/mandos/trunk : revision 869

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

import SocketServer as socketserver

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

41

42

try:

43

import SocketServer as socketserver

44

except ImportError:

45

import socketserver

38

46

import socket

39

47

import argparse

40

48

import datetime

41

49

import errno

42

import gnutls.crypto

43

import gnutls.connection

44

import gnutls.errors

45

import gnutls.library.functions

46

import gnutls.library.constants

47

import gnutls.library.types

48

import ConfigParser as configparser

50

try:

51

import ConfigParser as configparser

52

except ImportError:

53

import configparser

49

54

import sys

50

55

import re

51

56

import os

60

65

import struct

61

66

import fcntl

62

67

import functools

63

import cPickle as pickle

68

try:

69

import cPickle as pickle

70

except ImportError:

71

import pickle

64

72

import multiprocessing

65

73

import types

66

74

import binascii

67

75

import tempfile

76

import itertools

77

import collections

78

import codecs

68

79

69

80

import dbus

70

81

import dbus.service

71

import gobject

72

import avahi

82

from gi.repository import GLib

73

83

from dbus.mainloop.glib import DBusGMainLoop

74

84

import ctypes

75

85

import ctypes.util

76

86

import xml.dom.minidom

77

87

import inspect

78

import GnuPGInterface

79

88

89

# Try to find the value of SO_BINDTODEVICE:

80

90

try:

91

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

92

# newer, and it is also the most natural place for it:

81

93

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

82

94

except AttributeError:

83

95

try:

96

# This is where SO_BINDTODEVICE was up to and including Python

97

# 2.6, and also 3.2:

84

98

from IN import SO_BINDTODEVICE

85

99

except ImportError:

86

SO_BINDTODEVICE = None

87

88

version = "1.4.1"

100

# In Python 2.7 it seems to have been removed entirely.

101

# Try running the C preprocessor:

102

try:

103

cc = subprocess.Popen(["cc", "--language=c", "-E",

104

"/dev/stdin"],

105

stdin=subprocess.PIPE,

106

stdout=subprocess.PIPE)

107

stdout = cc.communicate(

108

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

109

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

110

except (OSError, ValueError, IndexError):

111

# No value found

112

SO_BINDTODEVICE = None

113

114

if sys.version_info.major == 2:

115

str = unicode

116

117

version = "1.7.10"

89

118

stored_state_file = "clients.pickle"

90

119

91

120

logger = logging.getLogger()

92

syslogger = (logging.handlers.SysLogHandler

93

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

address = str("/dev/log")))

121

syslogger = None

95

122

96

123

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

124

if_nametoindex = ctypes.cdll.LoadLibrary(

125

ctypes.util.find_library("c")).if_nametoindex

100

126

except (OSError, AttributeError):

127

101

128

def if_nametoindex(interface):

102

129

"Get an interface index the hard way, i.e. using fcntl()"

103

130

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

131

with contextlib.closing(socket.socket()) as s:

105

132

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

133

struct.pack(b"16s16x", interface))

134

interface_index = struct.unpack("I", ifreq[16:20])[0]

110

135

return interface_index

111

136

112

137

138

def copy_function(func):

139

"""Make a copy of a function"""

140

if sys.version_info.major == 2:

141

return types.FunctionType(func.func_code,

142

func.func_globals,

143

func.func_name,

144

func.func_defaults,

145

func.func_closure)

146

else:

147

return types.FunctionType(func.__code__,

148

func.__globals__,

149

func.__name__,

150

func.__defaults__,

151

func.__closure__)

152

153

113

154

def initlogger(debug, level=logging.WARNING):

114

155

"""init logger and add loglevel"""

115

156

157

global syslogger

158

syslogger = (logging.handlers.SysLogHandler(

159

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

160

address = "/dev/log"))

116

161

syslogger.setFormatter(logging.Formatter

117

162

('Mandos [%(process)d]: %(levelname)s:'

118

163

' %(message)s'))

135

180

136

181

class PGPEngine(object):

137

182

"""A simple class for OpenPGP symmetric encryption & decryption"""

183

138

184

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

185

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet'])

186

self.gpg = "gpg"

187

try:

188

output = subprocess.check_output(["gpgconf"])

189

for line in output.splitlines():

190

name, text, path = line.split(b":")

191

if name == "gpg":

192

self.gpg = path

193

break

194

except OSError as e:

195

if e.errno != errno.ENOENT:

196

raise

197

self.gnupgargs = ['--batch',

198

'--homedir', self.tempdir,

199

'--force-mdc',

200

'--quiet']

201

# Only GPG version 1 has the --no-use-agent option.

202

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

203

self.gnupgargs.append("--no-use-agent")

146

204

147

205

def __enter__(self):

148

206

return self

149

207

150

def __exit__ (self, exc_type, exc_value, traceback):

208

def __exit__(self, exc_type, exc_value, traceback):

151

209

self._cleanup()

152

210

return False

153

211

170

228

def password_encode(self, password):

171

229

# Passphrase can not be empty and can not contain newlines or

172

230

# NUL bytes. So we prefix it and hex encode it.

173

return b"mandos" + binascii.hexlify(password)

231

encoded = b"mandos" + binascii.hexlify(password)

232

if len(encoded) > 2048:

233

# GnuPG can't handle long passwords, so encode differently

234

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

235

.replace(b"\n", b"\\n")

236

.replace(b"\0", b"\\x00"))

237

return encoded

174

238

175

239

def encrypt(self, data, password):

176

self.gnupg.passphrase = self.password_encode(password)

177

with open(os.devnull) as devnull:

178

try:

179

proc = self.gnupg.run(['--symmetric'],

180

create_fhs=['stdin', 'stdout'],

181

attach_fhs={'stderr': devnull})

182

with contextlib.closing(proc.handles['stdin']) as f:

183

f.write(data)

184

with contextlib.closing(proc.handles['stdout']) as f:

185

ciphertext = f.read()

186

proc.wait()

187

except IOError as e:

188

raise PGPError(e)

189

self.gnupg.passphrase = None

240

passphrase = self.password_encode(password)

241

with tempfile.NamedTemporaryFile(

242

dir=self.tempdir) as passfile:

243

passfile.write(passphrase)

244

passfile.flush()

245

proc = subprocess.Popen([self.gpg, '--symmetric',

246

'--passphrase-file',

247

passfile.name]

248

+ self.gnupgargs,

249

stdin = subprocess.PIPE,

250

stdout = subprocess.PIPE,

251

stderr = subprocess.PIPE)

252

ciphertext, err = proc.communicate(input = data)

253

if proc.returncode != 0:

254

raise PGPError(err)

190

255

return ciphertext

191

256

192

257

def decrypt(self, data, password):

193

self.gnupg.passphrase = self.password_encode(password)

194

with open(os.devnull) as devnull:

195

try:

196

proc = self.gnupg.run(['--decrypt'],

197

create_fhs=['stdin', 'stdout'],

198

attach_fhs={'stderr': devnull})

199

with contextlib.closing(proc.handles['stdin'] ) as f:

200

f.write(data)

201

with contextlib.closing(proc.handles['stdout']) as f:

202

decrypted_plaintext = f.read()

203

proc.wait()

204

except IOError as e:

205

raise PGPError(e)

206

self.gnupg.passphrase = None

258

passphrase = self.password_encode(password)

259

with tempfile.NamedTemporaryFile(

260

dir = self.tempdir) as passfile:

261

passfile.write(passphrase)

262

passfile.flush()

263

proc = subprocess.Popen([self.gpg, '--decrypt',

264

'--passphrase-file',

265

passfile.name]

266

+ self.gnupgargs,

267

stdin = subprocess.PIPE,

268

stdout = subprocess.PIPE,

269

stderr = subprocess.PIPE)

270

decrypted_plaintext, err = proc.communicate(input = data)

271

if proc.returncode != 0:

272

raise PGPError(err)

207

273

return decrypted_plaintext

208

274

209

275

# Pretend that we have an Avahi module

276

class Avahi(object):

277

"""This isn't so much a class as it is a module-like namespace.

278

It is instantiated once, and simulates having an Avahi module."""

279

IF_UNSPEC = -1 # avahi-common/address.h

280

PROTO_UNSPEC = -1 # avahi-common/address.h

281

PROTO_INET = 0 # avahi-common/address.h

282

PROTO_INET6 = 1 # avahi-common/address.h

283

DBUS_NAME = "org.freedesktop.Avahi"

284

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

285

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

286

DBUS_PATH_SERVER = "/"

287

def string_array_to_txt_array(self, t):

288

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

289

for s in t), signature="ay")

290

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

291

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

292

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

293

SERVER_INVALID = 0 # avahi-common/defs.h

294

SERVER_REGISTERING = 1 # avahi-common/defs.h

295

SERVER_RUNNING = 2 # avahi-common/defs.h

296

SERVER_COLLISION = 3 # avahi-common/defs.h

297

SERVER_FAILURE = 4 # avahi-common/defs.h

298

avahi = Avahi()

210

299

211

300

class AvahiError(Exception):

212

301

def __init__(self, value, *args, **kwargs):

213

302

self.value = value

214

super(AvahiError, self).__init__(value, *args, **kwargs)

215

def __unicode__(self):

216

return unicode(repr(self.value))

303

return super(AvahiError, self).__init__(value, *args,

304

**kwargs)

305

217

306

218

307

class AvahiServiceError(AvahiError):

219

308

pass

220

309

310

221

311

class AvahiGroupError(AvahiError):

222

312

pass

223

313

230

320

Used to optionally bind to the specified interface.

231

321

name: string; Example: 'Mandos'

232

322

type: string; Example: '_mandos._tcp'.

233

See <http://www.dns-sd.org/ServiceTypes.html>

323

See <https://www.iana.org/assignments/service-names-port-numbers>

234

324

port: integer; what port to announce

235

325

TXT: list of strings; TXT record for the service

236

326

domain: string; Domain to publish on, default to .local if empty.

242

332

server: D-Bus Server

243

333

bus: dbus.SystemBus()

244

334

"""

245

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

246

servicetype = None, port = None, TXT = None,

247

domain = "", host = "", max_renames = 32768,

248

protocol = avahi.PROTO_UNSPEC, bus = None):

335

336

def __init__(self,

337

interface = avahi.IF_UNSPEC,

338

name = None,

339

servicetype = None,

340

port = None,

341

TXT = None,

342

domain = "",

343

host = "",

344

max_renames = 32768,

345

protocol = avahi.PROTO_UNSPEC,

346

bus = None):

249

347

self.interface = interface

250

348

self.name = name

251

349

self.type = servicetype

260

358

self.server = None

261

359

self.bus = bus

262

360

self.entry_group_state_changed_match = None

263

def rename(self):

361

362

def rename(self, remove=True):

264

363

"""Derived from the Avahi example code"""

265

364

if self.rename_count >= self.max_renames:

266

365

logger.critical("No suitable Zeroconf service name found"

267

366

" after %i retries, exiting.",

268

367

self.rename_count)

269

368

raise AvahiServiceError("Too many renames")

270

self.name = unicode(self.server

271

.GetAlternativeServiceName(self.name))

369

self.name = str(

370

self.server.GetAlternativeServiceName(self.name))

371

self.rename_count += 1

272

372

logger.info("Changing Zeroconf service name to %r ...",

273

373

self.name)

274

self.remove()

374

if remove:

375

self.remove()

275

376

try:

276

377

self.add()

277

378

except dbus.exceptions.DBusException as error:

278

logger.critical("DBusException: %s", error)

279

self.cleanup()

280

os._exit(1)

281

self.rename_count += 1

379

if (error.get_dbus_name()

380

== "org.freedesktop.Avahi.CollisionError"):

381

logger.info("Local Zeroconf service name collision.")

382

return self.rename(remove=False)

383

else:

384

logger.critical("D-Bus Exception", exc_info=error)

385

self.cleanup()

386

os._exit(1)

387

282

388

def remove(self):

283

389

"""Derived from the Avahi example code"""

284

390

if self.entry_group_state_changed_match is not None:

286

392

self.entry_group_state_changed_match = None

287

393

if self.group is not None:

288

394

self.group.Reset()

395

289

396

def add(self):

290

397

"""Derived from the Avahi example code"""

291

398

self.remove()

308

415

dbus.UInt16(self.port),

309

416

avahi.string_array_to_txt_array(self.TXT))

310

417

self.group.Commit()

418

311

419

def entry_group_state_changed(self, state, error):

312

420

"""Derived from the Avahi example code"""

313

421

logger.debug("Avahi entry group state change: %i", state)

319

427

self.rename()

320

428

elif state == avahi.ENTRY_GROUP_FAILURE:

321

429

logger.critical("Avahi: Error in group state changed %s",

322

unicode(error))

323

raise AvahiGroupError("State changed: %s"

324

% unicode(error))

430

str(error))

431

raise AvahiGroupError("State changed: {!s}".format(error))

432

325

433

def cleanup(self):

326

434

"""Derived from the Avahi example code"""

327

435

if self.group is not None:

332

440

pass

333

441

self.group = None

334

442

self.remove()

443

335

444

def server_state_changed(self, state, error=None):

336

445

"""Derived from the Avahi example code"""

337

446

logger.debug("Avahi server state change: %i", state)

338

bad_states = { avahi.SERVER_INVALID:

339

"Zeroconf server invalid",

340

avahi.SERVER_REGISTERING: None,

341

avahi.SERVER_COLLISION:

342

"Zeroconf server name collision",

343

avahi.SERVER_FAILURE:

344

"Zeroconf server failure" }

447

bad_states = {

448

avahi.SERVER_INVALID: "Zeroconf server invalid",

449

avahi.SERVER_REGISTERING: None,

450

avahi.SERVER_COLLISION: "Zeroconf server name collision",

451

avahi.SERVER_FAILURE: "Zeroconf server failure",

452

}

345

453

if state in bad_states:

346

454

if bad_states[state] is not None:

347

455

if error is None:

350

458

logger.error(bad_states[state] + ": %r", error)

351

459

self.cleanup()

352

460

elif state == avahi.SERVER_RUNNING:

353

self.add()

461

try:

462

self.add()

463

except dbus.exceptions.DBusException as error:

464

if (error.get_dbus_name()

465

== "org.freedesktop.Avahi.CollisionError"):

466

logger.info("Local Zeroconf service name"

467

" collision.")

468

return self.rename(remove=False)

469

else:

470

logger.critical("D-Bus Exception", exc_info=error)

471

self.cleanup()

472

os._exit(1)

354

473

else:

355

474

if error is None:

356

475

logger.debug("Unknown state: %r", state)

357

476

else:

358

477

logger.debug("Unknown state: %r: %r", state, error)

478

359

479

def activate(self):

360

480

"""Derived from the Avahi example code"""

361

481

if self.server is None:

365

485

follow_name_owner_changes=True),

366

486

avahi.DBUS_INTERFACE_SERVER)

367

487

self.server.connect_to_signal("StateChanged",

368

self.server_state_changed)

488

self.server_state_changed)

369

489

self.server_state_changed(self.server.GetState())

370

490

491

371

492

class AvahiServiceToSyslog(AvahiService):

372

def rename(self):

493

def rename(self, *args, **kwargs):

373

494

"""Add the new name to the syslog messages"""

374

ret = AvahiService.rename(self)

375

syslogger.setFormatter(logging.Formatter

376

('Mandos (%s) [%%(process)d]:'

377

' %%(levelname)s: %%(message)s'

378

% self.name))

495

ret = AvahiService.rename(self, *args, **kwargs)

496

syslogger.setFormatter(logging.Formatter(

497

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

498

.format(self.name)))

379

499

return ret

380

500

381

def timedelta_to_milliseconds(td):

382

"Convert a datetime.timedelta() to milliseconds"

383

return ((td.days * 24 * 60 * 60 * 1000)

384

+ (td.seconds * 1000)

385

+ (td.microseconds // 1000))

386

501

# Pretend that we have a GnuTLS module

502

class GnuTLS(object):

503

"""This isn't so much a class as it is a module-like namespace.

504

It is instantiated once, and simulates having a GnuTLS module."""

505

506

_library = ctypes.cdll.LoadLibrary(

507

ctypes.util.find_library("gnutls"))

508

_need_version = b"3.3.0"

509

def __init__(self):

510

# Need to use class name "GnuTLS" here, since this method is

511

# called before the assignment to the "gnutls" global variable

512

# happens.

513

if GnuTLS.check_version(self._need_version) is None:

514

raise GnuTLS.Error("Needs GnuTLS {} or later"

515

.format(self._need_version))

516

517

# Unless otherwise indicated, the constants and types below are

518

# all from the gnutls/gnutls.h C header file.

519

520

# Constants

521

E_SUCCESS = 0

522

E_INTERRUPTED = -52

523

E_AGAIN = -28

524

CRT_OPENPGP = 2

525

CLIENT = 2

526

SHUT_RDWR = 0

527

CRD_CERTIFICATE = 1

528

E_NO_CERTIFICATE_FOUND = -49

529

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

530

531

# Types

532

class session_int(ctypes.Structure):

533

_fields_ = []

534

session_t = ctypes.POINTER(session_int)

535

class certificate_credentials_st(ctypes.Structure):

536

_fields_ = []

537

certificate_credentials_t = ctypes.POINTER(

538

certificate_credentials_st)

539

certificate_type_t = ctypes.c_int

540

class datum_t(ctypes.Structure):

541

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

542

('size', ctypes.c_uint)]

543

class openpgp_crt_int(ctypes.Structure):

544

_fields_ = []

545

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

546

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

547

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

548

credentials_type_t = ctypes.c_int

549

transport_ptr_t = ctypes.c_void_p

550

close_request_t = ctypes.c_int

551

552

# Exceptions

553

class Error(Exception):

554

# We need to use the class name "GnuTLS" here, since this

555

# exception might be raised from within GnuTLS.__init__,

556

# which is called before the assignment to the "gnutls"

557

# global variable has happened.

558

def __init__(self, message = None, code = None, args=()):

559

# Default usage is by a message string, but if a return

560

# code is passed, convert it to a string with

561

# gnutls.strerror()

562

self.code = code

563

if message is None and code is not None:

564

message = GnuTLS.strerror(code)

565

return super(GnuTLS.Error, self).__init__(

566

message, *args)

567

568

class CertificateSecurityError(Error):

569

pass

570

571

# Classes

572

class Credentials(object):

573

def __init__(self):

574

self._c_object = gnutls.certificate_credentials_t()

575

gnutls.certificate_allocate_credentials(

576

ctypes.byref(self._c_object))

577

self.type = gnutls.CRD_CERTIFICATE

578

579

def __del__(self):

580

gnutls.certificate_free_credentials(self._c_object)

581

582

class ClientSession(object):

583

def __init__(self, socket, credentials = None):

584

self._c_object = gnutls.session_t()

585

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

586

gnutls.set_default_priority(self._c_object)

587

gnutls.transport_set_ptr(self._c_object, socket.fileno())

588

gnutls.handshake_set_private_extensions(self._c_object,

589

True)

590

self.socket = socket

591

if credentials is None:

592

credentials = gnutls.Credentials()

593

gnutls.credentials_set(self._c_object, credentials.type,

594

ctypes.cast(credentials._c_object,

595

ctypes.c_void_p))

596

self.credentials = credentials

597

598

def __del__(self):

599

gnutls.deinit(self._c_object)

600

601

def handshake(self):

602

return gnutls.handshake(self._c_object)

603

604

def send(self, data):

605

data = bytes(data)

606

data_len = len(data)

607

while data_len > 0:

608

data_len -= gnutls.record_send(self._c_object,

609

data[-data_len:],

610

data_len)

611

612

def bye(self):

613

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

614

615

# Error handling functions

616

def _error_code(result):

617

"""A function to raise exceptions on errors, suitable

618

for the 'restype' attribute on ctypes functions"""

619

if result >= 0:

620

return result

621

if result == gnutls.E_NO_CERTIFICATE_FOUND:

622

raise gnutls.CertificateSecurityError(code = result)

623

raise gnutls.Error(code = result)

624

625

def _retry_on_error(result, func, arguments):

626

"""A function to retry on some errors, suitable

627

for the 'errcheck' attribute on ctypes functions"""

628

while result < 0:

629

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

630

return _error_code(result)

631

result = func(*arguments)

632

return result

633

634

# Unless otherwise indicated, the function declarations below are

635

# all from the gnutls/gnutls.h C header file.

636

637

# Functions

638

priority_set_direct = _library.gnutls_priority_set_direct

639

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

640

ctypes.POINTER(ctypes.c_char_p)]

641

priority_set_direct.restype = _error_code

642

643

init = _library.gnutls_init

644

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

645

init.restype = _error_code

646

647

set_default_priority = _library.gnutls_set_default_priority

648

set_default_priority.argtypes = [session_t]

649

set_default_priority.restype = _error_code

650

651

record_send = _library.gnutls_record_send

652

record_send.argtypes = [session_t, ctypes.c_void_p,

653

ctypes.c_size_t]

654

record_send.restype = ctypes.c_ssize_t

655

record_send.errcheck = _retry_on_error

656

657

certificate_allocate_credentials = (

658

_library.gnutls_certificate_allocate_credentials)

659

certificate_allocate_credentials.argtypes = [

660

ctypes.POINTER(certificate_credentials_t)]

661

certificate_allocate_credentials.restype = _error_code

662

663

certificate_free_credentials = (

664

_library.gnutls_certificate_free_credentials)

665

certificate_free_credentials.argtypes = [certificate_credentials_t]

666

certificate_free_credentials.restype = None

667

668

handshake_set_private_extensions = (

669

_library.gnutls_handshake_set_private_extensions)

670

handshake_set_private_extensions.argtypes = [session_t,

671

ctypes.c_int]

672

handshake_set_private_extensions.restype = None

673

674

credentials_set = _library.gnutls_credentials_set

675

credentials_set.argtypes = [session_t, credentials_type_t,

676

ctypes.c_void_p]

677

credentials_set.restype = _error_code

678

679

strerror = _library.gnutls_strerror

680

strerror.argtypes = [ctypes.c_int]

681

strerror.restype = ctypes.c_char_p

682

683

certificate_type_get = _library.gnutls_certificate_type_get

684

certificate_type_get.argtypes = [session_t]

685

certificate_type_get.restype = _error_code

686

687

certificate_get_peers = _library.gnutls_certificate_get_peers

688

certificate_get_peers.argtypes = [session_t,

689

ctypes.POINTER(ctypes.c_uint)]

690

certificate_get_peers.restype = ctypes.POINTER(datum_t)

691

692

global_set_log_level = _library.gnutls_global_set_log_level

693

global_set_log_level.argtypes = [ctypes.c_int]

694

global_set_log_level.restype = None

695

696

global_set_log_function = _library.gnutls_global_set_log_function

697

global_set_log_function.argtypes = [log_func]

698

global_set_log_function.restype = None

699

700

deinit = _library.gnutls_deinit

701

deinit.argtypes = [session_t]

702

deinit.restype = None

703

704

handshake = _library.gnutls_handshake

705

handshake.argtypes = [session_t]

706

handshake.restype = _error_code

707

handshake.errcheck = _retry_on_error

708

709

transport_set_ptr = _library.gnutls_transport_set_ptr

710

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

711

transport_set_ptr.restype = None

712

713

bye = _library.gnutls_bye

714

bye.argtypes = [session_t, close_request_t]

715

bye.restype = _error_code

716

bye.errcheck = _retry_on_error

717

718

check_version = _library.gnutls_check_version

719

check_version.argtypes = [ctypes.c_char_p]

720

check_version.restype = ctypes.c_char_p

721

722

# All the function declarations below are from gnutls/openpgp.h

723

724

openpgp_crt_init = _library.gnutls_openpgp_crt_init

725

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

726

openpgp_crt_init.restype = _error_code

727

728

openpgp_crt_import = _library.gnutls_openpgp_crt_import

729

openpgp_crt_import.argtypes = [openpgp_crt_t,

730

ctypes.POINTER(datum_t),

731

openpgp_crt_fmt_t]

732

openpgp_crt_import.restype = _error_code

733

734

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

735

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

736

ctypes.POINTER(ctypes.c_uint)]

737

openpgp_crt_verify_self.restype = _error_code

738

739

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

740

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

741

openpgp_crt_deinit.restype = None

742

743

openpgp_crt_get_fingerprint = (

744

_library.gnutls_openpgp_crt_get_fingerprint)

745

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

746

ctypes.c_void_p,

747

ctypes.POINTER(

748

ctypes.c_size_t)]

749

openpgp_crt_get_fingerprint.restype = _error_code

750

751

# Remove non-public functions

752

del _error_code, _retry_on_error

753

# Create the global "gnutls" object, simulating a module

754

gnutls = GnuTLS()

755

756

def call_pipe(connection, # : multiprocessing.Connection

757

func, *args, **kwargs):

758

"""This function is meant to be called by multiprocessing.Process

759

760

This function runs func(*args, **kwargs), and writes the resulting

761

return value on the provided multiprocessing.Connection.

762

"""

763

connection.send(func(*args, **kwargs))

764

connection.close()

765

387

766

class Client(object):

388

767

"""A representation of a client host served by this server.

389

768

394

773

checker: subprocess.Popen(); a running checker process used

395

774

to see if the client lives.

396

775

'None' if no process is running.

397

checker_callback_tag: a gobject event source tag, or None

776

checker_callback_tag: a GLib event source tag, or None

398

777

checker_command: string; External command which is run to check

399

778

if client lives. %() expansions are done at

400

779

runtime with vars(self) as dict, so that for

401

780

instance %(name)s can be used in the command.

402

checker_initiator_tag: a gobject event source tag, or None

781

checker_initiator_tag: a GLib event source tag, or None

403

782

created: datetime.datetime(); (UTC) object creation

404

783

client_structure: Object describing what attributes a client has

405

784

and is used for storing the client at exit

406

785

current_checker_command: string; current running checker_command

407

disable_initiator_tag: a gobject event source tag, or None

786

disable_initiator_tag: a GLib event source tag, or None

408

787

enabled: bool()

409

788

fingerprint: string (40 or 32 hexadecimal digits); used to

410

789

uniquely identify the client

414

793

last_checked_ok: datetime.datetime(); (UTC) or None

415

794

last_checker_status: integer between 0 and 255 reflecting exit

416

795

status of last checker. -1 reflects crashed

417

checker, or None.

796

checker, -2 means no checker completed yet.

797

last_checker_signal: The signal which killed the last checker, if

798

last_checker_status is -1

418

799

last_enabled: datetime.datetime(); (UTC) or None

419

800

name: string; from the config file, used in log messages and

420

801

D-Bus identifiers

421

802

secret: bytestring; sent verbatim (over TLS) to client

422

803

timeout: datetime.timedelta(); How long from last_checked_ok

423

804

until this client is disabled

424

extended_timeout: extra long timeout when password has been sent

805

extended_timeout: extra long timeout when secret has been sent

425

806

runtime_expansions: Allowed attributes for runtime expansion.

426

807

expires: datetime.datetime(); time (UTC) when a client will be

427

808

disabled, or None

809

server_settings: The server_settings dict from main()

428

810

"""

429

811

430

812

runtime_expansions = ("approval_delay", "approval_duration",

431

"created", "enabled", "fingerprint",

432

"host", "interval", "last_checked_ok",

813

"created", "enabled", "expires",

814

"fingerprint", "host", "interval",

815

"last_approval_request", "last_checked_ok",

433

816

"last_enabled", "name", "timeout")

434

client_defaults = { "timeout": "5m",

435

"extended_timeout": "15m",

436

"interval": "2m",

437

"checker": "fping -q -- %%(host)s",

438

"host": "",

439

"approval_delay": "0s",

440

"approval_duration": "1s",

441

"approved_by_default": "True",

442

"enabled": "True",

443

}

444

445

def timeout_milliseconds(self):

446

"Return the 'timeout' attribute in milliseconds"

447

return timedelta_to_milliseconds(self.timeout)

448

449

def extended_timeout_milliseconds(self):

450

"Return the 'extended_timeout' attribute in milliseconds"

451

return timedelta_to_milliseconds(self.extended_timeout)

452

453

def interval_milliseconds(self):

454

"Return the 'interval' attribute in milliseconds"

455

return timedelta_to_milliseconds(self.interval)

456

457

def approval_delay_milliseconds(self):

458

return timedelta_to_milliseconds(self.approval_delay)

459

817

client_defaults = {

818

"timeout": "PT5M",

819

"extended_timeout": "PT15M",

820

"interval": "PT2M",

821

"checker": "fping -q -- %%(host)s",

822

"host": "",

823

"approval_delay": "PT0S",

824

"approval_duration": "PT1S",

825

"approved_by_default": "True",

826

"enabled": "True",

827

}

828

460

829

@staticmethod

461

830

def config_parser(config):

462

""" Construct a new dict of client settings of this form:

831

"""Construct a new dict of client settings of this form:

463

832

{ client_name: {setting_name: value, ...}, ...}

464

with exceptions for any special settings as defined above"""

833

with exceptions for any special settings as defined above.

834

NOTE: Must be a pure function. Must return the same result

835

value given the same arguments.

836

"""

465

837

settings = {}

466

838

for client_name in config.sections():

467

839

section = dict(config.items(client_name))

471

843

# Reformat values from string types to Python types

472

844

client["approved_by_default"] = config.getboolean(

473

845

client_name, "approved_by_default")

474

client["enabled"] = config.getboolean(client_name, "enabled")

846

client["enabled"] = config.getboolean(client_name,

847

"enabled")

475

848

849

# Uppercase and remove spaces from fingerprint for later

850

# comparison purposes with return value from the

851

# fingerprint() function

476

852

client["fingerprint"] = (section["fingerprint"].upper()

477

853

.replace(" ", ""))

478

854

if "secret" in section:

479

client["secret"] = section["secret"].decode("base64")

855

client["secret"] = codecs.decode(section["secret"]

856

.encode("utf-8"),

857

"base64")

480

858

elif "secfile" in section:

481

859

with open(os.path.expanduser(os.path.expandvars

482

860

(section["secfile"])),

483

861

"rb") as secfile:

484

862

client["secret"] = secfile.read()

485

863

else:

486

raise TypeError("No secret or secfile for section %s"

487

% section)

864

raise TypeError("No secret or secfile for section {}"

865

.format(section))

488

866

client["timeout"] = string_to_delta(section["timeout"])

489

867

client["extended_timeout"] = string_to_delta(

490

868

section["extended_timeout"])

496

874

client["checker_command"] = section["checker"]

497

875

client["last_approval_request"] = None

498

876

client["last_checked_ok"] = None

499

client["last_checker_status"] = None

500

if client["enabled"]:

501

client["last_enabled"] = datetime.datetime.utcnow()

502

client["expires"] = (datetime.datetime.utcnow()

503

+ client["timeout"])

504

else:

505

client["last_enabled"] = None

506

client["expires"] = None

507

877

client["last_checker_status"] = -2

878

508

879

return settings

509

510

511

def __init__(self, settings, name = None):

512

"""Note: the 'checker' key in 'config' sets the

513

'checker_command' attribute and *not* the 'checker'

514

attribute."""

880

881

def __init__(self, settings, name = None, server_settings=None):

515

882

self.name = name

883

if server_settings is None:

884

server_settings = {}

885

self.server_settings = server_settings

516

886

# adding all client settings

517

for setting, value in settings.iteritems():

887

for setting, value in settings.items():

518

888

setattr(self, setting, value)

519

889

890

if self.enabled:

891

if not hasattr(self, "last_enabled"):

892

self.last_enabled = datetime.datetime.utcnow()

893

if not hasattr(self, "expires"):

894

self.expires = (datetime.datetime.utcnow()

895

+ self.timeout)

896

else:

897

self.last_enabled = None

898

self.expires = None

899

520

900

logger.debug("Creating client %r", self.name)

521

# Uppercase and remove spaces from fingerprint for later

522

# comparison purposes with return value from the fingerprint()

523

# function

524

901

logger.debug(" Fingerprint: %s", self.fingerprint)

525

self.created = settings.get("created", datetime.datetime.utcnow())

526

902

self.created = settings.get("created",

903

datetime.datetime.utcnow())

904

527

905

# attributes specific for this server instance

528

906

self.checker = None

529

907

self.checker_initiator_tag = None

532

910

self.current_checker_command = None

533

911

self.approved = None

534

912

self.approvals_pending = 0

535

self.changedstate = (multiprocessing_manager

536

.Condition(multiprocessing_manager

537

.Lock()))

538

self.client_structure = [attr for attr in

539

self.__dict__.iterkeys()

913

self.changedstate = multiprocessing_manager.Condition(

914

multiprocessing_manager.Lock())

915

self.client_structure = [attr

916

for attr in self.__dict__.keys()

540

917

if not attr.startswith("_")]

541

918

self.client_structure.append("client_structure")

542

919

543

for name, t in inspect.getmembers(type(self),

544

lambda obj:

545

isinstance(obj,

546

property)):

920

for name, t in inspect.getmembers(

921

type(self), lambda obj: isinstance(obj, property)):

547

922

if not name.startswith("_"):

548

923

self.client_structure.append(name)

549

924

557

932

if getattr(self, "enabled", False):

558

933

# Already enabled

559

934

return

560

self.send_changedstate()

561

935

self.expires = datetime.datetime.utcnow() + self.timeout

562

936

self.enabled = True

563

937

self.last_enabled = datetime.datetime.utcnow()

564

938

self.init_checker()

939

self.send_changedstate()

565

940

566

941

def disable(self, quiet=True):

567

942

"""Disable this client."""

568

943

if not getattr(self, "enabled", False):

569

944

return False

570

945

if not quiet:

571

self.send_changedstate()

572

if not quiet:

573

946

logger.info("Disabling client %s", self.name)

574

if getattr(self, "disable_initiator_tag", False):

575

gobject.source_remove(self.disable_initiator_tag)

947

if getattr(self, "disable_initiator_tag", None) is not None:

948

GLib.source_remove(self.disable_initiator_tag)

576

949

self.disable_initiator_tag = None

577

950

self.expires = None

578

if getattr(self, "checker_initiator_tag", False):

579

gobject.source_remove(self.checker_initiator_tag)

951

if getattr(self, "checker_initiator_tag", None) is not None:

952

GLib.source_remove(self.checker_initiator_tag)

580

953

self.checker_initiator_tag = None

581

954

self.stop_checker()

582

955

self.enabled = False

583

# Do not run this again if called by a gobject.timeout_add

956

if not quiet:

957

self.send_changedstate()

958

# Do not run this again if called by a GLib.timeout_add

584

959

return False

585

960

586

961

def __del__(self):

589

964

def init_checker(self):

590

965

# Schedule a new checker to be started an 'interval' from now,

591

966

# and every interval from then on.

592

self.checker_initiator_tag = (gobject.timeout_add

593

(self.interval_milliseconds(),

594

self.start_checker))

967

if self.checker_initiator_tag is not None:

968

GLib.source_remove(self.checker_initiator_tag)

969

self.checker_initiator_tag = GLib.timeout_add(

970

int(self.interval.total_seconds() * 1000),

971

self.start_checker)

595

972

# Schedule a disable() when 'timeout' has passed

596

self.disable_initiator_tag = (gobject.timeout_add

597

(self.timeout_milliseconds(),

598

self.disable))

973

if self.disable_initiator_tag is not None:

974

GLib.source_remove(self.disable_initiator_tag)

975

self.disable_initiator_tag = GLib.timeout_add(

976

int(self.timeout.total_seconds() * 1000), self.disable)

599

977

# Also start a new checker *right now*.

600

978

self.start_checker()

601

979

602

def checker_callback(self, pid, condition, command):

980

def checker_callback(self, source, condition, connection,

981

command):

603

982

"""The checker has completed, so take appropriate actions."""

604

983

self.checker_callback_tag = None

605

984

self.checker = None

606

if os.WIFEXITED(condition):

607

self.last_checker_status = os.WEXITSTATUS(condition)

985

# Read return code from connection (see call_pipe)

986

returncode = connection.recv()

987

connection.close()

988

989

if returncode >= 0:

990

self.last_checker_status = returncode

991

self.last_checker_signal = None

608

992

if self.last_checker_status == 0:

609

993

logger.info("Checker for %(name)s succeeded",

610

994

vars(self))

611

995

self.checked_ok()

612

996

else:

613

logger.info("Checker for %(name)s failed",

614

vars(self))

997

logger.info("Checker for %(name)s failed", vars(self))

615

998

else:

616

999

self.last_checker_status = -1

1000

self.last_checker_signal = -returncode

617

1001

logger.warning("Checker for %(name)s crashed?",

618

1002

vars(self))

619

620

def checked_ok(self, timeout=None):

621

"""Bump up the timeout for this client.

622

623

This should only be called when the client has been seen,

624

alive and well.

625

"""

1003

return False

1004

1005

def checked_ok(self):

1006

"""Assert that the client has been seen, alive and well."""

1007

self.last_checked_ok = datetime.datetime.utcnow()

1008

self.last_checker_status = 0

1009

self.last_checker_signal = None

1010

self.bump_timeout()

1011

1012

def bump_timeout(self, timeout=None):

1013

"""Bump up the timeout for this client."""

626

1014

if timeout is None:

627

1015

timeout = self.timeout

628

self.last_checked_ok = datetime.datetime.utcnow()

629

1016

if self.disable_initiator_tag is not None:

630

gobject.source_remove(self.disable_initiator_tag)

1017

GLib.source_remove(self.disable_initiator_tag)

1018

self.disable_initiator_tag = None

631

1019

if getattr(self, "enabled", False):

632

self.disable_initiator_tag = (gobject.timeout_add

633

(timedelta_to_milliseconds

634

(timeout), self.disable))

1020

self.disable_initiator_tag = GLib.timeout_add(

1021

int(timeout.total_seconds() * 1000), self.disable)

635

1022

self.expires = datetime.datetime.utcnow() + timeout

636

1023

637

1024

def need_approval(self):

643

1030

If a checker already exists, leave it running and do

644

1031

nothing."""

645

1032

# The reason for not killing a running checker is that if we

646

# did that, then if a checker (for some reason) started

647

# running slowly and taking more than 'interval' time, the

648

# client would inevitably timeout, since no checker would get

649

# a chance to run to completion. If we instead leave running

1033

# did that, and if a checker (for some reason) started running

1034

# slowly and taking more than 'interval' time, then the client

1035

# would inevitably timeout, since no checker would get a

1036

# chance to run to completion. If we instead leave running

650

1037

# checkers alone, the checker would have to take more time

651

1038

# than 'timeout' for the client to be disabled, which is as it

652

1039

# should be.

653

1040

654

# If a checker exists, make sure it is not a zombie

655

try:

656

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

657

except (AttributeError, OSError) as error:

658

if (isinstance(error, OSError)

659

and error.errno != errno.ECHILD):

660

raise error

661

else:

662

if pid:

663

logger.warning("Checker was a zombie")

664

gobject.source_remove(self.checker_callback_tag)

665

self.checker_callback(pid, status,

666

self.current_checker_command)

1041

if self.checker is not None and not self.checker.is_alive():

1042

logger.warning("Checker was not alive; joining")

1043

self.checker.join()

1044

self.checker = None

667

1045

# Start a new checker if needed

668

1046

if self.checker is None:

1047

# Escape attributes for the shell

1048

escaped_attrs = {

1049

attr: re.escape(str(getattr(self, attr)))

1050

for attr in self.runtime_expansions }

669

1051

try:

670

# In case checker_command has exactly one % operator

671

command = self.checker_command % self.host

672

except TypeError:

673

# Escape attributes for the shell

674

escaped_attrs = dict(

675

(attr,

676

re.escape(unicode(str(getattr(self, attr, "")),

677

errors=

678

'replace')))

679

for attr in

680

self.runtime_expansions)

681

682

try:

683

command = self.checker_command % escaped_attrs

684

except TypeError as error:

685

logger.error('Could not format string "%s":'

686

' %s', self.checker_command, error)

687

return True # Try again later

1052

command = self.checker_command % escaped_attrs

1053

except TypeError as error:

1054

logger.error('Could not format string "%s"',

1055

self.checker_command,

1056

exc_info=error)

1057

return True # Try again later

688

1058

self.current_checker_command = command

689

try:

690

logger.info("Starting checker %r for %s",

691

command, self.name)

692

# We don't need to redirect stdout and stderr, since

693

# in normal mode, that is already done by daemon(),

694

# and in debug mode we don't want to. (Stdin is

695

# always replaced by /dev/null.)

696

self.checker = subprocess.Popen(command,

697

close_fds=True,

698

shell=True, cwd="/")

699

self.checker_callback_tag = (gobject.child_watch_add

700

(self.checker.pid,

701

self.checker_callback,

702

data=command))

703

# The checker may have completed before the gobject

704

# watch was added. Check for this.

705

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

706

if pid:

707

gobject.source_remove(self.checker_callback_tag)

708

self.checker_callback(pid, status, command)

709

except OSError as error:

710

logger.error("Failed to start subprocess: %s",

711

error)

712

# Re-run this periodically if run by gobject.timeout_add

1059

logger.info("Starting checker %r for %s", command,

1060

self.name)

1061

# We don't need to redirect stdout and stderr, since

1062

# in normal mode, that is already done by daemon(),

1063

# and in debug mode we don't want to. (Stdin is

1064

# always replaced by /dev/null.)

1065

# The exception is when not debugging but nevertheless

1066

# running in the foreground; use the previously

1067

# created wnull.

1068

popen_args = { "close_fds": True,

1069

"shell": True,

1070

"cwd": "/" }

1071

if (not self.server_settings["debug"]

1072

and self.server_settings["foreground"]):

1073

popen_args.update({"stdout": wnull,

1074

"stderr": wnull })

1075

pipe = multiprocessing.Pipe(duplex = False)

1076

self.checker = multiprocessing.Process(

1077

target = call_pipe,

1078

args = (pipe[1], subprocess.call, command),

1079

kwargs = popen_args)

1080

self.checker.start()

1081

self.checker_callback_tag = GLib.io_add_watch(

1082

pipe[0].fileno(), GLib.IO_IN,

1083

self.checker_callback, pipe[0], command)

1084

# Re-run this periodically if run by GLib.timeout_add

713

1085

return True

714

1086

715

1087

def stop_checker(self):

716

1088

"""Force the checker process, if any, to stop."""

717

1089

if self.checker_callback_tag:

718

gobject.source_remove(self.checker_callback_tag)

1090

GLib.source_remove(self.checker_callback_tag)

719

1091

self.checker_callback_tag = None

720

1092

if getattr(self, "checker", None) is None:

721

1093

return

722

1094

logger.debug("Stopping checker for %(name)s", vars(self))

723

try:

724

os.kill(self.checker.pid, signal.SIGTERM)

725

#time.sleep(0.5)

726

#if self.checker.poll() is None:

727

# os.kill(self.checker.pid, signal.SIGKILL)

728

except OSError as error:

729

if error.errno != errno.ESRCH: # No such process

730

raise

1095

self.checker.terminate()

731

1096

self.checker = None

732

1097

733

1098

734

def dbus_service_property(dbus_interface, signature="v",

735

access="readwrite", byte_arrays=False):

1099

def dbus_service_property(dbus_interface,

1100

signature="v",

1101

access="readwrite",

1102

byte_arrays=False):

736

1103

"""Decorators for marking methods of a DBusObjectWithProperties to

737

1104

become properties on the D-Bus.

738

1105

747

1114

# "Set" method, so we fail early here:

748

1115

if byte_arrays and signature != "ay":

749

1116

raise ValueError("Byte arrays not supported for non-'ay'"

750

" signature %r" % signature)

1117

" signature {!r}".format(signature))

1118

751

1119

def decorator(func):

752

1120

func._dbus_is_property = True

753

1121

func._dbus_interface = dbus_interface

758

1126

func._dbus_name = func._dbus_name[:-14]

759

1127

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

760

1128

return func

1129

1130

return decorator

1131

1132

1133

def dbus_interface_annotations(dbus_interface):

1134

"""Decorator for marking functions returning interface annotations

1135

1136

Usage:

1137

1138

@dbus_interface_annotations("org.example.Interface")

1139

def _foo(self): # Function name does not matter

1140

return {"org.freedesktop.DBus.Deprecated": "true",

1141

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1142

"false"}

1143

"""

1144

1145

def decorator(func):

1146

func._dbus_is_interface = True

1147

func._dbus_interface = dbus_interface

1148

func._dbus_name = dbus_interface

1149

return func

1150

1151

return decorator

1152

1153

1154

def dbus_annotations(annotations):

1155

"""Decorator to annotate D-Bus methods, signals or properties

1156

Usage:

1157

1158

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1159

"org.freedesktop.DBus.Property."

1160

"EmitsChangedSignal": "false"})

1161

@dbus_service_property("org.example.Interface", signature="b",

1162

access="r")

1163

def Property_dbus_property(self):

1164

return dbus.Boolean(False)

1165

1166

See also the DBusObjectWithAnnotations class.

1167

"""

1168

1169

def decorator(func):

1170

func._dbus_annotations = annotations

1171

return func

1172

761

1173

return decorator

762

1174

763

1175

764

1176

class DBusPropertyException(dbus.exceptions.DBusException):

765

1177

"""A base class for D-Bus property-related exceptions

766

1178

"""

767

def __unicode__(self):

768

return unicode(str(self))

1179

pass

769

1180

770

1181

771

1182

class DBusPropertyAccessException(DBusPropertyException):

780

1191

pass

781

1192

782

1193

783

class DBusObjectWithProperties(dbus.service.Object):

1194

class DBusObjectWithAnnotations(dbus.service.Object):

1195

"""A D-Bus object with annotations.

1196

1197

Classes inheriting from this can use the dbus_annotations

1198

decorator to add annotations to methods or signals.

1199

"""

1200

1201

@staticmethod

1202

def _is_dbus_thing(thing):

1203

"""Returns a function testing if an attribute is a D-Bus thing

1204

1205

If called like _is_dbus_thing("method") it returns a function

1206

suitable for use as predicate to inspect.getmembers().

1207

"""

1208

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1209

False)

1210

1211

def _get_all_dbus_things(self, thing):

1212

"""Returns a generator of (name, attribute) pairs

1213

"""

1214

return ((getattr(athing.__get__(self), "_dbus_name", name),

1215

athing.__get__(self))

1216

for cls in self.__class__.__mro__

1217

for name, athing in

1218

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1219

1220

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1221

out_signature = "s",

1222

path_keyword = 'object_path',

1223

connection_keyword = 'connection')

1224

def Introspect(self, object_path, connection):

1225

"""Overloading of standard D-Bus method.

1226

1227

Inserts annotation tags on methods and signals.

1228

"""

1229

xmlstring = dbus.service.Object.Introspect(self, object_path,

1230

connection)

1231

try:

1232

document = xml.dom.minidom.parseString(xmlstring)

1233

1234

for if_tag in document.getElementsByTagName("interface"):

1235

# Add annotation tags

1236

for typ in ("method", "signal"):

1237

for tag in if_tag.getElementsByTagName(typ):

1238

annots = dict()

1239

for name, prop in (self.

1240

_get_all_dbus_things(typ)):

1241

if (name == tag.getAttribute("name")

1242

and prop._dbus_interface

1243

== if_tag.getAttribute("name")):

1244

annots.update(getattr(

1245

prop, "_dbus_annotations", {}))

1246

for name, value in annots.items():

1247

ann_tag = document.createElement(

1248

"annotation")

1249

ann_tag.setAttribute("name", name)

1250

ann_tag.setAttribute("value", value)

1251

tag.appendChild(ann_tag)

1252

# Add interface annotation tags

1253

for annotation, value in dict(

1254

itertools.chain.from_iterable(

1255

annotations().items()

1256

for name, annotations

1257

in self._get_all_dbus_things("interface")

1258

if name == if_tag.getAttribute("name")

1259

)).items():

1260

ann_tag = document.createElement("annotation")

1261

ann_tag.setAttribute("name", annotation)

1262

ann_tag.setAttribute("value", value)

1263

if_tag.appendChild(ann_tag)

1264

# Fix argument name for the Introspect method itself

1265

if (if_tag.getAttribute("name")

1266

== dbus.INTROSPECTABLE_IFACE):

1267

for cn in if_tag.getElementsByTagName("method"):

1268

if cn.getAttribute("name") == "Introspect":

1269

for arg in cn.getElementsByTagName("arg"):

1270

if (arg.getAttribute("direction")

1271

== "out"):

1272

arg.setAttribute("name",

1273

"xml_data")

1274

xmlstring = document.toxml("utf-8")

1275

document.unlink()

1276

except (AttributeError, xml.dom.DOMException,

1277

xml.parsers.expat.ExpatError) as error:

1278

logger.error("Failed to override Introspection method",

1279

exc_info=error)

1280

return xmlstring

1281

1282

1283

class DBusObjectWithProperties(DBusObjectWithAnnotations):

784

1284

"""A D-Bus object with properties.

785

1285

786

1286

Classes inheriting from this can use the dbus_service_property

788

1288

standard Get(), Set(), and GetAll() methods on the D-Bus.

789

1289

"""

790

1290

791

@staticmethod

792

def _is_dbus_property(obj):

793

return getattr(obj, "_dbus_is_property", False)

794

795

def _get_all_dbus_properties(self):

796

"""Returns a generator of (name, attribute) pairs

797

"""

798

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

799

for cls in self.__class__.__mro__

800

for name, prop in

801

inspect.getmembers(cls, self._is_dbus_property))

802

803

1291

def _get_dbus_property(self, interface_name, property_name):

804

1292

"""Returns a bound method if one exists which is a D-Bus

805

1293

property with the specified name and interface.

806

1294

"""

807

for cls in self.__class__.__mro__:

808

for name, value in (inspect.getmembers

809

(cls, self._is_dbus_property)):

1295

for cls in self.__class__.__mro__:

1296

for name, value in inspect.getmembers(

1297

cls, self._is_dbus_thing("property")):

810

1298

if (value._dbus_name == property_name

811

1299

and value._dbus_interface == interface_name):

812

1300

return value.__get__(self)

813

1301

814

1302

# No such property

815

raise DBusPropertyNotFound(self.dbus_object_path + ":"

816

+ interface_name + "."

817

+ property_name)

818

819

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1303

raise DBusPropertyNotFound("{}:{}.{}".format(

1304

self.dbus_object_path, interface_name, property_name))

1305

1306

@classmethod

1307

def _get_all_interface_names(cls):

1308

"""Get a sequence of all interfaces supported by an object"""

1309

return (name for name in set(getattr(getattr(x, attr),

1310

"_dbus_interface", None)

1311

for x in (inspect.getmro(cls))

1312

for attr in dir(x))

1313

if name is not None)

1314

1315

@dbus.service.method(dbus.PROPERTIES_IFACE,

1316

in_signature="ss",

820

1317

out_signature="v")

821

1318

def Get(self, interface_name, property_name):

822

1319

"""Standard D-Bus property Get() method, see D-Bus standard.

840

1337

# The byte_arrays option is not supported yet on

841

1338

# signatures other than "ay".

842

1339

if prop._dbus_signature != "ay":

843

raise ValueError

844

value = dbus.ByteArray(''.join(unichr(byte)

845

for byte in value))

1340

raise ValueError("Byte arrays not supported for non-"

1341

"'ay' signature {!r}"

1342

.format(prop._dbus_signature))

1343

value = dbus.ByteArray(b''.join(chr(byte)

1344

for byte in value))

846

1345

prop(value)

847

1346

848

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1347

@dbus.service.method(dbus.PROPERTIES_IFACE,

1348

in_signature="s",

849

1349

out_signature="a{sv}")

850

1350

def GetAll(self, interface_name):

851

1351

"""Standard D-Bus property GetAll() method, see D-Bus

854

1354

Note: Will not include properties with access="write".

855

1355

"""

856

1356

properties = {}

857

for name, prop in self._get_all_dbus_properties():

1357

for name, prop in self._get_all_dbus_things("property"):

858

1358

if (interface_name

859

1359

and interface_name != prop._dbus_interface):

860

1360

# Interface non-empty but did not match

866

1366

if not hasattr(value, "variant_level"):

867

1367

properties[name] = value

868

1368

continue

869

properties[name] = type(value)(value, variant_level=

870

value.variant_level+1)

1369

properties[name] = type(value)(

1370

value, variant_level = value.variant_level + 1)

871

1371

return dbus.Dictionary(properties, signature="sv")

872

1372

1373

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1374

def PropertiesChanged(self, interface_name, changed_properties,

1375

invalidated_properties):

1376

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1377

standard.

1378

"""

1379

pass

1380

873

1381

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

874

1382

out_signature="s",

875

1383

path_keyword='object_path',

876

1384

connection_keyword='connection')

877

1385

def Introspect(self, object_path, connection):

878

"""Standard D-Bus method, overloaded to insert property tags.

1386

"""Overloading of standard D-Bus method.

1387

1388

Inserts property tags and interface annotation tags.

879

1389

"""

880

xmlstring = dbus.service.Object.Introspect(self, object_path,

881

connection)

1390

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1391

object_path,

1392

connection)

882

1393

try:

883

1394

document = xml.dom.minidom.parseString(xmlstring)

1395

884

1396

def make_tag(document, name, prop):

885

1397

e = document.createElement("property")

886

1398

e.setAttribute("name", name)

887

1399

e.setAttribute("type", prop._dbus_signature)

888

1400

e.setAttribute("access", prop._dbus_access)

889

1401

return e

1402

890

1403

for if_tag in document.getElementsByTagName("interface"):

1404

# Add property tags

891

1405

for tag in (make_tag(document, name, prop)

892

1406

for name, prop

893

in self._get_all_dbus_properties()

1407

in self._get_all_dbus_things("property")

894

1408

if prop._dbus_interface

895

1409

== if_tag.getAttribute("name")):

896

1410

if_tag.appendChild(tag)

1411

# Add annotation tags for properties

1412

for tag in if_tag.getElementsByTagName("property"):

1413

annots = dict()

1414

for name, prop in self._get_all_dbus_things(

1415

"property"):

1416

if (name == tag.getAttribute("name")

1417

and prop._dbus_interface

1418

== if_tag.getAttribute("name")):

1419

annots.update(getattr(

1420

prop, "_dbus_annotations", {}))

1421

for name, value in annots.items():

1422

ann_tag = document.createElement(

1423

"annotation")

1424

ann_tag.setAttribute("name", name)

1425

ann_tag.setAttribute("value", value)

1426

tag.appendChild(ann_tag)

897

1427

# Add the names to the return values for the

898

1428

# "org.freedesktop.DBus.Properties" methods

899

1429

if (if_tag.getAttribute("name")

914

1444

except (AttributeError, xml.dom.DOMException,

915

1445

xml.parsers.expat.ExpatError) as error:

916

1446

logger.error("Failed to override Introspection method",

917

error)

918

return xmlstring

919

920

921

def datetime_to_dbus (dt, variant_level=0):

1447

exc_info=error)

1448

return xmlstring

1449

1450

try:

1451

dbus.OBJECT_MANAGER_IFACE

1452

except AttributeError:

1453

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1454

1455

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1456

"""A D-Bus object with an ObjectManager.

1457

1458

Classes inheriting from this exposes the standard

1459

GetManagedObjects call and the InterfacesAdded and

1460

InterfacesRemoved signals on the standard

1461

"org.freedesktop.DBus.ObjectManager" interface.

1462

1463

Note: No signals are sent automatically; they must be sent

1464

manually.

1465

"""

1466

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1467

out_signature = "a{oa{sa{sv}}}")

1468

def GetManagedObjects(self):

1469

"""This function must be overridden"""

1470

raise NotImplementedError()

1471

1472

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1473

signature = "oa{sa{sv}}")

1474

def InterfacesAdded(self, object_path, interfaces_and_properties):

1475

pass

1476

1477

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1478

def InterfacesRemoved(self, object_path, interfaces):

1479

pass

1480

1481

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1482

out_signature = "s",

1483

path_keyword = 'object_path',

1484

connection_keyword = 'connection')

1485

def Introspect(self, object_path, connection):

1486

"""Overloading of standard D-Bus method.

1487

1488

Override return argument name of GetManagedObjects to be

1489

"objpath_interfaces_and_properties"

1490

"""

1491

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1492

object_path,

1493

connection)

1494

try:

1495

document = xml.dom.minidom.parseString(xmlstring)

1496

1497

for if_tag in document.getElementsByTagName("interface"):

1498

# Fix argument name for the GetManagedObjects method

1499

if (if_tag.getAttribute("name")

1500

== dbus.OBJECT_MANAGER_IFACE):

1501

for cn in if_tag.getElementsByTagName("method"):

1502

if (cn.getAttribute("name")

1503

== "GetManagedObjects"):

1504

for arg in cn.getElementsByTagName("arg"):

1505

if (arg.getAttribute("direction")

1506

== "out"):

1507

arg.setAttribute(

1508

"name",

1509

"objpath_interfaces"

1510

"_and_properties")

1511

xmlstring = document.toxml("utf-8")

1512

document.unlink()

1513

except (AttributeError, xml.dom.DOMException,

1514

xml.parsers.expat.ExpatError) as error:

1515

logger.error("Failed to override Introspection method",

1516

exc_info = error)

1517

return xmlstring

1518

1519

def datetime_to_dbus(dt, variant_level=0):

922

1520

"""Convert a UTC datetime.datetime() to a D-Bus type."""

923

1521

if dt is None:

924

1522

return dbus.String("", variant_level = variant_level)

925

return dbus.String(dt.isoformat(),

926

variant_level=variant_level)

927

928

929

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

930

.__metaclass__):

931

"""Applied to an empty subclass of a D-Bus object, this metaclass

932

will add additional D-Bus attributes matching a certain pattern.

1523

return dbus.String(dt.isoformat(), variant_level=variant_level)

1524

1525

1526

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1527

"""A class decorator; applied to a subclass of

1528

dbus.service.Object, it will add alternate D-Bus attributes with

1529

interface names according to the "alt_interface_names" mapping.

1530

Usage:

1531

1532

@alternate_dbus_interfaces({"org.example.Interface":

1533

"net.example.AlternateInterface"})

1534

class SampleDBusObject(dbus.service.Object):

1535

@dbus.service.method("org.example.Interface")

1536

def SampleDBusMethod():

1537

pass

1538

1539

The above "SampleDBusMethod" on "SampleDBusObject" will be

1540

reachable via two interfaces: "org.example.Interface" and

1541

"net.example.AlternateInterface", the latter of which will have

1542

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1543

"true", unless "deprecate" is passed with a False value.

1544

1545

This works for methods and signals, and also for D-Bus properties

1546

(from DBusObjectWithProperties) and interfaces (from the

1547

dbus_interface_annotations decorator).

933

1548

"""

934

def __new__(mcs, name, bases, attr):

935

# Go through all the base classes which could have D-Bus

936

# methods, signals, or properties in them

937

for base in (b for b in bases

938

if issubclass(b, dbus.service.Object)):

939

# Go though all attributes of the base class

940

for attrname, attribute in inspect.getmembers(base):

1549

1550

def wrapper(cls):

1551

for orig_interface_name, alt_interface_name in (

1552

alt_interface_names.items()):

1553

attr = {}

1554

interface_names = set()

1555

# Go though all attributes of the class

1556

for attrname, attribute in inspect.getmembers(cls):

941

1557

# Ignore non-D-Bus attributes, and D-Bus attributes

942

1558

# with the wrong interface name

943

1559

if (not hasattr(attribute, "_dbus_interface")

944

or not attribute._dbus_interface

945

.startswith("se.recompile.Mandos")):

1560

or not attribute._dbus_interface.startswith(

1561

orig_interface_name)):

946

1562

continue

947

1563

# Create an alternate D-Bus interface name based on

948

1564

# the current name

949

alt_interface = (attribute._dbus_interface

950

.replace("se.recompile.Mandos",

951

"se.bsnet.fukt.Mandos"))

1565

alt_interface = attribute._dbus_interface.replace(

1566

orig_interface_name, alt_interface_name)

1567

interface_names.add(alt_interface)

952

1568

# Is this a D-Bus signal?

953

1569

if getattr(attribute, "_dbus_is_signal", False):

954

# Extract the original non-method function by

955

# black magic

956

nonmethod_func = (dict(

1570

# Extract the original non-method undecorated

1571

# function by black magic

1572

if sys.version_info.major == 2:

1573

nonmethod_func = (dict(

957

1574

zip(attribute.func_code.co_freevars,

958

attribute.__closure__))["func"]

959

.cell_contents)

1575

attribute.__closure__))

1576

["func"].cell_contents)

1577

else:

1578

nonmethod_func = (dict(

1579

zip(attribute.__code__.co_freevars,

1580

attribute.__closure__))

1581

["func"].cell_contents)

960

1582

# Create a new, but exactly alike, function

961

1583

# object, and decorate it to be a new D-Bus signal

962

1584

# with the alternate D-Bus interface name

963

new_function = (dbus.service.signal

964

(alt_interface,

965

attribute._dbus_signature)

966

(types.FunctionType(

967

nonmethod_func.func_code,

968

nonmethod_func.func_globals,

969

nonmethod_func.func_name,

970

nonmethod_func.func_defaults,

971

nonmethod_func.func_closure)))

1585

new_function = copy_function(nonmethod_func)

1586

new_function = (dbus.service.signal(

1587

alt_interface,

1588

attribute._dbus_signature)(new_function))

1589

# Copy annotations, if any

1590

try:

1591

new_function._dbus_annotations = dict(

1592

attribute._dbus_annotations)

1593

except AttributeError:

1594

pass

972

1595

# Define a creator of a function to call both the

973

# old and new functions, so both the old and new

974

# signals gets sent when the function is called

1596

# original and alternate functions, so both the

1597

# original and alternate signals gets sent when

1598

# the function is called

975

1599

def fixscope(func1, func2):

976

1600

"""This function is a scope container to pass

977

1601

func1 and func2 to the "call_both" function

978

1602

outside of its arguments"""

1603

1604

@functools.wraps(func2)

979

1605

def call_both(*args, **kwargs):

980

1606

"""This function will emit two D-Bus

981

1607

signals by calling func1 and func2"""

982

1608

func1(*args, **kwargs)

983

1609

func2(*args, **kwargs)

1610

# Make wrapper function look like a D-Bus signal

1611

for name, attr in inspect.getmembers(func2):

1612

if name.startswith("_dbus_"):

1613

setattr(call_both, name, attr)

1614

984

1615

return call_both

985

1616

# Create the "call_both" function and add it to

986

1617

# the class

987

attr[attrname] = fixscope(attribute,

988

new_function)

1618

attr[attrname] = fixscope(attribute, new_function)

989

1619

# Is this a D-Bus method?

990

1620

elif getattr(attribute, "_dbus_is_method", False):

991

1621

# Create a new, but exactly alike, function

992

1622

# object. Decorate it to be a new D-Bus method

993

1623

# with the alternate D-Bus interface name. Add it

994

1624

# to the class.

995

attr[attrname] = (dbus.service.method

996

(alt_interface,

997

attribute._dbus_in_signature,

998

attribute._dbus_out_signature)

999

(types.FunctionType

1000

(attribute.func_code,

1001

attribute.func_globals,

1002

attribute.func_name,

1003

attribute.func_defaults,

1004

attribute.func_closure)))

1625

attr[attrname] = (

1626

dbus.service.method(

1627

alt_interface,

1628

attribute._dbus_in_signature,

1629

attribute._dbus_out_signature)

1630

(copy_function(attribute)))

1631

# Copy annotations, if any

1632

try:

1633

attr[attrname]._dbus_annotations = dict(

1634

attribute._dbus_annotations)

1635

except AttributeError:

1636

pass

1005

1637

# Is this a D-Bus property?

1006

1638

elif getattr(attribute, "_dbus_is_property", False):

1007

1639

# Create a new, but exactly alike, function

1008

1640

# object, and decorate it to be a new D-Bus

1009

1641

# property with the alternate D-Bus interface

1010

1642

# name. Add it to the class.

1011

attr[attrname] = (dbus_service_property

1012

(alt_interface,

1013

attribute._dbus_signature,

1014

attribute._dbus_access,

1015

attribute

1016

._dbus_get_args_options

1017

["byte_arrays"])

1018

(types.FunctionType

1019

(attribute.func_code,

1020

attribute.func_globals,

1021

attribute.func_name,

1022

attribute.func_defaults,

1023

attribute.func_closure)))

1024

return type.__new__(mcs, name, bases, attr)

1025

1026

1643

attr[attrname] = (dbus_service_property(

1644

alt_interface, attribute._dbus_signature,

1645

attribute._dbus_access,

1646

attribute._dbus_get_args_options

1647

["byte_arrays"])

1648

(copy_function(attribute)))

1649

# Copy annotations, if any

1650

try:

1651

attr[attrname]._dbus_annotations = dict(

1652

attribute._dbus_annotations)

1653

except AttributeError:

1654

pass

1655

# Is this a D-Bus interface?

1656

elif getattr(attribute, "_dbus_is_interface", False):

1657

# Create a new, but exactly alike, function

1658

# object. Decorate it to be a new D-Bus interface

1659

# with the alternate D-Bus interface name. Add it

1660

# to the class.

1661

attr[attrname] = (

1662

dbus_interface_annotations(alt_interface)

1663

(copy_function(attribute)))

1664

if deprecate:

1665

# Deprecate all alternate interfaces

1666

iname="_AlternateDBusNames_interface_annotation{}"

1667

for interface_name in interface_names:

1668

1669

@dbus_interface_annotations(interface_name)

1670

def func(self):

1671

return { "org.freedesktop.DBus.Deprecated":

1672

"true" }

1673

# Find an unused name

1674

for aname in (iname.format(i)

1675

for i in itertools.count()):

1676

if aname not in attr:

1677

attr[aname] = func

1678

break

1679

if interface_names:

1680

# Replace the class with a new subclass of it with

1681

# methods, signals, etc. as created above.

1682

if sys.version_info.major == 2:

1683

cls = type(b"{}Alternate".format(cls.__name__),

1684

(cls, ), attr)

1685

else:

1686

cls = type("{}Alternate".format(cls.__name__),

1687

(cls, ), attr)

1688

return cls

1689

1690

return wrapper

1691

1692

1693

@alternate_dbus_interfaces({"se.recompile.Mandos":

1694

"se.bsnet.fukt.Mandos"})

1027

1695

class ClientDBus(Client, DBusObjectWithProperties):

1028

1696

"""A Client class using D-Bus

1029

1697

1033

1701

"""

1034

1702

1035

1703

runtime_expansions = (Client.runtime_expansions

1036

+ ("dbus_object_path",))

1704

+ ("dbus_object_path", ))

1705

1706

_interface = "se.recompile.Mandos.Client"

1037

1707

1038

1708

# dbus.service.Object doesn't use super(), so we can't either.

1039

1709

1040

1710

def __init__(self, bus = None, *args, **kwargs):

1041

1711

self.bus = bus

1042

1712

Client.__init__(self, *args, **kwargs)

1043

self._approvals_pending = 0

1044

1045

self._approvals_pending = 0

1046

1713

# Only now, when this client is initialized, can it show up on

1047

1714

# the D-Bus

1048

client_object_name = unicode(self.name).translate(

1715

client_object_name = str(self.name).translate(

1049

1716

{ord("."): ord("_"),

1050

1717

ord("-"): ord("_")})

1051

self.dbus_object_path = (dbus.ObjectPath

1052

("/clients/" + client_object_name))

1718

self.dbus_object_path = dbus.ObjectPath(

1719

"/clients/" + client_object_name)

1053

1720

DBusObjectWithProperties.__init__(self, self.bus,

1054

1721

self.dbus_object_path)

1055

1056

def notifychangeproperty(transform_func,

1057

dbus_name, type_func=lambda x: x,

1058

variant_level=1):

1722

1723

def notifychangeproperty(transform_func, dbus_name,

1724

type_func=lambda x: x,

1725

variant_level=1,

1726

invalidate_only=False,

1727

_interface=_interface):

1059

1728

""" Modify a variable so that it's a property which announces

1060

1729

its changes to DBus.

1061

1730

1066

1735

to the D-Bus. Default: no transform

1067

1736

variant_level: D-Bus variant level. Default: 1

1068

1737

"""

1069

attrname = "_{0}".format(dbus_name)

1738

attrname = "_{}".format(dbus_name)

1739

1070

1740

def setter(self, value):

1071

1741

if hasattr(self, "dbus_object_path"):

1072

1742

if (not hasattr(self, attrname) or

1073

1743

type_func(getattr(self, attrname, None))

1074

1744

!= type_func(value)):

1075

dbus_value = transform_func(type_func(value),

1076

variant_level

1077

=variant_level)

1078

self.PropertyChanged(dbus.String(dbus_name),

1079

dbus_value)

1745

if invalidate_only:

1746

self.PropertiesChanged(

1747

_interface, dbus.Dictionary(),

1748

dbus.Array((dbus_name, )))

1749

else:

1750

dbus_value = transform_func(

1751

type_func(value),

1752

variant_level = variant_level)

1753

self.PropertyChanged(dbus.String(dbus_name),

1754

dbus_value)

1755

self.PropertiesChanged(

1756

_interface,

1757

dbus.Dictionary({ dbus.String(dbus_name):

1758

dbus_value }),

1759

dbus.Array())

1080

1760

setattr(self, attrname, value)

1081

1761

1082

1762

return property(lambda self: getattr(self, attrname), setter)

1083

1763

1084

1085

1764

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1086

1765

approvals_pending = notifychangeproperty(dbus.Boolean,

1087

1766

"ApprovalPending",

1089

1768

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1090

1769

last_enabled = notifychangeproperty(datetime_to_dbus,

1091

1770

"LastEnabled")

1092

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1093

type_func = lambda checker:

1094

checker is not None)

1771

checker = notifychangeproperty(

1772

dbus.Boolean, "CheckerRunning",

1773

type_func = lambda checker: checker is not None)

1095

1774

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1096

1775

"LastCheckedOK")

1776

last_checker_status = notifychangeproperty(dbus.Int16,

1777

"LastCheckerStatus")

1097

1778

last_approval_request = notifychangeproperty(

1098

1779

datetime_to_dbus, "LastApprovalRequest")

1099

1780

approved_by_default = notifychangeproperty(dbus.Boolean,

1100

1781

"ApprovedByDefault")

1101

approval_delay = notifychangeproperty(dbus.UInt64,

1102

"ApprovalDelay",

1103

type_func =

1104

timedelta_to_milliseconds)

1782

approval_delay = notifychangeproperty(

1783

dbus.UInt64, "ApprovalDelay",

1784

type_func = lambda td: td.total_seconds() * 1000)

1105

1785

approval_duration = notifychangeproperty(

1106

1786

dbus.UInt64, "ApprovalDuration",

1107

type_func = timedelta_to_milliseconds)

1787

type_func = lambda td: td.total_seconds() * 1000)

1108

1788

host = notifychangeproperty(dbus.String, "Host")

1109

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1110

type_func =

1111

timedelta_to_milliseconds)

1789

timeout = notifychangeproperty(

1790

dbus.UInt64, "Timeout",

1791

type_func = lambda td: td.total_seconds() * 1000)

1112

1792

extended_timeout = notifychangeproperty(

1113

1793

dbus.UInt64, "ExtendedTimeout",

1114

type_func = timedelta_to_milliseconds)

1115

interval = notifychangeproperty(dbus.UInt64,

1116

"Interval",

1117

type_func =

1118

timedelta_to_milliseconds)

1794

type_func = lambda td: td.total_seconds() * 1000)

1795

interval = notifychangeproperty(

1796

dbus.UInt64, "Interval",

1797

type_func = lambda td: td.total_seconds() * 1000)

1119

1798

checker_command = notifychangeproperty(dbus.String, "Checker")

1799

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1800

invalidate_only=True)

1120

1801

1121

1802

del notifychangeproperty

1122

1803

1129

1810

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1130

1811

Client.__del__(self, *args, **kwargs)

1131

1812

1132

def checker_callback(self, pid, condition, command,

1133

*args, **kwargs):

1134

self.checker_callback_tag = None

1135

self.checker = None

1136

if os.WIFEXITED(condition):

1137

exitstatus = os.WEXITSTATUS(condition)

1813

def checker_callback(self, source, condition,

1814

connection, command, *args, **kwargs):

1815

ret = Client.checker_callback(self, source, condition,

1816

connection, command, *args,

1817

**kwargs)

1818

exitstatus = self.last_checker_status

1819

if exitstatus >= 0:

1138

1820

# Emit D-Bus signal

1139

1821

self.CheckerCompleted(dbus.Int16(exitstatus),

1140

dbus.Int64(condition),

1822

# This is specific to GNU libC

1823

dbus.Int64(exitstatus << 8),

1141

1824

dbus.String(command))

1142

1825

else:

1143

1826

# Emit D-Bus signal

1144

1827

self.CheckerCompleted(dbus.Int16(-1),

1145

dbus.Int64(condition),

1828

dbus.Int64(

1829

# This is specific to GNU libC

1830

(exitstatus << 8)

1831

| self.last_checker_signal),

1146

1832

dbus.String(command))

1147

1148

return Client.checker_callback(self, pid, condition, command,

1149

*args, **kwargs)

1833

return ret

1150

1834

1151

1835

def start_checker(self, *args, **kwargs):

1152

old_checker = self.checker

1153

if self.checker is not None:

1154

old_checker_pid = self.checker.pid

1155

else:

1156

old_checker_pid = None

1836

old_checker_pid = getattr(self.checker, "pid", None)

1157

1837

r = Client.start_checker(self, *args, **kwargs)

1158

1838

# Only if new checker process was started

1159

1839

if (self.checker is not None

1167

1847

return False

1168

1848

1169

1849

def approve(self, value=True):

1170

self.send_changedstate()

1171

1850

self.approved = value

1172

gobject.timeout_add(timedelta_to_milliseconds

1173

(self.approval_duration),

1174

self._reset_approved)

1175

1851

GLib.timeout_add(int(self.approval_duration.total_seconds()

1852

* 1000), self._reset_approved)

1853

self.send_changedstate()

1176

1854

1177

1855

## D-Bus methods, signals & properties

1178

_interface = "se.recompile.Mandos.Client"

1856

1857

## Interfaces

1179

1858

1180

1859

## Signals

1181

1860

1192

1871

pass

1193

1872

1194

1873

# PropertyChanged - signal

1874

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1195

1875

@dbus.service.signal(_interface, signature="sv")

1196

1876

def PropertyChanged(self, property, value):

1197

1877

"D-Bus signal"

1218

1898

"D-Bus signal"

1219

1899

return self.need_approval()

1220

1900

1221

# NeRwequest - signal

1222

@dbus.service.signal(_interface, signature="s")

1223

def NewRequest(self, ip):

1224

"""D-Bus signal

1225

Is sent after a client request a password.

1226

"""

1227

pass

1228

1229

1901

## Methods

1230

1902

1231

1903

# Approve - method

1239

1911

self.checked_ok()

1240

1912

1241

1913

# Enable - method

1914

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1242

1915

@dbus.service.method(_interface)

1243

1916

def Enable(self):

1244

1917

"D-Bus method"

1245

1918

self.enable()

1246

1919

1247

1920

# StartChecker - method

1921

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1248

1922

@dbus.service.method(_interface)

1249

1923

def StartChecker(self):

1250

1924

"D-Bus method"

1251

1925

self.start_checker()

1252

1926

1253

1927

# Disable - method

1928

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1254

1929

@dbus.service.method(_interface)

1255

1930

def Disable(self):

1256

1931

"D-Bus method"

1257

1932

self.disable()

1258

1933

1259

1934

# StopChecker - method

1935

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1260

1936

@dbus.service.method(_interface)

1261

1937

def StopChecker(self):

1262

1938

self.stop_checker()

1269

1945

return dbus.Boolean(bool(self.approvals_pending))

1270

1946

1271

1947

# ApprovedByDefault - property

1272

@dbus_service_property(_interface, signature="b",

1948

@dbus_service_property(_interface,

1949

signature="b",

1273

1950

access="readwrite")

1274

1951

def ApprovedByDefault_dbus_property(self, value=None):

1275

1952

if value is None: # get

1277

1954

self.approved_by_default = bool(value)

1278

1955

1279

1956

# ApprovalDelay - property

1280

@dbus_service_property(_interface, signature="t",

1957

@dbus_service_property(_interface,

1958

signature="t",

1281

1959

access="readwrite")

1282

1960

def ApprovalDelay_dbus_property(self, value=None):

1283

1961

if value is None: # get

1284

return dbus.UInt64(self.approval_delay_milliseconds())

1962

return dbus.UInt64(self.approval_delay.total_seconds()

1963

* 1000)

1285

1964

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1286

1965

1287

1966

# ApprovalDuration - property

1288

@dbus_service_property(_interface, signature="t",

1967

@dbus_service_property(_interface,

1968

signature="t",

1289

1969

access="readwrite")

1290

1970

def ApprovalDuration_dbus_property(self, value=None):

1291

1971

if value is None: # get

1292

return dbus.UInt64(timedelta_to_milliseconds(

1293

self.approval_duration))

1972

return dbus.UInt64(self.approval_duration.total_seconds()

1973

* 1000)

1294

1974

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1295

1975

1296

1976

# Name - property

1977

@dbus_annotations(

1978

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1297

1979

@dbus_service_property(_interface, signature="s", access="read")

1298

1980

def Name_dbus_property(self):

1299

1981

return dbus.String(self.name)

1300

1982

1301

1983

# Fingerprint - property

1984

@dbus_annotations(

1985

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1302

1986

@dbus_service_property(_interface, signature="s", access="read")

1303

1987

def Fingerprint_dbus_property(self):

1304

1988

return dbus.String(self.fingerprint)

1305

1989

1306

1990

# Host - property

1307

@dbus_service_property(_interface, signature="s",

1991

@dbus_service_property(_interface,

1992

signature="s",

1308

1993

access="readwrite")

1309

1994

def Host_dbus_property(self, value=None):

1310

1995

if value is None: # get

1311

1996

return dbus.String(self.host)

1312

self.host = unicode(value)

1997

self.host = str(value)

1313

1998

1314

1999

# Created - property

2000

@dbus_annotations(

2001

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1315

2002

@dbus_service_property(_interface, signature="s", access="read")

1316

2003

def Created_dbus_property(self):

1317

2004

return datetime_to_dbus(self.created)

1322

2009

return datetime_to_dbus(self.last_enabled)

1323

2010

1324

2011

# Enabled - property

1325

@dbus_service_property(_interface, signature="b",

2012

@dbus_service_property(_interface,

2013

signature="b",

1326

2014

access="readwrite")

1327

2015

def Enabled_dbus_property(self, value=None):

1328

2016

if value is None: # get

1333

2021

self.disable()

1334

2022

1335

2023

# LastCheckedOK - property

1336

@dbus_service_property(_interface, signature="s",

2024

@dbus_service_property(_interface,

2025

signature="s",

1337

2026

access="readwrite")

1338

2027

def LastCheckedOK_dbus_property(self, value=None):

1339

2028

if value is not None:

1341

2030

return

1342

2031

return datetime_to_dbus(self.last_checked_ok)

1343

2032

2033

# LastCheckerStatus - property

2034

@dbus_service_property(_interface, signature="n", access="read")

2035

def LastCheckerStatus_dbus_property(self):

2036

return dbus.Int16(self.last_checker_status)

2037

1344

2038

# Expires - property

1345

2039

@dbus_service_property(_interface, signature="s", access="read")

1346

2040

def Expires_dbus_property(self):

1352

2046

return datetime_to_dbus(self.last_approval_request)

1353

2047

1354

2048

# Timeout - property

1355

@dbus_service_property(_interface, signature="t",

2049

@dbus_service_property(_interface,

2050

signature="t",

1356

2051

access="readwrite")

1357

2052

def Timeout_dbus_property(self, value=None):

1358

2053

if value is None: # get

1359

return dbus.UInt64(self.timeout_milliseconds())

2054

return dbus.UInt64(self.timeout.total_seconds() * 1000)

2055

old_timeout = self.timeout

1360

2056

self.timeout = datetime.timedelta(0, 0, 0, value)

1361

if getattr(self, "disable_initiator_tag", None) is None:

1362

return

1363

# Reschedule timeout

1364

gobject.source_remove(self.disable_initiator_tag)

1365

self.disable_initiator_tag = None

1366

self.expires = None

1367

time_to_die = timedelta_to_milliseconds((self

1368

.last_checked_ok

1369

+ self.timeout)

1370

- datetime.datetime

1371

.utcnow())

1372

if time_to_die <= 0:

1373

# The timeout has passed

1374

self.disable()

1375

else:

1376

self.expires = (datetime.datetime.utcnow()

1377

+ datetime.timedelta(milliseconds =

1378

time_to_die))

1379

self.disable_initiator_tag = (gobject.timeout_add

1380

(time_to_die, self.disable))

2057

# Reschedule disabling

2058

if self.enabled:

2059

now = datetime.datetime.utcnow()

2060

self.expires += self.timeout - old_timeout

2061

if self.expires <= now:

2062

# The timeout has passed

2063

self.disable()

2064

else:

2065

if (getattr(self, "disable_initiator_tag", None)

2066

is None):

2067

return

2068

GLib.source_remove(self.disable_initiator_tag)

2069

self.disable_initiator_tag = GLib.timeout_add(

2070

int((self.expires - now).total_seconds() * 1000),

2071

self.disable)

1381

2072

1382

2073

# ExtendedTimeout - property

1383

@dbus_service_property(_interface, signature="t",

2074

@dbus_service_property(_interface,

2075

signature="t",

1384

2076

access="readwrite")

1385

2077

def ExtendedTimeout_dbus_property(self, value=None):

1386

2078

if value is None: # get

1387

return dbus.UInt64(self.extended_timeout_milliseconds())

2079

return dbus.UInt64(self.extended_timeout.total_seconds()

2080

* 1000)

1388

2081

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1389

2082

1390

2083

# Interval - property

1391

@dbus_service_property(_interface, signature="t",

2084

@dbus_service_property(_interface,

2085

signature="t",

1392

2086

access="readwrite")

1393

2087

def Interval_dbus_property(self, value=None):

1394

2088

if value is None: # get

1395

return dbus.UInt64(self.interval_milliseconds())

2089

return dbus.UInt64(self.interval.total_seconds() * 1000)

1396

2090

self.interval = datetime.timedelta(0, 0, 0, value)

1397

2091

if getattr(self, "checker_initiator_tag", None) is None:

1398

2092

return

1399

2093

if self.enabled:

1400

2094

# Reschedule checker run

1401

gobject.source_remove(self.checker_initiator_tag)

1402

self.checker_initiator_tag = (gobject.timeout_add

1403

(value, self.start_checker))

1404

self.start_checker() # Start one now, too

2095

GLib.source_remove(self.checker_initiator_tag)

2096

self.checker_initiator_tag = GLib.timeout_add(

2097

value, self.start_checker)

2098

self.start_checker() # Start one now, too

1405

2099

1406

2100

# Checker - property

1407

@dbus_service_property(_interface, signature="s",

2101

@dbus_service_property(_interface,

2102

signature="s",

1408

2103

access="readwrite")

1409

2104

def Checker_dbus_property(self, value=None):

1410

2105

if value is None: # get

1411

2106

return dbus.String(self.checker_command)

1412

self.checker_command = unicode(value)

2107

self.checker_command = str(value)

1413

2108

1414

2109

# CheckerRunning - property

1415

@dbus_service_property(_interface, signature="b",

2110

@dbus_service_property(_interface,

2111

signature="b",

1416

2112

access="readwrite")

1417

2113

def CheckerRunning_dbus_property(self, value=None):

1418

2114

if value is None: # get

1423

2119

self.stop_checker()

1424

2120

1425

2121

# ObjectPath - property

2122

@dbus_annotations(

2123

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2124

"org.freedesktop.DBus.Deprecated": "true"})

1426

2125

@dbus_service_property(_interface, signature="o", access="read")

1427

2126

def ObjectPath_dbus_property(self):

1428

2127

return self.dbus_object_path # is already a dbus.ObjectPath

1429

2128

1430

2129

# Secret = property

1431

@dbus_service_property(_interface, signature="ay",

1432

access="write", byte_arrays=True)

2130

@dbus_annotations(

2131

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2132

"invalidates"})

2133

@dbus_service_property(_interface,

2134

signature="ay",

2135

access="write",

2136

byte_arrays=True)

1433

2137

def Secret_dbus_property(self, value):

1434

self.secret = str(value)

2138

self.secret = bytes(value)

1435

2139

1436

2140

del _interface

1437

2141

1441

2145

self._pipe = child_pipe

1442

2146

self._pipe.send(('init', fpr, address))

1443

2147

if not self._pipe.recv():

1444

raise KeyError()

2148

raise KeyError(fpr)

1445

2149

1446

2150

def __getattribute__(self, name):

1447

2151

if name == '_pipe':

1451

2155

if data[0] == 'data':

1452

2156

return data[1]

1453

2157

if data[0] == 'function':

2158

1454

2159

def func(*args, **kwargs):

1455

2160

self._pipe.send(('funcall', name, args, kwargs))

1456

2161

return self._pipe.recv()[1]

2162

1457

2163

return func

1458

2164

1459

2165

def __setattr__(self, name, value):

1462

2168

self._pipe.send(('setattr', name, value))

1463

2169

1464

2170

1465

class ClientDBusTransitional(ClientDBus):

1466

__metaclass__ = AlternateDBusNamesMetaclass

1467

1468

1469

2171

class ClientHandler(socketserver.BaseRequestHandler, object):

1470

2172

"""A class to handle client connections.

1471

2173

1475

2177

def handle(self):

1476

2178

with contextlib.closing(self.server.child_pipe) as child_pipe:

1477

2179

logger.info("TCP connection from: %s",

1478

unicode(self.client_address))

2180

str(self.client_address))

1479

2181

logger.debug("Pipe FD: %d",

1480

2182

self.server.child_pipe.fileno())

1481

2183

1482

session = (gnutls.connection

1483

.ClientSession(self.request,

1484

gnutls.connection

1485

.X509Credentials()))

1486

1487

# Note: gnutls.connection.X509Credentials is really a

1488

# generic GnuTLS certificate credentials object so long as

1489

# no X.509 keys are added to it. Therefore, we can use it

1490

# here despite using OpenPGP certificates.

2184

session = gnutls.ClientSession(self.request)

1491

2185

1492

2186

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1493

2187

# "+AES-256-CBC", "+SHA1",

1497

2191

priority = self.server.gnutls_priority

1498

2192

if priority is None:

1499

2193

priority = "NORMAL"

1500

(gnutls.library.functions

1501

.gnutls_priority_set_direct(session._c_object,

1502

priority, None))

2194

gnutls.priority_set_direct(session._c_object,

2195

priority.encode("utf-8"),

2196

None)

1503

2197

1504

2198

# Start communication using the Mandos protocol

1505

2199

# Get protocol number

1507

2201

logger.debug("Protocol version: %r", line)

1508

2202

try:

1509

2203

if int(line.strip().split()[0]) > 1:

1510

raise RuntimeError

2204

raise RuntimeError(line)

1511

2205

except (ValueError, IndexError, RuntimeError) as error:

1512

2206

logger.error("Unknown protocol version: %s", error)

1513

2207

return

1515

2209

# Start GnuTLS connection

1516

2210

try:

1517

2211

session.handshake()

1518

except gnutls.errors.GNUTLSError as error:

2212

except gnutls.Error as error:

1519

2213

logger.warning("Handshake failed: %s", error)

1520

2214

# Do not run session.bye() here: the session is not

1521

2215

# established. Just abandon the request.

1525

2219

approval_required = False

1526

2220

try:

1527

2221

try:

1528

fpr = self.fingerprint(self.peer_certificate

1529

(session))

1530

except (TypeError,

1531

gnutls.errors.GNUTLSError) as error:

2222

fpr = self.fingerprint(

2223

self.peer_certificate(session))

2224

except (TypeError, gnutls.Error) as error:

1532

2225

logger.warning("Bad certificate: %s", error)

1533

2226

return

1534

2227

logger.debug("Fingerprint: %s", fpr)

1539

2232

except KeyError:

1540

2233

return

1541

2234

1542

if self.server.use_dbus:

1543

# Emit D-Bus signal

1544

client.NewRequest(str(self.client_address))

1545

1546

2235

if client.approval_delay:

1547

2236

delay = client.approval_delay

1548

2237

client.approvals_pending += 1

1551

2240

while True:

1552

2241

if not client.enabled:

1553

2242

logger.info("Client %s is disabled",

1554

client.name)

2243

client.name)

1555

2244

if self.server.use_dbus:

1556

2245

# Emit D-Bus signal

1557

2246

client.Rejected("Disabled")

1566

2255

if self.server.use_dbus:

1567

2256

# Emit D-Bus signal

1568

2257

client.NeedApproval(

1569

client.approval_delay_milliseconds(),

1570

client.approved_by_default)

2258

client.approval_delay.total_seconds()

2259

* 1000, client.approved_by_default)

1571

2260

else:

1572

2261

logger.warning("Client %s was not approved",

1573

2262

client.name)

1579

2268

#wait until timeout or approved

1580

2269

time = datetime.datetime.now()

1581

2270

client.changedstate.acquire()

1582

(client.changedstate.wait

1583

(float(client.timedelta_to_milliseconds(delay)

1584

/ 1000)))

2271

client.changedstate.wait(delay.total_seconds())

1585

2272

client.changedstate.release()

1586

2273

time2 = datetime.datetime.now()

1587

2274

if (time2 - time) >= delay:

1598

2285

else:

1599

2286

delay -= time2 - time

1600

2287

1601

sent_size = 0

1602

while sent_size < len(client.secret):

1603

try:

1604

sent = session.send(client.secret[sent_size:])

1605

except gnutls.errors.GNUTLSError as error:

1606

logger.warning("gnutls send failed")

1607

return

1608

logger.debug("Sent: %d, remaining: %d",

1609

sent, len(client.secret)

1610

- (sent_size + sent))

1611

sent_size += sent

2288

try:

2289

session.send(client.secret)

2290

except gnutls.Error as error:

2291

logger.warning("gnutls send failed",

2292

exc_info = error)

2293

return

1612

2294

1613

2295

logger.info("Sending secret to %s", client.name)

1614

2296

# bump the timeout using extended_timeout

1615

client.checked_ok(client.extended_timeout)

2297

client.bump_timeout(client.extended_timeout)

1616

2298

if self.server.use_dbus:

1617

2299

# Emit D-Bus signal

1618

2300

client.GotSecret()

1622

2304

client.approvals_pending -= 1

1623

2305

try:

1624

2306

session.bye()

1625

except gnutls.errors.GNUTLSError as error:

1626

logger.warning("GnuTLS bye failed")

2307

except gnutls.Error as error:

2308

logger.warning("GnuTLS bye failed",

2309

exc_info=error)

1627

2310

1628

2311

@staticmethod

1629

2312

def peer_certificate(session):

1630

2313

"Return the peer's OpenPGP certificate as a bytestring"

1631

2314

# If not an OpenPGP certificate...

1632

if (gnutls.library.functions

1633

.gnutls_certificate_type_get(session._c_object)

1634

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1635

# ...do the normal thing

1636

return session.peer_certificate

2315

if (gnutls.certificate_type_get(session._c_object)

2316

!= gnutls.CRT_OPENPGP):

2317

# ...return invalid data

2318

return b""

1637

2319

list_size = ctypes.c_uint(1)

1638

cert_list = (gnutls.library.functions

1639

.gnutls_certificate_get_peers

2320

cert_list = (gnutls.certificate_get_peers

1640

2321

(session._c_object, ctypes.byref(list_size)))

1641

2322

if not bool(cert_list) and list_size.value != 0:

1642

raise gnutls.errors.GNUTLSError("error getting peer"

1643

" certificate")

2323

raise gnutls.Error("error getting peer certificate")

1644

2324

if list_size.value == 0:

1645

2325

return None

1646

2326

cert = cert_list[0]

1650

2330

def fingerprint(openpgp):

1651

2331

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1652

2332

# New GnuTLS "datum" with the OpenPGP public key

1653

datum = (gnutls.library.types

1654

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1655

ctypes.POINTER

1656

(ctypes.c_ubyte)),

1657

ctypes.c_uint(len(openpgp))))

2333

datum = gnutls.datum_t(

2334

ctypes.cast(ctypes.c_char_p(openpgp),

2335

ctypes.POINTER(ctypes.c_ubyte)),

2336

ctypes.c_uint(len(openpgp)))

1658

2337

# New empty GnuTLS certificate

1659

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1660

(gnutls.library.functions

1661

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2338

crt = gnutls.openpgp_crt_t()

2339

gnutls.openpgp_crt_init(ctypes.byref(crt))

1662

2340

# Import the OpenPGP public key into the certificate

1663

(gnutls.library.functions

1664

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1665

gnutls.library.constants

1666

.GNUTLS_OPENPGP_FMT_RAW))

2341

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2342

gnutls.OPENPGP_FMT_RAW)

1667

2343

# Verify the self signature in the key

1668

2344

crtverify = ctypes.c_uint()

1669

(gnutls.library.functions

1670

.gnutls_openpgp_crt_verify_self(crt, 0,

1671

ctypes.byref(crtverify)))

2345

gnutls.openpgp_crt_verify_self(crt, 0,

2346

ctypes.byref(crtverify))

1672

2347

if crtverify.value != 0:

1673

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1674

raise (gnutls.errors.CertificateSecurityError

1675

("Verify failed"))

2348

gnutls.openpgp_crt_deinit(crt)

2349

raise gnutls.CertificateSecurityError("Verify failed")

1676

2350

# New buffer for the fingerprint

1677

2351

buf = ctypes.create_string_buffer(20)

1678

2352

buf_len = ctypes.c_size_t()

1679

2353

# Get the fingerprint from the certificate into the buffer

1680

(gnutls.library.functions

1681

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1682

ctypes.byref(buf_len)))

2354

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2355

ctypes.byref(buf_len))

1683

2356

# Deinit the certificate

1684

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2357

gnutls.openpgp_crt_deinit(crt)

1685

2358

# Convert the buffer to a Python bytestring

1686

2359

fpr = ctypes.string_at(buf, buf_len.value)

1687

2360

# Convert the bytestring to hexadecimal notation

1691

2364

1692

2365

class MultiprocessingMixIn(object):

1693

2366

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2367

1694

2368

def sub_process_main(self, request, address):

1695

2369

try:

1696

2370

self.finish_request(request, address)

1701

2375

def process_request(self, request, address):

1702

2376

"""Start a new process to process the request."""

1703

2377

proc = multiprocessing.Process(target = self.sub_process_main,

1704

args = (request,

1705

address))

2378

args = (request, address))

1706

2379

proc.start()

1707

2380

return proc

1708

2381

1709

2382

1710

2383

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1711

2384

""" adds a pipe to the MixIn """

2385

1712

2386

def process_request(self, request, client_address):

1713

2387

"""Overrides and wraps the original process_request().

1714

2388

1723

2397

1724

2398

def add_pipe(self, parent_pipe, proc):

1725

2399

"""Dummy function; override as necessary"""

1726

raise NotImplementedError

2400

raise NotImplementedError()

1727

2401

1728

2402

1729

2403

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1735

2409

interface: None or a network interface name (string)

1736

2410

use_ipv6: Boolean; to use IPv6 or not

1737

2411

"""

2412

1738

2413

def __init__(self, server_address, RequestHandlerClass,

1739

interface=None, use_ipv6=True):

2414

interface=None,

2415

use_ipv6=True,

2416

socketfd=None):

2417

"""If socketfd is set, use that file descriptor instead of

2418

creating a new one with socket.socket().

2419

"""

1740

2420

self.interface = interface

1741

2421

if use_ipv6:

1742

2422

self.address_family = socket.AF_INET6

2423

if socketfd is not None:

2424

# Save the file descriptor

2425

self.socketfd = socketfd

2426

# Save the original socket.socket() function

2427

self.socket_socket = socket.socket

2428

# To implement --socket, we monkey patch socket.socket.

2429

#

2430

# (When socketserver.TCPServer is a new-style class, we

2431

# could make self.socket into a property instead of monkey

2432

# patching socket.socket.)

2433

#

2434

# Create a one-time-only replacement for socket.socket()

2435

@functools.wraps(socket.socket)

2436

def socket_wrapper(*args, **kwargs):

2437

# Restore original function so subsequent calls are

2438

# not affected.

2439

socket.socket = self.socket_socket

2440

del self.socket_socket

2441

# This time only, return a new socket object from the

2442

# saved file descriptor.

2443

return socket.fromfd(self.socketfd, *args, **kwargs)

2444

# Replace socket.socket() function with wrapper

2445

socket.socket = socket_wrapper

2446

# The socketserver.TCPServer.__init__ will call

2447

# socket.socket(), which might be our replacement,

2448

# socket_wrapper(), if socketfd was set.

1743

2449

socketserver.TCPServer.__init__(self, server_address,

1744

2450

RequestHandlerClass)

2451

1745

2452

def server_bind(self):

1746

2453

"""This overrides the normal server_bind() function

1747

2454

to bind to an interface if one was specified, and also NOT to

1748

2455

bind to an address or port if they were not specified."""

2456

global SO_BINDTODEVICE

1749

2457

if self.interface is not None:

1750

2458

if SO_BINDTODEVICE is None:

1751

logger.error("SO_BINDTODEVICE does not exist;"

1752

" cannot bind to interface %s",

1753

self.interface)

1754

else:

1755

try:

1756

self.socket.setsockopt(socket.SOL_SOCKET,

1757

SO_BINDTODEVICE,

1758

str(self.interface

1759

+ '\0'))

1760

except socket.error as error:

1761

if error[0] == errno.EPERM:

1762

logger.error("No permission to"

1763

" bind to interface %s",

1764

self.interface)

1765

elif error[0] == errno.ENOPROTOOPT:

1766

logger.error("SO_BINDTODEVICE not available;"

1767

" cannot bind to interface %s",

1768

self.interface)

1769

else:

1770

raise

2459

# Fall back to a hard-coded value which seems to be

2460

# common enough.

2461

logger.warning("SO_BINDTODEVICE not found, trying 25")

2462

SO_BINDTODEVICE = 25

2463

try:

2464

self.socket.setsockopt(

2465

socket.SOL_SOCKET, SO_BINDTODEVICE,

2466

(self.interface + "\0").encode("utf-8"))

2467

except socket.error as error:

2468

if error.errno == errno.EPERM:

2469

logger.error("No permission to bind to"

2470

" interface %s", self.interface)

2471

elif error.errno == errno.ENOPROTOOPT:

2472

logger.error("SO_BINDTODEVICE not available;"

2473

" cannot bind to interface %s",

2474

self.interface)

2475

elif error.errno == errno.ENODEV:

2476

logger.error("Interface %s does not exist,"

2477

" cannot bind", self.interface)

2478

else:

2479

raise

1771

2480

# Only bind(2) the socket if we really need to.

1772

2481

if self.server_address[0] or self.server_address[1]:

1773

2482

if not self.server_address[0]:

1774

2483

if self.address_family == socket.AF_INET6:

1775

2484

any_address = "::" # in6addr_any

1776

2485

else:

1777

any_address = socket.INADDR_ANY

2486

any_address = "0.0.0.0" # INADDR_ANY

1778

2487

self.server_address = (any_address,

1779

2488

self.server_address[1])

1780

2489

elif not self.server_address[1]:

1781

self.server_address = (self.server_address[0],

1782

0)

2490

self.server_address = (self.server_address[0], 0)

1783

2491

# if self.interface:

1784

2492

# self.server_address = (self.server_address[0],

1785

2493

# 0, # port

1797

2505

gnutls_priority GnuTLS priority string

1798

2506

use_dbus: Boolean; to emit D-Bus signals or not

1799

2507

1800

Assumes a gobject.MainLoop event loop.

2508

Assumes a GLib.MainLoop event loop.

1801

2509

"""

2510

1802

2511

def __init__(self, server_address, RequestHandlerClass,

1803

interface=None, use_ipv6=True, clients=None,

1804

gnutls_priority=None, use_dbus=True):

2512

interface=None,

2513

use_ipv6=True,

2514

clients=None,

2515

gnutls_priority=None,

2516

use_dbus=True,

2517

socketfd=None):

1805

2518

self.enabled = False

1806

2519

self.clients = clients

1807

2520

if self.clients is None:

1811

2524

IPv6_TCPServer.__init__(self, server_address,

1812

2525

RequestHandlerClass,

1813

2526

interface = interface,

1814

use_ipv6 = use_ipv6)

2527

use_ipv6 = use_ipv6,

2528

socketfd = socketfd)

2529

1815

2530

def server_activate(self):

1816

2531

if self.enabled:

1817

2532

return socketserver.TCPServer.server_activate(self)

1821

2536

1822

2537

def add_pipe(self, parent_pipe, proc):

1823

2538

# Call "handle_ipc" for both data and EOF events

1824

gobject.io_add_watch(parent_pipe.fileno(),

1825

gobject.IO_IN | gobject.IO_HUP,

1826

functools.partial(self.handle_ipc,

1827

parent_pipe =

1828

parent_pipe,

1829

proc = proc))

2539

GLib.io_add_watch(

2540

parent_pipe.fileno(),

2541

GLib.IO_IN | GLib.IO_HUP,

2542

functools.partial(self.handle_ipc,

2543

parent_pipe = parent_pipe,

2544

proc = proc))

1830

2545

1831

def handle_ipc(self, source, condition, parent_pipe=None,

1832

proc = None, client_object=None):

1833

condition_names = {

1834

gobject.IO_IN: "IN", # There is data to read.

1835

gobject.IO_OUT: "OUT", # Data can be written (without

1836

# blocking).

1837

gobject.IO_PRI: "PRI", # There is urgent data to read.

1838

gobject.IO_ERR: "ERR", # Error condition.

1839

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1840

# broken, usually for pipes and

1841

# sockets).

1842

}

1843

conditions_string = ' | '.join(name

1844

for cond, name in

1845

condition_names.iteritems()

1846

if cond & condition)

2546

def handle_ipc(self, source, condition,

2547

parent_pipe=None,

2548

proc = None,

2549

client_object=None):

1847

2550

# error, or the other end of multiprocessing.Pipe has closed

1848

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2551

if condition & (GLib.IO_ERR | GLib.IO_HUP):

1849

2552

# Wait for other process to exit

1850

2553

proc.join()

1851

2554

return False

1858

2561

fpr = request[1]

1859

2562

address = request[2]

1860

2563

1861

for c in self.clients.itervalues():

2564

for c in self.clients.values():

1862

2565

if c.fingerprint == fpr:

1863

2566

client = c

1864

2567

break

1872

2575

parent_pipe.send(False)

1873

2576

return False

1874

2577

1875

gobject.io_add_watch(parent_pipe.fileno(),

1876

gobject.IO_IN | gobject.IO_HUP,

1877

functools.partial(self.handle_ipc,

1878

parent_pipe =

1879

parent_pipe,

1880

proc = proc,

1881

client_object =

1882

client))

2578

GLib.io_add_watch(

2579

parent_pipe.fileno(),

2580

GLib.IO_IN | GLib.IO_HUP,

2581

functools.partial(self.handle_ipc,

2582

parent_pipe = parent_pipe,

2583

proc = proc,

2584

client_object = client))

1883

2585

parent_pipe.send(True)

1884

2586

# remove the old hook in favor of the new above hook on

1885

2587

# same fileno

1891

2593

1892

2594

parent_pipe.send(('data', getattr(client_object,

1893

2595

funcname)(*args,

1894

**kwargs)))

2596

**kwargs)))

1895

2597

1896

2598

if command == 'getattr':

1897

2599

attrname = request[1]

1898

if callable(client_object.__getattribute__(attrname)):

1899

parent_pipe.send(('function',))

2600

if isinstance(client_object.__getattribute__(attrname),

2601

collections.Callable):

2602

parent_pipe.send(('function', ))

1900

2603

else:

1901

parent_pipe.send(('data', client_object

1902

.__getattribute__(attrname)))

2604

parent_pipe.send((

2605

'data', client_object.__getattribute__(attrname)))

1903

2606

1904

2607

if command == 'setattr':

1905

2608

attrname = request[1]

1909

2612

return True

1910

2613

1911

2614

2615

def rfc3339_duration_to_delta(duration):

2616

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2617

2618

>>> rfc3339_duration_to_delta("P7D")

2619

datetime.timedelta(7)

2620

>>> rfc3339_duration_to_delta("PT60S")

2621

datetime.timedelta(0, 60)

2622

>>> rfc3339_duration_to_delta("PT60M")

2623

datetime.timedelta(0, 3600)

2624

>>> rfc3339_duration_to_delta("PT24H")

2625

datetime.timedelta(1)

2626

>>> rfc3339_duration_to_delta("P1W")

2627

datetime.timedelta(7)

2628

>>> rfc3339_duration_to_delta("PT5M30S")

2629

datetime.timedelta(0, 330)

2630

>>> rfc3339_duration_to_delta("P1DT3M20S")

2631

datetime.timedelta(1, 200)

2632

"""

2633

2634

# Parsing an RFC 3339 duration with regular expressions is not

2635

# possible - there would have to be multiple places for the same

2636

# values, like seconds. The current code, while more esoteric, is

2637

# cleaner without depending on a parsing library. If Python had a

2638

# built-in library for parsing we would use it, but we'd like to

2639

# avoid excessive use of external libraries.

2640

2641

# New type for defining tokens, syntax, and semantics all-in-one

2642

Token = collections.namedtuple("Token", (

2643

"regexp", # To match token; if "value" is not None, must have

2644

# a "group" containing digits

2645

"value", # datetime.timedelta or None

2646

"followers")) # Tokens valid after this token

2647

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2648

# the "duration" ABNF definition in RFC 3339, Appendix A.

2649

token_end = Token(re.compile(r"$"), None, frozenset())

2650

token_second = Token(re.compile(r"(\d+)S"),

2651

datetime.timedelta(seconds=1),

2652

frozenset((token_end, )))

2653

token_minute = Token(re.compile(r"(\d+)M"),

2654

datetime.timedelta(minutes=1),

2655

frozenset((token_second, token_end)))

2656

token_hour = Token(re.compile(r"(\d+)H"),

2657

datetime.timedelta(hours=1),

2658

frozenset((token_minute, token_end)))

2659

token_time = Token(re.compile(r"T"),

2660

None,

2661

frozenset((token_hour, token_minute,

2662

token_second)))

2663

token_day = Token(re.compile(r"(\d+)D"),

2664

datetime.timedelta(days=1),

2665

frozenset((token_time, token_end)))

2666

token_month = Token(re.compile(r"(\d+)M"),

2667

datetime.timedelta(weeks=4),

2668

frozenset((token_day, token_end)))

2669

token_year = Token(re.compile(r"(\d+)Y"),

2670

datetime.timedelta(weeks=52),

2671

frozenset((token_month, token_end)))

2672

token_week = Token(re.compile(r"(\d+)W"),

2673

datetime.timedelta(weeks=1),

2674

frozenset((token_end, )))

2675

token_duration = Token(re.compile(r"P"), None,

2676

frozenset((token_year, token_month,

2677

token_day, token_time,

2678

token_week)))

2679

# Define starting values

2680

value = datetime.timedelta() # Value so far

2681

found_token = None

2682

followers = frozenset((token_duration, )) # Following valid tokens

2683

s = duration # String left to parse

2684

# Loop until end token is found

2685

while found_token is not token_end:

2686

# Search for any currently valid tokens

2687

for token in followers:

2688

match = token.regexp.match(s)

2689

if match is not None:

2690

# Token found

2691

if token.value is not None:

2692

# Value found, parse digits

2693

factor = int(match.group(1), 10)

2694

# Add to value so far

2695

value += factor * token.value

2696

# Strip token from string

2697

s = token.regexp.sub("", s, 1)

2698

# Go to found token

2699

found_token = token

2700

# Set valid next tokens

2701

followers = found_token.followers

2702

break

2703

else:

2704

# No currently valid tokens were found

2705

raise ValueError("Invalid RFC 3339 duration: {!r}"

2706

.format(duration))

2707

# End token found

2708

return value

2709

2710

1912

2711

def string_to_delta(interval):

1913

2712

"""Parse a string and return a datetime.timedelta

1914

2713

1925

2724

>>> string_to_delta('5m 30s')

1926

2725

datetime.timedelta(0, 330)

1927

2726

"""

2727

2728

try:

2729

return rfc3339_duration_to_delta(interval)

2730

except ValueError:

2731

pass

2732

1928

2733

timevalue = datetime.timedelta(0)

1929

2734

for s in interval.split():

1930

2735

try:

1931

suffix = unicode(s[-1])

2736

suffix = s[-1]

1932

2737

value = int(s[:-1])

1933

2738

if suffix == "d":

1934

2739

delta = datetime.timedelta(value)

1941

2746

elif suffix == "w":

1942

2747

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1943

2748

else:

1944

raise ValueError("Unknown suffix %r" % suffix)

1945

except (ValueError, IndexError) as e:

2749

raise ValueError("Unknown suffix {!r}".format(suffix))

2750

except IndexError as e:

1946

2751

raise ValueError(*(e.args))

1947

2752

timevalue += delta

1948

2753

return timevalue

1961

2766

sys.exit()

1962

2767

if not noclose:

1963

2768

# Close all standard open file descriptors

1964

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2769

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1965

2770

if not stat.S_ISCHR(os.fstat(null).st_mode):

1966

2771

raise OSError(errno.ENODEV,

1967

"%s not a character device"

1968

% os.path.devnull)

2772

"{} not a character device"

2773

.format(os.devnull))

1969

2774

os.dup2(null, sys.stdin.fileno())

1970

2775

os.dup2(null, sys.stdout.fileno())

1971

2776

os.dup2(null, sys.stderr.fileno())

1980

2785

1981

2786

parser = argparse.ArgumentParser()

1982

2787

parser.add_argument("-v", "--version", action="version",

1983

version = "%%(prog)s %s" % version,

2788

version = "%(prog)s {}".format(version),

1984

2789

help="show version number and exit")

1985

2790

parser.add_argument("-i", "--interface", metavar="IF",

1986

2791

help="Bind to interface IF")

1992

2797

help="Run self-test")

1993

2798

parser.add_argument("--debug", action="store_true",

1994

2799

help="Debug mode; run in foreground and log"

1995

" to terminal")

2800

" to terminal", default=None)

1996

2801

parser.add_argument("--debuglevel", metavar="LEVEL",

1997

2802

help="Debug level for stdout output")

1998

2803

parser.add_argument("--priority", help="GnuTLS"

2005

2810

" files")

2006

2811

parser.add_argument("--no-dbus", action="store_false",

2007

2812

dest="use_dbus", help="Do not provide D-Bus"

2008

" system bus interface")

2813

" system bus interface", default=None)

2009

2814

parser.add_argument("--no-ipv6", action="store_false",

2010

dest="use_ipv6", help="Do not use IPv6")

2815

dest="use_ipv6", help="Do not use IPv6",

2816

default=None)

2011

2817

parser.add_argument("--no-restore", action="store_false",

2012

2818

dest="restore", help="Do not restore stored"

2013

" state")

2819

" state", default=None)

2820

parser.add_argument("--socket", type=int,

2821

help="Specify a file descriptor to a network"

2822

" socket to use instead of creating one")

2014

2823

parser.add_argument("--statedir", metavar="DIR",

2015

2824

help="Directory to save/restore state in")

2825

parser.add_argument("--foreground", action="store_true",

2826

help="Run in foreground", default=None)

2827

parser.add_argument("--no-zeroconf", action="store_false",

2828

dest="zeroconf", help="Do not use Zeroconf",

2829

default=None)

2016

2830

2017

2831

options = parser.parse_args()

2018

2832

2019

2833

if options.check:

2020

2834

import doctest

2021

doctest.testmod()

2022

sys.exit()

2835

fail_count, test_count = doctest.testmod()

2836

sys.exit(os.EX_OK if fail_count == 0 else 1)

2023

2837

2024

2838

# Default values for config file for server-global settings

2025

2839

server_defaults = { "interface": "",

2027

2841

"port": "",

2028

2842

"debug": "False",

2029

2843

"priority":

2030

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2844

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2845

":+SIGN-DSA-SHA256",

2031

2846

"servicename": "Mandos",

2032

2847

"use_dbus": "True",

2033

2848

"use_ipv6": "True",

2034

2849

"debuglevel": "",

2035

2850

"restore": "True",

2036

"statedir": "/var/lib/mandos"

2037

}

2851

"socket": "",

2852

"statedir": "/var/lib/mandos",

2853

"foreground": "False",

2854

"zeroconf": "True",

2855

}

2038

2856

2039

2857

# Parse config file for server-global settings

2040

2858

server_config = configparser.SafeConfigParser(server_defaults)

2041

2859

del server_defaults

2042

server_config.read(os.path.join(options.configdir,

2043

"mandos.conf"))

2860

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2044

2861

# Convert the SafeConfigParser object to a dict

2045

2862

server_settings = server_config.defaults()

2046

2863

# Use the appropriate methods on the non-string config options

2047

for option in ("debug", "use_dbus", "use_ipv6"):

2864

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

2048

2865

server_settings[option] = server_config.getboolean("DEFAULT",

2049

2866

option)

2050

2867

if server_settings["port"]:

2051

2868

server_settings["port"] = server_config.getint("DEFAULT",

2052

2869

"port")

2870

if server_settings["socket"]:

2871

server_settings["socket"] = server_config.getint("DEFAULT",

2872

"socket")

2873

# Later, stdin will, and stdout and stderr might, be dup'ed

2874

# over with an opened os.devnull. But we don't want this to

2875

# happen with a supplied network socket.

2876

if 0 <= server_settings["socket"] <= 2:

2877

server_settings["socket"] = os.dup(server_settings

2878

["socket"])

2053

2879

del server_config

2054

2880

2055

2881

# Override the settings from the config file with command line

2056

2882

# options, if set.

2057

2883

for option in ("interface", "address", "port", "debug",

2058

"priority", "servicename", "configdir",

2059

"use_dbus", "use_ipv6", "debuglevel", "restore",

2060

"statedir"):

2884

"priority", "servicename", "configdir", "use_dbus",

2885

"use_ipv6", "debuglevel", "restore", "statedir",

2886

"socket", "foreground", "zeroconf"):

2061

2887

value = getattr(options, option)

2062

2888

if value is not None:

2063

2889

server_settings[option] = value

2064

2890

del options

2065

2891

# Force all strings to be unicode

2066

2892

for option in server_settings.keys():

2067

if type(server_settings[option]) is str:

2068

server_settings[option] = unicode(server_settings[option])

2893

if isinstance(server_settings[option], bytes):

2894

server_settings[option] = (server_settings[option]

2895

.decode("utf-8"))

2896

# Force all boolean options to be boolean

2897

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2898

"foreground", "zeroconf"):

2899

server_settings[option] = bool(server_settings[option])

2900

# Debug implies foreground

2901

if server_settings["debug"]:

2902

server_settings["foreground"] = True

2069

2903

# Now we have our good server settings in "server_settings"

2070

2904

2071

2905

##################################################################

2072

2906

2907

if (not server_settings["zeroconf"]

2908

and not (server_settings["port"]

2909

or server_settings["socket"] != "")):

2910

parser.error("Needs port or socket to work without Zeroconf")

2911

2073

2912

# For convenience

2074

2913

debug = server_settings["debug"]

2075

2914

debuglevel = server_settings["debuglevel"]

2077

2916

use_ipv6 = server_settings["use_ipv6"]

2078

2917

stored_state_path = os.path.join(server_settings["statedir"],

2079

2918

stored_state_file)

2919

foreground = server_settings["foreground"]

2920

zeroconf = server_settings["zeroconf"]

2080

2921

2081

2922

if debug:

2082

2923

initlogger(debug, logging.DEBUG)

2088

2929

initlogger(debug, level)

2089

2930

2090

2931

if server_settings["servicename"] != "Mandos":

2091

syslogger.setFormatter(logging.Formatter

2092

('Mandos (%s) [%%(process)d]:'

2093

' %%(levelname)s: %%(message)s'

2094

% server_settings["servicename"]))

2932

syslogger.setFormatter(

2933

logging.Formatter('Mandos ({}) [%(process)d]:'

2934

' %(levelname)s: %(message)s'.format(

2935

server_settings["servicename"])))

2095

2936

2096

2937

# Parse config file with clients

2097

client_config = configparser.SafeConfigParser(Client.client_defaults)

2938

client_config = configparser.SafeConfigParser(Client

2939

.client_defaults)

2098

2940

client_config.read(os.path.join(server_settings["configdir"],

2099

2941

"clients.conf"))

2100

2942

2101

2943

global mandos_dbus_service

2102

2944

mandos_dbus_service = None

2103

2945

2104

tcp_server = MandosServer((server_settings["address"],

2105

server_settings["port"]),

2106

ClientHandler,

2107

interface=(server_settings["interface"]

2108

or None),

2109

use_ipv6=use_ipv6,

2110

gnutls_priority=

2111

server_settings["priority"],

2112

use_dbus=use_dbus)

2113

if not debug:

2114

pidfilename = "/var/run/mandos.pid"

2946

socketfd = None

2947

if server_settings["socket"] != "":

2948

socketfd = server_settings["socket"]

2949

tcp_server = MandosServer(

2950

(server_settings["address"], server_settings["port"]),

2951

ClientHandler,

2952

interface=(server_settings["interface"] or None),

2953

use_ipv6=use_ipv6,

2954

gnutls_priority=server_settings["priority"],

2955

use_dbus=use_dbus,

2956

socketfd=socketfd)

2957

if not foreground:

2958

pidfilename = "/run/mandos.pid"

2959

if not os.path.isdir("/run/."):

2960

pidfilename = "/var/run/mandos.pid"

2961

pidfile = None

2115

2962

try:

2116

pidfile = open(pidfilename, "w")

2117

except IOError:

2118

logger.error("Could not open file %r", pidfilename)

2963

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2964

except IOError as e:

2965

logger.error("Could not open file %r", pidfilename,

2966

exc_info=e)

2119

2967

2120

try:

2121

uid = pwd.getpwnam("_mandos").pw_uid

2122

gid = pwd.getpwnam("_mandos").pw_gid

2123

except KeyError:

2968

for name, group in (("_mandos", "_mandos"),

2969

("mandos", "mandos"),

2970

("nobody", "nogroup")):

2124

2971

try:

2125

uid = pwd.getpwnam("mandos").pw_uid

2126

gid = pwd.getpwnam("mandos").pw_gid

2972

uid = pwd.getpwnam(name).pw_uid

2973

gid = pwd.getpwnam(group).pw_gid

2974

break

2127

2975

except KeyError:

2128

try:

2129

uid = pwd.getpwnam("nobody").pw_uid

2130

gid = pwd.getpwnam("nobody").pw_gid

2131

except KeyError:

2132

uid = 65534

2133

gid = 65534

2976

continue

2977

else:

2978

uid = 65534

2979

gid = 65534

2134

2980

try:

2135

2981

os.setgid(gid)

2136

2982

os.setuid(uid)

2983

if debug:

2984

logger.debug("Did setuid/setgid to {}:{}".format(uid,

2985

gid))

2137

2986

except OSError as error:

2138

if error[0] != errno.EPERM:

2139

raise error

2987

logger.warning("Failed to setuid/setgid to {}:{}: {}"

2988

.format(uid, gid, os.strerror(error.errno)))

2989

if error.errno != errno.EPERM:

2990

raise

2140

2991

2141

2992

if debug:

2142

2993

# Enable all possible GnuTLS debugging

2143

2994

2144

2995

# "Use a log level over 10 to enable all debugging options."

2145

2996

# - GnuTLS manual

2146

gnutls.library.functions.gnutls_global_set_log_level(11)

2997

gnutls.global_set_log_level(11)

2147

2998

2148

@gnutls.library.types.gnutls_log_func

2999

@gnutls.log_func

2149

3000

def debug_gnutls(level, string):

2150

3001

logger.debug("GnuTLS: %s", string[:-1])

2151

3002

2152

(gnutls.library.functions

2153

.gnutls_global_set_log_function(debug_gnutls))

3003

gnutls.global_set_log_function(debug_gnutls)

2154

3004

2155

3005

# Redirect stdin so all checkers get /dev/null

2156

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

3006

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2157

3007

os.dup2(null, sys.stdin.fileno())

2158

3008

if null > 2:

2159

3009

os.close(null)

2160

3010

2161

3011

# Need to fork before connecting to D-Bus

2162

if not debug:

3012

if not foreground:

2163

3013

# Close all input and output, do double fork, etc.

2164

3014

daemon()

2165

3015

2166

gobject.threads_init()

3016

# multiprocessing will use threads, so before we use GLib we need

3017

# to inform GLib that threads will be used.

3018

GLib.threads_init()

2167

3019

2168

3020

global main_loop

2169

3021

# From the Avahi example code

2170

DBusGMainLoop(set_as_default=True )

2171

main_loop = gobject.MainLoop()

3022

DBusGMainLoop(set_as_default=True)

3023

main_loop = GLib.MainLoop()

2172

3024

bus = dbus.SystemBus()

2173

3025

# End of Avahi example code

2174

3026

if use_dbus:

2175

3027

try:

2176

3028

bus_name = dbus.service.BusName("se.recompile.Mandos",

2177

bus, do_not_queue=True)

2178

old_bus_name = (dbus.service.BusName

2179

("se.bsnet.fukt.Mandos", bus,

2180

do_not_queue=True))

2181

except dbus.exceptions.NameExistsException as e:

2182

logger.error(unicode(e) + ", disabling D-Bus")

3029

bus,

3030

do_not_queue=True)

3031

old_bus_name = dbus.service.BusName(

3032

"se.bsnet.fukt.Mandos", bus,

3033

do_not_queue=True)

3034

except dbus.exceptions.DBusException as e:

3035

logger.error("Disabling D-Bus:", exc_info=e)

2183

3036

use_dbus = False

2184

3037

server_settings["use_dbus"] = False

2185

3038

tcp_server.use_dbus = False

2186

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2187

service = AvahiServiceToSyslog(name =

2188

server_settings["servicename"],

2189

servicetype = "_mandos._tcp",

2190

protocol = protocol, bus = bus)

2191

if server_settings["interface"]:

2192

service.interface = (if_nametoindex

2193

(str(server_settings["interface"])))

3039

if zeroconf:

3040

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3041

service = AvahiServiceToSyslog(

3042

name = server_settings["servicename"],

3043

servicetype = "_mandos._tcp",

3044

protocol = protocol,

3045

bus = bus)

3046

if server_settings["interface"]:

3047

service.interface = if_nametoindex(

3048

server_settings["interface"].encode("utf-8"))

2194

3049

2195

3050

global multiprocessing_manager

2196

3051

multiprocessing_manager = multiprocessing.Manager()

2197

3052

2198

3053

client_class = Client

2199

3054

if use_dbus:

2200

client_class = functools.partial(ClientDBusTransitional,

2201

bus = bus)

3055

client_class = functools.partial(ClientDBus, bus = bus)

2202

3056

2203

3057

client_settings = Client.config_parser(client_config)

2204

3058

old_client_settings = {}

2205

3059

clients_data = {}

2206

3060

3061

# This is used to redirect stdout and stderr for checker processes

3062

global wnull

3063

wnull = open(os.devnull, "w") # A writable /dev/null

3064

# Only used if server is running in foreground but not in debug

3065

# mode

3066

if debug or not foreground:

3067

wnull.close()

3068

2207

3069

# Get client data and settings from last running state.

2208

3070

if server_settings["restore"]:

2209

3071

try:

2210

3072

with open(stored_state_path, "rb") as stored_state:

2211

clients_data, old_client_settings = (pickle.load

2212

(stored_state))

3073

if sys.version_info.major == 2:

3074

clients_data, old_client_settings = pickle.load(

3075

stored_state)

3076

else:

3077

bytes_clients_data, bytes_old_client_settings = (

3078

pickle.load(stored_state, encoding = "bytes"))

3079

### Fix bytes to strings

3080

## clients_data

3081

# .keys()

3082

clients_data = { (key.decode("utf-8")

3083

if isinstance(key, bytes)

3084

else key): value

3085

for key, value in

3086

bytes_clients_data.items() }

3087

del bytes_clients_data

3088

for key in clients_data:

3089

value = { (k.decode("utf-8")

3090

if isinstance(k, bytes) else k): v

3091

for k, v in

3092

clients_data[key].items() }

3093

clients_data[key] = value

3094

# .client_structure

3095

value["client_structure"] = [

3096

(s.decode("utf-8")

3097

if isinstance(s, bytes)

3098

else s) for s in

3099

value["client_structure"] ]

3100

# .name & .host

3101

for k in ("name", "host"):

3102

if isinstance(value[k], bytes):

3103

value[k] = value[k].decode("utf-8")

3104

## old_client_settings

3105

# .keys()

3106

old_client_settings = {

3107

(key.decode("utf-8")

3108

if isinstance(key, bytes)

3109

else key): value

3110

for key, value in

3111

bytes_old_client_settings.items() }

3112

del bytes_old_client_settings

3113

# .host

3114

for value in old_client_settings.values():

3115

if isinstance(value["host"], bytes):

3116

value["host"] = (value["host"]

3117

.decode("utf-8"))

2213

3118

os.remove(stored_state_path)

2214

3119

except IOError as e:

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

3120

if e.errno == errno.ENOENT:

3121

logger.warning("Could not load persistent state:"

3122

" {}".format(os.strerror(e.errno)))

3123

else:

3124

logger.critical("Could not load persistent state:",

3125

exc_info=e)

2218

3126

raise

2219

3127

except EOFError as e:

2220

3128

logger.warning("Could not load persistent state: "

2221

"EOFError: {0}".format(e))

3129

"EOFError:",

3130

exc_info=e)

2222

3131

2223

3132

with PGPEngine() as pgp:

2224

for client_name, client in clients_data.iteritems():

3133

for client_name, client in clients_data.items():

3134

# Skip removed clients

3135

if client_name not in client_settings:

3136

continue

3137

2225

3138

# Decide which value to use after restoring saved state.

2226

3139

# We have three different values: Old config file,

2227

3140

# new config file, and saved state.

2232

3145

# For each value in new config, check if it

2233

3146

# differs from the old config value (Except for

2234

3147

# the "secret" attribute)

2235

if (name != "secret" and

2236

value != old_client_settings[client_name]

2237

[name]):

3148

if (name != "secret"

3149

and (value !=

3150

old_client_settings[client_name][name])):

2238

3151

client[name] = value

2239

3152

except KeyError:

2240

3153

pass

2241

3154

2242

3155

# Clients who has passed its expire date can still be

2243

# enabled if its last checker was successful. Clients

2244

# whose checker failed before we stored its state is

2245

# assumed to have failed all checkers during downtime.

3156

# enabled if its last checker was successful. A Client

3157

# whose checker succeeded before we stored its state is

3158

# assumed to have successfully run all checkers during

3159

# downtime.

2246

3160

if client["enabled"]:

2247

3161

if datetime.datetime.utcnow() >= client["expires"]:

2248

3162

if not client["last_checked_ok"]:

2249

3163

logger.warning(

2250

"disabling client {0} - Client never "

2251

"performed a successfull checker"

2252

.format(client["name"]))

3164

"disabling client {} - Client never "

3165

"performed a successful checker".format(

3166

client_name))

2253

3167

client["enabled"] = False

2254

3168

elif client["last_checker_status"] != 0:

2255

3169

logger.warning(

2256

"disabling client {0} - Client "

2257

"last checker failed with error code {1}"

2258

.format(client["name"],

2259

client["last_checker_status"]))

3170

"disabling client {} - Client last"

3171

" checker failed with error code"

3172

" {}".format(

3173

client_name,

3174

client["last_checker_status"]))

2260

3175

client["enabled"] = False

2261

3176

else:

2262

client["expires"] = (datetime.datetime

2263

.utcnow()

2264

+ client["timeout"])

2265

3177

client["expires"] = (

3178

datetime.datetime.utcnow()

3179

+ client["timeout"])

3180

logger.debug("Last checker succeeded,"

3181

" keeping {} enabled".format(

3182

client_name))

2266

3183

try:

2267

client["secret"] = (

2268

pgp.decrypt(client["encrypted_secret"],

2269

client_settings[client_name]

2270

["secret"]))

3184

client["secret"] = pgp.decrypt(

3185

client["encrypted_secret"],

3186

client_settings[client_name]["secret"])

2271

3187

except PGPError:

2272

3188

# If decryption fails, we use secret from new settings

2273

logger.debug("Failed to decrypt {0} old secret"

2274

.format(client_name))

2275

client["secret"] = (

2276

client_settings[client_name]["secret"])

2277

3189

logger.debug("Failed to decrypt {} old secret".format(

3190

client_name))

3191

client["secret"] = (client_settings[client_name]

3192

["secret"])

2278

3193

2279

3194

# Add/remove clients based on new changes made to config

2280

for client_name in set(old_client_settings) - set(client_settings):

3195

for client_name in (set(old_client_settings)

3196

- set(client_settings)):

2281

3197

del clients_data[client_name]

2282

for client_name in set(client_settings) - set(old_client_settings):

3198

for client_name in (set(client_settings)

3199

- set(old_client_settings)):

2283

3200

clients_data[client_name] = client_settings[client_name]

2284

2285

# Create clients all clients

2286

for client_name, client in clients_data.iteritems():

3201

3202

# Create all client objects

3203

for client_name, client in clients_data.items():

2287

3204

tcp_server.clients[client_name] = client_class(

2288

name = client_name, settings = client)

3205

name = client_name,

3206

settings = client,

3207

server_settings = server_settings)

2289

3208

2290

3209

if not tcp_server.clients:

2291

3210

logger.warning("No clients defined")

2292

2293

if not debug:

2294

try:

2295

with pidfile:

2296

pid = os.getpid()

2297

pidfile.write(str(pid) + "\n".encode("utf-8"))

2298

del pidfile

2299

except IOError:

2300

logger.error("Could not write to file %r with PID %d",

2301

pidfilename, pid)

2302

except NameError:

2303

# "pidfile" was never created

2304

pass

3211

3212

if not foreground:

3213

if pidfile is not None:

3214

pid = os.getpid()

3215

try:

3216

with pidfile:

3217

print(pid, file=pidfile)

3218

except IOError:

3219

logger.error("Could not write to file %r with PID %d",

3220

pidfilename, pid)

3221

del pidfile

2305

3222

del pidfilename

2306

signal.signal(signal.SIGINT, signal.SIG_IGN)

2307

3223

2308

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2309

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3224

for termsig in (signal.SIGHUP, signal.SIGTERM):

3225

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3226

lambda: main_loop.quit() and False)

2310

3227

2311

3228

if use_dbus:

2312

class MandosDBusService(dbus.service.Object):

3229

3230

@alternate_dbus_interfaces(

3231

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3232

class MandosDBusService(DBusObjectWithObjectManager):

2313

3233

"""A D-Bus proxy object"""

3234

2314

3235

def __init__(self):

2315

3236

dbus.service.Object.__init__(self, bus, "/")

3237

2316

3238

_interface = "se.recompile.Mandos"

2317

3239

2318

3240

@dbus.service.signal(_interface, signature="o")

2325

3247

"D-Bus signal"

2326

3248

pass

2327

3249

3250

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3251

"true"})

2328

3252

@dbus.service.signal(_interface, signature="os")

2329

3253

def ClientRemoved(self, objpath, name):

2330

3254

"D-Bus signal"

2331

3255

pass

2332

3256

3257

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3258

"true"})

2333

3259

@dbus.service.method(_interface, out_signature="ao")

2334

3260

def GetAllClients(self):

2335

3261

"D-Bus method"

2336

return dbus.Array(c.dbus_object_path

2337

for c in

2338

tcp_server.clients.itervalues())

3262

return dbus.Array(c.dbus_object_path for c in

3263

tcp_server.clients.values())

2339

3264

3265

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3266

"true"})

2340

3267

@dbus.service.method(_interface,

2341

3268

out_signature="a{oa{sv}}")

2342

3269

def GetAllClientsWithProperties(self):

2343

3270

"D-Bus method"

2344

3271

return dbus.Dictionary(

2345

((c.dbus_object_path, c.GetAll(""))

2346

for c in tcp_server.clients.itervalues()),

3272

{ c.dbus_object_path: c.GetAll(

3273

"se.recompile.Mandos.Client")

3274

for c in tcp_server.clients.values() },

2347

3275

signature="oa{sv}")

2348

3276

2349

3277

@dbus.service.method(_interface, in_signature="o")

2350

3278

def RemoveClient(self, object_path):

2351

3279

"D-Bus method"

2352

for c in tcp_server.clients.itervalues():

3280

for c in tcp_server.clients.values():

2353

3281

if c.dbus_object_path == object_path:

2354

3282

del tcp_server.clients[c.name]

2355

3283

c.remove_from_connection()

2356

# Don't signal anything except ClientRemoved

3284

# Don't signal the disabling

2357

3285

c.disable(quiet=True)

2358

# Emit D-Bus signal

2359

self.ClientRemoved(object_path, c.name)

3286

# Emit D-Bus signal for removal

3287

self.client_removed_signal(c)

2360

3288

return

2361

3289

raise KeyError(object_path)

2362

3290

2363

3291

del _interface

3292

3293

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3294

out_signature = "a{oa{sa{sv}}}")

3295

def GetManagedObjects(self):

3296

"""D-Bus method"""

3297

return dbus.Dictionary(

3298

{ client.dbus_object_path:

3299

dbus.Dictionary(

3300

{ interface: client.GetAll(interface)

3301

for interface in

3302

client._get_all_interface_names()})

3303

for client in tcp_server.clients.values()})

3304

3305

def client_added_signal(self, client):

3306

"""Send the new standard signal and the old signal"""

3307

if use_dbus:

3308

# New standard signal

3309

self.InterfacesAdded(

3310

client.dbus_object_path,

3311

dbus.Dictionary(

3312

{ interface: client.GetAll(interface)

3313

for interface in

3314

client._get_all_interface_names()}))

3315

# Old signal

3316

self.ClientAdded(client.dbus_object_path)

3317

3318

def client_removed_signal(self, client):

3319

"""Send the new standard signal and the old signal"""

3320

if use_dbus:

3321

# New standard signal

3322

self.InterfacesRemoved(

3323

client.dbus_object_path,

3324

client._get_all_interface_names())

3325

# Old signal

3326

self.ClientRemoved(client.dbus_object_path,

3327

client.name)

2364

3328

2365

class MandosDBusServiceTransitional(MandosDBusService):

2366

__metaclass__ = AlternateDBusNamesMetaclass

2367

mandos_dbus_service = MandosDBusServiceTransitional()

3329

mandos_dbus_service = MandosDBusService()

2368

3330

3331

# Save modules to variables to exempt the modules from being

3332

# unloaded before the function registered with atexit() is run.

3333

mp = multiprocessing

3334

wn = wnull

2369

3335

def cleanup():

2370

3336

"Cleanup function; run on exit"

2371

service.cleanup()

3337

if zeroconf:

3338

service.cleanup()

2372

3339

2373

multiprocessing.active_children()

3340

mp.active_children()

3341

wn.close()

2374

3342

if not (tcp_server.clients or client_settings):

2375

3343

return

2376

3344

2379

3347

# removed/edited, old secret will thus be unrecovable.

2380

3348

clients = {}

2381

3349

with PGPEngine() as pgp:

2382

for client in tcp_server.clients.itervalues():

3350

for client in tcp_server.clients.values():

2383

3351

key = client_settings[client.name]["secret"]

2384

3352

client.encrypted_secret = pgp.encrypt(client.secret,

2385

3353

key)

2387

3355

2388

3356

# A list of attributes that can not be pickled

2389

3357

# + secret.

2390

exclude = set(("bus", "changedstate", "secret",

2391

"checker"))

2392

for name, typ in (inspect.getmembers

2393

(dbus.service.Object)):

3358

exclude = { "bus", "changedstate", "secret",

3359

"checker", "server_settings" }

3360

for name, typ in inspect.getmembers(dbus.service

3361

.Object):

2394

3362

exclude.add(name)

2395

3363

2396

3364

client_dict["encrypted_secret"] = (client

2403

3371

del client_settings[client.name]["secret"]

2404

3372

2405

3373

try:

2406

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2407

prefix="clients-",

2408

dir=os.path.dirname

2409

(stored_state_path))

2410

with os.fdopen(tempfd, "wb") as stored_state:

2411

pickle.dump((clients, client_settings), stored_state)

3374

with tempfile.NamedTemporaryFile(

3375

mode='wb',

3376

suffix=".pickle",

3377

prefix='clients-',

3378

dir=os.path.dirname(stored_state_path),

3379

delete=False) as stored_state:

3380

pickle.dump((clients, client_settings), stored_state,

3381

protocol = 2)

3382

tempname = stored_state.name

2412

3383

os.rename(tempname, stored_state_path)

2413

3384

except (IOError, OSError) as e:

2414

logger.warning("Could not save persistent state: {0}"

2415

.format(e))

2416

3385

if not debug:

2417

3386

try:

2418

3387

os.remove(tempname)

2419

3388

except NameError:

2420

3389

pass

2421

if e.errno not in set((errno.ENOENT, errno.EACCES,

2422

errno.EEXIST)):

2423

raise e

3390

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3391

logger.warning("Could not save persistent state: {}"

3392

.format(os.strerror(e.errno)))

3393

else:

3394

logger.warning("Could not save persistent state:",

3395

exc_info=e)

3396

raise

2424

3397

2425

3398

# Delete all clients, and settings from config

2426

3399

while tcp_server.clients:

2427

3400

name, client = tcp_server.clients.popitem()

2428

3401

if use_dbus:

2429

3402

client.remove_from_connection()

2430

# Don't signal anything except ClientRemoved

3403

# Don't signal the disabling

2431

3404

client.disable(quiet=True)

3405

# Emit D-Bus signal for removal

2432

3406

if use_dbus:

2433

# Emit D-Bus signal

2434

mandos_dbus_service.ClientRemoved(client

2435

.dbus_object_path,

2436

client.name)

3407

mandos_dbus_service.client_removed_signal(client)

2437

3408

client_settings.clear()

2438

3409

2439

3410

atexit.register(cleanup)

2440

3411

2441

for client in tcp_server.clients.itervalues():

3412

for client in tcp_server.clients.values():

2442

3413

if use_dbus:

2443

# Emit D-Bus signal

2444

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3414

# Emit D-Bus signal for adding

3415

mandos_dbus_service.client_added_signal(client)

2445

3416

# Need to initiate checking of clients

2446

3417

if client.enabled:

2447

3418

client.init_checker()

2450

3421

tcp_server.server_activate()

2451

3422

2452

3423

# Find out what port we got

2453

service.port = tcp_server.socket.getsockname()[1]

3424

if zeroconf:

3425

service.port = tcp_server.socket.getsockname()[1]

2454

3426

if use_ipv6:

2455

3427

logger.info("Now listening on address %r, port %d,"

2456

" flowinfo %d, scope_id %d"

2457

% tcp_server.socket.getsockname())

3428

" flowinfo %d, scope_id %d",

3429

*tcp_server.socket.getsockname())

2458

3430

else: # IPv4

2459

logger.info("Now listening on address %r, port %d"

2460

% tcp_server.socket.getsockname())

3431

logger.info("Now listening on address %r, port %d",

3432

*tcp_server.socket.getsockname())

2461

3433

2462

3434

#service.interface = tcp_server.socket.getsockname()[3]

2463

3435

2464

3436

try:

2465

# From the Avahi example code

2466

try:

2467

service.activate()

2468

except dbus.exceptions.DBusException as error:

2469

logger.critical("DBusException: %s", error)

2470

cleanup()

2471

sys.exit(1)

2472

# End of Avahi example code

3437

if zeroconf:

3438

# From the Avahi example code

3439

try:

3440

service.activate()

3441

except dbus.exceptions.DBusException as error:

3442

logger.critical("D-Bus Exception", exc_info=error)

3443

cleanup()

3444

sys.exit(1)

3445

# End of Avahi example code

2473

3446

2474

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2475

lambda *args, **kwargs:

2476

(tcp_server.handle_request

2477

(*args[2:], **kwargs) or True))

3447

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3448

lambda *args, **kwargs:

3449

(tcp_server.handle_request

3450

(*args[2:], **kwargs) or True))

2478

3451

2479

3452

logger.debug("Starting main loop")

2480

3453

main_loop.run()

2481

3454

except AvahiError as error:

2482

logger.critical("AvahiError: %s", error)

3455

logger.critical("Avahi Error", exc_info=error)

2483

3456

cleanup()

2484

3457

sys.exit(1)

2485

3458

except KeyboardInterrupt:

2490

3463

# Must run before the D-Bus bus name gets deregistered

2491

3464

cleanup()

2492

3465

3466

2493

3467

if __name__ == '__main__':

2494

3468

main()