/mandos/trunk : revision 523

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

37

import SocketServer as socketserver

40

38

import socket

41

39

import argparse

65

63

import cPickle as pickle

66

64

import multiprocessing

67

65

import types

68

import binascii

69

import tempfile

70

import itertools

71

import collections

66

import hashlib

72

67

73

68

import dbus

74

69

import dbus.service

79

74

import ctypes.util

80

75

import xml.dom.minidom

81

76

import inspect

77

import Crypto.Cipher.AES

82

78

83

79

try:

84

80

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

88

84

except ImportError:

89

85

SO_BINDTODEVICE = None

90

86

91

if sys.version_info.major == 2:

92

str = unicode

93

87

94

version = "1.6.9"

95

stored_state_file = "clients.pickle"

88

version = "1.4.1"

96

89

97

90

logger = logging.getLogger()

98

syslogger = None

99

100

try:

101

if_nametoindex = (ctypes.cdll.LoadLibrary

102

(ctypes.util.find_library("c"))

103

.if_nametoindex)

104

except (OSError, AttributeError):

105

def if_nametoindex(interface):

106

"Get an interface index the hard way, i.e. using fcntl()"

107

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

108

with contextlib.closing(socket.socket()) as s:

109

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

110

struct.pack(b"16s16x", interface))

111

interface_index = struct.unpack("I", ifreq[16:20])[0]

112

return interface_index

113

114

115

def initlogger(debug, level=logging.WARNING):

116

"""init logger and add loglevel"""

117

118

global syslogger

119

syslogger = (logging.handlers.SysLogHandler

120

(facility =

121

logging.handlers.SysLogHandler.LOG_DAEMON,

122

address = "/dev/log"))

123

syslogger.setFormatter(logging.Formatter

124

('Mandos [%(process)d]: %(levelname)s:'

125

' %(message)s'))

126

logger.addHandler(syslogger)

127

128

if debug:

129

console = logging.StreamHandler()

130

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

131

' [%(process)d]:'

132

' %(levelname)s:'

133

' %(message)s'))

134

logger.addHandler(console)

135

logger.setLevel(level)

136

137

138

class PGPError(Exception):

139

"""Exception if encryption/decryption fails"""

140

pass

141

142

143

class PGPEngine(object):

144

"""A simple class for OpenPGP symmetric encryption & decryption"""

145

def __init__(self):

146

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

147

self.gnupgargs = ['--batch',

148

'--home', self.tempdir,

149

'--force-mdc',

150

'--quiet',

151

'--no-use-agent']

152

153

def __enter__(self):

154

return self

155

156

def __exit__(self, exc_type, exc_value, traceback):

157

self._cleanup()

158

return False

159

160

def __del__(self):

161

self._cleanup()

162

163

def _cleanup(self):

164

if self.tempdir is not None:

165

# Delete contents of tempdir

166

for root, dirs, files in os.walk(self.tempdir,

167

topdown = False):

168

for filename in files:

169

os.remove(os.path.join(root, filename))

170

for dirname in dirs:

171

os.rmdir(os.path.join(root, dirname))

172

# Remove tempdir

173

os.rmdir(self.tempdir)

174

self.tempdir = None

175

176

def password_encode(self, password):

177

# Passphrase can not be empty and can not contain newlines or

178

# NUL bytes. So we prefix it and hex encode it.

179

encoded = b"mandos" + binascii.hexlify(password)

180

if len(encoded) > 2048:

181

# GnuPG can't handle long passwords, so encode differently

182

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

183

.replace(b"\n", b"\\n")

184

.replace(b"\0", b"\\x00"))

185

return encoded

186

187

def encrypt(self, data, password):

188

passphrase = self.password_encode(password)

189

with tempfile.NamedTemporaryFile(dir=self.tempdir

190

) as passfile:

191

passfile.write(passphrase)

192

passfile.flush()

193

proc = subprocess.Popen(['gpg', '--symmetric',

194

'--passphrase-file',

195

passfile.name]

196

+ self.gnupgargs,

197

stdin = subprocess.PIPE,

198

stdout = subprocess.PIPE,

199

stderr = subprocess.PIPE)

200

ciphertext, err = proc.communicate(input = data)

201

if proc.returncode != 0:

202

raise PGPError(err)

203

return ciphertext

204

205

def decrypt(self, data, password):

206

passphrase = self.password_encode(password)

207

with tempfile.NamedTemporaryFile(dir = self.tempdir

208

) as passfile:

209

passfile.write(passphrase)

210

passfile.flush()

211

proc = subprocess.Popen(['gpg', '--decrypt',

212

'--passphrase-file',

213

passfile.name]

214

+ self.gnupgargs,

215

stdin = subprocess.PIPE,

216

stdout = subprocess.PIPE,

217

stderr = subprocess.PIPE)

218

decrypted_plaintext, err = proc.communicate(input

219

= data)

220

if proc.returncode != 0:

221

raise PGPError(err)

222

return decrypted_plaintext

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

93

syslogger = (logging.handlers.SysLogHandler

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

address = str("/dev/log")))

96

syslogger.setFormatter(logging.Formatter

97

('Mandos [%(process)d]: %(levelname)s:'

98

' %(message)s'))

99

logger.addHandler(syslogger)

100

101

console = logging.StreamHandler()

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

104

' %(levelname)s:'

105

' %(message)s'))

106

logger.addHandler(console)

223

107

224

108

225

109

class AvahiError(Exception):

226

110

def __init__(self, value, *args, **kwargs):

227

111

self.value = value

228

return super(AvahiError, self).__init__(value, *args,

229

**kwargs)

112

super(AvahiError, self).__init__(value, *args, **kwargs)

113

def __unicode__(self):

114

return unicode(repr(self.value))

230

115

231

116

class AvahiServiceError(AvahiError):

232

117

pass

243

128

Used to optionally bind to the specified interface.

244

129

name: string; Example: 'Mandos'

245

130

type: string; Example: '_mandos._tcp'.

246

See <https://www.iana.org/assignments/service-names-port-numbers>

131

See <http://www.dns-sd.org/ServiceTypes.html>

247

132

port: integer; what port to announce

248

133

TXT: list of strings; TXT record for the service

249

134

domain: string; Domain to publish on, default to .local if empty.

255

140

server: D-Bus Server

256

141

bus: dbus.SystemBus()

257

142

"""

258

259

143

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

144

servicetype = None, port = None, TXT = None,

261

145

domain = "", host = "", max_renames = 32768,

274

158

self.server = None

275

159

self.bus = bus

276

160

self.entry_group_state_changed_match = None

277

278

def rename(self, remove=True):

161

def rename(self):

279

162

"""Derived from the Avahi example code"""

280

163

if self.rename_count >= self.max_renames:

281

164

logger.critical("No suitable Zeroconf service name found"

282

165

" after %i retries, exiting.",

283

166

self.rename_count)

284

167

raise AvahiServiceError("Too many renames")

285

self.name = str(self.server

286

.GetAlternativeServiceName(self.name))

287

self.rename_count += 1

168

self.name = unicode(self.server

169

.GetAlternativeServiceName(self.name))

288

170

logger.info("Changing Zeroconf service name to %r ...",

289

171

self.name)

290

if remove:

291

self.remove()

172

self.remove()

292

173

try:

293

174

self.add()

294

175

except dbus.exceptions.DBusException as error:

295

if (error.get_dbus_name()

296

== "org.freedesktop.Avahi.CollisionError"):

297

logger.info("Local Zeroconf service name collision.")

298

return self.rename(remove=False)

299

else:

300

logger.critical("D-Bus Exception", exc_info=error)

301

self.cleanup()

302

os._exit(1)

303

176

logger.critical("DBusException: %s", error)

177

self.cleanup()

178

os._exit(1)

179

self.rename_count += 1

304

180

def remove(self):

305

181

"""Derived from the Avahi example code"""

306

182

if self.entry_group_state_changed_match is not None:

308

184

self.entry_group_state_changed_match = None

309

185

if self.group is not None:

310

186

self.group.Reset()

311

312

187

def add(self):

313

188

"""Derived from the Avahi example code"""

314

189

self.remove()

331

206

dbus.UInt16(self.port),

332

207

avahi.string_array_to_txt_array(self.TXT))

333

208

self.group.Commit()

334

335

209

def entry_group_state_changed(self, state, error):

336

210

"""Derived from the Avahi example code"""

337

211

logger.debug("Avahi entry group state change: %i", state)

343

217

self.rename()

344

218

elif state == avahi.ENTRY_GROUP_FAILURE:

345

219

logger.critical("Avahi: Error in group state changed %s",

346

str(error))

347

raise AvahiGroupError("State changed: {!s}"

348

.format(error))

349

220

unicode(error))

221

raise AvahiGroupError("State changed: %s"

222

% unicode(error))

350

223

def cleanup(self):

351

224

"""Derived from the Avahi example code"""

352

225

if self.group is not None:

353

226

try:

354

227

self.group.Free()

355

228

except (dbus.exceptions.UnknownMethodException,

356

dbus.exceptions.DBusException):

229

dbus.exceptions.DBusException) as e:

357

230

pass

358

231

self.group = None

359

232

self.remove()

360

361

233

def server_state_changed(self, state, error=None):

362

234

"""Derived from the Avahi example code"""

363

235

logger.debug("Avahi server state change: %i", state)

382

254

logger.debug("Unknown state: %r", state)

383

255

else:

384

256

logger.debug("Unknown state: %r: %r", state, error)

385

386

257

def activate(self):

387

258

"""Derived from the Avahi example code"""

388

259

if self.server is None:

395

266

self.server_state_changed)

396

267

self.server_state_changed(self.server.GetState())

397

268

398

399

269

class AvahiServiceToSyslog(AvahiService):

400

def rename(self, *args, **kwargs):

270

def rename(self):

401

271

"""Add the new name to the syslog messages"""

402

ret = AvahiService.rename(self, *args, **kwargs)

272

ret = AvahiService.rename(self)

403

273

syslogger.setFormatter(logging.Formatter

404

('Mandos ({}) [%(process)d]:'

405

' %(levelname)s: %(message)s'

406

.format(self.name)))

274

('Mandos (%s) [%%(process)d]:'

275

' %%(levelname)s: %%(message)s'

276

% self.name))

407

277

return ret

408

278

409

279

def _timedelta_to_milliseconds(td):

280

"Convert a datetime.timedelta() to milliseconds"

281

return ((td.days * 24 * 60 * 60 * 1000)

282

+ (td.seconds * 1000)

283

+ (td.microseconds // 1000))

284

410

285

class Client(object):

411

286

"""A representation of a client host served by this server.

412

287

413

288

Attributes:

414

approved: bool(); 'None' if not yet approved/disapproved

289

_approved: bool(); 'None' if not yet approved/disapproved

415

290

approval_delay: datetime.timedelta(); Time to wait for approval

416

291

approval_duration: datetime.timedelta(); Duration of one approval

417

292

checker: subprocess.Popen(); a running checker process used

436

311

last_approval_request: datetime.datetime(); (UTC) or None

437

312

last_checked_ok: datetime.datetime(); (UTC) or None

438

313

last_checker_status: integer between 0 and 255 reflecting exit

439

status of last checker. -1 reflects crashed

440

checker, -2 means no checker completed yet.

441

last_enabled: datetime.datetime(); (UTC) or None

314

status of last checker. -1 reflect crashed

315

checker, or None.

316

last_enabled: datetime.datetime(); (UTC)

442

317

name: string; from the config file, used in log messages and

443

318

D-Bus identifiers

444

319

secret: bytestring; sent verbatim (over TLS) to client

445

320

timeout: datetime.timedelta(); How long from last_checked_ok

446

321

until this client is disabled

447

extended_timeout: extra long timeout when secret has been sent

322

extended_timeout: extra long timeout when password has been sent

448

323

runtime_expansions: Allowed attributes for runtime expansion.

449

324

expires: datetime.datetime(); time (UTC) when a client will be

450

325

disabled, or None

451

server_settings: The server_settings dict from main()

452

326

"""

453

327

454

328

runtime_expansions = ("approval_delay", "approval_duration",

455

"created", "enabled", "expires",

456

"fingerprint", "host", "interval",

457

"last_approval_request", "last_checked_ok",

329

"created", "enabled", "fingerprint",

330

"host", "interval", "last_checked_ok",

458

331

"last_enabled", "name", "timeout")

459

client_defaults = { "timeout": "PT5M",

460

"extended_timeout": "PT15M",

461

"interval": "PT2M",

462

"checker": "fping -q -- %%(host)s",

463

"host": "",

464

"approval_delay": "PT0S",

465

"approval_duration": "PT1S",

466

"approved_by_default": "True",

467

"enabled": "True",

468

}

469

470

@staticmethod

471

def config_parser(config):

472

"""Construct a new dict of client settings of this form:

473

{ client_name: {setting_name: value, ...}, ...}

474

with exceptions for any special settings as defined above.

475

NOTE: Must be a pure function. Must return the same result

476

value given the same arguments.

477

"""

478

settings = {}

479

for client_name in config.sections():

480

section = dict(config.items(client_name))

481

client = settings[client_name] = {}

482

483

client["host"] = section["host"]

484

# Reformat values from string types to Python types

485

client["approved_by_default"] = config.getboolean(

486

client_name, "approved_by_default")

487

client["enabled"] = config.getboolean(client_name,

488

"enabled")

489

490

# Uppercase and remove spaces from fingerprint for later

491

# comparison purposes with return value from the

492

# fingerprint() function

493

client["fingerprint"] = (section["fingerprint"].upper()

494

.replace(" ", ""))

495

if "secret" in section:

496

client["secret"] = section["secret"].decode("base64")

497

elif "secfile" in section:

498

with open(os.path.expanduser(os.path.expandvars

499

(section["secfile"])),

500

"rb") as secfile:

501

client["secret"] = secfile.read()

502

else:

503

raise TypeError("No secret or secfile for section {}"

504

.format(section))

505

client["timeout"] = string_to_delta(section["timeout"])

506

client["extended_timeout"] = string_to_delta(

507

section["extended_timeout"])

508

client["interval"] = string_to_delta(section["interval"])

509

client["approval_delay"] = string_to_delta(

510

section["approval_delay"])

511

client["approval_duration"] = string_to_delta(

512

section["approval_duration"])

513

client["checker_command"] = section["checker"]

514

client["last_approval_request"] = None

515

client["last_checked_ok"] = None

516

client["last_checker_status"] = -2

517

518

return settings

519

520

def __init__(self, settings, name = None, server_settings=None):

332

333

def timeout_milliseconds(self):

334

"Return the 'timeout' attribute in milliseconds"

335

return _timedelta_to_milliseconds(self.timeout)

336

337

def extended_timeout_milliseconds(self):

338

"Return the 'extended_timeout' attribute in milliseconds"

339

return _timedelta_to_milliseconds(self.extended_timeout)

340

341

def interval_milliseconds(self):

342

"Return the 'interval' attribute in milliseconds"

343

return _timedelta_to_milliseconds(self.interval)

344

345

def approval_delay_milliseconds(self):

346

return _timedelta_to_milliseconds(self.approval_delay)

347

348

def __init__(self, name = None, config=None):

349

"""Note: the 'checker' key in 'config' sets the

350

'checker_command' attribute and *not* the 'checker'

351

attribute."""

521

352

self.name = name

522

if server_settings is None:

523

server_settings = {}

524

self.server_settings = server_settings

525

# adding all client settings

526

for setting, value in settings.items():

527

setattr(self, setting, value)

528

529

if self.enabled:

530

if not hasattr(self, "last_enabled"):

531

self.last_enabled = datetime.datetime.utcnow()

532

if not hasattr(self, "expires"):

533

self.expires = (datetime.datetime.utcnow()

534

+ self.timeout)

535

else:

536

self.last_enabled = None

537

self.expires = None

538

353

if config is None:

354

config = {}

539

355

logger.debug("Creating client %r", self.name)

356

# Uppercase and remove spaces from fingerprint for later

357

# comparison purposes with return value from the fingerprint()

358

# function

359

self.fingerprint = (config["fingerprint"].upper()

360

.replace(" ", ""))

540

361

logger.debug(" Fingerprint: %s", self.fingerprint)

541

self.created = settings.get("created",

542

datetime.datetime.utcnow())

543

544

# attributes specific for this server instance

362

if "secret" in config:

363

self.secret = config["secret"].decode("base64")

364

elif "secfile" in config:

365

with open(os.path.expanduser(os.path.expandvars

366

(config["secfile"])),

367

"rb") as secfile:

368

self.secret = secfile.read()

369

else:

370

raise TypeError("No secret or secfile for client %s"

371

% self.name)

372

self.host = config.get("host", "")

373

self.created = datetime.datetime.utcnow()

374

self.enabled = True

375

self.last_approval_request = None

376

self.last_enabled = datetime.datetime.utcnow()

377

self.last_checked_ok = None

378

self.last_checker_status = None

379

self.timeout = string_to_delta(config["timeout"])

380

self.extended_timeout = string_to_delta(config

381

["extended_timeout"])

382

self.interval = string_to_delta(config["interval"])

545

383

self.checker = None

546

384

self.checker_initiator_tag = None

547

385

self.disable_initiator_tag = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

548

387

self.checker_callback_tag = None

388

self.checker_command = config["checker"]

549

389

self.current_checker_command = None

550

self.approved = None

390

self._approved = None

391

self.approved_by_default = config.get("approved_by_default",

392

True)

551

393

self.approvals_pending = 0

394

self.approval_delay = string_to_delta(

395

config["approval_delay"])

396

self.approval_duration = string_to_delta(

397

config["approval_duration"])

552

398

self.changedstate = (multiprocessing_manager

553

399

.Condition(multiprocessing_manager

554

400

.Lock()))

555

self.client_structure = [attr for attr in

556

self.__dict__.iterkeys()

401

self.client_structure = [attr for attr

402

in self.__dict__.iterkeys()

557

403

if not attr.startswith("_")]

558

404

self.client_structure.append("client_structure")

559

405

406

560

407

for name, t in inspect.getmembers(type(self),

561

408

lambda obj:

562

409

isinstance(obj,

574

421

if getattr(self, "enabled", False):

575

422

# Already enabled

576

423

return

424

self.send_changedstate()

577

425

self.expires = datetime.datetime.utcnow() + self.timeout

578

426

self.enabled = True

579

427

self.last_enabled = datetime.datetime.utcnow()

580

428

self.init_checker()

581

self.send_changedstate()

582

429

583

430

def disable(self, quiet=True):

584

431

"""Disable this client."""

585

432

if not getattr(self, "enabled", False):

586

433

return False

587

434

if not quiet:

435

self.send_changedstate()

436

if not quiet:

588

437

logger.info("Disabling client %s", self.name)

589

if getattr(self, "disable_initiator_tag", None) is not None:

438

if getattr(self, "disable_initiator_tag", False):

590

439

gobject.source_remove(self.disable_initiator_tag)

591

440

self.disable_initiator_tag = None

592

441

self.expires = None

593

if getattr(self, "checker_initiator_tag", None) is not None:

442

if getattr(self, "checker_initiator_tag", False):

594

443

gobject.source_remove(self.checker_initiator_tag)

595

444

self.checker_initiator_tag = None

596

445

self.stop_checker()

597

446

self.enabled = False

598

if not quiet:

599

self.send_changedstate()

600

447

# Do not run this again if called by a gobject.timeout_add

601

448

return False

602

449

603

450

def __del__(self):

604

451

self.disable()

605

452

606

453

def init_checker(self):

607

454

# Schedule a new checker to be started an 'interval' from now,

608

455

# and every interval from then on.

609

if self.checker_initiator_tag is not None:

610

gobject.source_remove(self.checker_initiator_tag)

611

456

self.checker_initiator_tag = (gobject.timeout_add

612

(int(self.interval

613

.total_seconds() * 1000),

457

(self.interval_milliseconds(),

614

458

self.start_checker))

615

459

# Schedule a disable() when 'timeout' has passed

616

if self.disable_initiator_tag is not None:

617

gobject.source_remove(self.disable_initiator_tag)

618

460

self.disable_initiator_tag = (gobject.timeout_add

619

(int(self.timeout

620

.total_seconds() * 1000),

621

self.disable))

461

(self.timeout_milliseconds(),

462

self.disable))

622

463

# Also start a new checker *right now*.

623

464

self.start_checker()

624

465

466

625

467

def checker_callback(self, pid, condition, command):

626

468

"""The checker has completed, so take appropriate actions."""

627

469

self.checker_callback_tag = None

628

470

self.checker = None

629

471

if os.WIFEXITED(condition):

630

self.last_checker_status = os.WEXITSTATUS(condition)

472

self.last_checker_status = os.WEXITSTATUS(condition)

631

473

if self.last_checker_status == 0:

632

474

logger.info("Checker for %(name)s succeeded",

633

475

vars(self))

640

482

logger.warning("Checker for %(name)s crashed?",

641

483

vars(self))

642

484

643

def checked_ok(self):

644

"""Assert that the client has been seen, alive and well."""

645

self.last_checked_ok = datetime.datetime.utcnow()

646

self.last_checker_status = 0

647

self.bump_timeout()

648

649

def bump_timeout(self, timeout=None):

650

"""Bump up the timeout for this client."""

485

def checked_ok(self, timeout=None):

486

"""Bump up the timeout for this client.

487

488

This should only be called when the client has been seen,

489

alive and well.

490

"""

651

491

if timeout is None:

652

492

timeout = self.timeout

493

self.last_checked_ok = datetime.datetime.utcnow()

653

494

if self.disable_initiator_tag is not None:

654

495

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = None

656

496

if getattr(self, "enabled", False):

657

497

self.disable_initiator_tag = (gobject.timeout_add

658

(int(timeout.total_seconds()

659

* 1000), self.disable))

498

(_timedelta_to_milliseconds

499

(timeout), self.disable))

660

500

self.expires = datetime.datetime.utcnow() + timeout

661

501

662

502

def need_approval(self):

668

508

If a checker already exists, leave it running and do

669

509

nothing."""

670

510

# The reason for not killing a running checker is that if we

671

# did that, and if a checker (for some reason) started running

672

# slowly and taking more than 'interval' time, then the client

673

# would inevitably timeout, since no checker would get a

674

# chance to run to completion. If we instead leave running

511

# did that, then if a checker (for some reason) started

512

# running slowly and taking more than 'interval' time, the

513

# client would inevitably timeout, since no checker would get

514

# a chance to run to completion. If we instead leave running

675

515

# checkers alone, the checker would have to take more time

676

516

# than 'timeout' for the client to be disabled, which is as it

677

517

# should be.

679

519

# If a checker exists, make sure it is not a zombie

680

520

try:

681

521

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

682

except AttributeError:

683

pass

684

except OSError as error:

685

if error.errno != errno.ECHILD:

686

raise

522

except (AttributeError, OSError) as error:

523

if (isinstance(error, OSError)

524

and error.errno != errno.ECHILD):

525

raise error

687

526

else:

688

527

if pid:

689

528

logger.warning("Checker was a zombie")

692

531

self.current_checker_command)

693

532

# Start a new checker if needed

694

533

if self.checker is None:

695

# Escape attributes for the shell

696

escaped_attrs = { attr:

697

re.escape(str(getattr(self, attr)))

698

for attr in self.runtime_expansions }

699

534

try:

700

command = self.checker_command % escaped_attrs

701

except TypeError as error:

702

logger.error('Could not format string "%s"',

703

self.checker_command, exc_info=error)

704

return True # Try again later

535

# In case checker_command has exactly one % operator

536

command = self.checker_command % self.host

537

except TypeError:

538

# Escape attributes for the shell

539

escaped_attrs = dict(

540

(attr,

541

re.escape(unicode(str(getattr(self, attr, "")),

542

errors=

543

'replace')))

544

for attr in

545

self.runtime_expansions)

546

547

try:

548

command = self.checker_command % escaped_attrs

549

except TypeError as error:

550

logger.error('Could not format string "%s":'

551

' %s', self.checker_command, error)

552

return True # Try again later

705

553

self.current_checker_command = command

706

554

try:

707

555

logger.info("Starting checker %r for %s",

710

558

# in normal mode, that is already done by daemon(),

711

559

# and in debug mode we don't want to. (Stdin is

712

560

# always replaced by /dev/null.)

713

# The exception is when not debugging but nevertheless

714

# running in the foreground; use the previously

715

# created wnull.

716

popen_args = {}

717

if (not self.server_settings["debug"]

718

and self.server_settings["foreground"]):

719

popen_args.update({"stdout": wnull,

720

"stderr": wnull })

721

561

self.checker = subprocess.Popen(command,

722

562

close_fds=True,

723

shell=True, cwd="/",

724

**popen_args)

725

except OSError as error:

726

logger.error("Failed to start subprocess",

727

exc_info=error)

728

return True

729

self.checker_callback_tag = (gobject.child_watch_add

730

(self.checker.pid,

731

self.checker_callback,

732

data=command))

733

# The checker may have completed before the gobject

734

# watch was added. Check for this.

735

try:

563

shell=True, cwd="/")

564

self.checker_callback_tag = (gobject.child_watch_add

565

(self.checker.pid,

566

self.checker_callback,

567

data=command))

568

# The checker may have completed before the gobject

569

# watch was added. Check for this.

736

570

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

571

if pid:

572

gobject.source_remove(self.checker_callback_tag)

573

self.checker_callback(pid, status, command)

737

574

except OSError as error:

738

if error.errno == errno.ECHILD:

739

# This should never happen

740

logger.error("Child process vanished",

741

exc_info=error)

742

return True

743

raise

744

if pid:

745

gobject.source_remove(self.checker_callback_tag)

746

self.checker_callback(pid, status, command)

575

logger.error("Failed to start subprocess: %s",

576

error)

747

577

# Re-run this periodically if run by gobject.timeout_add

748

578

return True

749

579

756

586

return

757

587

logger.debug("Stopping checker for %(name)s", vars(self))

758

588

try:

759

self.checker.terminate()

589

os.kill(self.checker.pid, signal.SIGTERM)

760

590

#time.sleep(0.5)

761

591

#if self.checker.poll() is None:

762

# self.checker.kill()

592

# os.kill(self.checker.pid, signal.SIGKILL)

763

593

except OSError as error:

764

594

if error.errno != errno.ESRCH: # No such process

765

595

raise

766

596

self.checker = None

767

597

598

# Encrypts a client secret and stores it in a varible

599

# encrypted_secret

600

def encrypt_secret(self, key):

601

# Encryption-key need to be of a specific size, so we hash

602

# supplied key

603

hasheng = hashlib.sha256()

604

hasheng.update(key)

605

encryptionkey = hasheng.digest()

606

607

# Create validation hash so we know at decryption if it was

608

# sucessful

609

hasheng = hashlib.sha256()

610

hasheng.update(self.secret)

611

validationhash = hasheng.digest()

612

613

# Encrypt secret

614

iv = os.urandom(Crypto.Cipher.AES.block_size)

615

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

616

Crypto.Cipher.AES.MODE_CFB, iv)

617

ciphertext = ciphereng.encrypt(validationhash+self.secret)

618

self.encrypted_secret = (ciphertext, iv)

619

620

# Decrypt a encrypted client secret

621

def decrypt_secret(self, key):

622

# Decryption-key need to be of a specific size, so we hash

623

# supplied key

624

hasheng = hashlib.sha256()

625

hasheng.update(key)

626

encryptionkey = hasheng.digest()

627

628

# Decrypt encrypted secret

629

ciphertext, iv = self.encrypted_secret

630

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

631

Crypto.Cipher.AES.MODE_CFB, iv)

632

plain = ciphereng.decrypt(ciphertext)

633

634

# Validate decrypted secret to know if it was succesful

635

hasheng = hashlib.sha256()

636

validationhash = plain[:hasheng.digest_size]

637

secret = plain[hasheng.digest_size:]

638

hasheng.update(secret)

639

640

# If validation fails, we use key as new secret. Otherwise, we

641

# use the decrypted secret

642

if hasheng.digest() == validationhash:

643

self.secret = secret

644

else:

645

self.secret = key

646

del self.encrypted_secret

647

768

648

769

649

def dbus_service_property(dbus_interface, signature="v",

770

650

access="readwrite", byte_arrays=False):

782

662

# "Set" method, so we fail early here:

783

663

if byte_arrays and signature != "ay":

784

664

raise ValueError("Byte arrays not supported for non-'ay'"

785

" signature {!r}".format(signature))

665

" signature %r" % signature)

786

666

def decorator(func):

787

667

func._dbus_is_property = True

788

668

func._dbus_interface = dbus_interface

796

676

return decorator

797

677

798

678

799

def dbus_interface_annotations(dbus_interface):

800

"""Decorator for marking functions returning interface annotations

801

802

Usage:

803

804

@dbus_interface_annotations("org.example.Interface")

805

def _foo(self): # Function name does not matter

806

return {"org.freedesktop.DBus.Deprecated": "true",

807

"org.freedesktop.DBus.Property.EmitsChangedSignal":

808

"false"}

809

"""

810

def decorator(func):

811

func._dbus_is_interface = True

812

func._dbus_interface = dbus_interface

813

func._dbus_name = dbus_interface

814

return func

815

return decorator

816

817

818

def dbus_annotations(annotations):

819

"""Decorator to annotate D-Bus methods, signals or properties

820

Usage:

821

822

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

823

"org.freedesktop.DBus.Property."

824

"EmitsChangedSignal": "false"})

825

@dbus_service_property("org.example.Interface", signature="b",

826

access="r")

827

def Property_dbus_property(self):

828

return dbus.Boolean(False)

829

"""

830

def decorator(func):

831

func._dbus_annotations = annotations

832

return func

833

return decorator

834

835

836

679

class DBusPropertyException(dbus.exceptions.DBusException):

837

680

"""A base class for D-Bus property-related exceptions

838

681

"""

839

pass

682

def __unicode__(self):

683

return unicode(str(self))

684

840

685

841

686

class DBusPropertyAccessException(DBusPropertyException):

842

687

"""A property's access permissions disallows an operation.

859

704

"""

860

705

861

706

@staticmethod

862

def _is_dbus_thing(thing):

863

"""Returns a function testing if an attribute is a D-Bus thing

864

865

If called like _is_dbus_thing("method") it returns a function

866

suitable for use as predicate to inspect.getmembers().

867

"""

868

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

869

False)

707

def _is_dbus_property(obj):

708

return getattr(obj, "_dbus_is_property", False)

870

709

871

def _get_all_dbus_things(self, thing):

710

def _get_all_dbus_properties(self):

872

711

"""Returns a generator of (name, attribute) pairs

873

712

"""

874

return ((getattr(athing.__get__(self), "_dbus_name",

875

name),

876

athing.__get__(self))

713

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

877

714

for cls in self.__class__.__mro__

878

for name, athing in

879

inspect.getmembers(cls,

880

self._is_dbus_thing(thing)))

715

for name, prop in

716

inspect.getmembers(cls, self._is_dbus_property))

881

717

882

718

def _get_dbus_property(self, interface_name, property_name):

883

719

"""Returns a bound method if one exists which is a D-Bus

885

721

"""

886

722

for cls in self.__class__.__mro__:

887

723

for name, value in (inspect.getmembers

888

(cls,

889

self._is_dbus_thing("property"))):

724

(cls, self._is_dbus_property)):

890

725

if (value._dbus_name == property_name

891

726

and value._dbus_interface == interface_name):

892

727

return value.__get__(self)

920

755

# The byte_arrays option is not supported yet on

921

756

# signatures other than "ay".

922

757

if prop._dbus_signature != "ay":

923

raise ValueError("Byte arrays not supported for non-"

924

"'ay' signature {!r}"

925

.format(prop._dbus_signature))

926

value = dbus.ByteArray(b''.join(chr(byte)

927

for byte in value))

758

raise ValueError

759

value = dbus.ByteArray(''.join(unichr(byte)

760

for byte in value))

928

761

prop(value)

929

762

930

763

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

935

768

936

769

Note: Will not include properties with access="write".

937

770

"""

938

properties = {}

939

for name, prop in self._get_all_dbus_things("property"):

771

all = {}

772

for name, prop in self._get_all_dbus_properties():

940

773

if (interface_name

941

774

and interface_name != prop._dbus_interface):

942

775

# Interface non-empty but did not match

946

779

continue

947

780

value = prop()

948

781

if not hasattr(value, "variant_level"):

949

properties[name] = value

782

all[name] = value

950

783

continue

951

properties[name] = type(value)(value, variant_level=

952

value.variant_level+1)

953

return dbus.Dictionary(properties, signature="sv")

954

955

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

956

def PropertiesChanged(self, interface_name, changed_properties,

957

invalidated_properties):

958

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

959

standard.

960

"""

961

pass

784

all[name] = type(value)(value, variant_level=

785

value.variant_level+1)

786

return dbus.Dictionary(all, signature="sv")

962

787

963

788

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

964

789

out_signature="s",

965

790

path_keyword='object_path',

966

791

connection_keyword='connection')

967

792

def Introspect(self, object_path, connection):

968

"""Overloading of standard D-Bus method.

969

970

Inserts property tags and interface annotation tags.

793

"""Standard D-Bus method, overloaded to insert property tags.

971

794

"""

972

795

xmlstring = dbus.service.Object.Introspect(self, object_path,

973

796

connection)

980

803

e.setAttribute("access", prop._dbus_access)

981

804

return e

982

805

for if_tag in document.getElementsByTagName("interface"):

983

# Add property tags

984

806

for tag in (make_tag(document, name, prop)

985

807

for name, prop

986

in self._get_all_dbus_things("property")

808

in self._get_all_dbus_properties()

987

809

if prop._dbus_interface

988

810

== if_tag.getAttribute("name")):

989

811

if_tag.appendChild(tag)

990

# Add annotation tags

991

for typ in ("method", "signal", "property"):

992

for tag in if_tag.getElementsByTagName(typ):

993

annots = dict()

994

for name, prop in (self.

995

_get_all_dbus_things(typ)):

996

if (name == tag.getAttribute("name")

997

and prop._dbus_interface

998

== if_tag.getAttribute("name")):

999

annots.update(getattr

1000

(prop,

1001

"_dbus_annotations",

1002

{}))

1003

for name, value in annots.items():

1004

ann_tag = document.createElement(

1005

"annotation")

1006

ann_tag.setAttribute("name", name)

1007

ann_tag.setAttribute("value", value)

1008

tag.appendChild(ann_tag)

1009

# Add interface annotation tags

1010

for annotation, value in dict(

1011

itertools.chain.from_iterable(

1012

annotations().items()

1013

for name, annotations in

1014

self._get_all_dbus_things("interface")

1015

if name == if_tag.getAttribute("name")

1016

)).items():

1017

ann_tag = document.createElement("annotation")

1018

ann_tag.setAttribute("name", annotation)

1019

ann_tag.setAttribute("value", value)

1020

if_tag.appendChild(ann_tag)

1021

812

# Add the names to the return values for the

1022

813

# "org.freedesktop.DBus.Properties" methods

1023

814

if (if_tag.getAttribute("name")

1038

829

except (AttributeError, xml.dom.DOMException,

1039

830

xml.parsers.expat.ExpatError) as error:

1040

831

logger.error("Failed to override Introspection method",

1041

exc_info=error)

832

error)

1042

833

return xmlstring

1043

834

1044

835

1045

def datetime_to_dbus(dt, variant_level=0):

836

def datetime_to_dbus (dt, variant_level=0):

1046

837

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1047

838

if dt is None:

1048

839

return dbus.String("", variant_level = variant_level)

1049

840

return dbus.String(dt.isoformat(),

1050

841

variant_level=variant_level)

1051

842

1052

1053

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1054

"""A class decorator; applied to a subclass of

1055

dbus.service.Object, it will add alternate D-Bus attributes with

1056

interface names according to the "alt_interface_names" mapping.

1057

Usage:

1058

1059

@alternate_dbus_interfaces({"org.example.Interface":

1060

"net.example.AlternateInterface"})

1061

class SampleDBusObject(dbus.service.Object):

1062

@dbus.service.method("org.example.Interface")

1063

def SampleDBusMethod():

1064

pass

1065

1066

The above "SampleDBusMethod" on "SampleDBusObject" will be

1067

reachable via two interfaces: "org.example.Interface" and

1068

"net.example.AlternateInterface", the latter of which will have

1069

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1070

"true", unless "deprecate" is passed with a False value.

1071

1072

This works for methods and signals, and also for D-Bus properties

1073

(from DBusObjectWithProperties) and interfaces (from the

1074

dbus_interface_annotations decorator).

843

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

844

.__metaclass__):

845

"""Applied to an empty subclass of a D-Bus object, this metaclass

846

will add additional D-Bus attributes matching a certain pattern.

1075

847

"""

1076

def wrapper(cls):

1077

for orig_interface_name, alt_interface_name in (

1078

alt_interface_names.items()):

1079

attr = {}

1080

interface_names = set()

1081

# Go though all attributes of the class

1082

for attrname, attribute in inspect.getmembers(cls):

848

def __new__(mcs, name, bases, attr):

849

# Go through all the base classes which could have D-Bus

850

# methods, signals, or properties in them

851

for base in (b for b in bases

852

if issubclass(b, dbus.service.Object)):

853

# Go though all attributes of the base class

854

for attrname, attribute in inspect.getmembers(base):

1083

855

# Ignore non-D-Bus attributes, and D-Bus attributes

1084

856

# with the wrong interface name

1085

857

if (not hasattr(attribute, "_dbus_interface")

1086

858

or not attribute._dbus_interface

1087

.startswith(orig_interface_name)):

859

.startswith("se.recompile.Mandos")):

1088

860

continue

1089

861

# Create an alternate D-Bus interface name based on

1090

862

# the current name

1091

863

alt_interface = (attribute._dbus_interface

1092

.replace(orig_interface_name,

1093

alt_interface_name))

1094

interface_names.add(alt_interface)

864

.replace("se.recompile.Mandos",

865

"se.bsnet.fukt.Mandos"))

1095

866

# Is this a D-Bus signal?

1096

867

if getattr(attribute, "_dbus_is_signal", False):

1097

# Extract the original non-method undecorated

1098

# function by black magic

868

# Extract the original non-method function by

869

# black magic

1099

870

nonmethod_func = (dict(

1100

871

zip(attribute.func_code.co_freevars,

1101

872

attribute.__closure__))["func"]

1112

883

nonmethod_func.func_name,

1113

884

nonmethod_func.func_defaults,

1114

885

nonmethod_func.func_closure)))

1115

# Copy annotations, if any

1116

try:

1117

new_function._dbus_annotations = (

1118

dict(attribute._dbus_annotations))

1119

except AttributeError:

1120

pass

1121

886

# Define a creator of a function to call both the

1122

# original and alternate functions, so both the

1123

# original and alternate signals gets sent when

1124

# the function is called

887

# old and new functions, so both the old and new

888

# signals gets sent when the function is called

1125

889

def fixscope(func1, func2):

1126

890

"""This function is a scope container to pass

1127

891

func1 and func2 to the "call_both" function

1134

898

return call_both

1135

899

# Create the "call_both" function and add it to

1136

900

# the class

1137

attr[attrname] = fixscope(attribute, new_function)

901

attr[attrname] = fixscope(attribute,

902

new_function)

1138

903

# Is this a D-Bus method?

1139

904

elif getattr(attribute, "_dbus_is_method", False):

1140

905

# Create a new, but exactly alike, function

1151

916

attribute.func_name,

1152

917

attribute.func_defaults,

1153

918

attribute.func_closure)))

1154

# Copy annotations, if any

1155

try:

1156

attr[attrname]._dbus_annotations = (

1157

dict(attribute._dbus_annotations))

1158

except AttributeError:

1159

pass

1160

919

# Is this a D-Bus property?

1161

920

elif getattr(attribute, "_dbus_is_property", False):

1162

921

# Create a new, but exactly alike, function

1176

935

attribute.func_name,

1177

936

attribute.func_defaults,

1178

937

attribute.func_closure)))

1179

# Copy annotations, if any

1180

try:

1181

attr[attrname]._dbus_annotations = (

1182

dict(attribute._dbus_annotations))

1183

except AttributeError:

1184

pass

1185

# Is this a D-Bus interface?

1186

elif getattr(attribute, "_dbus_is_interface", False):

1187

# Create a new, but exactly alike, function

1188

# object. Decorate it to be a new D-Bus interface

1189

# with the alternate D-Bus interface name. Add it

1190

# to the class.

1191

attr[attrname] = (dbus_interface_annotations

1192

(alt_interface)

1193

(types.FunctionType

1194

(attribute.func_code,

1195

attribute.func_globals,

1196

attribute.func_name,

1197

attribute.func_defaults,

1198

attribute.func_closure)))

1199

if deprecate:

1200

# Deprecate all alternate interfaces

1201

iname="_AlternateDBusNames_interface_annotation{}"

1202

for interface_name in interface_names:

1203

@dbus_interface_annotations(interface_name)

1204

def func(self):

1205

return { "org.freedesktop.DBus.Deprecated":

1206

"true" }

1207

# Find an unused name

1208

for aname in (iname.format(i)

1209

for i in itertools.count()):

1210

if aname not in attr:

1211

attr[aname] = func

1212

break

1213

if interface_names:

1214

# Replace the class with a new subclass of it with

1215

# methods, signals, etc. as created above.

1216

cls = type(b"{}Alternate".format(cls.__name__),

1217

(cls,), attr)

1218

return cls

1219

return wrapper

1220

1221

1222

@alternate_dbus_interfaces({"se.recompile.Mandos":

1223

"se.bsnet.fukt.Mandos"})

938

return type.__new__(mcs, name, bases, attr)

939

1224

940

class ClientDBus(Client, DBusObjectWithProperties):

1225

941

"""A Client class using D-Bus

1226

942

1232

948

runtime_expansions = (Client.runtime_expansions

1233

949

+ ("dbus_object_path",))

1234

950

1235

_interface = "se.recompile.Mandos.Client"

1236

1237

951

# dbus.service.Object doesn't use super(), so we can't either.

1238

952

1239

953

def __init__(self, bus = None, *args, **kwargs):

1240

954

self.bus = bus

955

self._approvals_pending = 0

1241

956

Client.__init__(self, *args, **kwargs)

957

self.add_to_dbus()

958

959

def add_to_dbus(self):

1242

960

# Only now, when this client is initialized, can it show up on

1243

961

# the D-Bus

1244

client_object_name = str(self.name).translate(

962

client_object_name = unicode(self.name).translate(

1245

963

{ord("."): ord("_"),

1246

964

ord("-"): ord("_")})

1247

965

self.dbus_object_path = (dbus.ObjectPath

1248

966

("/clients/" + client_object_name))

1249

967

DBusObjectWithProperties.__init__(self, self.bus,

1250

968

self.dbus_object_path)

1251

969

1252

970

def notifychangeproperty(transform_func,

1253

971

dbus_name, type_func=lambda x: x,

1254

variant_level=1, invalidate_only=False,

1255

_interface=_interface):

972

variant_level=1):

1256

973

""" Modify a variable so that it's a property which announces

1257

974

its changes to DBus.

1258

975

1259

976

transform_fun: Function that takes a value and a variant_level

1260

977

and transforms it to a D-Bus type.

1261

978

dbus_name: D-Bus name of the variable

1263

980

to the D-Bus. Default: no transform

1264

981

variant_level: D-Bus variant level. Default: 1

1265

982

"""

1266

attrname = "_{}".format(dbus_name)

983

attrname = "_{0}".format(dbus_name)

1267

984

def setter(self, value):

1268

985

if hasattr(self, "dbus_object_path"):

1269

986

if (not hasattr(self, attrname) or

1270

987

type_func(getattr(self, attrname, None))

1271

988

!= type_func(value)):

1272

if invalidate_only:

1273

self.PropertiesChanged(_interface,

1274

dbus.Dictionary(),

1275

dbus.Array

1276

((dbus_name,)))

1277

else:

1278

dbus_value = transform_func(type_func(value),

1279

variant_level

1280

=variant_level)

1281

self.PropertyChanged(dbus.String(dbus_name),

1282

dbus_value)

1283

self.PropertiesChanged(_interface,

1284

dbus.Dictionary({

1285

dbus.String(dbus_name):

1286

dbus_value }), dbus.Array())

989

dbus_value = transform_func(type_func(value),

990

variant_level

991

=variant_level)

992

self.PropertyChanged(dbus.String(dbus_name),

993

dbus_value)

1287

994

setattr(self, attrname, value)

1288

995

1289

996

return property(lambda self: getattr(self, attrname), setter)

1290

997

998

1291

999

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1292

1000

approvals_pending = notifychangeproperty(dbus.Boolean,

1293

1001

"ApprovalPending",

1300

1008

checker is not None)

1301

1009

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1302

1010

"LastCheckedOK")

1303

last_checker_status = notifychangeproperty(dbus.Int16,

1304

"LastCheckerStatus")

1305

1011

last_approval_request = notifychangeproperty(

1306

1012

datetime_to_dbus, "LastApprovalRequest")

1307

1013

approved_by_default = notifychangeproperty(dbus.Boolean,

1309

1015

approval_delay = notifychangeproperty(dbus.UInt64,

1310

1016

"ApprovalDelay",

1311

1017

type_func =

1312

lambda td: td.total_seconds()

1313

* 1000)

1018

_timedelta_to_milliseconds)

1314

1019

approval_duration = notifychangeproperty(

1315

1020

dbus.UInt64, "ApprovalDuration",

1316

type_func = lambda td: td.total_seconds() * 1000)

1021

type_func = _timedelta_to_milliseconds)

1317

1022

host = notifychangeproperty(dbus.String, "Host")

1318

1023

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1319

type_func = lambda td:

1320

td.total_seconds() * 1000)

1024

type_func =

1025

_timedelta_to_milliseconds)

1321

1026

extended_timeout = notifychangeproperty(

1322

1027

dbus.UInt64, "ExtendedTimeout",

1323

type_func = lambda td: td.total_seconds() * 1000)

1028

type_func = _timedelta_to_milliseconds)

1324

1029

interval = notifychangeproperty(dbus.UInt64,

1325

1030

"Interval",

1326

1031

type_func =

1327

lambda td: td.total_seconds()

1328

* 1000)

1032

_timedelta_to_milliseconds)

1329

1033

checker_command = notifychangeproperty(dbus.String, "Checker")

1330

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1331

invalidate_only=True)

1332

1034

1333

1035

del notifychangeproperty

1334

1036

1361

1063

*args, **kwargs)

1362

1064

1363

1065

def start_checker(self, *args, **kwargs):

1364

old_checker_pid = getattr(self.checker, "pid", None)

1066

old_checker = self.checker

1067

if self.checker is not None:

1068

old_checker_pid = self.checker.pid

1069

else:

1070

old_checker_pid = None

1365

1071

r = Client.start_checker(self, *args, **kwargs)

1366

1072

# Only if new checker process was started

1367

1073

if (self.checker is not None

1371

1077

return r

1372

1078

1373

1079

def _reset_approved(self):

1374

self.approved = None

1080

self._approved = None

1375

1081

return False

1376

1082

1377

1083

def approve(self, value=True):

1378

self.approved = value

1379

gobject.timeout_add(int(self.approval_duration.total_seconds()

1380

* 1000), self._reset_approved)

1381

1084

self.send_changedstate()

1085

self._approved = value

1086

gobject.timeout_add(_timedelta_to_milliseconds

1087

(self.approval_duration),

1088

self._reset_approved)

1089

1382

1090

1383

1091

## D-Bus methods, signals & properties

1384

1385

## Interfaces

1092

_interface = "se.recompile.Mandos.Client"

1386

1093

1387

1094

## Signals

1388

1095

1399

1106

pass

1400

1107

1401

1108

# PropertyChanged - signal

1402

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1403

1109

@dbus.service.signal(_interface, signature="sv")

1404

1110

def PropertyChanged(self, property, value):

1405

1111

"D-Bus signal"

1481

1187

access="readwrite")

1482

1188

def ApprovalDelay_dbus_property(self, value=None):

1483

1189

if value is None: # get

1484

return dbus.UInt64(self.approval_delay.total_seconds()

1485

* 1000)

1190

return dbus.UInt64(self.approval_delay_milliseconds())

1486

1191

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1487

1192

1488

1193

# ApprovalDuration - property

1490

1195

access="readwrite")

1491

1196

def ApprovalDuration_dbus_property(self, value=None):

1492

1197

if value is None: # get

1493

return dbus.UInt64(self.approval_duration.total_seconds()

1494

* 1000)

1198

return dbus.UInt64(_timedelta_to_milliseconds(

1199

self.approval_duration))

1495

1200

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1496

1201

1497

1202

# Name - property

1510

1215

def Host_dbus_property(self, value=None):

1511

1216

if value is None: # get

1512

1217

return dbus.String(self.host)

1513

self.host = str(value)

1218

self.host = value

1514

1219

1515

1220

# Created - property

1516

1221

@dbus_service_property(_interface, signature="s", access="read")

1517

1222

def Created_dbus_property(self):

1518

return datetime_to_dbus(self.created)

1223

return dbus.String(datetime_to_dbus(self.created))

1519

1224

1520

1225

# LastEnabled - property

1521

1226

@dbus_service_property(_interface, signature="s", access="read")

1542

1247

return

1543

1248

return datetime_to_dbus(self.last_checked_ok)

1544

1249

1545

# LastCheckerStatus - property

1546

@dbus_service_property(_interface, signature="n",

1547

access="read")

1548

def LastCheckerStatus_dbus_property(self):

1549

return dbus.Int16(self.last_checker_status)

1550

1551

1250

# Expires - property

1552

1251

@dbus_service_property(_interface, signature="s", access="read")

1553

1252

def Expires_dbus_property(self):

1563

1262

access="readwrite")

1564

1263

def Timeout_dbus_property(self, value=None):

1565

1264

if value is None: # get

1566

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1567

old_timeout = self.timeout

1265

return dbus.UInt64(self.timeout_milliseconds())

1568

1266

self.timeout = datetime.timedelta(0, 0, 0, value)

1569

# Reschedule disabling

1570

if self.enabled:

1571

now = datetime.datetime.utcnow()

1572

self.expires += self.timeout - old_timeout

1573

if self.expires <= now:

1574

# The timeout has passed

1575

self.disable()

1576

else:

1577

if (getattr(self, "disable_initiator_tag", None)

1578

is None):

1579

return

1580

gobject.source_remove(self.disable_initiator_tag)

1581

self.disable_initiator_tag = (

1582

gobject.timeout_add(

1583

int((self.expires - now).total_seconds()

1584

* 1000), self.disable))

1267

if getattr(self, "disable_initiator_tag", None) is None:

1268

return

1269

# Reschedule timeout

1270

gobject.source_remove(self.disable_initiator_tag)

1271

self.disable_initiator_tag = None

1272

self.expires = None

1273

time_to_die = _timedelta_to_milliseconds((self

1274

.last_checked_ok

1275

+ self.timeout)

1276

- datetime.datetime

1277

.utcnow())

1278

if time_to_die <= 0:

1279

# The timeout has passed

1280

self.disable()

1281

else:

1282

self.expires = (datetime.datetime.utcnow()

1283

+ datetime.timedelta(milliseconds =

1284

time_to_die))

1285

self.disable_initiator_tag = (gobject.timeout_add

1286

(time_to_die, self.disable))

1585

1287

1586

1288

# ExtendedTimeout - property

1587

1289

@dbus_service_property(_interface, signature="t",

1588

1290

access="readwrite")

1589

1291

def ExtendedTimeout_dbus_property(self, value=None):

1590

1292

if value is None: # get

1591

return dbus.UInt64(self.extended_timeout.total_seconds()

1592

* 1000)

1293

return dbus.UInt64(self.extended_timeout_milliseconds())

1593

1294

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1594

1295

1595

1296

# Interval - property

1597

1298

access="readwrite")

1598

1299

def Interval_dbus_property(self, value=None):

1599

1300

if value is None: # get

1600

return dbus.UInt64(self.interval.total_seconds() * 1000)

1301

return dbus.UInt64(self.interval_milliseconds())

1601

1302

self.interval = datetime.timedelta(0, 0, 0, value)

1602

1303

if getattr(self, "checker_initiator_tag", None) is None:

1603

1304

return

1604

if self.enabled:

1605

# Reschedule checker run

1606

gobject.source_remove(self.checker_initiator_tag)

1607

self.checker_initiator_tag = (gobject.timeout_add

1608

(value, self.start_checker))

1609

self.start_checker() # Start one now, too

1305

# Reschedule checker run

1306

gobject.source_remove(self.checker_initiator_tag)

1307

self.checker_initiator_tag = (gobject.timeout_add

1308

(value, self.start_checker))

1309

self.start_checker() # Start one now, too

1610

1310

1611

1311

# Checker - property

1612

1312

@dbus_service_property(_interface, signature="s",

1614

1314

def Checker_dbus_property(self, value=None):

1615

1315

if value is None: # get

1616

1316

return dbus.String(self.checker_command)

1617

self.checker_command = str(value)

1317

self.checker_command = value

1618

1318

1619

1319

# CheckerRunning - property

1620

1320

@dbus_service_property(_interface, signature="b",

1636

1336

@dbus_service_property(_interface, signature="ay",

1637

1337

access="write", byte_arrays=True)

1638

1338

def Secret_dbus_property(self, value):

1639

self.secret = bytes(value)

1339

self.secret = str(value)

1640

1340

1641

1341

del _interface

1642

1342

1649

1349

raise KeyError()

1650

1350

1651

1351

def __getattribute__(self, name):

1652

if name == '_pipe':

1352

if(name == '_pipe'):

1653

1353

return super(ProxyClient, self).__getattribute__(name)

1654

1354

self._pipe.send(('getattr', name))

1655

1355

data = self._pipe.recv()

1662

1362

return func

1663

1363

1664

1364

def __setattr__(self, name, value):

1665

if name == '_pipe':

1365

if(name == '_pipe'):

1666

1366

return super(ProxyClient, self).__setattr__(name, value)

1667

1367

self._pipe.send(('setattr', name, value))

1668

1368

1369

class ClientDBusTransitional(ClientDBus):

1370

__metaclass__ = AlternateDBusNamesMetaclass

1669

1371

1670

1372

class ClientHandler(socketserver.BaseRequestHandler, object):

1671

1373

"""A class to handle client connections.

1676

1378

def handle(self):

1677

1379

with contextlib.closing(self.server.child_pipe) as child_pipe:

1678

1380

logger.info("TCP connection from: %s",

1679

str(self.client_address))

1381

unicode(self.client_address))

1680

1382

logger.debug("Pipe FD: %d",

1681

1383

self.server.child_pipe.fileno())

1682

1384

1708

1410

logger.debug("Protocol version: %r", line)

1709

1411

try:

1710

1412

if int(line.strip().split()[0]) > 1:

1711

raise RuntimeError(line)

1413

raise RuntimeError

1712

1414

except (ValueError, IndexError, RuntimeError) as error:

1713

1415

logger.error("Unknown protocol version: %s", error)

1714

1416

return

1754

1456

client.Rejected("Disabled")

1755

1457

return

1756

1458

1757

if client.approved or not client.approval_delay:

1459

if client._approved or not client.approval_delay:

1758

1460

#We are approved or approval is disabled

1759

1461

break

1760

elif client.approved is None:

1462

elif client._approved is None:

1761

1463

logger.info("Client %s needs approval",

1762

1464

client.name)

1763

1465

if self.server.use_dbus:

1764

1466

# Emit D-Bus signal

1765

1467

client.NeedApproval(

1766

client.approval_delay.total_seconds()

1767

* 1000, client.approved_by_default)

1468

client.approval_delay_milliseconds(),

1469

client.approved_by_default)

1768

1470

else:

1769

1471

logger.warning("Client %s was not approved",

1770

1472

client.name)

1776

1478

#wait until timeout or approved

1777

1479

time = datetime.datetime.now()

1778

1480

client.changedstate.acquire()

1779

client.changedstate.wait(delay.total_seconds())

1481

(client.changedstate.wait

1482

(float(client._timedelta_to_milliseconds(delay)

1483

/ 1000)))

1780

1484

client.changedstate.release()

1781

1485

time2 = datetime.datetime.now()

1782

1486

if (time2 - time) >= delay:

1798

1502

try:

1799

1503

sent = session.send(client.secret[sent_size:])

1800

1504

except gnutls.errors.GNUTLSError as error:

1801

logger.warning("gnutls send failed",

1802

exc_info=error)

1505

logger.warning("gnutls send failed")

1803

1506

return

1804

1507

logger.debug("Sent: %d, remaining: %d",

1805

1508

sent, len(client.secret)

1808

1511

1809

1512

logger.info("Sending secret to %s", client.name)

1810

1513

# bump the timeout using extended_timeout

1811

client.bump_timeout(client.extended_timeout)

1514

client.checked_ok(client.extended_timeout)

1812

1515

if self.server.use_dbus:

1813

1516

# Emit D-Bus signal

1814

1517

client.GotSecret()

1819

1522

try:

1820

1523

session.bye()

1821

1524

except gnutls.errors.GNUTLSError as error:

1822

logger.warning("GnuTLS bye failed",

1823

exc_info=error)

1525

logger.warning("GnuTLS bye failed")

1824

1526

1825

1527

@staticmethod

1826

1528

def peer_certificate(session):

1882

1584

# Convert the buffer to a Python bytestring

1883

1585

fpr = ctypes.string_at(buf, buf_len.value)

1884

1586

# Convert the bytestring to hexadecimal notation

1885

hex_fpr = binascii.hexlify(fpr).upper()

1587

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1886

1588

return hex_fpr

1887

1589

1888

1590

1891

1593

def sub_process_main(self, request, address):

1892

1594

try:

1893

1595

self.finish_request(request, address)

1894

except Exception:

1596

except:

1895

1597

self.handle_error(request, address)

1896

1598

self.close_request(request)

1897

1599

1898

1600

def process_request(self, request, address):

1899

1601

"""Start a new process to process the request."""

1900

1602

proc = multiprocessing.Process(target = self.sub_process_main,

1901

args = (request, address))

1603

args = (request,

1604

address))

1902

1605

proc.start()

1903

1606

return proc

1904

1607

1919

1622

1920

1623

def add_pipe(self, parent_pipe, proc):

1921

1624

"""Dummy function; override as necessary"""

1922

raise NotImplementedError()

1625

raise NotImplementedError

1923

1626

1924

1627

1925

1628

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1932

1635

use_ipv6: Boolean; to use IPv6 or not

1933

1636

"""

1934

1637

def __init__(self, server_address, RequestHandlerClass,

1935

interface=None, use_ipv6=True, socketfd=None):

1936

"""If socketfd is set, use that file descriptor instead of

1937

creating a new one with socket.socket().

1938

"""

1638

interface=None, use_ipv6=True):

1939

1639

self.interface = interface

1940

1640

if use_ipv6:

1941

1641

self.address_family = socket.AF_INET6

1942

if socketfd is not None:

1943

# Save the file descriptor

1944

self.socketfd = socketfd

1945

# Save the original socket.socket() function

1946

self.socket_socket = socket.socket

1947

# To implement --socket, we monkey patch socket.socket.

1948

#

1949

# (When socketserver.TCPServer is a new-style class, we

1950

# could make self.socket into a property instead of monkey

1951

# patching socket.socket.)

1952

#

1953

# Create a one-time-only replacement for socket.socket()

1954

@functools.wraps(socket.socket)

1955

def socket_wrapper(*args, **kwargs):

1956

# Restore original function so subsequent calls are

1957

# not affected.

1958

socket.socket = self.socket_socket

1959

del self.socket_socket

1960

# This time only, return a new socket object from the

1961

# saved file descriptor.

1962

return socket.fromfd(self.socketfd, *args, **kwargs)

1963

# Replace socket.socket() function with wrapper

1964

socket.socket = socket_wrapper

1965

# The socketserver.TCPServer.__init__ will call

1966

# socket.socket(), which might be our replacement,

1967

# socket_wrapper(), if socketfd was set.

1968

1642

socketserver.TCPServer.__init__(self, server_address,

1969

1643

RequestHandlerClass)

1970

1971

1644

def server_bind(self):

1972

1645

"""This overrides the normal server_bind() function

1973

1646

to bind to an interface if one was specified, and also NOT to

1981

1654

try:

1982

1655

self.socket.setsockopt(socket.SOL_SOCKET,

1983

1656

SO_BINDTODEVICE,

1984

(self.interface + "\0")

1985

.encode("utf-8"))

1657

str(self.interface

1658

+ '\0'))

1986

1659

except socket.error as error:

1987

if error.errno == errno.EPERM:

1988

logger.error("No permission to bind to"

1989

" interface %s", self.interface)

1990

elif error.errno == errno.ENOPROTOOPT:

1660

if error[0] == errno.EPERM:

1661

logger.error("No permission to"

1662

" bind to interface %s",

1663

self.interface)

1664

elif error[0] == errno.ENOPROTOOPT:

1991

1665

logger.error("SO_BINDTODEVICE not available;"

1992

1666

" cannot bind to interface %s",

1993

1667

self.interface)

1994

elif error.errno == errno.ENODEV:

1995

logger.error("Interface %s does not exist,"

1996

" cannot bind", self.interface)

1997

1668

else:

1998

1669

raise

1999

1670

# Only bind(2) the socket if we really need to.

2002

1673

if self.address_family == socket.AF_INET6:

2003

1674

any_address = "::" # in6addr_any

2004

1675

else:

2005

any_address = "0.0.0.0" # INADDR_ANY

1676

any_address = socket.INADDR_ANY

2006

1677

self.server_address = (any_address,

2007

1678

self.server_address[1])

2008

1679

elif not self.server_address[1]:

2029

1700

"""

2030

1701

def __init__(self, server_address, RequestHandlerClass,

2031

1702

interface=None, use_ipv6=True, clients=None,

2032

gnutls_priority=None, use_dbus=True, socketfd=None):

1703

gnutls_priority=None, use_dbus=True):

2033

1704

self.enabled = False

2034

1705

self.clients = clients

2035

1706

if self.clients is None:

2039

1710

IPv6_TCPServer.__init__(self, server_address,

2040

1711

RequestHandlerClass,

2041

1712

interface = interface,

2042

use_ipv6 = use_ipv6,

2043

socketfd = socketfd)

1713

use_ipv6 = use_ipv6)

2044

1714

def server_activate(self):

2045

1715

if self.enabled:

2046

1716

return socketserver.TCPServer.server_activate(self)

2059

1729

2060

1730

def handle_ipc(self, source, condition, parent_pipe=None,

2061

1731

proc = None, client_object=None):

1732

condition_names = {

1733

gobject.IO_IN: "IN", # There is data to read.

1734

gobject.IO_OUT: "OUT", # Data can be written (without

1735

# blocking).

1736

gobject.IO_PRI: "PRI", # There is urgent data to read.

1737

gobject.IO_ERR: "ERR", # Error condition.

1738

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1739

# broken, usually for pipes and

1740

# sockets).

1741

}

1742

conditions_string = ' | '.join(name

1743

for cond, name in

1744

condition_names.iteritems()

1745

if cond & condition)

2062

1746

# error, or the other end of multiprocessing.Pipe has closed

2063

if condition & (gobject.IO_ERR | gobject.IO_HUP):

1747

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2064

1748

# Wait for other process to exit

2065

1749

proc.join()

2066

1750

return False

2124

1808

return True

2125

1809

2126

1810

2127

def rfc3339_duration_to_delta(duration):

2128

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2129

2130

>>> rfc3339_duration_to_delta("P7D")

2131

datetime.timedelta(7)

2132

>>> rfc3339_duration_to_delta("PT60S")

2133

datetime.timedelta(0, 60)

2134

>>> rfc3339_duration_to_delta("PT60M")

2135

datetime.timedelta(0, 3600)

2136

>>> rfc3339_duration_to_delta("PT24H")

2137

datetime.timedelta(1)

2138

>>> rfc3339_duration_to_delta("P1W")

2139

datetime.timedelta(7)

2140

>>> rfc3339_duration_to_delta("PT5M30S")

2141

datetime.timedelta(0, 330)

2142

>>> rfc3339_duration_to_delta("P1DT3M20S")

2143

datetime.timedelta(1, 200)

2144

"""

2145

2146

# Parsing an RFC 3339 duration with regular expressions is not

2147

# possible - there would have to be multiple places for the same

2148

# values, like seconds. The current code, while more esoteric, is

2149

# cleaner without depending on a parsing library. If Python had a

2150

# built-in library for parsing we would use it, but we'd like to

2151

# avoid excessive use of external libraries.

2152

2153

# New type for defining tokens, syntax, and semantics all-in-one

2154

Token = collections.namedtuple("Token",

2155

("regexp", # To match token; if

2156

# "value" is not None,

2157

# must have a "group"

2158

# containing digits

2159

"value", # datetime.timedelta or

2160

# None

2161

"followers")) # Tokens valid after

2162

# this token

2163

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2164

# the "duration" ABNF definition in RFC 3339, Appendix A.

2165

token_end = Token(re.compile(r"$"), None, frozenset())

2166

token_second = Token(re.compile(r"(\d+)S"),

2167

datetime.timedelta(seconds=1),

2168

frozenset((token_end,)))

2169

token_minute = Token(re.compile(r"(\d+)M"),

2170

datetime.timedelta(minutes=1),

2171

frozenset((token_second, token_end)))

2172

token_hour = Token(re.compile(r"(\d+)H"),

2173

datetime.timedelta(hours=1),

2174

frozenset((token_minute, token_end)))

2175

token_time = Token(re.compile(r"T"),

2176

None,

2177

frozenset((token_hour, token_minute,

2178

token_second)))

2179

token_day = Token(re.compile(r"(\d+)D"),

2180

datetime.timedelta(days=1),

2181

frozenset((token_time, token_end)))

2182

token_month = Token(re.compile(r"(\d+)M"),

2183

datetime.timedelta(weeks=4),

2184

frozenset((token_day, token_end)))

2185

token_year = Token(re.compile(r"(\d+)Y"),

2186

datetime.timedelta(weeks=52),

2187

frozenset((token_month, token_end)))

2188

token_week = Token(re.compile(r"(\d+)W"),

2189

datetime.timedelta(weeks=1),

2190

frozenset((token_end,)))

2191

token_duration = Token(re.compile(r"P"), None,

2192

frozenset((token_year, token_month,

2193

token_day, token_time,

2194

token_week)))

2195

# Define starting values

2196

value = datetime.timedelta() # Value so far

2197

found_token = None

2198

followers = frozenset((token_duration,)) # Following valid tokens

2199

s = duration # String left to parse

2200

# Loop until end token is found

2201

while found_token is not token_end:

2202

# Search for any currently valid tokens

2203

for token in followers:

2204

match = token.regexp.match(s)

2205

if match is not None:

2206

# Token found

2207

if token.value is not None:

2208

# Value found, parse digits

2209

factor = int(match.group(1), 10)

2210

# Add to value so far

2211

value += factor * token.value

2212

# Strip token from string

2213

s = token.regexp.sub("", s, 1)

2214

# Go to found token

2215

found_token = token

2216

# Set valid next tokens

2217

followers = found_token.followers

2218

break

2219

else:

2220

# No currently valid tokens were found

2221

raise ValueError("Invalid RFC 3339 duration")

2222

# End token found

2223

return value

2224

2225

2226

1811

def string_to_delta(interval):

2227

1812

"""Parse a string and return a datetime.timedelta

2228

1813

2239

1824

>>> string_to_delta('5m 30s')

2240

1825

datetime.timedelta(0, 330)

2241

1826

"""

2242

2243

try:

2244

return rfc3339_duration_to_delta(interval)

2245

except ValueError:

2246

pass

2247

2248

1827

timevalue = datetime.timedelta(0)

2249

1828

for s in interval.split():

2250

1829

try:

2251

suffix = s[-1]

1830

suffix = unicode(s[-1])

2252

1831

value = int(s[:-1])

2253

1832

if suffix == "d":

2254

1833

delta = datetime.timedelta(value)

2261

1840

elif suffix == "w":

2262

1841

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2263

1842

else:

2264

raise ValueError("Unknown suffix {!r}"

2265

.format(suffix))

2266

except IndexError as e:

1843

raise ValueError("Unknown suffix %r" % suffix)

1844

except (ValueError, IndexError) as e:

2267

1845

raise ValueError(*(e.args))

2268

1846

timevalue += delta

2269

1847

return timevalue

2270

1848

2271

1849

1850

def if_nametoindex(interface):

1851

"""Call the C function if_nametoindex(), or equivalent

1852

1853

Note: This function cannot accept a unicode string."""

1854

global if_nametoindex

1855

try:

1856

if_nametoindex = (ctypes.cdll.LoadLibrary

1857

(ctypes.util.find_library("c"))

1858

.if_nametoindex)

1859

except (OSError, AttributeError):

1860

logger.warning("Doing if_nametoindex the hard way")

1861

def if_nametoindex(interface):

1862

"Get an interface index the hard way, i.e. using fcntl()"

1863

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1864

with contextlib.closing(socket.socket()) as s:

1865

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1866

struct.pack(str("16s16x"),

1867

interface))

1868

interface_index = struct.unpack(str("I"),

1869

ifreq[16:20])[0]

1870

return interface_index

1871

return if_nametoindex(interface)

1872

1873

2272

1874

def daemon(nochdir = False, noclose = False):

2273

1875

"""See daemon(3). Standard BSD Unix function.

2274

1876

2282

1884

sys.exit()

2283

1885

if not noclose:

2284

1886

# Close all standard open file descriptors

2285

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1887

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2286

1888

if not stat.S_ISCHR(os.fstat(null).st_mode):

2287

raise OSError(errno.ENODEV, "{} not a character device"

2288

.format(os.devnull))

1889

raise OSError(errno.ENODEV,

1890

"%s not a character device"

1891

% os.path.devnull)

2289

1892

os.dup2(null, sys.stdin.fileno())

2290

1893

os.dup2(null, sys.stdout.fileno())

2291

1894

os.dup2(null, sys.stderr.fileno())

2300

1903

2301

1904

parser = argparse.ArgumentParser()

2302

1905

parser.add_argument("-v", "--version", action="version",

2303

version = "%(prog)s {}".format(version),

1906

version = "%%(prog)s %s" % version,

2304

1907

help="show version number and exit")

2305

1908

parser.add_argument("-i", "--interface", metavar="IF",

2306

1909

help="Bind to interface IF")

2312

1915

help="Run self-test")

2313

1916

parser.add_argument("--debug", action="store_true",

2314

1917

help="Debug mode; run in foreground and log"

2315

" to terminal", default=None)

1918

" to terminal")

2316

1919

parser.add_argument("--debuglevel", metavar="LEVEL",

2317

1920

help="Debug level for stdout output")

2318

1921

parser.add_argument("--priority", help="GnuTLS"

2325

1928

" files")

2326

1929

parser.add_argument("--no-dbus", action="store_false",

2327

1930

dest="use_dbus", help="Do not provide D-Bus"

2328

" system bus interface", default=None)

1931

" system bus interface")

2329

1932

parser.add_argument("--no-ipv6", action="store_false",

2330

dest="use_ipv6", help="Do not use IPv6",

2331

default=None)

1933

dest="use_ipv6", help="Do not use IPv6")

2332

1934

parser.add_argument("--no-restore", action="store_false",

2333

dest="restore", help="Do not restore stored"

2334

" state", default=None)

2335

parser.add_argument("--socket", type=int,

2336

help="Specify a file descriptor to a network"

2337

" socket to use instead of creating one")

2338

parser.add_argument("--statedir", metavar="DIR",

2339

help="Directory to save/restore state in")

2340

parser.add_argument("--foreground", action="store_true",

2341

help="Run in foreground", default=None)

2342

parser.add_argument("--no-zeroconf", action="store_false",

2343

dest="zeroconf", help="Do not use Zeroconf",

2344

default=None)

2345

1935

dest="restore",

1936

help="Do not restore stored state",

1937

default=True)

1938

2346

1939

options = parser.parse_args()

2347

1940

2348

1941

if options.check:

2349

1942

import doctest

2350

fail_count, test_count = doctest.testmod()

2351

sys.exit(os.EX_OK if fail_count == 0 else 1)

1943

doctest.testmod()

1944

sys.exit()

2352

1945

2353

1946

# Default values for config file for server-global settings

2354

1947

server_defaults = { "interface": "",

2356

1949

"port": "",

2357

1950

"debug": "False",

2358

1951

"priority":

2359

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

1952

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2360

1953

"servicename": "Mandos",

2361

1954

"use_dbus": "True",

2362

1955

"use_ipv6": "True",

2363

1956

"debuglevel": "",

2364

"restore": "True",

2365

"socket": "",

2366

"statedir": "/var/lib/mandos",

2367

"foreground": "False",

2368

"zeroconf": "True",

2369

1957

}

2370

1958

2371

1959

# Parse config file for server-global settings

2376

1964

# Convert the SafeConfigParser object to a dict

2377

1965

server_settings = server_config.defaults()

2378

1966

# Use the appropriate methods on the non-string config options

2379

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

1967

for option in ("debug", "use_dbus", "use_ipv6"):

2380

1968

server_settings[option] = server_config.getboolean("DEFAULT",

2381

1969

option)

2382

1970

if server_settings["port"]:

2383

1971

server_settings["port"] = server_config.getint("DEFAULT",

2384

1972

"port")

2385

if server_settings["socket"]:

2386

server_settings["socket"] = server_config.getint("DEFAULT",

2387

"socket")

2388

# Later, stdin will, and stdout and stderr might, be dup'ed

2389

# over with an opened os.devnull. But we don't want this to

2390

# happen with a supplied network socket.

2391

if 0 <= server_settings["socket"] <= 2:

2392

server_settings["socket"] = os.dup(server_settings

2393

["socket"])

2394

1973

del server_config

2395

1974

2396

1975

# Override the settings from the config file with command line

2397

1976

# options, if set.

2398

1977

for option in ("interface", "address", "port", "debug",

2399

1978

"priority", "servicename", "configdir",

2400

"use_dbus", "use_ipv6", "debuglevel", "restore",

2401

"statedir", "socket", "foreground", "zeroconf"):

1979

"use_dbus", "use_ipv6", "debuglevel", "restore"):

2402

1980

value = getattr(options, option)

2403

1981

if value is not None:

2404

1982

server_settings[option] = value

2405

1983

del options

2406

1984

# Force all strings to be unicode

2407

1985

for option in server_settings.keys():

2408

if isinstance(server_settings[option], bytes):

2409

server_settings[option] = (server_settings[option]

2410

.decode("utf-8"))

2411

# Force all boolean options to be boolean

2412

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2413

"foreground", "zeroconf"):

2414

server_settings[option] = bool(server_settings[option])

2415

# Debug implies foreground

2416

if server_settings["debug"]:

2417

server_settings["foreground"] = True

1986

if type(server_settings[option]) is str:

1987

server_settings[option] = unicode(server_settings[option])

2418

1988

# Now we have our good server settings in "server_settings"

2419

1989

2420

1990

##################################################################

2421

1991

2422

if (not server_settings["zeroconf"] and

2423

not (server_settings["port"]

2424

or server_settings["socket"] != "")):

2425

parser.error("Needs port or socket to work without"

2426

" Zeroconf")

2427

2428

1992

# For convenience

2429

1993

debug = server_settings["debug"]

2430

1994

debuglevel = server_settings["debuglevel"]

2431

1995

use_dbus = server_settings["use_dbus"]

2432

1996

use_ipv6 = server_settings["use_ipv6"]

2433

stored_state_path = os.path.join(server_settings["statedir"],

2434

stored_state_file)

2435

foreground = server_settings["foreground"]

2436

zeroconf = server_settings["zeroconf"]

2437

2438

if debug:

2439

initlogger(debug, logging.DEBUG)

2440

else:

2441

if not debuglevel:

2442

initlogger(debug)

2443

else:

2444

level = getattr(logging, debuglevel.upper())

2445

initlogger(debug, level)

2446

1997

2447

1998

if server_settings["servicename"] != "Mandos":

2448

1999

syslogger.setFormatter(logging.Formatter

2449

('Mandos ({}) [%(process)d]:'

2450

' %(levelname)s: %(message)s'

2451

.format(server_settings

2452

["servicename"])))

2000

('Mandos (%s) [%%(process)d]:'

2001

' %%(levelname)s: %%(message)s'

2002

% server_settings["servicename"]))

2453

2003

2454

2004

# Parse config file with clients

2455

client_config = configparser.SafeConfigParser(Client

2456

.client_defaults)

2005

client_defaults = { "timeout": "5m",

2006

"extended_timeout": "15m",

2007

"interval": "2m",

2008

"checker": "fping -q -- %%(host)s",

2009

"host": "",

2010

"approval_delay": "0s",

2011

"approval_duration": "1s",

2012

}

2013

client_config = configparser.SafeConfigParser(client_defaults)

2457

2014

client_config.read(os.path.join(server_settings["configdir"],

2458

2015

"clients.conf"))

2459

2016

2460

2017

global mandos_dbus_service

2461

2018

mandos_dbus_service = None

2462

2019

2463

socketfd = None

2464

if server_settings["socket"] != "":

2465

socketfd = server_settings["socket"]

2466

2020

tcp_server = MandosServer((server_settings["address"],

2467

2021

server_settings["port"]),

2468

2022

ClientHandler,

2471

2025

use_ipv6=use_ipv6,

2472

2026

gnutls_priority=

2473

2027

server_settings["priority"],

2474

use_dbus=use_dbus,

2475

socketfd=socketfd)

2476

if not foreground:

2477

pidfilename = "/run/mandos.pid"

2478

if not os.path.isdir("/run/."):

2479

pidfilename = "/var/run/mandos.pid"

2480

pidfile = None

2028

use_dbus=use_dbus)

2029

if not debug:

2030

pidfilename = "/var/run/mandos.pid"

2481

2031

try:

2482

2032

pidfile = open(pidfilename, "w")

2483

except IOError as e:

2484

logger.error("Could not open file %r", pidfilename,

2485

exc_info=e)

2033

except IOError:

2034

logger.error("Could not open file %r", pidfilename)

2486

2035

2487

for name in ("_mandos", "mandos", "nobody"):

2036

try:

2037

uid = pwd.getpwnam("_mandos").pw_uid

2038

gid = pwd.getpwnam("_mandos").pw_gid

2039

except KeyError:

2488

2040

try:

2489

uid = pwd.getpwnam(name).pw_uid

2490

gid = pwd.getpwnam(name).pw_gid

2491

break

2041

uid = pwd.getpwnam("mandos").pw_uid

2042

gid = pwd.getpwnam("mandos").pw_gid

2492

2043

except KeyError:

2493

continue

2494

else:

2495

uid = 65534

2496

gid = 65534

2044

try:

2045

uid = pwd.getpwnam("nobody").pw_uid

2046

gid = pwd.getpwnam("nobody").pw_gid

2047

except KeyError:

2048

uid = 65534

2049

gid = 65534

2497

2050

try:

2498

2051

os.setgid(gid)

2499

2052

os.setuid(uid)

2500

2053

except OSError as error:

2501

if error.errno != errno.EPERM:

2502

raise

2054

if error[0] != errno.EPERM:

2055

raise error

2056

2057

if not debug and not debuglevel:

2058

logger.setLevel(logging.WARNING)

2059

if debuglevel:

2060

level = getattr(logging, debuglevel.upper())

2061

logger.setLevel(level)

2503

2062

2504

2063

if debug:

2064

logger.setLevel(logging.DEBUG)

2505

2065

# Enable all possible GnuTLS debugging

2506

2066

2507

2067

# "Use a log level over 10 to enable all debugging options."

2516

2076

.gnutls_global_set_log_function(debug_gnutls))

2517

2077

2518

2078

# Redirect stdin so all checkers get /dev/null

2519

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2079

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2520

2080

os.dup2(null, sys.stdin.fileno())

2521

2081

if null > 2:

2522

2082

os.close(null)

2083

else:

2084

# No console logging

2085

logger.removeHandler(console)

2523

2086

2524

2087

# Need to fork before connecting to D-Bus

2525

if not foreground:

2088

if not debug:

2526

2089

# Close all input and output, do double fork, etc.

2527

2090

daemon()

2528

2091

2529

# multiprocessing will use threads, so before we use gobject we

2530

# need to inform gobject that threads will be used.

2531

gobject.threads_init()

2532

2533

2092

global main_loop

2534

2093

# From the Avahi example code

2535

DBusGMainLoop(set_as_default=True)

2094

DBusGMainLoop(set_as_default=True )

2536

2095

main_loop = gobject.MainLoop()

2537

2096

bus = dbus.SystemBus()

2538

2097

# End of Avahi example code

2544

2103

("se.bsnet.fukt.Mandos", bus,

2545

2104

do_not_queue=True))

2546

2105

except dbus.exceptions.NameExistsException as e:

2547

logger.error("Disabling D-Bus:", exc_info=e)

2106

logger.error(unicode(e) + ", disabling D-Bus")

2548

2107

use_dbus = False

2549

2108

server_settings["use_dbus"] = False

2550

2109

tcp_server.use_dbus = False

2551

if zeroconf:

2552

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2553

service = AvahiServiceToSyslog(name =

2554

server_settings["servicename"],

2555

servicetype = "_mandos._tcp",

2556

protocol = protocol, bus = bus)

2557

if server_settings["interface"]:

2558

service.interface = (if_nametoindex

2559

(server_settings["interface"]

2560

.encode("utf-8")))

2110

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2111

service = AvahiServiceToSyslog(name =

2112

server_settings["servicename"],

2113

servicetype = "_mandos._tcp",

2114

protocol = protocol, bus = bus)

2115

if server_settings["interface"]:

2116

service.interface = (if_nametoindex

2117

(str(server_settings["interface"])))

2561

2118

2562

2119

global multiprocessing_manager

2563

2120

multiprocessing_manager = multiprocessing.Manager()

2564

2121

2565

2122

client_class = Client

2566

2123

if use_dbus:

2567

client_class = functools.partial(ClientDBus, bus = bus)

2568

2569

client_settings = Client.config_parser(client_config)

2124

client_class = functools.partial(ClientDBusTransitional,

2125

bus = bus)

2126

2127

special_settings = {

2128

# Some settings need to be accessd by special methods;

2129

# booleans need .getboolean(), etc. Here is a list of them:

2130

"approved_by_default":

2131

lambda section:

2132

client_config.getboolean(section, "approved_by_default"),

2133

}

2134

# Construct a new dict of client settings of this form:

2135

# { client_name: {setting_name: value, ...}, ...}

2136

# with exceptions for any special settings as defined above

2137

client_settings = dict((clientname,

2138

dict((setting,

2139

(value if

2140

setting not in special_settings

2141

else special_settings[setting]

2142

(clientname)))

2143

for setting, value

2144

in client_config.items(clientname)))

2145

for clientname in client_config.sections())

2146

2570

2147

old_client_settings = {}

2571

clients_data = {}

2572

2573

# This is used to redirect stdout and stderr for checker processes

2574

global wnull

2575

wnull = open(os.devnull, "w") # A writable /dev/null

2576

# Only used if server is running in foreground but not in debug

2577

# mode

2578

if debug or not foreground:

2579

wnull.close()

2580

2581

# Get client data and settings from last running state.

2148

clients_data = []

2149

2150

# Get client data and settings from last running state.

2582

2151

if server_settings["restore"]:

2583

2152

try:

2584

2153

with open(stored_state_path, "rb") as stored_state:

2585

clients_data, old_client_settings = (pickle.load

2586

(stored_state))

2154

clients_data, old_client_settings = (

2155

pickle.load(stored_state))

2587

2156

os.remove(stored_state_path)

2588

2157

except IOError as e:

2589

if e.errno == errno.ENOENT:

2590

logger.warning("Could not load persistent state: {}"

2591

.format(os.strerror(e.errno)))

2592

else:

2593

logger.critical("Could not load persistent state:",

2594

exc_info=e)

2158

logger.warning("Could not load persistant state: {0}"

2159

.format(e))

2160

if e.errno != errno.ENOENT:

2595

2161

raise

2596

except EOFError as e:

2597

logger.warning("Could not load persistent state: "

2598

"EOFError:", exc_info=e)

2599

2600

with PGPEngine() as pgp:

2601

for client_name, client in clients_data.items():

2602

# Skip removed clients

2603

if client_name not in client_settings:

2604

continue

2605

2606

# Decide which value to use after restoring saved state.

2607

# We have three different values: Old config file,

2608

# new config file, and saved state.

2609

# New config value takes precedence if it differs from old

2610

# config value, otherwise use saved state.

2611

for name, value in client_settings[client_name].items():

2612

try:

2613

# For each value in new config, check if it

2614

# differs from the old config value (Except for

2615

# the "secret" attribute)

2616

if (name != "secret" and

2617

value != old_client_settings[client_name]

2618

[name]):

2619

client[name] = value

2620

except KeyError:

2621

pass

2622

2623

# Clients who has passed its expire date can still be

2624

# enabled if its last checker was successful. Clients

2625

# whose checker succeeded before we stored its state is

2626

# assumed to have successfully run all checkers during

2627

# downtime.

2628

if client["enabled"]:

2629

if datetime.datetime.utcnow() >= client["expires"]:

2630

if not client["last_checked_ok"]:

2631

logger.warning(

2632

"disabling client {} - Client never "

2633

"performed a successful checker"

2634

.format(client_name))

2635

client["enabled"] = False

2636

elif client["last_checker_status"] != 0:

2637

logger.warning(

2638

"disabling client {} - Client last"

2639

" checker failed with error code {}"

2640

.format(client_name,

2641

client["last_checker_status"]))

2642

client["enabled"] = False

2643

else:

2644

client["expires"] = (datetime.datetime

2645

.utcnow()

2646

+ client["timeout"])

2647

logger.debug("Last checker succeeded,"

2648

" keeping {} enabled"

2649

.format(client_name))

2162

2163

for client in clients_data:

2164

client_name = client["name"]

2165

2166

# Decide which value to use after restoring saved state.

2167

# We have three different values: Old config file,

2168

# new config file, and saved state.

2169

# New config value takes precedence if it differs from old

2170

# config value, otherwise use saved state.

2171

for name, value in client_settings[client_name].items():

2650

2172

try:

2651

client["secret"] = (

2652

pgp.decrypt(client["encrypted_secret"],

2653

client_settings[client_name]

2654

["secret"]))

2655

except PGPError:

2656

# If decryption fails, we use secret from new settings

2657

logger.debug("Failed to decrypt {} old secret"

2658

.format(client_name))

2659

client["secret"] = (

2660

client_settings[client_name]["secret"])

2661

2662

# Add/remove clients based on new changes made to config

2663

for client_name in (set(old_client_settings)

2664

- set(client_settings)):

2665

del clients_data[client_name]

2666

for client_name in (set(client_settings)

2667

- set(old_client_settings)):

2668

clients_data[client_name] = client_settings[client_name]

2669

2670

# Create all client objects

2671

for client_name, client in clients_data.items():

2672

tcp_server.clients[client_name] = client_class(

2673

name = client_name, settings = client,

2674

server_settings = server_settings)

2173

# For each value in new config, check if it differs

2174

# from the old config value (Except for the "secret"

2175

# attribute)

2176

if (name != "secret" and

2177

value != old_client_settings[client_name][name]):

2178

setattr(client, name, value)

2179

except KeyError:

2180

pass

2181

2182

# Clients who has passed its expire date, can still be enabled

2183

# if its last checker was sucessful. Clients who checkers

2184

# failed before we stored it state is asumed to had failed

2185

# checker during downtime.

2186

if client["enabled"] and client["last_checked_ok"]:

2187

if ((datetime.datetime.utcnow()

2188

- client["last_checked_ok"]) > client["interval"]):

2189

if client["last_checker_status"] != 0:

2190

client["enabled"] = False

2191

else:

2192

client["expires"] = (datetime.datetime.utcnow()

2193

+ client["timeout"])

2194

2195

client["changedstate"] = (multiprocessing_manager

2196

.Condition(multiprocessing_manager

2197

.Lock()))

2198

if use_dbus:

2199

new_client = ClientDBusTransitional.__new__(

2200

ClientDBusTransitional)

2201

tcp_server.clients[client_name] = new_client

2202

new_client.bus = bus

2203

for name, value in client.iteritems():

2204

setattr(new_client, name, value)

2205

new_client._approvals_pending = 0

2206

new_client.add_to_dbus()

2207

else:

2208

tcp_server.clients[client_name] = Client.__new__(Client)

2209

for name, value in client.iteritems():

2210

setattr(tcp_server.clients[client_name], name, value)

2211

2212

tcp_server.clients[client_name].decrypt_secret(

2213

client_settings[client_name]["secret"])

2214

2215

# Create/remove clients based on new changes made to config

2216

for clientname in set(old_client_settings) - set(client_settings):

2217

del tcp_server.clients[clientname]

2218

for clientname in set(client_settings) - set(old_client_settings):

2219

tcp_server.clients[clientname] = client_class(name

2220

= clientname,

2221

config =

2222

client_settings

2223

[clientname])

2675

2224

2676

2225

if not tcp_server.clients:

2677

2226

logger.warning("No clients defined")

2678

2679

if not foreground:

2680

if pidfile is not None:

2681

try:

2682

with pidfile:

2683

pid = os.getpid()

2684

pidfile.write("{}\n".format(pid).encode("utf-8"))

2685

except IOError:

2686

logger.error("Could not write to file %r with PID %d",

2687

pidfilename, pid)

2688

del pidfile

2227

2228

if not debug:

2229

try:

2230

with pidfile:

2231

pid = os.getpid()

2232

pidfile.write(str(pid) + "\n".encode("utf-8"))

2233

del pidfile

2234

except IOError:

2235

logger.error("Could not write to file %r with PID %d",

2236

pidfilename, pid)

2237

except NameError:

2238

# "pidfile" was never created

2239

pass

2689

2240

del pidfilename

2241

2242

signal.signal(signal.SIGINT, signal.SIG_IGN)

2690

2243

2691

2244

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2692

2245

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2693

2246

2694

2247

if use_dbus:

2695

@alternate_dbus_interfaces({"se.recompile.Mandos":

2696

"se.bsnet.fukt.Mandos"})

2697

class MandosDBusService(DBusObjectWithProperties):

2248

class MandosDBusService(dbus.service.Object):

2698

2249

"""A D-Bus proxy object"""

2699

2250

def __init__(self):

2700

2251

dbus.service.Object.__init__(self, bus, "/")

2701

2252

_interface = "se.recompile.Mandos"

2702

2253

2703

@dbus_interface_annotations(_interface)

2704

def _foo(self):

2705

return { "org.freedesktop.DBus.Property"

2706

".EmitsChangedSignal":

2707

"false"}

2708

2709

2254

@dbus.service.signal(_interface, signature="o")

2710

2255

def ClientAdded(self, objpath):

2711

2256

"D-Bus signal"

2733

2278

def GetAllClientsWithProperties(self):

2734

2279

"D-Bus method"

2735

2280

return dbus.Dictionary(

2736

{ c.dbus_object_path: c.GetAll("")

2737

for c in tcp_server.clients.itervalues() },

2281

((c.dbus_object_path, c.GetAll(""))

2282

for c in tcp_server.clients.itervalues()),

2738

2283

signature="oa{sv}")

2739

2284

2740

2285

@dbus.service.method(_interface, in_signature="o")

2753

2298

2754

2299

del _interface

2755

2300

2756

mandos_dbus_service = MandosDBusService()

2301

class MandosDBusServiceTransitional(MandosDBusService):

2302

__metaclass__ = AlternateDBusNamesMetaclass

2303

mandos_dbus_service = MandosDBusServiceTransitional()

2757

2304

2758

2305

def cleanup():

2759

2306

"Cleanup function; run on exit"

2760

if zeroconf:

2761

service.cleanup()

2307

service.cleanup()

2762

2308

2763

2309

multiprocessing.active_children()

2764

wnull.close()

2765

2310

if not (tcp_server.clients or client_settings):

2766

2311

return

2767

2312

2768

2313

# Store client before exiting. Secrets are encrypted with key

2769

2314

# based on what config file has. If config file is

2770

2315

# removed/edited, old secret will thus be unrecovable.

2771

clients = {}

2772

with PGPEngine() as pgp:

2773

for client in tcp_server.clients.itervalues():

2774

key = client_settings[client.name]["secret"]

2775

client.encrypted_secret = pgp.encrypt(client.secret,

2776

key)

2777

client_dict = {}

2778

2779

# A list of attributes that can not be pickled

2780

# + secret.

2781

exclude = { "bus", "changedstate", "secret",

2782

"checker", "server_settings" }

2783

for name, typ in (inspect.getmembers

2784

(dbus.service.Object)):

2785

exclude.add(name)

2786

2787

client_dict["encrypted_secret"] = (client

2788

.encrypted_secret)

2789

for attr in client.client_structure:

2790

if attr not in exclude:

2791

client_dict[attr] = getattr(client, attr)

2792

2793

clients[client.name] = client_dict

2794

del client_settings[client.name]["secret"]

2795

2316

clients = []

2317

for client in tcp_server.clients.itervalues():

2318

client.encrypt_secret(

2319

client_settings[client.name]["secret"])

2320

2321

client_dict = {}

2322

2323

# A list of attributes that will not be stored when

2324

# shutting down.

2325

exclude = set(("bus", "changedstate", "secret"))

2326

for name, typ in inspect.getmembers(dbus.service.Object):

2327

exclude.add(name)

2328

2329

client_dict["encrypted_secret"] = client.encrypted_secret

2330

for attr in client.client_structure:

2331

if attr not in exclude:

2332

client_dict[attr] = getattr(client, attr)

2333

2334

clients.append(client_dict)

2335

del client_settings[client.name]["secret"]

2336

2796

2337

try:

2797

with (tempfile.NamedTemporaryFile

2798

(mode='wb', suffix=".pickle", prefix='clients-',

2799

dir=os.path.dirname(stored_state_path),

2800

delete=False)) as stored_state:

2338

with os.fdopen(os.open(stored_state_path,

2339

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2340

stat.S_IRUSR | stat.S_IWUSR),

2341

"wb") as stored_state:

2801

2342

pickle.dump((clients, client_settings), stored_state)

2802

tempname=stored_state.name

2803

os.rename(tempname, stored_state_path)

2804

except (IOError, OSError) as e:

2805

if not debug:

2806

try:

2807

os.remove(tempname)

2808

except NameError:

2809

pass

2810

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2811

logger.warning("Could not save persistent state: {}"

2812

.format(os.strerror(e.errno)))

2813

else:

2814

logger.warning("Could not save persistent state:",

2815

exc_info=e)

2343

except IOError as e:

2344

logger.warning("Could not save persistant state: {0}"

2345

.format(e))

2346

if e.errno != errno.ENOENT:

2816

2347

raise

2817

2348

2818

2349

# Delete all clients, and settings from config

2819

2350

while tcp_server.clients:

2820

2351

name, client = tcp_server.clients.popitem()

2838

2369

# Need to initiate checking of clients

2839

2370

if client.enabled:

2840

2371

client.init_checker()

2372

2841

2373

2842

2374

tcp_server.enable()

2843

2375

tcp_server.server_activate()

2844

2376

2845

2377

# Find out what port we got

2846

if zeroconf:

2847

service.port = tcp_server.socket.getsockname()[1]

2378

service.port = tcp_server.socket.getsockname()[1]

2848

2379

if use_ipv6:

2849

2380

logger.info("Now listening on address %r, port %d,"

2850

" flowinfo %d, scope_id %d",

2851

*tcp_server.socket.getsockname())

2381

" flowinfo %d, scope_id %d"

2382

% tcp_server.socket.getsockname())

2852

2383

else: # IPv4

2853

logger.info("Now listening on address %r, port %d",

2854

*tcp_server.socket.getsockname())

2384

logger.info("Now listening on address %r, port %d"

2385

% tcp_server.socket.getsockname())

2855

2386

2856

2387

#service.interface = tcp_server.socket.getsockname()[3]

2857

2388

2858

2389

try:

2859

if zeroconf:

2860

# From the Avahi example code

2861

try:

2862

service.activate()

2863

except dbus.exceptions.DBusException as error:

2864

logger.critical("D-Bus Exception", exc_info=error)

2865

cleanup()

2866

sys.exit(1)

2867

# End of Avahi example code

2390

# From the Avahi example code

2391

try:

2392

service.activate()

2393

except dbus.exceptions.DBusException as error:

2394

logger.critical("DBusException: %s", error)

2395

cleanup()

2396

sys.exit(1)

2397

# End of Avahi example code

2868

2398

2869

2399

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2870

2400

lambda *args, **kwargs:

2874

2404

logger.debug("Starting main loop")

2875

2405

main_loop.run()

2876

2406

except AvahiError as error:

2877

logger.critical("Avahi Error", exc_info=error)

2407

logger.critical("AvahiError: %s", error)

2878

2408

cleanup()

2879

2409

sys.exit(1)

2880

2410

except KeyboardInterrupt:

2885

2415

# Must run before the D-Bus bus name gets deregistered

2886

2416

cleanup()

2887

2417

2418

2888

2419

if __name__ == '__main__':

2889

2420

main()