106
237
max_renames: integer; maximum number of renames
107
238
rename_count: integer; counter so we only rename after collisions
108
239
a sensible number of times
240
group: D-Bus Entry Group
242
bus: dbus.SystemBus()
110
244
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
111
type = None, port = None, TXT = None, domain = "",
112
host = "", max_renames = 32768):
245
servicetype = None, port = None, TXT = None,
246
domain = "", host = "", max_renames = 32768,
247
protocol = avahi.PROTO_UNSPEC, bus = None):
113
248
self.interface = interface
250
self.type = servicetype
252
self.TXT = TXT if TXT is not None else []
121
253
self.domain = domain
123
255
self.rename_count = 0
124
256
self.max_renames = max_renames
257
self.protocol = protocol
258
self.group = None # our entry group
261
self.entry_group_state_changed_match = None
125
262
def rename(self):
126
263
"""Derived from the Avahi example code"""
127
264
if self.rename_count >= self.max_renames:
128
logger.critical(u"No suitable Zeroconf service name found"
129
u" after %i retries, exiting.",
265
logger.critical("No suitable Zeroconf service name found"
266
" after %i retries, exiting.",
131
268
raise AvahiServiceError("Too many renames")
132
self.name = server.GetAlternativeServiceName(self.name)
133
logger.info(u"Changing Zeroconf service name to %r ...",
135
syslogger.setFormatter(logging.Formatter\
136
('Mandos (%s): %%(levelname)s:'
137
' %%(message)s' % self.name))
269
self.name = unicode(self.server
270
.GetAlternativeServiceName(self.name))
271
logger.info("Changing Zeroconf service name to %r ...",
276
except dbus.exceptions.DBusException as error:
277
logger.critical("DBusException: %s", error)
140
280
self.rename_count += 1
141
281
def remove(self):
142
282
"""Derived from the Avahi example code"""
143
if group is not None:
283
if self.entry_group_state_changed_match is not None:
284
self.entry_group_state_changed_match.remove()
285
self.entry_group_state_changed_match = None
286
if self.group is not None:
146
289
"""Derived from the Avahi example code"""
149
group = dbus.Interface\
150
(bus.get_object(avahi.DBUS_NAME,
151
server.EntryGroupNew()),
152
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
group.connect_to_signal('StateChanged',
154
entry_group_state_changed)
155
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
156
service.name, service.type)
158
self.interface, # interface
159
avahi.PROTO_INET6, # protocol
160
dbus.UInt32(0), # flags
161
self.name, self.type,
162
self.domain, self.host,
163
dbus.UInt16(self.port),
164
avahi.string_array_to_txt_array(self.TXT))
167
# From the Avahi example code:
168
group = None # our entry group
169
# End of Avahi example code
291
if self.group is None:
292
self.group = dbus.Interface(
293
self.bus.get_object(avahi.DBUS_NAME,
294
self.server.EntryGroupNew()),
295
avahi.DBUS_INTERFACE_ENTRY_GROUP)
296
self.entry_group_state_changed_match = (
297
self.group.connect_to_signal(
298
'StateChanged', self.entry_group_state_changed))
299
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
300
self.name, self.type)
301
self.group.AddService(
304
dbus.UInt32(0), # flags
305
self.name, self.type,
306
self.domain, self.host,
307
dbus.UInt16(self.port),
308
avahi.string_array_to_txt_array(self.TXT))
310
def entry_group_state_changed(self, state, error):
311
"""Derived from the Avahi example code"""
312
logger.debug("Avahi entry group state change: %i", state)
314
if state == avahi.ENTRY_GROUP_ESTABLISHED:
315
logger.debug("Zeroconf service established.")
316
elif state == avahi.ENTRY_GROUP_COLLISION:
317
logger.info("Zeroconf service name collision.")
319
elif state == avahi.ENTRY_GROUP_FAILURE:
320
logger.critical("Avahi: Error in group state changed %s",
322
raise AvahiGroupError("State changed: %s"
325
"""Derived from the Avahi example code"""
326
if self.group is not None:
329
except (dbus.exceptions.UnknownMethodException,
330
dbus.exceptions.DBusException):
334
def server_state_changed(self, state, error=None):
335
"""Derived from the Avahi example code"""
336
logger.debug("Avahi server state change: %i", state)
337
bad_states = { avahi.SERVER_INVALID:
338
"Zeroconf server invalid",
339
avahi.SERVER_REGISTERING: None,
340
avahi.SERVER_COLLISION:
341
"Zeroconf server name collision",
342
avahi.SERVER_FAILURE:
343
"Zeroconf server failure" }
344
if state in bad_states:
345
if bad_states[state] is not None:
347
logger.error(bad_states[state])
349
logger.error(bad_states[state] + ": %r", error)
351
elif state == avahi.SERVER_RUNNING:
355
logger.debug("Unknown state: %r", state)
357
logger.debug("Unknown state: %r: %r", state, error)
359
"""Derived from the Avahi example code"""
360
if self.server is None:
361
self.server = dbus.Interface(
362
self.bus.get_object(avahi.DBUS_NAME,
363
avahi.DBUS_PATH_SERVER,
364
follow_name_owner_changes=True),
365
avahi.DBUS_INTERFACE_SERVER)
366
self.server.connect_to_signal("StateChanged",
367
self.server_state_changed)
368
self.server_state_changed(self.server.GetState())
370
class AvahiServiceToSyslog(AvahiService):
372
"""Add the new name to the syslog messages"""
373
ret = AvahiService.rename(self)
374
syslogger.setFormatter(logging.Formatter
375
('Mandos (%s) [%%(process)d]:'
376
' %%(levelname)s: %%(message)s'
380
def timedelta_to_milliseconds(td):
381
"Convert a datetime.timedelta() to milliseconds"
382
return ((td.days * 24 * 60 * 60 * 1000)
383
+ (td.seconds * 1000)
384
+ (td.microseconds // 1000))
172
386
class Client(object):
173
387
"""A representation of a client host served by this server.
175
name: string; from the config file, used in log messages
390
approved: bool(); 'None' if not yet approved/disapproved
391
approval_delay: datetime.timedelta(); Time to wait for approval
392
approval_duration: datetime.timedelta(); Duration of one approval
393
checker: subprocess.Popen(); a running checker process used
394
to see if the client lives.
395
'None' if no process is running.
396
checker_callback_tag: a gobject event source tag, or None
397
checker_command: string; External command which is run to check
398
if client lives. %() expansions are done at
399
runtime with vars(self) as dict, so that for
400
instance %(name)s can be used in the command.
401
checker_initiator_tag: a gobject event source tag, or None
402
created: datetime.datetime(); (UTC) object creation
403
client_structure: Object describing what attributes a client has
404
and is used for storing the client at exit
405
current_checker_command: string; current running checker_command
406
disable_initiator_tag: a gobject event source tag, or None
176
408
fingerprint: string (40 or 32 hexadecimal digits); used to
177
409
uniquely identify the client
178
secret: bytestring; sent verbatim (over TLS) to client
179
host: string; available for use by the checker command
180
created: datetime.datetime(); object creation, not client host
181
last_checked_ok: datetime.datetime() or None if not yet checked OK
182
timeout: datetime.timedelta(); How long from last_checked_ok
183
until this client is invalid
184
interval: datetime.timedelta(); How often to start a new checker
185
stop_hook: If set, called by stop() as stop_hook(self)
186
checker: subprocess.Popen(); a running checker process used
187
to see if the client lives.
188
'None' if no process is running.
189
checker_initiator_tag: a gobject event source tag, or None
190
stop_initiator_tag: - '' -
191
checker_callback_tag: - '' -
192
checker_command: string; External command which is run to check if
193
client lives. %() expansions are done at
194
runtime with vars(self) as dict, so that for
195
instance %(name)s can be used in the command.
197
_timeout: Real variable for 'timeout'
198
_interval: Real variable for 'interval'
199
_timeout_milliseconds: Used when calling gobject.timeout_add()
200
_interval_milliseconds: - '' -
410
host: string; available for use by the checker command
411
interval: datetime.timedelta(); How often to start a new checker
412
last_approval_request: datetime.datetime(); (UTC) or None
413
last_checked_ok: datetime.datetime(); (UTC) or None
415
last_checker_status: integer between 0 and 255 reflecting exit
416
status of last checker. -1 reflects crashed
418
last_enabled: datetime.datetime(); (UTC) or None
419
name: string; from the config file, used in log messages and
421
secret: bytestring; sent verbatim (over TLS) to client
422
timeout: datetime.timedelta(); How long from last_checked_ok
423
until this client is disabled
424
extended_timeout: extra long timeout when password has been sent
425
runtime_expansions: Allowed attributes for runtime expansion.
426
expires: datetime.datetime(); time (UTC) when a client will be
202
def _set_timeout(self, timeout):
203
"Setter function for 'timeout' attribute"
204
self._timeout = timeout
205
self._timeout_milliseconds = ((self.timeout.days
206
* 24 * 60 * 60 * 1000)
207
+ (self.timeout.seconds * 1000)
208
+ (self.timeout.microseconds
210
timeout = property(lambda self: self._timeout,
213
def _set_interval(self, interval):
214
"Setter function for 'interval' attribute"
215
self._interval = interval
216
self._interval_milliseconds = ((self.interval.days
217
* 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds
220
+ (self.interval.microseconds
222
interval = property(lambda self: self._interval,
225
def __init__(self, name = None, stop_hook=None, config={}):
430
runtime_expansions = ("approval_delay", "approval_duration",
431
"created", "enabled", "fingerprint",
432
"host", "interval", "last_checked_ok",
433
"last_enabled", "name", "timeout")
434
client_defaults = { "timeout": "5m",
435
"extended_timeout": "15m",
437
"checker": "fping -q -- %%(host)s",
439
"approval_delay": "0s",
440
"approval_duration": "1s",
441
"approved_by_default": "True",
445
def timeout_milliseconds(self):
446
"Return the 'timeout' attribute in milliseconds"
447
return timedelta_to_milliseconds(self.timeout)
449
def extended_timeout_milliseconds(self):
450
"Return the 'extended_timeout' attribute in milliseconds"
451
return timedelta_to_milliseconds(self.extended_timeout)
453
def interval_milliseconds(self):
454
"Return the 'interval' attribute in milliseconds"
455
return timedelta_to_milliseconds(self.interval)
457
def approval_delay_milliseconds(self):
458
return timedelta_to_milliseconds(self.approval_delay)
461
def config_parser(config):
462
""" Construct a new dict of client settings of this form:
463
{ client_name: {setting_name: value, ...}, ...}
464
with exceptions for any special settings as defined above"""
466
for client_name in config.sections():
467
section = dict(config.items(client_name))
468
client = settings[client_name] = {}
470
client["host"] = section["host"]
471
# Reformat values from string types to Python types
472
client["approved_by_default"] = config.getboolean(
473
client_name, "approved_by_default")
474
client["enabled"] = config.getboolean(client_name, "enabled")
476
client["fingerprint"] = (section["fingerprint"].upper()
478
if "secret" in section:
479
client["secret"] = section["secret"].decode("base64")
480
elif "secfile" in section:
481
with open(os.path.expanduser(os.path.expandvars
482
(section["secfile"])),
484
client["secret"] = secfile.read()
486
raise TypeError("No secret or secfile for section %s"
488
client["timeout"] = string_to_delta(section["timeout"])
489
client["extended_timeout"] = string_to_delta(
490
section["extended_timeout"])
491
client["interval"] = string_to_delta(section["interval"])
492
client["approval_delay"] = string_to_delta(
493
section["approval_delay"])
494
client["approval_duration"] = string_to_delta(
495
section["approval_duration"])
496
client["checker_command"] = section["checker"]
497
client["last_approval_request"] = None
498
client["last_checked_ok"] = None
499
client["last_checker_status"] = None
500
if client["enabled"]:
501
client["last_enabled"] = datetime.datetime.utcnow()
502
client["expires"] = (datetime.datetime.utcnow()
505
client["last_enabled"] = None
506
client["expires"] = None
511
def __init__(self, settings, name = None):
226
512
"""Note: the 'checker' key in 'config' sets the
227
513
'checker_command' attribute and *not* the 'checker'
230
logger.debug(u"Creating client %r", self.name)
516
# adding all client settings
517
for setting, value in settings.iteritems():
518
setattr(self, setting, value)
520
logger.debug("Creating client %r", self.name)
231
521
# Uppercase and remove spaces from fingerprint for later
232
522
# comparison purposes with return value from the fingerprint()
234
self.fingerprint = config["fingerprint"].upper()\
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
237
if "secret" in config:
238
self.secret = config["secret"].decode(u"base64")
239
elif "secfile" in config:
240
sf = open(config["secfile"])
241
self.secret = sf.read()
244
raise TypeError(u"No secret or secfile for client %s"
246
self.host = config.get("host", "")
247
self.created = datetime.datetime.now()
248
self.last_checked_ok = None
249
self.timeout = string_to_delta(config["timeout"])
250
self.interval = string_to_delta(config["interval"])
251
self.stop_hook = stop_hook
524
logger.debug(" Fingerprint: %s", self.fingerprint)
525
self.created = settings.get("created", datetime.datetime.utcnow())
527
# attributes specific for this server instance
252
528
self.checker = None
253
529
self.checker_initiator_tag = None
254
self.stop_initiator_tag = None
530
self.disable_initiator_tag = None
255
531
self.checker_callback_tag = None
256
self.check_command = config["checker"]
532
self.current_checker_command = None
534
self.approvals_pending = 0
535
self.changedstate = (multiprocessing_manager
536
.Condition(multiprocessing_manager
538
self.client_structure = [attr for attr in
539
self.__dict__.iterkeys()
540
if not attr.startswith("_")]
541
self.client_structure.append("client_structure")
543
for name, t in inspect.getmembers(type(self),
547
if not name.startswith("_"):
548
self.client_structure.append(name)
550
# Send notice to process children that client state has changed
551
def send_changedstate(self):
552
with self.changedstate:
553
self.changedstate.notify_all()
258
556
"""Start this client's checker and timeout hooks"""
557
if getattr(self, "enabled", False):
560
self.send_changedstate()
561
self.expires = datetime.datetime.utcnow() + self.timeout
563
self.last_enabled = datetime.datetime.utcnow()
566
def disable(self, quiet=True):
567
"""Disable this client."""
568
if not getattr(self, "enabled", False):
571
self.send_changedstate()
573
logger.info("Disabling client %s", self.name)
574
if getattr(self, "disable_initiator_tag", False):
575
gobject.source_remove(self.disable_initiator_tag)
576
self.disable_initiator_tag = None
578
if getattr(self, "checker_initiator_tag", False):
579
gobject.source_remove(self.checker_initiator_tag)
580
self.checker_initiator_tag = None
583
# Do not run this again if called by a gobject.timeout_add
589
def init_checker(self):
259
590
# Schedule a new checker to be started an 'interval' from now,
260
591
# and every interval from then on.
261
self.checker_initiator_tag = gobject.timeout_add\
262
(self._interval_milliseconds,
592
self.checker_initiator_tag = (gobject.timeout_add
593
(self.interval_milliseconds(),
595
# Schedule a disable() when 'timeout' has passed
596
self.disable_initiator_tag = (gobject.timeout_add
597
(self.timeout_milliseconds(),
264
599
# Also start a new checker *right now*.
265
600
self.start_checker()
266
# Schedule a stop() when 'timeout' has passed
267
self.stop_initiator_tag = gobject.timeout_add\
268
(self._timeout_milliseconds,
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
274
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
276
logger.info(u"Stopping client %s", self.name)
280
if getattr(self, "stop_initiator_tag", False):
281
gobject.source_remove(self.stop_initiator_tag)
282
self.stop_initiator_tag = None
283
if getattr(self, "checker_initiator_tag", False):
284
gobject.source_remove(self.checker_initiator_tag)
285
self.checker_initiator_tag = None
289
# Do not run this again if called by a gobject.timeout_add
292
self.stop_hook = None
294
def checker_callback(self, pid, condition):
602
def checker_callback(self, pid, condition, command):
295
603
"""The checker has completed, so take appropriate actions."""
296
now = datetime.datetime.now()
297
604
self.checker_callback_tag = None
298
605
self.checker = None
299
if os.WIFEXITED(condition) \
300
and (os.WEXITSTATUS(condition) == 0):
301
logger.info(u"Checker for %(name)s succeeded",
303
self.last_checked_ok = now
304
gobject.source_remove(self.stop_initiator_tag)
305
self.stop_initiator_tag = gobject.timeout_add\
306
(self._timeout_milliseconds,
308
elif not os.WIFEXITED(condition):
309
logger.warning(u"Checker for %(name)s crashed?",
606
if os.WIFEXITED(condition):
607
self.last_checker_status = os.WEXITSTATUS(condition)
608
if self.last_checker_status == 0:
609
logger.info("Checker for %(name)s succeeded",
613
logger.info("Checker for %(name)s failed",
616
self.last_checker_status = -1
617
logger.warning("Checker for %(name)s crashed?",
312
logger.info(u"Checker for %(name)s failed",
620
def checked_ok(self, timeout=None):
621
"""Bump up the timeout for this client.
623
This should only be called when the client has been seen,
627
timeout = self.timeout
628
self.last_checked_ok = datetime.datetime.utcnow()
629
if self.disable_initiator_tag is not None:
630
gobject.source_remove(self.disable_initiator_tag)
631
if getattr(self, "enabled", False):
632
self.disable_initiator_tag = (gobject.timeout_add
633
(timedelta_to_milliseconds
634
(timeout), self.disable))
635
self.expires = datetime.datetime.utcnow() + timeout
637
def need_approval(self):
638
self.last_approval_request = datetime.datetime.utcnow()
314
640
def start_checker(self):
315
641
"""Start a new checker subprocess if one is not running.
316
643
If a checker already exists, leave it running and do
318
645
# The reason for not killing a running checker is that if we
363
719
self.checker_callback_tag = None
364
720
if getattr(self, "checker", None) is None:
366
logger.debug(u"Stopping checker for %(name)s", vars(self))
722
logger.debug("Stopping checker for %(name)s", vars(self))
368
724
os.kill(self.checker.pid, signal.SIGTERM)
370
726
#if self.checker.poll() is None:
371
727
# os.kill(self.checker.pid, signal.SIGKILL)
372
except OSError, error:
728
except OSError as error:
373
729
if error.errno != errno.ESRCH: # No such process
375
731
self.checker = None
376
def still_valid(self):
377
"""Has the timeout not yet passed for this client?"""
378
now = datetime.datetime.now()
379
if self.last_checked_ok is None:
380
return now < (self.created + self.timeout)
382
return now < (self.last_checked_ok + self.timeout)
385
def peer_certificate(session):
386
"Return the peer's OpenPGP certificate as a bytestring"
387
# If not an OpenPGP certificate...
388
if gnutls.library.functions.gnutls_certificate_type_get\
389
(session._c_object) \
390
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
391
# ...do the normal thing
392
return session.peer_certificate
393
list_size = ctypes.c_uint()
394
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
(session._c_object, ctypes.byref(list_size))
396
if list_size.value == 0:
399
return ctypes.string_at(cert.data, cert.size)
402
def fingerprint(openpgp):
403
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
404
# New GnuTLS "datum" with the OpenPGP public key
405
datum = gnutls.library.types.gnutls_datum_t\
406
(ctypes.cast(ctypes.c_char_p(openpgp),
407
ctypes.POINTER(ctypes.c_ubyte)),
408
ctypes.c_uint(len(openpgp)))
409
# New empty GnuTLS certificate
410
crt = gnutls.library.types.gnutls_openpgp_crt_t()
411
gnutls.library.functions.gnutls_openpgp_crt_init\
413
# Import the OpenPGP public key into the certificate
414
gnutls.library.functions.gnutls_openpgp_crt_import\
415
(crt, ctypes.byref(datum),
416
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
417
# Verify the self signature in the key
418
crtverify = ctypes.c_uint();
419
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
(crt, 0, ctypes.byref(crtverify))
421
if crtverify.value != 0:
422
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
423
raise gnutls.errors.CertificateSecurityError("Verify failed")
424
# New buffer for the fingerprint
425
buffer = ctypes.create_string_buffer(20)
426
buffer_length = ctypes.c_size_t()
427
# Get the fingerprint from the certificate into the buffer
428
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
430
# Deinit the certificate
431
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
432
# Convert the buffer to a Python bytestring
433
fpr = ctypes.string_at(buffer, buffer_length.value)
434
# Convert the bytestring to hexadecimal notation
435
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
440
"""A TCP request handler class.
441
Instantiated by IPv6_TCPServer for each request to handle it.
734
def dbus_service_property(dbus_interface, signature="v",
735
access="readwrite", byte_arrays=False):
736
"""Decorators for marking methods of a DBusObjectWithProperties to
737
become properties on the D-Bus.
739
The decorated method will be called with no arguments by "Get"
740
and with one argument by "Set".
742
The parameters, where they are supported, are the same as
743
dbus.service.method, except there is only "signature", since the
744
type from Get() and the type sent to Set() is the same.
746
# Encoding deeply encoded byte arrays is not supported yet by the
747
# "Set" method, so we fail early here:
748
if byte_arrays and signature != "ay":
749
raise ValueError("Byte arrays not supported for non-'ay'"
750
" signature %r" % signature)
752
func._dbus_is_property = True
753
func._dbus_interface = dbus_interface
754
func._dbus_signature = signature
755
func._dbus_access = access
756
func._dbus_name = func.__name__
757
if func._dbus_name.endswith("_dbus_property"):
758
func._dbus_name = func._dbus_name[:-14]
759
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
764
class DBusPropertyException(dbus.exceptions.DBusException):
765
"""A base class for D-Bus property-related exceptions
767
def __unicode__(self):
768
return unicode(str(self))
771
class DBusPropertyAccessException(DBusPropertyException):
772
"""A property's access permissions disallows an operation.
777
class DBusPropertyNotFound(DBusPropertyException):
778
"""An attempt was made to access a non-existing property.
783
class DBusObjectWithProperties(dbus.service.Object):
784
"""A D-Bus object with properties.
786
Classes inheriting from this can use the dbus_service_property
787
decorator to expose methods as D-Bus properties. It exposes the
788
standard Get(), Set(), and GetAll() methods on the D-Bus.
792
def _is_dbus_property(obj):
793
return getattr(obj, "_dbus_is_property", False)
795
def _get_all_dbus_properties(self):
796
"""Returns a generator of (name, attribute) pairs
798
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
799
for cls in self.__class__.__mro__
801
inspect.getmembers(cls, self._is_dbus_property))
803
def _get_dbus_property(self, interface_name, property_name):
804
"""Returns a bound method if one exists which is a D-Bus
805
property with the specified name and interface.
807
for cls in self.__class__.__mro__:
808
for name, value in (inspect.getmembers
809
(cls, self._is_dbus_property)):
810
if (value._dbus_name == property_name
811
and value._dbus_interface == interface_name):
812
return value.__get__(self)
815
raise DBusPropertyNotFound(self.dbus_object_path + ":"
816
+ interface_name + "."
819
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
821
def Get(self, interface_name, property_name):
822
"""Standard D-Bus property Get() method, see D-Bus standard.
824
prop = self._get_dbus_property(interface_name, property_name)
825
if prop._dbus_access == "write":
826
raise DBusPropertyAccessException(property_name)
828
if not hasattr(value, "variant_level"):
830
return type(value)(value, variant_level=value.variant_level+1)
832
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
833
def Set(self, interface_name, property_name, value):
834
"""Standard D-Bus property Set() method, see D-Bus standard.
836
prop = self._get_dbus_property(interface_name, property_name)
837
if prop._dbus_access == "read":
838
raise DBusPropertyAccessException(property_name)
839
if prop._dbus_get_args_options["byte_arrays"]:
840
# The byte_arrays option is not supported yet on
841
# signatures other than "ay".
842
if prop._dbus_signature != "ay":
844
value = dbus.ByteArray(''.join(unichr(byte)
848
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
849
out_signature="a{sv}")
850
def GetAll(self, interface_name):
851
"""Standard D-Bus property GetAll() method, see D-Bus
854
Note: Will not include properties with access="write".
857
for name, prop in self._get_all_dbus_properties():
859
and interface_name != prop._dbus_interface):
860
# Interface non-empty but did not match
862
# Ignore write-only properties
863
if prop._dbus_access == "write":
866
if not hasattr(value, "variant_level"):
867
properties[name] = value
869
properties[name] = type(value)(value, variant_level=
870
value.variant_level+1)
871
return dbus.Dictionary(properties, signature="sv")
873
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
875
path_keyword='object_path',
876
connection_keyword='connection')
877
def Introspect(self, object_path, connection):
878
"""Standard D-Bus method, overloaded to insert property tags.
880
xmlstring = dbus.service.Object.Introspect(self, object_path,
883
document = xml.dom.minidom.parseString(xmlstring)
884
def make_tag(document, name, prop):
885
e = document.createElement("property")
886
e.setAttribute("name", name)
887
e.setAttribute("type", prop._dbus_signature)
888
e.setAttribute("access", prop._dbus_access)
890
for if_tag in document.getElementsByTagName("interface"):
891
for tag in (make_tag(document, name, prop)
893
in self._get_all_dbus_properties()
894
if prop._dbus_interface
895
== if_tag.getAttribute("name")):
896
if_tag.appendChild(tag)
897
# Add the names to the return values for the
898
# "org.freedesktop.DBus.Properties" methods
899
if (if_tag.getAttribute("name")
900
== "org.freedesktop.DBus.Properties"):
901
for cn in if_tag.getElementsByTagName("method"):
902
if cn.getAttribute("name") == "Get":
903
for arg in cn.getElementsByTagName("arg"):
904
if (arg.getAttribute("direction")
906
arg.setAttribute("name", "value")
907
elif cn.getAttribute("name") == "GetAll":
908
for arg in cn.getElementsByTagName("arg"):
909
if (arg.getAttribute("direction")
911
arg.setAttribute("name", "props")
912
xmlstring = document.toxml("utf-8")
914
except (AttributeError, xml.dom.DOMException,
915
xml.parsers.expat.ExpatError) as error:
916
logger.error("Failed to override Introspection method",
921
def datetime_to_dbus (dt, variant_level=0):
922
"""Convert a UTC datetime.datetime() to a D-Bus type."""
924
return dbus.String("", variant_level = variant_level)
925
return dbus.String(dt.isoformat(),
926
variant_level=variant_level)
929
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
931
"""Applied to an empty subclass of a D-Bus object, this metaclass
932
will add additional D-Bus attributes matching a certain pattern.
934
def __new__(mcs, name, bases, attr):
935
# Go through all the base classes which could have D-Bus
936
# methods, signals, or properties in them
937
for base in (b for b in bases
938
if issubclass(b, dbus.service.Object)):
939
# Go though all attributes of the base class
940
for attrname, attribute in inspect.getmembers(base):
941
# Ignore non-D-Bus attributes, and D-Bus attributes
942
# with the wrong interface name
943
if (not hasattr(attribute, "_dbus_interface")
944
or not attribute._dbus_interface
945
.startswith("se.recompile.Mandos")):
947
# Create an alternate D-Bus interface name based on
949
alt_interface = (attribute._dbus_interface
950
.replace("se.recompile.Mandos",
951
"se.bsnet.fukt.Mandos"))
952
# Is this a D-Bus signal?
953
if getattr(attribute, "_dbus_is_signal", False):
954
# Extract the original non-method function by
956
nonmethod_func = (dict(
957
zip(attribute.func_code.co_freevars,
958
attribute.__closure__))["func"]
960
# Create a new, but exactly alike, function
961
# object, and decorate it to be a new D-Bus signal
962
# with the alternate D-Bus interface name
963
new_function = (dbus.service.signal
965
attribute._dbus_signature)
967
nonmethod_func.func_code,
968
nonmethod_func.func_globals,
969
nonmethod_func.func_name,
970
nonmethod_func.func_defaults,
971
nonmethod_func.func_closure)))
972
# Define a creator of a function to call both the
973
# old and new functions, so both the old and new
974
# signals gets sent when the function is called
975
def fixscope(func1, func2):
976
"""This function is a scope container to pass
977
func1 and func2 to the "call_both" function
978
outside of its arguments"""
979
def call_both(*args, **kwargs):
980
"""This function will emit two D-Bus
981
signals by calling func1 and func2"""
982
func1(*args, **kwargs)
983
func2(*args, **kwargs)
985
# Create the "call_both" function and add it to
987
attr[attrname] = fixscope(attribute,
989
# Is this a D-Bus method?
990
elif getattr(attribute, "_dbus_is_method", False):
991
# Create a new, but exactly alike, function
992
# object. Decorate it to be a new D-Bus method
993
# with the alternate D-Bus interface name. Add it
995
attr[attrname] = (dbus.service.method
997
attribute._dbus_in_signature,
998
attribute._dbus_out_signature)
1000
(attribute.func_code,
1001
attribute.func_globals,
1002
attribute.func_name,
1003
attribute.func_defaults,
1004
attribute.func_closure)))
1005
# Is this a D-Bus property?
1006
elif getattr(attribute, "_dbus_is_property", False):
1007
# Create a new, but exactly alike, function
1008
# object, and decorate it to be a new D-Bus
1009
# property with the alternate D-Bus interface
1010
# name. Add it to the class.
1011
attr[attrname] = (dbus_service_property
1013
attribute._dbus_signature,
1014
attribute._dbus_access,
1016
._dbus_get_args_options
1019
(attribute.func_code,
1020
attribute.func_globals,
1021
attribute.func_name,
1022
attribute.func_defaults,
1023
attribute.func_closure)))
1024
return type.__new__(mcs, name, bases, attr)
1027
class ClientDBus(Client, DBusObjectWithProperties):
1028
"""A Client class using D-Bus
1031
dbus_object_path: dbus.ObjectPath
1032
bus: dbus.SystemBus()
1035
runtime_expansions = (Client.runtime_expansions
1036
+ ("dbus_object_path",))
1038
# dbus.service.Object doesn't use super(), so we can't either.
1040
def __init__(self, bus = None, *args, **kwargs):
1042
Client.__init__(self, *args, **kwargs)
1044
self._approvals_pending = 0
1045
# Only now, when this client is initialized, can it show up on
1047
client_object_name = unicode(self.name).translate(
1048
{ord("."): ord("_"),
1049
ord("-"): ord("_")})
1050
self.dbus_object_path = (dbus.ObjectPath
1051
("/clients/" + client_object_name))
1052
DBusObjectWithProperties.__init__(self, self.bus,
1053
self.dbus_object_path)
1055
def notifychangeproperty(transform_func,
1056
dbus_name, type_func=lambda x: x,
1058
""" Modify a variable so that it's a property which announces
1059
its changes to DBus.
1061
transform_fun: Function that takes a value and a variant_level
1062
and transforms it to a D-Bus type.
1063
dbus_name: D-Bus name of the variable
1064
type_func: Function that transform the value before sending it
1065
to the D-Bus. Default: no transform
1066
variant_level: D-Bus variant level. Default: 1
1068
attrname = "_{0}".format(dbus_name)
1069
def setter(self, value):
1070
if hasattr(self, "dbus_object_path"):
1071
if (not hasattr(self, attrname) or
1072
type_func(getattr(self, attrname, None))
1073
!= type_func(value)):
1074
dbus_value = transform_func(type_func(value),
1077
self.PropertyChanged(dbus.String(dbus_name),
1079
setattr(self, attrname, value)
1081
return property(lambda self: getattr(self, attrname), setter)
1084
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1085
approvals_pending = notifychangeproperty(dbus.Boolean,
1088
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1089
last_enabled = notifychangeproperty(datetime_to_dbus,
1091
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1092
type_func = lambda checker:
1093
checker is not None)
1094
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1096
last_approval_request = notifychangeproperty(
1097
datetime_to_dbus, "LastApprovalRequest")
1098
approved_by_default = notifychangeproperty(dbus.Boolean,
1099
"ApprovedByDefault")
1100
approval_delay = notifychangeproperty(dbus.UInt64,
1103
timedelta_to_milliseconds)
1104
approval_duration = notifychangeproperty(
1105
dbus.UInt64, "ApprovalDuration",
1106
type_func = timedelta_to_milliseconds)
1107
host = notifychangeproperty(dbus.String, "Host")
1108
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1110
timedelta_to_milliseconds)
1111
extended_timeout = notifychangeproperty(
1112
dbus.UInt64, "ExtendedTimeout",
1113
type_func = timedelta_to_milliseconds)
1114
interval = notifychangeproperty(dbus.UInt64,
1117
timedelta_to_milliseconds)
1118
checker_command = notifychangeproperty(dbus.String, "Checker")
1120
del notifychangeproperty
1122
def __del__(self, *args, **kwargs):
1124
self.remove_from_connection()
1127
if hasattr(DBusObjectWithProperties, "__del__"):
1128
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1129
Client.__del__(self, *args, **kwargs)
1131
def checker_callback(self, pid, condition, command,
1133
self.checker_callback_tag = None
1135
if os.WIFEXITED(condition):
1136
exitstatus = os.WEXITSTATUS(condition)
1138
self.CheckerCompleted(dbus.Int16(exitstatus),
1139
dbus.Int64(condition),
1140
dbus.String(command))
1143
self.CheckerCompleted(dbus.Int16(-1),
1144
dbus.Int64(condition),
1145
dbus.String(command))
1147
return Client.checker_callback(self, pid, condition, command,
1150
def start_checker(self, *args, **kwargs):
1151
old_checker = self.checker
1152
if self.checker is not None:
1153
old_checker_pid = self.checker.pid
1155
old_checker_pid = None
1156
r = Client.start_checker(self, *args, **kwargs)
1157
# Only if new checker process was started
1158
if (self.checker is not None
1159
and old_checker_pid != self.checker.pid):
1161
self.CheckerStarted(self.current_checker_command)
1164
def _reset_approved(self):
1165
self.approved = None
1168
def approve(self, value=True):
1169
self.send_changedstate()
1170
self.approved = value
1171
gobject.timeout_add(timedelta_to_milliseconds
1172
(self.approval_duration),
1173
self._reset_approved)
1176
## D-Bus methods, signals & properties
1177
_interface = "se.recompile.Mandos.Client"
1181
# CheckerCompleted - signal
1182
@dbus.service.signal(_interface, signature="nxs")
1183
def CheckerCompleted(self, exitcode, waitstatus, command):
1187
# CheckerStarted - signal
1188
@dbus.service.signal(_interface, signature="s")
1189
def CheckerStarted(self, command):
1193
# PropertyChanged - signal
1194
@dbus.service.signal(_interface, signature="sv")
1195
def PropertyChanged(self, property, value):
1199
# GotSecret - signal
1200
@dbus.service.signal(_interface)
1201
def GotSecret(self):
1203
Is sent after a successful transfer of secret from the Mandos
1204
server to mandos-client
1209
@dbus.service.signal(_interface, signature="s")
1210
def Rejected(self, reason):
1214
# NeedApproval - signal
1215
@dbus.service.signal(_interface, signature="tb")
1216
def NeedApproval(self, timeout, default):
1218
return self.need_approval()
1220
# NeRwequest - signal
1221
@dbus.service.signal(_interface, signature="s")
1222
def NewRequest(self, ip):
1224
Is sent after a client request a password.
1231
@dbus.service.method(_interface, in_signature="b")
1232
def Approve(self, value):
1235
# CheckedOK - method
1236
@dbus.service.method(_interface)
1237
def CheckedOK(self):
1241
@dbus.service.method(_interface)
1246
# StartChecker - method
1247
@dbus.service.method(_interface)
1248
def StartChecker(self):
1250
self.start_checker()
1253
@dbus.service.method(_interface)
1258
# StopChecker - method
1259
@dbus.service.method(_interface)
1260
def StopChecker(self):
1265
# ApprovalPending - property
1266
@dbus_service_property(_interface, signature="b", access="read")
1267
def ApprovalPending_dbus_property(self):
1268
return dbus.Boolean(bool(self.approvals_pending))
1270
# ApprovedByDefault - property
1271
@dbus_service_property(_interface, signature="b",
1273
def ApprovedByDefault_dbus_property(self, value=None):
1274
if value is None: # get
1275
return dbus.Boolean(self.approved_by_default)
1276
self.approved_by_default = bool(value)
1278
# ApprovalDelay - property
1279
@dbus_service_property(_interface, signature="t",
1281
def ApprovalDelay_dbus_property(self, value=None):
1282
if value is None: # get
1283
return dbus.UInt64(self.approval_delay_milliseconds())
1284
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1286
# ApprovalDuration - property
1287
@dbus_service_property(_interface, signature="t",
1289
def ApprovalDuration_dbus_property(self, value=None):
1290
if value is None: # get
1291
return dbus.UInt64(timedelta_to_milliseconds(
1292
self.approval_duration))
1293
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1296
@dbus_service_property(_interface, signature="s", access="read")
1297
def Name_dbus_property(self):
1298
return dbus.String(self.name)
1300
# Fingerprint - property
1301
@dbus_service_property(_interface, signature="s", access="read")
1302
def Fingerprint_dbus_property(self):
1303
return dbus.String(self.fingerprint)
1306
@dbus_service_property(_interface, signature="s",
1308
def Host_dbus_property(self, value=None):
1309
if value is None: # get
1310
return dbus.String(self.host)
1311
self.host = unicode(value)
1313
# Created - property
1314
@dbus_service_property(_interface, signature="s", access="read")
1315
def Created_dbus_property(self):
1316
return datetime_to_dbus(self.created)
1318
# LastEnabled - property
1319
@dbus_service_property(_interface, signature="s", access="read")
1320
def LastEnabled_dbus_property(self):
1321
return datetime_to_dbus(self.last_enabled)
1323
# Enabled - property
1324
@dbus_service_property(_interface, signature="b",
1326
def Enabled_dbus_property(self, value=None):
1327
if value is None: # get
1328
return dbus.Boolean(self.enabled)
1334
# LastCheckedOK - property
1335
@dbus_service_property(_interface, signature="s",
1337
def LastCheckedOK_dbus_property(self, value=None):
1338
if value is not None:
1341
return datetime_to_dbus(self.last_checked_ok)
1343
# Expires - property
1344
@dbus_service_property(_interface, signature="s", access="read")
1345
def Expires_dbus_property(self):
1346
return datetime_to_dbus(self.expires)
1348
# LastApprovalRequest - property
1349
@dbus_service_property(_interface, signature="s", access="read")
1350
def LastApprovalRequest_dbus_property(self):
1351
return datetime_to_dbus(self.last_approval_request)
1353
# Timeout - property
1354
@dbus_service_property(_interface, signature="t",
1356
def Timeout_dbus_property(self, value=None):
1357
if value is None: # get
1358
return dbus.UInt64(self.timeout_milliseconds())
1359
self.timeout = datetime.timedelta(0, 0, 0, value)
1360
if getattr(self, "disable_initiator_tag", None) is None:
1362
# Reschedule timeout
1363
gobject.source_remove(self.disable_initiator_tag)
1364
self.disable_initiator_tag = None
1366
time_to_die = timedelta_to_milliseconds((self
1371
if time_to_die <= 0:
1372
# The timeout has passed
1375
self.expires = (datetime.datetime.utcnow()
1376
+ datetime.timedelta(milliseconds =
1378
self.disable_initiator_tag = (gobject.timeout_add
1379
(time_to_die, self.disable))
1381
# ExtendedTimeout - property
1382
@dbus_service_property(_interface, signature="t",
1384
def ExtendedTimeout_dbus_property(self, value=None):
1385
if value is None: # get
1386
return dbus.UInt64(self.extended_timeout_milliseconds())
1387
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1389
# Interval - property
1390
@dbus_service_property(_interface, signature="t",
1392
def Interval_dbus_property(self, value=None):
1393
if value is None: # get
1394
return dbus.UInt64(self.interval_milliseconds())
1395
self.interval = datetime.timedelta(0, 0, 0, value)
1396
if getattr(self, "checker_initiator_tag", None) is None:
1399
# Reschedule checker run
1400
gobject.source_remove(self.checker_initiator_tag)
1401
self.checker_initiator_tag = (gobject.timeout_add
1402
(value, self.start_checker))
1403
self.start_checker() # Start one now, too
1405
# Checker - property
1406
@dbus_service_property(_interface, signature="s",
1408
def Checker_dbus_property(self, value=None):
1409
if value is None: # get
1410
return dbus.String(self.checker_command)
1411
self.checker_command = unicode(value)
1413
# CheckerRunning - property
1414
@dbus_service_property(_interface, signature="b",
1416
def CheckerRunning_dbus_property(self, value=None):
1417
if value is None: # get
1418
return dbus.Boolean(self.checker is not None)
1420
self.start_checker()
1424
# ObjectPath - property
1425
@dbus_service_property(_interface, signature="o", access="read")
1426
def ObjectPath_dbus_property(self):
1427
return self.dbus_object_path # is already a dbus.ObjectPath
1430
@dbus_service_property(_interface, signature="ay",
1431
access="write", byte_arrays=True)
1432
def Secret_dbus_property(self, value):
1433
self.secret = str(value)
1438
class ProxyClient(object):
1439
def __init__(self, child_pipe, fpr, address):
1440
self._pipe = child_pipe
1441
self._pipe.send(('init', fpr, address))
1442
if not self._pipe.recv():
1445
def __getattribute__(self, name):
1447
return super(ProxyClient, self).__getattribute__(name)
1448
self._pipe.send(('getattr', name))
1449
data = self._pipe.recv()
1450
if data[0] == 'data':
1452
if data[0] == 'function':
1453
def func(*args, **kwargs):
1454
self._pipe.send(('funcall', name, args, kwargs))
1455
return self._pipe.recv()[1]
1458
def __setattr__(self, name, value):
1460
return super(ProxyClient, self).__setattr__(name, value)
1461
self._pipe.send(('setattr', name, value))
1464
class ClientDBusTransitional(ClientDBus):
1465
__metaclass__ = AlternateDBusNamesMetaclass
1468
class ClientHandler(socketserver.BaseRequestHandler, object):
1469
"""A class to handle client connections.
1471
Instantiated once for each connection to handle it.
442
1472
Note: This will run in its own forked process."""
444
1474
def handle(self):
445
logger.info(u"TCP connection from: %s",
446
unicode(self.client_address))
447
session = gnutls.connection.ClientSession\
448
(self.request, gnutls.connection.X509Credentials())
450
line = self.request.makefile().readline()
451
logger.debug(u"Protocol version: %r", line)
453
if int(line.strip().split()[0]) > 1:
455
except (ValueError, IndexError, RuntimeError), error:
456
logger.error(u"Unknown protocol version: %s", error)
459
# Note: gnutls.connection.X509Credentials is really a generic
460
# GnuTLS certificate credentials object so long as no X.509
461
# keys are added to it. Therefore, we can use it here despite
462
# using OpenPGP certificates.
464
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
465
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
467
priority = "NORMAL" # Fallback default, since this
469
if self.server.settings["priority"]:
470
priority = self.server.settings["priority"]
471
gnutls.library.functions.gnutls_priority_set_direct\
472
(session._c_object, priority, None);
476
except gnutls.errors.GNUTLSError, error:
477
logger.warning(u"Handshake failed: %s", error)
478
# Do not run session.bye() here: the session is not
479
# established. Just abandon the request.
482
fpr = fingerprint(peer_certificate(session))
483
except (TypeError, gnutls.errors.GNUTLSError), error:
484
logger.warning(u"Bad certificate: %s", error)
487
logger.debug(u"Fingerprint: %s", fpr)
489
for c in self.server.clients:
490
if c.fingerprint == fpr:
494
logger.warning(u"Client not found for fingerprint: %s",
498
# Have to check if client.still_valid(), since it is possible
499
# that the client timed out while establishing the GnuTLS
501
if not client.still_valid():
502
logger.warning(u"Client %(name)s is invalid",
507
while sent_size < len(client.secret):
508
sent = session.send(client.secret[sent_size:])
509
logger.debug(u"Sent: %d, remaining: %d",
510
sent, len(client.secret)
511
- (sent_size + sent))
516
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
517
"""IPv6 TCP server. Accepts 'None' as address and/or port.
1475
with contextlib.closing(self.server.child_pipe) as child_pipe:
1476
logger.info("TCP connection from: %s",
1477
unicode(self.client_address))
1478
logger.debug("Pipe FD: %d",
1479
self.server.child_pipe.fileno())
1481
session = (gnutls.connection
1482
.ClientSession(self.request,
1484
.X509Credentials()))
1486
# Note: gnutls.connection.X509Credentials is really a
1487
# generic GnuTLS certificate credentials object so long as
1488
# no X.509 keys are added to it. Therefore, we can use it
1489
# here despite using OpenPGP certificates.
1491
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1492
# "+AES-256-CBC", "+SHA1",
1493
# "+COMP-NULL", "+CTYPE-OPENPGP",
1495
# Use a fallback default, since this MUST be set.
1496
priority = self.server.gnutls_priority
1497
if priority is None:
1499
(gnutls.library.functions
1500
.gnutls_priority_set_direct(session._c_object,
1503
# Start communication using the Mandos protocol
1504
# Get protocol number
1505
line = self.request.makefile().readline()
1506
logger.debug("Protocol version: %r", line)
1508
if int(line.strip().split()[0]) > 1:
1510
except (ValueError, IndexError, RuntimeError) as error:
1511
logger.error("Unknown protocol version: %s", error)
1514
# Start GnuTLS connection
1517
except gnutls.errors.GNUTLSError as error:
1518
logger.warning("Handshake failed: %s", error)
1519
# Do not run session.bye() here: the session is not
1520
# established. Just abandon the request.
1522
logger.debug("Handshake succeeded")
1524
approval_required = False
1527
fpr = self.fingerprint(self.peer_certificate
1530
gnutls.errors.GNUTLSError) as error:
1531
logger.warning("Bad certificate: %s", error)
1533
logger.debug("Fingerprint: %s", fpr)
1536
client = ProxyClient(child_pipe, fpr,
1537
self.client_address)
1541
if self.server.use_dbus:
1543
client.NewRequest(str(self.client_address))
1545
if client.approval_delay:
1546
delay = client.approval_delay
1547
client.approvals_pending += 1
1548
approval_required = True
1551
if not client.enabled:
1552
logger.info("Client %s is disabled",
1554
if self.server.use_dbus:
1556
client.Rejected("Disabled")
1559
if client.approved or not client.approval_delay:
1560
#We are approved or approval is disabled
1562
elif client.approved is None:
1563
logger.info("Client %s needs approval",
1565
if self.server.use_dbus:
1567
client.NeedApproval(
1568
client.approval_delay_milliseconds(),
1569
client.approved_by_default)
1571
logger.warning("Client %s was not approved",
1573
if self.server.use_dbus:
1575
client.Rejected("Denied")
1578
#wait until timeout or approved
1579
time = datetime.datetime.now()
1580
client.changedstate.acquire()
1581
(client.changedstate.wait
1582
(float(client.timedelta_to_milliseconds(delay)
1584
client.changedstate.release()
1585
time2 = datetime.datetime.now()
1586
if (time2 - time) >= delay:
1587
if not client.approved_by_default:
1588
logger.warning("Client %s timed out while"
1589
" waiting for approval",
1591
if self.server.use_dbus:
1593
client.Rejected("Approval timed out")
1598
delay -= time2 - time
1601
while sent_size < len(client.secret):
1603
sent = session.send(client.secret[sent_size:])
1604
except gnutls.errors.GNUTLSError as error:
1605
logger.warning("gnutls send failed")
1607
logger.debug("Sent: %d, remaining: %d",
1608
sent, len(client.secret)
1609
- (sent_size + sent))
1612
logger.info("Sending secret to %s", client.name)
1613
# bump the timeout using extended_timeout
1614
client.checked_ok(client.extended_timeout)
1615
if self.server.use_dbus:
1620
if approval_required:
1621
client.approvals_pending -= 1
1624
except gnutls.errors.GNUTLSError as error:
1625
logger.warning("GnuTLS bye failed")
1628
def peer_certificate(session):
1629
"Return the peer's OpenPGP certificate as a bytestring"
1630
# If not an OpenPGP certificate...
1631
if (gnutls.library.functions
1632
.gnutls_certificate_type_get(session._c_object)
1633
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1634
# ...do the normal thing
1635
return session.peer_certificate
1636
list_size = ctypes.c_uint(1)
1637
cert_list = (gnutls.library.functions
1638
.gnutls_certificate_get_peers
1639
(session._c_object, ctypes.byref(list_size)))
1640
if not bool(cert_list) and list_size.value != 0:
1641
raise gnutls.errors.GNUTLSError("error getting peer"
1643
if list_size.value == 0:
1646
return ctypes.string_at(cert.data, cert.size)
1649
def fingerprint(openpgp):
1650
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1651
# New GnuTLS "datum" with the OpenPGP public key
1652
datum = (gnutls.library.types
1653
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1656
ctypes.c_uint(len(openpgp))))
1657
# New empty GnuTLS certificate
1658
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1659
(gnutls.library.functions
1660
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1661
# Import the OpenPGP public key into the certificate
1662
(gnutls.library.functions
1663
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1664
gnutls.library.constants
1665
.GNUTLS_OPENPGP_FMT_RAW))
1666
# Verify the self signature in the key
1667
crtverify = ctypes.c_uint()
1668
(gnutls.library.functions
1669
.gnutls_openpgp_crt_verify_self(crt, 0,
1670
ctypes.byref(crtverify)))
1671
if crtverify.value != 0:
1672
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1673
raise (gnutls.errors.CertificateSecurityError
1675
# New buffer for the fingerprint
1676
buf = ctypes.create_string_buffer(20)
1677
buf_len = ctypes.c_size_t()
1678
# Get the fingerprint from the certificate into the buffer
1679
(gnutls.library.functions
1680
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1681
ctypes.byref(buf_len)))
1682
# Deinit the certificate
1683
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1684
# Convert the buffer to a Python bytestring
1685
fpr = ctypes.string_at(buf, buf_len.value)
1686
# Convert the bytestring to hexadecimal notation
1687
hex_fpr = binascii.hexlify(fpr).upper()
1691
class MultiprocessingMixIn(object):
1692
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1693
def sub_process_main(self, request, address):
1695
self.finish_request(request, address)
1697
self.handle_error(request, address)
1698
self.close_request(request)
1700
def process_request(self, request, address):
1701
"""Start a new process to process the request."""
1702
proc = multiprocessing.Process(target = self.sub_process_main,
1709
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1710
""" adds a pipe to the MixIn """
1711
def process_request(self, request, client_address):
1712
"""Overrides and wraps the original process_request().
1714
This function creates a new pipe in self.pipe
1716
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1718
proc = MultiprocessingMixIn.process_request(self, request,
1720
self.child_pipe.close()
1721
self.add_pipe(parent_pipe, proc)
1723
def add_pipe(self, parent_pipe, proc):
1724
"""Dummy function; override as necessary"""
1725
raise NotImplementedError
1728
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1729
socketserver.TCPServer, object):
1730
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
519
settings: Server settings
520
clients: Set() of Client objects
521
1733
enabled: Boolean; whether this server is activated yet
1734
interface: None or a network interface name (string)
1735
use_ipv6: Boolean; to use IPv6 or not
523
address_family = socket.AF_INET6
524
def __init__(self, *args, **kwargs):
525
if "settings" in kwargs:
526
self.settings = kwargs["settings"]
527
del kwargs["settings"]
528
if "clients" in kwargs:
529
self.clients = kwargs["clients"]
530
del kwargs["clients"]
532
return super(type(self), self).__init__(*args, **kwargs)
1737
def __init__(self, server_address, RequestHandlerClass,
1738
interface=None, use_ipv6=True):
1739
self.interface = interface
1741
self.address_family = socket.AF_INET6
1742
socketserver.TCPServer.__init__(self, server_address,
1743
RequestHandlerClass)
533
1744
def server_bind(self):
534
1745
"""This overrides the normal server_bind() function
535
1746
to bind to an interface if one was specified, and also NOT to
536
1747
bind to an address or port if they were not specified."""
537
if self.settings["interface"]:
538
# 25 is from /usr/include/asm-i486/socket.h
539
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
541
self.socket.setsockopt(socket.SOL_SOCKET,
543
self.settings["interface"])
544
except socket.error, error:
545
if error[0] == errno.EPERM:
546
logger.error(u"No permission to"
547
u" bind to interface %s",
548
self.settings["interface"])
1748
if self.interface is not None:
1749
if SO_BINDTODEVICE is None:
1750
logger.error("SO_BINDTODEVICE does not exist;"
1751
" cannot bind to interface %s",
1755
self.socket.setsockopt(socket.SOL_SOCKET,
1759
except socket.error as error:
1760
if error[0] == errno.EPERM:
1761
logger.error("No permission to"
1762
" bind to interface %s",
1764
elif error[0] == errno.ENOPROTOOPT:
1765
logger.error("SO_BINDTODEVICE not available;"
1766
" cannot bind to interface %s",
551
1770
# Only bind(2) the socket if we really need to.
552
1771
if self.server_address[0] or self.server_address[1]:
553
1772
if not self.server_address[0]:
555
self.server_address = (in6addr_any,
1773
if self.address_family == socket.AF_INET6:
1774
any_address = "::" # in6addr_any
1776
any_address = socket.INADDR_ANY
1777
self.server_address = (any_address,
556
1778
self.server_address[1])
557
1779
elif not self.server_address[1]:
558
1780
self.server_address = (self.server_address[0],
560
# if self.settings["interface"]:
1782
# if self.interface:
561
1783
# self.server_address = (self.server_address[0],
564
1786
# if_nametoindex
567
return super(type(self), self).server_bind()
1788
return socketserver.TCPServer.server_bind(self)
1791
class MandosServer(IPv6_TCPServer):
1795
clients: set of Client objects
1796
gnutls_priority GnuTLS priority string
1797
use_dbus: Boolean; to emit D-Bus signals or not
1799
Assumes a gobject.MainLoop event loop.
1801
def __init__(self, server_address, RequestHandlerClass,
1802
interface=None, use_ipv6=True, clients=None,
1803
gnutls_priority=None, use_dbus=True):
1804
self.enabled = False
1805
self.clients = clients
1806
if self.clients is None:
1808
self.use_dbus = use_dbus
1809
self.gnutls_priority = gnutls_priority
1810
IPv6_TCPServer.__init__(self, server_address,
1811
RequestHandlerClass,
1812
interface = interface,
1813
use_ipv6 = use_ipv6)
568
1814
def server_activate(self):
569
1815
if self.enabled:
570
return super(type(self), self).server_activate()
1816
return socketserver.TCPServer.server_activate(self)
571
1818
def enable(self):
572
1819
self.enabled = True
1821
def add_pipe(self, parent_pipe, proc):
1822
# Call "handle_ipc" for both data and EOF events
1823
gobject.io_add_watch(parent_pipe.fileno(),
1824
gobject.IO_IN | gobject.IO_HUP,
1825
functools.partial(self.handle_ipc,
1830
def handle_ipc(self, source, condition, parent_pipe=None,
1831
proc = None, client_object=None):
1833
gobject.IO_IN: "IN", # There is data to read.
1834
gobject.IO_OUT: "OUT", # Data can be written (without
1836
gobject.IO_PRI: "PRI", # There is urgent data to read.
1837
gobject.IO_ERR: "ERR", # Error condition.
1838
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1839
# broken, usually for pipes and
1842
conditions_string = ' | '.join(name
1844
condition_names.iteritems()
1845
if cond & condition)
1846
# error, or the other end of multiprocessing.Pipe has closed
1847
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1848
# Wait for other process to exit
1852
# Read a request from the child
1853
request = parent_pipe.recv()
1854
command = request[0]
1856
if command == 'init':
1858
address = request[2]
1860
for c in self.clients.itervalues():
1861
if c.fingerprint == fpr:
1865
logger.info("Client not found for fingerprint: %s, ad"
1866
"dress: %s", fpr, address)
1869
mandos_dbus_service.ClientNotFound(fpr,
1871
parent_pipe.send(False)
1874
gobject.io_add_watch(parent_pipe.fileno(),
1875
gobject.IO_IN | gobject.IO_HUP,
1876
functools.partial(self.handle_ipc,
1882
parent_pipe.send(True)
1883
# remove the old hook in favor of the new above hook on
1886
if command == 'funcall':
1887
funcname = request[1]
1891
parent_pipe.send(('data', getattr(client_object,
1895
if command == 'getattr':
1896
attrname = request[1]
1897
if callable(client_object.__getattribute__(attrname)):
1898
parent_pipe.send(('function',))
1900
parent_pipe.send(('data', client_object
1901
.__getattribute__(attrname)))
1903
if command == 'setattr':
1904
attrname = request[1]
1906
setattr(client_object, attrname, value)
575
1911
def string_to_delta(interval):
576
1912
"""Parse a string and return a datetime.timedelta
578
1914
>>> string_to_delta('7d')
579
1915
datetime.timedelta(7)
580
1916
>>> string_to_delta('60s')
722
2029
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
723
2030
"servicename": "Mandos",
2035
"statedir": "/var/lib/mandos"
726
2038
# Parse config file for server-global settings
727
server_config = ConfigParser.SafeConfigParser(server_defaults)
2039
server_config = configparser.SafeConfigParser(server_defaults)
728
2040
del server_defaults
729
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2041
server_config.read(os.path.join(options.configdir,
730
2043
# Convert the SafeConfigParser object to a dict
731
2044
server_settings = server_config.defaults()
732
# Use getboolean on the boolean config option
733
server_settings["debug"] = server_config.getboolean\
2045
# Use the appropriate methods on the non-string config options
2046
for option in ("debug", "use_dbus", "use_ipv6"):
2047
server_settings[option] = server_config.getboolean("DEFAULT",
2049
if server_settings["port"]:
2050
server_settings["port"] = server_config.getint("DEFAULT",
735
2052
del server_config
737
2054
# Override the settings from the config file with command line
738
2055
# options, if set.
739
2056
for option in ("interface", "address", "port", "debug",
740
"priority", "servicename", "configdir"):
2057
"priority", "servicename", "configdir",
2058
"use_dbus", "use_ipv6", "debuglevel", "restore",
741
2060
value = getattr(options, option)
742
2061
if value is not None:
743
2062
server_settings[option] = value
2064
# Force all strings to be unicode
2065
for option in server_settings.keys():
2066
if type(server_settings[option]) is str:
2067
server_settings[option] = unicode(server_settings[option])
745
2068
# Now we have our good server settings in "server_settings"
2070
##################################################################
747
2073
debug = server_settings["debug"]
2074
debuglevel = server_settings["debuglevel"]
2075
use_dbus = server_settings["use_dbus"]
2076
use_ipv6 = server_settings["use_ipv6"]
2077
stored_state_path = os.path.join(server_settings["statedir"],
750
syslogger.setLevel(logging.WARNING)
751
console.setLevel(logging.WARNING)
2081
initlogger(logging.DEBUG)
2086
level = getattr(logging, debuglevel.upper())
753
2089
if server_settings["servicename"] != "Mandos":
754
syslogger.setFormatter(logging.Formatter\
755
('Mandos (%s): %%(levelname)s:'
2090
syslogger.setFormatter(logging.Formatter
2091
('Mandos (%s) [%%(process)d]:'
2092
' %%(levelname)s: %%(message)s'
757
2093
% server_settings["servicename"]))
759
2095
# Parse config file with clients
760
client_defaults = { "timeout": "1h",
762
"checker": "fping -q -- %(host)s",
765
client_config = ConfigParser.SafeConfigParser(client_defaults)
2096
client_config = configparser.SafeConfigParser(Client.client_defaults)
766
2097
client_config.read(os.path.join(server_settings["configdir"],
767
2098
"clients.conf"))
770
tcp_server = IPv6_TCPServer((server_settings["address"],
771
server_settings["port"]),
773
settings=server_settings,
775
pidfilename = "/var/run/mandos.pid"
777
pidfile = open(pidfilename, "w")
778
except IOError, error:
779
logger.error("Could not open file %r", pidfilename)
784
uid = pwd.getpwnam("mandos").pw_uid
787
uid = pwd.getpwnam("nobody").pw_uid
791
gid = pwd.getpwnam("mandos").pw_gid
794
gid = pwd.getpwnam("nogroup").pw_gid
2100
global mandos_dbus_service
2101
mandos_dbus_service = None
2103
tcp_server = MandosServer((server_settings["address"],
2104
server_settings["port"]),
2106
interface=(server_settings["interface"]
2110
server_settings["priority"],
2113
pidfilename = "/var/run/mandos.pid"
2115
pidfile = open(pidfilename, "w")
2117
logger.error("Could not open file %r", pidfilename)
2120
uid = pwd.getpwnam("_mandos").pw_uid
2121
gid = pwd.getpwnam("_mandos").pw_gid
2124
uid = pwd.getpwnam("mandos").pw_uid
2125
gid = pwd.getpwnam("mandos").pw_gid
2128
uid = pwd.getpwnam("nobody").pw_uid
2129
gid = pwd.getpwnam("nobody").pw_gid
800
except OSError, error:
2136
except OSError as error:
801
2137
if error[0] != errno.EPERM:
805
service = AvahiService(name = server_settings["servicename"],
806
type = "_mandos._tcp", );
807
if server_settings["interface"]:
808
service.interface = if_nametoindex\
809
(server_settings["interface"])
2141
# Enable all possible GnuTLS debugging
2143
# "Use a log level over 10 to enable all debugging options."
2145
gnutls.library.functions.gnutls_global_set_log_level(11)
2147
@gnutls.library.types.gnutls_log_func
2148
def debug_gnutls(level, string):
2149
logger.debug("GnuTLS: %s", string[:-1])
2151
(gnutls.library.functions
2152
.gnutls_global_set_log_function(debug_gnutls))
2154
# Redirect stdin so all checkers get /dev/null
2155
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2156
os.dup2(null, sys.stdin.fileno())
2160
# No console logging
2161
logger.removeHandler(console)
2163
# Need to fork before connecting to D-Bus
2165
# Close all input and output, do double fork, etc.
811
2168
global main_loop
814
2169
# From the Avahi example code
815
2170
DBusGMainLoop(set_as_default=True )
816
2171
main_loop = gobject.MainLoop()
817
2172
bus = dbus.SystemBus()
818
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
819
avahi.DBUS_PATH_SERVER),
820
avahi.DBUS_INTERFACE_SERVER)
821
2173
# End of Avahi example code
823
def remove_from_clients(client):
824
clients.remove(client)
826
logger.critical(u"No clients left, exiting")
829
clients.update(Set(Client(name = section,
830
stop_hook = remove_from_clients,
832
= dict(client_config.items(section)))
833
for section in client_config.sections()))
835
logger.critical(u"No clients defined")
839
# Redirect stdin so all checkers get /dev/null
840
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
841
os.dup2(null, sys.stdin.fileno())
846
logger.removeHandler(console)
847
# Close all input and output, do double fork, etc.
852
pidfile.write(str(pid) + "\n")
856
logger.error(u"Could not write to file %r with PID %d",
859
# "pidfile" was never created
2176
bus_name = dbus.service.BusName("se.recompile.Mandos",
2177
bus, do_not_queue=True)
2178
old_bus_name = (dbus.service.BusName
2179
("se.bsnet.fukt.Mandos", bus,
2181
except dbus.exceptions.NameExistsException as e:
2182
logger.error(unicode(e) + ", disabling D-Bus")
2184
server_settings["use_dbus"] = False
2185
tcp_server.use_dbus = False
2186
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2187
service = AvahiServiceToSyslog(name =
2188
server_settings["servicename"],
2189
servicetype = "_mandos._tcp",
2190
protocol = protocol, bus = bus)
2191
if server_settings["interface"]:
2192
service.interface = (if_nametoindex
2193
(str(server_settings["interface"])))
2195
global multiprocessing_manager
2196
multiprocessing_manager = multiprocessing.Manager()
2198
client_class = Client
2200
client_class = functools.partial(ClientDBusTransitional,
2203
client_settings = Client.config_parser(client_config)
2204
old_client_settings = {}
2207
# Get client data and settings from last running state.
2208
if server_settings["restore"]:
2210
with open(stored_state_path, "rb") as stored_state:
2211
clients_data, old_client_settings = (pickle.load
2213
os.remove(stored_state_path)
2214
except IOError as e:
2215
logger.warning("Could not load persistent state: {0}"
2217
if e.errno != errno.ENOENT:
2220
with PGPEngine() as pgp:
2221
for client_name, client in clients_data.iteritems():
2222
# Decide which value to use after restoring saved state.
2223
# We have three different values: Old config file,
2224
# new config file, and saved state.
2225
# New config value takes precedence if it differs from old
2226
# config value, otherwise use saved state.
2227
for name, value in client_settings[client_name].items():
2229
# For each value in new config, check if it
2230
# differs from the old config value (Except for
2231
# the "secret" attribute)
2232
if (name != "secret" and
2233
value != old_client_settings[client_name]
2235
client[name] = value
2239
# Clients who has passed its expire date can still be
2240
# enabled if its last checker was successful. Clients
2241
# whose checker failed before we stored its state is
2242
# assumed to have failed all checkers during downtime.
2243
if client["enabled"]:
2244
if datetime.datetime.utcnow() >= client["expires"]:
2245
if not client["last_checked_ok"]:
2247
"disabling client {0} - Client never "
2248
"performed a successfull checker"
2249
.format(client["name"]))
2250
client["enabled"] = False
2251
elif client["last_checker_status"] != 0:
2253
"disabling client {0} - Client "
2254
"last checker failed with error code {1}"
2255
.format(client["name"],
2256
client["last_checker_status"]))
2257
client["enabled"] = False
2259
client["expires"] = (datetime.datetime
2261
+ client["timeout"])
2264
client["secret"] = (
2265
pgp.decrypt(client["encrypted_secret"],
2266
client_settings[client_name]
2269
# If decryption fails, we use secret from new settings
2270
logger.debug("Failed to decrypt {0} old secret"
2271
.format(client_name))
2272
client["secret"] = (
2273
client_settings[client_name]["secret"])
2276
# Add/remove clients based on new changes made to config
2277
for client_name in set(old_client_settings) - set(client_settings):
2278
del clients_data[client_name]
2279
for client_name in set(client_settings) - set(old_client_settings):
2280
clients_data[client_name] = client_settings[client_name]
2282
# Create clients all clients
2283
for client_name, client in clients_data.iteritems():
2284
tcp_server.clients[client_name] = client_class(
2285
name = client_name, settings = client)
2287
if not tcp_server.clients:
2288
logger.warning("No clients defined")
2294
pidfile.write(str(pid) + "\n".encode("utf-8"))
2297
logger.error("Could not write to file %r with PID %d",
2300
# "pidfile" was never created
2303
signal.signal(signal.SIGINT, signal.SIG_IGN)
2305
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2306
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2309
class MandosDBusService(dbus.service.Object):
2310
"""A D-Bus proxy object"""
2312
dbus.service.Object.__init__(self, bus, "/")
2313
_interface = "se.recompile.Mandos"
2315
@dbus.service.signal(_interface, signature="o")
2316
def ClientAdded(self, objpath):
2320
@dbus.service.signal(_interface, signature="ss")
2321
def ClientNotFound(self, fingerprint, address):
2325
@dbus.service.signal(_interface, signature="os")
2326
def ClientRemoved(self, objpath, name):
2330
@dbus.service.method(_interface, out_signature="ao")
2331
def GetAllClients(self):
2333
return dbus.Array(c.dbus_object_path
2335
tcp_server.clients.itervalues())
2337
@dbus.service.method(_interface,
2338
out_signature="a{oa{sv}}")
2339
def GetAllClientsWithProperties(self):
2341
return dbus.Dictionary(
2342
((c.dbus_object_path, c.GetAll(""))
2343
for c in tcp_server.clients.itervalues()),
2346
@dbus.service.method(_interface, in_signature="o")
2347
def RemoveClient(self, object_path):
2349
for c in tcp_server.clients.itervalues():
2350
if c.dbus_object_path == object_path:
2351
del tcp_server.clients[c.name]
2352
c.remove_from_connection()
2353
# Don't signal anything except ClientRemoved
2354
c.disable(quiet=True)
2356
self.ClientRemoved(object_path, c.name)
2358
raise KeyError(object_path)
2362
class MandosDBusServiceTransitional(MandosDBusService):
2363
__metaclass__ = AlternateDBusNamesMetaclass
2364
mandos_dbus_service = MandosDBusServiceTransitional()
864
2367
"Cleanup function; run on exit"
866
# From the Avahi example code
867
if not group is None:
870
# End of Avahi example code
873
client = clients.pop()
874
client.stop_hook = None
2370
multiprocessing.active_children()
2371
if not (tcp_server.clients or client_settings):
2374
# Store client before exiting. Secrets are encrypted with key
2375
# based on what config file has. If config file is
2376
# removed/edited, old secret will thus be unrecovable.
2378
with PGPEngine() as pgp:
2379
for client in tcp_server.clients.itervalues():
2380
key = client_settings[client.name]["secret"]
2381
client.encrypted_secret = pgp.encrypt(client.secret,
2385
# A list of attributes that can not be pickled
2387
exclude = set(("bus", "changedstate", "secret",
2389
for name, typ in (inspect.getmembers
2390
(dbus.service.Object)):
2393
client_dict["encrypted_secret"] = (client
2395
for attr in client.client_structure:
2396
if attr not in exclude:
2397
client_dict[attr] = getattr(client, attr)
2399
clients[client.name] = client_dict
2400
del client_settings[client.name]["secret"]
2403
with os.fdopen(os.open(stored_state_path,
2404
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2405
0600), "wb") as stored_state:
2406
pickle.dump((clients, client_settings), stored_state)
2407
except (IOError, OSError) as e:
2408
logger.warning("Could not save persistent state: {0}"
2410
if e.errno not in (errno.ENOENT, errno.EACCES):
2413
# Delete all clients, and settings from config
2414
while tcp_server.clients:
2415
name, client = tcp_server.clients.popitem()
2417
client.remove_from_connection()
2418
# Don't signal anything except ClientRemoved
2419
client.disable(quiet=True)
2422
mandos_dbus_service.ClientRemoved(client
2425
client_settings.clear()
877
2427
atexit.register(cleanup)
880
signal.signal(signal.SIGINT, signal.SIG_IGN)
881
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
882
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
884
for client in clients:
2429
for client in tcp_server.clients.itervalues():
2432
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2433
# Need to initiate checking of clients
2435
client.init_checker()
887
2437
tcp_server.enable()
888
2438
tcp_server.server_activate()
890
2440
# Find out what port we got
891
2441
service.port = tcp_server.socket.getsockname()[1]
892
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
893
u" scope_id %d" % tcp_server.socket.getsockname())
2443
logger.info("Now listening on address %r, port %d,"
2444
" flowinfo %d, scope_id %d"
2445
% tcp_server.socket.getsockname())
2447
logger.info("Now listening on address %r, port %d"
2448
% tcp_server.socket.getsockname())
895
2450
#service.interface = tcp_server.socket.getsockname()[3]
898
2453
# From the Avahi example code
899
server.connect_to_signal("StateChanged", server_state_changed)
901
server_state_changed(server.GetState())
902
except dbus.exceptions.DBusException, error:
903
logger.critical(u"DBusException: %s", error)
2456
except dbus.exceptions.DBusException as error:
2457
logger.critical("DBusException: %s", error)
905
2460
# End of Avahi example code
907
2462
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
908
2463
lambda *args, **kwargs:
909
tcp_server.handle_request\
910
(*args[2:], **kwargs) or True)
2464
(tcp_server.handle_request
2465
(*args[2:], **kwargs) or True))
912
logger.debug(u"Starting main loop")
913
main_loop_started = True
2467
logger.debug("Starting main loop")
915
except AvahiError, error:
916
logger.critical(u"AvahiError: %s" + unicode(error))
2469
except AvahiError as error:
2470
logger.critical("AvahiError: %s", error)
918
2473
except KeyboardInterrupt:
2475
print("", file=sys.stderr)
2476
logger.debug("Server received KeyboardInterrupt")
2477
logger.debug("Server exiting")
2478
# Must run before the D-Bus bus name gets deregistered
922
2481
if __name__ == '__main__':