237
110
max_renames: integer; maximum number of renames
238
111
rename_count: integer; counter so we only rename after collisions
239
112
a sensible number of times
240
group: D-Bus Entry Group
242
bus: dbus.SystemBus()
244
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
245
servicetype = None, port = None, TXT = None,
246
domain = "", host = "", max_renames = 32768,
247
protocol = avahi.PROTO_UNSPEC, bus = None):
115
type = None, port = None, TXT = None, domain = "",
116
host = "", max_renames = 12):
248
117
self.interface = interface
250
self.type = servicetype
252
self.TXT = TXT if TXT is not None else []
253
125
self.domain = domain
255
127
self.rename_count = 0
256
self.max_renames = max_renames
257
self.protocol = protocol
258
self.group = None # our entry group
261
self.entry_group_state_changed_match = None
262
128
def rename(self):
263
129
"""Derived from the Avahi example code"""
264
130
if self.rename_count >= self.max_renames:
265
logger.critical("No suitable Zeroconf service name found"
266
" after %i retries, exiting.",
131
logger.critical(u"No suitable service name found after %i"
132
u" retries, exiting.", rename_count)
268
133
raise AvahiServiceError("Too many renames")
269
self.name = unicode(self.server
270
.GetAlternativeServiceName(self.name))
271
logger.info("Changing Zeroconf service name to %r ...",
134
name = server.GetAlternativeServiceName(name)
135
logger.error(u"Changing name to %r ...", name)
276
except dbus.exceptions.DBusException as error:
277
logger.critical("DBusException: %s", error)
280
138
self.rename_count += 1
281
139
def remove(self):
282
140
"""Derived from the Avahi example code"""
283
if self.entry_group_state_changed_match is not None:
284
self.entry_group_state_changed_match.remove()
285
self.entry_group_state_changed_match = None
286
if self.group is not None:
141
if group is not None:
289
144
"""Derived from the Avahi example code"""
291
if self.group is None:
292
self.group = dbus.Interface(
293
self.bus.get_object(avahi.DBUS_NAME,
294
self.server.EntryGroupNew()),
295
avahi.DBUS_INTERFACE_ENTRY_GROUP)
296
self.entry_group_state_changed_match = (
297
self.group.connect_to_signal(
298
'StateChanged', self.entry_group_state_changed))
299
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
300
self.name, self.type)
301
self.group.AddService(
304
dbus.UInt32(0), # flags
305
self.name, self.type,
306
self.domain, self.host,
307
dbus.UInt16(self.port),
308
avahi.string_array_to_txt_array(self.TXT))
310
def entry_group_state_changed(self, state, error):
311
"""Derived from the Avahi example code"""
312
logger.debug("Avahi entry group state change: %i", state)
314
if state == avahi.ENTRY_GROUP_ESTABLISHED:
315
logger.debug("Zeroconf service established.")
316
elif state == avahi.ENTRY_GROUP_COLLISION:
317
logger.info("Zeroconf service name collision.")
319
elif state == avahi.ENTRY_GROUP_FAILURE:
320
logger.critical("Avahi: Error in group state changed %s",
322
raise AvahiGroupError("State changed: %s"
325
"""Derived from the Avahi example code"""
326
if self.group is not None:
329
except (dbus.exceptions.UnknownMethodException,
330
dbus.exceptions.DBusException):
334
def server_state_changed(self, state, error=None):
335
"""Derived from the Avahi example code"""
336
logger.debug("Avahi server state change: %i", state)
337
bad_states = { avahi.SERVER_INVALID:
338
"Zeroconf server invalid",
339
avahi.SERVER_REGISTERING: None,
340
avahi.SERVER_COLLISION:
341
"Zeroconf server name collision",
342
avahi.SERVER_FAILURE:
343
"Zeroconf server failure" }
344
if state in bad_states:
345
if bad_states[state] is not None:
347
logger.error(bad_states[state])
349
logger.error(bad_states[state] + ": %r", error)
351
elif state == avahi.SERVER_RUNNING:
355
logger.debug("Unknown state: %r", state)
357
logger.debug("Unknown state: %r: %r", state, error)
359
"""Derived from the Avahi example code"""
360
if self.server is None:
361
self.server = dbus.Interface(
362
self.bus.get_object(avahi.DBUS_NAME,
363
avahi.DBUS_PATH_SERVER,
364
follow_name_owner_changes=True),
365
avahi.DBUS_INTERFACE_SERVER)
366
self.server.connect_to_signal("StateChanged",
367
self.server_state_changed)
368
self.server_state_changed(self.server.GetState())
370
class AvahiServiceToSyslog(AvahiService):
372
"""Add the new name to the syslog messages"""
373
ret = AvahiService.rename(self)
374
syslogger.setFormatter(logging.Formatter
375
('Mandos (%s) [%%(process)d]:'
376
' %%(levelname)s: %%(message)s'
380
def timedelta_to_milliseconds(td):
381
"Convert a datetime.timedelta() to milliseconds"
382
return ((td.days * 24 * 60 * 60 * 1000)
383
+ (td.seconds * 1000)
384
+ (td.microseconds // 1000))
147
group = dbus.Interface\
148
(bus.get_object(avahi.DBUS_NAME,
149
server.EntryGroupNew()),
150
avahi.DBUS_INTERFACE_ENTRY_GROUP)
151
group.connect_to_signal('StateChanged',
152
entry_group_state_changed)
153
logger.debug(u"Adding service '%s' of type '%s' ...",
154
service.name, service.type)
156
self.interface, # interface
157
avahi.PROTO_INET6, # protocol
158
dbus.UInt32(0), # flags
159
self.name, self.type,
160
self.domain, self.host,
161
dbus.UInt16(self.port),
162
avahi.string_array_to_txt_array(self.TXT))
165
# From the Avahi example code:
166
group = None # our entry group
167
# End of Avahi example code
386
170
class Client(object):
387
171
"""A representation of a client host served by this server.
390
approved: bool(); 'None' if not yet approved/disapproved
391
approval_delay: datetime.timedelta(); Time to wait for approval
392
approval_duration: datetime.timedelta(); Duration of one approval
393
checker: subprocess.Popen(); a running checker process used
394
to see if the client lives.
395
'None' if no process is running.
396
checker_callback_tag: a gobject event source tag, or None
397
checker_command: string; External command which is run to check
398
if client lives. %() expansions are done at
173
name: string; from the config file, used in log messages
174
fingerprint: string (40 or 32 hexadecimal digits); used to
175
uniquely identify the client
176
secret: bytestring; sent verbatim (over TLS) to client
177
fqdn: string (FQDN); available for use by the checker command
178
created: datetime.datetime(); object creation, not client host
179
last_checked_ok: datetime.datetime() or None if not yet checked OK
180
timeout: datetime.timedelta(); How long from last_checked_ok
181
until this client is invalid
182
interval: datetime.timedelta(); How often to start a new checker
183
stop_hook: If set, called by stop() as stop_hook(self)
184
checker: subprocess.Popen(); a running checker process used
185
to see if the client lives.
186
'None' if no process is running.
187
checker_initiator_tag: a gobject event source tag, or None
188
stop_initiator_tag: - '' -
189
checker_callback_tag: - '' -
190
checker_command: string; External command which is run to check if
191
client lives. %() expansions are done at
399
192
runtime with vars(self) as dict, so that for
400
193
instance %(name)s can be used in the command.
401
checker_initiator_tag: a gobject event source tag, or None
402
created: datetime.datetime(); (UTC) object creation
403
client_structure: Object describing what attributes a client has
404
and is used for storing the client at exit
405
current_checker_command: string; current running checker_command
406
disable_initiator_tag: a gobject event source tag, or None
408
fingerprint: string (40 or 32 hexadecimal digits); used to
409
uniquely identify the client
410
host: string; available for use by the checker command
411
interval: datetime.timedelta(); How often to start a new checker
412
last_approval_request: datetime.datetime(); (UTC) or None
413
last_checked_ok: datetime.datetime(); (UTC) or None
414
last_checker_status: integer between 0 and 255 reflecting exit
415
status of last checker. -1 reflects crashed
417
last_enabled: datetime.datetime(); (UTC) or None
418
name: string; from the config file, used in log messages and
420
secret: bytestring; sent verbatim (over TLS) to client
421
timeout: datetime.timedelta(); How long from last_checked_ok
422
until this client is disabled
423
extended_timeout: extra long timeout when password has been sent
424
runtime_expansions: Allowed attributes for runtime expansion.
425
expires: datetime.datetime(); time (UTC) when a client will be
195
_timeout: Real variable for 'timeout'
196
_interval: Real variable for 'interval'
197
_timeout_milliseconds: Used when calling gobject.timeout_add()
198
_interval_milliseconds: - '' -
429
runtime_expansions = ("approval_delay", "approval_duration",
430
"created", "enabled", "fingerprint",
431
"host", "interval", "last_checked_ok",
432
"last_enabled", "name", "timeout")
433
client_defaults = { "timeout": "5m",
434
"extended_timeout": "15m",
436
"checker": "fping -q -- %%(host)s",
438
"approval_delay": "0s",
439
"approval_duration": "1s",
440
"approved_by_default": "True",
444
def timeout_milliseconds(self):
445
"Return the 'timeout' attribute in milliseconds"
446
return timedelta_to_milliseconds(self.timeout)
448
def extended_timeout_milliseconds(self):
449
"Return the 'extended_timeout' attribute in milliseconds"
450
return timedelta_to_milliseconds(self.extended_timeout)
452
def interval_milliseconds(self):
453
"Return the 'interval' attribute in milliseconds"
454
return timedelta_to_milliseconds(self.interval)
456
def approval_delay_milliseconds(self):
457
return timedelta_to_milliseconds(self.approval_delay)
460
def config_parser(config):
461
""" Construct a new dict of client settings of this form:
462
{ client_name: {setting_name: value, ...}, ...}
463
with exceptions for any special settings as defined above"""
465
for client_name in config.sections():
466
section = dict(config.items(client_name))
467
client = settings[client_name] = {}
469
client["host"] = section["host"]
470
# Reformat values from string types to Python types
471
client["approved_by_default"] = config.getboolean(
472
client_name, "approved_by_default")
473
client["enabled"] = config.getboolean(client_name, "enabled")
475
client["fingerprint"] = (section["fingerprint"].upper()
477
if "secret" in section:
478
client["secret"] = section["secret"].decode("base64")
479
elif "secfile" in section:
480
with open(os.path.expanduser(os.path.expandvars
481
(section["secfile"])),
483
client["secret"] = secfile.read()
485
raise TypeError("No secret or secfile for section %s"
487
client["timeout"] = string_to_delta(section["timeout"])
488
client["extended_timeout"] = string_to_delta(
489
section["extended_timeout"])
490
client["interval"] = string_to_delta(section["interval"])
491
client["approval_delay"] = string_to_delta(
492
section["approval_delay"])
493
client["approval_duration"] = string_to_delta(
494
section["approval_duration"])
495
client["checker_command"] = section["checker"]
496
client["last_approval_request"] = None
497
client["last_checked_ok"] = None
498
client["last_checker_status"] = None
499
if client["enabled"]:
500
client["last_enabled"] = datetime.datetime.utcnow()
501
client["expires"] = (datetime.datetime.utcnow()
504
client["last_enabled"] = None
505
client["expires"] = None
510
def __init__(self, settings, name = None):
200
def _set_timeout(self, timeout):
201
"Setter function for 'timeout' attribute"
202
self._timeout = timeout
203
self._timeout_milliseconds = ((self.timeout.days
204
* 24 * 60 * 60 * 1000)
205
+ (self.timeout.seconds * 1000)
206
+ (self.timeout.microseconds
208
timeout = property(lambda self: self._timeout,
211
def _set_interval(self, interval):
212
"Setter function for 'interval' attribute"
213
self._interval = interval
214
self._interval_milliseconds = ((self.interval.days
215
* 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds
218
+ (self.interval.microseconds
220
interval = property(lambda self: self._interval,
223
def __init__(self, name = None, stop_hook=None, config={}):
511
224
"""Note: the 'checker' key in 'config' sets the
512
225
'checker_command' attribute and *not* the 'checker'
515
# adding all client settings
516
for setting, value in settings.iteritems():
517
setattr(self, setting, value)
519
logger.debug("Creating client %r", self.name)
228
logger.debug(u"Creating client %r", self.name)
520
229
# Uppercase and remove spaces from fingerprint for later
521
230
# comparison purposes with return value from the fingerprint()
523
logger.debug(" Fingerprint: %s", self.fingerprint)
524
self.created = settings.get("created", datetime.datetime.utcnow())
526
# attributes specific for this server instance
232
self.fingerprint = config["fingerprint"].upper()\
234
logger.debug(u" Fingerprint: %s", self.fingerprint)
235
if "secret" in config:
236
self.secret = config["secret"].decode(u"base64")
237
elif "secfile" in config:
238
sf = open(config["secfile"])
239
self.secret = sf.read()
242
raise TypeError(u"No secret or secfile for client %s"
244
self.fqdn = config.get("fqdn", "")
245
self.created = datetime.datetime.now()
246
self.last_checked_ok = None
247
self.timeout = string_to_delta(config["timeout"])
248
self.interval = string_to_delta(config["interval"])
249
self.stop_hook = stop_hook
527
250
self.checker = None
528
251
self.checker_initiator_tag = None
529
self.disable_initiator_tag = None
252
self.stop_initiator_tag = None
530
253
self.checker_callback_tag = None
531
self.current_checker_command = None
533
self.approvals_pending = 0
534
self.changedstate = (multiprocessing_manager
535
.Condition(multiprocessing_manager
537
self.client_structure = [attr for attr in
538
self.__dict__.iterkeys()
539
if not attr.startswith("_")]
540
self.client_structure.append("client_structure")
542
for name, t in inspect.getmembers(type(self),
546
if not name.startswith("_"):
547
self.client_structure.append(name)
549
# Send notice to process children that client state has changed
550
def send_changedstate(self):
551
with self.changedstate:
552
self.changedstate.notify_all()
254
self.check_command = config["checker"]
555
256
"""Start this client's checker and timeout hooks"""
556
if getattr(self, "enabled", False):
559
self.send_changedstate()
560
self.expires = datetime.datetime.utcnow() + self.timeout
562
self.last_enabled = datetime.datetime.utcnow()
565
def disable(self, quiet=True):
566
"""Disable this client."""
567
if not getattr(self, "enabled", False):
257
# Schedule a new checker to be started an 'interval' from now,
258
# and every interval from then on.
259
self.checker_initiator_tag = gobject.timeout_add\
260
(self._interval_milliseconds,
262
# Also start a new checker *right now*.
264
# Schedule a stop() when 'timeout' has passed
265
self.stop_initiator_tag = gobject.timeout_add\
266
(self._timeout_milliseconds,
270
The possibility that a client might be restarted is left open,
271
but not currently used."""
272
# If this client doesn't have a secret, it is already stopped.
274
logger.info(u"Stopping client %s", self.name)
570
self.send_changedstate()
572
logger.info("Disabling client %s", self.name)
573
if getattr(self, "disable_initiator_tag", False):
574
gobject.source_remove(self.disable_initiator_tag)
575
self.disable_initiator_tag = None
278
if getattr(self, "stop_initiator_tag", False):
279
gobject.source_remove(self.stop_initiator_tag)
280
self.stop_initiator_tag = None
577
281
if getattr(self, "checker_initiator_tag", False):
578
282
gobject.source_remove(self.checker_initiator_tag)
579
283
self.checker_initiator_tag = None
580
284
self.stop_checker()
582
287
# Do not run this again if called by a gobject.timeout_add
585
289
def __del__(self):
588
def init_checker(self):
589
# Schedule a new checker to be started an 'interval' from now,
590
# and every interval from then on.
591
self.checker_initiator_tag = (gobject.timeout_add
592
(self.interval_milliseconds(),
594
# Schedule a disable() when 'timeout' has passed
595
self.disable_initiator_tag = (gobject.timeout_add
596
(self.timeout_milliseconds(),
598
# Also start a new checker *right now*.
601
def checker_callback(self, pid, condition, command):
290
self.stop_hook = None
292
def checker_callback(self, pid, condition):
602
293
"""The checker has completed, so take appropriate actions."""
294
now = datetime.datetime.now()
603
295
self.checker_callback_tag = None
604
296
self.checker = None
605
if os.WIFEXITED(condition):
606
self.last_checker_status = os.WEXITSTATUS(condition)
607
if self.last_checker_status == 0:
608
logger.info("Checker for %(name)s succeeded",
612
logger.info("Checker for %(name)s failed",
615
self.last_checker_status = -1
616
logger.warning("Checker for %(name)s crashed?",
297
if os.WIFEXITED(condition) \
298
and (os.WEXITSTATUS(condition) == 0):
299
logger.info(u"Checker for %(name)s succeeded",
301
self.last_checked_ok = now
302
gobject.source_remove(self.stop_initiator_tag)
303
self.stop_initiator_tag = gobject.timeout_add\
304
(self._timeout_milliseconds,
306
elif not os.WIFEXITED(condition):
307
logger.warning(u"Checker for %(name)s crashed?",
619
def checked_ok(self, timeout=None):
620
"""Bump up the timeout for this client.
622
This should only be called when the client has been seen,
626
timeout = self.timeout
627
self.last_checked_ok = datetime.datetime.utcnow()
628
if self.disable_initiator_tag is not None:
629
gobject.source_remove(self.disable_initiator_tag)
630
if getattr(self, "enabled", False):
631
self.disable_initiator_tag = (gobject.timeout_add
632
(timedelta_to_milliseconds
633
(timeout), self.disable))
634
self.expires = datetime.datetime.utcnow() + timeout
636
def need_approval(self):
637
self.last_approval_request = datetime.datetime.utcnow()
310
logger.info(u"Checker for %(name)s failed",
639
312
def start_checker(self):
640
313
"""Start a new checker subprocess if one is not running.
642
314
If a checker already exists, leave it running and do
644
316
# The reason for not killing a running checker is that if we
721
360
logger.debug("Stopping checker for %(name)s", vars(self))
723
362
os.kill(self.checker.pid, signal.SIGTERM)
725
364
#if self.checker.poll() is None:
726
365
# os.kill(self.checker.pid, signal.SIGKILL)
727
except OSError as error:
366
except OSError, error:
728
367
if error.errno != errno.ESRCH: # No such process
730
369
self.checker = None
733
def dbus_service_property(dbus_interface, signature="v",
734
access="readwrite", byte_arrays=False):
735
"""Decorators for marking methods of a DBusObjectWithProperties to
736
become properties on the D-Bus.
738
The decorated method will be called with no arguments by "Get"
739
and with one argument by "Set".
741
The parameters, where they are supported, are the same as
742
dbus.service.method, except there is only "signature", since the
743
type from Get() and the type sent to Set() is the same.
745
# Encoding deeply encoded byte arrays is not supported yet by the
746
# "Set" method, so we fail early here:
747
if byte_arrays and signature != "ay":
748
raise ValueError("Byte arrays not supported for non-'ay'"
749
" signature %r" % signature)
751
func._dbus_is_property = True
752
func._dbus_interface = dbus_interface
753
func._dbus_signature = signature
754
func._dbus_access = access
755
func._dbus_name = func.__name__
756
if func._dbus_name.endswith("_dbus_property"):
757
func._dbus_name = func._dbus_name[:-14]
758
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
763
class DBusPropertyException(dbus.exceptions.DBusException):
764
"""A base class for D-Bus property-related exceptions
766
def __unicode__(self):
767
return unicode(str(self))
770
class DBusPropertyAccessException(DBusPropertyException):
771
"""A property's access permissions disallows an operation.
776
class DBusPropertyNotFound(DBusPropertyException):
777
"""An attempt was made to access a non-existing property.
782
class DBusObjectWithProperties(dbus.service.Object):
783
"""A D-Bus object with properties.
785
Classes inheriting from this can use the dbus_service_property
786
decorator to expose methods as D-Bus properties. It exposes the
787
standard Get(), Set(), and GetAll() methods on the D-Bus.
791
def _is_dbus_property(obj):
792
return getattr(obj, "_dbus_is_property", False)
794
def _get_all_dbus_properties(self):
795
"""Returns a generator of (name, attribute) pairs
797
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
798
for cls in self.__class__.__mro__
800
inspect.getmembers(cls, self._is_dbus_property))
802
def _get_dbus_property(self, interface_name, property_name):
803
"""Returns a bound method if one exists which is a D-Bus
804
property with the specified name and interface.
806
for cls in self.__class__.__mro__:
807
for name, value in (inspect.getmembers
808
(cls, self._is_dbus_property)):
809
if (value._dbus_name == property_name
810
and value._dbus_interface == interface_name):
811
return value.__get__(self)
814
raise DBusPropertyNotFound(self.dbus_object_path + ":"
815
+ interface_name + "."
818
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
820
def Get(self, interface_name, property_name):
821
"""Standard D-Bus property Get() method, see D-Bus standard.
823
prop = self._get_dbus_property(interface_name, property_name)
824
if prop._dbus_access == "write":
825
raise DBusPropertyAccessException(property_name)
827
if not hasattr(value, "variant_level"):
829
return type(value)(value, variant_level=value.variant_level+1)
831
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
832
def Set(self, interface_name, property_name, value):
833
"""Standard D-Bus property Set() method, see D-Bus standard.
835
prop = self._get_dbus_property(interface_name, property_name)
836
if prop._dbus_access == "read":
837
raise DBusPropertyAccessException(property_name)
838
if prop._dbus_get_args_options["byte_arrays"]:
839
# The byte_arrays option is not supported yet on
840
# signatures other than "ay".
841
if prop._dbus_signature != "ay":
843
value = dbus.ByteArray(''.join(unichr(byte)
847
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
848
out_signature="a{sv}")
849
def GetAll(self, interface_name):
850
"""Standard D-Bus property GetAll() method, see D-Bus
853
Note: Will not include properties with access="write".
856
for name, prop in self._get_all_dbus_properties():
858
and interface_name != prop._dbus_interface):
859
# Interface non-empty but did not match
861
# Ignore write-only properties
862
if prop._dbus_access == "write":
865
if not hasattr(value, "variant_level"):
866
properties[name] = value
868
properties[name] = type(value)(value, variant_level=
869
value.variant_level+1)
870
return dbus.Dictionary(properties, signature="sv")
872
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
874
path_keyword='object_path',
875
connection_keyword='connection')
876
def Introspect(self, object_path, connection):
877
"""Standard D-Bus method, overloaded to insert property tags.
879
xmlstring = dbus.service.Object.Introspect(self, object_path,
882
document = xml.dom.minidom.parseString(xmlstring)
883
def make_tag(document, name, prop):
884
e = document.createElement("property")
885
e.setAttribute("name", name)
886
e.setAttribute("type", prop._dbus_signature)
887
e.setAttribute("access", prop._dbus_access)
889
for if_tag in document.getElementsByTagName("interface"):
890
for tag in (make_tag(document, name, prop)
892
in self._get_all_dbus_properties()
893
if prop._dbus_interface
894
== if_tag.getAttribute("name")):
895
if_tag.appendChild(tag)
896
# Add the names to the return values for the
897
# "org.freedesktop.DBus.Properties" methods
898
if (if_tag.getAttribute("name")
899
== "org.freedesktop.DBus.Properties"):
900
for cn in if_tag.getElementsByTagName("method"):
901
if cn.getAttribute("name") == "Get":
902
for arg in cn.getElementsByTagName("arg"):
903
if (arg.getAttribute("direction")
905
arg.setAttribute("name", "value")
906
elif cn.getAttribute("name") == "GetAll":
907
for arg in cn.getElementsByTagName("arg"):
908
if (arg.getAttribute("direction")
910
arg.setAttribute("name", "props")
911
xmlstring = document.toxml("utf-8")
913
except (AttributeError, xml.dom.DOMException,
914
xml.parsers.expat.ExpatError) as error:
915
logger.error("Failed to override Introspection method",
920
def datetime_to_dbus (dt, variant_level=0):
921
"""Convert a UTC datetime.datetime() to a D-Bus type."""
923
return dbus.String("", variant_level = variant_level)
924
return dbus.String(dt.isoformat(),
925
variant_level=variant_level)
928
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
930
"""Applied to an empty subclass of a D-Bus object, this metaclass
931
will add additional D-Bus attributes matching a certain pattern.
933
def __new__(mcs, name, bases, attr):
934
# Go through all the base classes which could have D-Bus
935
# methods, signals, or properties in them
936
for base in (b for b in bases
937
if issubclass(b, dbus.service.Object)):
938
# Go though all attributes of the base class
939
for attrname, attribute in inspect.getmembers(base):
940
# Ignore non-D-Bus attributes, and D-Bus attributes
941
# with the wrong interface name
942
if (not hasattr(attribute, "_dbus_interface")
943
or not attribute._dbus_interface
944
.startswith("se.recompile.Mandos")):
946
# Create an alternate D-Bus interface name based on
948
alt_interface = (attribute._dbus_interface
949
.replace("se.recompile.Mandos",
950
"se.bsnet.fukt.Mandos"))
951
# Is this a D-Bus signal?
952
if getattr(attribute, "_dbus_is_signal", False):
953
# Extract the original non-method function by
955
nonmethod_func = (dict(
956
zip(attribute.func_code.co_freevars,
957
attribute.__closure__))["func"]
959
# Create a new, but exactly alike, function
960
# object, and decorate it to be a new D-Bus signal
961
# with the alternate D-Bus interface name
962
new_function = (dbus.service.signal
964
attribute._dbus_signature)
966
nonmethod_func.func_code,
967
nonmethod_func.func_globals,
968
nonmethod_func.func_name,
969
nonmethod_func.func_defaults,
970
nonmethod_func.func_closure)))
971
# Define a creator of a function to call both the
972
# old and new functions, so both the old and new
973
# signals gets sent when the function is called
974
def fixscope(func1, func2):
975
"""This function is a scope container to pass
976
func1 and func2 to the "call_both" function
977
outside of its arguments"""
978
def call_both(*args, **kwargs):
979
"""This function will emit two D-Bus
980
signals by calling func1 and func2"""
981
func1(*args, **kwargs)
982
func2(*args, **kwargs)
984
# Create the "call_both" function and add it to
986
attr[attrname] = fixscope(attribute,
988
# Is this a D-Bus method?
989
elif getattr(attribute, "_dbus_is_method", False):
990
# Create a new, but exactly alike, function
991
# object. Decorate it to be a new D-Bus method
992
# with the alternate D-Bus interface name. Add it
994
attr[attrname] = (dbus.service.method
996
attribute._dbus_in_signature,
997
attribute._dbus_out_signature)
999
(attribute.func_code,
1000
attribute.func_globals,
1001
attribute.func_name,
1002
attribute.func_defaults,
1003
attribute.func_closure)))
1004
# Is this a D-Bus property?
1005
elif getattr(attribute, "_dbus_is_property", False):
1006
# Create a new, but exactly alike, function
1007
# object, and decorate it to be a new D-Bus
1008
# property with the alternate D-Bus interface
1009
# name. Add it to the class.
1010
attr[attrname] = (dbus_service_property
1012
attribute._dbus_signature,
1013
attribute._dbus_access,
1015
._dbus_get_args_options
1018
(attribute.func_code,
1019
attribute.func_globals,
1020
attribute.func_name,
1021
attribute.func_defaults,
1022
attribute.func_closure)))
1023
return type.__new__(mcs, name, bases, attr)
1026
class ClientDBus(Client, DBusObjectWithProperties):
1027
"""A Client class using D-Bus
1030
dbus_object_path: dbus.ObjectPath
1031
bus: dbus.SystemBus()
1034
runtime_expansions = (Client.runtime_expansions
1035
+ ("dbus_object_path",))
1037
# dbus.service.Object doesn't use super(), so we can't either.
1039
def __init__(self, bus = None, *args, **kwargs):
1041
Client.__init__(self, *args, **kwargs)
1042
self._approvals_pending = 0
1044
self._approvals_pending = 0
1045
# Only now, when this client is initialized, can it show up on
1047
client_object_name = unicode(self.name).translate(
1048
{ord("."): ord("_"),
1049
ord("-"): ord("_")})
1050
self.dbus_object_path = (dbus.ObjectPath
1051
("/clients/" + client_object_name))
1052
DBusObjectWithProperties.__init__(self, self.bus,
1053
self.dbus_object_path)
1055
def notifychangeproperty(transform_func,
1056
dbus_name, type_func=lambda x: x,
1058
""" Modify a variable so that it's a property which announces
1059
its changes to DBus.
1061
transform_fun: Function that takes a value and a variant_level
1062
and transforms it to a D-Bus type.
1063
dbus_name: D-Bus name of the variable
1064
type_func: Function that transform the value before sending it
1065
to the D-Bus. Default: no transform
1066
variant_level: D-Bus variant level. Default: 1
1068
attrname = "_{0}".format(dbus_name)
1069
def setter(self, value):
1070
if hasattr(self, "dbus_object_path"):
1071
if (not hasattr(self, attrname) or
1072
type_func(getattr(self, attrname, None))
1073
!= type_func(value)):
1074
dbus_value = transform_func(type_func(value),
1077
self.PropertyChanged(dbus.String(dbus_name),
1079
setattr(self, attrname, value)
1081
return property(lambda self: getattr(self, attrname), setter)
1084
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1085
approvals_pending = notifychangeproperty(dbus.Boolean,
1088
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1089
last_enabled = notifychangeproperty(datetime_to_dbus,
1091
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1092
type_func = lambda checker:
1093
checker is not None)
1094
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1096
last_approval_request = notifychangeproperty(
1097
datetime_to_dbus, "LastApprovalRequest")
1098
approved_by_default = notifychangeproperty(dbus.Boolean,
1099
"ApprovedByDefault")
1100
approval_delay = notifychangeproperty(dbus.UInt64,
1103
timedelta_to_milliseconds)
1104
approval_duration = notifychangeproperty(
1105
dbus.UInt64, "ApprovalDuration",
1106
type_func = timedelta_to_milliseconds)
1107
host = notifychangeproperty(dbus.String, "Host")
1108
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1110
timedelta_to_milliseconds)
1111
extended_timeout = notifychangeproperty(
1112
dbus.UInt64, "ExtendedTimeout",
1113
type_func = timedelta_to_milliseconds)
1114
interval = notifychangeproperty(dbus.UInt64,
1117
timedelta_to_milliseconds)
1118
checker_command = notifychangeproperty(dbus.String, "Checker")
1120
del notifychangeproperty
1122
def __del__(self, *args, **kwargs):
1124
self.remove_from_connection()
1127
if hasattr(DBusObjectWithProperties, "__del__"):
1128
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1129
Client.__del__(self, *args, **kwargs)
1131
def checker_callback(self, pid, condition, command,
1133
self.checker_callback_tag = None
1135
if os.WIFEXITED(condition):
1136
exitstatus = os.WEXITSTATUS(condition)
1138
self.CheckerCompleted(dbus.Int16(exitstatus),
1139
dbus.Int64(condition),
1140
dbus.String(command))
1143
self.CheckerCompleted(dbus.Int16(-1),
1144
dbus.Int64(condition),
1145
dbus.String(command))
1147
return Client.checker_callback(self, pid, condition, command,
1150
def start_checker(self, *args, **kwargs):
1151
old_checker = self.checker
1152
if self.checker is not None:
1153
old_checker_pid = self.checker.pid
1155
old_checker_pid = None
1156
r = Client.start_checker(self, *args, **kwargs)
1157
# Only if new checker process was started
1158
if (self.checker is not None
1159
and old_checker_pid != self.checker.pid):
1161
self.CheckerStarted(self.current_checker_command)
1164
def _reset_approved(self):
1165
self.approved = None
1168
def approve(self, value=True):
1169
self.send_changedstate()
1170
self.approved = value
1171
gobject.timeout_add(timedelta_to_milliseconds
1172
(self.approval_duration),
1173
self._reset_approved)
1176
## D-Bus methods, signals & properties
1177
_interface = "se.recompile.Mandos.Client"
1181
# CheckerCompleted - signal
1182
@dbus.service.signal(_interface, signature="nxs")
1183
def CheckerCompleted(self, exitcode, waitstatus, command):
1187
# CheckerStarted - signal
1188
@dbus.service.signal(_interface, signature="s")
1189
def CheckerStarted(self, command):
1193
# PropertyChanged - signal
1194
@dbus.service.signal(_interface, signature="sv")
1195
def PropertyChanged(self, property, value):
1199
# GotSecret - signal
1200
@dbus.service.signal(_interface)
1201
def GotSecret(self):
1203
Is sent after a successful transfer of secret from the Mandos
1204
server to mandos-client
1209
@dbus.service.signal(_interface, signature="s")
1210
def Rejected(self, reason):
1214
# NeedApproval - signal
1215
@dbus.service.signal(_interface, signature="tb")
1216
def NeedApproval(self, timeout, default):
1218
return self.need_approval()
1220
# NeRwequest - signal
1221
@dbus.service.signal(_interface, signature="s")
1222
def NewRequest(self, ip):
1224
Is sent after a client request a password.
1231
@dbus.service.method(_interface, in_signature="b")
1232
def Approve(self, value):
1235
# CheckedOK - method
1236
@dbus.service.method(_interface)
1237
def CheckedOK(self):
1241
@dbus.service.method(_interface)
1246
# StartChecker - method
1247
@dbus.service.method(_interface)
1248
def StartChecker(self):
1250
self.start_checker()
1253
@dbus.service.method(_interface)
1258
# StopChecker - method
1259
@dbus.service.method(_interface)
1260
def StopChecker(self):
1265
# ApprovalPending - property
1266
@dbus_service_property(_interface, signature="b", access="read")
1267
def ApprovalPending_dbus_property(self):
1268
return dbus.Boolean(bool(self.approvals_pending))
1270
# ApprovedByDefault - property
1271
@dbus_service_property(_interface, signature="b",
1273
def ApprovedByDefault_dbus_property(self, value=None):
1274
if value is None: # get
1275
return dbus.Boolean(self.approved_by_default)
1276
self.approved_by_default = bool(value)
1278
# ApprovalDelay - property
1279
@dbus_service_property(_interface, signature="t",
1281
def ApprovalDelay_dbus_property(self, value=None):
1282
if value is None: # get
1283
return dbus.UInt64(self.approval_delay_milliseconds())
1284
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1286
# ApprovalDuration - property
1287
@dbus_service_property(_interface, signature="t",
1289
def ApprovalDuration_dbus_property(self, value=None):
1290
if value is None: # get
1291
return dbus.UInt64(timedelta_to_milliseconds(
1292
self.approval_duration))
1293
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1296
@dbus_service_property(_interface, signature="s", access="read")
1297
def Name_dbus_property(self):
1298
return dbus.String(self.name)
1300
# Fingerprint - property
1301
@dbus_service_property(_interface, signature="s", access="read")
1302
def Fingerprint_dbus_property(self):
1303
return dbus.String(self.fingerprint)
1306
@dbus_service_property(_interface, signature="s",
1308
def Host_dbus_property(self, value=None):
1309
if value is None: # get
1310
return dbus.String(self.host)
1311
self.host = unicode(value)
1313
# Created - property
1314
@dbus_service_property(_interface, signature="s", access="read")
1315
def Created_dbus_property(self):
1316
return datetime_to_dbus(self.created)
1318
# LastEnabled - property
1319
@dbus_service_property(_interface, signature="s", access="read")
1320
def LastEnabled_dbus_property(self):
1321
return datetime_to_dbus(self.last_enabled)
1323
# Enabled - property
1324
@dbus_service_property(_interface, signature="b",
1326
def Enabled_dbus_property(self, value=None):
1327
if value is None: # get
1328
return dbus.Boolean(self.enabled)
1334
# LastCheckedOK - property
1335
@dbus_service_property(_interface, signature="s",
1337
def LastCheckedOK_dbus_property(self, value=None):
1338
if value is not None:
1341
return datetime_to_dbus(self.last_checked_ok)
1343
# Expires - property
1344
@dbus_service_property(_interface, signature="s", access="read")
1345
def Expires_dbus_property(self):
1346
return datetime_to_dbus(self.expires)
1348
# LastApprovalRequest - property
1349
@dbus_service_property(_interface, signature="s", access="read")
1350
def LastApprovalRequest_dbus_property(self):
1351
return datetime_to_dbus(self.last_approval_request)
1353
# Timeout - property
1354
@dbus_service_property(_interface, signature="t",
1356
def Timeout_dbus_property(self, value=None):
1357
if value is None: # get
1358
return dbus.UInt64(self.timeout_milliseconds())
1359
self.timeout = datetime.timedelta(0, 0, 0, value)
1360
if getattr(self, "disable_initiator_tag", None) is None:
1362
# Reschedule timeout
1363
gobject.source_remove(self.disable_initiator_tag)
1364
self.disable_initiator_tag = None
1366
time_to_die = timedelta_to_milliseconds((self
1371
if time_to_die <= 0:
1372
# The timeout has passed
1375
self.expires = (datetime.datetime.utcnow()
1376
+ datetime.timedelta(milliseconds =
1378
self.disable_initiator_tag = (gobject.timeout_add
1379
(time_to_die, self.disable))
1381
# ExtendedTimeout - property
1382
@dbus_service_property(_interface, signature="t",
1384
def ExtendedTimeout_dbus_property(self, value=None):
1385
if value is None: # get
1386
return dbus.UInt64(self.extended_timeout_milliseconds())
1387
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1389
# Interval - property
1390
@dbus_service_property(_interface, signature="t",
1392
def Interval_dbus_property(self, value=None):
1393
if value is None: # get
1394
return dbus.UInt64(self.interval_milliseconds())
1395
self.interval = datetime.timedelta(0, 0, 0, value)
1396
if getattr(self, "checker_initiator_tag", None) is None:
1399
# Reschedule checker run
1400
gobject.source_remove(self.checker_initiator_tag)
1401
self.checker_initiator_tag = (gobject.timeout_add
1402
(value, self.start_checker))
1403
self.start_checker() # Start one now, too
1405
# Checker - property
1406
@dbus_service_property(_interface, signature="s",
1408
def Checker_dbus_property(self, value=None):
1409
if value is None: # get
1410
return dbus.String(self.checker_command)
1411
self.checker_command = unicode(value)
1413
# CheckerRunning - property
1414
@dbus_service_property(_interface, signature="b",
1416
def CheckerRunning_dbus_property(self, value=None):
1417
if value is None: # get
1418
return dbus.Boolean(self.checker is not None)
1420
self.start_checker()
1424
# ObjectPath - property
1425
@dbus_service_property(_interface, signature="o", access="read")
1426
def ObjectPath_dbus_property(self):
1427
return self.dbus_object_path # is already a dbus.ObjectPath
1430
@dbus_service_property(_interface, signature="ay",
1431
access="write", byte_arrays=True)
1432
def Secret_dbus_property(self, value):
1433
self.secret = str(value)
1438
class ProxyClient(object):
1439
def __init__(self, child_pipe, fpr, address):
1440
self._pipe = child_pipe
1441
self._pipe.send(('init', fpr, address))
1442
if not self._pipe.recv():
1445
def __getattribute__(self, name):
1447
return super(ProxyClient, self).__getattribute__(name)
1448
self._pipe.send(('getattr', name))
1449
data = self._pipe.recv()
1450
if data[0] == 'data':
1452
if data[0] == 'function':
1453
def func(*args, **kwargs):
1454
self._pipe.send(('funcall', name, args, kwargs))
1455
return self._pipe.recv()[1]
1458
def __setattr__(self, name, value):
1460
return super(ProxyClient, self).__setattr__(name, value)
1461
self._pipe.send(('setattr', name, value))
1464
class ClientDBusTransitional(ClientDBus):
1465
__metaclass__ = AlternateDBusNamesMetaclass
1468
class ClientHandler(socketserver.BaseRequestHandler, object):
1469
"""A class to handle client connections.
1471
Instantiated once for each connection to handle it.
370
def still_valid(self):
371
"""Has the timeout not yet passed for this client?"""
372
now = datetime.datetime.now()
373
if self.last_checked_ok is None:
374
return now < (self.created + self.timeout)
376
return now < (self.last_checked_ok + self.timeout)
379
def peer_certificate(session):
380
"Return the peer's OpenPGP certificate as a bytestring"
381
# If not an OpenPGP certificate...
382
if gnutls.library.functions.gnutls_certificate_type_get\
383
(session._c_object) \
384
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
385
# ...do the normal thing
386
return session.peer_certificate
387
list_size = ctypes.c_uint()
388
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
389
(session._c_object, ctypes.byref(list_size))
390
if list_size.value == 0:
393
return ctypes.string_at(cert.data, cert.size)
396
def fingerprint(openpgp):
397
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
398
# New GnuTLS "datum" with the OpenPGP public key
399
datum = gnutls.library.types.gnutls_datum_t\
400
(ctypes.cast(ctypes.c_char_p(openpgp),
401
ctypes.POINTER(ctypes.c_ubyte)),
402
ctypes.c_uint(len(openpgp)))
403
# New empty GnuTLS certificate
404
crt = gnutls.library.types.gnutls_openpgp_crt_t()
405
gnutls.library.functions.gnutls_openpgp_crt_init\
407
# Import the OpenPGP public key into the certificate
408
gnutls.library.functions.gnutls_openpgp_crt_import\
409
(crt, ctypes.byref(datum),
410
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
411
# New buffer for the fingerprint
412
buffer = ctypes.create_string_buffer(20)
413
buffer_length = ctypes.c_size_t()
414
# Get the fingerprint from the certificate into the buffer
415
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
416
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
417
# Deinit the certificate
418
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
419
# Convert the buffer to a Python bytestring
420
fpr = ctypes.string_at(buffer, buffer_length.value)
421
# Convert the bytestring to hexadecimal notation
422
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
426
class tcp_handler(SocketServer.BaseRequestHandler, object):
427
"""A TCP request handler class.
428
Instantiated by IPv6_TCPServer for each request to handle it.
1472
429
Note: This will run in its own forked process."""
1474
431
def handle(self):
1475
with contextlib.closing(self.server.child_pipe) as child_pipe:
1476
logger.info("TCP connection from: %s",
1477
unicode(self.client_address))
1478
logger.debug("Pipe FD: %d",
1479
self.server.child_pipe.fileno())
1481
session = (gnutls.connection
1482
.ClientSession(self.request,
1484
.X509Credentials()))
1486
# Note: gnutls.connection.X509Credentials is really a
1487
# generic GnuTLS certificate credentials object so long as
1488
# no X.509 keys are added to it. Therefore, we can use it
1489
# here despite using OpenPGP certificates.
1491
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1492
# "+AES-256-CBC", "+SHA1",
1493
# "+COMP-NULL", "+CTYPE-OPENPGP",
1495
# Use a fallback default, since this MUST be set.
1496
priority = self.server.gnutls_priority
1497
if priority is None:
1499
(gnutls.library.functions
1500
.gnutls_priority_set_direct(session._c_object,
1503
# Start communication using the Mandos protocol
1504
# Get protocol number
1505
line = self.request.makefile().readline()
1506
logger.debug("Protocol version: %r", line)
1508
if int(line.strip().split()[0]) > 1:
1510
except (ValueError, IndexError, RuntimeError) as error:
1511
logger.error("Unknown protocol version: %s", error)
1514
# Start GnuTLS connection
1517
except gnutls.errors.GNUTLSError as error:
1518
logger.warning("Handshake failed: %s", error)
1519
# Do not run session.bye() here: the session is not
1520
# established. Just abandon the request.
1522
logger.debug("Handshake succeeded")
1524
approval_required = False
1527
fpr = self.fingerprint(self.peer_certificate
1530
gnutls.errors.GNUTLSError) as error:
1531
logger.warning("Bad certificate: %s", error)
1533
logger.debug("Fingerprint: %s", fpr)
1536
client = ProxyClient(child_pipe, fpr,
1537
self.client_address)
1541
if self.server.use_dbus:
1543
client.NewRequest(str(self.client_address))
1545
if client.approval_delay:
1546
delay = client.approval_delay
1547
client.approvals_pending += 1
1548
approval_required = True
1551
if not client.enabled:
1552
logger.info("Client %s is disabled",
1554
if self.server.use_dbus:
1556
client.Rejected("Disabled")
1559
if client.approved or not client.approval_delay:
1560
#We are approved or approval is disabled
1562
elif client.approved is None:
1563
logger.info("Client %s needs approval",
1565
if self.server.use_dbus:
1567
client.NeedApproval(
1568
client.approval_delay_milliseconds(),
1569
client.approved_by_default)
1571
logger.warning("Client %s was not approved",
1573
if self.server.use_dbus:
1575
client.Rejected("Denied")
1578
#wait until timeout or approved
1579
time = datetime.datetime.now()
1580
client.changedstate.acquire()
1581
(client.changedstate.wait
1582
(float(client.timedelta_to_milliseconds(delay)
1584
client.changedstate.release()
1585
time2 = datetime.datetime.now()
1586
if (time2 - time) >= delay:
1587
if not client.approved_by_default:
1588
logger.warning("Client %s timed out while"
1589
" waiting for approval",
1591
if self.server.use_dbus:
1593
client.Rejected("Approval timed out")
1598
delay -= time2 - time
1601
while sent_size < len(client.secret):
1603
sent = session.send(client.secret[sent_size:])
1604
except gnutls.errors.GNUTLSError as error:
1605
logger.warning("gnutls send failed")
1607
logger.debug("Sent: %d, remaining: %d",
1608
sent, len(client.secret)
1609
- (sent_size + sent))
1612
logger.info("Sending secret to %s", client.name)
1613
# bump the timeout using extended_timeout
1614
client.checked_ok(client.extended_timeout)
1615
if self.server.use_dbus:
1620
if approval_required:
1621
client.approvals_pending -= 1
1624
except gnutls.errors.GNUTLSError as error:
1625
logger.warning("GnuTLS bye failed")
1628
def peer_certificate(session):
1629
"Return the peer's OpenPGP certificate as a bytestring"
1630
# If not an OpenPGP certificate...
1631
if (gnutls.library.functions
1632
.gnutls_certificate_type_get(session._c_object)
1633
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1634
# ...do the normal thing
1635
return session.peer_certificate
1636
list_size = ctypes.c_uint(1)
1637
cert_list = (gnutls.library.functions
1638
.gnutls_certificate_get_peers
1639
(session._c_object, ctypes.byref(list_size)))
1640
if not bool(cert_list) and list_size.value != 0:
1641
raise gnutls.errors.GNUTLSError("error getting peer"
1643
if list_size.value == 0:
1646
return ctypes.string_at(cert.data, cert.size)
1649
def fingerprint(openpgp):
1650
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1651
# New GnuTLS "datum" with the OpenPGP public key
1652
datum = (gnutls.library.types
1653
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1656
ctypes.c_uint(len(openpgp))))
1657
# New empty GnuTLS certificate
1658
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1659
(gnutls.library.functions
1660
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1661
# Import the OpenPGP public key into the certificate
1662
(gnutls.library.functions
1663
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1664
gnutls.library.constants
1665
.GNUTLS_OPENPGP_FMT_RAW))
1666
# Verify the self signature in the key
1667
crtverify = ctypes.c_uint()
1668
(gnutls.library.functions
1669
.gnutls_openpgp_crt_verify_self(crt, 0,
1670
ctypes.byref(crtverify)))
1671
if crtverify.value != 0:
1672
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1673
raise (gnutls.errors.CertificateSecurityError
1675
# New buffer for the fingerprint
1676
buf = ctypes.create_string_buffer(20)
1677
buf_len = ctypes.c_size_t()
1678
# Get the fingerprint from the certificate into the buffer
1679
(gnutls.library.functions
1680
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1681
ctypes.byref(buf_len)))
1682
# Deinit the certificate
1683
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1684
# Convert the buffer to a Python bytestring
1685
fpr = ctypes.string_at(buf, buf_len.value)
1686
# Convert the bytestring to hexadecimal notation
1687
hex_fpr = binascii.hexlify(fpr).upper()
1691
class MultiprocessingMixIn(object):
1692
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1693
def sub_process_main(self, request, address):
1695
self.finish_request(request, address)
1697
self.handle_error(request, address)
1698
self.close_request(request)
1700
def process_request(self, request, address):
1701
"""Start a new process to process the request."""
1702
proc = multiprocessing.Process(target = self.sub_process_main,
1709
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1710
""" adds a pipe to the MixIn """
1711
def process_request(self, request, client_address):
1712
"""Overrides and wraps the original process_request().
1714
This function creates a new pipe in self.pipe
1716
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1718
proc = MultiprocessingMixIn.process_request(self, request,
1720
self.child_pipe.close()
1721
self.add_pipe(parent_pipe, proc)
1723
def add_pipe(self, parent_pipe, proc):
1724
"""Dummy function; override as necessary"""
1725
raise NotImplementedError
1728
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1729
socketserver.TCPServer, object):
1730
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
432
logger.info(u"TCP connection from: %s",
433
unicode(self.client_address))
434
session = gnutls.connection.ClientSession\
435
(self.request, gnutls.connection.X509Credentials())
437
line = self.request.makefile().readline()
438
logger.debug(u"Protocol version: %r", line)
440
if int(line.strip().split()[0]) > 1:
442
except (ValueError, IndexError, RuntimeError), error:
443
logger.error(u"Unknown protocol version: %s", error)
446
# Note: gnutls.connection.X509Credentials is really a generic
447
# GnuTLS certificate credentials object so long as no X.509
448
# keys are added to it. Therefore, we can use it here despite
449
# using OpenPGP certificates.
451
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
452
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
454
priority = "NORMAL" # Fallback default, since this
456
if self.server.settings["priority"]:
457
priority = self.server.settings["priority"]
458
gnutls.library.functions.gnutls_priority_set_direct\
459
(session._c_object, priority, None);
463
except gnutls.errors.GNUTLSError, error:
464
logger.warning(u"Handshake failed: %s", error)
465
# Do not run session.bye() here: the session is not
466
# established. Just abandon the request.
469
fpr = fingerprint(peer_certificate(session))
470
except (TypeError, gnutls.errors.GNUTLSError), error:
471
logger.warning(u"Bad certificate: %s", error)
474
logger.debug(u"Fingerprint: %s", fpr)
476
for c in self.server.clients:
477
if c.fingerprint == fpr:
481
logger.warning(u"Client not found for fingerprint: %s",
485
# Have to check if client.still_valid(), since it is possible
486
# that the client timed out while establishing the GnuTLS
488
if not client.still_valid():
489
logger.warning(u"Client %(name)s is invalid",
494
while sent_size < len(client.secret):
495
sent = session.send(client.secret[sent_size:])
496
logger.debug(u"Sent: %d, remaining: %d",
497
sent, len(client.secret)
498
- (sent_size + sent))
503
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
504
"""IPv6 TCP server. Accepts 'None' as address and/or port.
1733
enabled: Boolean; whether this server is activated yet
1734
interface: None or a network interface name (string)
1735
use_ipv6: Boolean; to use IPv6 or not
506
settings: Server settings
507
clients: Set() of Client objects
1737
def __init__(self, server_address, RequestHandlerClass,
1738
interface=None, use_ipv6=True):
1739
self.interface = interface
1741
self.address_family = socket.AF_INET6
1742
socketserver.TCPServer.__init__(self, server_address,
1743
RequestHandlerClass)
509
address_family = socket.AF_INET6
510
def __init__(self, *args, **kwargs):
511
if "settings" in kwargs:
512
self.settings = kwargs["settings"]
513
del kwargs["settings"]
514
if "clients" in kwargs:
515
self.clients = kwargs["clients"]
516
del kwargs["clients"]
517
return super(type(self), self).__init__(*args, **kwargs)
1744
518
def server_bind(self):
1745
519
"""This overrides the normal server_bind() function
1746
520
to bind to an interface if one was specified, and also NOT to
1747
521
bind to an address or port if they were not specified."""
1748
if self.interface is not None:
1749
if SO_BINDTODEVICE is None:
1750
logger.error("SO_BINDTODEVICE does not exist;"
1751
" cannot bind to interface %s",
1755
self.socket.setsockopt(socket.SOL_SOCKET,
1759
except socket.error as error:
1760
if error[0] == errno.EPERM:
1761
logger.error("No permission to"
1762
" bind to interface %s",
1764
elif error[0] == errno.ENOPROTOOPT:
1765
logger.error("SO_BINDTODEVICE not available;"
1766
" cannot bind to interface %s",
522
if self.settings["interface"]:
523
# 25 is from /usr/include/asm-i486/socket.h
524
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
526
self.socket.setsockopt(socket.SOL_SOCKET,
528
self.settings["interface"])
529
except socket.error, error:
530
if error[0] == errno.EPERM:
531
logger.error(u"No permission to"
532
u" bind to interface %s",
533
self.settings["interface"])
1770
536
# Only bind(2) the socket if we really need to.
1771
537
if self.server_address[0] or self.server_address[1]:
1772
538
if not self.server_address[0]:
1773
if self.address_family == socket.AF_INET6:
1774
any_address = "::" # in6addr_any
1776
any_address = socket.INADDR_ANY
1777
self.server_address = (any_address,
540
self.server_address = (in6addr_any,
1778
541
self.server_address[1])
1779
elif not self.server_address[1]:
542
elif self.server_address[1] is None:
1780
543
self.server_address = (self.server_address[0],
1782
# if self.interface:
1783
# self.server_address = (self.server_address[0],
1788
return socketserver.TCPServer.server_bind(self)
1791
class MandosServer(IPv6_TCPServer):
1795
clients: set of Client objects
1796
gnutls_priority GnuTLS priority string
1797
use_dbus: Boolean; to emit D-Bus signals or not
1799
Assumes a gobject.MainLoop event loop.
1801
def __init__(self, server_address, RequestHandlerClass,
1802
interface=None, use_ipv6=True, clients=None,
1803
gnutls_priority=None, use_dbus=True):
1804
self.enabled = False
1805
self.clients = clients
1806
if self.clients is None:
1808
self.use_dbus = use_dbus
1809
self.gnutls_priority = gnutls_priority
1810
IPv6_TCPServer.__init__(self, server_address,
1811
RequestHandlerClass,
1812
interface = interface,
1813
use_ipv6 = use_ipv6)
1814
def server_activate(self):
1816
return socketserver.TCPServer.server_activate(self)
1821
def add_pipe(self, parent_pipe, proc):
1822
# Call "handle_ipc" for both data and EOF events
1823
gobject.io_add_watch(parent_pipe.fileno(),
1824
gobject.IO_IN | gobject.IO_HUP,
1825
functools.partial(self.handle_ipc,
1830
def handle_ipc(self, source, condition, parent_pipe=None,
1831
proc = None, client_object=None):
1833
gobject.IO_IN: "IN", # There is data to read.
1834
gobject.IO_OUT: "OUT", # Data can be written (without
1836
gobject.IO_PRI: "PRI", # There is urgent data to read.
1837
gobject.IO_ERR: "ERR", # Error condition.
1838
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1839
# broken, usually for pipes and
1842
conditions_string = ' | '.join(name
1844
condition_names.iteritems()
1845
if cond & condition)
1846
# error, or the other end of multiprocessing.Pipe has closed
1847
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1848
# Wait for other process to exit
1852
# Read a request from the child
1853
request = parent_pipe.recv()
1854
command = request[0]
1856
if command == 'init':
1858
address = request[2]
1860
for c in self.clients.itervalues():
1861
if c.fingerprint == fpr:
1865
logger.info("Client not found for fingerprint: %s, ad"
1866
"dress: %s", fpr, address)
1869
mandos_dbus_service.ClientNotFound(fpr,
1871
parent_pipe.send(False)
1874
gobject.io_add_watch(parent_pipe.fileno(),
1875
gobject.IO_IN | gobject.IO_HUP,
1876
functools.partial(self.handle_ipc,
1882
parent_pipe.send(True)
1883
# remove the old hook in favor of the new above hook on
1886
if command == 'funcall':
1887
funcname = request[1]
1891
parent_pipe.send(('data', getattr(client_object,
1895
if command == 'getattr':
1896
attrname = request[1]
1897
if callable(client_object.__getattribute__(attrname)):
1898
parent_pipe.send(('function',))
1900
parent_pipe.send(('data', client_object
1901
.__getattribute__(attrname)))
1903
if command == 'setattr':
1904
attrname = request[1]
1906
setattr(client_object, attrname, value)
545
return super(type(self), self).server_bind()
1911
548
def string_to_delta(interval):
1912
549
"""Parse a string and return a datetime.timedelta
1914
551
>>> string_to_delta('7d')
1915
552
datetime.timedelta(7)
1916
553
>>> string_to_delta('60s')
2029
688
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2030
689
"servicename": "Mandos",
2035
"statedir": "/var/lib/mandos"
2038
692
# Parse config file for server-global settings
2039
server_config = configparser.SafeConfigParser(server_defaults)
693
server_config = ConfigParser.SafeConfigParser(server_defaults)
2040
694
del server_defaults
2041
server_config.read(os.path.join(options.configdir,
695
server_config.read(os.path.join(options.configdir, "server.conf"))
696
server_section = "server"
2043
697
# Convert the SafeConfigParser object to a dict
2044
server_settings = server_config.defaults()
2045
# Use the appropriate methods on the non-string config options
2046
for option in ("debug", "use_dbus", "use_ipv6"):
2047
server_settings[option] = server_config.getboolean("DEFAULT",
2049
if server_settings["port"]:
2050
server_settings["port"] = server_config.getint("DEFAULT",
698
server_settings = dict(server_config.items(server_section))
699
# Use getboolean on the boolean config option
700
server_settings["debug"] = server_config.getboolean\
701
(server_section, "debug")
2052
702
del server_config
2054
704
# Override the settings from the config file with command line
2055
705
# options, if set.
2056
706
for option in ("interface", "address", "port", "debug",
2057
"priority", "servicename", "configdir",
2058
"use_dbus", "use_ipv6", "debuglevel", "restore",
707
"priority", "servicename", "configdir"):
2060
708
value = getattr(options, option)
2061
709
if value is not None:
2062
710
server_settings[option] = value
2064
# Force all strings to be unicode
2065
for option in server_settings.keys():
2066
if type(server_settings[option]) is str:
2067
server_settings[option] = unicode(server_settings[option])
2068
712
# Now we have our good server settings in "server_settings"
2070
##################################################################
2073
debug = server_settings["debug"]
2074
debuglevel = server_settings["debuglevel"]
2075
use_dbus = server_settings["use_dbus"]
2076
use_ipv6 = server_settings["use_ipv6"]
2077
stored_state_path = os.path.join(server_settings["statedir"],
2081
initlogger(logging.DEBUG)
2086
level = getattr(logging, debuglevel.upper())
2089
if server_settings["servicename"] != "Mandos":
2090
syslogger.setFormatter(logging.Formatter
2091
('Mandos (%s) [%%(process)d]:'
2092
' %%(levelname)s: %%(message)s'
2093
% server_settings["servicename"]))
2095
714
# Parse config file with clients
2096
client_config = configparser.SafeConfigParser(Client.client_defaults)
715
client_defaults = { "timeout": "1h",
717
"checker": "fping -q -- %%(fqdn)s",
719
client_config = ConfigParser.SafeConfigParser(client_defaults)
2097
720
client_config.read(os.path.join(server_settings["configdir"],
2098
721
"clients.conf"))
2100
global mandos_dbus_service
2101
mandos_dbus_service = None
2103
tcp_server = MandosServer((server_settings["address"],
2104
server_settings["port"]),
2106
interface=(server_settings["interface"]
2110
server_settings["priority"],
2113
pidfilename = "/var/run/mandos.pid"
2115
pidfile = open(pidfilename, "w")
2117
logger.error("Could not open file %r", pidfilename)
2120
uid = pwd.getpwnam("_mandos").pw_uid
2121
gid = pwd.getpwnam("_mandos").pw_gid
2124
uid = pwd.getpwnam("mandos").pw_uid
2125
gid = pwd.getpwnam("mandos").pw_gid
2128
uid = pwd.getpwnam("nobody").pw_uid
2129
gid = pwd.getpwnam("nobody").pw_gid
2136
except OSError as error:
2137
if error[0] != errno.EPERM:
2141
# Enable all possible GnuTLS debugging
2143
# "Use a log level over 10 to enable all debugging options."
2145
gnutls.library.functions.gnutls_global_set_log_level(11)
2147
@gnutls.library.types.gnutls_log_func
2148
def debug_gnutls(level, string):
2149
logger.debug("GnuTLS: %s", string[:-1])
2151
(gnutls.library.functions
2152
.gnutls_global_set_log_function(debug_gnutls))
2154
# Redirect stdin so all checkers get /dev/null
2155
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2156
os.dup2(null, sys.stdin.fileno())
2160
# No console logging
2161
logger.removeHandler(console)
2163
# Need to fork before connecting to D-Bus
2165
# Close all input and output, do double fork, etc.
2168
gobject.threads_init()
724
service = AvahiService(name = server_settings["servicename"],
725
type = "_mandos._tcp", );
726
if server_settings["interface"]:
727
service.interface = if_nametoindex(server_settings["interface"])
2170
729
global main_loop
2171
732
# From the Avahi example code
2172
733
DBusGMainLoop(set_as_default=True )
2173
734
main_loop = gobject.MainLoop()
2174
735
bus = dbus.SystemBus()
736
server = dbus.Interface(
737
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
738
avahi.DBUS_INTERFACE_SERVER )
2175
739
# End of Avahi example code
2178
bus_name = dbus.service.BusName("se.recompile.Mandos",
2179
bus, do_not_queue=True)
2180
old_bus_name = (dbus.service.BusName
2181
("se.bsnet.fukt.Mandos", bus,
2183
except dbus.exceptions.NameExistsException as e:
2184
logger.error(unicode(e) + ", disabling D-Bus")
2186
server_settings["use_dbus"] = False
2187
tcp_server.use_dbus = False
2188
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2189
service = AvahiServiceToSyslog(name =
2190
server_settings["servicename"],
2191
servicetype = "_mandos._tcp",
2192
protocol = protocol, bus = bus)
2193
if server_settings["interface"]:
2194
service.interface = (if_nametoindex
2195
(str(server_settings["interface"])))
2197
global multiprocessing_manager
2198
multiprocessing_manager = multiprocessing.Manager()
2200
client_class = Client
2202
client_class = functools.partial(ClientDBusTransitional,
2205
client_settings = Client.config_parser(client_config)
2206
old_client_settings = {}
2209
# Get client data and settings from last running state.
2210
if server_settings["restore"]:
2212
with open(stored_state_path, "rb") as stored_state:
2213
clients_data, old_client_settings = (pickle.load
2215
os.remove(stored_state_path)
2216
except IOError as e:
2217
logger.warning("Could not load persistent state: {0}"
2219
if e.errno != errno.ENOENT:
2221
except EOFError as e:
2222
logger.warning("Could not load persistent state: "
2223
"EOFError: {0}".format(e))
2225
with PGPEngine() as pgp:
2226
for client_name, client in clients_data.iteritems():
2227
# Decide which value to use after restoring saved state.
2228
# We have three different values: Old config file,
2229
# new config file, and saved state.
2230
# New config value takes precedence if it differs from old
2231
# config value, otherwise use saved state.
2232
for name, value in client_settings[client_name].items():
2234
# For each value in new config, check if it
2235
# differs from the old config value (Except for
2236
# the "secret" attribute)
2237
if (name != "secret" and
2238
value != old_client_settings[client_name]
2240
client[name] = value
2244
# Clients who has passed its expire date can still be
2245
# enabled if its last checker was successful. Clients
2246
# whose checker failed before we stored its state is
2247
# assumed to have failed all checkers during downtime.
2248
if client["enabled"]:
2249
if datetime.datetime.utcnow() >= client["expires"]:
2250
if not client["last_checked_ok"]:
2252
"disabling client {0} - Client never "
2253
"performed a successfull checker"
2254
.format(client["name"]))
2255
client["enabled"] = False
2256
elif client["last_checker_status"] != 0:
2258
"disabling client {0} - Client "
2259
"last checker failed with error code {1}"
2260
.format(client["name"],
2261
client["last_checker_status"]))
2262
client["enabled"] = False
2264
client["expires"] = (datetime.datetime
2266
+ client["timeout"])
2269
client["secret"] = (
2270
pgp.decrypt(client["encrypted_secret"],
2271
client_settings[client_name]
2274
# If decryption fails, we use secret from new settings
2275
logger.debug("Failed to decrypt {0} old secret"
2276
.format(client_name))
2277
client["secret"] = (
2278
client_settings[client_name]["secret"])
2281
# Add/remove clients based on new changes made to config
2282
for client_name in set(old_client_settings) - set(client_settings):
2283
del clients_data[client_name]
2284
for client_name in set(client_settings) - set(old_client_settings):
2285
clients_data[client_name] = client_settings[client_name]
2287
# Create clients all clients
2288
for client_name, client in clients_data.iteritems():
2289
tcp_server.clients[client_name] = client_class(
2290
name = client_name, settings = client)
2292
if not tcp_server.clients:
2293
logger.warning("No clients defined")
741
debug = server_settings["debug"]
744
console = logging.StreamHandler()
745
# console.setLevel(logging.DEBUG)
746
console.setFormatter(logging.Formatter\
747
('%(levelname)s: %(message)s'))
748
logger.addHandler(console)
752
def remove_from_clients(client):
753
clients.remove(client)
755
logger.critical(u"No clients left, exiting")
758
clients.update(Set(Client(name = section,
759
stop_hook = remove_from_clients,
761
= dict(client_config.items(section)))
762
for section in client_config.sections()))
768
"Cleanup function; run on exit"
770
# From the Avahi example code
771
if not group is None:
774
# End of Avahi example code
777
client = clients.pop()
778
client.stop_hook = None
781
atexit.register(cleanup)
2299
pidfile.write(str(pid) + "\n".encode("utf-8"))
2302
logger.error("Could not write to file %r with PID %d",
2305
# "pidfile" was never created
2308
784
signal.signal(signal.SIGINT, signal.SIG_IGN)
2310
785
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2311
786
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2314
class MandosDBusService(dbus.service.Object):
2315
"""A D-Bus proxy object"""
2317
dbus.service.Object.__init__(self, bus, "/")
2318
_interface = "se.recompile.Mandos"
2320
@dbus.service.signal(_interface, signature="o")
2321
def ClientAdded(self, objpath):
2325
@dbus.service.signal(_interface, signature="ss")
2326
def ClientNotFound(self, fingerprint, address):
2330
@dbus.service.signal(_interface, signature="os")
2331
def ClientRemoved(self, objpath, name):
2335
@dbus.service.method(_interface, out_signature="ao")
2336
def GetAllClients(self):
2338
return dbus.Array(c.dbus_object_path
2340
tcp_server.clients.itervalues())
2342
@dbus.service.method(_interface,
2343
out_signature="a{oa{sv}}")
2344
def GetAllClientsWithProperties(self):
2346
return dbus.Dictionary(
2347
((c.dbus_object_path, c.GetAll(""))
2348
for c in tcp_server.clients.itervalues()),
2351
@dbus.service.method(_interface, in_signature="o")
2352
def RemoveClient(self, object_path):
2354
for c in tcp_server.clients.itervalues():
2355
if c.dbus_object_path == object_path:
2356
del tcp_server.clients[c.name]
2357
c.remove_from_connection()
2358
# Don't signal anything except ClientRemoved
2359
c.disable(quiet=True)
2361
self.ClientRemoved(object_path, c.name)
2363
raise KeyError(object_path)
2367
class MandosDBusServiceTransitional(MandosDBusService):
2368
__metaclass__ = AlternateDBusNamesMetaclass
2369
mandos_dbus_service = MandosDBusServiceTransitional()
2372
"Cleanup function; run on exit"
2375
multiprocessing.active_children()
2376
if not (tcp_server.clients or client_settings):
2379
# Store client before exiting. Secrets are encrypted with key
2380
# based on what config file has. If config file is
2381
# removed/edited, old secret will thus be unrecovable.
2383
with PGPEngine() as pgp:
2384
for client in tcp_server.clients.itervalues():
2385
key = client_settings[client.name]["secret"]
2386
client.encrypted_secret = pgp.encrypt(client.secret,
2390
# A list of attributes that can not be pickled
2392
exclude = set(("bus", "changedstate", "secret",
2394
for name, typ in (inspect.getmembers
2395
(dbus.service.Object)):
2398
client_dict["encrypted_secret"] = (client
2400
for attr in client.client_structure:
2401
if attr not in exclude:
2402
client_dict[attr] = getattr(client, attr)
2404
clients[client.name] = client_dict
2405
del client_settings[client.name]["secret"]
2408
with os.fdopen(os.open(stored_state_path,
2409
(os.O_CREAT | os.O_WRONLY
2410
| os.O_TRUNC | os.O_EXCL),
2411
(stat.S_IREAD | stat.S_IWRITE)),
2412
"wb") as stored_state:
2413
pickle.dump((clients, client_settings), stored_state)
2414
except (IOError, OSError) as e:
2415
logger.warning("Could not save persistent state: {0}"
2417
if e.errno not in set((errno.ENOENT, errno.EACCES,
2421
# Delete all clients, and settings from config
2422
while tcp_server.clients:
2423
name, client = tcp_server.clients.popitem()
2425
client.remove_from_connection()
2426
# Don't signal anything except ClientRemoved
2427
client.disable(quiet=True)
2430
mandos_dbus_service.ClientRemoved(client
2433
client_settings.clear()
2435
atexit.register(cleanup)
2437
for client in tcp_server.clients.itervalues():
2440
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2441
# Need to initiate checking of clients
2443
client.init_checker()
2446
tcp_server.server_activate()
788
for client in clients:
791
tcp_server = IPv6_TCPServer((server_settings["address"],
792
server_settings["port"]),
794
settings=server_settings,
2448
796
# Find out what port we got
2449
797
service.port = tcp_server.socket.getsockname()[1]
2451
logger.info("Now listening on address %r, port %d,"
2452
" flowinfo %d, scope_id %d"
2453
% tcp_server.socket.getsockname())
2455
logger.info("Now listening on address %r, port %d"
2456
% tcp_server.socket.getsockname())
798
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
799
u" scope_id %d" % tcp_server.socket.getsockname())
2458
801
#service.interface = tcp_server.socket.getsockname()[3]
2461
804
# From the Avahi example code
805
server.connect_to_signal("StateChanged", server_state_changed)
2464
except dbus.exceptions.DBusException as error:
2465
logger.critical("DBusException: %s", error)
807
server_state_changed(server.GetState())
808
except dbus.exceptions.DBusException, error:
809
logger.critical(u"DBusException: %s", error)
2468
811
# End of Avahi example code
2470
813
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2471
814
lambda *args, **kwargs:
2472
(tcp_server.handle_request
2473
(*args[2:], **kwargs) or True))
815
tcp_server.handle_request\
816
(*args[2:], **kwargs) or True)
2475
818
logger.debug("Starting main loop")
819
main_loop_started = True
2477
except AvahiError as error:
2478
logger.critical("AvahiError: %s", error)
821
except AvahiError, error:
822
logger.critical(u"AvahiError: %s" + unicode(error))
2481
824
except KeyboardInterrupt:
2483
print("", file=sys.stderr)
2484
logger.debug("Server received KeyboardInterrupt")
2485
logger.debug("Server exiting")
2486
# Must run before the D-Bus bus name gets deregistered
2489
828
if __name__ == '__main__':