/mandos/trunk : revision 633

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

88

except ImportError:

89

SO_BINDTODEVICE = None

90

91

version = "1.6.8"

91

version = "1.6.1"

92

stored_state_file = "clients.pickle"

93

94

logger = logging.getLogger()

95

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

96

98

97

99

try:

98

100

if_nametoindex = (ctypes.cdll.LoadLibrary

104

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

107

with contextlib.closing(socket.socket()) as s:

106

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(b"16s16x", interface))

108

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

109

113

return interface_index

110

114

111

115

112

116

def initlogger(debug, level=logging.WARNING):

113

117

"""init logger and add loglevel"""

114

118

115

global syslogger

116

syslogger = (logging.handlers.SysLogHandler

117

(facility =

118

logging.handlers.SysLogHandler.LOG_DAEMON,

119

address = "/dev/log"))

120

119

syslogger.setFormatter(logging.Formatter

121

120

('Mandos [%(process)d]: %(levelname)s:'

122

121

' %(message)s'))

222

221

class AvahiError(Exception):

223

222

def __init__(self, value, *args, **kwargs):

224

223

self.value = value

225

return super(AvahiError, self).__init__(value, *args,

226

**kwargs)

224

super(AvahiError, self).__init__(value, *args, **kwargs)

225

def __unicode__(self):

226

return unicode(repr(self.value))

227

228

class AvahiServiceError(AvahiError):

229

pass

335

elif state == avahi.ENTRY_GROUP_FAILURE:

336

logger.critical("Avahi: Error in group state changed %s",

337

unicode(error))

338

raise AvahiGroupError("State changed: {!s}"

338

raise AvahiGroupError("State changed: {0!s}"

339

.format(error))

340

341

def cleanup(self):

392

"""Add the new name to the syslog messages"""

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({}) [%(process)d]:'

395

('Mandos ({0}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

398

return ret

399

400

401

def timedelta_to_milliseconds(td):

402

"Convert a datetime.timedelta() to milliseconds"

403

return ((td.days * 24 * 60 * 60 * 1000)

404

+ (td.seconds * 1000)

405

+ (td.microseconds // 1000))

406

407

401

408

class Client(object):

402

409

"""A representation of a client host served by this server.

403

410

458

465

"enabled": "True",

459

466

}

460

467

468

def timeout_milliseconds(self):

469

"Return the 'timeout' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.timeout)

471

472

def extended_timeout_milliseconds(self):

473

"Return the 'extended_timeout' attribute in milliseconds"

474

return timedelta_to_milliseconds(self.extended_timeout)

475

476

def interval_milliseconds(self):

477

"Return the 'interval' attribute in milliseconds"

478

return timedelta_to_milliseconds(self.interval)

479

480

def approval_delay_milliseconds(self):

481

return timedelta_to_milliseconds(self.approval_delay)

482

461

483

@staticmethod

462

484

def config_parser(config):

463

485

"""Construct a new dict of client settings of this form:

488

510

"rb") as secfile:

489

511

client["secret"] = secfile.read()

490

512

else:

491

raise TypeError("No secret or secfile for section {}"

513

raise TypeError("No secret or secfile for section {0}"

492

514

.format(section))

493

515

client["timeout"] = string_to_delta(section["timeout"])

494

516

client["extended_timeout"] = string_to_delta(

511

533

server_settings = {}

512

534

self.server_settings = server_settings

513

535

# adding all client settings

514

for setting, value in settings.items():

536

for setting, value in settings.iteritems():

515

537

setattr(self, setting, value)

516

538

517

539

if self.enabled:

600

622

if self.checker_initiator_tag is not None:

601

623

gobject.source_remove(self.checker_initiator_tag)

602

624

self.checker_initiator_tag = (gobject.timeout_add

603

(int(self.interval

604

.total_seconds() * 1000),

625

(self.interval_milliseconds(),

605

626

self.start_checker))

606

627

# Schedule a disable() when 'timeout' has passed

607

628

if self.disable_initiator_tag is not None:

608

629

gobject.source_remove(self.disable_initiator_tag)

609

630

self.disable_initiator_tag = (gobject.timeout_add

610

(int(self.timeout

611

.total_seconds() * 1000),

612

self.disable))

631

(self.timeout_milliseconds(),

632

self.disable))

613

633

# Also start a new checker *right now*.

614

634

self.start_checker()

615

635

646

666

self.disable_initiator_tag = None

647

667

if getattr(self, "enabled", False):

648

668

self.disable_initiator_tag = (gobject.timeout_add

649

(int(timeout.total_seconds()

650

* 1000), self.disable))

669

(timedelta_to_milliseconds

670

(timeout), self.disable))

651

671

self.expires = datetime.datetime.utcnow() + timeout

652

672

653

673

def need_approval(self):

670

690

# If a checker exists, make sure it is not a zombie

671

691

try:

672

692

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

673

except AttributeError:

674

pass

675

except OSError as error:

676

if error.errno != errno.ECHILD:

677

raise

693

except (AttributeError, OSError) as error:

694

if (isinstance(error, OSError)

695

and error.errno != errno.ECHILD):

696

raise error

678

697

else:

679

698

if pid:

680

699

logger.warning("Checker was a zombie")

684

703

# Start a new checker if needed

685

704

if self.checker is None:

686

705

# Escape attributes for the shell

687

escaped_attrs = { attr:

688

re.escape(unicode(getattr(self,

689

attr)))

690

for attr in self.runtime_expansions }

706

escaped_attrs = dict(

707

(attr, re.escape(unicode(getattr(self, attr))))

708

for attr in

709

self.runtime_expansions)

691

710

try:

692

711

command = self.checker_command % escaped_attrs

693

712

except TypeError as error:

774

793

# "Set" method, so we fail early here:

775

794

if byte_arrays and signature != "ay":

776

795

raise ValueError("Byte arrays not supported for non-'ay'"

777

" signature {!r}".format(signature))

796

" signature {0!r}".format(signature))

778

797

def decorator(func):

779

798

func._dbus_is_property = True

780

799

func._dbus_interface = dbus_interface

828

847

class DBusPropertyException(dbus.exceptions.DBusException):

829

848

"""A base class for D-Bus property-related exceptions

830

849

"""

831

pass

850

def __unicode__(self):

851

return unicode(str(self))

852

832

853

833

854

class DBusPropertyAccessException(DBusPropertyException):

834

855

"""A property's access permissions disallows an operation.

857

878

If called like _is_dbus_thing("method") it returns a function

858

879

suitable for use as predicate to inspect.getmembers().

859

880

"""

860

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

881

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

861

882

False)

862

883

863

884

def _get_all_dbus_things(self, thing):

912

933

# The byte_arrays option is not supported yet on

913

934

# signatures other than "ay".

914

935

if prop._dbus_signature != "ay":

915

raise ValueError("Byte arrays not supported for non-"

916

"'ay' signature {!r}"

917

.format(prop._dbus_signature))

936

raise ValueError

918

937

value = dbus.ByteArray(b''.join(chr(byte)

919

938

for byte in value))

920

939

prop(value)

984

1003

(prop,

985

1004

"_dbus_annotations",

986

1005

{}))

987

for name, value in annots.items():

1006

for name, value in annots.iteritems():

988

1007

ann_tag = document.createElement(

989

1008

"annotation")

990

1009

ann_tag.setAttribute("name", name)

993

1012

# Add interface annotation tags

994

1013

for annotation, value in dict(

995

1014

itertools.chain.from_iterable(

996

annotations().items()

1015

annotations().iteritems()

997

1016

for name, annotations in

998

1017

self._get_all_dbus_things("interface")

999

1018

if name == if_tag.getAttribute("name")

1000

)).items():

1019

)).iteritems():

1001

1020

ann_tag = document.createElement("annotation")

1002

1021

ann_tag.setAttribute("name", annotation)

1003

1022

ann_tag.setAttribute("value", value)

1059

1078

"""

1060

1079

def wrapper(cls):

1061

1080

for orig_interface_name, alt_interface_name in (

1062

alt_interface_names.items()):

1081

alt_interface_names.iteritems()):

1063

1082

attr = {}

1064

1083

interface_names = set()

1065

1084

# Go though all attributes of the class

1182

1201

attribute.func_closure)))

1183

1202

if deprecate:

1184

1203

# Deprecate all alternate interfaces

1185

iname="_AlternateDBusNames_interface_annotation{}"

1204

iname="_AlternateDBusNames_interface_annotation{0}"

1186

1205

for interface_name in interface_names:

1187

1206

@dbus_interface_annotations(interface_name)

1188

1207

def func(self):

1197

1216

if interface_names:

1198

1217

# Replace the class with a new subclass of it with

1199

1218

# methods, signals, etc. as created above.

1200

cls = type(b"{}Alternate".format(cls.__name__),

1219

cls = type(b"{0}Alternate".format(cls.__name__),

1201

1220

(cls,), attr)

1202

1221

return cls

1203

1222

return wrapper

1244

1263

to the D-Bus. Default: no transform

1245

1264

variant_level: D-Bus variant level. Default: 1

1246

1265

"""

1247

attrname = "_{}".format(dbus_name)

1266

attrname = "_{0}".format(dbus_name)

1248

1267

def setter(self, value):

1249

1268

if hasattr(self, "dbus_object_path"):

1250

1269

if (not hasattr(self, attrname) or

1280

1299

approval_delay = notifychangeproperty(dbus.UInt64,

1281

1300

"ApprovalDelay",

1282

1301

type_func =

1283

lambda td: td.total_seconds()

1284

* 1000)

1302

timedelta_to_milliseconds)

1285

1303

approval_duration = notifychangeproperty(

1286

1304

dbus.UInt64, "ApprovalDuration",

1287

type_func = lambda td: td.total_seconds() * 1000)

1305

type_func = timedelta_to_milliseconds)

1288

1306

host = notifychangeproperty(dbus.String, "Host")

1289

1307

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1290

type_func = lambda td:

1291

td.total_seconds() * 1000)

1308

type_func =

1309

timedelta_to_milliseconds)

1292

1310

extended_timeout = notifychangeproperty(

1293

1311

dbus.UInt64, "ExtendedTimeout",

1294

type_func = lambda td: td.total_seconds() * 1000)

1312

type_func = timedelta_to_milliseconds)

1295

1313

interval = notifychangeproperty(dbus.UInt64,

1296

1314

"Interval",

1297

1315

type_func =

1298

lambda td: td.total_seconds()

1299

* 1000)

1316

timedelta_to_milliseconds)

1300

1317

checker_command = notifychangeproperty(dbus.String, "Checker")

1301

1318

1302

1319

del notifychangeproperty

1330

1347

*args, **kwargs)

1331

1348

1332

1349

def start_checker(self, *args, **kwargs):

1333

old_checker_pid = getattr(self.checker, "pid", None)

1350

old_checker = self.checker

1351

if self.checker is not None:

1352

old_checker_pid = self.checker.pid

1353

else:

1354

old_checker_pid = None

1334

1355

r = Client.start_checker(self, *args, **kwargs)

1335

1356

# Only if new checker process was started

1336

1357

if (self.checker is not None

1345

1366

1346

1367

def approve(self, value=True):

1347

1368

self.approved = value

1348

gobject.timeout_add(int(self.approval_duration.total_seconds()

1349

* 1000), self._reset_approved)

1369

gobject.timeout_add(timedelta_to_milliseconds

1370

(self.approval_duration),

1371

self._reset_approved)

1350

1372

self.send_changedstate()

1351

1373

1352

1374

## D-Bus methods, signals & properties

1455

1477

access="readwrite")

1456

1478

def ApprovalDelay_dbus_property(self, value=None):

1457

1479

if value is None: # get

1458

return dbus.UInt64(self.approval_delay.total_seconds()

1459

* 1000)

1480

return dbus.UInt64(self.approval_delay_milliseconds())

1460

1481

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1461

1482

1462

1483

# ApprovalDuration - property

1464

1485

access="readwrite")

1465

1486

def ApprovalDuration_dbus_property(self, value=None):

1466

1487

if value is None: # get

1467

return dbus.UInt64(self.approval_duration.total_seconds()

1468

* 1000)

1488

return dbus.UInt64(timedelta_to_milliseconds(

1489

self.approval_duration))

1469

1490

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1470

1491

1471

1492

# Name - property

1537

1558

access="readwrite")

1538

1559

def Timeout_dbus_property(self, value=None):

1539

1560

if value is None: # get

1540

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1561

return dbus.UInt64(self.timeout_milliseconds())

1541

1562

old_timeout = self.timeout

1542

1563

self.timeout = datetime.timedelta(0, 0, 0, value)

1543

1564

# Reschedule disabling

1554

1575

gobject.source_remove(self.disable_initiator_tag)

1555

1576

self.disable_initiator_tag = (

1556

1577

gobject.timeout_add(

1557

int((self.expires - now).total_seconds()

1558

* 1000), self.disable))

1578

timedelta_to_milliseconds(self.expires - now),

1579

self.disable))

1559

1580

1560

1581

# ExtendedTimeout - property

1561

1582

@dbus_service_property(_interface, signature="t",

1562

1583

access="readwrite")

1563

1584

def ExtendedTimeout_dbus_property(self, value=None):

1564

1585

if value is None: # get

1565

return dbus.UInt64(self.extended_timeout.total_seconds()

1566

* 1000)

1586

return dbus.UInt64(self.extended_timeout_milliseconds())

1567

1587

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1568

1588

1569

1589

# Interval - property

1571

1591

access="readwrite")

1572

1592

def Interval_dbus_property(self, value=None):

1573

1593

if value is None: # get

1574

return dbus.UInt64(self.interval.total_seconds() * 1000)

1594

return dbus.UInt64(self.interval_milliseconds())

1575

1595

self.interval = datetime.timedelta(0, 0, 0, value)

1576

1596

if getattr(self, "checker_initiator_tag", None) is None:

1577

1597

return

1610

1630

@dbus_service_property(_interface, signature="ay",

1611

1631

access="write", byte_arrays=True)

1612

1632

def Secret_dbus_property(self, value):

1613

self.secret = bytes(value)

1633

self.secret = str(value)

1614

1634

1615

1635

del _interface

1616

1636

1682

1702

logger.debug("Protocol version: %r", line)

1683

1703

try:

1684

1704

if int(line.strip().split()[0]) > 1:

1685

raise RuntimeError(line)

1705

raise RuntimeError

1686

1706

except (ValueError, IndexError, RuntimeError) as error:

1687

1707

logger.error("Unknown protocol version: %s", error)

1688

1708

return

1737

1757

if self.server.use_dbus:

1738

1758

# Emit D-Bus signal

1739

1759

client.NeedApproval(

1740

client.approval_delay.total_seconds()

1741

* 1000, client.approved_by_default)

1760

client.approval_delay_milliseconds(),

1761

client.approved_by_default)

1742

1762

else:

1743

1763

logger.warning("Client %s was not approved",

1744

1764

client.name)

1750

1770

#wait until timeout or approved

1751

1771

time = datetime.datetime.now()

1752

1772

client.changedstate.acquire()

1753

client.changedstate.wait(delay.total_seconds())

1773

client.changedstate.wait(

1774

float(timedelta_to_milliseconds(delay)

1775

/ 1000))

1754

1776

client.changedstate.release()

1755

1777

time2 = datetime.datetime.now()

1756

1778

if (time2 - time) >= delay:

1893

1915

1894

1916

def add_pipe(self, parent_pipe, proc):

1895

1917

"""Dummy function; override as necessary"""

1896

raise NotImplementedError()

1918

raise NotImplementedError

1897

1919

1898

1920

1899

1921

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1955

1977

try:

1956

1978

self.socket.setsockopt(socket.SOL_SOCKET,

1957

1979

SO_BINDTODEVICE,

1958

(self.interface + "\0")

1959

.encode("utf-8"))

1980

str(self.interface + '\0'))

1960

1981

except socket.error as error:

1961

1982

if error.errno == errno.EPERM:

1962

1983

logger.error("No permission to bind to"

2165

2186

token_duration = Token(re.compile(r"P"), None,

2166

2187

frozenset((token_year, token_month,

2167

2188

token_day, token_time,

2168

token_week)))

2189

token_week))),

2169

2190

# Define starting values

2170

2191

value = datetime.timedelta() # Value so far

2171

2192

found_token = None

2172

followers = frozenset((token_duration,)) # Following valid tokens

2193

followers = frozenset(token_duration,) # Following valid tokens

2173

2194

s = duration # String left to parse

2174

2195

# Loop until end token is found

2175

2196

while found_token is not token_end:

2222

2243

timevalue = datetime.timedelta(0)

2223

2244

for s in interval.split():

2224

2245

try:

2225

suffix = s[-1]

2246

suffix = unicode(s[-1])

2226

2247

value = int(s[:-1])

2227

2248

if suffix == "d":

2228

2249

delta = datetime.timedelta(value)

2235

2256

elif suffix == "w":

2236

2257

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2237

2258

else:

2238

raise ValueError("Unknown suffix {!r}"

2259

raise ValueError("Unknown suffix {0!r}"

2239

2260

.format(suffix))

2240

except IndexError as e:

2261

except (ValueError, IndexError) as e:

2241

2262

raise ValueError(*(e.args))

2242

2263

timevalue += delta

2243

2264

return timevalue

2258

2279

# Close all standard open file descriptors

2259

2280

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2260

2281

if not stat.S_ISCHR(os.fstat(null).st_mode):

2261

raise OSError(errno.ENODEV, "{} not a character device"

2282

raise OSError(errno.ENODEV,

2283

"{0} not a character device"

2262

2284

.format(os.devnull))

2263

2285

os.dup2(null, sys.stdin.fileno())

2264

2286

os.dup2(null, sys.stdout.fileno())

2274

2296

2275

2297

parser = argparse.ArgumentParser()

2276

2298

parser.add_argument("-v", "--version", action="version",

2277

version = "%(prog)s {}".format(version),

2299

version = "%(prog)s {0}".format(version),

2278

2300

help="show version number and exit")

2279

2301

parser.add_argument("-i", "--interface", metavar="IF",

2280

2302

help="Bind to interface IF")

2313

2335

help="Directory to save/restore state in")

2314

2336

parser.add_argument("--foreground", action="store_true",

2315

2337

help="Run in foreground", default=None)

2316

parser.add_argument("--no-zeroconf", action="store_false",

2317

dest="zeroconf", help="Do not use Zeroconf",

2318

default=None)

2319

2338

2320

2339

options = parser.parse_args()

2321

2340

2322

2341

if options.check:

2323

2342

import doctest

2324

fail_count, test_count = doctest.testmod()

2325

sys.exit(os.EX_OK if fail_count == 0 else 1)

2343

doctest.testmod()

2344

sys.exit()

2326

2345

2327

2346

# Default values for config file for server-global settings

2328

2347

server_defaults = { "interface": "",

2339

2358

"socket": "",

2340

2359

"statedir": "/var/lib/mandos",

2341

2360

"foreground": "False",

2342

"zeroconf": "True",

2343

2361

}

2344

2362

2345

2363

# Parse config file for server-global settings

2372

2390

for option in ("interface", "address", "port", "debug",

2373

2391

"priority", "servicename", "configdir",

2374

2392

"use_dbus", "use_ipv6", "debuglevel", "restore",

2375

"statedir", "socket", "foreground", "zeroconf"):

2393

"statedir", "socket", "foreground"):

2376

2394

value = getattr(options, option)

2377

2395

if value is not None:

2378

2396

server_settings[option] = value

2379

2397

del options

2380

2398

# Force all strings to be unicode

2381

2399

for option in server_settings.keys():

2382

if isinstance(server_settings[option], bytes):

2383

server_settings[option] = (server_settings[option]

2384

.decode("utf-8"))

2400

if type(server_settings[option]) is str:

2401

server_settings[option] = unicode(server_settings[option])

2385

2402

# Force all boolean options to be boolean

2386

2403

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2387

"foreground", "zeroconf"):

2404

"foreground"):

2388

2405

server_settings[option] = bool(server_settings[option])

2389

2406

# Debug implies foreground

2390

2407

if server_settings["debug"]:

2393

2410

2394

2411

##################################################################

2395

2412

2396

if (not server_settings["zeroconf"] and

2397

not (server_settings["port"]

2398

or server_settings["socket"] != "")):

2399

parser.error("Needs port or socket to work without"

2400

" Zeroconf")

2401

2402

2413

# For convenience

2403

2414

debug = server_settings["debug"]

2404

2415

debuglevel = server_settings["debuglevel"]

2407

2418

stored_state_path = os.path.join(server_settings["statedir"],

2408

2419

stored_state_file)

2409

2420

foreground = server_settings["foreground"]

2410

zeroconf = server_settings["zeroconf"]

2411

2421

2412

2422

if debug:

2413

2423

initlogger(debug, logging.DEBUG)

2420

2430

2421

2431

if server_settings["servicename"] != "Mandos":

2422

2432

syslogger.setFormatter(logging.Formatter

2423

('Mandos ({}) [%(process)d]:'

2433

('Mandos ({0}) [%(process)d]:'

2424

2434

' %(levelname)s: %(message)s'

2425

2435

.format(server_settings

2426

2436

["servicename"])))

2434

2444

global mandos_dbus_service

2435

2445

mandos_dbus_service = None

2436

2446

2437

socketfd = None

2438

if server_settings["socket"] != "":

2439

socketfd = server_settings["socket"]

2440

2447

tcp_server = MandosServer((server_settings["address"],

2441

2448

server_settings["port"]),

2442

2449

ClientHandler,

2446

2453

gnutls_priority=

2447

2454

server_settings["priority"],

2448

2455

use_dbus=use_dbus,

2449

socketfd=socketfd)

2456

socketfd=(server_settings["socket"]

2457

or None))

2450

2458

if not foreground:

2451

2459

pidfilename = "/run/mandos.pid"

2452

if not os.path.isdir("/run/."):

2453

pidfilename = "/var/run/mandos.pid"

2454

2460

pidfile = None

2455

2461

try:

2456

2462

pidfile = open(pidfilename, "w")

2473

2479

os.setuid(uid)

2474

2480

except OSError as error:

2475

2481

if error.errno != errno.EPERM:

2476

raise

2482

raise error

2477

2483

2478

2484

if debug:

2479

2485

# Enable all possible GnuTLS debugging

2522

2528

use_dbus = False

2523

2529

server_settings["use_dbus"] = False

2524

2530

tcp_server.use_dbus = False

2525

if zeroconf:

2526

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2527

service = AvahiServiceToSyslog(name =

2528

server_settings["servicename"],

2529

servicetype = "_mandos._tcp",

2530

protocol = protocol, bus = bus)

2531

if server_settings["interface"]:

2532

service.interface = (if_nametoindex

2533

(server_settings["interface"]

2534

.encode("utf-8")))

2531

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2532

service = AvahiServiceToSyslog(name =

2533

server_settings["servicename"],

2534

servicetype = "_mandos._tcp",

2535

protocol = protocol, bus = bus)

2536

if server_settings["interface"]:

2537

service.interface = (if_nametoindex

2538

(str(server_settings["interface"])))

2535

2539

2536

2540

global multiprocessing_manager

2537

2541

multiprocessing_manager = multiprocessing.Manager()

2561

2565

os.remove(stored_state_path)

2562

2566

except IOError as e:

2563

2567

if e.errno == errno.ENOENT:

2564

logger.warning("Could not load persistent state: {}"

2568

logger.warning("Could not load persistent state: {0}"

2565

2569

.format(os.strerror(e.errno)))

2566

2570

else:

2567

2571

logger.critical("Could not load persistent state:",

2572

2576

"EOFError:", exc_info=e)

2573

2577

2574

2578

with PGPEngine() as pgp:

2575

for client_name, client in clients_data.items():

2579

for client_name, client in clients_data.iteritems():

2576

2580

# Skip removed clients

2577

2581

if client_name not in client_settings:

2578

2582

continue

2603

2607

if datetime.datetime.utcnow() >= client["expires"]:

2604

2608

if not client["last_checked_ok"]:

2605

2609

logger.warning(

2606

"disabling client {} - Client never "

2610

"disabling client {0} - Client never "

2607

2611

"performed a successful checker"

2608

2612

.format(client_name))

2609

2613

client["enabled"] = False

2610

2614

elif client["last_checker_status"] != 0:

2611

2615

logger.warning(

2612

"disabling client {} - Client last"

2613

" checker failed with error code {}"

2616

"disabling client {0} - Client "

2617

"last checker failed with error code {1}"

2614

2618

.format(client_name,

2615

2619

client["last_checker_status"]))

2616

2620

client["enabled"] = False

2619

2623

.utcnow()

2620

2624

+ client["timeout"])

2621

2625

logger.debug("Last checker succeeded,"

2622

" keeping {} enabled"

2626

" keeping {0} enabled"

2623

2627

.format(client_name))

2624

2628

try:

2625

2629

client["secret"] = (

2628

2632

["secret"]))

2629

2633

except PGPError:

2630

2634

# If decryption fails, we use secret from new settings

2631

logger.debug("Failed to decrypt {} old secret"

2635

logger.debug("Failed to decrypt {0} old secret"

2632

2636

.format(client_name))

2633

2637

client["secret"] = (

2634

2638

client_settings[client_name]["secret"])

2642

2646

clients_data[client_name] = client_settings[client_name]

2643

2647

2644

2648

# Create all client objects

2645

for client_name, client in clients_data.items():

2649

for client_name, client in clients_data.iteritems():

2646

2650

tcp_server.clients[client_name] = client_class(

2647

2651

name = client_name, settings = client,

2648

2652

server_settings = server_settings)

2655

2659

try:

2656

2660

with pidfile:

2657

2661

pid = os.getpid()

2658

pidfile.write("{}\n".format(pid).encode("utf-8"))

2662

pidfile.write(str(pid) + "\n".encode("utf-8"))

2659

2663

except IOError:

2660

2664

logger.error("Could not write to file %r with PID %d",

2661

2665

pidfilename, pid)

2731

2735

2732

2736

def cleanup():

2733

2737

"Cleanup function; run on exit"

2734

if zeroconf:

2735

service.cleanup()

2738

service.cleanup()

2736

2739

2737

2740

multiprocessing.active_children()

2738

2741

wnull.close()

2752

2755

2753

2756

# A list of attributes that can not be pickled

2754

2757

# + secret.

2755

exclude = { "bus", "changedstate", "secret",

2756

"checker", "server_settings" }

2758

exclude = set(("bus", "changedstate", "secret",

2759

"checker", "server_settings"))

2757

2760

for name, typ in (inspect.getmembers

2758

2761

(dbus.service.Object)):

2759

2762

exclude.add(name)

2782

2785

except NameError:

2783

2786

pass

2784

2787

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2785

logger.warning("Could not save persistent state: {}"

2788

logger.warning("Could not save persistent state: {0}"

2786

2789

.format(os.strerror(e.errno)))

2787

2790

else:

2788

2791

logger.warning("Could not save persistent state:",

2789

2792

exc_info=e)

2790

raise

2793

raise e

2791

2794

2792

2795

# Delete all clients, and settings from config

2793

2796

while tcp_server.clients:

2817

2820

tcp_server.server_activate()

2818

2821

2819

2822

# Find out what port we got

2820

if zeroconf:

2821

service.port = tcp_server.socket.getsockname()[1]

2823

service.port = tcp_server.socket.getsockname()[1]

2822

2824

if use_ipv6:

2823

2825

logger.info("Now listening on address %r, port %d,"

2824

2826

" flowinfo %d, scope_id %d",

2830

2832

#service.interface = tcp_server.socket.getsockname()[3]

2831

2833

2832

2834

try:

2833

if zeroconf:

2834

# From the Avahi example code

2835

try:

2836

service.activate()

2837

except dbus.exceptions.DBusException as error:

2838

logger.critical("D-Bus Exception", exc_info=error)

2839

cleanup()

2840

sys.exit(1)

2841

# End of Avahi example code

2835

# From the Avahi example code

2836

try:

2837

service.activate()

2838

except dbus.exceptions.DBusException as error:

2839

logger.critical("D-Bus Exception", exc_info=error)

2840

cleanup()

2841

sys.exit(1)

2842

# End of Avahi example code

2842

2843

2844

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2844

2845

lambda *args, **kwargs: