/mandos/trunk : revision 518.1.2

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

37

import SocketServer as socketserver

40

38

import socket

41

39

import argparse

65

63

import cPickle as pickle

66

64

import multiprocessing

67

65

import types

68

import binascii

69

import tempfile

70

import itertools

66

import hashlib

71

67

72

68

import dbus

73

69

import dbus.service

78

74

import ctypes.util

79

75

import xml.dom.minidom

80

76

import inspect

81

import GnuPGInterface

77

import Crypto.Cipher.AES

82

78

83

79

try:

84

80

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

88

84

except ImportError:

89

85

SO_BINDTODEVICE = None

90

86

91

version = "1.5.3"

92

stored_state_file = "clients.pickle"

87

88

version = "1.4.1"

93

89

94

90

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

95

93

syslogger = (logging.handlers.SysLogHandler

96

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

95

address = str("/dev/log")))

98

99

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

103

except (OSError, AttributeError):

104

def if_nametoindex(interface):

105

"Get an interface index the hard way, i.e. using fcntl()"

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

with contextlib.closing(socket.socket()) as s:

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

113

return interface_index

114

115

116

def initlogger(debug, level=logging.WARNING):

117

"""init logger and add loglevel"""

118

119

syslogger.setFormatter(logging.Formatter

120

('Mandos [%(process)d]: %(levelname)s:'

121

' %(message)s'))

122

logger.addHandler(syslogger)

123

124

if debug:

125

console = logging.StreamHandler()

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

127

' [%(process)d]:'

128

' %(levelname)s:'

129

' %(message)s'))

130

logger.addHandler(console)

131

logger.setLevel(level)

132

133

134

class PGPError(Exception):

135

"""Exception if encryption/decryption fails"""

136

pass

137

138

139

class PGPEngine(object):

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

141

def __init__(self):

142

self.gnupg = GnuPGInterface.GnuPG()

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

144

self.gnupg = GnuPGInterface.GnuPG()

145

self.gnupg.options.meta_interactive = False

146

self.gnupg.options.homedir = self.tempdir

147

self.gnupg.options.extra_args.extend(['--force-mdc',

148

'--quiet',

149

'--no-use-agent'])

150

151

def __enter__(self):

152

return self

153

154

def __exit__ (self, exc_type, exc_value, traceback):

155

self._cleanup()

156

return False

157

158

def __del__(self):

159

self._cleanup()

160

161

def _cleanup(self):

162

if self.tempdir is not None:

163

# Delete contents of tempdir

164

for root, dirs, files in os.walk(self.tempdir,

165

topdown = False):

166

for filename in files:

167

os.remove(os.path.join(root, filename))

168

for dirname in dirs:

169

os.rmdir(os.path.join(root, dirname))

170

# Remove tempdir

171

os.rmdir(self.tempdir)

172

self.tempdir = None

173

174

def password_encode(self, password):

175

# Passphrase can not be empty and can not contain newlines or

176

# NUL bytes. So we prefix it and hex encode it.

177

return b"mandos" + binascii.hexlify(password)

178

179

def encrypt(self, data, password):

180

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

182

try:

183

proc = self.gnupg.run(['--symmetric'],

184

create_fhs=['stdin', 'stdout'],

185

attach_fhs={'stderr': devnull})

186

with contextlib.closing(proc.handles['stdin']) as f:

187

f.write(data)

188

with contextlib.closing(proc.handles['stdout']) as f:

189

ciphertext = f.read()

190

proc.wait()

191

except IOError as e:

192

raise PGPError(e)

193

self.gnupg.passphrase = None

194

return ciphertext

195

196

def decrypt(self, data, password):

197

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

199

try:

200

proc = self.gnupg.run(['--decrypt'],

201

create_fhs=['stdin', 'stdout'],

202

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

204

f.write(data)

205

with contextlib.closing(proc.handles['stdout']) as f:

206

decrypted_plaintext = f.read()

207

proc.wait()

208

except IOError as e:

209

raise PGPError(e)

210

self.gnupg.passphrase = None

211

return decrypted_plaintext

96

syslogger.setFormatter(logging.Formatter

97

('Mandos [%(process)d]: %(levelname)s:'

98

' %(message)s'))

99

logger.addHandler(syslogger)

100

101

console = logging.StreamHandler()

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

104

' %(levelname)s:'

105

' %(message)s'))

106

logger.addHandler(console)

212

107

213

108

214

109

class AvahiError(Exception):

245

140

server: D-Bus Server

246

141

bus: dbus.SystemBus()

247

142

"""

248

249

143

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

250

144

servicetype = None, port = None, TXT = None,

251

145

domain = "", host = "", max_renames = 32768,

264

158

self.server = None

265

159

self.bus = bus

266

160

self.entry_group_state_changed_match = None

267

268

161

def rename(self):

269

162

"""Derived from the Avahi example code"""

270

163

if self.rename_count >= self.max_renames:

280

173

try:

281

174

self.add()

282

175

except dbus.exceptions.DBusException as error:

283

logger.critical("D-Bus Exception", exc_info=error)

176

logger.critical("DBusException: %s", error)

284

177

self.cleanup()

285

178

os._exit(1)

286

179

self.rename_count += 1

287

288

180

def remove(self):

289

181

"""Derived from the Avahi example code"""

290

182

if self.entry_group_state_changed_match is not None:

292

184

self.entry_group_state_changed_match = None

293

185

if self.group is not None:

294

186

self.group.Reset()

295

296

187

def add(self):

297

188

"""Derived from the Avahi example code"""

298

189

self.remove()

315

206

dbus.UInt16(self.port),

316

207

avahi.string_array_to_txt_array(self.TXT))

317

208

self.group.Commit()

318

319

209

def entry_group_state_changed(self, state, error):

320

210

"""Derived from the Avahi example code"""

321

211

logger.debug("Avahi entry group state change: %i", state)

328

218

elif state == avahi.ENTRY_GROUP_FAILURE:

329

219

logger.critical("Avahi: Error in group state changed %s",

330

220

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

333

221

raise AvahiGroupError("State changed: %s"

222

% unicode(error))

334

223

def cleanup(self):

335

224

"""Derived from the Avahi example code"""

336

225

if self.group is not None:

337

226

try:

338

227

self.group.Free()

339

228

except (dbus.exceptions.UnknownMethodException,

340

dbus.exceptions.DBusException):

229

dbus.exceptions.DBusException) as e:

341

230

pass

342

231

self.group = None

343

232

self.remove()

344

345

233

def server_state_changed(self, state, error=None):

346

234

"""Derived from the Avahi example code"""

347

235

logger.debug("Avahi server state change: %i", state)

366

254

logger.debug("Unknown state: %r", state)

367

255

else:

368

256

logger.debug("Unknown state: %r: %r", state, error)

369

370

257

def activate(self):

371

258

"""Derived from the Avahi example code"""

372

259

if self.server is None:

379

266

self.server_state_changed)

380

267

self.server_state_changed(self.server.GetState())

381

268

382

383

269

class AvahiServiceToSyslog(AvahiService):

384

270

def rename(self):

385

271

"""Add the new name to the syslog messages"""

386

272

ret = AvahiService.rename(self)

387

273

syslogger.setFormatter(logging.Formatter

388

('Mandos ({0}) [%(process)d]:'

389

' %(levelname)s: %(message)s'

390

.format(self.name)))

274

('Mandos (%s) [%%(process)d]:'

275

' %%(levelname)s: %%(message)s'

276

% self.name))

391

277

return ret

392

278

393

394

def timedelta_to_milliseconds(td):

279

def _timedelta_to_milliseconds(td):

395

280

"Convert a datetime.timedelta() to milliseconds"

396

281

return ((td.days * 24 * 60 * 60 * 1000)

397

282

+ (td.seconds * 1000)

398

283

+ (td.microseconds // 1000))

399

400

284

401

285

class Client(object):

402

286

"""A representation of a client host served by this server.

403

287

404

288

Attributes:

405

approved: bool(); 'None' if not yet approved/disapproved

289

_approved: bool(); 'None' if not yet approved/disapproved

406

290

approval_delay: datetime.timedelta(); Time to wait for approval

407

291

approval_duration: datetime.timedelta(); Duration of one approval

408

292

checker: subprocess.Popen(); a running checker process used

426

310

interval: datetime.timedelta(); How often to start a new checker

427

311

last_approval_request: datetime.datetime(); (UTC) or None

428

312

last_checked_ok: datetime.datetime(); (UTC) or None

429

last_checker_status: integer between 0 and 255 reflecting exit

430

status of last checker. -1 reflects crashed

431

checker, -2 means no checker completed yet.

432

last_enabled: datetime.datetime(); (UTC) or None

313

last_checker_status: integer between 0 and 255 reflecting exit status

314

of last checker. -1 reflect crashed checker,

315

or None.

316

last_enabled: datetime.datetime(); (UTC)

433

317

name: string; from the config file, used in log messages and

434

318

D-Bus identifiers

435

319

secret: bytestring; sent verbatim (over TLS) to client

436

320

timeout: datetime.timedelta(); How long from last_checked_ok

437

321

until this client is disabled

438

extended_timeout: extra long timeout when secret has been sent

322

extended_timeout: extra long timeout when password has been sent

439

323

runtime_expansions: Allowed attributes for runtime expansion.

440

324

expires: datetime.datetime(); time (UTC) when a client will be

441

325

disabled, or None

445

329

"created", "enabled", "fingerprint",

446

330

"host", "interval", "last_checked_ok",

447

331

"last_enabled", "name", "timeout")

448

client_defaults = { "timeout": "5m",

449

"extended_timeout": "15m",

450

"interval": "2m",

451

"checker": "fping -q -- %%(host)s",

452

"host": "",

453

"approval_delay": "0s",

454

"approval_duration": "1s",

455

"approved_by_default": "True",

456

"enabled": "True",

457

}

458

332

459

333

def timeout_milliseconds(self):

460

334

"Return the 'timeout' attribute in milliseconds"

461

return timedelta_to_milliseconds(self.timeout)

335

return _timedelta_to_milliseconds(self.timeout)

462

336

463

337

def extended_timeout_milliseconds(self):

464

338

"Return the 'extended_timeout' attribute in milliseconds"

465

return timedelta_to_milliseconds(self.extended_timeout)

339

return _timedelta_to_milliseconds(self.extended_timeout)

466

340

467

341

def interval_milliseconds(self):

468

342

"Return the 'interval' attribute in milliseconds"

469

return timedelta_to_milliseconds(self.interval)

343

return _timedelta_to_milliseconds(self.interval)

470

344

471

345

def approval_delay_milliseconds(self):

472

return timedelta_to_milliseconds(self.approval_delay)

473

474

@staticmethod

475

def config_parser(config):

476

"""Construct a new dict of client settings of this form:

477

{ client_name: {setting_name: value, ...}, ...}

478

with exceptions for any special settings as defined above.

479

NOTE: Must be a pure function. Must return the same result

480

value given the same arguments.

481

"""

482

settings = {}

483

for client_name in config.sections():

484

section = dict(config.items(client_name))

485

client = settings[client_name] = {}

486

487

client["host"] = section["host"]

488

# Reformat values from string types to Python types

489

client["approved_by_default"] = config.getboolean(

490

client_name, "approved_by_default")

491

client["enabled"] = config.getboolean(client_name,

492

"enabled")

493

494

client["fingerprint"] = (section["fingerprint"].upper()

495

.replace(" ", ""))

496

if "secret" in section:

497

client["secret"] = section["secret"].decode("base64")

498

elif "secfile" in section:

499

with open(os.path.expanduser(os.path.expandvars

500

(section["secfile"])),

501

"rb") as secfile:

502

client["secret"] = secfile.read()

503

else:

504

raise TypeError("No secret or secfile for section {0}"

505

.format(section))

506

client["timeout"] = string_to_delta(section["timeout"])

507

client["extended_timeout"] = string_to_delta(

508

section["extended_timeout"])

509

client["interval"] = string_to_delta(section["interval"])

510

client["approval_delay"] = string_to_delta(

511

section["approval_delay"])

512

client["approval_duration"] = string_to_delta(

513

section["approval_duration"])

514

client["checker_command"] = section["checker"]

515

client["last_approval_request"] = None

516

client["last_checked_ok"] = None

517

client["last_checker_status"] = -2

518

519

return settings

520

521

def __init__(self, settings, name = None):

346

return _timedelta_to_milliseconds(self.approval_delay)

347

348

def __init__(self, name = None, config=None):

349

"""Note: the 'checker' key in 'config' sets the

350

'checker_command' attribute and *not* the 'checker'

351

attribute."""

522

352

self.name = name

523

# adding all client settings

524

for setting, value in settings.iteritems():

525

setattr(self, setting, value)

526

527

if self.enabled:

528

if not hasattr(self, "last_enabled"):

529

self.last_enabled = datetime.datetime.utcnow()

530

if not hasattr(self, "expires"):

531

self.expires = (datetime.datetime.utcnow()

532

+ self.timeout)

533

else:

534

self.last_enabled = None

535

self.expires = None

536

353

if config is None:

354

config = {}

537

355

logger.debug("Creating client %r", self.name)

538

356

# Uppercase and remove spaces from fingerprint for later

539

357

# comparison purposes with return value from the fingerprint()

540

358

# function

359

self.fingerprint = (config["fingerprint"].upper()

360

.replace(" ", ""))

541

361

logger.debug(" Fingerprint: %s", self.fingerprint)

542

self.created = settings.get("created",

543

datetime.datetime.utcnow())

544

545

# attributes specific for this server instance

362

if "secret" in config:

363

self.secret = config["secret"].decode("base64")

364

elif "secfile" in config:

365

with open(os.path.expanduser(os.path.expandvars

366

(config["secfile"])),

367

"rb") as secfile:

368

self.secret = secfile.read()

369

else:

370

raise TypeError("No secret or secfile for client %s"

371

% self.name)

372

self.host = config.get("host", "")

373

self.created = datetime.datetime.utcnow()

374

self.enabled = True

375

self.last_approval_request = None

376

self.last_enabled = datetime.datetime.utcnow()

377

self.last_checked_ok = None

378

self.last_checker_status = None

379

self.timeout = string_to_delta(config["timeout"])

380

self.extended_timeout = string_to_delta(config

381

["extended_timeout"])

382

self.interval = string_to_delta(config["interval"])

546

383

self.checker = None

547

384

self.checker_initiator_tag = None

548

385

self.disable_initiator_tag = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

549

387

self.checker_callback_tag = None

388

self.checker_command = config["checker"]

550

389

self.current_checker_command = None

551

self.approved = None

390

self._approved = None

391

self.approved_by_default = config.get("approved_by_default",

392

True)

552

393

self.approvals_pending = 0

394

self.approval_delay = string_to_delta(

395

config["approval_delay"])

396

self.approval_duration = string_to_delta(

397

config["approval_duration"])

553

398

self.changedstate = (multiprocessing_manager

554

399

.Condition(multiprocessing_manager

555

400

.Lock()))

556

self.client_structure = [attr for attr in

557

self.__dict__.iterkeys()

558

if not attr.startswith("_")]

401

self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]

559

402

self.client_structure.append("client_structure")

560

403

404

561

405

for name, t in inspect.getmembers(type(self),

562

lambda obj:

563

isinstance(obj,

564

property)):

406

lambda obj: isinstance(obj, property)):

565

407

if not name.startswith("_"):

566

408

self.client_structure.append(name)

567

409

575

417

if getattr(self, "enabled", False):

576

418

# Already enabled

577

419

return

420

self.send_changedstate()

578

421

self.expires = datetime.datetime.utcnow() + self.timeout

579

422

self.enabled = True

580

423

self.last_enabled = datetime.datetime.utcnow()

581

424

self.init_checker()

582

self.send_changedstate()

583

425

584

426

def disable(self, quiet=True):

585

427

"""Disable this client."""

586

428

if not getattr(self, "enabled", False):

587

429

return False

588

430

if not quiet:

431

self.send_changedstate()

432

if not quiet:

589

433

logger.info("Disabling client %s", self.name)

590

if getattr(self, "disable_initiator_tag", None) is not None:

434

if getattr(self, "disable_initiator_tag", False):

591

435

gobject.source_remove(self.disable_initiator_tag)

592

436

self.disable_initiator_tag = None

593

437

self.expires = None

594

if getattr(self, "checker_initiator_tag", None) is not None:

438

if getattr(self, "checker_initiator_tag", False):

595

439

gobject.source_remove(self.checker_initiator_tag)

596

440

self.checker_initiator_tag = None

597

441

self.stop_checker()

598

442

self.enabled = False

599

if not quiet:

600

self.send_changedstate()

601

443

# Do not run this again if called by a gobject.timeout_add

602

444

return False

603

445

604

446

def __del__(self):

605

447

self.disable()

606

448

607

449

def init_checker(self):

608

450

# Schedule a new checker to be started an 'interval' from now,

609

451

# and every interval from then on.

610

if self.checker_initiator_tag is not None:

611

gobject.source_remove(self.checker_initiator_tag)

612

452

self.checker_initiator_tag = (gobject.timeout_add

613

453

(self.interval_milliseconds(),

614

454

self.start_checker))

615

455

# Schedule a disable() when 'timeout' has passed

616

if self.disable_initiator_tag is not None:

617

gobject.source_remove(self.disable_initiator_tag)

618

456

self.disable_initiator_tag = (gobject.timeout_add

619

457

(self.timeout_milliseconds(),

620

458

self.disable))

621

459

# Also start a new checker *right now*.

622

460

self.start_checker()

623

461

462

624

463

def checker_callback(self, pid, condition, command):

625

464

"""The checker has completed, so take appropriate actions."""

626

465

self.checker_callback_tag = None

627

466

self.checker = None

628

467

if os.WIFEXITED(condition):

629

self.last_checker_status = os.WEXITSTATUS(condition)

468

self.last_checker_status = os.WEXITSTATUS(condition)

630

469

if self.last_checker_status == 0:

631

470

logger.info("Checker for %(name)s succeeded",

632

471

vars(self))

639

478

logger.warning("Checker for %(name)s crashed?",

640

479

vars(self))

641

480

642

def checked_ok(self):

643

"""Assert that the client has been seen, alive and well."""

644

self.last_checked_ok = datetime.datetime.utcnow()

645

self.last_checker_status = 0

646

self.bump_timeout()

647

648

def bump_timeout(self, timeout=None):

649

"""Bump up the timeout for this client."""

481

def checked_ok(self, timeout=None):

482

"""Bump up the timeout for this client.

483

484

This should only be called when the client has been seen,

485

alive and well.

486

"""

650

487

if timeout is None:

651

488

timeout = self.timeout

489

self.last_checked_ok = datetime.datetime.utcnow()

652

490

if self.disable_initiator_tag is not None:

653

491

gobject.source_remove(self.disable_initiator_tag)

654

self.disable_initiator_tag = None

655

492

if getattr(self, "enabled", False):

656

493

self.disable_initiator_tag = (gobject.timeout_add

657

(timedelta_to_milliseconds

494

(_timedelta_to_milliseconds

658

495

(timeout), self.disable))

659

496

self.expires = datetime.datetime.utcnow() + timeout

660

497

667

504

If a checker already exists, leave it running and do

668

505

nothing."""

669

506

# The reason for not killing a running checker is that if we

670

# did that, and if a checker (for some reason) started running

671

# slowly and taking more than 'interval' time, then the client

672

# would inevitably timeout, since no checker would get a

673

# chance to run to completion. If we instead leave running

507

# did that, then if a checker (for some reason) started

508

# running slowly and taking more than 'interval' time, the

509

# client would inevitably timeout, since no checker would get

510

# a chance to run to completion. If we instead leave running

674

511

# checkers alone, the checker would have to take more time

675

512

# than 'timeout' for the client to be disabled, which is as it

676

513

# should be.

706

543

try:

707

544

command = self.checker_command % escaped_attrs

708

545

except TypeError as error:

709

logger.error('Could not format string "%s"',

710

self.checker_command, exc_info=error)

546

logger.error('Could not format string "%s":'

547

' %s', self.checker_command, error)

711

548

return True # Try again later

712

549

self.current_checker_command = command

713

550

try:

731

568

gobject.source_remove(self.checker_callback_tag)

732

569

self.checker_callback(pid, status, command)

733

570

except OSError as error:

734

logger.error("Failed to start subprocess",

735

exc_info=error)

571

logger.error("Failed to start subprocess: %s",

572

error)

736

573

# Re-run this periodically if run by gobject.timeout_add

737

574

return True

738

575

745

582

return

746

583

logger.debug("Stopping checker for %(name)s", vars(self))

747

584

try:

748

self.checker.terminate()

585

os.kill(self.checker.pid, signal.SIGTERM)

749

586

#time.sleep(0.5)

750

587

#if self.checker.poll() is None:

751

# self.checker.kill()

588

# os.kill(self.checker.pid, signal.SIGKILL)

752

589

except OSError as error:

753

590

if error.errno != errno.ESRCH: # No such process

754

591

raise

755

592

self.checker = None

756

593

594

# Encrypts a client secret and stores it in a varible encrypted_secret

595

def encrypt_secret(self, key):

596

# Encryption-key need to be of a specific size, so we hash inputed key

597

hasheng = hashlib.sha256()

598

hasheng.update(key)

599

encryptionkey = hasheng.digest()

600

601

# Create validation hash so we know at decryption if it was sucessful

602

hasheng = hashlib.sha256()

603

hasheng.update(self.secret)

604

validationhash = hasheng.digest()

605

606

# Encrypt secret

607

iv = os.urandom(Crypto.Cipher.AES.block_size)

608

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

609

Crypto.Cipher.AES.MODE_CFB, iv)

610

ciphertext = ciphereng.encrypt(validationhash+self.secret)

611

self.encrypted_secret = (ciphertext, iv)

612

613

# Decrypt a encrypted client secret

614

def decrypt_secret(self, key):

615

# Decryption-key need to be of a specific size, so we hash inputed key

616

hasheng = hashlib.sha256()

617

hasheng.update(key)

618

encryptionkey = hasheng.digest()

619

620

# Decrypt encrypted secret

621

ciphertext, iv = self.encrypted_secret

622

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

623

Crypto.Cipher.AES.MODE_CFB, iv)

624

plain = ciphereng.decrypt(ciphertext)

625

626

# Validate decrypted secret to know if it was succesful

627

hasheng = hashlib.sha256()

628

validationhash = plain[:hasheng.digest_size]

629

secret = plain[hasheng.digest_size:]

630

hasheng.update(secret)

631

632

# if validation fails, we use key as new secret. Otherwhise, we use

633

# the decrypted secret

634

if hasheng.digest() == validationhash:

635

self.secret = secret

636

else:

637

self.secret = key

638

del self.encrypted_secret

639

757

640

758

641

def dbus_service_property(dbus_interface, signature="v",

759

642

access="readwrite", byte_arrays=False):

771

654

# "Set" method, so we fail early here:

772

655

if byte_arrays and signature != "ay":

773

656

raise ValueError("Byte arrays not supported for non-'ay'"

774

" signature {0!r}".format(signature))

657

" signature %r" % signature)

775

658

def decorator(func):

776

659

func._dbus_is_property = True

777

660

func._dbus_interface = dbus_interface

785

668

return decorator

786

669

787

670

788

def dbus_interface_annotations(dbus_interface):

789

"""Decorator for marking functions returning interface annotations

790

791

Usage:

792

793

@dbus_interface_annotations("org.example.Interface")

794

def _foo(self): # Function name does not matter

795

return {"org.freedesktop.DBus.Deprecated": "true",

796

"org.freedesktop.DBus.Property.EmitsChangedSignal":

797

"false"}

798

"""

799

def decorator(func):

800

func._dbus_is_interface = True

801

func._dbus_interface = dbus_interface

802

func._dbus_name = dbus_interface

803

return func

804

return decorator

805

806

807

def dbus_annotations(annotations):

808

"""Decorator to annotate D-Bus methods, signals or properties

809

Usage:

810

811

@dbus_service_property("org.example.Interface", signature="b",

812

access="r")

813

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

814

"org.freedesktop.DBus.Property."

815

"EmitsChangedSignal": "false"})

816

def Property_dbus_property(self):

817

return dbus.Boolean(False)

818

"""

819

def decorator(func):

820

func._dbus_annotations = annotations

821

return func

822

return decorator

823

824

825

671

class DBusPropertyException(dbus.exceptions.DBusException):

826

672

"""A base class for D-Bus property-related exceptions

827

673

"""

850

696

"""

851

697

852

698

@staticmethod

853

def _is_dbus_thing(thing):

854

"""Returns a function testing if an attribute is a D-Bus thing

855

856

If called like _is_dbus_thing("method") it returns a function

857

suitable for use as predicate to inspect.getmembers().

858

"""

859

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

860

False)

699

def _is_dbus_property(obj):

700

return getattr(obj, "_dbus_is_property", False)

861

701

862

def _get_all_dbus_things(self, thing):

702

def _get_all_dbus_properties(self):

863

703

"""Returns a generator of (name, attribute) pairs

864

704

"""

865

return ((getattr(athing.__get__(self), "_dbus_name",

866

name),

867

athing.__get__(self))

705

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

868

706

for cls in self.__class__.__mro__

869

for name, athing in

870

inspect.getmembers(cls,

871

self._is_dbus_thing(thing)))

707

for name, prop in

708

inspect.getmembers(cls, self._is_dbus_property))

872

709

873

710

def _get_dbus_property(self, interface_name, property_name):

874

711

"""Returns a bound method if one exists which is a D-Bus

876

713

"""

877

714

for cls in self.__class__.__mro__:

878

715

for name, value in (inspect.getmembers

879

(cls,

880

self._is_dbus_thing("property"))):

716

(cls, self._is_dbus_property)):

881

717

if (value._dbus_name == property_name

882

718

and value._dbus_interface == interface_name):

883

719

return value.__get__(self)

912

748

# signatures other than "ay".

913

749

if prop._dbus_signature != "ay":

914

750

raise ValueError

915

value = dbus.ByteArray(b''.join(chr(byte)

916

for byte in value))

751

value = dbus.ByteArray(''.join(unichr(byte)

752

for byte in value))

917

753

prop(value)

918

754

919

755

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

924

760

925

761

Note: Will not include properties with access="write".

926

762

"""

927

properties = {}

928

for name, prop in self._get_all_dbus_things("property"):

763

all = {}

764

for name, prop in self._get_all_dbus_properties():

929

765

if (interface_name

930

766

and interface_name != prop._dbus_interface):

931

767

# Interface non-empty but did not match

935

771

continue

936

772

value = prop()

937

773

if not hasattr(value, "variant_level"):

938

properties[name] = value

774

all[name] = value

939

775

continue

940

properties[name] = type(value)(value, variant_level=

941

value.variant_level+1)

942

return dbus.Dictionary(properties, signature="sv")

776

all[name] = type(value)(value, variant_level=

777

value.variant_level+1)

778

return dbus.Dictionary(all, signature="sv")

943

779

944

780

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

945

781

out_signature="s",

946

782

path_keyword='object_path',

947

783

connection_keyword='connection')

948

784

def Introspect(self, object_path, connection):

949

"""Overloading of standard D-Bus method.

950

951

Inserts property tags and interface annotation tags.

785

"""Standard D-Bus method, overloaded to insert property tags.

952

786

"""

953

787

xmlstring = dbus.service.Object.Introspect(self, object_path,

954

788

connection)

961

795

e.setAttribute("access", prop._dbus_access)

962

796

return e

963

797

for if_tag in document.getElementsByTagName("interface"):

964

# Add property tags

965

798

for tag in (make_tag(document, name, prop)

966

799

for name, prop

967

in self._get_all_dbus_things("property")

800

in self._get_all_dbus_properties()

968

801

if prop._dbus_interface

969

802

== if_tag.getAttribute("name")):

970

803

if_tag.appendChild(tag)

971

# Add annotation tags

972

for typ in ("method", "signal", "property"):

973

for tag in if_tag.getElementsByTagName(typ):

974

annots = dict()

975

for name, prop in (self.

976

_get_all_dbus_things(typ)):

977

if (name == tag.getAttribute("name")

978

and prop._dbus_interface

979

== if_tag.getAttribute("name")):

980

annots.update(getattr

981

(prop,

982

"_dbus_annotations",

983

{}))

984

for name, value in annots.iteritems():

985

ann_tag = document.createElement(

986

"annotation")

987

ann_tag.setAttribute("name", name)

988

ann_tag.setAttribute("value", value)

989

tag.appendChild(ann_tag)

990

# Add interface annotation tags

991

for annotation, value in dict(

992

itertools.chain.from_iterable(

993

annotations().iteritems()

994

for name, annotations in

995

self._get_all_dbus_things("interface")

996

if name == if_tag.getAttribute("name")

997

)).iteritems():

998

ann_tag = document.createElement("annotation")

999

ann_tag.setAttribute("name", annotation)

1000

ann_tag.setAttribute("value", value)

1001

if_tag.appendChild(ann_tag)

1002

804

# Add the names to the return values for the

1003

805

# "org.freedesktop.DBus.Properties" methods

1004

806

if (if_tag.getAttribute("name")

1019

821

except (AttributeError, xml.dom.DOMException,

1020

822

xml.parsers.expat.ExpatError) as error:

1021

823

logger.error("Failed to override Introspection method",

1022

exc_info=error)

824

error)

1023

825

return xmlstring

1024

826

1025

827

1030

832

return dbus.String(dt.isoformat(),

1031

833

variant_level=variant_level)

1032

834

1033

1034

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1035

"""A class decorator; applied to a subclass of

1036

dbus.service.Object, it will add alternate D-Bus attributes with

1037

interface names according to the "alt_interface_names" mapping.

1038

Usage:

1039

1040

@alternate_dbus_names({"org.example.Interface":

1041

"net.example.AlternateInterface"})

1042

class SampleDBusObject(dbus.service.Object):

1043

@dbus.service.method("org.example.Interface")

1044

def SampleDBusMethod():

1045

pass

1046

1047

The above "SampleDBusMethod" on "SampleDBusObject" will be

1048

reachable via two interfaces: "org.example.Interface" and

1049

"net.example.AlternateInterface", the latter of which will have

1050

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1051

"true", unless "deprecate" is passed with a False value.

1052

1053

This works for methods and signals, and also for D-Bus properties

1054

(from DBusObjectWithProperties) and interfaces (from the

1055

dbus_interface_annotations decorator).

835

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

836

.__metaclass__):

837

"""Applied to an empty subclass of a D-Bus object, this metaclass

838

will add additional D-Bus attributes matching a certain pattern.

1056

839

"""

1057

def wrapper(cls):

1058

for orig_interface_name, alt_interface_name in (

1059

alt_interface_names.iteritems()):

1060

attr = {}

1061

interface_names = set()

1062

# Go though all attributes of the class

1063

for attrname, attribute in inspect.getmembers(cls):

840

def __new__(mcs, name, bases, attr):

841

# Go through all the base classes which could have D-Bus

842

# methods, signals, or properties in them

843

for base in (b for b in bases

844

if issubclass(b, dbus.service.Object)):

845

# Go though all attributes of the base class

846

for attrname, attribute in inspect.getmembers(base):

1064

847

# Ignore non-D-Bus attributes, and D-Bus attributes

1065

848

# with the wrong interface name

1066

849

if (not hasattr(attribute, "_dbus_interface")

1067

850

or not attribute._dbus_interface

1068

.startswith(orig_interface_name)):

851

.startswith("se.recompile.Mandos")):

1069

852

continue

1070

853

# Create an alternate D-Bus interface name based on

1071

854

# the current name

1072

855

alt_interface = (attribute._dbus_interface

1073

.replace(orig_interface_name,

1074

alt_interface_name))

1075

interface_names.add(alt_interface)

856

.replace("se.recompile.Mandos",

857

"se.bsnet.fukt.Mandos"))

1076

858

# Is this a D-Bus signal?

1077

859

if getattr(attribute, "_dbus_is_signal", False):

1078

860

# Extract the original non-method function by

1093

875

nonmethod_func.func_name,

1094

876

nonmethod_func.func_defaults,

1095

877

nonmethod_func.func_closure)))

1096

# Copy annotations, if any

1097

try:

1098

new_function._dbus_annotations = (

1099

dict(attribute._dbus_annotations))

1100

except AttributeError:

1101

pass

1102

878

# Define a creator of a function to call both the

1103

# original and alternate functions, so both the

1104

# original and alternate signals gets sent when

1105

# the function is called

879

# old and new functions, so both the old and new

880

# signals gets sent when the function is called

1106

881

def fixscope(func1, func2):

1107

882

"""This function is a scope container to pass

1108

883

func1 and func2 to the "call_both" function

1115

890

return call_both

1116

891

# Create the "call_both" function and add it to

1117

892

# the class

1118

attr[attrname] = fixscope(attribute, new_function)

893

attr[attrname] = fixscope(attribute,

894

new_function)

1119

895

# Is this a D-Bus method?

1120

896

elif getattr(attribute, "_dbus_is_method", False):

1121

897

# Create a new, but exactly alike, function

1132

908

attribute.func_name,

1133

909

attribute.func_defaults,

1134

910

attribute.func_closure)))

1135

# Copy annotations, if any

1136

try:

1137

attr[attrname]._dbus_annotations = (

1138

dict(attribute._dbus_annotations))

1139

except AttributeError:

1140

pass

1141

911

# Is this a D-Bus property?

1142

912

elif getattr(attribute, "_dbus_is_property", False):

1143

913

# Create a new, but exactly alike, function

1157

927

attribute.func_name,

1158

928

attribute.func_defaults,

1159

929

attribute.func_closure)))

1160

# Copy annotations, if any

1161

try:

1162

attr[attrname]._dbus_annotations = (

1163

dict(attribute._dbus_annotations))

1164

except AttributeError:

1165

pass

1166

# Is this a D-Bus interface?

1167

elif getattr(attribute, "_dbus_is_interface", False):

1168

# Create a new, but exactly alike, function

1169

# object. Decorate it to be a new D-Bus interface

1170

# with the alternate D-Bus interface name. Add it

1171

# to the class.

1172

attr[attrname] = (dbus_interface_annotations

1173

(alt_interface)

1174

(types.FunctionType

1175

(attribute.func_code,

1176

attribute.func_globals,

1177

attribute.func_name,

1178

attribute.func_defaults,

1179

attribute.func_closure)))

1180

if deprecate:

1181

# Deprecate all alternate interfaces

1182

iname="_AlternateDBusNames_interface_annotation{0}"

1183

for interface_name in interface_names:

1184

@dbus_interface_annotations(interface_name)

1185

def func(self):

1186

return { "org.freedesktop.DBus.Deprecated":

1187

"true" }

1188

# Find an unused name

1189

for aname in (iname.format(i)

1190

for i in itertools.count()):

1191

if aname not in attr:

1192

attr[aname] = func

1193

break

1194

if interface_names:

1195

# Replace the class with a new subclass of it with

1196

# methods, signals, etc. as created above.

1197

cls = type(b"{0}Alternate".format(cls.__name__),

1198

(cls,), attr)

1199

return cls

1200

return wrapper

1201

1202

1203

@alternate_dbus_interfaces({"se.recompile.Mandos":

1204

"se.bsnet.fukt.Mandos"})

930

return type.__new__(mcs, name, bases, attr)

931

1205

932

class ClientDBus(Client, DBusObjectWithProperties):

1206

933

"""A Client class using D-Bus

1207

934

1218

945

def __init__(self, bus = None, *args, **kwargs):

1219

946

self.bus = bus

1220

947

Client.__init__(self, *args, **kwargs)

948

949

self._approvals_pending = 0

1221

950

# Only now, when this client is initialized, can it show up on

1222

951

# the D-Bus

1223

952

client_object_name = unicode(self.name).translate(

1227

956

("/clients/" + client_object_name))

1228

957

DBusObjectWithProperties.__init__(self, self.bus,

1229

958

self.dbus_object_path)

1230

959

1231

960

def notifychangeproperty(transform_func,

1232

961

dbus_name, type_func=lambda x: x,

1233

962

variant_level=1):

1234

963

""" Modify a variable so that it's a property which announces

1235

964

its changes to DBus.

1236

965

1237

966

transform_fun: Function that takes a value and a variant_level

1238

967

and transforms it to a D-Bus type.

1239

968

dbus_name: D-Bus name of the variable

1256

985

1257

986

return property(lambda self: getattr(self, attrname), setter)

1258

987

988

1259

989

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1260

990

approvals_pending = notifychangeproperty(dbus.Boolean,

1261

991

"ApprovalPending",

1268

998

checker is not None)

1269

999

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1270

1000

"LastCheckedOK")

1271

last_checker_status = notifychangeproperty(dbus.Int16,

1272

"LastCheckerStatus")

1273

1001

last_approval_request = notifychangeproperty(

1274

1002

datetime_to_dbus, "LastApprovalRequest")

1275

1003

approved_by_default = notifychangeproperty(dbus.Boolean,

1276

1004

"ApprovedByDefault")

1277

approval_delay = notifychangeproperty(dbus.UInt64,

1005

approval_delay = notifychangeproperty(dbus.UInt16,

1278

1006

"ApprovalDelay",

1279

1007

type_func =

1280

timedelta_to_milliseconds)

1008

_timedelta_to_milliseconds)

1281

1009

approval_duration = notifychangeproperty(

1282

dbus.UInt64, "ApprovalDuration",

1283

type_func = timedelta_to_milliseconds)

1010

dbus.UInt16, "ApprovalDuration",

1011

type_func = _timedelta_to_milliseconds)

1284

1012

host = notifychangeproperty(dbus.String, "Host")

1285

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1013

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1286

1014

type_func =

1287

timedelta_to_milliseconds)

1015

_timedelta_to_milliseconds)

1288

1016

extended_timeout = notifychangeproperty(

1289

dbus.UInt64, "ExtendedTimeout",

1290

type_func = timedelta_to_milliseconds)

1291

interval = notifychangeproperty(dbus.UInt64,

1017

dbus.UInt16, "ExtendedTimeout",

1018

type_func = _timedelta_to_milliseconds)

1019

interval = notifychangeproperty(dbus.UInt16,

1292

1020

"Interval",

1293

1021

type_func =

1294

timedelta_to_milliseconds)

1022

_timedelta_to_milliseconds)

1295

1023

checker_command = notifychangeproperty(dbus.String, "Checker")

1296

1024

1297

1025

del notifychangeproperty

1339

1067

return r

1340

1068

1341

1069

def _reset_approved(self):

1342

self.approved = None

1070

self._approved = None

1343

1071

return False

1344

1072

1345

1073

def approve(self, value=True):

1346

self.approved = value

1347

gobject.timeout_add(timedelta_to_milliseconds

1074

self.send_changedstate()

1075

self._approved = value

1076

gobject.timeout_add(_timedelta_to_milliseconds

1348

1077

(self.approval_duration),

1349

1078

self._reset_approved)

1350

self.send_changedstate()

1079

1351

1080

1352

1081

## D-Bus methods, signals & properties

1353

1082

_interface = "se.recompile.Mandos.Client"

1354

1083

1355

## Interfaces

1356

1357

@dbus_interface_annotations(_interface)

1358

def _foo(self):

1359

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1360

"false"}

1361

1362

1084

## Signals

1363

1085

1364

1086

# CheckerCompleted - signal

1463

1185

access="readwrite")

1464

1186

def ApprovalDuration_dbus_property(self, value=None):

1465

1187

if value is None: # get

1466

return dbus.UInt64(timedelta_to_milliseconds(

1188

return dbus.UInt64(_timedelta_to_milliseconds(

1467

1189

self.approval_duration))

1468

1190

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1469

1191

1483

1205

def Host_dbus_property(self, value=None):

1484

1206

if value is None: # get

1485

1207

return dbus.String(self.host)

1486

self.host = unicode(value)

1208

self.host = value

1487

1209

1488

1210

# Created - property

1489

1211

@dbus_service_property(_interface, signature="s", access="read")

1490

1212

def Created_dbus_property(self):

1491

return datetime_to_dbus(self.created)

1213

return dbus.String(datetime_to_dbus(self.created))

1492

1214

1493

1215

# LastEnabled - property

1494

1216

@dbus_service_property(_interface, signature="s", access="read")

1515

1237

return

1516

1238

return datetime_to_dbus(self.last_checked_ok)

1517

1239

1518

# LastCheckerStatus - property

1519

@dbus_service_property(_interface, signature="n",

1520

access="read")

1521

def LastCheckerStatus_dbus_property(self):

1522

return dbus.Int16(self.last_checker_status)

1523

1524

1240

# Expires - property

1525

1241

@dbus_service_property(_interface, signature="s", access="read")

1526

1242

def Expires_dbus_property(self):

1537

1253

def Timeout_dbus_property(self, value=None):

1538

1254

if value is None: # get

1539

1255

return dbus.UInt64(self.timeout_milliseconds())

1540

old_timeout = self.timeout

1541

1256

self.timeout = datetime.timedelta(0, 0, 0, value)

1542

# Reschedule disabling

1543

if self.enabled:

1544

now = datetime.datetime.utcnow()

1545

self.expires += self.timeout - old_timeout

1546

if self.expires <= now:

1547

# The timeout has passed

1548

self.disable()

1549

else:

1550

if (getattr(self, "disable_initiator_tag", None)

1551

is None):

1552

return

1553

gobject.source_remove(self.disable_initiator_tag)

1554

self.disable_initiator_tag = (

1555

gobject.timeout_add(

1556

timedelta_to_milliseconds(self.expires - now),

1557

self.disable))

1257

if getattr(self, "disable_initiator_tag", None) is None:

1258

return

1259

# Reschedule timeout

1260

gobject.source_remove(self.disable_initiator_tag)

1261

self.disable_initiator_tag = None

1262

self.expires = None

1263

time_to_die = _timedelta_to_milliseconds((self

1264

.last_checked_ok

1265

+ self.timeout)

1266

- datetime.datetime

1267

.utcnow())

1268

if time_to_die <= 0:

1269

# The timeout has passed

1270

self.disable()

1271

else:

1272

self.expires = (datetime.datetime.utcnow()

1273

+ datetime.timedelta(milliseconds =

1274

time_to_die))

1275

self.disable_initiator_tag = (gobject.timeout_add

1276

(time_to_die, self.disable))

1558

1277

1559

1278

# ExtendedTimeout - property

1560

1279

@dbus_service_property(_interface, signature="t",

1573

1292

self.interval = datetime.timedelta(0, 0, 0, value)

1574

1293

if getattr(self, "checker_initiator_tag", None) is None:

1575

1294

return

1576

if self.enabled:

1577

# Reschedule checker run

1578

gobject.source_remove(self.checker_initiator_tag)

1579

self.checker_initiator_tag = (gobject.timeout_add

1580

(value, self.start_checker))

1581

self.start_checker() # Start one now, too

1295

# Reschedule checker run

1296

gobject.source_remove(self.checker_initiator_tag)

1297

self.checker_initiator_tag = (gobject.timeout_add

1298

(value, self.start_checker))

1299

self.start_checker() # Start one now, too

1582

1300

1583

1301

# Checker - property

1584

1302

@dbus_service_property(_interface, signature="s",

1586

1304

def Checker_dbus_property(self, value=None):

1587

1305

if value is None: # get

1588

1306

return dbus.String(self.checker_command)

1589

self.checker_command = unicode(value)

1307

self.checker_command = value

1590

1308

1591

1309

# CheckerRunning - property

1592

1310

@dbus_service_property(_interface, signature="b",

1621

1339

raise KeyError()

1622

1340

1623

1341

def __getattribute__(self, name):

1624

if name == '_pipe':

1342

if(name == '_pipe'):

1625

1343

return super(ProxyClient, self).__getattribute__(name)

1626

1344

self._pipe.send(('getattr', name))

1627

1345

data = self._pipe.recv()

1634

1352

return func

1635

1353

1636

1354

def __setattr__(self, name, value):

1637

if name == '_pipe':

1355

if(name == '_pipe'):

1638

1356

return super(ProxyClient, self).__setattr__(name, value)

1639

1357

self._pipe.send(('setattr', name, value))

1640

1358

1359

class ClientDBusTransitional(ClientDBus):

1360

__metaclass__ = AlternateDBusNamesMetaclass

1641

1361

1642

1362

class ClientHandler(socketserver.BaseRequestHandler, object):

1643

1363

"""A class to handle client connections.

1726

1446

client.Rejected("Disabled")

1727

1447

return

1728

1448

1729

if client.approved or not client.approval_delay:

1449

if client._approved or not client.approval_delay:

1730

1450

#We are approved or approval is disabled

1731

1451

break

1732

elif client.approved is None:

1452

elif client._approved is None:

1733

1453

logger.info("Client %s needs approval",

1734

1454

client.name)

1735

1455

if self.server.use_dbus:

1748

1468

#wait until timeout or approved

1749

1469

time = datetime.datetime.now()

1750

1470

client.changedstate.acquire()

1751

client.changedstate.wait(

1752

float(timedelta_to_milliseconds(delay)

1753

/ 1000))

1471

(client.changedstate.wait

1472

(float(client._timedelta_to_milliseconds(delay)

1473

/ 1000)))

1754

1474

client.changedstate.release()

1755

1475

time2 = datetime.datetime.now()

1756

1476

if (time2 - time) >= delay:

1772

1492

try:

1773

1493

sent = session.send(client.secret[sent_size:])

1774

1494

except gnutls.errors.GNUTLSError as error:

1775

logger.warning("gnutls send failed",

1776

exc_info=error)

1495

logger.warning("gnutls send failed")

1777

1496

return

1778

1497

logger.debug("Sent: %d, remaining: %d",

1779

1498

sent, len(client.secret)

1782

1501

1783

1502

logger.info("Sending secret to %s", client.name)

1784

1503

# bump the timeout using extended_timeout

1785

client.bump_timeout(client.extended_timeout)

1504

client.checked_ok(client.extended_timeout)

1786

1505

if self.server.use_dbus:

1787

1506

# Emit D-Bus signal

1788

1507

client.GotSecret()

1793

1512

try:

1794

1513

session.bye()

1795

1514

except gnutls.errors.GNUTLSError as error:

1796

logger.warning("GnuTLS bye failed",

1797

exc_info=error)

1515

logger.warning("GnuTLS bye failed")

1798

1516

1799

1517

@staticmethod

1800

1518

def peer_certificate(session):

1856

1574

# Convert the buffer to a Python bytestring

1857

1575

fpr = ctypes.string_at(buf, buf_len.value)

1858

1576

# Convert the bytestring to hexadecimal notation

1859

hex_fpr = binascii.hexlify(fpr).upper()

1577

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1860

1578

return hex_fpr

1861

1579

1862

1580

1865

1583

def sub_process_main(self, request, address):

1866

1584

try:

1867

1585

self.finish_request(request, address)

1868

except Exception:

1586

except:

1869

1587

self.handle_error(request, address)

1870

1588

self.close_request(request)

1871

1589

1872

1590

def process_request(self, request, address):

1873

1591

"""Start a new process to process the request."""

1874

1592

proc = multiprocessing.Process(target = self.sub_process_main,

1875

args = (request, address))

1593

args = (request,

1594

address))

1876

1595

proc.start()

1877

1596

return proc

1878

1597

1928

1647

str(self.interface

1929

1648

+ '\0'))

1930

1649

except socket.error as error:

1931

if error.errno == errno.EPERM:

1650

if error[0] == errno.EPERM:

1932

1651

logger.error("No permission to"

1933

1652

" bind to interface %s",

1934

1653

self.interface)

1935

elif error.errno == errno.ENOPROTOOPT:

1654

elif error[0] == errno.ENOPROTOOPT:

1936

1655

logger.error("SO_BINDTODEVICE not available;"

1937

1656

" cannot bind to interface %s",

1938

1657

self.interface)

1939

elif error.errno == errno.ENODEV:

1940

logger.error("Interface %s does not"

1941

" exist, cannot bind",

1942

self.interface)

1943

1658

else:

1944

1659

raise

1945

1660

# Only bind(2) the socket if we really need to.

2004

1719

2005

1720

def handle_ipc(self, source, condition, parent_pipe=None,

2006

1721

proc = None, client_object=None):

1722

condition_names = {

1723

gobject.IO_IN: "IN", # There is data to read.

1724

gobject.IO_OUT: "OUT", # Data can be written (without

1725

# blocking).

1726

gobject.IO_PRI: "PRI", # There is urgent data to read.

1727

gobject.IO_ERR: "ERR", # Error condition.

1728

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1729

# broken, usually for pipes and

1730

# sockets).

1731

}

1732

conditions_string = ' | '.join(name

1733

for cond, name in

1734

condition_names.iteritems()

1735

if cond & condition)

2007

1736

# error, or the other end of multiprocessing.Pipe has closed

2008

if condition & (gobject.IO_ERR | gobject.IO_HUP):

1737

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2009

1738

# Wait for other process to exit

2010

1739

proc.join()

2011

1740

return False

2101

1830

elif suffix == "w":

2102

1831

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2103

1832

else:

2104

raise ValueError("Unknown suffix {0!r}"

2105

.format(suffix))

1833

raise ValueError("Unknown suffix %r" % suffix)

2106

1834

except (ValueError, IndexError) as e:

2107

1835

raise ValueError(*(e.args))

2108

1836

timevalue += delta

2109

1837

return timevalue

2110

1838

2111

1839

1840

def if_nametoindex(interface):

1841

"""Call the C function if_nametoindex(), or equivalent

1842

1843

Note: This function cannot accept a unicode string."""

1844

global if_nametoindex

1845

try:

1846

if_nametoindex = (ctypes.cdll.LoadLibrary

1847

(ctypes.util.find_library("c"))

1848

.if_nametoindex)

1849

except (OSError, AttributeError):

1850

logger.warning("Doing if_nametoindex the hard way")

1851

def if_nametoindex(interface):

1852

"Get an interface index the hard way, i.e. using fcntl()"

1853

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1854

with contextlib.closing(socket.socket()) as s:

1855

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1856

struct.pack(str("16s16x"),

1857

interface))

1858

interface_index = struct.unpack(str("I"),

1859

ifreq[16:20])[0]

1860

return interface_index

1861

return if_nametoindex(interface)

1862

1863

2112

1864

def daemon(nochdir = False, noclose = False):

2113

1865

"""See daemon(3). Standard BSD Unix function.

2114

1866

2122

1874

sys.exit()

2123

1875

if not noclose:

2124

1876

# Close all standard open file descriptors

2125

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1877

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2126

1878

if not stat.S_ISCHR(os.fstat(null).st_mode):

2127

1879

raise OSError(errno.ENODEV,

2128

"{0} not a character device"

2129

.format(os.devnull))

1880

"%s not a character device"

1881

% os.path.devnull)

2130

1882

os.dup2(null, sys.stdin.fileno())

2131

1883

os.dup2(null, sys.stdout.fileno())

2132

1884

os.dup2(null, sys.stderr.fileno())

2141

1893

2142

1894

parser = argparse.ArgumentParser()

2143

1895

parser.add_argument("-v", "--version", action="version",

2144

version = "%(prog)s {0}".format(version),

1896

version = "%%(prog)s %s" % version,

2145

1897

help="show version number and exit")

2146

1898

parser.add_argument("-i", "--interface", metavar="IF",

2147

1899

help="Bind to interface IF")

2170

1922

parser.add_argument("--no-ipv6", action="store_false",

2171

1923

dest="use_ipv6", help="Do not use IPv6")

2172

1924

parser.add_argument("--no-restore", action="store_false",

2173

dest="restore", help="Do not restore stored"

2174

" state")

2175

parser.add_argument("--statedir", metavar="DIR",

2176

help="Directory to save/restore state in")

2177

1925

dest="restore", help="Do not restore stored state",

1926

default=True)

1927

2178

1928

options = parser.parse_args()

2179

1929

2180

1930

if options.check:

2193

1943

"use_dbus": "True",

2194

1944

"use_ipv6": "True",

2195

1945

"debuglevel": "",

2196

"restore": "True",

2197

"statedir": "/var/lib/mandos"

2198

1946

}

2199

1947

2200

1948

# Parse config file for server-global settings

2217

1965

# options, if set.

2218

1966

for option in ("interface", "address", "port", "debug",

2219

1967

"priority", "servicename", "configdir",

2220

"use_dbus", "use_ipv6", "debuglevel", "restore",

2221

"statedir"):

1968

"use_dbus", "use_ipv6", "debuglevel", "restore"):

2222

1969

value = getattr(options, option)

2223

1970

if value is not None:

2224

1971

server_settings[option] = value

2236

1983

debuglevel = server_settings["debuglevel"]

2237

1984

use_dbus = server_settings["use_dbus"]

2238

1985

use_ipv6 = server_settings["use_ipv6"]

2239

stored_state_path = os.path.join(server_settings["statedir"],

2240

stored_state_file)

2241

2242

if debug:

2243

initlogger(debug, logging.DEBUG)

2244

else:

2245

if not debuglevel:

2246

initlogger(debug)

2247

else:

2248

level = getattr(logging, debuglevel.upper())

2249

initlogger(debug, level)

2250

1986

2251

1987

if server_settings["servicename"] != "Mandos":

2252

1988

syslogger.setFormatter(logging.Formatter

2253

('Mandos ({0}) [%(process)d]:'

2254

' %(levelname)s: %(message)s'

2255

.format(server_settings

2256

["servicename"])))

1989

('Mandos (%s) [%%(process)d]:'

1990

' %%(levelname)s: %%(message)s'

1991

% server_settings["servicename"]))

2257

1992

2258

1993

# Parse config file with clients

2259

client_config = configparser.SafeConfigParser(Client

2260

.client_defaults)

1994

client_defaults = { "timeout": "5m",

1995

"extended_timeout": "15m",

1996

"interval": "2m",

1997

"checker": "fping -q -- %%(host)s",

1998

"host": "",

1999

"approval_delay": "0s",

2000

"approval_duration": "1s",

2001

}

2002

client_config = configparser.SafeConfigParser(client_defaults)

2261

2003

client_config.read(os.path.join(server_settings["configdir"],

2262

2004

"clients.conf"))

2263

2005

2277

2019

pidfilename = "/var/run/mandos.pid"

2278

2020

try:

2279

2021

pidfile = open(pidfilename, "w")

2280

except IOError as e:

2281

logger.error("Could not open file %r", pidfilename,

2282

exc_info=e)

2022

except IOError:

2023

logger.error("Could not open file %r", pidfilename)

2283

2024

2284

for name in ("_mandos", "mandos", "nobody"):

2025

try:

2026

uid = pwd.getpwnam("_mandos").pw_uid

2027

gid = pwd.getpwnam("_mandos").pw_gid

2028

except KeyError:

2285

2029

try:

2286

uid = pwd.getpwnam(name).pw_uid

2287

gid = pwd.getpwnam(name).pw_gid

2288

break

2030

uid = pwd.getpwnam("mandos").pw_uid

2031

gid = pwd.getpwnam("mandos").pw_gid

2289

2032

except KeyError:

2290

continue

2291

else:

2292

uid = 65534

2293

gid = 65534

2033

try:

2034

uid = pwd.getpwnam("nobody").pw_uid

2035

gid = pwd.getpwnam("nobody").pw_gid

2036

except KeyError:

2037

uid = 65534

2038

gid = 65534

2294

2039

try:

2295

2040

os.setgid(gid)

2296

2041

os.setuid(uid)

2298

2043

if error[0] != errno.EPERM:

2299

2044

raise error

2300

2045

2046

if not debug and not debuglevel:

2047

logger.setLevel(logging.WARNING)

2048

if debuglevel:

2049

level = getattr(logging, debuglevel.upper())

2050

logger.setLevel(level)

2051

2301

2052

if debug:

2053

logger.setLevel(logging.DEBUG)

2302

2054

# Enable all possible GnuTLS debugging

2303

2055

2304

2056

# "Use a log level over 10 to enable all debugging options."

2313

2065

.gnutls_global_set_log_function(debug_gnutls))

2314

2066

2315

2067

# Redirect stdin so all checkers get /dev/null

2316

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2068

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2317

2069

os.dup2(null, sys.stdin.fileno())

2318

2070

if null > 2:

2319

2071

os.close(null)

2072

else:

2073

# No console logging

2074

logger.removeHandler(console)

2320

2075

2321

2076

# Need to fork before connecting to D-Bus

2322

2077

if not debug:

2323

2078

# Close all input and output, do double fork, etc.

2324

2079

daemon()

2325

2080

2326

gobject.threads_init()

2327

2328

2081

global main_loop

2329

2082

# From the Avahi example code

2330

DBusGMainLoop(set_as_default=True)

2083

DBusGMainLoop(set_as_default=True )

2331

2084

main_loop = gobject.MainLoop()

2332

2085

bus = dbus.SystemBus()

2333

2086

# End of Avahi example code

2339

2092

("se.bsnet.fukt.Mandos", bus,

2340

2093

do_not_queue=True))

2341

2094

except dbus.exceptions.NameExistsException as e:

2342

logger.error("Disabling D-Bus:", exc_info=e)

2095

logger.error(unicode(e) + ", disabling D-Bus")

2343

2096

use_dbus = False

2344

2097

server_settings["use_dbus"] = False

2345

2098

tcp_server.use_dbus = False

2357

2110

2358

2111

client_class = Client

2359

2112

if use_dbus:

2360

client_class = functools.partial(ClientDBus, bus = bus)

2361

2362

client_settings = Client.config_parser(client_config)

2113

client_class = functools.partial(ClientDBusTransitional,

2114

bus = bus)

2115

2116

special_settings = {

2117

# Some settings need to be accessd by special methods;

2118

# booleans need .getboolean(), etc. Here is a list of them:

2119

"approved_by_default":

2120

lambda section:

2121

client_config.getboolean(section, "approved_by_default"),

2122

}

2123

# Construct a new dict of client settings of this form:

2124

# { client_name: {setting_name: value, ...}, ...}

2125

# with exceptions for any special settings as defined above

2126

client_settings = dict((clientname,

2127

dict((setting,

2128

(value if setting not in special_settings

2129

else special_settings[setting](clientname)))

2130

for setting, value in client_config.items(clientname)))

2131

for clientname in client_config.sections())

2132

2363

2133

old_client_settings = {}

2364

clients_data = {}

2365

2366

# Get client data and settings from last running state.

2134

clients_data = []

2135

2136

# Get client data and settings from last running state.

2367

2137

if server_settings["restore"]:

2368

2138

try:

2369

2139

with open(stored_state_path, "rb") as stored_state:

2370

clients_data, old_client_settings = (pickle.load

2371

(stored_state))

2140

clients_data, old_client_settings = pickle.load(stored_state)

2372

2141

os.remove(stored_state_path)

2373

2142

except IOError as e:

2374

if e.errno == errno.ENOENT:

2375

logger.warning("Could not load persistent state: {0}"

2376

.format(os.strerror(e.errno)))

2377

else:

2378

logger.critical("Could not load persistent state:",

2379

exc_info=e)

2143

logger.warning("Could not load persistant state: {0}".format(e))

2144

if e.errno != errno.ENOENT:

2380

2145

raise

2381

except EOFError as e:

2382

logger.warning("Could not load persistent state: "

2383

"EOFError:", exc_info=e)

2384

2385

with PGPEngine() as pgp:

2386

for client_name, client in clients_data.iteritems():

2387

# Decide which value to use after restoring saved state.

2388

# We have three different values: Old config file,

2389

# new config file, and saved state.

2390

# New config value takes precedence if it differs from old

2391

# config value, otherwise use saved state.

2392

for name, value in client_settings[client_name].items():

2393

try:

2394

# For each value in new config, check if it

2395

# differs from the old config value (Except for

2396

# the "secret" attribute)

2397

if (name != "secret" and

2398

value != old_client_settings[client_name]

2399

[name]):

2400

client[name] = value

2401

except KeyError:

2402

pass

2403

2404

# Clients who has passed its expire date can still be

2405

# enabled if its last checker was successful. Clients

2406

# whose checker succeeded before we stored its state is

2407

# assumed to have successfully run all checkers during

2408

# downtime.

2409

if client["enabled"]:

2410

if datetime.datetime.utcnow() >= client["expires"]:

2411

if not client["last_checked_ok"]:

2412

logger.warning(

2413

"disabling client {0} - Client never "

2414

"performed a successful checker"

2415

.format(client_name))

2416

client["enabled"] = False

2417

elif client["last_checker_status"] != 0:

2418

logger.warning(

2419

"disabling client {0} - Client "

2420

"last checker failed with error code {1}"

2421

.format(client_name,

2422

client["last_checker_status"]))

2423

client["enabled"] = False

2424

else:

2425

client["expires"] = (datetime.datetime

2426

.utcnow()

2427

+ client["timeout"])

2428

logger.debug("Last checker succeeded,"

2429

" keeping {0} enabled"

2430

.format(client_name))

2146

2147

for client in clients_data:

2148

client_name = client["name"]

2149

2150

# Decide which value to use after restoring saved state.

2151

# We have three different values: Old config file,

2152

# new config file, and saved state.

2153

# New config value takes precedence if it differs from old

2154

# config value, otherwise use saved state.

2155

for name, value in client_settings[client_name].items():

2431

2156

try:

2432

client["secret"] = (

2433

pgp.decrypt(client["encrypted_secret"],

2434

client_settings[client_name]

2435

["secret"]))

2436

except PGPError:

2437

# If decryption fails, we use secret from new settings

2438

logger.debug("Failed to decrypt {0} old secret"

2439

.format(client_name))

2440

client["secret"] = (

2441

client_settings[client_name]["secret"])

2442

2443

# Add/remove clients based on new changes made to config

2444

for client_name in (set(old_client_settings)

2445

- set(client_settings)):

2446

del clients_data[client_name]

2447

for client_name in (set(client_settings)

2448

- set(old_client_settings)):

2449

clients_data[client_name] = client_settings[client_name]

2450

2451

# Create all client objects

2452

for client_name, client in clients_data.iteritems():

2453

tcp_server.clients[client_name] = client_class(

2454

name = client_name, settings = client)

2455

2157

# For each value in new config, check if it differs

2158

# from the old config value (Except for the "secret"

2159

# attribute)

2160

if name != "secret" and value != old_client_settings[client_name][name]:

2161

setattr(client, name, value)

2162

except KeyError:

2163

pass

2164

2165

# Clients who has passed its expire date, can still be enabled if its

2166

# last checker was sucessful. Clients who checkers failed before we

2167

# stored it state is asumed to had failed checker during downtime.

2168

if client["enabled"] and client["last_checked_ok"]:

2169

if ((datetime.datetime.utcnow() - client["last_checked_ok"])

2170

> client["interval"]):

2171

if client["last_checker_status"] != 0:

2172

client["enabled"] = False

2173

else:

2174

client["expires"] = datetime.datetime.utcnow() + client["timeout"]

2175

2176

client["changedstate"] = (multiprocessing_manager

2177

.Condition(multiprocessing_manager

2178

.Lock()))

2179

if use_dbus:

2180

new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)

2181

tcp_server.clients[client_name] = new_client

2182

new_client.bus = bus

2183

for name, value in client.iteritems():

2184

setattr(new_client, name, value)

2185

client_object_name = unicode(client_name).translate(

2186

{ord("."): ord("_"),

2187

ord("-"): ord("_")})

2188

new_client.dbus_object_path = (dbus.ObjectPath

2189

("/clients/" + client_object_name))

2190

DBusObjectWithProperties.__init__(new_client,

2191

new_client.bus,

2192

new_client.dbus_object_path)

2193

else:

2194

tcp_server.clients[client_name] = Client.__new__(Client)

2195

for name, value in client.iteritems():

2196

setattr(tcp_server.clients[client_name], name, value)

2197

2198

tcp_server.clients[client_name].decrypt_secret(

2199

client_settings[client_name]["secret"])

2200

2201

# Create/remove clients based on new changes made to config

2202

for clientname in set(old_client_settings) - set(client_settings):

2203

del tcp_server.clients[clientname]

2204

for clientname in set(client_settings) - set(old_client_settings):

2205

tcp_server.clients[clientname] = (client_class(name = clientname,

2206

config =

2207

client_settings

2208

[clientname]))

2209

2210

2456

2211

if not tcp_server.clients:

2457

2212

logger.warning("No clients defined")

2458

2213

2459

2214

if not debug:

2460

2215

try:

2461

2216

with pidfile:

2469

2224

# "pidfile" was never created

2470

2225

pass

2471

2226

del pidfilename

2227

2472

2228

signal.signal(signal.SIGINT, signal.SIG_IGN)

2473

2229

2474

2230

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2475

2231

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2476

2232

2477

2233

if use_dbus:

2478

@alternate_dbus_interfaces({"se.recompile.Mandos":

2479

"se.bsnet.fukt.Mandos"})

2480

class MandosDBusService(DBusObjectWithProperties):

2234

class MandosDBusService(dbus.service.Object):

2481

2235

"""A D-Bus proxy object"""

2482

2236

def __init__(self):

2483

2237

dbus.service.Object.__init__(self, bus, "/")

2484

2238

_interface = "se.recompile.Mandos"

2485

2239

2486

@dbus_interface_annotations(_interface)

2487

def _foo(self):

2488

return { "org.freedesktop.DBus.Property"

2489

".EmitsChangedSignal":

2490

"false"}

2491

2492

2240

@dbus.service.signal(_interface, signature="o")

2493

2241

def ClientAdded(self, objpath):

2494

2242

"D-Bus signal"

2536

2284

2537

2285

del _interface

2538

2286

2539

mandos_dbus_service = MandosDBusService()

2287

class MandosDBusServiceTransitional(MandosDBusService):

2288

__metaclass__ = AlternateDBusNamesMetaclass

2289

mandos_dbus_service = MandosDBusServiceTransitional()

2540

2290

2541

2291

def cleanup():

2542

2292

"Cleanup function; run on exit"

2545

2295

multiprocessing.active_children()

2546

2296

if not (tcp_server.clients or client_settings):

2547

2297

return

2548

2549

# Store client before exiting. Secrets are encrypted with key

2550

# based on what config file has. If config file is

2551

# removed/edited, old secret will thus be unrecovable.

2552

clients = {}

2553

with PGPEngine() as pgp:

2554

for client in tcp_server.clients.itervalues():

2555

key = client_settings[client.name]["secret"]

2556

client.encrypted_secret = pgp.encrypt(client.secret,

2557

key)

2558

client_dict = {}

2559

2560

# A list of attributes that can not be pickled

2561

# + secret.

2562

exclude = set(("bus", "changedstate", "secret",

2563

"checker"))

2564

for name, typ in (inspect.getmembers

2565

(dbus.service.Object)):

2566

exclude.add(name)

2567

2568

client_dict["encrypted_secret"] = (client

2569

.encrypted_secret)

2570

for attr in client.client_structure:

2571

if attr not in exclude:

2572

client_dict[attr] = getattr(client, attr)

2573

2574

clients[client.name] = client_dict

2575

del client_settings[client.name]["secret"]

2576

2298

2299

# Store client before exiting. Secrets are encrypted with key based

2300

# on what config file has. If config file is removed/edited, old

2301

# secret will thus be unrecovable.

2302

clients = []

2303

for client in tcp_server.clients.itervalues():

2304

client.encrypt_secret(client_settings[client.name]["secret"])

2305

2306

client_dict = {}

2307

2308

# A list of attributes that will not be stored when shuting down.

2309

exclude = set(("bus", "changedstate", "secret"))

2310

for name, typ in inspect.getmembers(dbus.service.Object):

2311

exclude.add(name)

2312

2313

client_dict["encrypted_secret"] = client.encrypted_secret

2314

for attr in client.client_structure:

2315

if attr not in exclude:

2316

client_dict[attr] = getattr(client, attr)

2317

2318

clients.append(client_dict)

2319

del client_settings[client.name]["secret"]

2320

2577

2321

try:

2578

with (tempfile.NamedTemporaryFile

2579

(mode='wb', suffix=".pickle", prefix='clients-',

2580

dir=os.path.dirname(stored_state_path),

2581

delete=False)) as stored_state:

2322

with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:

2582

2323

pickle.dump((clients, client_settings), stored_state)

2583

tempname=stored_state.name

2584

os.rename(tempname, stored_state_path)

2585

except (IOError, OSError) as e:

2586

if not debug:

2587

try:

2588

os.remove(tempname)

2589

except NameError:

2590

pass

2591

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2592

logger.warning("Could not save persistent state: {0}"

2593

.format(os.strerror(e.errno)))

2594

else:

2595

logger.warning("Could not save persistent state:",

2596

exc_info=e)

2597

raise e

2598

2324

except IOError as e:

2325

logger.warning("Could not save persistant state: {0}".format(e))

2326

if e.errno != errno.ENOENT:

2327

raise

2328

2599

2329

# Delete all clients, and settings from config

2600

2330

while tcp_server.clients:

2601

2331

name, client = tcp_server.clients.popitem()

2619

2349

# Need to initiate checking of clients

2620

2350

if client.enabled:

2621

2351

client.init_checker()

2352

2622

2353

2623

2354

tcp_server.enable()

2624

2355

tcp_server.server_activate()

2627

2358

service.port = tcp_server.socket.getsockname()[1]

2628

2359

if use_ipv6:

2629

2360

logger.info("Now listening on address %r, port %d,"

2630

" flowinfo %d, scope_id %d",

2631

*tcp_server.socket.getsockname())

2361

" flowinfo %d, scope_id %d"

2362

% tcp_server.socket.getsockname())

2632

2363

else: # IPv4

2633

logger.info("Now listening on address %r, port %d",

2634

*tcp_server.socket.getsockname())

2364

logger.info("Now listening on address %r, port %d"

2365

% tcp_server.socket.getsockname())

2635

2366

2636

2367

#service.interface = tcp_server.socket.getsockname()[3]

2637

2368

2640

2371

try:

2641

2372

service.activate()

2642

2373

except dbus.exceptions.DBusException as error:

2643

logger.critical("D-Bus Exception", exc_info=error)

2374

logger.critical("DBusException: %s", error)

2644

2375

cleanup()

2645

2376

sys.exit(1)

2646

2377

# End of Avahi example code

2653

2384

logger.debug("Starting main loop")

2654

2385

main_loop.run()

2655

2386

except AvahiError as error:

2656

logger.critical("Avahi Error", exc_info=error)

2387

logger.critical("AvahiError: %s", error)

2657

2388

cleanup()

2658

2389

sys.exit(1)

2659

2390

except KeyboardInterrupt:

2664

2395

# Must run before the D-Bus bus name gets deregistered

2665

2396

cleanup()

2666

2397

2398

2667

2399

if __name__ == '__main__':

2668

2400

main()