/mandos/trunk : revision 518.2.3

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

65

import types

66

import binascii

67

import tempfile

68

import itertools

69

68

70

69

import dbus

71

70

import dbus.service

86

85

except ImportError:

87

86

SO_BINDTODEVICE = None

88

87

89

version = "1.5.3"

88

89

version = "1.4.1"

90

stored_state_file = "clients.pickle"

91

92

logger = logging.getLogger()

111

return interface_index

112

113

114

def initlogger(debug, level=logging.WARNING):

114

def initlogger(level=logging.WARNING):

115

"""init logger and add loglevel"""

116

117

syslogger.setFormatter(logging.Formatter

119

' %(message)s'))

120

logger.addHandler(syslogger)

121

122

if debug:

123

console = logging.StreamHandler()

124

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

125

' [%(process)d]:'

126

' %(levelname)s:'

127

' %(message)s'))

128

logger.addHandler(console)

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

129

128

logger.setLevel(level)

130

129

131

130

132

class PGPError(Exception):

133

"""Exception if encryption/decryption fails"""

131

class CryptoError(Exception):

134

132

pass

135

133

136

134

137

class PGPEngine(object):

135

class Crypto(object):

138

136

"""A simple class for OpenPGP symmetric encryption & decryption"""

139

137

def __init__(self):

140

138

self.gnupg = GnuPGInterface.GnuPG()

143

141

self.gnupg.options.meta_interactive = False

144

142

self.gnupg.options.homedir = self.tempdir

145

143

self.gnupg.options.extra_args.extend(['--force-mdc',

146

'--quiet',

147

'--no-use-agent'])

144

'--quiet'])

148

145

149

146

def __enter__(self):

150

147

return self

176

173

177

174

def encrypt(self, data, password):

178

175

self.gnupg.passphrase = self.password_encode(password)

179

with open(os.devnull, "w") as devnull:

176

with open(os.devnull) as devnull:

180

177

try:

181

178

proc = self.gnupg.run(['--symmetric'],

182

179

create_fhs=['stdin', 'stdout'],

187

184

ciphertext = f.read()

188

185

proc.wait()

189

186

except IOError as e:

190

raise PGPError(e)

187

raise CryptoError(e)

191

188

self.gnupg.passphrase = None

192

189

return ciphertext

193

190

194

191

def decrypt(self, data, password):

195

192

self.gnupg.passphrase = self.password_encode(password)

196

with open(os.devnull, "w") as devnull:

193

with open(os.devnull) as devnull:

197

194

try:

198

195

proc = self.gnupg.run(['--decrypt'],

199

196

create_fhs=['stdin', 'stdout'],

200

197

attach_fhs={'stderr': devnull})

201

with contextlib.closing(proc.handles['stdin']) as f:

198

with contextlib.closing(proc.handles['stdin'] ) as f:

202

199

f.write(data)

203

200

with contextlib.closing(proc.handles['stdout']) as f:

204

201

decrypted_plaintext = f.read()

205

202

proc.wait()

206

203

except IOError as e:

207

raise PGPError(e)

204

raise CryptoError(e)

208

205

self.gnupg.passphrase = None

209

206

return decrypted_plaintext

210

207

277

274

try:

278

275

self.add()

279

276

except dbus.exceptions.DBusException as error:

280

logger.critical("D-Bus Exception", exc_info=error)

277

logger.critical("DBusException: %s", error)

281

278

self.cleanup()

282

279

os._exit(1)

283

280

self.rename_count += 1

322

319

elif state == avahi.ENTRY_GROUP_FAILURE:

323

320

logger.critical("Avahi: Error in group state changed %s",

324

321

unicode(error))

325

raise AvahiGroupError("State changed: {0!s}"

326

.format(error))

322

raise AvahiGroupError("State changed: %s"

323

% unicode(error))

327

324

def cleanup(self):

328

325

"""Derived from the Avahi example code"""

329

326

if self.group is not None:

375

372

"""Add the new name to the syslog messages"""

376

373

ret = AvahiService.rename(self)

377

374

syslogger.setFormatter(logging.Formatter

378

('Mandos ({0}) [%(process)d]:'

379

' %(levelname)s: %(message)s'

380

.format(self.name)))

375

('Mandos (%s) [%%(process)d]:'

376

' %%(levelname)s: %%(message)s'

377

% self.name))

381

378

return ret

382

379

383

def timedelta_to_milliseconds(td):

380

def _timedelta_to_milliseconds(td):

384

381

"Convert a datetime.timedelta() to milliseconds"

385

382

return ((td.days * 24 * 60 * 60 * 1000)

386

383

+ (td.seconds * 1000)

390

387

"""A representation of a client host served by this server.

391

388

392

389

Attributes:

393

approved: bool(); 'None' if not yet approved/disapproved

390

_approved: bool(); 'None' if not yet approved/disapproved

394

391

approval_delay: datetime.timedelta(); Time to wait for approval

395

392

approval_duration: datetime.timedelta(); Duration of one approval

396

393

checker: subprocess.Popen(); a running checker process used

414

411

interval: datetime.timedelta(); How often to start a new checker

415

412

last_approval_request: datetime.datetime(); (UTC) or None

416

413

last_checked_ok: datetime.datetime(); (UTC) or None

414

417

415

last_checker_status: integer between 0 and 255 reflecting exit

418

416

status of last checker. -1 reflects crashed

419

checker, -2 means no checker completed yet.

417

checker, or None.

420

418

last_enabled: datetime.datetime(); (UTC) or None

421

419

name: string; from the config file, used in log messages and

422

420

D-Bus identifiers

423

421

secret: bytestring; sent verbatim (over TLS) to client

424

422

timeout: datetime.timedelta(); How long from last_checked_ok

425

423

until this client is disabled

426

extended_timeout: extra long timeout when secret has been sent

424

extended_timeout: extra long timeout when password has been sent

427

425

runtime_expansions: Allowed attributes for runtime expansion.

428

426

expires: datetime.datetime(); time (UTC) when a client will be

429

427

disabled, or None

433

431

"created", "enabled", "fingerprint",

434

432

"host", "interval", "last_checked_ok",

435

433

"last_enabled", "name", "timeout")

436

client_defaults = { "timeout": "5m",

437

"extended_timeout": "15m",

438

"interval": "2m",

439

"checker": "fping -q -- %%(host)s",

440

"host": "",

441

"approval_delay": "0s",

442

"approval_duration": "1s",

443

"approved_by_default": "True",

444

"enabled": "True",

445

}

446

434

447

435

def timeout_milliseconds(self):

448

436

"Return the 'timeout' attribute in milliseconds"

449

return timedelta_to_milliseconds(self.timeout)

437

return _timedelta_to_milliseconds(self.timeout)

450

438

451

439

def extended_timeout_milliseconds(self):

452

440

"Return the 'extended_timeout' attribute in milliseconds"

453

return timedelta_to_milliseconds(self.extended_timeout)

441

return _timedelta_to_milliseconds(self.extended_timeout)

454

442

455

443

def interval_milliseconds(self):

456

444

"Return the 'interval' attribute in milliseconds"

457

return timedelta_to_milliseconds(self.interval)

445

return _timedelta_to_milliseconds(self.interval)

458

446

459

447

def approval_delay_milliseconds(self):

460

return timedelta_to_milliseconds(self.approval_delay)

461

462

@staticmethod

463

def config_parser(config):

464

"""Construct a new dict of client settings of this form:

465

{ client_name: {setting_name: value, ...}, ...}

466

with exceptions for any special settings as defined above.

467

NOTE: Must be a pure function. Must return the same result

468

value given the same arguments.

469

"""

470

settings = {}

471

for client_name in config.sections():

472

section = dict(config.items(client_name))

473

client = settings[client_name] = {}

474

475

client["host"] = section["host"]

476

# Reformat values from string types to Python types

477

client["approved_by_default"] = config.getboolean(

478

client_name, "approved_by_default")

479

client["enabled"] = config.getboolean(client_name,

480

"enabled")

481

482

client["fingerprint"] = (section["fingerprint"].upper()

483

.replace(" ", ""))

484

if "secret" in section:

485

client["secret"] = section["secret"].decode("base64")

486

elif "secfile" in section:

487

with open(os.path.expanduser(os.path.expandvars

488

(section["secfile"])),

489

"rb") as secfile:

490

client["secret"] = secfile.read()

491

else:

492

raise TypeError("No secret or secfile for section {0}"

493

.format(section))

494

client["timeout"] = string_to_delta(section["timeout"])

495

client["extended_timeout"] = string_to_delta(

496

section["extended_timeout"])

497

client["interval"] = string_to_delta(section["interval"])

498

client["approval_delay"] = string_to_delta(

499

section["approval_delay"])

500

client["approval_duration"] = string_to_delta(

501

section["approval_duration"])

502

client["checker_command"] = section["checker"]

503

client["last_approval_request"] = None

504

client["last_checked_ok"] = None

505

client["last_checker_status"] = -2

506

507

return settings

508

509

510

def __init__(self, settings, name = None):

448

return _timedelta_to_milliseconds(self.approval_delay)

449

450

def __init__(self, name = None, config=None):

511

451

"""Note: the 'checker' key in 'config' sets the

512

452

'checker_command' attribute and *not* the 'checker'

513

453

attribute."""

514

454

self.name = name

515

# adding all client settings

516

for setting, value in settings.iteritems():

517

setattr(self, setting, value)

518

519

if self.enabled:

520

if not hasattr(self, "last_enabled"):

521

self.last_enabled = datetime.datetime.utcnow()

522

if not hasattr(self, "expires"):

523

self.expires = (datetime.datetime.utcnow()

524

+ self.timeout)

525

else:

526

self.last_enabled = None

527

self.expires = None

528

455

if config is None:

456

config = {}

529

457

logger.debug("Creating client %r", self.name)

530

458

# Uppercase and remove spaces from fingerprint for later

531

459

# comparison purposes with return value from the fingerprint()

532

460

# function

461

self.fingerprint = (config["fingerprint"].upper()

462

.replace(" ", ""))

533

463

logger.debug(" Fingerprint: %s", self.fingerprint)

534

self.created = settings.get("created",

535

datetime.datetime.utcnow())

536

537

# attributes specific for this server instance

464

if "secret" in config:

465

self.secret = config["secret"].decode("base64")

466

elif "secfile" in config:

467

with open(os.path.expanduser(os.path.expandvars

468

(config["secfile"])),

469

"rb") as secfile:

470

self.secret = secfile.read()

471

else:

472

raise TypeError("No secret or secfile for client %s"

473

% self.name)

474

self.host = config.get("host", "")

475

self.created = datetime.datetime.utcnow()

476

self.enabled = config.get("enabled", True)

477

self.last_approval_request = None

478

if self.enabled:

479

self.last_enabled = datetime.datetime.utcnow()

480

else:

481

self.last_enabled = None

482

self.last_checked_ok = None

483

self.last_checker_status = None

484

self.timeout = string_to_delta(config["timeout"])

485

self.extended_timeout = string_to_delta(config

486

["extended_timeout"])

487

self.interval = string_to_delta(config["interval"])

538

488

self.checker = None

539

489

self.checker_initiator_tag = None

540

490

self.disable_initiator_tag = None

491

if self.enabled:

492

self.expires = datetime.datetime.utcnow() + self.timeout

493

else:

494

self.expires = None

541

495

self.checker_callback_tag = None

496

self.checker_command = config["checker"]

542

497

self.current_checker_command = None

543

self.approved = None

498

self._approved = None

499

self.approved_by_default = config.get("approved_by_default",

500

True)

544

501

self.approvals_pending = 0

502

self.approval_delay = string_to_delta(

503

config["approval_delay"])

504

self.approval_duration = string_to_delta(

505

config["approval_duration"])

545

506

self.changedstate = (multiprocessing_manager

546

507

.Condition(multiprocessing_manager

547

508

.Lock()))

614

575

self.checker_callback_tag = None

615

576

self.checker = None

616

577

if os.WIFEXITED(condition):

617

self.last_checker_status = os.WEXITSTATUS(condition)

578

self.last_checker_status = os.WEXITSTATUS(condition)

618

579

if self.last_checker_status == 0:

619

580

logger.info("Checker for %(name)s succeeded",

620

581

vars(self))

627

588

logger.warning("Checker for %(name)s crashed?",

628

589

vars(self))

629

590

630

def checked_ok(self):

631

"""Assert that the client has been seen, alive and well."""

632

self.last_checked_ok = datetime.datetime.utcnow()

633

self.last_checker_status = 0

634

self.bump_timeout()

635

636

def bump_timeout(self, timeout=None):

637

"""Bump up the timeout for this client."""

591

def checked_ok(self, timeout=None):

592

"""Bump up the timeout for this client.

593

594

This should only be called when the client has been seen,

595

alive and well.

596

"""

638

597

if timeout is None:

639

598

timeout = self.timeout

599

self.last_checked_ok = datetime.datetime.utcnow()

640

600

if self.disable_initiator_tag is not None:

641

601

gobject.source_remove(self.disable_initiator_tag)

642

602

if getattr(self, "enabled", False):

643

603

self.disable_initiator_tag = (gobject.timeout_add

644

(timedelta_to_milliseconds

604

(_timedelta_to_milliseconds

645

605

(timeout), self.disable))

646

606

self.expires = datetime.datetime.utcnow() + timeout

647

607

693

653

try:

694

654

command = self.checker_command % escaped_attrs

695

655

except TypeError as error:

696

logger.error('Could not format string "%s"',

697

self.checker_command, exc_info=error)

656

logger.error('Could not format string "%s":'

657

' %s', self.checker_command, error)

698

658

return True # Try again later

699

659

self.current_checker_command = command

700

660

try:

718

678

gobject.source_remove(self.checker_callback_tag)

719

679

self.checker_callback(pid, status, command)

720

680

except OSError as error:

721

logger.error("Failed to start subprocess",

722

exc_info=error)

681

logger.error("Failed to start subprocess: %s",

682

error)

723

683

# Re-run this periodically if run by gobject.timeout_add

724

684

return True

725

685

732

692

return

733

693

logger.debug("Stopping checker for %(name)s", vars(self))

734

694

try:

735

self.checker.terminate()

695

os.kill(self.checker.pid, signal.SIGTERM)

736

696

#time.sleep(0.5)

737

697

#if self.checker.poll() is None:

738

# self.checker.kill()

698

# os.kill(self.checker.pid, signal.SIGKILL)

739

699

except OSError as error:

740

700

if error.errno != errno.ESRCH: # No such process

741

701

raise

758

718

# "Set" method, so we fail early here:

759

719

if byte_arrays and signature != "ay":

760

720

raise ValueError("Byte arrays not supported for non-'ay'"

761

" signature {0!r}".format(signature))

721

" signature %r" % signature)

762

722

def decorator(func):

763

723

func._dbus_is_property = True

764

724

func._dbus_interface = dbus_interface

772

732

return decorator

773

733

774

734

775

def dbus_interface_annotations(dbus_interface):

776

"""Decorator for marking functions returning interface annotations.

777

778

Usage:

779

780

@dbus_interface_annotations("org.example.Interface")

781

def _foo(self): # Function name does not matter

782

return {"org.freedesktop.DBus.Deprecated": "true",

783

"org.freedesktop.DBus.Property.EmitsChangedSignal":

784

"false"}

785

"""

786

def decorator(func):

787

func._dbus_is_interface = True

788

func._dbus_interface = dbus_interface

789

func._dbus_name = dbus_interface

790

return func

791

return decorator

792

793

794

def dbus_annotations(annotations):

795

"""Decorator to annotate D-Bus methods, signals or properties

796

Usage:

797

798

@dbus_service_property("org.example.Interface", signature="b",

799

access="r")

800

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

801

"org.freedesktop.DBus.Property."

802

"EmitsChangedSignal": "false"})

803

def Property_dbus_property(self):

804

return dbus.Boolean(False)

805

"""

806

def decorator(func):

807

func._dbus_annotations = annotations

808

return func

809

return decorator

810

811

812

735

class DBusPropertyException(dbus.exceptions.DBusException):

813

736

"""A base class for D-Bus property-related exceptions

814

737

"""

837

760

"""

838

761

839

762

@staticmethod

840

def _is_dbus_thing(thing):

841

"""Returns a function testing if an attribute is a D-Bus thing

842

843

If called like _is_dbus_thing("method") it returns a function

844

suitable for use as predicate to inspect.getmembers().

845

"""

846

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

847

False)

763

def _is_dbus_property(obj):

764

return getattr(obj, "_dbus_is_property", False)

848

765

849

def _get_all_dbus_things(self, thing):

766

def _get_all_dbus_properties(self):

850

767

"""Returns a generator of (name, attribute) pairs

851

768

"""

852

return ((getattr(athing.__get__(self), "_dbus_name",

853

name),

854

athing.__get__(self))

769

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

855

770

for cls in self.__class__.__mro__

856

for name, athing in

857

inspect.getmembers(cls,

858

self._is_dbus_thing(thing)))

771

for name, prop in

772

inspect.getmembers(cls, self._is_dbus_property))

859

773

860

774

def _get_dbus_property(self, interface_name, property_name):

861

775

"""Returns a bound method if one exists which is a D-Bus

863

777

"""

864

778

for cls in self.__class__.__mro__:

865

779

for name, value in (inspect.getmembers

866

(cls,

867

self._is_dbus_thing("property"))):

780

(cls, self._is_dbus_property)):

868

781

if (value._dbus_name == property_name

869

782

and value._dbus_interface == interface_name):

870

783

return value.__get__(self)

899

812

# signatures other than "ay".

900

813

if prop._dbus_signature != "ay":

901

814

raise ValueError

902

value = dbus.ByteArray(b''.join(chr(byte)

903

for byte in value))

815

value = dbus.ByteArray(''.join(unichr(byte)

816

for byte in value))

904

817

prop(value)

905

818

906

819

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

912

825

Note: Will not include properties with access="write".

913

826

"""

914

827

properties = {}

915

for name, prop in self._get_all_dbus_things("property"):

828

for name, prop in self._get_all_dbus_properties():

916

829

if (interface_name

917

830

and interface_name != prop._dbus_interface):

918

831

# Interface non-empty but did not match

933

846

path_keyword='object_path',

934

847

connection_keyword='connection')

935

848

def Introspect(self, object_path, connection):

936

"""Overloading of standard D-Bus method.

937

938

Inserts property tags and interface annotation tags.

849

"""Standard D-Bus method, overloaded to insert property tags.

939

850

"""

940

851

xmlstring = dbus.service.Object.Introspect(self, object_path,

941

852

connection)

948

859

e.setAttribute("access", prop._dbus_access)

949

860

return e

950

861

for if_tag in document.getElementsByTagName("interface"):

951

# Add property tags

952

862

for tag in (make_tag(document, name, prop)

953

863

for name, prop

954

in self._get_all_dbus_things("property")

864

in self._get_all_dbus_properties()

955

865

if prop._dbus_interface

956

866

== if_tag.getAttribute("name")):

957

867

if_tag.appendChild(tag)

958

# Add annotation tags

959

for typ in ("method", "signal", "property"):

960

for tag in if_tag.getElementsByTagName(typ):

961

annots = dict()

962

for name, prop in (self.

963

_get_all_dbus_things(typ)):

964

if (name == tag.getAttribute("name")

965

and prop._dbus_interface

966

== if_tag.getAttribute("name")):

967

annots.update(getattr

968

(prop,

969

"_dbus_annotations",

970

{}))

971

for name, value in annots.iteritems():

972

ann_tag = document.createElement(

973

"annotation")

974

ann_tag.setAttribute("name", name)

975

ann_tag.setAttribute("value", value)

976

tag.appendChild(ann_tag)

977

# Add interface annotation tags

978

for annotation, value in dict(

979

itertools.chain(

980

*(annotations().iteritems()

981

for name, annotations in

982

self._get_all_dbus_things("interface")

983

if name == if_tag.getAttribute("name")

984

))).iteritems():

985

ann_tag = document.createElement("annotation")

986

ann_tag.setAttribute("name", annotation)

987

ann_tag.setAttribute("value", value)

988

if_tag.appendChild(ann_tag)

989

868

# Add the names to the return values for the

990

869

# "org.freedesktop.DBus.Properties" methods

991

870

if (if_tag.getAttribute("name")

1006

885

except (AttributeError, xml.dom.DOMException,

1007

886

xml.parsers.expat.ExpatError) as error:

1008

887

logger.error("Failed to override Introspection method",

1009

exc_info=error)

888

error)

1010

889

return xmlstring

1011

890

1012

891

1026

905

def __new__(mcs, name, bases, attr):

1027

906

# Go through all the base classes which could have D-Bus

1028

907

# methods, signals, or properties in them

1029

old_interface_names = []

1030

908

for base in (b for b in bases

1031

909

if issubclass(b, dbus.service.Object)):

1032

910

# Go though all attributes of the base class

1042

920

alt_interface = (attribute._dbus_interface

1043

921

.replace("se.recompile.Mandos",

1044

922

"se.bsnet.fukt.Mandos"))

1045

if alt_interface != attribute._dbus_interface:

1046

old_interface_names.append(alt_interface)

1047

923

# Is this a D-Bus signal?

1048

924

if getattr(attribute, "_dbus_is_signal", False):

1049

925

# Extract the original non-method function by

1064

940

nonmethod_func.func_name,

1065

941

nonmethod_func.func_defaults,

1066

942

nonmethod_func.func_closure)))

1067

# Copy annotations, if any

1068

try:

1069

new_function._dbus_annotations = (

1070

dict(attribute._dbus_annotations))

1071

except AttributeError:

1072

pass

1073

943

# Define a creator of a function to call both the

1074

944

# old and new functions, so both the old and new

1075

945

# signals gets sent when the function is called

1103

973

attribute.func_name,

1104

974

attribute.func_defaults,

1105

975

attribute.func_closure)))

1106

# Copy annotations, if any

1107

try:

1108

attr[attrname]._dbus_annotations = (

1109

dict(attribute._dbus_annotations))

1110

except AttributeError:

1111

pass

1112

976

# Is this a D-Bus property?

1113

977

elif getattr(attribute, "_dbus_is_property", False):

1114

978

# Create a new, but exactly alike, function

1128

992

attribute.func_name,

1129

993

attribute.func_defaults,

1130

994

attribute.func_closure)))

1131

# Copy annotations, if any

1132

try:

1133

attr[attrname]._dbus_annotations = (

1134

dict(attribute._dbus_annotations))

1135

except AttributeError:

1136

pass

1137

# Is this a D-Bus interface?

1138

elif getattr(attribute, "_dbus_is_interface", False):

1139

# Create a new, but exactly alike, function

1140

# object. Decorate it to be a new D-Bus interface

1141

# with the alternate D-Bus interface name. Add it

1142

# to the class.

1143

attr[attrname] = (dbus_interface_annotations

1144

(alt_interface)

1145

(types.FunctionType

1146

(attribute.func_code,

1147

attribute.func_globals,

1148

attribute.func_name,

1149

attribute.func_defaults,

1150

attribute.func_closure)))

1151

# Deprecate all old interfaces

1152

basename="_AlternateDBusNamesMetaclass_interface_annotation{0}"

1153

for old_interface_name in old_interface_names:

1154

@dbus_interface_annotations(old_interface_name)

1155

def func(self):

1156

return { "org.freedesktop.DBus.Deprecated": "true" }

1157

# Find an unused name

1158

for aname in (basename.format(i) for i in

1159

itertools.count()):

1160

if aname not in attr:

1161

attr[aname] = func

1162

break

1163

995

return type.__new__(mcs, name, bases, attr)

1164

996

1165

997

1179

1011

def __init__(self, bus = None, *args, **kwargs):

1180

1012

self.bus = bus

1181

1013

Client.__init__(self, *args, **kwargs)

1014

1015

self._approvals_pending = 0

1182

1016

# Only now, when this client is initialized, can it show up on

1183

1017

# the D-Bus

1184

1018

client_object_name = unicode(self.name).translate(

1230

1064

checker is not None)

1231

1065

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1232

1066

"LastCheckedOK")

1233

last_checker_status = notifychangeproperty(dbus.Int16,

1234

"LastCheckerStatus")

1235

1067

last_approval_request = notifychangeproperty(

1236

1068

datetime_to_dbus, "LastApprovalRequest")

1237

1069

approved_by_default = notifychangeproperty(dbus.Boolean,

1238

1070

"ApprovedByDefault")

1239

approval_delay = notifychangeproperty(dbus.UInt64,

1071

approval_delay = notifychangeproperty(dbus.UInt16,

1240

1072

"ApprovalDelay",

1241

1073

type_func =

1242

timedelta_to_milliseconds)

1074

_timedelta_to_milliseconds)

1243

1075

approval_duration = notifychangeproperty(

1244

dbus.UInt64, "ApprovalDuration",

1245

type_func = timedelta_to_milliseconds)

1076

dbus.UInt16, "ApprovalDuration",

1077

type_func = _timedelta_to_milliseconds)

1246

1078

host = notifychangeproperty(dbus.String, "Host")

1247

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1079

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1248

1080

type_func =

1249

timedelta_to_milliseconds)

1081

_timedelta_to_milliseconds)

1250

1082

extended_timeout = notifychangeproperty(

1251

dbus.UInt64, "ExtendedTimeout",

1252

type_func = timedelta_to_milliseconds)

1253

interval = notifychangeproperty(dbus.UInt64,

1083

dbus.UInt16, "ExtendedTimeout",

1084

type_func = _timedelta_to_milliseconds)

1085

interval = notifychangeproperty(dbus.UInt16,

1254

1086

"Interval",

1255

1087

type_func =

1256

timedelta_to_milliseconds)

1088

_timedelta_to_milliseconds)

1257

1089

checker_command = notifychangeproperty(dbus.String, "Checker")

1258

1090

1259

1091

del notifychangeproperty

1301

1133

return r

1302

1134

1303

1135

def _reset_approved(self):

1304

self.approved = None

1136

self._approved = None

1305

1137

return False

1306

1138

1307

1139

def approve(self, value=True):

1308

1140

self.send_changedstate()

1309

self.approved = value

1310

gobject.timeout_add(timedelta_to_milliseconds

1141

self._approved = value

1142

gobject.timeout_add(_timedelta_to_milliseconds

1311

1143

(self.approval_duration),

1312

1144

self._reset_approved)

1313

1145

1315

1147

## D-Bus methods, signals & properties

1316

1148

_interface = "se.recompile.Mandos.Client"

1317

1149

1318

## Interfaces

1319

1320

@dbus_interface_annotations(_interface)

1321

def _foo(self):

1322

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1323

"false"}

1324

1325

1150

## Signals

1326

1151

1327

1152

# CheckerCompleted - signal

1363

1188

"D-Bus signal"

1364

1189

return self.need_approval()

1365

1190

1191

# NeRwequest - signal

1192

@dbus.service.signal(_interface, signature="s")

1193

def NewRequest(self, ip):

1194

"""D-Bus signal

1195

Is sent after a client request a password.

1196

"""

1197

pass

1198

1366

1199

## Methods

1367

1200

1368

1201

# Approve - method

1426

1259

access="readwrite")

1427

1260

def ApprovalDuration_dbus_property(self, value=None):

1428

1261

if value is None: # get

1429

return dbus.UInt64(timedelta_to_milliseconds(

1262

return dbus.UInt64(_timedelta_to_milliseconds(

1430

1263

self.approval_duration))

1431

1264

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1432

1265

1446

1279

def Host_dbus_property(self, value=None):

1447

1280

if value is None: # get

1448

1281

return dbus.String(self.host)

1449

self.host = unicode(value)

1282

self.host = value

1450

1283

1451

1284

# Created - property

1452

1285

@dbus_service_property(_interface, signature="s", access="read")

1478

1311

return

1479

1312

return datetime_to_dbus(self.last_checked_ok)

1480

1313

1481

# LastCheckerStatus - property

1482

@dbus_service_property(_interface, signature="n",

1483

access="read")

1484

def LastCheckerStatus_dbus_property(self):

1485

return dbus.Int16(self.last_checker_status)

1486

1487

1314

# Expires - property

1488

1315

@dbus_service_property(_interface, signature="s", access="read")

1489

1316

def Expires_dbus_property(self):

1501

1328

if value is None: # get

1502

1329

return dbus.UInt64(self.timeout_milliseconds())

1503

1330

self.timeout = datetime.timedelta(0, 0, 0, value)

1331

if getattr(self, "disable_initiator_tag", None) is None:

1332

return

1504

1333

# Reschedule timeout

1505

if self.enabled:

1506

now = datetime.datetime.utcnow()

1507

time_to_die = timedelta_to_milliseconds(

1508

(self.last_checked_ok + self.timeout) - now)

1509

if time_to_die <= 0:

1510

# The timeout has passed

1511

self.disable()

1512

else:

1513

self.expires = (now +

1514

datetime.timedelta(milliseconds =

1515

time_to_die))

1516

if (getattr(self, "disable_initiator_tag", None)

1517

is None):

1518

return

1519

gobject.source_remove(self.disable_initiator_tag)

1520

self.disable_initiator_tag = (gobject.timeout_add

1521

(time_to_die,

1522

self.disable))

1334

gobject.source_remove(self.disable_initiator_tag)

1335

self.disable_initiator_tag = None

1336

self.expires = None

1337

time_to_die = _timedelta_to_milliseconds((self

1338

.last_checked_ok

1339

+ self.timeout)

1340

- datetime.datetime

1341

.utcnow())

1342

if time_to_die <= 0:

1343

# The timeout has passed

1344

self.disable()

1345

else:

1346

self.expires = (datetime.datetime.utcnow()

1347

+ datetime.timedelta(milliseconds =

1348

time_to_die))

1349

self.disable_initiator_tag = (gobject.timeout_add

1350

(time_to_die, self.disable))

1523

1351

1524

1352

# ExtendedTimeout - property

1525

1353

@dbus_service_property(_interface, signature="t",

1551

1379

def Checker_dbus_property(self, value=None):

1552

1380

if value is None: # get

1553

1381

return dbus.String(self.checker_command)

1554

self.checker_command = unicode(value)

1382

self.checker_command = value

1555

1383

1556

1384

# CheckerRunning - property

1557

1385

@dbus_service_property(_interface, signature="b",

1586

1414

raise KeyError()

1587

1415

1588

1416

def __getattribute__(self, name):

1589

if name == '_pipe':

1417

if(name == '_pipe'):

1590

1418

return super(ProxyClient, self).__getattribute__(name)

1591

1419

self._pipe.send(('getattr', name))

1592

1420

data = self._pipe.recv()

1599

1427

return func

1600

1428

1601

1429

def __setattr__(self, name, value):

1602

if name == '_pipe':

1430

if(name == '_pipe'):

1603

1431

return super(ProxyClient, self).__setattr__(name, value)

1604

1432

self._pipe.send(('setattr', name, value))

1605

1433

1674

1502

logger.warning("Bad certificate: %s", error)

1675

1503

return

1676

1504

logger.debug("Fingerprint: %s", fpr)

1505

if self.server.use_dbus:

1506

# Emit D-Bus signal

1507

client.NewRequest(str(self.client_address))

1677

1508

1678

1509

try:

1679

1510

client = ProxyClient(child_pipe, fpr,

1695

1526

client.Rejected("Disabled")

1696

1527

return

1697

1528

1698

if client.approved or not client.approval_delay:

1529

if client._approved or not client.approval_delay:

1699

1530

#We are approved or approval is disabled

1700

1531

break

1701

elif client.approved is None:

1532

elif client._approved is None:

1702

1533

logger.info("Client %s needs approval",

1703

1534

client.name)

1704

1535

if self.server.use_dbus:

1718

1549

time = datetime.datetime.now()

1719

1550

client.changedstate.acquire()

1720

1551

(client.changedstate.wait

1721

(float(client.timedelta_to_milliseconds(delay)

1552

(float(client._timedelta_to_milliseconds(delay)

1722

1553

/ 1000)))

1723

1554

client.changedstate.release()

1724

1555

time2 = datetime.datetime.now()

1750

1581

1751

1582

logger.info("Sending secret to %s", client.name)

1752

1583

# bump the timeout using extended_timeout

1753

client.bump_timeout(client.extended_timeout)

1584

client.checked_ok(client.extended_timeout)

1754

1585

if self.server.use_dbus:

1755

1586

# Emit D-Bus signal

1756

1587

client.GotSecret()

1832

1663

def sub_process_main(self, request, address):

1833

1664

try:

1834

1665

self.finish_request(request, address)

1835

except Exception:

1666

except:

1836

1667

self.handle_error(request, address)

1837

1668

self.close_request(request)

1838

1669

2079

1910

elif suffix == "w":

2080

1911

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2081

1912

else:

2082

raise ValueError("Unknown suffix {0!r}"

2083

.format(suffix))

1913

raise ValueError("Unknown suffix %r" % suffix)

2084

1914

except (ValueError, IndexError) as e:

2085

1915

raise ValueError(*(e.args))

2086

1916

timevalue += delta

2100

1930

sys.exit()

2101

1931

if not noclose:

2102

1932

# Close all standard open file descriptors

2103

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1933

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2104

1934

if not stat.S_ISCHR(os.fstat(null).st_mode):

2105

1935

raise OSError(errno.ENODEV,

2106

"{0} not a character device"

2107

.format(os.devnull))

1936

"%s not a character device"

1937

% os.path.devnull)

2108

1938

os.dup2(null, sys.stdin.fileno())

2109

1939

os.dup2(null, sys.stdout.fileno())

2110

1940

os.dup2(null, sys.stderr.fileno())

2119

1949

2120

1950

parser = argparse.ArgumentParser()

2121

1951

parser.add_argument("-v", "--version", action="version",

2122

version = "%(prog)s {0}".format(version),

1952

version = "%%(prog)s %s" % version,

2123

1953

help="show version number and exit")

2124

1954

parser.add_argument("-i", "--interface", metavar="IF",

2125

1955

help="Bind to interface IF")

2218

2048

stored_state_file)

2219

2049

2220

2050

if debug:

2221

initlogger(debug, logging.DEBUG)

2051

initlogger(logging.DEBUG)

2222

2052

else:

2223

2053

if not debuglevel:

2224

initlogger(debug)

2054

initlogger()

2225

2055

else:

2226

2056

level = getattr(logging, debuglevel.upper())

2227

initlogger(debug, level)

2057

initlogger(level)

2228

2058

2229

2059

if server_settings["servicename"] != "Mandos":

2230

2060

syslogger.setFormatter(logging.Formatter

2231

('Mandos ({0}) [%(process)d]:'

2232

' %(levelname)s: %(message)s'

2233

.format(server_settings

2234

["servicename"])))

2061

('Mandos (%s) [%%(process)d]:'

2062

' %%(levelname)s: %%(message)s'

2063

% server_settings["servicename"]))

2235

2064

2236

2065

# Parse config file with clients

2237

client_config = configparser.SafeConfigParser(Client

2238

.client_defaults)

2066

client_defaults = { "timeout": "5m",

2067

"extended_timeout": "15m",

2068

"interval": "2m",

2069

"checker": "fping -q -- %%(host)s",

2070

"host": "",

2071

"approval_delay": "0s",

2072

"approval_duration": "1s",

2073

}

2074

client_config = configparser.SafeConfigParser(client_defaults)

2239

2075

client_config.read(os.path.join(server_settings["configdir"],

2240

2076

"clients.conf"))

2241

2077

2258

2094

except IOError:

2259

2095

logger.error("Could not open file %r", pidfilename)

2260

2096

2261

for name in ("_mandos", "mandos", "nobody"):

2097

try:

2098

uid = pwd.getpwnam("_mandos").pw_uid

2099

gid = pwd.getpwnam("_mandos").pw_gid

2100

except KeyError:

2262

2101

try:

2263

uid = pwd.getpwnam(name).pw_uid

2264

gid = pwd.getpwnam(name).pw_gid

2265

break

2102

uid = pwd.getpwnam("mandos").pw_uid

2103

gid = pwd.getpwnam("mandos").pw_gid

2266

2104

except KeyError:

2267

continue

2268

else:

2269

uid = 65534

2270

gid = 65534

2105

try:

2106

uid = pwd.getpwnam("nobody").pw_uid

2107

gid = pwd.getpwnam("nobody").pw_gid

2108

except KeyError:

2109

uid = 65534

2110

gid = 65534

2271

2111

try:

2272

2112

os.setgid(gid)

2273

2113

os.setuid(uid)

2290

2130

.gnutls_global_set_log_function(debug_gnutls))

2291

2131

2292

2132

# Redirect stdin so all checkers get /dev/null

2293

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2133

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2294

2134

os.dup2(null, sys.stdin.fileno())

2295

2135

if null > 2:

2296

2136

os.close(null)

2137

else:

2138

# No console logging

2139

logger.removeHandler(console)

2297

2140

2298

2141

# Need to fork before connecting to D-Bus

2299

2142

if not debug:

2300

2143

# Close all input and output, do double fork, etc.

2301

2144

daemon()

2302

2145

2303

gobject.threads_init()

2304

2305

2146

global main_loop

2306

2147

# From the Avahi example code

2307

DBusGMainLoop(set_as_default=True)

2148

DBusGMainLoop(set_as_default=True )

2308

2149

main_loop = gobject.MainLoop()

2309

2150

bus = dbus.SystemBus()

2310

2151

# End of Avahi example code

2337

2178

client_class = functools.partial(ClientDBusTransitional,

2338

2179

bus = bus)

2339

2180

2340

client_settings = Client.config_parser(client_config)

2181

special_settings = {

2182

# Some settings need to be accessd by special methods;

2183

# booleans need .getboolean(), etc. Here is a list of them:

2184

"approved_by_default":

2185

lambda section:

2186

client_config.getboolean(section, "approved_by_default"),

2187

"enabled":

2188

lambda section:

2189

client_config.getboolean(section, "enabled"),

2190

}

2191

# Construct a new dict of client settings of this form:

2192

# { client_name: {setting_name: value, ...}, ...}

2193

# with exceptions for any special settings as defined above

2194

client_settings = dict((clientname,

2195

dict((setting,

2196

(value

2197

if setting not in special_settings

2198

else special_settings[setting]

2199

(clientname)))

2200

for setting, value in

2201

client_config.items(clientname)))

2202

for clientname in client_config.sections())

2203

2341

2204

old_client_settings = {}

2342

clients_data = {}

2205

clients_data = []

2343

2206

2344

2207

# Get client data and settings from last running state.

2345

2208

if server_settings["restore"]:

2353

2216

.format(e))

2354

2217

if e.errno != errno.ENOENT:

2355

2218

raise

2356

except EOFError as e:

2357

logger.warning("Could not load persistent state: "

2358

"EOFError: {0}".format(e))

2359

2219

2360

with PGPEngine() as pgp:

2361

for client_name, client in clients_data.iteritems():

2220

with Crypto() as crypt:

2221

for client in clients_data:

2222

client_name = client["name"]

2223

2362

2224

# Decide which value to use after restoring saved state.

2363

2225

# We have three different values: Old config file,

2364

2226

# new config file, and saved state.

2372

2234

if (name != "secret" and

2373

2235

value != old_client_settings[client_name]

2374

2236

[name]):

2375

client[name] = value

2237

setattr(client, name, value)

2376

2238

except KeyError:

2377

2239

pass

2378

2240

2379

2241

# Clients who has passed its expire date can still be

2380

# enabled if its last checker was successful. Clients

2381

# whose checker succeeded before we stored its state is

2382

# assumed to have successfully run all checkers during

2383

# downtime.

2384

if client["enabled"]:

2385

if datetime.datetime.utcnow() >= client["expires"]:

2386

if not client["last_checked_ok"]:

2387

logger.warning(

2388

"disabling client {0} - Client never "

2389

"performed a successful checker"

2390

.format(client_name))

2391

client["enabled"] = False

2392

elif client["last_checker_status"] != 0:

2393

logger.warning(

2394

"disabling client {0} - Client "

2395

"last checker failed with error code {1}"

2396

.format(client_name,

2397

client["last_checker_status"]))

2242

# enabled if its last checker was sucessful. Clients

2243

# whose checker failed before we stored its state is

2244

# assumed to have failed all checkers during downtime.

2245

if client["enabled"] and client["last_checked_ok"]:

2246

if ((datetime.datetime.utcnow()

2247

- client["last_checked_ok"])

2248

> client["interval"]):

2249

if client["last_checker_status"] != 0:

2398

2250

client["enabled"] = False

2399

2251

else:

2400

2252

client["expires"] = (datetime.datetime

2401

2253

.utcnow()

2402

2254

+ client["timeout"])

2403

logger.debug("Last checker succeeded,"

2404

" keeping {0} enabled"

2405

.format(client_name))

2255

2256

client["changedstate"] = (multiprocessing_manager

2257

.Condition

2258

(multiprocessing_manager

2259

.Lock()))

2260

if use_dbus:

2261

new_client = (ClientDBusTransitional.__new__

2262

(ClientDBusTransitional))

2263

tcp_server.clients[client_name] = new_client

2264

new_client.bus = bus

2265

for name, value in client.iteritems():

2266

setattr(new_client, name, value)

2267

client_object_name = unicode(client_name).translate(

2268

{ord("."): ord("_"),

2269

ord("-"): ord("_")})

2270

new_client.dbus_object_path = (dbus.ObjectPath

2271

("/clients/"

2272

+ client_object_name))

2273

DBusObjectWithProperties.__init__(new_client,

2274

new_client.bus,

2275

new_client

2276

.dbus_object_path)

2277

else:

2278

tcp_server.clients[client_name] = (Client.__new__

2279

(Client))

2280

for name, value in client.iteritems():

2281

setattr(tcp_server.clients[client_name],

2282

name, value)

2283

2406

2284

try:

2407

client["secret"] = (

2408

pgp.decrypt(client["encrypted_secret"],

2409

client_settings[client_name]

2410

["secret"]))

2411

except PGPError:

2285

tcp_server.clients[client_name].secret = (

2286

crypt.decrypt(tcp_server.clients[client_name]

2287

.encrypted_secret,

2288

client_settings[client_name]

2289

["secret"]))

2290

except CryptoError:

2412

2291

# If decryption fails, we use secret from new settings

2413

logger.debug("Failed to decrypt {0} old secret"

2414

.format(client_name))

2415

client["secret"] = (

2292

tcp_server.clients[client_name].secret = (

2416

2293

client_settings[client_name]["secret"])

2417

2418

2294

2419

# Add/remove clients based on new changes made to config

2420

for client_name in (set(old_client_settings)

2421

- set(client_settings)):

2422

del clients_data[client_name]

2423

for client_name in (set(client_settings)

2424

- set(old_client_settings)):

2425

clients_data[client_name] = client_settings[client_name]

2426

2427

# Create all client objects

2428

for client_name, client in clients_data.iteritems():

2429

tcp_server.clients[client_name] = client_class(

2430

name = client_name, settings = client)

2295

# Create/remove clients based on new changes made to config

2296

for clientname in set(old_client_settings) - set(client_settings):

2297

del tcp_server.clients[clientname]

2298

for clientname in set(client_settings) - set(old_client_settings):

2299

tcp_server.clients[clientname] = (client_class(name

2300

= clientname,

2301

config =

2302

client_settings

2303

[clientname]))

2431

2304

2432

2305

if not tcp_server.clients:

2433

2306

logger.warning("No clients defined")

2445

2318

# "pidfile" was never created

2446

2319

pass

2447

2320

del pidfilename

2321

2448

2322

signal.signal(signal.SIGINT, signal.SIG_IGN)

2449

2323

2450

2324

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2451

2325

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2452

2326

2453

2327

if use_dbus:

2454

class MandosDBusService(DBusObjectWithProperties):

2328

class MandosDBusService(dbus.service.Object):

2455

2329

"""A D-Bus proxy object"""

2456

2330

def __init__(self):

2457

2331

dbus.service.Object.__init__(self, bus, "/")

2458

2332

_interface = "se.recompile.Mandos"

2459

2333

2460

@dbus_interface_annotations(_interface)

2461

def _foo(self):

2462

return { "org.freedesktop.DBus.Property"

2463

".EmitsChangedSignal":

2464

"false"}

2465

2466

2334

@dbus.service.signal(_interface, signature="o")

2467

2335

def ClientAdded(self, objpath):

2468

2336

"D-Bus signal"

2525

2393

# Store client before exiting. Secrets are encrypted with key

2526

2394

# based on what config file has. If config file is

2527

2395

# removed/edited, old secret will thus be unrecovable.

2528

clients = {}

2529

with PGPEngine() as pgp:

2396

clients = []

2397

with Crypto() as crypt:

2530

2398

for client in tcp_server.clients.itervalues():

2531

2399

key = client_settings[client.name]["secret"]

2532

client.encrypted_secret = pgp.encrypt(client.secret,

2533

key)

2400

client.encrypted_secret = crypt.encrypt(client.secret,

2401

key)

2534

2402

client_dict = {}

2535

2403

2536

# A list of attributes that can not be pickled

2537

# + secret.

2538

exclude = set(("bus", "changedstate", "secret",

2539

"checker"))

2404

# A list of attributes that will not be stored when

2405

# shutting down.

2406

exclude = set(("bus", "changedstate", "secret"))

2540

2407

for name, typ in (inspect.getmembers

2541

2408

(dbus.service.Object)):

2542

2409

exclude.add(name)

2547

2414

if attr not in exclude:

2548

2415

client_dict[attr] = getattr(client, attr)

2549

2416

2550

clients[client.name] = client_dict

2417

clients.append(client_dict)

2551

2418

del client_settings[client.name]["secret"]

2552

2419

2553

2420

try:

2554

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2555

prefix="clients-",

2556

dir=os.path.dirname

2557

(stored_state_path))

2558

with os.fdopen(tempfd, "wb") as stored_state:

2421

with os.fdopen(os.open(stored_state_path,

2422

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2423

0600), "wb") as stored_state:

2559

2424

pickle.dump((clients, client_settings), stored_state)

2560

os.rename(tempname, stored_state_path)

2561

2425

except (IOError, OSError) as e:

2562

2426

logger.warning("Could not save persistent state: {0}"

2563

2427

.format(e))

2564

if not debug:

2565

try:

2566

os.remove(tempname)

2567

except NameError:

2568

pass

2569

if e.errno not in set((errno.ENOENT, errno.EACCES,

2570

errno.EEXIST)):

2571

raise e

2428

if e.errno not in (errno.ENOENT, errno.EACCES):

2429

raise

2572

2430

2573

2431

# Delete all clients, and settings from config

2574

2432

while tcp_server.clients:

2601

2459

service.port = tcp_server.socket.getsockname()[1]

2602

2460

if use_ipv6:

2603

2461

logger.info("Now listening on address %r, port %d,"

2604

" flowinfo %d, scope_id %d",

2605

*tcp_server.socket.getsockname())

2462

" flowinfo %d, scope_id %d"

2463

% tcp_server.socket.getsockname())

2606

2464

else: # IPv4

2607

logger.info("Now listening on address %r, port %d",

2608

*tcp_server.socket.getsockname())

2465

logger.info("Now listening on address %r, port %d"

2466

% tcp_server.socket.getsockname())

2609

2467

2610

2468

#service.interface = tcp_server.socket.getsockname()[3]

2611

2469

2614

2472

try:

2615

2473

service.activate()

2616

2474

except dbus.exceptions.DBusException as error:

2617

logger.critical("D-Bus Exception", exc_info=error)

2475

logger.critical("DBusException: %s", error)

2618

2476

cleanup()

2619

2477

sys.exit(1)

2620

2478

# End of Avahi example code

2627

2485

logger.debug("Starting main loop")

2628

2486

main_loop.run()

2629

2487

except AvahiError as error:

2630

logger.critical("Avahi Error", exc_info=error)

2488

logger.critical("AvahiError: %s", error)

2631

2489

cleanup()

2632

2490

sys.exit(1)

2633

2491

except KeyboardInterrupt:

2638

2496

# Must run before the D-Bus bus name gets deregistered

2639

2497

cleanup()

2640

2498

2499

2641

2500

if __name__ == '__main__':

2642

2501

main()