/mandos/trunk : revision 749.1.2

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

import SocketServer as socketserver

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

38

43

import socket

39

44

import argparse

40

45

import datetime

45

50

import gnutls.library.functions

46

51

import gnutls.library.constants

47

52

import gnutls.library.types

48

import ConfigParser as configparser

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

49

57

import sys

50

58

import re

51

59

import os

60

68

import struct

61

69

import fcntl

62

70

import functools

63

import cPickle as pickle

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

64

75

import multiprocessing

76

import types

77

import binascii

78

import tempfile

79

import itertools

80

import collections

65

81

66

82

import dbus

67

83

import dbus.service

68

import gobject

84

try:

85

import gobject

86

except ImportError:

87

from gi.repository import GObject as gobject

69

88

import avahi

70

89

from dbus.mainloop.glib import DBusGMainLoop

71

90

import ctypes

81

100

except ImportError:

82

101

SO_BINDTODEVICE = None

83

102

84

85

version = "1.3.0"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

89

syslogger = (logging.handlers.SysLogHandler

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

address = str("/dev/log")))

92

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

95

logger.addHandler(syslogger)

96

97

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

101

logger.addHandler(console)

103

if sys.version_info.major == 2:

104

str = unicode

105

106

version = "1.6.9"

107

stored_state_file = "clients.pickle"

108

109

logger = logging.getLogger()

110

syslogger = None

111

112

try:

113

if_nametoindex = ctypes.cdll.LoadLibrary(

114

ctypes.util.find_library("c")).if_nametoindex

115

except (OSError, AttributeError):

116

117

def if_nametoindex(interface):

118

"Get an interface index the hard way, i.e. using fcntl()"

119

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

120

with contextlib.closing(socket.socket()) as s:

121

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

122

struct.pack(b"16s16x", interface))

123

interface_index = struct.unpack("I", ifreq[16:20])[0]

124

return interface_index

125

126

127

def initlogger(debug, level=logging.WARNING):

128

"""init logger and add loglevel"""

129

130

global syslogger

131

syslogger = (logging.handlers.SysLogHandler(

132

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

133

address = "/dev/log"))

134

syslogger.setFormatter(logging.Formatter

135

('Mandos [%(process)d]: %(levelname)s:'

136

' %(message)s'))

137

logger.addHandler(syslogger)

138

139

if debug:

140

console = logging.StreamHandler()

141

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

142

' [%(process)d]:'

143

' %(levelname)s:'

144

' %(message)s'))

145

logger.addHandler(console)

146

logger.setLevel(level)

147

148

149

class PGPError(Exception):

150

"""Exception if encryption/decryption fails"""

151

pass

152

153

154

class PGPEngine(object):

155

"""A simple class for OpenPGP symmetric encryption & decryption"""

156

157

def __init__(self):

158

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

159

self.gnupgargs = ['--batch',

160

'--home', self.tempdir,

161

'--force-mdc',

162

'--quiet',

163

'--no-use-agent']

164

165

def __enter__(self):

166

return self

167

168

def __exit__(self, exc_type, exc_value, traceback):

169

self._cleanup()

170

return False

171

172

def __del__(self):

173

self._cleanup()

174

175

def _cleanup(self):

176

if self.tempdir is not None:

177

# Delete contents of tempdir

178

for root, dirs, files in os.walk(self.tempdir,

179

topdown = False):

180

for filename in files:

181

os.remove(os.path.join(root, filename))

182

for dirname in dirs:

183

os.rmdir(os.path.join(root, dirname))

184

# Remove tempdir

185

os.rmdir(self.tempdir)

186

self.tempdir = None

187

188

def password_encode(self, password):

189

# Passphrase can not be empty and can not contain newlines or

190

# NUL bytes. So we prefix it and hex encode it.

191

encoded = b"mandos" + binascii.hexlify(password)

192

if len(encoded) > 2048:

193

# GnuPG can't handle long passwords, so encode differently

194

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

195

.replace(b"\n", b"\\n")

196

.replace(b"\0", b"\\x00"))

197

return encoded

198

199

def encrypt(self, data, password):

200

passphrase = self.password_encode(password)

201

with tempfile.NamedTemporaryFile(

202

dir=self.tempdir) as passfile:

203

passfile.write(passphrase)

204

passfile.flush()

205

proc = subprocess.Popen(['gpg', '--symmetric',

206

'--passphrase-file',

207

passfile.name]

208

+ self.gnupgargs,

209

stdin = subprocess.PIPE,

210

stdout = subprocess.PIPE,

211

stderr = subprocess.PIPE)

212

ciphertext, err = proc.communicate(input = data)

213

if proc.returncode != 0:

214

raise PGPError(err)

215

return ciphertext

216

217

def decrypt(self, data, password):

218

passphrase = self.password_encode(password)

219

with tempfile.NamedTemporaryFile(

220

dir = self.tempdir) as passfile:

221

passfile.write(passphrase)

222

passfile.flush()

223

proc = subprocess.Popen(['gpg', '--decrypt',

224

'--passphrase-file',

225

passfile.name]

226

+ self.gnupgargs,

227

stdin = subprocess.PIPE,

228

stdout = subprocess.PIPE,

229

stderr = subprocess.PIPE)

230

decrypted_plaintext, err = proc.communicate(input = data)

231

if proc.returncode != 0:

232

raise PGPError(err)

233

return decrypted_plaintext

234

102

235

103

236

class AvahiError(Exception):

104

237

def __init__(self, value, *args, **kwargs):

105

238

self.value = value

106

super(AvahiError, self).__init__(value, *args, **kwargs)

107

def __unicode__(self):

108

return unicode(repr(self.value))

239

return super(AvahiError, self).__init__(value, *args,

240

**kwargs)

241

109

242

110

243

class AvahiServiceError(AvahiError):

111

244

pass

112

245

246

113

247

class AvahiGroupError(AvahiError):

114

248

pass

115

249

122

256

Used to optionally bind to the specified interface.

123

257

name: string; Example: 'Mandos'

124

258

type: string; Example: '_mandos._tcp'.

125

See <http://www.dns-sd.org/ServiceTypes.html>

259

See <https://www.iana.org/assignments/service-names-port-numbers>

126

260

port: integer; what port to announce

127

261

TXT: list of strings; TXT record for the service

128

262

domain: string; Domain to publish on, default to .local if empty.

134

268

server: D-Bus Server

135

269

bus: dbus.SystemBus()

136

270

"""

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

138

servicetype = None, port = None, TXT = None,

139

domain = "", host = "", max_renames = 32768,

140

protocol = avahi.PROTO_UNSPEC, bus = None):

271

272

def __init__(self,

273

interface = avahi.IF_UNSPEC,

274

name = None,

275

servicetype = None,

276

port = None,

277

TXT = None,

278

domain = "",

279

host = "",

280

max_renames = 32768,

281

protocol = avahi.PROTO_UNSPEC,

282

bus = None):

141

283

self.interface = interface

142

284

self.name = name

143

285

self.type = servicetype

152

294

self.server = None

153

295

self.bus = bus

154

296

self.entry_group_state_changed_match = None

155

def rename(self):

297

298

def rename(self, remove=True):

156

299

"""Derived from the Avahi example code"""

157

300

if self.rename_count >= self.max_renames:

158

301

logger.critical("No suitable Zeroconf service name found"

159

302

" after %i retries, exiting.",

160

303

self.rename_count)

161

304

raise AvahiServiceError("Too many renames")

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

305

self.name = str(

306

self.server.GetAlternativeServiceName(self.name))

307

self.rename_count += 1

163

308

logger.info("Changing Zeroconf service name to %r ...",

164

309

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

169

self.remove()

310

if remove:

311

self.remove()

170

312

try:

171

313

self.add()

172

314

except dbus.exceptions.DBusException as error:

173

logger.critical("DBusException: %s", error)

174

self.cleanup()

175

os._exit(1)

176

self.rename_count += 1

315

if (error.get_dbus_name()

316

== "org.freedesktop.Avahi.CollisionError"):

317

logger.info("Local Zeroconf service name collision.")

318

return self.rename(remove=False)

319

else:

320

logger.critical("D-Bus Exception", exc_info=error)

321

self.cleanup()

322

os._exit(1)

323

177

324

def remove(self):

178

325

"""Derived from the Avahi example code"""

179

326

if self.entry_group_state_changed_match is not None:

181

328

self.entry_group_state_changed_match = None

182

329

if self.group is not None:

183

330

self.group.Reset()

331

184

332

def add(self):

185

333

"""Derived from the Avahi example code"""

186

334

self.remove()

191

339

avahi.DBUS_INTERFACE_ENTRY_GROUP)

192

340

self.entry_group_state_changed_match = (

193

341

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

342

'StateChanged', self.entry_group_state_changed))

195

343

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

196

344

self.name, self.type)

197

345

self.group.AddService(

203

351

dbus.UInt16(self.port),

204

352

avahi.string_array_to_txt_array(self.TXT))

205

353

self.group.Commit()

354

206

355

def entry_group_state_changed(self, state, error):

207

356

"""Derived from the Avahi example code"""

208

357

logger.debug("Avahi entry group state change: %i", state)

214

363

self.rename()

215

364

elif state == avahi.ENTRY_GROUP_FAILURE:

216

365

logger.critical("Avahi: Error in group state changed %s",

217

unicode(error))

218

raise AvahiGroupError("State changed: %s"

219

% unicode(error))

366

str(error))

367

raise AvahiGroupError("State changed: {!s}".format(error))

368

220

369

def cleanup(self):

221

370

"""Derived from the Avahi example code"""

222

371

if self.group is not None:

223

372

try:

224

373

self.group.Free()

225

374

except (dbus.exceptions.UnknownMethodException,

226

dbus.exceptions.DBusException) as e:

375

dbus.exceptions.DBusException):

227

376

pass

228

377

self.group = None

229

378

self.remove()

379

230

380

def server_state_changed(self, state, error=None):

231

381

"""Derived from the Avahi example code"""

232

382

logger.debug("Avahi server state change: %i", state)

233

bad_states = { avahi.SERVER_INVALID:

234

"Zeroconf server invalid",

235

avahi.SERVER_REGISTERING: None,

236

avahi.SERVER_COLLISION:

237

"Zeroconf server name collision",

238

avahi.SERVER_FAILURE:

239

"Zeroconf server failure" }

383

bad_states = {

384

avahi.SERVER_INVALID: "Zeroconf server invalid",

385

avahi.SERVER_REGISTERING: None,

386

avahi.SERVER_COLLISION: "Zeroconf server name collision",

387

avahi.SERVER_FAILURE: "Zeroconf server failure",

388

}

240

389

if state in bad_states:

241

390

if bad_states[state] is not None:

242

391

if error is None:

251

400

logger.debug("Unknown state: %r", state)

252

401

else:

253

402

logger.debug("Unknown state: %r: %r", state, error)

403

254

404

def activate(self):

255

405

"""Derived from the Avahi example code"""

256

406

if self.server is None:

260

410

follow_name_owner_changes=True),

261

411

avahi.DBUS_INTERFACE_SERVER)

262

412

self.server.connect_to_signal("StateChanged",

263

self.server_state_changed)

413

self.server_state_changed)

264

414

self.server_state_changed(self.server.GetState())

265

415

266

416

417

class AvahiServiceToSyslog(AvahiService):

418

def rename(self, *args, **kwargs):

419

"""Add the new name to the syslog messages"""

420

ret = AvahiService.rename(self, *args, **kwargs)

421

syslogger.setFormatter(logging.Formatter(

422

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

423

.format(self.name)))

424

return ret

425

426

def call_pipe(connection, # : multiprocessing.Connection

427

func, *args, **kwargs):

428

"""This function is meant to be called by multiprocessing.Process

429

430

This function runs func(*args, **kwargs), and writes the resulting

431

return value on the provided multiprocessing.Connection.

432

"""

433

connection.send(func(*args, **kwargs))

434

connection.close()

435

267

436

class Client(object):

268

437

"""A representation of a client host served by this server.

269

438

270

439

Attributes:

271

_approved: bool(); 'None' if not yet approved/disapproved

440

approved: bool(); 'None' if not yet approved/disapproved

272

441

approval_delay: datetime.timedelta(); Time to wait for approval

273

442

approval_duration: datetime.timedelta(); Duration of one approval

274

443

checker: subprocess.Popen(); a running checker process used

281

450

instance %(name)s can be used in the command.

282

451

checker_initiator_tag: a gobject event source tag, or None

283

452

created: datetime.datetime(); (UTC) object creation

453

client_structure: Object describing what attributes a client has

454

and is used for storing the client at exit

284

455

current_checker_command: string; current running checker_command

285

disable_hook: If set, called by disable() as disable_hook(self)

286

456

disable_initiator_tag: a gobject event source tag, or None

287

457

enabled: bool()

288

458

fingerprint: string (40 or 32 hexadecimal digits); used to

291

461

interval: datetime.timedelta(); How often to start a new checker

292

462

last_approval_request: datetime.datetime(); (UTC) or None

293

463

last_checked_ok: datetime.datetime(); (UTC) or None

294

last_enabled: datetime.datetime(); (UTC)

464

last_checker_status: integer between 0 and 255 reflecting exit

465

status of last checker. -1 reflects crashed

466

checker, -2 means no checker completed yet.

467

last_checker_signal: The signal which killed the last checker, if

468

last_checker_status is -1

469

last_enabled: datetime.datetime(); (UTC) or None

295

470

name: string; from the config file, used in log messages and

296

471

D-Bus identifiers

297

472

secret: bytestring; sent verbatim (over TLS) to client

298

473

timeout: datetime.timedelta(); How long from last_checked_ok

299

474

until this client is disabled

475

extended_timeout: extra long timeout when secret has been sent

300

476

runtime_expansions: Allowed attributes for runtime expansion.

477

expires: datetime.datetime(); time (UTC) when a client will be

478

disabled, or None

479

server_settings: The server_settings dict from main()

301

480

"""

302

481

303

482

runtime_expansions = ("approval_delay", "approval_duration",

304

"created", "enabled", "fingerprint",

305

"host", "interval", "last_checked_ok",

483

"created", "enabled", "expires",

484

"fingerprint", "host", "interval",

485

"last_approval_request", "last_checked_ok",

306

486

"last_enabled", "name", "timeout")

487

client_defaults = {

488

"timeout": "PT5M",

489

"extended_timeout": "PT15M",

490

"interval": "PT2M",

491

"checker": "fping -q -- %%(host)s",

492

"host": "",

493

"approval_delay": "PT0S",

494

"approval_duration": "PT1S",

495

"approved_by_default": "True",

496

"enabled": "True",

497

}

307

498

308

499

@staticmethod

309

def _timedelta_to_milliseconds(td):

310

"Convert a datetime.timedelta() to milliseconds"

311

return ((td.days * 24 * 60 * 60 * 1000)

312

+ (td.seconds * 1000)

313

+ (td.microseconds // 1000))

314

315

def timeout_milliseconds(self):

316

"Return the 'timeout' attribute in milliseconds"

317

return self._timedelta_to_milliseconds(self.timeout)

318

319

def interval_milliseconds(self):

320

"Return the 'interval' attribute in milliseconds"

321

return self._timedelta_to_milliseconds(self.interval)

322

323

def approval_delay_milliseconds(self):

324

return self._timedelta_to_milliseconds(self.approval_delay)

325

326

def __init__(self, name = None, disable_hook=None, config=None):

327

"""Note: the 'checker' key in 'config' sets the

328

'checker_command' attribute and *not* the 'checker'

329

attribute."""

500

def config_parser(config):

501

"""Construct a new dict of client settings of this form:

502

{ client_name: {setting_name: value, ...}, ...}

503

with exceptions for any special settings as defined above.

504

NOTE: Must be a pure function. Must return the same result

505

value given the same arguments.

506

"""

507

settings = {}

508

for client_name in config.sections():

509

section = dict(config.items(client_name))

510

client = settings[client_name] = {}

511

512

client["host"] = section["host"]

513

# Reformat values from string types to Python types

514

client["approved_by_default"] = config.getboolean(

515

client_name, "approved_by_default")

516

client["enabled"] = config.getboolean(client_name,

517

"enabled")

518

519

# Uppercase and remove spaces from fingerprint for later

520

# comparison purposes with return value from the

521

# fingerprint() function

522

client["fingerprint"] = (section["fingerprint"].upper()

523

.replace(" ", ""))

524

if "secret" in section:

525

client["secret"] = section["secret"].decode("base64")

526

elif "secfile" in section:

527

with open(os.path.expanduser(os.path.expandvars

528

(section["secfile"])),

529

"rb") as secfile:

530

client["secret"] = secfile.read()

531

else:

532

raise TypeError("No secret or secfile for section {}"

533

.format(section))

534

client["timeout"] = string_to_delta(section["timeout"])

535

client["extended_timeout"] = string_to_delta(

536

section["extended_timeout"])

537

client["interval"] = string_to_delta(section["interval"])

538

client["approval_delay"] = string_to_delta(

539

section["approval_delay"])

540

client["approval_duration"] = string_to_delta(

541

section["approval_duration"])

542

client["checker_command"] = section["checker"]

543

client["last_approval_request"] = None

544

client["last_checked_ok"] = None

545

client["last_checker_status"] = -2

546

547

return settings

548

549

def __init__(self, settings, name = None, server_settings=None):

330

550

self.name = name

331

if config is None:

332

config = {}

551

if server_settings is None:

552

server_settings = {}

553

self.server_settings = server_settings

554

# adding all client settings

555

for setting, value in settings.items():

556

setattr(self, setting, value)

557

558

if self.enabled:

559

if not hasattr(self, "last_enabled"):

560

self.last_enabled = datetime.datetime.utcnow()

561

if not hasattr(self, "expires"):

562

self.expires = (datetime.datetime.utcnow()

563

+ self.timeout)

564

else:

565

self.last_enabled = None

566

self.expires = None

567

333

568

logger.debug("Creating client %r", self.name)

334

# Uppercase and remove spaces from fingerprint for later

335

# comparison purposes with return value from the fingerprint()

336

# function

337

self.fingerprint = (config["fingerprint"].upper()

338

.replace(" ", ""))

339

569

logger.debug(" Fingerprint: %s", self.fingerprint)

340

if "secret" in config:

341

self.secret = config["secret"].decode("base64")

342

elif "secfile" in config:

343

with open(os.path.expanduser(os.path.expandvars

344

(config["secfile"])),

345

"rb") as secfile:

346

self.secret = secfile.read()

347

else:

348

raise TypeError("No secret or secfile for client %s"

349

% self.name)

350

self.host = config.get("host", "")

351

self.created = datetime.datetime.utcnow()

352

self.enabled = False

353

self.last_approval_request = None

354

self.last_enabled = None

355

self.last_checked_ok = None

356

self.timeout = string_to_delta(config["timeout"])

357

self.interval = string_to_delta(config["interval"])

358

self.disable_hook = disable_hook

570

self.created = settings.get("created",

571

datetime.datetime.utcnow())

572

573

# attributes specific for this server instance

359

574

self.checker = None

360

575

self.checker_initiator_tag = None

361

576

self.disable_initiator_tag = None

362

577

self.checker_callback_tag = None

363

self.checker_command = config["checker"]

364

578

self.current_checker_command = None

365

self.last_connect = None

366

self._approved = None

367

self.approved_by_default = config.get("approved_by_default",

368

True)

579

self.approved = None

369

580

self.approvals_pending = 0

370

self.approval_delay = string_to_delta(

371

config["approval_delay"])

372

self.approval_duration = string_to_delta(

373

config["approval_duration"])

374

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

581

self.changedstate = multiprocessing_manager.Condition(

582

multiprocessing_manager.Lock())

583

self.client_structure = [attr

584

for attr in self.__dict__.iterkeys()

585

if not attr.startswith("_")]

586

self.client_structure.append("client_structure")

587

588

for name, t in inspect.getmembers(

589

type(self), lambda obj: isinstance(obj, property)):

590

if not name.startswith("_"):

591

self.client_structure.append(name)

375

592

593

# Send notice to process children that client state has changed

376

594

def send_changedstate(self):

377

self.changedstate.acquire()

378

self.changedstate.notify_all()

379

self.changedstate.release()

380

595

with self.changedstate:

596

self.changedstate.notify_all()

597

381

598

def enable(self):

382

599

"""Start this client's checker and timeout hooks"""

383

600

if getattr(self, "enabled", False):

384

601

# Already enabled

385

602

return

386

self.send_changedstate()

603

self.expires = datetime.datetime.utcnow() + self.timeout

604

self.enabled = True

387

605

self.last_enabled = datetime.datetime.utcnow()

388

# Schedule a new checker to be started an 'interval' from now,

389

# and every interval from then on.

390

self.checker_initiator_tag = (gobject.timeout_add

391

(self.interval_milliseconds(),

392

self.start_checker))

393

# Schedule a disable() when 'timeout' has passed

394

self.disable_initiator_tag = (gobject.timeout_add

395

(self.timeout_milliseconds(),

396

self.disable))

397

self.enabled = True

398

# Also start a new checker *right now*.

399

self.start_checker()

606

self.init_checker()

607

self.send_changedstate()

400

608

401

609

def disable(self, quiet=True):

402

610

"""Disable this client."""

403

611

if not getattr(self, "enabled", False):

404

612

return False

405

613

if not quiet:

406

self.send_changedstate()

407

if not quiet:

408

614

logger.info("Disabling client %s", self.name)

409

if getattr(self, "disable_initiator_tag", False):

615

if getattr(self, "disable_initiator_tag", None) is not None:

410

616

gobject.source_remove(self.disable_initiator_tag)

411

617

self.disable_initiator_tag = None

412

if getattr(self, "checker_initiator_tag", False):

618

self.expires = None

619

if getattr(self, "checker_initiator_tag", None) is not None:

413

620

gobject.source_remove(self.checker_initiator_tag)

414

621

self.checker_initiator_tag = None

415

622

self.stop_checker()

416

if self.disable_hook:

417

self.disable_hook(self)

418

623

self.enabled = False

624

if not quiet:

625

self.send_changedstate()

419

626

# Do not run this again if called by a gobject.timeout_add

420

627

return False

421

628

422

629

def __del__(self):

423

self.disable_hook = None

424

630

self.disable()

425

631

426

def checker_callback(self, pid, condition, command):

632

def init_checker(self):

633

# Schedule a new checker to be started an 'interval' from now,

634

# and every interval from then on.

635

if self.checker_initiator_tag is not None:

636

gobject.source_remove(self.checker_initiator_tag)

637

self.checker_initiator_tag = gobject.timeout_add(

638

int(self.interval.total_seconds() * 1000),

639

self.start_checker)

640

# Schedule a disable() when 'timeout' has passed

641

if self.disable_initiator_tag is not None:

642

gobject.source_remove(self.disable_initiator_tag)

643

self.disable_initiator_tag = gobject.timeout_add(

644

int(self.timeout.total_seconds() * 1000), self.disable)

645

# Also start a new checker *right now*.

646

self.start_checker()

647

648

def checker_callback(self, source, condition,

649

(connection, command)):

427

650

"""The checker has completed, so take appropriate actions."""

428

651

self.checker_callback_tag = None

429

652

self.checker = None

430

if os.WIFEXITED(condition):

431

exitstatus = os.WEXITSTATUS(condition)

432

if exitstatus == 0:

653

# Read return code from connection (see call_pipe)

654

returncode = connection.recv()

655

connection.close()

656

657

if returncode >= 0:

658

self.last_checker_status = returncode

659

self.last_checker_signal = None

660

if self.last_checker_status == 0:

433

661

logger.info("Checker for %(name)s succeeded",

434

662

vars(self))

435

663

self.checked_ok()

436

664

else:

437

logger.info("Checker for %(name)s failed",

438

vars(self))

665

logger.info("Checker for %(name)s failed", vars(self))

439

666

else:

667

self.last_checker_status = -1

668

self.last_checker_signal = -returncode

440

669

logger.warning("Checker for %(name)s crashed?",

441

670

vars(self))

671

return False

442

672

443

673

def checked_ok(self):

444

"""Bump up the timeout for this client.

445

446

This should only be called when the client has been seen,

447

alive and well.

448

"""

674

"""Assert that the client has been seen, alive and well."""

449

675

self.last_checked_ok = datetime.datetime.utcnow()

450

gobject.source_remove(self.disable_initiator_tag)

451

self.disable_initiator_tag = (gobject.timeout_add

452

(self.timeout_milliseconds(),

453

self.disable))

676

self.last_checker_status = 0

677

self.last_checker_signal = None

678

self.bump_timeout()

679

680

def bump_timeout(self, timeout=None):

681

"""Bump up the timeout for this client."""

682

if timeout is None:

683

timeout = self.timeout

684

if self.disable_initiator_tag is not None:

685

gobject.source_remove(self.disable_initiator_tag)

686

self.disable_initiator_tag = None

687

if getattr(self, "enabled", False):

688

self.disable_initiator_tag = gobject.timeout_add(

689

int(timeout.total_seconds() * 1000), self.disable)

690

self.expires = datetime.datetime.utcnow() + timeout

454

691

455

692

def need_approval(self):

456

693

self.last_approval_request = datetime.datetime.utcnow()

461

698

If a checker already exists, leave it running and do

462

699

nothing."""

463

700

# The reason for not killing a running checker is that if we

464

# did that, then if a checker (for some reason) started

465

# running slowly and taking more than 'interval' time, the

466

# client would inevitably timeout, since no checker would get

467

# a chance to run to completion. If we instead leave running

701

# did that, and if a checker (for some reason) started running

702

# slowly and taking more than 'interval' time, then the client

703

# would inevitably timeout, since no checker would get a

704

# chance to run to completion. If we instead leave running

468

705

# checkers alone, the checker would have to take more time

469

706

# than 'timeout' for the client to be disabled, which is as it

470

707

# should be.

471

708

472

# If a checker exists, make sure it is not a zombie

473

try:

474

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

475

except (AttributeError, OSError) as error:

476

if (isinstance(error, OSError)

477

and error.errno != errno.ECHILD):

478

raise error

479

else:

480

if pid:

481

logger.warning("Checker was a zombie")

482

gobject.source_remove(self.checker_callback_tag)

483

self.checker_callback(pid, status,

484

self.current_checker_command)

709

if self.checker is not None and not self.checker.is_alive():

710

logger.warning("Checker was not alive; joining")

711

self.checker.join()

712

self.checker = None

485

713

# Start a new checker if needed

486

714

if self.checker is None:

715

# Escape attributes for the shell

716

escaped_attrs = {

717

attr: re.escape(str(getattr(self, attr)))

718

for attr in self.runtime_expansions }

487

719

try:

488

# In case checker_command has exactly one % operator

489

command = self.checker_command % self.host

490

except TypeError:

491

# Escape attributes for the shell

492

escaped_attrs = dict(

493

(attr,

494

re.escape(unicode(str(getattr(self, attr, "")),

495

errors=

496

'replace')))

497

for attr in

498

self.runtime_expansions)

499

500

try:

501

command = self.checker_command % escaped_attrs

502

except TypeError as error:

503

logger.error('Could not format string "%s":'

504

' %s', self.checker_command, error)

505

return True # Try again later

720

command = self.checker_command % escaped_attrs

721

except TypeError as error:

722

logger.error('Could not format string "%s"',

723

self.checker_command,

724

exc_info=error)

725

return True # Try again later

506

726

self.current_checker_command = command

507

try:

508

logger.info("Starting checker %r for %s",

509

command, self.name)

510

# We don't need to redirect stdout and stderr, since

511

# in normal mode, that is already done by daemon(),

512

# and in debug mode we don't want to. (Stdin is

513

# always replaced by /dev/null.)

514

self.checker = subprocess.Popen(command,

515

close_fds=True,

516

shell=True, cwd="/")

517

self.checker_callback_tag = (gobject.child_watch_add

518

(self.checker.pid,

519

self.checker_callback,

520

data=command))

521

# The checker may have completed before the gobject

522

# watch was added. Check for this.

523

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

524

if pid:

525

gobject.source_remove(self.checker_callback_tag)

526

self.checker_callback(pid, status, command)

527

except OSError as error:

528

logger.error("Failed to start subprocess: %s",

529

error)

727

logger.info("Starting checker %r for %s", command,

728

self.name)

729

# We don't need to redirect stdout and stderr, since

730

# in normal mode, that is already done by daemon(),

731

# and in debug mode we don't want to. (Stdin is

732

# always replaced by /dev/null.)

733

# The exception is when not debugging but nevertheless

734

# running in the foreground; use the previously

735

# created wnull.

736

popen_args = { "close_fds": True,

737

"shell": True,

738

"cwd": "/" }

739

if (not self.server_settings["debug"]

740

and self.server_settings["foreground"]):

741

popen_args.update({"stdout": wnull,

742

"stderr": wnull })

743

pipe = multiprocessing.Pipe(duplex=False)

744

self.checker = multiprocessing.Process(

745

target = call_pipe,

746

args = (subprocess.call, pipe[1], command),

747

kwargs = popen_args)

748

self.checker.start()

749

self.checker_callback_tag = gobject.io_add_watch(

750

pipe[0].fileno(), gobject.IO_IN,

751

self.checker_callback, (pipe[0], command))

530

752

# Re-run this periodically if run by gobject.timeout_add

531

753

return True

532

754

538

760

if getattr(self, "checker", None) is None:

539

761

return

540

762

logger.debug("Stopping checker for %(name)s", vars(self))

541

try:

542

os.kill(self.checker.pid, signal.SIGTERM)

543

#time.sleep(0.5)

544

#if self.checker.poll() is None:

545

# os.kill(self.checker.pid, signal.SIGKILL)

546

except OSError as error:

547

if error.errno != errno.ESRCH: # No such process

548

raise

763

self.checker.terminate()

549

764

self.checker = None

550

765

551

def dbus_service_property(dbus_interface, signature="v",

552

access="readwrite", byte_arrays=False):

766

767

def dbus_service_property(dbus_interface,

768

signature="v",

769

access="readwrite",

770

byte_arrays=False):

553

771

"""Decorators for marking methods of a DBusObjectWithProperties to

554

772

become properties on the D-Bus.

555

773

564

782

# "Set" method, so we fail early here:

565

783

if byte_arrays and signature != "ay":

566

784

raise ValueError("Byte arrays not supported for non-'ay'"

567

" signature %r" % signature)

785

" signature {!r}".format(signature))

786

568

787

def decorator(func):

569

788

func._dbus_is_property = True

570

789

func._dbus_interface = dbus_interface

575

794

func._dbus_name = func._dbus_name[:-14]

576

795

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

577

796

return func

797

798

return decorator

799

800

801

def dbus_interface_annotations(dbus_interface):

802

"""Decorator for marking functions returning interface annotations

803

804

Usage:

805

806

@dbus_interface_annotations("org.example.Interface")

807

def _foo(self): # Function name does not matter

808

return {"org.freedesktop.DBus.Deprecated": "true",

809

"org.freedesktop.DBus.Property.EmitsChangedSignal":

810

"false"}

811

"""

812

813

def decorator(func):

814

func._dbus_is_interface = True

815

func._dbus_interface = dbus_interface

816

func._dbus_name = dbus_interface

817

return func

818

819

return decorator

820

821

822

def dbus_annotations(annotations):

823

"""Decorator to annotate D-Bus methods, signals or properties

824

Usage:

825

826

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

827

"org.freedesktop.DBus.Property."

828

"EmitsChangedSignal": "false"})

829

@dbus_service_property("org.example.Interface", signature="b",

830

access="r")

831

def Property_dbus_property(self):

832

return dbus.Boolean(False)

833

"""

834

835

def decorator(func):

836

func._dbus_annotations = annotations

837

return func

838

578

839

return decorator

579

840

580

841

581

842

class DBusPropertyException(dbus.exceptions.DBusException):

582

843

"""A base class for D-Bus property-related exceptions

583

844

"""

584

def __unicode__(self):

585

return unicode(str(self))

845

pass

586

846

587

847

588

848

class DBusPropertyAccessException(DBusPropertyException):

599

859

600

860

class DBusObjectWithProperties(dbus.service.Object):

601

861

"""A D-Bus object with properties.

602

862

603

863

Classes inheriting from this can use the dbus_service_property

604

864

decorator to expose methods as D-Bus properties. It exposes the

605

865

standard Get(), Set(), and GetAll() methods on the D-Bus.

606

866

"""

607

867

608

868

@staticmethod

609

def _is_dbus_property(obj):

610

return getattr(obj, "_dbus_is_property", False)

869

def _is_dbus_thing(thing):

870

"""Returns a function testing if an attribute is a D-Bus thing

871

872

If called like _is_dbus_thing("method") it returns a function

873

suitable for use as predicate to inspect.getmembers().

874

"""

875

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

876

False)

611

877

612

def _get_all_dbus_properties(self):

878

def _get_all_dbus_things(self, thing):

613

879

"""Returns a generator of (name, attribute) pairs

614

880

"""

615

return ((prop._dbus_name, prop)

616

for name, prop in

617

inspect.getmembers(self, self._is_dbus_property))

881

return ((getattr(athing.__get__(self), "_dbus_name", name),

882

athing.__get__(self))

883

for cls in self.__class__.__mro__

884

for name, athing in

885

inspect.getmembers(cls, self._is_dbus_thing(thing)))

618

886

619

887

def _get_dbus_property(self, interface_name, property_name):

620

888

"""Returns a bound method if one exists which is a D-Bus

621

889

property with the specified name and interface.

622

890

"""

623

for name in (property_name,

624

property_name + "_dbus_property"):

625

prop = getattr(self, name, None)

626

if (prop is None

627

or not self._is_dbus_property(prop)

628

or prop._dbus_name != property_name

629

or (interface_name and prop._dbus_interface

630

and interface_name != prop._dbus_interface)):

631

continue

632

return prop

891

for cls in self.__class__.__mro__:

892

for name, value in inspect.getmembers(

893

cls, self._is_dbus_thing("property")):

894

if (value._dbus_name == property_name

895

and value._dbus_interface == interface_name):

896

return value.__get__(self)

897

633

898

# No such property

634

raise DBusPropertyNotFound(self.dbus_object_path + ":"

635

+ interface_name + "."

636

+ property_name)

899

raise DBusPropertyNotFound("{}:{}.{}".format(

900

self.dbus_object_path, interface_name, property_name))

637

901

638

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

902

@dbus.service.method(dbus.PROPERTIES_IFACE,

903

in_signature="ss",

639

904

out_signature="v")

640

905

def Get(self, interface_name, property_name):

641

906

"""Standard D-Bus property Get() method, see D-Bus standard.

659

924

# The byte_arrays option is not supported yet on

660

925

# signatures other than "ay".

661

926

if prop._dbus_signature != "ay":

662

raise ValueError

663

value = dbus.ByteArray(''.join(unichr(byte)

664

for byte in value))

927

raise ValueError("Byte arrays not supported for non-"

928

"'ay' signature {!r}"

929

.format(prop._dbus_signature))

930

value = dbus.ByteArray(b''.join(chr(byte)

931

for byte in value))

665

932

prop(value)

666

933

667

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

934

@dbus.service.method(dbus.PROPERTIES_IFACE,

935

in_signature="s",

668

936

out_signature="a{sv}")

669

937

def GetAll(self, interface_name):

670

938

"""Standard D-Bus property GetAll() method, see D-Bus

671

939

standard.

672

940

673

941

Note: Will not include properties with access="write".

674

942

"""

675

all = {}

676

for name, prop in self._get_all_dbus_properties():

943

properties = {}

944

for name, prop in self._get_all_dbus_things("property"):

677

945

if (interface_name

678

946

and interface_name != prop._dbus_interface):

679

947

# Interface non-empty but did not match

683

951

continue

684

952

value = prop()

685

953

if not hasattr(value, "variant_level"):

686

all[name] = value

954

properties[name] = value

687

955

continue

688

all[name] = type(value)(value, variant_level=

689

value.variant_level+1)

690

return dbus.Dictionary(all, signature="sv")

956

properties[name] = type(value)(

957

value, variant_level = value.variant_level + 1)

958

return dbus.Dictionary(properties, signature="sv")

959

960

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

961

def PropertiesChanged(self, interface_name, changed_properties,

962

invalidated_properties):

963

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

964

standard.

965

"""

966

pass

691

967

692

968

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

693

969

out_signature="s",

694

970

path_keyword='object_path',

695

971

connection_keyword='connection')

696

972

def Introspect(self, object_path, connection):

697

"""Standard D-Bus method, overloaded to insert property tags.

973

"""Overloading of standard D-Bus method.

974

975

Inserts property tags and interface annotation tags.

698

976

"""

699

977

xmlstring = dbus.service.Object.Introspect(self, object_path,

700

978

connection)

701

979

try:

702

980

document = xml.dom.minidom.parseString(xmlstring)

981

703

982

def make_tag(document, name, prop):

704

983

e = document.createElement("property")

705

984

e.setAttribute("name", name)

706

985

e.setAttribute("type", prop._dbus_signature)

707

986

e.setAttribute("access", prop._dbus_access)

708

987

return e

988

709

989

for if_tag in document.getElementsByTagName("interface"):

990

# Add property tags

710

991

for tag in (make_tag(document, name, prop)

711

992

for name, prop

712

in self._get_all_dbus_properties()

993

in self._get_all_dbus_things("property")

713

994

if prop._dbus_interface

714

995

== if_tag.getAttribute("name")):

715

996

if_tag.appendChild(tag)

997

# Add annotation tags

998

for typ in ("method", "signal", "property"):

999

for tag in if_tag.getElementsByTagName(typ):

1000

annots = dict()

1001

for name, prop in (self.

1002

_get_all_dbus_things(typ)):

1003

if (name == tag.getAttribute("name")

1004

and prop._dbus_interface

1005

== if_tag.getAttribute("name")):

1006

annots.update(getattr(

1007

prop, "_dbus_annotations", {}))

1008

for name, value in annots.items():

1009

ann_tag = document.createElement(

1010

"annotation")

1011

ann_tag.setAttribute("name", name)

1012

ann_tag.setAttribute("value", value)

1013

tag.appendChild(ann_tag)

1014

# Add interface annotation tags

1015

for annotation, value in dict(

1016

itertools.chain.from_iterable(

1017

annotations().items()

1018

for name, annotations

1019

in self._get_all_dbus_things("interface")

1020

if name == if_tag.getAttribute("name")

1021

)).items():

1022

ann_tag = document.createElement("annotation")

1023

ann_tag.setAttribute("name", annotation)

1024

ann_tag.setAttribute("value", value)

1025

if_tag.appendChild(ann_tag)

716

1026

# Add the names to the return values for the

717

1027

# "org.freedesktop.DBus.Properties" methods

718

1028

if (if_tag.getAttribute("name")

733

1043

except (AttributeError, xml.dom.DOMException,

734

1044

xml.parsers.expat.ExpatError) as error:

735

1045

logger.error("Failed to override Introspection method",

736

error)

1046

exc_info=error)

737

1047

return xmlstring

738

1048

739

1049

1050

def datetime_to_dbus(dt, variant_level=0):

1051

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1052

if dt is None:

1053

return dbus.String("", variant_level = variant_level)

1054

return dbus.String(dt.isoformat(), variant_level=variant_level)

1055

1056

1057

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1058

"""A class decorator; applied to a subclass of

1059

dbus.service.Object, it will add alternate D-Bus attributes with

1060

interface names according to the "alt_interface_names" mapping.

1061

Usage:

1062

1063

@alternate_dbus_interfaces({"org.example.Interface":

1064

"net.example.AlternateInterface"})

1065

class SampleDBusObject(dbus.service.Object):

1066

@dbus.service.method("org.example.Interface")

1067

def SampleDBusMethod():

1068

pass

1069

1070

The above "SampleDBusMethod" on "SampleDBusObject" will be

1071

reachable via two interfaces: "org.example.Interface" and

1072

"net.example.AlternateInterface", the latter of which will have

1073

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1074

"true", unless "deprecate" is passed with a False value.

1075

1076

This works for methods and signals, and also for D-Bus properties

1077

(from DBusObjectWithProperties) and interfaces (from the

1078

dbus_interface_annotations decorator).

1079

"""

1080

1081

def wrapper(cls):

1082

for orig_interface_name, alt_interface_name in (

1083

alt_interface_names.items()):

1084

attr = {}

1085

interface_names = set()

1086

# Go though all attributes of the class

1087

for attrname, attribute in inspect.getmembers(cls):

1088

# Ignore non-D-Bus attributes, and D-Bus attributes

1089

# with the wrong interface name

1090

if (not hasattr(attribute, "_dbus_interface")

1091

or not attribute._dbus_interface.startswith(

1092

orig_interface_name)):

1093

continue

1094

# Create an alternate D-Bus interface name based on

1095

# the current name

1096

alt_interface = attribute._dbus_interface.replace(

1097

orig_interface_name, alt_interface_name)

1098

interface_names.add(alt_interface)

1099

# Is this a D-Bus signal?

1100

if getattr(attribute, "_dbus_is_signal", False):

1101

# Extract the original non-method undecorated

1102

# function by black magic

1103

nonmethod_func = (dict(

1104

zip(attribute.func_code.co_freevars,

1105

attribute.__closure__))

1106

["func"].cell_contents)

1107

# Create a new, but exactly alike, function

1108

# object, and decorate it to be a new D-Bus signal

1109

# with the alternate D-Bus interface name

1110

new_function = (dbus.service.signal(

1111

alt_interface, attribute._dbus_signature)

1112

(types.FunctionType(

1113

nonmethod_func.func_code,

1114

nonmethod_func.func_globals,

1115

nonmethod_func.func_name,

1116

nonmethod_func.func_defaults,

1117

nonmethod_func.func_closure)))

1118

# Copy annotations, if any

1119

try:

1120

new_function._dbus_annotations = dict(

1121

attribute._dbus_annotations)

1122

except AttributeError:

1123

pass

1124

# Define a creator of a function to call both the

1125

# original and alternate functions, so both the

1126

# original and alternate signals gets sent when

1127

# the function is called

1128

def fixscope(func1, func2):

1129

"""This function is a scope container to pass

1130

func1 and func2 to the "call_both" function

1131

outside of its arguments"""

1132

1133

def call_both(*args, **kwargs):

1134

"""This function will emit two D-Bus

1135

signals by calling func1 and func2"""

1136

func1(*args, **kwargs)

1137

func2(*args, **kwargs)

1138

1139

return call_both

1140

# Create the "call_both" function and add it to

1141

# the class

1142

attr[attrname] = fixscope(attribute, new_function)

1143

# Is this a D-Bus method?

1144

elif getattr(attribute, "_dbus_is_method", False):

1145

# Create a new, but exactly alike, function

1146

# object. Decorate it to be a new D-Bus method

1147

# with the alternate D-Bus interface name. Add it

1148

# to the class.

1149

attr[attrname] = (

1150

dbus.service.method(

1151

alt_interface,

1152

attribute._dbus_in_signature,

1153

attribute._dbus_out_signature)

1154

(types.FunctionType(attribute.func_code,

1155

attribute.func_globals,

1156

attribute.func_name,

1157

attribute.func_defaults,

1158

attribute.func_closure)))

1159

# Copy annotations, if any

1160

try:

1161

attr[attrname]._dbus_annotations = dict(

1162

attribute._dbus_annotations)

1163

except AttributeError:

1164

pass

1165

# Is this a D-Bus property?

1166

elif getattr(attribute, "_dbus_is_property", False):

1167

# Create a new, but exactly alike, function

1168

# object, and decorate it to be a new D-Bus

1169

# property with the alternate D-Bus interface

1170

# name. Add it to the class.

1171

attr[attrname] = (dbus_service_property(

1172

alt_interface, attribute._dbus_signature,

1173

attribute._dbus_access,

1174

attribute._dbus_get_args_options

1175

["byte_arrays"])

1176

(types.FunctionType(

1177

attribute.func_code,

1178

attribute.func_globals,

1179

attribute.func_name,

1180

attribute.func_defaults,

1181

attribute.func_closure)))

1182

# Copy annotations, if any

1183

try:

1184

attr[attrname]._dbus_annotations = dict(

1185

attribute._dbus_annotations)

1186

except AttributeError:

1187

pass

1188

# Is this a D-Bus interface?

1189

elif getattr(attribute, "_dbus_is_interface", False):

1190

# Create a new, but exactly alike, function

1191

# object. Decorate it to be a new D-Bus interface

1192

# with the alternate D-Bus interface name. Add it

1193

# to the class.

1194

attr[attrname] = (

1195

dbus_interface_annotations(alt_interface)

1196

(types.FunctionType(attribute.func_code,

1197

attribute.func_globals,

1198

attribute.func_name,

1199

attribute.func_defaults,

1200

attribute.func_closure)))

1201

if deprecate:

1202

# Deprecate all alternate interfaces

1203

iname="_AlternateDBusNames_interface_annotation{}"

1204

for interface_name in interface_names:

1205

1206

@dbus_interface_annotations(interface_name)

1207

def func(self):

1208

return { "org.freedesktop.DBus.Deprecated":

1209

"true" }

1210

# Find an unused name

1211

for aname in (iname.format(i)

1212

for i in itertools.count()):

1213

if aname not in attr:

1214

attr[aname] = func

1215

break

1216

if interface_names:

1217

# Replace the class with a new subclass of it with

1218

# methods, signals, etc. as created above.

1219

cls = type(b"{}Alternate".format(cls.__name__),

1220

(cls, ), attr)

1221

return cls

1222

1223

return wrapper

1224

1225

1226

@alternate_dbus_interfaces({"se.recompile.Mandos":

1227

"se.bsnet.fukt.Mandos"})

740

1228

class ClientDBus(Client, DBusObjectWithProperties):

741

1229

"""A Client class using D-Bus

742

1230

746

1234

"""

747

1235

748

1236

runtime_expansions = (Client.runtime_expansions

749

+ ("dbus_object_path",))

1237

+ ("dbus_object_path", ))

1238

1239

_interface = "se.recompile.Mandos.Client"

750

1240

751

1241

# dbus.service.Object doesn't use super(), so we can't either.

752

1242

753

1243

def __init__(self, bus = None, *args, **kwargs):

754

self._approvals_pending = 0

755

1244

self.bus = bus

756

1245

Client.__init__(self, *args, **kwargs)

757

1246

# Only now, when this client is initialized, can it show up on

758

1247

# the D-Bus

759

client_object_name = unicode(self.name).translate(

1248

client_object_name = str(self.name).translate(

760

1249

{ord("."): ord("_"),

761

1250

ord("-"): ord("_")})

762

self.dbus_object_path = (dbus.ObjectPath

763

("/clients/" + client_object_name))

1251

self.dbus_object_path = dbus.ObjectPath(

1252

"/clients/" + client_object_name)

764

1253

DBusObjectWithProperties.__init__(self, self.bus,

765

1254

self.dbus_object_path)

766

767

def _get_approvals_pending(self):

768

return self._approvals_pending

769

def _set_approvals_pending(self, value):

770

old_value = self._approvals_pending

771

self._approvals_pending = value

772

bval = bool(value)

773

if (hasattr(self, "dbus_object_path")

774

and bval is not bool(old_value)):

775

dbus_bool = dbus.Boolean(bval, variant_level=1)

776

self.PropertyChanged(dbus.String("ApprovalPending"),

777

dbus_bool)

778

779

approvals_pending = property(_get_approvals_pending,

780

_set_approvals_pending)

781

del _get_approvals_pending, _set_approvals_pending

782

783

@staticmethod

784

def _datetime_to_dbus(dt, variant_level=0):

785

"""Convert a UTC datetime.datetime() to a D-Bus type."""

786

return dbus.String(dt.isoformat(),

787

variant_level=variant_level)

788

789

def enable(self):

790

oldstate = getattr(self, "enabled", False)

791

r = Client.enable(self)

792

if oldstate != self.enabled:

793

# Emit D-Bus signals

794

self.PropertyChanged(dbus.String("Enabled"),

795

dbus.Boolean(True, variant_level=1))

796

self.PropertyChanged(

797

dbus.String("LastEnabled"),

798

self._datetime_to_dbus(self.last_enabled,

799

variant_level=1))

800

return r

801

802

def disable(self, quiet = False):

803

oldstate = getattr(self, "enabled", False)

804

r = Client.disable(self, quiet=quiet)

805

if not quiet and oldstate != self.enabled:

806

# Emit D-Bus signal

807

self.PropertyChanged(dbus.String("Enabled"),

808

dbus.Boolean(False, variant_level=1))

809

return r

1255

1256

def notifychangeproperty(transform_func, dbus_name,

1257

type_func=lambda x: x,

1258

variant_level=1,

1259

invalidate_only=False,

1260

_interface=_interface):

1261

""" Modify a variable so that it's a property which announces

1262

its changes to DBus.

1263

1264

transform_fun: Function that takes a value and a variant_level

1265

and transforms it to a D-Bus type.

1266

dbus_name: D-Bus name of the variable

1267

type_func: Function that transform the value before sending it

1268

to the D-Bus. Default: no transform

1269

variant_level: D-Bus variant level. Default: 1

1270

"""

1271

attrname = "_{}".format(dbus_name)

1272

1273

def setter(self, value):

1274

if hasattr(self, "dbus_object_path"):

1275

if (not hasattr(self, attrname) or

1276

type_func(getattr(self, attrname, None))

1277

!= type_func(value)):

1278

if invalidate_only:

1279

self.PropertiesChanged(

1280

_interface, dbus.Dictionary(),

1281

dbus.Array((dbus_name, )))

1282

else:

1283

dbus_value = transform_func(

1284

type_func(value),

1285

variant_level = variant_level)

1286

self.PropertyChanged(dbus.String(dbus_name),

1287

dbus_value)

1288

self.PropertiesChanged(

1289

_interface,

1290

dbus.Dictionary({ dbus.String(dbus_name):

1291

dbus_value }),

1292

dbus.Array())

1293

setattr(self, attrname, value)

1294

1295

return property(lambda self: getattr(self, attrname), setter)

1296

1297

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1298

approvals_pending = notifychangeproperty(dbus.Boolean,

1299

"ApprovalPending",

1300

type_func = bool)

1301

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1302

last_enabled = notifychangeproperty(datetime_to_dbus,

1303

"LastEnabled")

1304

checker = notifychangeproperty(

1305

dbus.Boolean, "CheckerRunning",

1306

type_func = lambda checker: checker is not None)

1307

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1308

"LastCheckedOK")

1309

last_checker_status = notifychangeproperty(dbus.Int16,

1310

"LastCheckerStatus")

1311

last_approval_request = notifychangeproperty(

1312

datetime_to_dbus, "LastApprovalRequest")

1313

approved_by_default = notifychangeproperty(dbus.Boolean,

1314

"ApprovedByDefault")

1315

approval_delay = notifychangeproperty(

1316

dbus.UInt64, "ApprovalDelay",

1317

type_func = lambda td: td.total_seconds() * 1000)

1318

approval_duration = notifychangeproperty(

1319

dbus.UInt64, "ApprovalDuration",

1320

type_func = lambda td: td.total_seconds() * 1000)

1321

host = notifychangeproperty(dbus.String, "Host")

1322

timeout = notifychangeproperty(

1323

dbus.UInt64, "Timeout",

1324

type_func = lambda td: td.total_seconds() * 1000)

1325

extended_timeout = notifychangeproperty(

1326

dbus.UInt64, "ExtendedTimeout",

1327

type_func = lambda td: td.total_seconds() * 1000)

1328

interval = notifychangeproperty(

1329

dbus.UInt64, "Interval",

1330

type_func = lambda td: td.total_seconds() * 1000)

1331

checker_command = notifychangeproperty(dbus.String, "Checker")

1332

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1333

invalidate_only=True)

1334

1335

del notifychangeproperty

810

1336

811

1337

def __del__(self, *args, **kwargs):

812

1338

try:

817

1343

DBusObjectWithProperties.__del__(self, *args, **kwargs)

818

1344

Client.__del__(self, *args, **kwargs)

819

1345

820

def checker_callback(self, pid, condition, command,

821

*args, **kwargs):

822

self.checker_callback_tag = None

823

self.checker = None

824

# Emit D-Bus signal

825

self.PropertyChanged(dbus.String("CheckerRunning"),

826

dbus.Boolean(False, variant_level=1))

827

if os.WIFEXITED(condition):

828

exitstatus = os.WEXITSTATUS(condition)

1346

def checker_callback(self, source, condition,

1347

(connection, command), *args, **kwargs):

1348

ret = Client.checker_callback(self, source, condition,

1349

(connection, command), *args,

1350

**kwargs)

1351

exitstatus = self.last_checker_status

1352

if exitstatus >= 0:

829

1353

# Emit D-Bus signal

830

1354

self.CheckerCompleted(dbus.Int16(exitstatus),

831

dbus.Int64(condition),

1355

dbus.Int64(0),

832

1356

dbus.String(command))

833

1357

else:

834

1358

# Emit D-Bus signal

835

1359

self.CheckerCompleted(dbus.Int16(-1),

836

dbus.Int64(condition),

1360

dbus.Int64(

1361

self.last_checker_signal),

837

1362

dbus.String(command))

838

839

return Client.checker_callback(self, pid, condition, command,

840

*args, **kwargs)

841

842

def checked_ok(self, *args, **kwargs):

843

Client.checked_ok(self, *args, **kwargs)

844

# Emit D-Bus signal

845

self.PropertyChanged(

846

dbus.String("LastCheckedOK"),

847

(self._datetime_to_dbus(self.last_checked_ok,

848

variant_level=1)))

849

850

def need_approval(self, *args, **kwargs):

851

r = Client.need_approval(self, *args, **kwargs)

852

# Emit D-Bus signal

853

self.PropertyChanged(

854

dbus.String("LastApprovalRequest"),

855

(self._datetime_to_dbus(self.last_approval_request,

856

variant_level=1)))

857

return r

1363

return ret

858

1364

859

1365

def start_checker(self, *args, **kwargs):

860

old_checker = self.checker

861

if self.checker is not None:

862

old_checker_pid = self.checker.pid

863

else:

864

old_checker_pid = None

1366

old_checker_pid = getattr(self.checker, "pid", None)

865

1367

r = Client.start_checker(self, *args, **kwargs)

866

1368

# Only if new checker process was started

867

1369

if (self.checker is not None

868

1370

and old_checker_pid != self.checker.pid):

869

1371

# Emit D-Bus signal

870

1372

self.CheckerStarted(self.current_checker_command)

871

self.PropertyChanged(

872

dbus.String("CheckerRunning"),

873

dbus.Boolean(True, variant_level=1))

874

1373

return r

875

1374

876

def stop_checker(self, *args, **kwargs):

877

old_checker = getattr(self, "checker", None)

878

r = Client.stop_checker(self, *args, **kwargs)

879

if (old_checker is not None

880

and getattr(self, "checker", None) is None):

881

self.PropertyChanged(dbus.String("CheckerRunning"),

882

dbus.Boolean(False, variant_level=1))

883

return r

884

885

1375

def _reset_approved(self):

886

self._approved = None

1376

self.approved = None

887

1377

return False

888

1378

889

1379

def approve(self, value=True):

1380

self.approved = value

1381

gobject.timeout_add(int(self.approval_duration.total_seconds()

1382

* 1000), self._reset_approved)

890

1383

self.send_changedstate()

891

self._approved = value

892

gobject.timeout_add(self._timedelta_to_milliseconds

893

(self.approval_duration),

894

self._reset_approved)

895

896

1384

897

1385

## D-Bus methods, signals & properties

898

_interface = "se.bsnet.fukt.Mandos.Client"

1386

1387

## Interfaces

899

1388

900

1389

## Signals

901

1390

912

1401

pass

913

1402

914

1403

# PropertyChanged - signal

1404

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

915

1405

@dbus.service.signal(_interface, signature="sv")

916

1406

def PropertyChanged(self, property, value):

917

1407

"D-Bus signal"

981

1471

return dbus.Boolean(bool(self.approvals_pending))

982

1472

983

1473

# ApprovedByDefault - property

984

@dbus_service_property(_interface, signature="b",

1474

@dbus_service_property(_interface,

1475

signature="b",

985

1476

access="readwrite")

986

1477

def ApprovedByDefault_dbus_property(self, value=None):

987

1478

if value is None: # get

988

1479

return dbus.Boolean(self.approved_by_default)

989

1480

self.approved_by_default = bool(value)

990

# Emit D-Bus signal

991

self.PropertyChanged(dbus.String("ApprovedByDefault"),

992

dbus.Boolean(value, variant_level=1))

993

1481

994

1482

# ApprovalDelay - property

995

@dbus_service_property(_interface, signature="t",

1483

@dbus_service_property(_interface,

1484

signature="t",

996

1485

access="readwrite")

997

1486

def ApprovalDelay_dbus_property(self, value=None):

998

1487

if value is None: # get

999

return dbus.UInt64(self.approval_delay_milliseconds())

1488

return dbus.UInt64(self.approval_delay.total_seconds()

1489

* 1000)

1000

1490

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1001

# Emit D-Bus signal

1002

self.PropertyChanged(dbus.String("ApprovalDelay"),

1003

dbus.UInt64(value, variant_level=1))

1004

1491

1005

1492

# ApprovalDuration - property

1006

@dbus_service_property(_interface, signature="t",

1493

@dbus_service_property(_interface,

1494

signature="t",

1007

1495

access="readwrite")

1008

1496

def ApprovalDuration_dbus_property(self, value=None):

1009

1497

if value is None: # get

1010

return dbus.UInt64(self._timedelta_to_milliseconds(

1011

self.approval_duration))

1498

return dbus.UInt64(self.approval_duration.total_seconds()

1499

* 1000)

1012

1500

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1013

# Emit D-Bus signal

1014

self.PropertyChanged(dbus.String("ApprovalDuration"),

1015

dbus.UInt64(value, variant_level=1))

1016

1501

1017

1502

# Name - property

1018

1503

@dbus_service_property(_interface, signature="s", access="read")

1025

1510

return dbus.String(self.fingerprint)

1026

1511

1027

1512

# Host - property

1028

@dbus_service_property(_interface, signature="s",

1513

@dbus_service_property(_interface,

1514

signature="s",

1029

1515

access="readwrite")

1030

1516

def Host_dbus_property(self, value=None):

1031

1517

if value is None: # get

1032

1518

return dbus.String(self.host)

1033

self.host = value

1034

# Emit D-Bus signal

1035

self.PropertyChanged(dbus.String("Host"),

1036

dbus.String(value, variant_level=1))

1519

self.host = str(value)

1037

1520

1038

1521

# Created - property

1039

1522

@dbus_service_property(_interface, signature="s", access="read")

1040

1523

def Created_dbus_property(self):

1041

return dbus.String(self._datetime_to_dbus(self.created))

1524

return datetime_to_dbus(self.created)

1042

1525

1043

1526

# LastEnabled - property

1044

1527

@dbus_service_property(_interface, signature="s", access="read")

1045

1528

def LastEnabled_dbus_property(self):

1046

if self.last_enabled is None:

1047

return dbus.String("")

1048

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1529

return datetime_to_dbus(self.last_enabled)

1049

1530

1050

1531

# Enabled - property

1051

@dbus_service_property(_interface, signature="b",

1532

@dbus_service_property(_interface,

1533

signature="b",

1052

1534

access="readwrite")

1053

1535

def Enabled_dbus_property(self, value=None):

1054

1536

if value is None: # get

1059

1541

self.disable()

1060

1542

1061

1543

# LastCheckedOK - property

1062

@dbus_service_property(_interface, signature="s",

1544

@dbus_service_property(_interface,

1545

signature="s",

1063

1546

access="readwrite")

1064

1547

def LastCheckedOK_dbus_property(self, value=None):

1065

1548

if value is not None:

1066

1549

self.checked_ok()

1067

1550

return

1068

if self.last_checked_ok is None:

1069

return dbus.String("")

1070

return dbus.String(self._datetime_to_dbus(self

1071

.last_checked_ok))

1551

return datetime_to_dbus(self.last_checked_ok)

1552

1553

# LastCheckerStatus - property

1554

@dbus_service_property(_interface, signature="n", access="read")

1555

def LastCheckerStatus_dbus_property(self):

1556

return dbus.Int16(self.last_checker_status)

1557

1558

# Expires - property

1559

@dbus_service_property(_interface, signature="s", access="read")

1560

def Expires_dbus_property(self):

1561

return datetime_to_dbus(self.expires)

1072

1562

1073

1563

# LastApprovalRequest - property

1074

1564

@dbus_service_property(_interface, signature="s", access="read")

1075

1565

def LastApprovalRequest_dbus_property(self):

1076

if self.last_approval_request is None:

1077

return dbus.String("")

1078

return dbus.String(self.

1079

_datetime_to_dbus(self

1080

.last_approval_request))

1566

return datetime_to_dbus(self.last_approval_request)

1081

1567

1082

1568

# Timeout - property

1083

@dbus_service_property(_interface, signature="t",

1569

@dbus_service_property(_interface,

1570

signature="t",

1084

1571

access="readwrite")

1085

1572

def Timeout_dbus_property(self, value=None):

1086

1573

if value is None: # get

1087

return dbus.UInt64(self.timeout_milliseconds())

1574

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1575

old_timeout = self.timeout

1088

1576

self.timeout = datetime.timedelta(0, 0, 0, value)

1089

# Emit D-Bus signal

1090

self.PropertyChanged(dbus.String("Timeout"),

1091

dbus.UInt64(value, variant_level=1))

1092

if getattr(self, "disable_initiator_tag", None) is None:

1093

return

1094

# Reschedule timeout

1095

gobject.source_remove(self.disable_initiator_tag)

1096

self.disable_initiator_tag = None

1097

time_to_die = (self.

1098

_timedelta_to_milliseconds((self

1099

.last_checked_ok

1100

+ self.timeout)

1101

- datetime.datetime

1102

.utcnow()))

1103

if time_to_die <= 0:

1104

# The timeout has passed

1105

self.disable()

1106

else:

1107

self.disable_initiator_tag = (gobject.timeout_add

1108

(time_to_die, self.disable))

1577

# Reschedule disabling

1578

if self.enabled:

1579

now = datetime.datetime.utcnow()

1580

self.expires += self.timeout - old_timeout

1581

if self.expires <= now:

1582

# The timeout has passed

1583

self.disable()

1584

else:

1585

if (getattr(self, "disable_initiator_tag", None)

1586

is None):

1587

return

1588

gobject.source_remove(self.disable_initiator_tag)

1589

self.disable_initiator_tag = gobject.timeout_add(

1590

int((self.expires - now).total_seconds() * 1000),

1591

self.disable)

1592

1593

# ExtendedTimeout - property

1594

@dbus_service_property(_interface,

1595

signature="t",

1596

access="readwrite")

1597

def ExtendedTimeout_dbus_property(self, value=None):

1598

if value is None: # get

1599

return dbus.UInt64(self.extended_timeout.total_seconds()

1600

* 1000)

1601

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1109

1602

1110

1603

# Interval - property

1111

@dbus_service_property(_interface, signature="t",

1604

@dbus_service_property(_interface,

1605

signature="t",

1112

1606

access="readwrite")

1113

1607

def Interval_dbus_property(self, value=None):

1114

1608

if value is None: # get

1115

return dbus.UInt64(self.interval_milliseconds())

1609

return dbus.UInt64(self.interval.total_seconds() * 1000)

1116

1610

self.interval = datetime.timedelta(0, 0, 0, value)

1117

# Emit D-Bus signal

1118

self.PropertyChanged(dbus.String("Interval"),

1119

dbus.UInt64(value, variant_level=1))

1120

1611

if getattr(self, "checker_initiator_tag", None) is None:

1121

1612

return

1122

# Reschedule checker run

1123

gobject.source_remove(self.checker_initiator_tag)

1124

self.checker_initiator_tag = (gobject.timeout_add

1125

(value, self.start_checker))

1126

self.start_checker() # Start one now, too

1127

1613

if self.enabled:

1614

# Reschedule checker run

1615

gobject.source_remove(self.checker_initiator_tag)

1616

self.checker_initiator_tag = gobject.timeout_add(

1617

value, self.start_checker)

1618

self.start_checker() # Start one now, too

1619

1128

1620

# Checker - property

1129

@dbus_service_property(_interface, signature="s",

1621

@dbus_service_property(_interface,

1622

signature="s",

1130

1623

access="readwrite")

1131

1624

def Checker_dbus_property(self, value=None):

1132

1625

if value is None: # get

1133

1626

return dbus.String(self.checker_command)

1134

self.checker_command = value

1135

# Emit D-Bus signal

1136

self.PropertyChanged(dbus.String("Checker"),

1137

dbus.String(self.checker_command,

1138

variant_level=1))

1627

self.checker_command = str(value)

1139

1628

1140

1629

# CheckerRunning - property

1141

@dbus_service_property(_interface, signature="b",

1630

@dbus_service_property(_interface,

1631

signature="b",

1142

1632

access="readwrite")

1143

1633

def CheckerRunning_dbus_property(self, value=None):

1144

1634

if value is None: # get

1154

1644

return self.dbus_object_path # is already a dbus.ObjectPath

1155

1645

1156

1646

# Secret = property

1157

@dbus_service_property(_interface, signature="ay",

1158

access="write", byte_arrays=True)

1647

@dbus_service_property(_interface,

1648

signature="ay",

1649

access="write",

1650

byte_arrays=True)

1159

1651

def Secret_dbus_property(self, value):

1160

self.secret = str(value)

1652

self.secret = bytes(value)

1161

1653

1162

1654

del _interface

1163

1655

1168

1660

self._pipe.send(('init', fpr, address))

1169

1661

if not self._pipe.recv():

1170

1662

raise KeyError()

1171

1663

1172

1664

def __getattribute__(self, name):

1173

if(name == '_pipe'):

1665

if name == '_pipe':

1174

1666

return super(ProxyClient, self).__getattribute__(name)

1175

1667

self._pipe.send(('getattr', name))

1176

1668

data = self._pipe.recv()

1177

1669

if data[0] == 'data':

1178

1670

return data[1]

1179

1671

if data[0] == 'function':

1672

1180

1673

def func(*args, **kwargs):

1181

1674

self._pipe.send(('funcall', name, args, kwargs))

1182

1675

return self._pipe.recv()[1]

1676

1183

1677

return func

1184

1678

1185

1679

def __setattr__(self, name, value):

1186

if(name == '_pipe'):

1680

if name == '_pipe':

1187

1681

return super(ProxyClient, self).__setattr__(name, value)

1188

1682

self._pipe.send(('setattr', name, value))

1189

1683

1197

1691

def handle(self):

1198

1692

with contextlib.closing(self.server.child_pipe) as child_pipe:

1199

1693

logger.info("TCP connection from: %s",

1200

unicode(self.client_address))

1694

str(self.client_address))

1201

1695

logger.debug("Pipe FD: %d",

1202

1696

self.server.child_pipe.fileno())

1203

1204

session = (gnutls.connection

1205

.ClientSession(self.request,

1206

gnutls.connection

1207

.X509Credentials()))

1208

1697

1698

session = gnutls.connection.ClientSession(

1699

self.request, gnutls.connection .X509Credentials())

1700

1209

1701

# Note: gnutls.connection.X509Credentials is really a

1210

1702

# generic GnuTLS certificate credentials object so long as

1211

1703

# no X.509 keys are added to it. Therefore, we can use it

1212

1704

# here despite using OpenPGP certificates.

1213

1705

1214

1706

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1215

1707

# "+AES-256-CBC", "+SHA1",

1216

1708

# "+COMP-NULL", "+CTYPE-OPENPGP",

1219

1711

priority = self.server.gnutls_priority

1220

1712

if priority is None:

1221

1713

priority = "NORMAL"

1222

(gnutls.library.functions

1223

.gnutls_priority_set_direct(session._c_object,

1224

priority, None))

1225

1714

gnutls.library.functions.gnutls_priority_set_direct(

1715

session._c_object, priority, None)

1716

1226

1717

# Start communication using the Mandos protocol

1227

1718

# Get protocol number

1228

1719

line = self.request.makefile().readline()

1229

1720

logger.debug("Protocol version: %r", line)

1230

1721

try:

1231

1722

if int(line.strip().split()[0]) > 1:

1232

raise RuntimeError

1723

raise RuntimeError(line)

1233

1724

except (ValueError, IndexError, RuntimeError) as error:

1234

1725

logger.error("Unknown protocol version: %s", error)

1235

1726

return

1236

1727

1237

1728

# Start GnuTLS connection

1238

1729

try:

1239

1730

session.handshake()

1243

1734

# established. Just abandon the request.

1244

1735

return

1245

1736

logger.debug("Handshake succeeded")

1246

1737

1247

1738

approval_required = False

1248

1739

try:

1249

1740

try:

1250

fpr = self.fingerprint(self.peer_certificate

1251

(session))

1741

fpr = self.fingerprint(

1742

self.peer_certificate(session))

1252

1743

except (TypeError,

1253

1744

gnutls.errors.GNUTLSError) as error:

1254

1745

logger.warning("Bad certificate: %s", error)

1255

1746

return

1256

1747

logger.debug("Fingerprint: %s", fpr)

1257

1748

1258

1749

try:

1259

1750

client = ProxyClient(child_pipe, fpr,

1260

1751

self.client_address)

1269

1760

while True:

1270

1761

if not client.enabled:

1271

1762

logger.info("Client %s is disabled",

1272

client.name)

1763

client.name)

1273

1764

if self.server.use_dbus:

1274

1765

# Emit D-Bus signal

1275

client.Rejected("Disabled")

1766

client.Rejected("Disabled")

1276

1767

return

1277

1768

1278

if client._approved or not client.approval_delay:

1769

if client.approved or not client.approval_delay:

1279

1770

#We are approved or approval is disabled

1280

1771

break

1281

elif client._approved is None:

1772

elif client.approved is None:

1282

1773

logger.info("Client %s needs approval",

1283

1774

client.name)

1284

1775

if self.server.use_dbus:

1285

1776

# Emit D-Bus signal

1286

1777

client.NeedApproval(

1287

client.approval_delay_milliseconds(),

1288

client.approved_by_default)

1778

client.approval_delay.total_seconds()

1779

* 1000, client.approved_by_default)

1289

1780

else:

1290

1781

logger.warning("Client %s was not approved",

1291

1782

client.name)

1295

1786

return

1296

1787

1297

1788

#wait until timeout or approved

1298

#x = float(client._timedelta_to_milliseconds(delay))

1299

1789

time = datetime.datetime.now()

1300

1790

client.changedstate.acquire()

1301

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1791

client.changedstate.wait(delay.total_seconds())

1302

1792

client.changedstate.release()

1303

1793

time2 = datetime.datetime.now()

1304

1794

if (time2 - time) >= delay:

1320

1810

try:

1321

1811

sent = session.send(client.secret[sent_size:])

1322

1812

except gnutls.errors.GNUTLSError as error:

1323

logger.warning("gnutls send failed")

1813

logger.warning("gnutls send failed",

1814

exc_info=error)

1324

1815

return

1325

logger.debug("Sent: %d, remaining: %d",

1326

sent, len(client.secret)

1327

- (sent_size + sent))

1816

logger.debug("Sent: %d, remaining: %d", sent,

1817

len(client.secret) - (sent_size

1818

+ sent))

1328

1819

sent_size += sent

1329

1820

1330

1821

logger.info("Sending secret to %s", client.name)

1331

# bump the timeout as if seen

1332

client.checked_ok()

1822

# bump the timeout using extended_timeout

1823

client.bump_timeout(client.extended_timeout)

1333

1824

if self.server.use_dbus:

1334

1825

# Emit D-Bus signal

1335

1826

client.GotSecret()

1340

1831

try:

1341

1832

session.bye()

1342

1833

except gnutls.errors.GNUTLSError as error:

1343

logger.warning("GnuTLS bye failed")

1834

logger.warning("GnuTLS bye failed",

1835

exc_info=error)

1344

1836

1345

1837

@staticmethod

1346

1838

def peer_certificate(session):

1347

1839

"Return the peer's OpenPGP certificate as a bytestring"

1348

1840

# If not an OpenPGP certificate...

1349

if (gnutls.library.functions

1350

.gnutls_certificate_type_get(session._c_object)

1841

if (gnutls.library.functions.gnutls_certificate_type_get(

1842

session._c_object)

1351

1843

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1352

1844

# ...do the normal thing

1353

1845

return session.peer_certificate

1367

1859

def fingerprint(openpgp):

1368

1860

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1369

1861

# New GnuTLS "datum" with the OpenPGP public key

1370

datum = (gnutls.library.types

1371

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1372

ctypes.POINTER

1373

(ctypes.c_ubyte)),

1374

ctypes.c_uint(len(openpgp))))

1862

datum = gnutls.library.types.gnutls_datum_t(

1863

ctypes.cast(ctypes.c_char_p(openpgp),

1864

ctypes.POINTER(ctypes.c_ubyte)),

1865

ctypes.c_uint(len(openpgp)))

1375

1866

# New empty GnuTLS certificate

1376

1867

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1377

(gnutls.library.functions

1378

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1868

gnutls.library.functions.gnutls_openpgp_crt_init(

1869

ctypes.byref(crt))

1379

1870

# Import the OpenPGP public key into the certificate

1380

(gnutls.library.functions

1381

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1382

gnutls.library.constants

1383

.GNUTLS_OPENPGP_FMT_RAW))

1871

gnutls.library.functions.gnutls_openpgp_crt_import(

1872

crt, ctypes.byref(datum),

1873

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1384

1874

# Verify the self signature in the key

1385

1875

crtverify = ctypes.c_uint()

1386

(gnutls.library.functions

1387

.gnutls_openpgp_crt_verify_self(crt, 0,

1388

ctypes.byref(crtverify)))

1876

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1877

crt, 0, ctypes.byref(crtverify))

1389

1878

if crtverify.value != 0:

1390

1879

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1391

raise (gnutls.errors.CertificateSecurityError

1392

("Verify failed"))

1880

raise gnutls.errors.CertificateSecurityError(

1881

"Verify failed")

1393

1882

# New buffer for the fingerprint

1394

1883

buf = ctypes.create_string_buffer(20)

1395

1884

buf_len = ctypes.c_size_t()

1396

1885

# Get the fingerprint from the certificate into the buffer

1397

(gnutls.library.functions

1398

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1399

ctypes.byref(buf_len)))

1886

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1887

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1400

1888

# Deinit the certificate

1401

1889

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1402

1890

# Convert the buffer to a Python bytestring

1403

1891

fpr = ctypes.string_at(buf, buf_len.value)

1404

1892

# Convert the bytestring to hexadecimal notation

1405

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1893

hex_fpr = binascii.hexlify(fpr).upper()

1406

1894

return hex_fpr

1407

1895

1408

1896

1409

1897

class MultiprocessingMixIn(object):

1410

1898

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1899

1411

1900

def sub_process_main(self, request, address):

1412

1901

try:

1413

1902

self.finish_request(request, address)

1414

except:

1903

except Exception:

1415

1904

self.handle_error(request, address)

1416

1905

self.close_request(request)

1417

1906

1418

1907

def process_request(self, request, address):

1419

1908

"""Start a new process to process the request."""

1420

multiprocessing.Process(target = self.sub_process_main,

1421

args = (request, address)).start()

1909

proc = multiprocessing.Process(target = self.sub_process_main,

1910

args = (request, address))

1911

proc.start()

1912

return proc

1913

1422

1914

1423

1915

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1424

1916

""" adds a pipe to the MixIn """

1917

1425

1918

def process_request(self, request, client_address):

1426

1919

"""Overrides and wraps the original process_request().

1427

1920

1428

1921

This function creates a new pipe in self.pipe

1429

1922

"""

1430

1923

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1431

1432

super(MultiprocessingMixInWithPipe,

1433

self).process_request(request, client_address)

1924

1925

proc = MultiprocessingMixIn.process_request(self, request,

1926

client_address)

1434

1927

self.child_pipe.close()

1435

self.add_pipe(parent_pipe)

1436

1437

def add_pipe(self, parent_pipe):

1928

self.add_pipe(parent_pipe, proc)

1929

1930

def add_pipe(self, parent_pipe, proc):

1438

1931

"""Dummy function; override as necessary"""

1439

raise NotImplementedError

1932

raise NotImplementedError()

1933

1440

1934

1441

1935

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1442

1936

socketserver.TCPServer, object):

1447

1941

interface: None or a network interface name (string)

1448

1942

use_ipv6: Boolean; to use IPv6 or not

1449

1943

"""

1944

1450

1945

def __init__(self, server_address, RequestHandlerClass,

1451

interface=None, use_ipv6=True):

1946

interface=None,

1947

use_ipv6=True,

1948

socketfd=None):

1949

"""If socketfd is set, use that file descriptor instead of

1950

creating a new one with socket.socket().

1951

"""

1452

1952

self.interface = interface

1453

1953

if use_ipv6:

1454

1954

self.address_family = socket.AF_INET6

1955

if socketfd is not None:

1956

# Save the file descriptor

1957

self.socketfd = socketfd

1958

# Save the original socket.socket() function

1959

self.socket_socket = socket.socket

1960

# To implement --socket, we monkey patch socket.socket.

1961

#

1962

# (When socketserver.TCPServer is a new-style class, we

1963

# could make self.socket into a property instead of monkey

1964

# patching socket.socket.)

1965

#

1966

# Create a one-time-only replacement for socket.socket()

1967

@functools.wraps(socket.socket)

1968

def socket_wrapper(*args, **kwargs):

1969

# Restore original function so subsequent calls are

1970

# not affected.

1971

socket.socket = self.socket_socket

1972

del self.socket_socket

1973

# This time only, return a new socket object from the

1974

# saved file descriptor.

1975

return socket.fromfd(self.socketfd, *args, **kwargs)

1976

# Replace socket.socket() function with wrapper

1977

socket.socket = socket_wrapper

1978

# The socketserver.TCPServer.__init__ will call

1979

# socket.socket(), which might be our replacement,

1980

# socket_wrapper(), if socketfd was set.

1455

1981

socketserver.TCPServer.__init__(self, server_address,

1456

1982

RequestHandlerClass)

1983

1457

1984

def server_bind(self):

1458

1985

"""This overrides the normal server_bind() function

1459

1986

to bind to an interface if one was specified, and also NOT to

1465

1992

self.interface)

1466

1993

else:

1467

1994

try:

1468

self.socket.setsockopt(socket.SOL_SOCKET,

1469

SO_BINDTODEVICE,

1470

str(self.interface

1471

+ '\0'))

1995

self.socket.setsockopt(

1996

socket.SOL_SOCKET, SO_BINDTODEVICE,

1997

(self.interface + "\0").encode("utf-8"))

1472

1998

except socket.error as error:

1473

if error[0] == errno.EPERM:

1474

logger.error("No permission to"

1475

" bind to interface %s",

1476

self.interface)

1477

elif error[0] == errno.ENOPROTOOPT:

1999

if error.errno == errno.EPERM:

2000

logger.error("No permission to bind to"

2001

" interface %s", self.interface)

2002

elif error.errno == errno.ENOPROTOOPT:

1478

2003

logger.error("SO_BINDTODEVICE not available;"

1479

2004

" cannot bind to interface %s",

1480

2005

self.interface)

2006

elif error.errno == errno.ENODEV:

2007

logger.error("Interface %s does not exist,"

2008

" cannot bind", self.interface)

1481

2009

else:

1482

2010

raise

1483

2011

# Only bind(2) the socket if we really need to.

1486

2014

if self.address_family == socket.AF_INET6:

1487

2015

any_address = "::" # in6addr_any

1488

2016

else:

1489

any_address = socket.INADDR_ANY

2017

any_address = "0.0.0.0" # INADDR_ANY

1490

2018

self.server_address = (any_address,

1491

2019

self.server_address[1])

1492

2020

elif not self.server_address[1]:

1493

self.server_address = (self.server_address[0],

1494

0)

2021

self.server_address = (self.server_address[0], 0)

1495

2022

# if self.interface:

1496

2023

# self.server_address = (self.server_address[0],

1497

2024

# 0, # port

1511

2038

1512

2039

Assumes a gobject.MainLoop event loop.

1513

2040

"""

2041

1514

2042

def __init__(self, server_address, RequestHandlerClass,

1515

interface=None, use_ipv6=True, clients=None,

1516

gnutls_priority=None, use_dbus=True):

2043

interface=None,

2044

use_ipv6=True,

2045

clients=None,

2046

gnutls_priority=None,

2047

use_dbus=True,

2048

socketfd=None):

1517

2049

self.enabled = False

1518

2050

self.clients = clients

1519

2051

if self.clients is None:

1520

self.clients = set()

2052

self.clients = {}

1521

2053

self.use_dbus = use_dbus

1522

2054

self.gnutls_priority = gnutls_priority

1523

2055

IPv6_TCPServer.__init__(self, server_address,

1524

2056

RequestHandlerClass,

1525

2057

interface = interface,

1526

use_ipv6 = use_ipv6)

2058

use_ipv6 = use_ipv6,

2059

socketfd = socketfd)

2060

1527

2061

def server_activate(self):

1528

2062

if self.enabled:

1529

2063

return socketserver.TCPServer.server_activate(self)

2064

1530

2065

def enable(self):

1531

2066

self.enabled = True

1532

def add_pipe(self, parent_pipe):

2067

2068

def add_pipe(self, parent_pipe, proc):

1533

2069

# Call "handle_ipc" for both data and EOF events

1534

gobject.io_add_watch(parent_pipe.fileno(),

1535

gobject.IO_IN | gobject.IO_HUP,

1536

functools.partial(self.handle_ipc,

1537

parent_pipe = parent_pipe))

1538

1539

def handle_ipc(self, source, condition, parent_pipe=None,

2070

gobject.io_add_watch(

2071

parent_pipe.fileno(),

2072

gobject.IO_IN | gobject.IO_HUP,

2073

functools.partial(self.handle_ipc,

2074

parent_pipe = parent_pipe,

2075

proc = proc))

2076

2077

def handle_ipc(self, source, condition,

2078

parent_pipe=None,

2079

proc = None,

1540

2080

client_object=None):

1541

condition_names = {

1542

gobject.IO_IN: "IN", # There is data to read.

1543

gobject.IO_OUT: "OUT", # Data can be written (without

1544

# blocking).

1545

gobject.IO_PRI: "PRI", # There is urgent data to read.

1546

gobject.IO_ERR: "ERR", # Error condition.

1547

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1548

# broken, usually for pipes and

1549

# sockets).

1550

}

1551

conditions_string = ' | '.join(name

1552

for cond, name in

1553

condition_names.iteritems()

1554

if cond & condition)

1555

# error or the other end of multiprocessing.Pipe has closed

1556

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2081

# error, or the other end of multiprocessing.Pipe has closed

2082

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2083

# Wait for other process to exit

2084

proc.join()

1557

2085

return False

1558

2086

1559

2087

# Read a request from the child

1564

2092

fpr = request[1]

1565

2093

address = request[2]

1566

2094

1567

for c in self.clients:

2095

for c in self.clients.itervalues():

1568

2096

if c.fingerprint == fpr:

1569

2097

client = c

1570

2098

break

1573

2101

"dress: %s", fpr, address)

1574

2102

if self.use_dbus:

1575

2103

# Emit D-Bus signal

1576

mandos_dbus_service.ClientNotFound(fpr, address[0])

2104

mandos_dbus_service.ClientNotFound(fpr,

2105

address[0])

1577

2106

parent_pipe.send(False)

1578

2107

return False

1579

2108

1580

gobject.io_add_watch(parent_pipe.fileno(),

1581

gobject.IO_IN | gobject.IO_HUP,

1582

functools.partial(self.handle_ipc,

1583

parent_pipe = parent_pipe,

1584

client_object = client))

2109

gobject.io_add_watch(

2110

parent_pipe.fileno(),

2111

gobject.IO_IN | gobject.IO_HUP,

2112

functools.partial(self.handle_ipc,

2113

parent_pipe = parent_pipe,

2114

proc = proc,

2115

client_object = client))

1585

2116

parent_pipe.send(True)

1586

# remove the old hook in favor of the new above hook on same fileno

2117

# remove the old hook in favor of the new above hook on

2118

# same fileno

1587

2119

return False

1588

2120

if command == 'funcall':

1589

2121

funcname = request[1]

1590

2122

args = request[2]

1591

2123

kwargs = request[3]

1592

2124

1593

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1594

2125

parent_pipe.send(('data', getattr(client_object,

2126

funcname)(*args,

2127

**kwargs)))

2128

1595

2129

if command == 'getattr':

1596

2130

attrname = request[1]

1597

2131

if callable(client_object.__getattribute__(attrname)):

1598

parent_pipe.send(('function',))

2132

parent_pipe.send(('function', ))

1599

2133

else:

1600

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2134

parent_pipe.send((

2135

'data', client_object.__getattribute__(attrname)))

1601

2136

1602

2137

if command == 'setattr':

1603

2138

attrname = request[1]

1604

2139

value = request[2]

1605

2140

setattr(client_object, attrname, value)

1606

2141

1607

2142

return True

1608

2143

1609

2144

2145

def rfc3339_duration_to_delta(duration):

2146

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2147

2148

>>> rfc3339_duration_to_delta("P7D")

2149

datetime.timedelta(7)

2150

>>> rfc3339_duration_to_delta("PT60S")

2151

datetime.timedelta(0, 60)

2152

>>> rfc3339_duration_to_delta("PT60M")

2153

datetime.timedelta(0, 3600)

2154

>>> rfc3339_duration_to_delta("PT24H")

2155

datetime.timedelta(1)

2156

>>> rfc3339_duration_to_delta("P1W")

2157

datetime.timedelta(7)

2158

>>> rfc3339_duration_to_delta("PT5M30S")

2159

datetime.timedelta(0, 330)

2160

>>> rfc3339_duration_to_delta("P1DT3M20S")

2161

datetime.timedelta(1, 200)

2162

"""

2163

2164

# Parsing an RFC 3339 duration with regular expressions is not

2165

# possible - there would have to be multiple places for the same

2166

# values, like seconds. The current code, while more esoteric, is

2167

# cleaner without depending on a parsing library. If Python had a

2168

# built-in library for parsing we would use it, but we'd like to

2169

# avoid excessive use of external libraries.

2170

2171

# New type for defining tokens, syntax, and semantics all-in-one

2172

Token = collections.namedtuple("Token",

2173

("regexp", # To match token; if

2174

# "value" is not None,

2175

# must have a "group"

2176

# containing digits

2177

"value", # datetime.timedelta or

2178

# None

2179

"followers")) # Tokens valid after

2180

# this token

2181

Token = collections.namedtuple("Token", (

2182

"regexp", # To match token; if "value" is not None, must have

2183

# a "group" containing digits

2184

"value", # datetime.timedelta or None

2185

"followers")) # Tokens valid after this token

2186

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2187

# the "duration" ABNF definition in RFC 3339, Appendix A.

2188

token_end = Token(re.compile(r"$"), None, frozenset())

2189

token_second = Token(re.compile(r"(\d+)S"),

2190

datetime.timedelta(seconds=1),

2191

frozenset((token_end, )))

2192

token_minute = Token(re.compile(r"(\d+)M"),

2193

datetime.timedelta(minutes=1),

2194

frozenset((token_second, token_end)))

2195

token_hour = Token(re.compile(r"(\d+)H"),

2196

datetime.timedelta(hours=1),

2197

frozenset((token_minute, token_end)))

2198

token_time = Token(re.compile(r"T"),

2199

None,

2200

frozenset((token_hour, token_minute,

2201

token_second)))

2202

token_day = Token(re.compile(r"(\d+)D"),

2203

datetime.timedelta(days=1),

2204

frozenset((token_time, token_end)))

2205

token_month = Token(re.compile(r"(\d+)M"),

2206

datetime.timedelta(weeks=4),

2207

frozenset((token_day, token_end)))

2208

token_year = Token(re.compile(r"(\d+)Y"),

2209

datetime.timedelta(weeks=52),

2210

frozenset((token_month, token_end)))

2211

token_week = Token(re.compile(r"(\d+)W"),

2212

datetime.timedelta(weeks=1),

2213

frozenset((token_end, )))

2214

token_duration = Token(re.compile(r"P"), None,

2215

frozenset((token_year, token_month,

2216

token_day, token_time,

2217

token_week)))

2218

# Define starting values

2219

value = datetime.timedelta() # Value so far

2220

found_token = None

2221

followers = frozenset((token_duration,)) # Following valid tokens

2222

s = duration # String left to parse

2223

# Loop until end token is found

2224

while found_token is not token_end:

2225

# Search for any currently valid tokens

2226

for token in followers:

2227

match = token.regexp.match(s)

2228

if match is not None:

2229

# Token found

2230

if token.value is not None:

2231

# Value found, parse digits

2232

factor = int(match.group(1), 10)

2233

# Add to value so far

2234

value += factor * token.value

2235

# Strip token from string

2236

s = token.regexp.sub("", s, 1)

2237

# Go to found token

2238

found_token = token

2239

# Set valid next tokens

2240

followers = found_token.followers

2241

break

2242

else:

2243

# No currently valid tokens were found

2244

raise ValueError("Invalid RFC 3339 duration")

2245

# End token found

2246

return value

2247

2248

1610

2249

def string_to_delta(interval):

1611

2250

"""Parse a string and return a datetime.timedelta

1612

2251

1623

2262

>>> string_to_delta('5m 30s')

1624

2263

datetime.timedelta(0, 330)

1625

2264

"""

2265

2266

try:

2267

return rfc3339_duration_to_delta(interval)

2268

except ValueError:

2269

pass

2270

1626

2271

timevalue = datetime.timedelta(0)

1627

2272

for s in interval.split():

1628

2273

try:

1629

suffix = unicode(s[-1])

2274

suffix = s[-1]

1630

2275

value = int(s[:-1])

1631

2276

if suffix == "d":

1632

2277

delta = datetime.timedelta(value)

1639

2284

elif suffix == "w":

1640

2285

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1641

2286

else:

1642

raise ValueError("Unknown suffix %r" % suffix)

1643

except (ValueError, IndexError) as e:

2287

raise ValueError("Unknown suffix {!r}".format(suffix))

2288

except IndexError as e:

1644

2289

raise ValueError(*(e.args))

1645

2290

timevalue += delta

1646

2291

return timevalue

1647

2292

1648

2293

1649

def if_nametoindex(interface):

1650

"""Call the C function if_nametoindex(), or equivalent

1651

1652

Note: This function cannot accept a unicode string."""

1653

global if_nametoindex

1654

try:

1655

if_nametoindex = (ctypes.cdll.LoadLibrary

1656

(ctypes.util.find_library("c"))

1657

.if_nametoindex)

1658

except (OSError, AttributeError):

1659

logger.warning("Doing if_nametoindex the hard way")

1660

def if_nametoindex(interface):

1661

"Get an interface index the hard way, i.e. using fcntl()"

1662

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1663

with contextlib.closing(socket.socket()) as s:

1664

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1665

struct.pack(str("16s16x"),

1666

interface))

1667

interface_index = struct.unpack(str("I"),

1668

ifreq[16:20])[0]

1669

return interface_index

1670

return if_nametoindex(interface)

1671

1672

1673

2294

def daemon(nochdir = False, noclose = False):

1674

2295

"""See daemon(3). Standard BSD Unix function.

1675

2296

1683

2304

sys.exit()

1684

2305

if not noclose:

1685

2306

# Close all standard open file descriptors

1686

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2307

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1687

2308

if not stat.S_ISCHR(os.fstat(null).st_mode):

1688

2309

raise OSError(errno.ENODEV,

1689

"%s not a character device"

1690

% os.path.devnull)

2310

"{} not a character device"

2311

.format(os.devnull))

1691

2312

os.dup2(null, sys.stdin.fileno())

1692

2313

os.dup2(null, sys.stdout.fileno())

1693

2314

os.dup2(null, sys.stderr.fileno())

1702

2323

1703

2324

parser = argparse.ArgumentParser()

1704

2325

parser.add_argument("-v", "--version", action="version",

1705

version = "%%(prog)s %s" % version,

2326

version = "%(prog)s {}".format(version),

1706

2327

help="show version number and exit")

1707

2328

parser.add_argument("-i", "--interface", metavar="IF",

1708

2329

help="Bind to interface IF")

1714

2335

help="Run self-test")

1715

2336

parser.add_argument("--debug", action="store_true",

1716

2337

help="Debug mode; run in foreground and log"

1717

" to terminal")

2338

" to terminal", default=None)

1718

2339

parser.add_argument("--debuglevel", metavar="LEVEL",

1719

2340

help="Debug level for stdout output")

1720

2341

parser.add_argument("--priority", help="GnuTLS"

1727

2348

" files")

1728

2349

parser.add_argument("--no-dbus", action="store_false",

1729

2350

dest="use_dbus", help="Do not provide D-Bus"

1730

" system bus interface")

2351

" system bus interface", default=None)

1731

2352

parser.add_argument("--no-ipv6", action="store_false",

1732

dest="use_ipv6", help="Do not use IPv6")

2353

dest="use_ipv6", help="Do not use IPv6",

2354

default=None)

2355

parser.add_argument("--no-restore", action="store_false",

2356

dest="restore", help="Do not restore stored"

2357

" state", default=None)

2358

parser.add_argument("--socket", type=int,

2359

help="Specify a file descriptor to a network"

2360

" socket to use instead of creating one")

2361

parser.add_argument("--statedir", metavar="DIR",

2362

help="Directory to save/restore state in")

2363

parser.add_argument("--foreground", action="store_true",

2364

help="Run in foreground", default=None)

2365

parser.add_argument("--no-zeroconf", action="store_false",

2366

dest="zeroconf", help="Do not use Zeroconf",

2367

default=None)

2368

1733

2369

options = parser.parse_args()

1734

2370

1735

2371

if options.check:

1736

2372

import doctest

1737

doctest.testmod()

1738

sys.exit()

2373

fail_count, test_count = doctest.testmod()

2374

sys.exit(os.EX_OK if fail_count == 0 else 1)

1739

2375

1740

2376

# Default values for config file for server-global settings

1741

2377

server_defaults = { "interface": "",

1743

2379

"port": "",

1744

2380

"debug": "False",

1745

2381

"priority":

1746

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2382

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2383

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

1747

2384

"servicename": "Mandos",

1748

2385

"use_dbus": "True",

1749

2386

"use_ipv6": "True",

1750

2387

"debuglevel": "",

1751

}

2388

"restore": "True",

2389

"socket": "",

2390

"statedir": "/var/lib/mandos",

2391

"foreground": "False",

2392

"zeroconf": "True",

2393

}

1752

2394

1753

2395

# Parse config file for server-global settings

1754

2396

server_config = configparser.SafeConfigParser(server_defaults)

1755

2397

del server_defaults

1756

server_config.read(os.path.join(options.configdir,

1757

"mandos.conf"))

2398

server_config.read(os.path.join(options.configdir, "mandos.conf"))

1758

2399

# Convert the SafeConfigParser object to a dict

1759

2400

server_settings = server_config.defaults()

1760

2401

# Use the appropriate methods on the non-string config options

1761

for option in ("debug", "use_dbus", "use_ipv6"):

2402

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

1762

2403

server_settings[option] = server_config.getboolean("DEFAULT",

1763

2404

option)

1764

2405

if server_settings["port"]:

1765

2406

server_settings["port"] = server_config.getint("DEFAULT",

1766

2407

"port")

2408

if server_settings["socket"]:

2409

server_settings["socket"] = server_config.getint("DEFAULT",

2410

"socket")

2411

# Later, stdin will, and stdout and stderr might, be dup'ed

2412

# over with an opened os.devnull. But we don't want this to

2413

# happen with a supplied network socket.

2414

if 0 <= server_settings["socket"] <= 2:

2415

server_settings["socket"] = os.dup(server_settings

2416

["socket"])

1767

2417

del server_config

1768

2418

1769

2419

# Override the settings from the config file with command line

1770

2420

# options, if set.

1771

2421

for option in ("interface", "address", "port", "debug",

1772

"priority", "servicename", "configdir",

1773

"use_dbus", "use_ipv6", "debuglevel"):

2422

"priority", "servicename", "configdir", "use_dbus",

2423

"use_ipv6", "debuglevel", "restore", "statedir",

2424

"socket", "foreground", "zeroconf"):

1774

2425

value = getattr(options, option)

1775

2426

if value is not None:

1776

2427

server_settings[option] = value

1777

2428

del options

1778

2429

# Force all strings to be unicode

1779

2430

for option in server_settings.keys():

1780

if type(server_settings[option]) is str:

1781

server_settings[option] = unicode(server_settings[option])

2431

if isinstance(server_settings[option], bytes):

2432

server_settings[option] = (server_settings[option]

2433

.decode("utf-8"))

2434

# Force all boolean options to be boolean

2435

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2436

"foreground", "zeroconf"):

2437

server_settings[option] = bool(server_settings[option])

2438

# Debug implies foreground

2439

if server_settings["debug"]:

2440

server_settings["foreground"] = True

1782

2441

# Now we have our good server settings in "server_settings"

1783

2442

1784

2443

##################################################################

1785

2444

2445

if (not server_settings["zeroconf"]

2446

and not (server_settings["port"]

2447

or server_settings["socket"] != "")):

2448

parser.error("Needs port or socket to work without Zeroconf")

2449

1786

2450

# For convenience

1787

2451

debug = server_settings["debug"]

1788

2452

debuglevel = server_settings["debuglevel"]

1789

2453

use_dbus = server_settings["use_dbus"]

1790

2454

use_ipv6 = server_settings["use_ipv6"]

1791

2455

stored_state_path = os.path.join(server_settings["statedir"],

2456

stored_state_file)

2457

foreground = server_settings["foreground"]

2458

zeroconf = server_settings["zeroconf"]

2459

2460

if debug:

2461

initlogger(debug, logging.DEBUG)

2462

else:

2463

if not debuglevel:

2464

initlogger(debug)

2465

else:

2466

level = getattr(logging, debuglevel.upper())

2467

initlogger(debug, level)

2468

1792

2469

if server_settings["servicename"] != "Mandos":

1793

syslogger.setFormatter(logging.Formatter

1794

('Mandos (%s) [%%(process)d]:'

1795

' %%(levelname)s: %%(message)s'

1796

% server_settings["servicename"]))

2470

syslogger.setFormatter(

2471

logging.Formatter('Mandos ({}) [%(process)d]:'

2472

' %(levelname)s: %(message)s'.format(

2473

server_settings["servicename"])))

1797

2474

1798

2475

# Parse config file with clients

1799

client_defaults = { "timeout": "1h",

1800

"interval": "5m",

1801

"checker": "fping -q -- %%(host)s",

1802

"host": "",

1803

"approval_delay": "0s",

1804

"approval_duration": "1s",

1805

}

1806

client_config = configparser.SafeConfigParser(client_defaults)

2476

client_config = configparser.SafeConfigParser(Client

2477

.client_defaults)

1807

2478

client_config.read(os.path.join(server_settings["configdir"],

1808

2479

"clients.conf"))

1809

2480

1810

2481

global mandos_dbus_service

1811

2482

mandos_dbus_service = None

1812

2483

1813

tcp_server = MandosServer((server_settings["address"],

1814

server_settings["port"]),

1815

ClientHandler,

1816

interface=(server_settings["interface"]

1817

or None),

1818

use_ipv6=use_ipv6,

1819

gnutls_priority=

1820

server_settings["priority"],

1821

use_dbus=use_dbus)

1822

if not debug:

1823

pidfilename = "/var/run/mandos.pid"

2484

socketfd = None

2485

if server_settings["socket"] != "":

2486

socketfd = server_settings["socket"]

2487

tcp_server = MandosServer(

2488

(server_settings["address"], server_settings["port"]),

2489

ClientHandler,

2490

interface=(server_settings["interface"] or None),

2491

use_ipv6=use_ipv6,

2492

gnutls_priority=server_settings["priority"],

2493

use_dbus=use_dbus,

2494

socketfd=socketfd)

2495

if not foreground:

2496

pidfilename = "/run/mandos.pid"

2497

if not os.path.isdir("/run/."):

2498

pidfilename = "/var/run/mandos.pid"

2499

pidfile = None

1824

2500

try:

1825

2501

pidfile = open(pidfilename, "w")

1826

except IOError:

1827

logger.error("Could not open file %r", pidfilename)

2502

except IOError as e:

2503

logger.error("Could not open file %r", pidfilename,

2504

exc_info=e)

1828

2505

1829

try:

1830

uid = pwd.getpwnam("_mandos").pw_uid

1831

gid = pwd.getpwnam("_mandos").pw_gid

1832

except KeyError:

2506

for name in ("_mandos", "mandos", "nobody"):

1833

2507

try:

1834

uid = pwd.getpwnam("mandos").pw_uid

1835

gid = pwd.getpwnam("mandos").pw_gid

2508

uid = pwd.getpwnam(name).pw_uid

2509

gid = pwd.getpwnam(name).pw_gid

2510

break

1836

2511

except KeyError:

1837

try:

1838

uid = pwd.getpwnam("nobody").pw_uid

1839

gid = pwd.getpwnam("nobody").pw_gid

1840

except KeyError:

1841

uid = 65534

1842

gid = 65534

2512

continue

2513

else:

2514

uid = 65534

2515

gid = 65534

1843

2516

try:

1844

2517

os.setgid(gid)

1845

2518

os.setuid(uid)

1846

2519

except OSError as error:

1847

if error[0] != errno.EPERM:

1848

raise error

2520

if error.errno != errno.EPERM:

2521

raise

1849

2522

1850

if not debug and not debuglevel:

1851

syslogger.setLevel(logging.WARNING)

1852

console.setLevel(logging.WARNING)

1853

if debuglevel:

1854

level = getattr(logging, debuglevel.upper())

1855

syslogger.setLevel(level)

1856

console.setLevel(level)

1857

1858

2523

if debug:

1859

2524

# Enable all possible GnuTLS debugging

1860

2525

1866

2531

def debug_gnutls(level, string):

1867

2532

logger.debug("GnuTLS: %s", string[:-1])

1868

2533

1869

(gnutls.library.functions

1870

.gnutls_global_set_log_function(debug_gnutls))

2534

gnutls.library.functions.gnutls_global_set_log_function(

2535

debug_gnutls)

1871

2536

1872

2537

# Redirect stdin so all checkers get /dev/null

1873

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2538

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1874

2539

os.dup2(null, sys.stdin.fileno())

1875

2540

if null > 2:

1876

2541

os.close(null)

1877

else:

1878

# No console logging

1879

logger.removeHandler(console)

1880

2542

1881

2543

# Need to fork before connecting to D-Bus

1882

if not debug:

2544

if not foreground:

1883

2545

# Close all input and output, do double fork, etc.

1884

2546

daemon()

1885

2547

2548

# multiprocessing will use threads, so before we use gobject we

2549

# need to inform gobject that threads will be used.

2550

gobject.threads_init()

2551

1886

2552

global main_loop

1887

2553

# From the Avahi example code

1888

DBusGMainLoop(set_as_default=True )

2554

DBusGMainLoop(set_as_default=True)

1889

2555

main_loop = gobject.MainLoop()

1890

2556

bus = dbus.SystemBus()

1891

2557

# End of Avahi example code

1892

2558

if use_dbus:

1893

2559

try:

1894

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1895

bus, do_not_queue=True)

2560

bus_name = dbus.service.BusName("se.recompile.Mandos",

2561

bus,

2562

do_not_queue=True)

2563

old_bus_name = dbus.service.BusName(

2564

"se.bsnet.fukt.Mandos", bus,

2565

do_not_queue=True)

1896

2566

except dbus.exceptions.NameExistsException as e:

1897

logger.error(unicode(e) + ", disabling D-Bus")

2567

logger.error("Disabling D-Bus:", exc_info=e)

1898

2568

use_dbus = False

1899

2569

server_settings["use_dbus"] = False

1900

2570

tcp_server.use_dbus = False

1901

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1902

service = AvahiService(name = server_settings["servicename"],

1903

servicetype = "_mandos._tcp",

1904

protocol = protocol, bus = bus)

1905

if server_settings["interface"]:

1906

service.interface = (if_nametoindex

1907

(str(server_settings["interface"])))

2571

if zeroconf:

2572

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2573

service = AvahiServiceToSyslog(

2574

name = server_settings["servicename"],

2575

servicetype = "_mandos._tcp",

2576

protocol = protocol,

2577

bus = bus)

2578

if server_settings["interface"]:

2579

service.interface = if_nametoindex(

2580

server_settings["interface"].encode("utf-8"))

1908

2581

1909

2582

global multiprocessing_manager

1910

2583

multiprocessing_manager = multiprocessing.Manager()

1912

2585

client_class = Client

1913

2586

if use_dbus:

1914

2587

client_class = functools.partial(ClientDBus, bus = bus)

1915

def client_config_items(config, section):

1916

special_settings = {

1917

"approved_by_default":

1918

lambda: config.getboolean(section,

1919

"approved_by_default"),

1920

}

1921

for name, value in config.items(section):

2588

2589

client_settings = Client.config_parser(client_config)

2590

old_client_settings = {}

2591

clients_data = {}

2592

2593

# This is used to redirect stdout and stderr for checker processes

2594

global wnull

2595

wnull = open(os.devnull, "w") # A writable /dev/null

2596

# Only used if server is running in foreground but not in debug

2597

# mode

2598

if debug or not foreground:

2599

wnull.close()

2600

2601

# Get client data and settings from last running state.

2602

if server_settings["restore"]:

2603

try:

2604

with open(stored_state_path, "rb") as stored_state:

2605

clients_data, old_client_settings = pickle.load(

2606

stored_state)

2607

os.remove(stored_state_path)

2608

except IOError as e:

2609

if e.errno == errno.ENOENT:

2610

logger.warning("Could not load persistent state:"

2611

" {}".format(os.strerror(e.errno)))

2612

else:

2613

logger.critical("Could not load persistent state:",

2614

exc_info=e)

2615

raise

2616

except EOFError as e:

2617

logger.warning("Could not load persistent state: "

2618

"EOFError:",

2619

exc_info=e)

2620

2621

with PGPEngine() as pgp:

2622

for client_name, client in clients_data.items():

2623

# Skip removed clients

2624

if client_name not in client_settings:

2625

continue

2626

2627

# Decide which value to use after restoring saved state.

2628

# We have three different values: Old config file,

2629

# new config file, and saved state.

2630

# New config value takes precedence if it differs from old

2631

# config value, otherwise use saved state.

2632

for name, value in client_settings[client_name].items():

2633

try:

2634

# For each value in new config, check if it

2635

# differs from the old config value (Except for

2636

# the "secret" attribute)

2637

if (name != "secret"

2638

and (value !=

2639

old_client_settings[client_name][name])):

2640

client[name] = value

2641

except KeyError:

2642

pass

2643

2644

# Clients who has passed its expire date can still be

2645

# enabled if its last checker was successful. A Client

2646

# whose checker succeeded before we stored its state is

2647

# assumed to have successfully run all checkers during

2648

# downtime.

2649

if client["enabled"]:

2650

if datetime.datetime.utcnow() >= client["expires"]:

2651

if not client["last_checked_ok"]:

2652

logger.warning(

2653

"disabling client {} - Client never "

2654

"performed a successful checker".format(

2655

client_name))

2656

client["enabled"] = False

2657

elif client["last_checker_status"] != 0:

2658

logger.warning(

2659

"disabling client {} - Client last"

2660

" checker failed with error code"

2661

" {}".format(

2662

client_name,

2663

client["last_checker_status"]))

2664

client["enabled"] = False

2665

else:

2666

client["expires"] = (

2667

datetime.datetime.utcnow()

2668

+ client["timeout"])

2669

logger.debug("Last checker succeeded,"

2670

" keeping {} enabled".format(

2671

client_name))

1922

2672

try:

1923

yield (name, special_settings[name]())

1924

except KeyError:

1925

yield (name, value)

1926

1927

tcp_server.clients.update(set(

1928

client_class(name = section,

1929

config= dict(client_config_items(

1930

client_config, section)))

1931

for section in client_config.sections()))

2673

client["secret"] = pgp.decrypt(

2674

client["encrypted_secret"],

2675

client_settings[client_name]["secret"])

2676

except PGPError:

2677

# If decryption fails, we use secret from new settings

2678

logger.debug("Failed to decrypt {} old secret".format(

2679

client_name))

2680

client["secret"] = (client_settings[client_name]

2681

["secret"])

2682

2683

# Add/remove clients based on new changes made to config

2684

for client_name in (set(old_client_settings)

2685

- set(client_settings)):

2686

del clients_data[client_name]

2687

for client_name in (set(client_settings)

2688

- set(old_client_settings)):

2689

clients_data[client_name] = client_settings[client_name]

2690

2691

# Create all client objects

2692

for client_name, client in clients_data.items():

2693

tcp_server.clients[client_name] = client_class(

2694

name = client_name,

2695

settings = client,

2696

server_settings = server_settings)

2697

1932

2698

if not tcp_server.clients:

1933

2699

logger.warning("No clients defined")

1934

1935

if not debug:

1936

try:

1937

with pidfile:

1938

pid = os.getpid()

1939

pidfile.write(str(pid) + "\n".encode("utf-8"))

1940

del pidfile

1941

except IOError:

1942

logger.error("Could not write to file %r with PID %d",

1943

pidfilename, pid)

1944

except NameError:

1945

# "pidfile" was never created

1946

pass

2700

2701

if not foreground:

2702

if pidfile is not None:

2703

try:

2704

with pidfile:

2705

pid = os.getpid()

2706

pidfile.write("{}\n".format(pid).encode("utf-8"))

2707

except IOError:

2708

logger.error("Could not write to file %r with PID %d",

2709

pidfilename, pid)

2710

del pidfile

1947

2711

del pidfilename

1948

1949

signal.signal(signal.SIGINT, signal.SIG_IGN)

1950

2712

1951

2713

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1952

2714

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1953

2715

1954

2716

if use_dbus:

1955

class MandosDBusService(dbus.service.Object):

2717

2718

@alternate_dbus_interfaces(

2719

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2720

class MandosDBusService(DBusObjectWithProperties):

1956

2721

"""A D-Bus proxy object"""

2722

1957

2723

def __init__(self):

1958

2724

dbus.service.Object.__init__(self, bus, "/")

1959

_interface = "se.bsnet.fukt.Mandos"

2725

2726

_interface = "se.recompile.Mandos"

2727

2728

@dbus_interface_annotations(_interface)

2729

def _foo(self):

2730

return {

2731

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2732

"false" }

1960

2733

1961

2734

@dbus.service.signal(_interface, signature="o")

1962

2735

def ClientAdded(self, objpath):

1976

2749

@dbus.service.method(_interface, out_signature="ao")

1977

2750

def GetAllClients(self):

1978

2751

"D-Bus method"

1979

return dbus.Array(c.dbus_object_path

1980

for c in tcp_server.clients)

2752

return dbus.Array(c.dbus_object_path for c in

2753

tcp_server.clients.itervalues())

1981

2754

1982

2755

@dbus.service.method(_interface,

1983

2756

out_signature="a{oa{sv}}")

1984

2757

def GetAllClientsWithProperties(self):

1985

2758

"D-Bus method"

1986

2759

return dbus.Dictionary(

1987

((c.dbus_object_path, c.GetAll(""))

1988

for c in tcp_server.clients),

2760

{ c.dbus_object_path: c.GetAll("")

2761

for c in tcp_server.clients.itervalues() },

1989

2762

signature="oa{sv}")

1990

2763

1991

2764

@dbus.service.method(_interface, in_signature="o")

1992

2765

def RemoveClient(self, object_path):

1993

2766

"D-Bus method"

1994

for c in tcp_server.clients:

2767

for c in tcp_server.clients.itervalues():

1995

2768

if c.dbus_object_path == object_path:

1996

tcp_server.clients.remove(c)

2769

del tcp_server.clients[c.name]

1997

2770

c.remove_from_connection()

1998

2771

# Don't signal anything except ClientRemoved

1999

2772

c.disable(quiet=True)

2008

2781

2009

2782

def cleanup():

2010

2783

"Cleanup function; run on exit"

2011

service.cleanup()

2012

2784

if zeroconf:

2785

service.cleanup()

2786

2787

multiprocessing.active_children()

2788

wnull.close()

2789

if not (tcp_server.clients or client_settings):

2790

return

2791

2792

# Store client before exiting. Secrets are encrypted with key

2793

# based on what config file has. If config file is

2794

# removed/edited, old secret will thus be unrecovable.

2795

clients = {}

2796

with PGPEngine() as pgp:

2797

for client in tcp_server.clients.itervalues():

2798

key = client_settings[client.name]["secret"]

2799

client.encrypted_secret = pgp.encrypt(client.secret,

2800

key)

2801

client_dict = {}

2802

2803

# A list of attributes that can not be pickled

2804

# + secret.

2805

exclude = { "bus", "changedstate", "secret",

2806

"checker", "server_settings" }

2807

for name, typ in inspect.getmembers(dbus.service

2808

.Object):

2809

exclude.add(name)

2810

2811

client_dict["encrypted_secret"] = (client

2812

.encrypted_secret)

2813

for attr in client.client_structure:

2814

if attr not in exclude:

2815

client_dict[attr] = getattr(client, attr)

2816

2817

clients[client.name] = client_dict

2818

del client_settings[client.name]["secret"]

2819

2820

try:

2821

with tempfile.NamedTemporaryFile(

2822

mode='wb',

2823

suffix=".pickle",

2824

prefix='clients-',

2825

dir=os.path.dirname(stored_state_path),

2826

delete=False) as stored_state:

2827

pickle.dump((clients, client_settings), stored_state)

2828

tempname = stored_state.name

2829

os.rename(tempname, stored_state_path)

2830

except (IOError, OSError) as e:

2831

if not debug:

2832

try:

2833

os.remove(tempname)

2834

except NameError:

2835

pass

2836

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2837

logger.warning("Could not save persistent state: {}"

2838

.format(os.strerror(e.errno)))

2839

else:

2840

logger.warning("Could not save persistent state:",

2841

exc_info=e)

2842

raise

2843

2844

# Delete all clients, and settings from config

2013

2845

while tcp_server.clients:

2014

client = tcp_server.clients.pop()

2846

name, client = tcp_server.clients.popitem()

2015

2847

if use_dbus:

2016

2848

client.remove_from_connection()

2017

client.disable_hook = None

2018

2849

# Don't signal anything except ClientRemoved

2019

2850

client.disable(quiet=True)

2020

2851

if use_dbus:

2021

2852

# Emit D-Bus signal

2022

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2023

client.name)

2853

mandos_dbus_service.ClientRemoved(

2854

client.dbus_object_path, client.name)

2855

client_settings.clear()

2024

2856

2025

2857

atexit.register(cleanup)

2026

2858

2027

for client in tcp_server.clients:

2859

for client in tcp_server.clients.itervalues():

2028

2860

if use_dbus:

2029

2861

# Emit D-Bus signal

2030

2862

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2031

client.enable()

2863

# Need to initiate checking of clients

2864

if client.enabled:

2865

client.init_checker()

2032

2866

2033

2867

tcp_server.enable()

2034

2868

tcp_server.server_activate()

2035

2869

2036

2870

# Find out what port we got

2037

service.port = tcp_server.socket.getsockname()[1]

2871

if zeroconf:

2872

service.port = tcp_server.socket.getsockname()[1]

2038

2873

if use_ipv6:

2039

2874

logger.info("Now listening on address %r, port %d,"

2040

" flowinfo %d, scope_id %d"

2041

% tcp_server.socket.getsockname())

2875

" flowinfo %d, scope_id %d",

2876

*tcp_server.socket.getsockname())

2042

2877

else: # IPv4

2043

logger.info("Now listening on address %r, port %d"

2044

% tcp_server.socket.getsockname())

2878

logger.info("Now listening on address %r, port %d",

2879

*tcp_server.socket.getsockname())

2045

2880

2046

2881

#service.interface = tcp_server.socket.getsockname()[3]

2047

2882

2048

2883

try:

2049

# From the Avahi example code

2050

try:

2051

service.activate()

2052

except dbus.exceptions.DBusException as error:

2053

logger.critical("DBusException: %s", error)

2054

cleanup()

2055

sys.exit(1)

2056

# End of Avahi example code

2884

if zeroconf:

2885

# From the Avahi example code

2886

try:

2887

service.activate()

2888

except dbus.exceptions.DBusException as error:

2889

logger.critical("D-Bus Exception", exc_info=error)

2890

cleanup()

2891

sys.exit(1)

2892

# End of Avahi example code

2057

2893

2058

2894

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2059

2895

lambda *args, **kwargs:

2063

2899

logger.debug("Starting main loop")

2064

2900

main_loop.run()

2065

2901

except AvahiError as error:

2066

logger.critical("AvahiError: %s", error)

2902

logger.critical("Avahi Error", exc_info=error)

2067

2903

cleanup()

2068

2904

sys.exit(1)

2069

2905

except KeyboardInterrupt:

2074

2910

# Must run before the D-Bus bus name gets deregistered

2075

2911

cleanup()

2076

2912

2913

2077

2914

if __name__ == '__main__':

2078

2915

main()