105
126
max_renames: integer; maximum number of renames
106
127
rename_count: integer; counter so we only rename after collisions
107
128
a sensible number of times
129
group: D-Bus Entry Group
131
bus: dbus.SystemBus()
109
133
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
110
type = None, port = None, TXT = None, domain = "",
111
host = "", max_renames = 32768):
134
servicetype = None, port = None, TXT = None,
135
domain = u"", host = u"", max_renames = 32768,
136
protocol = avahi.PROTO_UNSPEC, bus = None):
112
137
self.interface = interface
139
self.type = servicetype
141
self.TXT = TXT if TXT is not None else []
120
142
self.domain = domain
122
144
self.rename_count = 0
123
145
self.max_renames = max_renames
146
self.protocol = protocol
147
self.group = None # our entry group
124
150
def rename(self):
125
151
"""Derived from the Avahi example code"""
126
152
if self.rename_count >= self.max_renames:
127
153
logger.critical(u"No suitable Zeroconf service name found"
128
154
u" after %i retries, exiting.",
130
raise AvahiServiceError("Too many renames")
131
self.name = server.GetAlternativeServiceName(self.name)
156
raise AvahiServiceError(u"Too many renames")
157
self.name = self.server.GetAlternativeServiceName(self.name)
132
158
logger.info(u"Changing Zeroconf service name to %r ...",
134
syslogger.setFormatter(logging.Formatter\
135
('Mandos (%s): %%(levelname)s:'
136
' %%(message)s' % self.name))
160
syslogger.setFormatter(logging.Formatter
161
(u'Mandos (%s) [%%(process)d]:'
162
u' %%(levelname)s: %%(message)s'
139
166
self.rename_count += 1
140
167
def remove(self):
141
168
"""Derived from the Avahi example code"""
142
if group is not None:
169
if self.group is not None:
145
172
"""Derived from the Avahi example code"""
148
group = dbus.Interface\
149
(bus.get_object(avahi.DBUS_NAME,
150
server.EntryGroupNew()),
151
avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
group.connect_to_signal('StateChanged',
153
entry_group_state_changed)
173
if self.group is None:
174
self.group = dbus.Interface(
175
self.bus.get_object(avahi.DBUS_NAME,
176
self.server.EntryGroupNew()),
177
avahi.DBUS_INTERFACE_ENTRY_GROUP)
178
self.group.connect_to_signal('StateChanged',
180
.entry_group_state_changed)
154
181
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
155
service.name, service.type)
157
self.interface, # interface
158
avahi.PROTO_INET6, # protocol
159
dbus.UInt32(0), # flags
160
self.name, self.type,
161
self.domain, self.host,
162
dbus.UInt16(self.port),
163
avahi.string_array_to_txt_array(self.TXT))
166
# From the Avahi example code:
167
group = None # our entry group
168
# End of Avahi example code
182
self.name, self.type)
183
self.group.AddService(
186
dbus.UInt32(0), # flags
187
self.name, self.type,
188
self.domain, self.host,
189
dbus.UInt16(self.port),
190
avahi.string_array_to_txt_array(self.TXT))
192
def entry_group_state_changed(self, state, error):
193
"""Derived from the Avahi example code"""
194
logger.debug(u"Avahi state change: %i", state)
196
if state == avahi.ENTRY_GROUP_ESTABLISHED:
197
logger.debug(u"Zeroconf service established.")
198
elif state == avahi.ENTRY_GROUP_COLLISION:
199
logger.warning(u"Zeroconf service name collision.")
201
elif state == avahi.ENTRY_GROUP_FAILURE:
202
logger.critical(u"Avahi: Error in group state changed %s",
204
raise AvahiGroupError(u"State changed: %s"
207
"""Derived from the Avahi example code"""
208
if self.group is not None:
211
def server_state_changed(self, state):
212
"""Derived from the Avahi example code"""
213
if state == avahi.SERVER_COLLISION:
214
logger.error(u"Zeroconf server name collision")
216
elif state == avahi.SERVER_RUNNING:
219
"""Derived from the Avahi example code"""
220
if self.server is None:
221
self.server = dbus.Interface(
222
self.bus.get_object(avahi.DBUS_NAME,
223
avahi.DBUS_PATH_SERVER),
224
avahi.DBUS_INTERFACE_SERVER)
225
self.server.connect_to_signal(u"StateChanged",
226
self.server_state_changed)
227
self.server_state_changed(self.server.GetState())
171
230
class Client(object):
172
231
"""A representation of a client host served by this server.
174
name: string; from the config file, used in log messages
234
name: string; from the config file, used in log messages and
175
236
fingerprint: string (40 or 32 hexadecimal digits); used to
176
237
uniquely identify the client
177
secret: bytestring; sent verbatim (over TLS) to client
178
host: string; available for use by the checker command
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
181
timeout: datetime.timedelta(); How long from last_checked_ok
182
until this client is invalid
183
interval: datetime.timedelta(); How often to start a new checker
184
stop_hook: If set, called by stop() as stop_hook(self)
185
checker: subprocess.Popen(); a running checker process used
186
to see if the client lives.
187
'None' if no process is running.
238
secret: bytestring; sent verbatim (over TLS) to client
239
host: string; available for use by the checker command
240
created: datetime.datetime(); (UTC) object creation
241
last_enabled: datetime.datetime(); (UTC)
243
last_checked_ok: datetime.datetime(); (UTC) or None
244
timeout: datetime.timedelta(); How long from last_checked_ok
245
until this client is invalid
246
interval: datetime.timedelta(); How often to start a new checker
247
disable_hook: If set, called by disable() as disable_hook(self)
248
checker: subprocess.Popen(); a running checker process used
249
to see if the client lives.
250
'None' if no process is running.
188
251
checker_initiator_tag: a gobject event source tag, or None
189
stop_initiator_tag: - '' -
252
disable_initiator_tag: - '' -
190
253
checker_callback_tag: - '' -
191
254
checker_command: string; External command which is run to check if
192
255
client lives. %() expansions are done at
193
256
runtime with vars(self) as dict, so that for
194
257
instance %(name)s can be used in the command.
196
_timeout: Real variable for 'timeout'
197
_interval: Real variable for 'interval'
198
_timeout_milliseconds: Used when calling gobject.timeout_add()
199
_interval_milliseconds: - '' -
258
current_checker_command: string; current running checker_command
201
def _set_timeout(self, timeout):
202
"Setter function for 'timeout' attribute"
203
self._timeout = timeout
204
self._timeout_milliseconds = ((self.timeout.days
205
* 24 * 60 * 60 * 1000)
206
+ (self.timeout.seconds * 1000)
207
+ (self.timeout.microseconds
209
timeout = property(lambda self: self._timeout,
212
def _set_interval(self, interval):
213
"Setter function for 'interval' attribute"
214
self._interval = interval
215
self._interval_milliseconds = ((self.interval.days
216
* 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds
219
+ (self.interval.microseconds
221
interval = property(lambda self: self._interval,
224
def __init__(self, name = None, stop_hook=None, config={}):
262
def _timedelta_to_milliseconds(td):
263
"Convert a datetime.timedelta() to milliseconds"
264
return ((td.days * 24 * 60 * 60 * 1000)
265
+ (td.seconds * 1000)
266
+ (td.microseconds // 1000))
268
def timeout_milliseconds(self):
269
"Return the 'timeout' attribute in milliseconds"
270
return self._timedelta_to_milliseconds(self.timeout)
272
def interval_milliseconds(self):
273
"Return the 'interval' attribute in milliseconds"
274
return self._timedelta_to_milliseconds(self.interval)
276
def __init__(self, name = None, disable_hook=None, config=None):
225
277
"""Note: the 'checker' key in 'config' sets the
226
278
'checker_command' attribute and *not* the 'checker'
229
283
logger.debug(u"Creating client %r", self.name)
230
284
# Uppercase and remove spaces from fingerprint for later
231
285
# comparison purposes with return value from the fingerprint()
233
self.fingerprint = config["fingerprint"].upper()\
287
self.fingerprint = (config[u"fingerprint"].upper()
235
289
logger.debug(u" Fingerprint: %s", self.fingerprint)
236
if "secret" in config:
237
self.secret = config["secret"].decode(u"base64")
238
elif "secfile" in config:
239
sf = open(config["secfile"])
240
self.secret = sf.read()
290
if u"secret" in config:
291
self.secret = config[u"secret"].decode(u"base64")
292
elif u"secfile" in config:
293
with closing(open(os.path.expanduser
295
(config[u"secfile"])))) as secfile:
296
self.secret = secfile.read()
243
298
raise TypeError(u"No secret or secfile for client %s"
245
self.host = config.get("host", "")
246
self.created = datetime.datetime.now()
300
self.host = config.get(u"host", u"")
301
self.created = datetime.datetime.utcnow()
303
self.last_enabled = None
247
304
self.last_checked_ok = None
248
self.timeout = string_to_delta(config["timeout"])
249
self.interval = string_to_delta(config["interval"])
250
self.stop_hook = stop_hook
305
self.timeout = string_to_delta(config[u"timeout"])
306
self.interval = string_to_delta(config[u"interval"])
307
self.disable_hook = disable_hook
251
308
self.checker = None
252
309
self.checker_initiator_tag = None
253
self.stop_initiator_tag = None
310
self.disable_initiator_tag = None
254
311
self.checker_callback_tag = None
255
self.check_command = config["checker"]
312
self.checker_command = config[u"checker"]
313
self.current_checker_command = None
314
self.last_connect = None
257
317
"""Start this client's checker and timeout hooks"""
318
if getattr(self, u"enabled", False):
321
self.last_enabled = datetime.datetime.utcnow()
258
322
# Schedule a new checker to be started an 'interval' from now,
259
323
# and every interval from then on.
260
self.checker_initiator_tag = gobject.timeout_add\
261
(self._interval_milliseconds,
324
self.checker_initiator_tag = (gobject.timeout_add
325
(self.interval_milliseconds(),
263
327
# Also start a new checker *right now*.
264
328
self.start_checker()
265
# Schedule a stop() when 'timeout' has passed
266
self.stop_initiator_tag = gobject.timeout_add\
267
(self._timeout_milliseconds,
271
The possibility that a client might be restarted is left open,
272
but not currently used."""
273
# If this client doesn't have a secret, it is already stopped.
274
if hasattr(self, "secret") and self.secret:
275
logger.info(u"Stopping client %s", self.name)
329
# Schedule a disable() when 'timeout' has passed
330
self.disable_initiator_tag = (gobject.timeout_add
331
(self.timeout_milliseconds(),
336
"""Disable this client."""
337
if not getattr(self, "enabled", False):
279
if getattr(self, "stop_initiator_tag", False):
280
gobject.source_remove(self.stop_initiator_tag)
281
self.stop_initiator_tag = None
282
if getattr(self, "checker_initiator_tag", False):
339
logger.info(u"Disabling client %s", self.name)
340
if getattr(self, u"disable_initiator_tag", False):
341
gobject.source_remove(self.disable_initiator_tag)
342
self.disable_initiator_tag = None
343
if getattr(self, u"checker_initiator_tag", False):
283
344
gobject.source_remove(self.checker_initiator_tag)
284
345
self.checker_initiator_tag = None
285
346
self.stop_checker()
347
if self.disable_hook:
348
self.disable_hook(self)
288
350
# Do not run this again if called by a gobject.timeout_add
290
353
def __del__(self):
291
self.stop_hook = None
293
def checker_callback(self, pid, condition):
354
self.disable_hook = None
357
def checker_callback(self, pid, condition, command):
294
358
"""The checker has completed, so take appropriate actions."""
295
now = datetime.datetime.now()
296
359
self.checker_callback_tag = None
297
360
self.checker = None
298
if os.WIFEXITED(condition) \
299
and (os.WEXITSTATUS(condition) == 0):
300
logger.info(u"Checker for %(name)s succeeded",
302
self.last_checked_ok = now
303
gobject.source_remove(self.stop_initiator_tag)
304
self.stop_initiator_tag = gobject.timeout_add\
305
(self._timeout_milliseconds,
307
elif not os.WIFEXITED(condition):
361
if os.WIFEXITED(condition):
362
exitstatus = os.WEXITSTATUS(condition)
364
logger.info(u"Checker for %(name)s succeeded",
368
logger.info(u"Checker for %(name)s failed",
308
371
logger.warning(u"Checker for %(name)s crashed?",
311
logger.info(u"Checker for %(name)s failed",
374
def checked_ok(self):
375
"""Bump up the timeout for this client.
377
This should only be called when the client has been seen,
380
self.last_checked_ok = datetime.datetime.utcnow()
381
gobject.source_remove(self.disable_initiator_tag)
382
self.disable_initiator_tag = (gobject.timeout_add
383
(self.timeout_milliseconds(),
313
386
def start_checker(self):
314
387
"""Start a new checker subprocess if one is not running.
315
389
If a checker already exists, leave it running and do
317
391
# The reason for not killing a running checker is that if we
372
468
if error.errno != errno.ESRCH: # No such process
374
470
self.checker = None
375
472
def still_valid(self):
376
473
"""Has the timeout not yet passed for this client?"""
377
now = datetime.datetime.now()
474
if not getattr(self, u"enabled", False):
476
now = datetime.datetime.utcnow()
378
477
if self.last_checked_ok is None:
379
478
return now < (self.created + self.timeout)
381
480
return now < (self.last_checked_ok + self.timeout)
384
def peer_certificate(session):
385
"Return the peer's OpenPGP certificate as a bytestring"
386
# If not an OpenPGP certificate...
387
if gnutls.library.functions.gnutls_certificate_type_get\
388
(session._c_object) \
389
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
390
# ...do the normal thing
391
return session.peer_certificate
392
list_size = ctypes.c_uint()
393
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
394
(session._c_object, ctypes.byref(list_size))
395
if list_size.value == 0:
398
return ctypes.string_at(cert.data, cert.size)
401
def fingerprint(openpgp):
402
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
403
# New GnuTLS "datum" with the OpenPGP public key
404
datum = gnutls.library.types.gnutls_datum_t\
405
(ctypes.cast(ctypes.c_char_p(openpgp),
406
ctypes.POINTER(ctypes.c_ubyte)),
407
ctypes.c_uint(len(openpgp)))
408
# New empty GnuTLS certificate
409
crt = gnutls.library.types.gnutls_openpgp_crt_t()
410
gnutls.library.functions.gnutls_openpgp_crt_init\
412
# Import the OpenPGP public key into the certificate
413
gnutls.library.functions.gnutls_openpgp_crt_import\
414
(crt, ctypes.byref(datum),
415
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
416
# Verify the self signature in the key
417
crtverify = ctypes.c_uint();
418
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
419
(crt, 0, ctypes.byref(crtverify))
420
if crtverify.value != 0:
421
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
422
raise gnutls.errors.CertificateSecurityError("Verify failed")
423
# New buffer for the fingerprint
424
buffer = ctypes.create_string_buffer(20)
425
buffer_length = ctypes.c_size_t()
426
# Get the fingerprint from the certificate into the buffer
427
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
428
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
429
# Deinit the certificate
430
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
431
# Convert the buffer to a Python bytestring
432
fpr = ctypes.string_at(buffer, buffer_length.value)
433
# Convert the bytestring to hexadecimal notation
434
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
438
class tcp_handler(SocketServer.BaseRequestHandler, object):
439
"""A TCP request handler class.
440
Instantiated by IPv6_TCPServer for each request to handle it.
483
def dbus_service_property(dbus_interface, signature=u"v",
484
access=u"readwrite", byte_arrays=False):
485
"""Decorators for marking methods of a DBusObjectWithProperties to
486
become properties on the D-Bus.
488
The decorated method will be called with no arguments by "Get"
489
and with one argument by "Set".
491
The parameters, where they are supported, are the same as
492
dbus.service.method, except there is only "signature", since the
493
type from Get() and the type sent to Set() is the same.
496
func._dbus_is_property = True
497
func._dbus_interface = dbus_interface
498
func._dbus_signature = signature
499
func._dbus_access = access
500
func._dbus_name = func.__name__
501
if func._dbus_name.endswith(u"_dbus_property"):
502
func._dbus_name = func._dbus_name[:-14]
503
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
508
class DBusPropertyException(dbus.exceptions.DBusException):
509
"""A base class for D-Bus property-related exceptions
511
def __unicode__(self):
512
return unicode(str(self))
515
class DBusPropertyAccessException(DBusPropertyException):
516
"""A property's access permissions disallows an operation.
521
class DBusPropertyNotFound(DBusPropertyException):
522
"""An attempt was made to access a non-existing property.
527
class DBusObjectWithProperties(dbus.service.Object):
528
"""A D-Bus object with properties.
530
Classes inheriting from this can use the dbus_service_property
531
decorator to expose methods as D-Bus properties. It exposes the
532
standard Get(), Set(), and GetAll() methods on the D-Bus.
536
def _is_dbus_property(obj):
537
return getattr(obj, u"_dbus_is_property", False)
539
def _get_all_dbus_properties(self):
540
"""Returns a generator of (name, attribute) pairs
542
return ((prop._dbus_name, prop)
544
inspect.getmembers(self, self._is_dbus_property))
546
def _get_dbus_property(self, interface_name, property_name):
547
"""Returns a bound method if one exists which is a D-Bus
548
property with the specified name and interface.
550
for name in (property_name,
551
property_name + u"_dbus_property"):
552
prop = getattr(self, name, None)
554
or not self._is_dbus_property(prop)
555
or prop._dbus_name != property_name
556
or (interface_name and prop._dbus_interface
557
and interface_name != prop._dbus_interface)):
561
raise DBusPropertyNotFound(self.dbus_object_path + u":"
562
+ interface_name + u"."
565
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
567
def Get(self, interface_name, property_name):
568
"""Standard D-Bus property Get() method, see D-Bus standard.
570
prop = self._get_dbus_property(interface_name, property_name)
571
if prop._dbus_access == u"write":
572
raise DBusPropertyAccessException(property_name)
574
if not hasattr(value, u"variant_level"):
576
return type(value)(value, variant_level=value.variant_level+1)
578
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
579
def Set(self, interface_name, property_name, value):
580
"""Standard D-Bus property Set() method, see D-Bus standard.
582
prop = self._get_dbus_property(interface_name, property_name)
583
if prop._dbus_access == u"read":
584
raise DBusPropertyAccessException(property_name)
585
if prop._dbus_get_args_options[u"byte_arrays"]:
586
value = dbus.ByteArray(''.join(unichr(byte)
590
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
591
out_signature=u"a{sv}")
592
def GetAll(self, interface_name):
593
"""Standard D-Bus property GetAll() method, see D-Bus
596
Note: Will not include properties with access="write".
599
for name, prop in self._get_all_dbus_properties():
601
and interface_name != prop._dbus_interface):
602
# Interface non-empty but did not match
604
# Ignore write-only properties
605
if prop._dbus_access == u"write":
608
if not hasattr(value, u"variant_level"):
611
all[name] = type(value)(value, variant_level=
612
value.variant_level+1)
613
return dbus.Dictionary(all, signature=u"sv")
615
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
617
path_keyword='object_path',
618
connection_keyword='connection')
619
def Introspect(self, object_path, connection):
620
"""Standard D-Bus method, overloaded to insert property tags.
622
xmlstring = dbus.service.Object.Introspect(self, object_path,
624
document = xml.dom.minidom.parseString(xmlstring)
626
def make_tag(document, name, prop):
627
e = document.createElement(u"property")
628
e.setAttribute(u"name", name)
629
e.setAttribute(u"type", prop._dbus_signature)
630
e.setAttribute(u"access", prop._dbus_access)
632
for if_tag in document.getElementsByTagName(u"interface"):
633
for tag in (make_tag(document, name, prop)
635
in self._get_all_dbus_properties()
636
if prop._dbus_interface
637
== if_tag.getAttribute(u"name")):
638
if_tag.appendChild(tag)
639
xmlstring = document.toxml(u"utf-8")
644
class ClientDBus(Client, DBusObjectWithProperties):
645
"""A Client class using D-Bus
648
dbus_object_path: dbus.ObjectPath
649
bus: dbus.SystemBus()
651
# dbus.service.Object doesn't use super(), so we can't either.
653
def __init__(self, bus = None, *args, **kwargs):
655
Client.__init__(self, *args, **kwargs)
656
# Only now, when this client is initialized, can it show up on
658
self.dbus_object_path = (dbus.ObjectPath
660
+ self.name.replace(u".", u"_")))
661
DBusObjectWithProperties.__init__(self, self.bus,
662
self.dbus_object_path)
665
def _datetime_to_dbus(dt, variant_level=0):
666
"""Convert a UTC datetime.datetime() to a D-Bus type."""
667
return dbus.String(dt.isoformat(),
668
variant_level=variant_level)
671
oldstate = getattr(self, u"enabled", False)
672
r = Client.enable(self)
673
if oldstate != self.enabled:
675
self.PropertyChanged(dbus.String(u"enabled"),
676
dbus.Boolean(True, variant_level=1))
677
self.PropertyChanged(
678
dbus.String(u"last_enabled"),
679
self._datetime_to_dbus(self.last_enabled,
683
def disable(self, signal = True):
684
oldstate = getattr(self, u"enabled", False)
685
r = Client.disable(self)
686
if signal and oldstate != self.enabled:
688
self.PropertyChanged(dbus.String(u"enabled"),
689
dbus.Boolean(False, variant_level=1))
692
def __del__(self, *args, **kwargs):
694
self.remove_from_connection()
697
if hasattr(DBusObjectWithProperties, u"__del__"):
698
DBusObjectWithProperties.__del__(self, *args, **kwargs)
699
Client.__del__(self, *args, **kwargs)
701
def checker_callback(self, pid, condition, command,
703
self.checker_callback_tag = None
706
self.PropertyChanged(dbus.String(u"checker_running"),
707
dbus.Boolean(False, variant_level=1))
708
if os.WIFEXITED(condition):
709
exitstatus = os.WEXITSTATUS(condition)
711
self.CheckerCompleted(dbus.Int16(exitstatus),
712
dbus.Int64(condition),
713
dbus.String(command))
716
self.CheckerCompleted(dbus.Int16(-1),
717
dbus.Int64(condition),
718
dbus.String(command))
720
return Client.checker_callback(self, pid, condition, command,
723
def checked_ok(self, *args, **kwargs):
724
r = Client.checked_ok(self, *args, **kwargs)
726
self.PropertyChanged(
727
dbus.String(u"last_checked_ok"),
728
(self._datetime_to_dbus(self.last_checked_ok,
732
def start_checker(self, *args, **kwargs):
733
old_checker = self.checker
734
if self.checker is not None:
735
old_checker_pid = self.checker.pid
737
old_checker_pid = None
738
r = Client.start_checker(self, *args, **kwargs)
739
# Only if new checker process was started
740
if (self.checker is not None
741
and old_checker_pid != self.checker.pid):
743
self.CheckerStarted(self.current_checker_command)
744
self.PropertyChanged(
745
dbus.String(u"checker_running"),
746
dbus.Boolean(True, variant_level=1))
749
def stop_checker(self, *args, **kwargs):
750
old_checker = getattr(self, u"checker", None)
751
r = Client.stop_checker(self, *args, **kwargs)
752
if (old_checker is not None
753
and getattr(self, u"checker", None) is None):
754
self.PropertyChanged(dbus.String(u"checker_running"),
755
dbus.Boolean(False, variant_level=1))
758
## D-Bus methods & signals
759
_interface = u"se.bsnet.fukt.Mandos.Client"
761
# CheckerCompleted - signal
762
@dbus.service.signal(_interface, signature=u"nxs")
763
def CheckerCompleted(self, exitcode, waitstatus, command):
767
# CheckerStarted - signal
768
@dbus.service.signal(_interface, signature=u"s")
769
def CheckerStarted(self, command):
773
# PropertyChanged - signal
774
@dbus.service.signal(_interface, signature=u"sv")
775
def PropertyChanged(self, property, value):
779
# ReceivedSecret - signal
780
@dbus.service.signal(_interface)
781
def ReceivedSecret(self):
786
@dbus.service.signal(_interface)
792
@dbus_service_property(_interface, signature=u"s", access=u"read")
793
def name_dbus_property(self):
794
return dbus.String(self.name)
796
# fingerprint - property
797
@dbus_service_property(_interface, signature=u"s", access=u"read")
798
def fingerprint_dbus_property(self):
799
return dbus.String(self.fingerprint)
802
@dbus_service_property(_interface, signature=u"s",
804
def host_dbus_property(self, value=None):
805
if value is None: # get
806
return dbus.String(self.host)
809
self.PropertyChanged(dbus.String(u"host"),
810
dbus.String(value, variant_level=1))
813
@dbus_service_property(_interface, signature=u"s", access=u"read")
814
def created_dbus_property(self):
815
return dbus.String(self._datetime_to_dbus(self.created))
817
# last_enabled - property
818
@dbus_service_property(_interface, signature=u"s", access=u"read")
819
def last_enabled_dbus_property(self):
820
if self.last_enabled is None:
821
return dbus.String(u"")
822
return dbus.String(self._datetime_to_dbus(self.last_enabled))
825
@dbus_service_property(_interface, signature=u"b",
827
def enabled_dbus_property(self, value=None):
828
if value is None: # get
829
return dbus.Boolean(self.enabled)
835
# last_checked_ok - property
836
@dbus_service_property(_interface, signature=u"s", access=u"read")
837
def last_checked_ok_dbus_property(self):
838
if self.last_checked_ok is None:
839
return dbus.String(u"")
840
return dbus.String(self._datetime_to_dbus(self
844
@dbus_service_property(_interface, signature=u"t",
846
def timeout_dbus_property(self, value=None):
847
if value is None: # get
848
return dbus.UInt64(self.timeout_milliseconds())
849
self.timeout = datetime.timedelta(0, 0, 0, value)
851
self.PropertyChanged(dbus.String(u"timeout"),
852
dbus.UInt64(value, variant_level=1))
853
if getattr(self, u"disable_initiator_tag", None) is None:
856
gobject.source_remove(self.disable_initiator_tag)
857
self.disable_initiator_tag = None
859
_timedelta_to_milliseconds((self
865
# The timeout has passed
868
self.disable_initiator_tag = (gobject.timeout_add
869
(time_to_die, self.disable))
871
# interval - property
872
@dbus_service_property(_interface, signature=u"t",
874
def interval_dbus_property(self, value=None):
875
if value is None: # get
876
return dbus.UInt64(self.interval_milliseconds())
877
self.interval = datetime.timedelta(0, 0, 0, value)
879
self.PropertyChanged(dbus.String(u"interval"),
880
dbus.UInt64(value, variant_level=1))
881
if getattr(self, u"checker_initiator_tag", None) is None:
883
# Reschedule checker run
884
gobject.source_remove(self.checker_initiator_tag)
885
self.checker_initiator_tag = (gobject.timeout_add
886
(value, self.start_checker))
887
self.start_checker() # Start one now, too
890
@dbus_service_property(_interface, signature=u"s",
892
def checker_dbus_property(self, value=None):
893
if value is None: # get
894
return dbus.String(self.checker_command)
895
self.checker_command = value
897
self.PropertyChanged(dbus.String(u"checker"),
898
dbus.String(self.checker_command,
901
# checker_running - property
902
@dbus_service_property(_interface, signature=u"b",
904
def checker_running_dbus_property(self, value=None):
905
if value is None: # get
906
return dbus.Boolean(self.checker is not None)
912
# object_path - property
913
@dbus_service_property(_interface, signature=u"o", access=u"read")
914
def object_path_dbus_property(self):
915
return self.dbus_object_path # is already a dbus.ObjectPath
917
# secret = property xxx
918
@dbus_service_property(_interface, signature=u"ay",
919
access=u"write", byte_arrays=True)
920
def secret_dbus_property(self, value):
921
self.secret = str(value)
926
class ClientHandler(socketserver.BaseRequestHandler, object):
927
"""A class to handle client connections.
929
Instantiated once for each connection to handle it.
441
930
Note: This will run in its own forked process."""
443
932
def handle(self):
444
933
logger.info(u"TCP connection from: %s",
445
unicode(self.client_address))
446
session = gnutls.connection.ClientSession\
447
(self.request, gnutls.connection.X509Credentials())
449
line = self.request.makefile().readline()
450
logger.debug(u"Protocol version: %r", line)
452
if int(line.strip().split()[0]) > 1:
454
except (ValueError, IndexError, RuntimeError), error:
455
logger.error(u"Unknown protocol version: %s", error)
458
# Note: gnutls.connection.X509Credentials is really a generic
459
# GnuTLS certificate credentials object so long as no X.509
460
# keys are added to it. Therefore, we can use it here despite
461
# using OpenPGP certificates.
463
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
464
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
466
priority = "NORMAL" # Fallback default, since this
468
if self.server.settings["priority"]:
469
priority = self.server.settings["priority"]
470
gnutls.library.functions.gnutls_priority_set_direct\
471
(session._c_object, priority, None);
475
except gnutls.errors.GNUTLSError, error:
476
logger.warning(u"Handshake failed: %s", error)
477
# Do not run session.bye() here: the session is not
478
# established. Just abandon the request.
481
fpr = fingerprint(peer_certificate(session))
482
except (TypeError, gnutls.errors.GNUTLSError), error:
483
logger.warning(u"Bad certificate: %s", error)
486
logger.debug(u"Fingerprint: %s", fpr)
488
for c in self.server.clients:
489
if c.fingerprint == fpr:
493
logger.warning(u"Client not found for fingerprint: %s",
497
# Have to check if client.still_valid(), since it is possible
498
# that the client timed out while establishing the GnuTLS
500
if not client.still_valid():
501
logger.warning(u"Client %(name)s is invalid",
506
while sent_size < len(client.secret):
507
sent = session.send(client.secret[sent_size:])
508
logger.debug(u"Sent: %d, remaining: %d",
509
sent, len(client.secret)
510
- (sent_size + sent))
515
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
516
"""IPv6 TCP server. Accepts 'None' as address and/or port.
934
unicode(self.client_address))
935
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
936
# Open IPC pipe to parent process
937
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
938
session = (gnutls.connection
939
.ClientSession(self.request,
943
line = self.request.makefile().readline()
944
logger.debug(u"Protocol version: %r", line)
946
if int(line.strip().split()[0]) > 1:
948
except (ValueError, IndexError, RuntimeError), error:
949
logger.error(u"Unknown protocol version: %s", error)
952
# Note: gnutls.connection.X509Credentials is really a
953
# generic GnuTLS certificate credentials object so long as
954
# no X.509 keys are added to it. Therefore, we can use it
955
# here despite using OpenPGP certificates.
957
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
958
# u"+AES-256-CBC", u"+SHA1",
959
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
961
# Use a fallback default, since this MUST be set.
962
priority = self.server.gnutls_priority
965
(gnutls.library.functions
966
.gnutls_priority_set_direct(session._c_object,
971
except gnutls.errors.GNUTLSError, error:
972
logger.warning(u"Handshake failed: %s", error)
973
# Do not run session.bye() here: the session is not
974
# established. Just abandon the request.
976
logger.debug(u"Handshake succeeded")
978
fpr = self.fingerprint(self.peer_certificate(session))
979
except (TypeError, gnutls.errors.GNUTLSError), error:
980
logger.warning(u"Bad certificate: %s", error)
983
logger.debug(u"Fingerprint: %s", fpr)
985
for c in self.server.clients:
986
if c.fingerprint == fpr:
990
ipc.write(u"NOTFOUND %s %s\n"
991
% (fpr, unicode(self.client_address)))
994
# Have to check if client.still_valid(), since it is
995
# possible that the client timed out while establishing
996
# the GnuTLS session.
997
if not client.still_valid():
998
ipc.write(u"INVALID %s\n" % client.name)
1001
ipc.write(u"SENDING %s\n" % client.name)
1003
while sent_size < len(client.secret):
1004
sent = session.send(client.secret[sent_size:])
1005
logger.debug(u"Sent: %d, remaining: %d",
1006
sent, len(client.secret)
1007
- (sent_size + sent))
1012
def peer_certificate(session):
1013
"Return the peer's OpenPGP certificate as a bytestring"
1014
# If not an OpenPGP certificate...
1015
if (gnutls.library.functions
1016
.gnutls_certificate_type_get(session._c_object)
1017
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1018
# ...do the normal thing
1019
return session.peer_certificate
1020
list_size = ctypes.c_uint(1)
1021
cert_list = (gnutls.library.functions
1022
.gnutls_certificate_get_peers
1023
(session._c_object, ctypes.byref(list_size)))
1024
if not bool(cert_list) and list_size.value != 0:
1025
raise gnutls.errors.GNUTLSError(u"error getting peer"
1027
if list_size.value == 0:
1030
return ctypes.string_at(cert.data, cert.size)
1033
def fingerprint(openpgp):
1034
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1035
# New GnuTLS "datum" with the OpenPGP public key
1036
datum = (gnutls.library.types
1037
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1040
ctypes.c_uint(len(openpgp))))
1041
# New empty GnuTLS certificate
1042
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1043
(gnutls.library.functions
1044
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1045
# Import the OpenPGP public key into the certificate
1046
(gnutls.library.functions
1047
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1048
gnutls.library.constants
1049
.GNUTLS_OPENPGP_FMT_RAW))
1050
# Verify the self signature in the key
1051
crtverify = ctypes.c_uint()
1052
(gnutls.library.functions
1053
.gnutls_openpgp_crt_verify_self(crt, 0,
1054
ctypes.byref(crtverify)))
1055
if crtverify.value != 0:
1056
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1057
raise (gnutls.errors.CertificateSecurityError
1059
# New buffer for the fingerprint
1060
buf = ctypes.create_string_buffer(20)
1061
buf_len = ctypes.c_size_t()
1062
# Get the fingerprint from the certificate into the buffer
1063
(gnutls.library.functions
1064
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1065
ctypes.byref(buf_len)))
1066
# Deinit the certificate
1067
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1068
# Convert the buffer to a Python bytestring
1069
fpr = ctypes.string_at(buf, buf_len.value)
1070
# Convert the bytestring to hexadecimal notation
1071
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1075
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
1076
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
1077
def process_request(self, request, client_address):
1078
"""Overrides and wraps the original process_request().
1080
This function creates a new pipe in self.pipe
1082
self.pipe = os.pipe()
1083
super(ForkingMixInWithPipe,
1084
self).process_request(request, client_address)
1085
os.close(self.pipe[1]) # close write end
1086
self.add_pipe(self.pipe[0])
1087
def add_pipe(self, pipe):
1088
"""Dummy function; override as necessary"""
1092
class IPv6_TCPServer(ForkingMixInWithPipe,
1093
socketserver.TCPServer, object):
1094
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
518
settings: Server settings
519
clients: Set() of Client objects
1097
enabled: Boolean; whether this server is activated yet
1098
interface: None or a network interface name (string)
1099
use_ipv6: Boolean; to use IPv6 or not
521
address_family = socket.AF_INET6
522
def __init__(self, *args, **kwargs):
523
if "settings" in kwargs:
524
self.settings = kwargs["settings"]
525
del kwargs["settings"]
526
if "clients" in kwargs:
527
self.clients = kwargs["clients"]
528
del kwargs["clients"]
529
return super(type(self), self).__init__(*args, **kwargs)
1101
def __init__(self, server_address, RequestHandlerClass,
1102
interface=None, use_ipv6=True):
1103
self.interface = interface
1105
self.address_family = socket.AF_INET6
1106
socketserver.TCPServer.__init__(self, server_address,
1107
RequestHandlerClass)
530
1108
def server_bind(self):
531
1109
"""This overrides the normal server_bind() function
532
1110
to bind to an interface if one was specified, and also NOT to
533
1111
bind to an address or port if they were not specified."""
534
if self.settings["interface"]:
535
# 25 is from /usr/include/asm-i486/socket.h
536
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
538
self.socket.setsockopt(socket.SOL_SOCKET,
540
self.settings["interface"])
541
except socket.error, error:
542
if error[0] == errno.EPERM:
543
logger.error(u"No permission to"
544
u" bind to interface %s",
545
self.settings["interface"])
1112
if self.interface is not None:
1113
if SO_BINDTODEVICE is None:
1114
logger.error(u"SO_BINDTODEVICE does not exist;"
1115
u" cannot bind to interface %s",
1119
self.socket.setsockopt(socket.SOL_SOCKET,
1123
except socket.error, error:
1124
if error[0] == errno.EPERM:
1125
logger.error(u"No permission to"
1126
u" bind to interface %s",
1128
elif error[0] == errno.ENOPROTOOPT:
1129
logger.error(u"SO_BINDTODEVICE not available;"
1130
u" cannot bind to interface %s",
548
1134
# Only bind(2) the socket if we really need to.
549
1135
if self.server_address[0] or self.server_address[1]:
550
1136
if not self.server_address[0]:
552
self.server_address = (in6addr_any,
1137
if self.address_family == socket.AF_INET6:
1138
any_address = u"::" # in6addr_any
1140
any_address = socket.INADDR_ANY
1141
self.server_address = (any_address,
553
1142
self.server_address[1])
554
1143
elif not self.server_address[1]:
555
1144
self.server_address = (self.server_address[0],
557
# if self.settings["interface"]:
1146
# if self.interface:
558
1147
# self.server_address = (self.server_address[0],
561
1150
# if_nametoindex
564
return super(type(self), self).server_bind()
1152
return socketserver.TCPServer.server_bind(self)
1155
class MandosServer(IPv6_TCPServer):
1159
clients: set of Client objects
1160
gnutls_priority GnuTLS priority string
1161
use_dbus: Boolean; to emit D-Bus signals or not
1163
Assumes a gobject.MainLoop event loop.
1165
def __init__(self, server_address, RequestHandlerClass,
1166
interface=None, use_ipv6=True, clients=None,
1167
gnutls_priority=None, use_dbus=True):
1168
self.enabled = False
1169
self.clients = clients
1170
if self.clients is None:
1171
self.clients = set()
1172
self.use_dbus = use_dbus
1173
self.gnutls_priority = gnutls_priority
1174
IPv6_TCPServer.__init__(self, server_address,
1175
RequestHandlerClass,
1176
interface = interface,
1177
use_ipv6 = use_ipv6)
1178
def server_activate(self):
1180
return socketserver.TCPServer.server_activate(self)
1183
def add_pipe(self, pipe):
1184
# Call "handle_ipc" for both data and EOF events
1185
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1187
def handle_ipc(self, source, condition, file_objects={}):
1189
gobject.IO_IN: u"IN", # There is data to read.
1190
gobject.IO_OUT: u"OUT", # Data can be written (without
1192
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1193
gobject.IO_ERR: u"ERR", # Error condition.
1194
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1195
# broken, usually for pipes and
1198
conditions_string = ' | '.join(name
1200
condition_names.iteritems()
1201
if cond & condition)
1202
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1205
# Turn the pipe file descriptor into a Python file object
1206
if source not in file_objects:
1207
file_objects[source] = os.fdopen(source, u"r", 1)
1209
# Read a line from the file object
1210
cmdline = file_objects[source].readline()
1211
if not cmdline: # Empty line means end of file
1212
# close the IPC pipe
1213
file_objects[source].close()
1214
del file_objects[source]
1216
# Stop calling this function
1219
logger.debug(u"IPC command: %r", cmdline)
1221
# Parse and act on command
1222
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1224
if cmd == u"NOTFOUND":
1225
logger.warning(u"Client not found for fingerprint: %s",
1229
mandos_dbus_service.ClientNotFound(args)
1230
elif cmd == u"INVALID":
1231
for client in self.clients:
1232
if client.name == args:
1233
logger.warning(u"Client %s is invalid", args)
1239
logger.error(u"Unknown client %s is invalid", args)
1240
elif cmd == u"SENDING":
1241
for client in self.clients:
1242
if client.name == args:
1243
logger.info(u"Sending secret to %s", client.name)
1247
client.ReceivedSecret()
1250
logger.error(u"Sending secret to unknown client %s",
1253
logger.error(u"Unknown IPC command: %r", cmdline)
1255
# Keep calling this function
567
1259
def string_to_delta(interval):
568
1260
"""Parse a string and return a datetime.timedelta
570
>>> string_to_delta('7d')
1262
>>> string_to_delta(u'7d')
571
1263
datetime.timedelta(7)
572
>>> string_to_delta('60s')
1264
>>> string_to_delta(u'60s')
573
1265
datetime.timedelta(0, 60)
574
>>> string_to_delta('60m')
1266
>>> string_to_delta(u'60m')
575
1267
datetime.timedelta(0, 3600)
576
>>> string_to_delta('24h')
1268
>>> string_to_delta(u'24h')
577
1269
datetime.timedelta(1)
578
1270
>>> string_to_delta(u'1w')
579
1271
datetime.timedelta(7)
580
>>> string_to_delta('5m 30s')
1272
>>> string_to_delta(u'5m 30s')
581
1273
datetime.timedelta(0, 330)
583
1275
timevalue = datetime.timedelta(0)
584
1276
for s in interval.split():
586
suffix=unicode(s[-1])
1278
suffix = unicode(s[-1])
588
1280
if suffix == u"d":
589
1281
delta = datetime.timedelta(value)
590
1282
elif suffix == u"s":
708
1383
# Default values for config file for server-global settings
709
server_defaults = { "interface": "",
714
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
715
"servicename": "Mandos",
1384
server_defaults = { u"interface": u"",
1389
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1390
u"servicename": u"Mandos",
1391
u"use_dbus": u"True",
1392
u"use_ipv6": u"True",
718
1395
# Parse config file for server-global settings
719
server_config = ConfigParser.SafeConfigParser(server_defaults)
1396
server_config = configparser.SafeConfigParser(server_defaults)
720
1397
del server_defaults
721
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1398
server_config.read(os.path.join(options.configdir,
722
1400
# Convert the SafeConfigParser object to a dict
723
1401
server_settings = server_config.defaults()
724
# Use getboolean on the boolean config option
725
server_settings["debug"] = server_config.getboolean\
1402
# Use the appropriate methods on the non-string config options
1403
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1404
server_settings[option] = server_config.getboolean(u"DEFAULT",
1406
if server_settings["port"]:
1407
server_settings["port"] = server_config.getint(u"DEFAULT",
727
1409
del server_config
729
1411
# Override the settings from the config file with command line
730
1412
# options, if set.
731
for option in ("interface", "address", "port", "debug",
732
"priority", "servicename", "configdir"):
1413
for option in (u"interface", u"address", u"port", u"debug",
1414
u"priority", u"servicename", u"configdir",
1415
u"use_dbus", u"use_ipv6"):
733
1416
value = getattr(options, option)
734
1417
if value is not None:
735
1418
server_settings[option] = value
1420
# Force all strings to be unicode
1421
for option in server_settings.keys():
1422
if type(server_settings[option]) is str:
1423
server_settings[option] = unicode(server_settings[option])
737
1424
# Now we have our good server settings in "server_settings"
739
debug = server_settings["debug"]
1426
##################################################################
1429
debug = server_settings[u"debug"]
1430
use_dbus = server_settings[u"use_dbus"]
1431
use_ipv6 = server_settings[u"use_ipv6"]
742
1434
syslogger.setLevel(logging.WARNING)
743
1435
console.setLevel(logging.WARNING)
745
if server_settings["servicename"] != "Mandos":
746
syslogger.setFormatter(logging.Formatter\
747
('Mandos (%s): %%(levelname)s:'
749
% server_settings["servicename"]))
1437
if server_settings[u"servicename"] != u"Mandos":
1438
syslogger.setFormatter(logging.Formatter
1439
(u'Mandos (%s) [%%(process)d]:'
1440
u' %%(levelname)s: %%(message)s'
1441
% server_settings[u"servicename"]))
751
1443
# Parse config file with clients
752
client_defaults = { "timeout": "1h",
754
"checker": "fping -q -- %(host)s",
1444
client_defaults = { u"timeout": u"1h",
1446
u"checker": u"fping -q -- %%(host)s",
757
client_config = ConfigParser.SafeConfigParser(client_defaults)
758
client_config.read(os.path.join(server_settings["configdir"],
762
service = AvahiService(name = server_settings["servicename"],
763
type = "_mandos._tcp", );
764
if server_settings["interface"]:
765
service.interface = if_nametoindex\
766
(server_settings["interface"])
1449
client_config = configparser.SafeConfigParser(client_defaults)
1450
client_config.read(os.path.join(server_settings[u"configdir"],
1453
global mandos_dbus_service
1454
mandos_dbus_service = None
1456
tcp_server = MandosServer((server_settings[u"address"],
1457
server_settings[u"port"]),
1459
interface=server_settings[u"interface"],
1462
server_settings[u"priority"],
1464
pidfilename = u"/var/run/mandos.pid"
1466
pidfile = open(pidfilename, u"w")
1468
logger.error(u"Could not open file %r", pidfilename)
1471
uid = pwd.getpwnam(u"_mandos").pw_uid
1472
gid = pwd.getpwnam(u"_mandos").pw_gid
1475
uid = pwd.getpwnam(u"mandos").pw_uid
1476
gid = pwd.getpwnam(u"mandos").pw_gid
1479
uid = pwd.getpwnam(u"nobody").pw_uid
1480
gid = pwd.getpwnam(u"nobody").pw_gid
1487
except OSError, error:
1488
if error[0] != errno.EPERM:
1491
# Enable all possible GnuTLS debugging
1493
# "Use a log level over 10 to enable all debugging options."
1495
gnutls.library.functions.gnutls_global_set_log_level(11)
1497
@gnutls.library.types.gnutls_log_func
1498
def debug_gnutls(level, string):
1499
logger.debug(u"GnuTLS: %s", string[:-1])
1501
(gnutls.library.functions
1502
.gnutls_global_set_log_function(debug_gnutls))
768
1504
global main_loop
771
1505
# From the Avahi example code
772
1506
DBusGMainLoop(set_as_default=True )
773
1507
main_loop = gobject.MainLoop()
774
1508
bus = dbus.SystemBus()
775
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
776
avahi.DBUS_PATH_SERVER),
777
avahi.DBUS_INTERFACE_SERVER)
778
1509
# End of Avahi example code
781
def remove_from_clients(client):
782
clients.remove(client)
784
logger.critical(u"No clients left, exiting")
787
clients.update(Set(Client(name = section,
788
stop_hook = remove_from_clients,
790
= dict(client_config.items(section)))
791
for section in client_config.sections()))
793
logger.critical(u"No clients defined")
1511
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1512
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1513
service = AvahiService(name = server_settings[u"servicename"],
1514
servicetype = u"_mandos._tcp",
1515
protocol = protocol, bus = bus)
1516
if server_settings["interface"]:
1517
service.interface = (if_nametoindex
1518
(str(server_settings[u"interface"])))
1520
client_class = Client
1522
client_class = functools.partial(ClientDBus, bus = bus)
1523
tcp_server.clients.update(set(
1524
client_class(name = section,
1525
config= dict(client_config.items(section)))
1526
for section in client_config.sections()))
1527
if not tcp_server.clients:
1528
logger.warning(u"No clients defined")
797
1531
# Redirect stdin so all checkers get /dev/null