To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 752
- compare with another revision
- download diff
- download tarball
- view history from revision 752
- Committer: Teddy Hogeborn
- Date: 2015-05-31 15:56:58 UTC
- Revision ID: teddy@recompile.se-20150531155658-l7znu7zlqr2dmuwd
mandos: Generate better messages in exceptions.
mandos (ProxyClient.__init__): Include fingerprint in KeyError().
(rfc3339_duration_to_delta): Include duration in ValueError().
mandos (ProxyClient.__init__): Include fingerprint in KeyError().
(rfc3339_duration_to_delta): Include duration in ValueError().
- files added:
- debian/mandos-client.examples
- debian/upstream
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
import SocketServer as socketserver
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
40
43
import socket
41
44
import argparse
42
45
import datetime
47
50
import gnutls.library.functions
48
51
import gnutls.library.constants
49
52
import gnutls.library.types
50
import ConfigParser as configparser
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
51
57
import sys
52
58
import re
53
59
import os
62
68
import struct
63
69
import fcntl
64
70
import functools
65
import cPickle as pickle
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
66
75
import multiprocessing
67
76
import types
68
77
import binascii
69
78
import tempfile
70
79
import itertools
80
import collections
81
import codecs
71
82
72
83
import dbus
73
84
import dbus.service
74
import gobject
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
75
89
import avahi
76
90
from dbus.mainloop.glib import DBusGMainLoop
77
91
import ctypes
78
92
import ctypes.util
79
93
import xml.dom.minidom
80
94
import inspect
81
import GnuPGInterface
82
95
83
96
try:
84
97
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
88
101
except ImportError:
89
102
SO_BINDTODEVICE = None
90
103
91
version = "1.5.3"
104
if sys.version_info.major == 2:
105
str = unicode
106
107
version = "1.6.9"
92
108
stored_state_file = "clients.pickle"
93
109
94
110
logger = logging.getLogger()
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
111
syslogger = None
98
112
99
113
try:
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
102
.if_nametoindex)
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
103
116
except (OSError, AttributeError):
117
104
118
def if_nametoindex(interface):
105
119
"Get an interface index the hard way, i.e. using fcntl()"
106
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
121
with contextlib.closing(socket.socket()) as s:
108
122
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
110
interface))
111
interface_index = struct.unpack(str("I"),
112
ifreq[16:20])[0]
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
113
125
return interface_index
114
126
115
127
116
128
def initlogger(debug, level=logging.WARNING):
117
129
"""init logger and add loglevel"""
118
130
131
global syslogger
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
119
135
syslogger.setFormatter(logging.Formatter
120
136
('Mandos [%(process)d]: %(levelname)s:'
121
137
' %(message)s'))
138
154
139
155
class PGPEngine(object):
140
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
157
141
158
def __init__(self):
142
self.gnupg = GnuPGInterface.GnuPG()
143
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
self.gnupg = GnuPGInterface.GnuPG()
145
self.gnupg.options.meta_interactive = False
146
self.gnupg.options.homedir = self.tempdir
147
self.gnupg.options.extra_args.extend(['--force-mdc',
148
'--quiet',
149
'--no-use-agent'])
160
self.gnupgargs = ['--batch',
161
'--home', self.tempdir,
162
'--force-mdc',
163
'--quiet',
164
'--no-use-agent']
150
165
151
166
def __enter__(self):
152
167
return self
153
168
154
def __exit__ (self, exc_type, exc_value, traceback):
169
def __exit__(self, exc_type, exc_value, traceback):
155
170
self._cleanup()
156
171
return False
157
172
174
189
def password_encode(self, password):
175
190
# Passphrase can not be empty and can not contain newlines or
176
191
# NUL bytes. So we prefix it and hex encode it.
177
return b"mandos" + binascii.hexlify(password)
192
encoded = b"mandos" + binascii.hexlify(password)
193
if len(encoded) > 2048:
194
# GnuPG can't handle long passwords, so encode differently
195
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
196
.replace(b"\n", b"\\n")
197
.replace(b"\0", b"\\x00"))
198
return encoded
178
199
179
200
def encrypt(self, data, password):
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
182
try:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
187
f.write(data)
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
190
proc.wait()
191
except IOError as e:
192
raise PGPError(e)
193
self.gnupg.passphrase = None
201
passphrase = self.password_encode(password)
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
204
passfile.write(passphrase)
205
passfile.flush()
206
proc = subprocess.Popen(['gpg', '--symmetric',
207
'--passphrase-file',
208
passfile.name]
209
+ self.gnupgargs,
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
214
if proc.returncode != 0:
215
raise PGPError(err)
194
216
return ciphertext
195
217
196
218
def decrypt(self, data, password):
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
199
try:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
204
f.write(data)
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
207
proc.wait()
208
except IOError as e:
209
raise PGPError(e)
210
self.gnupg.passphrase = None
219
passphrase = self.password_encode(password)
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
222
passfile.write(passphrase)
223
passfile.flush()
224
proc = subprocess.Popen(['gpg', '--decrypt',
225
'--passphrase-file',
226
passfile.name]
227
+ self.gnupgargs,
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
232
if proc.returncode != 0:
233
raise PGPError(err)
211
234
return decrypted_plaintext
212
235
213
236
214
237
class AvahiError(Exception):
215
238
def __init__(self, value, *args, **kwargs):
216
239
self.value = value
217
super(AvahiError, self).__init__(value, *args, **kwargs)
218
def __unicode__(self):
219
return unicode(repr(self.value))
240
return super(AvahiError, self).__init__(value, *args,
241
**kwargs)
242
220
243
221
244
class AvahiServiceError(AvahiError):
222
245
pass
223
246
247
224
248
class AvahiGroupError(AvahiError):
225
249
pass
226
250
233
257
Used to optionally bind to the specified interface.
234
258
name: string; Example: 'Mandos'
235
259
type: string; Example: '_mandos._tcp'.
236
See <http://www.dns-sd.org/ServiceTypes.html>
260
See <https://www.iana.org/assignments/service-names-port-numbers>
237
261
port: integer; what port to announce
238
262
TXT: list of strings; TXT record for the service
239
263
domain: string; Domain to publish on, default to .local if empty.
246
270
bus: dbus.SystemBus()
247
271
"""
248
272
249
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
250
servicetype = None, port = None, TXT = None,
251
domain = "", host = "", max_renames = 32768,
252
protocol = avahi.PROTO_UNSPEC, bus = None):
273
def __init__(self,
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
253
284
self.interface = interface
254
285
self.name = name
255
286
self.type = servicetype
265
296
self.bus = bus
266
297
self.entry_group_state_changed_match = None
267
298
268
def rename(self):
299
def rename(self, remove=True):
269
300
"""Derived from the Avahi example code"""
270
301
if self.rename_count >= self.max_renames:
271
302
logger.critical("No suitable Zeroconf service name found"
272
303
" after %i retries, exiting.",
273
304
self.rename_count)
274
305
raise AvahiServiceError("Too many renames")
275
self.name = unicode(self.server
276
.GetAlternativeServiceName(self.name))
306
self.name = str(
307
self.server.GetAlternativeServiceName(self.name))
308
self.rename_count += 1
277
309
logger.info("Changing Zeroconf service name to %r ...",
278
310
self.name)
279
self.remove()
311
if remove:
312
self.remove()
280
313
try:
281
314
self.add()
282
315
except dbus.exceptions.DBusException as error:
283
logger.critical("D-Bus Exception", exc_info=error)
284
self.cleanup()
285
os._exit(1)
286
self.rename_count += 1
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
320
else:
321
logger.critical("D-Bus Exception", exc_info=error)
322
self.cleanup()
323
os._exit(1)
287
324
288
325
def remove(self):
289
326
"""Derived from the Avahi example code"""
327
364
self.rename()
328
365
elif state == avahi.ENTRY_GROUP_FAILURE:
329
366
logger.critical("Avahi: Error in group state changed %s",
330
unicode(error))
331
raise AvahiGroupError("State changed: {0!s}"
332
.format(error))
367
str(error))
368
raise AvahiGroupError("State changed: {!s}".format(error))
333
369
334
370
def cleanup(self):
335
371
"""Derived from the Avahi example code"""
345
381
def server_state_changed(self, state, error=None):
346
382
"""Derived from the Avahi example code"""
347
383
logger.debug("Avahi server state change: %i", state)
348
bad_states = { avahi.SERVER_INVALID:
349
"Zeroconf server invalid",
350
avahi.SERVER_REGISTERING: None,
351
avahi.SERVER_COLLISION:
352
"Zeroconf server name collision",
353
avahi.SERVER_FAILURE:
354
"Zeroconf server failure" }
384
bad_states = {
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
389
}
355
390
if state in bad_states:
356
391
if bad_states[state] is not None:
357
392
if error is None:
376
411
follow_name_owner_changes=True),
377
412
avahi.DBUS_INTERFACE_SERVER)
378
413
self.server.connect_to_signal("StateChanged",
379
self.server_state_changed)
414
self.server_state_changed)
380
415
self.server_state_changed(self.server.GetState())
381
416
417
382
418
class AvahiServiceToSyslog(AvahiService):
383
def rename(self):
419
def rename(self, *args, **kwargs):
384
420
"""Add the new name to the syslog messages"""
385
ret = AvahiService.rename(self)
386
syslogger.setFormatter(logging.Formatter
387
('Mandos ({0}) [%(process)d]:'
388
' %(levelname)s: %(message)s'
389
.format(self.name)))
421
ret = AvahiService.rename(self, *args, **kwargs)
422
syslogger.setFormatter(logging.Formatter(
423
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
424
.format(self.name)))
390
425
return ret
391
426
392
def timedelta_to_milliseconds(td):
393
"Convert a datetime.timedelta() to milliseconds"
394
return ((td.days * 24 * 60 * 60 * 1000)
395
+ (td.seconds * 1000)
396
+ (td.microseconds // 1000))
397
427
398
428
class Client(object):
399
429
"""A representation of a client host served by this server.
436
466
runtime_expansions: Allowed attributes for runtime expansion.
437
467
expires: datetime.datetime(); time (UTC) when a client will be
438
468
disabled, or None
469
server_settings: The server_settings dict from main()
439
470
"""
440
471
441
472
runtime_expansions = ("approval_delay", "approval_duration",
442
"created", "enabled", "fingerprint",
443
"host", "interval", "last_checked_ok",
473
"created", "enabled", "expires",
474
"fingerprint", "host", "interval",
475
"last_approval_request", "last_checked_ok",
444
476
"last_enabled", "name", "timeout")
445
client_defaults = { "timeout": "5m",
446
"extended_timeout": "15m",
447
"interval": "2m",
448
"checker": "fping -q -- %%(host)s",
449
"host": "",
450
"approval_delay": "0s",
451
"approval_duration": "1s",
452
"approved_by_default": "True",
453
"enabled": "True",
454
}
455
456
def timeout_milliseconds(self):
457
"Return the 'timeout' attribute in milliseconds"
458
return timedelta_to_milliseconds(self.timeout)
459
460
def extended_timeout_milliseconds(self):
461
"Return the 'extended_timeout' attribute in milliseconds"
462
return timedelta_to_milliseconds(self.extended_timeout)
463
464
def interval_milliseconds(self):
465
"Return the 'interval' attribute in milliseconds"
466
return timedelta_to_milliseconds(self.interval)
467
468
def approval_delay_milliseconds(self):
469
return timedelta_to_milliseconds(self.approval_delay)
477
client_defaults = {
478
"timeout": "PT5M",
479
"extended_timeout": "PT15M",
480
"interval": "PT2M",
481
"checker": "fping -q -- %%(host)s",
482
"host": "",
483
"approval_delay": "PT0S",
484
"approval_duration": "PT1S",
485
"approved_by_default": "True",
486
"enabled": "True",
487
}
470
488
471
489
@staticmethod
472
490
def config_parser(config):
488
506
client["enabled"] = config.getboolean(client_name,
489
507
"enabled")
490
508
509
# Uppercase and remove spaces from fingerprint for later
510
# comparison purposes with return value from the
511
# fingerprint() function
491
512
client["fingerprint"] = (section["fingerprint"].upper()
492
513
.replace(" ", ""))
493
514
if "secret" in section:
498
519
"rb") as secfile:
499
520
client["secret"] = secfile.read()
500
521
else:
501
raise TypeError("No secret or secfile for section {0}"
522
raise TypeError("No secret or secfile for section {}"
502
523
.format(section))
503
524
client["timeout"] = string_to_delta(section["timeout"])
504
525
client["extended_timeout"] = string_to_delta(
515
536
516
537
return settings
517
538
518
def __init__(self, settings, name = None):
539
def __init__(self, settings, name = None, server_settings=None):
519
540
self.name = name
541
if server_settings is None:
542
server_settings = {}
543
self.server_settings = server_settings
520
544
# adding all client settings
521
for setting, value in settings.iteritems():
545
for setting, value in settings.items():
522
546
setattr(self, setting, value)
523
547
524
548
if self.enabled:
532
556
self.expires = None
533
557
534
558
logger.debug("Creating client %r", self.name)
535
# Uppercase and remove spaces from fingerprint for later
536
# comparison purposes with return value from the fingerprint()
537
# function
538
559
logger.debug(" Fingerprint: %s", self.fingerprint)
539
560
self.created = settings.get("created",
540
561
datetime.datetime.utcnow())
547
568
self.current_checker_command = None
548
569
self.approved = None
549
570
self.approvals_pending = 0
550
self.changedstate = (multiprocessing_manager
551
.Condition(multiprocessing_manager
552
.Lock()))
553
self.client_structure = [attr for attr in
554
self.__dict__.iterkeys()
571
self.changedstate = multiprocessing_manager.Condition(
572
multiprocessing_manager.Lock())
573
self.client_structure = [attr
574
for attr in self.__dict__.iterkeys()
555
575
if not attr.startswith("_")]
556
576
self.client_structure.append("client_structure")
557
577
558
for name, t in inspect.getmembers(type(self),
559
lambda obj:
560
isinstance(obj,
561
property)):
578
for name, t in inspect.getmembers(
579
type(self), lambda obj: isinstance(obj, property)):
562
580
if not name.startswith("_"):
563
581
self.client_structure.append(name)
564
582
606
624
# and every interval from then on.
607
625
if self.checker_initiator_tag is not None:
608
626
gobject.source_remove(self.checker_initiator_tag)
609
self.checker_initiator_tag = (gobject.timeout_add
610
(self.interval_milliseconds(),
611
self.start_checker))
627
self.checker_initiator_tag = gobject.timeout_add(
628
int(self.interval.total_seconds() * 1000),
629
self.start_checker)
612
630
# Schedule a disable() when 'timeout' has passed
613
631
if self.disable_initiator_tag is not None:
614
632
gobject.source_remove(self.disable_initiator_tag)
615
self.disable_initiator_tag = (gobject.timeout_add
616
(self.timeout_milliseconds(),
617
self.disable))
633
self.disable_initiator_tag = gobject.timeout_add(
634
int(self.timeout.total_seconds() * 1000), self.disable)
618
635
# Also start a new checker *right now*.
619
636
self.start_checker()
620
637
629
646
vars(self))
630
647
self.checked_ok()
631
648
else:
632
logger.info("Checker for %(name)s failed",
633
vars(self))
649
logger.info("Checker for %(name)s failed", vars(self))
634
650
else:
635
651
self.last_checker_status = -1
636
652
logger.warning("Checker for %(name)s crashed?",
650
666
gobject.source_remove(self.disable_initiator_tag)
651
667
self.disable_initiator_tag = None
652
668
if getattr(self, "enabled", False):
653
self.disable_initiator_tag = (gobject.timeout_add
654
(timedelta_to_milliseconds
655
(timeout), self.disable))
669
self.disable_initiator_tag = gobject.timeout_add(
670
int(timeout.total_seconds() * 1000), self.disable)
656
671
self.expires = datetime.datetime.utcnow() + timeout
657
672
658
673
def need_approval(self):
675
690
# If a checker exists, make sure it is not a zombie
676
691
try:
677
692
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
678
except (AttributeError, OSError) as error:
679
if (isinstance(error, OSError)
680
and error.errno != errno.ECHILD):
681
raise error
693
except AttributeError:
694
pass
695
except OSError as error:
696
if error.errno != errno.ECHILD:
697
raise
682
698
else:
683
699
if pid:
684
700
logger.warning("Checker was a zombie")
687
703
self.current_checker_command)
688
704
# Start a new checker if needed
689
705
if self.checker is None:
706
# Escape attributes for the shell
707
escaped_attrs = {
708
attr: re.escape(str(getattr(self, attr)))
709
for attr in self.runtime_expansions }
690
710
try:
691
# In case checker_command has exactly one % operator
692
command = self.checker_command % self.host
693
except TypeError:
694
# Escape attributes for the shell
695
escaped_attrs = dict(
696
(attr,
697
re.escape(unicode(str(getattr(self, attr, "")),
698
errors=
699
'replace')))
700
for attr in
701
self.runtime_expansions)
702
703
try:
704
command = self.checker_command % escaped_attrs
705
except TypeError as error:
706
logger.error('Could not format string "%s"',
707
self.checker_command, exc_info=error)
708
return True # Try again later
711
command = self.checker_command % escaped_attrs
712
except TypeError as error:
713
logger.error('Could not format string "%s"',
714
self.checker_command,
715
exc_info=error)
716
return True # Try again later
709
717
self.current_checker_command = command
710
718
try:
711
logger.info("Starting checker %r for %s",
712
command, self.name)
719
logger.info("Starting checker %r for %s", command,
720
self.name)
713
721
# We don't need to redirect stdout and stderr, since
714
722
# in normal mode, that is already done by daemon(),
715
723
# and in debug mode we don't want to. (Stdin is
716
724
# always replaced by /dev/null.)
725
# The exception is when not debugging but nevertheless
726
# running in the foreground; use the previously
727
# created wnull.
728
popen_args = {}
729
if (not self.server_settings["debug"]
730
and self.server_settings["foreground"]):
731
popen_args.update({"stdout": wnull,
732
"stderr": wnull })
717
733
self.checker = subprocess.Popen(command,
718
734
close_fds=True,
719
shell=True, cwd="/")
720
self.checker_callback_tag = (gobject.child_watch_add
721
(self.checker.pid,
722
self.checker_callback,
723
data=command))
724
# The checker may have completed before the gobject
725
# watch was added. Check for this.
735
shell=True,
736
cwd="/",
737
**popen_args)
738
except OSError as error:
739
logger.error("Failed to start subprocess",
740
exc_info=error)
741
return True
742
self.checker_callback_tag = gobject.child_watch_add(
743
self.checker.pid, self.checker_callback, data=command)
744
# The checker may have completed before the gobject
745
# watch was added. Check for this.
746
try:
726
747
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
727
if pid:
728
gobject.source_remove(self.checker_callback_tag)
729
self.checker_callback(pid, status, command)
730
748
except OSError as error:
731
logger.error("Failed to start subprocess",
732
exc_info=error)
749
if error.errno == errno.ECHILD:
750
# This should never happen
751
logger.error("Child process vanished",
752
exc_info=error)
753
return True
754
raise
755
if pid:
756
gobject.source_remove(self.checker_callback_tag)
757
self.checker_callback(pid, status, command)
733
758
# Re-run this periodically if run by gobject.timeout_add
734
759
return True
735
760
752
777
self.checker = None
753
778
754
779
755
def dbus_service_property(dbus_interface, signature="v",
756
access="readwrite", byte_arrays=False):
780
def dbus_service_property(dbus_interface,
781
signature="v",
782
access="readwrite",
783
byte_arrays=False):
757
784
"""Decorators for marking methods of a DBusObjectWithProperties to
758
785
become properties on the D-Bus.
759
786
768
795
# "Set" method, so we fail early here:
769
796
if byte_arrays and signature != "ay":
770
797
raise ValueError("Byte arrays not supported for non-'ay'"
771
" signature {0!r}".format(signature))
798
" signature {!r}".format(signature))
799
772
800
def decorator(func):
773
801
func._dbus_is_property = True
774
802
func._dbus_interface = dbus_interface
779
807
func._dbus_name = func._dbus_name[:-14]
780
808
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
781
809
return func
810
782
811
return decorator
783
812
784
813
793
822
"org.freedesktop.DBus.Property.EmitsChangedSignal":
794
823
"false"}
795
824
"""
825
796
826
def decorator(func):
797
827
func._dbus_is_interface = True
798
828
func._dbus_interface = dbus_interface
799
829
func._dbus_name = dbus_interface
800
830
return func
831
801
832
return decorator
802
833
803
834
805
836
"""Decorator to annotate D-Bus methods, signals or properties
806
837
Usage:
807
838
839
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
840
"org.freedesktop.DBus.Property."
841
"EmitsChangedSignal": "false"})
808
842
@dbus_service_property("org.example.Interface", signature="b",
809
843
access="r")
810
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
811
"org.freedesktop.DBus.Property."
812
"EmitsChangedSignal": "false"})
813
844
def Property_dbus_property(self):
814
845
return dbus.Boolean(False)
815
846
"""
847
816
848
def decorator(func):
817
849
func._dbus_annotations = annotations
818
850
return func
851
819
852
return decorator
820
853
821
854
822
855
class DBusPropertyException(dbus.exceptions.DBusException):
823
856
"""A base class for D-Bus property-related exceptions
824
857
"""
825
def __unicode__(self):
826
return unicode(str(self))
858
pass
827
859
828
860
829
861
class DBusPropertyAccessException(DBusPropertyException):
853
885
If called like _is_dbus_thing("method") it returns a function
854
886
suitable for use as predicate to inspect.getmembers().
855
887
"""
856
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
888
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
857
889
False)
858
890
859
891
def _get_all_dbus_things(self, thing):
860
892
"""Returns a generator of (name, attribute) pairs
861
893
"""
862
return ((getattr(athing.__get__(self), "_dbus_name",
863
name),
894
return ((getattr(athing.__get__(self), "_dbus_name", name),
864
895
athing.__get__(self))
865
896
for cls in self.__class__.__mro__
866
897
for name, athing in
867
inspect.getmembers(cls,
868
self._is_dbus_thing(thing)))
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
869
899
870
900
def _get_dbus_property(self, interface_name, property_name):
871
901
"""Returns a bound method if one exists which is a D-Bus
872
902
property with the specified name and interface.
873
903
"""
874
for cls in self.__class__.__mro__:
875
for name, value in (inspect.getmembers
876
(cls,
877
self._is_dbus_thing("property"))):
904
for cls in self.__class__.__mro__:
905
for name, value in inspect.getmembers(
906
cls, self._is_dbus_thing("property")):
878
907
if (value._dbus_name == property_name
879
908
and value._dbus_interface == interface_name):
880
909
return value.__get__(self)
881
910
882
911
# No such property
883
raise DBusPropertyNotFound(self.dbus_object_path + ":"
884
+ interface_name + "."
885
+ property_name)
912
raise DBusPropertyNotFound("{}:{}.{}".format(
913
self.dbus_object_path, interface_name, property_name))
886
914
887
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
915
@dbus.service.method(dbus.PROPERTIES_IFACE,
916
in_signature="ss",
888
917
out_signature="v")
889
918
def Get(self, interface_name, property_name):
890
919
"""Standard D-Bus property Get() method, see D-Bus standard.
908
937
# The byte_arrays option is not supported yet on
909
938
# signatures other than "ay".
910
939
if prop._dbus_signature != "ay":
911
raise ValueError
940
raise ValueError("Byte arrays not supported for non-"
941
"'ay' signature {!r}"
942
.format(prop._dbus_signature))
912
943
value = dbus.ByteArray(b''.join(chr(byte)
913
944
for byte in value))
914
945
prop(value)
915
946
916
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
947
@dbus.service.method(dbus.PROPERTIES_IFACE,
948
in_signature="s",
917
949
out_signature="a{sv}")
918
950
def GetAll(self, interface_name):
919
951
"""Standard D-Bus property GetAll() method, see D-Bus
934
966
if not hasattr(value, "variant_level"):
935
967
properties[name] = value
936
968
continue
937
properties[name] = type(value)(value, variant_level=
938
value.variant_level+1)
969
properties[name] = type(value)(
970
value, variant_level = value.variant_level + 1)
939
971
return dbus.Dictionary(properties, signature="sv")
940
972
973
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
974
def PropertiesChanged(self, interface_name, changed_properties,
975
invalidated_properties):
976
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
977
standard.
978
"""
979
pass
980
941
981
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
942
982
out_signature="s",
943
983
path_keyword='object_path',
951
991
connection)
952
992
try:
953
993
document = xml.dom.minidom.parseString(xmlstring)
994
954
995
def make_tag(document, name, prop):
955
996
e = document.createElement("property")
956
997
e.setAttribute("name", name)
957
998
e.setAttribute("type", prop._dbus_signature)
958
999
e.setAttribute("access", prop._dbus_access)
959
1000
return e
1001
960
1002
for if_tag in document.getElementsByTagName("interface"):
961
1003
# Add property tags
962
1004
for tag in (make_tag(document, name, prop)
974
1016
if (name == tag.getAttribute("name")
975
1017
and prop._dbus_interface
976
1018
== if_tag.getAttribute("name")):
977
annots.update(getattr
978
(prop,
979
"_dbus_annotations",
980
{}))
981
for name, value in annots.iteritems():
1019
annots.update(getattr(
1020
prop, "_dbus_annotations", {}))
1021
for name, value in annots.items():
982
1022
ann_tag = document.createElement(
983
1023
"annotation")
984
1024
ann_tag.setAttribute("name", name)
987
1027
# Add interface annotation tags
988
1028
for annotation, value in dict(
989
1029
itertools.chain.from_iterable(
990
annotations().iteritems()
991
for name, annotations in
992
self._get_all_dbus_things("interface")
1030
annotations().items()
1031
for name, annotations
1032
in self._get_all_dbus_things("interface")
993
1033
if name == if_tag.getAttribute("name")
994
)).iteritems():
1034
)).items():
995
1035
ann_tag = document.createElement("annotation")
996
1036
ann_tag.setAttribute("name", annotation)
997
1037
ann_tag.setAttribute("value", value)
1020
1060
return xmlstring
1021
1061
1022
1062
1023
def datetime_to_dbus (dt, variant_level=0):
1063
def datetime_to_dbus(dt, variant_level=0):
1024
1064
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1025
1065
if dt is None:
1026
1066
return dbus.String("", variant_level = variant_level)
1027
return dbus.String(dt.isoformat(),
1028
variant_level=variant_level)
1067
return dbus.String(dt.isoformat(), variant_level=variant_level)
1029
1068
1030
1069
1031
1070
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1034
1073
interface names according to the "alt_interface_names" mapping.
1035
1074
Usage:
1036
1075
1037
@alternate_dbus_names({"org.example.Interface":
1038
"net.example.AlternateInterface"})
1076
@alternate_dbus_interfaces({"org.example.Interface":
1077
"net.example.AlternateInterface"})
1039
1078
class SampleDBusObject(dbus.service.Object):
1040
1079
@dbus.service.method("org.example.Interface")
1041
1080
def SampleDBusMethod():
1051
1090
(from DBusObjectWithProperties) and interfaces (from the
1052
1091
dbus_interface_annotations decorator).
1053
1092
"""
1093
1054
1094
def wrapper(cls):
1055
1095
for orig_interface_name, alt_interface_name in (
1056
alt_interface_names.iteritems()):
1096
alt_interface_names.items()):
1057
1097
attr = {}
1058
1098
interface_names = set()
1059
1099
# Go though all attributes of the class
1061
1101
# Ignore non-D-Bus attributes, and D-Bus attributes
1062
1102
# with the wrong interface name
1063
1103
if (not hasattr(attribute, "_dbus_interface")
1064
or not attribute._dbus_interface
1065
.startswith(orig_interface_name)):
1104
or not attribute._dbus_interface.startswith(
1105
orig_interface_name)):
1066
1106
continue
1067
1107
# Create an alternate D-Bus interface name based on
1068
1108
# the current name
1069
alt_interface = (attribute._dbus_interface
1070
.replace(orig_interface_name,
1071
alt_interface_name))
1109
alt_interface = attribute._dbus_interface.replace(
1110
orig_interface_name, alt_interface_name)
1072
1111
interface_names.add(alt_interface)
1073
1112
# Is this a D-Bus signal?
1074
1113
if getattr(attribute, "_dbus_is_signal", False):
1075
# Extract the original non-method function by
1076
# black magic
1114
# Extract the original non-method undecorated
1115
# function by black magic
1077
1116
nonmethod_func = (dict(
1078
zip(attribute.func_code.co_freevars,
1079
attribute.__closure__))["func"]
1080
.cell_contents)
1117
zip(attribute.func_code.co_freevars,
1118
attribute.__closure__))
1119
["func"].cell_contents)
1081
1120
# Create a new, but exactly alike, function
1082
1121
# object, and decorate it to be a new D-Bus signal
1083
1122
# with the alternate D-Bus interface name
1084
new_function = (dbus.service.signal
1085
(alt_interface,
1086
attribute._dbus_signature)
1123
new_function = (dbus.service.signal(
1124
alt_interface, attribute._dbus_signature)
1087
1125
(types.FunctionType(
1088
nonmethod_func.func_code,
1089
nonmethod_func.func_globals,
1090
nonmethod_func.func_name,
1091
nonmethod_func.func_defaults,
1092
nonmethod_func.func_closure)))
1126
nonmethod_func.func_code,
1127
nonmethod_func.func_globals,
1128
nonmethod_func.func_name,
1129
nonmethod_func.func_defaults,
1130
nonmethod_func.func_closure)))
1093
1131
# Copy annotations, if any
1094
1132
try:
1095
new_function._dbus_annotations = (
1096
dict(attribute._dbus_annotations))
1133
new_function._dbus_annotations = dict(
1134
attribute._dbus_annotations)
1097
1135
except AttributeError:
1098
1136
pass
1099
1137
# Define a creator of a function to call both the
1104
1142
"""This function is a scope container to pass
1105
1143
func1 and func2 to the "call_both" function
1106
1144
outside of its arguments"""
1145
1107
1146
def call_both(*args, **kwargs):
1108
1147
"""This function will emit two D-Bus
1109
1148
signals by calling func1 and func2"""
1110
1149
func1(*args, **kwargs)
1111
1150
func2(*args, **kwargs)
1151
1112
1152
return call_both
1113
1153
# Create the "call_both" function and add it to
1114
1154
# the class
1119
1159
# object. Decorate it to be a new D-Bus method
1120
1160
# with the alternate D-Bus interface name. Add it
1121
1161
# to the class.
1122
attr[attrname] = (dbus.service.method
1123
(alt_interface,
1124
attribute._dbus_in_signature,
1125
attribute._dbus_out_signature)
1126
(types.FunctionType
1127
(attribute.func_code,
1128
attribute.func_globals,
1129
attribute.func_name,
1130
attribute.func_defaults,
1131
attribute.func_closure)))
1162
attr[attrname] = (
1163
dbus.service.method(
1164
alt_interface,
1165
attribute._dbus_in_signature,
1166
attribute._dbus_out_signature)
1167
(types.FunctionType(attribute.func_code,
1168
attribute.func_globals,
1169
attribute.func_name,
1170
attribute.func_defaults,
1171
attribute.func_closure)))
1132
1172
# Copy annotations, if any
1133
1173
try:
1134
attr[attrname]._dbus_annotations = (
1135
dict(attribute._dbus_annotations))
1174
attr[attrname]._dbus_annotations = dict(
1175
attribute._dbus_annotations)
1136
1176
except AttributeError:
1137
1177
pass
1138
1178
# Is this a D-Bus property?
1141
1181
# object, and decorate it to be a new D-Bus
1142
1182
# property with the alternate D-Bus interface
1143
1183
# name. Add it to the class.
1144
attr[attrname] = (dbus_service_property
1145
(alt_interface,
1146
attribute._dbus_signature,
1147
attribute._dbus_access,
1148
attribute
1149
._dbus_get_args_options
1150
["byte_arrays"])
1151
(types.FunctionType
1152
(attribute.func_code,
1153
attribute.func_globals,
1154
attribute.func_name,
1155
attribute.func_defaults,
1156
attribute.func_closure)))
1184
attr[attrname] = (dbus_service_property(
1185
alt_interface, attribute._dbus_signature,
1186
attribute._dbus_access,
1187
attribute._dbus_get_args_options
1188
["byte_arrays"])
1189
(types.FunctionType(
1190
attribute.func_code,
1191
attribute.func_globals,
1192
attribute.func_name,
1193
attribute.func_defaults,
1194
attribute.func_closure)))
1157
1195
# Copy annotations, if any
1158
1196
try:
1159
attr[attrname]._dbus_annotations = (
1160
dict(attribute._dbus_annotations))
1197
attr[attrname]._dbus_annotations = dict(
1198
attribute._dbus_annotations)
1161
1199
except AttributeError:
1162
1200
pass
1163
1201
# Is this a D-Bus interface?
1166
1204
# object. Decorate it to be a new D-Bus interface
1167
1205
# with the alternate D-Bus interface name. Add it
1168
1206
# to the class.
1169
attr[attrname] = (dbus_interface_annotations
1170
(alt_interface)
1171
(types.FunctionType
1172
(attribute.func_code,
1173
attribute.func_globals,
1174
attribute.func_name,
1175
attribute.func_defaults,
1176
attribute.func_closure)))
1207
attr[attrname] = (
1208
dbus_interface_annotations(alt_interface)
1209
(types.FunctionType(attribute.func_code,
1210
attribute.func_globals,
1211
attribute.func_name,
1212
attribute.func_defaults,
1213
attribute.func_closure)))
1177
1214
if deprecate:
1178
1215
# Deprecate all alternate interfaces
1179
iname="_AlternateDBusNames_interface_annotation{0}"
1216
iname="_AlternateDBusNames_interface_annotation{}"
1180
1217
for interface_name in interface_names:
1218
1181
1219
@dbus_interface_annotations(interface_name)
1182
1220
def func(self):
1183
1221
return { "org.freedesktop.DBus.Deprecated":
1184
"true" }
1222
"true" }
1185
1223
# Find an unused name
1186
1224
for aname in (iname.format(i)
1187
1225
for i in itertools.count()):
1191
1229
if interface_names:
1192
1230
# Replace the class with a new subclass of it with
1193
1231
# methods, signals, etc. as created above.
1194
cls = type(b"{0}Alternate".format(cls.__name__),
1195
(cls,), attr)
1232
cls = type(b"{}Alternate".format(cls.__name__),
1233
(cls, ), attr)
1196
1234
return cls
1235
1197
1236
return wrapper
1198
1237
1199
1238
1200
1239
@alternate_dbus_interfaces({"se.recompile.Mandos":
1201
"se.bsnet.fukt.Mandos"})
1240
"se.bsnet.fukt.Mandos"})
1202
1241
class ClientDBus(Client, DBusObjectWithProperties):
1203
1242
"""A Client class using D-Bus
1204
1243
1208
1247
"""
1209
1248
1210
1249
runtime_expansions = (Client.runtime_expansions
1211
+ ("dbus_object_path",))
1250
+ ("dbus_object_path", ))
1251
1252
_interface = "se.recompile.Mandos.Client"
1212
1253
1213
1254
# dbus.service.Object doesn't use super(), so we can't either.
1214
1255
1217
1258
Client.__init__(self, *args, **kwargs)
1218
1259
# Only now, when this client is initialized, can it show up on
1219
1260
# the D-Bus
1220
client_object_name = unicode(self.name).translate(
1261
client_object_name = str(self.name).translate(
1221
1262
{ord("."): ord("_"),
1222
1263
ord("-"): ord("_")})
1223
self.dbus_object_path = (dbus.ObjectPath
1224
("/clients/" + client_object_name))
1264
self.dbus_object_path = dbus.ObjectPath(
1265
"/clients/" + client_object_name)
1225
1266
DBusObjectWithProperties.__init__(self, self.bus,
1226
1267
self.dbus_object_path)
1227
1268
1228
def notifychangeproperty(transform_func,
1229
dbus_name, type_func=lambda x: x,
1230
variant_level=1):
1269
def notifychangeproperty(transform_func, dbus_name,
1270
type_func=lambda x: x,
1271
variant_level=1,
1272
invalidate_only=False,
1273
_interface=_interface):
1231
1274
""" Modify a variable so that it's a property which announces
1232
1275
its changes to DBus.
1233
1276
1238
1281
to the D-Bus. Default: no transform
1239
1282
variant_level: D-Bus variant level. Default: 1
1240
1283
"""
1241
attrname = "_{0}".format(dbus_name)
1284
attrname = "_{}".format(dbus_name)
1285
1242
1286
def setter(self, value):
1243
1287
if hasattr(self, "dbus_object_path"):
1244
1288
if (not hasattr(self, attrname) or
1245
1289
type_func(getattr(self, attrname, None))
1246
1290
!= type_func(value)):
1247
dbus_value = transform_func(type_func(value),
1248
variant_level
1249
=variant_level)
1250
self.PropertyChanged(dbus.String(dbus_name),
1251
dbus_value)
1291
if invalidate_only:
1292
self.PropertiesChanged(
1293
_interface, dbus.Dictionary(),
1294
dbus.Array((dbus_name, )))
1295
else:
1296
dbus_value = transform_func(
1297
type_func(value),
1298
variant_level = variant_level)
1299
self.PropertyChanged(dbus.String(dbus_name),
1300
dbus_value)
1301
self.PropertiesChanged(
1302
_interface,
1303
dbus.Dictionary({ dbus.String(dbus_name):
1304
dbus_value }),
1305
dbus.Array())
1252
1306
setattr(self, attrname, value)
1253
1307
1254
1308
return property(lambda self: getattr(self, attrname), setter)
1260
1314
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1261
1315
last_enabled = notifychangeproperty(datetime_to_dbus,
1262
1316
"LastEnabled")
1263
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1264
type_func = lambda checker:
1265
checker is not None)
1317
checker = notifychangeproperty(
1318
dbus.Boolean, "CheckerRunning",
1319
type_func = lambda checker: checker is not None)
1266
1320
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1267
1321
"LastCheckedOK")
1268
1322
last_checker_status = notifychangeproperty(dbus.Int16,
1271
1325
datetime_to_dbus, "LastApprovalRequest")
1272
1326
approved_by_default = notifychangeproperty(dbus.Boolean,
1273
1327
"ApprovedByDefault")
1274
approval_delay = notifychangeproperty(dbus.UInt64,
1275
"ApprovalDelay",
1276
type_func =
1277
timedelta_to_milliseconds)
1328
approval_delay = notifychangeproperty(
1329
dbus.UInt64, "ApprovalDelay",
1330
type_func = lambda td: td.total_seconds() * 1000)
1278
1331
approval_duration = notifychangeproperty(
1279
1332
dbus.UInt64, "ApprovalDuration",
1280
type_func = timedelta_to_milliseconds)
1333
type_func = lambda td: td.total_seconds() * 1000)
1281
1334
host = notifychangeproperty(dbus.String, "Host")
1282
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1283
type_func =
1284
timedelta_to_milliseconds)
1335
timeout = notifychangeproperty(
1336
dbus.UInt64, "Timeout",
1337
type_func = lambda td: td.total_seconds() * 1000)
1285
1338
extended_timeout = notifychangeproperty(
1286
1339
dbus.UInt64, "ExtendedTimeout",
1287
type_func = timedelta_to_milliseconds)
1288
interval = notifychangeproperty(dbus.UInt64,
1289
"Interval",
1290
type_func =
1291
timedelta_to_milliseconds)
1340
type_func = lambda td: td.total_seconds() * 1000)
1341
interval = notifychangeproperty(
1342
dbus.UInt64, "Interval",
1343
type_func = lambda td: td.total_seconds() * 1000)
1292
1344
checker_command = notifychangeproperty(dbus.String, "Checker")
1345
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1346
invalidate_only=True)
1293
1347
1294
1348
del notifychangeproperty
1295
1349
1322
1376
*args, **kwargs)
1323
1377
1324
1378
def start_checker(self, *args, **kwargs):
1325
old_checker = self.checker
1326
if self.checker is not None:
1327
old_checker_pid = self.checker.pid
1328
else:
1329
old_checker_pid = None
1379
old_checker_pid = getattr(self.checker, "pid", None)
1330
1380
r = Client.start_checker(self, *args, **kwargs)
1331
1381
# Only if new checker process was started
1332
1382
if (self.checker is not None
1341
1391
1342
1392
def approve(self, value=True):
1343
1393
self.approved = value
1344
gobject.timeout_add(timedelta_to_milliseconds
1345
(self.approval_duration),
1346
self._reset_approved)
1394
gobject.timeout_add(int(self.approval_duration.total_seconds()
1395
* 1000), self._reset_approved)
1347
1396
self.send_changedstate()
1348
1397
1349
1398
## D-Bus methods, signals & properties
1350
_interface = "se.recompile.Mandos.Client"
1351
1399
1352
1400
## Interfaces
1353
1401
1354
@dbus_interface_annotations(_interface)
1355
def _foo(self):
1356
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1357
"false"}
1358
1359
1402
## Signals
1360
1403
1361
1404
# CheckerCompleted - signal
1371
1414
pass
1372
1415
1373
1416
# PropertyChanged - signal
1417
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1374
1418
@dbus.service.signal(_interface, signature="sv")
1375
1419
def PropertyChanged(self, property, value):
1376
1420
"D-Bus signal"
1440
1484
return dbus.Boolean(bool(self.approvals_pending))
1441
1485
1442
1486
# ApprovedByDefault - property
1443
@dbus_service_property(_interface, signature="b",
1487
@dbus_service_property(_interface,
1488
signature="b",
1444
1489
access="readwrite")
1445
1490
def ApprovedByDefault_dbus_property(self, value=None):
1446
1491
if value is None: # get
1448
1493
self.approved_by_default = bool(value)
1449
1494
1450
1495
# ApprovalDelay - property
1451
@dbus_service_property(_interface, signature="t",
1496
@dbus_service_property(_interface,
1497
signature="t",
1452
1498
access="readwrite")
1453
1499
def ApprovalDelay_dbus_property(self, value=None):
1454
1500
if value is None: # get
1455
return dbus.UInt64(self.approval_delay_milliseconds())
1501
return dbus.UInt64(self.approval_delay.total_seconds()
1502
* 1000)
1456
1503
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1457
1504
1458
1505
# ApprovalDuration - property
1459
@dbus_service_property(_interface, signature="t",
1506
@dbus_service_property(_interface,
1507
signature="t",
1460
1508
access="readwrite")
1461
1509
def ApprovalDuration_dbus_property(self, value=None):
1462
1510
if value is None: # get
1463
return dbus.UInt64(timedelta_to_milliseconds(
1464
self.approval_duration))
1511
return dbus.UInt64(self.approval_duration.total_seconds()
1512
* 1000)
1465
1513
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1466
1514
1467
1515
# Name - property
1475
1523
return dbus.String(self.fingerprint)
1476
1524
1477
1525
# Host - property
1478
@dbus_service_property(_interface, signature="s",
1526
@dbus_service_property(_interface,
1527
signature="s",
1479
1528
access="readwrite")
1480
1529
def Host_dbus_property(self, value=None):
1481
1530
if value is None: # get
1482
1531
return dbus.String(self.host)
1483
self.host = unicode(value)
1532
self.host = str(value)
1484
1533
1485
1534
# Created - property
1486
1535
@dbus_service_property(_interface, signature="s", access="read")
1493
1542
return datetime_to_dbus(self.last_enabled)
1494
1543
1495
1544
# Enabled - property
1496
@dbus_service_property(_interface, signature="b",
1545
@dbus_service_property(_interface,
1546
signature="b",
1497
1547
access="readwrite")
1498
1548
def Enabled_dbus_property(self, value=None):
1499
1549
if value is None: # get
1504
1554
self.disable()
1505
1555
1506
1556
# LastCheckedOK - property
1507
@dbus_service_property(_interface, signature="s",
1557
@dbus_service_property(_interface,
1558
signature="s",
1508
1559
access="readwrite")
1509
1560
def LastCheckedOK_dbus_property(self, value=None):
1510
1561
if value is not None:
1513
1564
return datetime_to_dbus(self.last_checked_ok)
1514
1565
1515
1566
# LastCheckerStatus - property
1516
@dbus_service_property(_interface, signature="n",
1517
access="read")
1567
@dbus_service_property(_interface, signature="n", access="read")
1518
1568
def LastCheckerStatus_dbus_property(self):
1519
1569
return dbus.Int16(self.last_checker_status)
1520
1570
1529
1579
return datetime_to_dbus(self.last_approval_request)
1530
1580
1531
1581
# Timeout - property
1532
@dbus_service_property(_interface, signature="t",
1582
@dbus_service_property(_interface,
1583
signature="t",
1533
1584
access="readwrite")
1534
1585
def Timeout_dbus_property(self, value=None):
1535
1586
if value is None: # get
1536
return dbus.UInt64(self.timeout_milliseconds())
1587
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1537
1588
old_timeout = self.timeout
1538
1589
self.timeout = datetime.timedelta(0, 0, 0, value)
1539
1590
# Reschedule disabling
1548
1599
is None):
1549
1600
return
1550
1601
gobject.source_remove(self.disable_initiator_tag)
1551
self.disable_initiator_tag = (
1552
gobject.timeout_add(
1553
timedelta_to_milliseconds(self.expires - now),
1554
self.disable))
1602
self.disable_initiator_tag = gobject.timeout_add(
1603
int((self.expires - now).total_seconds() * 1000),
1604
self.disable)
1555
1605
1556
1606
# ExtendedTimeout - property
1557
@dbus_service_property(_interface, signature="t",
1607
@dbus_service_property(_interface,
1608
signature="t",
1558
1609
access="readwrite")
1559
1610
def ExtendedTimeout_dbus_property(self, value=None):
1560
1611
if value is None: # get
1561
return dbus.UInt64(self.extended_timeout_milliseconds())
1612
return dbus.UInt64(self.extended_timeout.total_seconds()
1613
* 1000)
1562
1614
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1563
1615
1564
1616
# Interval - property
1565
@dbus_service_property(_interface, signature="t",
1617
@dbus_service_property(_interface,
1618
signature="t",
1566
1619
access="readwrite")
1567
1620
def Interval_dbus_property(self, value=None):
1568
1621
if value is None: # get
1569
return dbus.UInt64(self.interval_milliseconds())
1622
return dbus.UInt64(self.interval.total_seconds() * 1000)
1570
1623
self.interval = datetime.timedelta(0, 0, 0, value)
1571
1624
if getattr(self, "checker_initiator_tag", None) is None:
1572
1625
return
1573
1626
if self.enabled:
1574
1627
# Reschedule checker run
1575
1628
gobject.source_remove(self.checker_initiator_tag)
1576
self.checker_initiator_tag = (gobject.timeout_add
1577
(value, self.start_checker))
1578
self.start_checker() # Start one now, too
1629
self.checker_initiator_tag = gobject.timeout_add(
1630
value, self.start_checker)
1631
self.start_checker() # Start one now, too
1579
1632
1580
1633
# Checker - property
1581
@dbus_service_property(_interface, signature="s",
1634
@dbus_service_property(_interface,
1635
signature="s",
1582
1636
access="readwrite")
1583
1637
def Checker_dbus_property(self, value=None):
1584
1638
if value is None: # get
1585
1639
return dbus.String(self.checker_command)
1586
self.checker_command = unicode(value)
1640
self.checker_command = str(value)
1587
1641
1588
1642
# CheckerRunning - property
1589
@dbus_service_property(_interface, signature="b",
1643
@dbus_service_property(_interface,
1644
signature="b",
1590
1645
access="readwrite")
1591
1646
def CheckerRunning_dbus_property(self, value=None):
1592
1647
if value is None: # get
1602
1657
return self.dbus_object_path # is already a dbus.ObjectPath
1603
1658
1604
1659
# Secret = property
1605
@dbus_service_property(_interface, signature="ay",
1606
access="write", byte_arrays=True)
1660
@dbus_service_property(_interface,
1661
signature="ay",
1662
access="write",
1663
byte_arrays=True)
1607
1664
def Secret_dbus_property(self, value):
1608
self.secret = str(value)
1665
self.secret = bytes(value)
1609
1666
1610
1667
del _interface
1611
1668
1615
1672
self._pipe = child_pipe
1616
1673
self._pipe.send(('init', fpr, address))
1617
1674
if not self._pipe.recv():
1618
raise KeyError()
1675
raise KeyError(fpr)
1619
1676
1620
1677
def __getattribute__(self, name):
1621
1678
if name == '_pipe':
1625
1682
if data[0] == 'data':
1626
1683
return data[1]
1627
1684
if data[0] == 'function':
1685
1628
1686
def func(*args, **kwargs):
1629
1687
self._pipe.send(('funcall', name, args, kwargs))
1630
1688
return self._pipe.recv()[1]
1689
1631
1690
return func
1632
1691
1633
1692
def __setattr__(self, name, value):
1645
1704
def handle(self):
1646
1705
with contextlib.closing(self.server.child_pipe) as child_pipe:
1647
1706
logger.info("TCP connection from: %s",
1648
unicode(self.client_address))
1707
str(self.client_address))
1649
1708
logger.debug("Pipe FD: %d",
1650
1709
self.server.child_pipe.fileno())
1651
1710
1652
session = (gnutls.connection
1653
.ClientSession(self.request,
1654
gnutls.connection
1655
.X509Credentials()))
1711
session = gnutls.connection.ClientSession(
1712
self.request, gnutls.connection .X509Credentials())
1656
1713
1657
1714
# Note: gnutls.connection.X509Credentials is really a
1658
1715
# generic GnuTLS certificate credentials object so long as
1667
1724
priority = self.server.gnutls_priority
1668
1725
if priority is None:
1669
1726
priority = "NORMAL"
1670
(gnutls.library.functions
1671
.gnutls_priority_set_direct(session._c_object,
1672
priority, None))
1727
gnutls.library.functions.gnutls_priority_set_direct(
1728
session._c_object, priority, None)
1673
1729
1674
1730
# Start communication using the Mandos protocol
1675
1731
# Get protocol number
1677
1733
logger.debug("Protocol version: %r", line)
1678
1734
try:
1679
1735
if int(line.strip().split()[0]) > 1:
1680
raise RuntimeError
1736
raise RuntimeError(line)
1681
1737
except (ValueError, IndexError, RuntimeError) as error:
1682
1738
logger.error("Unknown protocol version: %s", error)
1683
1739
return
1695
1751
approval_required = False
1696
1752
try:
1697
1753
try:
1698
fpr = self.fingerprint(self.peer_certificate
1699
(session))
1754
fpr = self.fingerprint(
1755
self.peer_certificate(session))
1700
1756
except (TypeError,
1701
1757
gnutls.errors.GNUTLSError) as error:
1702
1758
logger.warning("Bad certificate: %s", error)
1717
1773
while True:
1718
1774
if not client.enabled:
1719
1775
logger.info("Client %s is disabled",
1720
client.name)
1776
client.name)
1721
1777
if self.server.use_dbus:
1722
1778
# Emit D-Bus signal
1723
1779
client.Rejected("Disabled")
1732
1788
if self.server.use_dbus:
1733
1789
# Emit D-Bus signal
1734
1790
client.NeedApproval(
1735
client.approval_delay_milliseconds(),
1736
client.approved_by_default)
1791
client.approval_delay.total_seconds()
1792
* 1000, client.approved_by_default)
1737
1793
else:
1738
1794
logger.warning("Client %s was not approved",
1739
1795
client.name)
1745
1801
#wait until timeout or approved
1746
1802
time = datetime.datetime.now()
1747
1803
client.changedstate.acquire()
1748
client.changedstate.wait(
1749
float(timedelta_to_milliseconds(delay)
1750
/ 1000))
1804
client.changedstate.wait(delay.total_seconds())
1751
1805
client.changedstate.release()
1752
1806
time2 = datetime.datetime.now()
1753
1807
if (time2 - time) >= delay:
1772
1826
logger.warning("gnutls send failed",
1773
1827
exc_info=error)
1774
1828
return
1775
logger.debug("Sent: %d, remaining: %d",
1776
sent, len(client.secret)
1777
- (sent_size + sent))
1829
logger.debug("Sent: %d, remaining: %d", sent,
1830
len(client.secret) - (sent_size
1831
+ sent))
1778
1832
sent_size += sent
1779
1833
1780
1834
logger.info("Sending secret to %s", client.name)
1797
1851
def peer_certificate(session):
1798
1852
"Return the peer's OpenPGP certificate as a bytestring"
1799
1853
# If not an OpenPGP certificate...
1800
if (gnutls.library.functions
1801
.gnutls_certificate_type_get(session._c_object)
1854
if (gnutls.library.functions.gnutls_certificate_type_get(
1855
session._c_object)
1802
1856
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1803
1857
# ...do the normal thing
1804
1858
return session.peer_certificate
1818
1872
def fingerprint(openpgp):
1819
1873
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1820
1874
# New GnuTLS "datum" with the OpenPGP public key
1821
datum = (gnutls.library.types
1822
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1823
ctypes.POINTER
1824
(ctypes.c_ubyte)),
1825
ctypes.c_uint(len(openpgp))))
1875
datum = gnutls.library.types.gnutls_datum_t(
1876
ctypes.cast(ctypes.c_char_p(openpgp),
1877
ctypes.POINTER(ctypes.c_ubyte)),
1878
ctypes.c_uint(len(openpgp)))
1826
1879
# New empty GnuTLS certificate
1827
1880
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1828
(gnutls.library.functions
1829
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1881
gnutls.library.functions.gnutls_openpgp_crt_init(
1882
ctypes.byref(crt))
1830
1883
# Import the OpenPGP public key into the certificate
1831
(gnutls.library.functions
1832
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1833
gnutls.library.constants
1834
.GNUTLS_OPENPGP_FMT_RAW))
1884
gnutls.library.functions.gnutls_openpgp_crt_import(
1885
crt, ctypes.byref(datum),
1886
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1835
1887
# Verify the self signature in the key
1836
1888
crtverify = ctypes.c_uint()
1837
(gnutls.library.functions
1838
.gnutls_openpgp_crt_verify_self(crt, 0,
1839
ctypes.byref(crtverify)))
1889
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1890
crt, 0, ctypes.byref(crtverify))
1840
1891
if crtverify.value != 0:
1841
1892
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1842
raise (gnutls.errors.CertificateSecurityError
1843
("Verify failed"))
1893
raise gnutls.errors.CertificateSecurityError(
1894
"Verify failed")
1844
1895
# New buffer for the fingerprint
1845
1896
buf = ctypes.create_string_buffer(20)
1846
1897
buf_len = ctypes.c_size_t()
1847
1898
# Get the fingerprint from the certificate into the buffer
1848
(gnutls.library.functions
1849
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1850
ctypes.byref(buf_len)))
1899
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1900
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1851
1901
# Deinit the certificate
1852
1902
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1853
1903
# Convert the buffer to a Python bytestring
1859
1909
1860
1910
class MultiprocessingMixIn(object):
1861
1911
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1912
1862
1913
def sub_process_main(self, request, address):
1863
1914
try:
1864
1915
self.finish_request(request, address)
1876
1927
1877
1928
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1878
1929
""" adds a pipe to the MixIn """
1930
1879
1931
def process_request(self, request, client_address):
1880
1932
"""Overrides and wraps the original process_request().
1881
1933
1890
1942
1891
1943
def add_pipe(self, parent_pipe, proc):
1892
1944
"""Dummy function; override as necessary"""
1893
raise NotImplementedError
1945
raise NotImplementedError()
1894
1946
1895
1947
1896
1948
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1902
1954
interface: None or a network interface name (string)
1903
1955
use_ipv6: Boolean; to use IPv6 or not
1904
1956
"""
1957
1905
1958
def __init__(self, server_address, RequestHandlerClass,
1906
interface=None, use_ipv6=True):
1959
interface=None,
1960
use_ipv6=True,
1961
socketfd=None):
1962
"""If socketfd is set, use that file descriptor instead of
1963
creating a new one with socket.socket().
1964
"""
1907
1965
self.interface = interface
1908
1966
if use_ipv6:
1909
1967
self.address_family = socket.AF_INET6
1968
if socketfd is not None:
1969
# Save the file descriptor
1970
self.socketfd = socketfd
1971
# Save the original socket.socket() function
1972
self.socket_socket = socket.socket
1973
# To implement --socket, we monkey patch socket.socket.
1974
#
1975
# (When socketserver.TCPServer is a new-style class, we
1976
# could make self.socket into a property instead of monkey
1977
# patching socket.socket.)
1978
#
1979
# Create a one-time-only replacement for socket.socket()
1980
@functools.wraps(socket.socket)
1981
def socket_wrapper(*args, **kwargs):
1982
# Restore original function so subsequent calls are
1983
# not affected.
1984
socket.socket = self.socket_socket
1985
del self.socket_socket
1986
# This time only, return a new socket object from the
1987
# saved file descriptor.
1988
return socket.fromfd(self.socketfd, *args, **kwargs)
1989
# Replace socket.socket() function with wrapper
1990
socket.socket = socket_wrapper
1991
# The socketserver.TCPServer.__init__ will call
1992
# socket.socket(), which might be our replacement,
1993
# socket_wrapper(), if socketfd was set.
1910
1994
socketserver.TCPServer.__init__(self, server_address,
1911
1995
RequestHandlerClass)
1996
1912
1997
def server_bind(self):
1913
1998
"""This overrides the normal server_bind() function
1914
1999
to bind to an interface if one was specified, and also NOT to
1920
2005
self.interface)
1921
2006
else:
1922
2007
try:
1923
self.socket.setsockopt(socket.SOL_SOCKET,
1924
SO_BINDTODEVICE,
1925
str(self.interface
1926
+ '\0'))
2008
self.socket.setsockopt(
2009
socket.SOL_SOCKET, SO_BINDTODEVICE,
2010
(self.interface + "\0").encode("utf-8"))
1927
2011
except socket.error as error:
1928
if error[0] == errno.EPERM:
1929
logger.error("No permission to"
1930
" bind to interface %s",
1931
self.interface)
1932
elif error[0] == errno.ENOPROTOOPT:
2012
if error.errno == errno.EPERM:
2013
logger.error("No permission to bind to"
2014
" interface %s", self.interface)
2015
elif error.errno == errno.ENOPROTOOPT:
1933
2016
logger.error("SO_BINDTODEVICE not available;"
1934
2017
" cannot bind to interface %s",
1935
2018
self.interface)
2019
elif error.errno == errno.ENODEV:
2020
logger.error("Interface %s does not exist,"
2021
" cannot bind", self.interface)
1936
2022
else:
1937
2023
raise
1938
2024
# Only bind(2) the socket if we really need to.
1941
2027
if self.address_family == socket.AF_INET6:
1942
2028
any_address = "::" # in6addr_any
1943
2029
else:
1944
any_address = socket.INADDR_ANY
2030
any_address = "0.0.0.0" # INADDR_ANY
1945
2031
self.server_address = (any_address,
1946
2032
self.server_address[1])
1947
2033
elif not self.server_address[1]:
1948
self.server_address = (self.server_address[0],
1949
0)
2034
self.server_address = (self.server_address[0], 0)
1950
2035
# if self.interface:
1951
2036
# self.server_address = (self.server_address[0],
1952
2037
# 0, # port
1966
2051
1967
2052
Assumes a gobject.MainLoop event loop.
1968
2053
"""
2054
1969
2055
def __init__(self, server_address, RequestHandlerClass,
1970
interface=None, use_ipv6=True, clients=None,
1971
gnutls_priority=None, use_dbus=True):
2056
interface=None,
2057
use_ipv6=True,
2058
clients=None,
2059
gnutls_priority=None,
2060
use_dbus=True,
2061
socketfd=None):
1972
2062
self.enabled = False
1973
2063
self.clients = clients
1974
2064
if self.clients is None:
1978
2068
IPv6_TCPServer.__init__(self, server_address,
1979
2069
RequestHandlerClass,
1980
2070
interface = interface,
1981
use_ipv6 = use_ipv6)
2071
use_ipv6 = use_ipv6,
2072
socketfd = socketfd)
2073
1982
2074
def server_activate(self):
1983
2075
if self.enabled:
1984
2076
return socketserver.TCPServer.server_activate(self)
1988
2080
1989
2081
def add_pipe(self, parent_pipe, proc):
1990
2082
# Call "handle_ipc" for both data and EOF events
1991
gobject.io_add_watch(parent_pipe.fileno(),
1992
gobject.IO_IN | gobject.IO_HUP,
1993
functools.partial(self.handle_ipc,
1994
parent_pipe =
1995
parent_pipe,
1996
proc = proc))
2083
gobject.io_add_watch(
2084
parent_pipe.fileno(),
2085
gobject.IO_IN | gobject.IO_HUP,
2086
functools.partial(self.handle_ipc,
2087
parent_pipe = parent_pipe,
2088
proc = proc))
1997
2089
1998
def handle_ipc(self, source, condition, parent_pipe=None,
1999
proc = None, client_object=None):
2090
def handle_ipc(self, source, condition,
2091
parent_pipe=None,
2092
proc = None,
2093
client_object=None):
2000
2094
# error, or the other end of multiprocessing.Pipe has closed
2001
2095
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2002
2096
# Wait for other process to exit
2025
2119
parent_pipe.send(False)
2026
2120
return False
2027
2121
2028
gobject.io_add_watch(parent_pipe.fileno(),
2029
gobject.IO_IN | gobject.IO_HUP,
2030
functools.partial(self.handle_ipc,
2031
parent_pipe =
2032
parent_pipe,
2033
proc = proc,
2034
client_object =
2035
client))
2122
gobject.io_add_watch(
2123
parent_pipe.fileno(),
2124
gobject.IO_IN | gobject.IO_HUP,
2125
functools.partial(self.handle_ipc,
2126
parent_pipe = parent_pipe,
2127
proc = proc,
2128
client_object = client))
2036
2129
parent_pipe.send(True)
2037
2130
# remove the old hook in favor of the new above hook on
2038
2131
# same fileno
2044
2137
2045
2138
parent_pipe.send(('data', getattr(client_object,
2046
2139
funcname)(*args,
2047
**kwargs)))
2140
**kwargs)))
2048
2141
2049
2142
if command == 'getattr':
2050
2143
attrname = request[1]
2051
2144
if callable(client_object.__getattribute__(attrname)):
2052
parent_pipe.send(('function',))
2145
parent_pipe.send(('function', ))
2053
2146
else:
2054
parent_pipe.send(('data', client_object
2055
.__getattribute__(attrname)))
2147
parent_pipe.send((
2148
'data', client_object.__getattribute__(attrname)))
2056
2149
2057
2150
if command == 'setattr':
2058
2151
attrname = request[1]
2062
2155
return True
2063
2156
2064
2157
2158
def rfc3339_duration_to_delta(duration):
2159
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2160
2161
>>> rfc3339_duration_to_delta("P7D")
2162
datetime.timedelta(7)
2163
>>> rfc3339_duration_to_delta("PT60S")
2164
datetime.timedelta(0, 60)
2165
>>> rfc3339_duration_to_delta("PT60M")
2166
datetime.timedelta(0, 3600)
2167
>>> rfc3339_duration_to_delta("PT24H")
2168
datetime.timedelta(1)
2169
>>> rfc3339_duration_to_delta("P1W")
2170
datetime.timedelta(7)
2171
>>> rfc3339_duration_to_delta("PT5M30S")
2172
datetime.timedelta(0, 330)
2173
>>> rfc3339_duration_to_delta("P1DT3M20S")
2174
datetime.timedelta(1, 200)
2175
"""
2176
2177
# Parsing an RFC 3339 duration with regular expressions is not
2178
# possible - there would have to be multiple places for the same
2179
# values, like seconds. The current code, while more esoteric, is
2180
# cleaner without depending on a parsing library. If Python had a
2181
# built-in library for parsing we would use it, but we'd like to
2182
# avoid excessive use of external libraries.
2183
2184
# New type for defining tokens, syntax, and semantics all-in-one
2185
Token = collections.namedtuple("Token",
2186
("regexp", # To match token; if
2187
# "value" is not None,
2188
# must have a "group"
2189
# containing digits
2190
"value", # datetime.timedelta or
2191
# None
2192
"followers")) # Tokens valid after
2193
# this token
2194
Token = collections.namedtuple("Token", (
2195
"regexp", # To match token; if "value" is not None, must have
2196
# a "group" containing digits
2197
"value", # datetime.timedelta or None
2198
"followers")) # Tokens valid after this token
2199
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2200
# the "duration" ABNF definition in RFC 3339, Appendix A.
2201
token_end = Token(re.compile(r"$"), None, frozenset())
2202
token_second = Token(re.compile(r"(\d+)S"),
2203
datetime.timedelta(seconds=1),
2204
frozenset((token_end, )))
2205
token_minute = Token(re.compile(r"(\d+)M"),
2206
datetime.timedelta(minutes=1),
2207
frozenset((token_second, token_end)))
2208
token_hour = Token(re.compile(r"(\d+)H"),
2209
datetime.timedelta(hours=1),
2210
frozenset((token_minute, token_end)))
2211
token_time = Token(re.compile(r"T"),
2212
None,
2213
frozenset((token_hour, token_minute,
2214
token_second)))
2215
token_day = Token(re.compile(r"(\d+)D"),
2216
datetime.timedelta(days=1),
2217
frozenset((token_time, token_end)))
2218
token_month = Token(re.compile(r"(\d+)M"),
2219
datetime.timedelta(weeks=4),
2220
frozenset((token_day, token_end)))
2221
token_year = Token(re.compile(r"(\d+)Y"),
2222
datetime.timedelta(weeks=52),
2223
frozenset((token_month, token_end)))
2224
token_week = Token(re.compile(r"(\d+)W"),
2225
datetime.timedelta(weeks=1),
2226
frozenset((token_end, )))
2227
token_duration = Token(re.compile(r"P"), None,
2228
frozenset((token_year, token_month,
2229
token_day, token_time,
2230
token_week)))
2231
# Define starting values
2232
value = datetime.timedelta() # Value so far
2233
found_token = None
2234
followers = frozenset((token_duration,)) # Following valid tokens
2235
s = duration # String left to parse
2236
# Loop until end token is found
2237
while found_token is not token_end:
2238
# Search for any currently valid tokens
2239
for token in followers:
2240
match = token.regexp.match(s)
2241
if match is not None:
2242
# Token found
2243
if token.value is not None:
2244
# Value found, parse digits
2245
factor = int(match.group(1), 10)
2246
# Add to value so far
2247
value += factor * token.value
2248
# Strip token from string
2249
s = token.regexp.sub("", s, 1)
2250
# Go to found token
2251
found_token = token
2252
# Set valid next tokens
2253
followers = found_token.followers
2254
break
2255
else:
2256
# No currently valid tokens were found
2257
raise ValueError("Invalid RFC 3339 duration: {!r}"
2258
.format(duration))
2259
# End token found
2260
return value
2261
2262
2065
2263
def string_to_delta(interval):
2066
2264
"""Parse a string and return a datetime.timedelta
2067
2265
2078
2276
>>> string_to_delta('5m 30s')
2079
2277
datetime.timedelta(0, 330)
2080
2278
"""
2279
2280
try:
2281
return rfc3339_duration_to_delta(interval)
2282
except ValueError:
2283
pass
2284
2081
2285
timevalue = datetime.timedelta(0)
2082
2286
for s in interval.split():
2083
2287
try:
2084
suffix = unicode(s[-1])
2288
suffix = s[-1]
2085
2289
value = int(s[:-1])
2086
2290
if suffix == "d":
2087
2291
delta = datetime.timedelta(value)
2094
2298
elif suffix == "w":
2095
2299
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2096
2300
else:
2097
raise ValueError("Unknown suffix {0!r}"
2098
.format(suffix))
2099
except (ValueError, IndexError) as e:
2301
raise ValueError("Unknown suffix {!r}".format(suffix))
2302
except IndexError as e:
2100
2303
raise ValueError(*(e.args))
2101
2304
timevalue += delta
2102
2305
return timevalue
2118
2321
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2119
2322
if not stat.S_ISCHR(os.fstat(null).st_mode):
2120
2323
raise OSError(errno.ENODEV,
2121
"{0} not a character device"
2324
"{} not a character device"
2122
2325
.format(os.devnull))
2123
2326
os.dup2(null, sys.stdin.fileno())
2124
2327
os.dup2(null, sys.stdout.fileno())
2134
2337
2135
2338
parser = argparse.ArgumentParser()
2136
2339
parser.add_argument("-v", "--version", action="version",
2137
version = "%(prog)s {0}".format(version),
2340
version = "%(prog)s {}".format(version),
2138
2341
help="show version number and exit")
2139
2342
parser.add_argument("-i", "--interface", metavar="IF",
2140
2343
help="Bind to interface IF")
2146
2349
help="Run self-test")
2147
2350
parser.add_argument("--debug", action="store_true",
2148
2351
help="Debug mode; run in foreground and log"
2149
" to terminal")
2352
" to terminal", default=None)
2150
2353
parser.add_argument("--debuglevel", metavar="LEVEL",
2151
2354
help="Debug level for stdout output")
2152
2355
parser.add_argument("--priority", help="GnuTLS"
2159
2362
" files")
2160
2363
parser.add_argument("--no-dbus", action="store_false",
2161
2364
dest="use_dbus", help="Do not provide D-Bus"
2162
" system bus interface")
2365
" system bus interface", default=None)
2163
2366
parser.add_argument("--no-ipv6", action="store_false",
2164
dest="use_ipv6", help="Do not use IPv6")
2367
dest="use_ipv6", help="Do not use IPv6",
2368
default=None)
2165
2369
parser.add_argument("--no-restore", action="store_false",
2166
2370
dest="restore", help="Do not restore stored"
2167
" state")
2371
" state", default=None)
2372
parser.add_argument("--socket", type=int,
2373
help="Specify a file descriptor to a network"
2374
" socket to use instead of creating one")
2168
2375
parser.add_argument("--statedir", metavar="DIR",
2169
2376
help="Directory to save/restore state in")
2377
parser.add_argument("--foreground", action="store_true",
2378
help="Run in foreground", default=None)
2379
parser.add_argument("--no-zeroconf", action="store_false",
2380
dest="zeroconf", help="Do not use Zeroconf",
2381
default=None)
2170
2382
2171
2383
options = parser.parse_args()
2172
2384
2173
2385
if options.check:
2174
2386
import doctest
2175
doctest.testmod()
2176
sys.exit()
2387
fail_count, test_count = doctest.testmod()
2388
sys.exit(os.EX_OK if fail_count == 0 else 1)
2177
2389
2178
2390
# Default values for config file for server-global settings
2179
2391
server_defaults = { "interface": "",
2181
2393
"port": "",
2182
2394
"debug": "False",
2183
2395
"priority":
2184
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2396
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2397
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2185
2398
"servicename": "Mandos",
2186
2399
"use_dbus": "True",
2187
2400
"use_ipv6": "True",
2188
2401
"debuglevel": "",
2189
2402
"restore": "True",
2190
"statedir": "/var/lib/mandos"
2191
}
2403
"socket": "",
2404
"statedir": "/var/lib/mandos",
2405
"foreground": "False",
2406
"zeroconf": "True",
2407
}
2192
2408
2193
2409
# Parse config file for server-global settings
2194
2410
server_config = configparser.SafeConfigParser(server_defaults)
2195
2411
del server_defaults
2196
server_config.read(os.path.join(options.configdir,
2197
"mandos.conf"))
2412
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2198
2413
# Convert the SafeConfigParser object to a dict
2199
2414
server_settings = server_config.defaults()
2200
2415
# Use the appropriate methods on the non-string config options
2201
for option in ("debug", "use_dbus", "use_ipv6"):
2416
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2202
2417
server_settings[option] = server_config.getboolean("DEFAULT",
2203
2418
option)
2204
2419
if server_settings["port"]:
2205
2420
server_settings["port"] = server_config.getint("DEFAULT",
2206
2421
"port")
2422
if server_settings["socket"]:
2423
server_settings["socket"] = server_config.getint("DEFAULT",
2424
"socket")
2425
# Later, stdin will, and stdout and stderr might, be dup'ed
2426
# over with an opened os.devnull. But we don't want this to
2427
# happen with a supplied network socket.
2428
if 0 <= server_settings["socket"] <= 2:
2429
server_settings["socket"] = os.dup(server_settings
2430
["socket"])
2207
2431
del server_config
2208
2432
2209
2433
# Override the settings from the config file with command line
2210
2434
# options, if set.
2211
2435
for option in ("interface", "address", "port", "debug",
2212
"priority", "servicename", "configdir",
2213
"use_dbus", "use_ipv6", "debuglevel", "restore",
2214
"statedir"):
2436
"priority", "servicename", "configdir", "use_dbus",
2437
"use_ipv6", "debuglevel", "restore", "statedir",
2438
"socket", "foreground", "zeroconf"):
2215
2439
value = getattr(options, option)
2216
2440
if value is not None:
2217
2441
server_settings[option] = value
2218
2442
del options
2219
2443
# Force all strings to be unicode
2220
2444
for option in server_settings.keys():
2221
if type(server_settings[option]) is str:
2222
server_settings[option] = unicode(server_settings[option])
2445
if isinstance(server_settings[option], bytes):
2446
server_settings[option] = (server_settings[option]
2447
.decode("utf-8"))
2448
# Force all boolean options to be boolean
2449
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2450
"foreground", "zeroconf"):
2451
server_settings[option] = bool(server_settings[option])
2452
# Debug implies foreground
2453
if server_settings["debug"]:
2454
server_settings["foreground"] = True
2223
2455
# Now we have our good server settings in "server_settings"
2224
2456
2225
2457
##################################################################
2226
2458
2459
if (not server_settings["zeroconf"]
2460
and not (server_settings["port"]
2461
or server_settings["socket"] != "")):
2462
parser.error("Needs port or socket to work without Zeroconf")
2463
2227
2464
# For convenience
2228
2465
debug = server_settings["debug"]
2229
2466
debuglevel = server_settings["debuglevel"]
2231
2468
use_ipv6 = server_settings["use_ipv6"]
2232
2469
stored_state_path = os.path.join(server_settings["statedir"],
2233
2470
stored_state_file)
2471
foreground = server_settings["foreground"]
2472
zeroconf = server_settings["zeroconf"]
2234
2473
2235
2474
if debug:
2236
2475
initlogger(debug, logging.DEBUG)
2242
2481
initlogger(debug, level)
2243
2482
2244
2483
if server_settings["servicename"] != "Mandos":
2245
syslogger.setFormatter(logging.Formatter
2246
('Mandos ({0}) [%(process)d]:'
2247
' %(levelname)s: %(message)s'
2248
.format(server_settings
2249
["servicename"])))
2484
syslogger.setFormatter(
2485
logging.Formatter('Mandos ({}) [%(process)d]:'
2486
' %(levelname)s: %(message)s'.format(
2487
server_settings["servicename"])))
2250
2488
2251
2489
# Parse config file with clients
2252
2490
client_config = configparser.SafeConfigParser(Client
2257
2495
global mandos_dbus_service
2258
2496
mandos_dbus_service = None
2259
2497
2260
tcp_server = MandosServer((server_settings["address"],
2261
server_settings["port"]),
2262
ClientHandler,
2263
interface=(server_settings["interface"]
2264
or None),
2265
use_ipv6=use_ipv6,
2266
gnutls_priority=
2267
server_settings["priority"],
2268
use_dbus=use_dbus)
2269
if not debug:
2270
pidfilename = "/var/run/mandos.pid"
2498
socketfd = None
2499
if server_settings["socket"] != "":
2500
socketfd = server_settings["socket"]
2501
tcp_server = MandosServer(
2502
(server_settings["address"], server_settings["port"]),
2503
ClientHandler,
2504
interface=(server_settings["interface"] or None),
2505
use_ipv6=use_ipv6,
2506
gnutls_priority=server_settings["priority"],
2507
use_dbus=use_dbus,
2508
socketfd=socketfd)
2509
if not foreground:
2510
pidfilename = "/run/mandos.pid"
2511
if not os.path.isdir("/run/."):
2512
pidfilename = "/var/run/mandos.pid"
2513
pidfile = None
2271
2514
try:
2272
pidfile = open(pidfilename, "w")
2515
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2273
2516
except IOError as e:
2274
2517
logger.error("Could not open file %r", pidfilename,
2275
2518
exc_info=e)
2288
2531
os.setgid(gid)
2289
2532
os.setuid(uid)
2290
2533
except OSError as error:
2291
if error[0] != errno.EPERM:
2292
raise error
2534
if error.errno != errno.EPERM:
2535
raise
2293
2536
2294
2537
if debug:
2295
2538
# Enable all possible GnuTLS debugging
2302
2545
def debug_gnutls(level, string):
2303
2546
logger.debug("GnuTLS: %s", string[:-1])
2304
2547
2305
(gnutls.library.functions
2306
.gnutls_global_set_log_function(debug_gnutls))
2548
gnutls.library.functions.gnutls_global_set_log_function(
2549
debug_gnutls)
2307
2550
2308
2551
# Redirect stdin so all checkers get /dev/null
2309
2552
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2312
2555
os.close(null)
2313
2556
2314
2557
# Need to fork before connecting to D-Bus
2315
if not debug:
2558
if not foreground:
2316
2559
# Close all input and output, do double fork, etc.
2317
2560
daemon()
2318
2561
2562
# multiprocessing will use threads, so before we use gobject we
2563
# need to inform gobject that threads will be used.
2319
2564
gobject.threads_init()
2320
2565
2321
2566
global main_loop
2327
2572
if use_dbus:
2328
2573
try:
2329
2574
bus_name = dbus.service.BusName("se.recompile.Mandos",
2330
bus, do_not_queue=True)
2331
old_bus_name = (dbus.service.BusName
2332
("se.bsnet.fukt.Mandos", bus,
2333
do_not_queue=True))
2334
except dbus.exceptions.NameExistsException as e:
2575
bus,
2576
do_not_queue=True)
2577
old_bus_name = dbus.service.BusName(
2578
"se.bsnet.fukt.Mandos", bus,
2579
do_not_queue=True)
2580
except dbus.exceptions.DBusException as e:
2335
2581
logger.error("Disabling D-Bus:", exc_info=e)
2336
2582
use_dbus = False
2337
2583
server_settings["use_dbus"] = False
2338
2584
tcp_server.use_dbus = False
2339
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2340
service = AvahiServiceToSyslog(name =
2341
server_settings["servicename"],
2342
servicetype = "_mandos._tcp",
2343
protocol = protocol, bus = bus)
2344
if server_settings["interface"]:
2345
service.interface = (if_nametoindex
2346
(str(server_settings["interface"])))
2585
if zeroconf:
2586
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2587
service = AvahiServiceToSyslog(
2588
name = server_settings["servicename"],
2589
servicetype = "_mandos._tcp",
2590
protocol = protocol,
2591
bus = bus)
2592
if server_settings["interface"]:
2593
service.interface = if_nametoindex(
2594
server_settings["interface"].encode("utf-8"))
2347
2595
2348
2596
global multiprocessing_manager
2349
2597
multiprocessing_manager = multiprocessing.Manager()
2356
2604
old_client_settings = {}
2357
2605
clients_data = {}
2358
2606
2607
# This is used to redirect stdout and stderr for checker processes
2608
global wnull
2609
wnull = open(os.devnull, "w") # A writable /dev/null
2610
# Only used if server is running in foreground but not in debug
2611
# mode
2612
if debug or not foreground:
2613
wnull.close()
2614
2359
2615
# Get client data and settings from last running state.
2360
2616
if server_settings["restore"]:
2361
2617
try:
2362
2618
with open(stored_state_path, "rb") as stored_state:
2363
clients_data, old_client_settings = (pickle.load
2364
(stored_state))
2619
clients_data, old_client_settings = pickle.load(
2620
stored_state)
2365
2621
os.remove(stored_state_path)
2366
2622
except IOError as e:
2367
2623
if e.errno == errno.ENOENT:
2368
logger.warning("Could not load persistent state: {0}"
2369
.format(os.strerror(e.errno)))
2624
logger.warning("Could not load persistent state:"
2625
" {}".format(os.strerror(e.errno)))
2370
2626
else:
2371
2627
logger.critical("Could not load persistent state:",
2372
2628
exc_info=e)
2373
2629
raise
2374
2630
except EOFError as e:
2375
2631
logger.warning("Could not load persistent state: "
2376
"EOFError:", exc_info=e)
2632
"EOFError:",
2633
exc_info=e)
2377
2634
2378
2635
with PGPEngine() as pgp:
2379
for client_name, client in clients_data.iteritems():
2636
for client_name, client in clients_data.items():
2637
# Skip removed clients
2638
if client_name not in client_settings:
2639
continue
2640
2380
2641
# Decide which value to use after restoring saved state.
2381
2642
# We have three different values: Old config file,
2382
2643
# new config file, and saved state.
2387
2648
# For each value in new config, check if it
2388
2649
# differs from the old config value (Except for
2389
2650
# the "secret" attribute)
2390
if (name != "secret" and
2391
value != old_client_settings[client_name]
2392
[name]):
2651
if (name != "secret"
2652
and (value !=
2653
old_client_settings[client_name][name])):
2393
2654
client[name] = value
2394
2655
except KeyError:
2395
2656
pass
2403
2664
if datetime.datetime.utcnow() >= client["expires"]:
2404
2665
if not client["last_checked_ok"]:
2405
2666
logger.warning(
2406
"disabling client {0} - Client never "
2407
"performed a successful checker"
2408
.format(client_name))
2667
"disabling client {} - Client never "
2668
"performed a successful checker".format(
2669
client_name))
2409
2670
client["enabled"] = False
2410
2671
elif client["last_checker_status"] != 0:
2411
2672
logger.warning(
2412
"disabling client {0} - Client "
2413
"last checker failed with error code {1}"
2414
.format(client_name,
2415
client["last_checker_status"]))
2673
"disabling client {} - Client last"
2674
" checker failed with error code"
2675
" {}".format(
2676
client_name,
2677
client["last_checker_status"]))
2416
2678
client["enabled"] = False
2417
2679
else:
2418
client["expires"] = (datetime.datetime
2419
.utcnow()
2420
+ client["timeout"])
2680
client["expires"] = (
2681
datetime.datetime.utcnow()
2682
+ client["timeout"])
2421
2683
logger.debug("Last checker succeeded,"
2422
" keeping {0} enabled"
2423
.format(client_name))
2684
" keeping {} enabled".format(
2685
client_name))
2424
2686
try:
2425
client["secret"] = (
2426
pgp.decrypt(client["encrypted_secret"],
2427
client_settings[client_name]
2428
["secret"]))
2687
client["secret"] = pgp.decrypt(
2688
client["encrypted_secret"],
2689
client_settings[client_name]["secret"])
2429
2690
except PGPError:
2430
2691
# If decryption fails, we use secret from new settings
2431
logger.debug("Failed to decrypt {0} old secret"
2432
.format(client_name))
2433
client["secret"] = (
2434
client_settings[client_name]["secret"])
2692
logger.debug("Failed to decrypt {} old secret".format(
2693
client_name))
2694
client["secret"] = (client_settings[client_name]
2695
["secret"])
2435
2696
2436
2697
# Add/remove clients based on new changes made to config
2437
2698
for client_name in (set(old_client_settings)
2442
2703
clients_data[client_name] = client_settings[client_name]
2443
2704
2444
2705
# Create all client objects
2445
for client_name, client in clients_data.iteritems():
2706
for client_name, client in clients_data.items():
2446
2707
tcp_server.clients[client_name] = client_class(
2447
name = client_name, settings = client)
2708
name = client_name,
2709
settings = client,
2710
server_settings = server_settings)
2448
2711
2449
2712
if not tcp_server.clients:
2450
2713
logger.warning("No clients defined")
2451
2714
2452
if not debug:
2453
try:
2454
with pidfile:
2455
pid = os.getpid()
2456
pidfile.write(str(pid) + "\n".encode("utf-8"))
2457
del pidfile
2458
except IOError:
2459
logger.error("Could not write to file %r with PID %d",
2460
pidfilename, pid)
2461
except NameError:
2462
# "pidfile" was never created
2463
pass
2715
if not foreground:
2716
if pidfile is not None:
2717
pid = os.getpid()
2718
try:
2719
with pidfile:
2720
print(pid, file=pidfile)
2721
except IOError:
2722
logger.error("Could not write to file %r with PID %d",
2723
pidfilename, pid)
2724
del pidfile
2464
2725
del pidfilename
2465
signal.signal(signal.SIGINT, signal.SIG_IGN)
2466
2726
2467
2727
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2468
2728
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2469
2729
2470
2730
if use_dbus:
2471
@alternate_dbus_interfaces({"se.recompile.Mandos":
2472
"se.bsnet.fukt.Mandos"})
2731
2732
@alternate_dbus_interfaces(
2733
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2473
2734
class MandosDBusService(DBusObjectWithProperties):
2474
2735
"""A D-Bus proxy object"""
2736
2475
2737
def __init__(self):
2476
2738
dbus.service.Object.__init__(self, bus, "/")
2739
2477
2740
_interface = "se.recompile.Mandos"
2478
2741
2479
2742
@dbus_interface_annotations(_interface)
2480
2743
def _foo(self):
2481
return { "org.freedesktop.DBus.Property"
2482
".EmitsChangedSignal":
2483
"false"}
2744
return {
2745
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2746
"false" }
2484
2747
2485
2748
@dbus.service.signal(_interface, signature="o")
2486
2749
def ClientAdded(self, objpath):
2500
2763
@dbus.service.method(_interface, out_signature="ao")
2501
2764
def GetAllClients(self):
2502
2765
"D-Bus method"
2503
return dbus.Array(c.dbus_object_path
2504
for c in
2766
return dbus.Array(c.dbus_object_path for c in
2505
2767
tcp_server.clients.itervalues())
2506
2768
2507
2769
@dbus.service.method(_interface,
2509
2771
def GetAllClientsWithProperties(self):
2510
2772
"D-Bus method"
2511
2773
return dbus.Dictionary(
2512
((c.dbus_object_path, c.GetAll(""))
2513
for c in tcp_server.clients.itervalues()),
2774
{ c.dbus_object_path: c.GetAll("")
2775
for c in tcp_server.clients.itervalues() },
2514
2776
signature="oa{sv}")
2515
2777
2516
2778
@dbus.service.method(_interface, in_signature="o")
2533
2795
2534
2796
def cleanup():
2535
2797
"Cleanup function; run on exit"
2536
service.cleanup()
2798
if zeroconf:
2799
service.cleanup()
2537
2800
2538
2801
multiprocessing.active_children()
2802
wnull.close()
2539
2803
if not (tcp_server.clients or client_settings):
2540
2804
return
2541
2805
2552
2816
2553
2817
# A list of attributes that can not be pickled
2554
2818
# + secret.
2555
exclude = set(("bus", "changedstate", "secret",
2556
"checker"))
2557
for name, typ in (inspect.getmembers
2558
(dbus.service.Object)):
2819
exclude = { "bus", "changedstate", "secret",
2820
"checker", "server_settings" }
2821
for name, typ in inspect.getmembers(dbus.service
2822
.Object):
2559
2823
exclude.add(name)
2560
2824
2561
2825
client_dict["encrypted_secret"] = (client
2568
2832
del client_settings[client.name]["secret"]
2569
2833
2570
2834
try:
2571
with (tempfile.NamedTemporaryFile
2572
(mode='wb', suffix=".pickle", prefix='clients-',
2573
dir=os.path.dirname(stored_state_path),
2574
delete=False)) as stored_state:
2835
with tempfile.NamedTemporaryFile(
2836
mode='wb',
2837
suffix=".pickle",
2838
prefix='clients-',
2839
dir=os.path.dirname(stored_state_path),
2840
delete=False) as stored_state:
2575
2841
pickle.dump((clients, client_settings), stored_state)
2576
tempname=stored_state.name
2842
tempname = stored_state.name
2577
2843
os.rename(tempname, stored_state_path)
2578
2844
except (IOError, OSError) as e:
2579
2845
if not debug:
2582
2848
except NameError:
2583
2849
pass
2584
2850
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2585
logger.warning("Could not save persistent state: {0}"
2851
logger.warning("Could not save persistent state: {}"
2586
2852
.format(os.strerror(e.errno)))
2587
2853
else:
2588
2854
logger.warning("Could not save persistent state:",
2589
2855
exc_info=e)
2590
raise e
2856
raise
2591
2857
2592
2858
# Delete all clients, and settings from config
2593
2859
while tcp_server.clients:
2598
2864
client.disable(quiet=True)
2599
2865
if use_dbus:
2600
2866
# Emit D-Bus signal
2601
mandos_dbus_service.ClientRemoved(client
2602
.dbus_object_path,
2603
client.name)
2867
mandos_dbus_service.ClientRemoved(
2868
client.dbus_object_path, client.name)
2604
2869
client_settings.clear()
2605
2870
2606
2871
atexit.register(cleanup)
2617
2882
tcp_server.server_activate()
2618
2883
2619
2884
# Find out what port we got
2620
service.port = tcp_server.socket.getsockname()[1]
2885
if zeroconf:
2886
service.port = tcp_server.socket.getsockname()[1]
2621
2887
if use_ipv6:
2622
2888
logger.info("Now listening on address %r, port %d,"
2623
2889
" flowinfo %d, scope_id %d",
2629
2895
#service.interface = tcp_server.socket.getsockname()[3]
2630
2896
2631
2897
try:
2632
# From the Avahi example code
2633
try:
2634
service.activate()
2635
except dbus.exceptions.DBusException as error:
2636
logger.critical("D-Bus Exception", exc_info=error)
2637
cleanup()
2638
sys.exit(1)
2639
# End of Avahi example code
2898
if zeroconf:
2899
# From the Avahi example code
2900
try:
2901
service.activate()
2902
except dbus.exceptions.DBusException as error:
2903
logger.critical("D-Bus Exception", exc_info=error)
2904
cleanup()
2905
sys.exit(1)
2906
# End of Avahi example code
2640
2907
2641
2908
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2642
2909
lambda *args, **kwargs:
2657
2924
# Must run before the D-Bus bus name gets deregistered
2658
2925
cleanup()
2659
2926
2927
2660
2928
if __name__ == '__main__':
2661
2929
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0