/mandos/trunk : revision 237.4.80

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

import SocketServer as socketserver

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

41

42

try:

43

import SocketServer as socketserver

44

except ImportError:

45

import socketserver

38

46

import socket

39

47

import argparse

40

48

import datetime

41

49

import errno

42

import gnutls.crypto

43

import gnutls.connection

44

import gnutls.errors

45

import gnutls.library.functions

46

import gnutls.library.constants

47

import gnutls.library.types

48

import ConfigParser as configparser

50

try:

51

import ConfigParser as configparser

52

except ImportError:

53

import configparser

49

54

import sys

50

55

import re

51

56

import os

60

65

import struct

61

66

import fcntl

62

67

import functools

63

import cPickle as pickle

68

try:

69

import cPickle as pickle

70

except ImportError:

71

import pickle

64

72

import multiprocessing

65

73

import types

66

74

import binascii

67

75

import tempfile

76

import itertools

77

import collections

78

import codecs

68

79

69

80

import dbus

70

81

import dbus.service

71

import gobject

72

import avahi

82

from gi.repository import GLib

73

83

from dbus.mainloop.glib import DBusGMainLoop

74

84

import ctypes

75

85

import ctypes.util

76

86

import xml.dom.minidom

77

87

import inspect

78

import GnuPGInterface

79

88

89

# Try to find the value of SO_BINDTODEVICE:

80

90

try:

91

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

92

# newer, and it is also the most natural place for it:

81

93

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

82

94

except AttributeError:

83

95

try:

96

# This is where SO_BINDTODEVICE was up to and including Python

97

# 2.6, and also 3.2:

84

98

from IN import SO_BINDTODEVICE

85

99

except ImportError:

86

SO_BINDTODEVICE = None

87

88

version = "1.4.1"

100

# In Python 2.7 it seems to have been removed entirely.

101

# Try running the C preprocessor:

102

try:

103

cc = subprocess.Popen(["cc", "--language=c", "-E",

104

"/dev/stdin"],

105

stdin=subprocess.PIPE,

106

stdout=subprocess.PIPE)

107

stdout = cc.communicate(

108

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

109

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

110

except (OSError, ValueError, IndexError):

111

# No value found

112

SO_BINDTODEVICE = None

113

114

if sys.version_info.major == 2:

115

str = unicode

116

117

version = "1.7.10"

89

118

stored_state_file = "clients.pickle"

90

119

91

120

logger = logging.getLogger()

92

syslogger = (logging.handlers.SysLogHandler

93

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

address = str("/dev/log")))

121

syslogger = None

95

122

96

123

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

124

if_nametoindex = ctypes.cdll.LoadLibrary(

125

ctypes.util.find_library("c")).if_nametoindex

100

126

except (OSError, AttributeError):

127

101

128

def if_nametoindex(interface):

102

129

"Get an interface index the hard way, i.e. using fcntl()"

103

130

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

131

with contextlib.closing(socket.socket()) as s:

105

132

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

133

struct.pack(b"16s16x", interface))

134

interface_index = struct.unpack("I", ifreq[16:20])[0]

110

135

return interface_index

111

136

112

137

138

def copy_function(func):

139

"""Make a copy of a function"""

140

if sys.version_info.major == 2:

141

return types.FunctionType(func.func_code,

142

func.func_globals,

143

func.func_name,

144

func.func_defaults,

145

func.func_closure)

146

else:

147

return types.FunctionType(func.__code__,

148

func.__globals__,

149

func.__name__,

150

func.__defaults__,

151

func.__closure__)

152

153

113

154

def initlogger(debug, level=logging.WARNING):

114

155

"""init logger and add loglevel"""

115

156

157

global syslogger

158

syslogger = (logging.handlers.SysLogHandler(

159

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

160

address = "/dev/log"))

116

161

syslogger.setFormatter(logging.Formatter

117

162

('Mandos [%(process)d]: %(levelname)s:'

118

163

' %(message)s'))

135

180

136

181

class PGPEngine(object):

137

182

"""A simple class for OpenPGP symmetric encryption & decryption"""

183

138

184

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

185

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet',

146

'--no-use-agent'])

186

self.gpg = "gpg"

187

try:

188

output = subprocess.check_output(["gpgconf"])

189

for line in output.splitlines():

190

name, text, path = line.split(b":")

191

if name == "gpg":

192

self.gpg = path

193

break

194

except OSError as e:

195

if e.errno != errno.ENOENT:

196

raise

197

self.gnupgargs = ['--batch',

198

'--homedir', self.tempdir,

199

'--force-mdc',

200

'--quiet']

201

# Only GPG version 1 has the --no-use-agent option.

202

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

203

self.gnupgargs.append("--no-use-agent")

147

204

148

205

def __enter__(self):

149

206

return self

150

207

151

def __exit__ (self, exc_type, exc_value, traceback):

208

def __exit__(self, exc_type, exc_value, traceback):

152

209

self._cleanup()

153

210

return False

154

211

171

228

def password_encode(self, password):

172

229

# Passphrase can not be empty and can not contain newlines or

173

230

# NUL bytes. So we prefix it and hex encode it.

174

return b"mandos" + binascii.hexlify(password)

231

encoded = b"mandos" + binascii.hexlify(password)

232

if len(encoded) > 2048:

233

# GnuPG can't handle long passwords, so encode differently

234

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

235

.replace(b"\n", b"\\n")

236

.replace(b"\0", b"\\x00"))

237

return encoded

175

238

176

239

def encrypt(self, data, password):

177

self.gnupg.passphrase = self.password_encode(password)

178

with open(os.devnull) as devnull:

179

try:

180

proc = self.gnupg.run(['--symmetric'],

181

create_fhs=['stdin', 'stdout'],

182

attach_fhs={'stderr': devnull})

183

with contextlib.closing(proc.handles['stdin']) as f:

184

f.write(data)

185

with contextlib.closing(proc.handles['stdout']) as f:

186

ciphertext = f.read()

187

proc.wait()

188

except IOError as e:

189

raise PGPError(e)

190

self.gnupg.passphrase = None

240

passphrase = self.password_encode(password)

241

with tempfile.NamedTemporaryFile(

242

dir=self.tempdir) as passfile:

243

passfile.write(passphrase)

244

passfile.flush()

245

proc = subprocess.Popen([self.gpg, '--symmetric',

246

'--passphrase-file',

247

passfile.name]

248

+ self.gnupgargs,

249

stdin = subprocess.PIPE,

250

stdout = subprocess.PIPE,

251

stderr = subprocess.PIPE)

252

ciphertext, err = proc.communicate(input = data)

253

if proc.returncode != 0:

254

raise PGPError(err)

191

255

return ciphertext

192

256

193

257

def decrypt(self, data, password):

194

self.gnupg.passphrase = self.password_encode(password)

195

with open(os.devnull) as devnull:

196

try:

197

proc = self.gnupg.run(['--decrypt'],

198

create_fhs=['stdin', 'stdout'],

199

attach_fhs={'stderr': devnull})

200

with contextlib.closing(proc.handles['stdin'] ) as f:

201

f.write(data)

202

with contextlib.closing(proc.handles['stdout']) as f:

203

decrypted_plaintext = f.read()

204

proc.wait()

205

except IOError as e:

206

raise PGPError(e)

207

self.gnupg.passphrase = None

258

passphrase = self.password_encode(password)

259

with tempfile.NamedTemporaryFile(

260

dir = self.tempdir) as passfile:

261

passfile.write(passphrase)

262

passfile.flush()

263

proc = subprocess.Popen([self.gpg, '--decrypt',

264

'--passphrase-file',

265

passfile.name]

266

+ self.gnupgargs,

267

stdin = subprocess.PIPE,

268

stdout = subprocess.PIPE,

269

stderr = subprocess.PIPE)

270

decrypted_plaintext, err = proc.communicate(input = data)

271

if proc.returncode != 0:

272

raise PGPError(err)

208

273

return decrypted_plaintext

209

274

210

275

# Pretend that we have an Avahi module

276

class Avahi(object):

277

"""This isn't so much a class as it is a module-like namespace.

278

It is instantiated once, and simulates having an Avahi module."""

279

IF_UNSPEC = -1 # avahi-common/address.h

280

PROTO_UNSPEC = -1 # avahi-common/address.h

281

PROTO_INET = 0 # avahi-common/address.h

282

PROTO_INET6 = 1 # avahi-common/address.h

283

DBUS_NAME = "org.freedesktop.Avahi"

284

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

285

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

286

DBUS_PATH_SERVER = "/"

287

def string_array_to_txt_array(self, t):

288

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

289

for s in t), signature="ay")

290

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

291

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

292

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

293

SERVER_INVALID = 0 # avahi-common/defs.h

294

SERVER_REGISTERING = 1 # avahi-common/defs.h

295

SERVER_RUNNING = 2 # avahi-common/defs.h

296

SERVER_COLLISION = 3 # avahi-common/defs.h

297

SERVER_FAILURE = 4 # avahi-common/defs.h

298

avahi = Avahi()

211

299

212

300

class AvahiError(Exception):

213

301

def __init__(self, value, *args, **kwargs):

214

302

self.value = value

215

super(AvahiError, self).__init__(value, *args, **kwargs)

216

def __unicode__(self):

217

return unicode(repr(self.value))

303

return super(AvahiError, self).__init__(value, *args,

304

**kwargs)

305

218

306

219

307

class AvahiServiceError(AvahiError):

220

308

pass

221

309

310

222

311

class AvahiGroupError(AvahiError):

223

312

pass

224

313

231

320

Used to optionally bind to the specified interface.

232

321

name: string; Example: 'Mandos'

233

322

type: string; Example: '_mandos._tcp'.

234

See <http://www.dns-sd.org/ServiceTypes.html>

323

See <https://www.iana.org/assignments/service-names-port-numbers>

235

324

port: integer; what port to announce

236

325

TXT: list of strings; TXT record for the service

237

326

domain: string; Domain to publish on, default to .local if empty.

243

332

server: D-Bus Server

244

333

bus: dbus.SystemBus()

245

334

"""

246

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

247

servicetype = None, port = None, TXT = None,

248

domain = "", host = "", max_renames = 32768,

249

protocol = avahi.PROTO_UNSPEC, bus = None):

335

336

def __init__(self,

337

interface = avahi.IF_UNSPEC,

338

name = None,

339

servicetype = None,

340

port = None,

341

TXT = None,

342

domain = "",

343

host = "",

344

max_renames = 32768,

345

protocol = avahi.PROTO_UNSPEC,

346

bus = None):

250

347

self.interface = interface

251

348

self.name = name

252

349

self.type = servicetype

261

358

self.server = None

262

359

self.bus = bus

263

360

self.entry_group_state_changed_match = None

264

def rename(self):

361

362

def rename(self, remove=True):

265

363

"""Derived from the Avahi example code"""

266

364

if self.rename_count >= self.max_renames:

267

365

logger.critical("No suitable Zeroconf service name found"

268

366

" after %i retries, exiting.",

269

367

self.rename_count)

270

368

raise AvahiServiceError("Too many renames")

271

self.name = unicode(self.server

272

.GetAlternativeServiceName(self.name))

369

self.name = str(

370

self.server.GetAlternativeServiceName(self.name))

371

self.rename_count += 1

273

372

logger.info("Changing Zeroconf service name to %r ...",

274

373

self.name)

275

self.remove()

374

if remove:

375

self.remove()

276

376

try:

277

377

self.add()

278

378

except dbus.exceptions.DBusException as error:

279

logger.critical("DBusException: %s", error)

280

self.cleanup()

281

os._exit(1)

282

self.rename_count += 1

379

if (error.get_dbus_name()

380

== "org.freedesktop.Avahi.CollisionError"):

381

logger.info("Local Zeroconf service name collision.")

382

return self.rename(remove=False)

383

else:

384

logger.critical("D-Bus Exception", exc_info=error)

385

self.cleanup()

386

os._exit(1)

387

283

388

def remove(self):

284

389

"""Derived from the Avahi example code"""

285

390

if self.entry_group_state_changed_match is not None:

287

392

self.entry_group_state_changed_match = None

288

393

if self.group is not None:

289

394

self.group.Reset()

395

290

396

def add(self):

291

397

"""Derived from the Avahi example code"""

292

398

self.remove()

309

415

dbus.UInt16(self.port),

310

416

avahi.string_array_to_txt_array(self.TXT))

311

417

self.group.Commit()

418

312

419

def entry_group_state_changed(self, state, error):

313

420

"""Derived from the Avahi example code"""

314

421

logger.debug("Avahi entry group state change: %i", state)

320

427

self.rename()

321

428

elif state == avahi.ENTRY_GROUP_FAILURE:

322

429

logger.critical("Avahi: Error in group state changed %s",

323

unicode(error))

324

raise AvahiGroupError("State changed: %s"

325

% unicode(error))

430

str(error))

431

raise AvahiGroupError("State changed: {!s}".format(error))

432

326

433

def cleanup(self):

327

434

"""Derived from the Avahi example code"""

328

435

if self.group is not None:

333

440

pass

334

441

self.group = None

335

442

self.remove()

443

336

444

def server_state_changed(self, state, error=None):

337

445

"""Derived from the Avahi example code"""

338

446

logger.debug("Avahi server state change: %i", state)

339

bad_states = { avahi.SERVER_INVALID:

340

"Zeroconf server invalid",

341

avahi.SERVER_REGISTERING: None,

342

avahi.SERVER_COLLISION:

343

"Zeroconf server name collision",

344

avahi.SERVER_FAILURE:

345

"Zeroconf server failure" }

447

bad_states = {

448

avahi.SERVER_INVALID: "Zeroconf server invalid",

449

avahi.SERVER_REGISTERING: None,

450

avahi.SERVER_COLLISION: "Zeroconf server name collision",

451

avahi.SERVER_FAILURE: "Zeroconf server failure",

452

}

346

453

if state in bad_states:

347

454

if bad_states[state] is not None:

348

455

if error is None:

351

458

logger.error(bad_states[state] + ": %r", error)

352

459

self.cleanup()

353

460

elif state == avahi.SERVER_RUNNING:

354

self.add()

461

try:

462

self.add()

463

except dbus.exceptions.DBusException as error:

464

if (error.get_dbus_name()

465

== "org.freedesktop.Avahi.CollisionError"):

466

logger.info("Local Zeroconf service name"

467

" collision.")

468

return self.rename(remove=False)

469

else:

470

logger.critical("D-Bus Exception", exc_info=error)

471

self.cleanup()

472

os._exit(1)

355

473

else:

356

474

if error is None:

357

475

logger.debug("Unknown state: %r", state)

358

476

else:

359

477

logger.debug("Unknown state: %r: %r", state, error)

478

360

479

def activate(self):

361

480

"""Derived from the Avahi example code"""

362

481

if self.server is None:

366

485

follow_name_owner_changes=True),

367

486

avahi.DBUS_INTERFACE_SERVER)

368

487

self.server.connect_to_signal("StateChanged",

369

self.server_state_changed)

488

self.server_state_changed)

370

489

self.server_state_changed(self.server.GetState())

371

490

491

372

492

class AvahiServiceToSyslog(AvahiService):

373

def rename(self):

493

def rename(self, *args, **kwargs):

374

494

"""Add the new name to the syslog messages"""

375

ret = AvahiService.rename(self)

376

syslogger.setFormatter(logging.Formatter

377

('Mandos (%s) [%%(process)d]:'

378

' %%(levelname)s: %%(message)s'

379

% self.name))

495

ret = AvahiService.rename(self, *args, **kwargs)

496

syslogger.setFormatter(logging.Formatter(

497

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

498

.format(self.name)))

380

499

return ret

381

500

382

def timedelta_to_milliseconds(td):

383

"Convert a datetime.timedelta() to milliseconds"

384

return ((td.days * 24 * 60 * 60 * 1000)

385

+ (td.seconds * 1000)

386

+ (td.microseconds // 1000))

387

501

# Pretend that we have a GnuTLS module

502

class GnuTLS(object):

503

"""This isn't so much a class as it is a module-like namespace.

504

It is instantiated once, and simulates having a GnuTLS module."""

505

506

_library = ctypes.cdll.LoadLibrary(

507

ctypes.util.find_library("gnutls"))

508

_need_version = b"3.3.0"

509

def __init__(self):

510

# Need to use class name "GnuTLS" here, since this method is

511

# called before the assignment to the "gnutls" global variable

512

# happens.

513

if GnuTLS.check_version(self._need_version) is None:

514

raise GnuTLS.Error("Needs GnuTLS {} or later"

515

.format(self._need_version))

516

517

# Unless otherwise indicated, the constants and types below are

518

# all from the gnutls/gnutls.h C header file.

519

520

# Constants

521

E_SUCCESS = 0

522

E_INTERRUPTED = -52

523

E_AGAIN = -28

524

CRT_OPENPGP = 2

525

CLIENT = 2

526

SHUT_RDWR = 0

527

CRD_CERTIFICATE = 1

528

E_NO_CERTIFICATE_FOUND = -49

529

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

530

531

# Types

532

class session_int(ctypes.Structure):

533

_fields_ = []

534

session_t = ctypes.POINTER(session_int)

535

class certificate_credentials_st(ctypes.Structure):

536

_fields_ = []

537

certificate_credentials_t = ctypes.POINTER(

538

certificate_credentials_st)

539

certificate_type_t = ctypes.c_int

540

class datum_t(ctypes.Structure):

541

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

542

('size', ctypes.c_uint)]

543

class openpgp_crt_int(ctypes.Structure):

544

_fields_ = []

545

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

546

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

547

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

548

credentials_type_t = ctypes.c_int

549

transport_ptr_t = ctypes.c_void_p

550

close_request_t = ctypes.c_int

551

552

# Exceptions

553

class Error(Exception):

554

# We need to use the class name "GnuTLS" here, since this

555

# exception might be raised from within GnuTLS.__init__,

556

# which is called before the assignment to the "gnutls"

557

# global variable has happened.

558

def __init__(self, message = None, code = None, args=()):

559

# Default usage is by a message string, but if a return

560

# code is passed, convert it to a string with

561

# gnutls.strerror()

562

self.code = code

563

if message is None and code is not None:

564

message = GnuTLS.strerror(code)

565

return super(GnuTLS.Error, self).__init__(

566

message, *args)

567

568

class CertificateSecurityError(Error):

569

pass

570

571

# Classes

572

class Credentials(object):

573

def __init__(self):

574

self._c_object = gnutls.certificate_credentials_t()

575

gnutls.certificate_allocate_credentials(

576

ctypes.byref(self._c_object))

577

self.type = gnutls.CRD_CERTIFICATE

578

579

def __del__(self):

580

gnutls.certificate_free_credentials(self._c_object)

581

582

class ClientSession(object):

583

def __init__(self, socket, credentials = None):

584

self._c_object = gnutls.session_t()

585

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

586

gnutls.set_default_priority(self._c_object)

587

gnutls.transport_set_ptr(self._c_object, socket.fileno())

588

gnutls.handshake_set_private_extensions(self._c_object,

589

True)

590

self.socket = socket

591

if credentials is None:

592

credentials = gnutls.Credentials()

593

gnutls.credentials_set(self._c_object, credentials.type,

594

ctypes.cast(credentials._c_object,

595

ctypes.c_void_p))

596

self.credentials = credentials

597

598

def __del__(self):

599

gnutls.deinit(self._c_object)

600

601

def handshake(self):

602

return gnutls.handshake(self._c_object)

603

604

def send(self, data):

605

data = bytes(data)

606

data_len = len(data)

607

while data_len > 0:

608

data_len -= gnutls.record_send(self._c_object,

609

data[-data_len:],

610

data_len)

611

612

def bye(self):

613

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

614

615

# Error handling functions

616

def _error_code(result):

617

"""A function to raise exceptions on errors, suitable

618

for the 'restype' attribute on ctypes functions"""

619

if result >= 0:

620

return result

621

if result == gnutls.E_NO_CERTIFICATE_FOUND:

622

raise gnutls.CertificateSecurityError(code = result)

623

raise gnutls.Error(code = result)

624

625

def _retry_on_error(result, func, arguments):

626

"""A function to retry on some errors, suitable

627

for the 'errcheck' attribute on ctypes functions"""

628

while result < 0:

629

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

630

return _error_code(result)

631

result = func(*arguments)

632

return result

633

634

# Unless otherwise indicated, the function declarations below are

635

# all from the gnutls/gnutls.h C header file.

636

637

# Functions

638

priority_set_direct = _library.gnutls_priority_set_direct

639

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

640

ctypes.POINTER(ctypes.c_char_p)]

641

priority_set_direct.restype = _error_code

642

643

init = _library.gnutls_init

644

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

645

init.restype = _error_code

646

647

set_default_priority = _library.gnutls_set_default_priority

648

set_default_priority.argtypes = [session_t]

649

set_default_priority.restype = _error_code

650

651

record_send = _library.gnutls_record_send

652

record_send.argtypes = [session_t, ctypes.c_void_p,

653

ctypes.c_size_t]

654

record_send.restype = ctypes.c_ssize_t

655

record_send.errcheck = _retry_on_error

656

657

certificate_allocate_credentials = (

658

_library.gnutls_certificate_allocate_credentials)

659

certificate_allocate_credentials.argtypes = [

660

ctypes.POINTER(certificate_credentials_t)]

661

certificate_allocate_credentials.restype = _error_code

662

663

certificate_free_credentials = (

664

_library.gnutls_certificate_free_credentials)

665

certificate_free_credentials.argtypes = [certificate_credentials_t]

666

certificate_free_credentials.restype = None

667

668

handshake_set_private_extensions = (

669

_library.gnutls_handshake_set_private_extensions)

670

handshake_set_private_extensions.argtypes = [session_t,

671

ctypes.c_int]

672

handshake_set_private_extensions.restype = None

673

674

credentials_set = _library.gnutls_credentials_set

675

credentials_set.argtypes = [session_t, credentials_type_t,

676

ctypes.c_void_p]

677

credentials_set.restype = _error_code

678

679

strerror = _library.gnutls_strerror

680

strerror.argtypes = [ctypes.c_int]

681

strerror.restype = ctypes.c_char_p

682

683

certificate_type_get = _library.gnutls_certificate_type_get

684

certificate_type_get.argtypes = [session_t]

685

certificate_type_get.restype = _error_code

686

687

certificate_get_peers = _library.gnutls_certificate_get_peers

688

certificate_get_peers.argtypes = [session_t,

689

ctypes.POINTER(ctypes.c_uint)]

690

certificate_get_peers.restype = ctypes.POINTER(datum_t)

691

692

global_set_log_level = _library.gnutls_global_set_log_level

693

global_set_log_level.argtypes = [ctypes.c_int]

694

global_set_log_level.restype = None

695

696

global_set_log_function = _library.gnutls_global_set_log_function

697

global_set_log_function.argtypes = [log_func]

698

global_set_log_function.restype = None

699

700

deinit = _library.gnutls_deinit

701

deinit.argtypes = [session_t]

702

deinit.restype = None

703

704

handshake = _library.gnutls_handshake

705

handshake.argtypes = [session_t]

706

handshake.restype = _error_code

707

handshake.errcheck = _retry_on_error

708

709

transport_set_ptr = _library.gnutls_transport_set_ptr

710

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

711

transport_set_ptr.restype = None

712

713

bye = _library.gnutls_bye

714

bye.argtypes = [session_t, close_request_t]

715

bye.restype = _error_code

716

bye.errcheck = _retry_on_error

717

718

check_version = _library.gnutls_check_version

719

check_version.argtypes = [ctypes.c_char_p]

720

check_version.restype = ctypes.c_char_p

721

722

# All the function declarations below are from gnutls/openpgp.h

723

724

openpgp_crt_init = _library.gnutls_openpgp_crt_init

725

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

726

openpgp_crt_init.restype = _error_code

727

728

openpgp_crt_import = _library.gnutls_openpgp_crt_import

729

openpgp_crt_import.argtypes = [openpgp_crt_t,

730

ctypes.POINTER(datum_t),

731

openpgp_crt_fmt_t]

732

openpgp_crt_import.restype = _error_code

733

734

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

735

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

736

ctypes.POINTER(ctypes.c_uint)]

737

openpgp_crt_verify_self.restype = _error_code

738

739

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

740

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

741

openpgp_crt_deinit.restype = None

742

743

openpgp_crt_get_fingerprint = (

744

_library.gnutls_openpgp_crt_get_fingerprint)

745

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

746

ctypes.c_void_p,

747

ctypes.POINTER(

748

ctypes.c_size_t)]

749

openpgp_crt_get_fingerprint.restype = _error_code

750

751

# Remove non-public functions

752

del _error_code, _retry_on_error

753

# Create the global "gnutls" object, simulating a module

754

gnutls = GnuTLS()

755

756

def call_pipe(connection, # : multiprocessing.Connection

757

func, *args, **kwargs):

758

"""This function is meant to be called by multiprocessing.Process

759

760

This function runs func(*args, **kwargs), and writes the resulting

761

return value on the provided multiprocessing.Connection.

762

"""

763

connection.send(func(*args, **kwargs))

764

connection.close()

765

388

766

class Client(object):

389

767

"""A representation of a client host served by this server.

390

768

395

773

checker: subprocess.Popen(); a running checker process used

396

774

to see if the client lives.

397

775

'None' if no process is running.

398

checker_callback_tag: a gobject event source tag, or None

776

checker_callback_tag: a GLib event source tag, or None

399

777

checker_command: string; External command which is run to check

400

778

if client lives. %() expansions are done at

401

779

runtime with vars(self) as dict, so that for

402

780

instance %(name)s can be used in the command.

403

checker_initiator_tag: a gobject event source tag, or None

781

checker_initiator_tag: a GLib event source tag, or None

404

782

created: datetime.datetime(); (UTC) object creation

405

783

client_structure: Object describing what attributes a client has

406

784

and is used for storing the client at exit

407

785

current_checker_command: string; current running checker_command

408

disable_initiator_tag: a gobject event source tag, or None

786

disable_initiator_tag: a GLib event source tag, or None

409

787

enabled: bool()

410

788

fingerprint: string (40 or 32 hexadecimal digits); used to

411

789

uniquely identify the client

415

793

last_checked_ok: datetime.datetime(); (UTC) or None

416

794

last_checker_status: integer between 0 and 255 reflecting exit

417

795

status of last checker. -1 reflects crashed

418

checker, or None.

796

checker, -2 means no checker completed yet.

797

last_checker_signal: The signal which killed the last checker, if

798

last_checker_status is -1

419

799

last_enabled: datetime.datetime(); (UTC) or None

420

800

name: string; from the config file, used in log messages and

421

801

D-Bus identifiers

422

802

secret: bytestring; sent verbatim (over TLS) to client

423

803

timeout: datetime.timedelta(); How long from last_checked_ok

424

804

until this client is disabled

425

extended_timeout: extra long timeout when password has been sent

805

extended_timeout: extra long timeout when secret has been sent

426

806

runtime_expansions: Allowed attributes for runtime expansion.

427

807

expires: datetime.datetime(); time (UTC) when a client will be

428

808

disabled, or None

809

server_settings: The server_settings dict from main()

429

810

"""

430

811

431

812

runtime_expansions = ("approval_delay", "approval_duration",

432

"created", "enabled", "fingerprint",

433

"host", "interval", "last_checked_ok",

813

"created", "enabled", "expires",

814

"fingerprint", "host", "interval",

815

"last_approval_request", "last_checked_ok",

434

816

"last_enabled", "name", "timeout")

435

client_defaults = { "timeout": "5m",

436

"extended_timeout": "15m",

437

"interval": "2m",

438

"checker": "fping -q -- %%(host)s",

439

"host": "",

440

"approval_delay": "0s",

441

"approval_duration": "1s",

442

"approved_by_default": "True",

443

"enabled": "True",

444

}

445

446

def timeout_milliseconds(self):

447

"Return the 'timeout' attribute in milliseconds"

448

return timedelta_to_milliseconds(self.timeout)

449

450

def extended_timeout_milliseconds(self):

451

"Return the 'extended_timeout' attribute in milliseconds"

452

return timedelta_to_milliseconds(self.extended_timeout)

453

454

def interval_milliseconds(self):

455

"Return the 'interval' attribute in milliseconds"

456

return timedelta_to_milliseconds(self.interval)

457

458

def approval_delay_milliseconds(self):

459

return timedelta_to_milliseconds(self.approval_delay)

460

817

client_defaults = {

818

"timeout": "PT5M",

819

"extended_timeout": "PT15M",

820

"interval": "PT2M",

821

"checker": "fping -q -- %%(host)s",

822

"host": "",

823

"approval_delay": "PT0S",

824

"approval_duration": "PT1S",

825

"approved_by_default": "True",

826

"enabled": "True",

827

}

828

461

829

@staticmethod

462

830

def config_parser(config):

463

""" Construct a new dict of client settings of this form:

831

"""Construct a new dict of client settings of this form:

464

832

{ client_name: {setting_name: value, ...}, ...}

465

with exceptions for any special settings as defined above"""

833

with exceptions for any special settings as defined above.

834

NOTE: Must be a pure function. Must return the same result

835

value given the same arguments.

836

"""

466

837

settings = {}

467

838

for client_name in config.sections():

468

839

section = dict(config.items(client_name))

472

843

# Reformat values from string types to Python types

473

844

client["approved_by_default"] = config.getboolean(

474

845

client_name, "approved_by_default")

475

client["enabled"] = config.getboolean(client_name, "enabled")

846

client["enabled"] = config.getboolean(client_name,

847

"enabled")

476

848

849

# Uppercase and remove spaces from fingerprint for later

850

# comparison purposes with return value from the

851

# fingerprint() function

477

852

client["fingerprint"] = (section["fingerprint"].upper()

478

853

.replace(" ", ""))

479

854

if "secret" in section:

480

client["secret"] = section["secret"].decode("base64")

855

client["secret"] = codecs.decode(section["secret"]

856

.encode("utf-8"),

857

"base64")

481

858

elif "secfile" in section:

482

859

with open(os.path.expanduser(os.path.expandvars

483

860

(section["secfile"])),

484

861

"rb") as secfile:

485

862

client["secret"] = secfile.read()

486

863

else:

487

raise TypeError("No secret or secfile for section %s"

488

% section)

864

raise TypeError("No secret or secfile for section {}"

865

.format(section))

489

866

client["timeout"] = string_to_delta(section["timeout"])

490

867

client["extended_timeout"] = string_to_delta(

491

868

section["extended_timeout"])

497

874

client["checker_command"] = section["checker"]

498

875

client["last_approval_request"] = None

499

876

client["last_checked_ok"] = None

500

client["last_checker_status"] = None

501

if client["enabled"]:

502

client["last_enabled"] = datetime.datetime.utcnow()

503

client["expires"] = (datetime.datetime.utcnow()

504

+ client["timeout"])

505

else:

506

client["last_enabled"] = None

507

client["expires"] = None

508

877

client["last_checker_status"] = -2

878

509

879

return settings

510

511

512

def __init__(self, settings, name = None):

513

"""Note: the 'checker' key in 'config' sets the

514

'checker_command' attribute and *not* the 'checker'

515

attribute."""

880

881

def __init__(self, settings, name = None, server_settings=None):

516

882

self.name = name

883

if server_settings is None:

884

server_settings = {}

885

self.server_settings = server_settings

517

886

# adding all client settings

518

for setting, value in settings.iteritems():

887

for setting, value in settings.items():

519

888

setattr(self, setting, value)

520

889

890

if self.enabled:

891

if not hasattr(self, "last_enabled"):

892

self.last_enabled = datetime.datetime.utcnow()

893

if not hasattr(self, "expires"):

894

self.expires = (datetime.datetime.utcnow()

895

+ self.timeout)

896

else:

897

self.last_enabled = None

898

self.expires = None

899

521

900

logger.debug("Creating client %r", self.name)

522

# Uppercase and remove spaces from fingerprint for later

523

# comparison purposes with return value from the fingerprint()

524

# function

525

901

logger.debug(" Fingerprint: %s", self.fingerprint)

526

self.created = settings.get("created", datetime.datetime.utcnow())

527

902

self.created = settings.get("created",

903

datetime.datetime.utcnow())

904

528

905

# attributes specific for this server instance

529

906

self.checker = None

530

907

self.checker_initiator_tag = None

533

910

self.current_checker_command = None

534

911

self.approved = None

535

912

self.approvals_pending = 0

536

self.changedstate = (multiprocessing_manager

537

.Condition(multiprocessing_manager

538

.Lock()))

539

self.client_structure = [attr for attr in

540

self.__dict__.iterkeys()

913

self.changedstate = multiprocessing_manager.Condition(

914

multiprocessing_manager.Lock())

915

self.client_structure = [attr

916

for attr in self.__dict__.keys()

541

917

if not attr.startswith("_")]

542

918

self.client_structure.append("client_structure")

543

919

544

for name, t in inspect.getmembers(type(self),

545

lambda obj:

546

isinstance(obj,

547

property)):

920

for name, t in inspect.getmembers(

921

type(self), lambda obj: isinstance(obj, property)):

548

922

if not name.startswith("_"):

549

923

self.client_structure.append(name)

550

924

558

932

if getattr(self, "enabled", False):

559

933

# Already enabled

560

934

return

561

self.send_changedstate()

562

935

self.expires = datetime.datetime.utcnow() + self.timeout

563

936

self.enabled = True

564

937

self.last_enabled = datetime.datetime.utcnow()

565

938

self.init_checker()

939

self.send_changedstate()

566

940

567

941

def disable(self, quiet=True):

568

942

"""Disable this client."""

569

943

if not getattr(self, "enabled", False):

570

944

return False

571

945

if not quiet:

572

self.send_changedstate()

573

if not quiet:

574

946

logger.info("Disabling client %s", self.name)

575

if getattr(self, "disable_initiator_tag", False):

576

gobject.source_remove(self.disable_initiator_tag)

947

if getattr(self, "disable_initiator_tag", None) is not None:

948

GLib.source_remove(self.disable_initiator_tag)

577

949

self.disable_initiator_tag = None

578

950

self.expires = None

579

if getattr(self, "checker_initiator_tag", False):

580

gobject.source_remove(self.checker_initiator_tag)

951

if getattr(self, "checker_initiator_tag", None) is not None:

952

GLib.source_remove(self.checker_initiator_tag)

581

953

self.checker_initiator_tag = None

582

954

self.stop_checker()

583

955

self.enabled = False

584

# Do not run this again if called by a gobject.timeout_add

956

if not quiet:

957

self.send_changedstate()

958

# Do not run this again if called by a GLib.timeout_add

585

959

return False

586

960

587

961

def __del__(self):

590

964

def init_checker(self):

591

965

# Schedule a new checker to be started an 'interval' from now,

592

966

# and every interval from then on.

593

self.checker_initiator_tag = (gobject.timeout_add

594

(self.interval_milliseconds(),

595

self.start_checker))

967

if self.checker_initiator_tag is not None:

968

GLib.source_remove(self.checker_initiator_tag)

969

self.checker_initiator_tag = GLib.timeout_add(

970

int(self.interval.total_seconds() * 1000),

971

self.start_checker)

596

972

# Schedule a disable() when 'timeout' has passed

597

self.disable_initiator_tag = (gobject.timeout_add

598

(self.timeout_milliseconds(),

599

self.disable))

973

if self.disable_initiator_tag is not None:

974

GLib.source_remove(self.disable_initiator_tag)

975

self.disable_initiator_tag = GLib.timeout_add(

976

int(self.timeout.total_seconds() * 1000), self.disable)

600

977

# Also start a new checker *right now*.

601

978

self.start_checker()

602

979

603

def checker_callback(self, pid, condition, command):

980

def checker_callback(self, source, condition, connection,

981

command):

604

982

"""The checker has completed, so take appropriate actions."""

605

983

self.checker_callback_tag = None

606

984

self.checker = None

607

if os.WIFEXITED(condition):

608

self.last_checker_status = os.WEXITSTATUS(condition)

985

# Read return code from connection (see call_pipe)

986

returncode = connection.recv()

987

connection.close()

988

989

if returncode >= 0:

990

self.last_checker_status = returncode

991

self.last_checker_signal = None

609

992

if self.last_checker_status == 0:

610

993

logger.info("Checker for %(name)s succeeded",

611

994

vars(self))

612

995

self.checked_ok()

613

996

else:

614

logger.info("Checker for %(name)s failed",

615

vars(self))

997

logger.info("Checker for %(name)s failed", vars(self))

616

998

else:

617

999

self.last_checker_status = -1

1000

self.last_checker_signal = -returncode

618

1001

logger.warning("Checker for %(name)s crashed?",

619

1002

vars(self))

620

621

def checked_ok(self, timeout=None):

622

"""Bump up the timeout for this client.

623

624

This should only be called when the client has been seen,

625

alive and well.

626

"""

1003

return False

1004

1005

def checked_ok(self):

1006

"""Assert that the client has been seen, alive and well."""

1007

self.last_checked_ok = datetime.datetime.utcnow()

1008

self.last_checker_status = 0

1009

self.last_checker_signal = None

1010

self.bump_timeout()

1011

1012

def bump_timeout(self, timeout=None):

1013

"""Bump up the timeout for this client."""

627

1014

if timeout is None:

628

1015

timeout = self.timeout

629

self.last_checked_ok = datetime.datetime.utcnow()

630

1016

if self.disable_initiator_tag is not None:

631

gobject.source_remove(self.disable_initiator_tag)

1017

GLib.source_remove(self.disable_initiator_tag)

1018

self.disable_initiator_tag = None

632

1019

if getattr(self, "enabled", False):

633

self.disable_initiator_tag = (gobject.timeout_add

634

(timedelta_to_milliseconds

635

(timeout), self.disable))

1020

self.disable_initiator_tag = GLib.timeout_add(

1021

int(timeout.total_seconds() * 1000), self.disable)

636

1022

self.expires = datetime.datetime.utcnow() + timeout

637

1023

638

1024

def need_approval(self):

644

1030

If a checker already exists, leave it running and do

645

1031

nothing."""

646

1032

# The reason for not killing a running checker is that if we

647

# did that, then if a checker (for some reason) started

648

# running slowly and taking more than 'interval' time, the

649

# client would inevitably timeout, since no checker would get

650

# a chance to run to completion. If we instead leave running

1033

# did that, and if a checker (for some reason) started running

1034

# slowly and taking more than 'interval' time, then the client

1035

# would inevitably timeout, since no checker would get a

1036

# chance to run to completion. If we instead leave running

651

1037

# checkers alone, the checker would have to take more time

652

1038

# than 'timeout' for the client to be disabled, which is as it

653

1039

# should be.

654

1040

655

# If a checker exists, make sure it is not a zombie

656

try:

657

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

658

except (AttributeError, OSError) as error:

659

if (isinstance(error, OSError)

660

and error.errno != errno.ECHILD):

661

raise error

662

else:

663

if pid:

664

logger.warning("Checker was a zombie")

665

gobject.source_remove(self.checker_callback_tag)

666

self.checker_callback(pid, status,

667

self.current_checker_command)

1041

if self.checker is not None and not self.checker.is_alive():

1042

logger.warning("Checker was not alive; joining")

1043

self.checker.join()

1044

self.checker = None

668

1045

# Start a new checker if needed

669

1046

if self.checker is None:

1047

# Escape attributes for the shell

1048

escaped_attrs = {

1049

attr: re.escape(str(getattr(self, attr)))

1050

for attr in self.runtime_expansions }

670

1051

try:

671

# In case checker_command has exactly one % operator

672

command = self.checker_command % self.host

673

except TypeError:

674

# Escape attributes for the shell

675

escaped_attrs = dict(

676

(attr,

677

re.escape(unicode(str(getattr(self, attr, "")),

678

errors=

679

'replace')))

680

for attr in

681

self.runtime_expansions)

682

683

try:

684

command = self.checker_command % escaped_attrs

685

except TypeError as error:

686

logger.error('Could not format string "%s":'

687

' %s', self.checker_command, error)

688

return True # Try again later

1052

command = self.checker_command % escaped_attrs

1053

except TypeError as error:

1054

logger.error('Could not format string "%s"',

1055

self.checker_command,

1056

exc_info=error)

1057

return True # Try again later

689

1058

self.current_checker_command = command

690

try:

691

logger.info("Starting checker %r for %s",

692

command, self.name)

693

# We don't need to redirect stdout and stderr, since

694

# in normal mode, that is already done by daemon(),

695

# and in debug mode we don't want to. (Stdin is

696

# always replaced by /dev/null.)

697

self.checker = subprocess.Popen(command,

698

close_fds=True,

699

shell=True, cwd="/")

700

self.checker_callback_tag = (gobject.child_watch_add

701

(self.checker.pid,

702

self.checker_callback,

703

data=command))

704

# The checker may have completed before the gobject

705

# watch was added. Check for this.

706

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

707

if pid:

708

gobject.source_remove(self.checker_callback_tag)

709

self.checker_callback(pid, status, command)

710

except OSError as error:

711

logger.error("Failed to start subprocess: %s",

712

error)

713

# Re-run this periodically if run by gobject.timeout_add

1059

logger.info("Starting checker %r for %s", command,

1060

self.name)

1061

# We don't need to redirect stdout and stderr, since

1062

# in normal mode, that is already done by daemon(),

1063

# and in debug mode we don't want to. (Stdin is

1064

# always replaced by /dev/null.)

1065

# The exception is when not debugging but nevertheless

1066

# running in the foreground; use the previously

1067

# created wnull.

1068

popen_args = { "close_fds": True,

1069

"shell": True,

1070

"cwd": "/" }

1071

if (not self.server_settings["debug"]

1072

and self.server_settings["foreground"]):

1073

popen_args.update({"stdout": wnull,

1074

"stderr": wnull })

1075

pipe = multiprocessing.Pipe(duplex = False)

1076

self.checker = multiprocessing.Process(

1077

target = call_pipe,

1078

args = (pipe[1], subprocess.call, command),

1079

kwargs = popen_args)

1080

self.checker.start()

1081

self.checker_callback_tag = GLib.io_add_watch(

1082

pipe[0].fileno(), GLib.IO_IN,

1083

self.checker_callback, pipe[0], command)

1084

# Re-run this periodically if run by GLib.timeout_add

714

1085

return True

715

1086

716

1087

def stop_checker(self):

717

1088

"""Force the checker process, if any, to stop."""

718

1089

if self.checker_callback_tag:

719

gobject.source_remove(self.checker_callback_tag)

1090

GLib.source_remove(self.checker_callback_tag)

720

1091

self.checker_callback_tag = None

721

1092

if getattr(self, "checker", None) is None:

722

1093

return

723

1094

logger.debug("Stopping checker for %(name)s", vars(self))

724

try:

725

os.kill(self.checker.pid, signal.SIGTERM)

726

#time.sleep(0.5)

727

#if self.checker.poll() is None:

728

# os.kill(self.checker.pid, signal.SIGKILL)

729

except OSError as error:

730

if error.errno != errno.ESRCH: # No such process

731

raise

1095

self.checker.terminate()

732

1096

self.checker = None

733

1097

734

1098

735

def dbus_service_property(dbus_interface, signature="v",

736

access="readwrite", byte_arrays=False):

1099

def dbus_service_property(dbus_interface,

1100

signature="v",

1101

access="readwrite",

1102

byte_arrays=False):

737

1103

"""Decorators for marking methods of a DBusObjectWithProperties to

738

1104

become properties on the D-Bus.

739

1105

748

1114

# "Set" method, so we fail early here:

749

1115

if byte_arrays and signature != "ay":

750

1116

raise ValueError("Byte arrays not supported for non-'ay'"

751

" signature %r" % signature)

1117

" signature {!r}".format(signature))

1118

752

1119

def decorator(func):

753

1120

func._dbus_is_property = True

754

1121

func._dbus_interface = dbus_interface

759

1126

func._dbus_name = func._dbus_name[:-14]

760

1127

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

761

1128

return func

1129

1130

return decorator

1131

1132

1133

def dbus_interface_annotations(dbus_interface):

1134

"""Decorator for marking functions returning interface annotations

1135

1136

Usage:

1137

1138

@dbus_interface_annotations("org.example.Interface")

1139

def _foo(self): # Function name does not matter

1140

return {"org.freedesktop.DBus.Deprecated": "true",

1141

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1142

"false"}

1143

"""

1144

1145

def decorator(func):

1146

func._dbus_is_interface = True

1147

func._dbus_interface = dbus_interface

1148

func._dbus_name = dbus_interface

1149

return func

1150

1151

return decorator

1152

1153

1154

def dbus_annotations(annotations):

1155

"""Decorator to annotate D-Bus methods, signals or properties

1156

Usage:

1157

1158

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1159

"org.freedesktop.DBus.Property."

1160

"EmitsChangedSignal": "false"})

1161

@dbus_service_property("org.example.Interface", signature="b",

1162

access="r")

1163

def Property_dbus_property(self):

1164

return dbus.Boolean(False)

1165

1166

See also the DBusObjectWithAnnotations class.

1167

"""

1168

1169

def decorator(func):

1170

func._dbus_annotations = annotations

1171

return func

1172

762

1173

return decorator

763

1174

764

1175

765

1176

class DBusPropertyException(dbus.exceptions.DBusException):

766

1177

"""A base class for D-Bus property-related exceptions

767

1178

"""

768

def __unicode__(self):

769

return unicode(str(self))

1179

pass

770

1180

771

1181

772

1182

class DBusPropertyAccessException(DBusPropertyException):

781

1191

pass

782

1192

783

1193

784

class DBusObjectWithProperties(dbus.service.Object):

1194

class DBusObjectWithAnnotations(dbus.service.Object):

1195

"""A D-Bus object with annotations.

1196

1197

Classes inheriting from this can use the dbus_annotations

1198

decorator to add annotations to methods or signals.

1199

"""

1200

1201

@staticmethod

1202

def _is_dbus_thing(thing):

1203

"""Returns a function testing if an attribute is a D-Bus thing

1204

1205

If called like _is_dbus_thing("method") it returns a function

1206

suitable for use as predicate to inspect.getmembers().

1207

"""

1208

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1209

False)

1210

1211

def _get_all_dbus_things(self, thing):

1212

"""Returns a generator of (name, attribute) pairs

1213

"""

1214

return ((getattr(athing.__get__(self), "_dbus_name", name),

1215

athing.__get__(self))

1216

for cls in self.__class__.__mro__

1217

for name, athing in

1218

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1219

1220

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1221

out_signature = "s",

1222

path_keyword = 'object_path',

1223

connection_keyword = 'connection')

1224

def Introspect(self, object_path, connection):

1225

"""Overloading of standard D-Bus method.

1226

1227

Inserts annotation tags on methods and signals.

1228

"""

1229

xmlstring = dbus.service.Object.Introspect(self, object_path,

1230

connection)

1231

try:

1232

document = xml.dom.minidom.parseString(xmlstring)

1233

1234

for if_tag in document.getElementsByTagName("interface"):

1235

# Add annotation tags

1236

for typ in ("method", "signal"):

1237

for tag in if_tag.getElementsByTagName(typ):

1238

annots = dict()

1239

for name, prop in (self.

1240

_get_all_dbus_things(typ)):

1241

if (name == tag.getAttribute("name")

1242

and prop._dbus_interface

1243

== if_tag.getAttribute("name")):

1244

annots.update(getattr(

1245

prop, "_dbus_annotations", {}))

1246

for name, value in annots.items():

1247

ann_tag = document.createElement(

1248

"annotation")

1249

ann_tag.setAttribute("name", name)

1250

ann_tag.setAttribute("value", value)

1251

tag.appendChild(ann_tag)

1252

# Add interface annotation tags

1253

for annotation, value in dict(

1254

itertools.chain.from_iterable(

1255

annotations().items()

1256

for name, annotations

1257

in self._get_all_dbus_things("interface")

1258

if name == if_tag.getAttribute("name")

1259

)).items():

1260

ann_tag = document.createElement("annotation")

1261

ann_tag.setAttribute("name", annotation)

1262

ann_tag.setAttribute("value", value)

1263

if_tag.appendChild(ann_tag)

1264

# Fix argument name for the Introspect method itself

1265

if (if_tag.getAttribute("name")

1266

== dbus.INTROSPECTABLE_IFACE):

1267

for cn in if_tag.getElementsByTagName("method"):

1268

if cn.getAttribute("name") == "Introspect":

1269

for arg in cn.getElementsByTagName("arg"):

1270

if (arg.getAttribute("direction")

1271

== "out"):

1272

arg.setAttribute("name",

1273

"xml_data")

1274

xmlstring = document.toxml("utf-8")

1275

document.unlink()

1276

except (AttributeError, xml.dom.DOMException,

1277

xml.parsers.expat.ExpatError) as error:

1278

logger.error("Failed to override Introspection method",

1279

exc_info=error)

1280

return xmlstring

1281

1282

1283

class DBusObjectWithProperties(DBusObjectWithAnnotations):

785

1284

"""A D-Bus object with properties.

786

1285

787

1286

Classes inheriting from this can use the dbus_service_property

789

1288

standard Get(), Set(), and GetAll() methods on the D-Bus.

790

1289

"""

791

1290

792

@staticmethod

793

def _is_dbus_property(obj):

794

return getattr(obj, "_dbus_is_property", False)

795

796

def _get_all_dbus_properties(self):

797

"""Returns a generator of (name, attribute) pairs

798

"""

799

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

800

for cls in self.__class__.__mro__

801

for name, prop in

802

inspect.getmembers(cls, self._is_dbus_property))

803

804

1291

def _get_dbus_property(self, interface_name, property_name):

805

1292

"""Returns a bound method if one exists which is a D-Bus

806

1293

property with the specified name and interface.

807

1294

"""

808

for cls in self.__class__.__mro__:

809

for name, value in (inspect.getmembers

810

(cls, self._is_dbus_property)):

1295

for cls in self.__class__.__mro__:

1296

for name, value in inspect.getmembers(

1297

cls, self._is_dbus_thing("property")):

811

1298

if (value._dbus_name == property_name

812

1299

and value._dbus_interface == interface_name):

813

1300

return value.__get__(self)

814

1301

815

1302

# No such property

816

raise DBusPropertyNotFound(self.dbus_object_path + ":"

817

+ interface_name + "."

818

+ property_name)

819

820

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1303

raise DBusPropertyNotFound("{}:{}.{}".format(

1304

self.dbus_object_path, interface_name, property_name))

1305

1306

@classmethod

1307

def _get_all_interface_names(cls):

1308

"""Get a sequence of all interfaces supported by an object"""

1309

return (name for name in set(getattr(getattr(x, attr),

1310

"_dbus_interface", None)

1311

for x in (inspect.getmro(cls))

1312

for attr in dir(x))

1313

if name is not None)

1314

1315

@dbus.service.method(dbus.PROPERTIES_IFACE,

1316

in_signature="ss",

821

1317

out_signature="v")

822

1318

def Get(self, interface_name, property_name):

823

1319

"""Standard D-Bus property Get() method, see D-Bus standard.

841

1337

# The byte_arrays option is not supported yet on

842

1338

# signatures other than "ay".

843

1339

if prop._dbus_signature != "ay":

844

raise ValueError

845

value = dbus.ByteArray(''.join(unichr(byte)

846

for byte in value))

1340

raise ValueError("Byte arrays not supported for non-"

1341

"'ay' signature {!r}"

1342

.format(prop._dbus_signature))

1343

value = dbus.ByteArray(b''.join(chr(byte)

1344

for byte in value))

847

1345

prop(value)

848

1346

849

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1347

@dbus.service.method(dbus.PROPERTIES_IFACE,

1348

in_signature="s",

850

1349

out_signature="a{sv}")

851

1350

def GetAll(self, interface_name):

852

1351

"""Standard D-Bus property GetAll() method, see D-Bus

855

1354

Note: Will not include properties with access="write".

856

1355

"""

857

1356

properties = {}

858

for name, prop in self._get_all_dbus_properties():

1357

for name, prop in self._get_all_dbus_things("property"):

859

1358

if (interface_name

860

1359

and interface_name != prop._dbus_interface):

861

1360

# Interface non-empty but did not match

867

1366

if not hasattr(value, "variant_level"):

868

1367

properties[name] = value

869

1368

continue

870

properties[name] = type(value)(value, variant_level=

871

value.variant_level+1)

1369

properties[name] = type(value)(

1370

value, variant_level = value.variant_level + 1)

872

1371

return dbus.Dictionary(properties, signature="sv")

873

1372

1373

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1374

def PropertiesChanged(self, interface_name, changed_properties,

1375

invalidated_properties):

1376

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1377

standard.

1378

"""

1379

pass

1380

874

1381

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

875

1382

out_signature="s",

876

1383

path_keyword='object_path',

877

1384

connection_keyword='connection')

878

1385

def Introspect(self, object_path, connection):

879

"""Standard D-Bus method, overloaded to insert property tags.

1386

"""Overloading of standard D-Bus method.

1387

1388

Inserts property tags and interface annotation tags.

880

1389

"""

881

xmlstring = dbus.service.Object.Introspect(self, object_path,

882

connection)

1390

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1391

object_path,

1392

connection)

883

1393

try:

884

1394

document = xml.dom.minidom.parseString(xmlstring)

1395

885

1396

def make_tag(document, name, prop):

886

1397

e = document.createElement("property")

887

1398

e.setAttribute("name", name)

888

1399

e.setAttribute("type", prop._dbus_signature)

889

1400

e.setAttribute("access", prop._dbus_access)

890

1401

return e

1402

891

1403

for if_tag in document.getElementsByTagName("interface"):

1404

# Add property tags

892

1405

for tag in (make_tag(document, name, prop)

893

1406

for name, prop

894

in self._get_all_dbus_properties()

1407

in self._get_all_dbus_things("property")

895

1408

if prop._dbus_interface

896

1409

== if_tag.getAttribute("name")):

897

1410

if_tag.appendChild(tag)

1411

# Add annotation tags for properties

1412

for tag in if_tag.getElementsByTagName("property"):

1413

annots = dict()

1414

for name, prop in self._get_all_dbus_things(

1415

"property"):

1416

if (name == tag.getAttribute("name")

1417

and prop._dbus_interface

1418

== if_tag.getAttribute("name")):

1419

annots.update(getattr(

1420

prop, "_dbus_annotations", {}))

1421

for name, value in annots.items():

1422

ann_tag = document.createElement(

1423

"annotation")

1424

ann_tag.setAttribute("name", name)

1425

ann_tag.setAttribute("value", value)

1426

tag.appendChild(ann_tag)

898

1427

# Add the names to the return values for the

899

1428

# "org.freedesktop.DBus.Properties" methods

900

1429

if (if_tag.getAttribute("name")

915

1444

except (AttributeError, xml.dom.DOMException,

916

1445

xml.parsers.expat.ExpatError) as error:

917

1446

logger.error("Failed to override Introspection method",

918

error)

919

return xmlstring

920

921

922

def datetime_to_dbus (dt, variant_level=0):

1447

exc_info=error)

1448

return xmlstring

1449

1450

try:

1451

dbus.OBJECT_MANAGER_IFACE

1452

except AttributeError:

1453

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1454

1455

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1456

"""A D-Bus object with an ObjectManager.

1457

1458

Classes inheriting from this exposes the standard

1459

GetManagedObjects call and the InterfacesAdded and

1460

InterfacesRemoved signals on the standard

1461

"org.freedesktop.DBus.ObjectManager" interface.

1462

1463

Note: No signals are sent automatically; they must be sent

1464

manually.

1465

"""

1466

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1467

out_signature = "a{oa{sa{sv}}}")

1468

def GetManagedObjects(self):

1469

"""This function must be overridden"""

1470

raise NotImplementedError()

1471

1472

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1473

signature = "oa{sa{sv}}")

1474

def InterfacesAdded(self, object_path, interfaces_and_properties):

1475

pass

1476

1477

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1478

def InterfacesRemoved(self, object_path, interfaces):

1479

pass

1480

1481

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1482

out_signature = "s",

1483

path_keyword = 'object_path',

1484

connection_keyword = 'connection')

1485

def Introspect(self, object_path, connection):

1486

"""Overloading of standard D-Bus method.

1487

1488

Override return argument name of GetManagedObjects to be

1489

"objpath_interfaces_and_properties"

1490

"""

1491

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1492

object_path,

1493

connection)

1494

try:

1495

document = xml.dom.minidom.parseString(xmlstring)

1496

1497

for if_tag in document.getElementsByTagName("interface"):

1498

# Fix argument name for the GetManagedObjects method

1499

if (if_tag.getAttribute("name")

1500

== dbus.OBJECT_MANAGER_IFACE):

1501

for cn in if_tag.getElementsByTagName("method"):

1502

if (cn.getAttribute("name")

1503

== "GetManagedObjects"):

1504

for arg in cn.getElementsByTagName("arg"):

1505

if (arg.getAttribute("direction")

1506

== "out"):

1507

arg.setAttribute(

1508

"name",

1509

"objpath_interfaces"

1510

"_and_properties")

1511

xmlstring = document.toxml("utf-8")

1512

document.unlink()

1513

except (AttributeError, xml.dom.DOMException,

1514

xml.parsers.expat.ExpatError) as error:

1515

logger.error("Failed to override Introspection method",

1516

exc_info = error)

1517

return xmlstring

1518

1519

def datetime_to_dbus(dt, variant_level=0):

923

1520

"""Convert a UTC datetime.datetime() to a D-Bus type."""

924

1521

if dt is None:

925

1522

return dbus.String("", variant_level = variant_level)

926

return dbus.String(dt.isoformat(),

927

variant_level=variant_level)

928

929

930

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

931

.__metaclass__):

932

"""Applied to an empty subclass of a D-Bus object, this metaclass

933

will add additional D-Bus attributes matching a certain pattern.

1523

return dbus.String(dt.isoformat(), variant_level=variant_level)

1524

1525

1526

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1527

"""A class decorator; applied to a subclass of

1528

dbus.service.Object, it will add alternate D-Bus attributes with

1529

interface names according to the "alt_interface_names" mapping.

1530

Usage:

1531

1532

@alternate_dbus_interfaces({"org.example.Interface":

1533

"net.example.AlternateInterface"})

1534

class SampleDBusObject(dbus.service.Object):

1535

@dbus.service.method("org.example.Interface")

1536

def SampleDBusMethod():

1537

pass

1538

1539

The above "SampleDBusMethod" on "SampleDBusObject" will be

1540

reachable via two interfaces: "org.example.Interface" and

1541

"net.example.AlternateInterface", the latter of which will have

1542

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1543

"true", unless "deprecate" is passed with a False value.

1544

1545

This works for methods and signals, and also for D-Bus properties

1546

(from DBusObjectWithProperties) and interfaces (from the

1547

dbus_interface_annotations decorator).

934

1548

"""

935

def __new__(mcs, name, bases, attr):

936

# Go through all the base classes which could have D-Bus

937

# methods, signals, or properties in them

938

for base in (b for b in bases

939

if issubclass(b, dbus.service.Object)):

940

# Go though all attributes of the base class

941

for attrname, attribute in inspect.getmembers(base):

1549

1550

def wrapper(cls):

1551

for orig_interface_name, alt_interface_name in (

1552

alt_interface_names.items()):

1553

attr = {}

1554

interface_names = set()

1555

# Go though all attributes of the class

1556

for attrname, attribute in inspect.getmembers(cls):

942

1557

# Ignore non-D-Bus attributes, and D-Bus attributes

943

1558

# with the wrong interface name

944

1559

if (not hasattr(attribute, "_dbus_interface")

945

or not attribute._dbus_interface

946

.startswith("se.recompile.Mandos")):

1560

or not attribute._dbus_interface.startswith(

1561

orig_interface_name)):

947

1562

continue

948

1563

# Create an alternate D-Bus interface name based on

949

1564

# the current name

950

alt_interface = (attribute._dbus_interface

951

.replace("se.recompile.Mandos",

952

"se.bsnet.fukt.Mandos"))

1565

alt_interface = attribute._dbus_interface.replace(

1566

orig_interface_name, alt_interface_name)

1567

interface_names.add(alt_interface)

953

1568

# Is this a D-Bus signal?

954

1569

if getattr(attribute, "_dbus_is_signal", False):

955

# Extract the original non-method function by

956

# black magic

957

nonmethod_func = (dict(

1570

# Extract the original non-method undecorated

1571

# function by black magic

1572

if sys.version_info.major == 2:

1573

nonmethod_func = (dict(

958

1574

zip(attribute.func_code.co_freevars,

959

attribute.__closure__))["func"]

960

.cell_contents)

1575

attribute.__closure__))

1576

["func"].cell_contents)

1577

else:

1578

nonmethod_func = (dict(

1579

zip(attribute.__code__.co_freevars,

1580

attribute.__closure__))

1581

["func"].cell_contents)

961

1582

# Create a new, but exactly alike, function

962

1583

# object, and decorate it to be a new D-Bus signal

963

1584

# with the alternate D-Bus interface name

964

new_function = (dbus.service.signal

965

(alt_interface,

966

attribute._dbus_signature)

967

(types.FunctionType(

968

nonmethod_func.func_code,

969

nonmethod_func.func_globals,

970

nonmethod_func.func_name,

971

nonmethod_func.func_defaults,

972

nonmethod_func.func_closure)))

1585

new_function = copy_function(nonmethod_func)

1586

new_function = (dbus.service.signal(

1587

alt_interface,

1588

attribute._dbus_signature)(new_function))

1589

# Copy annotations, if any

1590

try:

1591

new_function._dbus_annotations = dict(

1592

attribute._dbus_annotations)

1593

except AttributeError:

1594

pass

973

1595

# Define a creator of a function to call both the

974

# old and new functions, so both the old and new

975

# signals gets sent when the function is called

1596

# original and alternate functions, so both the

1597

# original and alternate signals gets sent when

1598

# the function is called

976

1599

def fixscope(func1, func2):

977

1600

"""This function is a scope container to pass

978

1601

func1 and func2 to the "call_both" function

979

1602

outside of its arguments"""

1603

1604

@functools.wraps(func2)

980

1605

def call_both(*args, **kwargs):

981

1606

"""This function will emit two D-Bus

982

1607

signals by calling func1 and func2"""

983

1608

func1(*args, **kwargs)

984

1609

func2(*args, **kwargs)

1610

# Make wrapper function look like a D-Bus signal

1611

for name, attr in inspect.getmembers(func2):

1612

if name.startswith("_dbus_"):

1613

setattr(call_both, name, attr)

1614

985

1615

return call_both

986

1616

# Create the "call_both" function and add it to

987

1617

# the class

988

attr[attrname] = fixscope(attribute,

989

new_function)

1618

attr[attrname] = fixscope(attribute, new_function)

990

1619

# Is this a D-Bus method?

991

1620

elif getattr(attribute, "_dbus_is_method", False):

992

1621

# Create a new, but exactly alike, function

993

1622

# object. Decorate it to be a new D-Bus method

994

1623

# with the alternate D-Bus interface name. Add it

995

1624

# to the class.

996

attr[attrname] = (dbus.service.method

997

(alt_interface,

998

attribute._dbus_in_signature,

999

attribute._dbus_out_signature)

1000

(types.FunctionType

1001

(attribute.func_code,

1002

attribute.func_globals,

1003

attribute.func_name,

1004

attribute.func_defaults,

1005

attribute.func_closure)))

1625

attr[attrname] = (

1626

dbus.service.method(

1627

alt_interface,

1628

attribute._dbus_in_signature,

1629

attribute._dbus_out_signature)

1630

(copy_function(attribute)))

1631

# Copy annotations, if any

1632

try:

1633

attr[attrname]._dbus_annotations = dict(

1634

attribute._dbus_annotations)

1635

except AttributeError:

1636

pass

1006

1637

# Is this a D-Bus property?

1007

1638

elif getattr(attribute, "_dbus_is_property", False):

1008

1639

# Create a new, but exactly alike, function

1009

1640

# object, and decorate it to be a new D-Bus

1010

1641

# property with the alternate D-Bus interface

1011

1642

# name. Add it to the class.

1012

attr[attrname] = (dbus_service_property

1013

(alt_interface,

1014

attribute._dbus_signature,

1015

attribute._dbus_access,

1016

attribute

1017

._dbus_get_args_options

1018

["byte_arrays"])

1019

(types.FunctionType

1020

(attribute.func_code,

1021

attribute.func_globals,

1022

attribute.func_name,

1023

attribute.func_defaults,

1024

attribute.func_closure)))

1025

return type.__new__(mcs, name, bases, attr)

1026

1027

1643

attr[attrname] = (dbus_service_property(

1644

alt_interface, attribute._dbus_signature,

1645

attribute._dbus_access,

1646

attribute._dbus_get_args_options

1647

["byte_arrays"])

1648

(copy_function(attribute)))

1649

# Copy annotations, if any

1650

try:

1651

attr[attrname]._dbus_annotations = dict(

1652

attribute._dbus_annotations)

1653

except AttributeError:

1654

pass

1655

# Is this a D-Bus interface?

1656

elif getattr(attribute, "_dbus_is_interface", False):

1657

# Create a new, but exactly alike, function

1658

# object. Decorate it to be a new D-Bus interface

1659

# with the alternate D-Bus interface name. Add it

1660

# to the class.

1661

attr[attrname] = (

1662

dbus_interface_annotations(alt_interface)

1663

(copy_function(attribute)))

1664

if deprecate:

1665

# Deprecate all alternate interfaces

1666

iname="_AlternateDBusNames_interface_annotation{}"

1667

for interface_name in interface_names:

1668

1669

@dbus_interface_annotations(interface_name)

1670

def func(self):

1671

return { "org.freedesktop.DBus.Deprecated":

1672

"true" }

1673

# Find an unused name

1674

for aname in (iname.format(i)

1675

for i in itertools.count()):

1676

if aname not in attr:

1677

attr[aname] = func

1678

break

1679

if interface_names:

1680

# Replace the class with a new subclass of it with

1681

# methods, signals, etc. as created above.

1682

if sys.version_info.major == 2:

1683

cls = type(b"{}Alternate".format(cls.__name__),

1684

(cls, ), attr)

1685

else:

1686

cls = type("{}Alternate".format(cls.__name__),

1687

(cls, ), attr)

1688

return cls

1689

1690

return wrapper

1691

1692

1693

@alternate_dbus_interfaces({"se.recompile.Mandos":

1694

"se.bsnet.fukt.Mandos"})

1028

1695

class ClientDBus(Client, DBusObjectWithProperties):

1029

1696

"""A Client class using D-Bus

1030

1697

1034

1701

"""

1035

1702

1036

1703

runtime_expansions = (Client.runtime_expansions

1037

+ ("dbus_object_path",))

1704

+ ("dbus_object_path", ))

1705

1706

_interface = "se.recompile.Mandos.Client"

1038

1707

1039

1708

# dbus.service.Object doesn't use super(), so we can't either.

1040

1709

1041

1710

def __init__(self, bus = None, *args, **kwargs):

1042

1711

self.bus = bus

1043

1712

Client.__init__(self, *args, **kwargs)

1044

self._approvals_pending = 0

1045

1046

self._approvals_pending = 0

1047

1713

# Only now, when this client is initialized, can it show up on

1048

1714

# the D-Bus

1049

client_object_name = unicode(self.name).translate(

1715

client_object_name = str(self.name).translate(

1050

1716

{ord("."): ord("_"),

1051

1717

ord("-"): ord("_")})

1052

self.dbus_object_path = (dbus.ObjectPath

1053

("/clients/" + client_object_name))

1718

self.dbus_object_path = dbus.ObjectPath(

1719

"/clients/" + client_object_name)

1054

1720

DBusObjectWithProperties.__init__(self, self.bus,

1055

1721

self.dbus_object_path)

1056

1057

def notifychangeproperty(transform_func,

1058

dbus_name, type_func=lambda x: x,

1059

variant_level=1):

1722

1723

def notifychangeproperty(transform_func, dbus_name,

1724

type_func=lambda x: x,

1725

variant_level=1,

1726

invalidate_only=False,

1727

_interface=_interface):

1060

1728

""" Modify a variable so that it's a property which announces

1061

1729

its changes to DBus.

1062

1730

1067

1735

to the D-Bus. Default: no transform

1068

1736

variant_level: D-Bus variant level. Default: 1

1069

1737

"""

1070

attrname = "_{0}".format(dbus_name)

1738

attrname = "_{}".format(dbus_name)

1739

1071

1740

def setter(self, value):

1072

1741

if hasattr(self, "dbus_object_path"):

1073

1742

if (not hasattr(self, attrname) or

1074

1743

type_func(getattr(self, attrname, None))

1075

1744

!= type_func(value)):

1076

dbus_value = transform_func(type_func(value),

1077

variant_level

1078

=variant_level)

1079

self.PropertyChanged(dbus.String(dbus_name),

1080

dbus_value)

1745

if invalidate_only:

1746

self.PropertiesChanged(

1747

_interface, dbus.Dictionary(),

1748

dbus.Array((dbus_name, )))

1749

else:

1750

dbus_value = transform_func(

1751

type_func(value),

1752

variant_level = variant_level)

1753

self.PropertyChanged(dbus.String(dbus_name),

1754

dbus_value)

1755

self.PropertiesChanged(

1756

_interface,

1757

dbus.Dictionary({ dbus.String(dbus_name):

1758

dbus_value }),

1759

dbus.Array())

1081

1760

setattr(self, attrname, value)

1082

1761

1083

1762

return property(lambda self: getattr(self, attrname), setter)

1084

1763

1085

1086

1764

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1087

1765

approvals_pending = notifychangeproperty(dbus.Boolean,

1088

1766

"ApprovalPending",

1090

1768

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1091

1769

last_enabled = notifychangeproperty(datetime_to_dbus,

1092

1770

"LastEnabled")

1093

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1094

type_func = lambda checker:

1095

checker is not None)

1771

checker = notifychangeproperty(

1772

dbus.Boolean, "CheckerRunning",

1773

type_func = lambda checker: checker is not None)

1096

1774

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1097

1775

"LastCheckedOK")

1776

last_checker_status = notifychangeproperty(dbus.Int16,

1777

"LastCheckerStatus")

1098

1778

last_approval_request = notifychangeproperty(

1099

1779

datetime_to_dbus, "LastApprovalRequest")

1100

1780

approved_by_default = notifychangeproperty(dbus.Boolean,

1101

1781

"ApprovedByDefault")

1102

approval_delay = notifychangeproperty(dbus.UInt64,

1103

"ApprovalDelay",

1104

type_func =

1105

timedelta_to_milliseconds)

1782

approval_delay = notifychangeproperty(

1783

dbus.UInt64, "ApprovalDelay",

1784

type_func = lambda td: td.total_seconds() * 1000)

1106

1785

approval_duration = notifychangeproperty(

1107

1786

dbus.UInt64, "ApprovalDuration",

1108

type_func = timedelta_to_milliseconds)

1787

type_func = lambda td: td.total_seconds() * 1000)

1109

1788

host = notifychangeproperty(dbus.String, "Host")

1110

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1111

type_func =

1112

timedelta_to_milliseconds)

1789

timeout = notifychangeproperty(

1790

dbus.UInt64, "Timeout",

1791

type_func = lambda td: td.total_seconds() * 1000)

1113

1792

extended_timeout = notifychangeproperty(

1114

1793

dbus.UInt64, "ExtendedTimeout",

1115

type_func = timedelta_to_milliseconds)

1116

interval = notifychangeproperty(dbus.UInt64,

1117

"Interval",

1118

type_func =

1119

timedelta_to_milliseconds)

1794

type_func = lambda td: td.total_seconds() * 1000)

1795

interval = notifychangeproperty(

1796

dbus.UInt64, "Interval",

1797

type_func = lambda td: td.total_seconds() * 1000)

1120

1798

checker_command = notifychangeproperty(dbus.String, "Checker")

1799

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1800

invalidate_only=True)

1121

1801

1122

1802

del notifychangeproperty

1123

1803

1130

1810

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1131

1811

Client.__del__(self, *args, **kwargs)

1132

1812

1133

def checker_callback(self, pid, condition, command,

1134

*args, **kwargs):

1135

self.checker_callback_tag = None

1136

self.checker = None

1137

if os.WIFEXITED(condition):

1138

exitstatus = os.WEXITSTATUS(condition)

1813

def checker_callback(self, source, condition,

1814

connection, command, *args, **kwargs):

1815

ret = Client.checker_callback(self, source, condition,

1816

connection, command, *args,

1817

**kwargs)

1818

exitstatus = self.last_checker_status

1819

if exitstatus >= 0:

1139

1820

# Emit D-Bus signal

1140

1821

self.CheckerCompleted(dbus.Int16(exitstatus),

1141

dbus.Int64(condition),

1822

# This is specific to GNU libC

1823

dbus.Int64(exitstatus << 8),

1142

1824

dbus.String(command))

1143

1825

else:

1144

1826

# Emit D-Bus signal

1145

1827

self.CheckerCompleted(dbus.Int16(-1),

1146

dbus.Int64(condition),

1828

dbus.Int64(

1829

# This is specific to GNU libC

1830

(exitstatus << 8)

1831

| self.last_checker_signal),

1147

1832

dbus.String(command))

1148

1149

return Client.checker_callback(self, pid, condition, command,

1150

*args, **kwargs)

1833

return ret

1151

1834

1152

1835

def start_checker(self, *args, **kwargs):

1153

old_checker = self.checker

1154

if self.checker is not None:

1155

old_checker_pid = self.checker.pid

1156

else:

1157

old_checker_pid = None

1836

old_checker_pid = getattr(self.checker, "pid", None)

1158

1837

r = Client.start_checker(self, *args, **kwargs)

1159

1838

# Only if new checker process was started

1160

1839

if (self.checker is not None

1168

1847

return False

1169

1848

1170

1849

def approve(self, value=True):

1171

self.send_changedstate()

1172

1850

self.approved = value

1173

gobject.timeout_add(timedelta_to_milliseconds

1174

(self.approval_duration),

1175

self._reset_approved)

1176

1851

GLib.timeout_add(int(self.approval_duration.total_seconds()

1852

* 1000), self._reset_approved)

1853

self.send_changedstate()

1177

1854

1178

1855

## D-Bus methods, signals & properties

1179

_interface = "se.recompile.Mandos.Client"

1856

1857

## Interfaces

1180

1858

1181

1859

## Signals

1182

1860

1193

1871

pass

1194

1872

1195

1873

# PropertyChanged - signal

1874

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1196

1875

@dbus.service.signal(_interface, signature="sv")

1197

1876

def PropertyChanged(self, property, value):

1198

1877

"D-Bus signal"

1219

1898

"D-Bus signal"

1220

1899

return self.need_approval()

1221

1900

1222

# NeRwequest - signal

1223

@dbus.service.signal(_interface, signature="s")

1224

def NewRequest(self, ip):

1225

"""D-Bus signal

1226

Is sent after a client request a password.

1227

"""

1228

pass

1229

1230

1901

## Methods

1231

1902

1232

1903

# Approve - method

1240

1911

self.checked_ok()

1241

1912

1242

1913

# Enable - method

1914

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1243

1915

@dbus.service.method(_interface)

1244

1916

def Enable(self):

1245

1917

"D-Bus method"

1246

1918

self.enable()

1247

1919

1248

1920

# StartChecker - method

1921

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1249

1922

@dbus.service.method(_interface)

1250

1923

def StartChecker(self):

1251

1924

"D-Bus method"

1252

1925

self.start_checker()

1253

1926

1254

1927

# Disable - method

1928

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1255

1929

@dbus.service.method(_interface)

1256

1930

def Disable(self):

1257

1931

"D-Bus method"

1258

1932

self.disable()

1259

1933

1260

1934

# StopChecker - method

1935

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1261

1936

@dbus.service.method(_interface)

1262

1937

def StopChecker(self):

1263

1938

self.stop_checker()

1270

1945

return dbus.Boolean(bool(self.approvals_pending))

1271

1946

1272

1947

# ApprovedByDefault - property

1273

@dbus_service_property(_interface, signature="b",

1948

@dbus_service_property(_interface,

1949

signature="b",

1274

1950

access="readwrite")

1275

1951

def ApprovedByDefault_dbus_property(self, value=None):

1276

1952

if value is None: # get

1278

1954

self.approved_by_default = bool(value)

1279

1955

1280

1956

# ApprovalDelay - property

1281

@dbus_service_property(_interface, signature="t",

1957

@dbus_service_property(_interface,

1958

signature="t",

1282

1959

access="readwrite")

1283

1960

def ApprovalDelay_dbus_property(self, value=None):

1284

1961

if value is None: # get

1285

return dbus.UInt64(self.approval_delay_milliseconds())

1962

return dbus.UInt64(self.approval_delay.total_seconds()

1963

* 1000)

1286

1964

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1287

1965

1288

1966

# ApprovalDuration - property

1289

@dbus_service_property(_interface, signature="t",

1967

@dbus_service_property(_interface,

1968

signature="t",

1290

1969

access="readwrite")

1291

1970

def ApprovalDuration_dbus_property(self, value=None):

1292

1971

if value is None: # get

1293

return dbus.UInt64(timedelta_to_milliseconds(

1294

self.approval_duration))

1972

return dbus.UInt64(self.approval_duration.total_seconds()

1973

* 1000)

1295

1974

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1296

1975

1297

1976

# Name - property

1977

@dbus_annotations(

1978

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1298

1979

@dbus_service_property(_interface, signature="s", access="read")

1299

1980

def Name_dbus_property(self):

1300

1981

return dbus.String(self.name)

1301

1982

1302

1983

# Fingerprint - property

1984

@dbus_annotations(

1985

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1303

1986

@dbus_service_property(_interface, signature="s", access="read")

1304

1987

def Fingerprint_dbus_property(self):

1305

1988

return dbus.String(self.fingerprint)

1306

1989

1307

1990

# Host - property

1308

@dbus_service_property(_interface, signature="s",

1991

@dbus_service_property(_interface,

1992

signature="s",

1309

1993

access="readwrite")

1310

1994

def Host_dbus_property(self, value=None):

1311

1995

if value is None: # get

1312

1996

return dbus.String(self.host)

1313

self.host = unicode(value)

1997

self.host = str(value)

1314

1998

1315

1999

# Created - property

2000

@dbus_annotations(

2001

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1316

2002

@dbus_service_property(_interface, signature="s", access="read")

1317

2003

def Created_dbus_property(self):

1318

2004

return datetime_to_dbus(self.created)

1323

2009

return datetime_to_dbus(self.last_enabled)

1324

2010

1325

2011

# Enabled - property

1326

@dbus_service_property(_interface, signature="b",

2012

@dbus_service_property(_interface,

2013

signature="b",

1327

2014

access="readwrite")

1328

2015

def Enabled_dbus_property(self, value=None):

1329

2016

if value is None: # get

1334

2021

self.disable()

1335

2022

1336

2023

# LastCheckedOK - property

1337

@dbus_service_property(_interface, signature="s",

2024

@dbus_service_property(_interface,

2025

signature="s",

1338

2026

access="readwrite")

1339

2027

def LastCheckedOK_dbus_property(self, value=None):

1340

2028

if value is not None:

1342

2030

return

1343

2031

return datetime_to_dbus(self.last_checked_ok)

1344

2032

2033

# LastCheckerStatus - property

2034

@dbus_service_property(_interface, signature="n", access="read")

2035

def LastCheckerStatus_dbus_property(self):

2036

return dbus.Int16(self.last_checker_status)

2037

1345

2038

# Expires - property

1346

2039

@dbus_service_property(_interface, signature="s", access="read")

1347

2040

def Expires_dbus_property(self):

1353

2046

return datetime_to_dbus(self.last_approval_request)

1354

2047

1355

2048

# Timeout - property

1356

@dbus_service_property(_interface, signature="t",

2049

@dbus_service_property(_interface,

2050

signature="t",

1357

2051

access="readwrite")

1358

2052

def Timeout_dbus_property(self, value=None):

1359

2053

if value is None: # get

1360

return dbus.UInt64(self.timeout_milliseconds())

2054

return dbus.UInt64(self.timeout.total_seconds() * 1000)

2055

old_timeout = self.timeout

1361

2056

self.timeout = datetime.timedelta(0, 0, 0, value)

1362

if getattr(self, "disable_initiator_tag", None) is None:

1363

return

1364

# Reschedule timeout

1365

gobject.source_remove(self.disable_initiator_tag)

1366

self.disable_initiator_tag = None

1367

self.expires = None

1368

time_to_die = timedelta_to_milliseconds((self

1369

.last_checked_ok

1370

+ self.timeout)

1371

- datetime.datetime

1372

.utcnow())

1373

if time_to_die <= 0:

1374

# The timeout has passed

1375

self.disable()

1376

else:

1377

self.expires = (datetime.datetime.utcnow()

1378

+ datetime.timedelta(milliseconds =

1379

time_to_die))

1380

self.disable_initiator_tag = (gobject.timeout_add

1381

(time_to_die, self.disable))

2057

# Reschedule disabling

2058

if self.enabled:

2059

now = datetime.datetime.utcnow()

2060

self.expires += self.timeout - old_timeout

2061

if self.expires <= now:

2062

# The timeout has passed

2063

self.disable()

2064

else:

2065

if (getattr(self, "disable_initiator_tag", None)

2066

is None):

2067

return

2068

GLib.source_remove(self.disable_initiator_tag)

2069

self.disable_initiator_tag = GLib.timeout_add(

2070

int((self.expires - now).total_seconds() * 1000),

2071

self.disable)

1382

2072

1383

2073

# ExtendedTimeout - property

1384

@dbus_service_property(_interface, signature="t",

2074

@dbus_service_property(_interface,

2075

signature="t",

1385

2076

access="readwrite")

1386

2077

def ExtendedTimeout_dbus_property(self, value=None):

1387

2078

if value is None: # get

1388

return dbus.UInt64(self.extended_timeout_milliseconds())

2079

return dbus.UInt64(self.extended_timeout.total_seconds()

2080

* 1000)

1389

2081

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1390

2082

1391

2083

# Interval - property

1392

@dbus_service_property(_interface, signature="t",

2084

@dbus_service_property(_interface,

2085

signature="t",

1393

2086

access="readwrite")

1394

2087

def Interval_dbus_property(self, value=None):

1395

2088

if value is None: # get

1396

return dbus.UInt64(self.interval_milliseconds())

2089

return dbus.UInt64(self.interval.total_seconds() * 1000)

1397

2090

self.interval = datetime.timedelta(0, 0, 0, value)

1398

2091

if getattr(self, "checker_initiator_tag", None) is None:

1399

2092

return

1400

2093

if self.enabled:

1401

2094

# Reschedule checker run

1402

gobject.source_remove(self.checker_initiator_tag)

1403

self.checker_initiator_tag = (gobject.timeout_add

1404

(value, self.start_checker))

1405

self.start_checker() # Start one now, too

2095

GLib.source_remove(self.checker_initiator_tag)

2096

self.checker_initiator_tag = GLib.timeout_add(

2097

value, self.start_checker)

2098

self.start_checker() # Start one now, too

1406

2099

1407

2100

# Checker - property

1408

@dbus_service_property(_interface, signature="s",

2101

@dbus_service_property(_interface,

2102

signature="s",

1409

2103

access="readwrite")

1410

2104

def Checker_dbus_property(self, value=None):

1411

2105

if value is None: # get

1412

2106

return dbus.String(self.checker_command)

1413

self.checker_command = unicode(value)

2107

self.checker_command = str(value)

1414

2108

1415

2109

# CheckerRunning - property

1416

@dbus_service_property(_interface, signature="b",

2110

@dbus_service_property(_interface,

2111

signature="b",

1417

2112

access="readwrite")

1418

2113

def CheckerRunning_dbus_property(self, value=None):

1419

2114

if value is None: # get

1424

2119

self.stop_checker()

1425

2120

1426

2121

# ObjectPath - property

2122

@dbus_annotations(

2123

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2124

"org.freedesktop.DBus.Deprecated": "true"})

1427

2125

@dbus_service_property(_interface, signature="o", access="read")

1428

2126

def ObjectPath_dbus_property(self):

1429

2127

return self.dbus_object_path # is already a dbus.ObjectPath

1430

2128

1431

2129

# Secret = property

1432

@dbus_service_property(_interface, signature="ay",

1433

access="write", byte_arrays=True)

2130

@dbus_annotations(

2131

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2132

"invalidates"})

2133

@dbus_service_property(_interface,

2134

signature="ay",

2135

access="write",

2136

byte_arrays=True)

1434

2137

def Secret_dbus_property(self, value):

1435

self.secret = str(value)

2138

self.secret = bytes(value)

1436

2139

1437

2140

del _interface

1438

2141

1442

2145

self._pipe = child_pipe

1443

2146

self._pipe.send(('init', fpr, address))

1444

2147

if not self._pipe.recv():

1445

raise KeyError()

2148

raise KeyError(fpr)

1446

2149

1447

2150

def __getattribute__(self, name):

1448

2151

if name == '_pipe':

1452

2155

if data[0] == 'data':

1453

2156

return data[1]

1454

2157

if data[0] == 'function':

2158

1455

2159

def func(*args, **kwargs):

1456

2160

self._pipe.send(('funcall', name, args, kwargs))

1457

2161

return self._pipe.recv()[1]

2162

1458

2163

return func

1459

2164

1460

2165

def __setattr__(self, name, value):

1463

2168

self._pipe.send(('setattr', name, value))

1464

2169

1465

2170

1466

class ClientDBusTransitional(ClientDBus):

1467

__metaclass__ = AlternateDBusNamesMetaclass

1468

1469

1470

2171

class ClientHandler(socketserver.BaseRequestHandler, object):

1471

2172

"""A class to handle client connections.

1472

2173

1476

2177

def handle(self):

1477

2178

with contextlib.closing(self.server.child_pipe) as child_pipe:

1478

2179

logger.info("TCP connection from: %s",

1479

unicode(self.client_address))

2180

str(self.client_address))

1480

2181

logger.debug("Pipe FD: %d",

1481

2182

self.server.child_pipe.fileno())

1482

2183

1483

session = (gnutls.connection

1484

.ClientSession(self.request,

1485

gnutls.connection

1486

.X509Credentials()))

1487

1488

# Note: gnutls.connection.X509Credentials is really a

1489

# generic GnuTLS certificate credentials object so long as

1490

# no X.509 keys are added to it. Therefore, we can use it

1491

# here despite using OpenPGP certificates.

2184

session = gnutls.ClientSession(self.request)

1492

2185

1493

2186

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1494

2187

# "+AES-256-CBC", "+SHA1",

1498

2191

priority = self.server.gnutls_priority

1499

2192

if priority is None:

1500

2193

priority = "NORMAL"

1501

(gnutls.library.functions

1502

.gnutls_priority_set_direct(session._c_object,

1503

priority, None))

2194

gnutls.priority_set_direct(session._c_object,

2195

priority.encode("utf-8"),

2196

None)

1504

2197

1505

2198

# Start communication using the Mandos protocol

1506

2199

# Get protocol number

1508

2201

logger.debug("Protocol version: %r", line)

1509

2202

try:

1510

2203

if int(line.strip().split()[0]) > 1:

1511

raise RuntimeError

2204

raise RuntimeError(line)

1512

2205

except (ValueError, IndexError, RuntimeError) as error:

1513

2206

logger.error("Unknown protocol version: %s", error)

1514

2207

return

1516

2209

# Start GnuTLS connection

1517

2210

try:

1518

2211

session.handshake()

1519

except gnutls.errors.GNUTLSError as error:

2212

except gnutls.Error as error:

1520

2213

logger.warning("Handshake failed: %s", error)

1521

2214

# Do not run session.bye() here: the session is not

1522

2215

# established. Just abandon the request.

1526

2219

approval_required = False

1527

2220

try:

1528

2221

try:

1529

fpr = self.fingerprint(self.peer_certificate

1530

(session))

1531

except (TypeError,

1532

gnutls.errors.GNUTLSError) as error:

2222

fpr = self.fingerprint(

2223

self.peer_certificate(session))

2224

except (TypeError, gnutls.Error) as error:

1533

2225

logger.warning("Bad certificate: %s", error)

1534

2226

return

1535

2227

logger.debug("Fingerprint: %s", fpr)

1540

2232

except KeyError:

1541

2233

return

1542

2234

1543

if self.server.use_dbus:

1544

# Emit D-Bus signal

1545

client.NewRequest(str(self.client_address))

1546

1547

2235

if client.approval_delay:

1548

2236

delay = client.approval_delay

1549

2237

client.approvals_pending += 1

1552

2240

while True:

1553

2241

if not client.enabled:

1554

2242

logger.info("Client %s is disabled",

1555

client.name)

2243

client.name)

1556

2244

if self.server.use_dbus:

1557

2245

# Emit D-Bus signal

1558

2246

client.Rejected("Disabled")

1567

2255

if self.server.use_dbus:

1568

2256

# Emit D-Bus signal

1569

2257

client.NeedApproval(

1570

client.approval_delay_milliseconds(),

1571

client.approved_by_default)

2258

client.approval_delay.total_seconds()

2259

* 1000, client.approved_by_default)

1572

2260

else:

1573

2261

logger.warning("Client %s was not approved",

1574

2262

client.name)

1580

2268

#wait until timeout or approved

1581

2269

time = datetime.datetime.now()

1582

2270

client.changedstate.acquire()

1583

(client.changedstate.wait

1584

(float(client.timedelta_to_milliseconds(delay)

1585

/ 1000)))

2271

client.changedstate.wait(delay.total_seconds())

1586

2272

client.changedstate.release()

1587

2273

time2 = datetime.datetime.now()

1588

2274

if (time2 - time) >= delay:

1599

2285

else:

1600

2286

delay -= time2 - time

1601

2287

1602

sent_size = 0

1603

while sent_size < len(client.secret):

1604

try:

1605

sent = session.send(client.secret[sent_size:])

1606

except gnutls.errors.GNUTLSError as error:

1607

logger.warning("gnutls send failed")

1608

return

1609

logger.debug("Sent: %d, remaining: %d",

1610

sent, len(client.secret)

1611

- (sent_size + sent))

1612

sent_size += sent

2288

try:

2289

session.send(client.secret)

2290

except gnutls.Error as error:

2291

logger.warning("gnutls send failed",

2292

exc_info = error)

2293

return

1613

2294

1614

2295

logger.info("Sending secret to %s", client.name)

1615

2296

# bump the timeout using extended_timeout

1616

client.checked_ok(client.extended_timeout)

2297

client.bump_timeout(client.extended_timeout)

1617

2298

if self.server.use_dbus:

1618

2299

# Emit D-Bus signal

1619

2300

client.GotSecret()

1623

2304

client.approvals_pending -= 1

1624

2305

try:

1625

2306

session.bye()

1626

except gnutls.errors.GNUTLSError as error:

1627

logger.warning("GnuTLS bye failed")

2307

except gnutls.Error as error:

2308

logger.warning("GnuTLS bye failed",

2309

exc_info=error)

1628

2310

1629

2311

@staticmethod

1630

2312

def peer_certificate(session):

1631

2313

"Return the peer's OpenPGP certificate as a bytestring"

1632

2314

# If not an OpenPGP certificate...

1633

if (gnutls.library.functions

1634

.gnutls_certificate_type_get(session._c_object)

1635

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1636

# ...do the normal thing

1637

return session.peer_certificate

2315

if (gnutls.certificate_type_get(session._c_object)

2316

!= gnutls.CRT_OPENPGP):

2317

# ...return invalid data

2318

return b""

1638

2319

list_size = ctypes.c_uint(1)

1639

cert_list = (gnutls.library.functions

1640

.gnutls_certificate_get_peers

2320

cert_list = (gnutls.certificate_get_peers

1641

2321

(session._c_object, ctypes.byref(list_size)))

1642

2322

if not bool(cert_list) and list_size.value != 0:

1643

raise gnutls.errors.GNUTLSError("error getting peer"

1644

" certificate")

2323

raise gnutls.Error("error getting peer certificate")

1645

2324

if list_size.value == 0:

1646

2325

return None

1647

2326

cert = cert_list[0]

1651

2330

def fingerprint(openpgp):

1652

2331

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1653

2332

# New GnuTLS "datum" with the OpenPGP public key

1654

datum = (gnutls.library.types

1655

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1656

ctypes.POINTER

1657

(ctypes.c_ubyte)),

1658

ctypes.c_uint(len(openpgp))))

2333

datum = gnutls.datum_t(

2334

ctypes.cast(ctypes.c_char_p(openpgp),

2335

ctypes.POINTER(ctypes.c_ubyte)),

2336

ctypes.c_uint(len(openpgp)))

1659

2337

# New empty GnuTLS certificate

1660

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1661

(gnutls.library.functions

1662

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2338

crt = gnutls.openpgp_crt_t()

2339

gnutls.openpgp_crt_init(ctypes.byref(crt))

1663

2340

# Import the OpenPGP public key into the certificate

1664

(gnutls.library.functions

1665

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1666

gnutls.library.constants

1667

.GNUTLS_OPENPGP_FMT_RAW))

2341

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2342

gnutls.OPENPGP_FMT_RAW)

1668

2343

# Verify the self signature in the key

1669

2344

crtverify = ctypes.c_uint()

1670

(gnutls.library.functions

1671

.gnutls_openpgp_crt_verify_self(crt, 0,

1672

ctypes.byref(crtverify)))

2345

gnutls.openpgp_crt_verify_self(crt, 0,

2346

ctypes.byref(crtverify))

1673

2347

if crtverify.value != 0:

1674

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1675

raise (gnutls.errors.CertificateSecurityError

1676

("Verify failed"))

2348

gnutls.openpgp_crt_deinit(crt)

2349

raise gnutls.CertificateSecurityError("Verify failed")

1677

2350

# New buffer for the fingerprint

1678

2351

buf = ctypes.create_string_buffer(20)

1679

2352

buf_len = ctypes.c_size_t()

1680

2353

# Get the fingerprint from the certificate into the buffer

1681

(gnutls.library.functions

1682

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1683

ctypes.byref(buf_len)))

2354

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2355

ctypes.byref(buf_len))

1684

2356

# Deinit the certificate

1685

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2357

gnutls.openpgp_crt_deinit(crt)

1686

2358

# Convert the buffer to a Python bytestring

1687

2359

fpr = ctypes.string_at(buf, buf_len.value)

1688

2360

# Convert the bytestring to hexadecimal notation

1692

2364

1693

2365

class MultiprocessingMixIn(object):

1694

2366

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2367

1695

2368

def sub_process_main(self, request, address):

1696

2369

try:

1697

2370

self.finish_request(request, address)

1702

2375

def process_request(self, request, address):

1703

2376

"""Start a new process to process the request."""

1704

2377

proc = multiprocessing.Process(target = self.sub_process_main,

1705

args = (request,

1706

address))

2378

args = (request, address))

1707

2379

proc.start()

1708

2380

return proc

1709

2381

1710

2382

1711

2383

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1712

2384

""" adds a pipe to the MixIn """

2385

1713

2386

def process_request(self, request, client_address):

1714

2387

"""Overrides and wraps the original process_request().

1715

2388

1724

2397

1725

2398

def add_pipe(self, parent_pipe, proc):

1726

2399

"""Dummy function; override as necessary"""

1727

raise NotImplementedError

2400

raise NotImplementedError()

1728

2401

1729

2402

1730

2403

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1736

2409

interface: None or a network interface name (string)

1737

2410

use_ipv6: Boolean; to use IPv6 or not

1738

2411

"""

2412

1739

2413

def __init__(self, server_address, RequestHandlerClass,

1740

interface=None, use_ipv6=True):

2414

interface=None,

2415

use_ipv6=True,

2416

socketfd=None):

2417

"""If socketfd is set, use that file descriptor instead of

2418

creating a new one with socket.socket().

2419

"""

1741

2420

self.interface = interface

1742

2421

if use_ipv6:

1743

2422

self.address_family = socket.AF_INET6

2423

if socketfd is not None:

2424

# Save the file descriptor

2425

self.socketfd = socketfd

2426

# Save the original socket.socket() function

2427

self.socket_socket = socket.socket

2428

# To implement --socket, we monkey patch socket.socket.

2429

#

2430

# (When socketserver.TCPServer is a new-style class, we

2431

# could make self.socket into a property instead of monkey

2432

# patching socket.socket.)

2433

#

2434

# Create a one-time-only replacement for socket.socket()

2435

@functools.wraps(socket.socket)

2436

def socket_wrapper(*args, **kwargs):

2437

# Restore original function so subsequent calls are

2438

# not affected.

2439

socket.socket = self.socket_socket

2440

del self.socket_socket

2441

# This time only, return a new socket object from the

2442

# saved file descriptor.

2443

return socket.fromfd(self.socketfd, *args, **kwargs)

2444

# Replace socket.socket() function with wrapper

2445

socket.socket = socket_wrapper

2446

# The socketserver.TCPServer.__init__ will call

2447

# socket.socket(), which might be our replacement,

2448

# socket_wrapper(), if socketfd was set.

1744

2449

socketserver.TCPServer.__init__(self, server_address,

1745

2450

RequestHandlerClass)

2451

1746

2452

def server_bind(self):

1747

2453

"""This overrides the normal server_bind() function

1748

2454

to bind to an interface if one was specified, and also NOT to

1749

2455

bind to an address or port if they were not specified."""

2456

global SO_BINDTODEVICE

1750

2457

if self.interface is not None:

1751

2458

if SO_BINDTODEVICE is None:

1752

logger.error("SO_BINDTODEVICE does not exist;"

1753

" cannot bind to interface %s",

1754

self.interface)

1755

else:

1756

try:

1757

self.socket.setsockopt(socket.SOL_SOCKET,

1758

SO_BINDTODEVICE,

1759

str(self.interface

1760

+ '\0'))

1761

except socket.error as error:

1762

if error[0] == errno.EPERM:

1763

logger.error("No permission to"

1764

" bind to interface %s",

1765

self.interface)

1766

elif error[0] == errno.ENOPROTOOPT:

1767

logger.error("SO_BINDTODEVICE not available;"

1768

" cannot bind to interface %s",

1769

self.interface)

1770

else:

1771

raise

2459

# Fall back to a hard-coded value which seems to be

2460

# common enough.

2461

logger.warning("SO_BINDTODEVICE not found, trying 25")

2462

SO_BINDTODEVICE = 25

2463

try:

2464

self.socket.setsockopt(

2465

socket.SOL_SOCKET, SO_BINDTODEVICE,

2466

(self.interface + "\0").encode("utf-8"))

2467

except socket.error as error:

2468

if error.errno == errno.EPERM:

2469

logger.error("No permission to bind to"

2470

" interface %s", self.interface)

2471

elif error.errno == errno.ENOPROTOOPT:

2472

logger.error("SO_BINDTODEVICE not available;"

2473

" cannot bind to interface %s",

2474

self.interface)

2475

elif error.errno == errno.ENODEV:

2476

logger.error("Interface %s does not exist,"

2477

" cannot bind", self.interface)

2478

else:

2479

raise

1772

2480

# Only bind(2) the socket if we really need to.

1773

2481

if self.server_address[0] or self.server_address[1]:

1774

2482

if not self.server_address[0]:

1775

2483

if self.address_family == socket.AF_INET6:

1776

2484

any_address = "::" # in6addr_any

1777

2485

else:

1778

any_address = socket.INADDR_ANY

2486

any_address = "0.0.0.0" # INADDR_ANY

1779

2487

self.server_address = (any_address,

1780

2488

self.server_address[1])

1781

2489

elif not self.server_address[1]:

1782

self.server_address = (self.server_address[0],

1783

0)

2490

self.server_address = (self.server_address[0], 0)

1784

2491

# if self.interface:

1785

2492

# self.server_address = (self.server_address[0],

1786

2493

# 0, # port

1798

2505

gnutls_priority GnuTLS priority string

1799

2506

use_dbus: Boolean; to emit D-Bus signals or not

1800

2507

1801

Assumes a gobject.MainLoop event loop.

2508

Assumes a GLib.MainLoop event loop.

1802

2509

"""

2510

1803

2511

def __init__(self, server_address, RequestHandlerClass,

1804

interface=None, use_ipv6=True, clients=None,

1805

gnutls_priority=None, use_dbus=True):

2512

interface=None,

2513

use_ipv6=True,

2514

clients=None,

2515

gnutls_priority=None,

2516

use_dbus=True,

2517

socketfd=None):

1806

2518

self.enabled = False

1807

2519

self.clients = clients

1808

2520

if self.clients is None:

1812

2524

IPv6_TCPServer.__init__(self, server_address,

1813

2525

RequestHandlerClass,

1814

2526

interface = interface,

1815

use_ipv6 = use_ipv6)

2527

use_ipv6 = use_ipv6,

2528

socketfd = socketfd)

2529

1816

2530

def server_activate(self):

1817

2531

if self.enabled:

1818

2532

return socketserver.TCPServer.server_activate(self)

1822

2536

1823

2537

def add_pipe(self, parent_pipe, proc):

1824

2538

# Call "handle_ipc" for both data and EOF events

1825

gobject.io_add_watch(parent_pipe.fileno(),

1826

gobject.IO_IN | gobject.IO_HUP,

1827

functools.partial(self.handle_ipc,

1828

parent_pipe =

1829

parent_pipe,

1830

proc = proc))

2539

GLib.io_add_watch(

2540

parent_pipe.fileno(),

2541

GLib.IO_IN | GLib.IO_HUP,

2542

functools.partial(self.handle_ipc,

2543

parent_pipe = parent_pipe,

2544

proc = proc))

1831

2545

1832

def handle_ipc(self, source, condition, parent_pipe=None,

1833

proc = None, client_object=None):

1834

condition_names = {

1835

gobject.IO_IN: "IN", # There is data to read.

1836

gobject.IO_OUT: "OUT", # Data can be written (without

1837

# blocking).

1838

gobject.IO_PRI: "PRI", # There is urgent data to read.

1839

gobject.IO_ERR: "ERR", # Error condition.

1840

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1841

# broken, usually for pipes and

1842

# sockets).

1843

}

1844

conditions_string = ' | '.join(name

1845

for cond, name in

1846

condition_names.iteritems()

1847

if cond & condition)

2546

def handle_ipc(self, source, condition,

2547

parent_pipe=None,

2548

proc = None,

2549

client_object=None):

1848

2550

# error, or the other end of multiprocessing.Pipe has closed

1849

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2551

if condition & (GLib.IO_ERR | GLib.IO_HUP):

1850

2552

# Wait for other process to exit

1851

2553

proc.join()

1852

2554

return False

1859

2561

fpr = request[1]

1860

2562

address = request[2]

1861

2563

1862

for c in self.clients.itervalues():

2564

for c in self.clients.values():

1863

2565

if c.fingerprint == fpr:

1864

2566

client = c

1865

2567

break

1873

2575

parent_pipe.send(False)

1874

2576

return False

1875

2577

1876

gobject.io_add_watch(parent_pipe.fileno(),

1877

gobject.IO_IN | gobject.IO_HUP,

1878

functools.partial(self.handle_ipc,

1879

parent_pipe =

1880

parent_pipe,

1881

proc = proc,

1882

client_object =

1883

client))

2578

GLib.io_add_watch(

2579

parent_pipe.fileno(),

2580

GLib.IO_IN | GLib.IO_HUP,

2581

functools.partial(self.handle_ipc,

2582

parent_pipe = parent_pipe,

2583

proc = proc,

2584

client_object = client))

1884

2585

parent_pipe.send(True)

1885

2586

# remove the old hook in favor of the new above hook on

1886

2587

# same fileno

1892

2593

1893

2594

parent_pipe.send(('data', getattr(client_object,

1894

2595

funcname)(*args,

1895

**kwargs)))

2596

**kwargs)))

1896

2597

1897

2598

if command == 'getattr':

1898

2599

attrname = request[1]

1899

if callable(client_object.__getattribute__(attrname)):

1900

parent_pipe.send(('function',))

2600

if isinstance(client_object.__getattribute__(attrname),

2601

collections.Callable):

2602

parent_pipe.send(('function', ))

1901

2603

else:

1902

parent_pipe.send(('data', client_object

1903

.__getattribute__(attrname)))

2604

parent_pipe.send((

2605

'data', client_object.__getattribute__(attrname)))

1904

2606

1905

2607

if command == 'setattr':

1906

2608

attrname = request[1]

1910

2612

return True

1911

2613

1912

2614

2615

def rfc3339_duration_to_delta(duration):

2616

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2617

2618

>>> rfc3339_duration_to_delta("P7D")

2619

datetime.timedelta(7)

2620

>>> rfc3339_duration_to_delta("PT60S")

2621

datetime.timedelta(0, 60)

2622

>>> rfc3339_duration_to_delta("PT60M")

2623

datetime.timedelta(0, 3600)

2624

>>> rfc3339_duration_to_delta("PT24H")

2625

datetime.timedelta(1)

2626

>>> rfc3339_duration_to_delta("P1W")

2627

datetime.timedelta(7)

2628

>>> rfc3339_duration_to_delta("PT5M30S")

2629

datetime.timedelta(0, 330)

2630

>>> rfc3339_duration_to_delta("P1DT3M20S")

2631

datetime.timedelta(1, 200)

2632

"""

2633

2634

# Parsing an RFC 3339 duration with regular expressions is not

2635

# possible - there would have to be multiple places for the same

2636

# values, like seconds. The current code, while more esoteric, is

2637

# cleaner without depending on a parsing library. If Python had a

2638

# built-in library for parsing we would use it, but we'd like to

2639

# avoid excessive use of external libraries.

2640

2641

# New type for defining tokens, syntax, and semantics all-in-one

2642

Token = collections.namedtuple("Token", (

2643

"regexp", # To match token; if "value" is not None, must have

2644

# a "group" containing digits

2645

"value", # datetime.timedelta or None

2646

"followers")) # Tokens valid after this token

2647

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2648

# the "duration" ABNF definition in RFC 3339, Appendix A.

2649

token_end = Token(re.compile(r"$"), None, frozenset())

2650

token_second = Token(re.compile(r"(\d+)S"),

2651

datetime.timedelta(seconds=1),

2652

frozenset((token_end, )))

2653

token_minute = Token(re.compile(r"(\d+)M"),

2654

datetime.timedelta(minutes=1),

2655

frozenset((token_second, token_end)))

2656

token_hour = Token(re.compile(r"(\d+)H"),

2657

datetime.timedelta(hours=1),

2658

frozenset((token_minute, token_end)))

2659

token_time = Token(re.compile(r"T"),

2660

None,

2661

frozenset((token_hour, token_minute,

2662

token_second)))

2663

token_day = Token(re.compile(r"(\d+)D"),

2664

datetime.timedelta(days=1),

2665

frozenset((token_time, token_end)))

2666

token_month = Token(re.compile(r"(\d+)M"),

2667

datetime.timedelta(weeks=4),

2668

frozenset((token_day, token_end)))

2669

token_year = Token(re.compile(r"(\d+)Y"),

2670

datetime.timedelta(weeks=52),

2671

frozenset((token_month, token_end)))

2672

token_week = Token(re.compile(r"(\d+)W"),

2673

datetime.timedelta(weeks=1),

2674

frozenset((token_end, )))

2675

token_duration = Token(re.compile(r"P"), None,

2676

frozenset((token_year, token_month,

2677

token_day, token_time,

2678

token_week)))

2679

# Define starting values

2680

value = datetime.timedelta() # Value so far

2681

found_token = None

2682

followers = frozenset((token_duration, )) # Following valid tokens

2683

s = duration # String left to parse

2684

# Loop until end token is found

2685

while found_token is not token_end:

2686

# Search for any currently valid tokens

2687

for token in followers:

2688

match = token.regexp.match(s)

2689

if match is not None:

2690

# Token found

2691

if token.value is not None:

2692

# Value found, parse digits

2693

factor = int(match.group(1), 10)

2694

# Add to value so far

2695

value += factor * token.value

2696

# Strip token from string

2697

s = token.regexp.sub("", s, 1)

2698

# Go to found token

2699

found_token = token

2700

# Set valid next tokens

2701

followers = found_token.followers

2702

break

2703

else:

2704

# No currently valid tokens were found

2705

raise ValueError("Invalid RFC 3339 duration: {!r}"

2706

.format(duration))

2707

# End token found

2708

return value

2709

2710

1913

2711

def string_to_delta(interval):

1914

2712

"""Parse a string and return a datetime.timedelta

1915

2713

1926

2724

>>> string_to_delta('5m 30s')

1927

2725

datetime.timedelta(0, 330)

1928

2726

"""

2727

2728

try:

2729

return rfc3339_duration_to_delta(interval)

2730

except ValueError:

2731

pass

2732

1929

2733

timevalue = datetime.timedelta(0)

1930

2734

for s in interval.split():

1931

2735

try:

1932

suffix = unicode(s[-1])

2736

suffix = s[-1]

1933

2737

value = int(s[:-1])

1934

2738

if suffix == "d":

1935

2739

delta = datetime.timedelta(value)

1942

2746

elif suffix == "w":

1943

2747

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1944

2748

else:

1945

raise ValueError("Unknown suffix %r" % suffix)

1946

except (ValueError, IndexError) as e:

2749

raise ValueError("Unknown suffix {!r}".format(suffix))

2750

except IndexError as e:

1947

2751

raise ValueError(*(e.args))

1948

2752

timevalue += delta

1949

2753

return timevalue

1962

2766

sys.exit()

1963

2767

if not noclose:

1964

2768

# Close all standard open file descriptors

1965

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2769

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1966

2770

if not stat.S_ISCHR(os.fstat(null).st_mode):

1967

2771

raise OSError(errno.ENODEV,

1968

"%s not a character device"

1969

% os.path.devnull)

2772

"{} not a character device"

2773

.format(os.devnull))

1970

2774

os.dup2(null, sys.stdin.fileno())

1971

2775

os.dup2(null, sys.stdout.fileno())

1972

2776

os.dup2(null, sys.stderr.fileno())

1981

2785

1982

2786

parser = argparse.ArgumentParser()

1983

2787

parser.add_argument("-v", "--version", action="version",

1984

version = "%%(prog)s %s" % version,

2788

version = "%(prog)s {}".format(version),

1985

2789

help="show version number and exit")

1986

2790

parser.add_argument("-i", "--interface", metavar="IF",

1987

2791

help="Bind to interface IF")

1993

2797

help="Run self-test")

1994

2798

parser.add_argument("--debug", action="store_true",

1995

2799

help="Debug mode; run in foreground and log"

1996

" to terminal")

2800

" to terminal", default=None)

1997

2801

parser.add_argument("--debuglevel", metavar="LEVEL",

1998

2802

help="Debug level for stdout output")

1999

2803

parser.add_argument("--priority", help="GnuTLS"

2006

2810

" files")

2007

2811

parser.add_argument("--no-dbus", action="store_false",

2008

2812

dest="use_dbus", help="Do not provide D-Bus"

2009

" system bus interface")

2813

" system bus interface", default=None)

2010

2814

parser.add_argument("--no-ipv6", action="store_false",

2011

dest="use_ipv6", help="Do not use IPv6")

2815

dest="use_ipv6", help="Do not use IPv6",

2816

default=None)

2012

2817

parser.add_argument("--no-restore", action="store_false",

2013

2818

dest="restore", help="Do not restore stored"

2014

" state")

2819

" state", default=None)

2820

parser.add_argument("--socket", type=int,

2821

help="Specify a file descriptor to a network"

2822

" socket to use instead of creating one")

2015

2823

parser.add_argument("--statedir", metavar="DIR",

2016

2824

help="Directory to save/restore state in")

2825

parser.add_argument("--foreground", action="store_true",

2826

help="Run in foreground", default=None)

2827

parser.add_argument("--no-zeroconf", action="store_false",

2828

dest="zeroconf", help="Do not use Zeroconf",

2829

default=None)

2017

2830

2018

2831

options = parser.parse_args()

2019

2832

2020

2833

if options.check:

2021

2834

import doctest

2022

doctest.testmod()

2023

sys.exit()

2835

fail_count, test_count = doctest.testmod()

2836

sys.exit(os.EX_OK if fail_count == 0 else 1)

2024

2837

2025

2838

# Default values for config file for server-global settings

2026

2839

server_defaults = { "interface": "",

2028

2841

"port": "",

2029

2842

"debug": "False",

2030

2843

"priority":

2031

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2844

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2845

":+SIGN-DSA-SHA256",

2032

2846

"servicename": "Mandos",

2033

2847

"use_dbus": "True",

2034

2848

"use_ipv6": "True",

2035

2849

"debuglevel": "",

2036

2850

"restore": "True",

2037

"statedir": "/var/lib/mandos"

2038

}

2851

"socket": "",

2852

"statedir": "/var/lib/mandos",

2853

"foreground": "False",

2854

"zeroconf": "True",

2855

}

2039

2856

2040

2857

# Parse config file for server-global settings

2041

2858

server_config = configparser.SafeConfigParser(server_defaults)

2042

2859

del server_defaults

2043

server_config.read(os.path.join(options.configdir,

2044

"mandos.conf"))

2860

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2045

2861

# Convert the SafeConfigParser object to a dict

2046

2862

server_settings = server_config.defaults()

2047

2863

# Use the appropriate methods on the non-string config options

2048

for option in ("debug", "use_dbus", "use_ipv6"):

2864

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

2049

2865

server_settings[option] = server_config.getboolean("DEFAULT",

2050

2866

option)

2051

2867

if server_settings["port"]:

2052

2868

server_settings["port"] = server_config.getint("DEFAULT",

2053

2869

"port")

2870

if server_settings["socket"]:

2871

server_settings["socket"] = server_config.getint("DEFAULT",

2872

"socket")

2873

# Later, stdin will, and stdout and stderr might, be dup'ed

2874

# over with an opened os.devnull. But we don't want this to

2875

# happen with a supplied network socket.

2876

if 0 <= server_settings["socket"] <= 2:

2877

server_settings["socket"] = os.dup(server_settings

2878

["socket"])

2054

2879

del server_config

2055

2880

2056

2881

# Override the settings from the config file with command line

2057

2882

# options, if set.

2058

2883

for option in ("interface", "address", "port", "debug",

2059

"priority", "servicename", "configdir",

2060

"use_dbus", "use_ipv6", "debuglevel", "restore",

2061

"statedir"):

2884

"priority", "servicename", "configdir", "use_dbus",

2885

"use_ipv6", "debuglevel", "restore", "statedir",

2886

"socket", "foreground", "zeroconf"):

2062

2887

value = getattr(options, option)

2063

2888

if value is not None:

2064

2889

server_settings[option] = value

2065

2890

del options

2066

2891

# Force all strings to be unicode

2067

2892

for option in server_settings.keys():

2068

if type(server_settings[option]) is str:

2069

server_settings[option] = unicode(server_settings[option])

2893

if isinstance(server_settings[option], bytes):

2894

server_settings[option] = (server_settings[option]

2895

.decode("utf-8"))

2896

# Force all boolean options to be boolean

2897

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2898

"foreground", "zeroconf"):

2899

server_settings[option] = bool(server_settings[option])

2900

# Debug implies foreground

2901

if server_settings["debug"]:

2902

server_settings["foreground"] = True

2070

2903

# Now we have our good server settings in "server_settings"

2071

2904

2072

2905

##################################################################

2073

2906

2907

if (not server_settings["zeroconf"]

2908

and not (server_settings["port"]

2909

or server_settings["socket"] != "")):

2910

parser.error("Needs port or socket to work without Zeroconf")

2911

2074

2912

# For convenience

2075

2913

debug = server_settings["debug"]

2076

2914

debuglevel = server_settings["debuglevel"]

2078

2916

use_ipv6 = server_settings["use_ipv6"]

2079

2917

stored_state_path = os.path.join(server_settings["statedir"],

2080

2918

stored_state_file)

2919

foreground = server_settings["foreground"]

2920

zeroconf = server_settings["zeroconf"]

2081

2921

2082

2922

if debug:

2083

2923

initlogger(debug, logging.DEBUG)

2089

2929

initlogger(debug, level)

2090

2930

2091

2931

if server_settings["servicename"] != "Mandos":

2092

syslogger.setFormatter(logging.Formatter

2093

('Mandos (%s) [%%(process)d]:'

2094

' %%(levelname)s: %%(message)s'

2095

% server_settings["servicename"]))

2932

syslogger.setFormatter(

2933

logging.Formatter('Mandos ({}) [%(process)d]:'

2934

' %(levelname)s: %(message)s'.format(

2935

server_settings["servicename"])))

2096

2936

2097

2937

# Parse config file with clients

2098

client_config = configparser.SafeConfigParser(Client.client_defaults)

2938

client_config = configparser.SafeConfigParser(Client

2939

.client_defaults)

2099

2940

client_config.read(os.path.join(server_settings["configdir"],

2100

2941

"clients.conf"))

2101

2942

2102

2943

global mandos_dbus_service

2103

2944

mandos_dbus_service = None

2104

2945

2105

tcp_server = MandosServer((server_settings["address"],

2106

server_settings["port"]),

2107

ClientHandler,

2108

interface=(server_settings["interface"]

2109

or None),

2110

use_ipv6=use_ipv6,

2111

gnutls_priority=

2112

server_settings["priority"],

2113

use_dbus=use_dbus)

2114

if not debug:

2115

pidfilename = "/var/run/mandos.pid"

2946

socketfd = None

2947

if server_settings["socket"] != "":

2948

socketfd = server_settings["socket"]

2949

tcp_server = MandosServer(

2950

(server_settings["address"], server_settings["port"]),

2951

ClientHandler,

2952

interface=(server_settings["interface"] or None),

2953

use_ipv6=use_ipv6,

2954

gnutls_priority=server_settings["priority"],

2955

use_dbus=use_dbus,

2956

socketfd=socketfd)

2957

if not foreground:

2958

pidfilename = "/run/mandos.pid"

2959

if not os.path.isdir("/run/."):

2960

pidfilename = "/var/run/mandos.pid"

2961

pidfile = None

2116

2962

try:

2117

pidfile = open(pidfilename, "w")

2118

except IOError:

2119

logger.error("Could not open file %r", pidfilename)

2963

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2964

except IOError as e:

2965

logger.error("Could not open file %r", pidfilename,

2966

exc_info=e)

2120

2967

2121

try:

2122

uid = pwd.getpwnam("_mandos").pw_uid

2123

gid = pwd.getpwnam("_mandos").pw_gid

2124

except KeyError:

2968

for name, group in (("_mandos", "_mandos"),

2969

("mandos", "mandos"),

2970

("nobody", "nogroup")):

2125

2971

try:

2126

uid = pwd.getpwnam("mandos").pw_uid

2127

gid = pwd.getpwnam("mandos").pw_gid

2972

uid = pwd.getpwnam(name).pw_uid

2973

gid = pwd.getpwnam(group).pw_gid

2974

break

2128

2975

except KeyError:

2129

try:

2130

uid = pwd.getpwnam("nobody").pw_uid

2131

gid = pwd.getpwnam("nobody").pw_gid

2132

except KeyError:

2133

uid = 65534

2134

gid = 65534

2976

continue

2977

else:

2978

uid = 65534

2979

gid = 65534

2135

2980

try:

2136

2981

os.setgid(gid)

2137

2982

os.setuid(uid)

2983

if debug:

2984

logger.debug("Did setuid/setgid to {}:{}".format(uid,

2985

gid))

2138

2986

except OSError as error:

2139

if error[0] != errno.EPERM:

2140

raise error

2987

logger.warning("Failed to setuid/setgid to {}:{}: {}"

2988

.format(uid, gid, os.strerror(error.errno)))

2989

if error.errno != errno.EPERM:

2990

raise

2141

2991

2142

2992

if debug:

2143

2993

# Enable all possible GnuTLS debugging

2144

2994

2145

2995

# "Use a log level over 10 to enable all debugging options."

2146

2996

# - GnuTLS manual

2147

gnutls.library.functions.gnutls_global_set_log_level(11)

2997

gnutls.global_set_log_level(11)

2148

2998

2149

@gnutls.library.types.gnutls_log_func

2999

@gnutls.log_func

2150

3000

def debug_gnutls(level, string):

2151

3001

logger.debug("GnuTLS: %s", string[:-1])

2152

3002

2153

(gnutls.library.functions

2154

.gnutls_global_set_log_function(debug_gnutls))

3003

gnutls.global_set_log_function(debug_gnutls)

2155

3004

2156

3005

# Redirect stdin so all checkers get /dev/null

2157

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

3006

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2158

3007

os.dup2(null, sys.stdin.fileno())

2159

3008

if null > 2:

2160

3009

os.close(null)

2161

3010

2162

3011

# Need to fork before connecting to D-Bus

2163

if not debug:

3012

if not foreground:

2164

3013

# Close all input and output, do double fork, etc.

2165

3014

daemon()

2166

3015

2167

gobject.threads_init()

3016

# multiprocessing will use threads, so before we use GLib we need

3017

# to inform GLib that threads will be used.

3018

GLib.threads_init()

2168

3019

2169

3020

global main_loop

2170

3021

# From the Avahi example code

2171

DBusGMainLoop(set_as_default=True )

2172

main_loop = gobject.MainLoop()

3022

DBusGMainLoop(set_as_default=True)

3023

main_loop = GLib.MainLoop()

2173

3024

bus = dbus.SystemBus()

2174

3025

# End of Avahi example code

2175

3026

if use_dbus:

2176

3027

try:

2177

3028

bus_name = dbus.service.BusName("se.recompile.Mandos",

2178

bus, do_not_queue=True)

2179

old_bus_name = (dbus.service.BusName

2180

("se.bsnet.fukt.Mandos", bus,

2181

do_not_queue=True))

2182

except dbus.exceptions.NameExistsException as e:

2183

logger.error(unicode(e) + ", disabling D-Bus")

3029

bus,

3030

do_not_queue=True)

3031

old_bus_name = dbus.service.BusName(

3032

"se.bsnet.fukt.Mandos", bus,

3033

do_not_queue=True)

3034

except dbus.exceptions.DBusException as e:

3035

logger.error("Disabling D-Bus:", exc_info=e)

2184

3036

use_dbus = False

2185

3037

server_settings["use_dbus"] = False

2186

3038

tcp_server.use_dbus = False

2187

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2188

service = AvahiServiceToSyslog(name =

2189

server_settings["servicename"],

2190

servicetype = "_mandos._tcp",

2191

protocol = protocol, bus = bus)

2192

if server_settings["interface"]:

2193

service.interface = (if_nametoindex

2194

(str(server_settings["interface"])))

3039

if zeroconf:

3040

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3041

service = AvahiServiceToSyslog(

3042

name = server_settings["servicename"],

3043

servicetype = "_mandos._tcp",

3044

protocol = protocol,

3045

bus = bus)

3046

if server_settings["interface"]:

3047

service.interface = if_nametoindex(

3048

server_settings["interface"].encode("utf-8"))

2195

3049

2196

3050

global multiprocessing_manager

2197

3051

multiprocessing_manager = multiprocessing.Manager()

2198

3052

2199

3053

client_class = Client

2200

3054

if use_dbus:

2201

client_class = functools.partial(ClientDBusTransitional,

2202

bus = bus)

3055

client_class = functools.partial(ClientDBus, bus = bus)

2203

3056

2204

3057

client_settings = Client.config_parser(client_config)

2205

3058

old_client_settings = {}

2206

3059

clients_data = {}

2207

3060

3061

# This is used to redirect stdout and stderr for checker processes

3062

global wnull

3063

wnull = open(os.devnull, "w") # A writable /dev/null

3064

# Only used if server is running in foreground but not in debug

3065

# mode

3066

if debug or not foreground:

3067

wnull.close()

3068

2208

3069

# Get client data and settings from last running state.

2209

3070

if server_settings["restore"]:

2210

3071

try:

2211

3072

with open(stored_state_path, "rb") as stored_state:

2212

clients_data, old_client_settings = (pickle.load

2213

(stored_state))

3073

if sys.version_info.major == 2:

3074

clients_data, old_client_settings = pickle.load(

3075

stored_state)

3076

else:

3077

bytes_clients_data, bytes_old_client_settings = (

3078

pickle.load(stored_state, encoding = "bytes"))

3079

### Fix bytes to strings

3080

## clients_data

3081

# .keys()

3082

clients_data = { (key.decode("utf-8")

3083

if isinstance(key, bytes)

3084

else key): value

3085

for key, value in

3086

bytes_clients_data.items() }

3087

del bytes_clients_data

3088

for key in clients_data:

3089

value = { (k.decode("utf-8")

3090

if isinstance(k, bytes) else k): v

3091

for k, v in

3092

clients_data[key].items() }

3093

clients_data[key] = value

3094

# .client_structure

3095

value["client_structure"] = [

3096

(s.decode("utf-8")

3097

if isinstance(s, bytes)

3098

else s) for s in

3099

value["client_structure"] ]

3100

# .name & .host

3101

for k in ("name", "host"):

3102

if isinstance(value[k], bytes):

3103

value[k] = value[k].decode("utf-8")

3104

## old_client_settings

3105

# .keys()

3106

old_client_settings = {

3107

(key.decode("utf-8")

3108

if isinstance(key, bytes)

3109

else key): value

3110

for key, value in

3111

bytes_old_client_settings.items() }

3112

del bytes_old_client_settings

3113

# .host

3114

for value in old_client_settings.values():

3115

if isinstance(value["host"], bytes):

3116

value["host"] = (value["host"]

3117

.decode("utf-8"))

2214

3118

os.remove(stored_state_path)

2215

3119

except IOError as e:

2216

logger.warning("Could not load persistent state: {0}"

2217

.format(e))

2218

if e.errno != errno.ENOENT:

3120

if e.errno == errno.ENOENT:

3121

logger.warning("Could not load persistent state:"

3122

" {}".format(os.strerror(e.errno)))

3123

else:

3124

logger.critical("Could not load persistent state:",

3125

exc_info=e)

2219

3126

raise

2220

3127

except EOFError as e:

2221

3128

logger.warning("Could not load persistent state: "

2222

"EOFError: {0}".format(e))

3129

"EOFError:",

3130

exc_info=e)

2223

3131

2224

3132

with PGPEngine() as pgp:

2225

for client_name, client in clients_data.iteritems():

3133

for client_name, client in clients_data.items():

3134

# Skip removed clients

3135

if client_name not in client_settings:

3136

continue

3137

2226

3138

# Decide which value to use after restoring saved state.

2227

3139

# We have three different values: Old config file,

2228

3140

# new config file, and saved state.

2233

3145

# For each value in new config, check if it

2234

3146

# differs from the old config value (Except for

2235

3147

# the "secret" attribute)

2236

if (name != "secret" and

2237

value != old_client_settings[client_name]

2238

[name]):

3148

if (name != "secret"

3149

and (value !=

3150

old_client_settings[client_name][name])):

2239

3151

client[name] = value

2240

3152

except KeyError:

2241

3153

pass

2242

3154

2243

3155

# Clients who has passed its expire date can still be

2244

# enabled if its last checker was successful. Clients

2245

# whose checker failed before we stored its state is

2246

# assumed to have failed all checkers during downtime.

3156

# enabled if its last checker was successful. A Client

3157

# whose checker succeeded before we stored its state is

3158

# assumed to have successfully run all checkers during

3159

# downtime.

2247

3160

if client["enabled"]:

2248

3161

if datetime.datetime.utcnow() >= client["expires"]:

2249

3162

if not client["last_checked_ok"]:

2250

3163

logger.warning(

2251

"disabling client {0} - Client never "

2252

"performed a successfull checker"

2253

.format(client["name"]))

3164

"disabling client {} - Client never "

3165

"performed a successful checker".format(

3166

client_name))

2254

3167

client["enabled"] = False

2255

3168

elif client["last_checker_status"] != 0:

2256

3169

logger.warning(

2257

"disabling client {0} - Client "

2258

"last checker failed with error code {1}"

2259

.format(client["name"],

2260

client["last_checker_status"]))

3170

"disabling client {} - Client last"

3171

" checker failed with error code"

3172

" {}".format(

3173

client_name,

3174

client["last_checker_status"]))

2261

3175

client["enabled"] = False

2262

3176

else:

2263

client["expires"] = (datetime.datetime

2264

.utcnow()

2265

+ client["timeout"])

2266

3177

client["expires"] = (

3178

datetime.datetime.utcnow()

3179

+ client["timeout"])

3180

logger.debug("Last checker succeeded,"

3181

" keeping {} enabled".format(

3182

client_name))

2267

3183

try:

2268

client["secret"] = (

2269

pgp.decrypt(client["encrypted_secret"],

2270

client_settings[client_name]

2271

["secret"]))

3184

client["secret"] = pgp.decrypt(

3185

client["encrypted_secret"],

3186

client_settings[client_name]["secret"])

2272

3187

except PGPError:

2273

3188

# If decryption fails, we use secret from new settings

2274

logger.debug("Failed to decrypt {0} old secret"

2275

.format(client_name))

2276

client["secret"] = (

2277

client_settings[client_name]["secret"])

2278

3189

logger.debug("Failed to decrypt {} old secret".format(

3190

client_name))

3191

client["secret"] = (client_settings[client_name]

3192

["secret"])

2279

3193

2280

3194

# Add/remove clients based on new changes made to config

2281

for client_name in set(old_client_settings) - set(client_settings):

3195

for client_name in (set(old_client_settings)

3196

- set(client_settings)):

2282

3197

del clients_data[client_name]

2283

for client_name in set(client_settings) - set(old_client_settings):

3198

for client_name in (set(client_settings)

3199

- set(old_client_settings)):

2284

3200

clients_data[client_name] = client_settings[client_name]

2285

2286

# Create clients all clients

2287

for client_name, client in clients_data.iteritems():

3201

3202

# Create all client objects

3203

for client_name, client in clients_data.items():

2288

3204

tcp_server.clients[client_name] = client_class(

2289

name = client_name, settings = client)

3205

name = client_name,

3206

settings = client,

3207

server_settings = server_settings)

2290

3208

2291

3209

if not tcp_server.clients:

2292

3210

logger.warning("No clients defined")

2293

2294

if not debug:

2295

try:

2296

with pidfile:

2297

pid = os.getpid()

2298

pidfile.write(str(pid) + "\n".encode("utf-8"))

2299

del pidfile

2300

except IOError:

2301

logger.error("Could not write to file %r with PID %d",

2302

pidfilename, pid)

2303

except NameError:

2304

# "pidfile" was never created

2305

pass

3211

3212

if not foreground:

3213

if pidfile is not None:

3214

pid = os.getpid()

3215

try:

3216

with pidfile:

3217

print(pid, file=pidfile)

3218

except IOError:

3219

logger.error("Could not write to file %r with PID %d",

3220

pidfilename, pid)

3221

del pidfile

2306

3222

del pidfilename

2307

signal.signal(signal.SIGINT, signal.SIG_IGN)

2308

3223

2309

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2310

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3224

for termsig in (signal.SIGHUP, signal.SIGTERM):

3225

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3226

lambda: main_loop.quit() and False)

2311

3227

2312

3228

if use_dbus:

2313

class MandosDBusService(dbus.service.Object):

3229

3230

@alternate_dbus_interfaces(

3231

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3232

class MandosDBusService(DBusObjectWithObjectManager):

2314

3233

"""A D-Bus proxy object"""

3234

2315

3235

def __init__(self):

2316

3236

dbus.service.Object.__init__(self, bus, "/")

3237

2317

3238

_interface = "se.recompile.Mandos"

2318

3239

2319

3240

@dbus.service.signal(_interface, signature="o")

2326

3247

"D-Bus signal"

2327

3248

pass

2328

3249

3250

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3251

"true"})

2329

3252

@dbus.service.signal(_interface, signature="os")

2330

3253

def ClientRemoved(self, objpath, name):

2331

3254

"D-Bus signal"

2332

3255

pass

2333

3256

3257

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3258

"true"})

2334

3259

@dbus.service.method(_interface, out_signature="ao")

2335

3260

def GetAllClients(self):

2336

3261

"D-Bus method"

2337

return dbus.Array(c.dbus_object_path

2338

for c in

2339

tcp_server.clients.itervalues())

3262

return dbus.Array(c.dbus_object_path for c in

3263

tcp_server.clients.values())

2340

3264

3265

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3266

"true"})

2341

3267

@dbus.service.method(_interface,

2342

3268

out_signature="a{oa{sv}}")

2343

3269

def GetAllClientsWithProperties(self):

2344

3270

"D-Bus method"

2345

3271

return dbus.Dictionary(

2346

((c.dbus_object_path, c.GetAll(""))

2347

for c in tcp_server.clients.itervalues()),

3272

{ c.dbus_object_path: c.GetAll(

3273

"se.recompile.Mandos.Client")

3274

for c in tcp_server.clients.values() },

2348

3275

signature="oa{sv}")

2349

3276

2350

3277

@dbus.service.method(_interface, in_signature="o")

2351

3278

def RemoveClient(self, object_path):

2352

3279

"D-Bus method"

2353

for c in tcp_server.clients.itervalues():

3280

for c in tcp_server.clients.values():

2354

3281

if c.dbus_object_path == object_path:

2355

3282

del tcp_server.clients[c.name]

2356

3283

c.remove_from_connection()

2357

# Don't signal anything except ClientRemoved

3284

# Don't signal the disabling

2358

3285

c.disable(quiet=True)

2359

# Emit D-Bus signal

2360

self.ClientRemoved(object_path, c.name)

3286

# Emit D-Bus signal for removal

3287

self.client_removed_signal(c)

2361

3288

return

2362

3289

raise KeyError(object_path)

2363

3290

2364

3291

del _interface

3292

3293

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3294

out_signature = "a{oa{sa{sv}}}")

3295

def GetManagedObjects(self):

3296

"""D-Bus method"""

3297

return dbus.Dictionary(

3298

{ client.dbus_object_path:

3299

dbus.Dictionary(

3300

{ interface: client.GetAll(interface)

3301

for interface in

3302

client._get_all_interface_names()})

3303

for client in tcp_server.clients.values()})

3304

3305

def client_added_signal(self, client):

3306

"""Send the new standard signal and the old signal"""

3307

if use_dbus:

3308

# New standard signal

3309

self.InterfacesAdded(

3310

client.dbus_object_path,

3311

dbus.Dictionary(

3312

{ interface: client.GetAll(interface)

3313

for interface in

3314

client._get_all_interface_names()}))

3315

# Old signal

3316

self.ClientAdded(client.dbus_object_path)

3317

3318

def client_removed_signal(self, client):

3319

"""Send the new standard signal and the old signal"""

3320

if use_dbus:

3321

# New standard signal

3322

self.InterfacesRemoved(

3323

client.dbus_object_path,

3324

client._get_all_interface_names())

3325

# Old signal

3326

self.ClientRemoved(client.dbus_object_path,

3327

client.name)

2365

3328

2366

class MandosDBusServiceTransitional(MandosDBusService):

2367

__metaclass__ = AlternateDBusNamesMetaclass

2368

mandos_dbus_service = MandosDBusServiceTransitional()

3329

mandos_dbus_service = MandosDBusService()

2369

3330

3331

# Save modules to variables to exempt the modules from being

3332

# unloaded before the function registered with atexit() is run.

3333

mp = multiprocessing

3334

wn = wnull

2370

3335

def cleanup():

2371

3336

"Cleanup function; run on exit"

2372

service.cleanup()

3337

if zeroconf:

3338

service.cleanup()

2373

3339

2374

multiprocessing.active_children()

3340

mp.active_children()

3341

wn.close()

2375

3342

if not (tcp_server.clients or client_settings):

2376

3343

return

2377

3344

2380

3347

# removed/edited, old secret will thus be unrecovable.

2381

3348

clients = {}

2382

3349

with PGPEngine() as pgp:

2383

for client in tcp_server.clients.itervalues():

3350

for client in tcp_server.clients.values():

2384

3351

key = client_settings[client.name]["secret"]

2385

3352

client.encrypted_secret = pgp.encrypt(client.secret,

2386

3353

key)

2388

3355

2389

3356

# A list of attributes that can not be pickled

2390

3357

# + secret.

2391

exclude = set(("bus", "changedstate", "secret",

2392

"checker"))

2393

for name, typ in (inspect.getmembers

2394

(dbus.service.Object)):

3358

exclude = { "bus", "changedstate", "secret",

3359

"checker", "server_settings" }

3360

for name, typ in inspect.getmembers(dbus.service

3361

.Object):

2395

3362

exclude.add(name)

2396

3363

2397

3364

client_dict["encrypted_secret"] = (client

2404

3371

del client_settings[client.name]["secret"]

2405

3372

2406

3373

try:

2407

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2408

prefix="clients-",

2409

dir=os.path.dirname

2410

(stored_state_path))

2411

with os.fdopen(tempfd, "wb") as stored_state:

2412

pickle.dump((clients, client_settings), stored_state)

3374

with tempfile.NamedTemporaryFile(

3375

mode='wb',

3376

suffix=".pickle",

3377

prefix='clients-',

3378

dir=os.path.dirname(stored_state_path),

3379

delete=False) as stored_state:

3380

pickle.dump((clients, client_settings), stored_state,

3381

protocol = 2)

3382

tempname = stored_state.name

2413

3383

os.rename(tempname, stored_state_path)

2414

3384

except (IOError, OSError) as e:

2415

logger.warning("Could not save persistent state: {0}"

2416

.format(e))

2417

3385

if not debug:

2418

3386

try:

2419

3387

os.remove(tempname)

2420

3388

except NameError:

2421

3389

pass

2422

if e.errno not in set((errno.ENOENT, errno.EACCES,

2423

errno.EEXIST)):

2424

raise e

3390

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3391

logger.warning("Could not save persistent state: {}"

3392

.format(os.strerror(e.errno)))

3393

else:

3394

logger.warning("Could not save persistent state:",

3395

exc_info=e)

3396

raise

2425

3397

2426

3398

# Delete all clients, and settings from config

2427

3399

while tcp_server.clients:

2428

3400

name, client = tcp_server.clients.popitem()

2429

3401

if use_dbus:

2430

3402

client.remove_from_connection()

2431

# Don't signal anything except ClientRemoved

3403

# Don't signal the disabling

2432

3404

client.disable(quiet=True)

3405

# Emit D-Bus signal for removal

2433

3406

if use_dbus:

2434

# Emit D-Bus signal

2435

mandos_dbus_service.ClientRemoved(client

2436

.dbus_object_path,

2437

client.name)

3407

mandos_dbus_service.client_removed_signal(client)

2438

3408

client_settings.clear()

2439

3409

2440

3410

atexit.register(cleanup)

2441

3411

2442

for client in tcp_server.clients.itervalues():

3412

for client in tcp_server.clients.values():

2443

3413

if use_dbus:

2444

# Emit D-Bus signal

2445

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3414

# Emit D-Bus signal for adding

3415

mandos_dbus_service.client_added_signal(client)

2446

3416

# Need to initiate checking of clients

2447

3417

if client.enabled:

2448

3418

client.init_checker()

2451

3421

tcp_server.server_activate()

2452

3422

2453

3423

# Find out what port we got

2454

service.port = tcp_server.socket.getsockname()[1]

3424

if zeroconf:

3425

service.port = tcp_server.socket.getsockname()[1]

2455

3426

if use_ipv6:

2456

3427

logger.info("Now listening on address %r, port %d,"

2457

" flowinfo %d, scope_id %d"

2458

% tcp_server.socket.getsockname())

3428

" flowinfo %d, scope_id %d",

3429

*tcp_server.socket.getsockname())

2459

3430

else: # IPv4

2460

logger.info("Now listening on address %r, port %d"

2461

% tcp_server.socket.getsockname())

3431

logger.info("Now listening on address %r, port %d",

3432

*tcp_server.socket.getsockname())

2462

3433

2463

3434

#service.interface = tcp_server.socket.getsockname()[3]

2464

3435

2465

3436

try:

2466

# From the Avahi example code

2467

try:

2468

service.activate()

2469

except dbus.exceptions.DBusException as error:

2470

logger.critical("DBusException: %s", error)

2471

cleanup()

2472

sys.exit(1)

2473

# End of Avahi example code

3437

if zeroconf:

3438

# From the Avahi example code

3439

try:

3440

service.activate()

3441

except dbus.exceptions.DBusException as error:

3442

logger.critical("D-Bus Exception", exc_info=error)

3443

cleanup()

3444

sys.exit(1)

3445

# End of Avahi example code

2474

3446

2475

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2476

lambda *args, **kwargs:

2477

(tcp_server.handle_request

2478

(*args[2:], **kwargs) or True))

3447

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3448

lambda *args, **kwargs:

3449

(tcp_server.handle_request

3450

(*args[2:], **kwargs) or True))

2479

3451

2480

3452

logger.debug("Starting main loop")

2481

3453

main_loop.run()

2482

3454

except AvahiError as error:

2483

logger.critical("AvahiError: %s", error)

3455

logger.critical("Avahi Error", exc_info=error)

2484

3456

cleanup()

2485

3457

sys.exit(1)

2486

3458

except KeyboardInterrupt:

2491

3463

# Must run before the D-Bus bus name gets deregistered

2492

3464

cleanup()

2493

3465

3466

2494

3467

if __name__ == '__main__':

2495

3468

main()