/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2010-09-25 23:52:17 UTC
  • Revision ID: teddy@fukt.bsnet.se-20100925235217-4hhqfryz1ste6uw3
* mandos (ClientDBus.__init__): Bug fix: Translate "-" in client names
                                to "_" in D-Bus object paths.
  (MandosServer.handle_ipc): Bug fix: Send only address string to
                             D-Bus signal, not whole tuple.

* mandos-ctl: New options "--approve-by-default", "--deny-by-default",
              "--approval-delay", and "--approval-duration".
* mandos-ctl.xml (SYNOPSIS, OPTIONS): Document new options.

* mandos-monitor (MandosClientWidget.update): Fix spelling.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
60
60
import fcntl
61
61
import functools
62
62
import cPickle as pickle
63
 
import select
 
63
import multiprocessing
64
64
 
65
65
import dbus
66
66
import dbus.service
83
83
 
84
84
version = "1.0.14"
85
85
 
 
86
#logger = logging.getLogger(u'mandos')
86
87
logger = logging.Logger(u'mandos')
87
88
syslogger = (logging.handlers.SysLogHandler
88
89
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
156
157
                            u" after %i retries, exiting.",
157
158
                            self.rename_count)
158
159
            raise AvahiServiceError(u"Too many renames")
159
 
        self.name = self.server.GetAlternativeServiceName(self.name)
 
160
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
160
161
        logger.info(u"Changing Zeroconf service name to %r ...",
161
 
                    unicode(self.name))
 
162
                    self.name)
162
163
        syslogger.setFormatter(logging.Formatter
163
164
                               (u'Mandos (%s) [%%(process)d]:'
164
165
                                u' %%(levelname)s: %%(message)s'
165
166
                                % self.name))
166
167
        self.remove()
167
 
        self.add()
 
168
        try:
 
169
            self.add()
 
170
        except dbus.exceptions.DBusException, error:
 
171
            logger.critical(u"DBusException: %s", error)
 
172
            self.cleanup()
 
173
            os._exit(1)
168
174
        self.rename_count += 1
169
175
    def remove(self):
170
176
        """Derived from the Avahi example code"""
234
240
    """A representation of a client host served by this server.
235
241
    
236
242
    Attributes:
237
 
    name:       string; from the config file, used in log messages and
238
 
                        D-Bus identifiers
239
 
    fingerprint: string (40 or 32 hexadecimal digits); used to
240
 
                 uniquely identify the client
241
 
    secret:     bytestring; sent verbatim (over TLS) to client
242
 
    host:       string; available for use by the checker command
243
 
    created:    datetime.datetime(); (UTC) object creation
244
 
    last_enabled: datetime.datetime(); (UTC)
245
 
    enabled:    bool()
246
 
    last_checked_ok: datetime.datetime(); (UTC) or None
247
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
248
 
                                      until this client is disabled
249
 
    interval:   datetime.timedelta(); How often to start a new checker
250
 
    disable_hook:  If set, called by disable() as disable_hook(self)
 
243
    _approved:   bool(); 'None' if not yet approved/disapproved
 
244
    approval_delay: datetime.timedelta(); Time to wait for approval
 
245
    approval_duration: datetime.timedelta(); Duration of one approval
251
246
    checker:    subprocess.Popen(); a running checker process used
252
247
                                    to see if the client lives.
253
248
                                    'None' if no process is running.
254
 
    checker_initiator_tag: a gobject event source tag, or None
255
 
    disable_initiator_tag: - '' -
256
249
    checker_callback_tag:  - '' -
257
 
    checker_command: string; External command which is run to check if
258
 
                     client lives.  %() expansions are done at
 
250
    checker_command: string; External command which is run to check
 
251
                     if client lives.  %() expansions are done at
259
252
                     runtime with vars(self) as dict, so that for
260
253
                     instance %(name)s can be used in the command.
 
254
    checker_initiator_tag: a gobject event source tag, or None
 
255
    created:    datetime.datetime(); (UTC) object creation
261
256
    current_checker_command: string; current running checker_command
 
257
    disable_hook:  If set, called by disable() as disable_hook(self)
 
258
    disable_initiator_tag: - '' -
 
259
    enabled:    bool()
 
260
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
261
                 uniquely identify the client
 
262
    host:       string; available for use by the checker command
 
263
    interval:   datetime.timedelta(); How often to start a new checker
 
264
    last_checked_ok: datetime.datetime(); (UTC) or None
 
265
    last_enabled: datetime.datetime(); (UTC)
 
266
    name:       string; from the config file, used in log messages and
 
267
                        D-Bus identifiers
 
268
    secret:     bytestring; sent verbatim (over TLS) to client
 
269
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
270
                                      until this client is disabled
 
271
    runtime_expansions: Allowed attributes for runtime expansion.
262
272
    """
263
273
    
 
274
    runtime_expansions = (u"approval_delay", u"approval_duration",
 
275
                          u"created", u"enabled", u"fingerprint",
 
276
                          u"host", u"interval", u"last_checked_ok",
 
277
                          u"last_enabled", u"name", u"timeout")
 
278
    
264
279
    @staticmethod
265
280
    def _timedelta_to_milliseconds(td):
266
281
        "Convert a datetime.timedelta() to milliseconds"
275
290
    def interval_milliseconds(self):
276
291
        "Return the 'interval' attribute in milliseconds"
277
292
        return self._timedelta_to_milliseconds(self.interval)
 
293
 
 
294
    def approval_delay_milliseconds(self):
 
295
        return self._timedelta_to_milliseconds(self.approval_delay)
278
296
    
279
297
    def __init__(self, name = None, disable_hook=None, config=None):
280
298
        """Note: the 'checker' key in 'config' sets the
315
333
        self.checker_command = config[u"checker"]
316
334
        self.current_checker_command = None
317
335
        self.last_connect = None
 
336
        self._approved = None
 
337
        self.approved_by_default = config.get(u"approved_by_default",
 
338
                                              True)
 
339
        self.approvals_pending = 0
 
340
        self.approval_delay = string_to_delta(
 
341
            config[u"approval_delay"])
 
342
        self.approval_duration = string_to_delta(
 
343
            config[u"approval_duration"])
 
344
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
318
345
    
 
346
    def send_changedstate(self):
 
347
        self.changedstate.acquire()
 
348
        self.changedstate.notify_all()
 
349
        self.changedstate.release()
 
350
        
319
351
    def enable(self):
320
352
        """Start this client's checker and timeout hooks"""
321
353
        if getattr(self, u"enabled", False):
322
354
            # Already enabled
323
355
            return
 
356
        self.send_changedstate()
324
357
        self.last_enabled = datetime.datetime.utcnow()
325
358
        # Schedule a new checker to be started an 'interval' from now,
326
359
        # and every interval from then on.
340
373
        if not getattr(self, "enabled", False):
341
374
            return False
342
375
        if not quiet:
 
376
            self.send_changedstate()
 
377
        if not quiet:
343
378
            logger.info(u"Disabling client %s", self.name)
344
379
        if getattr(self, u"disable_initiator_tag", False):
345
380
            gobject.source_remove(self.disable_initiator_tag)
421
456
                command = self.checker_command % self.host
422
457
            except TypeError:
423
458
                # Escape attributes for the shell
424
 
                escaped_attrs = dict((key,
425
 
                                      re.escape(unicode(str(val),
426
 
                                                        errors=
427
 
                                                        u'replace')))
428
 
                                     for key, val in
429
 
                                     vars(self).iteritems())
 
459
                escaped_attrs = dict(
 
460
                    (attr,
 
461
                     re.escape(unicode(str(getattr(self, attr, u"")),
 
462
                                       errors=
 
463
                                       u'replace')))
 
464
                    for attr in
 
465
                    self.runtime_expansions)
 
466
 
430
467
                try:
431
468
                    command = self.checker_command % escaped_attrs
432
469
                except TypeError, error:
478
515
                raise
479
516
        self.checker = None
480
517
 
481
 
 
482
518
def dbus_service_property(dbus_interface, signature=u"v",
483
519
                          access=u"readwrite", byte_arrays=False):
484
520
    """Decorators for marking methods of a DBusObjectWithProperties to
675
711
    dbus_object_path: dbus.ObjectPath
676
712
    bus: dbus.SystemBus()
677
713
    """
 
714
    
 
715
    runtime_expansions = (Client.runtime_expansions
 
716
                          + (u"dbus_object_path",))
 
717
    
678
718
    # dbus.service.Object doesn't use super(), so we can't either.
679
719
    
680
720
    def __init__(self, bus = None, *args, **kwargs):
 
721
        self._approvals_pending = 0
681
722
        self.bus = bus
682
723
        Client.__init__(self, *args, **kwargs)
683
724
        # Only now, when this client is initialized, can it show up on
684
725
        # the D-Bus
 
726
        client_object_name = unicode(self.name).translate(
 
727
            {ord(u"."): ord(u"_"),
 
728
             ord(u"-"): ord(u"_")})
685
729
        self.dbus_object_path = (dbus.ObjectPath
686
 
                                 (u"/clients/"
687
 
                                  + self.name.replace(u".", u"_")))
 
730
                                 (u"/clients/" + client_object_name))
688
731
        DBusObjectWithProperties.__init__(self, self.bus,
689
732
                                          self.dbus_object_path)
 
733
        
 
734
    def _get_approvals_pending(self):
 
735
        return self._approvals_pending
 
736
    def _set_approvals_pending(self, value):
 
737
        old_value = self._approvals_pending
 
738
        self._approvals_pending = value
 
739
        bval = bool(value)
 
740
        if (hasattr(self, "dbus_object_path")
 
741
            and bval is not bool(old_value)):
 
742
            dbus_bool = dbus.Boolean(bval, variant_level=1)
 
743
            self.PropertyChanged(dbus.String(u"ApprovalPending"),
 
744
                                 dbus_bool)
 
745
 
 
746
    approvals_pending = property(_get_approvals_pending,
 
747
                                 _set_approvals_pending)
 
748
    del _get_approvals_pending, _set_approvals_pending
690
749
    
691
750
    @staticmethod
692
751
    def _datetime_to_dbus(dt, variant_level=0):
699
758
        r = Client.enable(self)
700
759
        if oldstate != self.enabled:
701
760
            # Emit D-Bus signals
702
 
            self.PropertyChanged(dbus.String(u"enabled"),
 
761
            self.PropertyChanged(dbus.String(u"Enabled"),
703
762
                                 dbus.Boolean(True, variant_level=1))
704
763
            self.PropertyChanged(
705
 
                dbus.String(u"last_enabled"),
 
764
                dbus.String(u"LastEnabled"),
706
765
                self._datetime_to_dbus(self.last_enabled,
707
766
                                       variant_level=1))
708
767
        return r
712
771
        r = Client.disable(self, quiet=quiet)
713
772
        if not quiet and oldstate != self.enabled:
714
773
            # Emit D-Bus signal
715
 
            self.PropertyChanged(dbus.String(u"enabled"),
 
774
            self.PropertyChanged(dbus.String(u"Enabled"),
716
775
                                 dbus.Boolean(False, variant_level=1))
717
776
        return r
718
777
    
730
789
        self.checker_callback_tag = None
731
790
        self.checker = None
732
791
        # Emit D-Bus signal
733
 
        self.PropertyChanged(dbus.String(u"checker_running"),
 
792
        self.PropertyChanged(dbus.String(u"CheckerRunning"),
734
793
                             dbus.Boolean(False, variant_level=1))
735
794
        if os.WIFEXITED(condition):
736
795
            exitstatus = os.WEXITSTATUS(condition)
751
810
        r = Client.checked_ok(self, *args, **kwargs)
752
811
        # Emit D-Bus signal
753
812
        self.PropertyChanged(
754
 
            dbus.String(u"last_checked_ok"),
 
813
            dbus.String(u"LastCheckedOK"),
755
814
            (self._datetime_to_dbus(self.last_checked_ok,
756
815
                                    variant_level=1)))
757
816
        return r
769
828
            # Emit D-Bus signal
770
829
            self.CheckerStarted(self.current_checker_command)
771
830
            self.PropertyChanged(
772
 
                dbus.String(u"checker_running"),
 
831
                dbus.String(u"CheckerRunning"),
773
832
                dbus.Boolean(True, variant_level=1))
774
833
        return r
775
834
    
778
837
        r = Client.stop_checker(self, *args, **kwargs)
779
838
        if (old_checker is not None
780
839
            and getattr(self, u"checker", None) is None):
781
 
            self.PropertyChanged(dbus.String(u"checker_running"),
 
840
            self.PropertyChanged(dbus.String(u"CheckerRunning"),
782
841
                                 dbus.Boolean(False, variant_level=1))
783
842
        return r
 
843
 
 
844
    def _reset_approved(self):
 
845
        self._approved = None
 
846
        return False
 
847
    
 
848
    def approve(self, value=True):
 
849
        self.send_changedstate()
 
850
        self._approved = value
 
851
        gobject.timeout_add(self._timedelta_to_milliseconds
 
852
                            (self.approval_duration),
 
853
                            self._reset_approved)
 
854
    
784
855
    
785
856
    ## D-Bus methods, signals & properties
786
857
    _interface = u"se.bsnet.fukt.Mandos.Client"
808
879
    # GotSecret - signal
809
880
    @dbus.service.signal(_interface)
810
881
    def GotSecret(self):
811
 
        "D-Bus signal"
 
882
        """D-Bus signal
 
883
        Is sent after a successful transfer of secret from the Mandos
 
884
        server to mandos-client
 
885
        """
812
886
        pass
813
887
    
814
888
    # Rejected - signal
815
 
    @dbus.service.signal(_interface)
816
 
    def Rejected(self):
 
889
    @dbus.service.signal(_interface, signature=u"s")
 
890
    def Rejected(self, reason):
 
891
        "D-Bus signal"
 
892
        pass
 
893
    
 
894
    # NeedApproval - signal
 
895
    @dbus.service.signal(_interface, signature=u"tb")
 
896
    def NeedApproval(self, timeout, default):
817
897
        "D-Bus signal"
818
898
        pass
819
899
    
820
900
    ## Methods
821
 
    
 
901
 
 
902
    # Approve - method
 
903
    @dbus.service.method(_interface, in_signature=u"b")
 
904
    def Approve(self, value):
 
905
        self.approve(value)
 
906
 
822
907
    # CheckedOK - method
823
908
    @dbus.service.method(_interface)
824
909
    def CheckedOK(self):
849
934
    
850
935
    ## Properties
851
936
    
852
 
    # name - property
 
937
    # ApprovalPending - property
 
938
    @dbus_service_property(_interface, signature=u"b", access=u"read")
 
939
    def ApprovalPending_dbus_property(self):
 
940
        return dbus.Boolean(bool(self.approvals_pending))
 
941
    
 
942
    # ApprovedByDefault - property
 
943
    @dbus_service_property(_interface, signature=u"b",
 
944
                           access=u"readwrite")
 
945
    def ApprovedByDefault_dbus_property(self, value=None):
 
946
        if value is None:       # get
 
947
            return dbus.Boolean(self.approved_by_default)
 
948
        self.approved_by_default = bool(value)
 
949
        # Emit D-Bus signal
 
950
        self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
 
951
                             dbus.Boolean(value, variant_level=1))
 
952
    
 
953
    # ApprovalDelay - property
 
954
    @dbus_service_property(_interface, signature=u"t",
 
955
                           access=u"readwrite")
 
956
    def ApprovalDelay_dbus_property(self, value=None):
 
957
        if value is None:       # get
 
958
            return dbus.UInt64(self.approval_delay_milliseconds())
 
959
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
960
        # Emit D-Bus signal
 
961
        self.PropertyChanged(dbus.String(u"ApprovalDelay"),
 
962
                             dbus.UInt64(value, variant_level=1))
 
963
    
 
964
    # ApprovalDuration - property
 
965
    @dbus_service_property(_interface, signature=u"t",
 
966
                           access=u"readwrite")
 
967
    def ApprovalDuration_dbus_property(self, value=None):
 
968
        if value is None:       # get
 
969
            return dbus.UInt64(self._timedelta_to_milliseconds(
 
970
                    self.approval_duration))
 
971
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
972
        # Emit D-Bus signal
 
973
        self.PropertyChanged(dbus.String(u"ApprovalDuration"),
 
974
                             dbus.UInt64(value, variant_level=1))
 
975
    
 
976
    # Name - property
853
977
    @dbus_service_property(_interface, signature=u"s", access=u"read")
854
 
    def name_dbus_property(self):
 
978
    def Name_dbus_property(self):
855
979
        return dbus.String(self.name)
856
980
    
857
 
    # fingerprint - property
 
981
    # Fingerprint - property
858
982
    @dbus_service_property(_interface, signature=u"s", access=u"read")
859
 
    def fingerprint_dbus_property(self):
 
983
    def Fingerprint_dbus_property(self):
860
984
        return dbus.String(self.fingerprint)
861
985
    
862
 
    # host - property
 
986
    # Host - property
863
987
    @dbus_service_property(_interface, signature=u"s",
864
988
                           access=u"readwrite")
865
 
    def host_dbus_property(self, value=None):
 
989
    def Host_dbus_property(self, value=None):
866
990
        if value is None:       # get
867
991
            return dbus.String(self.host)
868
992
        self.host = value
869
993
        # Emit D-Bus signal
870
 
        self.PropertyChanged(dbus.String(u"host"),
 
994
        self.PropertyChanged(dbus.String(u"Host"),
871
995
                             dbus.String(value, variant_level=1))
872
996
    
873
 
    # created - property
 
997
    # Created - property
874
998
    @dbus_service_property(_interface, signature=u"s", access=u"read")
875
 
    def created_dbus_property(self):
 
999
    def Created_dbus_property(self):
876
1000
        return dbus.String(self._datetime_to_dbus(self.created))
877
1001
    
878
 
    # last_enabled - property
 
1002
    # LastEnabled - property
879
1003
    @dbus_service_property(_interface, signature=u"s", access=u"read")
880
 
    def last_enabled_dbus_property(self):
 
1004
    def LastEnabled_dbus_property(self):
881
1005
        if self.last_enabled is None:
882
1006
            return dbus.String(u"")
883
1007
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
884
1008
    
885
 
    # enabled - property
 
1009
    # Enabled - property
886
1010
    @dbus_service_property(_interface, signature=u"b",
887
1011
                           access=u"readwrite")
888
 
    def enabled_dbus_property(self, value=None):
 
1012
    def Enabled_dbus_property(self, value=None):
889
1013
        if value is None:       # get
890
1014
            return dbus.Boolean(self.enabled)
891
1015
        if value:
893
1017
        else:
894
1018
            self.disable()
895
1019
    
896
 
    # last_checked_ok - property
 
1020
    # LastCheckedOK - property
897
1021
    @dbus_service_property(_interface, signature=u"s",
898
1022
                           access=u"readwrite")
899
 
    def last_checked_ok_dbus_property(self, value=None):
 
1023
    def LastCheckedOK_dbus_property(self, value=None):
900
1024
        if value is not None:
901
1025
            self.checked_ok()
902
1026
            return
905
1029
        return dbus.String(self._datetime_to_dbus(self
906
1030
                                                  .last_checked_ok))
907
1031
    
908
 
    # timeout - property
 
1032
    # Timeout - property
909
1033
    @dbus_service_property(_interface, signature=u"t",
910
1034
                           access=u"readwrite")
911
 
    def timeout_dbus_property(self, value=None):
 
1035
    def Timeout_dbus_property(self, value=None):
912
1036
        if value is None:       # get
913
1037
            return dbus.UInt64(self.timeout_milliseconds())
914
1038
        self.timeout = datetime.timedelta(0, 0, 0, value)
915
1039
        # Emit D-Bus signal
916
 
        self.PropertyChanged(dbus.String(u"timeout"),
 
1040
        self.PropertyChanged(dbus.String(u"Timeout"),
917
1041
                             dbus.UInt64(value, variant_level=1))
918
1042
        if getattr(self, u"disable_initiator_tag", None) is None:
919
1043
            return
933
1057
            self.disable_initiator_tag = (gobject.timeout_add
934
1058
                                          (time_to_die, self.disable))
935
1059
    
936
 
    # interval - property
 
1060
    # Interval - property
937
1061
    @dbus_service_property(_interface, signature=u"t",
938
1062
                           access=u"readwrite")
939
 
    def interval_dbus_property(self, value=None):
 
1063
    def Interval_dbus_property(self, value=None):
940
1064
        if value is None:       # get
941
1065
            return dbus.UInt64(self.interval_milliseconds())
942
1066
        self.interval = datetime.timedelta(0, 0, 0, value)
943
1067
        # Emit D-Bus signal
944
 
        self.PropertyChanged(dbus.String(u"interval"),
 
1068
        self.PropertyChanged(dbus.String(u"Interval"),
945
1069
                             dbus.UInt64(value, variant_level=1))
946
1070
        if getattr(self, u"checker_initiator_tag", None) is None:
947
1071
            return
951
1075
                                      (value, self.start_checker))
952
1076
        self.start_checker()    # Start one now, too
953
1077
 
954
 
    # checker - property
 
1078
    # Checker - property
955
1079
    @dbus_service_property(_interface, signature=u"s",
956
1080
                           access=u"readwrite")
957
 
    def checker_dbus_property(self, value=None):
 
1081
    def Checker_dbus_property(self, value=None):
958
1082
        if value is None:       # get
959
1083
            return dbus.String(self.checker_command)
960
1084
        self.checker_command = value
961
1085
        # Emit D-Bus signal
962
 
        self.PropertyChanged(dbus.String(u"checker"),
 
1086
        self.PropertyChanged(dbus.String(u"Checker"),
963
1087
                             dbus.String(self.checker_command,
964
1088
                                         variant_level=1))
965
1089
    
966
 
    # checker_running - property
 
1090
    # CheckerRunning - property
967
1091
    @dbus_service_property(_interface, signature=u"b",
968
1092
                           access=u"readwrite")
969
 
    def checker_running_dbus_property(self, value=None):
 
1093
    def CheckerRunning_dbus_property(self, value=None):
970
1094
        if value is None:       # get
971
1095
            return dbus.Boolean(self.checker is not None)
972
1096
        if value:
974
1098
        else:
975
1099
            self.stop_checker()
976
1100
    
977
 
    # object_path - property
 
1101
    # ObjectPath - property
978
1102
    @dbus_service_property(_interface, signature=u"o", access=u"read")
979
 
    def object_path_dbus_property(self):
 
1103
    def ObjectPath_dbus_property(self):
980
1104
        return self.dbus_object_path # is already a dbus.ObjectPath
981
1105
    
982
 
    # secret = property
 
1106
    # Secret = property
983
1107
    @dbus_service_property(_interface, signature=u"ay",
984
1108
                           access=u"write", byte_arrays=True)
985
 
    def secret_dbus_property(self, value):
 
1109
    def Secret_dbus_property(self, value):
986
1110
        self.secret = str(value)
987
1111
    
988
1112
    del _interface
989
1113
 
990
1114
 
 
1115
class ProxyClient(object):
 
1116
    def __init__(self, child_pipe, fpr, address):
 
1117
        self._pipe = child_pipe
 
1118
        self._pipe.send(('init', fpr, address))
 
1119
        if not self._pipe.recv():
 
1120
            raise KeyError()
 
1121
 
 
1122
    def __getattribute__(self, name):
 
1123
        if(name == '_pipe'):
 
1124
            return super(ProxyClient, self).__getattribute__(name)
 
1125
        self._pipe.send(('getattr', name))
 
1126
        data = self._pipe.recv()
 
1127
        if data[0] == 'data':
 
1128
            return data[1]
 
1129
        if data[0] == 'function':
 
1130
            def func(*args, **kwargs):
 
1131
                self._pipe.send(('funcall', name, args, kwargs))
 
1132
                return self._pipe.recv()[1]
 
1133
            return func
 
1134
 
 
1135
    def __setattr__(self, name, value):
 
1136
        if(name == '_pipe'):
 
1137
            return super(ProxyClient, self).__setattr__(name, value)
 
1138
        self._pipe.send(('setattr', name, value))
 
1139
 
 
1140
 
991
1141
class ClientHandler(socketserver.BaseRequestHandler, object):
992
1142
    """A class to handle client connections.
993
1143
    
995
1145
    Note: This will run in its own forked process."""
996
1146
    
997
1147
    def handle(self):
998
 
        logger.info(u"TCP connection from: %s",
999
 
                    unicode(self.client_address))
1000
 
        logger.debug(u"IPC Pipe FD: %d",
1001
 
                     self.server.child_pipe[1].fileno())
1002
 
        # Open IPC pipe to parent process
1003
 
        with contextlib.nested(self.server.child_pipe[1],
1004
 
                               self.server.parent_pipe[0]
1005
 
                               ) as (ipc, ipc_return):
 
1148
        with contextlib.closing(self.server.child_pipe) as child_pipe:
 
1149
            logger.info(u"TCP connection from: %s",
 
1150
                        unicode(self.client_address))
 
1151
            logger.debug(u"Pipe FD: %d",
 
1152
                         self.server.child_pipe.fileno())
 
1153
 
1006
1154
            session = (gnutls.connection
1007
1155
                       .ClientSession(self.request,
1008
1156
                                      gnutls.connection
1009
1157
                                      .X509Credentials()))
1010
 
            
 
1158
 
1011
1159
            # Note: gnutls.connection.X509Credentials is really a
1012
1160
            # generic GnuTLS certificate credentials object so long as
1013
1161
            # no X.509 keys are added to it.  Therefore, we can use it
1014
1162
            # here despite using OpenPGP certificates.
1015
 
            
 
1163
 
1016
1164
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1017
1165
            #                      u"+AES-256-CBC", u"+SHA1",
1018
1166
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
1024
1172
            (gnutls.library.functions
1025
1173
             .gnutls_priority_set_direct(session._c_object,
1026
1174
                                         priority, None))
1027
 
            
 
1175
 
1028
1176
            # Start communication using the Mandos protocol
1029
1177
            # Get protocol number
1030
1178
            line = self.request.makefile().readline()
1035
1183
            except (ValueError, IndexError, RuntimeError), error:
1036
1184
                logger.error(u"Unknown protocol version: %s", error)
1037
1185
                return
1038
 
            
 
1186
 
1039
1187
            # Start GnuTLS connection
1040
1188
            try:
1041
1189
                session.handshake()
1045
1193
                # established.  Just abandon the request.
1046
1194
                return
1047
1195
            logger.debug(u"Handshake succeeded")
 
1196
 
 
1197
            approval_required = False
1048
1198
            try:
1049
1199
                try:
1050
1200
                    fpr = self.fingerprint(self.peer_certificate
1054
1204
                    return
1055
1205
                logger.debug(u"Fingerprint: %s", fpr)
1056
1206
 
1057
 
                for c in self.server.clients:
1058
 
                    if c.fingerprint == fpr:
1059
 
                        client = c
 
1207
                try:
 
1208
                    client = ProxyClient(child_pipe, fpr,
 
1209
                                         self.client_address)
 
1210
                except KeyError:
 
1211
                    return
 
1212
                
 
1213
                if client.approval_delay:
 
1214
                    delay = client.approval_delay
 
1215
                    client.approvals_pending += 1
 
1216
                    approval_required = True
 
1217
                
 
1218
                while True:
 
1219
                    if not client.enabled:
 
1220
                        logger.warning(u"Client %s is disabled",
 
1221
                                       client.name)
 
1222
                        if self.server.use_dbus:
 
1223
                            # Emit D-Bus signal
 
1224
                            client.Rejected("Disabled")                    
 
1225
                        return
 
1226
                    
 
1227
                    if client._approved or not client.approval_delay:
 
1228
                        #We are approved or approval is disabled
1060
1229
                        break
1061
 
                else:
1062
 
                    ipc.write(u"NOTFOUND %s %s\n"
1063
 
                              % (fpr, unicode(self.client_address)))
1064
 
                    return
1065
 
                
1066
 
                class ClientProxy(object):
1067
 
                    """Client proxy object.  Not for calling methods."""
1068
 
                    def __init__(self, client):
1069
 
                        self.client = client
1070
 
                    def __getattr__(self, name):
1071
 
                        if name.startswith("ipc_"):
1072
 
                            def tempfunc():
1073
 
                                ipc.write("%s %s\n" % (name[4:].upper(),
1074
 
                                                       self.client.name))
1075
 
                            return tempfunc
1076
 
                        if not hasattr(self.client, name):
1077
 
                            raise AttributeError
1078
 
                        ipc.write(u"GETATTR %s %s\n"
1079
 
                                  % (name, self.client.fingerprint))
1080
 
                        return pickle.load(ipc_return)
1081
 
                clientproxy = ClientProxy(client)
1082
 
                # Have to check if client.enabled, since it is
1083
 
                # possible that the client was disabled since the
1084
 
                # GnuTLS session was established.
1085
 
                if not clientproxy.enabled:
1086
 
                    clientproxy.ipc_disabled()
1087
 
                    return
1088
 
                
1089
 
                clientproxy.ipc_sending()
 
1230
                    elif client._approved is None:
 
1231
                        logger.info(u"Client %s needs approval",
 
1232
                                    client.name)
 
1233
                        if self.server.use_dbus:
 
1234
                            # Emit D-Bus signal
 
1235
                            client.NeedApproval(
 
1236
                                client.approval_delay_milliseconds(),
 
1237
                                client.approved_by_default)
 
1238
                    else:
 
1239
                        logger.warning(u"Client %s was not approved",
 
1240
                                       client.name)
 
1241
                        if self.server.use_dbus:
 
1242
                            # Emit D-Bus signal
 
1243
                            client.Rejected("Denied")
 
1244
                        return
 
1245
                    
 
1246
                    #wait until timeout or approved
 
1247
                    #x = float(client._timedelta_to_milliseconds(delay))
 
1248
                    time = datetime.datetime.now()
 
1249
                    client.changedstate.acquire()
 
1250
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1251
                    client.changedstate.release()
 
1252
                    time2 = datetime.datetime.now()
 
1253
                    if (time2 - time) >= delay:
 
1254
                        if not client.approved_by_default:
 
1255
                            logger.warning("Client %s timed out while"
 
1256
                                           " waiting for approval",
 
1257
                                           client.name)
 
1258
                            if self.server.use_dbus:
 
1259
                                # Emit D-Bus signal
 
1260
                                client.Rejected("Approval timed out")
 
1261
                            return
 
1262
                        else:
 
1263
                            break
 
1264
                    else:
 
1265
                        delay -= time2 - time
 
1266
                
1090
1267
                sent_size = 0
1091
1268
                while sent_size < len(client.secret):
1092
 
                    sent = session.send(client.secret[sent_size:])
 
1269
                    try:
 
1270
                        sent = session.send(client.secret[sent_size:])
 
1271
                    except (gnutls.errors.GNUTLSError), error:
 
1272
                        logger.warning("gnutls send failed")
 
1273
                        return
1093
1274
                    logger.debug(u"Sent: %d, remaining: %d",
1094
1275
                                 sent, len(client.secret)
1095
1276
                                 - (sent_size + sent))
1096
1277
                    sent_size += sent
 
1278
 
 
1279
                logger.info(u"Sending secret to %s", client.name)
 
1280
                # bump the timeout as if seen
 
1281
                client.checked_ok()
 
1282
                if self.server.use_dbus:
 
1283
                    # Emit D-Bus signal
 
1284
                    client.GotSecret()
 
1285
            
1097
1286
            finally:
1098
 
                session.bye()
 
1287
                if approval_required:
 
1288
                    client.approvals_pending -= 1
 
1289
                try:
 
1290
                    session.bye()
 
1291
                except (gnutls.errors.GNUTLSError), error:
 
1292
                    logger.warning("GnuTLS bye failed")
1099
1293
    
1100
1294
    @staticmethod
1101
1295
    def peer_certificate(session):
1161
1355
        return hex_fpr
1162
1356
 
1163
1357
 
1164
 
class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):
1165
 
    """Like socketserver.ForkingMixIn, but also pass a pipe pair."""
 
1358
class MultiprocessingMixIn(object):
 
1359
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1360
    def sub_process_main(self, request, address):
 
1361
        try:
 
1362
            self.finish_request(request, address)
 
1363
        except:
 
1364
            self.handle_error(request, address)
 
1365
        self.close_request(request)
 
1366
            
 
1367
    def process_request(self, request, address):
 
1368
        """Start a new process to process the request."""
 
1369
        multiprocessing.Process(target = self.sub_process_main,
 
1370
                                args = (request, address)).start()
 
1371
 
 
1372
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
1373
    """ adds a pipe to the MixIn """
1166
1374
    def process_request(self, request, client_address):
1167
1375
        """Overrides and wraps the original process_request().
1168
1376
        
1169
1377
        This function creates a new pipe in self.pipe
1170
1378
        """
1171
 
        # Child writes to child_pipe
1172
 
        self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1173
 
        # Parent writes to parent_pipe
1174
 
        self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1175
 
        super(ForkingMixInWithPipes,
 
1379
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
 
1380
 
 
1381
        super(MultiprocessingMixInWithPipe,
1176
1382
              self).process_request(request, client_address)
1177
 
        # Close unused ends for parent
1178
 
        self.parent_pipe[0].close() # close read end
1179
 
        self.child_pipe[1].close()  # close write end
1180
 
        self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])
1181
 
    def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
 
1383
        self.child_pipe.close()
 
1384
        self.add_pipe(parent_pipe)
 
1385
 
 
1386
    def add_pipe(self, parent_pipe):
1182
1387
        """Dummy function; override as necessary"""
1183
 
        child_pipe_fd.close()
1184
 
        parent_pipe_fd.close()
1185
 
 
1186
 
 
1187
 
class IPv6_TCPServer(ForkingMixInWithPipes,
 
1388
        pass
 
1389
 
 
1390
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1188
1391
                     socketserver.TCPServer, object):
1189
1392
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1190
1393
    
1275
1478
            return socketserver.TCPServer.server_activate(self)
1276
1479
    def enable(self):
1277
1480
        self.enabled = True
1278
 
    def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
 
1481
    def add_pipe(self, parent_pipe):
1279
1482
        # Call "handle_ipc" for both data and EOF events
1280
 
        gobject.io_add_watch(child_pipe_fd.fileno(),
 
1483
        gobject.io_add_watch(parent_pipe.fileno(),
1281
1484
                             gobject.IO_IN | gobject.IO_HUP,
1282
1485
                             functools.partial(self.handle_ipc,
1283
 
                                               reply = parent_pipe_fd,
1284
 
                                               sender= child_pipe_fd))
1285
 
    def handle_ipc(self, source, condition, reply=None, sender=None):
 
1486
                                               parent_pipe = parent_pipe))
 
1487
        
 
1488
    def handle_ipc(self, source, condition, parent_pipe=None,
 
1489
                   client_object=None):
1286
1490
        condition_names = {
1287
1491
            gobject.IO_IN: u"IN",   # There is data to read.
1288
1492
            gobject.IO_OUT: u"OUT", # Data can be written (without
1297
1501
                                       for cond, name in
1298
1502
                                       condition_names.iteritems()
1299
1503
                                       if cond & condition)
1300
 
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1301
 
                     conditions_string)
1302
 
        
1303
 
        # Read a line from the file object
1304
 
        cmdline = sender.readline()
1305
 
        if not cmdline:             # Empty line means end of file
1306
 
            # close the IPC pipes
1307
 
            sender.close()
1308
 
            reply.close()
1309
 
            
1310
 
            # Stop calling this function
1311
 
            return False
1312
 
        
1313
 
        logger.debug(u"IPC command: %r", cmdline)
1314
 
        
1315
 
        # Parse and act on command
1316
 
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1317
 
        
1318
 
        if cmd == u"NOTFOUND":
1319
 
            fpr, address = args.split(None, 1)
1320
 
            logger.warning(u"Client not found for fingerprint: %s, ad"
1321
 
                           u"dress: %s", fpr, address)
1322
 
            if self.use_dbus:
1323
 
                # Emit D-Bus signal
1324
 
                mandos_dbus_service.ClientNotFound(fpr, address)
1325
 
        elif cmd == u"DISABLED":
1326
 
            for client in self.clients:
1327
 
                if client.name == args:
1328
 
                    logger.warning(u"Client %s is disabled", args)
1329
 
                    if self.use_dbus:
1330
 
                        # Emit D-Bus signal
1331
 
                        client.Rejected()
1332
 
                    break
1333
 
            else:
1334
 
                logger.error(u"Unknown client %s is disabled", args)
1335
 
        elif cmd == u"SENDING":
1336
 
            for client in self.clients:
1337
 
                if client.name == args:
1338
 
                    logger.info(u"Sending secret to %s", client.name)
1339
 
                    client.checked_ok()
1340
 
                    if self.use_dbus:
1341
 
                        # Emit D-Bus signal
1342
 
                        client.GotSecret()
1343
 
                    break
1344
 
            else:
1345
 
                logger.error(u"Sending secret to unknown client %s",
1346
 
                             args)
1347
 
        elif cmd == u"GETATTR":
1348
 
            attr_name, fpr = args.split(None, 1)
1349
 
            for client in self.clients:
1350
 
                if client.fingerprint == fpr:
1351
 
                    attr_value = getattr(client, attr_name, None)
1352
 
                    logger.debug("IPC reply: %r", attr_value)
1353
 
                    pickle.dump(attr_value, reply)
1354
 
                    break
1355
 
            else:
1356
 
                logger.error(u"Client %s on address %s requesting "
1357
 
                             u"attribute %s not found", fpr, address,
1358
 
                             attr_name)
1359
 
                pickle.dump(None, reply)
1360
 
        else:
1361
 
            logger.error(u"Unknown IPC command: %r", cmdline)
1362
 
        
1363
 
        # Keep calling this function
 
1504
        # error or the other end of multiprocessing.Pipe has closed
 
1505
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1506
            return False
 
1507
        
 
1508
        # Read a request from the child
 
1509
        request = parent_pipe.recv()
 
1510
        command = request[0]
 
1511
        
 
1512
        if command == 'init':
 
1513
            fpr = request[1]
 
1514
            address = request[2]
 
1515
            
 
1516
            for c in self.clients:
 
1517
                if c.fingerprint == fpr:
 
1518
                    client = c
 
1519
                    break
 
1520
            else:
 
1521
                logger.warning(u"Client not found for fingerprint: %s, ad"
 
1522
                               u"dress: %s", fpr, address)
 
1523
                if self.use_dbus:
 
1524
                    # Emit D-Bus signal
 
1525
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
 
1526
                parent_pipe.send(False)
 
1527
                return False
 
1528
            
 
1529
            gobject.io_add_watch(parent_pipe.fileno(),
 
1530
                                 gobject.IO_IN | gobject.IO_HUP,
 
1531
                                 functools.partial(self.handle_ipc,
 
1532
                                                   parent_pipe = parent_pipe,
 
1533
                                                   client_object = client))
 
1534
            parent_pipe.send(True)
 
1535
            # remove the old hook in favor of the new above hook on same fileno
 
1536
            return False
 
1537
        if command == 'funcall':
 
1538
            funcname = request[1]
 
1539
            args = request[2]
 
1540
            kwargs = request[3]
 
1541
            
 
1542
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
1543
 
 
1544
        if command == 'getattr':
 
1545
            attrname = request[1]
 
1546
            if callable(client_object.__getattribute__(attrname)):
 
1547
                parent_pipe.send(('function',))
 
1548
            else:
 
1549
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
1550
        
 
1551
        if command == 'setattr':
 
1552
            attrname = request[1]
 
1553
            value = request[2]
 
1554
            setattr(client_object, attrname, value)
 
1555
 
1364
1556
        return True
1365
1557
 
1366
1558
 
1469
1661
    parser.add_option("--debug", action=u"store_true",
1470
1662
                      help=u"Debug mode; run in foreground and log to"
1471
1663
                      u" terminal")
 
1664
    parser.add_option("--debuglevel", type=u"string", metavar="Level",
 
1665
                      help=u"Debug level for stdout output")
1472
1666
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1473
1667
                      u" priority string (see GnuTLS documentation)")
1474
1668
    parser.add_option("--servicename", type=u"string",
1499
1693
                        u"servicename": u"Mandos",
1500
1694
                        u"use_dbus": u"True",
1501
1695
                        u"use_ipv6": u"True",
 
1696
                        u"debuglevel": u"",
1502
1697
                        }
1503
1698
    
1504
1699
    # Parse config file for server-global settings
1521
1716
    # options, if set.
1522
1717
    for option in (u"interface", u"address", u"port", u"debug",
1523
1718
                   u"priority", u"servicename", u"configdir",
1524
 
                   u"use_dbus", u"use_ipv6"):
 
1719
                   u"use_dbus", u"use_ipv6", u"debuglevel"):
1525
1720
        value = getattr(options, option)
1526
1721
        if value is not None:
1527
1722
            server_settings[option] = value
1536
1731
    
1537
1732
    # For convenience
1538
1733
    debug = server_settings[u"debug"]
 
1734
    debuglevel = server_settings[u"debuglevel"]
1539
1735
    use_dbus = server_settings[u"use_dbus"]
1540
1736
    use_ipv6 = server_settings[u"use_ipv6"]
1541
 
    
1542
 
    if not debug:
1543
 
        syslogger.setLevel(logging.WARNING)
1544
 
        console.setLevel(logging.WARNING)
1545
 
    
 
1737
 
1546
1738
    if server_settings[u"servicename"] != u"Mandos":
1547
1739
        syslogger.setFormatter(logging.Formatter
1548
1740
                               (u'Mandos (%s) [%%(process)d]:'
1554
1746
                        u"interval": u"5m",
1555
1747
                        u"checker": u"fping -q -- %%(host)s",
1556
1748
                        u"host": u"",
 
1749
                        u"approval_delay": u"0s",
 
1750
                        u"approval_duration": u"1s",
1557
1751
                        }
1558
1752
    client_config = configparser.SafeConfigParser(client_defaults)
1559
1753
    client_config.read(os.path.join(server_settings[u"configdir"],
1571
1765
                              gnutls_priority=
1572
1766
                              server_settings[u"priority"],
1573
1767
                              use_dbus=use_dbus)
1574
 
    pidfilename = u"/var/run/mandos.pid"
1575
 
    try:
1576
 
        pidfile = open(pidfilename, u"w")
1577
 
    except IOError:
1578
 
        logger.error(u"Could not open file %r", pidfilename)
 
1768
    if not debug:
 
1769
        pidfilename = u"/var/run/mandos.pid"
 
1770
        try:
 
1771
            pidfile = open(pidfilename, u"w")
 
1772
        except IOError:
 
1773
            logger.error(u"Could not open file %r", pidfilename)
1579
1774
    
1580
1775
    try:
1581
1776
        uid = pwd.getpwnam(u"_mandos").pw_uid
1598
1793
        if error[0] != errno.EPERM:
1599
1794
            raise error
1600
1795
    
1601
 
    # Enable all possible GnuTLS debugging
 
1796
    if not debug and not debuglevel:
 
1797
        syslogger.setLevel(logging.WARNING)
 
1798
        console.setLevel(logging.WARNING)
 
1799
    if debuglevel:
 
1800
        level = getattr(logging, debuglevel.upper())
 
1801
        syslogger.setLevel(level)
 
1802
        console.setLevel(level)
 
1803
 
1602
1804
    if debug:
 
1805
        # Enable all possible GnuTLS debugging
 
1806
        
1603
1807
        # "Use a log level over 10 to enable all debugging options."
1604
1808
        # - GnuTLS manual
1605
1809
        gnutls.library.functions.gnutls_global_set_log_level(11)
1610
1814
        
1611
1815
        (gnutls.library.functions
1612
1816
         .gnutls_global_set_log_function(debug_gnutls))
 
1817
        
 
1818
        # Redirect stdin so all checkers get /dev/null
 
1819
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1820
        os.dup2(null, sys.stdin.fileno())
 
1821
        if null > 2:
 
1822
            os.close(null)
 
1823
    else:
 
1824
        # No console logging
 
1825
        logger.removeHandler(console)
 
1826
    
1613
1827
    
1614
1828
    global main_loop
1615
1829
    # From the Avahi example code
1633
1847
    if server_settings["interface"]:
1634
1848
        service.interface = (if_nametoindex
1635
1849
                             (str(server_settings[u"interface"])))
 
1850
 
 
1851
    if not debug:
 
1852
        # Close all input and output, do double fork, etc.
 
1853
        daemon()
 
1854
        
 
1855
    global multiprocessing_manager
 
1856
    multiprocessing_manager = multiprocessing.Manager()
1636
1857
    
1637
1858
    client_class = Client
1638
1859
    if use_dbus:
1639
1860
        client_class = functools.partial(ClientDBus, bus = bus)
 
1861
    def client_config_items(config, section):
 
1862
        special_settings = {
 
1863
            "approved_by_default":
 
1864
                lambda: config.getboolean(section,
 
1865
                                          "approved_by_default"),
 
1866
            }
 
1867
        for name, value in config.items(section):
 
1868
            try:
 
1869
                yield (name, special_settings[name]())
 
1870
            except KeyError:
 
1871
                yield (name, value)
 
1872
    
1640
1873
    tcp_server.clients.update(set(
1641
1874
            client_class(name = section,
1642
 
                         config= dict(client_config.items(section)))
 
1875
                         config= dict(client_config_items(
 
1876
                        client_config, section)))
1643
1877
            for section in client_config.sections()))
1644
1878
    if not tcp_server.clients:
1645
1879
        logger.warning(u"No clients defined")
1646
 
    
1647
 
    if debug:
1648
 
        # Redirect stdin so all checkers get /dev/null
1649
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1650
 
        os.dup2(null, sys.stdin.fileno())
1651
 
        if null > 2:
1652
 
            os.close(null)
1653
 
    else:
1654
 
        # No console logging
1655
 
        logger.removeHandler(console)
1656
 
        # Close all input and output, do double fork, etc.
1657
 
        daemon()
1658
 
    
1659
 
    try:
1660
 
        with pidfile:
1661
 
            pid = os.getpid()
1662
 
            pidfile.write(str(pid) + "\n")
1663
 
        del pidfile
1664
 
    except IOError:
1665
 
        logger.error(u"Could not write to file %r with PID %d",
1666
 
                     pidfilename, pid)
1667
 
    except NameError:
1668
 
        # "pidfile" was never created
1669
 
        pass
1670
 
    del pidfilename
1671
 
    
 
1880
        
1672
1881
    if not debug:
 
1882
        try:
 
1883
            with pidfile:
 
1884
                pid = os.getpid()
 
1885
                pidfile.write(str(pid) + "\n")
 
1886
            del pidfile
 
1887
        except IOError:
 
1888
            logger.error(u"Could not write to file %r with PID %d",
 
1889
                         pidfilename, pid)
 
1890
        except NameError:
 
1891
            # "pidfile" was never created
 
1892
            pass
 
1893
        del pidfilename
 
1894
        
1673
1895
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
1896
 
1674
1897
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1675
1898
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1676
1899