thing
1635
return session.peer_certificate
1636
list_size = ctypes.c_uint(1)
1637
cert_list = (gnutls.library.functions
1638
.gnutls_certificate_get_peers
1639
(session._c_object, ctypes.byref(list_size)))
1640
if not bool(cert_list) and list_size.value != 0:
1641
raise gnutls.errors.GNUTLSError("error getting peer"
1643
if list_size.value == 0:
1646
return ctypes.string_at(cert.data, cert.size)
1649
def fingerprint(openpgp):
1650
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1651
# New GnuTLS "datum" with the OpenPGP public key
1652
datum = (gnutls.library.types
1653
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1656
ctypes.c_uint(len(openpgp))))
1657
# New empty GnuTLS certificate
1658
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1659
(gnutls.library.functions
1660
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1661
# Import the OpenPGP public key into the certificate
1662
(gnutls.library.functions
1663
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1664
gnutls.library.constants
1665
.GNUTLS_OPENPGP_FMT_RAW))
1666
# Verify the self signature in the key
1667
crtverify = ctypes.c_uint()
1668
(gnutls.library.functions
1669
.gnutls_openpgp_crt_verify_self(crt, 0,
1670
ctypes.byref(crtverify)))
1671
if crtverify.value != 0:
1672
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1673
raise (gnutls.errors.CertificateSecurityError
1675
# New buffer for the fingerprint
1676
buf = ctypes.create_string_buffer(20)
1677
buf_len = ctypes.c_size_t()
1678
# Get the fingerprint from the certificate into the buffer
1679
(gnutls.library.functions
1680
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1681
ctypes.byref(buf_len)))
1682
# Deinit the certificate
1683
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1684
# Convert the buffer to a Python bytestring
1685
fpr = ctypes.string_at(buf, buf_len.value)
1686
# Convert the bytestring to hexadecimal notation
1687
hex_fpr = binascii.hexlify(fpr).upper()
1691
class MultiprocessingMixIn(object):
1692
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1693
def sub_process_main(self, request, address):
1695
self.finish_request(request, address)
1697
self.handle_error(request, address)
1698
self.close_request(request)
1700
def process_request(self, request, address):
1701
"""Start a new process to process the request."""
1702
proc = multiprocessing.Process(target = self.sub_process_main,
1709
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1710
""" adds a pipe to the MixIn """
1711
def process_request(self, request, client_address):
1712
"""Overrides and wraps the original process_request().
1714
This function creates a new pipe in self.pipe
1716
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1718
proc = MultiprocessingMixIn.process_request(self, request,
1720
self.child_pipe.close()
1721
self.add_pipe(parent_pipe, proc)
1723
def add_pipe(self, parent_pipe, proc):
1724
"""Dummy function; override as necessary"""
1725
raise NotImplementedError
1728
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1729
socketserver.TCPServer, object):
1730
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
430
logger.info(u"TCP connection from: %s",
431
unicode(self.client_address))
432
session = gnutls.connection.ClientSession\
433
(self.request, gnutls.connection.X509Credentials())
435
line = self.request.makefile().readline()
436
logger.debug(u"Protocol version: %r", line)
438
if int(line.strip().split()[0]) > 1:
440
except (ValueError, IndexError, RuntimeError), error:
441
logger.error(u"Unknown protocol version: %s", error)
444
# Note: gnutls.connection.X509Credentials is really a generic
445
# GnuTLS certificate credentials object so long as no X.509
446
# keys are added to it. Therefore, we can use it here despite
447
# using OpenPGP certificates.
449
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
450
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
452
priority = "NORMAL" # Fallback default, since this
454
if self.server.settings["priority"]:
455
priority = self.server.settings["priority"]
456
gnutls.library.functions.gnutls_priority_set_direct\
457
(session._c_object, priority, None);
461
except gnutls.errors.GNUTLSError, error:
462
logger.warning(u"Handshake failed: %s", error)
463
# Do not run session.bye() here: the session is not
464
# established. Just abandon the request.
467
fpr = fingerprint(peer_certificate(session))
468
except (TypeError, gnutls.errors.GNUTLSError), error:
469
logger.warning(u"Bad certificate: %s", error)
472
logger.debug(u"Fingerprint: %s", fpr)
474
for c in self.server.clients:
475
if c.fingerprint == fpr:
479
logger.warning(u"Client not found for fingerprint: %s",
483
# Have to check if client.still_valid(), since it is possible
484
# that the client timed out while establishing the GnuTLS
486
if not client.still_valid():
487
logger.warning(u"Client %(name)s is invalid",
492
while sent_size < len(client.secret):
493
sent = session.send(client.secret[sent_size:])
494
logger.debug(u"Sent: %d, remaining: %d",
495
sent, len(client.secret)
496
- (sent_size + sent))
501
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
502
"""IPv6 TCP server. Accepts 'None' as address and/or port.
1733
enabled: Boolean; whether this server is activated yet
1734
interface: None or a network interface name (string)
1735
use_ipv6: Boolean; to use IPv6 or not
504
settings: Server settings
505
clients: Set() of Client objects
1737
def __init__(self, server_address, RequestHandlerClass,
1738
interface=None, use_ipv6=True):
1739
self.interface = interface
1741
self.address_family = socket.AF_INET6
1742
socketserver.TCPServer.__init__(self, server_address,
1743
RequestHandlerClass)
507
address_family = socket.AF_INET6
508
def __init__(self, *args, **kwargs):
509
if "settings" in kwargs:
510
self.settings = kwargs["settings"]
511
del kwargs["settings"]
512
if "clients" in kwargs:
513
self.clients = kwargs["clients"]
514
del kwargs["clients"]
515
return super(type(self), self).__init__(*args, **kwargs)
1744
516
def server_bind(self):
1745
517
"""This overrides the normal server_bind() function
1746
518
to bind to an interface if one was specified, and also NOT to
1747
519
bind to an address or port if they were not specified."""
1748
if self.interface is not None:
1749
if SO_BINDTODEVICE is None:
1750
logger.error("SO_BINDTODEVICE does not exist;"
1751
" cannot bind to interface %s",
1755
self.socket.setsockopt(socket.SOL_SOCKET,
1759
except socket.error as error:
1760
if error[0] == errno.EPERM:
1761
logger.error("No permission to"
1762
" bind to interface %s",
1764
elif error[0] == errno.ENOPROTOOPT:
1765
logger.error("SO_BINDTODEVICE not available;"
1766
" cannot bind to interface %s",
520
if self.settings["interface"]:
521
# 25 is from /usr/include/asm-i486/socket.h
522
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
524
self.socket.setsockopt(socket.SOL_SOCKET,
526
self.settings["interface"])
527
except socket.error, error:
528
if error[0] == errno.EPERM:
529
logger.error(u"No permission to"
530
u" bind to interface %s",
531
self.settings["interface"])
1770
534
# Only bind(2) the socket if we really need to.
1771
535
if self.server_address[0] or self.server_address[1]:
1772
536
if not self.server_address[0]:
1773
if self.address_family == socket.AF_INET6:
1774
any_address = "::" # in6addr_any
1776
any_address = socket.INADDR_ANY
1777
self.server_address = (any_address,
538
self.server_address = (in6addr_any,
1778
539
self.server_address[1])
1779
540
elif not self.server_address[1]:
1780
541
self.server_address = (self.server_address[0],
1782
# if self.interface:
543
# if self.settings["interface"]:
1783
544
# self.server_address = (self.server_address[0],
1786
547
# if_nametoindex
1788
return socketserver.TCPServer.server_bind(self)
1791
class MandosServer(IPv6_TCPServer):
1795
clients: set of Client objects
1796
gnutls_priority GnuTLS priority string
1797
use_dbus: Boolean; to emit D-Bus signals or not
1799
Assumes a gobject.MainLoop event loop.
1801
def __init__(self, server_address, RequestHandlerClass,
1802
interface=None, use_ipv6=True, clients=None,
1803
gnutls_priority=None, use_dbus=True):
1804
self.enabled = False
1805
self.clients = clients
1806
if self.clients is None:
1808
self.use_dbus = use_dbus
1809
self.gnutls_priority = gnutls_priority
1810
IPv6_TCPServer.__init__(self, server_address,
1811
RequestHandlerClass,
1812
interface = interface,
1813
use_ipv6 = use_ipv6)
1814
def server_activate(self):
1816
return socketserver.TCPServer.server_activate(self)
1821
def add_pipe(self, parent_pipe, proc):
1822
# Call "handle_ipc" for both data and EOF events
1823
gobject.io_add_watch(parent_pipe.fileno(),
1824
gobject.IO_IN | gobject.IO_HUP,
1825
functools.partial(self.handle_ipc,
1830
def handle_ipc(self, source, condition, parent_pipe=None,
1831
proc = None, client_object=None):
1833
gobject.IO_IN: "IN", # There is data to read.
1834
gobject.IO_OUT: "OUT", # Data can be written (without
1836
gobject.IO_PRI: "PRI", # There is urgent data to read.
1837
gobject.IO_ERR: "ERR", # Error condition.
1838
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1839
# broken, usually for pipes and
1842
conditions_string = ' | '.join(name
1844
condition_names.iteritems()
1845
if cond & condition)
1846
# error, or the other end of multiprocessing.Pipe has closed
1847
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1848
# Wait for other process to exit
1852
# Read a request from the child
1853
request = parent_pipe.recv()
1854
command = request[0]
1856
if command == 'init':
1858
address = request[2]
1860
for c in self.clients.itervalues():
1861
if c.fingerprint == fpr:
1865
logger.info("Client not found for fingerprint: %s, ad"
1866
"dress: %s", fpr, address)
1869
mandos_dbus_service.ClientNotFound(fpr,
1871
parent_pipe.send(False)
1874
gobject.io_add_watch(parent_pipe.fileno(),
1875
gobject.IO_IN | gobject.IO_HUP,
1876
functools.partial(self.handle_ipc,
1882
parent_pipe.send(True)
1883
# remove the old hook in favor of the new above hook on
1886
if command == 'funcall':
1887
funcname = request[1]
1891
parent_pipe.send(('data', getattr(client_object,
1895
if command == 'getattr':
1896
attrname = request[1]
1897
if callable(client_object.__getattribute__(attrname)):
1898
parent_pipe.send(('function',))
1900
parent_pipe.send(('data', client_object
1901
.__getattribute__(attrname)))
1903
if command == 'setattr':
1904
attrname = request[1]
1906
setattr(client_object, attrname, value)
550
return super(type(self), self).server_bind()
1911
553
def string_to_delta(interval):
1912
554
"""Parse a string and return a datetime.timedelta
1914
556
>>> string_to_delta('7d')
1915
557
datetime.timedelta(7)
1916
558
>>> string_to_delta('60s')
2029
695
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2030
696
"servicename": "Mandos",
2035
"statedir": "/var/lib/mandos"
2038
699
# Parse config file for server-global settings
2039
server_config = configparser.SafeConfigParser(server_defaults)
700
server_config = ConfigParser.SafeConfigParser(server_defaults)
2040
701
del server_defaults
2041
server_config.read(os.path.join(options.configdir,
702
server_config.read(os.path.join(options.configdir, "mandos.conf"))
703
server_section = "server"
2043
704
# Convert the SafeConfigParser object to a dict
2044
server_settings = server_config.defaults()
2045
# Use the appropriate methods on the non-string config options
2046
for option in ("debug", "use_dbus", "use_ipv6"):
2047
server_settings[option] = server_config.getboolean("DEFAULT",
2049
if server_settings["port"]:
2050
server_settings["port"] = server_config.getint("DEFAULT",
705
server_settings = dict(server_config.items(server_section))
706
# Use getboolean on the boolean config option
707
server_settings["debug"] = server_config.getboolean\
708
(server_section, "debug")
2052
709
del server_config
2054
711
# Override the settings from the config file with command line
2055
712
# options, if set.
2056
713
for option in ("interface", "address", "port", "debug",
2057
"priority", "servicename", "configdir",
2058
"use_dbus", "use_ipv6", "debuglevel", "restore",
714
"priority", "servicename", "configdir"):
2060
715
value = getattr(options, option)
2061
716
if value is not None:
2062
717
server_settings[option] = value
2064
# Force all strings to be unicode
2065
for option in server_settings.keys():
2066
if type(server_settings[option]) is str:
2067
server_settings[option] = unicode(server_settings[option])
2068
719
# Now we have our good server settings in "server_settings"
2070
##################################################################
2073
721
debug = server_settings["debug"]
2074
debuglevel = server_settings["debuglevel"]
2075
use_dbus = server_settings["use_dbus"]
2076
use_ipv6 = server_settings["use_ipv6"]
2077
stored_state_path = os.path.join(server_settings["statedir"],
2081
initlogger(logging.DEBUG)
2086
level = getattr(logging, debuglevel.upper())
724
syslogger.setLevel(logging.WARNING)
725
console.setLevel(logging.WARNING)
2089
727
if server_settings["servicename"] != "Mandos":
2090
syslogger.setFormatter(logging.Formatter
2091
('Mandos (%s) [%%(process)d]:'
2092
' %%(levelname)s: %%(message)s'
728
syslogger.setFormatter(logging.Formatter\
729
('Mandos (%s): %%(levelname)s:'
2093
731
% server_settings["servicename"]))
2095
733
# Parse config file with clients
2096
client_config = configparser.SafeConfigParser(Client.client_defaults)
734
client_defaults = { "timeout": "1h",
736
"checker": "fping -q -- %%(host)s",
738
client_config = ConfigParser.SafeConfigParser(client_defaults)
2097
739
client_config.read(os.path.join(server_settings["configdir"],
2098
740
"clients.conf"))
2100
global mandos_dbus_service
2101
mandos_dbus_service = None
2103
tcp_server = MandosServer((server_settings["address"],
2104
server_settings["port"]),
2106
interface=(server_settings["interface"]
2110
server_settings["priority"],
2113
pidfilename = "/var/run/mandos.pid"
2115
pidfile = open(pidfilename, "w")
2117
logger.error("Could not open file %r", pidfilename)
2120
uid = pwd.getpwnam("_mandos").pw_uid
2121
gid = pwd.getpwnam("_mandos").pw_gid
2124
uid = pwd.getpwnam("mandos").pw_uid
2125
gid = pwd.getpwnam("mandos").pw_gid
2128
uid = pwd.getpwnam("nobody").pw_uid
2129
gid = pwd.getpwnam("nobody").pw_gid
2136
except OSError as error:
2137
if error[0] != errno.EPERM:
2141
# Enable all possible GnuTLS debugging
2143
# "Use a log level over 10 to enable all debugging options."
2145
gnutls.library.functions.gnutls_global_set_log_level(11)
2147
@gnutls.library.types.gnutls_log_func
2148
def debug_gnutls(level, string):
2149
logger.debug("GnuTLS: %s", string[:-1])
2151
(gnutls.library.functions
2152
.gnutls_global_set_log_function(debug_gnutls))
2154
# Redirect stdin so all checkers get /dev/null
2155
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2156
os.dup2(null, sys.stdin.fileno())
2160
# No console logging
2161
logger.removeHandler(console)
2163
# Need to fork before connecting to D-Bus
2165
# Close all input and output, do double fork, etc.
743
service = AvahiService(name = server_settings["servicename"],
744
type = "_mandos._tcp", );
745
if server_settings["interface"]:
746
service.interface = if_nametoindex(server_settings["interface"])
2168
748
global main_loop
2169
751
# From the Avahi example code
2170
752
DBusGMainLoop(set_as_default=True )
2171
753
main_loop = gobject.MainLoop()
2172
754
bus = dbus.SystemBus()
755
server = dbus.Interface(
756
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
757
avahi.DBUS_INTERFACE_SERVER )
2173
758
# End of Avahi example code
2176
bus_name = dbus.service.BusName("se.recompile.Mandos",
2177
bus, do_not_queue=True)
2178
old_bus_name = (dbus.service.BusName
2179
("se.bsnet.fukt.Mandos", bus,
2181
except dbus.exceptions.NameExistsException as e:
2182
logger.error(unicode(e) + ", disabling D-Bus")
2184
server_settings["use_dbus"] = False
2185
tcp_server.use_dbus = False
2186
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2187
service = AvahiServiceToSyslog(name =
2188
server_settings["servicename"],
2189
servicetype = "_mandos._tcp",
2190
protocol = protocol, bus = bus)
2191
if server_settings["interface"]:
2192
service.interface = (if_nametoindex
2193
(str(server_settings["interface"])))
2195
global multiprocessing_manager
2196
multiprocessing_manager = multiprocessing.Manager()
2198
client_class = Client
2200
client_class = functools.partial(ClientDBusTransitional,
2203
client_settings = Client.config_parser(client_config)
2204
old_client_settings = {}
2207
# Get client data and settings from last running state.
2208
if server_settings["restore"]:
2210
with open(stored_state_path, "rb") as stored_state:
2211
clients_data, old_client_settings = (pickle.load
2213
os.remove(stored_state_path)
2214
except IOError as e:
2215
logger.warning("Could not load persistent state: {0}"
2217
if e.errno != errno.ENOENT:
2220
with PGPEngine() as pgp:
2221
for client_name, client in clients_data.iteritems():
2222
# Decide which value to use after restoring saved state.
2223
# We have three different values: Old config file,
2224
# new config file, and saved state.
2225
# New config value takes precedence if it differs from old
2226
# config value, otherwise use saved state.
2227
for name, value in client_settings[client_name].items():
2229
# For each value in new config, check if it
2230
# differs from the old config value (Except for
2231
# the "secret" attribute)
2232
if (name != "secret" and
2233
value != old_client_settings[client_name]
2235
client[name] = value
2239
# Clients who has passed its expire date can still be
2240
# enabled if its last checker was successful. Clients
2241
# whose checker failed before we stored its state is
2242
# assumed to have failed all checkers during downtime.
2243
if client["enabled"]:
2244
if datetime.datetime.utcnow() >= client["expires"]:
2245
if not client["last_checked_ok"]:
2247
"disabling client {0} - Client never "
2248
"performed a successfull checker"
2249
.format(client["name"]))
2250
client["enabled"] = False
2251
elif client["last_checker_status"] != 0:
2253
"disabling client {0} - Client "
2254
"last checker failed with error code {1}"
2255
.format(client["name"],
2256
client["last_checker_status"]))
2257
client["enabled"] = False
2259
client["expires"] = (datetime.datetime
2261
+ client["timeout"])
2264
client["secret"] = (
2265
pgp.decrypt(client["encrypted_secret"],
2266
client_settings[client_name]
2269
# If decryption fails, we use secret from new settings
2270
logger.debug("Failed to decrypt {0} old secret"
2271
.format(client_name))
2272
client["secret"] = (
2273
client_settings[client_name]["secret"])
2276
# Add/remove clients based on new changes made to config
2277
for client_name in set(old_client_settings) - set(client_settings):
2278
del clients_data[client_name]
2279
for client_name in set(client_settings) - set(old_client_settings):
2280
clients_data[client_name] = client_settings[client_name]
2282
# Create clients all clients
2283
for client_name, client in clients_data.iteritems():
2284
tcp_server.clients[client_name] = client_class(
2285
name = client_name, settings = client)
2287
if not tcp_server.clients:
2288
logger.warning("No clients defined")
761
def remove_from_clients(client):
762
clients.remove(client)
764
logger.critical(u"No clients left, exiting")
767
clients.update(Set(Client(name = section,
768
stop_hook = remove_from_clients,
770
= dict(client_config.items(section)))
771
for section in client_config.sections()))
773
logger.critical(u"No clients defined")
777
logger.removeHandler(console)
780
pidfilename = "/var/run/mandos/mandos.pid"
783
pidfile = open(pidfilename, "w")
784
pidfile.write(str(pid) + "\n")
788
logger.error(u"Could not write %s file with PID %d",
789
pidfilename, os.getpid())
792
"Cleanup function; run on exit"
794
# From the Avahi example code
795
if not group is None:
798
# End of Avahi example code
801
client = clients.pop()
802
client.stop_hook = None
805
atexit.register(cleanup)
2294
pidfile.write(str(pid) + "\n".encode("utf-8"))
2297
logger.error("Could not write to file %r with PID %d",
2300
# "pidfile" was never created
2303
808
signal.signal(signal.SIGINT, signal.SIG_IGN)
2305
809
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2306
810
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2309
class MandosDBusService(dbus.service.Object):
2310
"""A D-Bus proxy object"""
2312
dbus.service.Object.__init__(self, bus, "/")
2313
_interface = "se.recompile.Mandos"
2315
@dbus.service.signal(_interface, signature="o")
2316
def ClientAdded(self, objpath):
2320
@dbus.service.signal(_interface, signature="ss")
2321
def ClientNotFound(self, fingerprint, address):
2325
@dbus.service.signal(_interface, signature="os")
2326
def ClientRemoved(self, objpath, name):
2330
@dbus.service.method(_interface, out_signature="ao")
2331
def GetAllClients(self):
2333
return dbus.Array(c.dbus_object_path
2335
tcp_server.clients.itervalues())
2337
@dbus.service.method(_interface,
2338
out_signature="a{oa{sv}}")
2339
def GetAllClientsWithProperties(self):
2341
return dbus.Dictionary(
2342
((c.dbus_object_path, c.GetAll(""))
2343
for c in tcp_server.clients.itervalues()),
2346
@dbus.service.method(_interface, in_signature="o")
2347
def RemoveClient(self, object_path):
2349
for c in tcp_server.clients.itervalues():
2350
if c.dbus_object_path == object_path:
2351
del tcp_server.clients[c.name]
2352
c.remove_from_connection()
2353
# Don't signal anything except ClientRemoved
2354
c.disable(quiet=True)
2356
self.ClientRemoved(object_path, c.name)
2358
raise KeyError(object_path)
2362
class MandosDBusServiceTransitional(MandosDBusService):
2363
__metaclass__ = AlternateDBusNamesMetaclass
2364
mandos_dbus_service = MandosDBusServiceTransitional()
2367
"Cleanup function; run on exit"
2370
multiprocessing.active_children()
2371
if not (tcp_server.clients or client_settings):
2374
# Store client before exiting. Secrets are encrypted with key
2375
# based on what config file has. If config file is
2376
# removed/edited, old secret will thus be unrecovable.
2378
with PGPEngine() as pgp:
2379
for client in tcp_server.clients.itervalues():
2380
key = client_settings[client.name]["secret"]
2381
client.encrypted_secret = pgp.encrypt(client.secret,
2385
# A list of attributes that can not be pickled
2387
exclude = set(("bus", "changedstate", "secret",
2389
for name, typ in (inspect.getmembers
2390
(dbus.service.Object)):
2393
client_dict["encrypted_secret"] = (client
2395
for attr in client.client_structure:
2396
if attr not in exclude:
2397
client_dict[attr] = getattr(client, attr)
2399
clients[client.name] = client_dict
2400
del client_settings[client.name]["secret"]
2403
with os.fdopen(os.open(stored_state_path,
2404
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2405
0600), "wb") as stored_state:
2406
pickle.dump((clients, client_settings), stored_state)
2407
except (IOError, OSError) as e:
2408
logger.warning("Could not save persistent state: {0}"
2410
if e.errno not in (errno.ENOENT, errno.EACCES):
2413
# Delete all clients, and settings from config
2414
while tcp_server.clients:
2415
name, client = tcp_server.clients.popitem()
2417
client.remove_from_connection()
2418
# Don't signal anything except ClientRemoved
2419
client.disable(quiet=True)
2422
mandos_dbus_service.ClientRemoved(client
2425
client_settings.clear()
2427
atexit.register(cleanup)
2429
for client in tcp_server.clients.itervalues():
2432
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2433
# Need to initiate checking of clients
2435
client.init_checker()
2438
tcp_server.server_activate()
812
for client in clients:
815
tcp_server = IPv6_TCPServer((server_settings["address"],
816
server_settings["port"]),
818
settings=server_settings,
2440
820
# Find out what port we got
2441
821
service.port = tcp_server.socket.getsockname()[1]
2443
logger.info("Now listening on address %r, port %d,"
2444
" flowinfo %d, scope_id %d"
2445
% tcp_server.socket.getsockname())
2447
logger.info("Now listening on address %r, port %d"
2448
% tcp_server.socket.getsockname())
822
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
823
u" scope_id %d" % tcp_server.socket.getsockname())
2450
825
#service.interface = tcp_server.socket.getsockname()[3]
2453
828
# From the Avahi example code
829
server.connect_to_signal("StateChanged", server_state_changed)
2456
except dbus.exceptions.DBusException as error:
2457
logger.critical("DBusException: %s", error)
831
server_state_changed(server.GetState())
832
except dbus.exceptions.DBusException, error:
833
logger.critical(u"DBusException: %s", error)
2460
835
# End of Avahi example code
2462
837
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2463
838
lambda *args, **kwargs:
2464
(tcp_server.handle_request
2465
(*args[2:], **kwargs) or True))
839
tcp_server.handle_request\
840
(*args[2:], **kwargs) or True)
2467
logger.debug("Starting main loop")
842
logger.debug(u"Starting main loop")
843
main_loop_started = True
2469
except AvahiError as error:
2470
logger.critical("AvahiError: %s", error)
845
except AvahiError, error:
846
logger.critical(u"AvahiError: %s" + unicode(error))
2473
848
except KeyboardInterrupt:
2475
print("", file=sys.stderr)
2476
logger.debug("Server received KeyboardInterrupt")
2477
logger.debug("Server exiting")
2478
# Must run before the D-Bus bus name gets deregistered
2481
852
if __name__ == '__main__':