/mandos/trunk : revision 24.1.185

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

37

import SocketServer as socketserver

43

38

import socket

44

39

import argparse

45

40

import datetime

50

45

import gnutls.library.functions

51

46

import gnutls.library.constants

52

47

import gnutls.library.types

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

48

import ConfigParser as configparser

57

49

import sys

58

50

import re

59

51

import os

68

60

import struct

69

61

import fcntl

70

62

import functools

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

63

import cPickle as pickle

75

64

import multiprocessing

76

65

import types

77

import binascii

78

import tempfile

79

import itertools

80

import collections

81

import codecs

82

66

83

67

import dbus

84

68

import dbus.service

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

69

import gobject

89

70

import avahi

90

71

from dbus.mainloop.glib import DBusGMainLoop

91

72

import ctypes

101

82

except ImportError:

102

83

SO_BINDTODEVICE = None

103

84

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

108

stored_state_file = "clients.pickle"

109

110

logger = logging.getLogger()

111

syslogger = None

112

113

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

116

except (OSError, AttributeError):

117

118

def if_nametoindex(interface):

119

"Get an interface index the hard way, i.e. using fcntl()"

120

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

121

with contextlib.closing(socket.socket()) as s:

122

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

125

return interface_index

126

127

128

def initlogger(debug, level=logging.WARNING):

129

"""init logger and add loglevel"""

130

131

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

135

syslogger.setFormatter(logging.Formatter

136

('Mandos [%(process)d]: %(levelname)s:'

137

' %(message)s'))

138

logger.addHandler(syslogger)

139

140

if debug:

141

console = logging.StreamHandler()

142

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

143

' [%(process)d]:'

144

' %(levelname)s:'

145

' %(message)s'))

146

logger.addHandler(console)

147

logger.setLevel(level)

148

149

150

class PGPError(Exception):

151

"""Exception if encryption/decryption fails"""

152

pass

153

154

155

class PGPEngine(object):

156

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

def __init__(self):

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

self.gnupgargs = ['--batch',

161

'--home', self.tempdir,

162

'--force-mdc',

163

'--quiet',

164

'--no-use-agent']

165

166

def __enter__(self):

167

return self

168

169

def __exit__(self, exc_type, exc_value, traceback):

170

self._cleanup()

171

return False

172

173

def __del__(self):

174

self._cleanup()

175

176

def _cleanup(self):

177

if self.tempdir is not None:

178

# Delete contents of tempdir

179

for root, dirs, files in os.walk(self.tempdir,

180

topdown = False):

181

for filename in files:

182

os.remove(os.path.join(root, filename))

183

for dirname in dirs:

184

os.rmdir(os.path.join(root, dirname))

185

# Remove tempdir

186

os.rmdir(self.tempdir)

187

self.tempdir = None

188

189

def password_encode(self, password):

190

# Passphrase can not be empty and can not contain newlines or

191

# NUL bytes. So we prefix it and hex encode it.

192

encoded = b"mandos" + binascii.hexlify(password)

193

if len(encoded) > 2048:

194

# GnuPG can't handle long passwords, so encode differently

195

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

196

.replace(b"\n", b"\\n")

197

.replace(b"\0", b"\\x00"))

198

return encoded

199

200

def encrypt(self, data, password):

201

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

204

passfile.write(passphrase)

205

passfile.flush()

206

proc = subprocess.Popen(['gpg', '--symmetric',

207

'--passphrase-file',

208

passfile.name]

209

+ self.gnupgargs,

210

stdin = subprocess.PIPE,

211

stdout = subprocess.PIPE,

212

stderr = subprocess.PIPE)

213

ciphertext, err = proc.communicate(input = data)

214

if proc.returncode != 0:

215

raise PGPError(err)

216

return ciphertext

217

218

def decrypt(self, data, password):

219

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

222

passfile.write(passphrase)

223

passfile.flush()

224

proc = subprocess.Popen(['gpg', '--decrypt',

225

'--passphrase-file',

226

passfile.name]

227

+ self.gnupgargs,

228

stdin = subprocess.PIPE,

229

stdout = subprocess.PIPE,

230

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

232

if proc.returncode != 0:

233

raise PGPError(err)

234

return decrypted_plaintext

235

85

86

version = "1.3.1"

87

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

90

syslogger = (logging.handlers.SysLogHandler

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

address = str("/dev/log")))

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

236

103

237

104

class AvahiError(Exception):

238

105

def __init__(self, value, *args, **kwargs):

239

106

self.value = value

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

107

super(AvahiError, self).__init__(value, *args, **kwargs)

108

def __unicode__(self):

109

return unicode(repr(self.value))

243

110

244

111

class AvahiServiceError(AvahiError):

245

112

pass

246

113

247

248

114

class AvahiGroupError(AvahiError):

249

115

pass

250

116

257

123

Used to optionally bind to the specified interface.

258

124

name: string; Example: 'Mandos'

259

125

type: string; Example: '_mandos._tcp'.

260

See <https://www.iana.org/assignments/service-names-port-numbers>

126

See <http://www.dns-sd.org/ServiceTypes.html>

261

127

port: integer; what port to announce

262

128

TXT: list of strings; TXT record for the service

263

129

domain: string; Domain to publish on, default to .local if empty.

269

135

server: D-Bus Server

270

136

bus: dbus.SystemBus()

271

137

"""

272

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

139

servicetype = None, port = None, TXT = None,

140

domain = "", host = "", max_renames = 32768,

141

protocol = avahi.PROTO_UNSPEC, bus = None):

284

142

self.interface = interface

285

143

self.name = name

286

144

self.type = servicetype

295

153

self.server = None

296

154

self.bus = bus

297

155

self.entry_group_state_changed_match = None

298

299

def rename(self, remove=True):

156

def rename(self):

300

157

"""Derived from the Avahi example code"""

301

158

if self.rename_count >= self.max_renames:

302

159

logger.critical("No suitable Zeroconf service name found"

303

160

" after %i retries, exiting.",

304

161

self.rename_count)

305

162

raise AvahiServiceError("Too many renames")

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

309

164

logger.info("Changing Zeroconf service name to %r ...",

310

165

self.name)

311

if remove:

312

self.remove()

166

syslogger.setFormatter(logging.Formatter

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

169

% self.name))

170

self.remove()

313

171

try:

314

172

self.add()

315

173

except dbus.exceptions.DBusException as error:

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

324

174

logger.critical("DBusException: %s", error)

175

self.cleanup()

176

os._exit(1)

177

self.rename_count += 1

325

178

def remove(self):

326

179

"""Derived from the Avahi example code"""

327

180

if self.entry_group_state_changed_match is not None:

329

182

self.entry_group_state_changed_match = None

330

183

if self.group is not None:

331

184

self.group.Reset()

332

333

185

def add(self):

334

186

"""Derived from the Avahi example code"""

335

187

self.remove()

340

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

341

193

self.entry_group_state_changed_match = (

342

194

self.group.connect_to_signal(

343

'StateChanged', self.entry_group_state_changed))

195

'StateChanged', self .entry_group_state_changed))

344

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

345

197

self.name, self.type)

346

198

self.group.AddService(

352

204

dbus.UInt16(self.port),

353

205

avahi.string_array_to_txt_array(self.TXT))

354

206

self.group.Commit()

355

356

207

def entry_group_state_changed(self, state, error):

357

208

"""Derived from the Avahi example code"""

358

209

logger.debug("Avahi entry group state change: %i", state)

364

215

self.rename()

365

216

elif state == avahi.ENTRY_GROUP_FAILURE:

366

217

logger.critical("Avahi: Error in group state changed %s",

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

369

218

unicode(error))

219

raise AvahiGroupError("State changed: %s"

220

% unicode(error))

370

221

def cleanup(self):

371

222

"""Derived from the Avahi example code"""

372

223

if self.group is not None:

373

224

try:

374

225

self.group.Free()

375

226

except (dbus.exceptions.UnknownMethodException,

376

dbus.exceptions.DBusException):

227

dbus.exceptions.DBusException) as e:

377

228

pass

378

229

self.group = None

379

230

self.remove()

380

381

231

def server_state_changed(self, state, error=None):

382

232

"""Derived from the Avahi example code"""

383

233

logger.debug("Avahi server state change: %i", state)

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

390

241

if state in bad_states:

391

242

if bad_states[state] is not None:

392

243

if error is None:

395

246

logger.error(bad_states[state] + ": %r", error)

396

247

self.cleanup()

397

248

elif state == avahi.SERVER_RUNNING:

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

249

self.add()

410

250

else:

411

251

if error is None:

412

252

logger.debug("Unknown state: %r", state)

413

253

else:

414

254

logger.debug("Unknown state: %r: %r", state, error)

415

416

255

def activate(self):

417

256

"""Derived from the Avahi example code"""

418

257

if self.server is None:

422

261

follow_name_owner_changes=True),

423

262

avahi.DBUS_INTERFACE_SERVER)

424

263

self.server.connect_to_signal("StateChanged",

425

self.server_state_changed)

264

self.server_state_changed)

426

265

self.server_state_changed(self.server.GetState())

427

266

428

267

429

class AvahiServiceToSyslog(AvahiService):

430

def rename(self, *args, **kwargs):

431

"""Add the new name to the syslog messages"""

432

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

436

return ret

437

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

447

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

448

274

class Client(object):

449

275

"""A representation of a client host served by this server.

450

276

451

277

Attributes:

452

approved: bool(); 'None' if not yet approved/disapproved

278

_approved: bool(); 'None' if not yet approved/disapproved

453

279

approval_delay: datetime.timedelta(); Time to wait for approval

454

280

approval_duration: datetime.timedelta(); Duration of one approval

455

281

checker: subprocess.Popen(); a running checker process used

462

288

instance %(name)s can be used in the command.

463

289

checker_initiator_tag: a gobject event source tag, or None

464

290

created: datetime.datetime(); (UTC) object creation

465

client_structure: Object describing what attributes a client has

466

and is used for storing the client at exit

467

291

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

468

293

disable_initiator_tag: a gobject event source tag, or None

469

294

enabled: bool()

470

295

fingerprint: string (40 or 32 hexadecimal digits); used to

473

298

interval: datetime.timedelta(); How often to start a new checker

474

299

last_approval_request: datetime.datetime(); (UTC) or None

475

300

last_checked_ok: datetime.datetime(); (UTC) or None

476

last_checker_status: integer between 0 and 255 reflecting exit

477

status of last checker. -1 reflects crashed

478

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

481

last_enabled: datetime.datetime(); (UTC) or None

301

last_enabled: datetime.datetime(); (UTC)

482

302

name: string; from the config file, used in log messages and

483

303

D-Bus identifiers

484

304

secret: bytestring; sent verbatim (over TLS) to client

485

305

timeout: datetime.timedelta(); How long from last_checked_ok

486

306

until this client is disabled

487

extended_timeout: extra long timeout when secret has been sent

307

extended_timeout: extra long timeout when password has been sent

488

308

runtime_expansions: Allowed attributes for runtime expansion.

489

309

expires: datetime.datetime(); time (UTC) when a client will be

490

310

disabled, or None

491

server_settings: The server_settings dict from main()

492

311

"""

493

312

494

313

runtime_expansions = ("approval_delay", "approval_duration",

495

"created", "enabled", "expires",

496

"fingerprint", "host", "interval",

497

"last_approval_request", "last_checked_ok",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

498

316

"last_enabled", "name", "timeout")

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

510

511

@staticmethod

512

def config_parser(config):

513

"""Construct a new dict of client settings of this form:

514

{ client_name: {setting_name: value, ...}, ...}

515

with exceptions for any special settings as defined above.

516

NOTE: Must be a pure function. Must return the same result

517

value given the same arguments.

518

"""

519

settings = {}

520

for client_name in config.sections():

521

section = dict(config.items(client_name))

522

client = settings[client_name] = {}

523

524

client["host"] = section["host"]

525

# Reformat values from string types to Python types

526

client["approved_by_default"] = config.getboolean(

527

client_name, "approved_by_default")

528

client["enabled"] = config.getboolean(client_name,

529

"enabled")

530

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

534

client["fingerprint"] = (section["fingerprint"].upper()

535

.replace(" ", ""))

536

if "secret" in section:

537

client["secret"] = section["secret"].decode("base64")

538

elif "secfile" in section:

539

with open(os.path.expanduser(os.path.expandvars

540

(section["secfile"])),

541

"rb") as secfile:

542

client["secret"] = secfile.read()

543

else:

544

raise TypeError("No secret or secfile for section {}"

545

.format(section))

546

client["timeout"] = string_to_delta(section["timeout"])

547

client["extended_timeout"] = string_to_delta(

548

section["extended_timeout"])

549

client["interval"] = string_to_delta(section["interval"])

550

client["approval_delay"] = string_to_delta(

551

section["approval_delay"])

552

client["approval_duration"] = string_to_delta(

553

section["approval_duration"])

554

client["checker_command"] = section["checker"]

555

client["last_approval_request"] = None

556

client["last_checked_ok"] = None

557

client["last_checker_status"] = -2

558

559

return settings

560

561

def __init__(self, settings, name = None, server_settings=None):

317

318

def timeout_milliseconds(self):

319

"Return the 'timeout' attribute in milliseconds"

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

325

326

def interval_milliseconds(self):

327

"Return the 'interval' attribute in milliseconds"

328

return _timedelta_to_milliseconds(self.interval)

329

330

def approval_delay_milliseconds(self):

331

return _timedelta_to_milliseconds(self.approval_delay)

332

333

def __init__(self, name = None, disable_hook=None, config=None):

334

"""Note: the 'checker' key in 'config' sets the

335

'checker_command' attribute and *not* the 'checker'

336

attribute."""

562

337

self.name = name

563

if server_settings is None:

564

server_settings = {}

565

self.server_settings = server_settings

566

# adding all client settings

567

for setting, value in settings.items():

568

setattr(self, setting, value)

569

570

if self.enabled:

571

if not hasattr(self, "last_enabled"):

572

self.last_enabled = datetime.datetime.utcnow()

573

if not hasattr(self, "expires"):

574

self.expires = (datetime.datetime.utcnow()

575

+ self.timeout)

576

else:

577

self.last_enabled = None

578

self.expires = None

579

338

if config is None:

339

config = {}

580

340

logger.debug("Creating client %r", self.name)

341

# Uppercase and remove spaces from fingerprint for later

342

# comparison purposes with return value from the fingerprint()

343

# function

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

581

346

logger.debug(" Fingerprint: %s", self.fingerprint)

582

self.created = settings.get("created",

583

datetime.datetime.utcnow())

584

585

# attributes specific for this server instance

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

350

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

352

"rb") as secfile:

353

self.secret = secfile.read()

354

else:

355

raise TypeError("No secret or secfile for client %s"

356

% self.name)

357

self.host = config.get("host", "")

358

self.created = datetime.datetime.utcnow()

359

self.enabled = False

360

self.last_approval_request = None

361

self.last_enabled = None

362

self.last_checked_ok = None

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

366

self.disable_hook = disable_hook

586

367

self.checker = None

587

368

self.checker_initiator_tag = None

588

369

self.disable_initiator_tag = None

370

self.expires = None

589

371

self.checker_callback_tag = None

372

self.checker_command = config["checker"]

590

373

self.current_checker_command = None

591

self.approved = None

374

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

592

378

self.approvals_pending = 0

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

597

if not attr.startswith("_")]

598

self.client_structure.append("client_structure")

599

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

602

if not name.startswith("_"):

603

self.client_structure.append(name)

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

604

384

605

# Send notice to process children that client state has changed

606

385

def send_changedstate(self):

607

with self.changedstate:

608

self.changedstate.notify_all()

609

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

610

390

def enable(self):

611

391

"""Start this client's checker and timeout hooks"""

612

392

if getattr(self, "enabled", False):

613

393

# Already enabled

614

394

return

395

self.send_changedstate()

396

# Schedule a new checker to be started an 'interval' from now,

397

# and every interval from then on.

398

self.checker_initiator_tag = (gobject.timeout_add

399

(self.interval_milliseconds(),

400

self.start_checker))

401

# Schedule a disable() when 'timeout' has passed

615

402

self.expires = datetime.datetime.utcnow() + self.timeout

403

self.disable_initiator_tag = (gobject.timeout_add

404

(self.timeout_milliseconds(),

405

self.disable))

616

406

self.enabled = True

617

407

self.last_enabled = datetime.datetime.utcnow()

618

self.init_checker()

619

self.send_changedstate()

408

# Also start a new checker *right now*.

409

self.start_checker()

620

410

621

411

def disable(self, quiet=True):

622

412

"""Disable this client."""

623

413

if not getattr(self, "enabled", False):

624

414

return False

625

415

if not quiet:

416

self.send_changedstate()

417

if not quiet:

626

418

logger.info("Disabling client %s", self.name)

627

if getattr(self, "disable_initiator_tag", None) is not None:

419

if getattr(self, "disable_initiator_tag", False):

628

420

gobject.source_remove(self.disable_initiator_tag)

629

421

self.disable_initiator_tag = None

630

422

self.expires = None

631

if getattr(self, "checker_initiator_tag", None) is not None:

423

if getattr(self, "checker_initiator_tag", False):

632

424

gobject.source_remove(self.checker_initiator_tag)

633

425

self.checker_initiator_tag = None

634

426

self.stop_checker()

427

if self.disable_hook:

428

self.disable_hook(self)

635

429

self.enabled = False

636

if not quiet:

637

self.send_changedstate()

638

430

# Do not run this again if called by a gobject.timeout_add

639

431

return False

640

432

641

433

def __del__(self):

434

self.disable_hook = None

642

435

self.disable()

643

436

644

def init_checker(self):

645

# Schedule a new checker to be started an 'interval' from now,

646

# and every interval from then on.

647

if self.checker_initiator_tag is not None:

648

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

652

# Schedule a disable() when 'timeout' has passed

653

if self.disable_initiator_tag is not None:

654

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

657

# Also start a new checker *right now*.

658

self.start_checker()

659

660

def checker_callback(self, source, condition, connection,

661

command):

437

def checker_callback(self, pid, condition, command):

662

438

"""The checker has completed, so take appropriate actions."""

663

439

self.checker_callback_tag = None

664

440

self.checker = None

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

672

if self.last_checker_status == 0:

441

if os.WIFEXITED(condition):

442

exitstatus = os.WEXITSTATUS(condition)

443

if exitstatus == 0:

673

444

logger.info("Checker for %(name)s succeeded",

674

445

vars(self))

675

446

self.checked_ok()

676

447

else:

677

logger.info("Checker for %(name)s failed", vars(self))

448

logger.info("Checker for %(name)s failed",

449

vars(self))

678

450

else:

679

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

681

451

logger.warning("Checker for %(name)s crashed?",

682

452

vars(self))

683

return False

684

685

def checked_ok(self):

686

"""Assert that the client has been seen, alive and well."""

687

self.last_checked_ok = datetime.datetime.utcnow()

688

self.last_checker_status = 0

689

self.last_checker_signal = None

690

self.bump_timeout()

691

692

def bump_timeout(self, timeout=None):

693

"""Bump up the timeout for this client."""

453

454

def checked_ok(self, timeout=None):

455

"""Bump up the timeout for this client.

456

457

This should only be called when the client has been seen,

458

alive and well.

459

"""

694

460

if timeout is None:

695

461

timeout = self.timeout

696

if self.disable_initiator_tag is not None:

697

gobject.source_remove(self.disable_initiator_tag)

698

self.disable_initiator_tag = None

699

if getattr(self, "enabled", False):

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

702

self.expires = datetime.datetime.utcnow() + timeout

462

self.last_checked_ok = datetime.datetime.utcnow()

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

self.disable_initiator_tag = (gobject.timeout_add

466

(_timedelta_to_milliseconds(timeout),

467

self.disable))

703

468

704

469

def need_approval(self):

705

470

self.last_approval_request = datetime.datetime.utcnow()

710

475

If a checker already exists, leave it running and do

711

476

nothing."""

712

477

# The reason for not killing a running checker is that if we

713

# did that, and if a checker (for some reason) started running

714

# slowly and taking more than 'interval' time, then the client

715

# would inevitably timeout, since no checker would get a

716

# chance to run to completion. If we instead leave running

478

# did that, then if a checker (for some reason) started

479

# running slowly and taking more than 'interval' time, the

480

# client would inevitably timeout, since no checker would get

481

# a chance to run to completion. If we instead leave running

717

482

# checkers alone, the checker would have to take more time

718

483

# than 'timeout' for the client to be disabled, which is as it

719

484

# should be.

720

485

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

486

# If a checker exists, make sure it is not a zombie

487

try:

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

489

except (AttributeError, OSError) as error:

490

if (isinstance(error, OSError)

491

and error.errno != errno.ECHILD):

492

raise error

493

else:

494

if pid:

495

logger.warning("Checker was a zombie")

496

gobject.source_remove(self.checker_callback_tag)

497

self.checker_callback(pid, status,

498

self.current_checker_command)

725

499

# Start a new checker if needed

726

500

if self.checker is None:

727

# Escape attributes for the shell

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

731

501

try:

732

command = self.checker_command % escaped_attrs

733

except TypeError as error:

734

logger.error('Could not format string "%s"',

735

self.checker_command,

736

exc_info=error)

737

return True # Try again later

502

# In case checker_command has exactly one % operator

503

command = self.checker_command % self.host

504

except TypeError:

505

# Escape attributes for the shell

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

514

try:

515

command = self.checker_command % escaped_attrs

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

519

return True # Try again later

738

520

self.current_checker_command = command

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

521

try:

522

logger.info("Starting checker %r for %s",

523

command, self.name)

524

# We don't need to redirect stdout and stderr, since

525

# in normal mode, that is already done by daemon(),

526

# and in debug mode we don't want to. (Stdin is

527

# always replaced by /dev/null.)

528

self.checker = subprocess.Popen(command,

529

close_fds=True,

530

shell=True, cwd="/")

531

self.checker_callback_tag = (gobject.child_watch_add

532

(self.checker.pid,

533

self.checker_callback,

534

data=command))

535

# The checker may have completed before the gobject

536

# watch was added. Check for this.

537

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

538

if pid:

539

gobject.source_remove(self.checker_callback_tag)

540

self.checker_callback(pid, status, command)

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

543

error)

764

544

# Re-run this periodically if run by gobject.timeout_add

765

545

return True

766

546

772

552

if getattr(self, "checker", None) is None:

773

553

return

774

554

logger.debug("Stopping checker for %(name)s", vars(self))

775

self.checker.terminate()

555

try:

556

os.kill(self.checker.pid, signal.SIGTERM)

557

#time.sleep(0.5)

558

#if self.checker.poll() is None:

559

# os.kill(self.checker.pid, signal.SIGKILL)

560

except OSError as error:

561

if error.errno != errno.ESRCH: # No such process

562

raise

776

563

self.checker = None

777

564

778

565

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

783

568

"""Decorators for marking methods of a DBusObjectWithProperties to

784

569

become properties on the D-Bus.

785

570

794

579

# "Set" method, so we fail early here:

795

580

if byte_arrays and signature != "ay":

796

581

raise ValueError("Byte arrays not supported for non-'ay'"

797

" signature {!r}".format(signature))

798

582

" signature %r" % signature)

799

583

def decorator(func):

800

584

func._dbus_is_property = True

801

585

func._dbus_interface = dbus_interface

806

590

func._dbus_name = func._dbus_name[:-14]

807

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

808

592

return func

809

810

return decorator

811

812

813

def dbus_interface_annotations(dbus_interface):

814

"""Decorator for marking functions returning interface annotations

815

816

Usage:

817

818

@dbus_interface_annotations("org.example.Interface")

819

def _foo(self): # Function name does not matter

820

return {"org.freedesktop.DBus.Deprecated": "true",

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

822

"false"}

823

"""

824

825

def decorator(func):

826

func._dbus_is_interface = True

827

func._dbus_interface = dbus_interface

828

func._dbus_name = dbus_interface

829

return func

830

831

return decorator

832

833

834

def dbus_annotations(annotations):

835

"""Decorator to annotate D-Bus methods, signals or properties

836

Usage:

837

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

841

@dbus_service_property("org.example.Interface", signature="b",

842

access="r")

843

def Property_dbus_property(self):

844

return dbus.Boolean(False)

845

"""

846

847

def decorator(func):

848

func._dbus_annotations = annotations

849

return func

850

851

593

return decorator

852

594

853

595

854

596

class DBusPropertyException(dbus.exceptions.DBusException):

855

597

"""A base class for D-Bus property-related exceptions

856

598

"""

857

pass

599

def __unicode__(self):

600

return unicode(str(self))

858

601

859

602

860

603

class DBusPropertyAccessException(DBusPropertyException):

878

621

"""

879

622

880

623

@staticmethod

881

def _is_dbus_thing(thing):

882

"""Returns a function testing if an attribute is a D-Bus thing

883

884

If called like _is_dbus_thing("method") it returns a function

885

suitable for use as predicate to inspect.getmembers().

886

"""

887

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

888

False)

624

def _is_dbus_property(obj):

625

return getattr(obj, "_dbus_is_property", False)

889

626

890

def _get_all_dbus_things(self, thing):

627

def _get_all_dbus_properties(self):

891

628

"""Returns a generator of (name, attribute) pairs

892

629

"""

893

return ((getattr(athing.__get__(self), "_dbus_name", name),

894

athing.__get__(self))

895

for cls in self.__class__.__mro__

896

for name, athing in

897

inspect.getmembers(cls, self._is_dbus_thing(thing)))

630

return ((prop._dbus_name, prop)

631

for name, prop in

632

inspect.getmembers(self, self._is_dbus_property))

898

633

634

# def _get_dbus_property(self, interface_name, property_name):

635

# """Returns a bound method if one exists which is a D-Bus

636

# property with the specified name and interface.

637

# """

638

# print("get_property({0!r}, {1!r}".format(interface_name, property_name),file=sys.stderr)

639

# print(dir(self), sys.stderr)

640

# for name in (property_name,

641

# property_name + "_dbus_property"):

642

# prop = getattr(self, name, None)

643

# if (prop is None

644

# or not self._is_dbus_property(prop)

645

# or prop._dbus_name != property_name

646

# or (interface_name and prop._dbus_interface

647

# and interface_name != prop._dbus_interface)):

648

# continue

649

# return prop

650

# # No such property

651

# raise DBusPropertyNotFound(self.dbus_object_path + ":"

652

# + interface_name + "."

653

# + property_name)

654

899

655

def _get_dbus_property(self, interface_name, property_name):

900

656

"""Returns a bound method if one exists which is a D-Bus

901

657

property with the specified name and interface.

902

658

"""

903

for cls in self.__class__.__mro__:

904

for name, value in inspect.getmembers(

905

cls, self._is_dbus_thing("property")):

906

if (value._dbus_name == property_name

907

and value._dbus_interface == interface_name):

908

return value.__get__(self)

659

for name, value in inspect.getmembers(self, self._is_dbus_property):

660

if value._dbus_name == property_name and value._dbus_interface == interface_name:

661

return value

909

662

910

663

# No such property

911

raise DBusPropertyNotFound("{}:{}.{}".format(

912

self.dbus_object_path, interface_name, property_name))

664

raise DBusPropertyNotFound(self.dbus_object_path + ":"

665

+ interface_name + "."

666

+ property_name)

667

913

668

914

@dbus.service.method(dbus.PROPERTIES_IFACE,

915

in_signature="ss",

669

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

916

670

out_signature="v")

917

671

def Get(self, interface_name, property_name):

918

672

"""Standard D-Bus property Get() method, see D-Bus standard.

936

690

# The byte_arrays option is not supported yet on

937

691

# signatures other than "ay".

938

692

if prop._dbus_signature != "ay":

939

raise ValueError("Byte arrays not supported for non-"

940

"'ay' signature {!r}"

941

.format(prop._dbus_signature))

942

value = dbus.ByteArray(b''.join(chr(byte)

943

for byte in value))

693

raise ValueError

694

value = dbus.ByteArray(''.join(unichr(byte)

695

for byte in value))

944

696

prop(value)

945

697

946

@dbus.service.method(dbus.PROPERTIES_IFACE,

947

in_signature="s",

698

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

948

699

out_signature="a{sv}")

949

700

def GetAll(self, interface_name):

950

701

"""Standard D-Bus property GetAll() method, see D-Bus

952

703

953

704

Note: Will not include properties with access="write".

954

705

"""

955

properties = {}

956

for name, prop in self._get_all_dbus_things("property"):

706

all = {}

707

for name, prop in self._get_all_dbus_properties():

957

708

if (interface_name

958

709

and interface_name != prop._dbus_interface):

959

710

# Interface non-empty but did not match

963

714

continue

964

715

value = prop()

965

716

if not hasattr(value, "variant_level"):

966

properties[name] = value

717

all[name] = value

967

718

continue

968

properties[name] = type(value)(

969

value, variant_level = value.variant_level + 1)

970

return dbus.Dictionary(properties, signature="sv")

971

972

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

973

def PropertiesChanged(self, interface_name, changed_properties,

974

invalidated_properties):

975

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

976

standard.

977

"""

978

pass

719

all[name] = type(value)(value, variant_level=

720

value.variant_level+1)

721

return dbus.Dictionary(all, signature="sv")

979

722

980

723

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

981

724

out_signature="s",

982

725

path_keyword='object_path',

983

726

connection_keyword='connection')

984

727

def Introspect(self, object_path, connection):

985

"""Overloading of standard D-Bus method.

986

987

Inserts property tags and interface annotation tags.

728

"""Standard D-Bus method, overloaded to insert property tags.

988

729

"""

989

730

xmlstring = dbus.service.Object.Introspect(self, object_path,

990

731

connection)

991

732

try:

992

733

document = xml.dom.minidom.parseString(xmlstring)

993

994

734

def make_tag(document, name, prop):

995

735

e = document.createElement("property")

996

736

e.setAttribute("name", name)

997

737

e.setAttribute("type", prop._dbus_signature)

998

738

e.setAttribute("access", prop._dbus_access)

999

739

return e

1000

1001

740

for if_tag in document.getElementsByTagName("interface"):

1002

# Add property tags

1003

741

for tag in (make_tag(document, name, prop)

1004

742

for name, prop

1005

in self._get_all_dbus_things("property")

743

in self._get_all_dbus_properties()

1006

744

if prop._dbus_interface

1007

745

== if_tag.getAttribute("name")):

1008

746

if_tag.appendChild(tag)

1009

# Add annotation tags

1010

for typ in ("method", "signal", "property"):

1011

for tag in if_tag.getElementsByTagName(typ):

1012

annots = dict()

1013

for name, prop in (self.

1014

_get_all_dbus_things(typ)):

1015

if (name == tag.getAttribute("name")

1016

and prop._dbus_interface

1017

== if_tag.getAttribute("name")):

1018

annots.update(getattr(

1019

prop, "_dbus_annotations", {}))

1020

for name, value in annots.items():

1021

ann_tag = document.createElement(

1022

"annotation")

1023

ann_tag.setAttribute("name", name)

1024

ann_tag.setAttribute("value", value)

1025

tag.appendChild(ann_tag)

1026

# Add interface annotation tags

1027

for annotation, value in dict(

1028

itertools.chain.from_iterable(

1029

annotations().items()

1030

for name, annotations

1031

in self._get_all_dbus_things("interface")

1032

if name == if_tag.getAttribute("name")

1033

)).items():

1034

ann_tag = document.createElement("annotation")

1035

ann_tag.setAttribute("name", annotation)

1036

ann_tag.setAttribute("value", value)

1037

if_tag.appendChild(ann_tag)

1038

747

# Add the names to the return values for the

1039

748

# "org.freedesktop.DBus.Properties" methods

1040

749

if (if_tag.getAttribute("name")

1055

764

except (AttributeError, xml.dom.DOMException,

1056

765

xml.parsers.expat.ExpatError) as error:

1057

766

logger.error("Failed to override Introspection method",

1058

exc_info=error)

767

error)

1059

768

return xmlstring

1060

769

1061

770

1062

def datetime_to_dbus(dt, variant_level=0):

771

def datetime_to_dbus (dt, variant_level=0):

1063

772

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1064

773

if dt is None:

1065

774

return dbus.String("", variant_level = variant_level)

1066

return dbus.String(dt.isoformat(), variant_level=variant_level)

1067

1068

1069

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1070

"""A class decorator; applied to a subclass of

1071

dbus.service.Object, it will add alternate D-Bus attributes with

1072

interface names according to the "alt_interface_names" mapping.

1073

Usage:

1074

1075

@alternate_dbus_interfaces({"org.example.Interface":

1076

"net.example.AlternateInterface"})

1077

class SampleDBusObject(dbus.service.Object):

1078

@dbus.service.method("org.example.Interface")

1079

def SampleDBusMethod():

1080

pass

1081

1082

The above "SampleDBusMethod" on "SampleDBusObject" will be

1083

reachable via two interfaces: "org.example.Interface" and

1084

"net.example.AlternateInterface", the latter of which will have

1085

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1086

"true", unless "deprecate" is passed with a False value.

1087

1088

This works for methods and signals, and also for D-Bus properties

1089

(from DBusObjectWithProperties) and interfaces (from the

1090

dbus_interface_annotations decorator).

1091

"""

1092

1093

def wrapper(cls):

1094

for orig_interface_name, alt_interface_name in (

1095

alt_interface_names.items()):

1096

attr = {}

1097

interface_names = set()

1098

# Go though all attributes of the class

1099

for attrname, attribute in inspect.getmembers(cls):

1100

# Ignore non-D-Bus attributes, and D-Bus attributes

1101

# with the wrong interface name

1102

if (not hasattr(attribute, "_dbus_interface")

1103

or not attribute._dbus_interface.startswith(

1104

orig_interface_name)):

1105

continue

1106

# Create an alternate D-Bus interface name based on

1107

# the current name

1108

alt_interface = attribute._dbus_interface.replace(

1109

orig_interface_name, alt_interface_name)

1110

interface_names.add(alt_interface)

1111

# Is this a D-Bus signal?

1112

if getattr(attribute, "_dbus_is_signal", False):

1113

if sys.version_info.major == 2:

1114

# Extract the original non-method undecorated

1115

# function by black magic

1116

nonmethod_func = (dict(

1117

zip(attribute.func_code.co_freevars,

1118

attribute.__closure__))

1119

["func"].cell_contents)

1120

else:

1121

nonmethod_func = attribute

1122

# Create a new, but exactly alike, function

1123

# object, and decorate it to be a new D-Bus signal

1124

# with the alternate D-Bus interface name

1125

if sys.version_info.major == 2:

1126

new_function = types.FunctionType(

1127

nonmethod_func.func_code,

1128

nonmethod_func.func_globals,

1129

nonmethod_func.func_name,

1130

nonmethod_func.func_defaults,

1131

nonmethod_func.func_closure)

1132

else:

1133

new_function = types.FunctionType(

1134

nonmethod_func.__code__,

1135

nonmethod_func.__globals__,

1136

nonmethod_func.__name__,

1137

nonmethod_func.__defaults__,

1138

nonmethod_func.__closure__)

1139

new_function = (dbus.service.signal(

1140

alt_interface,

1141

attribute._dbus_signature)(new_function))

1142

# Copy annotations, if any

1143

try:

1144

new_function._dbus_annotations = dict(

1145

attribute._dbus_annotations)

1146

except AttributeError:

1147

pass

1148

# Define a creator of a function to call both the

1149

# original and alternate functions, so both the

1150

# original and alternate signals gets sent when

1151

# the function is called

1152

def fixscope(func1, func2):

1153

"""This function is a scope container to pass

1154

func1 and func2 to the "call_both" function

1155

outside of its arguments"""

1156

1157

def call_both(*args, **kwargs):

1158

"""This function will emit two D-Bus

1159

signals by calling func1 and func2"""

1160

func1(*args, **kwargs)

1161

func2(*args, **kwargs)

1162

1163

return call_both

1164

# Create the "call_both" function and add it to

1165

# the class

1166

attr[attrname] = fixscope(attribute, new_function)

1167

# Is this a D-Bus method?

1168

elif getattr(attribute, "_dbus_is_method", False):

1169

# Create a new, but exactly alike, function

1170

# object. Decorate it to be a new D-Bus method

1171

# with the alternate D-Bus interface name. Add it

1172

# to the class.

1173

attr[attrname] = (

1174

dbus.service.method(

1175

alt_interface,

1176

attribute._dbus_in_signature,

1177

attribute._dbus_out_signature)

1178

(types.FunctionType(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1183

# Copy annotations, if any

1184

try:

1185

attr[attrname]._dbus_annotations = dict(

1186

attribute._dbus_annotations)

1187

except AttributeError:

1188

pass

1189

# Is this a D-Bus property?

1190

elif getattr(attribute, "_dbus_is_property", False):

1191

# Create a new, but exactly alike, function

1192

# object, and decorate it to be a new D-Bus

1193

# property with the alternate D-Bus interface

1194

# name. Add it to the class.

1195

attr[attrname] = (dbus_service_property(

1196

alt_interface, attribute._dbus_signature,

1197

attribute._dbus_access,

1198

attribute._dbus_get_args_options

1199

["byte_arrays"])

1200

(types.FunctionType(

1201

attribute.func_code,

1202

attribute.func_globals,

1203

attribute.func_name,

1204

attribute.func_defaults,

1205

attribute.func_closure)))

1206

# Copy annotations, if any

1207

try:

1208

attr[attrname]._dbus_annotations = dict(

1209

attribute._dbus_annotations)

1210

except AttributeError:

1211

pass

1212

# Is this a D-Bus interface?

1213

elif getattr(attribute, "_dbus_is_interface", False):

1214

# Create a new, but exactly alike, function

1215

# object. Decorate it to be a new D-Bus interface

1216

# with the alternate D-Bus interface name. Add it

1217

# to the class.

1218

attr[attrname] = (

1219

dbus_interface_annotations(alt_interface)

1220

(types.FunctionType(attribute.func_code,

1221

attribute.func_globals,

1222

attribute.func_name,

1223

attribute.func_defaults,

1224

attribute.func_closure)))

1225

if deprecate:

1226

# Deprecate all alternate interfaces

1227

iname="_AlternateDBusNames_interface_annotation{}"

1228

for interface_name in interface_names:

1229

1230

@dbus_interface_annotations(interface_name)

1231

def func(self):

1232

return { "org.freedesktop.DBus.Deprecated":

1233

"true" }

1234

# Find an unused name

1235

for aname in (iname.format(i)

1236

for i in itertools.count()):

1237

if aname not in attr:

1238

attr[aname] = func

1239

break

1240

if interface_names:

1241

# Replace the class with a new subclass of it with

1242

# methods, signals, etc. as created above.

1243

cls = type(b"{}Alternate".format(cls.__name__),

1244

(cls, ), attr)

1245

return cls

1246

1247

return wrapper

1248

1249

1250

@alternate_dbus_interfaces({"se.recompile.Mandos":

1251

"se.bsnet.fukt.Mandos"})

775

return dbus.String(dt.isoformat(),

776

variant_level=variant_level)

777

778

class transitional_clientdbus(DBusObjectWithProperties.__metaclass__):

779

def __new__(mcs, name, bases, attr):

780

for key, old_dbusobj in attr.items():

781

new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")

782

if getattr(old_dbusobj, "_dbus_is_signal", False):

783

unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,

784

old_dbusobj.__closure__))["func"].cell_contents

785

newfunc = types.FunctionType(unwrappedfunc.func_code,

786

unwrappedfunc.func_globals,

787

unwrappedfunc.func_name,

788

unwrappedfunc.func_defaults,

789

unwrappedfunc.func_closure)

790

new_dbusfunc = dbus.service.signal(

791

new_interface, old_dbusobj._dbus_signature)(newfunc)

792

attr["_transitional_{0}_1".format(key)] = new_dbusfunc

793

attr["_transitional_{0}_0".format(key)] = old_dbusobj

794

def fixscope(func1, func2):

795

def newcall(*args, **kwargs):

796

func1(*args, **kwargs)

797

func2(*args, **kwargs)

798

return newcall

799

800

attr[key] = fixscope(

801

old_dbusobj, attr["_transitional_{0}_1".format(key)])

802

803

if getattr(old_dbusobj, "_dbus_is_method", False):

804

new_dbusfunc = (dbus.service.method

805

(new_interface,

806

old_dbusobj._dbus_in_signature,

807

old_dbusobj._dbus_out_signature)

808

(types.FunctionType

809

(old_dbusobj.func_code,

810

old_dbusobj.func_globals,

811

old_dbusobj.func_name,

812

old_dbusobj.func_defaults,

813

old_dbusobj.func_closure)))

814

815

attr["_transitional_{0}".format(key)] = new_dbusfunc

816

if getattr(old_dbusobj, "_dbus_is_property", False):

817

new_dbusfunc = (dbus_service_property

818

(new_interface,

819

old_dbusobj._dbus_signature,

820

old_dbusobj._dbus_access,

821

old_dbusobj._dbus_get_args_options["byte_arrays"])

822

(types.FunctionType

823

(old_dbusobj.func_code,

824

old_dbusobj.func_globals,

825

old_dbusobj.func_name,

826

old_dbusobj.func_defaults,

827

old_dbusobj.func_closure)))

828

829

attr["_transitional_{0}".format(key)] = new_dbusfunc

830

return type.__new__(mcs, name, bases, attr)

831

1252

832

class ClientDBus(Client, DBusObjectWithProperties):

1253

833

"""A Client class using D-Bus

1254

834

1258

838

"""

1259

839

1260

840

runtime_expansions = (Client.runtime_expansions

1261

+ ("dbus_object_path", ))

1262

1263

_interface = "se.recompile.Mandos.Client"

841

+ ("dbus_object_path",))

842

843

__metaclass__ = transitional_clientdbus

1264

844

1265

845

# dbus.service.Object doesn't use super(), so we can't either.

1266

846

1267

847

def __init__(self, bus = None, *args, **kwargs):

848

self._approvals_pending = 0

1268

849

self.bus = bus

1269

850

Client.__init__(self, *args, **kwargs)

1270

851

# Only now, when this client is initialized, can it show up on

1271

852

# the D-Bus

1272

client_object_name = str(self.name).translate(

853

client_object_name = unicode(self.name).translate(

1273

854

{ord("."): ord("_"),

1274

855

ord("-"): ord("_")})

1275

self.dbus_object_path = dbus.ObjectPath(

1276

"/clients/" + client_object_name)

856

self.dbus_object_path = (dbus.ObjectPath

857

("/clients/" + client_object_name))

1277

858

DBusObjectWithProperties.__init__(self, self.bus,

1278

859

self.dbus_object_path)

1279

1280

def notifychangeproperty(transform_func, dbus_name,

1281

type_func=lambda x: x,

1282

variant_level=1,

1283

invalidate_only=False,

1284

_interface=_interface):

1285

""" Modify a variable so that it's a property which announces

1286

its changes to DBus.

1287

860

1288

transform_fun: Function that takes a value and a variant_level

1289

and transforms it to a D-Bus type.

1290

dbus_name: D-Bus name of the variable

861

def notifychangeproperty(transform_func,

862

dbus_name, type_func=lambda x: x,

863

variant_level=1):

864

""" Modify a variable so that its a property that announce its

865

changes to DBus.

866

transform_fun: Function that takes a value and transform it to

867

DBus type.

868

dbus_name: DBus name of the variable

1291

869

type_func: Function that transform the value before sending it

1292

to the D-Bus. Default: no transform

1293

variant_level: D-Bus variant level. Default: 1

870

to DBus

871

variant_level: DBus variant level. default: 1

1294

872

"""

1295

attrname = "_{}".format(dbus_name)

1296

873

real_value = [None,]

1297

874

def setter(self, value):

875

old_value = real_value[0]

876

real_value[0] = value

1298

877

if hasattr(self, "dbus_object_path"):

1299

if (not hasattr(self, attrname) or

1300

type_func(getattr(self, attrname, None))

1301

!= type_func(value)):

1302

if invalidate_only:

1303

self.PropertiesChanged(

1304

_interface, dbus.Dictionary(),

1305

dbus.Array((dbus_name, )))

1306

else:

1307

dbus_value = transform_func(

1308

type_func(value),

1309

variant_level = variant_level)

1310

self.PropertyChanged(dbus.String(dbus_name),

1311

dbus_value)

1312

self.PropertiesChanged(

1313

_interface,

1314

dbus.Dictionary({ dbus.String(dbus_name):

1315

dbus_value }),

1316

dbus.Array())

1317

setattr(self, attrname, value)

878

if type_func(old_value) != type_func(real_value[0]):

879

dbus_value = transform_func(type_func(real_value[0]),

880

variant_level)

881

self.PropertyChanged(dbus.String(dbus_name),

882

dbus_value)

1318

883

1319

return property(lambda self: getattr(self, attrname), setter)

884

return property(lambda self: real_value[0], setter)

885

1320

886

1321

887

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1322

888

approvals_pending = notifychangeproperty(dbus.Boolean,

1325

891

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1326

892

last_enabled = notifychangeproperty(datetime_to_dbus,

1327

893

"LastEnabled")

1328

checker = notifychangeproperty(

1329

dbus.Boolean, "CheckerRunning",

1330

type_func = lambda checker: checker is not None)

894

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

895

type_func = lambda checker: checker is not None)

1331

896

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1332

897

"LastCheckedOK")

1333

last_checker_status = notifychangeproperty(dbus.Int16,

1334

"LastCheckerStatus")

1335

last_approval_request = notifychangeproperty(

1336

datetime_to_dbus, "LastApprovalRequest")

898

last_approval_request = notifychangeproperty(datetime_to_dbus,

899

"LastApprovalRequest")

1337

900

approved_by_default = notifychangeproperty(dbus.Boolean,

1338

901

"ApprovedByDefault")

1339

approval_delay = notifychangeproperty(

1340

dbus.UInt64, "ApprovalDelay",

1341

type_func = lambda td: td.total_seconds() * 1000)

1342

approval_duration = notifychangeproperty(

1343

dbus.UInt64, "ApprovalDuration",

1344

type_func = lambda td: td.total_seconds() * 1000)

902

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

903

type_func = _timedelta_to_milliseconds)

904

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

905

type_func = _timedelta_to_milliseconds)

1345

906

host = notifychangeproperty(dbus.String, "Host")

1346

timeout = notifychangeproperty(

1347

dbus.UInt64, "Timeout",

1348

type_func = lambda td: td.total_seconds() * 1000)

1349

extended_timeout = notifychangeproperty(

1350

dbus.UInt64, "ExtendedTimeout",

1351

type_func = lambda td: td.total_seconds() * 1000)

1352

interval = notifychangeproperty(

1353

dbus.UInt64, "Interval",

1354

type_func = lambda td: td.total_seconds() * 1000)

907

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

908

type_func = _timedelta_to_milliseconds)

909

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

910

type_func = _timedelta_to_milliseconds)

911

interval = notifychangeproperty(dbus.UInt16, "Interval",

912

type_func = _timedelta_to_milliseconds)

1355

913

checker_command = notifychangeproperty(dbus.String, "Checker")

1356

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1357

invalidate_only=True)

1358

914

1359

915

del notifychangeproperty

1360

916

1367

923

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1368

924

Client.__del__(self, *args, **kwargs)

1369

925

1370

def checker_callback(self, source, condition,

1371

connection, command, *args, **kwargs):

1372

ret = Client.checker_callback(self, source, condition,

1373

connection, command, *args,

1374

**kwargs)

1375

exitstatus = self.last_checker_status

1376

if exitstatus >= 0:

926

def checker_callback(self, pid, condition, command,

927

*args, **kwargs):

928

self.checker_callback_tag = None

929

self.checker = None

930

if os.WIFEXITED(condition):

931

exitstatus = os.WEXITSTATUS(condition)

1377

932

# Emit D-Bus signal

1378

933

self.CheckerCompleted(dbus.Int16(exitstatus),

1379

dbus.Int64(0),

934

dbus.Int64(condition),

1380

935

dbus.String(command))

1381

936

else:

1382

937

# Emit D-Bus signal

1383

938

self.CheckerCompleted(dbus.Int16(-1),

1384

dbus.Int64(

1385

self.last_checker_signal),

939

dbus.Int64(condition),

1386

940

dbus.String(command))

1387

return ret

941

942

return Client.checker_callback(self, pid, condition, command,

943

*args, **kwargs)

1388

944

1389

945

def start_checker(self, *args, **kwargs):

1390

old_checker_pid = getattr(self.checker, "pid", None)

946

old_checker = self.checker

947

if self.checker is not None:

948

old_checker_pid = self.checker.pid

949

else:

950

old_checker_pid = None

1391

951

r = Client.start_checker(self, *args, **kwargs)

1392

952

# Only if new checker process was started

1393

953

if (self.checker is not None

1397

957

return r

1398

958

1399

959

def _reset_approved(self):

1400

self.approved = None

960

self._approved = None

1401

961

return False

1402

962

1403

963

def approve(self, value=True):

1404

self.approved = value

1405

gobject.timeout_add(int(self.approval_duration.total_seconds()

1406

* 1000), self._reset_approved)

1407

964

self.send_changedstate()

965

self._approved = value

966

gobject.timeout_add(_timedelta_to_milliseconds

967

(self.approval_duration),

968

self._reset_approved)

969

1408

970

1409

971

## D-Bus methods, signals & properties

1410

1411

## Interfaces

1412

972

_interface = "se.bsnet.fukt.Mandos.Client"

973

1413

974

## Signals

1414

975

1415

976

# CheckerCompleted - signal

1425

986

pass

1426

987

1427

988

# PropertyChanged - signal

1428

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1429

989

@dbus.service.signal(_interface, signature="sv")

1430

990

def PropertyChanged(self, property, value):

1431

991

"D-Bus signal"

1495

1055

return dbus.Boolean(bool(self.approvals_pending))

1496

1056

1497

1057

# ApprovedByDefault - property

1498

@dbus_service_property(_interface,

1499

signature="b",

1058

@dbus_service_property(_interface, signature="b",

1500

1059

access="readwrite")

1501

1060

def ApprovedByDefault_dbus_property(self, value=None):

1502

1061

if value is None: # get

1504

1063

self.approved_by_default = bool(value)

1505

1064

1506

1065

# ApprovalDelay - property

1507

@dbus_service_property(_interface,

1508

signature="t",

1066

@dbus_service_property(_interface, signature="t",

1509

1067

access="readwrite")

1510

1068

def ApprovalDelay_dbus_property(self, value=None):

1511

1069

if value is None: # get

1512

return dbus.UInt64(self.approval_delay.total_seconds()

1513

* 1000)

1070

return dbus.UInt64(self.approval_delay_milliseconds())

1514

1071

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1515

1072

1516

1073

# ApprovalDuration - property

1517

@dbus_service_property(_interface,

1518

signature="t",

1074

@dbus_service_property(_interface, signature="t",

1519

1075

access="readwrite")

1520

1076

def ApprovalDuration_dbus_property(self, value=None):

1521

1077

if value is None: # get

1522

return dbus.UInt64(self.approval_duration.total_seconds()

1523

* 1000)

1078

return dbus.UInt64(_timedelta_to_milliseconds(

1079

self.approval_duration))

1524

1080

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1525

1081

1526

1082

# Name - property

1534

1090

return dbus.String(self.fingerprint)

1535

1091

1536

1092

# Host - property

1537

@dbus_service_property(_interface,

1538

signature="s",

1093

@dbus_service_property(_interface, signature="s",

1539

1094

access="readwrite")

1540

1095

def Host_dbus_property(self, value=None):

1541

1096

if value is None: # get

1542

1097

return dbus.String(self.host)

1543

self.host = str(value)

1098

self.host = value

1544

1099

1545

1100

# Created - property

1546

1101

@dbus_service_property(_interface, signature="s", access="read")

1547

1102

def Created_dbus_property(self):

1548

return datetime_to_dbus(self.created)

1103

return dbus.String(datetime_to_dbus(self.created))

1549

1104

1550

1105

# LastEnabled - property

1551

1106

@dbus_service_property(_interface, signature="s", access="read")

1553

1108

return datetime_to_dbus(self.last_enabled)

1554

1109

1555

1110

# Enabled - property

1556

@dbus_service_property(_interface,

1557

signature="b",

1111

@dbus_service_property(_interface, signature="b",

1558

1112

access="readwrite")

1559

1113

def Enabled_dbus_property(self, value=None):

1560

1114

if value is None: # get

1565

1119

self.disable()

1566

1120

1567

1121

# LastCheckedOK - property

1568

@dbus_service_property(_interface,

1569

signature="s",

1122

@dbus_service_property(_interface, signature="s",

1570

1123

access="readwrite")

1571

1124

def LastCheckedOK_dbus_property(self, value=None):

1572

1125

if value is not None:

1574

1127

return

1575

1128

return datetime_to_dbus(self.last_checked_ok)

1576

1129

1577

# LastCheckerStatus - property

1578

@dbus_service_property(_interface, signature="n", access="read")

1579

def LastCheckerStatus_dbus_property(self):

1580

return dbus.Int16(self.last_checker_status)

1581

1582

1130

# Expires - property

1583

1131

@dbus_service_property(_interface, signature="s", access="read")

1584

1132

def Expires_dbus_property(self):

1590

1138

return datetime_to_dbus(self.last_approval_request)

1591

1139

1592

1140

# Timeout - property

1593

@dbus_service_property(_interface,

1594

signature="t",

1141

@dbus_service_property(_interface, signature="t",

1595

1142

access="readwrite")

1596

1143

def Timeout_dbus_property(self, value=None):

1597

1144

if value is None: # get

1598

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1599

old_timeout = self.timeout

1145

return dbus.UInt64(self.timeout_milliseconds())

1600

1146

self.timeout = datetime.timedelta(0, 0, 0, value)

1601

# Reschedule disabling

1602

if self.enabled:

1603

now = datetime.datetime.utcnow()

1604

self.expires += self.timeout - old_timeout

1605

if self.expires <= now:

1606

# The timeout has passed

1607

self.disable()

1608

else:

1609

if (getattr(self, "disable_initiator_tag", None)

1610

is None):

1611

return

1612

gobject.source_remove(self.disable_initiator_tag)

1613

self.disable_initiator_tag = gobject.timeout_add(

1614

int((self.expires - now).total_seconds() * 1000),

1615

self.disable)

1147

if getattr(self, "disable_initiator_tag", None) is None:

1148

return

1149

# Reschedule timeout

1150

gobject.source_remove(self.disable_initiator_tag)

1151

self.disable_initiator_tag = None

1152

self.expires = None

1153

time_to_die = (self.

1154

_timedelta_to_milliseconds((self

1155

.last_checked_ok

1156

+ self.timeout)

1157

- datetime.datetime

1158

.utcnow()))

1159

if time_to_die <= 0:

1160

# The timeout has passed

1161

self.disable()

1162

else:

1163

self.expires = (datetime.datetime.utcnow()

1164

+ datetime.timedelta(milliseconds = time_to_die))

1165

self.disable_initiator_tag = (gobject.timeout_add

1166

(time_to_die, self.disable))

1616

1167

1617

1168

# ExtendedTimeout - property

1618

@dbus_service_property(_interface,

1619

signature="t",

1169

@dbus_service_property(_interface, signature="t",

1620

1170

access="readwrite")

1621

1171

def ExtendedTimeout_dbus_property(self, value=None):

1622

1172

if value is None: # get

1623

return dbus.UInt64(self.extended_timeout.total_seconds()

1624

* 1000)

1173

return dbus.UInt64(self.extended_timeout_milliseconds())

1625

1174

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1626

1175

1627

1176

# Interval - property

1628

@dbus_service_property(_interface,

1629

signature="t",

1177

@dbus_service_property(_interface, signature="t",

1630

1178

access="readwrite")

1631

1179

def Interval_dbus_property(self, value=None):

1632

1180

if value is None: # get

1633

return dbus.UInt64(self.interval.total_seconds() * 1000)

1181

return dbus.UInt64(self.interval_milliseconds())

1634

1182

self.interval = datetime.timedelta(0, 0, 0, value)

1635

1183

if getattr(self, "checker_initiator_tag", None) is None:

1636

1184

return

1637

if self.enabled:

1638

# Reschedule checker run

1639

gobject.source_remove(self.checker_initiator_tag)

1640

self.checker_initiator_tag = gobject.timeout_add(

1641

value, self.start_checker)

1642

self.start_checker() # Start one now, too

1185

# Reschedule checker run

1186

gobject.source_remove(self.checker_initiator_tag)

1187

self.checker_initiator_tag = (gobject.timeout_add

1188

(value, self.start_checker))

1189

self.start_checker() # Start one now, too

1643

1190

1644

1191

# Checker - property

1645

@dbus_service_property(_interface,

1646

signature="s",

1192

@dbus_service_property(_interface, signature="s",

1647

1193

access="readwrite")

1648

1194

def Checker_dbus_property(self, value=None):

1649

1195

if value is None: # get

1650

1196

return dbus.String(self.checker_command)

1651

self.checker_command = str(value)

1197

self.checker_command = value

1652

1198

1653

1199

# CheckerRunning - property

1654

@dbus_service_property(_interface,

1655

signature="b",

1200

@dbus_service_property(_interface, signature="b",

1656

1201

access="readwrite")

1657

1202

def CheckerRunning_dbus_property(self, value=None):

1658

1203

if value is None: # get

1668

1213

return self.dbus_object_path # is already a dbus.ObjectPath

1669

1214

1670

1215

# Secret = property

1671

@dbus_service_property(_interface,

1672

signature="ay",

1673

access="write",

1674

byte_arrays=True)

1216

@dbus_service_property(_interface, signature="ay",

1217

access="write", byte_arrays=True)

1675

1218

def Secret_dbus_property(self, value):

1676

self.secret = bytes(value)

1219

self.secret = str(value)

1677

1220

1678

1221

del _interface

1679

1222

1683

1226

self._pipe = child_pipe

1684

1227

self._pipe.send(('init', fpr, address))

1685

1228

if not self._pipe.recv():

1686

raise KeyError(fpr)

1229

raise KeyError()

1687

1230

1688

1231

def __getattribute__(self, name):

1689

if name == '_pipe':

1232

if(name == '_pipe'):

1690

1233

return super(ProxyClient, self).__getattribute__(name)

1691

1234

self._pipe.send(('getattr', name))

1692

1235

data = self._pipe.recv()

1693

1236

if data[0] == 'data':

1694

1237

return data[1]

1695

1238

if data[0] == 'function':

1696

1697

1239

def func(*args, **kwargs):

1698

1240

self._pipe.send(('funcall', name, args, kwargs))

1699

1241

return self._pipe.recv()[1]

1700

1701

1242

return func

1702

1243

1703

1244

def __setattr__(self, name, value):

1704

if name == '_pipe':

1245

if(name == '_pipe'):

1705

1246

return super(ProxyClient, self).__setattr__(name, value)

1706

1247

self._pipe.send(('setattr', name, value))

1707

1248

1715

1256

def handle(self):

1716

1257

with contextlib.closing(self.server.child_pipe) as child_pipe:

1717

1258

logger.info("TCP connection from: %s",

1718

str(self.client_address))

1259

unicode(self.client_address))

1719

1260

logger.debug("Pipe FD: %d",

1720

1261

self.server.child_pipe.fileno())

1721

1262

1722

session = gnutls.connection.ClientSession(

1723

self.request, gnutls.connection .X509Credentials())

1263

session = (gnutls.connection

1264

.ClientSession(self.request,

1265

gnutls.connection

1266

.X509Credentials()))

1724

1267

1725

1268

# Note: gnutls.connection.X509Credentials is really a

1726

1269

# generic GnuTLS certificate credentials object so long as

1735

1278

priority = self.server.gnutls_priority

1736

1279

if priority is None:

1737

1280

priority = "NORMAL"

1738

gnutls.library.functions.gnutls_priority_set_direct(

1739

session._c_object, priority, None)

1281

(gnutls.library.functions

1282

.gnutls_priority_set_direct(session._c_object,

1283

priority, None))

1740

1284

1741

1285

# Start communication using the Mandos protocol

1742

1286

# Get protocol number

1744

1288

logger.debug("Protocol version: %r", line)

1745

1289

try:

1746

1290

if int(line.strip().split()[0]) > 1:

1747

raise RuntimeError(line)

1291

raise RuntimeError

1748

1292

except (ValueError, IndexError, RuntimeError) as error:

1749

1293

logger.error("Unknown protocol version: %s", error)

1750

1294

return

1762

1306

approval_required = False

1763

1307

try:

1764

1308

try:

1765

fpr = self.fingerprint(

1766

self.peer_certificate(session))

1309

fpr = self.fingerprint(self.peer_certificate

1310

(session))

1767

1311

except (TypeError,

1768

1312

gnutls.errors.GNUTLSError) as error:

1769

1313

logger.warning("Bad certificate: %s", error)

1784

1328

while True:

1785

1329

if not client.enabled:

1786

1330

logger.info("Client %s is disabled",

1787

client.name)

1331

client.name)

1788

1332

if self.server.use_dbus:

1789

1333

# Emit D-Bus signal

1790

client.Rejected("Disabled")

1334

client.Rejected("Disabled")

1791

1335

return

1792

1336

1793

if client.approved or not client.approval_delay:

1337

if client._approved or not client.approval_delay:

1794

1338

#We are approved or approval is disabled

1795

1339

break

1796

elif client.approved is None:

1340

elif client._approved is None:

1797

1341

logger.info("Client %s needs approval",

1798

1342

client.name)

1799

1343

if self.server.use_dbus:

1800

1344

# Emit D-Bus signal

1801

1345

client.NeedApproval(

1802

client.approval_delay.total_seconds()

1803

* 1000, client.approved_by_default)

1346

client.approval_delay_milliseconds(),

1347

client.approved_by_default)

1804

1348

else:

1805

1349

logger.warning("Client %s was not approved",

1806

1350

client.name)

1810

1354

return

1811

1355

1812

1356

#wait until timeout or approved

1357

#x = float(client._timedelta_to_milliseconds(delay))

1813

1358

time = datetime.datetime.now()

1814

1359

client.changedstate.acquire()

1815

client.changedstate.wait(delay.total_seconds())

1360

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1816

1361

client.changedstate.release()

1817

1362

time2 = datetime.datetime.now()

1818

1363

if (time2 - time) >= delay:

1834

1379

try:

1835

1380

sent = session.send(client.secret[sent_size:])

1836

1381

except gnutls.errors.GNUTLSError as error:

1837

logger.warning("gnutls send failed",

1838

exc_info=error)

1382

logger.warning("gnutls send failed")

1839

1383

return

1840

logger.debug("Sent: %d, remaining: %d", sent,

1841

len(client.secret) - (sent_size

1842

+ sent))

1384

logger.debug("Sent: %d, remaining: %d",

1385

sent, len(client.secret)

1386

- (sent_size + sent))

1843

1387

sent_size += sent

1844

1388

1845

1389

logger.info("Sending secret to %s", client.name)

1846

# bump the timeout using extended_timeout

1847

client.bump_timeout(client.extended_timeout)

1390

# bump the timeout as if seen

1391

client.checked_ok(client.extended_timeout)

1848

1392

if self.server.use_dbus:

1849

1393

# Emit D-Bus signal

1850

1394

client.GotSecret()

1855

1399

try:

1856

1400

session.bye()

1857

1401

except gnutls.errors.GNUTLSError as error:

1858

logger.warning("GnuTLS bye failed",

1859

exc_info=error)

1402

logger.warning("GnuTLS bye failed")

1860

1403

1861

1404

@staticmethod

1862

1405

def peer_certificate(session):

1863

1406

"Return the peer's OpenPGP certificate as a bytestring"

1864

1407

# If not an OpenPGP certificate...

1865

if (gnutls.library.functions.gnutls_certificate_type_get(

1866

session._c_object)

1408

if (gnutls.library.functions

1409

.gnutls_certificate_type_get(session._c_object)

1867

1410

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1868

1411

# ...do the normal thing

1869

1412

return session.peer_certificate

1883

1426

def fingerprint(openpgp):

1884

1427

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1885

1428

# New GnuTLS "datum" with the OpenPGP public key

1886

datum = gnutls.library.types.gnutls_datum_t(

1887

ctypes.cast(ctypes.c_char_p(openpgp),

1888

ctypes.POINTER(ctypes.c_ubyte)),

1889

ctypes.c_uint(len(openpgp)))

1429

datum = (gnutls.library.types

1430

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1431

ctypes.POINTER

1432

(ctypes.c_ubyte)),

1433

ctypes.c_uint(len(openpgp))))

1890

1434

# New empty GnuTLS certificate

1891

1435

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1892

gnutls.library.functions.gnutls_openpgp_crt_init(

1893

ctypes.byref(crt))

1436

(gnutls.library.functions

1437

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1894

1438

# Import the OpenPGP public key into the certificate

1895

gnutls.library.functions.gnutls_openpgp_crt_import(

1896

crt, ctypes.byref(datum),

1897

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1439

(gnutls.library.functions

1440

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1441

gnutls.library.constants

1442

.GNUTLS_OPENPGP_FMT_RAW))

1898

1443

# Verify the self signature in the key

1899

1444

crtverify = ctypes.c_uint()

1900

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1901

crt, 0, ctypes.byref(crtverify))

1445

(gnutls.library.functions

1446

.gnutls_openpgp_crt_verify_self(crt, 0,

1447

ctypes.byref(crtverify)))

1902

1448

if crtverify.value != 0:

1903

1449

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1904

raise gnutls.errors.CertificateSecurityError(

1905

"Verify failed")

1450

raise (gnutls.errors.CertificateSecurityError

1451

("Verify failed"))

1906

1452

# New buffer for the fingerprint

1907

1453

buf = ctypes.create_string_buffer(20)

1908

1454

buf_len = ctypes.c_size_t()

1909

1455

# Get the fingerprint from the certificate into the buffer

1910

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1911

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1456

(gnutls.library.functions

1457

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1458

ctypes.byref(buf_len)))

1912

1459

# Deinit the certificate

1913

1460

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1914

1461

# Convert the buffer to a Python bytestring

1915

1462

fpr = ctypes.string_at(buf, buf_len.value)

1916

1463

# Convert the bytestring to hexadecimal notation

1917

hex_fpr = binascii.hexlify(fpr).upper()

1464

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1918

1465

return hex_fpr

1919

1466

1920

1467

1921

1468

class MultiprocessingMixIn(object):

1922

1469

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1923

1924

1470

def sub_process_main(self, request, address):

1925

1471

try:

1926

1472

self.finish_request(request, address)

1927

except Exception:

1473

except:

1928

1474

self.handle_error(request, address)

1929

1475

self.close_request(request)

1930

1476

1931

1477

def process_request(self, request, address):

1932

1478

"""Start a new process to process the request."""

1933

proc = multiprocessing.Process(target = self.sub_process_main,

1934

args = (request, address))

1935

proc.start()

1936

return proc

1479

multiprocessing.Process(target = self.sub_process_main,

1480

args = (request, address)).start()

1937

1481

1938

1482

1939

1483

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1940

1484

""" adds a pipe to the MixIn """

1941

1942

1485

def process_request(self, request, client_address):

1943

1486

"""Overrides and wraps the original process_request().

1944

1487

1946

1489

"""

1947

1490

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1948

1491

1949

proc = MultiprocessingMixIn.process_request(self, request,

1950

client_address)

1492

super(MultiprocessingMixInWithPipe,

1493

self).process_request(request, client_address)

1951

1494

self.child_pipe.close()

1952

self.add_pipe(parent_pipe, proc)

1495

self.add_pipe(parent_pipe)

1953

1496

1954

def add_pipe(self, parent_pipe, proc):

1497

def add_pipe(self, parent_pipe):

1955

1498

"""Dummy function; override as necessary"""

1956

raise NotImplementedError()

1499

raise NotImplementedError

1957

1500

1958

1501

1959

1502

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1965

1508

interface: None or a network interface name (string)

1966

1509

use_ipv6: Boolean; to use IPv6 or not

1967

1510

"""

1968

1969

1511

def __init__(self, server_address, RequestHandlerClass,

1970

interface=None,

1971

use_ipv6=True,

1972

socketfd=None):

1973

"""If socketfd is set, use that file descriptor instead of

1974

creating a new one with socket.socket().

1975

"""

1512

interface=None, use_ipv6=True):

1976

1513

self.interface = interface

1977

1514

if use_ipv6:

1978

1515

self.address_family = socket.AF_INET6

1979

if socketfd is not None:

1980

# Save the file descriptor

1981

self.socketfd = socketfd

1982

# Save the original socket.socket() function

1983

self.socket_socket = socket.socket

1984

# To implement --socket, we monkey patch socket.socket.

1985

#

1986

# (When socketserver.TCPServer is a new-style class, we

1987

# could make self.socket into a property instead of monkey

1988

# patching socket.socket.)

1989

#

1990

# Create a one-time-only replacement for socket.socket()

1991

@functools.wraps(socket.socket)

1992

def socket_wrapper(*args, **kwargs):

1993

# Restore original function so subsequent calls are

1994

# not affected.

1995

socket.socket = self.socket_socket

1996

del self.socket_socket

1997

# This time only, return a new socket object from the

1998

# saved file descriptor.

1999

return socket.fromfd(self.socketfd, *args, **kwargs)

2000

# Replace socket.socket() function with wrapper

2001

socket.socket = socket_wrapper

2002

# The socketserver.TCPServer.__init__ will call

2003

# socket.socket(), which might be our replacement,

2004

# socket_wrapper(), if socketfd was set.

2005

1516

socketserver.TCPServer.__init__(self, server_address,

2006

1517

RequestHandlerClass)

2007

2008

1518

def server_bind(self):

2009

1519

"""This overrides the normal server_bind() function

2010

1520

to bind to an interface if one was specified, and also NOT to

2016

1526

self.interface)

2017

1527

else:

2018

1528

try:

2019

self.socket.setsockopt(

2020

socket.SOL_SOCKET, SO_BINDTODEVICE,

2021

(self.interface + "\0").encode("utf-8"))

1529

self.socket.setsockopt(socket.SOL_SOCKET,

1530

SO_BINDTODEVICE,

1531

str(self.interface

1532

+ '\0'))

2022

1533

except socket.error as error:

2023

if error.errno == errno.EPERM:

2024

logger.error("No permission to bind to"

2025

" interface %s", self.interface)

2026

elif error.errno == errno.ENOPROTOOPT:

1534

if error[0] == errno.EPERM:

1535

logger.error("No permission to"

1536

" bind to interface %s",

1537

self.interface)

1538

elif error[0] == errno.ENOPROTOOPT:

2027

1539

logger.error("SO_BINDTODEVICE not available;"

2028

1540

" cannot bind to interface %s",

2029

1541

self.interface)

2030

elif error.errno == errno.ENODEV:

2031

logger.error("Interface %s does not exist,"

2032

" cannot bind", self.interface)

2033

1542

else:

2034

1543

raise

2035

1544

# Only bind(2) the socket if we really need to.

2038

1547

if self.address_family == socket.AF_INET6:

2039

1548

any_address = "::" # in6addr_any

2040

1549

else:

2041

any_address = "0.0.0.0" # INADDR_ANY

1550

any_address = socket.INADDR_ANY

2042

1551

self.server_address = (any_address,

2043

1552

self.server_address[1])

2044

1553

elif not self.server_address[1]:

2045

self.server_address = (self.server_address[0], 0)

1554

self.server_address = (self.server_address[0],

1555

0)

2046

1556

# if self.interface:

2047

1557

# self.server_address = (self.server_address[0],

2048

1558

# 0, # port

2062

1572

2063

1573

Assumes a gobject.MainLoop event loop.

2064

1574

"""

2065

2066

1575

def __init__(self, server_address, RequestHandlerClass,

2067

interface=None,

2068

use_ipv6=True,

2069

clients=None,

2070

gnutls_priority=None,

2071

use_dbus=True,

2072

socketfd=None):

1576

interface=None, use_ipv6=True, clients=None,

1577

gnutls_priority=None, use_dbus=True):

2073

1578

self.enabled = False

2074

1579

self.clients = clients

2075

1580

if self.clients is None:

2076

self.clients = {}

1581

self.clients = set()

2077

1582

self.use_dbus = use_dbus

2078

1583

self.gnutls_priority = gnutls_priority

2079

1584

IPv6_TCPServer.__init__(self, server_address,

2080

1585

RequestHandlerClass,

2081

1586

interface = interface,

2082

use_ipv6 = use_ipv6,

2083

socketfd = socketfd)

2084

1587

use_ipv6 = use_ipv6)

2085

1588

def server_activate(self):

2086

1589

if self.enabled:

2087

1590

return socketserver.TCPServer.server_activate(self)

2088

2089

1591

def enable(self):

2090

1592

self.enabled = True

2091

2092

def add_pipe(self, parent_pipe, proc):

1593

def add_pipe(self, parent_pipe):

2093

1594

# Call "handle_ipc" for both data and EOF events

2094

gobject.io_add_watch(

2095

parent_pipe.fileno(),

2096

gobject.IO_IN | gobject.IO_HUP,

2097

functools.partial(self.handle_ipc,

2098

parent_pipe = parent_pipe,

2099

proc = proc))

2100

2101

def handle_ipc(self, source, condition,

2102

parent_pipe=None,

2103

proc = None,

1595

gobject.io_add_watch(parent_pipe.fileno(),

1596

gobject.IO_IN | gobject.IO_HUP,

1597

functools.partial(self.handle_ipc,

1598

parent_pipe = parent_pipe))

1599

1600

def handle_ipc(self, source, condition, parent_pipe=None,

2104

1601

client_object=None):

2105

# error, or the other end of multiprocessing.Pipe has closed

2106

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2107

# Wait for other process to exit

2108

proc.join()

1602

condition_names = {

1603

gobject.IO_IN: "IN", # There is data to read.

1604

gobject.IO_OUT: "OUT", # Data can be written (without

1605

# blocking).

1606

gobject.IO_PRI: "PRI", # There is urgent data to read.

1607

gobject.IO_ERR: "ERR", # Error condition.

1608

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1609

# broken, usually for pipes and

1610

# sockets).

1611

}

1612

conditions_string = ' | '.join(name

1613

for cond, name in

1614

condition_names.iteritems()

1615

if cond & condition)

1616

# error or the other end of multiprocessing.Pipe has closed

1617

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2109

1618

return False

2110

1619

2111

1620

# Read a request from the child

2116

1625

fpr = request[1]

2117

1626

address = request[2]

2118

1627

2119

for c in self.clients.itervalues():

1628

for c in self.clients:

2120

1629

if c.fingerprint == fpr:

2121

1630

client = c

2122

1631

break

2125

1634

"dress: %s", fpr, address)

2126

1635

if self.use_dbus:

2127

1636

# Emit D-Bus signal

2128

mandos_dbus_service.ClientNotFound(fpr,

2129

address[0])

1637

mandos_dbus_service.ClientNotFound(fpr, address[0])

2130

1638

parent_pipe.send(False)

2131

1639

return False

2132

1640

2133

gobject.io_add_watch(

2134

parent_pipe.fileno(),

2135

gobject.IO_IN | gobject.IO_HUP,

2136

functools.partial(self.handle_ipc,

2137

parent_pipe = parent_pipe,

2138

proc = proc,

2139

client_object = client))

1641

gobject.io_add_watch(parent_pipe.fileno(),

1642

gobject.IO_IN | gobject.IO_HUP,

1643

functools.partial(self.handle_ipc,

1644

parent_pipe = parent_pipe,

1645

client_object = client))

2140

1646

parent_pipe.send(True)

2141

# remove the old hook in favor of the new above hook on

2142

# same fileno

1647

# remove the old hook in favor of the new above hook on same fileno

2143

1648

return False

2144

1649

if command == 'funcall':

2145

1650

funcname = request[1]

2146

1651

args = request[2]

2147

1652

kwargs = request[3]

2148

1653

2149

parent_pipe.send(('data', getattr(client_object,

2150

funcname)(*args,

2151

**kwargs)))

1654

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

2152

1655

2153

1656

if command == 'getattr':

2154

1657

attrname = request[1]

2155

if isinstance(client_object.__getattribute__(attrname),

2156

collections.Callable):

2157

parent_pipe.send(('function', ))

1658

if callable(client_object.__getattribute__(attrname)):

1659

parent_pipe.send(('function',))

2158

1660

else:

2159

parent_pipe.send((

2160

'data', client_object.__getattribute__(attrname)))

1661

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2161

1662

2162

1663

if command == 'setattr':

2163

1664

attrname = request[1]

2167

1668

return True

2168

1669

2169

1670

2170

def rfc3339_duration_to_delta(duration):

2171

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2172

2173

>>> rfc3339_duration_to_delta("P7D")

2174

datetime.timedelta(7)

2175

>>> rfc3339_duration_to_delta("PT60S")

2176

datetime.timedelta(0, 60)

2177

>>> rfc3339_duration_to_delta("PT60M")

2178

datetime.timedelta(0, 3600)

2179

>>> rfc3339_duration_to_delta("PT24H")

2180

datetime.timedelta(1)

2181

>>> rfc3339_duration_to_delta("P1W")

2182

datetime.timedelta(7)

2183

>>> rfc3339_duration_to_delta("PT5M30S")

2184

datetime.timedelta(0, 330)

2185

>>> rfc3339_duration_to_delta("P1DT3M20S")

2186

datetime.timedelta(1, 200)

2187

"""

2188

2189

# Parsing an RFC 3339 duration with regular expressions is not

2190

# possible - there would have to be multiple places for the same

2191

# values, like seconds. The current code, while more esoteric, is

2192

# cleaner without depending on a parsing library. If Python had a

2193

# built-in library for parsing we would use it, but we'd like to

2194

# avoid excessive use of external libraries.

2195

2196

# New type for defining tokens, syntax, and semantics all-in-one

2197

Token = collections.namedtuple("Token", (

2198

"regexp", # To match token; if "value" is not None, must have

2199

# a "group" containing digits

2200

"value", # datetime.timedelta or None

2201

"followers")) # Tokens valid after this token

2202

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2203

# the "duration" ABNF definition in RFC 3339, Appendix A.

2204

token_end = Token(re.compile(r"$"), None, frozenset())

2205

token_second = Token(re.compile(r"(\d+)S"),

2206

datetime.timedelta(seconds=1),

2207

frozenset((token_end, )))

2208

token_minute = Token(re.compile(r"(\d+)M"),

2209

datetime.timedelta(minutes=1),

2210

frozenset((token_second, token_end)))

2211

token_hour = Token(re.compile(r"(\d+)H"),

2212

datetime.timedelta(hours=1),

2213

frozenset((token_minute, token_end)))

2214

token_time = Token(re.compile(r"T"),

2215

None,

2216

frozenset((token_hour, token_minute,

2217

token_second)))

2218

token_day = Token(re.compile(r"(\d+)D"),

2219

datetime.timedelta(days=1),

2220

frozenset((token_time, token_end)))

2221

token_month = Token(re.compile(r"(\d+)M"),

2222

datetime.timedelta(weeks=4),

2223

frozenset((token_day, token_end)))

2224

token_year = Token(re.compile(r"(\d+)Y"),

2225

datetime.timedelta(weeks=52),

2226

frozenset((token_month, token_end)))

2227

token_week = Token(re.compile(r"(\d+)W"),

2228

datetime.timedelta(weeks=1),

2229

frozenset((token_end, )))

2230

token_duration = Token(re.compile(r"P"), None,

2231

frozenset((token_year, token_month,

2232

token_day, token_time,

2233

token_week)))

2234

# Define starting values

2235

value = datetime.timedelta() # Value so far

2236

found_token = None

2237

followers = frozenset((token_duration, )) # Following valid tokens

2238

s = duration # String left to parse

2239

# Loop until end token is found

2240

while found_token is not token_end:

2241

# Search for any currently valid tokens

2242

for token in followers:

2243

match = token.regexp.match(s)

2244

if match is not None:

2245

# Token found

2246

if token.value is not None:

2247

# Value found, parse digits

2248

factor = int(match.group(1), 10)

2249

# Add to value so far

2250

value += factor * token.value

2251

# Strip token from string

2252

s = token.regexp.sub("", s, 1)

2253

# Go to found token

2254

found_token = token

2255

# Set valid next tokens

2256

followers = found_token.followers

2257

break

2258

else:

2259

# No currently valid tokens were found

2260

raise ValueError("Invalid RFC 3339 duration: {!r}"

2261

.format(duration))

2262

# End token found

2263

return value

2264

2265

2266

1671

def string_to_delta(interval):

2267

1672

"""Parse a string and return a datetime.timedelta

2268

1673

2279

1684

>>> string_to_delta('5m 30s')

2280

1685

datetime.timedelta(0, 330)

2281

1686

"""

2282

2283

try:

2284

return rfc3339_duration_to_delta(interval)

2285

except ValueError:

2286

pass

2287

2288

1687

timevalue = datetime.timedelta(0)

2289

1688

for s in interval.split():

2290

1689

try:

2291

suffix = s[-1]

1690

suffix = unicode(s[-1])

2292

1691

value = int(s[:-1])

2293

1692

if suffix == "d":

2294

1693

delta = datetime.timedelta(value)

2301

1700

elif suffix == "w":

2302

1701

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2303

1702

else:

2304

raise ValueError("Unknown suffix {!r}".format(suffix))

2305

except IndexError as e:

1703

raise ValueError("Unknown suffix %r" % suffix)

1704

except (ValueError, IndexError) as e:

2306

1705

raise ValueError(*(e.args))

2307

1706

timevalue += delta

2308

1707

return timevalue

2309

1708

2310

1709

1710

def if_nametoindex(interface):

1711

"""Call the C function if_nametoindex(), or equivalent

1712

1713

Note: This function cannot accept a unicode string."""

1714

global if_nametoindex

1715

try:

1716

if_nametoindex = (ctypes.cdll.LoadLibrary

1717

(ctypes.util.find_library("c"))

1718

.if_nametoindex)

1719

except (OSError, AttributeError):

1720

logger.warning("Doing if_nametoindex the hard way")

1721

def if_nametoindex(interface):

1722

"Get an interface index the hard way, i.e. using fcntl()"

1723

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1724

with contextlib.closing(socket.socket()) as s:

1725

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1726

struct.pack(str("16s16x"),

1727

interface))

1728

interface_index = struct.unpack(str("I"),

1729

ifreq[16:20])[0]

1730

return interface_index

1731

return if_nametoindex(interface)

1732

1733

2311

1734

def daemon(nochdir = False, noclose = False):

2312

1735

"""See daemon(3). Standard BSD Unix function.

2313

1736

2321

1744

sys.exit()

2322

1745

if not noclose:

2323

1746

# Close all standard open file descriptors

2324

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1747

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2325

1748

if not stat.S_ISCHR(os.fstat(null).st_mode):

2326

1749

raise OSError(errno.ENODEV,

2327

"{} not a character device"

2328

.format(os.devnull))

1750

"%s not a character device"

1751

% os.path.devnull)

2329

1752

os.dup2(null, sys.stdin.fileno())

2330

1753

os.dup2(null, sys.stdout.fileno())

2331

1754

os.dup2(null, sys.stderr.fileno())

2340

1763

2341

1764

parser = argparse.ArgumentParser()

2342

1765

parser.add_argument("-v", "--version", action="version",

2343

version = "%(prog)s {}".format(version),

1766

version = "%%(prog)s %s" % version,

2344

1767

help="show version number and exit")

2345

1768

parser.add_argument("-i", "--interface", metavar="IF",

2346

1769

help="Bind to interface IF")

2352

1775

help="Run self-test")

2353

1776

parser.add_argument("--debug", action="store_true",

2354

1777

help="Debug mode; run in foreground and log"

2355

" to terminal", default=None)

1778

" to terminal")

2356

1779

parser.add_argument("--debuglevel", metavar="LEVEL",

2357

1780

help="Debug level for stdout output")

2358

1781

parser.add_argument("--priority", help="GnuTLS"

2365

1788

" files")

2366

1789

parser.add_argument("--no-dbus", action="store_false",

2367

1790

dest="use_dbus", help="Do not provide D-Bus"

2368

" system bus interface", default=None)

1791

" system bus interface")

2369

1792

parser.add_argument("--no-ipv6", action="store_false",

2370

dest="use_ipv6", help="Do not use IPv6",

2371

default=None)

2372

parser.add_argument("--no-restore", action="store_false",

2373

dest="restore", help="Do not restore stored"

2374

" state", default=None)

2375

parser.add_argument("--socket", type=int,

2376

help="Specify a file descriptor to a network"

2377

" socket to use instead of creating one")

2378

parser.add_argument("--statedir", metavar="DIR",

2379

help="Directory to save/restore state in")

2380

parser.add_argument("--foreground", action="store_true",

2381

help="Run in foreground", default=None)

2382

parser.add_argument("--no-zeroconf", action="store_false",

2383

dest="zeroconf", help="Do not use Zeroconf",

2384

default=None)

2385

1793

dest="use_ipv6", help="Do not use IPv6")

2386

1794

options = parser.parse_args()

2387

1795

2388

1796

if options.check:

2389

1797

import doctest

2390

fail_count, test_count = doctest.testmod()

2391

sys.exit(os.EX_OK if fail_count == 0 else 1)

1798

doctest.testmod()

1799

sys.exit()

2392

1800

2393

1801

# Default values for config file for server-global settings

2394

1802

server_defaults = { "interface": "",

2396

1804

"port": "",

2397

1805

"debug": "False",

2398

1806

"priority":

2399

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2400

":+SIGN-DSA-SHA256",

1807

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2401

1808

"servicename": "Mandos",

2402

1809

"use_dbus": "True",

2403

1810

"use_ipv6": "True",

2404

1811

"debuglevel": "",

2405

"restore": "True",

2406

"socket": "",

2407

"statedir": "/var/lib/mandos",

2408

"foreground": "False",

2409

"zeroconf": "True",

2410

}

1812

}

2411

1813

2412

1814

# Parse config file for server-global settings

2413

1815

server_config = configparser.SafeConfigParser(server_defaults)

2414

1816

del server_defaults

2415

server_config.read(os.path.join(options.configdir, "mandos.conf"))

1817

server_config.read(os.path.join(options.configdir,

1818

"mandos.conf"))

2416

1819

# Convert the SafeConfigParser object to a dict

2417

1820

server_settings = server_config.defaults()

2418

1821

# Use the appropriate methods on the non-string config options

2419

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

1822

for option in ("debug", "use_dbus", "use_ipv6"):

2420

1823

server_settings[option] = server_config.getboolean("DEFAULT",

2421

1824

option)

2422

1825

if server_settings["port"]:

2423

1826

server_settings["port"] = server_config.getint("DEFAULT",

2424

1827

"port")

2425

if server_settings["socket"]:

2426

server_settings["socket"] = server_config.getint("DEFAULT",

2427

"socket")

2428

# Later, stdin will, and stdout and stderr might, be dup'ed

2429

# over with an opened os.devnull. But we don't want this to

2430

# happen with a supplied network socket.

2431

if 0 <= server_settings["socket"] <= 2:

2432

server_settings["socket"] = os.dup(server_settings

2433

["socket"])

2434

1828

del server_config

2435

1829

2436

1830

# Override the settings from the config file with command line

2437

1831

# options, if set.

2438

1832

for option in ("interface", "address", "port", "debug",

2439

"priority", "servicename", "configdir", "use_dbus",

2440

"use_ipv6", "debuglevel", "restore", "statedir",

2441

"socket", "foreground", "zeroconf"):

1833

"priority", "servicename", "configdir",

1834

"use_dbus", "use_ipv6", "debuglevel"):

2442

1835

value = getattr(options, option)

2443

1836

if value is not None:

2444

1837

server_settings[option] = value

2445

1838

del options

2446

1839

# Force all strings to be unicode

2447

1840

for option in server_settings.keys():

2448

if isinstance(server_settings[option], bytes):

2449

server_settings[option] = (server_settings[option]

2450

.decode("utf-8"))

2451

# Force all boolean options to be boolean

2452

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2453

"foreground", "zeroconf"):

2454

server_settings[option] = bool(server_settings[option])

2455

# Debug implies foreground

2456

if server_settings["debug"]:

2457

server_settings["foreground"] = True

1841

if type(server_settings[option]) is str:

1842

server_settings[option] = unicode(server_settings[option])

2458

1843

# Now we have our good server settings in "server_settings"

2459

1844

2460

1845

##################################################################

2461

1846

2462

if (not server_settings["zeroconf"]

2463

and not (server_settings["port"]

2464

or server_settings["socket"] != "")):

2465

parser.error("Needs port or socket to work without Zeroconf")

2466

2467

1847

# For convenience

2468

1848

debug = server_settings["debug"]

2469

1849

debuglevel = server_settings["debuglevel"]

2470

1850

use_dbus = server_settings["use_dbus"]

2471

1851

use_ipv6 = server_settings["use_ipv6"]

2472

stored_state_path = os.path.join(server_settings["statedir"],

2473

stored_state_file)

2474

foreground = server_settings["foreground"]

2475

zeroconf = server_settings["zeroconf"]

2476

2477

if debug:

2478

initlogger(debug, logging.DEBUG)

2479

else:

2480

if not debuglevel:

2481

initlogger(debug)

2482

else:

2483

level = getattr(logging, debuglevel.upper())

2484

initlogger(debug, level)

2485

1852

2486

1853

if server_settings["servicename"] != "Mandos":

2487

syslogger.setFormatter(

2488

logging.Formatter('Mandos ({}) [%(process)d]:'

2489

' %(levelname)s: %(message)s'.format(

2490

server_settings["servicename"])))

1854

syslogger.setFormatter(logging.Formatter

1855

('Mandos (%s) [%%(process)d]:'

1856

' %%(levelname)s: %%(message)s'

1857

% server_settings["servicename"]))

2491

1858

2492

1859

# Parse config file with clients

2493

client_config = configparser.SafeConfigParser(Client

2494

.client_defaults)

1860

client_defaults = { "timeout": "5m",

1861

"extended_timeout": "15m",

1862

"interval": "2m",

1863

"checker": "fping -q -- %%(host)s",

1864

"host": "",

1865

"approval_delay": "0s",

1866

"approval_duration": "1s",

1867

}

1868

client_config = configparser.SafeConfigParser(client_defaults)

2495

1869

client_config.read(os.path.join(server_settings["configdir"],

2496

1870

"clients.conf"))

2497

1871

2498

1872

global mandos_dbus_service

2499

1873

mandos_dbus_service = None

2500

1874

2501

socketfd = None

2502

if server_settings["socket"] != "":

2503

socketfd = server_settings["socket"]

2504

tcp_server = MandosServer(

2505

(server_settings["address"], server_settings["port"]),

2506

ClientHandler,

2507

interface=(server_settings["interface"] or None),

2508

use_ipv6=use_ipv6,

2509

gnutls_priority=server_settings["priority"],

2510

use_dbus=use_dbus,

2511

socketfd=socketfd)

2512

if not foreground:

2513

pidfilename = "/run/mandos.pid"

2514

if not os.path.isdir("/run/."):

2515

pidfilename = "/var/run/mandos.pid"

2516

pidfile = None

1875

tcp_server = MandosServer((server_settings["address"],

1876

server_settings["port"]),

1877

ClientHandler,

1878

interface=(server_settings["interface"]

1879

or None),

1880

use_ipv6=use_ipv6,

1881

gnutls_priority=

1882

server_settings["priority"],

1883

use_dbus=use_dbus)

1884

if not debug:

1885

pidfilename = "/var/run/mandos.pid"

2517

1886

try:

2518

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2519

except IOError as e:

2520

logger.error("Could not open file %r", pidfilename,

2521

exc_info=e)

1887

pidfile = open(pidfilename, "w")

1888

except IOError:

1889

logger.error("Could not open file %r", pidfilename)

2522

1890

2523

for name in ("_mandos", "mandos", "nobody"):

1891

try:

1892

uid = pwd.getpwnam("_mandos").pw_uid

1893

gid = pwd.getpwnam("_mandos").pw_gid

1894

except KeyError:

2524

1895

try:

2525

uid = pwd.getpwnam(name).pw_uid

2526

gid = pwd.getpwnam(name).pw_gid

2527

break

1896

uid = pwd.getpwnam("mandos").pw_uid

1897

gid = pwd.getpwnam("mandos").pw_gid

2528

1898

except KeyError:

2529

continue

2530

else:

2531

uid = 65534

2532

gid = 65534

1899

try:

1900

uid = pwd.getpwnam("nobody").pw_uid

1901

gid = pwd.getpwnam("nobody").pw_gid

1902

except KeyError:

1903

uid = 65534

1904

gid = 65534

2533

1905

try:

2534

1906

os.setgid(gid)

2535

1907

os.setuid(uid)

2536

1908

except OSError as error:

2537

if error.errno != errno.EPERM:

2538

raise

1909

if error[0] != errno.EPERM:

1910

raise error

1911

1912

if not debug and not debuglevel:

1913

syslogger.setLevel(logging.WARNING)

1914

console.setLevel(logging.WARNING)

1915

if debuglevel:

1916

level = getattr(logging, debuglevel.upper())

1917

syslogger.setLevel(level)

1918

console.setLevel(level)

2539

1919

2540

1920

if debug:

2541

1921

# Enable all possible GnuTLS debugging

2548

1928

def debug_gnutls(level, string):

2549

1929

logger.debug("GnuTLS: %s", string[:-1])

2550

1930

2551

gnutls.library.functions.gnutls_global_set_log_function(

2552

debug_gnutls)

1931

(gnutls.library.functions

1932

.gnutls_global_set_log_function(debug_gnutls))

2553

1933

2554

1934

# Redirect stdin so all checkers get /dev/null

2555

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1935

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2556

1936

os.dup2(null, sys.stdin.fileno())

2557

1937

if null > 2:

2558

1938

os.close(null)

1939

else:

1940

# No console logging

1941

logger.removeHandler(console)

2559

1942

2560

1943

# Need to fork before connecting to D-Bus

2561

if not foreground:

1944

if not debug:

2562

1945

# Close all input and output, do double fork, etc.

2563

1946

daemon()

2564

1947

2565

# multiprocessing will use threads, so before we use gobject we

2566

# need to inform gobject that threads will be used.

2567

gobject.threads_init()

2568

2569

1948

global main_loop

2570

1949

# From the Avahi example code

2571

DBusGMainLoop(set_as_default=True)

1950

DBusGMainLoop(set_as_default=True )

2572

1951

main_loop = gobject.MainLoop()

2573

1952

bus = dbus.SystemBus()

2574

1953

# End of Avahi example code

2575

1954

if use_dbus:

2576

1955

try:

2577

bus_name = dbus.service.BusName("se.recompile.Mandos",

2578

bus,

2579

do_not_queue=True)

2580

old_bus_name = dbus.service.BusName(

2581

"se.bsnet.fukt.Mandos", bus,

2582

do_not_queue=True)

2583

except dbus.exceptions.DBusException as e:

2584

logger.error("Disabling D-Bus:", exc_info=e)

1956

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1957

bus, do_not_queue=True)

1958

bus_name2 = dbus.service.BusName("se.recompile.Mandos",

1959

bus, do_not_queue=True)

1960

except dbus.exceptions.NameExistsException as e:

1961

logger.error(unicode(e) + ", disabling D-Bus")

2585

1962

use_dbus = False

2586

1963

server_settings["use_dbus"] = False

2587

1964

tcp_server.use_dbus = False

2588

if zeroconf:

2589

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2590

service = AvahiServiceToSyslog(

2591

name = server_settings["servicename"],

2592

servicetype = "_mandos._tcp",

2593

protocol = protocol,

2594

bus = bus)

2595

if server_settings["interface"]:

2596

service.interface = if_nametoindex(

2597

server_settings["interface"].encode("utf-8"))

1965

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1966

service = AvahiService(name = server_settings["servicename"],

1967

servicetype = "_mandos._tcp",

1968

protocol = protocol, bus = bus)

1969

if server_settings["interface"]:

1970

service.interface = (if_nametoindex

1971

(str(server_settings["interface"])))

2598

1972

2599

1973

global multiprocessing_manager

2600

1974

multiprocessing_manager = multiprocessing.Manager()

2602

1976

client_class = Client

2603

1977

if use_dbus:

2604

1978

client_class = functools.partial(ClientDBus, bus = bus)

2605

2606

client_settings = Client.config_parser(client_config)

2607

old_client_settings = {}

2608

clients_data = {}

2609

2610

# This is used to redirect stdout and stderr for checker processes

2611

global wnull

2612

wnull = open(os.devnull, "w") # A writable /dev/null

2613

# Only used if server is running in foreground but not in debug

2614

# mode

2615

if debug or not foreground:

2616

wnull.close()

2617

2618

# Get client data and settings from last running state.

2619

if server_settings["restore"]:

2620

try:

2621

with open(stored_state_path, "rb") as stored_state:

2622

clients_data, old_client_settings = pickle.load(

2623

stored_state)

2624

os.remove(stored_state_path)

2625

except IOError as e:

2626

if e.errno == errno.ENOENT:

2627

logger.warning("Could not load persistent state:"

2628

" {}".format(os.strerror(e.errno)))

2629

else:

2630

logger.critical("Could not load persistent state:",

2631

exc_info=e)

2632

raise

2633

except EOFError as e:

2634

logger.warning("Could not load persistent state: "

2635

"EOFError:",

2636

exc_info=e)

2637

2638

with PGPEngine() as pgp:

2639

for client_name, client in clients_data.items():

2640

# Skip removed clients

2641

if client_name not in client_settings:

2642

continue

2643

2644

# Decide which value to use after restoring saved state.

2645

# We have three different values: Old config file,

2646

# new config file, and saved state.

2647

# New config value takes precedence if it differs from old

2648

# config value, otherwise use saved state.

2649

for name, value in client_settings[client_name].items():

2650

try:

2651

# For each value in new config, check if it

2652

# differs from the old config value (Except for

2653

# the "secret" attribute)

2654

if (name != "secret"

2655

and (value !=

2656

old_client_settings[client_name][name])):

2657

client[name] = value

2658

except KeyError:

2659

pass

2660

2661

# Clients who has passed its expire date can still be

2662

# enabled if its last checker was successful. A Client

2663

# whose checker succeeded before we stored its state is

2664

# assumed to have successfully run all checkers during

2665

# downtime.

2666

if client["enabled"]:

2667

if datetime.datetime.utcnow() >= client["expires"]:

2668

if not client["last_checked_ok"]:

2669

logger.warning(

2670

"disabling client {} - Client never "

2671

"performed a successful checker".format(

2672

client_name))

2673

client["enabled"] = False

2674

elif client["last_checker_status"] != 0:

2675

logger.warning(

2676

"disabling client {} - Client last"

2677

" checker failed with error code"

2678

" {}".format(

2679

client_name,

2680

client["last_checker_status"]))

2681

client["enabled"] = False

2682

else:

2683

client["expires"] = (

2684

datetime.datetime.utcnow()

2685

+ client["timeout"])

2686

logger.debug("Last checker succeeded,"

2687

" keeping {} enabled".format(

2688

client_name))

1979

def client_config_items(config, section):

1980

special_settings = {

1981

"approved_by_default":

1982

lambda: config.getboolean(section,

1983

"approved_by_default"),

1984

}

1985

for name, value in config.items(section):

2689

1986

try:

2690

client["secret"] = pgp.decrypt(

2691

client["encrypted_secret"],

2692

client_settings[client_name]["secret"])

2693

except PGPError:

2694

# If decryption fails, we use secret from new settings

2695

logger.debug("Failed to decrypt {} old secret".format(

2696

client_name))

2697

client["secret"] = (client_settings[client_name]

2698

["secret"])

2699

2700

# Add/remove clients based on new changes made to config

2701

for client_name in (set(old_client_settings)

2702

- set(client_settings)):

2703

del clients_data[client_name]

2704

for client_name in (set(client_settings)

2705

- set(old_client_settings)):

2706

clients_data[client_name] = client_settings[client_name]

2707

2708

# Create all client objects

2709

for client_name, client in clients_data.items():

2710

tcp_server.clients[client_name] = client_class(

2711

name = client_name,

2712

settings = client,

2713

server_settings = server_settings)

2714

1987

yield (name, special_settings[name]())

1988

except KeyError:

1989

yield (name, value)

1990

1991

tcp_server.clients.update(set(

1992

client_class(name = section,

1993

config= dict(client_config_items(

1994

client_config, section)))

1995

for section in client_config.sections()))

2715

1996

if not tcp_server.clients:

2716

1997

logger.warning("No clients defined")

2717

2718

if not foreground:

2719

if pidfile is not None:

2720

pid = os.getpid()

2721

try:

2722

with pidfile:

2723

print(pid, file=pidfile)

2724

except IOError:

2725

logger.error("Could not write to file %r with PID %d",

2726

pidfilename, pid)

2727

del pidfile

1998

1999

if not debug:

2000

try:

2001

with pidfile:

2002

pid = os.getpid()

2003

pidfile.write(str(pid) + "\n".encode("utf-8"))

2004

del pidfile

2005

except IOError:

2006

logger.error("Could not write to file %r with PID %d",

2007

pidfilename, pid)

2008

except NameError:

2009

# "pidfile" was never created

2010

pass

2728

2011

del pidfilename

2012

2013

signal.signal(signal.SIGINT, signal.SIG_IGN)

2729

2014

2730

2015

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2731

2016

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2732

2017

2733

2018

if use_dbus:

2734

2735

@alternate_dbus_interfaces(

2736

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2737

class MandosDBusService(DBusObjectWithProperties):

2019

class MandosDBusService(dbus.service.Object):

2738

2020

"""A D-Bus proxy object"""

2739

2740

2021

def __init__(self):

2741

2022

dbus.service.Object.__init__(self, bus, "/")

2742

2743

_interface = "se.recompile.Mandos"

2744

2745

@dbus_interface_annotations(_interface)

2746

def _foo(self):

2747

return {

2748

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2749

"false" }

2023

_interface = "se.bsnet.fukt.Mandos"

2750

2024

2751

2025

@dbus.service.signal(_interface, signature="o")

2752

2026

def ClientAdded(self, objpath):

2766

2040

@dbus.service.method(_interface, out_signature="ao")

2767

2041

def GetAllClients(self):

2768

2042

"D-Bus method"

2769

return dbus.Array(c.dbus_object_path for c in

2770

tcp_server.clients.itervalues())

2043

return dbus.Array(c.dbus_object_path

2044

for c in tcp_server.clients)

2771

2045

2772

2046

@dbus.service.method(_interface,

2773

2047

out_signature="a{oa{sv}}")

2774

2048

def GetAllClientsWithProperties(self):

2775

2049

"D-Bus method"

2776

2050

return dbus.Dictionary(

2777

{ c.dbus_object_path: c.GetAll("")

2778

for c in tcp_server.clients.itervalues() },

2051

((c.dbus_object_path, c.GetAll(""))

2052

for c in tcp_server.clients),

2779

2053

signature="oa{sv}")

2780

2054

2781

2055

@dbus.service.method(_interface, in_signature="o")

2782

2056

def RemoveClient(self, object_path):

2783

2057

"D-Bus method"

2784

for c in tcp_server.clients.itervalues():

2058

for c in tcp_server.clients:

2785

2059

if c.dbus_object_path == object_path:

2786

del tcp_server.clients[c.name]

2060

tcp_server.clients.remove(c)

2787

2061

c.remove_from_connection()

2788

2062

# Don't signal anything except ClientRemoved

2789

2063

c.disable(quiet=True)

2798

2072

2799

2073

def cleanup():

2800

2074

"Cleanup function; run on exit"

2801

if zeroconf:

2802

service.cleanup()

2803

2804

multiprocessing.active_children()

2805

wnull.close()

2806

if not (tcp_server.clients or client_settings):

2807

return

2808

2809

# Store client before exiting. Secrets are encrypted with key

2810

# based on what config file has. If config file is

2811

# removed/edited, old secret will thus be unrecovable.

2812

clients = {}

2813

with PGPEngine() as pgp:

2814

for client in tcp_server.clients.itervalues():

2815

key = client_settings[client.name]["secret"]

2816

client.encrypted_secret = pgp.encrypt(client.secret,

2817

key)

2818

client_dict = {}

2819

2820

# A list of attributes that can not be pickled

2821

# + secret.

2822

exclude = { "bus", "changedstate", "secret",

2823

"checker", "server_settings" }

2824

for name, typ in inspect.getmembers(dbus.service

2825

.Object):

2826

exclude.add(name)

2827

2828

client_dict["encrypted_secret"] = (client

2829

.encrypted_secret)

2830

for attr in client.client_structure:

2831

if attr not in exclude:

2832

client_dict[attr] = getattr(client, attr)

2833

2834

clients[client.name] = client_dict

2835

del client_settings[client.name]["secret"]

2836

2837

try:

2838

with tempfile.NamedTemporaryFile(

2839

mode='wb',

2840

suffix=".pickle",

2841

prefix='clients-',

2842

dir=os.path.dirname(stored_state_path),

2843

delete=False) as stored_state:

2844

pickle.dump((clients, client_settings), stored_state)

2845

tempname = stored_state.name

2846

os.rename(tempname, stored_state_path)

2847

except (IOError, OSError) as e:

2848

if not debug:

2849

try:

2850

os.remove(tempname)

2851

except NameError:

2852

pass

2853

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2854

logger.warning("Could not save persistent state: {}"

2855

.format(os.strerror(e.errno)))

2856

else:

2857

logger.warning("Could not save persistent state:",

2858

exc_info=e)

2859

raise

2860

2861

# Delete all clients, and settings from config

2075

service.cleanup()

2076

2862

2077

while tcp_server.clients:

2863

name, client = tcp_server.clients.popitem()

2078

client = tcp_server.clients.pop()

2864

2079

if use_dbus:

2865

2080

client.remove_from_connection()

2081

client.disable_hook = None

2866

2082

# Don't signal anything except ClientRemoved

2867

2083

client.disable(quiet=True)

2868

2084

if use_dbus:

2869

2085

# Emit D-Bus signal

2870

mandos_dbus_service.ClientRemoved(

2871

client.dbus_object_path, client.name)

2872

client_settings.clear()

2086

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2087

client.name)

2873

2088

2874

2089

atexit.register(cleanup)

2875

2090

2876

for client in tcp_server.clients.itervalues():

2091

for client in tcp_server.clients:

2877

2092

if use_dbus:

2878

2093

# Emit D-Bus signal

2879

2094

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2880

# Need to initiate checking of clients

2881

if client.enabled:

2882

client.init_checker()

2095

client.enable()

2883

2096

2884

2097

tcp_server.enable()

2885

2098

tcp_server.server_activate()

2886

2099

2887

2100

# Find out what port we got

2888

if zeroconf:

2889

service.port = tcp_server.socket.getsockname()[1]

2101

service.port = tcp_server.socket.getsockname()[1]

2890

2102

if use_ipv6:

2891

2103

logger.info("Now listening on address %r, port %d,"

2892

" flowinfo %d, scope_id %d",

2893

*tcp_server.socket.getsockname())

2104

" flowinfo %d, scope_id %d"

2105

% tcp_server.socket.getsockname())

2894

2106

else: # IPv4

2895

logger.info("Now listening on address %r, port %d",

2896

*tcp_server.socket.getsockname())

2107

logger.info("Now listening on address %r, port %d"

2108

% tcp_server.socket.getsockname())

2897

2109

2898

2110

#service.interface = tcp_server.socket.getsockname()[3]

2899

2111

2900

2112

try:

2901

if zeroconf:

2902

# From the Avahi example code

2903

try:

2904

service.activate()

2905

except dbus.exceptions.DBusException as error:

2906

logger.critical("D-Bus Exception", exc_info=error)

2907

cleanup()

2908

sys.exit(1)

2909

# End of Avahi example code

2113

# From the Avahi example code

2114

try:

2115

service.activate()

2116

except dbus.exceptions.DBusException as error:

2117

logger.critical("DBusException: %s", error)

2118

cleanup()

2119

sys.exit(1)

2120

# End of Avahi example code

2910

2121

2911

2122

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2912

2123

lambda *args, **kwargs:

2916

2127

logger.debug("Starting main loop")

2917

2128

main_loop.run()

2918

2129

except AvahiError as error:

2919

logger.critical("Avahi Error", exc_info=error)

2130

logger.critical("AvahiError: %s", error)

2920

2131

cleanup()

2921

2132

sys.exit(1)

2922

2133

except KeyboardInterrupt: