62
import cPickle as pickle
69
import cPickle as pickle
63
72
import multiprocessing
66
81
import dbus.service
82
from gi.repository import GLib
69
83
from dbus.mainloop.glib import DBusGMainLoop
72
86
import xml.dom.minidom
89
# Try to find the value of SO_BINDTODEVICE:
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
92
# newer, and it is also the most natural place for it:
76
93
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
77
94
except AttributeError:
96
# This is where SO_BINDTODEVICE was up to and including Python
79
98
from IN import SO_BINDTODEVICE
80
99
except ImportError:
81
SO_BINDTODEVICE = None
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
88
syslogger = (logging.handlers.SysLogHandler
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
90
address = "/dev/log"))
91
syslogger.setFormatter(logging.Formatter
92
(u'Mandos [%(process)d]: %(levelname)s:'
94
logger.addHandler(syslogger)
96
console = logging.StreamHandler()
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
100
logger.addHandler(console)
100
# In Python 2.7 it seems to have been removed entirely.
101
# Try running the C preprocessor:
103
cc = subprocess.Popen(["cc", "--language=c", "-E",
105
stdin=subprocess.PIPE,
106
stdout=subprocess.PIPE)
107
stdout = cc.communicate(
108
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
109
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
110
except (OSError, ValueError, IndexError):
112
SO_BINDTODEVICE = None
114
if sys.version_info.major == 2:
118
stored_state_file = "clients.pickle"
120
logger = logging.getLogger()
124
if_nametoindex = ctypes.cdll.LoadLibrary(
125
ctypes.util.find_library("c")).if_nametoindex
126
except (OSError, AttributeError):
128
def if_nametoindex(interface):
129
"Get an interface index the hard way, i.e. using fcntl()"
130
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
131
with contextlib.closing(socket.socket()) as s:
132
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
133
struct.pack(b"16s16x", interface))
134
interface_index = struct.unpack("I", ifreq[16:20])[0]
135
return interface_index
138
def copy_function(func):
139
"""Make a copy of a function"""
140
if sys.version_info.major == 2:
141
return types.FunctionType(func.func_code,
147
return types.FunctionType(func.__code__,
154
def initlogger(debug, level=logging.WARNING):
155
"""init logger and add loglevel"""
158
syslogger = (logging.handlers.SysLogHandler(
159
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
161
syslogger.setFormatter(logging.Formatter
162
('Mandos [%(process)d]: %(levelname)s:'
164
logger.addHandler(syslogger)
167
console = logging.StreamHandler()
168
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
172
logger.addHandler(console)
173
logger.setLevel(level)
176
class PGPError(Exception):
177
"""Exception if encryption/decryption fails"""
181
class PGPEngine(object):
182
"""A simple class for OpenPGP symmetric encryption & decryption"""
185
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
188
output = subprocess.check_output(["gpgconf"])
189
for line in output.splitlines():
190
name, text, path = line.split(b":")
195
if e.errno != errno.ENOENT:
197
self.gnupgargs = ['--batch',
198
'--homedir', self.tempdir,
201
# Only GPG version 1 has the --no-use-agent option.
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
203
self.gnupgargs.append("--no-use-agent")
208
def __exit__(self, exc_type, exc_value, traceback):
216
if self.tempdir is not None:
217
# Delete contents of tempdir
218
for root, dirs, files in os.walk(self.tempdir,
220
for filename in files:
221
os.remove(os.path.join(root, filename))
223
os.rmdir(os.path.join(root, dirname))
225
os.rmdir(self.tempdir)
228
def password_encode(self, password):
229
# Passphrase can not be empty and can not contain newlines or
230
# NUL bytes. So we prefix it and hex encode it.
231
encoded = b"mandos" + binascii.hexlify(password)
232
if len(encoded) > 2048:
233
# GnuPG can't handle long passwords, so encode differently
234
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
235
.replace(b"\n", b"\\n")
236
.replace(b"\0", b"\\x00"))
239
def encrypt(self, data, password):
240
passphrase = self.password_encode(password)
241
with tempfile.NamedTemporaryFile(
242
dir=self.tempdir) as passfile:
243
passfile.write(passphrase)
245
proc = subprocess.Popen([self.gpg, '--symmetric',
249
stdin=subprocess.PIPE,
250
stdout=subprocess.PIPE,
251
stderr=subprocess.PIPE)
252
ciphertext, err = proc.communicate(input=data)
253
if proc.returncode != 0:
257
def decrypt(self, data, password):
258
passphrase = self.password_encode(password)
259
with tempfile.NamedTemporaryFile(
260
dir=self.tempdir) as passfile:
261
passfile.write(passphrase)
263
proc = subprocess.Popen([self.gpg, '--decrypt',
267
stdin=subprocess.PIPE,
268
stdout=subprocess.PIPE,
269
stderr=subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input=data)
271
if proc.returncode != 0:
273
return decrypted_plaintext
276
# Pretend that we have an Avahi module
278
"""This isn't so much a class as it is a module-like namespace.
279
It is instantiated once, and simulates having an Avahi module."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
289
def string_array_to_txt_array(self, t):
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
291
for s in t), signature="ay")
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
293
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
294
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
295
SERVER_INVALID = 0 # avahi-common/defs.h
296
SERVER_REGISTERING = 1 # avahi-common/defs.h
297
SERVER_RUNNING = 2 # avahi-common/defs.h
298
SERVER_COLLISION = 3 # avahi-common/defs.h
299
SERVER_FAILURE = 4 # avahi-common/defs.h
102
303
class AvahiError(Exception):
103
304
def __init__(self, value, *args, **kwargs):
104
305
self.value = value
105
super(AvahiError, self).__init__(value, *args, **kwargs)
106
def __unicode__(self):
107
return unicode(repr(self.value))
306
return super(AvahiError, self).__init__(value, *args,
109
310
class AvahiServiceError(AvahiError):
112
314
class AvahiGroupError(AvahiError):
116
318
class AvahiService(object):
117
319
"""An Avahi (Zeroconf) service.
120
322
interface: integer; avahi.IF_UNSPEC or an interface index.
121
323
Used to optionally bind to the specified interface.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
124
See <http://www.dns-sd.org/ServiceTypes.html>
324
name: string; Example: 'Mandos'
325
type: string; Example: '_mandos._tcp'.
326
See <https://www.iana.org/assignments/service-names-port-numbers>
125
327
port: integer; what port to announce
126
328
TXT: list of strings; TXT record for the service
127
329
domain: string; Domain to publish on, default to .local if empty.
197
418
dbus.UInt16(self.port),
198
419
avahi.string_array_to_txt_array(self.TXT))
199
420
self.group.Commit()
200
422
def entry_group_state_changed(self, state, error):
201
423
"""Derived from the Avahi example code"""
202
logger.debug(u"Avahi entry group state change: %i", state)
424
logger.debug("Avahi entry group state change: %i", state)
204
426
if state == avahi.ENTRY_GROUP_ESTABLISHED:
205
logger.debug(u"Zeroconf service established.")
427
logger.debug("Zeroconf service established.")
206
428
elif state == avahi.ENTRY_GROUP_COLLISION:
207
logger.warning(u"Zeroconf service name collision.")
429
logger.info("Zeroconf service name collision.")
209
431
elif state == avahi.ENTRY_GROUP_FAILURE:
210
logger.critical(u"Avahi: Error in group state changed %s",
212
raise AvahiGroupError(u"State changed: %s"
432
logger.critical("Avahi: Error in group state changed %s",
434
raise AvahiGroupError("State changed: {!s}".format(error))
214
436
def cleanup(self):
215
437
"""Derived from the Avahi example code"""
216
438
if self.group is not None:
441
except (dbus.exceptions.UnknownMethodException,
442
dbus.exceptions.DBusException):
218
444
self.group = None
219
def server_state_changed(self, state):
447
def server_state_changed(self, state, error=None):
220
448
"""Derived from the Avahi example code"""
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
449
logger.debug("Avahi server state change: %i", state)
451
avahi.SERVER_INVALID: "Zeroconf server invalid",
452
avahi.SERVER_REGISTERING: None,
453
avahi.SERVER_COLLISION: "Zeroconf server name collision",
454
avahi.SERVER_FAILURE: "Zeroconf server failure",
456
if state in bad_states:
457
if bad_states[state] is not None:
459
logger.error(bad_states[state])
461
logger.error(bad_states[state] + ": %r", error)
225
463
elif state == avahi.SERVER_RUNNING:
466
except dbus.exceptions.DBusException as error:
467
if (error.get_dbus_name()
468
== "org.freedesktop.Avahi.CollisionError"):
469
logger.info("Local Zeroconf service name"
471
return self.rename(remove=False)
473
logger.critical("D-Bus Exception", exc_info=error)
478
logger.debug("Unknown state: %r", state)
480
logger.debug("Unknown state: %r: %r", state, error)
227
482
def activate(self):
228
483
"""Derived from the Avahi example code"""
229
484
if self.server is None:
230
485
self.server = dbus.Interface(
231
486
self.bus.get_object(avahi.DBUS_NAME,
232
avahi.DBUS_PATH_SERVER),
487
avahi.DBUS_PATH_SERVER,
488
follow_name_owner_changes=True),
233
489
avahi.DBUS_INTERFACE_SERVER)
234
self.server.connect_to_signal(u"StateChanged",
235
self.server_state_changed)
490
self.server.connect_to_signal("StateChanged",
491
self.server_state_changed)
236
492
self.server_state_changed(self.server.GetState())
495
class AvahiServiceToSyslog(AvahiService):
496
def rename(self, *args, **kwargs):
497
"""Add the new name to the syslog messages"""
498
ret = AvahiService.rename(self, *args, **kwargs)
499
syslogger.setFormatter(logging.Formatter(
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
505
# Pretend that we have a GnuTLS module
506
class GnuTLS(object):
507
"""This isn't so much a class as it is a module-like namespace.
508
It is instantiated once, and simulates having a GnuTLS module."""
510
library = ctypes.util.find_library("gnutls")
512
library = ctypes.util.find_library("gnutls-deb0")
513
_library = ctypes.cdll.LoadLibrary(library)
515
_need_version = b"3.3.0"
518
# Need to use "self" here, since this method is called before
519
# the assignment to the "gnutls" global variable happens.
520
if self.check_version(self._need_version) is None:
521
raise self.Error("Needs GnuTLS {} or later"
522
.format(self._need_version))
524
# Unless otherwise indicated, the constants and types below are
525
# all from the gnutls/gnutls.h C header file.
535
E_NO_CERTIFICATE_FOUND = -49
536
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
539
class session_int(ctypes.Structure):
541
session_t = ctypes.POINTER(session_int)
543
class certificate_credentials_st(ctypes.Structure):
545
certificate_credentials_t = ctypes.POINTER(
546
certificate_credentials_st)
547
certificate_type_t = ctypes.c_int
549
class datum_t(ctypes.Structure):
550
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
551
('size', ctypes.c_uint)]
553
class openpgp_crt_int(ctypes.Structure):
555
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
556
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
557
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
558
credentials_type_t = ctypes.c_int
559
transport_ptr_t = ctypes.c_void_p
560
close_request_t = ctypes.c_int
563
class Error(Exception):
564
# We need to use the class name "GnuTLS" here, since this
565
# exception might be raised from within GnuTLS.__init__,
566
# which is called before the assignment to the "gnutls"
567
# global variable has happened.
568
def __init__(self, message=None, code=None, args=()):
569
# Default usage is by a message string, but if a return
570
# code is passed, convert it to a string with
573
if message is None and code is not None:
574
message = GnuTLS.strerror(code)
575
return super(GnuTLS.Error, self).__init__(
578
class CertificateSecurityError(Error):
582
class Credentials(object):
584
self._c_object = gnutls.certificate_credentials_t()
585
gnutls.certificate_allocate_credentials(
586
ctypes.byref(self._c_object))
587
self.type = gnutls.CRD_CERTIFICATE
590
gnutls.certificate_free_credentials(self._c_object)
592
class ClientSession(object):
593
def __init__(self, socket, credentials=None):
594
self._c_object = gnutls.session_t()
595
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
596
gnutls.set_default_priority(self._c_object)
597
gnutls.transport_set_ptr(self._c_object, socket.fileno())
598
gnutls.handshake_set_private_extensions(self._c_object,
601
if credentials is None:
602
credentials = gnutls.Credentials()
603
gnutls.credentials_set(self._c_object, credentials.type,
604
ctypes.cast(credentials._c_object,
606
self.credentials = credentials
609
gnutls.deinit(self._c_object)
612
return gnutls.handshake(self._c_object)
614
def send(self, data):
618
data_len -= gnutls.record_send(self._c_object,
623
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
625
# Error handling functions
626
def _error_code(result):
627
"""A function to raise exceptions on errors, suitable
628
for the 'restype' attribute on ctypes functions"""
631
if result == gnutls.E_NO_CERTIFICATE_FOUND:
632
raise gnutls.CertificateSecurityError(code=result)
633
raise gnutls.Error(code=result)
635
def _retry_on_error(result, func, arguments):
636
"""A function to retry on some errors, suitable
637
for the 'errcheck' attribute on ctypes functions"""
639
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
640
return _error_code(result)
641
result = func(*arguments)
644
# Unless otherwise indicated, the function declarations below are
645
# all from the gnutls/gnutls.h C header file.
648
priority_set_direct = _library.gnutls_priority_set_direct
649
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
650
ctypes.POINTER(ctypes.c_char_p)]
651
priority_set_direct.restype = _error_code
653
init = _library.gnutls_init
654
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
655
init.restype = _error_code
657
set_default_priority = _library.gnutls_set_default_priority
658
set_default_priority.argtypes = [session_t]
659
set_default_priority.restype = _error_code
661
record_send = _library.gnutls_record_send
662
record_send.argtypes = [session_t, ctypes.c_void_p,
664
record_send.restype = ctypes.c_ssize_t
665
record_send.errcheck = _retry_on_error
667
certificate_allocate_credentials = (
668
_library.gnutls_certificate_allocate_credentials)
669
certificate_allocate_credentials.argtypes = [
670
ctypes.POINTER(certificate_credentials_t)]
671
certificate_allocate_credentials.restype = _error_code
673
certificate_free_credentials = (
674
_library.gnutls_certificate_free_credentials)
675
certificate_free_credentials.argtypes = [
676
certificate_credentials_t]
677
certificate_free_credentials.restype = None
679
handshake_set_private_extensions = (
680
_library.gnutls_handshake_set_private_extensions)
681
handshake_set_private_extensions.argtypes = [session_t,
683
handshake_set_private_extensions.restype = None
685
credentials_set = _library.gnutls_credentials_set
686
credentials_set.argtypes = [session_t, credentials_type_t,
688
credentials_set.restype = _error_code
690
strerror = _library.gnutls_strerror
691
strerror.argtypes = [ctypes.c_int]
692
strerror.restype = ctypes.c_char_p
694
certificate_type_get = _library.gnutls_certificate_type_get
695
certificate_type_get.argtypes = [session_t]
696
certificate_type_get.restype = _error_code
698
certificate_get_peers = _library.gnutls_certificate_get_peers
699
certificate_get_peers.argtypes = [session_t,
700
ctypes.POINTER(ctypes.c_uint)]
701
certificate_get_peers.restype = ctypes.POINTER(datum_t)
703
global_set_log_level = _library.gnutls_global_set_log_level
704
global_set_log_level.argtypes = [ctypes.c_int]
705
global_set_log_level.restype = None
707
global_set_log_function = _library.gnutls_global_set_log_function
708
global_set_log_function.argtypes = [log_func]
709
global_set_log_function.restype = None
711
deinit = _library.gnutls_deinit
712
deinit.argtypes = [session_t]
713
deinit.restype = None
715
handshake = _library.gnutls_handshake
716
handshake.argtypes = [session_t]
717
handshake.restype = _error_code
718
handshake.errcheck = _retry_on_error
720
transport_set_ptr = _library.gnutls_transport_set_ptr
721
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
722
transport_set_ptr.restype = None
724
bye = _library.gnutls_bye
725
bye.argtypes = [session_t, close_request_t]
726
bye.restype = _error_code
727
bye.errcheck = _retry_on_error
729
check_version = _library.gnutls_check_version
730
check_version.argtypes = [ctypes.c_char_p]
731
check_version.restype = ctypes.c_char_p
733
# All the function declarations below are from gnutls/openpgp.h
735
openpgp_crt_init = _library.gnutls_openpgp_crt_init
736
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
737
openpgp_crt_init.restype = _error_code
739
openpgp_crt_import = _library.gnutls_openpgp_crt_import
740
openpgp_crt_import.argtypes = [openpgp_crt_t,
741
ctypes.POINTER(datum_t),
743
openpgp_crt_import.restype = _error_code
745
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
746
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
747
ctypes.POINTER(ctypes.c_uint)]
748
openpgp_crt_verify_self.restype = _error_code
750
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
751
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
752
openpgp_crt_deinit.restype = None
754
openpgp_crt_get_fingerprint = (
755
_library.gnutls_openpgp_crt_get_fingerprint)
756
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
760
openpgp_crt_get_fingerprint.restype = _error_code
762
# Remove non-public functions
763
del _error_code, _retry_on_error
764
# Create the global "gnutls" object, simulating a module
768
def call_pipe(connection, # : multiprocessing.Connection
769
func, *args, **kwargs):
770
"""This function is meant to be called by multiprocessing.Process
772
This function runs func(*args, **kwargs), and writes the resulting
773
return value on the provided multiprocessing.Connection.
775
connection.send(func(*args, **kwargs))
239
779
class Client(object):
240
780
"""A representation of a client host served by this server.
243
_approved: bool(); 'None' if not yet approved/disapproved
783
approved: bool(); 'None' if not yet approved/disapproved
244
784
approval_delay: datetime.timedelta(); Time to wait for approval
245
785
approval_duration: datetime.timedelta(); Duration of one approval
246
786
checker: subprocess.Popen(); a running checker process used
247
787
to see if the client lives.
248
788
'None' if no process is running.
249
checker_callback_tag: a gobject event source tag, or None
789
checker_callback_tag: a GLib event source tag, or None
250
790
checker_command: string; External command which is run to check
251
791
if client lives. %() expansions are done at
252
792
runtime with vars(self) as dict, so that for
253
793
instance %(name)s can be used in the command.
254
checker_initiator_tag: a gobject event source tag, or None
794
checker_initiator_tag: a GLib event source tag, or None
255
795
created: datetime.datetime(); (UTC) object creation
796
client_structure: Object describing what attributes a client has
797
and is used for storing the client at exit
256
798
current_checker_command: string; current running checker_command
257
disable_hook: If set, called by disable() as disable_hook(self)
258
disable_initiator_tag: a gobject event source tag, or None
799
disable_initiator_tag: a GLib event source tag, or None
260
801
fingerprint: string (40 or 32 hexadecimal digits); used to
261
802
uniquely identify the client
263
804
interval: datetime.timedelta(); How often to start a new checker
264
805
last_approval_request: datetime.datetime(); (UTC) or None
265
806
last_checked_ok: datetime.datetime(); (UTC) or None
266
last_enabled: datetime.datetime(); (UTC)
807
last_checker_status: integer between 0 and 255 reflecting exit
808
status of last checker. -1 reflects crashed
809
checker, -2 means no checker completed yet.
810
last_checker_signal: The signal which killed the last checker, if
811
last_checker_status is -1
812
last_enabled: datetime.datetime(); (UTC) or None
267
813
name: string; from the config file, used in log messages and
268
814
D-Bus identifiers
269
815
secret: bytestring; sent verbatim (over TLS) to client
270
816
timeout: datetime.timedelta(); How long from last_checked_ok
271
817
until this client is disabled
818
extended_timeout: extra long timeout when secret has been sent
272
819
runtime_expansions: Allowed attributes for runtime expansion.
820
expires: datetime.datetime(); time (UTC) when a client will be
822
server_settings: The server_settings dict from main()
275
runtime_expansions = (u"approval_delay", u"approval_duration",
276
u"created", u"enabled", u"fingerprint",
277
u"host", u"interval", u"last_checked_ok",
278
u"last_enabled", u"name", u"timeout")
825
runtime_expansions = ("approval_delay", "approval_duration",
826
"created", "enabled", "expires",
827
"fingerprint", "host", "interval",
828
"last_approval_request", "last_checked_ok",
829
"last_enabled", "name", "timeout")
832
"extended_timeout": "PT15M",
834
"checker": "fping -q -- %%(host)s",
836
"approval_delay": "PT0S",
837
"approval_duration": "PT1S",
838
"approved_by_default": "True",
281
def _timedelta_to_milliseconds(td):
282
"Convert a datetime.timedelta() to milliseconds"
283
return ((td.days * 24 * 60 * 60 * 1000)
284
+ (td.seconds * 1000)
285
+ (td.microseconds // 1000))
287
def timeout_milliseconds(self):
288
"Return the 'timeout' attribute in milliseconds"
289
return self._timedelta_to_milliseconds(self.timeout)
291
def interval_milliseconds(self):
292
"Return the 'interval' attribute in milliseconds"
293
return self._timedelta_to_milliseconds(self.interval)
295
def approval_delay_milliseconds(self):
296
return self._timedelta_to_milliseconds(self.approval_delay)
298
def __init__(self, name = None, disable_hook=None, config=None):
299
"""Note: the 'checker' key in 'config' sets the
300
'checker_command' attribute and *not* the 'checker'
843
def config_parser(config):
844
"""Construct a new dict of client settings of this form:
845
{ client_name: {setting_name: value, ...}, ...}
846
with exceptions for any special settings as defined above.
847
NOTE: Must be a pure function. Must return the same result
848
value given the same arguments.
851
for client_name in config.sections():
852
section = dict(config.items(client_name))
853
client = settings[client_name] = {}
855
client["host"] = section["host"]
856
# Reformat values from string types to Python types
857
client["approved_by_default"] = config.getboolean(
858
client_name, "approved_by_default")
859
client["enabled"] = config.getboolean(client_name,
862
# Uppercase and remove spaces from fingerprint for later
863
# comparison purposes with return value from the
864
# fingerprint() function
865
client["fingerprint"] = (section["fingerprint"].upper()
867
if "secret" in section:
868
client["secret"] = codecs.decode(section["secret"]
871
elif "secfile" in section:
872
with open(os.path.expanduser(os.path.expandvars
873
(section["secfile"])),
875
client["secret"] = secfile.read()
877
raise TypeError("No secret or secfile for section {}"
879
client["timeout"] = string_to_delta(section["timeout"])
880
client["extended_timeout"] = string_to_delta(
881
section["extended_timeout"])
882
client["interval"] = string_to_delta(section["interval"])
883
client["approval_delay"] = string_to_delta(
884
section["approval_delay"])
885
client["approval_duration"] = string_to_delta(
886
section["approval_duration"])
887
client["checker_command"] = section["checker"]
888
client["last_approval_request"] = None
889
client["last_checked_ok"] = None
890
client["last_checker_status"] = -2
894
def __init__(self, settings, name=None, server_settings=None):
305
logger.debug(u"Creating client %r", self.name)
306
# Uppercase and remove spaces from fingerprint for later
307
# comparison purposes with return value from the fingerprint()
309
self.fingerprint = (config[u"fingerprint"].upper()
311
logger.debug(u" Fingerprint: %s", self.fingerprint)
312
if u"secret" in config:
313
self.secret = config[u"secret"].decode(u"base64")
314
elif u"secfile" in config:
315
with open(os.path.expanduser(os.path.expandvars
316
(config[u"secfile"])),
318
self.secret = secfile.read()
896
if server_settings is None:
898
self.server_settings = server_settings
899
# adding all client settings
900
for setting, value in settings.items():
901
setattr(self, setting, value)
904
if not hasattr(self, "last_enabled"):
905
self.last_enabled = datetime.datetime.utcnow()
906
if not hasattr(self, "expires"):
907
self.expires = (datetime.datetime.utcnow()
320
raise TypeError(u"No secret or secfile for client %s"
322
self.host = config.get(u"host", u"")
323
self.created = datetime.datetime.utcnow()
325
self.last_approval_request = None
326
self.last_enabled = None
327
self.last_checked_ok = None
328
self.timeout = string_to_delta(config[u"timeout"])
329
self.interval = string_to_delta(config[u"interval"])
330
self.disable_hook = disable_hook
910
self.last_enabled = None
913
logger.debug("Creating client %r", self.name)
914
logger.debug(" Fingerprint: %s", self.fingerprint)
915
self.created = settings.get("created",
916
datetime.datetime.utcnow())
918
# attributes specific for this server instance
331
919
self.checker = None
332
920
self.checker_initiator_tag = None
333
921
self.disable_initiator_tag = None
334
922
self.checker_callback_tag = None
335
self.checker_command = config[u"checker"]
336
923
self.current_checker_command = None
337
self.last_connect = None
338
self._approved = None
339
self.approved_by_default = config.get(u"approved_by_default",
341
925
self.approvals_pending = 0
342
self.approval_delay = string_to_delta(
343
config[u"approval_delay"])
344
self.approval_duration = string_to_delta(
345
config[u"approval_duration"])
346
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
926
self.changedstate = multiprocessing_manager.Condition(
927
multiprocessing_manager.Lock())
928
self.client_structure = [attr
929
for attr in self.__dict__.keys()
930
if not attr.startswith("_")]
931
self.client_structure.append("client_structure")
933
for name, t in inspect.getmembers(
934
type(self), lambda obj: isinstance(obj, property)):
935
if not name.startswith("_"):
936
self.client_structure.append(name)
938
# Send notice to process children that client state has changed
348
939
def send_changedstate(self):
349
self.changedstate.acquire()
350
self.changedstate.notify_all()
351
self.changedstate.release()
940
with self.changedstate:
941
self.changedstate.notify_all()
353
943
def enable(self):
354
944
"""Start this client's checker and timeout hooks"""
355
if getattr(self, u"enabled", False):
945
if getattr(self, "enabled", False):
356
946
# Already enabled
358
self.send_changedstate()
948
self.expires = datetime.datetime.utcnow() + self.timeout
359
950
self.last_enabled = datetime.datetime.utcnow()
952
self.send_changedstate()
954
def disable(self, quiet=True):
955
"""Disable this client."""
956
if not getattr(self, "enabled", False):
959
logger.info("Disabling client %s", self.name)
960
if getattr(self, "disable_initiator_tag", None) is not None:
961
GLib.source_remove(self.disable_initiator_tag)
962
self.disable_initiator_tag = None
964
if getattr(self, "checker_initiator_tag", None) is not None:
965
GLib.source_remove(self.checker_initiator_tag)
966
self.checker_initiator_tag = None
970
self.send_changedstate()
971
# Do not run this again if called by a GLib.timeout_add
977
def init_checker(self):
360
978
# Schedule a new checker to be started an 'interval' from now,
361
979
# and every interval from then on.
362
self.checker_initiator_tag = (gobject.timeout_add
363
(self.interval_milliseconds(),
980
if self.checker_initiator_tag is not None:
981
GLib.source_remove(self.checker_initiator_tag)
982
self.checker_initiator_tag = GLib.timeout_add(
983
int(self.interval.total_seconds() * 1000),
365
985
# Schedule a disable() when 'timeout' has passed
366
self.disable_initiator_tag = (gobject.timeout_add
367
(self.timeout_milliseconds(),
986
if self.disable_initiator_tag is not None:
987
GLib.source_remove(self.disable_initiator_tag)
988
self.disable_initiator_tag = GLib.timeout_add(
989
int(self.timeout.total_seconds() * 1000), self.disable)
370
990
# Also start a new checker *right now*.
371
991
self.start_checker()
373
def disable(self, quiet=True):
374
"""Disable this client."""
375
if not getattr(self, "enabled", False):
378
self.send_changedstate()
380
logger.info(u"Disabling client %s", self.name)
381
if getattr(self, u"disable_initiator_tag", False):
382
gobject.source_remove(self.disable_initiator_tag)
383
self.disable_initiator_tag = None
384
if getattr(self, u"checker_initiator_tag", False):
385
gobject.source_remove(self.checker_initiator_tag)
386
self.checker_initiator_tag = None
388
if self.disable_hook:
389
self.disable_hook(self)
391
# Do not run this again if called by a gobject.timeout_add
395
self.disable_hook = None
398
def checker_callback(self, pid, condition, command):
993
def checker_callback(self, source, condition, connection,
399
995
"""The checker has completed, so take appropriate actions."""
400
996
self.checker_callback_tag = None
401
997
self.checker = None
402
if os.WIFEXITED(condition):
403
exitstatus = os.WEXITSTATUS(condition)
405
logger.info(u"Checker for %(name)s succeeded",
998
# Read return code from connection (see call_pipe)
999
returncode = connection.recv()
1003
self.last_checker_status = returncode
1004
self.last_checker_signal = None
1005
if self.last_checker_status == 0:
1006
logger.info("Checker for %(name)s succeeded",
407
1008
self.checked_ok()
409
logger.info(u"Checker for %(name)s failed",
1010
logger.info("Checker for %(name)s failed", vars(self))
412
logger.warning(u"Checker for %(name)s crashed?",
1012
self.last_checker_status = -1
1013
self.last_checker_signal = -returncode
1014
logger.warning("Checker for %(name)s crashed?",
415
1018
def checked_ok(self):
416
"""Bump up the timeout for this client.
418
This should only be called when the client has been seen,
1019
"""Assert that the client has been seen, alive and well."""
421
1020
self.last_checked_ok = datetime.datetime.utcnow()
422
gobject.source_remove(self.disable_initiator_tag)
423
self.disable_initiator_tag = (gobject.timeout_add
424
(self.timeout_milliseconds(),
1021
self.last_checker_status = 0
1022
self.last_checker_signal = None
1025
def bump_timeout(self, timeout=None):
1026
"""Bump up the timeout for this client."""
1028
timeout = self.timeout
1029
if self.disable_initiator_tag is not None:
1030
GLib.source_remove(self.disable_initiator_tag)
1031
self.disable_initiator_tag = None
1032
if getattr(self, "enabled", False):
1033
self.disable_initiator_tag = GLib.timeout_add(
1034
int(timeout.total_seconds() * 1000), self.disable)
1035
self.expires = datetime.datetime.utcnow() + timeout
427
1037
def need_approval(self):
428
1038
self.last_approval_request = datetime.datetime.utcnow()
430
1040
def start_checker(self):
431
1041
"""Start a new checker subprocess if one is not running.
433
1043
If a checker already exists, leave it running and do
435
1045
# The reason for not killing a running checker is that if we
436
# did that, then if a checker (for some reason) started
437
# running slowly and taking more than 'interval' time, the
438
# client would inevitably timeout, since no checker would get
439
# a chance to run to completion. If we instead leave running
1046
# did that, and if a checker (for some reason) started running
1047
# slowly and taking more than 'interval' time, then the client
1048
# would inevitably timeout, since no checker would get a
1049
# chance to run to completion. If we instead leave running
440
1050
# checkers alone, the checker would have to take more time
441
1051
# than 'timeout' for the client to be disabled, which is as it
444
# If a checker exists, make sure it is not a zombie
446
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
447
except (AttributeError, OSError), error:
448
if (isinstance(error, OSError)
449
and error.errno != errno.ECHILD):
453
logger.warning(u"Checker was a zombie")
454
gobject.source_remove(self.checker_callback_tag)
455
self.checker_callback(pid, status,
456
self.current_checker_command)
1054
if self.checker is not None and not self.checker.is_alive():
1055
logger.warning("Checker was not alive; joining")
457
1058
# Start a new checker if needed
458
1059
if self.checker is None:
1060
# Escape attributes for the shell
1062
attr: re.escape(str(getattr(self, attr)))
1063
for attr in self.runtime_expansions}
460
# In case checker_command has exactly one % operator
461
command = self.checker_command % self.host
463
# Escape attributes for the shell
464
escaped_attrs = dict(
466
re.escape(unicode(str(getattr(self, attr, u"")),
470
self.runtime_expansions)
473
command = self.checker_command % escaped_attrs
474
except TypeError, error:
475
logger.error(u'Could not format string "%s":'
476
u' %s', self.checker_command, error)
477
return True # Try again later
1065
command = self.checker_command % escaped_attrs
1066
except TypeError as error:
1067
logger.error('Could not format string "%s"',
1068
self.checker_command,
1070
return True # Try again later
478
1071
self.current_checker_command = command
480
logger.info(u"Starting checker %r for %s",
482
# We don't need to redirect stdout and stderr, since
483
# in normal mode, that is already done by daemon(),
484
# and in debug mode we don't want to. (Stdin is
485
# always replaced by /dev/null.)
486
self.checker = subprocess.Popen(command,
488
shell=True, cwd=u"/")
489
self.checker_callback_tag = (gobject.child_watch_add
491
self.checker_callback,
493
# The checker may have completed before the gobject
494
# watch was added. Check for this.
495
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
497
gobject.source_remove(self.checker_callback_tag)
498
self.checker_callback(pid, status, command)
499
except OSError, error:
500
logger.error(u"Failed to start subprocess: %s",
502
# Re-run this periodically if run by gobject.timeout_add
1072
logger.info("Starting checker %r for %s", command,
1074
# We don't need to redirect stdout and stderr, since
1075
# in normal mode, that is already done by daemon(),
1076
# and in debug mode we don't want to. (Stdin is
1077
# always replaced by /dev/null.)
1078
# The exception is when not debugging but nevertheless
1079
# running in the foreground; use the previously
1081
popen_args = {"close_fds": True,
1084
if (not self.server_settings["debug"]
1085
and self.server_settings["foreground"]):
1086
popen_args.update({"stdout": wnull,
1088
pipe = multiprocessing.Pipe(duplex=False)
1089
self.checker = multiprocessing.Process(
1091
args=(pipe[1], subprocess.call, command),
1093
self.checker.start()
1094
self.checker_callback_tag = GLib.io_add_watch(
1095
pipe[0].fileno(), GLib.IO_IN,
1096
self.checker_callback, pipe[0], command)
1097
# Re-run this periodically if run by GLib.timeout_add
505
1100
def stop_checker(self):
506
1101
"""Force the checker process, if any, to stop."""
507
1102
if self.checker_callback_tag:
508
gobject.source_remove(self.checker_callback_tag)
1103
GLib.source_remove(self.checker_callback_tag)
509
1104
self.checker_callback_tag = None
510
if getattr(self, u"checker", None) is None:
1105
if getattr(self, "checker", None) is None:
512
logger.debug(u"Stopping checker for %(name)s", vars(self))
514
os.kill(self.checker.pid, signal.SIGTERM)
516
#if self.checker.poll() is None:
517
# os.kill(self.checker.pid, signal.SIGKILL)
518
except OSError, error:
519
if error.errno != errno.ESRCH: # No such process
1107
logger.debug("Stopping checker for %(name)s", vars(self))
1108
self.checker.terminate()
521
1109
self.checker = None
523
def dbus_service_property(dbus_interface, signature=u"v",
524
access=u"readwrite", byte_arrays=False):
1112
def dbus_service_property(dbus_interface,
525
1116
"""Decorators for marking methods of a DBusObjectWithProperties to
526
1117
become properties on the D-Bus.
528
1119
The decorated method will be called with no arguments by "Get"
529
1120
and with one argument by "Set".
531
1122
The parameters, where they are supported, are the same as
532
1123
dbus.service.method, except there is only "signature", since the
533
1124
type from Get() and the type sent to Set() is the same.
535
1126
# Encoding deeply encoded byte arrays is not supported yet by the
536
1127
# "Set" method, so we fail early here:
537
if byte_arrays and signature != u"ay":
538
raise ValueError(u"Byte arrays not supported for non-'ay'"
539
u" signature %r" % signature)
1128
if byte_arrays and signature != "ay":
1129
raise ValueError("Byte arrays not supported for non-'ay'"
1130
" signature {!r}".format(signature))
540
1132
def decorator(func):
541
1133
func._dbus_is_property = True
542
1134
func._dbus_interface = dbus_interface
543
1135
func._dbus_signature = signature
544
1136
func._dbus_access = access
545
1137
func._dbus_name = func.__name__
546
if func._dbus_name.endswith(u"_dbus_property"):
1138
if func._dbus_name.endswith("_dbus_property"):
547
1139
func._dbus_name = func._dbus_name[:-14]
548
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
1140
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1146
def dbus_interface_annotations(dbus_interface):
1147
"""Decorator for marking functions returning interface annotations
1151
@dbus_interface_annotations("org.example.Interface")
1152
def _foo(self): # Function name does not matter
1153
return {"org.freedesktop.DBus.Deprecated": "true",
1154
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1158
def decorator(func):
1159
func._dbus_is_interface = True
1160
func._dbus_interface = dbus_interface
1161
func._dbus_name = dbus_interface
1167
def dbus_annotations(annotations):
1168
"""Decorator to annotate D-Bus methods, signals or properties
1171
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1172
"org.freedesktop.DBus.Property."
1173
"EmitsChangedSignal": "false"})
1174
@dbus_service_property("org.example.Interface", signature="b",
1176
def Property_dbus_property(self):
1177
return dbus.Boolean(False)
1179
See also the DBusObjectWithAnnotations class.
1182
def decorator(func):
1183
func._dbus_annotations = annotations
550
1186
return decorator
553
1189
class DBusPropertyException(dbus.exceptions.DBusException):
554
1190
"""A base class for D-Bus property-related exceptions
556
def __unicode__(self):
557
return unicode(str(self))
560
1195
class DBusPropertyAccessException(DBusPropertyException):
572
class DBusObjectWithProperties(dbus.service.Object):
1207
class DBusObjectWithAnnotations(dbus.service.Object):
1208
"""A D-Bus object with annotations.
1210
Classes inheriting from this can use the dbus_annotations
1211
decorator to add annotations to methods or signals.
1215
def _is_dbus_thing(thing):
1216
"""Returns a function testing if an attribute is a D-Bus thing
1218
If called like _is_dbus_thing("method") it returns a function
1219
suitable for use as predicate to inspect.getmembers().
1221
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1224
def _get_all_dbus_things(self, thing):
1225
"""Returns a generator of (name, attribute) pairs
1227
return ((getattr(athing.__get__(self), "_dbus_name", name),
1228
athing.__get__(self))
1229
for cls in self.__class__.__mro__
1231
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1233
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1235
path_keyword='object_path',
1236
connection_keyword='connection')
1237
def Introspect(self, object_path, connection):
1238
"""Overloading of standard D-Bus method.
1240
Inserts annotation tags on methods and signals.
1242
xmlstring = dbus.service.Object.Introspect(self, object_path,
1245
document = xml.dom.minidom.parseString(xmlstring)
1247
for if_tag in document.getElementsByTagName("interface"):
1248
# Add annotation tags
1249
for typ in ("method", "signal"):
1250
for tag in if_tag.getElementsByTagName(typ):
1252
for name, prop in (self.
1253
_get_all_dbus_things(typ)):
1254
if (name == tag.getAttribute("name")
1255
and prop._dbus_interface
1256
== if_tag.getAttribute("name")):
1257
annots.update(getattr(
1258
prop, "_dbus_annotations", {}))
1259
for name, value in annots.items():
1260
ann_tag = document.createElement(
1262
ann_tag.setAttribute("name", name)
1263
ann_tag.setAttribute("value", value)
1264
tag.appendChild(ann_tag)
1265
# Add interface annotation tags
1266
for annotation, value in dict(
1267
itertools.chain.from_iterable(
1268
annotations().items()
1269
for name, annotations
1270
in self._get_all_dbus_things("interface")
1271
if name == if_tag.getAttribute("name")
1273
ann_tag = document.createElement("annotation")
1274
ann_tag.setAttribute("name", annotation)
1275
ann_tag.setAttribute("value", value)
1276
if_tag.appendChild(ann_tag)
1277
# Fix argument name for the Introspect method itself
1278
if (if_tag.getAttribute("name")
1279
== dbus.INTROSPECTABLE_IFACE):
1280
for cn in if_tag.getElementsByTagName("method"):
1281
if cn.getAttribute("name") == "Introspect":
1282
for arg in cn.getElementsByTagName("arg"):
1283
if (arg.getAttribute("direction")
1285
arg.setAttribute("name",
1287
xmlstring = document.toxml("utf-8")
1289
except (AttributeError, xml.dom.DOMException,
1290
xml.parsers.expat.ExpatError) as error:
1291
logger.error("Failed to override Introspection method",
1296
class DBusObjectWithProperties(DBusObjectWithAnnotations):
573
1297
"""A D-Bus object with properties.
575
1299
Classes inheriting from this can use the dbus_service_property
576
1300
decorator to expose methods as D-Bus properties. It exposes the
577
1301
standard Get(), Set(), and GetAll() methods on the D-Bus.
581
def _is_dbus_property(obj):
582
return getattr(obj, u"_dbus_is_property", False)
584
def _get_all_dbus_properties(self):
585
"""Returns a generator of (name, attribute) pairs
587
return ((prop._dbus_name, prop)
589
inspect.getmembers(self, self._is_dbus_property))
591
1304
def _get_dbus_property(self, interface_name, property_name):
592
1305
"""Returns a bound method if one exists which is a D-Bus
593
1306
property with the specified name and interface.
595
for name in (property_name,
596
property_name + u"_dbus_property"):
597
prop = getattr(self, name, None)
599
or not self._is_dbus_property(prop)
600
or prop._dbus_name != property_name
601
or (interface_name and prop._dbus_interface
602
and interface_name != prop._dbus_interface)):
1308
for cls in self.__class__.__mro__:
1309
for name, value in inspect.getmembers(
1310
cls, self._is_dbus_thing("property")):
1311
if (value._dbus_name == property_name
1312
and value._dbus_interface == interface_name):
1313
return value.__get__(self)
605
1315
# No such property
606
raise DBusPropertyNotFound(self.dbus_object_path + u":"
607
+ interface_name + u"."
610
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
1316
raise DBusPropertyNotFound("{}:{}.{}".format(
1317
self.dbus_object_path, interface_name, property_name))
1320
def _get_all_interface_names(cls):
1321
"""Get a sequence of all interfaces supported by an object"""
1322
return (name for name in set(getattr(getattr(x, attr),
1323
"_dbus_interface", None)
1324
for x in (inspect.getmro(cls))
1326
if name is not None)
1328
@dbus.service.method(dbus.PROPERTIES_IFACE,
612
1331
def Get(self, interface_name, property_name):
613
1332
"""Standard D-Bus property Get() method, see D-Bus standard.
615
1334
prop = self._get_dbus_property(interface_name, property_name)
616
if prop._dbus_access == u"write":
1335
if prop._dbus_access == "write":
617
1336
raise DBusPropertyAccessException(property_name)
619
if not hasattr(value, u"variant_level"):
1338
if not hasattr(value, "variant_level"):
621
1340
return type(value)(value, variant_level=value.variant_level+1)
623
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
1342
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
624
1343
def Set(self, interface_name, property_name, value):
625
1344
"""Standard D-Bus property Set() method, see D-Bus standard.
627
1346
prop = self._get_dbus_property(interface_name, property_name)
628
if prop._dbus_access == u"read":
1347
if prop._dbus_access == "read":
629
1348
raise DBusPropertyAccessException(property_name)
630
if prop._dbus_get_args_options[u"byte_arrays"]:
1349
if prop._dbus_get_args_options["byte_arrays"]:
631
1350
# The byte_arrays option is not supported yet on
632
1351
# signatures other than "ay".
633
if prop._dbus_signature != u"ay":
635
value = dbus.ByteArray(''.join(unichr(byte)
1352
if prop._dbus_signature != "ay":
1353
raise ValueError("Byte arrays not supported for non-"
1354
"'ay' signature {!r}"
1355
.format(prop._dbus_signature))
1356
value = dbus.ByteArray(b''.join(chr(byte)
639
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
640
out_signature=u"a{sv}")
1360
@dbus.service.method(dbus.PROPERTIES_IFACE,
1362
out_signature="a{sv}")
641
1363
def GetAll(self, interface_name):
642
1364
"""Standard D-Bus property GetAll() method, see D-Bus
645
1367
Note: Will not include properties with access="write".
648
for name, prop in self._get_all_dbus_properties():
1370
for name, prop in self._get_all_dbus_things("property"):
649
1371
if (interface_name
650
1372
and interface_name != prop._dbus_interface):
651
1373
# Interface non-empty but did not match
653
1375
# Ignore write-only properties
654
if prop._dbus_access == u"write":
1376
if prop._dbus_access == "write":
657
if not hasattr(value, u"variant_level"):
1379
if not hasattr(value, "variant_level"):
1380
properties[name] = value
660
all[name] = type(value)(value, variant_level=
661
value.variant_level+1)
662
return dbus.Dictionary(all, signature=u"sv")
1382
properties[name] = type(value)(
1383
value, variant_level=value.variant_level + 1)
1384
return dbus.Dictionary(properties, signature="sv")
1386
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1387
def PropertiesChanged(self, interface_name, changed_properties,
1388
invalidated_properties):
1389
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
664
1394
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
666
1396
path_keyword='object_path',
667
1397
connection_keyword='connection')
668
1398
def Introspect(self, object_path, connection):
669
"""Standard D-Bus method, overloaded to insert property tags.
1399
"""Overloading of standard D-Bus method.
1401
Inserts property tags and interface annotation tags.
671
xmlstring = dbus.service.Object.Introspect(self, object_path,
1403
xmlstring = DBusObjectWithAnnotations.Introspect(self,
674
1407
document = xml.dom.minidom.parseString(xmlstring)
675
1409
def make_tag(document, name, prop):
676
e = document.createElement(u"property")
677
e.setAttribute(u"name", name)
678
e.setAttribute(u"type", prop._dbus_signature)
679
e.setAttribute(u"access", prop._dbus_access)
1410
e = document.createElement("property")
1411
e.setAttribute("name", name)
1412
e.setAttribute("type", prop._dbus_signature)
1413
e.setAttribute("access", prop._dbus_access)
681
for if_tag in document.getElementsByTagName(u"interface"):
1416
for if_tag in document.getElementsByTagName("interface"):
682
1418
for tag in (make_tag(document, name, prop)
684
in self._get_all_dbus_properties()
1420
in self._get_all_dbus_things("property")
685
1421
if prop._dbus_interface
686
== if_tag.getAttribute(u"name")):
1422
== if_tag.getAttribute("name")):
687
1423
if_tag.appendChild(tag)
1424
# Add annotation tags for properties
1425
for tag in if_tag.getElementsByTagName("property"):
1427
for name, prop in self._get_all_dbus_things(
1429
if (name == tag.getAttribute("name")
1430
and prop._dbus_interface
1431
== if_tag.getAttribute("name")):
1432
annots.update(getattr(
1433
prop, "_dbus_annotations", {}))
1434
for name, value in annots.items():
1435
ann_tag = document.createElement(
1437
ann_tag.setAttribute("name", name)
1438
ann_tag.setAttribute("value", value)
1439
tag.appendChild(ann_tag)
688
1440
# Add the names to the return values for the
689
1441
# "org.freedesktop.DBus.Properties" methods
690
if (if_tag.getAttribute(u"name")
691
== u"org.freedesktop.DBus.Properties"):
692
for cn in if_tag.getElementsByTagName(u"method"):
693
if cn.getAttribute(u"name") == u"Get":
694
for arg in cn.getElementsByTagName(u"arg"):
695
if (arg.getAttribute(u"direction")
697
arg.setAttribute(u"name", u"value")
698
elif cn.getAttribute(u"name") == u"GetAll":
699
for arg in cn.getElementsByTagName(u"arg"):
700
if (arg.getAttribute(u"direction")
702
arg.setAttribute(u"name", u"props")
703
xmlstring = document.toxml(u"utf-8")
705
except (AttributeError, xml.dom.DOMException,
706
xml.parsers.expat.ExpatError), error:
707
logger.error(u"Failed to override Introspection method",
1442
if (if_tag.getAttribute("name")
1443
== "org.freedesktop.DBus.Properties"):
1444
for cn in if_tag.getElementsByTagName("method"):
1445
if cn.getAttribute("name") == "Get":
1446
for arg in cn.getElementsByTagName("arg"):
1447
if (arg.getAttribute("direction")
1449
arg.setAttribute("name", "value")
1450
elif cn.getAttribute("name") == "GetAll":
1451
for arg in cn.getElementsByTagName("arg"):
1452
if (arg.getAttribute("direction")
1454
arg.setAttribute("name", "props")
1455
xmlstring = document.toxml("utf-8")
1457
except (AttributeError, xml.dom.DOMException,
1458
xml.parsers.expat.ExpatError) as error:
1459
logger.error("Failed to override Introspection method",
1465
dbus.OBJECT_MANAGER_IFACE
1466
except AttributeError:
1467
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1470
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1471
"""A D-Bus object with an ObjectManager.
1473
Classes inheriting from this exposes the standard
1474
GetManagedObjects call and the InterfacesAdded and
1475
InterfacesRemoved signals on the standard
1476
"org.freedesktop.DBus.ObjectManager" interface.
1478
Note: No signals are sent automatically; they must be sent
1481
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1482
out_signature="a{oa{sa{sv}}}")
1483
def GetManagedObjects(self):
1484
"""This function must be overridden"""
1485
raise NotImplementedError()
1487
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1488
signature="oa{sa{sv}}")
1489
def InterfacesAdded(self, object_path, interfaces_and_properties):
1492
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1493
def InterfacesRemoved(self, object_path, interfaces):
1496
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1498
path_keyword='object_path',
1499
connection_keyword='connection')
1500
def Introspect(self, object_path, connection):
1501
"""Overloading of standard D-Bus method.
1503
Override return argument name of GetManagedObjects to be
1504
"objpath_interfaces_and_properties"
1506
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1510
document = xml.dom.minidom.parseString(xmlstring)
1512
for if_tag in document.getElementsByTagName("interface"):
1513
# Fix argument name for the GetManagedObjects method
1514
if (if_tag.getAttribute("name")
1515
== dbus.OBJECT_MANAGER_IFACE):
1516
for cn in if_tag.getElementsByTagName("method"):
1517
if (cn.getAttribute("name")
1518
== "GetManagedObjects"):
1519
for arg in cn.getElementsByTagName("arg"):
1520
if (arg.getAttribute("direction")
1524
"objpath_interfaces"
1526
xmlstring = document.toxml("utf-8")
1528
except (AttributeError, xml.dom.DOMException,
1529
xml.parsers.expat.ExpatError) as error:
1530
logger.error("Failed to override Introspection method",
1535
def datetime_to_dbus(dt, variant_level=0):
1536
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1538
return dbus.String("", variant_level=variant_level)
1539
return dbus.String(dt.isoformat(), variant_level=variant_level)
1542
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1543
"""A class decorator; applied to a subclass of
1544
dbus.service.Object, it will add alternate D-Bus attributes with
1545
interface names according to the "alt_interface_names" mapping.
1548
@alternate_dbus_interfaces({"org.example.Interface":
1549
"net.example.AlternateInterface"})
1550
class SampleDBusObject(dbus.service.Object):
1551
@dbus.service.method("org.example.Interface")
1552
def SampleDBusMethod():
1555
The above "SampleDBusMethod" on "SampleDBusObject" will be
1556
reachable via two interfaces: "org.example.Interface" and
1557
"net.example.AlternateInterface", the latter of which will have
1558
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1559
"true", unless "deprecate" is passed with a False value.
1561
This works for methods and signals, and also for D-Bus properties
1562
(from DBusObjectWithProperties) and interfaces (from the
1563
dbus_interface_annotations decorator).
1567
for orig_interface_name, alt_interface_name in (
1568
alt_interface_names.items()):
1570
interface_names = set()
1571
# Go though all attributes of the class
1572
for attrname, attribute in inspect.getmembers(cls):
1573
# Ignore non-D-Bus attributes, and D-Bus attributes
1574
# with the wrong interface name
1575
if (not hasattr(attribute, "_dbus_interface")
1576
or not attribute._dbus_interface.startswith(
1577
orig_interface_name)):
1579
# Create an alternate D-Bus interface name based on
1581
alt_interface = attribute._dbus_interface.replace(
1582
orig_interface_name, alt_interface_name)
1583
interface_names.add(alt_interface)
1584
# Is this a D-Bus signal?
1585
if getattr(attribute, "_dbus_is_signal", False):
1586
# Extract the original non-method undecorated
1587
# function by black magic
1588
if sys.version_info.major == 2:
1589
nonmethod_func = (dict(
1590
zip(attribute.func_code.co_freevars,
1591
attribute.__closure__))
1592
["func"].cell_contents)
1594
nonmethod_func = (dict(
1595
zip(attribute.__code__.co_freevars,
1596
attribute.__closure__))
1597
["func"].cell_contents)
1598
# Create a new, but exactly alike, function
1599
# object, and decorate it to be a new D-Bus signal
1600
# with the alternate D-Bus interface name
1601
new_function = copy_function(nonmethod_func)
1602
new_function = (dbus.service.signal(
1604
attribute._dbus_signature)(new_function))
1605
# Copy annotations, if any
1607
new_function._dbus_annotations = dict(
1608
attribute._dbus_annotations)
1609
except AttributeError:
1612
# Define a creator of a function to call both the
1613
# original and alternate functions, so both the
1614
# original and alternate signals gets sent when
1615
# the function is called
1616
def fixscope(func1, func2):
1617
"""This function is a scope container to pass
1618
func1 and func2 to the "call_both" function
1619
outside of its arguments"""
1621
@functools.wraps(func2)
1622
def call_both(*args, **kwargs):
1623
"""This function will emit two D-Bus
1624
signals by calling func1 and func2"""
1625
func1(*args, **kwargs)
1626
func2(*args, **kwargs)
1627
# Make wrapper function look like a D-Bus
1629
for name, attr in inspect.getmembers(func2):
1630
if name.startswith("_dbus_"):
1631
setattr(call_both, name, attr)
1634
# Create the "call_both" function and add it to
1636
attr[attrname] = fixscope(attribute, new_function)
1637
# Is this a D-Bus method?
1638
elif getattr(attribute, "_dbus_is_method", False):
1639
# Create a new, but exactly alike, function
1640
# object. Decorate it to be a new D-Bus method
1641
# with the alternate D-Bus interface name. Add it
1644
dbus.service.method(
1646
attribute._dbus_in_signature,
1647
attribute._dbus_out_signature)
1648
(copy_function(attribute)))
1649
# Copy annotations, if any
1651
attr[attrname]._dbus_annotations = dict(
1652
attribute._dbus_annotations)
1653
except AttributeError:
1655
# Is this a D-Bus property?
1656
elif getattr(attribute, "_dbus_is_property", False):
1657
# Create a new, but exactly alike, function
1658
# object, and decorate it to be a new D-Bus
1659
# property with the alternate D-Bus interface
1660
# name. Add it to the class.
1661
attr[attrname] = (dbus_service_property(
1662
alt_interface, attribute._dbus_signature,
1663
attribute._dbus_access,
1664
attribute._dbus_get_args_options
1666
(copy_function(attribute)))
1667
# Copy annotations, if any
1669
attr[attrname]._dbus_annotations = dict(
1670
attribute._dbus_annotations)
1671
except AttributeError:
1673
# Is this a D-Bus interface?
1674
elif getattr(attribute, "_dbus_is_interface", False):
1675
# Create a new, but exactly alike, function
1676
# object. Decorate it to be a new D-Bus interface
1677
# with the alternate D-Bus interface name. Add it
1680
dbus_interface_annotations(alt_interface)
1681
(copy_function(attribute)))
1683
# Deprecate all alternate interfaces
1684
iname = "_AlternateDBusNames_interface_annotation{}"
1685
for interface_name in interface_names:
1687
@dbus_interface_annotations(interface_name)
1689
return {"org.freedesktop.DBus.Deprecated":
1691
# Find an unused name
1692
for aname in (iname.format(i)
1693
for i in itertools.count()):
1694
if aname not in attr:
1698
# Replace the class with a new subclass of it with
1699
# methods, signals, etc. as created above.
1700
if sys.version_info.major == 2:
1701
cls = type(b"{}Alternate".format(cls.__name__),
1704
cls = type("{}Alternate".format(cls.__name__),
1711
@alternate_dbus_interfaces({"se.recompile.Mandos":
1712
"se.bsnet.fukt.Mandos"})
712
1713
class ClientDBus(Client, DBusObjectWithProperties):
713
1714
"""A Client class using D-Bus
716
1717
dbus_object_path: dbus.ObjectPath
717
1718
bus: dbus.SystemBus()
720
1721
runtime_expansions = (Client.runtime_expansions
721
+ (u"dbus_object_path",))
1722
+ ("dbus_object_path", ))
1724
_interface = "se.recompile.Mandos.Client"
723
1726
# dbus.service.Object doesn't use super(), so we can't either.
725
def __init__(self, bus = None, *args, **kwargs):
726
self._approvals_pending = 0
1728
def __init__(self, bus=None, *args, **kwargs):
728
1730
Client.__init__(self, *args, **kwargs)
729
1731
# Only now, when this client is initialized, can it show up on
731
client_object_name = unicode(self.name).translate(
732
{ord(u"."): ord(u"_"),
733
ord(u"-"): ord(u"_")})
734
self.dbus_object_path = (dbus.ObjectPath
735
(u"/clients/" + client_object_name))
1733
client_object_name = str(self.name).translate(
1734
{ord("."): ord("_"),
1735
ord("-"): ord("_")})
1736
self.dbus_object_path = dbus.ObjectPath(
1737
"/clients/" + client_object_name)
736
1738
DBusObjectWithProperties.__init__(self, self.bus,
737
1739
self.dbus_object_path)
739
def _get_approvals_pending(self):
740
return self._approvals_pending
741
def _set_approvals_pending(self, value):
742
old_value = self._approvals_pending
743
self._approvals_pending = value
745
if (hasattr(self, "dbus_object_path")
746
and bval is not bool(old_value)):
747
dbus_bool = dbus.Boolean(bval, variant_level=1)
748
self.PropertyChanged(dbus.String(u"ApprovalPending"),
751
approvals_pending = property(_get_approvals_pending,
752
_set_approvals_pending)
753
del _get_approvals_pending, _set_approvals_pending
756
def _datetime_to_dbus(dt, variant_level=0):
757
"""Convert a UTC datetime.datetime() to a D-Bus type."""
758
return dbus.String(dt.isoformat(),
759
variant_level=variant_level)
762
oldstate = getattr(self, u"enabled", False)
763
r = Client.enable(self)
764
if oldstate != self.enabled:
766
self.PropertyChanged(dbus.String(u"Enabled"),
767
dbus.Boolean(True, variant_level=1))
768
self.PropertyChanged(
769
dbus.String(u"LastEnabled"),
770
self._datetime_to_dbus(self.last_enabled,
774
def disable(self, quiet = False):
775
oldstate = getattr(self, u"enabled", False)
776
r = Client.disable(self, quiet=quiet)
777
if not quiet and oldstate != self.enabled:
779
self.PropertyChanged(dbus.String(u"Enabled"),
780
dbus.Boolean(False, variant_level=1))
1741
def notifychangeproperty(transform_func, dbus_name,
1742
type_func=lambda x: x,
1744
invalidate_only=False,
1745
_interface=_interface):
1746
""" Modify a variable so that it's a property which announces
1747
its changes to DBus.
1749
transform_fun: Function that takes a value and a variant_level
1750
and transforms it to a D-Bus type.
1751
dbus_name: D-Bus name of the variable
1752
type_func: Function that transform the value before sending it
1753
to the D-Bus. Default: no transform
1754
variant_level: D-Bus variant level. Default: 1
1756
attrname = "_{}".format(dbus_name)
1758
def setter(self, value):
1759
if hasattr(self, "dbus_object_path"):
1760
if (not hasattr(self, attrname) or
1761
type_func(getattr(self, attrname, None))
1762
!= type_func(value)):
1764
self.PropertiesChanged(
1765
_interface, dbus.Dictionary(),
1766
dbus.Array((dbus_name, )))
1768
dbus_value = transform_func(
1770
variant_level=variant_level)
1771
self.PropertyChanged(dbus.String(dbus_name),
1773
self.PropertiesChanged(
1775
dbus.Dictionary({dbus.String(dbus_name):
1778
setattr(self, attrname, value)
1780
return property(lambda self: getattr(self, attrname), setter)
1782
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1783
approvals_pending = notifychangeproperty(dbus.Boolean,
1786
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1787
last_enabled = notifychangeproperty(datetime_to_dbus,
1789
checker = notifychangeproperty(
1790
dbus.Boolean, "CheckerRunning",
1791
type_func=lambda checker: checker is not None)
1792
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1794
last_checker_status = notifychangeproperty(dbus.Int16,
1795
"LastCheckerStatus")
1796
last_approval_request = notifychangeproperty(
1797
datetime_to_dbus, "LastApprovalRequest")
1798
approved_by_default = notifychangeproperty(dbus.Boolean,
1799
"ApprovedByDefault")
1800
approval_delay = notifychangeproperty(
1801
dbus.UInt64, "ApprovalDelay",
1802
type_func=lambda td: td.total_seconds() * 1000)
1803
approval_duration = notifychangeproperty(
1804
dbus.UInt64, "ApprovalDuration",
1805
type_func=lambda td: td.total_seconds() * 1000)
1806
host = notifychangeproperty(dbus.String, "Host")
1807
timeout = notifychangeproperty(
1808
dbus.UInt64, "Timeout",
1809
type_func=lambda td: td.total_seconds() * 1000)
1810
extended_timeout = notifychangeproperty(
1811
dbus.UInt64, "ExtendedTimeout",
1812
type_func=lambda td: td.total_seconds() * 1000)
1813
interval = notifychangeproperty(
1814
dbus.UInt64, "Interval",
1815
type_func=lambda td: td.total_seconds() * 1000)
1816
checker_command = notifychangeproperty(dbus.String, "Checker")
1817
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1818
invalidate_only=True)
1820
del notifychangeproperty
783
1822
def __del__(self, *args, **kwargs):
785
1824
self.remove_from_connection()
786
1825
except LookupError:
788
if hasattr(DBusObjectWithProperties, u"__del__"):
1827
if hasattr(DBusObjectWithProperties, "__del__"):
789
1828
DBusObjectWithProperties.__del__(self, *args, **kwargs)
790
1829
Client.__del__(self, *args, **kwargs)
792
def checker_callback(self, pid, condition, command,
794
self.checker_callback_tag = None
797
self.PropertyChanged(dbus.String(u"CheckerRunning"),
798
dbus.Boolean(False, variant_level=1))
799
if os.WIFEXITED(condition):
800
exitstatus = os.WEXITSTATUS(condition)
1831
def checker_callback(self, source, condition,
1832
connection, command, *args, **kwargs):
1833
ret = Client.checker_callback(self, source, condition,
1834
connection, command, *args,
1836
exitstatus = self.last_checker_status
801
1838
# Emit D-Bus signal
802
1839
self.CheckerCompleted(dbus.Int16(exitstatus),
803
dbus.Int64(condition),
1840
# This is specific to GNU libC
1841
dbus.Int64(exitstatus << 8),
804
1842
dbus.String(command))
806
1844
# Emit D-Bus signal
807
1845
self.CheckerCompleted(dbus.Int16(-1),
808
dbus.Int64(condition),
1847
# This is specific to GNU libC
1849
| self.last_checker_signal),
809
1850
dbus.String(command))
811
return Client.checker_callback(self, pid, condition, command,
814
def checked_ok(self, *args, **kwargs):
815
r = Client.checked_ok(self, *args, **kwargs)
817
self.PropertyChanged(
818
dbus.String(u"LastCheckedOK"),
819
(self._datetime_to_dbus(self.last_checked_ok,
823
def need_approval(self, *args, **kwargs):
824
r = Client.need_approval(self, *args, **kwargs)
826
self.PropertyChanged(
827
dbus.String(u"LastApprovalRequest"),
828
(self._datetime_to_dbus(self.last_approval_request,
832
1853
def start_checker(self, *args, **kwargs):
833
old_checker = self.checker
834
if self.checker is not None:
835
old_checker_pid = self.checker.pid
837
old_checker_pid = None
1854
old_checker_pid = getattr(self.checker, "pid", None)
838
1855
r = Client.start_checker(self, *args, **kwargs)
839
1856
# Only if new checker process was started
840
1857
if (self.checker is not None
841
1858
and old_checker_pid != self.checker.pid):
842
1859
# Emit D-Bus signal
843
1860
self.CheckerStarted(self.current_checker_command)
844
self.PropertyChanged(
845
dbus.String(u"CheckerRunning"),
846
dbus.Boolean(True, variant_level=1))
849
def stop_checker(self, *args, **kwargs):
850
old_checker = getattr(self, u"checker", None)
851
r = Client.stop_checker(self, *args, **kwargs)
852
if (old_checker is not None
853
and getattr(self, u"checker", None) is None):
854
self.PropertyChanged(dbus.String(u"CheckerRunning"),
855
dbus.Boolean(False, variant_level=1))
858
1863
def _reset_approved(self):
859
self._approved = None
1864
self.approved = None
862
1867
def approve(self, value=True):
1868
self.approved = value
1869
GLib.timeout_add(int(self.approval_duration.total_seconds()
1870
* 1000), self._reset_approved)
863
1871
self.send_changedstate()
864
self._approved = value
865
gobject.timeout_add(self._timedelta_to_milliseconds
866
(self.approval_duration),
867
self._reset_approved)
870
## D-Bus methods, signals & properties
871
_interface = u"se.bsnet.fukt.Mandos.Client"
1873
# D-Bus methods, signals & properties
875
1879
# CheckerCompleted - signal
876
@dbus.service.signal(_interface, signature=u"nxs")
1880
@dbus.service.signal(_interface, signature="nxs")
877
1881
def CheckerCompleted(self, exitcode, waitstatus, command):
881
1885
# CheckerStarted - signal
882
@dbus.service.signal(_interface, signature=u"s")
1886
@dbus.service.signal(_interface, signature="s")
883
1887
def CheckerStarted(self, command):
887
1891
# PropertyChanged - signal
888
@dbus.service.signal(_interface, signature=u"sv")
1892
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1893
@dbus.service.signal(_interface, signature="sv")
889
1894
def PropertyChanged(self, property, value):
893
1898
# GotSecret - signal
894
1899
@dbus.service.signal(_interface)
895
1900
def GotSecret(self):
1140
2163
self._pipe = child_pipe
1141
2164
self._pipe.send(('init', fpr, address))
1142
2165
if not self._pipe.recv():
1145
2168
def __getattribute__(self, name):
1146
if(name == '_pipe'):
1147
2170
return super(ProxyClient, self).__getattribute__(name)
1148
2171
self._pipe.send(('getattr', name))
1149
2172
data = self._pipe.recv()
1150
2173
if data[0] == 'data':
1152
2175
if data[0] == 'function':
1153
2177
def func(*args, **kwargs):
1154
2178
self._pipe.send(('funcall', name, args, kwargs))
1155
2179
return self._pipe.recv()[1]
1158
2183
def __setattr__(self, name, value):
1159
if(name == '_pipe'):
1160
2185
return super(ProxyClient, self).__setattr__(name, value)
1161
2186
self._pipe.send(('setattr', name, value))
1164
2189
class ClientHandler(socketserver.BaseRequestHandler, object):
1165
2190
"""A class to handle client connections.
1167
2192
Instantiated once for each connection to handle it.
1168
2193
Note: This will run in its own forked process."""
1170
2195
def handle(self):
1171
2196
with contextlib.closing(self.server.child_pipe) as child_pipe:
1172
logger.info(u"TCP connection from: %s",
1173
unicode(self.client_address))
1174
logger.debug(u"Pipe FD: %d",
2197
logger.info("TCP connection from: %s",
2198
str(self.client_address))
2199
logger.debug("Pipe FD: %d",
1175
2200
self.server.child_pipe.fileno())
1177
session = (gnutls.connection
1178
.ClientSession(self.request,
1180
.X509Credentials()))
1182
# Note: gnutls.connection.X509Credentials is really a
1183
# generic GnuTLS certificate credentials object so long as
1184
# no X.509 keys are added to it. Therefore, we can use it
1185
# here despite using OpenPGP certificates.
1187
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1188
# u"+AES-256-CBC", u"+SHA1",
1189
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
2202
session = gnutls.ClientSession(self.request)
2204
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2205
# "+AES-256-CBC", "+SHA1",
2206
# "+COMP-NULL", "+CTYPE-OPENPGP",
1191
2208
# Use a fallback default, since this MUST be set.
1192
2209
priority = self.server.gnutls_priority
1193
2210
if priority is None:
1194
priority = u"NORMAL"
1195
(gnutls.library.functions
1196
.gnutls_priority_set_direct(session._c_object,
2212
gnutls.priority_set_direct(session._c_object,
2213
priority.encode("utf-8"),
1199
2216
# Start communication using the Mandos protocol
1200
2217
# Get protocol number
1201
2218
line = self.request.makefile().readline()
1202
logger.debug(u"Protocol version: %r", line)
2219
logger.debug("Protocol version: %r", line)
1204
2221
if int(line.strip().split()[0]) > 1:
1206
except (ValueError, IndexError, RuntimeError), error:
1207
logger.error(u"Unknown protocol version: %s", error)
2222
raise RuntimeError(line)
2223
except (ValueError, IndexError, RuntimeError) as error:
2224
logger.error("Unknown protocol version: %s", error)
1210
2227
# Start GnuTLS connection
1212
2229
session.handshake()
1213
except gnutls.errors.GNUTLSError, error:
1214
logger.warning(u"Handshake failed: %s", error)
2230
except gnutls.Error as error:
2231
logger.warning("Handshake failed: %s", error)
1215
2232
# Do not run session.bye() here: the session is not
1216
2233
# established. Just abandon the request.
1218
logger.debug(u"Handshake succeeded")
2235
logger.debug("Handshake succeeded")
1220
2237
approval_required = False
1223
fpr = self.fingerprint(self.peer_certificate
1225
except (TypeError, gnutls.errors.GNUTLSError), error:
1226
logger.warning(u"Bad certificate: %s", error)
2240
fpr = self.fingerprint(
2241
self.peer_certificate(session))
2242
except (TypeError, gnutls.Error) as error:
2243
logger.warning("Bad certificate: %s", error)
1228
logger.debug(u"Fingerprint: %s", fpr)
2245
logger.debug("Fingerprint: %s", fpr)
1231
2248
client = ProxyClient(child_pipe, fpr,
1232
2249
self.client_address)
1233
2250
except KeyError:
1236
2253
if client.approval_delay:
1237
2254
delay = client.approval_delay
1238
2255
client.approvals_pending += 1
1239
2256
approval_required = True
1242
2259
if not client.enabled:
1243
logger.warning(u"Client %s is disabled",
2260
logger.info("Client %s is disabled",
1245
2262
if self.server.use_dbus:
1246
2263
# Emit D-Bus signal
1247
client.Rejected("Disabled")
2264
client.Rejected("Disabled")
1250
if client._approved or not client.approval_delay:
1251
#We are approved or approval is disabled
2267
if client.approved or not client.approval_delay:
2268
# We are approved or approval is disabled
1253
elif client._approved is None:
1254
logger.info(u"Client %s needs approval",
2270
elif client.approved is None:
2271
logger.info("Client %s needs approval",
1256
2273
if self.server.use_dbus:
1257
2274
# Emit D-Bus signal
1258
2275
client.NeedApproval(
1259
client.approval_delay_milliseconds(),
1260
client.approved_by_default)
2276
client.approval_delay.total_seconds()
2277
* 1000, client.approved_by_default)
1262
logger.warning(u"Client %s was not approved",
2279
logger.warning("Client %s was not approved",
1264
2281
if self.server.use_dbus:
1265
2282
# Emit D-Bus signal
1266
2283
client.Rejected("Denied")
1269
#wait until timeout or approved
1270
#x = float(client._timedelta_to_milliseconds(delay))
2286
# wait until timeout or approved
1271
2287
time = datetime.datetime.now()
1272
2288
client.changedstate.acquire()
1273
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
2289
client.changedstate.wait(delay.total_seconds())
1274
2290
client.changedstate.release()
1275
2291
time2 = datetime.datetime.now()
1276
2292
if (time2 - time) >= delay:
1288
2304
delay -= time2 - time
1291
while sent_size < len(client.secret):
1293
sent = session.send(client.secret[sent_size:])
1294
except (gnutls.errors.GNUTLSError), error:
1295
logger.warning("gnutls send failed")
1297
logger.debug(u"Sent: %d, remaining: %d",
1298
sent, len(client.secret)
1299
- (sent_size + sent))
1302
logger.info(u"Sending secret to %s", client.name)
1303
# bump the timeout as if seen
2307
session.send(client.secret)
2308
except gnutls.Error as error:
2309
logger.warning("gnutls send failed",
2313
logger.info("Sending secret to %s", client.name)
2314
# bump the timeout using extended_timeout
2315
client.bump_timeout(client.extended_timeout)
1305
2316
if self.server.use_dbus:
1306
2317
# Emit D-Bus signal
1307
2318
client.GotSecret()
1310
2321
if approval_required:
1311
2322
client.approvals_pending -= 1
1314
except (gnutls.errors.GNUTLSError), error:
1315
logger.warning("GnuTLS bye failed")
2325
except gnutls.Error as error:
2326
logger.warning("GnuTLS bye failed",
1318
2330
def peer_certificate(session):
1319
2331
"Return the peer's OpenPGP certificate as a bytestring"
1320
2332
# If not an OpenPGP certificate...
1321
if (gnutls.library.functions
1322
.gnutls_certificate_type_get(session._c_object)
1323
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1324
# ...do the normal thing
1325
return session.peer_certificate
2333
if (gnutls.certificate_type_get(session._c_object)
2334
!= gnutls.CRT_OPENPGP):
2335
# ...return invalid data
1326
2337
list_size = ctypes.c_uint(1)
1327
cert_list = (gnutls.library.functions
1328
.gnutls_certificate_get_peers
2338
cert_list = (gnutls.certificate_get_peers
1329
2339
(session._c_object, ctypes.byref(list_size)))
1330
2340
if not bool(cert_list) and list_size.value != 0:
1331
raise gnutls.errors.GNUTLSError(u"error getting peer"
2341
raise gnutls.Error("error getting peer certificate")
1333
2342
if list_size.value == 0:
1335
2344
cert = cert_list[0]
1336
2345
return ctypes.string_at(cert.data, cert.size)
1339
2348
def fingerprint(openpgp):
1340
2349
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1341
2350
# New GnuTLS "datum" with the OpenPGP public key
1342
datum = (gnutls.library.types
1343
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1346
ctypes.c_uint(len(openpgp))))
2351
datum = gnutls.datum_t(
2352
ctypes.cast(ctypes.c_char_p(openpgp),
2353
ctypes.POINTER(ctypes.c_ubyte)),
2354
ctypes.c_uint(len(openpgp)))
1347
2355
# New empty GnuTLS certificate
1348
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1349
(gnutls.library.functions
1350
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2356
crt = gnutls.openpgp_crt_t()
2357
gnutls.openpgp_crt_init(ctypes.byref(crt))
1351
2358
# Import the OpenPGP public key into the certificate
1352
(gnutls.library.functions
1353
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1354
gnutls.library.constants
1355
.GNUTLS_OPENPGP_FMT_RAW))
2359
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2360
gnutls.OPENPGP_FMT_RAW)
1356
2361
# Verify the self signature in the key
1357
2362
crtverify = ctypes.c_uint()
1358
(gnutls.library.functions
1359
.gnutls_openpgp_crt_verify_self(crt, 0,
1360
ctypes.byref(crtverify)))
2363
gnutls.openpgp_crt_verify_self(crt, 0,
2364
ctypes.byref(crtverify))
1361
2365
if crtverify.value != 0:
1362
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1363
raise (gnutls.errors.CertificateSecurityError
2366
gnutls.openpgp_crt_deinit(crt)
2367
raise gnutls.CertificateSecurityError("Verify failed")
1365
2368
# New buffer for the fingerprint
1366
2369
buf = ctypes.create_string_buffer(20)
1367
2370
buf_len = ctypes.c_size_t()
1368
2371
# Get the fingerprint from the certificate into the buffer
1369
(gnutls.library.functions
1370
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1371
ctypes.byref(buf_len)))
2372
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2373
ctypes.byref(buf_len))
1372
2374
# Deinit the certificate
1373
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2375
gnutls.openpgp_crt_deinit(crt)
1374
2376
# Convert the buffer to a Python bytestring
1375
2377
fpr = ctypes.string_at(buf, buf_len.value)
1376
2378
# Convert the bytestring to hexadecimal notation
1377
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
2379
hex_fpr = binascii.hexlify(fpr).upper()
1381
2383
class MultiprocessingMixIn(object):
1382
2384
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1383
2386
def sub_process_main(self, request, address):
1385
2388
self.finish_request(request, address)
1387
2390
self.handle_error(request, address)
1388
2391
self.close_request(request)
1390
2393
def process_request(self, request, address):
1391
2394
"""Start a new process to process the request."""
1392
multiprocessing.Process(target = self.sub_process_main,
1393
args = (request, address)).start()
2395
proc = multiprocessing.Process(target=self.sub_process_main,
2396
args=(request, address))
1395
2401
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1396
2402
""" adds a pipe to the MixIn """
1397
2404
def process_request(self, request, client_address):
1398
2405
"""Overrides and wraps the original process_request().
1400
2407
This function creates a new pipe in self.pipe
1402
2409
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1404
super(MultiprocessingMixInWithPipe,
1405
self).process_request(request, client_address)
2411
proc = MultiprocessingMixIn.process_request(self, request,
1406
2413
self.child_pipe.close()
1407
self.add_pipe(parent_pipe)
2414
self.add_pipe(parent_pipe, proc)
1409
def add_pipe(self, parent_pipe):
2416
def add_pipe(self, parent_pipe, proc):
1410
2417
"""Dummy function; override as necessary"""
2418
raise NotImplementedError()
1413
2421
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1414
2422
socketserver.TCPServer, object):
1415
2423
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1418
2426
enabled: Boolean; whether this server is activated yet
1419
2427
interface: None or a network interface name (string)
1420
2428
use_ipv6: Boolean; to use IPv6 or not
1422
2431
def __init__(self, server_address, RequestHandlerClass,
1423
interface=None, use_ipv6=True):
2435
"""If socketfd is set, use that file descriptor instead of
2436
creating a new one with socket.socket().
1424
2438
self.interface = interface
1426
2440
self.address_family = socket.AF_INET6
2441
if socketfd is not None:
2442
# Save the file descriptor
2443
self.socketfd = socketfd
2444
# Save the original socket.socket() function
2445
self.socket_socket = socket.socket
2447
# To implement --socket, we monkey patch socket.socket.
2449
# (When socketserver.TCPServer is a new-style class, we
2450
# could make self.socket into a property instead of monkey
2451
# patching socket.socket.)
2453
# Create a one-time-only replacement for socket.socket()
2454
@functools.wraps(socket.socket)
2455
def socket_wrapper(*args, **kwargs):
2456
# Restore original function so subsequent calls are
2458
socket.socket = self.socket_socket
2459
del self.socket_socket
2460
# This time only, return a new socket object from the
2461
# saved file descriptor.
2462
return socket.fromfd(self.socketfd, *args, **kwargs)
2463
# Replace socket.socket() function with wrapper
2464
socket.socket = socket_wrapper
2465
# The socketserver.TCPServer.__init__ will call
2466
# socket.socket(), which might be our replacement,
2467
# socket_wrapper(), if socketfd was set.
1427
2468
socketserver.TCPServer.__init__(self, server_address,
1428
2469
RequestHandlerClass)
1429
2471
def server_bind(self):
1430
2472
"""This overrides the normal server_bind() function
1431
2473
to bind to an interface if one was specified, and also NOT to
1432
2474
bind to an address or port if they were not specified."""
2475
global SO_BINDTODEVICE
1433
2476
if self.interface is not None:
1434
2477
if SO_BINDTODEVICE is None:
1435
logger.error(u"SO_BINDTODEVICE does not exist;"
1436
u" cannot bind to interface %s",
1440
self.socket.setsockopt(socket.SOL_SOCKET,
1444
except socket.error, error:
1445
if error[0] == errno.EPERM:
1446
logger.error(u"No permission to"
1447
u" bind to interface %s",
1449
elif error[0] == errno.ENOPROTOOPT:
1450
logger.error(u"SO_BINDTODEVICE not available;"
1451
u" cannot bind to interface %s",
2478
# Fall back to a hard-coded value which seems to be
2480
logger.warning("SO_BINDTODEVICE not found, trying 25")
2481
SO_BINDTODEVICE = 25
2483
self.socket.setsockopt(
2484
socket.SOL_SOCKET, SO_BINDTODEVICE,
2485
(self.interface + "\0").encode("utf-8"))
2486
except socket.error as error:
2487
if error.errno == errno.EPERM:
2488
logger.error("No permission to bind to"
2489
" interface %s", self.interface)
2490
elif error.errno == errno.ENOPROTOOPT:
2491
logger.error("SO_BINDTODEVICE not available;"
2492
" cannot bind to interface %s",
2494
elif error.errno == errno.ENODEV:
2495
logger.error("Interface %s does not exist,"
2496
" cannot bind", self.interface)
1455
2499
# Only bind(2) the socket if we really need to.
1456
2500
if self.server_address[0] or self.server_address[1]:
1457
2501
if not self.server_address[0]:
1458
2502
if self.address_family == socket.AF_INET6:
1459
any_address = u"::" # in6addr_any
2503
any_address = "::" # in6addr_any
1461
any_address = socket.INADDR_ANY
2505
any_address = "0.0.0.0" # INADDR_ANY
1462
2506
self.server_address = (any_address,
1463
2507
self.server_address[1])
1464
2508
elif not self.server_address[1]:
1465
self.server_address = (self.server_address[0],
2509
self.server_address = (self.server_address[0], 0)
1467
2510
# if self.interface:
1468
2511
# self.server_address = (self.server_address[0],
2634
def rfc3339_duration_to_delta(duration):
2635
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2637
>>> rfc3339_duration_to_delta("P7D")
2638
datetime.timedelta(7)
2639
>>> rfc3339_duration_to_delta("PT60S")
2640
datetime.timedelta(0, 60)
2641
>>> rfc3339_duration_to_delta("PT60M")
2642
datetime.timedelta(0, 3600)
2643
>>> rfc3339_duration_to_delta("PT24H")
2644
datetime.timedelta(1)
2645
>>> rfc3339_duration_to_delta("P1W")
2646
datetime.timedelta(7)
2647
>>> rfc3339_duration_to_delta("PT5M30S")
2648
datetime.timedelta(0, 330)
2649
>>> rfc3339_duration_to_delta("P1DT3M20S")
2650
datetime.timedelta(1, 200)
2653
# Parsing an RFC 3339 duration with regular expressions is not
2654
# possible - there would have to be multiple places for the same
2655
# values, like seconds. The current code, while more esoteric, is
2656
# cleaner without depending on a parsing library. If Python had a
2657
# built-in library for parsing we would use it, but we'd like to
2658
# avoid excessive use of external libraries.
2660
# New type for defining tokens, syntax, and semantics all-in-one
2661
Token = collections.namedtuple("Token", (
2662
"regexp", # To match token; if "value" is not None, must have
2663
# a "group" containing digits
2664
"value", # datetime.timedelta or None
2665
"followers")) # Tokens valid after this token
2666
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2667
# the "duration" ABNF definition in RFC 3339, Appendix A.
2668
token_end = Token(re.compile(r"$"), None, frozenset())
2669
token_second = Token(re.compile(r"(\d+)S"),
2670
datetime.timedelta(seconds=1),
2671
frozenset((token_end, )))
2672
token_minute = Token(re.compile(r"(\d+)M"),
2673
datetime.timedelta(minutes=1),
2674
frozenset((token_second, token_end)))
2675
token_hour = Token(re.compile(r"(\d+)H"),
2676
datetime.timedelta(hours=1),
2677
frozenset((token_minute, token_end)))
2678
token_time = Token(re.compile(r"T"),
2680
frozenset((token_hour, token_minute,
2682
token_day = Token(re.compile(r"(\d+)D"),
2683
datetime.timedelta(days=1),
2684
frozenset((token_time, token_end)))
2685
token_month = Token(re.compile(r"(\d+)M"),
2686
datetime.timedelta(weeks=4),
2687
frozenset((token_day, token_end)))
2688
token_year = Token(re.compile(r"(\d+)Y"),
2689
datetime.timedelta(weeks=52),
2690
frozenset((token_month, token_end)))
2691
token_week = Token(re.compile(r"(\d+)W"),
2692
datetime.timedelta(weeks=1),
2693
frozenset((token_end, )))
2694
token_duration = Token(re.compile(r"P"), None,
2695
frozenset((token_year, token_month,
2696
token_day, token_time,
2698
# Define starting values:
2700
value = datetime.timedelta()
2702
# Following valid tokens
2703
followers = frozenset((token_duration, ))
2704
# String left to parse
2706
# Loop until end token is found
2707
while found_token is not token_end:
2708
# Search for any currently valid tokens
2709
for token in followers:
2710
match = token.regexp.match(s)
2711
if match is not None:
2713
if token.value is not None:
2714
# Value found, parse digits
2715
factor = int(match.group(1), 10)
2716
# Add to value so far
2717
value += factor * token.value
2718
# Strip token from string
2719
s = token.regexp.sub("", s, 1)
2722
# Set valid next tokens
2723
followers = found_token.followers
2726
# No currently valid tokens were found
2727
raise ValueError("Invalid RFC 3339 duration: {!r}"
1582
2733
def string_to_delta(interval):
1583
2734
"""Parse a string and return a datetime.timedelta
1585
>>> string_to_delta(u'7d')
2736
>>> string_to_delta('7d')
1586
2737
datetime.timedelta(7)
1587
>>> string_to_delta(u'60s')
2738
>>> string_to_delta('60s')
1588
2739
datetime.timedelta(0, 60)
1589
>>> string_to_delta(u'60m')
2740
>>> string_to_delta('60m')
1590
2741
datetime.timedelta(0, 3600)
1591
>>> string_to_delta(u'24h')
2742
>>> string_to_delta('24h')
1592
2743
datetime.timedelta(1)
1593
>>> string_to_delta(u'1w')
2744
>>> string_to_delta('1w')
1594
2745
datetime.timedelta(7)
1595
>>> string_to_delta(u'5m 30s')
2746
>>> string_to_delta('5m 30s')
1596
2747
datetime.timedelta(0, 330)
2751
return rfc3339_duration_to_delta(interval)
1598
2755
timevalue = datetime.timedelta(0)
1599
2756
for s in interval.split():
1601
suffix = unicode(s[-1])
1602
2759
value = int(s[:-1])
1604
2761
delta = datetime.timedelta(value)
1605
elif suffix == u"s":
1606
2763
delta = datetime.timedelta(0, value)
1607
elif suffix == u"m":
1608
2765
delta = datetime.timedelta(0, 0, 0, 0, value)
1609
elif suffix == u"h":
1610
2767
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1611
elif suffix == u"w":
1612
2769
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1614
raise ValueError(u"Unknown suffix %r" % suffix)
1615
except (ValueError, IndexError), e:
1616
raise ValueError(e.message)
2771
raise ValueError("Unknown suffix {!r}".format(suffix))
2772
except IndexError as e:
2773
raise ValueError(*(e.args))
1617
2774
timevalue += delta
1618
2775
return timevalue
1621
def if_nametoindex(interface):
1622
"""Call the C function if_nametoindex(), or equivalent
1624
Note: This function cannot accept a unicode string."""
1625
global if_nametoindex
1627
if_nametoindex = (ctypes.cdll.LoadLibrary
1628
(ctypes.util.find_library(u"c"))
1630
except (OSError, AttributeError):
1631
logger.warning(u"Doing if_nametoindex the hard way")
1632
def if_nametoindex(interface):
1633
"Get an interface index the hard way, i.e. using fcntl()"
1634
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1635
with contextlib.closing(socket.socket()) as s:
1636
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1637
struct.pack(str(u"16s16x"),
1639
interface_index = struct.unpack(str(u"I"),
1641
return interface_index
1642
return if_nametoindex(interface)
1645
def daemon(nochdir = False, noclose = False):
2778
def daemon(nochdir=False, noclose=False):
1646
2779
"""See daemon(3). Standard BSD Unix function.
1648
2781
This should really exist as os.daemon, but it doesn't (yet)."""
1652
2785
if not nochdir:
1656
2789
if not noclose:
1657
2790
# Close all standard open file descriptors
1658
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2791
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1659
2792
if not stat.S_ISCHR(os.fstat(null).st_mode):
1660
2793
raise OSError(errno.ENODEV,
1661
u"%s not a character device"
2794
"{} not a character device"
2795
.format(os.devnull))
1663
2796
os.dup2(null, sys.stdin.fileno())
1664
2797
os.dup2(null, sys.stdout.fileno())
1665
2798
os.dup2(null, sys.stderr.fileno())
1672
2805
##################################################################
1673
2806
# Parsing of options, both command line and config file
1675
parser = optparse.OptionParser(version = "%%prog %s" % version)
1676
parser.add_option("-i", u"--interface", type=u"string",
1677
metavar="IF", help=u"Bind to interface IF")
1678
parser.add_option("-a", u"--address", type=u"string",
1679
help=u"Address to listen for requests on")
1680
parser.add_option("-p", u"--port", type=u"int",
1681
help=u"Port number to receive requests on")
1682
parser.add_option("--check", action=u"store_true",
1683
help=u"Run self-test")
1684
parser.add_option("--debug", action=u"store_true",
1685
help=u"Debug mode; run in foreground and log to"
1687
parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",
1688
help=u"Debug level for stdout output")
1689
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1690
u" priority string (see GnuTLS documentation)")
1691
parser.add_option("--servicename", type=u"string",
1692
metavar=u"NAME", help=u"Zeroconf service name")
1693
parser.add_option("--configdir", type=u"string",
1694
default=u"/etc/mandos", metavar=u"DIR",
1695
help=u"Directory to search for configuration"
1697
parser.add_option("--no-dbus", action=u"store_false",
1698
dest=u"use_dbus", help=u"Do not provide D-Bus"
1699
u" system bus interface")
1700
parser.add_option("--no-ipv6", action=u"store_false",
1701
dest=u"use_ipv6", help=u"Do not use IPv6")
1702
options = parser.parse_args()[0]
2808
parser = argparse.ArgumentParser()
2809
parser.add_argument("-v", "--version", action="version",
2810
version="%(prog)s {}".format(version),
2811
help="show version number and exit")
2812
parser.add_argument("-i", "--interface", metavar="IF",
2813
help="Bind to interface IF")
2814
parser.add_argument("-a", "--address",
2815
help="Address to listen for requests on")
2816
parser.add_argument("-p", "--port", type=int,
2817
help="Port number to receive requests on")
2818
parser.add_argument("--check", action="store_true",
2819
help="Run self-test")
2820
parser.add_argument("--debug", action="store_true",
2821
help="Debug mode; run in foreground and log"
2822
" to terminal", default=None)
2823
parser.add_argument("--debuglevel", metavar="LEVEL",
2824
help="Debug level for stdout output")
2825
parser.add_argument("--priority", help="GnuTLS"
2826
" priority string (see GnuTLS documentation)")
2827
parser.add_argument("--servicename",
2828
metavar="NAME", help="Zeroconf service name")
2829
parser.add_argument("--configdir",
2830
default="/etc/mandos", metavar="DIR",
2831
help="Directory to search for configuration"
2833
parser.add_argument("--no-dbus", action="store_false",
2834
dest="use_dbus", help="Do not provide D-Bus"
2835
" system bus interface", default=None)
2836
parser.add_argument("--no-ipv6", action="store_false",
2837
dest="use_ipv6", help="Do not use IPv6",
2839
parser.add_argument("--no-restore", action="store_false",
2840
dest="restore", help="Do not restore stored"
2841
" state", default=None)
2842
parser.add_argument("--socket", type=int,
2843
help="Specify a file descriptor to a network"
2844
" socket to use instead of creating one")
2845
parser.add_argument("--statedir", metavar="DIR",
2846
help="Directory to save/restore state in")
2847
parser.add_argument("--foreground", action="store_true",
2848
help="Run in foreground", default=None)
2849
parser.add_argument("--no-zeroconf", action="store_false",
2850
dest="zeroconf", help="Do not use Zeroconf",
2853
options = parser.parse_args()
1704
2855
if options.check:
2857
fail_count, test_count = doctest.testmod()
2858
sys.exit(os.EX_OK if fail_count == 0 else 1)
1709
2860
# Default values for config file for server-global settings
1710
server_defaults = { u"interface": u"",
1715
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1716
u"servicename": u"Mandos",
1717
u"use_dbus": u"True",
1718
u"use_ipv6": u"True",
2861
server_defaults = {"interface": "",
2866
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2867
":+SIGN-DSA-SHA256",
2868
"servicename": "Mandos",
2874
"statedir": "/var/lib/mandos",
2875
"foreground": "False",
1722
2879
# Parse config file for server-global settings
1723
2880
server_config = configparser.SafeConfigParser(server_defaults)
1724
2881
del server_defaults
1725
server_config.read(os.path.join(options.configdir,
2882
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1727
2883
# Convert the SafeConfigParser object to a dict
1728
2884
server_settings = server_config.defaults()
1729
2885
# Use the appropriate methods on the non-string config options
1730
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1731
server_settings[option] = server_config.getboolean(u"DEFAULT",
2886
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2887
server_settings[option] = server_config.getboolean("DEFAULT",
1733
2889
if server_settings["port"]:
1734
server_settings["port"] = server_config.getint(u"DEFAULT",
2890
server_settings["port"] = server_config.getint("DEFAULT",
2892
if server_settings["socket"]:
2893
server_settings["socket"] = server_config.getint("DEFAULT",
2895
# Later, stdin will, and stdout and stderr might, be dup'ed
2896
# over with an opened os.devnull. But we don't want this to
2897
# happen with a supplied network socket.
2898
if 0 <= server_settings["socket"] <= 2:
2899
server_settings["socket"] = os.dup(server_settings
1736
2901
del server_config
1738
2903
# Override the settings from the config file with command line
1739
2904
# options, if set.
1740
for option in (u"interface", u"address", u"port", u"debug",
1741
u"priority", u"servicename", u"configdir",
1742
u"use_dbus", u"use_ipv6", u"debuglevel"):
2905
for option in ("interface", "address", "port", "debug",
2906
"priority", "servicename", "configdir", "use_dbus",
2907
"use_ipv6", "debuglevel", "restore", "statedir",
2908
"socket", "foreground", "zeroconf"):
1743
2909
value = getattr(options, option)
1744
2910
if value is not None:
1745
2911
server_settings[option] = value
1747
2913
# Force all strings to be unicode
1748
2914
for option in server_settings.keys():
1749
if type(server_settings[option]) is str:
1750
server_settings[option] = unicode(server_settings[option])
2915
if isinstance(server_settings[option], bytes):
2916
server_settings[option] = (server_settings[option]
2918
# Force all boolean options to be boolean
2919
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2920
"foreground", "zeroconf"):
2921
server_settings[option] = bool(server_settings[option])
2922
# Debug implies foreground
2923
if server_settings["debug"]:
2924
server_settings["foreground"] = True
1751
2925
# Now we have our good server settings in "server_settings"
1753
2927
##################################################################
2929
if (not server_settings["zeroconf"]
2930
and not (server_settings["port"]
2931
or server_settings["socket"] != "")):
2932
parser.error("Needs port or socket to work without Zeroconf")
1755
2934
# For convenience
1756
debug = server_settings[u"debug"]
1757
debuglevel = server_settings[u"debuglevel"]
1758
use_dbus = server_settings[u"use_dbus"]
1759
use_ipv6 = server_settings[u"use_ipv6"]
1761
if server_settings[u"servicename"] != u"Mandos":
1762
syslogger.setFormatter(logging.Formatter
1763
(u'Mandos (%s) [%%(process)d]:'
1764
u' %%(levelname)s: %%(message)s'
1765
% server_settings[u"servicename"]))
2935
debug = server_settings["debug"]
2936
debuglevel = server_settings["debuglevel"]
2937
use_dbus = server_settings["use_dbus"]
2938
use_ipv6 = server_settings["use_ipv6"]
2939
stored_state_path = os.path.join(server_settings["statedir"],
2941
foreground = server_settings["foreground"]
2942
zeroconf = server_settings["zeroconf"]
2945
initlogger(debug, logging.DEBUG)
2950
level = getattr(logging, debuglevel.upper())
2951
initlogger(debug, level)
2953
if server_settings["servicename"] != "Mandos":
2954
syslogger.setFormatter(
2955
logging.Formatter('Mandos ({}) [%(process)d]:'
2956
' %(levelname)s: %(message)s'.format(
2957
server_settings["servicename"])))
1767
2959
# Parse config file with clients
1768
client_defaults = { u"timeout": u"1h",
1770
u"checker": u"fping -q -- %%(host)s",
1772
u"approval_delay": u"0s",
1773
u"approval_duration": u"1s",
1775
client_config = configparser.SafeConfigParser(client_defaults)
1776
client_config.read(os.path.join(server_settings[u"configdir"],
2960
client_config = configparser.SafeConfigParser(Client
2962
client_config.read(os.path.join(server_settings["configdir"],
1779
2965
global mandos_dbus_service
1780
2966
mandos_dbus_service = None
1782
tcp_server = MandosServer((server_settings[u"address"],
1783
server_settings[u"port"]),
1785
interface=(server_settings[u"interface"]
1789
server_settings[u"priority"],
1792
pidfilename = u"/var/run/mandos.pid"
1794
pidfile = open(pidfilename, u"w")
1796
logger.error(u"Could not open file %r", pidfilename)
1799
uid = pwd.getpwnam(u"_mandos").pw_uid
1800
gid = pwd.getpwnam(u"_mandos").pw_gid
1803
uid = pwd.getpwnam(u"mandos").pw_uid
1804
gid = pwd.getpwnam(u"mandos").pw_gid
2969
if server_settings["socket"] != "":
2970
socketfd = server_settings["socket"]
2971
tcp_server = MandosServer(
2972
(server_settings["address"], server_settings["port"]),
2974
interface=(server_settings["interface"] or None),
2976
gnutls_priority=server_settings["priority"],
2980
pidfilename = "/run/mandos.pid"
2981
if not os.path.isdir("/run/."):
2982
pidfilename = "/var/run/mandos.pid"
2985
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2986
except IOError as e:
2987
logger.error("Could not open file %r", pidfilename,
2990
for name, group in (("_mandos", "_mandos"),
2991
("mandos", "mandos"),
2992
("nobody", "nogroup")):
2994
uid = pwd.getpwnam(name).pw_uid
2995
gid = pwd.getpwnam(group).pw_gid
1805
2997
except KeyError:
1807
uid = pwd.getpwnam(u"nobody").pw_uid
1808
gid = pwd.getpwnam(u"nobody").pw_gid
1815
except OSError, error:
1816
if error[0] != errno.EPERM:
1819
if not debug and not debuglevel:
1820
syslogger.setLevel(logging.WARNING)
1821
console.setLevel(logging.WARNING)
1823
level = getattr(logging, debuglevel.upper())
1824
syslogger.setLevel(level)
1825
console.setLevel(level)
3006
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3008
except OSError as error:
3009
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3010
.format(uid, gid, os.strerror(error.errno)))
3011
if error.errno != errno.EPERM:
1828
3015
# Enable all possible GnuTLS debugging
1830
3017
# "Use a log level over 10 to enable all debugging options."
1831
3018
# - GnuTLS manual
1832
gnutls.library.functions.gnutls_global_set_log_level(11)
1834
@gnutls.library.types.gnutls_log_func
3019
gnutls.global_set_log_level(11)
1835
3022
def debug_gnutls(level, string):
1836
logger.debug(u"GnuTLS: %s", string[:-1])
1838
(gnutls.library.functions
1839
.gnutls_global_set_log_function(debug_gnutls))
3023
logger.debug("GnuTLS: %s", string[:-1])
3025
gnutls.global_set_log_function(debug_gnutls)
1841
3027
# Redirect stdin so all checkers get /dev/null
1842
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
3028
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1843
3029
os.dup2(null, sys.stdin.fileno())
1847
# No console logging
1848
logger.removeHandler(console)
1850
3033
# Need to fork before connecting to D-Bus
1852
3035
# Close all input and output, do double fork, etc.
3038
# multiprocessing will use threads, so before we use GLib we need
3039
# to inform GLib that threads will be used.
1855
3042
global main_loop
1856
3043
# From the Avahi example code
1857
DBusGMainLoop(set_as_default=True )
1858
main_loop = gobject.MainLoop()
3044
DBusGMainLoop(set_as_default=True)
3045
main_loop = GLib.MainLoop()
1859
3046
bus = dbus.SystemBus()
1860
3047
# End of Avahi example code
1863
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1864
bus, do_not_queue=True)
1865
except dbus.exceptions.NameExistsException, e:
1866
logger.error(unicode(e) + u", disabling D-Bus")
3050
bus_name = dbus.service.BusName("se.recompile.Mandos",
3053
old_bus_name = dbus.service.BusName(
3054
"se.bsnet.fukt.Mandos", bus,
3056
except dbus.exceptions.DBusException as e:
3057
logger.error("Disabling D-Bus:", exc_info=e)
1867
3058
use_dbus = False
1868
server_settings[u"use_dbus"] = False
3059
server_settings["use_dbus"] = False
1869
3060
tcp_server.use_dbus = False
1870
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1871
service = AvahiService(name = server_settings[u"servicename"],
1872
servicetype = u"_mandos._tcp",
1873
protocol = protocol, bus = bus)
1874
if server_settings["interface"]:
1875
service.interface = (if_nametoindex
1876
(str(server_settings[u"interface"])))
3062
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3063
service = AvahiServiceToSyslog(
3064
name=server_settings["servicename"],
3065
servicetype="_mandos._tcp",
3068
if server_settings["interface"]:
3069
service.interface = if_nametoindex(
3070
server_settings["interface"].encode("utf-8"))
1878
3072
global multiprocessing_manager
1879
3073
multiprocessing_manager = multiprocessing.Manager()
1881
3075
client_class = Client
1883
client_class = functools.partial(ClientDBus, bus = bus)
1884
def client_config_items(config, section):
1885
special_settings = {
1886
"approved_by_default":
1887
lambda: config.getboolean(section,
1888
"approved_by_default"),
1890
for name, value in config.items(section):
3077
client_class = functools.partial(ClientDBus, bus=bus)
3079
client_settings = Client.config_parser(client_config)
3080
old_client_settings = {}
3083
# This is used to redirect stdout and stderr for checker processes
3085
wnull = open(os.devnull, "w") # A writable /dev/null
3086
# Only used if server is running in foreground but not in debug
3088
if debug or not foreground:
3091
# Get client data and settings from last running state.
3092
if server_settings["restore"]:
3094
with open(stored_state_path, "rb") as stored_state:
3095
if sys.version_info.major == 2:
3096
clients_data, old_client_settings = pickle.load(
3099
bytes_clients_data, bytes_old_client_settings = (
3100
pickle.load(stored_state, encoding="bytes"))
3101
# Fix bytes to strings
3104
clients_data = {(key.decode("utf-8")
3105
if isinstance(key, bytes)
3108
bytes_clients_data.items()}
3109
del bytes_clients_data
3110
for key in clients_data:
3111
value = {(k.decode("utf-8")
3112
if isinstance(k, bytes) else k): v
3114
clients_data[key].items()}
3115
clients_data[key] = value
3117
value["client_structure"] = [
3119
if isinstance(s, bytes)
3121
value["client_structure"]]
3123
for k in ("name", "host"):
3124
if isinstance(value[k], bytes):
3125
value[k] = value[k].decode("utf-8")
3126
# old_client_settings
3128
old_client_settings = {
3129
(key.decode("utf-8")
3130
if isinstance(key, bytes)
3133
bytes_old_client_settings.items()}
3134
del bytes_old_client_settings
3136
for value in old_client_settings.values():
3137
if isinstance(value["host"], bytes):
3138
value["host"] = (value["host"]
3140
os.remove(stored_state_path)
3141
except IOError as e:
3142
if e.errno == errno.ENOENT:
3143
logger.warning("Could not load persistent state:"
3144
" {}".format(os.strerror(e.errno)))
3146
logger.critical("Could not load persistent state:",
3149
except EOFError as e:
3150
logger.warning("Could not load persistent state: "
3154
with PGPEngine() as pgp:
3155
for client_name, client in clients_data.items():
3156
# Skip removed clients
3157
if client_name not in client_settings:
3160
# Decide which value to use after restoring saved state.
3161
# We have three different values: Old config file,
3162
# new config file, and saved state.
3163
# New config value takes precedence if it differs from old
3164
# config value, otherwise use saved state.
3165
for name, value in client_settings[client_name].items():
3167
# For each value in new config, check if it
3168
# differs from the old config value (Except for
3169
# the "secret" attribute)
3170
if (name != "secret"
3172
old_client_settings[client_name][name])):
3173
client[name] = value
3177
# Clients who has passed its expire date can still be
3178
# enabled if its last checker was successful. A Client
3179
# whose checker succeeded before we stored its state is
3180
# assumed to have successfully run all checkers during
3182
if client["enabled"]:
3183
if datetime.datetime.utcnow() >= client["expires"]:
3184
if not client["last_checked_ok"]:
3186
"disabling client {} - Client never "
3187
"performed a successful checker".format(
3189
client["enabled"] = False
3190
elif client["last_checker_status"] != 0:
3192
"disabling client {} - Client last"
3193
" checker failed with error code"
3196
client["last_checker_status"]))
3197
client["enabled"] = False
3199
client["expires"] = (
3200
datetime.datetime.utcnow()
3201
+ client["timeout"])
3202
logger.debug("Last checker succeeded,"
3203
" keeping {} enabled".format(
1892
yield (name, special_settings[name]())
1896
tcp_server.clients.update(set(
1897
client_class(name = section,
1898
config= dict(client_config_items(
1899
client_config, section)))
1900
for section in client_config.sections()))
3206
client["secret"] = pgp.decrypt(
3207
client["encrypted_secret"],
3208
client_settings[client_name]["secret"])
3210
# If decryption fails, we use secret from new settings
3211
logger.debug("Failed to decrypt {} old secret".format(
3213
client["secret"] = (client_settings[client_name]
3216
# Add/remove clients based on new changes made to config
3217
for client_name in (set(old_client_settings)
3218
- set(client_settings)):
3219
del clients_data[client_name]
3220
for client_name in (set(client_settings)
3221
- set(old_client_settings)):
3222
clients_data[client_name] = client_settings[client_name]
3224
# Create all client objects
3225
for client_name, client in clients_data.items():
3226
tcp_server.clients[client_name] = client_class(
3229
server_settings=server_settings)
1901
3231
if not tcp_server.clients:
1902
logger.warning(u"No clients defined")
1908
pidfile.write(str(pid) + "\n")
1911
logger.error(u"Could not write to file %r with PID %d",
1914
# "pidfile" was never created
3232
logger.warning("No clients defined")
3235
if pidfile is not None:
3239
print(pid, file=pidfile)
3241
logger.error("Could not write to file %r with PID %d",
1916
3244
del pidfilename
1918
signal.signal(signal.SIGINT, signal.SIG_IGN)
1920
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1921
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3246
for termsig in (signal.SIGHUP, signal.SIGTERM):
3247
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3248
lambda: main_loop.quit() and False)
1924
class MandosDBusService(dbus.service.Object):
3252
@alternate_dbus_interfaces(
3253
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3254
class MandosDBusService(DBusObjectWithObjectManager):
1925
3255
"""A D-Bus proxy object"""
1926
3257
def __init__(self):
1927
dbus.service.Object.__init__(self, bus, u"/")
1928
_interface = u"se.bsnet.fukt.Mandos"
1930
@dbus.service.signal(_interface, signature=u"o")
3258
dbus.service.Object.__init__(self, bus, "/")
3260
_interface = "se.recompile.Mandos"
3262
@dbus.service.signal(_interface, signature="o")
1931
3263
def ClientAdded(self, objpath):
1935
@dbus.service.signal(_interface, signature=u"ss")
3267
@dbus.service.signal(_interface, signature="ss")
1936
3268
def ClientNotFound(self, fingerprint, address):
1940
@dbus.service.signal(_interface, signature=u"os")
3272
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3274
@dbus.service.signal(_interface, signature="os")
1941
3275
def ClientRemoved(self, objpath, name):
1945
@dbus.service.method(_interface, out_signature=u"ao")
3279
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3281
@dbus.service.method(_interface, out_signature="ao")
1946
3282
def GetAllClients(self):
1948
return dbus.Array(c.dbus_object_path
1949
for c in tcp_server.clients)
3284
return dbus.Array(c.dbus_object_path for c in
3285
tcp_server.clients.values())
3287
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
1951
3289
@dbus.service.method(_interface,
1952
out_signature=u"a{oa{sv}}")
3290
out_signature="a{oa{sv}}")
1953
3291
def GetAllClientsWithProperties(self):
1955
3293
return dbus.Dictionary(
1956
((c.dbus_object_path, c.GetAll(u""))
1957
for c in tcp_server.clients),
1958
signature=u"oa{sv}")
1960
@dbus.service.method(_interface, in_signature=u"o")
3294
{c.dbus_object_path: c.GetAll(
3295
"se.recompile.Mandos.Client")
3296
for c in tcp_server.clients.values()},
3299
@dbus.service.method(_interface, in_signature="o")
1961
3300
def RemoveClient(self, object_path):
1963
for c in tcp_server.clients:
3302
for c in tcp_server.clients.values():
1964
3303
if c.dbus_object_path == object_path:
1965
tcp_server.clients.remove(c)
3304
del tcp_server.clients[c.name]
1966
3305
c.remove_from_connection()
1967
# Don't signal anything except ClientRemoved
3306
# Don't signal the disabling
1968
3307
c.disable(quiet=True)
1970
self.ClientRemoved(object_path, c.name)
3308
# Emit D-Bus signal for removal
3309
self.client_removed_signal(c)
1972
3311
raise KeyError(object_path)
3315
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3316
out_signature="a{oa{sa{sv}}}")
3317
def GetManagedObjects(self):
3319
return dbus.Dictionary(
3320
{client.dbus_object_path:
3322
{interface: client.GetAll(interface)
3324
client._get_all_interface_names()})
3325
for client in tcp_server.clients.values()})
3327
def client_added_signal(self, client):
3328
"""Send the new standard signal and the old signal"""
3330
# New standard signal
3331
self.InterfacesAdded(
3332
client.dbus_object_path,
3334
{interface: client.GetAll(interface)
3336
client._get_all_interface_names()}))
3338
self.ClientAdded(client.dbus_object_path)
3340
def client_removed_signal(self, client):
3341
"""Send the new standard signal and the old signal"""
3343
# New standard signal
3344
self.InterfacesRemoved(
3345
client.dbus_object_path,
3346
client._get_all_interface_names())
3348
self.ClientRemoved(client.dbus_object_path,
1976
3351
mandos_dbus_service = MandosDBusService()
3353
# Save modules to variables to exempt the modules from being
3354
# unloaded before the function registered with atexit() is run.
3355
mp = multiprocessing
1979
3359
"Cleanup function; run on exit"
3363
mp.active_children()
3365
if not (tcp_server.clients or client_settings):
3368
# Store client before exiting. Secrets are encrypted with key
3369
# based on what config file has. If config file is
3370
# removed/edited, old secret will thus be unrecovable.
3372
with PGPEngine() as pgp:
3373
for client in tcp_server.clients.values():
3374
key = client_settings[client.name]["secret"]
3375
client.encrypted_secret = pgp.encrypt(client.secret,
3379
# A list of attributes that can not be pickled
3381
exclude = {"bus", "changedstate", "secret",
3382
"checker", "server_settings"}
3383
for name, typ in inspect.getmembers(dbus.service
3387
client_dict["encrypted_secret"] = (client
3389
for attr in client.client_structure:
3390
if attr not in exclude:
3391
client_dict[attr] = getattr(client, attr)
3393
clients[client.name] = client_dict
3394
del client_settings[client.name]["secret"]
3397
with tempfile.NamedTemporaryFile(
3401
dir=os.path.dirname(stored_state_path),
3402
delete=False) as stored_state:
3403
pickle.dump((clients, client_settings), stored_state,
3405
tempname = stored_state.name
3406
os.rename(tempname, stored_state_path)
3407
except (IOError, OSError) as e:
3413
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3414
logger.warning("Could not save persistent state: {}"
3415
.format(os.strerror(e.errno)))
3417
logger.warning("Could not save persistent state:",
3421
# Delete all clients, and settings from config
1982
3422
while tcp_server.clients:
1983
client = tcp_server.clients.pop()
3423
name, client = tcp_server.clients.popitem()
1985
3425
client.remove_from_connection()
1986
client.disable_hook = None
1987
# Don't signal anything except ClientRemoved
3426
# Don't signal the disabling
1988
3427
client.disable(quiet=True)
3428
# Emit D-Bus signal for removal
1991
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
3430
mandos_dbus_service.client_removed_signal(client)
3431
client_settings.clear()
1994
3433
atexit.register(cleanup)
1996
for client in tcp_server.clients:
3435
for client in tcp_server.clients.values():
1999
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3437
# Emit D-Bus signal for adding
3438
mandos_dbus_service.client_added_signal(client)
3439
# Need to initiate checking of clients
3441
client.init_checker()
2002
3443
tcp_server.enable()
2003
3444
tcp_server.server_activate()
2005
3446
# Find out what port we got
2006
service.port = tcp_server.socket.getsockname()[1]
3448
service.port = tcp_server.socket.getsockname()[1]
2008
logger.info(u"Now listening on address %r, port %d,"
2009
" flowinfo %d, scope_id %d"
2010
% tcp_server.socket.getsockname())
3450
logger.info("Now listening on address %r, port %d,"
3451
" flowinfo %d, scope_id %d",
3452
*tcp_server.socket.getsockname())
2012
logger.info(u"Now listening on address %r, port %d"
2013
% tcp_server.socket.getsockname())
2015
#service.interface = tcp_server.socket.getsockname()[3]
3454
logger.info("Now listening on address %r, port %d",
3455
*tcp_server.socket.getsockname())
3457
# service.interface = tcp_server.socket.getsockname()[3]
2018
# From the Avahi example code
2021
except dbus.exceptions.DBusException, error:
2022
logger.critical(u"DBusException: %s", error)
2025
# End of Avahi example code
2027
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2028
lambda *args, **kwargs:
2029
(tcp_server.handle_request
2030
(*args[2:], **kwargs) or True))
2032
logger.debug(u"Starting main loop")
3461
# From the Avahi example code
3464
except dbus.exceptions.DBusException as error:
3465
logger.critical("D-Bus Exception", exc_info=error)
3468
# End of Avahi example code
3470
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3471
lambda *args, **kwargs:
3472
(tcp_server.handle_request
3473
(*args[2:], **kwargs) or True))
3475
logger.debug("Starting main loop")
2033
3476
main_loop.run()
2034
except AvahiError, error:
2035
logger.critical(u"AvahiError: %s", error)
3477
except AvahiError as error:
3478
logger.critical("Avahi Error", exc_info=error)
2038
3481
except KeyboardInterrupt:
2041
logger.debug(u"Server received KeyboardInterrupt")
2042
logger.debug(u"Server exiting")
3483
print("", file=sys.stderr)
3484
logger.debug("Server received KeyboardInterrupt")
3485
logger.debug("Server exiting")
2043
3486
# Must run before the D-Bus bus name gets deregistered
2046
3490
if __name__ == '__main__':