To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 750
- compare with another revision
- download diff
- download tarball
- view history from revision 750
- Committer: Teddy Hogeborn
- Date: 2015-05-30 16:47:00 UTC
- Revision ID: teddy@recompile.se-20150530164700-77zrd7964gdhbk1f
mandos: Disable D-Bus if any DBusException is raised when connecting.
- files added:
- debian/mandos-client.examples
- debian/upstream
- network-hooks.d
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
# Contact the authors at <mandos@recompile.se>.
32
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
import SocketServer as socketserver
37
from future_builtins import *
38
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
38
43
import socket
39
44
import argparse
40
45
import datetime
45
50
import gnutls.library.functions
46
51
import gnutls.library.constants
47
52
import gnutls.library.types
48
import ConfigParser as configparser
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
49
57
import sys
50
58
import re
51
59
import os
60
68
import struct
61
69
import fcntl
62
70
import functools
63
import cPickle as pickle
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
64
75
import multiprocessing
76
import types
77
import binascii
78
import tempfile
79
import itertools
80
import collections
65
81
66
82
import dbus
67
83
import dbus.service
68
import gobject
84
try:
85
import gobject
86
except ImportError:
87
from gi.repository import GObject as gobject
69
88
import avahi
70
89
from dbus.mainloop.glib import DBusGMainLoop
71
90
import ctypes
81
100
except ImportError:
82
101
SO_BINDTODEVICE = None
83
102
84
85
version = "1.3.0"
86
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
89
syslogger = (logging.handlers.SysLogHandler
90
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
address = str("/dev/log")))
92
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
95
logger.addHandler(syslogger)
96
97
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
101
logger.addHandler(console)
103
if sys.version_info.major == 2:
104
str = unicode
105
106
version = "1.6.9"
107
stored_state_file = "clients.pickle"
108
109
logger = logging.getLogger()
110
syslogger = None
111
112
try:
113
if_nametoindex = ctypes.cdll.LoadLibrary(
114
ctypes.util.find_library("c")).if_nametoindex
115
except (OSError, AttributeError):
116
117
def if_nametoindex(interface):
118
"Get an interface index the hard way, i.e. using fcntl()"
119
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
120
with contextlib.closing(socket.socket()) as s:
121
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
122
struct.pack(b"16s16x", interface))
123
interface_index = struct.unpack("I", ifreq[16:20])[0]
124
return interface_index
125
126
127
def initlogger(debug, level=logging.WARNING):
128
"""init logger and add loglevel"""
129
130
global syslogger
131
syslogger = (logging.handlers.SysLogHandler(
132
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
133
address = "/dev/log"))
134
syslogger.setFormatter(logging.Formatter
135
('Mandos [%(process)d]: %(levelname)s:'
136
' %(message)s'))
137
logger.addHandler(syslogger)
138
139
if debug:
140
console = logging.StreamHandler()
141
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
142
' [%(process)d]:'
143
' %(levelname)s:'
144
' %(message)s'))
145
logger.addHandler(console)
146
logger.setLevel(level)
147
148
149
class PGPError(Exception):
150
"""Exception if encryption/decryption fails"""
151
pass
152
153
154
class PGPEngine(object):
155
"""A simple class for OpenPGP symmetric encryption & decryption"""
156
157
def __init__(self):
158
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
159
self.gnupgargs = ['--batch',
160
'--home', self.tempdir,
161
'--force-mdc',
162
'--quiet',
163
'--no-use-agent']
164
165
def __enter__(self):
166
return self
167
168
def __exit__(self, exc_type, exc_value, traceback):
169
self._cleanup()
170
return False
171
172
def __del__(self):
173
self._cleanup()
174
175
def _cleanup(self):
176
if self.tempdir is not None:
177
# Delete contents of tempdir
178
for root, dirs, files in os.walk(self.tempdir,
179
topdown = False):
180
for filename in files:
181
os.remove(os.path.join(root, filename))
182
for dirname in dirs:
183
os.rmdir(os.path.join(root, dirname))
184
# Remove tempdir
185
os.rmdir(self.tempdir)
186
self.tempdir = None
187
188
def password_encode(self, password):
189
# Passphrase can not be empty and can not contain newlines or
190
# NUL bytes. So we prefix it and hex encode it.
191
encoded = b"mandos" + binascii.hexlify(password)
192
if len(encoded) > 2048:
193
# GnuPG can't handle long passwords, so encode differently
194
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
195
.replace(b"\n", b"\\n")
196
.replace(b"\0", b"\\x00"))
197
return encoded
198
199
def encrypt(self, data, password):
200
passphrase = self.password_encode(password)
201
with tempfile.NamedTemporaryFile(
202
dir=self.tempdir) as passfile:
203
passfile.write(passphrase)
204
passfile.flush()
205
proc = subprocess.Popen(['gpg', '--symmetric',
206
'--passphrase-file',
207
passfile.name]
208
+ self.gnupgargs,
209
stdin = subprocess.PIPE,
210
stdout = subprocess.PIPE,
211
stderr = subprocess.PIPE)
212
ciphertext, err = proc.communicate(input = data)
213
if proc.returncode != 0:
214
raise PGPError(err)
215
return ciphertext
216
217
def decrypt(self, data, password):
218
passphrase = self.password_encode(password)
219
with tempfile.NamedTemporaryFile(
220
dir = self.tempdir) as passfile:
221
passfile.write(passphrase)
222
passfile.flush()
223
proc = subprocess.Popen(['gpg', '--decrypt',
224
'--passphrase-file',
225
passfile.name]
226
+ self.gnupgargs,
227
stdin = subprocess.PIPE,
228
stdout = subprocess.PIPE,
229
stderr = subprocess.PIPE)
230
decrypted_plaintext, err = proc.communicate(input = data)
231
if proc.returncode != 0:
232
raise PGPError(err)
233
return decrypted_plaintext
234
102
235
103
236
class AvahiError(Exception):
104
237
def __init__(self, value, *args, **kwargs):
105
238
self.value = value
106
super(AvahiError, self).__init__(value, *args, **kwargs)
107
def __unicode__(self):
108
return unicode(repr(self.value))
239
return super(AvahiError, self).__init__(value, *args,
240
**kwargs)
241
109
242
110
243
class AvahiServiceError(AvahiError):
111
244
pass
112
245
246
113
247
class AvahiGroupError(AvahiError):
114
248
pass
115
249
122
256
Used to optionally bind to the specified interface.
123
257
name: string; Example: 'Mandos'
124
258
type: string; Example: '_mandos._tcp'.
125
See <http://www.dns-sd.org/ServiceTypes.html>
259
See <https://www.iana.org/assignments/service-names-port-numbers>
126
260
port: integer; what port to announce
127
261
TXT: list of strings; TXT record for the service
128
262
domain: string; Domain to publish on, default to .local if empty.
134
268
server: D-Bus Server
135
269
bus: dbus.SystemBus()
136
270
"""
137
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
servicetype = None, port = None, TXT = None,
139
domain = "", host = "", max_renames = 32768,
140
protocol = avahi.PROTO_UNSPEC, bus = None):
271
272
def __init__(self,
273
interface = avahi.IF_UNSPEC,
274
name = None,
275
servicetype = None,
276
port = None,
277
TXT = None,
278
domain = "",
279
host = "",
280
max_renames = 32768,
281
protocol = avahi.PROTO_UNSPEC,
282
bus = None):
141
283
self.interface = interface
142
284
self.name = name
143
285
self.type = servicetype
152
294
self.server = None
153
295
self.bus = bus
154
296
self.entry_group_state_changed_match = None
155
def rename(self):
297
298
def rename(self, remove=True):
156
299
"""Derived from the Avahi example code"""
157
300
if self.rename_count >= self.max_renames:
158
301
logger.critical("No suitable Zeroconf service name found"
159
302
" after %i retries, exiting.",
160
303
self.rename_count)
161
304
raise AvahiServiceError("Too many renames")
162
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
305
self.name = str(
306
self.server.GetAlternativeServiceName(self.name))
307
self.rename_count += 1
163
308
logger.info("Changing Zeroconf service name to %r ...",
164
309
self.name)
165
syslogger.setFormatter(logging.Formatter
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
168
% self.name))
169
self.remove()
310
if remove:
311
self.remove()
170
312
try:
171
313
self.add()
172
314
except dbus.exceptions.DBusException as error:
173
logger.critical("DBusException: %s", error)
174
self.cleanup()
175
os._exit(1)
176
self.rename_count += 1
315
if (error.get_dbus_name()
316
== "org.freedesktop.Avahi.CollisionError"):
317
logger.info("Local Zeroconf service name collision.")
318
return self.rename(remove=False)
319
else:
320
logger.critical("D-Bus Exception", exc_info=error)
321
self.cleanup()
322
os._exit(1)
323
177
324
def remove(self):
178
325
"""Derived from the Avahi example code"""
179
326
if self.entry_group_state_changed_match is not None:
181
328
self.entry_group_state_changed_match = None
182
329
if self.group is not None:
183
330
self.group.Reset()
331
184
332
def add(self):
185
333
"""Derived from the Avahi example code"""
186
334
self.remove()
191
339
avahi.DBUS_INTERFACE_ENTRY_GROUP)
192
340
self.entry_group_state_changed_match = (
193
341
self.group.connect_to_signal(
194
'StateChanged', self .entry_group_state_changed))
342
'StateChanged', self.entry_group_state_changed))
195
343
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
196
344
self.name, self.type)
197
345
self.group.AddService(
203
351
dbus.UInt16(self.port),
204
352
avahi.string_array_to_txt_array(self.TXT))
205
353
self.group.Commit()
354
206
355
def entry_group_state_changed(self, state, error):
207
356
"""Derived from the Avahi example code"""
208
357
logger.debug("Avahi entry group state change: %i", state)
214
363
self.rename()
215
364
elif state == avahi.ENTRY_GROUP_FAILURE:
216
365
logger.critical("Avahi: Error in group state changed %s",
217
unicode(error))
218
raise AvahiGroupError("State changed: %s"
219
% unicode(error))
366
str(error))
367
raise AvahiGroupError("State changed: {!s}".format(error))
368
220
369
def cleanup(self):
221
370
"""Derived from the Avahi example code"""
222
371
if self.group is not None:
223
372
try:
224
373
self.group.Free()
225
374
except (dbus.exceptions.UnknownMethodException,
226
dbus.exceptions.DBusException) as e:
375
dbus.exceptions.DBusException):
227
376
pass
228
377
self.group = None
229
378
self.remove()
379
230
380
def server_state_changed(self, state, error=None):
231
381
"""Derived from the Avahi example code"""
232
382
logger.debug("Avahi server state change: %i", state)
233
bad_states = { avahi.SERVER_INVALID:
234
"Zeroconf server invalid",
235
avahi.SERVER_REGISTERING: None,
236
avahi.SERVER_COLLISION:
237
"Zeroconf server name collision",
238
avahi.SERVER_FAILURE:
239
"Zeroconf server failure" }
383
bad_states = {
384
avahi.SERVER_INVALID: "Zeroconf server invalid",
385
avahi.SERVER_REGISTERING: None,
386
avahi.SERVER_COLLISION: "Zeroconf server name collision",
387
avahi.SERVER_FAILURE: "Zeroconf server failure",
388
}
240
389
if state in bad_states:
241
390
if bad_states[state] is not None:
242
391
if error is None:
251
400
logger.debug("Unknown state: %r", state)
252
401
else:
253
402
logger.debug("Unknown state: %r: %r", state, error)
403
254
404
def activate(self):
255
405
"""Derived from the Avahi example code"""
256
406
if self.server is None:
260
410
follow_name_owner_changes=True),
261
411
avahi.DBUS_INTERFACE_SERVER)
262
412
self.server.connect_to_signal("StateChanged",
263
self.server_state_changed)
413
self.server_state_changed)
264
414
self.server_state_changed(self.server.GetState())
265
415
266
416
417
class AvahiServiceToSyslog(AvahiService):
418
def rename(self, *args, **kwargs):
419
"""Add the new name to the syslog messages"""
420
ret = AvahiService.rename(self, *args, **kwargs)
421
syslogger.setFormatter(logging.Formatter(
422
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
423
.format(self.name)))
424
return ret
425
426
267
427
class Client(object):
268
428
"""A representation of a client host served by this server.
269
429
270
430
Attributes:
271
_approved: bool(); 'None' if not yet approved/disapproved
431
approved: bool(); 'None' if not yet approved/disapproved
272
432
approval_delay: datetime.timedelta(); Time to wait for approval
273
433
approval_duration: datetime.timedelta(); Duration of one approval
274
434
checker: subprocess.Popen(); a running checker process used
281
441
instance %(name)s can be used in the command.
282
442
checker_initiator_tag: a gobject event source tag, or None
283
443
created: datetime.datetime(); (UTC) object creation
444
client_structure: Object describing what attributes a client has
445
and is used for storing the client at exit
284
446
current_checker_command: string; current running checker_command
285
disable_hook: If set, called by disable() as disable_hook(self)
286
447
disable_initiator_tag: a gobject event source tag, or None
287
448
enabled: bool()
288
449
fingerprint: string (40 or 32 hexadecimal digits); used to
291
452
interval: datetime.timedelta(); How often to start a new checker
292
453
last_approval_request: datetime.datetime(); (UTC) or None
293
454
last_checked_ok: datetime.datetime(); (UTC) or None
294
last_enabled: datetime.datetime(); (UTC)
455
last_checker_status: integer between 0 and 255 reflecting exit
456
status of last checker. -1 reflects crashed
457
checker, -2 means no checker completed yet.
458
last_enabled: datetime.datetime(); (UTC) or None
295
459
name: string; from the config file, used in log messages and
296
460
D-Bus identifiers
297
461
secret: bytestring; sent verbatim (over TLS) to client
298
462
timeout: datetime.timedelta(); How long from last_checked_ok
299
463
until this client is disabled
464
extended_timeout: extra long timeout when secret has been sent
300
465
runtime_expansions: Allowed attributes for runtime expansion.
466
expires: datetime.datetime(); time (UTC) when a client will be
467
disabled, or None
468
server_settings: The server_settings dict from main()
301
469
"""
302
470
303
471
runtime_expansions = ("approval_delay", "approval_duration",
304
"created", "enabled", "fingerprint",
305
"host", "interval", "last_checked_ok",
472
"created", "enabled", "expires",
473
"fingerprint", "host", "interval",
474
"last_approval_request", "last_checked_ok",
306
475
"last_enabled", "name", "timeout")
476
client_defaults = {
477
"timeout": "PT5M",
478
"extended_timeout": "PT15M",
479
"interval": "PT2M",
480
"checker": "fping -q -- %%(host)s",
481
"host": "",
482
"approval_delay": "PT0S",
483
"approval_duration": "PT1S",
484
"approved_by_default": "True",
485
"enabled": "True",
486
}
307
487
308
488
@staticmethod
309
def _timedelta_to_milliseconds(td):
310
"Convert a datetime.timedelta() to milliseconds"
311
return ((td.days * 24 * 60 * 60 * 1000)
312
+ (td.seconds * 1000)
313
+ (td.microseconds // 1000))
314
315
def timeout_milliseconds(self):
316
"Return the 'timeout' attribute in milliseconds"
317
return self._timedelta_to_milliseconds(self.timeout)
318
319
def interval_milliseconds(self):
320
"Return the 'interval' attribute in milliseconds"
321
return self._timedelta_to_milliseconds(self.interval)
322
323
def approval_delay_milliseconds(self):
324
return self._timedelta_to_milliseconds(self.approval_delay)
325
326
def __init__(self, name = None, disable_hook=None, config=None):
327
"""Note: the 'checker' key in 'config' sets the
328
'checker_command' attribute and *not* the 'checker'
329
attribute."""
489
def config_parser(config):
490
"""Construct a new dict of client settings of this form:
491
{ client_name: {setting_name: value, ...}, ...}
492
with exceptions for any special settings as defined above.
493
NOTE: Must be a pure function. Must return the same result
494
value given the same arguments.
495
"""
496
settings = {}
497
for client_name in config.sections():
498
section = dict(config.items(client_name))
499
client = settings[client_name] = {}
500
501
client["host"] = section["host"]
502
# Reformat values from string types to Python types
503
client["approved_by_default"] = config.getboolean(
504
client_name, "approved_by_default")
505
client["enabled"] = config.getboolean(client_name,
506
"enabled")
507
508
# Uppercase and remove spaces from fingerprint for later
509
# comparison purposes with return value from the
510
# fingerprint() function
511
client["fingerprint"] = (section["fingerprint"].upper()
512
.replace(" ", ""))
513
if "secret" in section:
514
client["secret"] = section["secret"].decode("base64")
515
elif "secfile" in section:
516
with open(os.path.expanduser(os.path.expandvars
517
(section["secfile"])),
518
"rb") as secfile:
519
client["secret"] = secfile.read()
520
else:
521
raise TypeError("No secret or secfile for section {}"
522
.format(section))
523
client["timeout"] = string_to_delta(section["timeout"])
524
client["extended_timeout"] = string_to_delta(
525
section["extended_timeout"])
526
client["interval"] = string_to_delta(section["interval"])
527
client["approval_delay"] = string_to_delta(
528
section["approval_delay"])
529
client["approval_duration"] = string_to_delta(
530
section["approval_duration"])
531
client["checker_command"] = section["checker"]
532
client["last_approval_request"] = None
533
client["last_checked_ok"] = None
534
client["last_checker_status"] = -2
535
536
return settings
537
538
def __init__(self, settings, name = None, server_settings=None):
330
539
self.name = name
331
if config is None:
332
config = {}
540
if server_settings is None:
541
server_settings = {}
542
self.server_settings = server_settings
543
# adding all client settings
544
for setting, value in settings.items():
545
setattr(self, setting, value)
546
547
if self.enabled:
548
if not hasattr(self, "last_enabled"):
549
self.last_enabled = datetime.datetime.utcnow()
550
if not hasattr(self, "expires"):
551
self.expires = (datetime.datetime.utcnow()
552
+ self.timeout)
553
else:
554
self.last_enabled = None
555
self.expires = None
556
333
557
logger.debug("Creating client %r", self.name)
334
# Uppercase and remove spaces from fingerprint for later
335
# comparison purposes with return value from the fingerprint()
336
# function
337
self.fingerprint = (config["fingerprint"].upper()
338
.replace(" ", ""))
339
558
logger.debug(" Fingerprint: %s", self.fingerprint)
340
if "secret" in config:
341
self.secret = config["secret"].decode("base64")
342
elif "secfile" in config:
343
with open(os.path.expanduser(os.path.expandvars
344
(config["secfile"])),
345
"rb") as secfile:
346
self.secret = secfile.read()
347
else:
348
raise TypeError("No secret or secfile for client %s"
349
% self.name)
350
self.host = config.get("host", "")
351
self.created = datetime.datetime.utcnow()
352
self.enabled = False
353
self.last_approval_request = None
354
self.last_enabled = None
355
self.last_checked_ok = None
356
self.timeout = string_to_delta(config["timeout"])
357
self.interval = string_to_delta(config["interval"])
358
self.disable_hook = disable_hook
559
self.created = settings.get("created",
560
datetime.datetime.utcnow())
561
562
# attributes specific for this server instance
359
563
self.checker = None
360
564
self.checker_initiator_tag = None
361
565
self.disable_initiator_tag = None
362
566
self.checker_callback_tag = None
363
self.checker_command = config["checker"]
364
567
self.current_checker_command = None
365
self.last_connect = None
366
self._approved = None
367
self.approved_by_default = config.get("approved_by_default",
368
True)
568
self.approved = None
369
569
self.approvals_pending = 0
370
self.approval_delay = string_to_delta(
371
config["approval_delay"])
372
self.approval_duration = string_to_delta(
373
config["approval_duration"])
374
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
570
self.changedstate = multiprocessing_manager.Condition(
571
multiprocessing_manager.Lock())
572
self.client_structure = [attr
573
for attr in self.__dict__.iterkeys()
574
if not attr.startswith("_")]
575
self.client_structure.append("client_structure")
576
577
for name, t in inspect.getmembers(
578
type(self), lambda obj: isinstance(obj, property)):
579
if not name.startswith("_"):
580
self.client_structure.append(name)
375
581
582
# Send notice to process children that client state has changed
376
583
def send_changedstate(self):
377
self.changedstate.acquire()
378
self.changedstate.notify_all()
379
self.changedstate.release()
380
584
with self.changedstate:
585
self.changedstate.notify_all()
586
381
587
def enable(self):
382
588
"""Start this client's checker and timeout hooks"""
383
589
if getattr(self, "enabled", False):
384
590
# Already enabled
385
591
return
386
self.send_changedstate()
592
self.expires = datetime.datetime.utcnow() + self.timeout
593
self.enabled = True
387
594
self.last_enabled = datetime.datetime.utcnow()
388
# Schedule a new checker to be started an 'interval' from now,
389
# and every interval from then on.
390
self.checker_initiator_tag = (gobject.timeout_add
391
(self.interval_milliseconds(),
392
self.start_checker))
393
# Schedule a disable() when 'timeout' has passed
394
self.disable_initiator_tag = (gobject.timeout_add
395
(self.timeout_milliseconds(),
396
self.disable))
397
self.enabled = True
398
# Also start a new checker *right now*.
399
self.start_checker()
595
self.init_checker()
596
self.send_changedstate()
400
597
401
598
def disable(self, quiet=True):
402
599
"""Disable this client."""
403
600
if not getattr(self, "enabled", False):
404
601
return False
405
602
if not quiet:
406
self.send_changedstate()
407
if not quiet:
408
603
logger.info("Disabling client %s", self.name)
409
if getattr(self, "disable_initiator_tag", False):
604
if getattr(self, "disable_initiator_tag", None) is not None:
410
605
gobject.source_remove(self.disable_initiator_tag)
411
606
self.disable_initiator_tag = None
412
if getattr(self, "checker_initiator_tag", False):
607
self.expires = None
608
if getattr(self, "checker_initiator_tag", None) is not None:
413
609
gobject.source_remove(self.checker_initiator_tag)
414
610
self.checker_initiator_tag = None
415
611
self.stop_checker()
416
if self.disable_hook:
417
self.disable_hook(self)
418
612
self.enabled = False
613
if not quiet:
614
self.send_changedstate()
419
615
# Do not run this again if called by a gobject.timeout_add
420
616
return False
421
617
422
618
def __del__(self):
423
self.disable_hook = None
424
619
self.disable()
425
620
621
def init_checker(self):
622
# Schedule a new checker to be started an 'interval' from now,
623
# and every interval from then on.
624
if self.checker_initiator_tag is not None:
625
gobject.source_remove(self.checker_initiator_tag)
626
self.checker_initiator_tag = gobject.timeout_add(
627
int(self.interval.total_seconds() * 1000),
628
self.start_checker)
629
# Schedule a disable() when 'timeout' has passed
630
if self.disable_initiator_tag is not None:
631
gobject.source_remove(self.disable_initiator_tag)
632
self.disable_initiator_tag = gobject.timeout_add(
633
int(self.timeout.total_seconds() * 1000), self.disable)
634
# Also start a new checker *right now*.
635
self.start_checker()
636
426
637
def checker_callback(self, pid, condition, command):
427
638
"""The checker has completed, so take appropriate actions."""
428
639
self.checker_callback_tag = None
429
640
self.checker = None
430
641
if os.WIFEXITED(condition):
431
exitstatus = os.WEXITSTATUS(condition)
432
if exitstatus == 0:
642
self.last_checker_status = os.WEXITSTATUS(condition)
643
if self.last_checker_status == 0:
433
644
logger.info("Checker for %(name)s succeeded",
434
645
vars(self))
435
646
self.checked_ok()
436
647
else:
437
logger.info("Checker for %(name)s failed",
438
vars(self))
648
logger.info("Checker for %(name)s failed", vars(self))
439
649
else:
650
self.last_checker_status = -1
440
651
logger.warning("Checker for %(name)s crashed?",
441
652
vars(self))
442
653
443
654
def checked_ok(self):
444
"""Bump up the timeout for this client.
445
446
This should only be called when the client has been seen,
447
alive and well.
448
"""
655
"""Assert that the client has been seen, alive and well."""
449
656
self.last_checked_ok = datetime.datetime.utcnow()
450
gobject.source_remove(self.disable_initiator_tag)
451
self.disable_initiator_tag = (gobject.timeout_add
452
(self.timeout_milliseconds(),
453
self.disable))
657
self.last_checker_status = 0
658
self.bump_timeout()
659
660
def bump_timeout(self, timeout=None):
661
"""Bump up the timeout for this client."""
662
if timeout is None:
663
timeout = self.timeout
664
if self.disable_initiator_tag is not None:
665
gobject.source_remove(self.disable_initiator_tag)
666
self.disable_initiator_tag = None
667
if getattr(self, "enabled", False):
668
self.disable_initiator_tag = gobject.timeout_add(
669
int(timeout.total_seconds() * 1000), self.disable)
670
self.expires = datetime.datetime.utcnow() + timeout
454
671
455
672
def need_approval(self):
456
673
self.last_approval_request = datetime.datetime.utcnow()
461
678
If a checker already exists, leave it running and do
462
679
nothing."""
463
680
# The reason for not killing a running checker is that if we
464
# did that, then if a checker (for some reason) started
465
# running slowly and taking more than 'interval' time, the
466
# client would inevitably timeout, since no checker would get
467
# a chance to run to completion. If we instead leave running
681
# did that, and if a checker (for some reason) started running
682
# slowly and taking more than 'interval' time, then the client
683
# would inevitably timeout, since no checker would get a
684
# chance to run to completion. If we instead leave running
468
685
# checkers alone, the checker would have to take more time
469
686
# than 'timeout' for the client to be disabled, which is as it
470
687
# should be.
472
689
# If a checker exists, make sure it is not a zombie
473
690
try:
474
691
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
475
except (AttributeError, OSError) as error:
476
if (isinstance(error, OSError)
477
and error.errno != errno.ECHILD):
478
raise error
692
except AttributeError:
693
pass
694
except OSError as error:
695
if error.errno != errno.ECHILD:
696
raise
479
697
else:
480
698
if pid:
481
699
logger.warning("Checker was a zombie")
484
702
self.current_checker_command)
485
703
# Start a new checker if needed
486
704
if self.checker is None:
705
# Escape attributes for the shell
706
escaped_attrs = {
707
attr: re.escape(str(getattr(self, attr)))
708
for attr in self.runtime_expansions }
487
709
try:
488
# In case checker_command has exactly one % operator
489
command = self.checker_command % self.host
490
except TypeError:
491
# Escape attributes for the shell
492
escaped_attrs = dict(
493
(attr,
494
re.escape(unicode(str(getattr(self, attr, "")),
495
errors=
496
'replace')))
497
for attr in
498
self.runtime_expansions)
499
500
try:
501
command = self.checker_command % escaped_attrs
502
except TypeError as error:
503
logger.error('Could not format string "%s":'
504
' %s', self.checker_command, error)
505
return True # Try again later
710
command = self.checker_command % escaped_attrs
711
except TypeError as error:
712
logger.error('Could not format string "%s"',
713
self.checker_command,
714
exc_info=error)
715
return True # Try again later
506
716
self.current_checker_command = command
507
717
try:
508
logger.info("Starting checker %r for %s",
509
command, self.name)
718
logger.info("Starting checker %r for %s", command,
719
self.name)
510
720
# We don't need to redirect stdout and stderr, since
511
721
# in normal mode, that is already done by daemon(),
512
722
# and in debug mode we don't want to. (Stdin is
513
723
# always replaced by /dev/null.)
724
# The exception is when not debugging but nevertheless
725
# running in the foreground; use the previously
726
# created wnull.
727
popen_args = {}
728
if (not self.server_settings["debug"]
729
and self.server_settings["foreground"]):
730
popen_args.update({"stdout": wnull,
731
"stderr": wnull })
514
732
self.checker = subprocess.Popen(command,
515
733
close_fds=True,
516
shell=True, cwd="/")
517
self.checker_callback_tag = (gobject.child_watch_add
518
(self.checker.pid,
519
self.checker_callback,
520
data=command))
521
# The checker may have completed before the gobject
522
# watch was added. Check for this.
734
shell=True,
735
cwd="/",
736
**popen_args)
737
except OSError as error:
738
logger.error("Failed to start subprocess",
739
exc_info=error)
740
return True
741
self.checker_callback_tag = gobject.child_watch_add(
742
self.checker.pid, self.checker_callback, data=command)
743
# The checker may have completed before the gobject
744
# watch was added. Check for this.
745
try:
523
746
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
524
if pid:
525
gobject.source_remove(self.checker_callback_tag)
526
self.checker_callback(pid, status, command)
527
747
except OSError as error:
528
logger.error("Failed to start subprocess: %s",
529
error)
748
if error.errno == errno.ECHILD:
749
# This should never happen
750
logger.error("Child process vanished",
751
exc_info=error)
752
return True
753
raise
754
if pid:
755
gobject.source_remove(self.checker_callback_tag)
756
self.checker_callback(pid, status, command)
530
757
# Re-run this periodically if run by gobject.timeout_add
531
758
return True
532
759
539
766
return
540
767
logger.debug("Stopping checker for %(name)s", vars(self))
541
768
try:
542
os.kill(self.checker.pid, signal.SIGTERM)
769
self.checker.terminate()
543
770
#time.sleep(0.5)
544
771
#if self.checker.poll() is None:
545
# os.kill(self.checker.pid, signal.SIGKILL)
772
# self.checker.kill()
546
773
except OSError as error:
547
774
if error.errno != errno.ESRCH: # No such process
548
775
raise
549
776
self.checker = None
550
777
551
def dbus_service_property(dbus_interface, signature="v",
552
access="readwrite", byte_arrays=False):
778
779
def dbus_service_property(dbus_interface,
780
signature="v",
781
access="readwrite",
782
byte_arrays=False):
553
783
"""Decorators for marking methods of a DBusObjectWithProperties to
554
784
become properties on the D-Bus.
555
785
564
794
# "Set" method, so we fail early here:
565
795
if byte_arrays and signature != "ay":
566
796
raise ValueError("Byte arrays not supported for non-'ay'"
567
" signature %r" % signature)
797
" signature {!r}".format(signature))
798
568
799
def decorator(func):
569
800
func._dbus_is_property = True
570
801
func._dbus_interface = dbus_interface
575
806
func._dbus_name = func._dbus_name[:-14]
576
807
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
577
808
return func
809
810
return decorator
811
812
813
def dbus_interface_annotations(dbus_interface):
814
"""Decorator for marking functions returning interface annotations
815
816
Usage:
817
818
@dbus_interface_annotations("org.example.Interface")
819
def _foo(self): # Function name does not matter
820
return {"org.freedesktop.DBus.Deprecated": "true",
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
822
"false"}
823
"""
824
825
def decorator(func):
826
func._dbus_is_interface = True
827
func._dbus_interface = dbus_interface
828
func._dbus_name = dbus_interface
829
return func
830
831
return decorator
832
833
834
def dbus_annotations(annotations):
835
"""Decorator to annotate D-Bus methods, signals or properties
836
Usage:
837
838
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
841
@dbus_service_property("org.example.Interface", signature="b",
842
access="r")
843
def Property_dbus_property(self):
844
return dbus.Boolean(False)
845
"""
846
847
def decorator(func):
848
func._dbus_annotations = annotations
849
return func
850
578
851
return decorator
579
852
580
853
581
854
class DBusPropertyException(dbus.exceptions.DBusException):
582
855
"""A base class for D-Bus property-related exceptions
583
856
"""
584
def __unicode__(self):
585
return unicode(str(self))
857
pass
586
858
587
859
588
860
class DBusPropertyAccessException(DBusPropertyException):
599
871
600
872
class DBusObjectWithProperties(dbus.service.Object):
601
873
"""A D-Bus object with properties.
602
874
603
875
Classes inheriting from this can use the dbus_service_property
604
876
decorator to expose methods as D-Bus properties. It exposes the
605
877
standard Get(), Set(), and GetAll() methods on the D-Bus.
606
878
"""
607
879
608
880
@staticmethod
609
def _is_dbus_property(obj):
610
return getattr(obj, "_dbus_is_property", False)
881
def _is_dbus_thing(thing):
882
"""Returns a function testing if an attribute is a D-Bus thing
883
884
If called like _is_dbus_thing("method") it returns a function
885
suitable for use as predicate to inspect.getmembers().
886
"""
887
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
888
False)
611
889
612
def _get_all_dbus_properties(self):
890
def _get_all_dbus_things(self, thing):
613
891
"""Returns a generator of (name, attribute) pairs
614
892
"""
615
return ((prop._dbus_name, prop)
616
for name, prop in
617
inspect.getmembers(self, self._is_dbus_property))
893
return ((getattr(athing.__get__(self), "_dbus_name", name),
894
athing.__get__(self))
895
for cls in self.__class__.__mro__
896
for name, athing in
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
618
898
619
899
def _get_dbus_property(self, interface_name, property_name):
620
900
"""Returns a bound method if one exists which is a D-Bus
621
901
property with the specified name and interface.
622
902
"""
623
for name in (property_name,
624
property_name + "_dbus_property"):
625
prop = getattr(self, name, None)
626
if (prop is None
627
or not self._is_dbus_property(prop)
628
or prop._dbus_name != property_name
629
or (interface_name and prop._dbus_interface
630
and interface_name != prop._dbus_interface)):
631
continue
632
return prop
903
for cls in self.__class__.__mro__:
904
for name, value in inspect.getmembers(
905
cls, self._is_dbus_thing("property")):
906
if (value._dbus_name == property_name
907
and value._dbus_interface == interface_name):
908
return value.__get__(self)
909
633
910
# No such property
634
raise DBusPropertyNotFound(self.dbus_object_path + ":"
635
+ interface_name + "."
636
+ property_name)
911
raise DBusPropertyNotFound("{}:{}.{}".format(
912
self.dbus_object_path, interface_name, property_name))
637
913
638
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
914
@dbus.service.method(dbus.PROPERTIES_IFACE,
915
in_signature="ss",
639
916
out_signature="v")
640
917
def Get(self, interface_name, property_name):
641
918
"""Standard D-Bus property Get() method, see D-Bus standard.
659
936
# The byte_arrays option is not supported yet on
660
937
# signatures other than "ay".
661
938
if prop._dbus_signature != "ay":
662
raise ValueError
663
value = dbus.ByteArray(''.join(unichr(byte)
664
for byte in value))
939
raise ValueError("Byte arrays not supported for non-"
940
"'ay' signature {!r}"
941
.format(prop._dbus_signature))
942
value = dbus.ByteArray(b''.join(chr(byte)
943
for byte in value))
665
944
prop(value)
666
945
667
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
946
@dbus.service.method(dbus.PROPERTIES_IFACE,
947
in_signature="s",
668
948
out_signature="a{sv}")
669
949
def GetAll(self, interface_name):
670
950
"""Standard D-Bus property GetAll() method, see D-Bus
671
951
standard.
672
952
673
953
Note: Will not include properties with access="write".
674
954
"""
675
all = {}
676
for name, prop in self._get_all_dbus_properties():
955
properties = {}
956
for name, prop in self._get_all_dbus_things("property"):
677
957
if (interface_name
678
958
and interface_name != prop._dbus_interface):
679
959
# Interface non-empty but did not match
683
963
continue
684
964
value = prop()
685
965
if not hasattr(value, "variant_level"):
686
all[name] = value
966
properties[name] = value
687
967
continue
688
all[name] = type(value)(value, variant_level=
689
value.variant_level+1)
690
return dbus.Dictionary(all, signature="sv")
968
properties[name] = type(value)(
969
value, variant_level = value.variant_level + 1)
970
return dbus.Dictionary(properties, signature="sv")
971
972
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
def PropertiesChanged(self, interface_name, changed_properties,
974
invalidated_properties):
975
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
976
standard.
977
"""
978
pass
691
979
692
980
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
693
981
out_signature="s",
694
982
path_keyword='object_path',
695
983
connection_keyword='connection')
696
984
def Introspect(self, object_path, connection):
697
"""Standard D-Bus method, overloaded to insert property tags.
985
"""Overloading of standard D-Bus method.
986
987
Inserts property tags and interface annotation tags.
698
988
"""
699
989
xmlstring = dbus.service.Object.Introspect(self, object_path,
700
990
connection)
701
991
try:
702
992
document = xml.dom.minidom.parseString(xmlstring)
993
703
994
def make_tag(document, name, prop):
704
995
e = document.createElement("property")
705
996
e.setAttribute("name", name)
706
997
e.setAttribute("type", prop._dbus_signature)
707
998
e.setAttribute("access", prop._dbus_access)
708
999
return e
1000
709
1001
for if_tag in document.getElementsByTagName("interface"):
1002
# Add property tags
710
1003
for tag in (make_tag(document, name, prop)
711
1004
for name, prop
712
in self._get_all_dbus_properties()
1005
in self._get_all_dbus_things("property")
713
1006
if prop._dbus_interface
714
1007
== if_tag.getAttribute("name")):
715
1008
if_tag.appendChild(tag)
1009
# Add annotation tags
1010
for typ in ("method", "signal", "property"):
1011
for tag in if_tag.getElementsByTagName(typ):
1012
annots = dict()
1013
for name, prop in (self.
1014
_get_all_dbus_things(typ)):
1015
if (name == tag.getAttribute("name")
1016
and prop._dbus_interface
1017
== if_tag.getAttribute("name")):
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1020
for name, value in annots.items():
1021
ann_tag = document.createElement(
1022
"annotation")
1023
ann_tag.setAttribute("name", name)
1024
ann_tag.setAttribute("value", value)
1025
tag.appendChild(ann_tag)
1026
# Add interface annotation tags
1027
for annotation, value in dict(
1028
itertools.chain.from_iterable(
1029
annotations().items()
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1032
if name == if_tag.getAttribute("name")
1033
)).items():
1034
ann_tag = document.createElement("annotation")
1035
ann_tag.setAttribute("name", annotation)
1036
ann_tag.setAttribute("value", value)
1037
if_tag.appendChild(ann_tag)
716
1038
# Add the names to the return values for the
717
1039
# "org.freedesktop.DBus.Properties" methods
718
1040
if (if_tag.getAttribute("name")
733
1055
except (AttributeError, xml.dom.DOMException,
734
1056
xml.parsers.expat.ExpatError) as error:
735
1057
logger.error("Failed to override Introspection method",
736
error)
1058
exc_info=error)
737
1059
return xmlstring
738
1060
739
1061
1062
def datetime_to_dbus(dt, variant_level=0):
1063
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1064
if dt is None:
1065
return dbus.String("", variant_level = variant_level)
1066
return dbus.String(dt.isoformat(), variant_level=variant_level)
1067
1068
1069
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1070
"""A class decorator; applied to a subclass of
1071
dbus.service.Object, it will add alternate D-Bus attributes with
1072
interface names according to the "alt_interface_names" mapping.
1073
Usage:
1074
1075
@alternate_dbus_interfaces({"org.example.Interface":
1076
"net.example.AlternateInterface"})
1077
class SampleDBusObject(dbus.service.Object):
1078
@dbus.service.method("org.example.Interface")
1079
def SampleDBusMethod():
1080
pass
1081
1082
The above "SampleDBusMethod" on "SampleDBusObject" will be
1083
reachable via two interfaces: "org.example.Interface" and
1084
"net.example.AlternateInterface", the latter of which will have
1085
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1086
"true", unless "deprecate" is passed with a False value.
1087
1088
This works for methods and signals, and also for D-Bus properties
1089
(from DBusObjectWithProperties) and interfaces (from the
1090
dbus_interface_annotations decorator).
1091
"""
1092
1093
def wrapper(cls):
1094
for orig_interface_name, alt_interface_name in (
1095
alt_interface_names.items()):
1096
attr = {}
1097
interface_names = set()
1098
# Go though all attributes of the class
1099
for attrname, attribute in inspect.getmembers(cls):
1100
# Ignore non-D-Bus attributes, and D-Bus attributes
1101
# with the wrong interface name
1102
if (not hasattr(attribute, "_dbus_interface")
1103
or not attribute._dbus_interface.startswith(
1104
orig_interface_name)):
1105
continue
1106
# Create an alternate D-Bus interface name based on
1107
# the current name
1108
alt_interface = attribute._dbus_interface.replace(
1109
orig_interface_name, alt_interface_name)
1110
interface_names.add(alt_interface)
1111
# Is this a D-Bus signal?
1112
if getattr(attribute, "_dbus_is_signal", False):
1113
# Extract the original non-method undecorated
1114
# function by black magic
1115
nonmethod_func = (dict(
1116
zip(attribute.func_code.co_freevars,
1117
attribute.__closure__))
1118
["func"].cell_contents)
1119
# Create a new, but exactly alike, function
1120
# object, and decorate it to be a new D-Bus signal
1121
# with the alternate D-Bus interface name
1122
new_function = (dbus.service.signal(
1123
alt_interface, attribute._dbus_signature)
1124
(types.FunctionType(
1125
nonmethod_func.func_code,
1126
nonmethod_func.func_globals,
1127
nonmethod_func.func_name,
1128
nonmethod_func.func_defaults,
1129
nonmethod_func.func_closure)))
1130
# Copy annotations, if any
1131
try:
1132
new_function._dbus_annotations = dict(
1133
attribute._dbus_annotations)
1134
except AttributeError:
1135
pass
1136
# Define a creator of a function to call both the
1137
# original and alternate functions, so both the
1138
# original and alternate signals gets sent when
1139
# the function is called
1140
def fixscope(func1, func2):
1141
"""This function is a scope container to pass
1142
func1 and func2 to the "call_both" function
1143
outside of its arguments"""
1144
1145
def call_both(*args, **kwargs):
1146
"""This function will emit two D-Bus
1147
signals by calling func1 and func2"""
1148
func1(*args, **kwargs)
1149
func2(*args, **kwargs)
1150
1151
return call_both
1152
# Create the "call_both" function and add it to
1153
# the class
1154
attr[attrname] = fixscope(attribute, new_function)
1155
# Is this a D-Bus method?
1156
elif getattr(attribute, "_dbus_is_method", False):
1157
# Create a new, but exactly alike, function
1158
# object. Decorate it to be a new D-Bus method
1159
# with the alternate D-Bus interface name. Add it
1160
# to the class.
1161
attr[attrname] = (
1162
dbus.service.method(
1163
alt_interface,
1164
attribute._dbus_in_signature,
1165
attribute._dbus_out_signature)
1166
(types.FunctionType(attribute.func_code,
1167
attribute.func_globals,
1168
attribute.func_name,
1169
attribute.func_defaults,
1170
attribute.func_closure)))
1171
# Copy annotations, if any
1172
try:
1173
attr[attrname]._dbus_annotations = dict(
1174
attribute._dbus_annotations)
1175
except AttributeError:
1176
pass
1177
# Is this a D-Bus property?
1178
elif getattr(attribute, "_dbus_is_property", False):
1179
# Create a new, but exactly alike, function
1180
# object, and decorate it to be a new D-Bus
1181
# property with the alternate D-Bus interface
1182
# name. Add it to the class.
1183
attr[attrname] = (dbus_service_property(
1184
alt_interface, attribute._dbus_signature,
1185
attribute._dbus_access,
1186
attribute._dbus_get_args_options
1187
["byte_arrays"])
1188
(types.FunctionType(
1189
attribute.func_code,
1190
attribute.func_globals,
1191
attribute.func_name,
1192
attribute.func_defaults,
1193
attribute.func_closure)))
1194
# Copy annotations, if any
1195
try:
1196
attr[attrname]._dbus_annotations = dict(
1197
attribute._dbus_annotations)
1198
except AttributeError:
1199
pass
1200
# Is this a D-Bus interface?
1201
elif getattr(attribute, "_dbus_is_interface", False):
1202
# Create a new, but exactly alike, function
1203
# object. Decorate it to be a new D-Bus interface
1204
# with the alternate D-Bus interface name. Add it
1205
# to the class.
1206
attr[attrname] = (
1207
dbus_interface_annotations(alt_interface)
1208
(types.FunctionType(attribute.func_code,
1209
attribute.func_globals,
1210
attribute.func_name,
1211
attribute.func_defaults,
1212
attribute.func_closure)))
1213
if deprecate:
1214
# Deprecate all alternate interfaces
1215
iname="_AlternateDBusNames_interface_annotation{}"
1216
for interface_name in interface_names:
1217
1218
@dbus_interface_annotations(interface_name)
1219
def func(self):
1220
return { "org.freedesktop.DBus.Deprecated":
1221
"true" }
1222
# Find an unused name
1223
for aname in (iname.format(i)
1224
for i in itertools.count()):
1225
if aname not in attr:
1226
attr[aname] = func
1227
break
1228
if interface_names:
1229
# Replace the class with a new subclass of it with
1230
# methods, signals, etc. as created above.
1231
cls = type(b"{}Alternate".format(cls.__name__),
1232
(cls, ), attr)
1233
return cls
1234
1235
return wrapper
1236
1237
1238
@alternate_dbus_interfaces({"se.recompile.Mandos":
1239
"se.bsnet.fukt.Mandos"})
740
1240
class ClientDBus(Client, DBusObjectWithProperties):
741
1241
"""A Client class using D-Bus
742
1242
746
1246
"""
747
1247
748
1248
runtime_expansions = (Client.runtime_expansions
749
+ ("dbus_object_path",))
1249
+ ("dbus_object_path", ))
1250
1251
_interface = "se.recompile.Mandos.Client"
750
1252
751
1253
# dbus.service.Object doesn't use super(), so we can't either.
752
1254
753
1255
def __init__(self, bus = None, *args, **kwargs):
754
self._approvals_pending = 0
755
1256
self.bus = bus
756
1257
Client.__init__(self, *args, **kwargs)
757
1258
# Only now, when this client is initialized, can it show up on
758
1259
# the D-Bus
759
client_object_name = unicode(self.name).translate(
1260
client_object_name = str(self.name).translate(
760
1261
{ord("."): ord("_"),
761
1262
ord("-"): ord("_")})
762
self.dbus_object_path = (dbus.ObjectPath
763
("/clients/" + client_object_name))
1263
self.dbus_object_path = dbus.ObjectPath(
1264
"/clients/" + client_object_name)
764
1265
DBusObjectWithProperties.__init__(self, self.bus,
765
1266
self.dbus_object_path)
766
767
def _get_approvals_pending(self):
768
return self._approvals_pending
769
def _set_approvals_pending(self, value):
770
old_value = self._approvals_pending
771
self._approvals_pending = value
772
bval = bool(value)
773
if (hasattr(self, "dbus_object_path")
774
and bval is not bool(old_value)):
775
dbus_bool = dbus.Boolean(bval, variant_level=1)
776
self.PropertyChanged(dbus.String("ApprovalPending"),
777
dbus_bool)
778
779
approvals_pending = property(_get_approvals_pending,
780
_set_approvals_pending)
781
del _get_approvals_pending, _set_approvals_pending
782
783
@staticmethod
784
def _datetime_to_dbus(dt, variant_level=0):
785
"""Convert a UTC datetime.datetime() to a D-Bus type."""
786
return dbus.String(dt.isoformat(),
787
variant_level=variant_level)
788
789
def enable(self):
790
oldstate = getattr(self, "enabled", False)
791
r = Client.enable(self)
792
if oldstate != self.enabled:
793
# Emit D-Bus signals
794
self.PropertyChanged(dbus.String("Enabled"),
795
dbus.Boolean(True, variant_level=1))
796
self.PropertyChanged(
797
dbus.String("LastEnabled"),
798
self._datetime_to_dbus(self.last_enabled,
799
variant_level=1))
800
return r
801
802
def disable(self, quiet = False):
803
oldstate = getattr(self, "enabled", False)
804
r = Client.disable(self, quiet=quiet)
805
if not quiet and oldstate != self.enabled:
806
# Emit D-Bus signal
807
self.PropertyChanged(dbus.String("Enabled"),
808
dbus.Boolean(False, variant_level=1))
809
return r
1267
1268
def notifychangeproperty(transform_func, dbus_name,
1269
type_func=lambda x: x,
1270
variant_level=1,
1271
invalidate_only=False,
1272
_interface=_interface):
1273
""" Modify a variable so that it's a property which announces
1274
its changes to DBus.
1275
1276
transform_fun: Function that takes a value and a variant_level
1277
and transforms it to a D-Bus type.
1278
dbus_name: D-Bus name of the variable
1279
type_func: Function that transform the value before sending it
1280
to the D-Bus. Default: no transform
1281
variant_level: D-Bus variant level. Default: 1
1282
"""
1283
attrname = "_{}".format(dbus_name)
1284
1285
def setter(self, value):
1286
if hasattr(self, "dbus_object_path"):
1287
if (not hasattr(self, attrname) or
1288
type_func(getattr(self, attrname, None))
1289
!= type_func(value)):
1290
if invalidate_only:
1291
self.PropertiesChanged(
1292
_interface, dbus.Dictionary(),
1293
dbus.Array((dbus_name, )))
1294
else:
1295
dbus_value = transform_func(
1296
type_func(value),
1297
variant_level = variant_level)
1298
self.PropertyChanged(dbus.String(dbus_name),
1299
dbus_value)
1300
self.PropertiesChanged(
1301
_interface,
1302
dbus.Dictionary({ dbus.String(dbus_name):
1303
dbus_value }),
1304
dbus.Array())
1305
setattr(self, attrname, value)
1306
1307
return property(lambda self: getattr(self, attrname), setter)
1308
1309
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1310
approvals_pending = notifychangeproperty(dbus.Boolean,
1311
"ApprovalPending",
1312
type_func = bool)
1313
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1314
last_enabled = notifychangeproperty(datetime_to_dbus,
1315
"LastEnabled")
1316
checker = notifychangeproperty(
1317
dbus.Boolean, "CheckerRunning",
1318
type_func = lambda checker: checker is not None)
1319
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1320
"LastCheckedOK")
1321
last_checker_status = notifychangeproperty(dbus.Int16,
1322
"LastCheckerStatus")
1323
last_approval_request = notifychangeproperty(
1324
datetime_to_dbus, "LastApprovalRequest")
1325
approved_by_default = notifychangeproperty(dbus.Boolean,
1326
"ApprovedByDefault")
1327
approval_delay = notifychangeproperty(
1328
dbus.UInt64, "ApprovalDelay",
1329
type_func = lambda td: td.total_seconds() * 1000)
1330
approval_duration = notifychangeproperty(
1331
dbus.UInt64, "ApprovalDuration",
1332
type_func = lambda td: td.total_seconds() * 1000)
1333
host = notifychangeproperty(dbus.String, "Host")
1334
timeout = notifychangeproperty(
1335
dbus.UInt64, "Timeout",
1336
type_func = lambda td: td.total_seconds() * 1000)
1337
extended_timeout = notifychangeproperty(
1338
dbus.UInt64, "ExtendedTimeout",
1339
type_func = lambda td: td.total_seconds() * 1000)
1340
interval = notifychangeproperty(
1341
dbus.UInt64, "Interval",
1342
type_func = lambda td: td.total_seconds() * 1000)
1343
checker_command = notifychangeproperty(dbus.String, "Checker")
1344
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1345
invalidate_only=True)
1346
1347
del notifychangeproperty
810
1348
811
1349
def __del__(self, *args, **kwargs):
812
1350
try:
821
1359
*args, **kwargs):
822
1360
self.checker_callback_tag = None
823
1361
self.checker = None
824
# Emit D-Bus signal
825
self.PropertyChanged(dbus.String("CheckerRunning"),
826
dbus.Boolean(False, variant_level=1))
827
1362
if os.WIFEXITED(condition):
828
1363
exitstatus = os.WEXITSTATUS(condition)
829
1364
# Emit D-Bus signal
839
1374
return Client.checker_callback(self, pid, condition, command,
840
1375
*args, **kwargs)
841
1376
842
def checked_ok(self, *args, **kwargs):
843
Client.checked_ok(self, *args, **kwargs)
844
# Emit D-Bus signal
845
self.PropertyChanged(
846
dbus.String("LastCheckedOK"),
847
(self._datetime_to_dbus(self.last_checked_ok,
848
variant_level=1)))
849
850
def need_approval(self, *args, **kwargs):
851
r = Client.need_approval(self, *args, **kwargs)
852
# Emit D-Bus signal
853
self.PropertyChanged(
854
dbus.String("LastApprovalRequest"),
855
(self._datetime_to_dbus(self.last_approval_request,
856
variant_level=1)))
857
return r
858
859
1377
def start_checker(self, *args, **kwargs):
860
old_checker = self.checker
861
if self.checker is not None:
862
old_checker_pid = self.checker.pid
863
else:
864
old_checker_pid = None
1378
old_checker_pid = getattr(self.checker, "pid", None)
865
1379
r = Client.start_checker(self, *args, **kwargs)
866
1380
# Only if new checker process was started
867
1381
if (self.checker is not None
868
1382
and old_checker_pid != self.checker.pid):
869
1383
# Emit D-Bus signal
870
1384
self.CheckerStarted(self.current_checker_command)
871
self.PropertyChanged(
872
dbus.String("CheckerRunning"),
873
dbus.Boolean(True, variant_level=1))
874
1385
return r
875
1386
876
def stop_checker(self, *args, **kwargs):
877
old_checker = getattr(self, "checker", None)
878
r = Client.stop_checker(self, *args, **kwargs)
879
if (old_checker is not None
880
and getattr(self, "checker", None) is None):
881
self.PropertyChanged(dbus.String("CheckerRunning"),
882
dbus.Boolean(False, variant_level=1))
883
return r
884
885
1387
def _reset_approved(self):
886
self._approved = None
1388
self.approved = None
887
1389
return False
888
1390
889
1391
def approve(self, value=True):
1392
self.approved = value
1393
gobject.timeout_add(int(self.approval_duration.total_seconds()
1394
* 1000), self._reset_approved)
890
1395
self.send_changedstate()
891
self._approved = value
892
gobject.timeout_add(self._timedelta_to_milliseconds
893
(self.approval_duration),
894
self._reset_approved)
895
896
1396
897
1397
## D-Bus methods, signals & properties
898
_interface = "se.bsnet.fukt.Mandos.Client"
1398
1399
## Interfaces
899
1400
900
1401
## Signals
901
1402
912
1413
pass
913
1414
914
1415
# PropertyChanged - signal
1416
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
915
1417
@dbus.service.signal(_interface, signature="sv")
916
1418
def PropertyChanged(self, property, value):
917
1419
"D-Bus signal"
981
1483
return dbus.Boolean(bool(self.approvals_pending))
982
1484
983
1485
# ApprovedByDefault - property
984
@dbus_service_property(_interface, signature="b",
1486
@dbus_service_property(_interface,
1487
signature="b",
985
1488
access="readwrite")
986
1489
def ApprovedByDefault_dbus_property(self, value=None):
987
1490
if value is None: # get
988
1491
return dbus.Boolean(self.approved_by_default)
989
1492
self.approved_by_default = bool(value)
990
# Emit D-Bus signal
991
self.PropertyChanged(dbus.String("ApprovedByDefault"),
992
dbus.Boolean(value, variant_level=1))
993
1493
994
1494
# ApprovalDelay - property
995
@dbus_service_property(_interface, signature="t",
1495
@dbus_service_property(_interface,
1496
signature="t",
996
1497
access="readwrite")
997
1498
def ApprovalDelay_dbus_property(self, value=None):
998
1499
if value is None: # get
999
return dbus.UInt64(self.approval_delay_milliseconds())
1500
return dbus.UInt64(self.approval_delay.total_seconds()
1501
* 1000)
1000
1502
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1001
# Emit D-Bus signal
1002
self.PropertyChanged(dbus.String("ApprovalDelay"),
1003
dbus.UInt64(value, variant_level=1))
1004
1503
1005
1504
# ApprovalDuration - property
1006
@dbus_service_property(_interface, signature="t",
1505
@dbus_service_property(_interface,
1506
signature="t",
1007
1507
access="readwrite")
1008
1508
def ApprovalDuration_dbus_property(self, value=None):
1009
1509
if value is None: # get
1010
return dbus.UInt64(self._timedelta_to_milliseconds(
1011
self.approval_duration))
1510
return dbus.UInt64(self.approval_duration.total_seconds()
1511
* 1000)
1012
1512
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1013
# Emit D-Bus signal
1014
self.PropertyChanged(dbus.String("ApprovalDuration"),
1015
dbus.UInt64(value, variant_level=1))
1016
1513
1017
1514
# Name - property
1018
1515
@dbus_service_property(_interface, signature="s", access="read")
1025
1522
return dbus.String(self.fingerprint)
1026
1523
1027
1524
# Host - property
1028
@dbus_service_property(_interface, signature="s",
1525
@dbus_service_property(_interface,
1526
signature="s",
1029
1527
access="readwrite")
1030
1528
def Host_dbus_property(self, value=None):
1031
1529
if value is None: # get
1032
1530
return dbus.String(self.host)
1033
self.host = value
1034
# Emit D-Bus signal
1035
self.PropertyChanged(dbus.String("Host"),
1036
dbus.String(value, variant_level=1))
1531
self.host = str(value)
1037
1532
1038
1533
# Created - property
1039
1534
@dbus_service_property(_interface, signature="s", access="read")
1040
1535
def Created_dbus_property(self):
1041
return dbus.String(self._datetime_to_dbus(self.created))
1536
return datetime_to_dbus(self.created)
1042
1537
1043
1538
# LastEnabled - property
1044
1539
@dbus_service_property(_interface, signature="s", access="read")
1045
1540
def LastEnabled_dbus_property(self):
1046
if self.last_enabled is None:
1047
return dbus.String("")
1048
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1541
return datetime_to_dbus(self.last_enabled)
1049
1542
1050
1543
# Enabled - property
1051
@dbus_service_property(_interface, signature="b",
1544
@dbus_service_property(_interface,
1545
signature="b",
1052
1546
access="readwrite")
1053
1547
def Enabled_dbus_property(self, value=None):
1054
1548
if value is None: # get
1059
1553
self.disable()
1060
1554
1061
1555
# LastCheckedOK - property
1062
@dbus_service_property(_interface, signature="s",
1556
@dbus_service_property(_interface,
1557
signature="s",
1063
1558
access="readwrite")
1064
1559
def LastCheckedOK_dbus_property(self, value=None):
1065
1560
if value is not None:
1066
1561
self.checked_ok()
1067
1562
return
1068
if self.last_checked_ok is None:
1069
return dbus.String("")
1070
return dbus.String(self._datetime_to_dbus(self
1071
.last_checked_ok))
1563
return datetime_to_dbus(self.last_checked_ok)
1564
1565
# LastCheckerStatus - property
1566
@dbus_service_property(_interface, signature="n", access="read")
1567
def LastCheckerStatus_dbus_property(self):
1568
return dbus.Int16(self.last_checker_status)
1569
1570
# Expires - property
1571
@dbus_service_property(_interface, signature="s", access="read")
1572
def Expires_dbus_property(self):
1573
return datetime_to_dbus(self.expires)
1072
1574
1073
1575
# LastApprovalRequest - property
1074
1576
@dbus_service_property(_interface, signature="s", access="read")
1075
1577
def LastApprovalRequest_dbus_property(self):
1076
if self.last_approval_request is None:
1077
return dbus.String("")
1078
return dbus.String(self.
1079
_datetime_to_dbus(self
1080
.last_approval_request))
1578
return datetime_to_dbus(self.last_approval_request)
1081
1579
1082
1580
# Timeout - property
1083
@dbus_service_property(_interface, signature="t",
1581
@dbus_service_property(_interface,
1582
signature="t",
1084
1583
access="readwrite")
1085
1584
def Timeout_dbus_property(self, value=None):
1086
1585
if value is None: # get
1087
return dbus.UInt64(self.timeout_milliseconds())
1586
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1587
old_timeout = self.timeout
1088
1588
self.timeout = datetime.timedelta(0, 0, 0, value)
1089
# Emit D-Bus signal
1090
self.PropertyChanged(dbus.String("Timeout"),
1091
dbus.UInt64(value, variant_level=1))
1092
if getattr(self, "disable_initiator_tag", None) is None:
1093
return
1094
# Reschedule timeout
1095
gobject.source_remove(self.disable_initiator_tag)
1096
self.disable_initiator_tag = None
1097
time_to_die = (self.
1098
_timedelta_to_milliseconds((self
1099
.last_checked_ok
1100
+ self.timeout)
1101
- datetime.datetime
1102
.utcnow()))
1103
if time_to_die <= 0:
1104
# The timeout has passed
1105
self.disable()
1106
else:
1107
self.disable_initiator_tag = (gobject.timeout_add
1108
(time_to_die, self.disable))
1589
# Reschedule disabling
1590
if self.enabled:
1591
now = datetime.datetime.utcnow()
1592
self.expires += self.timeout - old_timeout
1593
if self.expires <= now:
1594
# The timeout has passed
1595
self.disable()
1596
else:
1597
if (getattr(self, "disable_initiator_tag", None)
1598
is None):
1599
return
1600
gobject.source_remove(self.disable_initiator_tag)
1601
self.disable_initiator_tag = gobject.timeout_add(
1602
int((self.expires - now).total_seconds() * 1000),
1603
self.disable)
1604
1605
# ExtendedTimeout - property
1606
@dbus_service_property(_interface,
1607
signature="t",
1608
access="readwrite")
1609
def ExtendedTimeout_dbus_property(self, value=None):
1610
if value is None: # get
1611
return dbus.UInt64(self.extended_timeout.total_seconds()
1612
* 1000)
1613
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1109
1614
1110
1615
# Interval - property
1111
@dbus_service_property(_interface, signature="t",
1616
@dbus_service_property(_interface,
1617
signature="t",
1112
1618
access="readwrite")
1113
1619
def Interval_dbus_property(self, value=None):
1114
1620
if value is None: # get
1115
return dbus.UInt64(self.interval_milliseconds())
1621
return dbus.UInt64(self.interval.total_seconds() * 1000)
1116
1622
self.interval = datetime.timedelta(0, 0, 0, value)
1117
# Emit D-Bus signal
1118
self.PropertyChanged(dbus.String("Interval"),
1119
dbus.UInt64(value, variant_level=1))
1120
1623
if getattr(self, "checker_initiator_tag", None) is None:
1121
1624
return
1122
# Reschedule checker run
1123
gobject.source_remove(self.checker_initiator_tag)
1124
self.checker_initiator_tag = (gobject.timeout_add
1125
(value, self.start_checker))
1126
self.start_checker() # Start one now, too
1127
1625
if self.enabled:
1626
# Reschedule checker run
1627
gobject.source_remove(self.checker_initiator_tag)
1628
self.checker_initiator_tag = gobject.timeout_add(
1629
value, self.start_checker)
1630
self.start_checker() # Start one now, too
1631
1128
1632
# Checker - property
1129
@dbus_service_property(_interface, signature="s",
1633
@dbus_service_property(_interface,
1634
signature="s",
1130
1635
access="readwrite")
1131
1636
def Checker_dbus_property(self, value=None):
1132
1637
if value is None: # get
1133
1638
return dbus.String(self.checker_command)
1134
self.checker_command = value
1135
# Emit D-Bus signal
1136
self.PropertyChanged(dbus.String("Checker"),
1137
dbus.String(self.checker_command,
1138
variant_level=1))
1639
self.checker_command = str(value)
1139
1640
1140
1641
# CheckerRunning - property
1141
@dbus_service_property(_interface, signature="b",
1642
@dbus_service_property(_interface,
1643
signature="b",
1142
1644
access="readwrite")
1143
1645
def CheckerRunning_dbus_property(self, value=None):
1144
1646
if value is None: # get
1154
1656
return self.dbus_object_path # is already a dbus.ObjectPath
1155
1657
1156
1658
# Secret = property
1157
@dbus_service_property(_interface, signature="ay",
1158
access="write", byte_arrays=True)
1659
@dbus_service_property(_interface,
1660
signature="ay",
1661
access="write",
1662
byte_arrays=True)
1159
1663
def Secret_dbus_property(self, value):
1160
self.secret = str(value)
1664
self.secret = bytes(value)
1161
1665
1162
1666
del _interface
1163
1667
1168
1672
self._pipe.send(('init', fpr, address))
1169
1673
if not self._pipe.recv():
1170
1674
raise KeyError()
1171
1675
1172
1676
def __getattribute__(self, name):
1173
if(name == '_pipe'):
1677
if name == '_pipe':
1174
1678
return super(ProxyClient, self).__getattribute__(name)
1175
1679
self._pipe.send(('getattr', name))
1176
1680
data = self._pipe.recv()
1177
1681
if data[0] == 'data':
1178
1682
return data[1]
1179
1683
if data[0] == 'function':
1684
1180
1685
def func(*args, **kwargs):
1181
1686
self._pipe.send(('funcall', name, args, kwargs))
1182
1687
return self._pipe.recv()[1]
1688
1183
1689
return func
1184
1690
1185
1691
def __setattr__(self, name, value):
1186
if(name == '_pipe'):
1692
if name == '_pipe':
1187
1693
return super(ProxyClient, self).__setattr__(name, value)
1188
1694
self._pipe.send(('setattr', name, value))
1189
1695
1197
1703
def handle(self):
1198
1704
with contextlib.closing(self.server.child_pipe) as child_pipe:
1199
1705
logger.info("TCP connection from: %s",
1200
unicode(self.client_address))
1706
str(self.client_address))
1201
1707
logger.debug("Pipe FD: %d",
1202
1708
self.server.child_pipe.fileno())
1203
1204
session = (gnutls.connection
1205
.ClientSession(self.request,
1206
gnutls.connection
1207
.X509Credentials()))
1208
1709
1710
session = gnutls.connection.ClientSession(
1711
self.request, gnutls.connection .X509Credentials())
1712
1209
1713
# Note: gnutls.connection.X509Credentials is really a
1210
1714
# generic GnuTLS certificate credentials object so long as
1211
1715
# no X.509 keys are added to it. Therefore, we can use it
1212
1716
# here despite using OpenPGP certificates.
1213
1717
1214
1718
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1215
1719
# "+AES-256-CBC", "+SHA1",
1216
1720
# "+COMP-NULL", "+CTYPE-OPENPGP",
1219
1723
priority = self.server.gnutls_priority
1220
1724
if priority is None:
1221
1725
priority = "NORMAL"
1222
(gnutls.library.functions
1223
.gnutls_priority_set_direct(session._c_object,
1224
priority, None))
1225
1726
gnutls.library.functions.gnutls_priority_set_direct(
1727
session._c_object, priority, None)
1728
1226
1729
# Start communication using the Mandos protocol
1227
1730
# Get protocol number
1228
1731
line = self.request.makefile().readline()
1229
1732
logger.debug("Protocol version: %r", line)
1230
1733
try:
1231
1734
if int(line.strip().split()[0]) > 1:
1232
raise RuntimeError
1735
raise RuntimeError(line)
1233
1736
except (ValueError, IndexError, RuntimeError) as error:
1234
1737
logger.error("Unknown protocol version: %s", error)
1235
1738
return
1236
1739
1237
1740
# Start GnuTLS connection
1238
1741
try:
1239
1742
session.handshake()
1243
1746
# established. Just abandon the request.
1244
1747
return
1245
1748
logger.debug("Handshake succeeded")
1246
1749
1247
1750
approval_required = False
1248
1751
try:
1249
1752
try:
1250
fpr = self.fingerprint(self.peer_certificate
1251
(session))
1753
fpr = self.fingerprint(
1754
self.peer_certificate(session))
1252
1755
except (TypeError,
1253
1756
gnutls.errors.GNUTLSError) as error:
1254
1757
logger.warning("Bad certificate: %s", error)
1255
1758
return
1256
1759
logger.debug("Fingerprint: %s", fpr)
1257
1760
1258
1761
try:
1259
1762
client = ProxyClient(child_pipe, fpr,
1260
1763
self.client_address)
1269
1772
while True:
1270
1773
if not client.enabled:
1271
1774
logger.info("Client %s is disabled",
1272
client.name)
1775
client.name)
1273
1776
if self.server.use_dbus:
1274
1777
# Emit D-Bus signal
1275
client.Rejected("Disabled")
1778
client.Rejected("Disabled")
1276
1779
return
1277
1780
1278
if client._approved or not client.approval_delay:
1781
if client.approved or not client.approval_delay:
1279
1782
#We are approved or approval is disabled
1280
1783
break
1281
elif client._approved is None:
1784
elif client.approved is None:
1282
1785
logger.info("Client %s needs approval",
1283
1786
client.name)
1284
1787
if self.server.use_dbus:
1285
1788
# Emit D-Bus signal
1286
1789
client.NeedApproval(
1287
client.approval_delay_milliseconds(),
1288
client.approved_by_default)
1790
client.approval_delay.total_seconds()
1791
* 1000, client.approved_by_default)
1289
1792
else:
1290
1793
logger.warning("Client %s was not approved",
1291
1794
client.name)
1295
1798
return
1296
1799
1297
1800
#wait until timeout or approved
1298
#x = float(client._timedelta_to_milliseconds(delay))
1299
1801
time = datetime.datetime.now()
1300
1802
client.changedstate.acquire()
1301
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1803
client.changedstate.wait(delay.total_seconds())
1302
1804
client.changedstate.release()
1303
1805
time2 = datetime.datetime.now()
1304
1806
if (time2 - time) >= delay:
1320
1822
try:
1321
1823
sent = session.send(client.secret[sent_size:])
1322
1824
except gnutls.errors.GNUTLSError as error:
1323
logger.warning("gnutls send failed")
1825
logger.warning("gnutls send failed",
1826
exc_info=error)
1324
1827
return
1325
logger.debug("Sent: %d, remaining: %d",
1326
sent, len(client.secret)
1327
- (sent_size + sent))
1828
logger.debug("Sent: %d, remaining: %d", sent,
1829
len(client.secret) - (sent_size
1830
+ sent))
1328
1831
sent_size += sent
1329
1832
1330
1833
logger.info("Sending secret to %s", client.name)
1331
# bump the timeout as if seen
1332
client.checked_ok()
1834
# bump the timeout using extended_timeout
1835
client.bump_timeout(client.extended_timeout)
1333
1836
if self.server.use_dbus:
1334
1837
# Emit D-Bus signal
1335
1838
client.GotSecret()
1340
1843
try:
1341
1844
session.bye()
1342
1845
except gnutls.errors.GNUTLSError as error:
1343
logger.warning("GnuTLS bye failed")
1846
logger.warning("GnuTLS bye failed",
1847
exc_info=error)
1344
1848
1345
1849
@staticmethod
1346
1850
def peer_certificate(session):
1347
1851
"Return the peer's OpenPGP certificate as a bytestring"
1348
1852
# If not an OpenPGP certificate...
1349
if (gnutls.library.functions
1350
.gnutls_certificate_type_get(session._c_object)
1853
if (gnutls.library.functions.gnutls_certificate_type_get(
1854
session._c_object)
1351
1855
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1352
1856
# ...do the normal thing
1353
1857
return session.peer_certificate
1367
1871
def fingerprint(openpgp):
1368
1872
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1369
1873
# New GnuTLS "datum" with the OpenPGP public key
1370
datum = (gnutls.library.types
1371
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1372
ctypes.POINTER
1373
(ctypes.c_ubyte)),
1374
ctypes.c_uint(len(openpgp))))
1874
datum = gnutls.library.types.gnutls_datum_t(
1875
ctypes.cast(ctypes.c_char_p(openpgp),
1876
ctypes.POINTER(ctypes.c_ubyte)),
1877
ctypes.c_uint(len(openpgp)))
1375
1878
# New empty GnuTLS certificate
1376
1879
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1377
(gnutls.library.functions
1378
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1880
gnutls.library.functions.gnutls_openpgp_crt_init(
1881
ctypes.byref(crt))
1379
1882
# Import the OpenPGP public key into the certificate
1380
(gnutls.library.functions
1381
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1382
gnutls.library.constants
1383
.GNUTLS_OPENPGP_FMT_RAW))
1883
gnutls.library.functions.gnutls_openpgp_crt_import(
1884
crt, ctypes.byref(datum),
1885
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1384
1886
# Verify the self signature in the key
1385
1887
crtverify = ctypes.c_uint()
1386
(gnutls.library.functions
1387
.gnutls_openpgp_crt_verify_self(crt, 0,
1388
ctypes.byref(crtverify)))
1888
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1889
crt, 0, ctypes.byref(crtverify))
1389
1890
if crtverify.value != 0:
1390
1891
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1391
raise (gnutls.errors.CertificateSecurityError
1392
("Verify failed"))
1892
raise gnutls.errors.CertificateSecurityError(
1893
"Verify failed")
1393
1894
# New buffer for the fingerprint
1394
1895
buf = ctypes.create_string_buffer(20)
1395
1896
buf_len = ctypes.c_size_t()
1396
1897
# Get the fingerprint from the certificate into the buffer
1397
(gnutls.library.functions
1398
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1399
ctypes.byref(buf_len)))
1898
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1899
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1400
1900
# Deinit the certificate
1401
1901
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1402
1902
# Convert the buffer to a Python bytestring
1403
1903
fpr = ctypes.string_at(buf, buf_len.value)
1404
1904
# Convert the bytestring to hexadecimal notation
1405
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1905
hex_fpr = binascii.hexlify(fpr).upper()
1406
1906
return hex_fpr
1407
1907
1408
1908
1409
1909
class MultiprocessingMixIn(object):
1410
1910
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1911
1411
1912
def sub_process_main(self, request, address):
1412
1913
try:
1413
1914
self.finish_request(request, address)
1414
except:
1915
except Exception:
1415
1916
self.handle_error(request, address)
1416
1917
self.close_request(request)
1417
1918
1418
1919
def process_request(self, request, address):
1419
1920
"""Start a new process to process the request."""
1420
multiprocessing.Process(target = self.sub_process_main,
1421
args = (request, address)).start()
1921
proc = multiprocessing.Process(target = self.sub_process_main,
1922
args = (request, address))
1923
proc.start()
1924
return proc
1925
1422
1926
1423
1927
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1424
1928
""" adds a pipe to the MixIn """
1929
1425
1930
def process_request(self, request, client_address):
1426
1931
"""Overrides and wraps the original process_request().
1427
1932
1428
1933
This function creates a new pipe in self.pipe
1429
1934
"""
1430
1935
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1431
1432
super(MultiprocessingMixInWithPipe,
1433
self).process_request(request, client_address)
1936
1937
proc = MultiprocessingMixIn.process_request(self, request,
1938
client_address)
1434
1939
self.child_pipe.close()
1435
self.add_pipe(parent_pipe)
1436
1437
def add_pipe(self, parent_pipe):
1940
self.add_pipe(parent_pipe, proc)
1941
1942
def add_pipe(self, parent_pipe, proc):
1438
1943
"""Dummy function; override as necessary"""
1439
raise NotImplementedError
1944
raise NotImplementedError()
1945
1440
1946
1441
1947
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1442
1948
socketserver.TCPServer, object):
1447
1953
interface: None or a network interface name (string)
1448
1954
use_ipv6: Boolean; to use IPv6 or not
1449
1955
"""
1956
1450
1957
def __init__(self, server_address, RequestHandlerClass,
1451
interface=None, use_ipv6=True):
1958
interface=None,
1959
use_ipv6=True,
1960
socketfd=None):
1961
"""If socketfd is set, use that file descriptor instead of
1962
creating a new one with socket.socket().
1963
"""
1452
1964
self.interface = interface
1453
1965
if use_ipv6:
1454
1966
self.address_family = socket.AF_INET6
1967
if socketfd is not None:
1968
# Save the file descriptor
1969
self.socketfd = socketfd
1970
# Save the original socket.socket() function
1971
self.socket_socket = socket.socket
1972
# To implement --socket, we monkey patch socket.socket.
1973
#
1974
# (When socketserver.TCPServer is a new-style class, we
1975
# could make self.socket into a property instead of monkey
1976
# patching socket.socket.)
1977
#
1978
# Create a one-time-only replacement for socket.socket()
1979
@functools.wraps(socket.socket)
1980
def socket_wrapper(*args, **kwargs):
1981
# Restore original function so subsequent calls are
1982
# not affected.
1983
socket.socket = self.socket_socket
1984
del self.socket_socket
1985
# This time only, return a new socket object from the
1986
# saved file descriptor.
1987
return socket.fromfd(self.socketfd, *args, **kwargs)
1988
# Replace socket.socket() function with wrapper
1989
socket.socket = socket_wrapper
1990
# The socketserver.TCPServer.__init__ will call
1991
# socket.socket(), which might be our replacement,
1992
# socket_wrapper(), if socketfd was set.
1455
1993
socketserver.TCPServer.__init__(self, server_address,
1456
1994
RequestHandlerClass)
1995
1457
1996
def server_bind(self):
1458
1997
"""This overrides the normal server_bind() function
1459
1998
to bind to an interface if one was specified, and also NOT to
1465
2004
self.interface)
1466
2005
else:
1467
2006
try:
1468
self.socket.setsockopt(socket.SOL_SOCKET,
1469
SO_BINDTODEVICE,
1470
str(self.interface
1471
+ '\0'))
2007
self.socket.setsockopt(
2008
socket.SOL_SOCKET, SO_BINDTODEVICE,
2009
(self.interface + "\0").encode("utf-8"))
1472
2010
except socket.error as error:
1473
if error[0] == errno.EPERM:
1474
logger.error("No permission to"
1475
" bind to interface %s",
1476
self.interface)
1477
elif error[0] == errno.ENOPROTOOPT:
2011
if error.errno == errno.EPERM:
2012
logger.error("No permission to bind to"
2013
" interface %s", self.interface)
2014
elif error.errno == errno.ENOPROTOOPT:
1478
2015
logger.error("SO_BINDTODEVICE not available;"
1479
2016
" cannot bind to interface %s",
1480
2017
self.interface)
2018
elif error.errno == errno.ENODEV:
2019
logger.error("Interface %s does not exist,"
2020
" cannot bind", self.interface)
1481
2021
else:
1482
2022
raise
1483
2023
# Only bind(2) the socket if we really need to.
1486
2026
if self.address_family == socket.AF_INET6:
1487
2027
any_address = "::" # in6addr_any
1488
2028
else:
1489
any_address = socket.INADDR_ANY
2029
any_address = "0.0.0.0" # INADDR_ANY
1490
2030
self.server_address = (any_address,
1491
2031
self.server_address[1])
1492
2032
elif not self.server_address[1]:
1493
self.server_address = (self.server_address[0],
1494
0)
2033
self.server_address = (self.server_address[0], 0)
1495
2034
# if self.interface:
1496
2035
# self.server_address = (self.server_address[0],
1497
2036
# 0, # port
1511
2050
1512
2051
Assumes a gobject.MainLoop event loop.
1513
2052
"""
2053
1514
2054
def __init__(self, server_address, RequestHandlerClass,
1515
interface=None, use_ipv6=True, clients=None,
1516
gnutls_priority=None, use_dbus=True):
2055
interface=None,
2056
use_ipv6=True,
2057
clients=None,
2058
gnutls_priority=None,
2059
use_dbus=True,
2060
socketfd=None):
1517
2061
self.enabled = False
1518
2062
self.clients = clients
1519
2063
if self.clients is None:
1520
self.clients = set()
2064
self.clients = {}
1521
2065
self.use_dbus = use_dbus
1522
2066
self.gnutls_priority = gnutls_priority
1523
2067
IPv6_TCPServer.__init__(self, server_address,
1524
2068
RequestHandlerClass,
1525
2069
interface = interface,
1526
use_ipv6 = use_ipv6)
2070
use_ipv6 = use_ipv6,
2071
socketfd = socketfd)
2072
1527
2073
def server_activate(self):
1528
2074
if self.enabled:
1529
2075
return socketserver.TCPServer.server_activate(self)
2076
1530
2077
def enable(self):
1531
2078
self.enabled = True
1532
def add_pipe(self, parent_pipe):
2079
2080
def add_pipe(self, parent_pipe, proc):
1533
2081
# Call "handle_ipc" for both data and EOF events
1534
gobject.io_add_watch(parent_pipe.fileno(),
1535
gobject.IO_IN | gobject.IO_HUP,
1536
functools.partial(self.handle_ipc,
1537
parent_pipe = parent_pipe))
1538
1539
def handle_ipc(self, source, condition, parent_pipe=None,
2082
gobject.io_add_watch(
2083
parent_pipe.fileno(),
2084
gobject.IO_IN | gobject.IO_HUP,
2085
functools.partial(self.handle_ipc,
2086
parent_pipe = parent_pipe,
2087
proc = proc))
2088
2089
def handle_ipc(self, source, condition,
2090
parent_pipe=None,
2091
proc = None,
1540
2092
client_object=None):
1541
condition_names = {
1542
gobject.IO_IN: "IN", # There is data to read.
1543
gobject.IO_OUT: "OUT", # Data can be written (without
1544
# blocking).
1545
gobject.IO_PRI: "PRI", # There is urgent data to read.
1546
gobject.IO_ERR: "ERR", # Error condition.
1547
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1548
# broken, usually for pipes and
1549
# sockets).
1550
}
1551
conditions_string = ' | '.join(name
1552
for cond, name in
1553
condition_names.iteritems()
1554
if cond & condition)
1555
# error or the other end of multiprocessing.Pipe has closed
1556
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2093
# error, or the other end of multiprocessing.Pipe has closed
2094
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2095
# Wait for other process to exit
2096
proc.join()
1557
2097
return False
1558
2098
1559
2099
# Read a request from the child
1564
2104
fpr = request[1]
1565
2105
address = request[2]
1566
2106
1567
for c in self.clients:
2107
for c in self.clients.itervalues():
1568
2108
if c.fingerprint == fpr:
1569
2109
client = c
1570
2110
break
1573
2113
"dress: %s", fpr, address)
1574
2114
if self.use_dbus:
1575
2115
# Emit D-Bus signal
1576
mandos_dbus_service.ClientNotFound(fpr, address[0])
2116
mandos_dbus_service.ClientNotFound(fpr,
2117
address[0])
1577
2118
parent_pipe.send(False)
1578
2119
return False
1579
2120
1580
gobject.io_add_watch(parent_pipe.fileno(),
1581
gobject.IO_IN | gobject.IO_HUP,
1582
functools.partial(self.handle_ipc,
1583
parent_pipe = parent_pipe,
1584
client_object = client))
2121
gobject.io_add_watch(
2122
parent_pipe.fileno(),
2123
gobject.IO_IN | gobject.IO_HUP,
2124
functools.partial(self.handle_ipc,
2125
parent_pipe = parent_pipe,
2126
proc = proc,
2127
client_object = client))
1585
2128
parent_pipe.send(True)
1586
# remove the old hook in favor of the new above hook on same fileno
2129
# remove the old hook in favor of the new above hook on
2130
# same fileno
1587
2131
return False
1588
2132
if command == 'funcall':
1589
2133
funcname = request[1]
1590
2134
args = request[2]
1591
2135
kwargs = request[3]
1592
2136
1593
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1594
2137
parent_pipe.send(('data', getattr(client_object,
2138
funcname)(*args,
2139
**kwargs)))
2140
1595
2141
if command == 'getattr':
1596
2142
attrname = request[1]
1597
2143
if callable(client_object.__getattribute__(attrname)):
1598
parent_pipe.send(('function',))
2144
parent_pipe.send(('function', ))
1599
2145
else:
1600
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2146
parent_pipe.send((
2147
'data', client_object.__getattribute__(attrname)))
1601
2148
1602
2149
if command == 'setattr':
1603
2150
attrname = request[1]
1604
2151
value = request[2]
1605
2152
setattr(client_object, attrname, value)
1606
2153
1607
2154
return True
1608
2155
1609
2156
2157
def rfc3339_duration_to_delta(duration):
2158
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2159
2160
>>> rfc3339_duration_to_delta("P7D")
2161
datetime.timedelta(7)
2162
>>> rfc3339_duration_to_delta("PT60S")
2163
datetime.timedelta(0, 60)
2164
>>> rfc3339_duration_to_delta("PT60M")
2165
datetime.timedelta(0, 3600)
2166
>>> rfc3339_duration_to_delta("PT24H")
2167
datetime.timedelta(1)
2168
>>> rfc3339_duration_to_delta("P1W")
2169
datetime.timedelta(7)
2170
>>> rfc3339_duration_to_delta("PT5M30S")
2171
datetime.timedelta(0, 330)
2172
>>> rfc3339_duration_to_delta("P1DT3M20S")
2173
datetime.timedelta(1, 200)
2174
"""
2175
2176
# Parsing an RFC 3339 duration with regular expressions is not
2177
# possible - there would have to be multiple places for the same
2178
# values, like seconds. The current code, while more esoteric, is
2179
# cleaner without depending on a parsing library. If Python had a
2180
# built-in library for parsing we would use it, but we'd like to
2181
# avoid excessive use of external libraries.
2182
2183
# New type for defining tokens, syntax, and semantics all-in-one
2184
Token = collections.namedtuple("Token",
2185
("regexp", # To match token; if
2186
# "value" is not None,
2187
# must have a "group"
2188
# containing digits
2189
"value", # datetime.timedelta or
2190
# None
2191
"followers")) # Tokens valid after
2192
# this token
2193
Token = collections.namedtuple("Token", (
2194
"regexp", # To match token; if "value" is not None, must have
2195
# a "group" containing digits
2196
"value", # datetime.timedelta or None
2197
"followers")) # Tokens valid after this token
2198
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2199
# the "duration" ABNF definition in RFC 3339, Appendix A.
2200
token_end = Token(re.compile(r"$"), None, frozenset())
2201
token_second = Token(re.compile(r"(\d+)S"),
2202
datetime.timedelta(seconds=1),
2203
frozenset((token_end, )))
2204
token_minute = Token(re.compile(r"(\d+)M"),
2205
datetime.timedelta(minutes=1),
2206
frozenset((token_second, token_end)))
2207
token_hour = Token(re.compile(r"(\d+)H"),
2208
datetime.timedelta(hours=1),
2209
frozenset((token_minute, token_end)))
2210
token_time = Token(re.compile(r"T"),
2211
None,
2212
frozenset((token_hour, token_minute,
2213
token_second)))
2214
token_day = Token(re.compile(r"(\d+)D"),
2215
datetime.timedelta(days=1),
2216
frozenset((token_time, token_end)))
2217
token_month = Token(re.compile(r"(\d+)M"),
2218
datetime.timedelta(weeks=4),
2219
frozenset((token_day, token_end)))
2220
token_year = Token(re.compile(r"(\d+)Y"),
2221
datetime.timedelta(weeks=52),
2222
frozenset((token_month, token_end)))
2223
token_week = Token(re.compile(r"(\d+)W"),
2224
datetime.timedelta(weeks=1),
2225
frozenset((token_end, )))
2226
token_duration = Token(re.compile(r"P"), None,
2227
frozenset((token_year, token_month,
2228
token_day, token_time,
2229
token_week)))
2230
# Define starting values
2231
value = datetime.timedelta() # Value so far
2232
found_token = None
2233
followers = frozenset((token_duration,)) # Following valid tokens
2234
s = duration # String left to parse
2235
# Loop until end token is found
2236
while found_token is not token_end:
2237
# Search for any currently valid tokens
2238
for token in followers:
2239
match = token.regexp.match(s)
2240
if match is not None:
2241
# Token found
2242
if token.value is not None:
2243
# Value found, parse digits
2244
factor = int(match.group(1), 10)
2245
# Add to value so far
2246
value += factor * token.value
2247
# Strip token from string
2248
s = token.regexp.sub("", s, 1)
2249
# Go to found token
2250
found_token = token
2251
# Set valid next tokens
2252
followers = found_token.followers
2253
break
2254
else:
2255
# No currently valid tokens were found
2256
raise ValueError("Invalid RFC 3339 duration")
2257
# End token found
2258
return value
2259
2260
1610
2261
def string_to_delta(interval):
1611
2262
"""Parse a string and return a datetime.timedelta
1612
2263
1623
2274
>>> string_to_delta('5m 30s')
1624
2275
datetime.timedelta(0, 330)
1625
2276
"""
2277
2278
try:
2279
return rfc3339_duration_to_delta(interval)
2280
except ValueError:
2281
pass
2282
1626
2283
timevalue = datetime.timedelta(0)
1627
2284
for s in interval.split():
1628
2285
try:
1629
suffix = unicode(s[-1])
2286
suffix = s[-1]
1630
2287
value = int(s[:-1])
1631
2288
if suffix == "d":
1632
2289
delta = datetime.timedelta(value)
1639
2296
elif suffix == "w":
1640
2297
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1641
2298
else:
1642
raise ValueError("Unknown suffix %r" % suffix)
1643
except (ValueError, IndexError) as e:
2299
raise ValueError("Unknown suffix {!r}".format(suffix))
2300
except IndexError as e:
1644
2301
raise ValueError(*(e.args))
1645
2302
timevalue += delta
1646
2303
return timevalue
1647
2304
1648
2305
1649
def if_nametoindex(interface):
1650
"""Call the C function if_nametoindex(), or equivalent
1651
1652
Note: This function cannot accept a unicode string."""
1653
global if_nametoindex
1654
try:
1655
if_nametoindex = (ctypes.cdll.LoadLibrary
1656
(ctypes.util.find_library("c"))
1657
.if_nametoindex)
1658
except (OSError, AttributeError):
1659
logger.warning("Doing if_nametoindex the hard way")
1660
def if_nametoindex(interface):
1661
"Get an interface index the hard way, i.e. using fcntl()"
1662
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1663
with contextlib.closing(socket.socket()) as s:
1664
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1665
struct.pack(str("16s16x"),
1666
interface))
1667
interface_index = struct.unpack(str("I"),
1668
ifreq[16:20])[0]
1669
return interface_index
1670
return if_nametoindex(interface)
1671
1672
1673
2306
def daemon(nochdir = False, noclose = False):
1674
2307
"""See daemon(3). Standard BSD Unix function.
1675
2308
1683
2316
sys.exit()
1684
2317
if not noclose:
1685
2318
# Close all standard open file descriptors
1686
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2319
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1687
2320
if not stat.S_ISCHR(os.fstat(null).st_mode):
1688
2321
raise OSError(errno.ENODEV,
1689
"%s not a character device"
1690
% os.path.devnull)
2322
"{} not a character device"
2323
.format(os.devnull))
1691
2324
os.dup2(null, sys.stdin.fileno())
1692
2325
os.dup2(null, sys.stdout.fileno())
1693
2326
os.dup2(null, sys.stderr.fileno())
1702
2335
1703
2336
parser = argparse.ArgumentParser()
1704
2337
parser.add_argument("-v", "--version", action="version",
1705
version = "%%(prog)s %s" % version,
2338
version = "%(prog)s {}".format(version),
1706
2339
help="show version number and exit")
1707
2340
parser.add_argument("-i", "--interface", metavar="IF",
1708
2341
help="Bind to interface IF")
1714
2347
help="Run self-test")
1715
2348
parser.add_argument("--debug", action="store_true",
1716
2349
help="Debug mode; run in foreground and log"
1717
" to terminal")
2350
" to terminal", default=None)
1718
2351
parser.add_argument("--debuglevel", metavar="LEVEL",
1719
2352
help="Debug level for stdout output")
1720
2353
parser.add_argument("--priority", help="GnuTLS"
1727
2360
" files")
1728
2361
parser.add_argument("--no-dbus", action="store_false",
1729
2362
dest="use_dbus", help="Do not provide D-Bus"
1730
" system bus interface")
2363
" system bus interface", default=None)
1731
2364
parser.add_argument("--no-ipv6", action="store_false",
1732
dest="use_ipv6", help="Do not use IPv6")
2365
dest="use_ipv6", help="Do not use IPv6",
2366
default=None)
2367
parser.add_argument("--no-restore", action="store_false",
2368
dest="restore", help="Do not restore stored"
2369
" state", default=None)
2370
parser.add_argument("--socket", type=int,
2371
help="Specify a file descriptor to a network"
2372
" socket to use instead of creating one")
2373
parser.add_argument("--statedir", metavar="DIR",
2374
help="Directory to save/restore state in")
2375
parser.add_argument("--foreground", action="store_true",
2376
help="Run in foreground", default=None)
2377
parser.add_argument("--no-zeroconf", action="store_false",
2378
dest="zeroconf", help="Do not use Zeroconf",
2379
default=None)
2380
1733
2381
options = parser.parse_args()
1734
2382
1735
2383
if options.check:
1736
2384
import doctest
1737
doctest.testmod()
1738
sys.exit()
2385
fail_count, test_count = doctest.testmod()
2386
sys.exit(os.EX_OK if fail_count == 0 else 1)
1739
2387
1740
2388
# Default values for config file for server-global settings
1741
2389
server_defaults = { "interface": "",
1743
2391
"port": "",
1744
2392
"debug": "False",
1745
2393
"priority":
1746
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2394
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2395
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
1747
2396
"servicename": "Mandos",
1748
2397
"use_dbus": "True",
1749
2398
"use_ipv6": "True",
1750
2399
"debuglevel": "",
1751
}
2400
"restore": "True",
2401
"socket": "",
2402
"statedir": "/var/lib/mandos",
2403
"foreground": "False",
2404
"zeroconf": "True",
2405
}
1752
2406
1753
2407
# Parse config file for server-global settings
1754
2408
server_config = configparser.SafeConfigParser(server_defaults)
1755
2409
del server_defaults
1756
server_config.read(os.path.join(options.configdir,
1757
"mandos.conf"))
2410
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1758
2411
# Convert the SafeConfigParser object to a dict
1759
2412
server_settings = server_config.defaults()
1760
2413
# Use the appropriate methods on the non-string config options
1761
for option in ("debug", "use_dbus", "use_ipv6"):
2414
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
1762
2415
server_settings[option] = server_config.getboolean("DEFAULT",
1763
2416
option)
1764
2417
if server_settings["port"]:
1765
2418
server_settings["port"] = server_config.getint("DEFAULT",
1766
2419
"port")
2420
if server_settings["socket"]:
2421
server_settings["socket"] = server_config.getint("DEFAULT",
2422
"socket")
2423
# Later, stdin will, and stdout and stderr might, be dup'ed
2424
# over with an opened os.devnull. But we don't want this to
2425
# happen with a supplied network socket.
2426
if 0 <= server_settings["socket"] <= 2:
2427
server_settings["socket"] = os.dup(server_settings
2428
["socket"])
1767
2429
del server_config
1768
2430
1769
2431
# Override the settings from the config file with command line
1770
2432
# options, if set.
1771
2433
for option in ("interface", "address", "port", "debug",
1772
"priority", "servicename", "configdir",
1773
"use_dbus", "use_ipv6", "debuglevel"):
2434
"priority", "servicename", "configdir", "use_dbus",
2435
"use_ipv6", "debuglevel", "restore", "statedir",
2436
"socket", "foreground", "zeroconf"):
1774
2437
value = getattr(options, option)
1775
2438
if value is not None:
1776
2439
server_settings[option] = value
1777
2440
del options
1778
2441
# Force all strings to be unicode
1779
2442
for option in server_settings.keys():
1780
if type(server_settings[option]) is str:
1781
server_settings[option] = unicode(server_settings[option])
2443
if isinstance(server_settings[option], bytes):
2444
server_settings[option] = (server_settings[option]
2445
.decode("utf-8"))
2446
# Force all boolean options to be boolean
2447
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2448
"foreground", "zeroconf"):
2449
server_settings[option] = bool(server_settings[option])
2450
# Debug implies foreground
2451
if server_settings["debug"]:
2452
server_settings["foreground"] = True
1782
2453
# Now we have our good server settings in "server_settings"
1783
2454
1784
2455
##################################################################
1785
2456
2457
if (not server_settings["zeroconf"]
2458
and not (server_settings["port"]
2459
or server_settings["socket"] != "")):
2460
parser.error("Needs port or socket to work without Zeroconf")
2461
1786
2462
# For convenience
1787
2463
debug = server_settings["debug"]
1788
2464
debuglevel = server_settings["debuglevel"]
1789
2465
use_dbus = server_settings["use_dbus"]
1790
2466
use_ipv6 = server_settings["use_ipv6"]
1791
2467
stored_state_path = os.path.join(server_settings["statedir"],
2468
stored_state_file)
2469
foreground = server_settings["foreground"]
2470
zeroconf = server_settings["zeroconf"]
2471
2472
if debug:
2473
initlogger(debug, logging.DEBUG)
2474
else:
2475
if not debuglevel:
2476
initlogger(debug)
2477
else:
2478
level = getattr(logging, debuglevel.upper())
2479
initlogger(debug, level)
2480
1792
2481
if server_settings["servicename"] != "Mandos":
1793
syslogger.setFormatter(logging.Formatter
1794
('Mandos (%s) [%%(process)d]:'
1795
' %%(levelname)s: %%(message)s'
1796
% server_settings["servicename"]))
2482
syslogger.setFormatter(
2483
logging.Formatter('Mandos ({}) [%(process)d]:'
2484
' %(levelname)s: %(message)s'.format(
2485
server_settings["servicename"])))
1797
2486
1798
2487
# Parse config file with clients
1799
client_defaults = { "timeout": "1h",
1800
"interval": "5m",
1801
"checker": "fping -q -- %%(host)s",
1802
"host": "",
1803
"approval_delay": "0s",
1804
"approval_duration": "1s",
1805
}
1806
client_config = configparser.SafeConfigParser(client_defaults)
2488
client_config = configparser.SafeConfigParser(Client
2489
.client_defaults)
1807
2490
client_config.read(os.path.join(server_settings["configdir"],
1808
2491
"clients.conf"))
1809
2492
1810
2493
global mandos_dbus_service
1811
2494
mandos_dbus_service = None
1812
2495
1813
tcp_server = MandosServer((server_settings["address"],
1814
server_settings["port"]),
1815
ClientHandler,
1816
interface=(server_settings["interface"]
1817
or None),
1818
use_ipv6=use_ipv6,
1819
gnutls_priority=
1820
server_settings["priority"],
1821
use_dbus=use_dbus)
1822
if not debug:
1823
pidfilename = "/var/run/mandos.pid"
2496
socketfd = None
2497
if server_settings["socket"] != "":
2498
socketfd = server_settings["socket"]
2499
tcp_server = MandosServer(
2500
(server_settings["address"], server_settings["port"]),
2501
ClientHandler,
2502
interface=(server_settings["interface"] or None),
2503
use_ipv6=use_ipv6,
2504
gnutls_priority=server_settings["priority"],
2505
use_dbus=use_dbus,
2506
socketfd=socketfd)
2507
if not foreground:
2508
pidfilename = "/run/mandos.pid"
2509
if not os.path.isdir("/run/."):
2510
pidfilename = "/var/run/mandos.pid"
2511
pidfile = None
1824
2512
try:
1825
2513
pidfile = open(pidfilename, "w")
1826
except IOError:
1827
logger.error("Could not open file %r", pidfilename)
2514
except IOError as e:
2515
logger.error("Could not open file %r", pidfilename,
2516
exc_info=e)
1828
2517
1829
try:
1830
uid = pwd.getpwnam("_mandos").pw_uid
1831
gid = pwd.getpwnam("_mandos").pw_gid
1832
except KeyError:
2518
for name in ("_mandos", "mandos", "nobody"):
1833
2519
try:
1834
uid = pwd.getpwnam("mandos").pw_uid
1835
gid = pwd.getpwnam("mandos").pw_gid
2520
uid = pwd.getpwnam(name).pw_uid
2521
gid = pwd.getpwnam(name).pw_gid
2522
break
1836
2523
except KeyError:
1837
try:
1838
uid = pwd.getpwnam("nobody").pw_uid
1839
gid = pwd.getpwnam("nobody").pw_gid
1840
except KeyError:
1841
uid = 65534
1842
gid = 65534
2524
continue
2525
else:
2526
uid = 65534
2527
gid = 65534
1843
2528
try:
1844
2529
os.setgid(gid)
1845
2530
os.setuid(uid)
1846
2531
except OSError as error:
1847
if error[0] != errno.EPERM:
1848
raise error
2532
if error.errno != errno.EPERM:
2533
raise
1849
2534
1850
if not debug and not debuglevel:
1851
syslogger.setLevel(logging.WARNING)
1852
console.setLevel(logging.WARNING)
1853
if debuglevel:
1854
level = getattr(logging, debuglevel.upper())
1855
syslogger.setLevel(level)
1856
console.setLevel(level)
1857
1858
2535
if debug:
1859
2536
# Enable all possible GnuTLS debugging
1860
2537
1866
2543
def debug_gnutls(level, string):
1867
2544
logger.debug("GnuTLS: %s", string[:-1])
1868
2545
1869
(gnutls.library.functions
1870
.gnutls_global_set_log_function(debug_gnutls))
2546
gnutls.library.functions.gnutls_global_set_log_function(
2547
debug_gnutls)
1871
2548
1872
2549
# Redirect stdin so all checkers get /dev/null
1873
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2550
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1874
2551
os.dup2(null, sys.stdin.fileno())
1875
2552
if null > 2:
1876
2553
os.close(null)
1877
else:
1878
# No console logging
1879
logger.removeHandler(console)
1880
2554
1881
2555
# Need to fork before connecting to D-Bus
1882
if not debug:
2556
if not foreground:
1883
2557
# Close all input and output, do double fork, etc.
1884
2558
daemon()
1885
2559
2560
# multiprocessing will use threads, so before we use gobject we
2561
# need to inform gobject that threads will be used.
2562
gobject.threads_init()
2563
1886
2564
global main_loop
1887
2565
# From the Avahi example code
1888
DBusGMainLoop(set_as_default=True )
2566
DBusGMainLoop(set_as_default=True)
1889
2567
main_loop = gobject.MainLoop()
1890
2568
bus = dbus.SystemBus()
1891
2569
# End of Avahi example code
1892
2570
if use_dbus:
1893
2571
try:
1894
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1895
bus, do_not_queue=True)
1896
except dbus.exceptions.NameExistsException as e:
1897
logger.error(unicode(e) + ", disabling D-Bus")
2572
bus_name = dbus.service.BusName("se.recompile.Mandos",
2573
bus,
2574
do_not_queue=True)
2575
old_bus_name = dbus.service.BusName(
2576
"se.bsnet.fukt.Mandos", bus,
2577
do_not_queue=True)
2578
except dbus.exceptions.DBusException as e:
2579
logger.error("Disabling D-Bus:", exc_info=e)
1898
2580
use_dbus = False
1899
2581
server_settings["use_dbus"] = False
1900
2582
tcp_server.use_dbus = False
1901
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1902
service = AvahiService(name = server_settings["servicename"],
1903
servicetype = "_mandos._tcp",
1904
protocol = protocol, bus = bus)
1905
if server_settings["interface"]:
1906
service.interface = (if_nametoindex
1907
(str(server_settings["interface"])))
2583
if zeroconf:
2584
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2585
service = AvahiServiceToSyslog(
2586
name = server_settings["servicename"],
2587
servicetype = "_mandos._tcp",
2588
protocol = protocol,
2589
bus = bus)
2590
if server_settings["interface"]:
2591
service.interface = if_nametoindex(
2592
server_settings["interface"].encode("utf-8"))
1908
2593
1909
2594
global multiprocessing_manager
1910
2595
multiprocessing_manager = multiprocessing.Manager()
1912
2597
client_class = Client
1913
2598
if use_dbus:
1914
2599
client_class = functools.partial(ClientDBus, bus = bus)
1915
def client_config_items(config, section):
1916
special_settings = {
1917
"approved_by_default":
1918
lambda: config.getboolean(section,
1919
"approved_by_default"),
1920
}
1921
for name, value in config.items(section):
2600
2601
client_settings = Client.config_parser(client_config)
2602
old_client_settings = {}
2603
clients_data = {}
2604
2605
# This is used to redirect stdout and stderr for checker processes
2606
global wnull
2607
wnull = open(os.devnull, "w") # A writable /dev/null
2608
# Only used if server is running in foreground but not in debug
2609
# mode
2610
if debug or not foreground:
2611
wnull.close()
2612
2613
# Get client data and settings from last running state.
2614
if server_settings["restore"]:
2615
try:
2616
with open(stored_state_path, "rb") as stored_state:
2617
clients_data, old_client_settings = pickle.load(
2618
stored_state)
2619
os.remove(stored_state_path)
2620
except IOError as e:
2621
if e.errno == errno.ENOENT:
2622
logger.warning("Could not load persistent state:"
2623
" {}".format(os.strerror(e.errno)))
2624
else:
2625
logger.critical("Could not load persistent state:",
2626
exc_info=e)
2627
raise
2628
except EOFError as e:
2629
logger.warning("Could not load persistent state: "
2630
"EOFError:",
2631
exc_info=e)
2632
2633
with PGPEngine() as pgp:
2634
for client_name, client in clients_data.items():
2635
# Skip removed clients
2636
if client_name not in client_settings:
2637
continue
2638
2639
# Decide which value to use after restoring saved state.
2640
# We have three different values: Old config file,
2641
# new config file, and saved state.
2642
# New config value takes precedence if it differs from old
2643
# config value, otherwise use saved state.
2644
for name, value in client_settings[client_name].items():
2645
try:
2646
# For each value in new config, check if it
2647
# differs from the old config value (Except for
2648
# the "secret" attribute)
2649
if (name != "secret"
2650
and (value !=
2651
old_client_settings[client_name][name])):
2652
client[name] = value
2653
except KeyError:
2654
pass
2655
2656
# Clients who has passed its expire date can still be
2657
# enabled if its last checker was successful. Clients
2658
# whose checker succeeded before we stored its state is
2659
# assumed to have successfully run all checkers during
2660
# downtime.
2661
if client["enabled"]:
2662
if datetime.datetime.utcnow() >= client["expires"]:
2663
if not client["last_checked_ok"]:
2664
logger.warning(
2665
"disabling client {} - Client never "
2666
"performed a successful checker".format(
2667
client_name))
2668
client["enabled"] = False
2669
elif client["last_checker_status"] != 0:
2670
logger.warning(
2671
"disabling client {} - Client last"
2672
" checker failed with error code"
2673
" {}".format(
2674
client_name,
2675
client["last_checker_status"]))
2676
client["enabled"] = False
2677
else:
2678
client["expires"] = (
2679
datetime.datetime.utcnow()
2680
+ client["timeout"])
2681
logger.debug("Last checker succeeded,"
2682
" keeping {} enabled".format(
2683
client_name))
1922
2684
try:
1923
yield (name, special_settings[name]())
1924
except KeyError:
1925
yield (name, value)
1926
1927
tcp_server.clients.update(set(
1928
client_class(name = section,
1929
config= dict(client_config_items(
1930
client_config, section)))
1931
for section in client_config.sections()))
2685
client["secret"] = pgp.decrypt(
2686
client["encrypted_secret"],
2687
client_settings[client_name]["secret"])
2688
except PGPError:
2689
# If decryption fails, we use secret from new settings
2690
logger.debug("Failed to decrypt {} old secret".format(
2691
client_name))
2692
client["secret"] = (client_settings[client_name]
2693
["secret"])
2694
2695
# Add/remove clients based on new changes made to config
2696
for client_name in (set(old_client_settings)
2697
- set(client_settings)):
2698
del clients_data[client_name]
2699
for client_name in (set(client_settings)
2700
- set(old_client_settings)):
2701
clients_data[client_name] = client_settings[client_name]
2702
2703
# Create all client objects
2704
for client_name, client in clients_data.items():
2705
tcp_server.clients[client_name] = client_class(
2706
name = client_name,
2707
settings = client,
2708
server_settings = server_settings)
2709
1932
2710
if not tcp_server.clients:
1933
2711
logger.warning("No clients defined")
1934
1935
if not debug:
1936
try:
1937
with pidfile:
1938
pid = os.getpid()
1939
pidfile.write(str(pid) + "\n".encode("utf-8"))
1940
del pidfile
1941
except IOError:
1942
logger.error("Could not write to file %r with PID %d",
1943
pidfilename, pid)
1944
except NameError:
1945
# "pidfile" was never created
1946
pass
2712
2713
if not foreground:
2714
if pidfile is not None:
2715
try:
2716
with pidfile:
2717
pid = os.getpid()
2718
pidfile.write("{}\n".format(pid).encode("utf-8"))
2719
except IOError:
2720
logger.error("Could not write to file %r with PID %d",
2721
pidfilename, pid)
2722
del pidfile
1947
2723
del pidfilename
1948
1949
signal.signal(signal.SIGINT, signal.SIG_IGN)
1950
2724
1951
2725
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1952
2726
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1953
2727
1954
2728
if use_dbus:
1955
class MandosDBusService(dbus.service.Object):
2729
2730
@alternate_dbus_interfaces(
2731
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2732
class MandosDBusService(DBusObjectWithProperties):
1956
2733
"""A D-Bus proxy object"""
2734
1957
2735
def __init__(self):
1958
2736
dbus.service.Object.__init__(self, bus, "/")
1959
_interface = "se.bsnet.fukt.Mandos"
2737
2738
_interface = "se.recompile.Mandos"
2739
2740
@dbus_interface_annotations(_interface)
2741
def _foo(self):
2742
return {
2743
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2744
"false" }
1960
2745
1961
2746
@dbus.service.signal(_interface, signature="o")
1962
2747
def ClientAdded(self, objpath):
1976
2761
@dbus.service.method(_interface, out_signature="ao")
1977
2762
def GetAllClients(self):
1978
2763
"D-Bus method"
1979
return dbus.Array(c.dbus_object_path
1980
for c in tcp_server.clients)
2764
return dbus.Array(c.dbus_object_path for c in
2765
tcp_server.clients.itervalues())
1981
2766
1982
2767
@dbus.service.method(_interface,
1983
2768
out_signature="a{oa{sv}}")
1984
2769
def GetAllClientsWithProperties(self):
1985
2770
"D-Bus method"
1986
2771
return dbus.Dictionary(
1987
((c.dbus_object_path, c.GetAll(""))
1988
for c in tcp_server.clients),
2772
{ c.dbus_object_path: c.GetAll("")
2773
for c in tcp_server.clients.itervalues() },
1989
2774
signature="oa{sv}")
1990
2775
1991
2776
@dbus.service.method(_interface, in_signature="o")
1992
2777
def RemoveClient(self, object_path):
1993
2778
"D-Bus method"
1994
for c in tcp_server.clients:
2779
for c in tcp_server.clients.itervalues():
1995
2780
if c.dbus_object_path == object_path:
1996
tcp_server.clients.remove(c)
2781
del tcp_server.clients[c.name]
1997
2782
c.remove_from_connection()
1998
2783
# Don't signal anything except ClientRemoved
1999
2784
c.disable(quiet=True)
2008
2793
2009
2794
def cleanup():
2010
2795
"Cleanup function; run on exit"
2011
service.cleanup()
2012
2796
if zeroconf:
2797
service.cleanup()
2798
2799
multiprocessing.active_children()
2800
wnull.close()
2801
if not (tcp_server.clients or client_settings):
2802
return
2803
2804
# Store client before exiting. Secrets are encrypted with key
2805
# based on what config file has. If config file is
2806
# removed/edited, old secret will thus be unrecovable.
2807
clients = {}
2808
with PGPEngine() as pgp:
2809
for client in tcp_server.clients.itervalues():
2810
key = client_settings[client.name]["secret"]
2811
client.encrypted_secret = pgp.encrypt(client.secret,
2812
key)
2813
client_dict = {}
2814
2815
# A list of attributes that can not be pickled
2816
# + secret.
2817
exclude = { "bus", "changedstate", "secret",
2818
"checker", "server_settings" }
2819
for name, typ in inspect.getmembers(dbus.service
2820
.Object):
2821
exclude.add(name)
2822
2823
client_dict["encrypted_secret"] = (client
2824
.encrypted_secret)
2825
for attr in client.client_structure:
2826
if attr not in exclude:
2827
client_dict[attr] = getattr(client, attr)
2828
2829
clients[client.name] = client_dict
2830
del client_settings[client.name]["secret"]
2831
2832
try:
2833
with tempfile.NamedTemporaryFile(
2834
mode='wb',
2835
suffix=".pickle",
2836
prefix='clients-',
2837
dir=os.path.dirname(stored_state_path),
2838
delete=False) as stored_state:
2839
pickle.dump((clients, client_settings), stored_state)
2840
tempname = stored_state.name
2841
os.rename(tempname, stored_state_path)
2842
except (IOError, OSError) as e:
2843
if not debug:
2844
try:
2845
os.remove(tempname)
2846
except NameError:
2847
pass
2848
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2849
logger.warning("Could not save persistent state: {}"
2850
.format(os.strerror(e.errno)))
2851
else:
2852
logger.warning("Could not save persistent state:",
2853
exc_info=e)
2854
raise
2855
2856
# Delete all clients, and settings from config
2013
2857
while tcp_server.clients:
2014
client = tcp_server.clients.pop()
2858
name, client = tcp_server.clients.popitem()
2015
2859
if use_dbus:
2016
2860
client.remove_from_connection()
2017
client.disable_hook = None
2018
2861
# Don't signal anything except ClientRemoved
2019
2862
client.disable(quiet=True)
2020
2863
if use_dbus:
2021
2864
# Emit D-Bus signal
2022
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2023
client.name)
2865
mandos_dbus_service.ClientRemoved(
2866
client.dbus_object_path, client.name)
2867
client_settings.clear()
2024
2868
2025
2869
atexit.register(cleanup)
2026
2870
2027
for client in tcp_server.clients:
2871
for client in tcp_server.clients.itervalues():
2028
2872
if use_dbus:
2029
2873
# Emit D-Bus signal
2030
2874
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2031
client.enable()
2875
# Need to initiate checking of clients
2876
if client.enabled:
2877
client.init_checker()
2032
2878
2033
2879
tcp_server.enable()
2034
2880
tcp_server.server_activate()
2035
2881
2036
2882
# Find out what port we got
2037
service.port = tcp_server.socket.getsockname()[1]
2883
if zeroconf:
2884
service.port = tcp_server.socket.getsockname()[1]
2038
2885
if use_ipv6:
2039
2886
logger.info("Now listening on address %r, port %d,"
2040
" flowinfo %d, scope_id %d"
2041
% tcp_server.socket.getsockname())
2887
" flowinfo %d, scope_id %d",
2888
*tcp_server.socket.getsockname())
2042
2889
else: # IPv4
2043
logger.info("Now listening on address %r, port %d"
2044
% tcp_server.socket.getsockname())
2890
logger.info("Now listening on address %r, port %d",
2891
*tcp_server.socket.getsockname())
2045
2892
2046
2893
#service.interface = tcp_server.socket.getsockname()[3]
2047
2894
2048
2895
try:
2049
# From the Avahi example code
2050
try:
2051
service.activate()
2052
except dbus.exceptions.DBusException as error:
2053
logger.critical("DBusException: %s", error)
2054
cleanup()
2055
sys.exit(1)
2056
# End of Avahi example code
2896
if zeroconf:
2897
# From the Avahi example code
2898
try:
2899
service.activate()
2900
except dbus.exceptions.DBusException as error:
2901
logger.critical("D-Bus Exception", exc_info=error)
2902
cleanup()
2903
sys.exit(1)
2904
# End of Avahi example code
2057
2905
2058
2906
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2059
2907
lambda *args, **kwargs:
2063
2911
logger.debug("Starting main loop")
2064
2912
main_loop.run()
2065
2913
except AvahiError as error:
2066
logger.critical("AvahiError: %s", error)
2914
logger.critical("Avahi Error", exc_info=error)
2067
2915
cleanup()
2068
2916
sys.exit(1)
2069
2917
except KeyboardInterrupt:
2074
2922
# Must run before the D-Bus bus name gets deregistered
2075
2923
cleanup()
2076
2924
2925
2077
2926
if __name__ == '__main__':
2078
2927
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0