/mandos/trunk : revision 237.4.39

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

37

39

import SocketServer as socketserver

38

40

import socket

39

41

import argparse

62

64

import functools

63

65

import cPickle as pickle

64

66

import multiprocessing

67

import types

68

import binascii

69

import tempfile

70

import itertools

71

import collections

65

72

66

73

import dbus

67

74

import dbus.service

81

88

except ImportError:

82

89

SO_BINDTODEVICE = None

83

90

84

85

version = "1.3.1"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

91

version = "1.6.3"

92

stored_state_file = "clients.pickle"

93

94

logger = logging.getLogger()

89

95

syslogger = (logging.handlers.SysLogHandler

90

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

97

address = str("/dev/log")))

92

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

95

logger.addHandler(syslogger)

96

97

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

101

logger.addHandler(console)

98

99

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

103

except (OSError, AttributeError):

104

def if_nametoindex(interface):

105

"Get an interface index the hard way, i.e. using fcntl()"

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

with contextlib.closing(socket.socket()) as s:

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

113

return interface_index

114

115

116

def initlogger(debug, level=logging.WARNING):

117

"""init logger and add loglevel"""

118

119

syslogger.setFormatter(logging.Formatter

120

('Mandos [%(process)d]: %(levelname)s:'

121

' %(message)s'))

122

logger.addHandler(syslogger)

123

124

if debug:

125

console = logging.StreamHandler()

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

127

' [%(process)d]:'

128

' %(levelname)s:'

129

' %(message)s'))

130

logger.addHandler(console)

131

logger.setLevel(level)

132

133

134

class PGPError(Exception):

135

"""Exception if encryption/decryption fails"""

136

pass

137

138

139

class PGPEngine(object):

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

141

def __init__(self):

142

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

143

self.gnupgargs = ['--batch',

144

'--home', self.tempdir,

145

'--force-mdc',

146

'--quiet',

147

'--no-use-agent']

148

149

def __enter__(self):

150

return self

151

152

def __exit__(self, exc_type, exc_value, traceback):

153

self._cleanup()

154

return False

155

156

def __del__(self):

157

self._cleanup()

158

159

def _cleanup(self):

160

if self.tempdir is not None:

161

# Delete contents of tempdir

162

for root, dirs, files in os.walk(self.tempdir,

163

topdown = False):

164

for filename in files:

165

os.remove(os.path.join(root, filename))

166

for dirname in dirs:

167

os.rmdir(os.path.join(root, dirname))

168

# Remove tempdir

169

os.rmdir(self.tempdir)

170

self.tempdir = None

171

172

def password_encode(self, password):

173

# Passphrase can not be empty and can not contain newlines or

174

# NUL bytes. So we prefix it and hex encode it.

175

encoded = b"mandos" + binascii.hexlify(password)

176

if len(encoded) > 2048:

177

# GnuPG can't handle long passwords, so encode differently

178

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

179

.replace(b"\n", b"\\n")

180

.replace(b"\0", b"\\x00"))

181

return encoded

182

183

def encrypt(self, data, password):

184

passphrase = self.password_encode(password)

185

with tempfile.NamedTemporaryFile(dir=self.tempdir

186

) as passfile:

187

passfile.write(passphrase)

188

passfile.flush()

189

proc = subprocess.Popen(['gpg', '--symmetric',

190

'--passphrase-file',

191

passfile.name]

192

+ self.gnupgargs,

193

stdin = subprocess.PIPE,

194

stdout = subprocess.PIPE,

195

stderr = subprocess.PIPE)

196

ciphertext, err = proc.communicate(input = data)

197

if proc.returncode != 0:

198

raise PGPError(err)

199

return ciphertext

200

201

def decrypt(self, data, password):

202

passphrase = self.password_encode(password)

203

with tempfile.NamedTemporaryFile(dir = self.tempdir

204

) as passfile:

205

passfile.write(passphrase)

206

passfile.flush()

207

proc = subprocess.Popen(['gpg', '--decrypt',

208

'--passphrase-file',

209

passfile.name]

210

+ self.gnupgargs,

211

stdin = subprocess.PIPE,

212

stdout = subprocess.PIPE,

213

stderr = subprocess.PIPE)

214

decrypted_plaintext, err = proc.communicate(input

215

= data)

216

if proc.returncode != 0:

217

raise PGPError(err)

218

return decrypted_plaintext

219

102

220

103

221

class AvahiError(Exception):

104

222

def __init__(self, value, *args, **kwargs):

122

240

Used to optionally bind to the specified interface.

123

241

name: string; Example: 'Mandos'

124

242

type: string; Example: '_mandos._tcp'.

125

See <http://www.dns-sd.org/ServiceTypes.html>

243

See <https://www.iana.org/assignments/service-names-port-numbers>

126

244

port: integer; what port to announce

127

245

TXT: list of strings; TXT record for the service

128

246

domain: string; Domain to publish on, default to .local if empty.

134

252

server: D-Bus Server

135

253

bus: dbus.SystemBus()

136

254

"""

255

137

256

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

138

257

servicetype = None, port = None, TXT = None,

139

258

domain = "", host = "", max_renames = 32768,

152

271

self.server = None

153

272

self.bus = bus

154

273

self.entry_group_state_changed_match = None

274

155

275

def rename(self):

156

276

"""Derived from the Avahi example code"""

157

277

if self.rename_count >= self.max_renames:

159

279

" after %i retries, exiting.",

160

280

self.rename_count)

161

281

raise AvahiServiceError("Too many renames")

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

163

284

logger.info("Changing Zeroconf service name to %r ...",

164

285

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

169

286

self.remove()

170

287

try:

171

288

self.add()

172

289

except dbus.exceptions.DBusException as error:

173

logger.critical("DBusException: %s", error)

290

logger.critical("D-Bus Exception", exc_info=error)

174

291

self.cleanup()

175

292

os._exit(1)

176

293

self.rename_count += 1

294

177

295

def remove(self):

178

296

"""Derived from the Avahi example code"""

179

297

if self.entry_group_state_changed_match is not None:

181

299

self.entry_group_state_changed_match = None

182

300

if self.group is not None:

183

301

self.group.Reset()

302

184

303

def add(self):

185

304

"""Derived from the Avahi example code"""

186

305

self.remove()

191

310

avahi.DBUS_INTERFACE_ENTRY_GROUP)

192

311

self.entry_group_state_changed_match = (

193

312

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

313

'StateChanged', self.entry_group_state_changed))

195

314

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

196

315

self.name, self.type)

197

316

self.group.AddService(

203

322

dbus.UInt16(self.port),

204

323

avahi.string_array_to_txt_array(self.TXT))

205

324

self.group.Commit()

325

206

326

def entry_group_state_changed(self, state, error):

207

327

"""Derived from the Avahi example code"""

208

328

logger.debug("Avahi entry group state change: %i", state)

215

335

elif state == avahi.ENTRY_GROUP_FAILURE:

216

336

logger.critical("Avahi: Error in group state changed %s",

217

337

unicode(error))

218

raise AvahiGroupError("State changed: %s"

219

% unicode(error))

338

raise AvahiGroupError("State changed: {0!s}"

339

.format(error))

340

220

341

def cleanup(self):

221

342

"""Derived from the Avahi example code"""

222

343

if self.group is not None:

223

344

try:

224

345

self.group.Free()

225

346

except (dbus.exceptions.UnknownMethodException,

226

dbus.exceptions.DBusException) as e:

347

dbus.exceptions.DBusException):

227

348

pass

228

349

self.group = None

229

350

self.remove()

351

230

352

def server_state_changed(self, state, error=None):

231

353

"""Derived from the Avahi example code"""

232

354

logger.debug("Avahi server state change: %i", state)

251

373

logger.debug("Unknown state: %r", state)

252

374

else:

253

375

logger.debug("Unknown state: %r: %r", state, error)

376

254

377

def activate(self):

255

378

"""Derived from the Avahi example code"""

256

379

if self.server is None:

264

387

self.server_state_changed(self.server.GetState())

265

388

266

389

267

def _timedelta_to_milliseconds(td):

390

class AvahiServiceToSyslog(AvahiService):

391

def rename(self):

392

"""Add the new name to the syslog messages"""

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({0}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

398

return ret

399

400

401

def timedelta_to_milliseconds(td):

268

402

"Convert a datetime.timedelta() to milliseconds"

269

403

return ((td.days * 24 * 60 * 60 * 1000)

270

404

+ (td.seconds * 1000)

271

405

+ (td.microseconds // 1000))

272

406

407

273

408

class Client(object):

274

409

"""A representation of a client host served by this server.

275

410

276

411

Attributes:

277

_approved: bool(); 'None' if not yet approved/disapproved

412

approved: bool(); 'None' if not yet approved/disapproved

278

413

approval_delay: datetime.timedelta(); Time to wait for approval

279

414

approval_duration: datetime.timedelta(); Duration of one approval

280

415

checker: subprocess.Popen(); a running checker process used

287

422

instance %(name)s can be used in the command.

288

423

checker_initiator_tag: a gobject event source tag, or None

289

424

created: datetime.datetime(); (UTC) object creation

425

client_structure: Object describing what attributes a client has

426

and is used for storing the client at exit

290

427

current_checker_command: string; current running checker_command

291

disable_hook: If set, called by disable() as disable_hook(self)

292

428

disable_initiator_tag: a gobject event source tag, or None

293

429

enabled: bool()

294

430

fingerprint: string (40 or 32 hexadecimal digits); used to

297

433

interval: datetime.timedelta(); How often to start a new checker

298

434

last_approval_request: datetime.datetime(); (UTC) or None

299

435

last_checked_ok: datetime.datetime(); (UTC) or None

300

last_enabled: datetime.datetime(); (UTC)

436

last_checker_status: integer between 0 and 255 reflecting exit

437

status of last checker. -1 reflects crashed

438

checker, -2 means no checker completed yet.

439

last_enabled: datetime.datetime(); (UTC) or None

301

440

name: string; from the config file, used in log messages and

302

441

D-Bus identifiers

303

442

secret: bytestring; sent verbatim (over TLS) to client

304

443

timeout: datetime.timedelta(); How long from last_checked_ok

305

444

until this client is disabled

306

extended_timeout: extra long timeout when password has been sent

445

extended_timeout: extra long timeout when secret has been sent

307

446

runtime_expansions: Allowed attributes for runtime expansion.

308

447

expires: datetime.datetime(); time (UTC) when a client will be

309

448

disabled, or None

449

server_settings: The server_settings dict from main()

310

450

"""

311

451

312

452

runtime_expansions = ("approval_delay", "approval_duration",

313

"created", "enabled", "fingerprint",

314

"host", "interval", "last_checked_ok",

453

"created", "enabled", "expires",

454

"fingerprint", "host", "interval",

455

"last_approval_request", "last_checked_ok",

315

456

"last_enabled", "name", "timeout")

316

457

client_defaults = { "timeout": "PT5M",

458

"extended_timeout": "PT15M",

459

"interval": "PT2M",

460

"checker": "fping -q -- %%(host)s",

461

"host": "",

462

"approval_delay": "PT0S",

463

"approval_duration": "PT1S",

464

"approved_by_default": "True",

465

"enabled": "True",

466

}

467

317

468

def timeout_milliseconds(self):

318

469

"Return the 'timeout' attribute in milliseconds"

319

return _timedelta_to_milliseconds(self.timeout)

320

470

return timedelta_to_milliseconds(self.timeout)

471

321

472

def extended_timeout_milliseconds(self):

322

473

"Return the 'extended_timeout' attribute in milliseconds"

323

return _timedelta_to_milliseconds(self.extended_timeout)

474

return timedelta_to_milliseconds(self.extended_timeout)

324

475

325

476

def interval_milliseconds(self):

326

477

"Return the 'interval' attribute in milliseconds"

327

return _timedelta_to_milliseconds(self.interval)

328

478

return timedelta_to_milliseconds(self.interval)

479

329

480

def approval_delay_milliseconds(self):

330

return _timedelta_to_milliseconds(self.approval_delay)

331

332

def __init__(self, name = None, disable_hook=None, config=None):

333

"""Note: the 'checker' key in 'config' sets the

334

'checker_command' attribute and *not* the 'checker'

335

attribute."""

481

return timedelta_to_milliseconds(self.approval_delay)

482

483

@staticmethod

484

def config_parser(config):

485

"""Construct a new dict of client settings of this form:

486

{ client_name: {setting_name: value, ...}, ...}

487

with exceptions for any special settings as defined above.

488

NOTE: Must be a pure function. Must return the same result

489

value given the same arguments.

490

"""

491

settings = {}

492

for client_name in config.sections():

493

section = dict(config.items(client_name))

494

client = settings[client_name] = {}

495

496

client["host"] = section["host"]

497

# Reformat values from string types to Python types

498

client["approved_by_default"] = config.getboolean(

499

client_name, "approved_by_default")

500

client["enabled"] = config.getboolean(client_name,

501

"enabled")

502

503

client["fingerprint"] = (section["fingerprint"].upper()

504

.replace(" ", ""))

505

if "secret" in section:

506

client["secret"] = section["secret"].decode("base64")

507

elif "secfile" in section:

508

with open(os.path.expanduser(os.path.expandvars

509

(section["secfile"])),

510

"rb") as secfile:

511

client["secret"] = secfile.read()

512

else:

513

raise TypeError("No secret or secfile for section {0}"

514

.format(section))

515

client["timeout"] = string_to_delta(section["timeout"])

516

client["extended_timeout"] = string_to_delta(

517

section["extended_timeout"])

518

client["interval"] = string_to_delta(section["interval"])

519

client["approval_delay"] = string_to_delta(

520

section["approval_delay"])

521

client["approval_duration"] = string_to_delta(

522

section["approval_duration"])

523

client["checker_command"] = section["checker"]

524

client["last_approval_request"] = None

525

client["last_checked_ok"] = None

526

client["last_checker_status"] = -2

527

528

return settings

529

530

def __init__(self, settings, name = None, server_settings=None):

336

531

self.name = name

337

if config is None:

338

config = {}

532

if server_settings is None:

533

server_settings = {}

534

self.server_settings = server_settings

535

# adding all client settings

536

for setting, value in settings.iteritems():

537

setattr(self, setting, value)

538

539

if self.enabled:

540

if not hasattr(self, "last_enabled"):

541

self.last_enabled = datetime.datetime.utcnow()

542

if not hasattr(self, "expires"):

543

self.expires = (datetime.datetime.utcnow()

544

+ self.timeout)

545

else:

546

self.last_enabled = None

547

self.expires = None

548

339

549

logger.debug("Creating client %r", self.name)

340

550

# Uppercase and remove spaces from fingerprint for later

341

551

# comparison purposes with return value from the fingerprint()

342

552

# function

343

self.fingerprint = (config["fingerprint"].upper()

344

.replace(" ", ""))

345

553

logger.debug(" Fingerprint: %s", self.fingerprint)

346

if "secret" in config:

347

self.secret = config["secret"].decode("base64")

348

elif "secfile" in config:

349

with open(os.path.expanduser(os.path.expandvars

350

(config["secfile"])),

351

"rb") as secfile:

352

self.secret = secfile.read()

353

else:

354

raise TypeError("No secret or secfile for client %s"

355

% self.name)

356

self.host = config.get("host", "")

357

self.created = datetime.datetime.utcnow()

358

self.enabled = False

359

self.last_approval_request = None

360

self.last_enabled = None

361

self.last_checked_ok = None

362

self.timeout = string_to_delta(config["timeout"])

363

self.extended_timeout = string_to_delta(config["extended_timeout"])

364

self.interval = string_to_delta(config["interval"])

365

self.disable_hook = disable_hook

554

self.created = settings.get("created",

555

datetime.datetime.utcnow())

556

557

# attributes specific for this server instance

366

558

self.checker = None

367

559

self.checker_initiator_tag = None

368

560

self.disable_initiator_tag = None

369

self.expires = None

370

561

self.checker_callback_tag = None

371

self.checker_command = config["checker"]

372

562

self.current_checker_command = None

373

self.last_connect = None

374

self._approved = None

375

self.approved_by_default = config.get("approved_by_default",

376

True)

563

self.approved = None

377

564

self.approvals_pending = 0

378

self.approval_delay = string_to_delta(

379

config["approval_delay"])

380

self.approval_duration = string_to_delta(

381

config["approval_duration"])

382

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

565

self.changedstate = (multiprocessing_manager

566

.Condition(multiprocessing_manager

567

.Lock()))

568

self.client_structure = [attr for attr in

569

self.__dict__.iterkeys()

570

if not attr.startswith("_")]

571

self.client_structure.append("client_structure")

572

573

for name, t in inspect.getmembers(type(self),

574

lambda obj:

575

isinstance(obj,

576

property)):

577

if not name.startswith("_"):

578

self.client_structure.append(name)

383

579

580

# Send notice to process children that client state has changed

384

581

def send_changedstate(self):

385

self.changedstate.acquire()

386

self.changedstate.notify_all()

387

self.changedstate.release()

388

582

with self.changedstate:

583

self.changedstate.notify_all()

584

389

585

def enable(self):

390

586

"""Start this client's checker and timeout hooks"""

391

587

if getattr(self, "enabled", False):

392

588

# Already enabled

393

589

return

590

self.expires = datetime.datetime.utcnow() + self.timeout

591

self.enabled = True

592

self.last_enabled = datetime.datetime.utcnow()

593

self.init_checker()

394

594

self.send_changedstate()

595

596

def disable(self, quiet=True):

597

"""Disable this client."""

598

if not getattr(self, "enabled", False):

599

return False

600

if not quiet:

601

logger.info("Disabling client %s", self.name)

602

if getattr(self, "disable_initiator_tag", None) is not None:

603

gobject.source_remove(self.disable_initiator_tag)

604

self.disable_initiator_tag = None

605

self.expires = None

606

if getattr(self, "checker_initiator_tag", None) is not None:

607

gobject.source_remove(self.checker_initiator_tag)

608

self.checker_initiator_tag = None

609

self.stop_checker()

610

self.enabled = False

611

if not quiet:

612

self.send_changedstate()

613

# Do not run this again if called by a gobject.timeout_add

614

return False

615

616

def __del__(self):

617

self.disable()

618

619

def init_checker(self):

395

620

# Schedule a new checker to be started an 'interval' from now,

396

621

# and every interval from then on.

622

if self.checker_initiator_tag is not None:

623

gobject.source_remove(self.checker_initiator_tag)

397

624

self.checker_initiator_tag = (gobject.timeout_add

398

625

(self.interval_milliseconds(),

399

626

self.start_checker))

400

627

# Schedule a disable() when 'timeout' has passed

401

self.expires = datetime.datetime.utcnow() + self.timeout

628

if self.disable_initiator_tag is not None:

629

gobject.source_remove(self.disable_initiator_tag)

402

630

self.disable_initiator_tag = (gobject.timeout_add

403

631

(self.timeout_milliseconds(),

404

632

self.disable))

405

self.enabled = True

406

self.last_enabled = datetime.datetime.utcnow()

407

633

# Also start a new checker *right now*.

408

634

self.start_checker()

409

635

410

def disable(self, quiet=True):

411

"""Disable this client."""

412

if not getattr(self, "enabled", False):

413

return False

414

if not quiet:

415

self.send_changedstate()

416

if not quiet:

417

logger.info("Disabling client %s", self.name)

418

if getattr(self, "disable_initiator_tag", False):

419

gobject.source_remove(self.disable_initiator_tag)

420

self.disable_initiator_tag = None

421

self.expires = None

422

if getattr(self, "checker_initiator_tag", False):

423

gobject.source_remove(self.checker_initiator_tag)

424

self.checker_initiator_tag = None

425

self.stop_checker()

426

if self.disable_hook:

427

self.disable_hook(self)

428

self.enabled = False

429

# Do not run this again if called by a gobject.timeout_add

430

return False

431

432

def __del__(self):

433

self.disable_hook = None

434

self.disable()

435

436

636

def checker_callback(self, pid, condition, command):

437

637

"""The checker has completed, so take appropriate actions."""

438

638

self.checker_callback_tag = None

439

639

self.checker = None

440

640

if os.WIFEXITED(condition):

441

exitstatus = os.WEXITSTATUS(condition)

442

if exitstatus == 0:

641

self.last_checker_status = os.WEXITSTATUS(condition)

642

if self.last_checker_status == 0:

443

643

logger.info("Checker for %(name)s succeeded",

444

644

vars(self))

445

645

self.checked_ok()

447

647

logger.info("Checker for %(name)s failed",

448

648

vars(self))

449

649

else:

650

self.last_checker_status = -1

450

651

logger.warning("Checker for %(name)s crashed?",

451

652

vars(self))

452

653

453

def checked_ok(self, timeout=None):

454

"""Bump up the timeout for this client.

455

456

This should only be called when the client has been seen,

457

alive and well.

458

"""

654

def checked_ok(self):

655

"""Assert that the client has been seen, alive and well."""

656

self.last_checked_ok = datetime.datetime.utcnow()

657

self.last_checker_status = 0

658

self.bump_timeout()

659

660

def bump_timeout(self, timeout=None):

661

"""Bump up the timeout for this client."""

459

662

if timeout is None:

460

663

timeout = self.timeout

461

self.last_checked_ok = datetime.datetime.utcnow()

462

gobject.source_remove(self.disable_initiator_tag)

463

self.expires = datetime.datetime.utcnow() + timeout

464

self.disable_initiator_tag = (gobject.timeout_add

465

(_timedelta_to_milliseconds(timeout),

466

self.disable))

664

if self.disable_initiator_tag is not None:

665

gobject.source_remove(self.disable_initiator_tag)

666

self.disable_initiator_tag = None

667

if getattr(self, "enabled", False):

668

self.disable_initiator_tag = (gobject.timeout_add

669

(timedelta_to_milliseconds

670

(timeout), self.disable))

671

self.expires = datetime.datetime.utcnow() + timeout

467

672

468

673

def need_approval(self):

469

674

self.last_approval_request = datetime.datetime.utcnow()

474

679

If a checker already exists, leave it running and do

475

680

nothing."""

476

681

# The reason for not killing a running checker is that if we

477

# did that, then if a checker (for some reason) started

478

# running slowly and taking more than 'interval' time, the

479

# client would inevitably timeout, since no checker would get

480

# a chance to run to completion. If we instead leave running

682

# did that, and if a checker (for some reason) started running

683

# slowly and taking more than 'interval' time, then the client

684

# would inevitably timeout, since no checker would get a

685

# chance to run to completion. If we instead leave running

481

686

# checkers alone, the checker would have to take more time

482

687

# than 'timeout' for the client to be disabled, which is as it

483

688

# should be.

485

690

# If a checker exists, make sure it is not a zombie

486

691

try:

487

692

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

488

except (AttributeError, OSError) as error:

489

if (isinstance(error, OSError)

490

and error.errno != errno.ECHILD):

491

raise error

693

except AttributeError:

694

pass

695

except OSError as error:

696

if error.errno != errno.ECHILD:

697

raise

492

698

else:

493

699

if pid:

494

700

logger.warning("Checker was a zombie")

497

703

self.current_checker_command)

498

704

# Start a new checker if needed

499

705

if self.checker is None:

706

# Escape attributes for the shell

707

escaped_attrs = dict(

708

(attr, re.escape(unicode(getattr(self, attr))))

709

for attr in

710

self.runtime_expansions)

500

711

try:

501

# In case checker_command has exactly one % operator

502

command = self.checker_command % self.host

503

except TypeError:

504

# Escape attributes for the shell

505

escaped_attrs = dict(

506

(attr,

507

re.escape(unicode(str(getattr(self, attr, "")),

508

errors=

509

'replace')))

510

for attr in

511

self.runtime_expansions)

512

513

try:

514

command = self.checker_command % escaped_attrs

515

except TypeError as error:

516

logger.error('Could not format string "%s":'

517

' %s', self.checker_command, error)

518

return True # Try again later

712

command = self.checker_command % escaped_attrs

713

except TypeError as error:

714

logger.error('Could not format string "%s"',

715

self.checker_command, exc_info=error)

716

return True # Try again later

519

717

self.current_checker_command = command

520

718

try:

521

719

logger.info("Starting checker %r for %s",

524

722

# in normal mode, that is already done by daemon(),

525

723

# and in debug mode we don't want to. (Stdin is

526

724

# always replaced by /dev/null.)

725

# The exception is when not debugging but nevertheless

726

# running in the foreground; use the previously

727

# created wnull.

728

popen_args = {}

729

if (not self.server_settings["debug"]

730

and self.server_settings["foreground"]):

731

popen_args.update({"stdout": wnull,

732

"stderr": wnull })

527

733

self.checker = subprocess.Popen(command,

528

734

close_fds=True,

529

shell=True, cwd="/")

530

self.checker_callback_tag = (gobject.child_watch_add

531

(self.checker.pid,

532

self.checker_callback,

533

data=command))

534

# The checker may have completed before the gobject

535

# watch was added. Check for this.

735

shell=True, cwd="/",

736

**popen_args)

737

except OSError as error:

738

logger.error("Failed to start subprocess",

739

exc_info=error)

740

return True

741

self.checker_callback_tag = (gobject.child_watch_add

742

(self.checker.pid,

743

self.checker_callback,

744

data=command))

745

# The checker may have completed before the gobject

746

# watch was added. Check for this.

747

try:

536

748

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

537

if pid:

538

gobject.source_remove(self.checker_callback_tag)

539

self.checker_callback(pid, status, command)

540

749

except OSError as error:

541

logger.error("Failed to start subprocess: %s",

542

error)

750

if error.errno == errno.ECHILD:

751

# This should never happen

752

logger.error("Child process vanished",

753

exc_info=error)

754

return True

755

raise

756

if pid:

757

gobject.source_remove(self.checker_callback_tag)

758

self.checker_callback(pid, status, command)

543

759

# Re-run this periodically if run by gobject.timeout_add

544

760

return True

545

761

552

768

return

553

769

logger.debug("Stopping checker for %(name)s", vars(self))

554

770

try:

555

os.kill(self.checker.pid, signal.SIGTERM)

771

self.checker.terminate()

556

772

#time.sleep(0.5)

557

773

#if self.checker.poll() is None:

558

# os.kill(self.checker.pid, signal.SIGKILL)

774

# self.checker.kill()

559

775

except OSError as error:

560

776

if error.errno != errno.ESRCH: # No such process

561

777

raise

562

778

self.checker = None

563

779

780

564

781

def dbus_service_property(dbus_interface, signature="v",

565

782

access="readwrite", byte_arrays=False):

566

783

"""Decorators for marking methods of a DBusObjectWithProperties to

577

794

# "Set" method, so we fail early here:

578

795

if byte_arrays and signature != "ay":

579

796

raise ValueError("Byte arrays not supported for non-'ay'"

580

" signature %r" % signature)

797

" signature {0!r}".format(signature))

581

798

def decorator(func):

582

799

func._dbus_is_property = True

583

800

func._dbus_interface = dbus_interface

591

808

return decorator

592

809

593

810

811

def dbus_interface_annotations(dbus_interface):

812

"""Decorator for marking functions returning interface annotations

813

814

Usage:

815

816

@dbus_interface_annotations("org.example.Interface")

817

def _foo(self): # Function name does not matter

818

return {"org.freedesktop.DBus.Deprecated": "true",

819

"org.freedesktop.DBus.Property.EmitsChangedSignal":

820

"false"}

821

"""

822

def decorator(func):

823

func._dbus_is_interface = True

824

func._dbus_interface = dbus_interface

825

func._dbus_name = dbus_interface

826

return func

827

return decorator

828

829

830

def dbus_annotations(annotations):

831

"""Decorator to annotate D-Bus methods, signals or properties

832

Usage:

833

834

@dbus_service_property("org.example.Interface", signature="b",

835

access="r")

836

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

837

"org.freedesktop.DBus.Property."

838

"EmitsChangedSignal": "false"})

839

def Property_dbus_property(self):

840

return dbus.Boolean(False)

841

"""

842

def decorator(func):

843

func._dbus_annotations = annotations

844

return func

845

return decorator

846

847

594

848

class DBusPropertyException(dbus.exceptions.DBusException):

595

849

"""A base class for D-Bus property-related exceptions

596

850

"""

612

866

613

867

class DBusObjectWithProperties(dbus.service.Object):

614

868

"""A D-Bus object with properties.

615

869

616

870

Classes inheriting from this can use the dbus_service_property

617

871

decorator to expose methods as D-Bus properties. It exposes the

618

872

standard Get(), Set(), and GetAll() methods on the D-Bus.

619

873

"""

620

874

621

875

@staticmethod

622

def _is_dbus_property(obj):

623

return getattr(obj, "_dbus_is_property", False)

876

def _is_dbus_thing(thing):

877

"""Returns a function testing if an attribute is a D-Bus thing

878

879

If called like _is_dbus_thing("method") it returns a function

880

suitable for use as predicate to inspect.getmembers().

881

"""

882

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

883

False)

624

884

625

def _get_all_dbus_properties(self):

885

def _get_all_dbus_things(self, thing):

626

886

"""Returns a generator of (name, attribute) pairs

627

887

"""

628

return ((prop._dbus_name, prop)

629

for name, prop in

630

inspect.getmembers(self, self._is_dbus_property))

888

return ((getattr(athing.__get__(self), "_dbus_name",

889

name),

890

athing.__get__(self))

891

for cls in self.__class__.__mro__

892

for name, athing in

893

inspect.getmembers(cls,

894

self._is_dbus_thing(thing)))

631

895

632

896

def _get_dbus_property(self, interface_name, property_name):

633

897

"""Returns a bound method if one exists which is a D-Bus

634

898

property with the specified name and interface.

635

899

"""

636

for name in (property_name,

637

property_name + "_dbus_property"):

638

prop = getattr(self, name, None)

639

if (prop is None

640

or not self._is_dbus_property(prop)

641

or prop._dbus_name != property_name

642

or (interface_name and prop._dbus_interface

643

and interface_name != prop._dbus_interface)):

644

continue

645

return prop

900

for cls in self.__class__.__mro__:

901

for name, value in (inspect.getmembers

902

(cls,

903

self._is_dbus_thing("property"))):

904

if (value._dbus_name == property_name

905

and value._dbus_interface == interface_name):

906

return value.__get__(self)

907

646

908

# No such property

647

909

raise DBusPropertyNotFound(self.dbus_object_path + ":"

648

910

+ interface_name + "."

672

934

# The byte_arrays option is not supported yet on

673

935

# signatures other than "ay".

674

936

if prop._dbus_signature != "ay":

675

raise ValueError

676

value = dbus.ByteArray(''.join(unichr(byte)

677

for byte in value))

937

raise ValueError("Byte arrays not supported for non-"

938

"'ay' signature {0!r}"

939

.format(prop._dbus_signature))

940

value = dbus.ByteArray(b''.join(chr(byte)

941

for byte in value))

678

942

prop(value)

679

943

680

944

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

682

946

def GetAll(self, interface_name):

683

947

"""Standard D-Bus property GetAll() method, see D-Bus

684

948

standard.

685

949

686

950

Note: Will not include properties with access="write".

687

951

"""

688

all = {}

689

for name, prop in self._get_all_dbus_properties():

952

properties = {}

953

for name, prop in self._get_all_dbus_things("property"):

690

954

if (interface_name

691

955

and interface_name != prop._dbus_interface):

692

956

# Interface non-empty but did not match

696

960

continue

697

961

value = prop()

698

962

if not hasattr(value, "variant_level"):

699

all[name] = value

963

properties[name] = value

700

964

continue

701

all[name] = type(value)(value, variant_level=

702

value.variant_level+1)

703

return dbus.Dictionary(all, signature="sv")

965

properties[name] = type(value)(value, variant_level=

966

value.variant_level+1)

967

return dbus.Dictionary(properties, signature="sv")

704

968

705

969

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

706

970

out_signature="s",

707

971

path_keyword='object_path',

708

972

connection_keyword='connection')

709

973

def Introspect(self, object_path, connection):

710

"""Standard D-Bus method, overloaded to insert property tags.

974

"""Overloading of standard D-Bus method.

975

976

Inserts property tags and interface annotation tags.

711

977

"""

712

978

xmlstring = dbus.service.Object.Introspect(self, object_path,

713

979

connection)

720

986

e.setAttribute("access", prop._dbus_access)

721

987

return e

722

988

for if_tag in document.getElementsByTagName("interface"):

989

# Add property tags

723

990

for tag in (make_tag(document, name, prop)

724

991

for name, prop

725

in self._get_all_dbus_properties()

992

in self._get_all_dbus_things("property")

726

993

if prop._dbus_interface

727

994

== if_tag.getAttribute("name")):

728

995

if_tag.appendChild(tag)

996

# Add annotation tags

997

for typ in ("method", "signal", "property"):

998

for tag in if_tag.getElementsByTagName(typ):

999

annots = dict()

1000

for name, prop in (self.

1001

_get_all_dbus_things(typ)):

1002

if (name == tag.getAttribute("name")

1003

and prop._dbus_interface

1004

== if_tag.getAttribute("name")):

1005

annots.update(getattr

1006

(prop,

1007

"_dbus_annotations",

1008

{}))

1009

for name, value in annots.iteritems():

1010

ann_tag = document.createElement(

1011

"annotation")

1012

ann_tag.setAttribute("name", name)

1013

ann_tag.setAttribute("value", value)

1014

tag.appendChild(ann_tag)

1015

# Add interface annotation tags

1016

for annotation, value in dict(

1017

itertools.chain.from_iterable(

1018

annotations().iteritems()

1019

for name, annotations in

1020

self._get_all_dbus_things("interface")

1021

if name == if_tag.getAttribute("name")

1022

)).iteritems():

1023

ann_tag = document.createElement("annotation")

1024

ann_tag.setAttribute("name", annotation)

1025

ann_tag.setAttribute("value", value)

1026

if_tag.appendChild(ann_tag)

729

1027

# Add the names to the return values for the

730

1028

# "org.freedesktop.DBus.Properties" methods

731

1029

if (if_tag.getAttribute("name")

746

1044

except (AttributeError, xml.dom.DOMException,

747

1045

xml.parsers.expat.ExpatError) as error:

748

1046

logger.error("Failed to override Introspection method",

749

error)

1047

exc_info=error)

750

1048

return xmlstring

751

1049

752

1050

753

def datetime_to_dbus (dt, variant_level=0):

1051

def datetime_to_dbus(dt, variant_level=0):

754

1052

"""Convert a UTC datetime.datetime() to a D-Bus type."""

755

1053

if dt is None:

756

1054

return dbus.String("", variant_level = variant_level)

757

1055

return dbus.String(dt.isoformat(),

758

1056

variant_level=variant_level)

759

1057

1058

1059

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1060

"""A class decorator; applied to a subclass of

1061

dbus.service.Object, it will add alternate D-Bus attributes with

1062

interface names according to the "alt_interface_names" mapping.

1063

Usage:

1064

1065

@alternate_dbus_interfaces({"org.example.Interface":

1066

"net.example.AlternateInterface"})

1067

class SampleDBusObject(dbus.service.Object):

1068

@dbus.service.method("org.example.Interface")

1069

def SampleDBusMethod():

1070

pass

1071

1072

The above "SampleDBusMethod" on "SampleDBusObject" will be

1073

reachable via two interfaces: "org.example.Interface" and

1074

"net.example.AlternateInterface", the latter of which will have

1075

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1076

"true", unless "deprecate" is passed with a False value.

1077

1078

This works for methods and signals, and also for D-Bus properties

1079

(from DBusObjectWithProperties) and interfaces (from the

1080

dbus_interface_annotations decorator).

1081

"""

1082

def wrapper(cls):

1083

for orig_interface_name, alt_interface_name in (

1084

alt_interface_names.iteritems()):

1085

attr = {}

1086

interface_names = set()

1087

# Go though all attributes of the class

1088

for attrname, attribute in inspect.getmembers(cls):

1089

# Ignore non-D-Bus attributes, and D-Bus attributes

1090

# with the wrong interface name

1091

if (not hasattr(attribute, "_dbus_interface")

1092

or not attribute._dbus_interface

1093

.startswith(orig_interface_name)):

1094

continue

1095

# Create an alternate D-Bus interface name based on

1096

# the current name

1097

alt_interface = (attribute._dbus_interface

1098

.replace(orig_interface_name,

1099

alt_interface_name))

1100

interface_names.add(alt_interface)

1101

# Is this a D-Bus signal?

1102

if getattr(attribute, "_dbus_is_signal", False):

1103

# Extract the original non-method undecorated

1104

# function by black magic

1105

nonmethod_func = (dict(

1106

zip(attribute.func_code.co_freevars,

1107

attribute.__closure__))["func"]

1108

.cell_contents)

1109

# Create a new, but exactly alike, function

1110

# object, and decorate it to be a new D-Bus signal

1111

# with the alternate D-Bus interface name

1112

new_function = (dbus.service.signal

1113

(alt_interface,

1114

attribute._dbus_signature)

1115

(types.FunctionType(

1116

nonmethod_func.func_code,

1117

nonmethod_func.func_globals,

1118

nonmethod_func.func_name,

1119

nonmethod_func.func_defaults,

1120

nonmethod_func.func_closure)))

1121

# Copy annotations, if any

1122

try:

1123

new_function._dbus_annotations = (

1124

dict(attribute._dbus_annotations))

1125

except AttributeError:

1126

pass

1127

# Define a creator of a function to call both the

1128

# original and alternate functions, so both the

1129

# original and alternate signals gets sent when

1130

# the function is called

1131

def fixscope(func1, func2):

1132

"""This function is a scope container to pass

1133

func1 and func2 to the "call_both" function

1134

outside of its arguments"""

1135

def call_both(*args, **kwargs):

1136

"""This function will emit two D-Bus

1137

signals by calling func1 and func2"""

1138

func1(*args, **kwargs)

1139

func2(*args, **kwargs)

1140

return call_both

1141

# Create the "call_both" function and add it to

1142

# the class

1143

attr[attrname] = fixscope(attribute, new_function)

1144

# Is this a D-Bus method?

1145

elif getattr(attribute, "_dbus_is_method", False):

1146

# Create a new, but exactly alike, function

1147

# object. Decorate it to be a new D-Bus method

1148

# with the alternate D-Bus interface name. Add it

1149

# to the class.

1150

attr[attrname] = (dbus.service.method

1151

(alt_interface,

1152

attribute._dbus_in_signature,

1153

attribute._dbus_out_signature)

1154

(types.FunctionType

1155

(attribute.func_code,

1156

attribute.func_globals,

1157

attribute.func_name,

1158

attribute.func_defaults,

1159

attribute.func_closure)))

1160

# Copy annotations, if any

1161

try:

1162

attr[attrname]._dbus_annotations = (

1163

dict(attribute._dbus_annotations))

1164

except AttributeError:

1165

pass

1166

# Is this a D-Bus property?

1167

elif getattr(attribute, "_dbus_is_property", False):

1168

# Create a new, but exactly alike, function

1169

# object, and decorate it to be a new D-Bus

1170

# property with the alternate D-Bus interface

1171

# name. Add it to the class.

1172

attr[attrname] = (dbus_service_property

1173

(alt_interface,

1174

attribute._dbus_signature,

1175

attribute._dbus_access,

1176

attribute

1177

._dbus_get_args_options

1178

["byte_arrays"])

1179

(types.FunctionType

1180

(attribute.func_code,

1181

attribute.func_globals,

1182

attribute.func_name,

1183

attribute.func_defaults,

1184

attribute.func_closure)))

1185

# Copy annotations, if any

1186

try:

1187

attr[attrname]._dbus_annotations = (

1188

dict(attribute._dbus_annotations))

1189

except AttributeError:

1190

pass

1191

# Is this a D-Bus interface?

1192

elif getattr(attribute, "_dbus_is_interface", False):

1193

# Create a new, but exactly alike, function

1194

# object. Decorate it to be a new D-Bus interface

1195

# with the alternate D-Bus interface name. Add it

1196

# to the class.

1197

attr[attrname] = (dbus_interface_annotations

1198

(alt_interface)

1199

(types.FunctionType

1200

(attribute.func_code,

1201

attribute.func_globals,

1202

attribute.func_name,

1203

attribute.func_defaults,

1204

attribute.func_closure)))

1205

if deprecate:

1206

# Deprecate all alternate interfaces

1207

iname="_AlternateDBusNames_interface_annotation{0}"

1208

for interface_name in interface_names:

1209

@dbus_interface_annotations(interface_name)

1210

def func(self):

1211

return { "org.freedesktop.DBus.Deprecated":

1212

"true" }

1213

# Find an unused name

1214

for aname in (iname.format(i)

1215

for i in itertools.count()):

1216

if aname not in attr:

1217

attr[aname] = func

1218

break

1219

if interface_names:

1220

# Replace the class with a new subclass of it with

1221

# methods, signals, etc. as created above.

1222

cls = type(b"{0}Alternate".format(cls.__name__),

1223

(cls,), attr)

1224

return cls

1225

return wrapper

1226

1227

1228

@alternate_dbus_interfaces({"se.recompile.Mandos":

1229

"se.bsnet.fukt.Mandos"})

760

1230

class ClientDBus(Client, DBusObjectWithProperties):

761

1231

"""A Client class using D-Bus

762

1232

771

1241

# dbus.service.Object doesn't use super(), so we can't either.

772

1242

773

1243

def __init__(self, bus = None, *args, **kwargs):

774

self._approvals_pending = 0

775

1244

self.bus = bus

776

1245

Client.__init__(self, *args, **kwargs)

777

1246

# Only now, when this client is initialized, can it show up on

783

1252

("/clients/" + client_object_name))

784

1253

DBusObjectWithProperties.__init__(self, self.bus,

785

1254

self.dbus_object_path)

786

1255

787

1256

def notifychangeproperty(transform_func,

788

1257

dbus_name, type_func=lambda x: x,

789

1258

variant_level=1):

790

""" Modify a variable so that its a property that announce its

791

changes to DBus.

792

transform_fun: Function that takes a value and transform it to

793

DBus type.

794

dbus_name: DBus name of the variable

1259

""" Modify a variable so that it's a property which announces

1260

its changes to DBus.

1261

1262

transform_fun: Function that takes a value and a variant_level

1263

and transforms it to a D-Bus type.

1264

dbus_name: D-Bus name of the variable

795

1265

type_func: Function that transform the value before sending it

796

to DBus

797

variant_level: DBus variant level. default: 1

1266

to the D-Bus. Default: no transform

1267

variant_level: D-Bus variant level. Default: 1

798

1268

"""

799

real_value = [None,]

1269

attrname = "_{0}".format(dbus_name)

800

1270

def setter(self, value):

801

old_value = real_value[0]

802

real_value[0] = value

803

1271

if hasattr(self, "dbus_object_path"):

804

if type_func(old_value) != type_func(real_value[0]):

805

dbus_value = transform_func(type_func(real_value[0]),

806

variant_level)

1272

if (not hasattr(self, attrname) or

1273

type_func(getattr(self, attrname, None))

1274

!= type_func(value)):

1275

dbus_value = transform_func(type_func(value),

1276

variant_level

1277

=variant_level)

807

1278

self.PropertyChanged(dbus.String(dbus_name),

808

1279

dbus_value)

809

810

return property(lambda self: real_value[0], setter)

811

812

1280

setattr(self, attrname, value)

1281

1282

return property(lambda self: getattr(self, attrname), setter)

1283

813

1284

expires = notifychangeproperty(datetime_to_dbus, "Expires")

814

1285

approvals_pending = notifychangeproperty(dbus.Boolean,

815

1286

"ApprovalPending",

818

1289

last_enabled = notifychangeproperty(datetime_to_dbus,

819

1290

"LastEnabled")

820

1291

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

821

type_func = lambda checker: checker is not None)

1292

type_func = lambda checker:

1293

checker is not None)

822

1294

last_checked_ok = notifychangeproperty(datetime_to_dbus,

823

1295

"LastCheckedOK")

824

last_approval_request = notifychangeproperty(datetime_to_dbus,

825

"LastApprovalRequest")

1296

last_checker_status = notifychangeproperty(dbus.Int16,

1297

"LastCheckerStatus")

1298

last_approval_request = notifychangeproperty(

1299

datetime_to_dbus, "LastApprovalRequest")

826

1300

approved_by_default = notifychangeproperty(dbus.Boolean,

827

1301

"ApprovedByDefault")

828

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

829

type_func = _timedelta_to_milliseconds)

830

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

831

type_func = _timedelta_to_milliseconds)

1302

approval_delay = notifychangeproperty(dbus.UInt64,

1303

"ApprovalDelay",

1304

type_func =

1305

timedelta_to_milliseconds)

1306

approval_duration = notifychangeproperty(

1307

dbus.UInt64, "ApprovalDuration",

1308

type_func = timedelta_to_milliseconds)

832

1309

host = notifychangeproperty(dbus.String, "Host")

833

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

834

type_func = _timedelta_to_milliseconds)

835

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

836

type_func = _timedelta_to_milliseconds)

837

interval = notifychangeproperty(dbus.UInt16, "Interval",

838

type_func = _timedelta_to_milliseconds)

1310

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1311

type_func =

1312

timedelta_to_milliseconds)

1313

extended_timeout = notifychangeproperty(

1314

dbus.UInt64, "ExtendedTimeout",

1315

type_func = timedelta_to_milliseconds)

1316

interval = notifychangeproperty(dbus.UInt64,

1317

"Interval",

1318

type_func =

1319

timedelta_to_milliseconds)

839

1320

checker_command = notifychangeproperty(dbus.String, "Checker")

840

1321

841

1322

del notifychangeproperty

867

1348

868

1349

return Client.checker_callback(self, pid, condition, command,

869

1350

*args, **kwargs)

870

1351

871

1352

def start_checker(self, *args, **kwargs):

872

1353

old_checker = self.checker

873

1354

if self.checker is not None:

883

1364

return r

884

1365

885

1366

def _reset_approved(self):

886

self._approved = None

1367

self.approved = None

887

1368

return False

888

1369

889

1370

def approve(self, value=True):

890

self.send_changedstate()

891

self._approved = value

892

gobject.timeout_add(_timedelta_to_milliseconds

1371

self.approved = value

1372

gobject.timeout_add(timedelta_to_milliseconds

893

1373

(self.approval_duration),

894

1374

self._reset_approved)

895

1375

self.send_changedstate()

896

1376

897

1377

## D-Bus methods, signals & properties

898

_interface = "se.bsnet.fukt.Mandos.Client"

1378

_interface = "se.recompile.Mandos.Client"

1379

1380

## Interfaces

1381

1382

@dbus_interface_annotations(_interface)

1383

def _foo(self):

1384

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1385

"false"}

899

1386

900

1387

## Signals

901

1388

1001

1488

access="readwrite")

1002

1489

def ApprovalDuration_dbus_property(self, value=None):

1003

1490

if value is None: # get

1004

return dbus.UInt64(_timedelta_to_milliseconds(

1491

return dbus.UInt64(timedelta_to_milliseconds(

1005

1492

self.approval_duration))

1006

1493

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1007

1494

1021

1508

def Host_dbus_property(self, value=None):

1022

1509

if value is None: # get

1023

1510

return dbus.String(self.host)

1024

self.host = value

1511

self.host = unicode(value)

1025

1512

1026

1513

# Created - property

1027

1514

@dbus_service_property(_interface, signature="s", access="read")

1028

1515

def Created_dbus_property(self):

1029

return dbus.String(datetime_to_dbus(self.created))

1516

return datetime_to_dbus(self.created)

1030

1517

1031

1518

# LastEnabled - property

1032

1519

@dbus_service_property(_interface, signature="s", access="read")

1053

1540

return

1054

1541

return datetime_to_dbus(self.last_checked_ok)

1055

1542

1543

# LastCheckerStatus - property

1544

@dbus_service_property(_interface, signature="n",

1545

access="read")

1546

def LastCheckerStatus_dbus_property(self):

1547

return dbus.Int16(self.last_checker_status)

1548

1056

1549

# Expires - property

1057

1550

@dbus_service_property(_interface, signature="s", access="read")

1058

1551

def Expires_dbus_property(self):

1069

1562

def Timeout_dbus_property(self, value=None):

1070

1563

if value is None: # get

1071

1564

return dbus.UInt64(self.timeout_milliseconds())

1565

old_timeout = self.timeout

1072

1566

self.timeout = datetime.timedelta(0, 0, 0, value)

1073

if getattr(self, "disable_initiator_tag", None) is None:

1074

return

1075

# Reschedule timeout

1076

gobject.source_remove(self.disable_initiator_tag)

1077

self.disable_initiator_tag = None

1078

self.expires = None

1079

time_to_die = (self.

1080

_timedelta_to_milliseconds((self

1081

.last_checked_ok

1082

+ self.timeout)

1083

- datetime.datetime

1084

.utcnow()))

1085

if time_to_die <= 0:

1086

# The timeout has passed

1087

self.disable()

1088

else:

1089

self.expires = (datetime.datetime.utcnow()

1090

+ datetime.timedelta(milliseconds = time_to_die))

1091

self.disable_initiator_tag = (gobject.timeout_add

1092

(time_to_die, self.disable))

1093

1567

# Reschedule disabling

1568

if self.enabled:

1569

now = datetime.datetime.utcnow()

1570

self.expires += self.timeout - old_timeout

1571

if self.expires <= now:

1572

# The timeout has passed

1573

self.disable()

1574

else:

1575

if (getattr(self, "disable_initiator_tag", None)

1576

is None):

1577

return

1578

gobject.source_remove(self.disable_initiator_tag)

1579

self.disable_initiator_tag = (

1580

gobject.timeout_add(

1581

timedelta_to_milliseconds(self.expires - now),

1582

self.disable))

1583

1094

1584

# ExtendedTimeout - property

1095

1585

@dbus_service_property(_interface, signature="t",

1096

1586

access="readwrite")

1098

1588

if value is None: # get

1099

1589

return dbus.UInt64(self.extended_timeout_milliseconds())

1100

1590

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1101

1591

1102

1592

# Interval - property

1103

1593

@dbus_service_property(_interface, signature="t",

1104

1594

access="readwrite")

1108

1598

self.interval = datetime.timedelta(0, 0, 0, value)

1109

1599

if getattr(self, "checker_initiator_tag", None) is None:

1110

1600

return

1111

# Reschedule checker run

1112

gobject.source_remove(self.checker_initiator_tag)

1113

self.checker_initiator_tag = (gobject.timeout_add

1114

(value, self.start_checker))

1115

self.start_checker() # Start one now, too

1116

1601

if self.enabled:

1602

# Reschedule checker run

1603

gobject.source_remove(self.checker_initiator_tag)

1604

self.checker_initiator_tag = (gobject.timeout_add

1605

(value, self.start_checker))

1606

self.start_checker() # Start one now, too

1607

1117

1608

# Checker - property

1118

1609

@dbus_service_property(_interface, signature="s",

1119

1610

access="readwrite")

1120

1611

def Checker_dbus_property(self, value=None):

1121

1612

if value is None: # get

1122

1613

return dbus.String(self.checker_command)

1123

self.checker_command = value

1614

self.checker_command = unicode(value)

1124

1615

1125

1616

# CheckerRunning - property

1126

1617

@dbus_service_property(_interface, signature="b",

1153

1644

self._pipe.send(('init', fpr, address))

1154

1645

if not self._pipe.recv():

1155

1646

raise KeyError()

1156

1647

1157

1648

def __getattribute__(self, name):

1158

if(name == '_pipe'):

1649

if name == '_pipe':

1159

1650

return super(ProxyClient, self).__getattribute__(name)

1160

1651

self._pipe.send(('getattr', name))

1161

1652

data = self._pipe.recv()

1166

1657

self._pipe.send(('funcall', name, args, kwargs))

1167

1658

return self._pipe.recv()[1]

1168

1659

return func

1169

1660

1170

1661

def __setattr__(self, name, value):

1171

if(name == '_pipe'):

1662

if name == '_pipe':

1172

1663

return super(ProxyClient, self).__setattr__(name, value)

1173

1664

self._pipe.send(('setattr', name, value))

1174

1665

1185

1676

unicode(self.client_address))

1186

1677

logger.debug("Pipe FD: %d",

1187

1678

self.server.child_pipe.fileno())

1188

1679

1189

1680

session = (gnutls.connection

1190

1681

.ClientSession(self.request,

1191

1682

gnutls.connection

1192

1683

.X509Credentials()))

1193

1684

1194

1685

# Note: gnutls.connection.X509Credentials is really a

1195

1686

# generic GnuTLS certificate credentials object so long as

1196

1687

# no X.509 keys are added to it. Therefore, we can use it

1197

1688

# here despite using OpenPGP certificates.

1198

1689

1199

1690

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1200

1691

# "+AES-256-CBC", "+SHA1",

1201

1692

# "+COMP-NULL", "+CTYPE-OPENPGP",

1207

1698

(gnutls.library.functions

1208

1699

.gnutls_priority_set_direct(session._c_object,

1209

1700

priority, None))

1210

1701

1211

1702

# Start communication using the Mandos protocol

1212

1703

# Get protocol number

1213

1704

line = self.request.makefile().readline()

1214

1705

logger.debug("Protocol version: %r", line)

1215

1706

try:

1216

1707

if int(line.strip().split()[0]) > 1:

1217

raise RuntimeError

1708

raise RuntimeError(line)

1218

1709

except (ValueError, IndexError, RuntimeError) as error:

1219

1710

logger.error("Unknown protocol version: %s", error)

1220

1711

return

1221

1712

1222

1713

# Start GnuTLS connection

1223

1714

try:

1224

1715

session.handshake()

1228

1719

# established. Just abandon the request.

1229

1720

return

1230

1721

logger.debug("Handshake succeeded")

1231

1722

1232

1723

approval_required = False

1233

1724

try:

1234

1725

try:

1239

1730

logger.warning("Bad certificate: %s", error)

1240

1731

return

1241

1732

logger.debug("Fingerprint: %s", fpr)

1242

1733

1243

1734

try:

1244

1735

client = ProxyClient(child_pipe, fpr,

1245

1736

self.client_address)

1257

1748

client.name)

1258

1749

if self.server.use_dbus:

1259

1750

# Emit D-Bus signal

1260

client.Rejected("Disabled")

1751

client.Rejected("Disabled")

1261

1752

return

1262

1753

1263

if client._approved or not client.approval_delay:

1754

if client.approved or not client.approval_delay:

1264

1755

#We are approved or approval is disabled

1265

1756

break

1266

elif client._approved is None:

1757

elif client.approved is None:

1267

1758

logger.info("Client %s needs approval",

1268

1759

client.name)

1269

1760

if self.server.use_dbus:

1280

1771

return

1281

1772

1282

1773

#wait until timeout or approved

1283

#x = float(client._timedelta_to_milliseconds(delay))

1284

1774

time = datetime.datetime.now()

1285

1775

client.changedstate.acquire()

1286

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1776

client.changedstate.wait(

1777

float(timedelta_to_milliseconds(delay)

1778

/ 1000))

1287

1779

client.changedstate.release()

1288

1780

time2 = datetime.datetime.now()

1289

1781

if (time2 - time) >= delay:

1305

1797

try:

1306

1798

sent = session.send(client.secret[sent_size:])

1307

1799

except gnutls.errors.GNUTLSError as error:

1308

logger.warning("gnutls send failed")

1800

logger.warning("gnutls send failed",

1801

exc_info=error)

1309

1802

return

1310

1803

logger.debug("Sent: %d, remaining: %d",

1311

1804

sent, len(client.secret)

1312

1805

- (sent_size + sent))

1313

1806

sent_size += sent

1314

1807

1315

1808

logger.info("Sending secret to %s", client.name)

1316

# bump the timeout as if seen

1317

client.checked_ok(client.extended_timeout)

1809

# bump the timeout using extended_timeout

1810

client.bump_timeout(client.extended_timeout)

1318

1811

if self.server.use_dbus:

1319

1812

# Emit D-Bus signal

1320

1813

client.GotSecret()

1325

1818

try:

1326

1819

session.bye()

1327

1820

except gnutls.errors.GNUTLSError as error:

1328

logger.warning("GnuTLS bye failed")

1821

logger.warning("GnuTLS bye failed",

1822

exc_info=error)

1329

1823

1330

1824

@staticmethod

1331

1825

def peer_certificate(session):

1387

1881

# Convert the buffer to a Python bytestring

1388

1882

fpr = ctypes.string_at(buf, buf_len.value)

1389

1883

# Convert the bytestring to hexadecimal notation

1390

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1884

hex_fpr = binascii.hexlify(fpr).upper()

1391

1885

return hex_fpr

1392

1886

1393

1887

1396

1890

def sub_process_main(self, request, address):

1397

1891

try:

1398

1892

self.finish_request(request, address)

1399

except:

1893

except Exception:

1400

1894

self.handle_error(request, address)

1401

1895

self.close_request(request)

1402

1896

1403

1897

def process_request(self, request, address):

1404

1898

"""Start a new process to process the request."""

1405

multiprocessing.Process(target = self.sub_process_main,

1406

args = (request, address)).start()

1899

proc = multiprocessing.Process(target = self.sub_process_main,

1900

args = (request, address))

1901

proc.start()

1902

return proc

1903

1407

1904

1408

1905

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1409

1906

""" adds a pipe to the MixIn """

1413

1910

This function creates a new pipe in self.pipe

1414

1911

"""

1415

1912

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1416

1417

super(MultiprocessingMixInWithPipe,

1418

self).process_request(request, client_address)

1913

1914

proc = MultiprocessingMixIn.process_request(self, request,

1915

client_address)

1419

1916

self.child_pipe.close()

1420

self.add_pipe(parent_pipe)

1421

1422

def add_pipe(self, parent_pipe):

1917

self.add_pipe(parent_pipe, proc)

1918

1919

def add_pipe(self, parent_pipe, proc):

1423

1920

"""Dummy function; override as necessary"""

1424

raise NotImplementedError

1921

raise NotImplementedError()

1922

1425

1923

1426

1924

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1427

1925

socketserver.TCPServer, object):

1433

1931

use_ipv6: Boolean; to use IPv6 or not

1434

1932

"""

1435

1933

def __init__(self, server_address, RequestHandlerClass,

1436

interface=None, use_ipv6=True):

1934

interface=None, use_ipv6=True, socketfd=None):

1935

"""If socketfd is set, use that file descriptor instead of

1936

creating a new one with socket.socket().

1937

"""

1437

1938

self.interface = interface

1438

1939

if use_ipv6:

1439

1940

self.address_family = socket.AF_INET6

1941

if socketfd is not None:

1942

# Save the file descriptor

1943

self.socketfd = socketfd

1944

# Save the original socket.socket() function

1945

self.socket_socket = socket.socket

1946

# To implement --socket, we monkey patch socket.socket.

1947

#

1948

# (When socketserver.TCPServer is a new-style class, we

1949

# could make self.socket into a property instead of monkey

1950

# patching socket.socket.)

1951

#

1952

# Create a one-time-only replacement for socket.socket()

1953

@functools.wraps(socket.socket)

1954

def socket_wrapper(*args, **kwargs):

1955

# Restore original function so subsequent calls are

1956

# not affected.

1957

socket.socket = self.socket_socket

1958

del self.socket_socket

1959

# This time only, return a new socket object from the

1960

# saved file descriptor.

1961

return socket.fromfd(self.socketfd, *args, **kwargs)

1962

# Replace socket.socket() function with wrapper

1963

socket.socket = socket_wrapper

1964

# The socketserver.TCPServer.__init__ will call

1965

# socket.socket(), which might be our replacement,

1966

# socket_wrapper(), if socketfd was set.

1440

1967

socketserver.TCPServer.__init__(self, server_address,

1441

1968

RequestHandlerClass)

1969

1442

1970

def server_bind(self):

1443

1971

"""This overrides the normal server_bind() function

1444

1972

to bind to an interface if one was specified, and also NOT to

1452

1980

try:

1453

1981

self.socket.setsockopt(socket.SOL_SOCKET,

1454

1982

SO_BINDTODEVICE,

1455

str(self.interface

1456

+ '\0'))

1983

str(self.interface + '\0'))

1457

1984

except socket.error as error:

1458

if error[0] == errno.EPERM:

1459

logger.error("No permission to"

1460

" bind to interface %s",

1461

self.interface)

1462

elif error[0] == errno.ENOPROTOOPT:

1985

if error.errno == errno.EPERM:

1986

logger.error("No permission to bind to"

1987

" interface %s", self.interface)

1988

elif error.errno == errno.ENOPROTOOPT:

1463

1989

logger.error("SO_BINDTODEVICE not available;"

1464

1990

" cannot bind to interface %s",

1465

1991

self.interface)

1992

elif error.errno == errno.ENODEV:

1993

logger.error("Interface %s does not exist,"

1994

" cannot bind", self.interface)

1466

1995

else:

1467

1996

raise

1468

1997

# Only bind(2) the socket if we really need to.

1471

2000

if self.address_family == socket.AF_INET6:

1472

2001

any_address = "::" # in6addr_any

1473

2002

else:

1474

any_address = socket.INADDR_ANY

2003

any_address = "0.0.0.0" # INADDR_ANY

1475

2004

self.server_address = (any_address,

1476

2005

self.server_address[1])

1477

2006

elif not self.server_address[1]:

1498

2027

"""

1499

2028

def __init__(self, server_address, RequestHandlerClass,

1500

2029

interface=None, use_ipv6=True, clients=None,

1501

gnutls_priority=None, use_dbus=True):

2030

gnutls_priority=None, use_dbus=True, socketfd=None):

1502

2031

self.enabled = False

1503

2032

self.clients = clients

1504

2033

if self.clients is None:

1505

self.clients = set()

2034

self.clients = {}

1506

2035

self.use_dbus = use_dbus

1507

2036

self.gnutls_priority = gnutls_priority

1508

2037

IPv6_TCPServer.__init__(self, server_address,

1509

2038

RequestHandlerClass,

1510

2039

interface = interface,

1511

use_ipv6 = use_ipv6)

2040

use_ipv6 = use_ipv6,

2041

socketfd = socketfd)

1512

2042

def server_activate(self):

1513

2043

if self.enabled:

1514

2044

return socketserver.TCPServer.server_activate(self)

2045

1515

2046

def enable(self):

1516

2047

self.enabled = True

1517

def add_pipe(self, parent_pipe):

2048

2049

def add_pipe(self, parent_pipe, proc):

1518

2050

# Call "handle_ipc" for both data and EOF events

1519

2051

gobject.io_add_watch(parent_pipe.fileno(),

1520

2052

gobject.IO_IN | gobject.IO_HUP,

1521

2053

functools.partial(self.handle_ipc,

1522

parent_pipe = parent_pipe))

1523

2054

parent_pipe =

2055

parent_pipe,

2056

proc = proc))

2057

1524

2058

def handle_ipc(self, source, condition, parent_pipe=None,

1525

client_object=None):

1526

condition_names = {

1527

gobject.IO_IN: "IN", # There is data to read.

1528

gobject.IO_OUT: "OUT", # Data can be written (without

1529

# blocking).

1530

gobject.IO_PRI: "PRI", # There is urgent data to read.

1531

gobject.IO_ERR: "ERR", # Error condition.

1532

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1533

# broken, usually for pipes and

1534

# sockets).

1535

}

1536

conditions_string = ' | '.join(name

1537

for cond, name in

1538

condition_names.iteritems()

1539

if cond & condition)

1540

# error or the other end of multiprocessing.Pipe has closed

1541

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2059

proc = None, client_object=None):

2060

# error, or the other end of multiprocessing.Pipe has closed

2061

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2062

# Wait for other process to exit

2063

proc.join()

1542

2064

return False

1543

2065

1544

2066

# Read a request from the child

1549

2071

fpr = request[1]

1550

2072

address = request[2]

1551

2073

1552

for c in self.clients:

2074

for c in self.clients.itervalues():

1553

2075

if c.fingerprint == fpr:

1554

2076

client = c

1555

2077

break

1558

2080

"dress: %s", fpr, address)

1559

2081

if self.use_dbus:

1560

2082

# Emit D-Bus signal

1561

mandos_dbus_service.ClientNotFound(fpr, address[0])

2083

mandos_dbus_service.ClientNotFound(fpr,

2084

address[0])

1562

2085

parent_pipe.send(False)

1563

2086

return False

1564

2087

1565

2088

gobject.io_add_watch(parent_pipe.fileno(),

1566

2089

gobject.IO_IN | gobject.IO_HUP,

1567

2090

functools.partial(self.handle_ipc,

1568

parent_pipe = parent_pipe,

1569

client_object = client))

2091

parent_pipe =

2092

parent_pipe,

2093

proc = proc,

2094

client_object =

2095

client))

1570

2096

parent_pipe.send(True)

1571

# remove the old hook in favor of the new above hook on same fileno

2097

# remove the old hook in favor of the new above hook on

2098

# same fileno

1572

2099

return False

1573

2100

if command == 'funcall':

1574

2101

funcname = request[1]

1575

2102

args = request[2]

1576

2103

kwargs = request[3]

1577

2104

1578

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1579

2105

parent_pipe.send(('data', getattr(client_object,

2106

funcname)(*args,

2107

**kwargs)))

2108

1580

2109

if command == 'getattr':

1581

2110

attrname = request[1]

1582

2111

if callable(client_object.__getattribute__(attrname)):

1583

2112

parent_pipe.send(('function',))

1584

2113

else:

1585

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2114

parent_pipe.send(('data', client_object

2115

.__getattribute__(attrname)))

1586

2116

1587

2117

if command == 'setattr':

1588

2118

attrname = request[1]

1589

2119

value = request[2]

1590

2120

setattr(client_object, attrname, value)

1591

2121

1592

2122

return True

1593

2123

1594

2124

2125

def rfc3339_duration_to_delta(duration):

2126

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2127

2128

>>> rfc3339_duration_to_delta("P7D")

2129

datetime.timedelta(7)

2130

>>> rfc3339_duration_to_delta("PT60S")

2131

datetime.timedelta(0, 60)

2132

>>> rfc3339_duration_to_delta("PT60M")

2133

datetime.timedelta(0, 3600)

2134

>>> rfc3339_duration_to_delta("PT24H")

2135

datetime.timedelta(1)

2136

>>> rfc3339_duration_to_delta("P1W")

2137

datetime.timedelta(7)

2138

>>> rfc3339_duration_to_delta("PT5M30S")

2139

datetime.timedelta(0, 330)

2140

>>> rfc3339_duration_to_delta("P1DT3M20S")

2141

datetime.timedelta(1, 200)

2142

"""

2143

2144

# Parsing an RFC 3339 duration with regular expressions is not

2145

# possible - there would have to be multiple places for the same

2146

# values, like seconds. The current code, while more esoteric, is

2147

# cleaner without depending on a parsing library. If Python had a

2148

# built-in library for parsing we would use it, but we'd like to

2149

# avoid excessive use of external libraries.

2150

2151

# New type for defining tokens, syntax, and semantics all-in-one

2152

Token = collections.namedtuple("Token",

2153

("regexp", # To match token; if

2154

# "value" is not None,

2155

# must have a "group"

2156

# containing digits

2157

"value", # datetime.timedelta or

2158

# None

2159

"followers")) # Tokens valid after

2160

# this token

2161

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2162

# the "duration" ABNF definition in RFC 3339, Appendix A.

2163

token_end = Token(re.compile(r"$"), None, frozenset())

2164

token_second = Token(re.compile(r"(\d+)S"),

2165

datetime.timedelta(seconds=1),

2166

frozenset((token_end,)))

2167

token_minute = Token(re.compile(r"(\d+)M"),

2168

datetime.timedelta(minutes=1),

2169

frozenset((token_second, token_end)))

2170

token_hour = Token(re.compile(r"(\d+)H"),

2171

datetime.timedelta(hours=1),

2172

frozenset((token_minute, token_end)))

2173

token_time = Token(re.compile(r"T"),

2174

None,

2175

frozenset((token_hour, token_minute,

2176

token_second)))

2177

token_day = Token(re.compile(r"(\d+)D"),

2178

datetime.timedelta(days=1),

2179

frozenset((token_time, token_end)))

2180

token_month = Token(re.compile(r"(\d+)M"),

2181

datetime.timedelta(weeks=4),

2182

frozenset((token_day, token_end)))

2183

token_year = Token(re.compile(r"(\d+)Y"),

2184

datetime.timedelta(weeks=52),

2185

frozenset((token_month, token_end)))

2186

token_week = Token(re.compile(r"(\d+)W"),

2187

datetime.timedelta(weeks=1),

2188

frozenset((token_end,)))

2189

token_duration = Token(re.compile(r"P"), None,

2190

frozenset((token_year, token_month,

2191

token_day, token_time,

2192

token_week))),

2193

# Define starting values

2194

value = datetime.timedelta() # Value so far

2195

found_token = None

2196

followers = frozenset(token_duration,) # Following valid tokens

2197

s = duration # String left to parse

2198

# Loop until end token is found

2199

while found_token is not token_end:

2200

# Search for any currently valid tokens

2201

for token in followers:

2202

match = token.regexp.match(s)

2203

if match is not None:

2204

# Token found

2205

if token.value is not None:

2206

# Value found, parse digits

2207

factor = int(match.group(1), 10)

2208

# Add to value so far

2209

value += factor * token.value

2210

# Strip token from string

2211

s = token.regexp.sub("", s, 1)

2212

# Go to found token

2213

found_token = token

2214

# Set valid next tokens

2215

followers = found_token.followers

2216

break

2217

else:

2218

# No currently valid tokens were found

2219

raise ValueError("Invalid RFC 3339 duration")

2220

# End token found

2221

return value

2222

2223

1595

2224

def string_to_delta(interval):

1596

2225

"""Parse a string and return a datetime.timedelta

1597

2226

1608

2237

>>> string_to_delta('5m 30s')

1609

2238

datetime.timedelta(0, 330)

1610

2239

"""

2240

2241

try:

2242

return rfc3339_duration_to_delta(interval)

2243

except ValueError:

2244

pass

2245

1611

2246

timevalue = datetime.timedelta(0)

1612

2247

for s in interval.split():

1613

2248

try:

1624

2259

elif suffix == "w":

1625

2260

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1626

2261

else:

1627

raise ValueError("Unknown suffix %r" % suffix)

1628

except (ValueError, IndexError) as e:

2262

raise ValueError("Unknown suffix {0!r}"

2263

.format(suffix))

2264

except IndexError as e:

1629

2265

raise ValueError(*(e.args))

1630

2266

timevalue += delta

1631

2267

return timevalue

1632

2268

1633

2269

1634

def if_nametoindex(interface):

1635

"""Call the C function if_nametoindex(), or equivalent

1636

1637

Note: This function cannot accept a unicode string."""

1638

global if_nametoindex

1639

try:

1640

if_nametoindex = (ctypes.cdll.LoadLibrary

1641

(ctypes.util.find_library("c"))

1642

.if_nametoindex)

1643

except (OSError, AttributeError):

1644

logger.warning("Doing if_nametoindex the hard way")

1645

def if_nametoindex(interface):

1646

"Get an interface index the hard way, i.e. using fcntl()"

1647

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1648

with contextlib.closing(socket.socket()) as s:

1649

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1650

struct.pack(str("16s16x"),

1651

interface))

1652

interface_index = struct.unpack(str("I"),

1653

ifreq[16:20])[0]

1654

return interface_index

1655

return if_nametoindex(interface)

1656

1657

1658

2270

def daemon(nochdir = False, noclose = False):

1659

2271

"""See daemon(3). Standard BSD Unix function.

1660

2272

1668

2280

sys.exit()

1669

2281

if not noclose:

1670

2282

# Close all standard open file descriptors

1671

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2283

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1672

2284

if not stat.S_ISCHR(os.fstat(null).st_mode):

1673

2285

raise OSError(errno.ENODEV,

1674

"%s not a character device"

1675

% os.path.devnull)

2286

"{0} not a character device"

2287

.format(os.devnull))

1676

2288

os.dup2(null, sys.stdin.fileno())

1677

2289

os.dup2(null, sys.stdout.fileno())

1678

2290

os.dup2(null, sys.stderr.fileno())

1687

2299

1688

2300

parser = argparse.ArgumentParser()

1689

2301

parser.add_argument("-v", "--version", action="version",

1690

version = "%%(prog)s %s" % version,

2302

version = "%(prog)s {0}".format(version),

1691

2303

help="show version number and exit")

1692

2304

parser.add_argument("-i", "--interface", metavar="IF",

1693

2305

help="Bind to interface IF")

1699

2311

help="Run self-test")

1700

2312

parser.add_argument("--debug", action="store_true",

1701

2313

help="Debug mode; run in foreground and log"

1702

" to terminal")

2314

" to terminal", default=None)

1703

2315

parser.add_argument("--debuglevel", metavar="LEVEL",

1704

2316

help="Debug level for stdout output")

1705

2317

parser.add_argument("--priority", help="GnuTLS"

1712

2324

" files")

1713

2325

parser.add_argument("--no-dbus", action="store_false",

1714

2326

dest="use_dbus", help="Do not provide D-Bus"

1715

" system bus interface")

2327

" system bus interface", default=None)

1716

2328

parser.add_argument("--no-ipv6", action="store_false",

1717

dest="use_ipv6", help="Do not use IPv6")

2329

dest="use_ipv6", help="Do not use IPv6",

2330

default=None)

2331

parser.add_argument("--no-restore", action="store_false",

2332

dest="restore", help="Do not restore stored"

2333

" state", default=None)

2334

parser.add_argument("--socket", type=int,

2335

help="Specify a file descriptor to a network"

2336

" socket to use instead of creating one")

2337

parser.add_argument("--statedir", metavar="DIR",

2338

help="Directory to save/restore state in")

2339

parser.add_argument("--foreground", action="store_true",

2340

help="Run in foreground", default=None)

2341

1718

2342

options = parser.parse_args()

1719

2343

1720

2344

if options.check:

1728

2352

"port": "",

1729

2353

"debug": "False",

1730

2354

"priority":

1731

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2355

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

1732

2356

"servicename": "Mandos",

1733

2357

"use_dbus": "True",

1734

2358

"use_ipv6": "True",

1735

2359

"debuglevel": "",

2360

"restore": "True",

2361

"socket": "",

2362

"statedir": "/var/lib/mandos",

2363

"foreground": "False",

1736

2364

}

1737

2365

1738

2366

# Parse config file for server-global settings

1743

2371

# Convert the SafeConfigParser object to a dict

1744

2372

server_settings = server_config.defaults()

1745

2373

# Use the appropriate methods on the non-string config options

1746

for option in ("debug", "use_dbus", "use_ipv6"):

2374

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

1747

2375

server_settings[option] = server_config.getboolean("DEFAULT",

1748

2376

option)

1749

2377

if server_settings["port"]:

1750

2378

server_settings["port"] = server_config.getint("DEFAULT",

1751

2379

"port")

2380

if server_settings["socket"]:

2381

server_settings["socket"] = server_config.getint("DEFAULT",

2382

"socket")

2383

# Later, stdin will, and stdout and stderr might, be dup'ed

2384

# over with an opened os.devnull. But we don't want this to

2385

# happen with a supplied network socket.

2386

if 0 <= server_settings["socket"] <= 2:

2387

server_settings["socket"] = os.dup(server_settings

2388

["socket"])

1752

2389

del server_config

1753

2390

1754

2391

# Override the settings from the config file with command line

1755

2392

# options, if set.

1756

2393

for option in ("interface", "address", "port", "debug",

1757

2394

"priority", "servicename", "configdir",

1758

"use_dbus", "use_ipv6", "debuglevel"):

2395

"use_dbus", "use_ipv6", "debuglevel", "restore",

2396

"statedir", "socket", "foreground"):

1759

2397

value = getattr(options, option)

1760

2398

if value is not None:

1761

2399

server_settings[option] = value

1764

2402

for option in server_settings.keys():

1765

2403

if type(server_settings[option]) is str:

1766

2404

server_settings[option] = unicode(server_settings[option])

2405

# Force all boolean options to be boolean

2406

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2407

"foreground"):

2408

server_settings[option] = bool(server_settings[option])

2409

# Debug implies foreground

2410

if server_settings["debug"]:

2411

server_settings["foreground"] = True

1767

2412

# Now we have our good server settings in "server_settings"

1768

2413

1769

2414

##################################################################

1773

2418

debuglevel = server_settings["debuglevel"]

1774

2419

use_dbus = server_settings["use_dbus"]

1775

2420

use_ipv6 = server_settings["use_ipv6"]

1776

2421

stored_state_path = os.path.join(server_settings["statedir"],

2422

stored_state_file)

2423

foreground = server_settings["foreground"]

2424

2425

if debug:

2426

initlogger(debug, logging.DEBUG)

2427

else:

2428

if not debuglevel:

2429

initlogger(debug)

2430

else:

2431

level = getattr(logging, debuglevel.upper())

2432

initlogger(debug, level)

2433

1777

2434

if server_settings["servicename"] != "Mandos":

1778

2435

syslogger.setFormatter(logging.Formatter

1779

('Mandos (%s) [%%(process)d]:'

1780

' %%(levelname)s: %%(message)s'

1781

% server_settings["servicename"]))

2436

('Mandos ({0}) [%(process)d]:'

2437

' %(levelname)s: %(message)s'

2438

.format(server_settings

2439

["servicename"])))

1782

2440

1783

2441

# Parse config file with clients

1784

client_defaults = { "timeout": "5m",

1785

"extended_timeout": "15m",

1786

"interval": "2m",

1787

"checker": "fping -q -- %%(host)s",

1788

"host": "",

1789

"approval_delay": "0s",

1790

"approval_duration": "1s",

1791

}

1792

client_config = configparser.SafeConfigParser(client_defaults)

2442

client_config = configparser.SafeConfigParser(Client

2443

.client_defaults)

1793

2444

client_config.read(os.path.join(server_settings["configdir"],

1794

2445

"clients.conf"))

1795

2446

1804

2455

use_ipv6=use_ipv6,

1805

2456

gnutls_priority=

1806

2457

server_settings["priority"],

1807

use_dbus=use_dbus)

1808

if not debug:

1809

pidfilename = "/var/run/mandos.pid"

2458

use_dbus=use_dbus,

2459

socketfd=(server_settings["socket"]

2460

or None))

2461

if not foreground:

2462

pidfilename = "/run/mandos.pid"

2463

if not os.path.isdir("/run/."):

2464

pidfilename = "/var/run/mandos.pid"

2465

pidfile = None

1810

2466

try:

1811

2467

pidfile = open(pidfilename, "w")

1812

except IOError:

1813

logger.error("Could not open file %r", pidfilename)

2468

except IOError as e:

2469

logger.error("Could not open file %r", pidfilename,

2470

exc_info=e)

1814

2471

1815

try:

1816

uid = pwd.getpwnam("_mandos").pw_uid

1817

gid = pwd.getpwnam("_mandos").pw_gid

1818

except KeyError:

2472

for name in ("_mandos", "mandos", "nobody"):

1819

2473

try:

1820

uid = pwd.getpwnam("mandos").pw_uid

1821

gid = pwd.getpwnam("mandos").pw_gid

2474

uid = pwd.getpwnam(name).pw_uid

2475

gid = pwd.getpwnam(name).pw_gid

2476

break

1822

2477

except KeyError:

1823

try:

1824

uid = pwd.getpwnam("nobody").pw_uid

1825

gid = pwd.getpwnam("nobody").pw_gid

1826

except KeyError:

1827

uid = 65534

1828

gid = 65534

2478

continue

2479

else:

2480

uid = 65534

2481

gid = 65534

1829

2482

try:

1830

2483

os.setgid(gid)

1831

2484

os.setuid(uid)

1832

2485

except OSError as error:

1833

if error[0] != errno.EPERM:

1834

raise error

2486

if error.errno != errno.EPERM:

2487

raise

1835

2488

1836

if not debug and not debuglevel:

1837

syslogger.setLevel(logging.WARNING)

1838

console.setLevel(logging.WARNING)

1839

if debuglevel:

1840

level = getattr(logging, debuglevel.upper())

1841

syslogger.setLevel(level)

1842

console.setLevel(level)

1843

1844

2489

if debug:

1845

2490

# Enable all possible GnuTLS debugging

1846

2491

1856

2501

.gnutls_global_set_log_function(debug_gnutls))

1857

2502

1858

2503

# Redirect stdin so all checkers get /dev/null

1859

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2504

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1860

2505

os.dup2(null, sys.stdin.fileno())

1861

2506

if null > 2:

1862

2507

os.close(null)

1863

else:

1864

# No console logging

1865

logger.removeHandler(console)

1866

2508

1867

2509

# Need to fork before connecting to D-Bus

1868

if not debug:

2510

if not foreground:

1869

2511

# Close all input and output, do double fork, etc.

1870

2512

daemon()

1871

2513

2514

# multiprocessing will use threads, so before we use gobject we

2515

# need to inform gobject that threads will be used.

2516

gobject.threads_init()

2517

1872

2518

global main_loop

1873

2519

# From the Avahi example code

1874

DBusGMainLoop(set_as_default=True )

2520

DBusGMainLoop(set_as_default=True)

1875

2521

main_loop = gobject.MainLoop()

1876

2522

bus = dbus.SystemBus()

1877

2523

# End of Avahi example code

1878

2524

if use_dbus:

1879

2525

try:

1880

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2526

bus_name = dbus.service.BusName("se.recompile.Mandos",

1881

2527

bus, do_not_queue=True)

2528

old_bus_name = (dbus.service.BusName

2529

("se.bsnet.fukt.Mandos", bus,

2530

do_not_queue=True))

1882

2531

except dbus.exceptions.NameExistsException as e:

1883

logger.error(unicode(e) + ", disabling D-Bus")

2532

logger.error("Disabling D-Bus:", exc_info=e)

1884

2533

use_dbus = False

1885

2534

server_settings["use_dbus"] = False

1886

2535

tcp_server.use_dbus = False

1887

2536

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1888

service = AvahiService(name = server_settings["servicename"],

1889

servicetype = "_mandos._tcp",

1890

protocol = protocol, bus = bus)

2537

service = AvahiServiceToSyslog(name =

2538

server_settings["servicename"],

2539

servicetype = "_mandos._tcp",

2540

protocol = protocol, bus = bus)

1891

2541

if server_settings["interface"]:

1892

2542

service.interface = (if_nametoindex

1893

2543

(str(server_settings["interface"])))

1898

2548

client_class = Client

1899

2549

if use_dbus:

1900

2550

client_class = functools.partial(ClientDBus, bus = bus)

1901

def client_config_items(config, section):

1902

special_settings = {

1903

"approved_by_default":

1904

lambda: config.getboolean(section,

1905

"approved_by_default"),

1906

}

1907

for name, value in config.items(section):

2551

2552

client_settings = Client.config_parser(client_config)

2553

old_client_settings = {}

2554

clients_data = {}

2555

2556

# This is used to redirect stdout and stderr for checker processes

2557

global wnull

2558

wnull = open(os.devnull, "w") # A writable /dev/null

2559

# Only used if server is running in foreground but not in debug

2560

# mode

2561

if debug or not foreground:

2562

wnull.close()

2563

2564

# Get client data and settings from last running state.

2565

if server_settings["restore"]:

2566

try:

2567

with open(stored_state_path, "rb") as stored_state:

2568

clients_data, old_client_settings = (pickle.load

2569

(stored_state))

2570

os.remove(stored_state_path)

2571

except IOError as e:

2572

if e.errno == errno.ENOENT:

2573

logger.warning("Could not load persistent state: {0}"

2574

.format(os.strerror(e.errno)))

2575

else:

2576

logger.critical("Could not load persistent state:",

2577

exc_info=e)

2578

raise

2579

except EOFError as e:

2580

logger.warning("Could not load persistent state: "

2581

"EOFError:", exc_info=e)

2582

2583

with PGPEngine() as pgp:

2584

for client_name, client in clients_data.iteritems():

2585

# Skip removed clients

2586

if client_name not in client_settings:

2587

continue

2588

2589

# Decide which value to use after restoring saved state.

2590

# We have three different values: Old config file,

2591

# new config file, and saved state.

2592

# New config value takes precedence if it differs from old

2593

# config value, otherwise use saved state.

2594

for name, value in client_settings[client_name].items():

2595

try:

2596

# For each value in new config, check if it

2597

# differs from the old config value (Except for

2598

# the "secret" attribute)

2599

if (name != "secret" and

2600

value != old_client_settings[client_name]

2601

[name]):

2602

client[name] = value

2603

except KeyError:

2604

pass

2605

2606

# Clients who has passed its expire date can still be

2607

# enabled if its last checker was successful. Clients

2608

# whose checker succeeded before we stored its state is

2609

# assumed to have successfully run all checkers during

2610

# downtime.

2611

if client["enabled"]:

2612

if datetime.datetime.utcnow() >= client["expires"]:

2613

if not client["last_checked_ok"]:

2614

logger.warning(

2615

"disabling client {0} - Client never "

2616

"performed a successful checker"

2617

.format(client_name))

2618

client["enabled"] = False

2619

elif client["last_checker_status"] != 0:

2620

logger.warning(

2621

"disabling client {0} - Client "

2622

"last checker failed with error code {1}"

2623

.format(client_name,

2624

client["last_checker_status"]))

2625

client["enabled"] = False

2626

else:

2627

client["expires"] = (datetime.datetime

2628

.utcnow()

2629

+ client["timeout"])

2630

logger.debug("Last checker succeeded,"

2631

" keeping {0} enabled"

2632

.format(client_name))

1908

2633

try:

1909

yield (name, special_settings[name]())

1910

except KeyError:

1911

yield (name, value)

1912

1913

tcp_server.clients.update(set(

1914

client_class(name = section,

1915

config= dict(client_config_items(

1916

client_config, section)))

1917

for section in client_config.sections()))

2634

client["secret"] = (

2635

pgp.decrypt(client["encrypted_secret"],

2636

client_settings[client_name]

2637

["secret"]))

2638

except PGPError:

2639

# If decryption fails, we use secret from new settings

2640

logger.debug("Failed to decrypt {0} old secret"

2641

.format(client_name))

2642

client["secret"] = (

2643

client_settings[client_name]["secret"])

2644

2645

# Add/remove clients based on new changes made to config

2646

for client_name in (set(old_client_settings)

2647

- set(client_settings)):

2648

del clients_data[client_name]

2649

for client_name in (set(client_settings)

2650

- set(old_client_settings)):

2651

clients_data[client_name] = client_settings[client_name]

2652

2653

# Create all client objects

2654

for client_name, client in clients_data.iteritems():

2655

tcp_server.clients[client_name] = client_class(

2656

name = client_name, settings = client,

2657

server_settings = server_settings)

2658

1918

2659

if not tcp_server.clients:

1919

2660

logger.warning("No clients defined")

1920

1921

if not debug:

1922

try:

1923

with pidfile:

1924

pid = os.getpid()

1925

pidfile.write(str(pid) + "\n".encode("utf-8"))

1926

del pidfile

1927

except IOError:

1928

logger.error("Could not write to file %r with PID %d",

1929

pidfilename, pid)

1930

except NameError:

1931

# "pidfile" was never created

1932

pass

2661

2662

if not foreground:

2663

if pidfile is not None:

2664

try:

2665

with pidfile:

2666

pid = os.getpid()

2667

pidfile.write(str(pid) + "\n".encode("utf-8"))

2668

except IOError:

2669

logger.error("Could not write to file %r with PID %d",

2670

pidfilename, pid)

2671

del pidfile

1933

2672

del pidfilename

1934

1935

signal.signal(signal.SIGINT, signal.SIG_IGN)

1936

2673

1937

2674

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1938

2675

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1939

2676

1940

2677

if use_dbus:

1941

class MandosDBusService(dbus.service.Object):

2678

@alternate_dbus_interfaces({"se.recompile.Mandos":

2679

"se.bsnet.fukt.Mandos"})

2680

class MandosDBusService(DBusObjectWithProperties):

1942

2681

"""A D-Bus proxy object"""

1943

2682

def __init__(self):

1944

2683

dbus.service.Object.__init__(self, bus, "/")

1945

_interface = "se.bsnet.fukt.Mandos"

2684

_interface = "se.recompile.Mandos"

2685

2686

@dbus_interface_annotations(_interface)

2687

def _foo(self):

2688

return { "org.freedesktop.DBus.Property"

2689

".EmitsChangedSignal":

2690

"false"}

1946

2691

1947

2692

@dbus.service.signal(_interface, signature="o")

1948

2693

def ClientAdded(self, objpath):

1963

2708

def GetAllClients(self):

1964

2709

"D-Bus method"

1965

2710

return dbus.Array(c.dbus_object_path

1966

for c in tcp_server.clients)

2711

for c in

2712

tcp_server.clients.itervalues())

1967

2713

1968

2714

@dbus.service.method(_interface,

1969

2715

out_signature="a{oa{sv}}")

1971

2717

"D-Bus method"

1972

2718

return dbus.Dictionary(

1973

2719

((c.dbus_object_path, c.GetAll(""))

1974

for c in tcp_server.clients),

2720

for c in tcp_server.clients.itervalues()),

1975

2721

signature="oa{sv}")

1976

2722

1977

2723

@dbus.service.method(_interface, in_signature="o")

1978

2724

def RemoveClient(self, object_path):

1979

2725

"D-Bus method"

1980

for c in tcp_server.clients:

2726

for c in tcp_server.clients.itervalues():

1981

2727

if c.dbus_object_path == object_path:

1982

tcp_server.clients.remove(c)

2728

del tcp_server.clients[c.name]

1983

2729

c.remove_from_connection()

1984

2730

# Don't signal anything except ClientRemoved

1985

2731

c.disable(quiet=True)

1996

2742

"Cleanup function; run on exit"

1997

2743

service.cleanup()

1998

2744

2745

multiprocessing.active_children()

2746

wnull.close()

2747

if not (tcp_server.clients or client_settings):

2748

return

2749

2750

# Store client before exiting. Secrets are encrypted with key

2751

# based on what config file has. If config file is

2752

# removed/edited, old secret will thus be unrecovable.

2753

clients = {}

2754

with PGPEngine() as pgp:

2755

for client in tcp_server.clients.itervalues():

2756

key = client_settings[client.name]["secret"]

2757

client.encrypted_secret = pgp.encrypt(client.secret,

2758

key)

2759

client_dict = {}

2760

2761

# A list of attributes that can not be pickled

2762

# + secret.

2763

exclude = set(("bus", "changedstate", "secret",

2764

"checker", "server_settings"))

2765

for name, typ in (inspect.getmembers

2766

(dbus.service.Object)):

2767

exclude.add(name)

2768

2769

client_dict["encrypted_secret"] = (client

2770

.encrypted_secret)

2771

for attr in client.client_structure:

2772

if attr not in exclude:

2773

client_dict[attr] = getattr(client, attr)

2774

2775

clients[client.name] = client_dict

2776

del client_settings[client.name]["secret"]

2777

2778

try:

2779

with (tempfile.NamedTemporaryFile

2780

(mode='wb', suffix=".pickle", prefix='clients-',

2781

dir=os.path.dirname(stored_state_path),

2782

delete=False)) as stored_state:

2783

pickle.dump((clients, client_settings), stored_state)

2784

tempname=stored_state.name

2785

os.rename(tempname, stored_state_path)

2786

except (IOError, OSError) as e:

2787

if not debug:

2788

try:

2789

os.remove(tempname)

2790

except NameError:

2791

pass

2792

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2793

logger.warning("Could not save persistent state: {0}"

2794

.format(os.strerror(e.errno)))

2795

else:

2796

logger.warning("Could not save persistent state:",

2797

exc_info=e)

2798

raise

2799

2800

# Delete all clients, and settings from config

1999

2801

while tcp_server.clients:

2000

client = tcp_server.clients.pop()

2802

name, client = tcp_server.clients.popitem()

2001

2803

if use_dbus:

2002

2804

client.remove_from_connection()

2003

client.disable_hook = None

2004

2805

# Don't signal anything except ClientRemoved

2005

2806

client.disable(quiet=True)

2006

2807

if use_dbus:

2007

2808

# Emit D-Bus signal

2008

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2809

mandos_dbus_service.ClientRemoved(client

2810

.dbus_object_path,

2009

2811

client.name)

2812

client_settings.clear()

2010

2813

2011

2814

atexit.register(cleanup)

2012

2815

2013

for client in tcp_server.clients:

2816

for client in tcp_server.clients.itervalues():

2014

2817

if use_dbus:

2015

2818

# Emit D-Bus signal

2016

2819

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2017

client.enable()

2820

# Need to initiate checking of clients

2821

if client.enabled:

2822

client.init_checker()

2018

2823

2019

2824

tcp_server.enable()

2020

2825

tcp_server.server_activate()

2023

2828

service.port = tcp_server.socket.getsockname()[1]

2024

2829

if use_ipv6:

2025

2830

logger.info("Now listening on address %r, port %d,"

2026

" flowinfo %d, scope_id %d"

2027

% tcp_server.socket.getsockname())

2831

" flowinfo %d, scope_id %d",

2832

*tcp_server.socket.getsockname())

2028

2833

else: # IPv4

2029

logger.info("Now listening on address %r, port %d"

2030

% tcp_server.socket.getsockname())

2834

logger.info("Now listening on address %r, port %d",

2835

*tcp_server.socket.getsockname())

2031

2836

2032

2837

#service.interface = tcp_server.socket.getsockname()[3]

2033

2838

2036

2841

try:

2037

2842

service.activate()

2038

2843

except dbus.exceptions.DBusException as error:

2039

logger.critical("DBusException: %s", error)

2844

logger.critical("D-Bus Exception", exc_info=error)

2040

2845

cleanup()

2041

2846

sys.exit(1)

2042

2847

# End of Avahi example code

2049

2854

logger.debug("Starting main loop")

2050

2855

main_loop.run()

2051

2856

except AvahiError as error:

2052

logger.critical("AvahiError: %s", error)

2857

logger.critical("Avahi Error", exc_info=error)

2053

2858

cleanup()

2054

2859

sys.exit(1)

2055

2860

except KeyboardInterrupt: