/mandos/trunk : revision 237.4.53

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

19

# the Free Software Foundation, either version 3 of the License, or

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

25

# GNU General Public License for more details.

26

#

26

#

27

# You should have received a copy of the GNU General Public License

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

30

#

31

# Contact the authors at <mandos@recompile.se>.

32

#

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

37

from future_builtins import *

41

38

42

try:

43

import SocketServer as socketserver

44

except ImportError:

45

import socketserver

39

import SocketServer as socketserver

46

40

import socket

47

41

import argparse

48

42

import datetime

49

43

import errno

50

try:

51

import ConfigParser as configparser

52

except ImportError:

53

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

54

51

import sys

55

52

import re

56

53

import os

65

62

import struct

66

63

import fcntl

67

64

import functools

68

try:

69

import cPickle as pickle

70

except ImportError:

71

import pickle

65

import cPickle as pickle

72

66

import multiprocessing

73

67

import types

74

68

import binascii

75

69

import tempfile

76

70

import itertools

77

71

import collections

78

import codecs

79

72

80

73

import dbus

81

74

import dbus.service

82

from gi.repository import GLib

75

import gobject

76

import avahi

83

77

from dbus.mainloop.glib import DBusGMainLoop

84

78

import ctypes

85

79

import ctypes.util

86

80

import xml.dom.minidom

87

81

import inspect

88

82

89

# Try to find the value of SO_BINDTODEVICE:

90

83

try:

91

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

92

# newer, and it is also the most natural place for it:

93

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

94

85

except AttributeError:

95

86

try:

96

# This is where SO_BINDTODEVICE was up to and including Python

97

# 2.6, and also 3.2:

98

87

from IN import SO_BINDTODEVICE

99

88

except ImportError:

100

# In Python 2.7 it seems to have been removed entirely.

101

# Try running the C preprocessor:

102

try:

103

cc = subprocess.Popen(["cc", "--language=c", "-E",

104

"/dev/stdin"],

105

stdin=subprocess.PIPE,

106

stdout=subprocess.PIPE)

107

stdout = cc.communicate(

108

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

109

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

110

except (OSError, ValueError, IndexError):

111

# No value found

112

SO_BINDTODEVICE = None

113

114

if sys.version_info.major == 2:

115

str = unicode

116

117

version = "1.7.13"

89

SO_BINDTODEVICE = None

90

91

version = "1.6.8"

118

92

stored_state_file = "clients.pickle"

119

93

120

94

logger = logging.getLogger()

121

95

syslogger = None

122

96

123

97

try:

124

if_nametoindex = ctypes.cdll.LoadLibrary(

125

ctypes.util.find_library("c")).if_nametoindex

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

126

101

except (OSError, AttributeError):

127

128

102

def if_nametoindex(interface):

129

103

"Get an interface index the hard way, i.e. using fcntl()"

130

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

131

105

with contextlib.closing(socket.socket()) as s:

132

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

133

struct.pack(b"16s16x", interface))

134

interface_index = struct.unpack("I", ifreq[16:20])[0]

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

135

111

return interface_index

136

112

137

113

138

def copy_function(func):

139

"""Make a copy of a function"""

140

if sys.version_info.major == 2:

141

return types.FunctionType(func.func_code,

142

func.func_globals,

143

func.func_name,

144

func.func_defaults,

145

func.func_closure)

146

else:

147

return types.FunctionType(func.__code__,

148

func.__globals__,

149

func.__name__,

150

func.__defaults__,

151

func.__closure__)

152

153

154

114

def initlogger(debug, level=logging.WARNING):

155

115

"""init logger and add loglevel"""

156

116

157

117

global syslogger

158

syslogger = (logging.handlers.SysLogHandler(

159

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

160

address="/dev/log"))

118

syslogger = (logging.handlers.SysLogHandler

119

(facility =

120

logging.handlers.SysLogHandler.LOG_DAEMON,

121

address = str("/dev/log")))

161

122

syslogger.setFormatter(logging.Formatter

162

123

('Mandos [%(process)d]: %(levelname)s:'

163

124

' %(message)s'))

164

125

logger.addHandler(syslogger)

165

126

166

127

if debug:

167

128

console = logging.StreamHandler()

168

129

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

180

141

181

142

class PGPEngine(object):

182

143

"""A simple class for OpenPGP symmetric encryption & decryption"""

183

184

144

def __init__(self):

185

145

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

186

self.gpg = "gpg"

187

try:

188

output = subprocess.check_output(["gpgconf"])

189

for line in output.splitlines():

190

name, text, path = line.split(b":")

191

if name == "gpg":

192

self.gpg = path

193

break

194

except OSError as e:

195

if e.errno != errno.ENOENT:

196

raise

197

146

self.gnupgargs = ['--batch',

198

'--homedir', self.tempdir,

147

'--home', self.tempdir,

199

148

'--force-mdc',

200

'--quiet']

201

# Only GPG version 1 has the --no-use-agent option.

202

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

203

self.gnupgargs.append("--no-use-agent")

204

149

'--quiet',

150

'--no-use-agent']

151

205

152

def __enter__(self):

206

153

return self

207

154

208

155

def __exit__(self, exc_type, exc_value, traceback):

209

156

self._cleanup()

210

157

return False

211

158

212

159

def __del__(self):

213

160

self._cleanup()

214

161

215

162

def _cleanup(self):

216

163

if self.tempdir is not None:

217

164

# Delete contents of tempdir

218

165

for root, dirs, files in os.walk(self.tempdir,

219

topdown=False):

166

topdown = False):

220

167

for filename in files:

221

168

os.remove(os.path.join(root, filename))

222

169

for dirname in dirs:

224

171

# Remove tempdir

225

172

os.rmdir(self.tempdir)

226

173

self.tempdir = None

227

174

228

175

def password_encode(self, password):

229

176

# Passphrase can not be empty and can not contain newlines or

230

177

# NUL bytes. So we prefix it and hex encode it.

235

182

.replace(b"\n", b"\\n")

236

183

.replace(b"\0", b"\\x00"))

237

184

return encoded

238

185

239

186

def encrypt(self, data, password):

240

187

passphrase = self.password_encode(password)

241

with tempfile.NamedTemporaryFile(

242

dir=self.tempdir) as passfile:

188

with tempfile.NamedTemporaryFile(dir=self.tempdir

189

) as passfile:

243

190

passfile.write(passphrase)

244

191

passfile.flush()

245

proc = subprocess.Popen([self.gpg, '--symmetric',

192

proc = subprocess.Popen(['gpg', '--symmetric',

246

193

'--passphrase-file',

247

194

passfile.name]

248

195

+ self.gnupgargs,

249

stdin=subprocess.PIPE,

250

stdout=subprocess.PIPE,

251

stderr=subprocess.PIPE)

252

ciphertext, err = proc.communicate(input=data)

196

stdin = subprocess.PIPE,

197

stdout = subprocess.PIPE,

198

stderr = subprocess.PIPE)

199

ciphertext, err = proc.communicate(input = data)

253

200

if proc.returncode != 0:

254

201

raise PGPError(err)

255

202

return ciphertext

256

203

257

204

def decrypt(self, data, password):

258

205

passphrase = self.password_encode(password)

259

with tempfile.NamedTemporaryFile(

260

dir=self.tempdir) as passfile:

206

with tempfile.NamedTemporaryFile(dir = self.tempdir

207

) as passfile:

261

208

passfile.write(passphrase)

262

209

passfile.flush()

263

proc = subprocess.Popen([self.gpg, '--decrypt',

210

proc = subprocess.Popen(['gpg', '--decrypt',

264

211

'--passphrase-file',

265

212

passfile.name]

266

213

+ self.gnupgargs,

267

stdin=subprocess.PIPE,

268

stdout=subprocess.PIPE,

269

stderr=subprocess.PIPE)

270

decrypted_plaintext, err = proc.communicate(input=data)

214

stdin = subprocess.PIPE,

215

stdout = subprocess.PIPE,

216

stderr = subprocess.PIPE)

217

decrypted_plaintext, err = proc.communicate(input

218

= data)

271

219

if proc.returncode != 0:

272

220

raise PGPError(err)

273

221

return decrypted_plaintext

274

222

275

223

276

# Pretend that we have an Avahi module

277

class Avahi(object):

278

"""This isn't so much a class as it is a module-like namespace.

279

It is instantiated once, and simulates having an Avahi module."""

280

IF_UNSPEC = -1 # avahi-common/address.h

281

PROTO_UNSPEC = -1 # avahi-common/address.h

282

PROTO_INET = 0 # avahi-common/address.h

283

PROTO_INET6 = 1 # avahi-common/address.h

284

DBUS_NAME = "org.freedesktop.Avahi"

285

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

286

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

287

DBUS_PATH_SERVER = "/"

288

289

def string_array_to_txt_array(self, t):

290

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

291

for s in t), signature="ay")

292

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

293

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

294

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

295

SERVER_INVALID = 0 # avahi-common/defs.h

296

SERVER_REGISTERING = 1 # avahi-common/defs.h

297

SERVER_RUNNING = 2 # avahi-common/defs.h

298

SERVER_COLLISION = 3 # avahi-common/defs.h

299

SERVER_FAILURE = 4 # avahi-common/defs.h

300

avahi = Avahi()

301

302

303

224

class AvahiError(Exception):

304

225

def __init__(self, value, *args, **kwargs):

305

226

self.value = value

306

return super(AvahiError, self).__init__(value, *args,

307

**kwargs)

308

227

super(AvahiError, self).__init__(value, *args, **kwargs)

228

def __unicode__(self):

229

return unicode(repr(self.value))

309

230

310

231

class AvahiServiceError(AvahiError):

311

232

pass

312

233

313

314

234

class AvahiGroupError(AvahiError):

315

235

pass

316

236

317

237

318

238

class AvahiService(object):

319

239

"""An Avahi (Zeroconf) service.

320

240

321

241

Attributes:

322

242

interface: integer; avahi.IF_UNSPEC or an interface index.

323

243

Used to optionally bind to the specified interface.

335

255

server: D-Bus Server

336

256

bus: dbus.SystemBus()

337

257

"""

338

339

def __init__(self,

340

interface=avahi.IF_UNSPEC,

341

name=None,

342

servicetype=None,

343

port=None,

344

TXT=None,

345

domain="",

346

host="",

347

max_renames=32768,

348

protocol=avahi.PROTO_UNSPEC,

349

bus=None):

258

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

350

263

self.interface = interface

351

264

self.name = name

352

265

self.type = servicetype

361

274

self.server = None

362

275

self.bus = bus

363

276

self.entry_group_state_changed_match = None

364

365

def rename(self, remove=True):

277

278

def rename(self):

366

279

"""Derived from the Avahi example code"""

367

280

if self.rename_count >= self.max_renames:

368

281

logger.critical("No suitable Zeroconf service name found"

369

282

" after %i retries, exiting.",

370

283

self.rename_count)

371

284

raise AvahiServiceError("Too many renames")

372

self.name = str(

373

self.server.GetAlternativeServiceName(self.name))

374

self.rename_count += 1

285

self.name = unicode(self.server

286

.GetAlternativeServiceName(self.name))

375

287

logger.info("Changing Zeroconf service name to %r ...",

376

288

self.name)

377

if remove:

378

self.remove()

289

self.remove()

379

290

try:

380

291

self.add()

381

292

except dbus.exceptions.DBusException as error:

382

if (error.get_dbus_name()

383

== "org.freedesktop.Avahi.CollisionError"):

384

logger.info("Local Zeroconf service name collision.")

385

return self.rename(remove=False)

386

else:

387

logger.critical("D-Bus Exception", exc_info=error)

388

self.cleanup()

389

os._exit(1)

390

293

logger.critical("D-Bus Exception", exc_info=error)

294

self.cleanup()

295

os._exit(1)

296

self.rename_count += 1

297

391

298

def remove(self):

392

299

"""Derived from the Avahi example code"""

393

300

if self.entry_group_state_changed_match is not None:

395

302

self.entry_group_state_changed_match = None

396

303

if self.group is not None:

397

304

self.group.Reset()

398

305

399

306

def add(self):

400

307

"""Derived from the Avahi example code"""

401

308

self.remove()

418

325

dbus.UInt16(self.port),

419

326

avahi.string_array_to_txt_array(self.TXT))

420

327

self.group.Commit()

421

328

422

329

def entry_group_state_changed(self, state, error):

423

330

"""Derived from the Avahi example code"""

424

331

logger.debug("Avahi entry group state change: %i", state)

425

332

426

333

if state == avahi.ENTRY_GROUP_ESTABLISHED:

427

334

logger.debug("Zeroconf service established.")

428

335

elif state == avahi.ENTRY_GROUP_COLLISION:

430

337

self.rename()

431

338

elif state == avahi.ENTRY_GROUP_FAILURE:

432

339

logger.critical("Avahi: Error in group state changed %s",

433

str(error))

434

raise AvahiGroupError("State changed: {!s}".format(error))

435

340

unicode(error))

341

raise AvahiGroupError("State changed: {!s}"

342

.format(error))

343

436

344

def cleanup(self):

437

345

"""Derived from the Avahi example code"""

438

346

if self.group is not None:

443

351

pass

444

352

self.group = None

445

353

self.remove()

446

354

447

355

def server_state_changed(self, state, error=None):

448

356

"""Derived from the Avahi example code"""

449

357

logger.debug("Avahi server state change: %i", state)

450

bad_states = {

451

avahi.SERVER_INVALID: "Zeroconf server invalid",

452

avahi.SERVER_REGISTERING: None,

453

avahi.SERVER_COLLISION: "Zeroconf server name collision",

454

avahi.SERVER_FAILURE: "Zeroconf server failure",

455

}

358

bad_states = { avahi.SERVER_INVALID:

359

"Zeroconf server invalid",

360

avahi.SERVER_REGISTERING: None,

361

avahi.SERVER_COLLISION:

362

"Zeroconf server name collision",

363

avahi.SERVER_FAILURE:

364

"Zeroconf server failure" }

456

365

if state in bad_states:

457

366

if bad_states[state] is not None:

458

367

if error is None:

461

370

logger.error(bad_states[state] + ": %r", error)

462

371

self.cleanup()

463

372

elif state == avahi.SERVER_RUNNING:

464

try:

465

self.add()

466

except dbus.exceptions.DBusException as error:

467

if (error.get_dbus_name()

468

== "org.freedesktop.Avahi.CollisionError"):

469

logger.info("Local Zeroconf service name"

470

" collision.")

471

return self.rename(remove=False)

472

else:

473

logger.critical("D-Bus Exception", exc_info=error)

474

self.cleanup()

475

os._exit(1)

373

self.add()

476

374

else:

477

375

if error is None:

478

376

logger.debug("Unknown state: %r", state)

479

377

else:

480

378

logger.debug("Unknown state: %r: %r", state, error)

481

379

482

380

def activate(self):

483

381

"""Derived from the Avahi example code"""

484

382

if self.server is None:

488

386

follow_name_owner_changes=True),

489

387

avahi.DBUS_INTERFACE_SERVER)

490

388

self.server.connect_to_signal("StateChanged",

491

self.server_state_changed)

389

self.server_state_changed)

492

390

self.server_state_changed(self.server.GetState())

493

391

494

392

495

393

class AvahiServiceToSyslog(AvahiService):

496

def rename(self, *args, **kwargs):

394

def rename(self):

497

395

"""Add the new name to the syslog messages"""

498

ret = AvahiService.rename(self, *args, **kwargs)

499

syslogger.setFormatter(logging.Formatter(

500

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

501

.format(self.name)))

396

ret = AvahiService.rename(self)

397

syslogger.setFormatter(logging.Formatter

398

('Mandos ({}) [%(process)d]:'

399

' %(levelname)s: %(message)s'

400

.format(self.name)))

502

401

return ret

503

402

504

403

505

# Pretend that we have a GnuTLS module

506

class GnuTLS(object):

507

"""This isn't so much a class as it is a module-like namespace.

508

It is instantiated once, and simulates having a GnuTLS module."""

509

510

library = ctypes.util.find_library("gnutls")

511

if library is None:

512

library = ctypes.util.find_library("gnutls-deb0")

513

_library = ctypes.cdll.LoadLibrary(library)

514

del library

515

_need_version = b"3.3.0"

516

517

def __init__(self):

518

# Need to use "self" here, since this method is called before

519

# the assignment to the "gnutls" global variable happens.

520

if self.check_version(self._need_version) is None:

521

raise self.Error("Needs GnuTLS {} or later"

522

.format(self._need_version))

523

524

# Unless otherwise indicated, the constants and types below are

525

# all from the gnutls/gnutls.h C header file.

526

527

# Constants

528

E_SUCCESS = 0

529

E_INTERRUPTED = -52

530

E_AGAIN = -28

531

CRT_OPENPGP = 2

532

CLIENT = 2

533

SHUT_RDWR = 0

534

CRD_CERTIFICATE = 1

535

E_NO_CERTIFICATE_FOUND = -49

536

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

537

538

# Types

539

class session_int(ctypes.Structure):

540

_fields_ = []

541

session_t = ctypes.POINTER(session_int)

542

543

class certificate_credentials_st(ctypes.Structure):

544

_fields_ = []

545

certificate_credentials_t = ctypes.POINTER(

546

certificate_credentials_st)

547

certificate_type_t = ctypes.c_int

548

549

class datum_t(ctypes.Structure):

550

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

551

('size', ctypes.c_uint)]

552

553

class openpgp_crt_int(ctypes.Structure):

554

_fields_ = []

555

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

556

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

557

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

558

credentials_type_t = ctypes.c_int

559

transport_ptr_t = ctypes.c_void_p

560

close_request_t = ctypes.c_int

561

562

# Exceptions

563

class Error(Exception):

564

# We need to use the class name "GnuTLS" here, since this

565

# exception might be raised from within GnuTLS.__init__,

566

# which is called before the assignment to the "gnutls"

567

# global variable has happened.

568

def __init__(self, message=None, code=None, args=()):

569

# Default usage is by a message string, but if a return

570

# code is passed, convert it to a string with

571

# gnutls.strerror()

572

self.code = code

573

if message is None and code is not None:

574

message = GnuTLS.strerror(code)

575

return super(GnuTLS.Error, self).__init__(

576

message, *args)

577

578

class CertificateSecurityError(Error):

579

pass

580

581

# Classes

582

class Credentials(object):

583

def __init__(self):

584

self._c_object = gnutls.certificate_credentials_t()

585

gnutls.certificate_allocate_credentials(

586

ctypes.byref(self._c_object))

587

self.type = gnutls.CRD_CERTIFICATE

588

589

def __del__(self):

590

gnutls.certificate_free_credentials(self._c_object)

591

592

class ClientSession(object):

593

def __init__(self, socket, credentials=None):

594

self._c_object = gnutls.session_t()

595

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

596

gnutls.set_default_priority(self._c_object)

597

gnutls.transport_set_ptr(self._c_object, socket.fileno())

598

gnutls.handshake_set_private_extensions(self._c_object,

599

True)

600

self.socket = socket

601

if credentials is None:

602

credentials = gnutls.Credentials()

603

gnutls.credentials_set(self._c_object, credentials.type,

604

ctypes.cast(credentials._c_object,

605

ctypes.c_void_p))

606

self.credentials = credentials

607

608

def __del__(self):

609

gnutls.deinit(self._c_object)

610

611

def handshake(self):

612

return gnutls.handshake(self._c_object)

613

614

def send(self, data):

615

data = bytes(data)

616

data_len = len(data)

617

while data_len > 0:

618

data_len -= gnutls.record_send(self._c_object,

619

data[-data_len:],

620

data_len)

621

622

def bye(self):

623

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

624

625

# Error handling functions

626

def _error_code(result):

627

"""A function to raise exceptions on errors, suitable

628

for the 'restype' attribute on ctypes functions"""

629

if result >= 0:

630

return result

631

if result == gnutls.E_NO_CERTIFICATE_FOUND:

632

raise gnutls.CertificateSecurityError(code=result)

633

raise gnutls.Error(code=result)

634

635

def _retry_on_error(result, func, arguments):

636

"""A function to retry on some errors, suitable

637

for the 'errcheck' attribute on ctypes functions"""

638

while result < 0:

639

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

640

return _error_code(result)

641

result = func(*arguments)

642

return result

643

644

# Unless otherwise indicated, the function declarations below are

645

# all from the gnutls/gnutls.h C header file.

646

647

# Functions

648

priority_set_direct = _library.gnutls_priority_set_direct

649

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

650

ctypes.POINTER(ctypes.c_char_p)]

651

priority_set_direct.restype = _error_code

652

653

init = _library.gnutls_init

654

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

655

init.restype = _error_code

656

657

set_default_priority = _library.gnutls_set_default_priority

658

set_default_priority.argtypes = [session_t]

659

set_default_priority.restype = _error_code

660

661

record_send = _library.gnutls_record_send

662

record_send.argtypes = [session_t, ctypes.c_void_p,

663

ctypes.c_size_t]

664

record_send.restype = ctypes.c_ssize_t

665

record_send.errcheck = _retry_on_error

666

667

certificate_allocate_credentials = (

668

_library.gnutls_certificate_allocate_credentials)

669

certificate_allocate_credentials.argtypes = [

670

ctypes.POINTER(certificate_credentials_t)]

671

certificate_allocate_credentials.restype = _error_code

672

673

certificate_free_credentials = (

674

_library.gnutls_certificate_free_credentials)

675

certificate_free_credentials.argtypes = [

676

certificate_credentials_t]

677

certificate_free_credentials.restype = None

678

679

handshake_set_private_extensions = (

680

_library.gnutls_handshake_set_private_extensions)

681

handshake_set_private_extensions.argtypes = [session_t,

682

ctypes.c_int]

683

handshake_set_private_extensions.restype = None

684

685

credentials_set = _library.gnutls_credentials_set

686

credentials_set.argtypes = [session_t, credentials_type_t,

687

ctypes.c_void_p]

688

credentials_set.restype = _error_code

689

690

strerror = _library.gnutls_strerror

691

strerror.argtypes = [ctypes.c_int]

692

strerror.restype = ctypes.c_char_p

693

694

certificate_type_get = _library.gnutls_certificate_type_get

695

certificate_type_get.argtypes = [session_t]

696

certificate_type_get.restype = _error_code

697

698

certificate_get_peers = _library.gnutls_certificate_get_peers

699

certificate_get_peers.argtypes = [session_t,

700

ctypes.POINTER(ctypes.c_uint)]

701

certificate_get_peers.restype = ctypes.POINTER(datum_t)

702

703

global_set_log_level = _library.gnutls_global_set_log_level

704

global_set_log_level.argtypes = [ctypes.c_int]

705

global_set_log_level.restype = None

706

707

global_set_log_function = _library.gnutls_global_set_log_function

708

global_set_log_function.argtypes = [log_func]

709

global_set_log_function.restype = None

710

711

deinit = _library.gnutls_deinit

712

deinit.argtypes = [session_t]

713

deinit.restype = None

714

715

handshake = _library.gnutls_handshake

716

handshake.argtypes = [session_t]

717

handshake.restype = _error_code

718

handshake.errcheck = _retry_on_error

719

720

transport_set_ptr = _library.gnutls_transport_set_ptr

721

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

722

transport_set_ptr.restype = None

723

724

bye = _library.gnutls_bye

725

bye.argtypes = [session_t, close_request_t]

726

bye.restype = _error_code

727

bye.errcheck = _retry_on_error

728

729

check_version = _library.gnutls_check_version

730

check_version.argtypes = [ctypes.c_char_p]

731

check_version.restype = ctypes.c_char_p

732

733

# All the function declarations below are from gnutls/openpgp.h

734

735

openpgp_crt_init = _library.gnutls_openpgp_crt_init

736

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

737

openpgp_crt_init.restype = _error_code

738

739

openpgp_crt_import = _library.gnutls_openpgp_crt_import

740

openpgp_crt_import.argtypes = [openpgp_crt_t,

741

ctypes.POINTER(datum_t),

742

openpgp_crt_fmt_t]

743

openpgp_crt_import.restype = _error_code

744

745

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

746

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

747

ctypes.POINTER(ctypes.c_uint)]

748

openpgp_crt_verify_self.restype = _error_code

749

750

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

751

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

752

openpgp_crt_deinit.restype = None

753

754

openpgp_crt_get_fingerprint = (

755

_library.gnutls_openpgp_crt_get_fingerprint)

756

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

757

ctypes.c_void_p,

758

ctypes.POINTER(

759

ctypes.c_size_t)]

760

openpgp_crt_get_fingerprint.restype = _error_code

761

762

# Remove non-public functions

763

del _error_code, _retry_on_error

764

# Create the global "gnutls" object, simulating a module

765

gnutls = GnuTLS()

766

767

768

def call_pipe(connection, # : multiprocessing.Connection

769

func, *args, **kwargs):

770

"""This function is meant to be called by multiprocessing.Process

771

772

This function runs func(*args, **kwargs), and writes the resulting

773

return value on the provided multiprocessing.Connection.

774

"""

775

connection.send(func(*args, **kwargs))

776

connection.close()

777

778

779

404

class Client(object):

780

405

"""A representation of a client host served by this server.

781

406

782

407

Attributes:

783

408

approved: bool(); 'None' if not yet approved/disapproved

784

409

approval_delay: datetime.timedelta(); Time to wait for approval

786

411

checker: subprocess.Popen(); a running checker process used

787

412

to see if the client lives.

788

413

'None' if no process is running.

789

checker_callback_tag: a GLib event source tag, or None

414

checker_callback_tag: a gobject event source tag, or None

790

415

checker_command: string; External command which is run to check

791

416

if client lives. %() expansions are done at

792

417

runtime with vars(self) as dict, so that for

793

418

instance %(name)s can be used in the command.

794

checker_initiator_tag: a GLib event source tag, or None

419

checker_initiator_tag: a gobject event source tag, or None

795

420

created: datetime.datetime(); (UTC) object creation

796

421

client_structure: Object describing what attributes a client has

797

422

and is used for storing the client at exit

798

423

current_checker_command: string; current running checker_command

799

disable_initiator_tag: a GLib event source tag, or None

424

disable_initiator_tag: a gobject event source tag, or None

800

425

enabled: bool()

801

426

fingerprint: string (40 or 32 hexadecimal digits); used to

802

427

uniquely identify the client

807

432

last_checker_status: integer between 0 and 255 reflecting exit

808

433

status of last checker. -1 reflects crashed

809

434

checker, -2 means no checker completed yet.

810

last_checker_signal: The signal which killed the last checker, if

811

last_checker_status is -1

812

435

last_enabled: datetime.datetime(); (UTC) or None

813

436

name: string; from the config file, used in log messages and

814

437

D-Bus identifiers

821

444

disabled, or None

822

445

server_settings: The server_settings dict from main()

823

446

"""

824

447

825

448

runtime_expansions = ("approval_delay", "approval_duration",

826

449

"created", "enabled", "expires",

827

450

"fingerprint", "host", "interval",

828

451

"last_approval_request", "last_checked_ok",

829

452

"last_enabled", "name", "timeout")

830

client_defaults = {

831

"timeout": "PT5M",

832

"extended_timeout": "PT15M",

833

"interval": "PT2M",

834

"checker": "fping -q -- %%(host)s",

835

"host": "",

836

"approval_delay": "PT0S",

837

"approval_duration": "PT1S",

838

"approved_by_default": "True",

839

"enabled": "True",

840

}

841

453

client_defaults = { "timeout": "PT5M",

454

"extended_timeout": "PT15M",

455

"interval": "PT2M",

456

"checker": "fping -q -- %%(host)s",

457

"host": "",

458

"approval_delay": "PT0S",

459

"approval_duration": "PT1S",

460

"approved_by_default": "True",

461

"enabled": "True",

462

}

463

842

464

@staticmethod

843

465

def config_parser(config):

844

466

"""Construct a new dict of client settings of this form:

851

473

for client_name in config.sections():

852

474

section = dict(config.items(client_name))

853

475

client = settings[client_name] = {}

854

476

855

477

client["host"] = section["host"]

856

478

# Reformat values from string types to Python types

857

479

client["approved_by_default"] = config.getboolean(

858

480

client_name, "approved_by_default")

859

481

client["enabled"] = config.getboolean(client_name,

860

482

"enabled")

861

862

# Uppercase and remove spaces from fingerprint for later

863

# comparison purposes with return value from the

864

# fingerprint() function

483

865

484

client["fingerprint"] = (section["fingerprint"].upper()

866

485

.replace(" ", ""))

867

486

if "secret" in section:

868

client["secret"] = codecs.decode(section["secret"]

869

.encode("utf-8"),

870

"base64")

487

client["secret"] = section["secret"].decode("base64")

871

488

elif "secfile" in section:

872

489

with open(os.path.expanduser(os.path.expandvars

873

490

(section["secfile"])),

888

505

client["last_approval_request"] = None

889

506

client["last_checked_ok"] = None

890

507

client["last_checker_status"] = -2

891

508

892

509

return settings

893

894

def __init__(self, settings, name=None, server_settings=None):

510

511

def __init__(self, settings, name = None, server_settings=None):

895

512

self.name = name

896

513

if server_settings is None:

897

514

server_settings = {}

899

516

# adding all client settings

900

517

for setting, value in settings.items():

901

518

setattr(self, setting, value)

902

519

903

520

if self.enabled:

904

521

if not hasattr(self, "last_enabled"):

905

522

self.last_enabled = datetime.datetime.utcnow()

909

526

else:

910

527

self.last_enabled = None

911

528

self.expires = None

912

529

913

530

logger.debug("Creating client %r", self.name)

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the fingerprint()

533

# function

914

534

logger.debug(" Fingerprint: %s", self.fingerprint)

915

535

self.created = settings.get("created",

916

536

datetime.datetime.utcnow())

917

537

918

538

# attributes specific for this server instance

919

539

self.checker = None

920

540

self.checker_initiator_tag = None

923

543

self.current_checker_command = None

924

544

self.approved = None

925

545

self.approvals_pending = 0

926

self.changedstate = multiprocessing_manager.Condition(

927

multiprocessing_manager.Lock())

928

self.client_structure = [attr

929

for attr in self.__dict__.keys()

546

self.changedstate = (multiprocessing_manager

547

.Condition(multiprocessing_manager

548

.Lock()))

549

self.client_structure = [attr for attr in

550

self.__dict__.iterkeys()

930

551

if not attr.startswith("_")]

931

552

self.client_structure.append("client_structure")

932

933

for name, t in inspect.getmembers(

934

type(self), lambda obj: isinstance(obj, property)):

553

554

for name, t in inspect.getmembers(type(self),

555

lambda obj:

556

isinstance(obj,

557

property)):

935

558

if not name.startswith("_"):

936

559

self.client_structure.append(name)

937

560

938

561

# Send notice to process children that client state has changed

939

562

def send_changedstate(self):

940

563

with self.changedstate:

941

564

self.changedstate.notify_all()

942

565

943

566

def enable(self):

944

567

"""Start this client's checker and timeout hooks"""

945

568

if getattr(self, "enabled", False):

950

573

self.last_enabled = datetime.datetime.utcnow()

951

574

self.init_checker()

952

575

self.send_changedstate()

953

576

954

577

def disable(self, quiet=True):

955

578

"""Disable this client."""

956

579

if not getattr(self, "enabled", False):

958

581

if not quiet:

959

582

logger.info("Disabling client %s", self.name)

960

583

if getattr(self, "disable_initiator_tag", None) is not None:

961

GLib.source_remove(self.disable_initiator_tag)

584

gobject.source_remove(self.disable_initiator_tag)

962

585

self.disable_initiator_tag = None

963

586

self.expires = None

964

587

if getattr(self, "checker_initiator_tag", None) is not None:

965

GLib.source_remove(self.checker_initiator_tag)

588

gobject.source_remove(self.checker_initiator_tag)

966

589

self.checker_initiator_tag = None

967

590

self.stop_checker()

968

591

self.enabled = False

969

592

if not quiet:

970

593

self.send_changedstate()

971

# Do not run this again if called by a GLib.timeout_add

594

# Do not run this again if called by a gobject.timeout_add

972

595

return False

973

596

974

597

def __del__(self):

975

598

self.disable()

976

599

977

600

def init_checker(self):

978

601

# Schedule a new checker to be started an 'interval' from now,

979

602

# and every interval from then on.

980

603

if self.checker_initiator_tag is not None:

981

GLib.source_remove(self.checker_initiator_tag)

982

self.checker_initiator_tag = GLib.timeout_add(

983

int(self.interval.total_seconds() * 1000),

984

self.start_checker)

604

gobject.source_remove(self.checker_initiator_tag)

605

self.checker_initiator_tag = (gobject.timeout_add

606

(int(self.interval

607

.total_seconds() * 1000),

608

self.start_checker))

985

609

# Schedule a disable() when 'timeout' has passed

986

610

if self.disable_initiator_tag is not None:

987

GLib.source_remove(self.disable_initiator_tag)

988

self.disable_initiator_tag = GLib.timeout_add(

989

int(self.timeout.total_seconds() * 1000), self.disable)

611

gobject.source_remove(self.disable_initiator_tag)

612

self.disable_initiator_tag = (gobject.timeout_add

613

(int(self.timeout

614

.total_seconds() * 1000),

615

self.disable))

990

616

# Also start a new checker *right now*.

991

617

self.start_checker()

992

993

def checker_callback(self, source, condition, connection,

994

command):

618

619

def checker_callback(self, pid, condition, command):

995

620

"""The checker has completed, so take appropriate actions."""

996

621

self.checker_callback_tag = None

997

622

self.checker = None

998

# Read return code from connection (see call_pipe)

999

returncode = connection.recv()

1000

connection.close()

1001

1002

if returncode >= 0:

1003

self.last_checker_status = returncode

1004

self.last_checker_signal = None

623

if os.WIFEXITED(condition):

624

self.last_checker_status = os.WEXITSTATUS(condition)

1005

625

if self.last_checker_status == 0:

1006

626

logger.info("Checker for %(name)s succeeded",

1007

627

vars(self))

1008

628

self.checked_ok()

1009

629

else:

1010

logger.info("Checker for %(name)s failed", vars(self))

630

logger.info("Checker for %(name)s failed",

631

vars(self))

1011

632

else:

1012

633

self.last_checker_status = -1

1013

self.last_checker_signal = -returncode

1014

634

logger.warning("Checker for %(name)s crashed?",

1015

635

vars(self))

1016

return False

1017

636

1018

637

def checked_ok(self):

1019

638

"""Assert that the client has been seen, alive and well."""

1020

639

self.last_checked_ok = datetime.datetime.utcnow()

1021

640

self.last_checker_status = 0

1022

self.last_checker_signal = None

1023

641

self.bump_timeout()

1024

642

1025

643

def bump_timeout(self, timeout=None):

1026

644

"""Bump up the timeout for this client."""

1027

645

if timeout is None:

1028

646

timeout = self.timeout

1029

647

if self.disable_initiator_tag is not None:

1030

GLib.source_remove(self.disable_initiator_tag)

648

gobject.source_remove(self.disable_initiator_tag)

1031

649

self.disable_initiator_tag = None

1032

650

if getattr(self, "enabled", False):

1033

self.disable_initiator_tag = GLib.timeout_add(

1034

int(timeout.total_seconds() * 1000), self.disable)

651

self.disable_initiator_tag = (gobject.timeout_add

652

(int(timeout.total_seconds()

653

* 1000), self.disable))

1035

654

self.expires = datetime.datetime.utcnow() + timeout

1036

655

1037

656

def need_approval(self):

1038

657

self.last_approval_request = datetime.datetime.utcnow()

1039

658

1040

659

def start_checker(self):

1041

660

"""Start a new checker subprocess if one is not running.

1042

661

1043

662

If a checker already exists, leave it running and do

1044

663

nothing."""

1045

664

# The reason for not killing a running checker is that if we

1050

669

# checkers alone, the checker would have to take more time

1051

670

# than 'timeout' for the client to be disabled, which is as it

1052

671

# should be.

1053

1054

if self.checker is not None and not self.checker.is_alive():

1055

logger.warning("Checker was not alive; joining")

1056

self.checker.join()

1057

self.checker = None

672

673

# If a checker exists, make sure it is not a zombie

674

try:

675

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

676

except AttributeError:

677

pass

678

except OSError as error:

679

if error.errno != errno.ECHILD:

680

raise

681

else:

682

if pid:

683

logger.warning("Checker was a zombie")

684

gobject.source_remove(self.checker_callback_tag)

685

self.checker_callback(pid, status,

686

self.current_checker_command)

1058

687

# Start a new checker if needed

1059

688

if self.checker is None:

1060

689

# Escape attributes for the shell

1061

escaped_attrs = {

1062

attr: re.escape(str(getattr(self, attr)))

1063

for attr in self.runtime_expansions}

690

escaped_attrs = { attr:

691

re.escape(unicode(getattr(self,

692

attr)))

693

for attr in self.runtime_expansions }

1064

694

try:

1065

695

command = self.checker_command % escaped_attrs

1066

696

except TypeError as error:

1067

697

logger.error('Could not format string "%s"',

1068

self.checker_command,

698

self.checker_command, exc_info=error)

699

return True # Try again later

700

self.current_checker_command = command

701

try:

702

logger.info("Starting checker %r for %s",

703

command, self.name)

704

# We don't need to redirect stdout and stderr, since

705

# in normal mode, that is already done by daemon(),

706

# and in debug mode we don't want to. (Stdin is

707

# always replaced by /dev/null.)

708

# The exception is when not debugging but nevertheless

709

# running in the foreground; use the previously

710

# created wnull.

711

popen_args = {}

712

if (not self.server_settings["debug"]

713

and self.server_settings["foreground"]):

714

popen_args.update({"stdout": wnull,

715

"stderr": wnull })

716

self.checker = subprocess.Popen(command,

717

close_fds=True,

718

shell=True, cwd="/",

719

**popen_args)

720

except OSError as error:

721

logger.error("Failed to start subprocess",

1069

722

exc_info=error)

1070

return True # Try again later

1071

self.current_checker_command = command

1072

logger.info("Starting checker %r for %s", command,

1073

self.name)

1074

# We don't need to redirect stdout and stderr, since

1075

# in normal mode, that is already done by daemon(),

1076

# and in debug mode we don't want to. (Stdin is

1077

# always replaced by /dev/null.)

1078

# The exception is when not debugging but nevertheless

1079

# running in the foreground; use the previously

1080

# created wnull.

1081

popen_args = {"close_fds": True,

1082

"shell": True,

1083

"cwd": "/"}

1084

if (not self.server_settings["debug"]

1085

and self.server_settings["foreground"]):

1086

popen_args.update({"stdout": wnull,

1087

"stderr": wnull})

1088

pipe = multiprocessing.Pipe(duplex=False)

1089

self.checker = multiprocessing.Process(

1090

target=call_pipe,

1091

args=(pipe[1], subprocess.call, command),

1092

kwargs=popen_args)

1093

self.checker.start()

1094

self.checker_callback_tag = GLib.io_add_watch(

1095

pipe[0].fileno(), GLib.IO_IN,

1096

self.checker_callback, pipe[0], command)

1097

# Re-run this periodically if run by GLib.timeout_add

723

return True

724

self.checker_callback_tag = (gobject.child_watch_add

725

(self.checker.pid,

726

self.checker_callback,

727

data=command))

728

# The checker may have completed before the gobject

729

# watch was added. Check for this.

730

try:

731

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

732

except OSError as error:

733

if error.errno == errno.ECHILD:

734

# This should never happen

735

logger.error("Child process vanished",

736

exc_info=error)

737

return True

738

raise

739

if pid:

740

gobject.source_remove(self.checker_callback_tag)

741

self.checker_callback(pid, status, command)

742

# Re-run this periodically if run by gobject.timeout_add

1098

743

return True

1099

744

1100

745

def stop_checker(self):

1101

746

"""Force the checker process, if any, to stop."""

1102

747

if self.checker_callback_tag:

1103

GLib.source_remove(self.checker_callback_tag)

748

gobject.source_remove(self.checker_callback_tag)

1104

749

self.checker_callback_tag = None

1105

750

if getattr(self, "checker", None) is None:

1106

751

return

1107

752

logger.debug("Stopping checker for %(name)s", vars(self))

1108

self.checker.terminate()

753

try:

754

self.checker.terminate()

755

#time.sleep(0.5)

756

#if self.checker.poll() is None:

757

# self.checker.kill()

758

except OSError as error:

759

if error.errno != errno.ESRCH: # No such process

760

raise

1109

761

self.checker = None

1110

762

1111

763

1112

def dbus_service_property(dbus_interface,

1113

signature="v",

1114

access="readwrite",

1115

byte_arrays=False):

764

def dbus_service_property(dbus_interface, signature="v",

765

access="readwrite", byte_arrays=False):

1116

766

"""Decorators for marking methods of a DBusObjectWithProperties to

1117

767

become properties on the D-Bus.

1118

768

1119

769

The decorated method will be called with no arguments by "Get"

1120

770

and with one argument by "Set".

1121

771

1122

772

The parameters, where they are supported, are the same as

1123

773

dbus.service.method, except there is only "signature", since the

1124

774

type from Get() and the type sent to Set() is the same.

1128

778

if byte_arrays and signature != "ay":

1129

779

raise ValueError("Byte arrays not supported for non-'ay'"

1130

780

" signature {!r}".format(signature))

1131

1132

781

def decorator(func):

1133

782

func._dbus_is_property = True

1134

783

func._dbus_interface = dbus_interface

1137

786

func._dbus_name = func.__name__

1138

787

if func._dbus_name.endswith("_dbus_property"):

1139

788

func._dbus_name = func._dbus_name[:-14]

1140

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

789

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1141

790

return func

1142

1143

791

return decorator

1144

792

1145

793

1146

794

def dbus_interface_annotations(dbus_interface):

1147

795

"""Decorator for marking functions returning interface annotations

1148

796

1149

797

Usage:

1150

798

1151

799

@dbus_interface_annotations("org.example.Interface")

1152

800

def _foo(self): # Function name does not matter

1153

801

return {"org.freedesktop.DBus.Deprecated": "true",

1154

802

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1155

803

"false"}

1156

804

"""

1157

1158

805

def decorator(func):

1159

806

func._dbus_is_interface = True

1160

807

func._dbus_interface = dbus_interface

1161

808

func._dbus_name = dbus_interface

1162

809

return func

1163

1164

810

return decorator

1165

811

1166

812

1167

813

def dbus_annotations(annotations):

1168

814

"""Decorator to annotate D-Bus methods, signals or properties

1169

815

Usage:

1170

1171

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1172

"org.freedesktop.DBus.Property."

1173

"EmitsChangedSignal": "false"})

816

1174

817

@dbus_service_property("org.example.Interface", signature="b",

1175

818

access="r")

819

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

820

"org.freedesktop.DBus.Property."

821

"EmitsChangedSignal": "false"})

1176

822

def Property_dbus_property(self):

1177

823

return dbus.Boolean(False)

1178

1179

See also the DBusObjectWithAnnotations class.

1180

824

"""

1181

1182

825

def decorator(func):

1183

826

func._dbus_annotations = annotations

1184

827

return func

1185

1186

828

return decorator

1187

829

1188

830

1189

831

class DBusPropertyException(dbus.exceptions.DBusException):

1190

832

"""A base class for D-Bus property-related exceptions

1191

833

"""

1192

pass

834

def __unicode__(self):

835

return unicode(str(self))

1193

836

1194

837

1195

838

class DBusPropertyAccessException(DBusPropertyException):

1204

847

pass

1205

848

1206

849

1207

class DBusObjectWithAnnotations(dbus.service.Object):

1208

"""A D-Bus object with annotations.

1209

1210

Classes inheriting from this can use the dbus_annotations

1211

decorator to add annotations to methods or signals.

850

class DBusObjectWithProperties(dbus.service.Object):

851

"""A D-Bus object with properties.

852

853

Classes inheriting from this can use the dbus_service_property

854

decorator to expose methods as D-Bus properties. It exposes the

855

standard Get(), Set(), and GetAll() methods on the D-Bus.

1212

856

"""

1213

857

1214

858

@staticmethod

1215

859

def _is_dbus_thing(thing):

1216

860

"""Returns a function testing if an attribute is a D-Bus thing

1217

861

1218

862

If called like _is_dbus_thing("method") it returns a function

1219

863

suitable for use as predicate to inspect.getmembers().

1220

864

"""

1221

865

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1222

866

False)

1223

867

1224

868

def _get_all_dbus_things(self, thing):

1225

869

"""Returns a generator of (name, attribute) pairs

1226

870

"""

1227

return ((getattr(athing.__get__(self), "_dbus_name", name),

871

return ((getattr(athing.__get__(self), "_dbus_name",

872

name),

1228

873

athing.__get__(self))

1229

874

for cls in self.__class__.__mro__

1230

875

for name, athing in

1231

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1232

1233

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1234

out_signature="s",

1235

path_keyword='object_path',

1236

connection_keyword='connection')

1237

def Introspect(self, object_path, connection):

1238

"""Overloading of standard D-Bus method.

1239

1240

Inserts annotation tags on methods and signals.

1241

"""

1242

xmlstring = dbus.service.Object.Introspect(self, object_path,

1243

connection)

1244

try:

1245

document = xml.dom.minidom.parseString(xmlstring)

1246

1247

for if_tag in document.getElementsByTagName("interface"):

1248

# Add annotation tags

1249

for typ in ("method", "signal"):

1250

for tag in if_tag.getElementsByTagName(typ):

1251

annots = dict()

1252

for name, prop in (self.

1253

_get_all_dbus_things(typ)):

1254

if (name == tag.getAttribute("name")

1255

and prop._dbus_interface

1256

== if_tag.getAttribute("name")):

1257

annots.update(getattr(

1258

prop, "_dbus_annotations", {}))

1259

for name, value in annots.items():

1260

ann_tag = document.createElement(

1261

"annotation")

1262

ann_tag.setAttribute("name", name)

1263

ann_tag.setAttribute("value", value)

1264

tag.appendChild(ann_tag)

1265

# Add interface annotation tags

1266

for annotation, value in dict(

1267

itertools.chain.from_iterable(

1268

annotations().items()

1269

for name, annotations

1270

in self._get_all_dbus_things("interface")

1271

if name == if_tag.getAttribute("name")

1272

)).items():

1273

ann_tag = document.createElement("annotation")

1274

ann_tag.setAttribute("name", annotation)

1275

ann_tag.setAttribute("value", value)

1276

if_tag.appendChild(ann_tag)

1277

# Fix argument name for the Introspect method itself

1278

if (if_tag.getAttribute("name")

1279

== dbus.INTROSPECTABLE_IFACE):

1280

for cn in if_tag.getElementsByTagName("method"):

1281

if cn.getAttribute("name") == "Introspect":

1282

for arg in cn.getElementsByTagName("arg"):

1283

if (arg.getAttribute("direction")

1284

== "out"):

1285

arg.setAttribute("name",

1286

"xml_data")

1287

xmlstring = document.toxml("utf-8")

1288

document.unlink()

1289

except (AttributeError, xml.dom.DOMException,

1290

xml.parsers.expat.ExpatError) as error:

1291

logger.error("Failed to override Introspection method",

1292

exc_info=error)

1293

return xmlstring

1294

1295

1296

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1297

"""A D-Bus object with properties.

1298

1299

Classes inheriting from this can use the dbus_service_property

1300

decorator to expose methods as D-Bus properties. It exposes the

1301

standard Get(), Set(), and GetAll() methods on the D-Bus.

1302

"""

1303

876

inspect.getmembers(cls,

877

self._is_dbus_thing(thing)))

878

1304

879

def _get_dbus_property(self, interface_name, property_name):

1305

880

"""Returns a bound method if one exists which is a D-Bus

1306

881

property with the specified name and interface.

1307

882

"""

1308

for cls in self.__class__.__mro__:

1309

for name, value in inspect.getmembers(

1310

cls, self._is_dbus_thing("property")):

883

for cls in self.__class__.__mro__:

884

for name, value in (inspect.getmembers

885

(cls,

886

self._is_dbus_thing("property"))):

1311

887

if (value._dbus_name == property_name

1312

888

and value._dbus_interface == interface_name):

1313

889

return value.__get__(self)

1314

890

1315

891

# No such property

1316

raise DBusPropertyNotFound("{}:{}.{}".format(

1317

self.dbus_object_path, interface_name, property_name))

1318

1319

@classmethod

1320

def _get_all_interface_names(cls):

1321

"""Get a sequence of all interfaces supported by an object"""

1322

return (name for name in set(getattr(getattr(x, attr),

1323

"_dbus_interface", None)

1324

for x in (inspect.getmro(cls))

1325

for attr in dir(x))

1326

if name is not None)

1327

1328

@dbus.service.method(dbus.PROPERTIES_IFACE,

1329

in_signature="ss",

892

raise DBusPropertyNotFound(self.dbus_object_path + ":"

893

+ interface_name + "."

894

+ property_name)

895

896

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1330

897

out_signature="v")

1331

898

def Get(self, interface_name, property_name):

1332

899

"""Standard D-Bus property Get() method, see D-Bus standard.

1338

905

if not hasattr(value, "variant_level"):

1339

906

return value

1340

907

return type(value)(value, variant_level=value.variant_level+1)

1341

908

1342

909

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1343

910

def Set(self, interface_name, property_name, value):

1344

911

"""Standard D-Bus property Set() method, see D-Bus standard.

1356

923

value = dbus.ByteArray(b''.join(chr(byte)

1357

924

for byte in value))

1358

925

prop(value)

1359

1360

@dbus.service.method(dbus.PROPERTIES_IFACE,

1361

in_signature="s",

926

927

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1362

928

out_signature="a{sv}")

1363

929

def GetAll(self, interface_name):

1364

930

"""Standard D-Bus property GetAll() method, see D-Bus

1365

931

standard.

1366

932

1367

933

Note: Will not include properties with access="write".

1368

934

"""

1369

935

properties = {}

1379

945

if not hasattr(value, "variant_level"):

1380

946

properties[name] = value

1381

947

continue

1382

properties[name] = type(value)(

1383

value, variant_level=value.variant_level + 1)

948

properties[name] = type(value)(value, variant_level=

949

value.variant_level+1)

1384

950

return dbus.Dictionary(properties, signature="sv")

1385

1386

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1387

def PropertiesChanged(self, interface_name, changed_properties,

1388

invalidated_properties):

1389

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1390

standard.

1391

"""

1392

pass

1393

951

1394

952

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1395

953

out_signature="s",

1396

954

path_keyword='object_path',

1397

955

connection_keyword='connection')

1398

956

def Introspect(self, object_path, connection):

1399

957

"""Overloading of standard D-Bus method.

1400

958

1401

959

Inserts property tags and interface annotation tags.

1402

960

"""

1403

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1404

object_path,

1405

connection)

961

xmlstring = dbus.service.Object.Introspect(self, object_path,

962

connection)

1406

963

try:

1407

964

document = xml.dom.minidom.parseString(xmlstring)

1408

1409

965

def make_tag(document, name, prop):

1410

966

e = document.createElement("property")

1411

967

e.setAttribute("name", name)

1412

968

e.setAttribute("type", prop._dbus_signature)

1413

969

e.setAttribute("access", prop._dbus_access)

1414

970

return e

1415

1416

971

for if_tag in document.getElementsByTagName("interface"):

1417

972

# Add property tags

1418

973

for tag in (make_tag(document, name, prop)

1421

976

if prop._dbus_interface

1422

977

== if_tag.getAttribute("name")):

1423

978

if_tag.appendChild(tag)

1424

# Add annotation tags for properties

1425

for tag in if_tag.getElementsByTagName("property"):

1426

annots = dict()

1427

for name, prop in self._get_all_dbus_things(

1428

"property"):

1429

if (name == tag.getAttribute("name")

1430

and prop._dbus_interface

1431

== if_tag.getAttribute("name")):

1432

annots.update(getattr(

1433

prop, "_dbus_annotations", {}))

1434

for name, value in annots.items():

1435

ann_tag = document.createElement(

1436

"annotation")

1437

ann_tag.setAttribute("name", name)

1438

ann_tag.setAttribute("value", value)

1439

tag.appendChild(ann_tag)

979

# Add annotation tags

980

for typ in ("method", "signal", "property"):

981

for tag in if_tag.getElementsByTagName(typ):

982

annots = dict()

983

for name, prop in (self.

984

_get_all_dbus_things(typ)):

985

if (name == tag.getAttribute("name")

986

and prop._dbus_interface

987

== if_tag.getAttribute("name")):

988

annots.update(getattr

989

(prop,

990

"_dbus_annotations",

991

{}))

992

for name, value in annots.items():

993

ann_tag = document.createElement(

994

"annotation")

995

ann_tag.setAttribute("name", name)

996

ann_tag.setAttribute("value", value)

997

tag.appendChild(ann_tag)

998

# Add interface annotation tags

999

for annotation, value in dict(

1000

itertools.chain.from_iterable(

1001

annotations().items()

1002

for name, annotations in

1003

self._get_all_dbus_things("interface")

1004

if name == if_tag.getAttribute("name")

1005

)).items():

1006

ann_tag = document.createElement("annotation")

1007

ann_tag.setAttribute("name", annotation)

1008

ann_tag.setAttribute("value", value)

1009

if_tag.appendChild(ann_tag)

1440

1010

# Add the names to the return values for the

1441

1011

# "org.freedesktop.DBus.Properties" methods

1442

1012

if (if_tag.getAttribute("name")

1460

1030

exc_info=error)

1461

1031

return xmlstring

1462

1032

1463

try:

1464

dbus.OBJECT_MANAGER_IFACE

1465

except AttributeError:

1466

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1467

1468

1469

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1470

"""A D-Bus object with an ObjectManager.

1471

1472

Classes inheriting from this exposes the standard

1473

GetManagedObjects call and the InterfacesAdded and

1474

InterfacesRemoved signals on the standard

1475

"org.freedesktop.DBus.ObjectManager" interface.

1476

1477

Note: No signals are sent automatically; they must be sent

1478

manually.

1479

"""

1480

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1481

out_signature="a{oa{sa{sv}}}")

1482

def GetManagedObjects(self):

1483

"""This function must be overridden"""

1484

raise NotImplementedError()

1485

1486

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1487

signature="oa{sa{sv}}")

1488

def InterfacesAdded(self, object_path, interfaces_and_properties):

1489

pass

1490

1491

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1492

def InterfacesRemoved(self, object_path, interfaces):

1493

pass

1494

1495

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1496

out_signature="s",

1497

path_keyword='object_path',

1498

connection_keyword='connection')

1499

def Introspect(self, object_path, connection):

1500

"""Overloading of standard D-Bus method.

1501

1502

Override return argument name of GetManagedObjects to be

1503

"objpath_interfaces_and_properties"

1504

"""

1505

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1506

object_path,

1507

connection)

1508

try:

1509

document = xml.dom.minidom.parseString(xmlstring)

1510

1511

for if_tag in document.getElementsByTagName("interface"):

1512

# Fix argument name for the GetManagedObjects method

1513

if (if_tag.getAttribute("name")

1514

== dbus.OBJECT_MANAGER_IFACE):

1515

for cn in if_tag.getElementsByTagName("method"):

1516

if (cn.getAttribute("name")

1517

== "GetManagedObjects"):

1518

for arg in cn.getElementsByTagName("arg"):

1519

if (arg.getAttribute("direction")

1520

== "out"):

1521

arg.setAttribute(

1522

"name",

1523

"objpath_interfaces"

1524

"_and_properties")

1525

xmlstring = document.toxml("utf-8")

1526

document.unlink()

1527

except (AttributeError, xml.dom.DOMException,

1528

xml.parsers.expat.ExpatError) as error:

1529

logger.error("Failed to override Introspection method",

1530

exc_info=error)

1531

return xmlstring

1532

1533

1033

1534

1034

def datetime_to_dbus(dt, variant_level=0):

1535

1035

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1536

1036

if dt is None:

1537

return dbus.String("", variant_level=variant_level)

1538

return dbus.String(dt.isoformat(), variant_level=variant_level)

1037

return dbus.String("", variant_level = variant_level)

1038

return dbus.String(dt.isoformat(),

1039

variant_level=variant_level)

1539

1040

1540

1041

1541

1042

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1543

1044

dbus.service.Object, it will add alternate D-Bus attributes with

1544

1045

interface names according to the "alt_interface_names" mapping.

1545

1046

Usage:

1546

1047

1547

1048

@alternate_dbus_interfaces({"org.example.Interface":

1548

1049

"net.example.AlternateInterface"})

1549

1050

class SampleDBusObject(dbus.service.Object):

1550

1051

@dbus.service.method("org.example.Interface")

1551

1052

def SampleDBusMethod():

1552

1053

pass

1553

1054

1554

1055

The above "SampleDBusMethod" on "SampleDBusObject" will be

1555

1056

reachable via two interfaces: "org.example.Interface" and

1556

1057

"net.example.AlternateInterface", the latter of which will have

1557

1058

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1558

1059

"true", unless "deprecate" is passed with a False value.

1559

1060

1560

1061

This works for methods and signals, and also for D-Bus properties

1561

1062

(from DBusObjectWithProperties) and interfaces (from the

1562

1063

dbus_interface_annotations decorator).

1563

1064

"""

1564

1565

1065

def wrapper(cls):

1566

1066

for orig_interface_name, alt_interface_name in (

1567

alt_interface_names.items()):

1067

alt_interface_names.items()):

1568

1068

attr = {}

1569

1069

interface_names = set()

1570

1070

# Go though all attributes of the class

1572

1072

# Ignore non-D-Bus attributes, and D-Bus attributes

1573

1073

# with the wrong interface name

1574

1074

if (not hasattr(attribute, "_dbus_interface")

1575

or not attribute._dbus_interface.startswith(

1576

orig_interface_name)):

1075

or not attribute._dbus_interface

1076

.startswith(orig_interface_name)):

1577

1077

continue

1578

1078

# Create an alternate D-Bus interface name based on

1579

1079

# the current name

1580

alt_interface = attribute._dbus_interface.replace(

1581

orig_interface_name, alt_interface_name)

1080

alt_interface = (attribute._dbus_interface

1081

.replace(orig_interface_name,

1082

alt_interface_name))

1582

1083

interface_names.add(alt_interface)

1583

1084

# Is this a D-Bus signal?

1584

1085

if getattr(attribute, "_dbus_is_signal", False):

1585

1086

# Extract the original non-method undecorated

1586

1087

# function by black magic

1587

if sys.version_info.major == 2:

1588

nonmethod_func = (dict(

1088

nonmethod_func = (dict(

1589

1089

zip(attribute.func_code.co_freevars,

1590

attribute.__closure__))

1591

["func"].cell_contents)

1592

else:

1593

nonmethod_func = (dict(

1594

zip(attribute.__code__.co_freevars,

1595

attribute.__closure__))

1596

["func"].cell_contents)

1090

attribute.__closure__))["func"]

1091

.cell_contents)

1597

1092

# Create a new, but exactly alike, function

1598

1093

# object, and decorate it to be a new D-Bus signal

1599

1094

# with the alternate D-Bus interface name

1600

new_function = copy_function(nonmethod_func)

1601

new_function = (dbus.service.signal(

1602

alt_interface,

1603

attribute._dbus_signature)(new_function))

1095

new_function = (dbus.service.signal

1096

(alt_interface,

1097

attribute._dbus_signature)

1098

(types.FunctionType(

1099

nonmethod_func.func_code,

1100

nonmethod_func.func_globals,

1101

nonmethod_func.func_name,

1102

nonmethod_func.func_defaults,

1103

nonmethod_func.func_closure)))

1604

1104

# Copy annotations, if any

1605

1105

try:

1606

new_function._dbus_annotations = dict(

1607

attribute._dbus_annotations)

1106

new_function._dbus_annotations = (

1107

dict(attribute._dbus_annotations))

1608

1108

except AttributeError:

1609

1109

pass

1610

1611

1110

# Define a creator of a function to call both the

1612

1111

# original and alternate functions, so both the

1613

1112

# original and alternate signals gets sent when

1616

1115

"""This function is a scope container to pass

1617

1116

func1 and func2 to the "call_both" function

1618

1117

outside of its arguments"""

1619

1620

@functools.wraps(func2)

1621

1118

def call_both(*args, **kwargs):

1622

1119

"""This function will emit two D-Bus

1623

1120

signals by calling func1 and func2"""

1624

1121

func1(*args, **kwargs)

1625

1122

func2(*args, **kwargs)

1626

# Make wrapper function look like a D-Bus

1627

# signal

1628

for name, attr in inspect.getmembers(func2):

1629

if name.startswith("_dbus_"):

1630

setattr(call_both, name, attr)

1631

1632

1123

return call_both

1633

1124

# Create the "call_both" function and add it to

1634

1125

# the class

1639

1130

# object. Decorate it to be a new D-Bus method

1640

1131

# with the alternate D-Bus interface name. Add it

1641

1132

# to the class.

1642

attr[attrname] = (

1643

dbus.service.method(

1644

alt_interface,

1645

attribute._dbus_in_signature,

1646

attribute._dbus_out_signature)

1647

(copy_function(attribute)))

1133

attr[attrname] = (dbus.service.method

1134

(alt_interface,

1135

attribute._dbus_in_signature,

1136

attribute._dbus_out_signature)

1137

(types.FunctionType

1138

(attribute.func_code,

1139

attribute.func_globals,

1140

attribute.func_name,

1141

attribute.func_defaults,

1142

attribute.func_closure)))

1648

1143

# Copy annotations, if any

1649

1144

try:

1650

attr[attrname]._dbus_annotations = dict(

1651

attribute._dbus_annotations)

1145

attr[attrname]._dbus_annotations = (

1146

dict(attribute._dbus_annotations))

1652

1147

except AttributeError:

1653

1148

pass

1654

1149

# Is this a D-Bus property?

1657

1152

# object, and decorate it to be a new D-Bus

1658

1153

# property with the alternate D-Bus interface

1659

1154

# name. Add it to the class.

1660

attr[attrname] = (dbus_service_property(

1661

alt_interface, attribute._dbus_signature,

1662

attribute._dbus_access,

1663

attribute._dbus_get_args_options

1664

["byte_arrays"])

1665

(copy_function(attribute)))

1155

attr[attrname] = (dbus_service_property

1156

(alt_interface,

1157

attribute._dbus_signature,

1158

attribute._dbus_access,

1159

attribute

1160

._dbus_get_args_options

1161

["byte_arrays"])

1162

(types.FunctionType

1163

(attribute.func_code,

1164

attribute.func_globals,

1165

attribute.func_name,

1166

attribute.func_defaults,

1167

attribute.func_closure)))

1666

1168

# Copy annotations, if any

1667

1169

try:

1668

attr[attrname]._dbus_annotations = dict(

1669

attribute._dbus_annotations)

1170

attr[attrname]._dbus_annotations = (

1171

dict(attribute._dbus_annotations))

1670

1172

except AttributeError:

1671

1173

pass

1672

1174

# Is this a D-Bus interface?

1675

1177

# object. Decorate it to be a new D-Bus interface

1676

1178

# with the alternate D-Bus interface name. Add it

1677

1179

# to the class.

1678

attr[attrname] = (

1679

dbus_interface_annotations(alt_interface)

1680

(copy_function(attribute)))

1180

attr[attrname] = (dbus_interface_annotations

1181

(alt_interface)

1182

(types.FunctionType

1183

(attribute.func_code,

1184

attribute.func_globals,

1185

attribute.func_name,

1186

attribute.func_defaults,

1187

attribute.func_closure)))

1681

1188

if deprecate:

1682

1189

# Deprecate all alternate interfaces

1683

iname = "_AlternateDBusNames_interface_annotation{}"

1190

iname="_AlternateDBusNames_interface_annotation{}"

1684

1191

for interface_name in interface_names:

1685

1686

1192

@dbus_interface_annotations(interface_name)

1687

1193

def func(self):

1688

return {"org.freedesktop.DBus.Deprecated":

1689

"true"}

1194

return { "org.freedesktop.DBus.Deprecated":

1195

"true" }

1690

1196

# Find an unused name

1691

1197

for aname in (iname.format(i)

1692

1198

for i in itertools.count()):

1696

1202

if interface_names:

1697

1203

# Replace the class with a new subclass of it with

1698

1204

# methods, signals, etc. as created above.

1699

if sys.version_info.major == 2:

1700

cls = type(b"{}Alternate".format(cls.__name__),

1701

(cls, ), attr)

1702

else:

1703

cls = type("{}Alternate".format(cls.__name__),

1704

(cls, ), attr)

1205

cls = type(b"{}Alternate".format(cls.__name__),

1206

(cls,), attr)

1705

1207

return cls

1706

1707

1208

return wrapper

1708

1209

1709

1210

1710

1211

@alternate_dbus_interfaces({"se.recompile.Mandos":

1711

"se.bsnet.fukt.Mandos"})

1212

"se.bsnet.fukt.Mandos"})

1712

1213

class ClientDBus(Client, DBusObjectWithProperties):

1713

1214

"""A Client class using D-Bus

1714

1215

1715

1216

Attributes:

1716

1217

dbus_object_path: dbus.ObjectPath

1717

1218

bus: dbus.SystemBus()

1718

1219

"""

1719

1220

1720

1221

runtime_expansions = (Client.runtime_expansions

1721

+ ("dbus_object_path", ))

1722

1723

_interface = "se.recompile.Mandos.Client"

1724

1222

+ ("dbus_object_path",))

1223

1725

1224

# dbus.service.Object doesn't use super(), so we can't either.

1726

1727

def __init__(self, bus=None, *args, **kwargs):

1225

1226

def __init__(self, bus = None, *args, **kwargs):

1728

1227

self.bus = bus

1729

1228

Client.__init__(self, *args, **kwargs)

1730

1229

# Only now, when this client is initialized, can it show up on

1731

1230

# the D-Bus

1732

client_object_name = str(self.name).translate(

1231

client_object_name = unicode(self.name).translate(

1733

1232

{ord("."): ord("_"),

1734

1233

ord("-"): ord("_")})

1735

self.dbus_object_path = dbus.ObjectPath(

1736

"/clients/" + client_object_name)

1234

self.dbus_object_path = (dbus.ObjectPath

1235

("/clients/" + client_object_name))

1737

1236

DBusObjectWithProperties.__init__(self, self.bus,

1738

1237

self.dbus_object_path)

1739

1740

def notifychangeproperty(transform_func, dbus_name,

1741

type_func=lambda x: x,

1742

variant_level=1,

1743

invalidate_only=False,

1744

_interface=_interface):

1238

1239

def notifychangeproperty(transform_func,

1240

dbus_name, type_func=lambda x: x,

1241

variant_level=1):

1745

1242

""" Modify a variable so that it's a property which announces

1746

1243

its changes to DBus.

1747

1244

1748

1245

transform_fun: Function that takes a value and a variant_level

1749

1246

and transforms it to a D-Bus type.

1750

1247

dbus_name: D-Bus name of the variable

1753

1250

variant_level: D-Bus variant level. Default: 1

1754

1251

"""

1755

1252

attrname = "_{}".format(dbus_name)

1756

1757

1253

def setter(self, value):

1758

1254

if hasattr(self, "dbus_object_path"):

1759

1255

if (not hasattr(self, attrname) or

1760

1256

type_func(getattr(self, attrname, None))

1761

1257

!= type_func(value)):

1762

if invalidate_only:

1763

self.PropertiesChanged(

1764

_interface, dbus.Dictionary(),

1765

dbus.Array((dbus_name, )))

1766

else:

1767

dbus_value = transform_func(

1768

type_func(value),

1769

variant_level=variant_level)

1770

self.PropertyChanged(dbus.String(dbus_name),

1771

dbus_value)

1772

self.PropertiesChanged(

1773

_interface,

1774

dbus.Dictionary({dbus.String(dbus_name):

1775

dbus_value}),

1776

dbus.Array())

1258

dbus_value = transform_func(type_func(value),

1259

variant_level

1260

=variant_level)

1261

self.PropertyChanged(dbus.String(dbus_name),

1262

dbus_value)

1777

1263

setattr(self, attrname, value)

1778

1264

1779

1265

return property(lambda self: getattr(self, attrname), setter)

1780

1266

1781

1267

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1782

1268

approvals_pending = notifychangeproperty(dbus.Boolean,

1783

1269

"ApprovalPending",

1784

type_func=bool)

1270

type_func = bool)

1785

1271

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1786

1272

last_enabled = notifychangeproperty(datetime_to_dbus,

1787

1273

"LastEnabled")

1788

checker = notifychangeproperty(

1789

dbus.Boolean, "CheckerRunning",

1790

type_func=lambda checker: checker is not None)

1274

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1275

type_func = lambda checker:

1276

checker is not None)

1791

1277

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1792

1278

"LastCheckedOK")

1793

1279

last_checker_status = notifychangeproperty(dbus.Int16,

1796

1282

datetime_to_dbus, "LastApprovalRequest")

1797

1283

approved_by_default = notifychangeproperty(dbus.Boolean,

1798

1284

"ApprovedByDefault")

1799

approval_delay = notifychangeproperty(

1800

dbus.UInt64, "ApprovalDelay",

1801

type_func=lambda td: td.total_seconds() * 1000)

1285

approval_delay = notifychangeproperty(dbus.UInt64,

1286

"ApprovalDelay",

1287

type_func =

1288

lambda td: td.total_seconds()

1289

* 1000)

1802

1290

approval_duration = notifychangeproperty(

1803

1291

dbus.UInt64, "ApprovalDuration",

1804

type_func=lambda td: td.total_seconds() * 1000)

1292

type_func = lambda td: td.total_seconds() * 1000)

1805

1293

host = notifychangeproperty(dbus.String, "Host")

1806

timeout = notifychangeproperty(

1807

dbus.UInt64, "Timeout",

1808

type_func=lambda td: td.total_seconds() * 1000)

1294

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1295

type_func = lambda td:

1296

td.total_seconds() * 1000)

1809

1297

extended_timeout = notifychangeproperty(

1810

1298

dbus.UInt64, "ExtendedTimeout",

1811

type_func=lambda td: td.total_seconds() * 1000)

1812

interval = notifychangeproperty(

1813

dbus.UInt64, "Interval",

1814

type_func=lambda td: td.total_seconds() * 1000)

1299

type_func = lambda td: td.total_seconds() * 1000)

1300

interval = notifychangeproperty(dbus.UInt64,

1301

"Interval",

1302

type_func =

1303

lambda td: td.total_seconds()

1304

* 1000)

1815

1305

checker_command = notifychangeproperty(dbus.String, "Checker")

1816

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1817

invalidate_only=True)

1818

1306

1819

1307

del notifychangeproperty

1820

1308

1821

1309

def __del__(self, *args, **kwargs):

1822

1310

try:

1823

1311

self.remove_from_connection()

1826

1314

if hasattr(DBusObjectWithProperties, "__del__"):

1827

1315

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1828

1316

Client.__del__(self, *args, **kwargs)

1829

1830

def checker_callback(self, source, condition,

1831

connection, command, *args, **kwargs):

1832

ret = Client.checker_callback(self, source, condition,

1833

connection, command, *args,

1834

**kwargs)

1835

exitstatus = self.last_checker_status

1836

if exitstatus >= 0:

1317

1318

def checker_callback(self, pid, condition, command,

1319

*args, **kwargs):

1320

self.checker_callback_tag = None

1321

self.checker = None

1322

if os.WIFEXITED(condition):

1323

exitstatus = os.WEXITSTATUS(condition)

1837

1324

# Emit D-Bus signal

1838

1325

self.CheckerCompleted(dbus.Int16(exitstatus),

1839

# This is specific to GNU libC

1840

dbus.Int64(exitstatus << 8),

1326

dbus.Int64(condition),

1841

1327

dbus.String(command))

1842

1328

else:

1843

1329

# Emit D-Bus signal

1844

1330

self.CheckerCompleted(dbus.Int16(-1),

1845

dbus.Int64(

1846

# This is specific to GNU libC

1847

(exitstatus << 8)

1848

| self.last_checker_signal),

1331

dbus.Int64(condition),

1849

1332

dbus.String(command))

1850

return ret

1851

1333

1334

return Client.checker_callback(self, pid, condition, command,

1335

*args, **kwargs)

1336

1852

1337

def start_checker(self, *args, **kwargs):

1853

1338

old_checker_pid = getattr(self.checker, "pid", None)

1854

1339

r = Client.start_checker(self, *args, **kwargs)

1858

1343

# Emit D-Bus signal

1859

1344

self.CheckerStarted(self.current_checker_command)

1860

1345

return r

1861

1346

1862

1347

def _reset_approved(self):

1863

1348

self.approved = None

1864

1349

return False

1865

1350

1866

1351

def approve(self, value=True):

1867

1352

self.approved = value

1868

GLib.timeout_add(int(self.approval_duration.total_seconds()

1869

* 1000), self._reset_approved)

1353

gobject.timeout_add(int(self.approval_duration.total_seconds()

1354

* 1000), self._reset_approved)

1870

1355

self.send_changedstate()

1871

1872

# D-Bus methods, signals & properties

1873

1874

# Interfaces

1875

1876

# Signals

1877

1356

1357

## D-Bus methods, signals & properties

1358

_interface = "se.recompile.Mandos.Client"

1359

1360

## Interfaces

1361

1362

@dbus_interface_annotations(_interface)

1363

def _foo(self):

1364

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1365

"false"}

1366

1367

## Signals

1368

1878

1369

# CheckerCompleted - signal

1879

1370

@dbus.service.signal(_interface, signature="nxs")

1880

1371

def CheckerCompleted(self, exitcode, waitstatus, command):

1881

1372

"D-Bus signal"

1882

1373

pass

1883

1374

1884

1375

# CheckerStarted - signal

1885

1376

@dbus.service.signal(_interface, signature="s")

1886

1377

def CheckerStarted(self, command):

1887

1378

"D-Bus signal"

1888

1379

pass

1889

1380

1890

1381

# PropertyChanged - signal

1891

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1892

1382

@dbus.service.signal(_interface, signature="sv")

1893

1383

def PropertyChanged(self, property, value):

1894

1384

"D-Bus signal"

1895

1385

pass

1896

1386

1897

1387

# GotSecret - signal

1898

1388

@dbus.service.signal(_interface)

1899

1389

def GotSecret(self):

1902

1392

server to mandos-client

1903

1393

"""

1904

1394

pass

1905

1395

1906

1396

# Rejected - signal

1907

1397

@dbus.service.signal(_interface, signature="s")

1908

1398

def Rejected(self, reason):

1909

1399

"D-Bus signal"

1910

1400

pass

1911

1401

1912

1402

# NeedApproval - signal

1913

1403

@dbus.service.signal(_interface, signature="tb")

1914

1404

def NeedApproval(self, timeout, default):

1915

1405

"D-Bus signal"

1916

1406

return self.need_approval()

1917

1918

# Methods

1919

1407

1408

## Methods

1409

1920

1410

# Approve - method

1921

1411

@dbus.service.method(_interface, in_signature="b")

1922

1412

def Approve(self, value):

1923

1413

self.approve(value)

1924

1414

1925

1415

# CheckedOK - method

1926

1416

@dbus.service.method(_interface)

1927

1417

def CheckedOK(self):

1928

1418

self.checked_ok()

1929

1419

1930

1420

# Enable - method

1931

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1932

1421

@dbus.service.method(_interface)

1933

1422

def Enable(self):

1934

1423

"D-Bus method"

1935

1424

self.enable()

1936

1425

1937

1426

# StartChecker - method

1938

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1939

1427

@dbus.service.method(_interface)

1940

1428

def StartChecker(self):

1941

1429

"D-Bus method"

1942

1430

self.start_checker()

1943

1431

1944

1432

# Disable - method

1945

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1946

1433

@dbus.service.method(_interface)

1947

1434

def Disable(self):

1948

1435

"D-Bus method"

1949

1436

self.disable()

1950

1437

1951

1438

# StopChecker - method

1952

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1953

1439

@dbus.service.method(_interface)

1954

1440

def StopChecker(self):

1955

1441

self.stop_checker()

1956

1957

# Properties

1958

1442

1443

## Properties

1444

1959

1445

# ApprovalPending - property

1960

1446

@dbus_service_property(_interface, signature="b", access="read")

1961

1447

def ApprovalPending_dbus_property(self):

1962

1448

return dbus.Boolean(bool(self.approvals_pending))

1963

1449

1964

1450

# ApprovedByDefault - property

1965

@dbus_service_property(_interface,

1966

signature="b",

1451

@dbus_service_property(_interface, signature="b",

1967

1452

access="readwrite")

1968

1453

def ApprovedByDefault_dbus_property(self, value=None):

1969

1454

if value is None: # get

1970

1455

return dbus.Boolean(self.approved_by_default)

1971

1456

self.approved_by_default = bool(value)

1972

1457

1973

1458

# ApprovalDelay - property

1974

@dbus_service_property(_interface,

1975

signature="t",

1459

@dbus_service_property(_interface, signature="t",

1976

1460

access="readwrite")

1977

1461

def ApprovalDelay_dbus_property(self, value=None):

1978

1462

if value is None: # get

1979

1463

return dbus.UInt64(self.approval_delay.total_seconds()

1980

1464

* 1000)

1981

1465

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1982

1466

1983

1467

# ApprovalDuration - property

1984

@dbus_service_property(_interface,

1985

signature="t",

1468

@dbus_service_property(_interface, signature="t",

1986

1469

access="readwrite")

1987

1470

def ApprovalDuration_dbus_property(self, value=None):

1988

1471

if value is None: # get

1989

1472

return dbus.UInt64(self.approval_duration.total_seconds()

1990

1473

* 1000)

1991

1474

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1992

1475

1993

1476

# Name - property

1994

@dbus_annotations(

1995

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1996

1477

@dbus_service_property(_interface, signature="s", access="read")

1997

1478

def Name_dbus_property(self):

1998

1479

return dbus.String(self.name)

1999

1480

2000

1481

# Fingerprint - property

2001

@dbus_annotations(

2002

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2003

1482

@dbus_service_property(_interface, signature="s", access="read")

2004

1483

def Fingerprint_dbus_property(self):

2005

1484

return dbus.String(self.fingerprint)

2006

1485

2007

1486

# Host - property

2008

@dbus_service_property(_interface,

2009

signature="s",

1487

@dbus_service_property(_interface, signature="s",

2010

1488

access="readwrite")

2011

1489

def Host_dbus_property(self, value=None):

2012

1490

if value is None: # get

2013

1491

return dbus.String(self.host)

2014

self.host = str(value)

2015

1492

self.host = unicode(value)

1493

2016

1494

# Created - property

2017

@dbus_annotations(

2018

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2019

1495

@dbus_service_property(_interface, signature="s", access="read")

2020

1496

def Created_dbus_property(self):

2021

1497

return datetime_to_dbus(self.created)

2022

1498

2023

1499

# LastEnabled - property

2024

1500

@dbus_service_property(_interface, signature="s", access="read")

2025

1501

def LastEnabled_dbus_property(self):

2026

1502

return datetime_to_dbus(self.last_enabled)

2027

1503

2028

1504

# Enabled - property

2029

@dbus_service_property(_interface,

2030

signature="b",

1505

@dbus_service_property(_interface, signature="b",

2031

1506

access="readwrite")

2032

1507

def Enabled_dbus_property(self, value=None):

2033

1508

if value is None: # get

2036

1511

self.enable()

2037

1512

else:

2038

1513

self.disable()

2039

1514

2040

1515

# LastCheckedOK - property

2041

@dbus_service_property(_interface,

2042

signature="s",

1516

@dbus_service_property(_interface, signature="s",

2043

1517

access="readwrite")

2044

1518

def LastCheckedOK_dbus_property(self, value=None):

2045

1519

if value is not None:

2046

1520

self.checked_ok()

2047

1521

return

2048

1522

return datetime_to_dbus(self.last_checked_ok)

2049

1523

2050

1524

# LastCheckerStatus - property

2051

@dbus_service_property(_interface, signature="n", access="read")

1525

@dbus_service_property(_interface, signature="n",

1526

access="read")

2052

1527

def LastCheckerStatus_dbus_property(self):

2053

1528

return dbus.Int16(self.last_checker_status)

2054

1529

2055

1530

# Expires - property

2056

1531

@dbus_service_property(_interface, signature="s", access="read")

2057

1532

def Expires_dbus_property(self):

2058

1533

return datetime_to_dbus(self.expires)

2059

1534

2060

1535

# LastApprovalRequest - property

2061

1536

@dbus_service_property(_interface, signature="s", access="read")

2062

1537

def LastApprovalRequest_dbus_property(self):

2063

1538

return datetime_to_dbus(self.last_approval_request)

2064

1539

2065

1540

# Timeout - property

2066

@dbus_service_property(_interface,

2067

signature="t",

1541

@dbus_service_property(_interface, signature="t",

2068

1542

access="readwrite")

2069

1543

def Timeout_dbus_property(self, value=None):

2070

1544

if value is None: # get

2082

1556

if (getattr(self, "disable_initiator_tag", None)

2083

1557

is None):

2084

1558

return

2085

GLib.source_remove(self.disable_initiator_tag)

2086

self.disable_initiator_tag = GLib.timeout_add(

2087

int((self.expires - now).total_seconds() * 1000),

2088

self.disable)

2089

1559

gobject.source_remove(self.disable_initiator_tag)

1560

self.disable_initiator_tag = (

1561

gobject.timeout_add(

1562

int((self.expires - now).total_seconds()

1563

* 1000), self.disable))

1564

2090

1565

# ExtendedTimeout - property

2091

@dbus_service_property(_interface,

2092

signature="t",

1566

@dbus_service_property(_interface, signature="t",

2093

1567

access="readwrite")

2094

1568

def ExtendedTimeout_dbus_property(self, value=None):

2095

1569

if value is None: # get

2096

1570

return dbus.UInt64(self.extended_timeout.total_seconds()

2097

1571

* 1000)

2098

1572

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2099

1573

2100

1574

# Interval - property

2101

@dbus_service_property(_interface,

2102

signature="t",

1575

@dbus_service_property(_interface, signature="t",

2103

1576

access="readwrite")

2104

1577

def Interval_dbus_property(self, value=None):

2105

1578

if value is None: # get

2109

1582

return

2110

1583

if self.enabled:

2111

1584

# Reschedule checker run

2112

GLib.source_remove(self.checker_initiator_tag)

2113

self.checker_initiator_tag = GLib.timeout_add(

2114

value, self.start_checker)

2115

self.start_checker() # Start one now, too

2116

1585

gobject.source_remove(self.checker_initiator_tag)

1586

self.checker_initiator_tag = (gobject.timeout_add

1587

(value, self.start_checker))

1588

self.start_checker() # Start one now, too

1589

2117

1590

# Checker - property

2118

@dbus_service_property(_interface,

2119

signature="s",

1591

@dbus_service_property(_interface, signature="s",

2120

1592

access="readwrite")

2121

1593

def Checker_dbus_property(self, value=None):

2122

1594

if value is None: # get

2123

1595

return dbus.String(self.checker_command)

2124

self.checker_command = str(value)

2125

1596

self.checker_command = unicode(value)

1597

2126

1598

# CheckerRunning - property

2127

@dbus_service_property(_interface,

2128

signature="b",

1599

@dbus_service_property(_interface, signature="b",

2129

1600

access="readwrite")

2130

1601

def CheckerRunning_dbus_property(self, value=None):

2131

1602

if value is None: # get

2134

1605

self.start_checker()

2135

1606

else:

2136

1607

self.stop_checker()

2137

1608

2138

1609

# ObjectPath - property

2139

@dbus_annotations(

2140

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2141

"org.freedesktop.DBus.Deprecated": "true"})

2142

1610

@dbus_service_property(_interface, signature="o", access="read")

2143

1611

def ObjectPath_dbus_property(self):

2144

return self.dbus_object_path # is already a dbus.ObjectPath

2145

1612

return self.dbus_object_path # is already a dbus.ObjectPath

1613

2146

1614

# Secret = property

2147

@dbus_annotations(

2148

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2149

"invalidates"})

2150

@dbus_service_property(_interface,

2151

signature="ay",

2152

access="write",

2153

byte_arrays=True)

1615

@dbus_service_property(_interface, signature="ay",

1616

access="write", byte_arrays=True)

2154

1617

def Secret_dbus_property(self, value):

2155

self.secret = bytes(value)

2156

1618

self.secret = str(value)

1619

2157

1620

del _interface

2158

1621

2159

1622

2162

1625

self._pipe = child_pipe

2163

1626

self._pipe.send(('init', fpr, address))

2164

1627

if not self._pipe.recv():

2165

raise KeyError(fpr)

2166

1628

raise KeyError()

1629

2167

1630

def __getattribute__(self, name):

2168

1631

if name == '_pipe':

2169

1632

return super(ProxyClient, self).__getattribute__(name)

2172

1635

if data[0] == 'data':

2173

1636

return data[1]

2174

1637

if data[0] == 'function':

2175

2176

1638

def func(*args, **kwargs):

2177

1639

self._pipe.send(('funcall', name, args, kwargs))

2178

1640

return self._pipe.recv()[1]

2179

2180

1641

return func

2181

1642

2182

1643

def __setattr__(self, name, value):

2183

1644

if name == '_pipe':

2184

1645

return super(ProxyClient, self).__setattr__(name, value)

2187

1648

2188

1649

class ClientHandler(socketserver.BaseRequestHandler, object):

2189

1650

"""A class to handle client connections.

2190

1651

2191

1652

Instantiated once for each connection to handle it.

2192

1653

Note: This will run in its own forked process."""

2193

1654

2194

1655

def handle(self):

2195

1656

with contextlib.closing(self.server.child_pipe) as child_pipe:

2196

1657

logger.info("TCP connection from: %s",

2197

str(self.client_address))

1658

unicode(self.client_address))

2198

1659

logger.debug("Pipe FD: %d",

2199

1660

self.server.child_pipe.fileno())

2200

2201

session = gnutls.ClientSession(self.request)

2202

2203

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2204

# "+AES-256-CBC", "+SHA1",

2205

# "+COMP-NULL", "+CTYPE-OPENPGP",

2206

# "+DHE-DSS"))

1661

1662

session = (gnutls.connection

1663

.ClientSession(self.request,

1664

gnutls.connection

1665

.X509Credentials()))

1666

1667

# Note: gnutls.connection.X509Credentials is really a

1668

# generic GnuTLS certificate credentials object so long as

1669

# no X.509 keys are added to it. Therefore, we can use it

1670

# here despite using OpenPGP certificates.

1671

1672

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1673

# "+AES-256-CBC", "+SHA1",

1674

# "+COMP-NULL", "+CTYPE-OPENPGP",

1675

# "+DHE-DSS"))

2207

1676

# Use a fallback default, since this MUST be set.

2208

1677

priority = self.server.gnutls_priority

2209

1678

if priority is None:

2210

1679

priority = "NORMAL"

2211

gnutls.priority_set_direct(session._c_object,

2212

priority.encode("utf-8"),

2213

None)

2214

1680

(gnutls.library.functions

1681

.gnutls_priority_set_direct(session._c_object,

1682

priority, None))

1683

2215

1684

# Start communication using the Mandos protocol

2216

1685

# Get protocol number

2217

1686

line = self.request.makefile().readline()

2222

1691

except (ValueError, IndexError, RuntimeError) as error:

2223

1692

logger.error("Unknown protocol version: %s", error)

2224

1693

return

2225

1694

2226

1695

# Start GnuTLS connection

2227

1696

try:

2228

1697

session.handshake()

2229

except gnutls.Error as error:

1698

except gnutls.errors.GNUTLSError as error:

2230

1699

logger.warning("Handshake failed: %s", error)

2231

1700

# Do not run session.bye() here: the session is not

2232

1701

# established. Just abandon the request.

2233

1702

return

2234

1703

logger.debug("Handshake succeeded")

2235

1704

2236

1705

approval_required = False

2237

1706

try:

2238

1707

try:

2239

fpr = self.fingerprint(

2240

self.peer_certificate(session))

2241

except (TypeError, gnutls.Error) as error:

1708

fpr = self.fingerprint(self.peer_certificate

1709

(session))

1710

except (TypeError,

1711

gnutls.errors.GNUTLSError) as error:

2242

1712

logger.warning("Bad certificate: %s", error)

2243

1713

return

2244

1714

logger.debug("Fingerprint: %s", fpr)

2245

1715

2246

1716

try:

2247

1717

client = ProxyClient(child_pipe, fpr,

2248

1718

self.client_address)

2249

1719

except KeyError:

2250

1720

return

2251

1721

2252

1722

if client.approval_delay:

2253

1723

delay = client.approval_delay

2254

1724

client.approvals_pending += 1

2255

1725

approval_required = True

2256

1726

2257

1727

while True:

2258

1728

if not client.enabled:

2259

1729

logger.info("Client %s is disabled",

2260

client.name)

1730

client.name)

2261

1731

if self.server.use_dbus:

2262

1732

# Emit D-Bus signal

2263

1733

client.Rejected("Disabled")

2264

1734

return

2265

1735

2266

1736

if client.approved or not client.approval_delay:

2267

# We are approved or approval is disabled

1737

#We are approved or approval is disabled

2268

1738

break

2269

1739

elif client.approved is None:

2270

1740

logger.info("Client %s needs approval",

2281

1751

# Emit D-Bus signal

2282

1752

client.Rejected("Denied")

2283

1753

return

2284

2285

# wait until timeout or approved

1754

1755

#wait until timeout or approved

2286

1756

time = datetime.datetime.now()

2287

1757

client.changedstate.acquire()

2288

1758

client.changedstate.wait(delay.total_seconds())

2301

1771

break

2302

1772

else:

2303

1773

delay -= time2 - time

2304

2305

try:

2306

session.send(client.secret)

2307

except gnutls.Error as error:

2308

logger.warning("gnutls send failed",

2309

exc_info=error)

2310

return

2311

1774

1775

sent_size = 0

1776

while sent_size < len(client.secret):

1777

try:

1778

sent = session.send(client.secret[sent_size:])

1779

except gnutls.errors.GNUTLSError as error:

1780

logger.warning("gnutls send failed",

1781

exc_info=error)

1782

return

1783

logger.debug("Sent: %d, remaining: %d",

1784

sent, len(client.secret)

1785

- (sent_size + sent))

1786

sent_size += sent

1787

2312

1788

logger.info("Sending secret to %s", client.name)

2313

1789

# bump the timeout using extended_timeout

2314

1790

client.bump_timeout(client.extended_timeout)

2315

1791

if self.server.use_dbus:

2316

1792

# Emit D-Bus signal

2317

1793

client.GotSecret()

2318

1794

2319

1795

finally:

2320

1796

if approval_required:

2321

1797

client.approvals_pending -= 1

2322

1798

try:

2323

1799

session.bye()

2324

except gnutls.Error as error:

1800

except gnutls.errors.GNUTLSError as error:

2325

1801

logger.warning("GnuTLS bye failed",

2326

1802

exc_info=error)

2327

1803

2328

1804

@staticmethod

2329

1805

def peer_certificate(session):

2330

1806

"Return the peer's OpenPGP certificate as a bytestring"

2331

1807

# If not an OpenPGP certificate...

2332

if (gnutls.certificate_type_get(session._c_object)

2333

!= gnutls.CRT_OPENPGP):

2334

# ...return invalid data

2335

return b""

1808

if (gnutls.library.functions

1809

.gnutls_certificate_type_get(session._c_object)

1810

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1811

# ...do the normal thing

1812

return session.peer_certificate

2336

1813

list_size = ctypes.c_uint(1)

2337

cert_list = (gnutls.certificate_get_peers

1814

cert_list = (gnutls.library.functions

1815

.gnutls_certificate_get_peers

2338

1816

(session._c_object, ctypes.byref(list_size)))

2339

1817

if not bool(cert_list) and list_size.value != 0:

2340

raise gnutls.Error("error getting peer certificate")

1818

raise gnutls.errors.GNUTLSError("error getting peer"

1819

" certificate")

2341

1820

if list_size.value == 0:

2342

1821

return None

2343

1822

cert = cert_list[0]

2344

1823

return ctypes.string_at(cert.data, cert.size)

2345

1824

2346

1825

@staticmethod

2347

1826

def fingerprint(openpgp):

2348

1827

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2349

1828

# New GnuTLS "datum" with the OpenPGP public key

2350

datum = gnutls.datum_t(

2351

ctypes.cast(ctypes.c_char_p(openpgp),

2352

ctypes.POINTER(ctypes.c_ubyte)),

2353

ctypes.c_uint(len(openpgp)))

1829

datum = (gnutls.library.types

1830

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1831

ctypes.POINTER

1832

(ctypes.c_ubyte)),

1833

ctypes.c_uint(len(openpgp))))

2354

1834

# New empty GnuTLS certificate

2355

crt = gnutls.openpgp_crt_t()

2356

gnutls.openpgp_crt_init(ctypes.byref(crt))

1835

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1836

(gnutls.library.functions

1837

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2357

1838

# Import the OpenPGP public key into the certificate

2358

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2359

gnutls.OPENPGP_FMT_RAW)

1839

(gnutls.library.functions

1840

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1841

gnutls.library.constants

1842

.GNUTLS_OPENPGP_FMT_RAW))

2360

1843

# Verify the self signature in the key

2361

1844

crtverify = ctypes.c_uint()

2362

gnutls.openpgp_crt_verify_self(crt, 0,

2363

ctypes.byref(crtverify))

1845

(gnutls.library.functions

1846

.gnutls_openpgp_crt_verify_self(crt, 0,

1847

ctypes.byref(crtverify)))

2364

1848

if crtverify.value != 0:

2365

gnutls.openpgp_crt_deinit(crt)

2366

raise gnutls.CertificateSecurityError("Verify failed")

1849

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1850

raise (gnutls.errors.CertificateSecurityError

1851

("Verify failed"))

2367

1852

# New buffer for the fingerprint

2368

1853

buf = ctypes.create_string_buffer(20)

2369

1854

buf_len = ctypes.c_size_t()

2370

1855

# Get the fingerprint from the certificate into the buffer

2371

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2372

ctypes.byref(buf_len))

1856

(gnutls.library.functions

1857

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1858

ctypes.byref(buf_len)))

2373

1859

# Deinit the certificate

2374

gnutls.openpgp_crt_deinit(crt)

1860

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2375

1861

# Convert the buffer to a Python bytestring

2376

1862

fpr = ctypes.string_at(buf, buf_len.value)

2377

1863

# Convert the bytestring to hexadecimal notation

2381

1867

2382

1868

class MultiprocessingMixIn(object):

2383

1869

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2384

2385

1870

def sub_process_main(self, request, address):

2386

1871

try:

2387

1872

self.finish_request(request, address)

2388

1873

except Exception:

2389

1874

self.handle_error(request, address)

2390

1875

self.close_request(request)

2391

1876

2392

1877

def process_request(self, request, address):

2393

1878

"""Start a new process to process the request."""

2394

proc = multiprocessing.Process(target=self.sub_process_main,

2395

args=(request, address))

1879

proc = multiprocessing.Process(target = self.sub_process_main,

1880

args = (request, address))

2396

1881

proc.start()

2397

1882

return proc

2398

1883

2399

1884

2400

1885

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2401

1886

""" adds a pipe to the MixIn """

2402

2403

1887

def process_request(self, request, client_address):

2404

1888

"""Overrides and wraps the original process_request().

2405

1889

2406

1890

This function creates a new pipe in self.pipe

2407

1891

"""

2408

1892

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2409

1893

2410

1894

proc = MultiprocessingMixIn.process_request(self, request,

2411

1895

client_address)

2412

1896

self.child_pipe.close()

2413

1897

self.add_pipe(parent_pipe, proc)

2414

1898

2415

1899

def add_pipe(self, parent_pipe, proc):

2416

1900

"""Dummy function; override as necessary"""

2417

1901

raise NotImplementedError()

2420

1904

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2421

1905

socketserver.TCPServer, object):

2422

1906

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2423

1907

2424

1908

Attributes:

2425

1909

enabled: Boolean; whether this server is activated yet

2426

1910

interface: None or a network interface name (string)

2427

1911

use_ipv6: Boolean; to use IPv6 or not

2428

1912

"""

2429

2430

1913

def __init__(self, server_address, RequestHandlerClass,

2431

interface=None,

2432

use_ipv6=True,

2433

socketfd=None):

1914

interface=None, use_ipv6=True, socketfd=None):

2434

1915

"""If socketfd is set, use that file descriptor instead of

2435

1916

creating a new one with socket.socket().

2436

1917

"""

2442

1923

self.socketfd = socketfd

2443

1924

# Save the original socket.socket() function

2444

1925

self.socket_socket = socket.socket

2445

2446

1926

# To implement --socket, we monkey patch socket.socket.

2447

#

1927

#

2448

1928

# (When socketserver.TCPServer is a new-style class, we

2449

1929

# could make self.socket into a property instead of monkey

2450

1930

# patching socket.socket.)

2451

#

1931

#

2452

1932

# Create a one-time-only replacement for socket.socket()

2453

1933

@functools.wraps(socket.socket)

2454

1934

def socket_wrapper(*args, **kwargs):

2466

1946

# socket_wrapper(), if socketfd was set.

2467

1947

socketserver.TCPServer.__init__(self, server_address,

2468

1948

RequestHandlerClass)

2469

1949

2470

1950

def server_bind(self):

2471

1951

"""This overrides the normal server_bind() function

2472

1952

to bind to an interface if one was specified, and also NOT to

2473

1953

bind to an address or port if they were not specified."""

2474

global SO_BINDTODEVICE

2475

1954

if self.interface is not None:

2476

1955

if SO_BINDTODEVICE is None:

2477

# Fall back to a hard-coded value which seems to be

2478

# common enough.

2479

logger.warning("SO_BINDTODEVICE not found, trying 25")

2480

SO_BINDTODEVICE = 25

2481

try:

2482

self.socket.setsockopt(

2483

socket.SOL_SOCKET, SO_BINDTODEVICE,

2484

(self.interface + "\0").encode("utf-8"))

2485

except socket.error as error:

2486

if error.errno == errno.EPERM:

2487

logger.error("No permission to bind to"

2488

" interface %s", self.interface)

2489

elif error.errno == errno.ENOPROTOOPT:

2490

logger.error("SO_BINDTODEVICE not available;"

2491

" cannot bind to interface %s",

2492

self.interface)

2493

elif error.errno == errno.ENODEV:

2494

logger.error("Interface %s does not exist,"

2495

" cannot bind", self.interface)

2496

else:

2497

raise

1956

logger.error("SO_BINDTODEVICE does not exist;"

1957

" cannot bind to interface %s",

1958

self.interface)

1959

else:

1960

try:

1961

self.socket.setsockopt(socket.SOL_SOCKET,

1962

SO_BINDTODEVICE,

1963

str(self.interface + '\0'))

1964

except socket.error as error:

1965

if error.errno == errno.EPERM:

1966

logger.error("No permission to bind to"

1967

" interface %s", self.interface)

1968

elif error.errno == errno.ENOPROTOOPT:

1969

logger.error("SO_BINDTODEVICE not available;"

1970

" cannot bind to interface %s",

1971

self.interface)

1972

elif error.errno == errno.ENODEV:

1973

logger.error("Interface %s does not exist,"

1974

" cannot bind", self.interface)

1975

else:

1976

raise

2498

1977

# Only bind(2) the socket if we really need to.

2499

1978

if self.server_address[0] or self.server_address[1]:

2500

1979

if not self.server_address[0]:

2501

1980

if self.address_family == socket.AF_INET6:

2502

any_address = "::" # in6addr_any

1981

any_address = "::" # in6addr_any

2503

1982

else:

2504

any_address = "0.0.0.0" # INADDR_ANY

1983

any_address = "0.0.0.0" # INADDR_ANY

2505

1984

self.server_address = (any_address,

2506

1985

self.server_address[1])

2507

1986

elif not self.server_address[1]:

2508

self.server_address = (self.server_address[0], 0)

1987

self.server_address = (self.server_address[0],

1988

0)

2509

1989

# if self.interface:

2510

1990

# self.server_address = (self.server_address[0],

2511

1991

# 0, # port

2517

1997

2518

1998

class MandosServer(IPv6_TCPServer):

2519

1999

"""Mandos server.

2520

2000

2521

2001

Attributes:

2522

2002

clients: set of Client objects

2523

2003

gnutls_priority GnuTLS priority string

2524

2004

use_dbus: Boolean; to emit D-Bus signals or not

2525

2526

Assumes a GLib.MainLoop event loop.

2005

2006

Assumes a gobject.MainLoop event loop.

2527

2007

"""

2528

2529

2008

def __init__(self, server_address, RequestHandlerClass,

2530

interface=None,

2531

use_ipv6=True,

2532

clients=None,

2533

gnutls_priority=None,

2534

use_dbus=True,

2535

socketfd=None):

2009

interface=None, use_ipv6=True, clients=None,

2010

gnutls_priority=None, use_dbus=True, socketfd=None):

2536

2011

self.enabled = False

2537

2012

self.clients = clients

2538

2013

if self.clients is None:

2541

2016

self.gnutls_priority = gnutls_priority

2542

2017

IPv6_TCPServer.__init__(self, server_address,

2543

2018

RequestHandlerClass,

2544

interface=interface,

2545

use_ipv6=use_ipv6,

2546

socketfd=socketfd)

2547

2019

interface = interface,

2020

use_ipv6 = use_ipv6,

2021

socketfd = socketfd)

2548

2022

def server_activate(self):

2549

2023

if self.enabled:

2550

2024

return socketserver.TCPServer.server_activate(self)

2551

2025

2552

2026

def enable(self):

2553

2027

self.enabled = True

2554

2028

2555

2029

def add_pipe(self, parent_pipe, proc):

2556

2030

# Call "handle_ipc" for both data and EOF events

2557

GLib.io_add_watch(

2558

parent_pipe.fileno(),

2559

GLib.IO_IN | GLib.IO_HUP,

2560

functools.partial(self.handle_ipc,

2561

parent_pipe=parent_pipe,

2562

proc=proc))

2563

2564

def handle_ipc(self, source, condition,

2565

parent_pipe=None,

2566

proc=None,

2567

client_object=None):

2031

gobject.io_add_watch(parent_pipe.fileno(),

2032

gobject.IO_IN | gobject.IO_HUP,

2033

functools.partial(self.handle_ipc,

2034

parent_pipe =

2035

parent_pipe,

2036

proc = proc))

2037

2038

def handle_ipc(self, source, condition, parent_pipe=None,

2039

proc = None, client_object=None):

2568

2040

# error, or the other end of multiprocessing.Pipe has closed

2569

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2041

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2570

2042

# Wait for other process to exit

2571

2043

proc.join()

2572

2044

return False

2573

2045

2574

2046

# Read a request from the child

2575

2047

request = parent_pipe.recv()

2576

2048

command = request[0]

2577

2049

2578

2050

if command == 'init':

2579

2051

fpr = request[1]

2580

2052

address = request[2]

2581

2582

for c in self.clients.values():

2053

2054

for c in self.clients.itervalues():

2583

2055

if c.fingerprint == fpr:

2584

2056

client = c

2585

2057

break

2592

2064

address[0])

2593

2065

parent_pipe.send(False)

2594

2066

return False

2595

2596

GLib.io_add_watch(

2597

parent_pipe.fileno(),

2598

GLib.IO_IN | GLib.IO_HUP,

2599

functools.partial(self.handle_ipc,

2600

parent_pipe=parent_pipe,

2601

proc=proc,

2602

client_object=client))

2067

2068

gobject.io_add_watch(parent_pipe.fileno(),

2069

gobject.IO_IN | gobject.IO_HUP,

2070

functools.partial(self.handle_ipc,

2071

parent_pipe =

2072

parent_pipe,

2073

proc = proc,

2074

client_object =

2075

client))

2603

2076

parent_pipe.send(True)

2604

2077

# remove the old hook in favor of the new above hook on

2605

2078

# same fileno

2608

2081

funcname = request[1]

2609

2082

args = request[2]

2610

2083

kwargs = request[3]

2611

2084

2612

2085

parent_pipe.send(('data', getattr(client_object,

2613

2086

funcname)(*args,

2614

**kwargs)))

2615

2087

**kwargs)))

2088

2616

2089

if command == 'getattr':

2617

2090

attrname = request[1]

2618

if isinstance(client_object.__getattribute__(attrname),

2619

collections.Callable):

2620

parent_pipe.send(('function', ))

2091

if callable(client_object.__getattribute__(attrname)):

2092

parent_pipe.send(('function',))

2621

2093

else:

2622

parent_pipe.send((

2623

'data', client_object.__getattribute__(attrname)))

2624

2094

parent_pipe.send(('data', client_object

2095

.__getattribute__(attrname)))

2096

2625

2097

if command == 'setattr':

2626

2098

attrname = request[1]

2627

2099

value = request[2]

2628

2100

setattr(client_object, attrname, value)

2629

2101

2630

2102

return True

2631

2103

2632

2104

2633

2105

def rfc3339_duration_to_delta(duration):

2634

2106

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2635

2107

2636

2108

>>> rfc3339_duration_to_delta("P7D")

2637

2109

datetime.timedelta(7)

2638

2110

>>> rfc3339_duration_to_delta("PT60S")

2648

2120

>>> rfc3339_duration_to_delta("P1DT3M20S")

2649

2121

datetime.timedelta(1, 200)

2650

2122

"""

2651

2123

2652

2124

# Parsing an RFC 3339 duration with regular expressions is not

2653

2125

# possible - there would have to be multiple places for the same

2654

2126

# values, like seconds. The current code, while more esoteric, is

2655

2127

# cleaner without depending on a parsing library. If Python had a

2656

2128

# built-in library for parsing we would use it, but we'd like to

2657

2129

# avoid excessive use of external libraries.

2658

2130

2659

2131

# New type for defining tokens, syntax, and semantics all-in-one

2660

Token = collections.namedtuple("Token", (

2661

"regexp", # To match token; if "value" is not None, must have

2662

# a "group" containing digits

2663

"value", # datetime.timedelta or None

2664

"followers")) # Tokens valid after this token

2132

Token = collections.namedtuple("Token",

2133

("regexp", # To match token; if

2134

# "value" is not None,

2135

# must have a "group"

2136

# containing digits

2137

"value", # datetime.timedelta or

2138

# None

2139

"followers")) # Tokens valid after

2140

# this token

2665

2141

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2666

2142

# the "duration" ABNF definition in RFC 3339, Appendix A.

2667

2143

token_end = Token(re.compile(r"$"), None, frozenset())

2668

2144

token_second = Token(re.compile(r"(\d+)S"),

2669

2145

datetime.timedelta(seconds=1),

2670

frozenset((token_end, )))

2146

frozenset((token_end,)))

2671

2147

token_minute = Token(re.compile(r"(\d+)M"),

2672

2148

datetime.timedelta(minutes=1),

2673

2149

frozenset((token_second, token_end)))

2689

2165

frozenset((token_month, token_end)))

2690

2166

token_week = Token(re.compile(r"(\d+)W"),

2691

2167

datetime.timedelta(weeks=1),

2692

frozenset((token_end, )))

2168

frozenset((token_end,)))

2693

2169

token_duration = Token(re.compile(r"P"), None,

2694

2170

frozenset((token_year, token_month,

2695

2171

token_day, token_time,

2696

2172

token_week)))

2697

# Define starting values:

2698

# Value so far

2699

value = datetime.timedelta()

2173

# Define starting values

2174

value = datetime.timedelta() # Value so far

2700

2175

found_token = None

2701

# Following valid tokens

2702

followers = frozenset((token_duration, ))

2703

# String left to parse

2704

s = duration

2176

followers = frozenset((token_duration,)) # Following valid tokens

2177

s = duration # String left to parse

2705

2178

# Loop until end token is found

2706

2179

while found_token is not token_end:

2707

2180

# Search for any currently valid tokens

2723

2196

break

2724

2197

else:

2725

2198

# No currently valid tokens were found

2726

raise ValueError("Invalid RFC 3339 duration: {!r}"

2727

.format(duration))

2199

raise ValueError("Invalid RFC 3339 duration")

2728

2200

# End token found

2729

2201

return value

2730

2202

2731

2203

2732

2204

def string_to_delta(interval):

2733

2205

"""Parse a string and return a datetime.timedelta

2734

2206

2735

2207

>>> string_to_delta('7d')

2736

2208

datetime.timedelta(7)

2737

2209

>>> string_to_delta('60s')

2745

2217

>>> string_to_delta('5m 30s')

2746

2218

datetime.timedelta(0, 330)

2747

2219

"""

2748

2220

2749

2221

try:

2750

2222

return rfc3339_duration_to_delta(interval)

2751

2223

except ValueError:

2752

2224

pass

2753

2225

2754

2226

timevalue = datetime.timedelta(0)

2755

2227

for s in interval.split():

2756

2228

try:

2757

suffix = s[-1]

2229

suffix = unicode(s[-1])

2758

2230

value = int(s[:-1])

2759

2231

if suffix == "d":

2760

2232

delta = datetime.timedelta(value)

2767

2239

elif suffix == "w":

2768

2240

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2769

2241

else:

2770

raise ValueError("Unknown suffix {!r}".format(suffix))

2242

raise ValueError("Unknown suffix {!r}"

2243

.format(suffix))

2771

2244

except IndexError as e:

2772

2245

raise ValueError(*(e.args))

2773

2246

timevalue += delta

2774

2247

return timevalue

2775

2248

2776

2249

2777

def daemon(nochdir=False, noclose=False):

2250

def daemon(nochdir = False, noclose = False):

2778

2251

"""See daemon(3). Standard BSD Unix function.

2779

2252

2780

2253

This should really exist as os.daemon, but it doesn't (yet)."""

2781

2254

if os.fork():

2782

2255

sys.exit()

2789

2262

# Close all standard open file descriptors

2790

2263

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2791

2264

if not stat.S_ISCHR(os.fstat(null).st_mode):

2792

raise OSError(errno.ENODEV,

2793

"{} not a character device"

2265

raise OSError(errno.ENODEV, "{} not a character device"

2794

2266

.format(os.devnull))

2795

2267

os.dup2(null, sys.stdin.fileno())

2796

2268

os.dup2(null, sys.stdout.fileno())

2800

2272

2801

2273

2802

2274

def main():

2803

2275

2804

2276

##################################################################

2805

2277

# Parsing of options, both command line and config file

2806

2278

2807

2279

parser = argparse.ArgumentParser()

2808

2280

parser.add_argument("-v", "--version", action="version",

2809

version="%(prog)s {}".format(version),

2281

version = "%(prog)s {}".format(version),

2810

2282

help="show version number and exit")

2811

2283

parser.add_argument("-i", "--interface", metavar="IF",

2812

2284

help="Bind to interface IF")

2848

2320

parser.add_argument("--no-zeroconf", action="store_false",

2849

2321

dest="zeroconf", help="Do not use Zeroconf",

2850

2322

default=None)

2851

2323

2852

2324

options = parser.parse_args()

2853

2325

2854

2326

if options.check:

2855

2327

import doctest

2856

2328

fail_count, test_count = doctest.testmod()

2857

2329

sys.exit(os.EX_OK if fail_count == 0 else 1)

2858

2330

2859

2331

# Default values for config file for server-global settings

2860

server_defaults = {"interface": "",

2861

"address": "",

2862

"port": "",

2863

"debug": "False",

2864

"priority":

2865

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2866

":+SIGN-DSA-SHA256",

2867

"servicename": "Mandos",

2868

"use_dbus": "True",

2869

"use_ipv6": "True",

2870

"debuglevel": "",

2871

"restore": "True",

2872

"socket": "",

2873

"statedir": "/var/lib/mandos",

2874

"foreground": "False",

2875

"zeroconf": "True",

2876

}

2877

2332

server_defaults = { "interface": "",

2333

"address": "",

2334

"port": "",

2335

"debug": "False",

2336

"priority":

2337

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2338

"servicename": "Mandos",

2339

"use_dbus": "True",

2340

"use_ipv6": "True",

2341

"debuglevel": "",

2342

"restore": "True",

2343

"socket": "",

2344

"statedir": "/var/lib/mandos",

2345

"foreground": "False",

2346

"zeroconf": "True",

2347

}

2348

2878

2349

# Parse config file for server-global settings

2879

2350

server_config = configparser.SafeConfigParser(server_defaults)

2880

2351

del server_defaults

2881

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2352

server_config.read(os.path.join(options.configdir,

2353

"mandos.conf"))

2882

2354

# Convert the SafeConfigParser object to a dict

2883

2355

server_settings = server_config.defaults()

2884

2356

# Use the appropriate methods on the non-string config options

2898

2370

server_settings["socket"] = os.dup(server_settings

2899

2371

["socket"])

2900

2372

del server_config

2901

2373

2902

2374

# Override the settings from the config file with command line

2903

2375

# options, if set.

2904

2376

for option in ("interface", "address", "port", "debug",

2905

"priority", "servicename", "configdir", "use_dbus",

2906

"use_ipv6", "debuglevel", "restore", "statedir",

2907

"socket", "foreground", "zeroconf"):

2377

"priority", "servicename", "configdir",

2378

"use_dbus", "use_ipv6", "debuglevel", "restore",

2379

"statedir", "socket", "foreground", "zeroconf"):

2908

2380

value = getattr(options, option)

2909

2381

if value is not None:

2910

2382

server_settings[option] = value

2911

2383

del options

2912

2384

# Force all strings to be unicode

2913

2385

for option in server_settings.keys():

2914

if isinstance(server_settings[option], bytes):

2915

server_settings[option] = (server_settings[option]

2916

.decode("utf-8"))

2386

if type(server_settings[option]) is str:

2387

server_settings[option] = unicode(server_settings[option])

2917

2388

# Force all boolean options to be boolean

2918

2389

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2919

2390

"foreground", "zeroconf"):

2922

2393

if server_settings["debug"]:

2923

2394

server_settings["foreground"] = True

2924

2395

# Now we have our good server settings in "server_settings"

2925

2396

2926

2397

##################################################################

2927

2928

if (not server_settings["zeroconf"]

2929

and not (server_settings["port"]

2930

or server_settings["socket"] != "")):

2931

parser.error("Needs port or socket to work without Zeroconf")

2932

2398

2399

if (not server_settings["zeroconf"] and

2400

not (server_settings["port"]

2401

or server_settings["socket"] != "")):

2402

parser.error("Needs port or socket to work without"

2403

" Zeroconf")

2404

2933

2405

# For convenience

2934

2406

debug = server_settings["debug"]

2935

2407

debuglevel = server_settings["debuglevel"]

2939

2411

stored_state_file)

2940

2412

foreground = server_settings["foreground"]

2941

2413

zeroconf = server_settings["zeroconf"]

2942

2414

2943

2415

if debug:

2944

2416

initlogger(debug, logging.DEBUG)

2945

2417

else:

2948

2420

else:

2949

2421

level = getattr(logging, debuglevel.upper())

2950

2422

initlogger(debug, level)

2951

2423

2952

2424

if server_settings["servicename"] != "Mandos":

2953

syslogger.setFormatter(

2954

logging.Formatter('Mandos ({}) [%(process)d]:'

2955

' %(levelname)s: %(message)s'.format(

2956

server_settings["servicename"])))

2957

2425

syslogger.setFormatter(logging.Formatter

2426

('Mandos ({}) [%(process)d]:'

2427

' %(levelname)s: %(message)s'

2428

.format(server_settings

2429

["servicename"])))

2430

2958

2431

# Parse config file with clients

2959

2432

client_config = configparser.SafeConfigParser(Client

2960

2433

.client_defaults)

2961

2434

client_config.read(os.path.join(server_settings["configdir"],

2962

2435

"clients.conf"))

2963

2436

2964

2437

global mandos_dbus_service

2965

2438

mandos_dbus_service = None

2966

2439

2967

2440

socketfd = None

2968

2441

if server_settings["socket"] != "":

2969

2442

socketfd = server_settings["socket"]

2970

tcp_server = MandosServer(

2971

(server_settings["address"], server_settings["port"]),

2972

ClientHandler,

2973

interface=(server_settings["interface"] or None),

2974

use_ipv6=use_ipv6,

2975

gnutls_priority=server_settings["priority"],

2976

use_dbus=use_dbus,

2977

socketfd=socketfd)

2443

tcp_server = MandosServer((server_settings["address"],

2444

server_settings["port"]),

2445

ClientHandler,

2446

interface=(server_settings["interface"]

2447

or None),

2448

use_ipv6=use_ipv6,

2449

gnutls_priority=

2450

server_settings["priority"],

2451

use_dbus=use_dbus,

2452

socketfd=socketfd)

2978

2453

if not foreground:

2979

2454

pidfilename = "/run/mandos.pid"

2980

2455

if not os.path.isdir("/run/."):

2981

2456

pidfilename = "/var/run/mandos.pid"

2982

2457

pidfile = None

2983

2458

try:

2984

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2459

pidfile = open(pidfilename, "w")

2985

2460

except IOError as e:

2986

2461

logger.error("Could not open file %r", pidfilename,

2987

2462

exc_info=e)

2988

2989

for name, group in (("_mandos", "_mandos"),

2990

("mandos", "mandos"),

2991

("nobody", "nogroup")):

2463

2464

for name in ("_mandos", "mandos", "nobody"):

2992

2465

try:

2993

2466

uid = pwd.getpwnam(name).pw_uid

2994

gid = pwd.getpwnam(group).pw_gid

2467

gid = pwd.getpwnam(name).pw_gid

2995

2468

break

2996

2469

except KeyError:

2997

2470

continue

3001

2474

try:

3002

2475

os.setgid(gid)

3003

2476

os.setuid(uid)

3004

if debug:

3005

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3006

gid))

3007

2477

except OSError as error:

3008

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3009

.format(uid, gid, os.strerror(error.errno)))

3010

2478

if error.errno != errno.EPERM:

3011

2479

raise

3012

2480

3013

2481

if debug:

3014

2482

# Enable all possible GnuTLS debugging

3015

2483

3016

2484

# "Use a log level over 10 to enable all debugging options."

3017

2485

# - GnuTLS manual

3018

gnutls.global_set_log_level(11)

3019

3020

@gnutls.log_func

2486

gnutls.library.functions.gnutls_global_set_log_level(11)

2487

2488

@gnutls.library.types.gnutls_log_func

3021

2489

def debug_gnutls(level, string):

3022

2490

logger.debug("GnuTLS: %s", string[:-1])

3023

3024

gnutls.global_set_log_function(debug_gnutls)

3025

2491

2492

(gnutls.library.functions

2493

.gnutls_global_set_log_function(debug_gnutls))

2494

3026

2495

# Redirect stdin so all checkers get /dev/null

3027

2496

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3028

2497

os.dup2(null, sys.stdin.fileno())

3029

2498

if null > 2:

3030

2499

os.close(null)

3031

2500

3032

2501

# Need to fork before connecting to D-Bus

3033

2502

if not foreground:

3034

2503

# Close all input and output, do double fork, etc.

3035

2504

daemon()

3036

3037

# multiprocessing will use threads, so before we use GLib we need

3038

# to inform GLib that threads will be used.

3039

GLib.threads_init()

3040

2505

2506

# multiprocessing will use threads, so before we use gobject we

2507

# need to inform gobject that threads will be used.

2508

gobject.threads_init()

2509

3041

2510

global main_loop

3042

2511

# From the Avahi example code

3043

2512

DBusGMainLoop(set_as_default=True)

3044

main_loop = GLib.MainLoop()

2513

main_loop = gobject.MainLoop()

3045

2514

bus = dbus.SystemBus()

3046

2515

# End of Avahi example code

3047

2516

if use_dbus:

3048

2517

try:

3049

2518

bus_name = dbus.service.BusName("se.recompile.Mandos",

3050

bus,

3051

do_not_queue=True)

3052

old_bus_name = dbus.service.BusName(

3053

"se.bsnet.fukt.Mandos", bus,

3054

do_not_queue=True)

3055

except dbus.exceptions.DBusException as e:

2519

bus, do_not_queue=True)

2520

old_bus_name = (dbus.service.BusName

2521

("se.bsnet.fukt.Mandos", bus,

2522

do_not_queue=True))

2523

except dbus.exceptions.NameExistsException as e:

3056

2524

logger.error("Disabling D-Bus:", exc_info=e)

3057

2525

use_dbus = False

3058

2526

server_settings["use_dbus"] = False

3059

2527

tcp_server.use_dbus = False

3060

2528

if zeroconf:

3061

2529

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3062

service = AvahiServiceToSyslog(

3063

name=server_settings["servicename"],

3064

servicetype="_mandos._tcp",

3065

protocol=protocol,

3066

bus=bus)

2530

service = AvahiServiceToSyslog(name =

2531

server_settings["servicename"],

2532

servicetype = "_mandos._tcp",

2533

protocol = protocol, bus = bus)

3067

2534

if server_settings["interface"]:

3068

service.interface = if_nametoindex(

3069

server_settings["interface"].encode("utf-8"))

3070

2535

service.interface = (if_nametoindex

2536

(str(server_settings["interface"])))

2537

3071

2538

global multiprocessing_manager

3072

2539

multiprocessing_manager = multiprocessing.Manager()

3073

2540

3074

2541

client_class = Client

3075

2542

if use_dbus:

3076

client_class = functools.partial(ClientDBus, bus=bus)

3077

2543

client_class = functools.partial(ClientDBus, bus = bus)

2544

3078

2545

client_settings = Client.config_parser(client_config)

3079

2546

old_client_settings = {}

3080

2547

clients_data = {}

3081

2548

3082

2549

# This is used to redirect stdout and stderr for checker processes

3083

2550

global wnull

3084

wnull = open(os.devnull, "w") # A writable /dev/null

2551

wnull = open(os.devnull, "w") # A writable /dev/null

3085

2552

# Only used if server is running in foreground but not in debug

3086

2553

# mode

3087

2554

if debug or not foreground:

3088

2555

wnull.close()

3089

2556

3090

2557

# Get client data and settings from last running state.

3091

2558

if server_settings["restore"]:

3092

2559

try:

3093

2560

with open(stored_state_path, "rb") as stored_state:

3094

if sys.version_info.major == 2:

3095

clients_data, old_client_settings = pickle.load(

3096

stored_state)

3097

else:

3098

bytes_clients_data, bytes_old_client_settings = (

3099

pickle.load(stored_state, encoding="bytes"))

3100

# Fix bytes to strings

3101

# clients_data

3102

# .keys()

3103

clients_data = {(key.decode("utf-8")

3104

if isinstance(key, bytes)

3105

else key): value

3106

for key, value in

3107

bytes_clients_data.items()}

3108

del bytes_clients_data

3109

for key in clients_data:

3110

value = {(k.decode("utf-8")

3111

if isinstance(k, bytes) else k): v

3112

for k, v in

3113

clients_data[key].items()}

3114

clients_data[key] = value

3115

# .client_structure

3116

value["client_structure"] = [

3117

(s.decode("utf-8")

3118

if isinstance(s, bytes)

3119

else s) for s in

3120

value["client_structure"]]

3121

# .name & .host

3122

for k in ("name", "host"):

3123

if isinstance(value[k], bytes):

3124

value[k] = value[k].decode("utf-8")

3125

# old_client_settings

3126

# .keys()

3127

old_client_settings = {

3128

(key.decode("utf-8")

3129

if isinstance(key, bytes)

3130

else key): value

3131

for key, value in

3132

bytes_old_client_settings.items()}

3133

del bytes_old_client_settings

3134

# .host

3135

for value in old_client_settings.values():

3136

if isinstance(value["host"], bytes):

3137

value["host"] = (value["host"]

3138

.decode("utf-8"))

2561

clients_data, old_client_settings = (pickle.load

2562

(stored_state))

3139

2563

os.remove(stored_state_path)

3140

2564

except IOError as e:

3141

2565

if e.errno == errno.ENOENT:

3142

logger.warning("Could not load persistent state:"

3143

" {}".format(os.strerror(e.errno)))

2566

logger.warning("Could not load persistent state: {}"

2567

.format(os.strerror(e.errno)))

3144

2568

else:

3145

2569

logger.critical("Could not load persistent state:",

3146

2570

exc_info=e)

3147

2571

raise

3148

2572

except EOFError as e:

3149

2573

logger.warning("Could not load persistent state: "

3150

"EOFError:",

3151

exc_info=e)

3152

2574

"EOFError:", exc_info=e)

2575

3153

2576

with PGPEngine() as pgp:

3154

2577

for client_name, client in clients_data.items():

3155

2578

# Skip removed clients

3156

2579

if client_name not in client_settings:

3157

2580

continue

3158

2581

3159

2582

# Decide which value to use after restoring saved state.

3160

2583

# We have three different values: Old config file,

3161

2584

# new config file, and saved state.

3166

2589

# For each value in new config, check if it

3167

2590

# differs from the old config value (Except for

3168

2591

# the "secret" attribute)

3169

if (name != "secret"

3170

and (value !=

3171

old_client_settings[client_name][name])):

2592

if (name != "secret" and

2593

value != old_client_settings[client_name]

2594

[name]):

3172

2595

client[name] = value

3173

2596

except KeyError:

3174

2597

pass

3175

2598

3176

2599

# Clients who has passed its expire date can still be

3177

# enabled if its last checker was successful. A Client

2600

# enabled if its last checker was successful. Clients

3178

2601

# whose checker succeeded before we stored its state is

3179

2602

# assumed to have successfully run all checkers during

3180

2603

# downtime.

3183

2606

if not client["last_checked_ok"]:

3184

2607

logger.warning(

3185

2608

"disabling client {} - Client never "

3186

"performed a successful checker".format(

3187

client_name))

2609

"performed a successful checker"

2610

.format(client_name))

3188

2611

client["enabled"] = False

3189

2612

elif client["last_checker_status"] != 0:

3190

2613

logger.warning(

3191

2614

"disabling client {} - Client last"

3192

" checker failed with error code"

3193

" {}".format(

3194

client_name,

3195

client["last_checker_status"]))

2615

" checker failed with error code {}"

2616

.format(client_name,

2617

client["last_checker_status"]))

3196

2618

client["enabled"] = False

3197

2619

else:

3198

client["expires"] = (

3199

datetime.datetime.utcnow()

3200

+ client["timeout"])

2620

client["expires"] = (datetime.datetime

2621

.utcnow()

2622

+ client["timeout"])

3201

2623

logger.debug("Last checker succeeded,"

3202

" keeping {} enabled".format(

3203

client_name))

2624

" keeping {} enabled"

2625

.format(client_name))

3204

2626

try:

3205

client["secret"] = pgp.decrypt(

3206

client["encrypted_secret"],

3207

client_settings[client_name]["secret"])

2627

client["secret"] = (

2628

pgp.decrypt(client["encrypted_secret"],

2629

client_settings[client_name]

2630

["secret"]))

3208

2631

except PGPError:

3209

2632

# If decryption fails, we use secret from new settings

3210

logger.debug("Failed to decrypt {} old secret".format(

3211

client_name))

3212

client["secret"] = (client_settings[client_name]

3213

["secret"])

3214

2633

logger.debug("Failed to decrypt {} old secret"

2634

.format(client_name))

2635

client["secret"] = (

2636

client_settings[client_name]["secret"])

2637

3215

2638

# Add/remove clients based on new changes made to config

3216

2639

for client_name in (set(old_client_settings)

3217

2640

- set(client_settings)):

3219

2642

for client_name in (set(client_settings)

3220

2643

- set(old_client_settings)):

3221

2644

clients_data[client_name] = client_settings[client_name]

3222

2645

3223

2646

# Create all client objects

3224

2647

for client_name, client in clients_data.items():

3225

2648

tcp_server.clients[client_name] = client_class(

3226

name=client_name,

3227

settings=client,

3228

server_settings=server_settings)

3229

2649

name = client_name, settings = client,

2650

server_settings = server_settings)

2651

3230

2652

if not tcp_server.clients:

3231

2653

logger.warning("No clients defined")

3232

2654

3233

2655

if not foreground:

3234

2656

if pidfile is not None:

3235

pid = os.getpid()

3236

2657

try:

3237

2658

with pidfile:

3238

print(pid, file=pidfile)

2659

pid = os.getpid()

2660

pidfile.write(str(pid) + "\n".encode("utf-8"))

3239

2661

except IOError:

3240

2662

logger.error("Could not write to file %r with PID %d",

3241

2663

pidfilename, pid)

3242

2664

del pidfile

3243

2665

del pidfilename

3244

3245

for termsig in (signal.SIGHUP, signal.SIGTERM):

3246

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3247

lambda: main_loop.quit() and False)

3248

2666

2667

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2668

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2669

3249

2670

if use_dbus:

3250

3251

@alternate_dbus_interfaces(

3252

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3253

class MandosDBusService(DBusObjectWithObjectManager):

2671

@alternate_dbus_interfaces({"se.recompile.Mandos":

2672

"se.bsnet.fukt.Mandos"})

2673

class MandosDBusService(DBusObjectWithProperties):

3254

2674

"""A D-Bus proxy object"""

3255

3256

2675

def __init__(self):

3257

2676

dbus.service.Object.__init__(self, bus, "/")

3258

3259

2677

_interface = "se.recompile.Mandos"

3260

2678

2679

@dbus_interface_annotations(_interface)

2680

def _foo(self):

2681

return { "org.freedesktop.DBus.Property"

2682

".EmitsChangedSignal":

2683

"false"}

2684

3261

2685

@dbus.service.signal(_interface, signature="o")

3262

2686

def ClientAdded(self, objpath):

3263

2687

"D-Bus signal"

3264

2688

pass

3265

2689

3266

2690

@dbus.service.signal(_interface, signature="ss")

3267

2691

def ClientNotFound(self, fingerprint, address):

3268

2692

"D-Bus signal"

3269

2693

pass

3270

3271

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3272

"true"})

2694

3273

2695

@dbus.service.signal(_interface, signature="os")

3274

2696

def ClientRemoved(self, objpath, name):

3275

2697

"D-Bus signal"

3276

2698

pass

3277

3278

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3279

"true"})

2699

3280

2700

@dbus.service.method(_interface, out_signature="ao")

3281

2701

def GetAllClients(self):

3282

2702

"D-Bus method"

3283

return dbus.Array(c.dbus_object_path for c in

3284

tcp_server.clients.values())

3285

3286

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3287

"true"})

2703

return dbus.Array(c.dbus_object_path

2704

for c in

2705

tcp_server.clients.itervalues())

2706

3288

2707

@dbus.service.method(_interface,

3289

2708

out_signature="a{oa{sv}}")

3290

2709

def GetAllClientsWithProperties(self):

3291

2710

"D-Bus method"

3292

2711

return dbus.Dictionary(

3293

{c.dbus_object_path: c.GetAll(

3294

"se.recompile.Mandos.Client")

3295

for c in tcp_server.clients.values()},

2712

((c.dbus_object_path, c.GetAll(""))

2713

for c in tcp_server.clients.itervalues()),

3296

2714

signature="oa{sv}")

3297

2715

3298

2716

@dbus.service.method(_interface, in_signature="o")

3299

2717

def RemoveClient(self, object_path):

3300

2718

"D-Bus method"

3301

for c in tcp_server.clients.values():

2719

for c in tcp_server.clients.itervalues():

3302

2720

if c.dbus_object_path == object_path:

3303

2721

del tcp_server.clients[c.name]

3304

2722

c.remove_from_connection()

3305

# Don't signal the disabling

2723

# Don't signal anything except ClientRemoved

3306

2724

c.disable(quiet=True)

3307

# Emit D-Bus signal for removal

3308

self.client_removed_signal(c)

2725

# Emit D-Bus signal

2726

self.ClientRemoved(object_path, c.name)

3309

2727

return

3310

2728

raise KeyError(object_path)

3311

2729

3312

2730

del _interface

3313

3314

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3315

out_signature="a{oa{sa{sv}}}")

3316

def GetManagedObjects(self):

3317

"""D-Bus method"""

3318

return dbus.Dictionary(

3319

{client.dbus_object_path:

3320

dbus.Dictionary(

3321

{interface: client.GetAll(interface)

3322

for interface in

3323

client._get_all_interface_names()})

3324

for client in tcp_server.clients.values()})

3325

3326

def client_added_signal(self, client):

3327

"""Send the new standard signal and the old signal"""

3328

if use_dbus:

3329

# New standard signal

3330

self.InterfacesAdded(

3331

client.dbus_object_path,

3332

dbus.Dictionary(

3333

{interface: client.GetAll(interface)

3334

for interface in

3335

client._get_all_interface_names()}))

3336

# Old signal

3337

self.ClientAdded(client.dbus_object_path)

3338

3339

def client_removed_signal(self, client):

3340

"""Send the new standard signal and the old signal"""

3341

if use_dbus:

3342

# New standard signal

3343

self.InterfacesRemoved(

3344

client.dbus_object_path,

3345

client._get_all_interface_names())

3346

# Old signal

3347

self.ClientRemoved(client.dbus_object_path,

3348

client.name)

3349

2731

3350

2732

mandos_dbus_service = MandosDBusService()

3351

3352

# Save modules to variables to exempt the modules from being

3353

# unloaded before the function registered with atexit() is run.

3354

mp = multiprocessing

3355

wn = wnull

3356

2733

3357

2734

def cleanup():

3358

2735

"Cleanup function; run on exit"

3359

2736

if zeroconf:

3360

2737

service.cleanup()

3361

3362

mp.active_children()

3363

wn.close()

2738

2739

multiprocessing.active_children()

2740

wnull.close()

3364

2741

if not (tcp_server.clients or client_settings):

3365

2742

return

3366

2743

3367

2744

# Store client before exiting. Secrets are encrypted with key

3368

2745

# based on what config file has. If config file is

3369

2746

# removed/edited, old secret will thus be unrecovable.

3370

2747

clients = {}

3371

2748

with PGPEngine() as pgp:

3372

for client in tcp_server.clients.values():

2749

for client in tcp_server.clients.itervalues():

3373

2750

key = client_settings[client.name]["secret"]

3374

2751

client.encrypted_secret = pgp.encrypt(client.secret,

3375

2752

key)

3376

2753

client_dict = {}

3377

2754

3378

2755

# A list of attributes that can not be pickled

3379

2756

# + secret.

3380

exclude = {"bus", "changedstate", "secret",

3381

"checker", "server_settings"}

3382

for name, typ in inspect.getmembers(dbus.service

3383

.Object):

2757

exclude = { "bus", "changedstate", "secret",

2758

"checker", "server_settings" }

2759

for name, typ in (inspect.getmembers

2760

(dbus.service.Object)):

3384

2761

exclude.add(name)

3385

2762

3386

2763

client_dict["encrypted_secret"] = (client

3387

2764

.encrypted_secret)

3388

2765

for attr in client.client_structure:

3389

2766

if attr not in exclude:

3390

2767

client_dict[attr] = getattr(client, attr)

3391

2768

3392

2769

clients[client.name] = client_dict

3393

2770

del client_settings[client.name]["secret"]

3394

2771

3395

2772

try:

3396

with tempfile.NamedTemporaryFile(

3397

mode='wb',

3398

suffix=".pickle",

3399

prefix='clients-',

3400

dir=os.path.dirname(stored_state_path),

3401

delete=False) as stored_state:

3402

pickle.dump((clients, client_settings), stored_state,

3403

protocol=2)

3404

tempname = stored_state.name

2773

with (tempfile.NamedTemporaryFile

2774

(mode='wb', suffix=".pickle", prefix='clients-',

2775

dir=os.path.dirname(stored_state_path),

2776

delete=False)) as stored_state:

2777

pickle.dump((clients, client_settings), stored_state)

2778

tempname=stored_state.name

3405

2779

os.rename(tempname, stored_state_path)

3406

2780

except (IOError, OSError) as e:

3407

2781

if not debug:

3416

2790

logger.warning("Could not save persistent state:",

3417

2791

exc_info=e)

3418

2792

raise

3419

2793

3420

2794

# Delete all clients, and settings from config

3421

2795

while tcp_server.clients:

3422

2796

name, client = tcp_server.clients.popitem()

3423

2797

if use_dbus:

3424

2798

client.remove_from_connection()

3425

# Don't signal the disabling

2799

# Don't signal anything except ClientRemoved

3426

2800

client.disable(quiet=True)

3427

# Emit D-Bus signal for removal

3428

2801

if use_dbus:

3429

mandos_dbus_service.client_removed_signal(client)

2802

# Emit D-Bus signal

2803

mandos_dbus_service.ClientRemoved(client

2804

.dbus_object_path,

2805

client.name)

3430

2806

client_settings.clear()

3431

2807

3432

2808

atexit.register(cleanup)

3433

3434

for client in tcp_server.clients.values():

2809

2810

for client in tcp_server.clients.itervalues():

3435

2811

if use_dbus:

3436

# Emit D-Bus signal for adding

3437

mandos_dbus_service.client_added_signal(client)

2812

# Emit D-Bus signal

2813

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3438

2814

# Need to initiate checking of clients

3439

2815

if client.enabled:

3440

2816

client.init_checker()

3441

2817

3442

2818

tcp_server.enable()

3443

2819

tcp_server.server_activate()

3444

2820

3445

2821

# Find out what port we got

3446

2822

if zeroconf:

3447

2823

service.port = tcp_server.socket.getsockname()[1]

3452

2828

else: # IPv4

3453

2829

logger.info("Now listening on address %r, port %d",

3454

2830

*tcp_server.socket.getsockname())

3455

3456

# service.interface = tcp_server.socket.getsockname()[3]

3457

2831

2832

#service.interface = tcp_server.socket.getsockname()[3]

2833

3458

2834

try:

3459

2835

if zeroconf:

3460

2836

# From the Avahi example code

3465

2841

cleanup()

3466

2842

sys.exit(1)

3467

2843

# End of Avahi example code

3468

3469

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3470

lambda *args, **kwargs:

3471

(tcp_server.handle_request

3472

(*args[2:], **kwargs) or True))

3473

2844

2845

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2846

lambda *args, **kwargs:

2847

(tcp_server.handle_request

2848

(*args[2:], **kwargs) or True))

2849

3474

2850

logger.debug("Starting main loop")

3475

2851

main_loop.run()

3476

2852

except AvahiError as error:

3485

2861

# Must run before the D-Bus bus name gets deregistered

3486

2862

cleanup()

3487

2863

3488

3489

2864

if __name__ == '__main__':

3490

2865

main()