/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2011-09-26 19:36:18 UTC
  • mfrom: (24.1.184 mandos)
  • Revision ID: teddy@fukt.bsnet.se-20110926193618-vtj5c9hena1maixx
Merge from Björn

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
1
1
#!/usr/bin/python
2
 
 
3
 
import SocketServer
 
2
# -*- mode: python; coding: utf-8 -*-
 
3
# 
 
4
# Mandos server - give out binary blobs to connecting clients.
 
5
# 
 
6
# This program is partly derived from an example program for an Avahi
 
7
# service publisher, downloaded from
 
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
 
9
# methods "add", "remove", "server_state_changed",
 
10
# "entry_group_state_changed", "cleanup", and "activate" in the
 
11
# "AvahiService" class, and some lines in "main".
 
12
# 
 
13
# Everything else is
 
14
# Copyright © 2008-2011 Teddy Hogeborn
 
15
# Copyright © 2008-2011 Björn Påhlsson
 
16
# 
 
17
# This program is free software: you can redistribute it and/or modify
 
18
# it under the terms of the GNU General Public License as published by
 
19
# the Free Software Foundation, either version 3 of the License, or
 
20
# (at your option) any later version.
 
21
#
 
22
#     This program is distributed in the hope that it will be useful,
 
23
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
 
24
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 
25
#     GNU General Public License for more details.
 
26
# 
 
27
# You should have received a copy of the GNU General Public License
 
28
# along with this program.  If not, see
 
29
# <http://www.gnu.org/licenses/>.
 
30
# 
 
31
# Contact the authors at <mandos@fukt.bsnet.se>.
 
32
# 
 
33
 
 
34
from __future__ import (division, absolute_import, print_function,
 
35
                        unicode_literals)
 
36
 
 
37
import SocketServer as socketserver
4
38
import socket
5
 
import select
6
 
from optparse import OptionParser
 
39
import argparse
7
40
import datetime
8
41
import errno
9
42
import gnutls.crypto
10
43
import gnutls.connection
11
44
import gnutls.errors
12
 
import ConfigParser
 
45
import gnutls.library.functions
 
46
import gnutls.library.constants
 
47
import gnutls.library.types
 
48
import ConfigParser as configparser
13
49
import sys
14
 
 
15
 
 
 
50
import re
 
51
import os
 
52
import signal
 
53
import subprocess
 
54
import atexit
 
55
import stat
 
56
import logging
 
57
import logging.handlers
 
58
import pwd
 
59
import contextlib
 
60
import struct
 
61
import fcntl
 
62
import functools
 
63
import cPickle as pickle
 
64
import multiprocessing
 
65
 
 
66
import dbus
 
67
import dbus.service
 
68
import gobject
 
69
import avahi
 
70
from dbus.mainloop.glib import DBusGMainLoop
 
71
import ctypes
 
72
import ctypes.util
 
73
import xml.dom.minidom
 
74
import inspect
 
75
 
 
76
try:
 
77
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
 
78
except AttributeError:
 
79
    try:
 
80
        from IN import SO_BINDTODEVICE
 
81
    except ImportError:
 
82
        SO_BINDTODEVICE = None
 
83
 
 
84
 
 
85
version = "1.3.1"
 
86
 
 
87
#logger = logging.getLogger('mandos')
 
88
logger = logging.Logger('mandos')
 
89
syslogger = (logging.handlers.SysLogHandler
 
90
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
91
              address = str("/dev/log")))
 
92
syslogger.setFormatter(logging.Formatter
 
93
                       ('Mandos [%(process)d]: %(levelname)s:'
 
94
                        ' %(message)s'))
 
95
logger.addHandler(syslogger)
 
96
 
 
97
console = logging.StreamHandler()
 
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
 
99
                                       ' %(levelname)s:'
 
100
                                       ' %(message)s'))
 
101
logger.addHandler(console)
 
102
 
 
103
class AvahiError(Exception):
 
104
    def __init__(self, value, *args, **kwargs):
 
105
        self.value = value
 
106
        super(AvahiError, self).__init__(value, *args, **kwargs)
 
107
    def __unicode__(self):
 
108
        return unicode(repr(self.value))
 
109
 
 
110
class AvahiServiceError(AvahiError):
 
111
    pass
 
112
 
 
113
class AvahiGroupError(AvahiError):
 
114
    pass
 
115
 
 
116
 
 
117
class AvahiService(object):
 
118
    """An Avahi (Zeroconf) service.
 
119
    
 
120
    Attributes:
 
121
    interface: integer; avahi.IF_UNSPEC or an interface index.
 
122
               Used to optionally bind to the specified interface.
 
123
    name: string; Example: 'Mandos'
 
124
    type: string; Example: '_mandos._tcp'.
 
125
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
126
    port: integer; what port to announce
 
127
    TXT: list of strings; TXT record for the service
 
128
    domain: string; Domain to publish on, default to .local if empty.
 
129
    host: string; Host to publish records for, default is localhost
 
130
    max_renames: integer; maximum number of renames
 
131
    rename_count: integer; counter so we only rename after collisions
 
132
                  a sensible number of times
 
133
    group: D-Bus Entry Group
 
134
    server: D-Bus Server
 
135
    bus: dbus.SystemBus()
 
136
    """
 
137
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
 
138
                 servicetype = None, port = None, TXT = None,
 
139
                 domain = "", host = "", max_renames = 32768,
 
140
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
141
        self.interface = interface
 
142
        self.name = name
 
143
        self.type = servicetype
 
144
        self.port = port
 
145
        self.TXT = TXT if TXT is not None else []
 
146
        self.domain = domain
 
147
        self.host = host
 
148
        self.rename_count = 0
 
149
        self.max_renames = max_renames
 
150
        self.protocol = protocol
 
151
        self.group = None       # our entry group
 
152
        self.server = None
 
153
        self.bus = bus
 
154
        self.entry_group_state_changed_match = None
 
155
    def rename(self):
 
156
        """Derived from the Avahi example code"""
 
157
        if self.rename_count >= self.max_renames:
 
158
            logger.critical("No suitable Zeroconf service name found"
 
159
                            " after %i retries, exiting.",
 
160
                            self.rename_count)
 
161
            raise AvahiServiceError("Too many renames")
 
162
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
 
163
        logger.info("Changing Zeroconf service name to %r ...",
 
164
                    self.name)
 
165
        syslogger.setFormatter(logging.Formatter
 
166
                               ('Mandos (%s) [%%(process)d]:'
 
167
                                ' %%(levelname)s: %%(message)s'
 
168
                                % self.name))
 
169
        self.remove()
 
170
        try:
 
171
            self.add()
 
172
        except dbus.exceptions.DBusException as error:
 
173
            logger.critical("DBusException: %s", error)
 
174
            self.cleanup()
 
175
            os._exit(1)
 
176
        self.rename_count += 1
 
177
    def remove(self):
 
178
        """Derived from the Avahi example code"""
 
179
        if self.entry_group_state_changed_match is not None:
 
180
            self.entry_group_state_changed_match.remove()
 
181
            self.entry_group_state_changed_match = None
 
182
        if self.group is not None:
 
183
            self.group.Reset()
 
184
    def add(self):
 
185
        """Derived from the Avahi example code"""
 
186
        self.remove()
 
187
        if self.group is None:
 
188
            self.group = dbus.Interface(
 
189
                self.bus.get_object(avahi.DBUS_NAME,
 
190
                                    self.server.EntryGroupNew()),
 
191
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
192
        self.entry_group_state_changed_match = (
 
193
            self.group.connect_to_signal(
 
194
                'StateChanged', self .entry_group_state_changed))
 
195
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
 
196
                     self.name, self.type)
 
197
        self.group.AddService(
 
198
            self.interface,
 
199
            self.protocol,
 
200
            dbus.UInt32(0),     # flags
 
201
            self.name, self.type,
 
202
            self.domain, self.host,
 
203
            dbus.UInt16(self.port),
 
204
            avahi.string_array_to_txt_array(self.TXT))
 
205
        self.group.Commit()
 
206
    def entry_group_state_changed(self, state, error):
 
207
        """Derived from the Avahi example code"""
 
208
        logger.debug("Avahi entry group state change: %i", state)
 
209
        
 
210
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
 
211
            logger.debug("Zeroconf service established.")
 
212
        elif state == avahi.ENTRY_GROUP_COLLISION:
 
213
            logger.info("Zeroconf service name collision.")
 
214
            self.rename()
 
215
        elif state == avahi.ENTRY_GROUP_FAILURE:
 
216
            logger.critical("Avahi: Error in group state changed %s",
 
217
                            unicode(error))
 
218
            raise AvahiGroupError("State changed: %s"
 
219
                                  % unicode(error))
 
220
    def cleanup(self):
 
221
        """Derived from the Avahi example code"""
 
222
        if self.group is not None:
 
223
            try:
 
224
                self.group.Free()
 
225
            except (dbus.exceptions.UnknownMethodException,
 
226
                    dbus.exceptions.DBusException) as e:
 
227
                pass
 
228
            self.group = None
 
229
        self.remove()
 
230
    def server_state_changed(self, state, error=None):
 
231
        """Derived from the Avahi example code"""
 
232
        logger.debug("Avahi server state change: %i", state)
 
233
        bad_states = { avahi.SERVER_INVALID:
 
234
                           "Zeroconf server invalid",
 
235
                       avahi.SERVER_REGISTERING: None,
 
236
                       avahi.SERVER_COLLISION:
 
237
                           "Zeroconf server name collision",
 
238
                       avahi.SERVER_FAILURE:
 
239
                           "Zeroconf server failure" }
 
240
        if state in bad_states:
 
241
            if bad_states[state] is not None:
 
242
                if error is None:
 
243
                    logger.error(bad_states[state])
 
244
                else:
 
245
                    logger.error(bad_states[state] + ": %r", error)
 
246
            self.cleanup()
 
247
        elif state == avahi.SERVER_RUNNING:
 
248
            self.add()
 
249
        else:
 
250
            if error is None:
 
251
                logger.debug("Unknown state: %r", state)
 
252
            else:
 
253
                logger.debug("Unknown state: %r: %r", state, error)
 
254
    def activate(self):
 
255
        """Derived from the Avahi example code"""
 
256
        if self.server is None:
 
257
            self.server = dbus.Interface(
 
258
                self.bus.get_object(avahi.DBUS_NAME,
 
259
                                    avahi.DBUS_PATH_SERVER,
 
260
                                    follow_name_owner_changes=True),
 
261
                avahi.DBUS_INTERFACE_SERVER)
 
262
        self.server.connect_to_signal("StateChanged",
 
263
                                 self.server_state_changed)
 
264
        self.server_state_changed(self.server.GetState())
 
265
 
 
266
 
 
267
def _timedelta_to_milliseconds(td):
 
268
    "Convert a datetime.timedelta() to milliseconds"
 
269
    return ((td.days * 24 * 60 * 60 * 1000)
 
270
            + (td.seconds * 1000)
 
271
            + (td.microseconds // 1000))
 
272
        
16
273
class Client(object):
17
 
    def __init__(self, name=None, options=None, dn=None,
18
 
                 password=None, passfile=None, fqdn=None,
19
 
                 timeout=None, interval=-1):
 
274
    """A representation of a client host served by this server.
 
275
    
 
276
    Attributes:
 
277
    _approved:   bool(); 'None' if not yet approved/disapproved
 
278
    approval_delay: datetime.timedelta(); Time to wait for approval
 
279
    approval_duration: datetime.timedelta(); Duration of one approval
 
280
    checker:    subprocess.Popen(); a running checker process used
 
281
                                    to see if the client lives.
 
282
                                    'None' if no process is running.
 
283
    checker_callback_tag: a gobject event source tag, or None
 
284
    checker_command: string; External command which is run to check
 
285
                     if client lives.  %() expansions are done at
 
286
                     runtime with vars(self) as dict, so that for
 
287
                     instance %(name)s can be used in the command.
 
288
    checker_initiator_tag: a gobject event source tag, or None
 
289
    created:    datetime.datetime(); (UTC) object creation
 
290
    current_checker_command: string; current running checker_command
 
291
    disable_hook:  If set, called by disable() as disable_hook(self)
 
292
    disable_initiator_tag: a gobject event source tag, or None
 
293
    enabled:    bool()
 
294
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
295
                 uniquely identify the client
 
296
    host:       string; available for use by the checker command
 
297
    interval:   datetime.timedelta(); How often to start a new checker
 
298
    last_approval_request: datetime.datetime(); (UTC) or None
 
299
    last_checked_ok: datetime.datetime(); (UTC) or None
 
300
    last_enabled: datetime.datetime(); (UTC)
 
301
    name:       string; from the config file, used in log messages and
 
302
                        D-Bus identifiers
 
303
    secret:     bytestring; sent verbatim (over TLS) to client
 
304
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
305
                                      until this client is disabled
 
306
    extended_timeout:   extra long timeout when password has been sent
 
307
    runtime_expansions: Allowed attributes for runtime expansion.
 
308
    expires:    datetime.datetime(); time (UTC) when a client will be
 
309
                disabled, or None
 
310
    """
 
311
    
 
312
    runtime_expansions = ("approval_delay", "approval_duration",
 
313
                          "created", "enabled", "fingerprint",
 
314
                          "host", "interval", "last_checked_ok",
 
315
                          "last_enabled", "name", "timeout")
 
316
        
 
317
    def timeout_milliseconds(self):
 
318
        "Return the 'timeout' attribute in milliseconds"
 
319
        return _timedelta_to_milliseconds(self.timeout)
 
320
 
 
321
    def extended_timeout_milliseconds(self):
 
322
        "Return the 'extended_timeout' attribute in milliseconds"
 
323
        return _timedelta_to_milliseconds(self.extended_timeout)    
 
324
    
 
325
    def interval_milliseconds(self):
 
326
        "Return the 'interval' attribute in milliseconds"
 
327
        return _timedelta_to_milliseconds(self.interval)
 
328
 
 
329
    def approval_delay_milliseconds(self):
 
330
        return _timedelta_to_milliseconds(self.approval_delay)
 
331
    
 
332
    def __init__(self, name = None, disable_hook=None, config=None):
 
333
        """Note: the 'checker' key in 'config' sets the
 
334
        'checker_command' attribute and *not* the 'checker'
 
335
        attribute."""
20
336
        self.name = name
21
 
        self.dn = dn
22
 
        if password:
23
 
            self.password = password
24
 
        elif passfile:
25
 
            self.password = open(passfile).readall()
26
 
        else:
27
 
            print "No Password or Passfile in client config file"
28
 
            # raise RuntimeError XXX
29
 
            self.password = "gazonk"
30
 
        self.fqdn = fqdn
31
 
        self.created = datetime.datetime.now()
32
 
        self.last_seen = None
 
337
        if config is None:
 
338
            config = {}
 
339
        logger.debug("Creating client %r", self.name)
 
340
        # Uppercase and remove spaces from fingerprint for later
 
341
        # comparison purposes with return value from the fingerprint()
 
342
        # function
 
343
        self.fingerprint = (config["fingerprint"].upper()
 
344
                            .replace(" ", ""))
 
345
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
346
        if "secret" in config:
 
347
            self.secret = config["secret"].decode("base64")
 
348
        elif "secfile" in config:
 
349
            with open(os.path.expanduser(os.path.expandvars
 
350
                                         (config["secfile"])),
 
351
                      "rb") as secfile:
 
352
                self.secret = secfile.read()
 
353
        else:
 
354
            raise TypeError("No secret or secfile for client %s"
 
355
                            % self.name)
 
356
        self.host = config.get("host", "")
 
357
        self.created = datetime.datetime.utcnow()
 
358
        self.enabled = False
 
359
        self.last_approval_request = None
 
360
        self.last_enabled = None
 
361
        self.last_checked_ok = None
 
362
        self.timeout = string_to_delta(config["timeout"])
 
363
        self.extended_timeout = string_to_delta(config["extended_timeout"])
 
364
        self.interval = string_to_delta(config["interval"])
 
365
        self.disable_hook = disable_hook
 
366
        self.checker = None
 
367
        self.checker_initiator_tag = None
 
368
        self.disable_initiator_tag = None
 
369
        self.expires = None
 
370
        self.checker_callback_tag = None
 
371
        self.checker_command = config["checker"]
 
372
        self.current_checker_command = None
 
373
        self.last_connect = None
 
374
        self._approved = None
 
375
        self.approved_by_default = config.get("approved_by_default",
 
376
                                              True)
 
377
        self.approvals_pending = 0
 
378
        self.approval_delay = string_to_delta(
 
379
            config["approval_delay"])
 
380
        self.approval_duration = string_to_delta(
 
381
            config["approval_duration"])
 
382
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
 
383
    
 
384
    def send_changedstate(self):
 
385
        self.changedstate.acquire()
 
386
        self.changedstate.notify_all()
 
387
        self.changedstate.release()
 
388
        
 
389
    def enable(self):
 
390
        """Start this client's checker and timeout hooks"""
 
391
        if getattr(self, "enabled", False):
 
392
            # Already enabled
 
393
            return
 
394
        self.send_changedstate()
 
395
        # Schedule a new checker to be started an 'interval' from now,
 
396
        # and every interval from then on.
 
397
        self.checker_initiator_tag = (gobject.timeout_add
 
398
                                      (self.interval_milliseconds(),
 
399
                                       self.start_checker))
 
400
        # Schedule a disable() when 'timeout' has passed
 
401
        self.expires = datetime.datetime.utcnow() + self.timeout
 
402
        self.disable_initiator_tag = (gobject.timeout_add
 
403
                                   (self.timeout_milliseconds(),
 
404
                                    self.disable))
 
405
        self.enabled = True
 
406
        self.last_enabled = datetime.datetime.utcnow()
 
407
        # Also start a new checker *right now*.
 
408
        self.start_checker()
 
409
    
 
410
    def disable(self, quiet=True):
 
411
        """Disable this client."""
 
412
        if not getattr(self, "enabled", False):
 
413
            return False
 
414
        if not quiet:
 
415
            self.send_changedstate()
 
416
        if not quiet:
 
417
            logger.info("Disabling client %s", self.name)
 
418
        if getattr(self, "disable_initiator_tag", False):
 
419
            gobject.source_remove(self.disable_initiator_tag)
 
420
            self.disable_initiator_tag = None
 
421
        self.expires = None
 
422
        if getattr(self, "checker_initiator_tag", False):
 
423
            gobject.source_remove(self.checker_initiator_tag)
 
424
            self.checker_initiator_tag = None
 
425
        self.stop_checker()
 
426
        if self.disable_hook:
 
427
            self.disable_hook(self)
 
428
        self.enabled = False
 
429
        # Do not run this again if called by a gobject.timeout_add
 
430
        return False
 
431
    
 
432
    def __del__(self):
 
433
        self.disable_hook = None
 
434
        self.disable()
 
435
    
 
436
    def checker_callback(self, pid, condition, command):
 
437
        """The checker has completed, so take appropriate actions."""
 
438
        self.checker_callback_tag = None
 
439
        self.checker = None
 
440
        if os.WIFEXITED(condition):
 
441
            exitstatus = os.WEXITSTATUS(condition)
 
442
            if exitstatus == 0:
 
443
                logger.info("Checker for %(name)s succeeded",
 
444
                            vars(self))
 
445
                self.checked_ok()
 
446
            else:
 
447
                logger.info("Checker for %(name)s failed",
 
448
                            vars(self))
 
449
        else:
 
450
            logger.warning("Checker for %(name)s crashed?",
 
451
                           vars(self))
 
452
    
 
453
    def checked_ok(self, timeout=None):
 
454
        """Bump up the timeout for this client.
 
455
        
 
456
        This should only be called when the client has been seen,
 
457
        alive and well.
 
458
        """
33
459
        if timeout is None:
34
 
            timeout = options.timeout
35
 
        self.timeout = timeout
36
 
        if interval == -1:
37
 
            interval = options.interval
38
 
        self.interval = interval
39
 
        self.next_check = datetime.datetime.now()
40
 
 
41
 
 
42
 
class server_metaclass(type):
43
 
    "Common behavior for the UDP and TCP server classes"
44
 
    def __new__(cls, name, bases, attrs):
45
 
        attrs["address_family"] = socket.AF_INET6
46
 
        attrs["allow_reuse_address"] = True
47
 
        def server_bind(self):
48
 
            if self.options.interface:
49
 
                if not hasattr(socket, "SO_BINDTODEVICE"):
50
 
                    # From /usr/include/asm-i486/socket.h
51
 
                    socket.SO_BINDTODEVICE = 25
 
460
            timeout = self.timeout
 
461
        self.last_checked_ok = datetime.datetime.utcnow()
 
462
        gobject.source_remove(self.disable_initiator_tag)
 
463
        self.expires = datetime.datetime.utcnow() + timeout
 
464
        self.disable_initiator_tag = (gobject.timeout_add
 
465
                                      (_timedelta_to_milliseconds(timeout),
 
466
                                       self.disable))
 
467
    
 
468
    def need_approval(self):
 
469
        self.last_approval_request = datetime.datetime.utcnow()
 
470
    
 
471
    def start_checker(self):
 
472
        """Start a new checker subprocess if one is not running.
 
473
        
 
474
        If a checker already exists, leave it running and do
 
475
        nothing."""
 
476
        # The reason for not killing a running checker is that if we
 
477
        # did that, then if a checker (for some reason) started
 
478
        # running slowly and taking more than 'interval' time, the
 
479
        # client would inevitably timeout, since no checker would get
 
480
        # a chance to run to completion.  If we instead leave running
 
481
        # checkers alone, the checker would have to take more time
 
482
        # than 'timeout' for the client to be disabled, which is as it
 
483
        # should be.
 
484
        
 
485
        # If a checker exists, make sure it is not a zombie
 
486
        try:
 
487
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
488
        except (AttributeError, OSError) as error:
 
489
            if (isinstance(error, OSError)
 
490
                and error.errno != errno.ECHILD):
 
491
                raise error
 
492
        else:
 
493
            if pid:
 
494
                logger.warning("Checker was a zombie")
 
495
                gobject.source_remove(self.checker_callback_tag)
 
496
                self.checker_callback(pid, status,
 
497
                                      self.current_checker_command)
 
498
        # Start a new checker if needed
 
499
        if self.checker is None:
 
500
            try:
 
501
                # In case checker_command has exactly one % operator
 
502
                command = self.checker_command % self.host
 
503
            except TypeError:
 
504
                # Escape attributes for the shell
 
505
                escaped_attrs = dict(
 
506
                    (attr,
 
507
                     re.escape(unicode(str(getattr(self, attr, "")),
 
508
                                       errors=
 
509
                                       'replace')))
 
510
                    for attr in
 
511
                    self.runtime_expansions)
 
512
 
 
513
                try:
 
514
                    command = self.checker_command % escaped_attrs
 
515
                except TypeError as error:
 
516
                    logger.error('Could not format string "%s":'
 
517
                                 ' %s', self.checker_command, error)
 
518
                    return True # Try again later
 
519
            self.current_checker_command = command
 
520
            try:
 
521
                logger.info("Starting checker %r for %s",
 
522
                            command, self.name)
 
523
                # We don't need to redirect stdout and stderr, since
 
524
                # in normal mode, that is already done by daemon(),
 
525
                # and in debug mode we don't want to.  (Stdin is
 
526
                # always replaced by /dev/null.)
 
527
                self.checker = subprocess.Popen(command,
 
528
                                                close_fds=True,
 
529
                                                shell=True, cwd="/")
 
530
                self.checker_callback_tag = (gobject.child_watch_add
 
531
                                             (self.checker.pid,
 
532
                                              self.checker_callback,
 
533
                                              data=command))
 
534
                # The checker may have completed before the gobject
 
535
                # watch was added.  Check for this.
 
536
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
537
                if pid:
 
538
                    gobject.source_remove(self.checker_callback_tag)
 
539
                    self.checker_callback(pid, status, command)
 
540
            except OSError as error:
 
541
                logger.error("Failed to start subprocess: %s",
 
542
                             error)
 
543
        # Re-run this periodically if run by gobject.timeout_add
 
544
        return True
 
545
    
 
546
    def stop_checker(self):
 
547
        """Force the checker process, if any, to stop."""
 
548
        if self.checker_callback_tag:
 
549
            gobject.source_remove(self.checker_callback_tag)
 
550
            self.checker_callback_tag = None
 
551
        if getattr(self, "checker", None) is None:
 
552
            return
 
553
        logger.debug("Stopping checker for %(name)s", vars(self))
 
554
        try:
 
555
            os.kill(self.checker.pid, signal.SIGTERM)
 
556
            #time.sleep(0.5)
 
557
            #if self.checker.poll() is None:
 
558
            #    os.kill(self.checker.pid, signal.SIGKILL)
 
559
        except OSError as error:
 
560
            if error.errno != errno.ESRCH: # No such process
 
561
                raise
 
562
        self.checker = None
 
563
 
 
564
def dbus_service_property(dbus_interface, signature="v",
 
565
                          access="readwrite", byte_arrays=False):
 
566
    """Decorators for marking methods of a DBusObjectWithProperties to
 
567
    become properties on the D-Bus.
 
568
    
 
569
    The decorated method will be called with no arguments by "Get"
 
570
    and with one argument by "Set".
 
571
    
 
572
    The parameters, where they are supported, are the same as
 
573
    dbus.service.method, except there is only "signature", since the
 
574
    type from Get() and the type sent to Set() is the same.
 
575
    """
 
576
    # Encoding deeply encoded byte arrays is not supported yet by the
 
577
    # "Set" method, so we fail early here:
 
578
    if byte_arrays and signature != "ay":
 
579
        raise ValueError("Byte arrays not supported for non-'ay'"
 
580
                         " signature %r" % signature)
 
581
    def decorator(func):
 
582
        func._dbus_is_property = True
 
583
        func._dbus_interface = dbus_interface
 
584
        func._dbus_signature = signature
 
585
        func._dbus_access = access
 
586
        func._dbus_name = func.__name__
 
587
        if func._dbus_name.endswith("_dbus_property"):
 
588
            func._dbus_name = func._dbus_name[:-14]
 
589
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
590
        return func
 
591
    return decorator
 
592
 
 
593
 
 
594
class DBusPropertyException(dbus.exceptions.DBusException):
 
595
    """A base class for D-Bus property-related exceptions
 
596
    """
 
597
    def __unicode__(self):
 
598
        return unicode(str(self))
 
599
 
 
600
 
 
601
class DBusPropertyAccessException(DBusPropertyException):
 
602
    """A property's access permissions disallows an operation.
 
603
    """
 
604
    pass
 
605
 
 
606
 
 
607
class DBusPropertyNotFound(DBusPropertyException):
 
608
    """An attempt was made to access a non-existing property.
 
609
    """
 
610
    pass
 
611
 
 
612
 
 
613
class DBusObjectWithProperties(dbus.service.Object):
 
614
    """A D-Bus object with properties.
 
615
 
 
616
    Classes inheriting from this can use the dbus_service_property
 
617
    decorator to expose methods as D-Bus properties.  It exposes the
 
618
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
619
    """
 
620
    
 
621
    @staticmethod
 
622
    def _is_dbus_property(obj):
 
623
        return getattr(obj, "_dbus_is_property", False)
 
624
    
 
625
    def _get_all_dbus_properties(self):
 
626
        """Returns a generator of (name, attribute) pairs
 
627
        """
 
628
        return ((prop._dbus_name, prop)
 
629
                for name, prop in
 
630
                inspect.getmembers(self, self._is_dbus_property))
 
631
    
 
632
    def _get_dbus_property(self, interface_name, property_name):
 
633
        """Returns a bound method if one exists which is a D-Bus
 
634
        property with the specified name and interface.
 
635
        """
 
636
        for name in (property_name,
 
637
                     property_name + "_dbus_property"):
 
638
            prop = getattr(self, name, None)
 
639
            if (prop is None
 
640
                or not self._is_dbus_property(prop)
 
641
                or prop._dbus_name != property_name
 
642
                or (interface_name and prop._dbus_interface
 
643
                    and interface_name != prop._dbus_interface)):
 
644
                continue
 
645
            return prop
 
646
        # No such property
 
647
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
648
                                   + interface_name + "."
 
649
                                   + property_name)
 
650
    
 
651
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
652
                         out_signature="v")
 
653
    def Get(self, interface_name, property_name):
 
654
        """Standard D-Bus property Get() method, see D-Bus standard.
 
655
        """
 
656
        prop = self._get_dbus_property(interface_name, property_name)
 
657
        if prop._dbus_access == "write":
 
658
            raise DBusPropertyAccessException(property_name)
 
659
        value = prop()
 
660
        if not hasattr(value, "variant_level"):
 
661
            return value
 
662
        return type(value)(value, variant_level=value.variant_level+1)
 
663
    
 
664
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
 
665
    def Set(self, interface_name, property_name, value):
 
666
        """Standard D-Bus property Set() method, see D-Bus standard.
 
667
        """
 
668
        prop = self._get_dbus_property(interface_name, property_name)
 
669
        if prop._dbus_access == "read":
 
670
            raise DBusPropertyAccessException(property_name)
 
671
        if prop._dbus_get_args_options["byte_arrays"]:
 
672
            # The byte_arrays option is not supported yet on
 
673
            # signatures other than "ay".
 
674
            if prop._dbus_signature != "ay":
 
675
                raise ValueError
 
676
            value = dbus.ByteArray(''.join(unichr(byte)
 
677
                                           for byte in value))
 
678
        prop(value)
 
679
    
 
680
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
681
                         out_signature="a{sv}")
 
682
    def GetAll(self, interface_name):
 
683
        """Standard D-Bus property GetAll() method, see D-Bus
 
684
        standard.
 
685
 
 
686
        Note: Will not include properties with access="write".
 
687
        """
 
688
        all = {}
 
689
        for name, prop in self._get_all_dbus_properties():
 
690
            if (interface_name
 
691
                and interface_name != prop._dbus_interface):
 
692
                # Interface non-empty but did not match
 
693
                continue
 
694
            # Ignore write-only properties
 
695
            if prop._dbus_access == "write":
 
696
                continue
 
697
            value = prop()
 
698
            if not hasattr(value, "variant_level"):
 
699
                all[name] = value
 
700
                continue
 
701
            all[name] = type(value)(value, variant_level=
 
702
                                    value.variant_level+1)
 
703
        return dbus.Dictionary(all, signature="sv")
 
704
    
 
705
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
706
                         out_signature="s",
 
707
                         path_keyword='object_path',
 
708
                         connection_keyword='connection')
 
709
    def Introspect(self, object_path, connection):
 
710
        """Standard D-Bus method, overloaded to insert property tags.
 
711
        """
 
712
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
713
                                                   connection)
 
714
        try:
 
715
            document = xml.dom.minidom.parseString(xmlstring)
 
716
            def make_tag(document, name, prop):
 
717
                e = document.createElement("property")
 
718
                e.setAttribute("name", name)
 
719
                e.setAttribute("type", prop._dbus_signature)
 
720
                e.setAttribute("access", prop._dbus_access)
 
721
                return e
 
722
            for if_tag in document.getElementsByTagName("interface"):
 
723
                for tag in (make_tag(document, name, prop)
 
724
                            for name, prop
 
725
                            in self._get_all_dbus_properties()
 
726
                            if prop._dbus_interface
 
727
                            == if_tag.getAttribute("name")):
 
728
                    if_tag.appendChild(tag)
 
729
                # Add the names to the return values for the
 
730
                # "org.freedesktop.DBus.Properties" methods
 
731
                if (if_tag.getAttribute("name")
 
732
                    == "org.freedesktop.DBus.Properties"):
 
733
                    for cn in if_tag.getElementsByTagName("method"):
 
734
                        if cn.getAttribute("name") == "Get":
 
735
                            for arg in cn.getElementsByTagName("arg"):
 
736
                                if (arg.getAttribute("direction")
 
737
                                    == "out"):
 
738
                                    arg.setAttribute("name", "value")
 
739
                        elif cn.getAttribute("name") == "GetAll":
 
740
                            for arg in cn.getElementsByTagName("arg"):
 
741
                                if (arg.getAttribute("direction")
 
742
                                    == "out"):
 
743
                                    arg.setAttribute("name", "props")
 
744
            xmlstring = document.toxml("utf-8")
 
745
            document.unlink()
 
746
        except (AttributeError, xml.dom.DOMException,
 
747
                xml.parsers.expat.ExpatError) as error:
 
748
            logger.error("Failed to override Introspection method",
 
749
                         error)
 
750
        return xmlstring
 
751
 
 
752
 
 
753
def datetime_to_dbus (dt, variant_level=0):
 
754
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
755
    if dt is None:
 
756
        return dbus.String("", variant_level = variant_level)
 
757
    return dbus.String(dt.isoformat(),
 
758
                       variant_level=variant_level)
 
759
 
 
760
class ClientDBus(Client, DBusObjectWithProperties):
 
761
    """A Client class using D-Bus
 
762
    
 
763
    Attributes:
 
764
    dbus_object_path: dbus.ObjectPath
 
765
    bus: dbus.SystemBus()
 
766
    """
 
767
    
 
768
    runtime_expansions = (Client.runtime_expansions
 
769
                          + ("dbus_object_path",))
 
770
    
 
771
    # dbus.service.Object doesn't use super(), so we can't either.
 
772
    
 
773
    def __init__(self, bus = None, *args, **kwargs):
 
774
        self._approvals_pending = 0
 
775
        self.bus = bus
 
776
        Client.__init__(self, *args, **kwargs)
 
777
        # Only now, when this client is initialized, can it show up on
 
778
        # the D-Bus
 
779
        client_object_name = unicode(self.name).translate(
 
780
            {ord("."): ord("_"),
 
781
             ord("-"): ord("_")})
 
782
        self.dbus_object_path = (dbus.ObjectPath
 
783
                                 ("/clients/" + client_object_name))
 
784
        DBusObjectWithProperties.__init__(self, self.bus,
 
785
                                          self.dbus_object_path)
 
786
        
 
787
    def notifychangeproperty(transform_func,
 
788
                             dbus_name, type_func=lambda x: x,
 
789
                             variant_level=1):
 
790
        """ Modify a variable so that its a property that announce its
 
791
        changes to DBus.
 
792
        transform_fun: Function that takes a value and transform it to
 
793
                       DBus type.
 
794
        dbus_name: DBus name of the variable
 
795
        type_func: Function that transform the value before sending it
 
796
                   to DBus
 
797
        variant_level: DBus variant level. default: 1
 
798
        """
 
799
        real_value = [None,]
 
800
        def setter(self, value):
 
801
            old_value = real_value[0]
 
802
            real_value[0] = value
 
803
            if hasattr(self, "dbus_object_path"):
 
804
                if type_func(old_value) != type_func(real_value[0]):
 
805
                    dbus_value = transform_func(type_func(real_value[0]),
 
806
                                                variant_level)
 
807
                    self.PropertyChanged(dbus.String(dbus_name),
 
808
                                         dbus_value)
 
809
 
 
810
        return property(lambda self: real_value[0], setter)
 
811
 
 
812
 
 
813
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
814
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
815
                                             "ApprovalPending",
 
816
                                             type_func = bool)
 
817
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
818
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
819
                                        "LastEnabled")
 
820
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
821
                                   type_func = lambda checker: checker is not None)
 
822
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
823
                                           "LastCheckedOK")
 
824
    last_approval_request = notifychangeproperty(datetime_to_dbus,
 
825
                                                 "LastApprovalRequest")
 
826
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
827
                                               "ApprovedByDefault")
 
828
    approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",
 
829
                                          type_func = _timedelta_to_milliseconds)
 
830
    approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",
 
831
                                             type_func = _timedelta_to_milliseconds)
 
832
    host = notifychangeproperty(dbus.String, "Host")
 
833
    timeout = notifychangeproperty(dbus.UInt16, "Timeout",
 
834
                                   type_func = _timedelta_to_milliseconds)
 
835
    extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",
 
836
                                            type_func = _timedelta_to_milliseconds)
 
837
    interval = notifychangeproperty(dbus.UInt16, "Interval",
 
838
                                    type_func = _timedelta_to_milliseconds)
 
839
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
840
    
 
841
    del notifychangeproperty
 
842
    
 
843
    def __del__(self, *args, **kwargs):
 
844
        try:
 
845
            self.remove_from_connection()
 
846
        except LookupError:
 
847
            pass
 
848
        if hasattr(DBusObjectWithProperties, "__del__"):
 
849
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
 
850
        Client.__del__(self, *args, **kwargs)
 
851
    
 
852
    def checker_callback(self, pid, condition, command,
 
853
                         *args, **kwargs):
 
854
        self.checker_callback_tag = None
 
855
        self.checker = None
 
856
        if os.WIFEXITED(condition):
 
857
            exitstatus = os.WEXITSTATUS(condition)
 
858
            # Emit D-Bus signal
 
859
            self.CheckerCompleted(dbus.Int16(exitstatus),
 
860
                                  dbus.Int64(condition),
 
861
                                  dbus.String(command))
 
862
        else:
 
863
            # Emit D-Bus signal
 
864
            self.CheckerCompleted(dbus.Int16(-1),
 
865
                                  dbus.Int64(condition),
 
866
                                  dbus.String(command))
 
867
        
 
868
        return Client.checker_callback(self, pid, condition, command,
 
869
                                       *args, **kwargs)
 
870
 
 
871
    def start_checker(self, *args, **kwargs):
 
872
        old_checker = self.checker
 
873
        if self.checker is not None:
 
874
            old_checker_pid = self.checker.pid
 
875
        else:
 
876
            old_checker_pid = None
 
877
        r = Client.start_checker(self, *args, **kwargs)
 
878
        # Only if new checker process was started
 
879
        if (self.checker is not None
 
880
            and old_checker_pid != self.checker.pid):
 
881
            # Emit D-Bus signal
 
882
            self.CheckerStarted(self.current_checker_command)
 
883
        return r
 
884
    
 
885
    def _reset_approved(self):
 
886
        self._approved = None
 
887
        return False
 
888
    
 
889
    def approve(self, value=True):
 
890
        self.send_changedstate()
 
891
        self._approved = value
 
892
        gobject.timeout_add(_timedelta_to_milliseconds
 
893
                            (self.approval_duration),
 
894
                            self._reset_approved)
 
895
    
 
896
    
 
897
    ## D-Bus methods, signals & properties
 
898
    _interface = "se.bsnet.fukt.Mandos.Client"
 
899
    
 
900
    ## Signals
 
901
    
 
902
    # CheckerCompleted - signal
 
903
    @dbus.service.signal(_interface, signature="nxs")
 
904
    def CheckerCompleted(self, exitcode, waitstatus, command):
 
905
        "D-Bus signal"
 
906
        pass
 
907
    
 
908
    # CheckerStarted - signal
 
909
    @dbus.service.signal(_interface, signature="s")
 
910
    def CheckerStarted(self, command):
 
911
        "D-Bus signal"
 
912
        pass
 
913
    
 
914
    # PropertyChanged - signal
 
915
    @dbus.service.signal(_interface, signature="sv")
 
916
    def PropertyChanged(self, property, value):
 
917
        "D-Bus signal"
 
918
        pass
 
919
    
 
920
    # GotSecret - signal
 
921
    @dbus.service.signal(_interface)
 
922
    def GotSecret(self):
 
923
        """D-Bus signal
 
924
        Is sent after a successful transfer of secret from the Mandos
 
925
        server to mandos-client
 
926
        """
 
927
        pass
 
928
    
 
929
    # Rejected - signal
 
930
    @dbus.service.signal(_interface, signature="s")
 
931
    def Rejected(self, reason):
 
932
        "D-Bus signal"
 
933
        pass
 
934
    
 
935
    # NeedApproval - signal
 
936
    @dbus.service.signal(_interface, signature="tb")
 
937
    def NeedApproval(self, timeout, default):
 
938
        "D-Bus signal"
 
939
        return self.need_approval()
 
940
    
 
941
    ## Methods
 
942
    
 
943
    # Approve - method
 
944
    @dbus.service.method(_interface, in_signature="b")
 
945
    def Approve(self, value):
 
946
        self.approve(value)
 
947
    
 
948
    # CheckedOK - method
 
949
    @dbus.service.method(_interface)
 
950
    def CheckedOK(self):
 
951
        self.checked_ok()
 
952
    
 
953
    # Enable - method
 
954
    @dbus.service.method(_interface)
 
955
    def Enable(self):
 
956
        "D-Bus method"
 
957
        self.enable()
 
958
    
 
959
    # StartChecker - method
 
960
    @dbus.service.method(_interface)
 
961
    def StartChecker(self):
 
962
        "D-Bus method"
 
963
        self.start_checker()
 
964
    
 
965
    # Disable - method
 
966
    @dbus.service.method(_interface)
 
967
    def Disable(self):
 
968
        "D-Bus method"
 
969
        self.disable()
 
970
    
 
971
    # StopChecker - method
 
972
    @dbus.service.method(_interface)
 
973
    def StopChecker(self):
 
974
        self.stop_checker()
 
975
    
 
976
    ## Properties
 
977
    
 
978
    # ApprovalPending - property
 
979
    @dbus_service_property(_interface, signature="b", access="read")
 
980
    def ApprovalPending_dbus_property(self):
 
981
        return dbus.Boolean(bool(self.approvals_pending))
 
982
    
 
983
    # ApprovedByDefault - property
 
984
    @dbus_service_property(_interface, signature="b",
 
985
                           access="readwrite")
 
986
    def ApprovedByDefault_dbus_property(self, value=None):
 
987
        if value is None:       # get
 
988
            return dbus.Boolean(self.approved_by_default)
 
989
        self.approved_by_default = bool(value)
 
990
    
 
991
    # ApprovalDelay - property
 
992
    @dbus_service_property(_interface, signature="t",
 
993
                           access="readwrite")
 
994
    def ApprovalDelay_dbus_property(self, value=None):
 
995
        if value is None:       # get
 
996
            return dbus.UInt64(self.approval_delay_milliseconds())
 
997
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
998
    
 
999
    # ApprovalDuration - property
 
1000
    @dbus_service_property(_interface, signature="t",
 
1001
                           access="readwrite")
 
1002
    def ApprovalDuration_dbus_property(self, value=None):
 
1003
        if value is None:       # get
 
1004
            return dbus.UInt64(_timedelta_to_milliseconds(
 
1005
                    self.approval_duration))
 
1006
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
1007
    
 
1008
    # Name - property
 
1009
    @dbus_service_property(_interface, signature="s", access="read")
 
1010
    def Name_dbus_property(self):
 
1011
        return dbus.String(self.name)
 
1012
    
 
1013
    # Fingerprint - property
 
1014
    @dbus_service_property(_interface, signature="s", access="read")
 
1015
    def Fingerprint_dbus_property(self):
 
1016
        return dbus.String(self.fingerprint)
 
1017
    
 
1018
    # Host - property
 
1019
    @dbus_service_property(_interface, signature="s",
 
1020
                           access="readwrite")
 
1021
    def Host_dbus_property(self, value=None):
 
1022
        if value is None:       # get
 
1023
            return dbus.String(self.host)
 
1024
        self.host = value
 
1025
    
 
1026
    # Created - property
 
1027
    @dbus_service_property(_interface, signature="s", access="read")
 
1028
    def Created_dbus_property(self):
 
1029
        return dbus.String(datetime_to_dbus(self.created))
 
1030
    
 
1031
    # LastEnabled - property
 
1032
    @dbus_service_property(_interface, signature="s", access="read")
 
1033
    def LastEnabled_dbus_property(self):
 
1034
        return datetime_to_dbus(self.last_enabled)
 
1035
    
 
1036
    # Enabled - property
 
1037
    @dbus_service_property(_interface, signature="b",
 
1038
                           access="readwrite")
 
1039
    def Enabled_dbus_property(self, value=None):
 
1040
        if value is None:       # get
 
1041
            return dbus.Boolean(self.enabled)
 
1042
        if value:
 
1043
            self.enable()
 
1044
        else:
 
1045
            self.disable()
 
1046
    
 
1047
    # LastCheckedOK - property
 
1048
    @dbus_service_property(_interface, signature="s",
 
1049
                           access="readwrite")
 
1050
    def LastCheckedOK_dbus_property(self, value=None):
 
1051
        if value is not None:
 
1052
            self.checked_ok()
 
1053
            return
 
1054
        return datetime_to_dbus(self.last_checked_ok)
 
1055
    
 
1056
    # Expires - property
 
1057
    @dbus_service_property(_interface, signature="s", access="read")
 
1058
    def Expires_dbus_property(self):
 
1059
        return datetime_to_dbus(self.expires)
 
1060
    
 
1061
    # LastApprovalRequest - property
 
1062
    @dbus_service_property(_interface, signature="s", access="read")
 
1063
    def LastApprovalRequest_dbus_property(self):
 
1064
        return datetime_to_dbus(self.last_approval_request)
 
1065
    
 
1066
    # Timeout - property
 
1067
    @dbus_service_property(_interface, signature="t",
 
1068
                           access="readwrite")
 
1069
    def Timeout_dbus_property(self, value=None):
 
1070
        if value is None:       # get
 
1071
            return dbus.UInt64(self.timeout_milliseconds())
 
1072
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
1073
        if getattr(self, "disable_initiator_tag", None) is None:
 
1074
            return
 
1075
        # Reschedule timeout
 
1076
        gobject.source_remove(self.disable_initiator_tag)
 
1077
        self.disable_initiator_tag = None
 
1078
        self.expires = None
 
1079
        time_to_die = (self.
 
1080
                       _timedelta_to_milliseconds((self
 
1081
                                                   .last_checked_ok
 
1082
                                                   + self.timeout)
 
1083
                                                  - datetime.datetime
 
1084
                                                  .utcnow()))
 
1085
        if time_to_die <= 0:
 
1086
            # The timeout has passed
 
1087
            self.disable()
 
1088
        else:
 
1089
            self.expires = (datetime.datetime.utcnow()
 
1090
                            + datetime.timedelta(milliseconds = time_to_die))
 
1091
            self.disable_initiator_tag = (gobject.timeout_add
 
1092
                                          (time_to_die, self.disable))
 
1093
 
 
1094
    # ExtendedTimeout - property
 
1095
    @dbus_service_property(_interface, signature="t",
 
1096
                           access="readwrite")
 
1097
    def ExtendedTimeout_dbus_property(self, value=None):
 
1098
        if value is None:       # get
 
1099
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1100
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
 
1101
 
 
1102
    # Interval - property
 
1103
    @dbus_service_property(_interface, signature="t",
 
1104
                           access="readwrite")
 
1105
    def Interval_dbus_property(self, value=None):
 
1106
        if value is None:       # get
 
1107
            return dbus.UInt64(self.interval_milliseconds())
 
1108
        self.interval = datetime.timedelta(0, 0, 0, value)
 
1109
        if getattr(self, "checker_initiator_tag", None) is None:
 
1110
            return
 
1111
        # Reschedule checker run
 
1112
        gobject.source_remove(self.checker_initiator_tag)
 
1113
        self.checker_initiator_tag = (gobject.timeout_add
 
1114
                                      (value, self.start_checker))
 
1115
        self.start_checker()    # Start one now, too
 
1116
 
 
1117
    # Checker - property
 
1118
    @dbus_service_property(_interface, signature="s",
 
1119
                           access="readwrite")
 
1120
    def Checker_dbus_property(self, value=None):
 
1121
        if value is None:       # get
 
1122
            return dbus.String(self.checker_command)
 
1123
        self.checker_command = value
 
1124
    
 
1125
    # CheckerRunning - property
 
1126
    @dbus_service_property(_interface, signature="b",
 
1127
                           access="readwrite")
 
1128
    def CheckerRunning_dbus_property(self, value=None):
 
1129
        if value is None:       # get
 
1130
            return dbus.Boolean(self.checker is not None)
 
1131
        if value:
 
1132
            self.start_checker()
 
1133
        else:
 
1134
            self.stop_checker()
 
1135
    
 
1136
    # ObjectPath - property
 
1137
    @dbus_service_property(_interface, signature="o", access="read")
 
1138
    def ObjectPath_dbus_property(self):
 
1139
        return self.dbus_object_path # is already a dbus.ObjectPath
 
1140
    
 
1141
    # Secret = property
 
1142
    @dbus_service_property(_interface, signature="ay",
 
1143
                           access="write", byte_arrays=True)
 
1144
    def Secret_dbus_property(self, value):
 
1145
        self.secret = str(value)
 
1146
    
 
1147
    del _interface
 
1148
 
 
1149
 
 
1150
class ProxyClient(object):
 
1151
    def __init__(self, child_pipe, fpr, address):
 
1152
        self._pipe = child_pipe
 
1153
        self._pipe.send(('init', fpr, address))
 
1154
        if not self._pipe.recv():
 
1155
            raise KeyError()
 
1156
 
 
1157
    def __getattribute__(self, name):
 
1158
        if(name == '_pipe'):
 
1159
            return super(ProxyClient, self).__getattribute__(name)
 
1160
        self._pipe.send(('getattr', name))
 
1161
        data = self._pipe.recv()
 
1162
        if data[0] == 'data':
 
1163
            return data[1]
 
1164
        if data[0] == 'function':
 
1165
            def func(*args, **kwargs):
 
1166
                self._pipe.send(('funcall', name, args, kwargs))
 
1167
                return self._pipe.recv()[1]
 
1168
            return func
 
1169
 
 
1170
    def __setattr__(self, name, value):
 
1171
        if(name == '_pipe'):
 
1172
            return super(ProxyClient, self).__setattr__(name, value)
 
1173
        self._pipe.send(('setattr', name, value))
 
1174
 
 
1175
 
 
1176
class ClientHandler(socketserver.BaseRequestHandler, object):
 
1177
    """A class to handle client connections.
 
1178
    
 
1179
    Instantiated once for each connection to handle it.
 
1180
    Note: This will run in its own forked process."""
 
1181
    
 
1182
    def handle(self):
 
1183
        with contextlib.closing(self.server.child_pipe) as child_pipe:
 
1184
            logger.info("TCP connection from: %s",
 
1185
                        unicode(self.client_address))
 
1186
            logger.debug("Pipe FD: %d",
 
1187
                         self.server.child_pipe.fileno())
 
1188
 
 
1189
            session = (gnutls.connection
 
1190
                       .ClientSession(self.request,
 
1191
                                      gnutls.connection
 
1192
                                      .X509Credentials()))
 
1193
 
 
1194
            # Note: gnutls.connection.X509Credentials is really a
 
1195
            # generic GnuTLS certificate credentials object so long as
 
1196
            # no X.509 keys are added to it.  Therefore, we can use it
 
1197
            # here despite using OpenPGP certificates.
 
1198
 
 
1199
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
1200
            #                      "+AES-256-CBC", "+SHA1",
 
1201
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
 
1202
            #                      "+DHE-DSS"))
 
1203
            # Use a fallback default, since this MUST be set.
 
1204
            priority = self.server.gnutls_priority
 
1205
            if priority is None:
 
1206
                priority = "NORMAL"
 
1207
            (gnutls.library.functions
 
1208
             .gnutls_priority_set_direct(session._c_object,
 
1209
                                         priority, None))
 
1210
 
 
1211
            # Start communication using the Mandos protocol
 
1212
            # Get protocol number
 
1213
            line = self.request.makefile().readline()
 
1214
            logger.debug("Protocol version: %r", line)
 
1215
            try:
 
1216
                if int(line.strip().split()[0]) > 1:
 
1217
                    raise RuntimeError
 
1218
            except (ValueError, IndexError, RuntimeError) as error:
 
1219
                logger.error("Unknown protocol version: %s", error)
 
1220
                return
 
1221
 
 
1222
            # Start GnuTLS connection
 
1223
            try:
 
1224
                session.handshake()
 
1225
            except gnutls.errors.GNUTLSError as error:
 
1226
                logger.warning("Handshake failed: %s", error)
 
1227
                # Do not run session.bye() here: the session is not
 
1228
                # established.  Just abandon the request.
 
1229
                return
 
1230
            logger.debug("Handshake succeeded")
 
1231
 
 
1232
            approval_required = False
 
1233
            try:
 
1234
                try:
 
1235
                    fpr = self.fingerprint(self.peer_certificate
 
1236
                                           (session))
 
1237
                except (TypeError,
 
1238
                        gnutls.errors.GNUTLSError) as error:
 
1239
                    logger.warning("Bad certificate: %s", error)
 
1240
                    return
 
1241
                logger.debug("Fingerprint: %s", fpr)
 
1242
 
 
1243
                try:
 
1244
                    client = ProxyClient(child_pipe, fpr,
 
1245
                                         self.client_address)
 
1246
                except KeyError:
 
1247
                    return
 
1248
                
 
1249
                if client.approval_delay:
 
1250
                    delay = client.approval_delay
 
1251
                    client.approvals_pending += 1
 
1252
                    approval_required = True
 
1253
                
 
1254
                while True:
 
1255
                    if not client.enabled:
 
1256
                        logger.info("Client %s is disabled",
 
1257
                                       client.name)
 
1258
                        if self.server.use_dbus:
 
1259
                            # Emit D-Bus signal
 
1260
                            client.Rejected("Disabled")                    
 
1261
                        return
 
1262
                    
 
1263
                    if client._approved or not client.approval_delay:
 
1264
                        #We are approved or approval is disabled
 
1265
                        break
 
1266
                    elif client._approved is None:
 
1267
                        logger.info("Client %s needs approval",
 
1268
                                    client.name)
 
1269
                        if self.server.use_dbus:
 
1270
                            # Emit D-Bus signal
 
1271
                            client.NeedApproval(
 
1272
                                client.approval_delay_milliseconds(),
 
1273
                                client.approved_by_default)
 
1274
                    else:
 
1275
                        logger.warning("Client %s was not approved",
 
1276
                                       client.name)
 
1277
                        if self.server.use_dbus:
 
1278
                            # Emit D-Bus signal
 
1279
                            client.Rejected("Denied")
 
1280
                        return
 
1281
                    
 
1282
                    #wait until timeout or approved
 
1283
                    #x = float(client._timedelta_to_milliseconds(delay))
 
1284
                    time = datetime.datetime.now()
 
1285
                    client.changedstate.acquire()
 
1286
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1287
                    client.changedstate.release()
 
1288
                    time2 = datetime.datetime.now()
 
1289
                    if (time2 - time) >= delay:
 
1290
                        if not client.approved_by_default:
 
1291
                            logger.warning("Client %s timed out while"
 
1292
                                           " waiting for approval",
 
1293
                                           client.name)
 
1294
                            if self.server.use_dbus:
 
1295
                                # Emit D-Bus signal
 
1296
                                client.Rejected("Approval timed out")
 
1297
                            return
 
1298
                        else:
 
1299
                            break
 
1300
                    else:
 
1301
                        delay -= time2 - time
 
1302
                
 
1303
                sent_size = 0
 
1304
                while sent_size < len(client.secret):
 
1305
                    try:
 
1306
                        sent = session.send(client.secret[sent_size:])
 
1307
                    except gnutls.errors.GNUTLSError as error:
 
1308
                        logger.warning("gnutls send failed")
 
1309
                        return
 
1310
                    logger.debug("Sent: %d, remaining: %d",
 
1311
                                 sent, len(client.secret)
 
1312
                                 - (sent_size + sent))
 
1313
                    sent_size += sent
 
1314
 
 
1315
                logger.info("Sending secret to %s", client.name)
 
1316
                # bump the timeout as if seen
 
1317
                client.checked_ok(client.extended_timeout)
 
1318
                if self.server.use_dbus:
 
1319
                    # Emit D-Bus signal
 
1320
                    client.GotSecret()
 
1321
            
 
1322
            finally:
 
1323
                if approval_required:
 
1324
                    client.approvals_pending -= 1
 
1325
                try:
 
1326
                    session.bye()
 
1327
                except gnutls.errors.GNUTLSError as error:
 
1328
                    logger.warning("GnuTLS bye failed")
 
1329
    
 
1330
    @staticmethod
 
1331
    def peer_certificate(session):
 
1332
        "Return the peer's OpenPGP certificate as a bytestring"
 
1333
        # If not an OpenPGP certificate...
 
1334
        if (gnutls.library.functions
 
1335
            .gnutls_certificate_type_get(session._c_object)
 
1336
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
1337
            # ...do the normal thing
 
1338
            return session.peer_certificate
 
1339
        list_size = ctypes.c_uint(1)
 
1340
        cert_list = (gnutls.library.functions
 
1341
                     .gnutls_certificate_get_peers
 
1342
                     (session._c_object, ctypes.byref(list_size)))
 
1343
        if not bool(cert_list) and list_size.value != 0:
 
1344
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1345
                                            " certificate")
 
1346
        if list_size.value == 0:
 
1347
            return None
 
1348
        cert = cert_list[0]
 
1349
        return ctypes.string_at(cert.data, cert.size)
 
1350
    
 
1351
    @staticmethod
 
1352
    def fingerprint(openpgp):
 
1353
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
 
1354
        # New GnuTLS "datum" with the OpenPGP public key
 
1355
        datum = (gnutls.library.types
 
1356
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1357
                                             ctypes.POINTER
 
1358
                                             (ctypes.c_ubyte)),
 
1359
                                 ctypes.c_uint(len(openpgp))))
 
1360
        # New empty GnuTLS certificate
 
1361
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
1362
        (gnutls.library.functions
 
1363
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
1364
        # Import the OpenPGP public key into the certificate
 
1365
        (gnutls.library.functions
 
1366
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1367
                                    gnutls.library.constants
 
1368
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
1369
        # Verify the self signature in the key
 
1370
        crtverify = ctypes.c_uint()
 
1371
        (gnutls.library.functions
 
1372
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1373
                                         ctypes.byref(crtverify)))
 
1374
        if crtverify.value != 0:
 
1375
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1376
            raise (gnutls.errors.CertificateSecurityError
 
1377
                   ("Verify failed"))
 
1378
        # New buffer for the fingerprint
 
1379
        buf = ctypes.create_string_buffer(20)
 
1380
        buf_len = ctypes.c_size_t()
 
1381
        # Get the fingerprint from the certificate into the buffer
 
1382
        (gnutls.library.functions
 
1383
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1384
                                             ctypes.byref(buf_len)))
 
1385
        # Deinit the certificate
 
1386
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1387
        # Convert the buffer to a Python bytestring
 
1388
        fpr = ctypes.string_at(buf, buf_len.value)
 
1389
        # Convert the bytestring to hexadecimal notation
 
1390
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
1391
        return hex_fpr
 
1392
 
 
1393
 
 
1394
class MultiprocessingMixIn(object):
 
1395
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1396
    def sub_process_main(self, request, address):
 
1397
        try:
 
1398
            self.finish_request(request, address)
 
1399
        except:
 
1400
            self.handle_error(request, address)
 
1401
        self.close_request(request)
 
1402
            
 
1403
    def process_request(self, request, address):
 
1404
        """Start a new process to process the request."""
 
1405
        multiprocessing.Process(target = self.sub_process_main,
 
1406
                                args = (request, address)).start()
 
1407
 
 
1408
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
1409
    """ adds a pipe to the MixIn """
 
1410
    def process_request(self, request, client_address):
 
1411
        """Overrides and wraps the original process_request().
 
1412
        
 
1413
        This function creates a new pipe in self.pipe
 
1414
        """
 
1415
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
 
1416
 
 
1417
        super(MultiprocessingMixInWithPipe,
 
1418
              self).process_request(request, client_address)
 
1419
        self.child_pipe.close()
 
1420
        self.add_pipe(parent_pipe)
 
1421
 
 
1422
    def add_pipe(self, parent_pipe):
 
1423
        """Dummy function; override as necessary"""
 
1424
        raise NotImplementedError
 
1425
 
 
1426
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
 
1427
                     socketserver.TCPServer, object):
 
1428
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
1429
    
 
1430
    Attributes:
 
1431
        enabled:        Boolean; whether this server is activated yet
 
1432
        interface:      None or a network interface name (string)
 
1433
        use_ipv6:       Boolean; to use IPv6 or not
 
1434
    """
 
1435
    def __init__(self, server_address, RequestHandlerClass,
 
1436
                 interface=None, use_ipv6=True):
 
1437
        self.interface = interface
 
1438
        if use_ipv6:
 
1439
            self.address_family = socket.AF_INET6
 
1440
        socketserver.TCPServer.__init__(self, server_address,
 
1441
                                        RequestHandlerClass)
 
1442
    def server_bind(self):
 
1443
        """This overrides the normal server_bind() function
 
1444
        to bind to an interface if one was specified, and also NOT to
 
1445
        bind to an address or port if they were not specified."""
 
1446
        if self.interface is not None:
 
1447
            if SO_BINDTODEVICE is None:
 
1448
                logger.error("SO_BINDTODEVICE does not exist;"
 
1449
                             " cannot bind to interface %s",
 
1450
                             self.interface)
 
1451
            else:
52
1452
                try:
53
1453
                    self.socket.setsockopt(socket.SOL_SOCKET,
54
 
                                           socket.SO_BINDTODEVICE,
55
 
                                           self.options.interface)
56
 
                except socket.error, error:
 
1454
                                           SO_BINDTODEVICE,
 
1455
                                           str(self.interface
 
1456
                                               + '\0'))
 
1457
                except socket.error as error:
57
1458
                    if error[0] == errno.EPERM:
58
 
                        print "Warning: No permission to bind to interface", \
59
 
                              self.options.interface
 
1459
                        logger.error("No permission to"
 
1460
                                     " bind to interface %s",
 
1461
                                     self.interface)
 
1462
                    elif error[0] == errno.ENOPROTOOPT:
 
1463
                        logger.error("SO_BINDTODEVICE not available;"
 
1464
                                     " cannot bind to interface %s",
 
1465
                                     self.interface)
60
1466
                    else:
61
 
                        raise error
62
 
            return super(type(self), self).server_bind()
63
 
        attrs["server_bind"] = server_bind
64
 
        def init(self, *args, **kwargs):
65
 
            if "options" in kwargs:
66
 
                self.options = kwargs["options"]
67
 
                del kwargs["options"]
68
 
            if "clients" in kwargs:
69
 
                self.clients = kwargs["clients"]
70
 
                del kwargs["clients"]
71
 
            if "credentials" in kwargs:
72
 
                self.credentials = kwargs["credentials"]
73
 
                del kwargs["credentials"]
74
 
            return super(type(self), self).__init__(*args, **kwargs)
75
 
        attrs["__init__"] = init
76
 
        return type.__new__(cls, name, bases, attrs)
77
 
 
78
 
 
79
 
class udp_handler(SocketServer.DatagramRequestHandler, object):
80
 
    def handle(self):
81
 
        self.wfile.write("Polo")
82
 
        print "UDP request answered"
83
 
 
84
 
 
85
 
class IPv6_UDPServer(SocketServer.UDPServer, object):
86
 
    __metaclass__ = server_metaclass
87
 
    def verify_request(self, request, client_address):
88
 
        print "UDP request came"
89
 
        return request[0] == "Marco"
90
 
 
91
 
 
92
 
class tcp_handler(SocketServer.BaseRequestHandler, object):
93
 
    def handle(self):
94
 
        print "TCP request came"
95
 
        print "Request:", self.request
96
 
        print "Client Address:", self.client_address
97
 
        print "Server:", self.server
98
 
        session = gnutls.connection.ServerSession(self.request,
99
 
                                                  self.server.credentials)
100
 
        session.handshake()
101
 
        if session.peer_certificate:
102
 
            print "DN:", session.peer_certificate.subject
103
 
        try:
104
 
            session.verify_peer()
105
 
        except gnutls.errors.CertificateError, error:
106
 
            print "Verify failed", error
107
 
            session.bye()
108
 
            return
109
 
        try:
110
 
            session.send(dict((client.dn, client.password)
111
 
                              for client in self.server.clients)
112
 
                         [session.peer_certificate.subject])
113
 
        except KeyError:
114
 
            session.send("gazonk")
115
 
            # Log maybe? XXX
116
 
        session.bye()
117
 
 
118
 
 
119
 
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
120
 
    __metaclass__ = server_metaclass
121
 
    request_queue_size = 1024
122
 
 
123
 
 
124
 
in6addr_any = "::"
125
 
 
126
 
cred = None
 
1467
                        raise
 
1468
        # Only bind(2) the socket if we really need to.
 
1469
        if self.server_address[0] or self.server_address[1]:
 
1470
            if not self.server_address[0]:
 
1471
                if self.address_family == socket.AF_INET6:
 
1472
                    any_address = "::" # in6addr_any
 
1473
                else:
 
1474
                    any_address = socket.INADDR_ANY
 
1475
                self.server_address = (any_address,
 
1476
                                       self.server_address[1])
 
1477
            elif not self.server_address[1]:
 
1478
                self.server_address = (self.server_address[0],
 
1479
                                       0)
 
1480
#                 if self.interface:
 
1481
#                     self.server_address = (self.server_address[0],
 
1482
#                                            0, # port
 
1483
#                                            0, # flowinfo
 
1484
#                                            if_nametoindex
 
1485
#                                            (self.interface))
 
1486
            return socketserver.TCPServer.server_bind(self)
 
1487
 
 
1488
 
 
1489
class MandosServer(IPv6_TCPServer):
 
1490
    """Mandos server.
 
1491
    
 
1492
    Attributes:
 
1493
        clients:        set of Client objects
 
1494
        gnutls_priority GnuTLS priority string
 
1495
        use_dbus:       Boolean; to emit D-Bus signals or not
 
1496
    
 
1497
    Assumes a gobject.MainLoop event loop.
 
1498
    """
 
1499
    def __init__(self, server_address, RequestHandlerClass,
 
1500
                 interface=None, use_ipv6=True, clients=None,
 
1501
                 gnutls_priority=None, use_dbus=True):
 
1502
        self.enabled = False
 
1503
        self.clients = clients
 
1504
        if self.clients is None:
 
1505
            self.clients = set()
 
1506
        self.use_dbus = use_dbus
 
1507
        self.gnutls_priority = gnutls_priority
 
1508
        IPv6_TCPServer.__init__(self, server_address,
 
1509
                                RequestHandlerClass,
 
1510
                                interface = interface,
 
1511
                                use_ipv6 = use_ipv6)
 
1512
    def server_activate(self):
 
1513
        if self.enabled:
 
1514
            return socketserver.TCPServer.server_activate(self)
 
1515
    def enable(self):
 
1516
        self.enabled = True
 
1517
    def add_pipe(self, parent_pipe):
 
1518
        # Call "handle_ipc" for both data and EOF events
 
1519
        gobject.io_add_watch(parent_pipe.fileno(),
 
1520
                             gobject.IO_IN | gobject.IO_HUP,
 
1521
                             functools.partial(self.handle_ipc,
 
1522
                                               parent_pipe = parent_pipe))
 
1523
        
 
1524
    def handle_ipc(self, source, condition, parent_pipe=None,
 
1525
                   client_object=None):
 
1526
        condition_names = {
 
1527
            gobject.IO_IN: "IN",   # There is data to read.
 
1528
            gobject.IO_OUT: "OUT", # Data can be written (without
 
1529
                                    # blocking).
 
1530
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
1531
            gobject.IO_ERR: "ERR", # Error condition.
 
1532
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
 
1533
                                    # broken, usually for pipes and
 
1534
                                    # sockets).
 
1535
            }
 
1536
        conditions_string = ' | '.join(name
 
1537
                                       for cond, name in
 
1538
                                       condition_names.iteritems()
 
1539
                                       if cond & condition)
 
1540
        # error or the other end of multiprocessing.Pipe has closed
 
1541
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1542
            return False
 
1543
        
 
1544
        # Read a request from the child
 
1545
        request = parent_pipe.recv()
 
1546
        command = request[0]
 
1547
        
 
1548
        if command == 'init':
 
1549
            fpr = request[1]
 
1550
            address = request[2]
 
1551
            
 
1552
            for c in self.clients:
 
1553
                if c.fingerprint == fpr:
 
1554
                    client = c
 
1555
                    break
 
1556
            else:
 
1557
                logger.info("Client not found for fingerprint: %s, ad"
 
1558
                            "dress: %s", fpr, address)
 
1559
                if self.use_dbus:
 
1560
                    # Emit D-Bus signal
 
1561
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
 
1562
                parent_pipe.send(False)
 
1563
                return False
 
1564
            
 
1565
            gobject.io_add_watch(parent_pipe.fileno(),
 
1566
                                 gobject.IO_IN | gobject.IO_HUP,
 
1567
                                 functools.partial(self.handle_ipc,
 
1568
                                                   parent_pipe = parent_pipe,
 
1569
                                                   client_object = client))
 
1570
            parent_pipe.send(True)
 
1571
            # remove the old hook in favor of the new above hook on same fileno
 
1572
            return False
 
1573
        if command == 'funcall':
 
1574
            funcname = request[1]
 
1575
            args = request[2]
 
1576
            kwargs = request[3]
 
1577
            
 
1578
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
1579
 
 
1580
        if command == 'getattr':
 
1581
            attrname = request[1]
 
1582
            if callable(client_object.__getattribute__(attrname)):
 
1583
                parent_pipe.send(('function',))
 
1584
            else:
 
1585
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
1586
        
 
1587
        if command == 'setattr':
 
1588
            attrname = request[1]
 
1589
            value = request[2]
 
1590
            setattr(client_object, attrname, value)
 
1591
 
 
1592
        return True
 
1593
 
127
1594
 
128
1595
def string_to_delta(interval):
129
1596
    """Parse a string and return a datetime.timedelta
130
 
 
 
1597
    
131
1598
    >>> string_to_delta('7d')
132
1599
    datetime.timedelta(7)
133
1600
    >>> string_to_delta('60s')
136
1603
    datetime.timedelta(0, 3600)
137
1604
    >>> string_to_delta('24h')
138
1605
    datetime.timedelta(1)
139
 
    >>> string_to_delta(u'1w')
 
1606
    >>> string_to_delta('1w')
140
1607
    datetime.timedelta(7)
 
1608
    >>> string_to_delta('5m 30s')
 
1609
    datetime.timedelta(0, 330)
141
1610
    """
 
1611
    timevalue = datetime.timedelta(0)
 
1612
    for s in interval.split():
 
1613
        try:
 
1614
            suffix = unicode(s[-1])
 
1615
            value = int(s[:-1])
 
1616
            if suffix == "d":
 
1617
                delta = datetime.timedelta(value)
 
1618
            elif suffix == "s":
 
1619
                delta = datetime.timedelta(0, value)
 
1620
            elif suffix == "m":
 
1621
                delta = datetime.timedelta(0, 0, 0, 0, value)
 
1622
            elif suffix == "h":
 
1623
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
 
1624
            elif suffix == "w":
 
1625
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
 
1626
            else:
 
1627
                raise ValueError("Unknown suffix %r" % suffix)
 
1628
        except (ValueError, IndexError) as e:
 
1629
            raise ValueError(*(e.args))
 
1630
        timevalue += delta
 
1631
    return timevalue
 
1632
 
 
1633
 
 
1634
def if_nametoindex(interface):
 
1635
    """Call the C function if_nametoindex(), or equivalent
 
1636
    
 
1637
    Note: This function cannot accept a unicode string."""
 
1638
    global if_nametoindex
142
1639
    try:
143
 
        suffix=unicode(interval[-1])
144
 
        value=int(interval[:-1])
145
 
        if suffix == u"d":
146
 
            delta = datetime.timedelta(value)
147
 
        elif suffix == u"s":
148
 
            delta = datetime.timedelta(0, value)
149
 
        elif suffix == u"m":
150
 
            delta = datetime.timedelta(0, 0, 0, 0, value)
151
 
        elif suffix == u"h":
152
 
            delta = datetime.timedelta(0, 0, 0, 0, 0, value)
153
 
        elif suffix == u"w":
154
 
            delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
155
 
        else:
156
 
            raise ValueError
157
 
    except (ValueError, IndexError):
158
 
        raise ValueError
159
 
    return delta
 
1640
        if_nametoindex = (ctypes.cdll.LoadLibrary
 
1641
                          (ctypes.util.find_library("c"))
 
1642
                          .if_nametoindex)
 
1643
    except (OSError, AttributeError):
 
1644
        logger.warning("Doing if_nametoindex the hard way")
 
1645
        def if_nametoindex(interface):
 
1646
            "Get an interface index the hard way, i.e. using fcntl()"
 
1647
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
1648
            with contextlib.closing(socket.socket()) as s:
 
1649
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
1650
                                    struct.pack(str("16s16x"),
 
1651
                                                interface))
 
1652
            interface_index = struct.unpack(str("I"),
 
1653
                                            ifreq[16:20])[0]
 
1654
            return interface_index
 
1655
    return if_nametoindex(interface)
 
1656
 
 
1657
 
 
1658
def daemon(nochdir = False, noclose = False):
 
1659
    """See daemon(3).  Standard BSD Unix function.
 
1660
    
 
1661
    This should really exist as os.daemon, but it doesn't (yet)."""
 
1662
    if os.fork():
 
1663
        sys.exit()
 
1664
    os.setsid()
 
1665
    if not nochdir:
 
1666
        os.chdir("/")
 
1667
    if os.fork():
 
1668
        sys.exit()
 
1669
    if not noclose:
 
1670
        # Close all standard open file descriptors
 
1671
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1672
        if not stat.S_ISCHR(os.fstat(null).st_mode):
 
1673
            raise OSError(errno.ENODEV,
 
1674
                          "%s not a character device"
 
1675
                          % os.path.devnull)
 
1676
        os.dup2(null, sys.stdin.fileno())
 
1677
        os.dup2(null, sys.stdout.fileno())
 
1678
        os.dup2(null, sys.stderr.fileno())
 
1679
        if null > 2:
 
1680
            os.close(null)
 
1681
 
160
1682
 
161
1683
def main():
162
 
    parser = OptionParser()
163
 
    parser.add_option("-i", "--interface", type="string",
164
 
                      default="eth0", metavar="IF",
165
 
                      help="Interface to bind to")
166
 
    parser.add_option("--cert", type="string", default="cert.pem",
167
 
                      metavar="FILE",
168
 
                      help="Public key certificate to use")
169
 
    parser.add_option("--key", type="string", default="key.pem",
170
 
                      metavar="FILE",
171
 
                      help="Private key to use")
172
 
    parser.add_option("--ca", type="string", default="ca.pem",
173
 
                      metavar="FILE",
174
 
                      help="Certificate Authority certificate to use")
175
 
    parser.add_option("--crl", type="string", default="crl.pem",
176
 
                      metavar="FILE",
177
 
                      help="Certificate Revokation List to use")
178
 
    parser.add_option("-p", "--port", type="int", default=49001,
179
 
                      help="Port number to receive requests on")
180
 
    parser.add_option("--dh", type="int", metavar="BITS",
181
 
                      help="DH group to use")
182
 
    parser.add_option("-t", "--timeout", type="string", # Parsed later
183
 
                      default="15m",
184
 
                      help="Amount of downtime allowed for clients")
185
 
    parser.add_option("--interval", type="string", # Parsed later
186
 
                      default="5m",
187
 
                      help="How often to check that a client is up")
188
 
    parser.add_option("--check", action="store_true", default=False,
189
 
                      help="Run self-test")
190
 
    (options, args) = parser.parse_args()
191
 
 
 
1684
    
 
1685
    ##################################################################
 
1686
    # Parsing of options, both command line and config file
 
1687
    
 
1688
    parser = argparse.ArgumentParser()
 
1689
    parser.add_argument("-v", "--version", action="version",
 
1690
                        version = "%%(prog)s %s" % version,
 
1691
                        help="show version number and exit")
 
1692
    parser.add_argument("-i", "--interface", metavar="IF",
 
1693
                        help="Bind to interface IF")
 
1694
    parser.add_argument("-a", "--address",
 
1695
                        help="Address to listen for requests on")
 
1696
    parser.add_argument("-p", "--port", type=int,
 
1697
                        help="Port number to receive requests on")
 
1698
    parser.add_argument("--check", action="store_true",
 
1699
                        help="Run self-test")
 
1700
    parser.add_argument("--debug", action="store_true",
 
1701
                        help="Debug mode; run in foreground and log"
 
1702
                        " to terminal")
 
1703
    parser.add_argument("--debuglevel", metavar="LEVEL",
 
1704
                        help="Debug level for stdout output")
 
1705
    parser.add_argument("--priority", help="GnuTLS"
 
1706
                        " priority string (see GnuTLS documentation)")
 
1707
    parser.add_argument("--servicename",
 
1708
                        metavar="NAME", help="Zeroconf service name")
 
1709
    parser.add_argument("--configdir",
 
1710
                        default="/etc/mandos", metavar="DIR",
 
1711
                        help="Directory to search for configuration"
 
1712
                        " files")
 
1713
    parser.add_argument("--no-dbus", action="store_false",
 
1714
                        dest="use_dbus", help="Do not provide D-Bus"
 
1715
                        " system bus interface")
 
1716
    parser.add_argument("--no-ipv6", action="store_false",
 
1717
                        dest="use_ipv6", help="Do not use IPv6")
 
1718
    options = parser.parse_args()
 
1719
    
192
1720
    if options.check:
193
1721
        import doctest
194
1722
        doctest.testmod()
195
1723
        sys.exit()
196
1724
    
197
 
    # Parse the time arguments
198
 
    try:
199
 
        options.timeout = string_to_delta(options.timeout)
200
 
    except ValueError:
201
 
        parser.error("option --timeout: Unparseable time")
202
 
    
203
 
    try:
204
 
        options.interval = string_to_delta(options.interval)
205
 
    except ValueError:
206
 
        parser.error("option --interval: Unparseable time")
207
 
    
208
 
    cert = gnutls.crypto.X509Certificate(open(options.cert).read())
209
 
    key = gnutls.crypto.X509PrivateKey(open(options.key).read())
210
 
    ca = gnutls.crypto.X509Certificate(open(options.ca).read())
211
 
    crl = gnutls.crypto.X509CRL(open(options.crl).read())
212
 
    cred = gnutls.connection.X509Credentials(cert, key, [ca], [crl])
213
 
    
214
 
    # Parse config file
215
 
    defaults = {}
216
 
    client_config_object = ConfigParser.SafeConfigParser(defaults)
217
 
    client_config_object.read("mandos-clients.conf")
218
 
    clients = [Client(name=section, options=options,
219
 
                      **(dict(client_config_object.items(section))))
220
 
               for section in client_config_object.sections()]
221
 
    
222
 
    udp_server = IPv6_UDPServer((in6addr_any, options.port),
223
 
                                udp_handler,
224
 
                                options=options)
225
 
    
226
 
    tcp_server = IPv6_TCPServer((in6addr_any, options.port),
227
 
                                tcp_handler,
228
 
                                options=options,
229
 
                                clients=clients,
230
 
                                credentials=cred)
231
 
    
232
 
    while True:
233
 
        in_, out, err = select.select((udp_server,
234
 
                                       tcp_server), (), ())
235
 
        for server in in_:
236
 
            server.handle_request()
237
 
 
238
 
 
239
 
if __name__ == "__main__":
 
1725
    # Default values for config file for server-global settings
 
1726
    server_defaults = { "interface": "",
 
1727
                        "address": "",
 
1728
                        "port": "",
 
1729
                        "debug": "False",
 
1730
                        "priority":
 
1731
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
1732
                        "servicename": "Mandos",
 
1733
                        "use_dbus": "True",
 
1734
                        "use_ipv6": "True",
 
1735
                        "debuglevel": "",
 
1736
                        }
 
1737
    
 
1738
    # Parse config file for server-global settings
 
1739
    server_config = configparser.SafeConfigParser(server_defaults)
 
1740
    del server_defaults
 
1741
    server_config.read(os.path.join(options.configdir,
 
1742
                                    "mandos.conf"))
 
1743
    # Convert the SafeConfigParser object to a dict
 
1744
    server_settings = server_config.defaults()
 
1745
    # Use the appropriate methods on the non-string config options
 
1746
    for option in ("debug", "use_dbus", "use_ipv6"):
 
1747
        server_settings[option] = server_config.getboolean("DEFAULT",
 
1748
                                                           option)
 
1749
    if server_settings["port"]:
 
1750
        server_settings["port"] = server_config.getint("DEFAULT",
 
1751
                                                       "port")
 
1752
    del server_config
 
1753
    
 
1754
    # Override the settings from the config file with command line
 
1755
    # options, if set.
 
1756
    for option in ("interface", "address", "port", "debug",
 
1757
                   "priority", "servicename", "configdir",
 
1758
                   "use_dbus", "use_ipv6", "debuglevel"):
 
1759
        value = getattr(options, option)
 
1760
        if value is not None:
 
1761
            server_settings[option] = value
 
1762
    del options
 
1763
    # Force all strings to be unicode
 
1764
    for option in server_settings.keys():
 
1765
        if type(server_settings[option]) is str:
 
1766
            server_settings[option] = unicode(server_settings[option])
 
1767
    # Now we have our good server settings in "server_settings"
 
1768
    
 
1769
    ##################################################################
 
1770
    
 
1771
    # For convenience
 
1772
    debug = server_settings["debug"]
 
1773
    debuglevel = server_settings["debuglevel"]
 
1774
    use_dbus = server_settings["use_dbus"]
 
1775
    use_ipv6 = server_settings["use_ipv6"]
 
1776
 
 
1777
    if server_settings["servicename"] != "Mandos":
 
1778
        syslogger.setFormatter(logging.Formatter
 
1779
                               ('Mandos (%s) [%%(process)d]:'
 
1780
                                ' %%(levelname)s: %%(message)s'
 
1781
                                % server_settings["servicename"]))
 
1782
    
 
1783
    # Parse config file with clients
 
1784
    client_defaults = { "timeout": "5m",
 
1785
                        "extended_timeout": "15m",
 
1786
                        "interval": "2m",
 
1787
                        "checker": "fping -q -- %%(host)s",
 
1788
                        "host": "",
 
1789
                        "approval_delay": "0s",
 
1790
                        "approval_duration": "1s",
 
1791
                        }
 
1792
    client_config = configparser.SafeConfigParser(client_defaults)
 
1793
    client_config.read(os.path.join(server_settings["configdir"],
 
1794
                                    "clients.conf"))
 
1795
    
 
1796
    global mandos_dbus_service
 
1797
    mandos_dbus_service = None
 
1798
    
 
1799
    tcp_server = MandosServer((server_settings["address"],
 
1800
                               server_settings["port"]),
 
1801
                              ClientHandler,
 
1802
                              interface=(server_settings["interface"]
 
1803
                                         or None),
 
1804
                              use_ipv6=use_ipv6,
 
1805
                              gnutls_priority=
 
1806
                              server_settings["priority"],
 
1807
                              use_dbus=use_dbus)
 
1808
    if not debug:
 
1809
        pidfilename = "/var/run/mandos.pid"
 
1810
        try:
 
1811
            pidfile = open(pidfilename, "w")
 
1812
        except IOError:
 
1813
            logger.error("Could not open file %r", pidfilename)
 
1814
    
 
1815
    try:
 
1816
        uid = pwd.getpwnam("_mandos").pw_uid
 
1817
        gid = pwd.getpwnam("_mandos").pw_gid
 
1818
    except KeyError:
 
1819
        try:
 
1820
            uid = pwd.getpwnam("mandos").pw_uid
 
1821
            gid = pwd.getpwnam("mandos").pw_gid
 
1822
        except KeyError:
 
1823
            try:
 
1824
                uid = pwd.getpwnam("nobody").pw_uid
 
1825
                gid = pwd.getpwnam("nobody").pw_gid
 
1826
            except KeyError:
 
1827
                uid = 65534
 
1828
                gid = 65534
 
1829
    try:
 
1830
        os.setgid(gid)
 
1831
        os.setuid(uid)
 
1832
    except OSError as error:
 
1833
        if error[0] != errno.EPERM:
 
1834
            raise error
 
1835
    
 
1836
    if not debug and not debuglevel:
 
1837
        syslogger.setLevel(logging.WARNING)
 
1838
        console.setLevel(logging.WARNING)
 
1839
    if debuglevel:
 
1840
        level = getattr(logging, debuglevel.upper())
 
1841
        syslogger.setLevel(level)
 
1842
        console.setLevel(level)
 
1843
 
 
1844
    if debug:
 
1845
        # Enable all possible GnuTLS debugging
 
1846
        
 
1847
        # "Use a log level over 10 to enable all debugging options."
 
1848
        # - GnuTLS manual
 
1849
        gnutls.library.functions.gnutls_global_set_log_level(11)
 
1850
        
 
1851
        @gnutls.library.types.gnutls_log_func
 
1852
        def debug_gnutls(level, string):
 
1853
            logger.debug("GnuTLS: %s", string[:-1])
 
1854
        
 
1855
        (gnutls.library.functions
 
1856
         .gnutls_global_set_log_function(debug_gnutls))
 
1857
        
 
1858
        # Redirect stdin so all checkers get /dev/null
 
1859
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1860
        os.dup2(null, sys.stdin.fileno())
 
1861
        if null > 2:
 
1862
            os.close(null)
 
1863
    else:
 
1864
        # No console logging
 
1865
        logger.removeHandler(console)
 
1866
    
 
1867
    # Need to fork before connecting to D-Bus
 
1868
    if not debug:
 
1869
        # Close all input and output, do double fork, etc.
 
1870
        daemon()
 
1871
    
 
1872
    global main_loop
 
1873
    # From the Avahi example code
 
1874
    DBusGMainLoop(set_as_default=True )
 
1875
    main_loop = gobject.MainLoop()
 
1876
    bus = dbus.SystemBus()
 
1877
    # End of Avahi example code
 
1878
    if use_dbus:
 
1879
        try:
 
1880
            bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
 
1881
                                            bus, do_not_queue=True)
 
1882
        except dbus.exceptions.NameExistsException as e:
 
1883
            logger.error(unicode(e) + ", disabling D-Bus")
 
1884
            use_dbus = False
 
1885
            server_settings["use_dbus"] = False
 
1886
            tcp_server.use_dbus = False
 
1887
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
1888
    service = AvahiService(name = server_settings["servicename"],
 
1889
                           servicetype = "_mandos._tcp",
 
1890
                           protocol = protocol, bus = bus)
 
1891
    if server_settings["interface"]:
 
1892
        service.interface = (if_nametoindex
 
1893
                             (str(server_settings["interface"])))
 
1894
    
 
1895
    global multiprocessing_manager
 
1896
    multiprocessing_manager = multiprocessing.Manager()
 
1897
    
 
1898
    client_class = Client
 
1899
    if use_dbus:
 
1900
        client_class = functools.partial(ClientDBus, bus = bus)
 
1901
    def client_config_items(config, section):
 
1902
        special_settings = {
 
1903
            "approved_by_default":
 
1904
                lambda: config.getboolean(section,
 
1905
                                          "approved_by_default"),
 
1906
            }
 
1907
        for name, value in config.items(section):
 
1908
            try:
 
1909
                yield (name, special_settings[name]())
 
1910
            except KeyError:
 
1911
                yield (name, value)
 
1912
    
 
1913
    tcp_server.clients.update(set(
 
1914
            client_class(name = section,
 
1915
                         config= dict(client_config_items(
 
1916
                        client_config, section)))
 
1917
            for section in client_config.sections()))
 
1918
    if not tcp_server.clients:
 
1919
        logger.warning("No clients defined")
 
1920
        
 
1921
    if not debug:
 
1922
        try:
 
1923
            with pidfile:
 
1924
                pid = os.getpid()
 
1925
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
1926
            del pidfile
 
1927
        except IOError:
 
1928
            logger.error("Could not write to file %r with PID %d",
 
1929
                         pidfilename, pid)
 
1930
        except NameError:
 
1931
            # "pidfile" was never created
 
1932
            pass
 
1933
        del pidfilename
 
1934
        
 
1935
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
1936
 
 
1937
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
 
1938
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
 
1939
    
 
1940
    if use_dbus:
 
1941
        class MandosDBusService(dbus.service.Object):
 
1942
            """A D-Bus proxy object"""
 
1943
            def __init__(self):
 
1944
                dbus.service.Object.__init__(self, bus, "/")
 
1945
            _interface = "se.bsnet.fukt.Mandos"
 
1946
            
 
1947
            @dbus.service.signal(_interface, signature="o")
 
1948
            def ClientAdded(self, objpath):
 
1949
                "D-Bus signal"
 
1950
                pass
 
1951
            
 
1952
            @dbus.service.signal(_interface, signature="ss")
 
1953
            def ClientNotFound(self, fingerprint, address):
 
1954
                "D-Bus signal"
 
1955
                pass
 
1956
            
 
1957
            @dbus.service.signal(_interface, signature="os")
 
1958
            def ClientRemoved(self, objpath, name):
 
1959
                "D-Bus signal"
 
1960
                pass
 
1961
            
 
1962
            @dbus.service.method(_interface, out_signature="ao")
 
1963
            def GetAllClients(self):
 
1964
                "D-Bus method"
 
1965
                return dbus.Array(c.dbus_object_path
 
1966
                                  for c in tcp_server.clients)
 
1967
            
 
1968
            @dbus.service.method(_interface,
 
1969
                                 out_signature="a{oa{sv}}")
 
1970
            def GetAllClientsWithProperties(self):
 
1971
                "D-Bus method"
 
1972
                return dbus.Dictionary(
 
1973
                    ((c.dbus_object_path, c.GetAll(""))
 
1974
                     for c in tcp_server.clients),
 
1975
                    signature="oa{sv}")
 
1976
            
 
1977
            @dbus.service.method(_interface, in_signature="o")
 
1978
            def RemoveClient(self, object_path):
 
1979
                "D-Bus method"
 
1980
                for c in tcp_server.clients:
 
1981
                    if c.dbus_object_path == object_path:
 
1982
                        tcp_server.clients.remove(c)
 
1983
                        c.remove_from_connection()
 
1984
                        # Don't signal anything except ClientRemoved
 
1985
                        c.disable(quiet=True)
 
1986
                        # Emit D-Bus signal
 
1987
                        self.ClientRemoved(object_path, c.name)
 
1988
                        return
 
1989
                raise KeyError(object_path)
 
1990
            
 
1991
            del _interface
 
1992
        
 
1993
        mandos_dbus_service = MandosDBusService()
 
1994
    
 
1995
    def cleanup():
 
1996
        "Cleanup function; run on exit"
 
1997
        service.cleanup()
 
1998
        
 
1999
        while tcp_server.clients:
 
2000
            client = tcp_server.clients.pop()
 
2001
            if use_dbus:
 
2002
                client.remove_from_connection()
 
2003
            client.disable_hook = None
 
2004
            # Don't signal anything except ClientRemoved
 
2005
            client.disable(quiet=True)
 
2006
            if use_dbus:
 
2007
                # Emit D-Bus signal
 
2008
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
2009
                                                  client.name)
 
2010
    
 
2011
    atexit.register(cleanup)
 
2012
    
 
2013
    for client in tcp_server.clients:
 
2014
        if use_dbus:
 
2015
            # Emit D-Bus signal
 
2016
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
2017
        client.enable()
 
2018
    
 
2019
    tcp_server.enable()
 
2020
    tcp_server.server_activate()
 
2021
    
 
2022
    # Find out what port we got
 
2023
    service.port = tcp_server.socket.getsockname()[1]
 
2024
    if use_ipv6:
 
2025
        logger.info("Now listening on address %r, port %d,"
 
2026
                    " flowinfo %d, scope_id %d"
 
2027
                    % tcp_server.socket.getsockname())
 
2028
    else:                       # IPv4
 
2029
        logger.info("Now listening on address %r, port %d"
 
2030
                    % tcp_server.socket.getsockname())
 
2031
    
 
2032
    #service.interface = tcp_server.socket.getsockname()[3]
 
2033
    
 
2034
    try:
 
2035
        # From the Avahi example code
 
2036
        try:
 
2037
            service.activate()
 
2038
        except dbus.exceptions.DBusException as error:
 
2039
            logger.critical("DBusException: %s", error)
 
2040
            cleanup()
 
2041
            sys.exit(1)
 
2042
        # End of Avahi example code
 
2043
        
 
2044
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
 
2045
                             lambda *args, **kwargs:
 
2046
                             (tcp_server.handle_request
 
2047
                              (*args[2:], **kwargs) or True))
 
2048
        
 
2049
        logger.debug("Starting main loop")
 
2050
        main_loop.run()
 
2051
    except AvahiError as error:
 
2052
        logger.critical("AvahiError: %s", error)
 
2053
        cleanup()
 
2054
        sys.exit(1)
 
2055
    except KeyboardInterrupt:
 
2056
        if debug:
 
2057
            print("", file=sys.stderr)
 
2058
        logger.debug("Server received KeyboardInterrupt")
 
2059
    logger.debug("Server exiting")
 
2060
    # Must run before the D-Bus bus name gets deregistered
 
2061
    cleanup()
 
2062
 
 
2063
if __name__ == '__main__':
240
2064
    main()
241