/mandos/trunk : revision 608

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

68

import binascii

69

import tempfile

70

import itertools

71

import collections

72

71

73

72

import dbus

74

73

import dbus.service

79

78

import ctypes.util

80

79

import xml.dom.minidom

81

80

import inspect

81

import GnuPGInterface

82

83

try:

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

88

except ImportError:

89

SO_BINDTODEVICE = None

90

91

if sys.version_info.major == 2:

92

str = unicode

93

94

version = "1.6.9"

91

version = "1.6.0"

95

92

stored_state_file = "clients.pickle"

96

93

97

94

logger = logging.getLogger()

98

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

99

98

100

99

try:

101

100

if_nametoindex = (ctypes.cdll.LoadLibrary

107

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

108

107

with contextlib.closing(socket.socket()) as s:

109

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

110

struct.pack(b"16s16x", interface))

111

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

112

113

return interface_index

113

114

115

116

def initlogger(debug, level=logging.WARNING):

116

117

"""init logger and add loglevel"""

117

118

global syslogger

119

syslogger = (logging.handlers.SysLogHandler

120

(facility =

121

logging.handlers.SysLogHandler.LOG_DAEMON,

122

address = "/dev/log"))

123

119

syslogger.setFormatter(logging.Formatter

124

120

('Mandos [%(process)d]: %(levelname)s:'

125

121

' %(message)s'))

143

139

class PGPEngine(object):

144

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

145

141

def __init__(self):

142

self.gnupg = GnuPGInterface.GnuPG()

146

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

147

self.gnupgargs = ['--batch',

148

'--home', self.tempdir,

149

'--force-mdc',

150

'--quiet',

151

'--no-use-agent']

144

self.gnupg = GnuPGInterface.GnuPG()

145

self.gnupg.options.meta_interactive = False

146

self.gnupg.options.homedir = self.tempdir

147

self.gnupg.options.extra_args.extend(['--force-mdc',

148

'--quiet',

149

'--no-use-agent'])

152

150

153

151

def __enter__(self):

154

152

return self

176

174

def password_encode(self, password):

177

175

# Passphrase can not be empty and can not contain newlines or

178

176

# NUL bytes. So we prefix it and hex encode it.

179

encoded = b"mandos" + binascii.hexlify(password)

180

if len(encoded) > 2048:

181

# GnuPG can't handle long passwords, so encode differently

182

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

183

.replace(b"\n", b"\\n")

184

.replace(b"\0", b"\\x00"))

185

return encoded

177

return b"mandos" + binascii.hexlify(password)

186

178

187

179

def encrypt(self, data, password):

188

passphrase = self.password_encode(password)

189

with tempfile.NamedTemporaryFile(dir=self.tempdir

190

) as passfile:

191

passfile.write(passphrase)

192

passfile.flush()

193

proc = subprocess.Popen(['gpg', '--symmetric',

194

'--passphrase-file',

195

passfile.name]

196

+ self.gnupgargs,

197

stdin = subprocess.PIPE,

198

stdout = subprocess.PIPE,

199

stderr = subprocess.PIPE)

200

ciphertext, err = proc.communicate(input = data)

201

if proc.returncode != 0:

202

raise PGPError(err)

180

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

182

try:

183

proc = self.gnupg.run(['--symmetric'],

184

create_fhs=['stdin', 'stdout'],

185

attach_fhs={'stderr': devnull})

186

with contextlib.closing(proc.handles['stdin']) as f:

187

f.write(data)

188

with contextlib.closing(proc.handles['stdout']) as f:

189

ciphertext = f.read()

190

proc.wait()

191

except IOError as e:

192

raise PGPError(e)

193

self.gnupg.passphrase = None

203

194

return ciphertext

204

195

205

196

def decrypt(self, data, password):

206

passphrase = self.password_encode(password)

207

with tempfile.NamedTemporaryFile(dir = self.tempdir

208

) as passfile:

209

passfile.write(passphrase)

210

passfile.flush()

211

proc = subprocess.Popen(['gpg', '--decrypt',

212

'--passphrase-file',

213

passfile.name]

214

+ self.gnupgargs,

215

stdin = subprocess.PIPE,

216

stdout = subprocess.PIPE,

217

stderr = subprocess.PIPE)

218

decrypted_plaintext, err = proc.communicate(input

219

= data)

220

if proc.returncode != 0:

221

raise PGPError(err)

197

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

199

try:

200

proc = self.gnupg.run(['--decrypt'],

201

create_fhs=['stdin', 'stdout'],

202

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

204

f.write(data)

205

with contextlib.closing(proc.handles['stdout']) as f:

206

decrypted_plaintext = f.read()

207

proc.wait()

208

except IOError as e:

209

raise PGPError(e)

210

self.gnupg.passphrase = None

222

211

return decrypted_plaintext

223

212

224

213

225

214

class AvahiError(Exception):

226

215

def __init__(self, value, *args, **kwargs):

227

216

self.value = value

228

return super(AvahiError, self).__init__(value, *args,

229

**kwargs)

217

super(AvahiError, self).__init__(value, *args, **kwargs)

218

def __unicode__(self):

219

return unicode(repr(self.value))

230

220

231

221

class AvahiServiceError(AvahiError):

232

222

pass

243

233

Used to optionally bind to the specified interface.

244

234

name: string; Example: 'Mandos'

245

235

type: string; Example: '_mandos._tcp'.

246

See <https://www.iana.org/assignments/service-names-port-numbers>

236

See <http://www.dns-sd.org/ServiceTypes.html>

247

237

port: integer; what port to announce

248

238

TXT: list of strings; TXT record for the service

249

239

domain: string; Domain to publish on, default to .local if empty.

275

265

self.bus = bus

276

266

self.entry_group_state_changed_match = None

277

267

278

def rename(self, remove=True):

268

def rename(self):

279

269

"""Derived from the Avahi example code"""

280

270

if self.rename_count >= self.max_renames:

281

271

logger.critical("No suitable Zeroconf service name found"

282

272

" after %i retries, exiting.",

283

273

self.rename_count)

284

274

raise AvahiServiceError("Too many renames")

285

self.name = str(self.server

286

.GetAlternativeServiceName(self.name))

287

self.rename_count += 1

275

self.name = unicode(self.server

276

.GetAlternativeServiceName(self.name))

288

277

logger.info("Changing Zeroconf service name to %r ...",

289

278

self.name)

290

if remove:

291

self.remove()

279

self.remove()

292

280

try:

293

281

self.add()

294

282

except dbus.exceptions.DBusException as error:

295

if (error.get_dbus_name()

296

== "org.freedesktop.Avahi.CollisionError"):

297

logger.info("Local Zeroconf service name collision.")

298

return self.rename(remove=False)

299

else:

300

logger.critical("D-Bus Exception", exc_info=error)

301

self.cleanup()

302

os._exit(1)

283

logger.critical("D-Bus Exception", exc_info=error)

284

self.cleanup()

285

os._exit(1)

286

self.rename_count += 1

303

287

304

288

def remove(self):

305

289

"""Derived from the Avahi example code"""

343

327

self.rename()

344

328

elif state == avahi.ENTRY_GROUP_FAILURE:

345

329

logger.critical("Avahi: Error in group state changed %s",

346

str(error))

347

raise AvahiGroupError("State changed: {!s}"

330

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

348

332

.format(error))

349

333

350

334

def cleanup(self):

397

381

398

382

399

383

class AvahiServiceToSyslog(AvahiService):

400

def rename(self, *args, **kwargs):

384

def rename(self):

401

385

"""Add the new name to the syslog messages"""

402

ret = AvahiService.rename(self, *args, **kwargs)

386

ret = AvahiService.rename(self)

403

387

syslogger.setFormatter(logging.Formatter

404

('Mandos ({}) [%(process)d]:'

388

('Mandos ({0}) [%(process)d]:'

405

389

' %(levelname)s: %(message)s'

406

390

.format(self.name)))

407

391

return ret

408

392

409

393

394

def timedelta_to_milliseconds(td):

395

"Convert a datetime.timedelta() to milliseconds"

396

return ((td.days * 24 * 60 * 60 * 1000)

397

+ (td.seconds * 1000)

398

+ (td.microseconds // 1000))

399

400

410

401

class Client(object):

411

402

"""A representation of a client host served by this server.

412

403

448

439

runtime_expansions: Allowed attributes for runtime expansion.

449

440

expires: datetime.datetime(); time (UTC) when a client will be

450

441

disabled, or None

451

server_settings: The server_settings dict from main()

452

442

"""

453

443

454

444

runtime_expansions = ("approval_delay", "approval_duration",

456

446

"fingerprint", "host", "interval",

457

447

"last_approval_request", "last_checked_ok",

458

448

"last_enabled", "name", "timeout")

459

client_defaults = { "timeout": "PT5M",

460

"extended_timeout": "PT15M",

461

"interval": "PT2M",

449

client_defaults = { "timeout": "5m",

450

"extended_timeout": "15m",

451

"interval": "2m",

462

452

"checker": "fping -q -- %%(host)s",

463

453

"host": "",

464

"approval_delay": "PT0S",

465

"approval_duration": "PT1S",

454

"approval_delay": "0s",

455

"approval_duration": "1s",

466

456

"approved_by_default": "True",

467

457

"enabled": "True",

468

458

}

469

459

460

def timeout_milliseconds(self):

461

"Return the 'timeout' attribute in milliseconds"

462

return timedelta_to_milliseconds(self.timeout)

463

464

def extended_timeout_milliseconds(self):

465

"Return the 'extended_timeout' attribute in milliseconds"

466

return timedelta_to_milliseconds(self.extended_timeout)

467

468

def interval_milliseconds(self):

469

"Return the 'interval' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.interval)

471

472

def approval_delay_milliseconds(self):

473

return timedelta_to_milliseconds(self.approval_delay)

474

470

475

@staticmethod

471

476

def config_parser(config):

472

477

"""Construct a new dict of client settings of this form:

497

502

"rb") as secfile:

498

503

client["secret"] = secfile.read()

499

504

else:

500

raise TypeError("No secret or secfile for section {}"

505

raise TypeError("No secret or secfile for section {0}"

501

506

.format(section))

502

507

client["timeout"] = string_to_delta(section["timeout"])

503

508

client["extended_timeout"] = string_to_delta(

514

519

515

520

return settings

516

521

517

def __init__(self, settings, name = None, server_settings=None):

522

def __init__(self, settings, name = None):

518

523

self.name = name

519

if server_settings is None:

520

server_settings = {}

521

self.server_settings = server_settings

522

524

# adding all client settings

523

for setting, value in settings.items():

525

for setting, value in settings.iteritems():

524

526

setattr(self, setting, value)

525

527

526

528

if self.enabled:

609

611

if self.checker_initiator_tag is not None:

610

612

gobject.source_remove(self.checker_initiator_tag)

611

613

self.checker_initiator_tag = (gobject.timeout_add

612

(int(self.interval

613

.total_seconds() * 1000),

614

(self.interval_milliseconds(),

614

615

self.start_checker))

615

616

# Schedule a disable() when 'timeout' has passed

616

617

if self.disable_initiator_tag is not None:

617

618

gobject.source_remove(self.disable_initiator_tag)

618

619

self.disable_initiator_tag = (gobject.timeout_add

619

(int(self.timeout

620

.total_seconds() * 1000),

621

self.disable))

620

(self.timeout_milliseconds(),

621

self.disable))

622

# Also start a new checker *right now*.

623

self.start_checker()

624

655

self.disable_initiator_tag = None

656

if getattr(self, "enabled", False):

657

self.disable_initiator_tag = (gobject.timeout_add

658

(int(timeout.total_seconds()

659

* 1000), self.disable))

658

(timedelta_to_milliseconds

659

(timeout), self.disable))

660

self.expires = datetime.datetime.utcnow() + timeout

661

662

def need_approval(self):

679

# If a checker exists, make sure it is not a zombie

680

try:

681

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

682

except AttributeError:

683

pass

684

except OSError as error:

685

if error.errno != errno.ECHILD:

686

raise

682

except (AttributeError, OSError) as error:

683

if (isinstance(error, OSError)

684

and error.errno != errno.ECHILD):

685

raise error

687

686

else:

688

687

if pid:

689

688

logger.warning("Checker was a zombie")

693

692

# Start a new checker if needed

694

693

if self.checker is None:

695

694

# Escape attributes for the shell

696

escaped_attrs = { attr:

697

re.escape(str(getattr(self, attr)))

698

for attr in self.runtime_expansions }

695

escaped_attrs = dict(

696

(attr, re.escape(unicode(getattr(self, attr))))

697

for attr in

698

self.runtime_expansions)

699

try:

700

command = self.checker_command % escaped_attrs

701

except TypeError as error:

710

# in normal mode, that is already done by daemon(),

711

# and in debug mode we don't want to. (Stdin is

712

# always replaced by /dev/null.)

713

# The exception is when not debugging but nevertheless

714

# running in the foreground; use the previously

715

# created wnull.

716

popen_args = {}

717

if (not self.server_settings["debug"]

718

and self.server_settings["foreground"]):

719

popen_args.update({"stdout": wnull,

720

"stderr": wnull })

721

713

self.checker = subprocess.Popen(command,

722

714

close_fds=True,

723

shell=True, cwd="/",

724

**popen_args)

715

shell=True, cwd="/")

725

716

except OSError as error:

726

717

logger.error("Failed to start subprocess",

727

718

exc_info=error)

728

return True

729

719

self.checker_callback_tag = (gobject.child_watch_add

730

720

(self.checker.pid,

731

721

self.checker_callback,

732

722

data=command))

733

723

# The checker may have completed before the gobject

734

724

# watch was added. Check for this.

735

try:

736

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

737

except OSError as error:

738

if error.errno == errno.ECHILD:

739

# This should never happen

740

logger.error("Child process vanished",

741

exc_info=error)

742

return True

743

raise

725

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

744

726

if pid:

745

727

gobject.source_remove(self.checker_callback_tag)

746

728

self.checker_callback(pid, status, command)

782

764

# "Set" method, so we fail early here:

783

765

if byte_arrays and signature != "ay":

784

766

raise ValueError("Byte arrays not supported for non-'ay'"

785

" signature {!r}".format(signature))

767

" signature {0!r}".format(signature))

786

768

def decorator(func):

787

769

func._dbus_is_property = True

788

770

func._dbus_interface = dbus_interface

819

801

"""Decorator to annotate D-Bus methods, signals or properties

820

802

Usage:

821

803

822

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

823

"org.freedesktop.DBus.Property."

824

"EmitsChangedSignal": "false"})

825

804

@dbus_service_property("org.example.Interface", signature="b",

826

805

access="r")

806

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

807

"org.freedesktop.DBus.Property."

808

"EmitsChangedSignal": "false"})

827

809

def Property_dbus_property(self):

828

810

return dbus.Boolean(False)

829

811

"""

836

818

class DBusPropertyException(dbus.exceptions.DBusException):

837

819

"""A base class for D-Bus property-related exceptions

838

820

"""

839

pass

821

def __unicode__(self):

822

return unicode(str(self))

823

840

824

841

825

class DBusPropertyAccessException(DBusPropertyException):

842

826

"""A property's access permissions disallows an operation.

865

849

If called like _is_dbus_thing("method") it returns a function

866

850

suitable for use as predicate to inspect.getmembers().

867

851

"""

868

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

852

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

869

853

False)

870

854

871

855

def _get_all_dbus_things(self, thing):

920

904

# The byte_arrays option is not supported yet on

921

905

# signatures other than "ay".

922

906

if prop._dbus_signature != "ay":

923

raise ValueError("Byte arrays not supported for non-"

924

"'ay' signature {!r}"

925

.format(prop._dbus_signature))

907

raise ValueError

926

908

value = dbus.ByteArray(b''.join(chr(byte)

927

909

for byte in value))

928

910

prop(value)

952

934

value.variant_level+1)

953

935

return dbus.Dictionary(properties, signature="sv")

954

936

955

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

956

def PropertiesChanged(self, interface_name, changed_properties,

957

invalidated_properties):

958

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

959

standard.

960

"""

961

pass

962

963

937

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

964

938

out_signature="s",

965

939

path_keyword='object_path',

1000

974

(prop,

1001

975

"_dbus_annotations",

1002

976

{}))

1003

for name, value in annots.items():

977

for name, value in annots.iteritems():

1004

978

ann_tag = document.createElement(

1005

979

"annotation")

1006

980

ann_tag.setAttribute("name", name)

1009

983

# Add interface annotation tags

1010

984

for annotation, value in dict(

1011

985

itertools.chain.from_iterable(

1012

annotations().items()

986

annotations().iteritems()

1013

987

for name, annotations in

1014

988

self._get_all_dbus_things("interface")

1015

989

if name == if_tag.getAttribute("name")

1016

)).items():

990

)).iteritems():

1017

991

ann_tag = document.createElement("annotation")

1018

992

ann_tag.setAttribute("name", annotation)

1019

993

ann_tag.setAttribute("value", value)

1075

1049

"""

1076

1050

def wrapper(cls):

1077

1051

for orig_interface_name, alt_interface_name in (

1078

alt_interface_names.items()):

1052

alt_interface_names.iteritems()):

1079

1053

attr = {}

1080

1054

interface_names = set()

1081

1055

# Go though all attributes of the class

1094

1068

interface_names.add(alt_interface)

1095

1069

# Is this a D-Bus signal?

1096

1070

if getattr(attribute, "_dbus_is_signal", False):

1097

# Extract the original non-method undecorated

1098

# function by black magic

1071

# Extract the original non-method function by

1072

# black magic

1099

1073

nonmethod_func = (dict(

1100

1074

zip(attribute.func_code.co_freevars,

1101

1075

attribute.__closure__))["func"]

1198

1172

attribute.func_closure)))

1199

1173

if deprecate:

1200

1174

# Deprecate all alternate interfaces

1201

iname="_AlternateDBusNames_interface_annotation{}"

1175

iname="_AlternateDBusNames_interface_annotation{0}"

1202

1176

for interface_name in interface_names:

1203

1177

@dbus_interface_annotations(interface_name)

1204

1178

def func(self):

1213

1187

if interface_names:

1214

1188

# Replace the class with a new subclass of it with

1215

1189

# methods, signals, etc. as created above.

1216

cls = type(b"{}Alternate".format(cls.__name__),

1190

cls = type(b"{0}Alternate".format(cls.__name__),

1217

1191

(cls,), attr)

1218

1192

return cls

1219

1193

return wrapper

1232

1206

runtime_expansions = (Client.runtime_expansions

1233

1207

+ ("dbus_object_path",))

1234

1208

1235

_interface = "se.recompile.Mandos.Client"

1236

1237

1209

# dbus.service.Object doesn't use super(), so we can't either.

1238

1210

1239

1211

def __init__(self, bus = None, *args, **kwargs):

1241

1213

Client.__init__(self, *args, **kwargs)

1242

1214

# Only now, when this client is initialized, can it show up on

1243

1215

# the D-Bus

1244

client_object_name = str(self.name).translate(

1216

client_object_name = unicode(self.name).translate(

1245

1217

{ord("."): ord("_"),

1246

1218

ord("-"): ord("_")})

1247

1219

self.dbus_object_path = (dbus.ObjectPath

1251

1223

1252

1224

def notifychangeproperty(transform_func,

1253

1225

dbus_name, type_func=lambda x: x,

1254

variant_level=1, invalidate_only=False,

1255

_interface=_interface):

1226

variant_level=1):

1256

1227

""" Modify a variable so that it's a property which announces

1257

1228

its changes to DBus.

1258

1229

1263

1234

to the D-Bus. Default: no transform

1264

1235

variant_level: D-Bus variant level. Default: 1

1265

1236

"""

1266

attrname = "_{}".format(dbus_name)

1237

attrname = "_{0}".format(dbus_name)

1267

1238

def setter(self, value):

1268

1239

if hasattr(self, "dbus_object_path"):

1269

1240

if (not hasattr(self, attrname) or

1270

1241

type_func(getattr(self, attrname, None))

1271

1242

!= type_func(value)):

1272

if invalidate_only:

1273

self.PropertiesChanged(_interface,

1274

dbus.Dictionary(),

1275

dbus.Array

1276

((dbus_name,)))

1277

else:

1278

dbus_value = transform_func(type_func(value),

1279

variant_level

1280

=variant_level)

1281

self.PropertyChanged(dbus.String(dbus_name),

1282

dbus_value)

1283

self.PropertiesChanged(_interface,

1284

dbus.Dictionary({

1285

dbus.String(dbus_name):

1286

dbus_value }), dbus.Array())

1243

dbus_value = transform_func(type_func(value),

1244

variant_level

1245

=variant_level)

1246

self.PropertyChanged(dbus.String(dbus_name),

1247

dbus_value)

1287

1248

setattr(self, attrname, value)

1288

1249

1289

1250

return property(lambda self: getattr(self, attrname), setter)

1309

1270

approval_delay = notifychangeproperty(dbus.UInt64,

1310

1271

"ApprovalDelay",

1311

1272

type_func =

1312

lambda td: td.total_seconds()

1313

* 1000)

1273

timedelta_to_milliseconds)

1314

1274

approval_duration = notifychangeproperty(

1315

1275

dbus.UInt64, "ApprovalDuration",

1316

type_func = lambda td: td.total_seconds() * 1000)

1276

type_func = timedelta_to_milliseconds)

1317

1277

host = notifychangeproperty(dbus.String, "Host")

1318

1278

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1319

type_func = lambda td:

1320

td.total_seconds() * 1000)

1279

type_func =

1280

timedelta_to_milliseconds)

1321

1281

extended_timeout = notifychangeproperty(

1322

1282

dbus.UInt64, "ExtendedTimeout",

1323

type_func = lambda td: td.total_seconds() * 1000)

1283

type_func = timedelta_to_milliseconds)

1324

1284

interval = notifychangeproperty(dbus.UInt64,

1325

1285

"Interval",

1326

1286

type_func =

1327

lambda td: td.total_seconds()

1328

* 1000)

1287

timedelta_to_milliseconds)

1329

1288

checker_command = notifychangeproperty(dbus.String, "Checker")

1330

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1331

invalidate_only=True)

1332

1289

1333

1290

del notifychangeproperty

1334

1291

1361

1318

*args, **kwargs)

1362

1319

1363

1320

def start_checker(self, *args, **kwargs):

1364

old_checker_pid = getattr(self.checker, "pid", None)

1321

old_checker = self.checker

1322

if self.checker is not None:

1323

old_checker_pid = self.checker.pid

1324

else:

1325

old_checker_pid = None

1365

1326

r = Client.start_checker(self, *args, **kwargs)

1366

1327

# Only if new checker process was started

1367

1328

if (self.checker is not None

1376

1337

1377

1338

def approve(self, value=True):

1378

1339

self.approved = value

1379

gobject.timeout_add(int(self.approval_duration.total_seconds()

1380

* 1000), self._reset_approved)

1340

gobject.timeout_add(timedelta_to_milliseconds

1341

(self.approval_duration),

1342

self._reset_approved)

1381

1343

self.send_changedstate()

1382

1344

1383

1345

## D-Bus methods, signals & properties

1346

_interface = "se.recompile.Mandos.Client"

1384

1347

1385

1348

## Interfaces

1386

1349

1350

@dbus_interface_annotations(_interface)

1351

def _foo(self):

1352

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1353

"false"}

1354

1387

1355

## Signals

1388

1356

1389

1357

# CheckerCompleted - signal

1399

1367

pass

1400

1368

1401

1369

# PropertyChanged - signal

1402

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1403

1370

@dbus.service.signal(_interface, signature="sv")

1404

1371

def PropertyChanged(self, property, value):

1405

1372

"D-Bus signal"

1481

1448

access="readwrite")

1482

1449

def ApprovalDelay_dbus_property(self, value=None):

1483

1450

if value is None: # get

1484

return dbus.UInt64(self.approval_delay.total_seconds()

1485

* 1000)

1451

return dbus.UInt64(self.approval_delay_milliseconds())

1486

1452

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1487

1453

1488

1454

# ApprovalDuration - property

1490

1456

access="readwrite")

1491

1457

def ApprovalDuration_dbus_property(self, value=None):

1492

1458

if value is None: # get

1493

return dbus.UInt64(self.approval_duration.total_seconds()

1494

* 1000)

1459

return dbus.UInt64(timedelta_to_milliseconds(

1460

self.approval_duration))

1495

1461

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1496

1462

1497

1463

# Name - property

1510

1476

def Host_dbus_property(self, value=None):

1511

1477

if value is None: # get

1512

1478

return dbus.String(self.host)

1513

self.host = str(value)

1479

self.host = unicode(value)

1514

1480

1515

1481

# Created - property

1516

1482

@dbus_service_property(_interface, signature="s", access="read")

1563

1529

access="readwrite")

1564

1530

def Timeout_dbus_property(self, value=None):

1565

1531

if value is None: # get

1566

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1532

return dbus.UInt64(self.timeout_milliseconds())

1567

1533

old_timeout = self.timeout

1568

1534

self.timeout = datetime.timedelta(0, 0, 0, value)

1569

1535

# Reschedule disabling

1580

1546

gobject.source_remove(self.disable_initiator_tag)

1581

1547

self.disable_initiator_tag = (

1582

1548

gobject.timeout_add(

1583

int((self.expires - now).total_seconds()

1584

* 1000), self.disable))

1549

timedelta_to_milliseconds(self.expires - now),

1550

self.disable))

1585

1551

1586

1552

# ExtendedTimeout - property

1587

1553

@dbus_service_property(_interface, signature="t",

1588

1554

access="readwrite")

1589

1555

def ExtendedTimeout_dbus_property(self, value=None):

1590

1556

if value is None: # get

1591

return dbus.UInt64(self.extended_timeout.total_seconds()

1592

* 1000)

1557

return dbus.UInt64(self.extended_timeout_milliseconds())

1593

1558

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1594

1559

1595

1560

# Interval - property

1597

1562

access="readwrite")

1598

1563

def Interval_dbus_property(self, value=None):

1599

1564

if value is None: # get

1600

return dbus.UInt64(self.interval.total_seconds() * 1000)

1565

return dbus.UInt64(self.interval_milliseconds())

1601

1566

self.interval = datetime.timedelta(0, 0, 0, value)

1602

1567

if getattr(self, "checker_initiator_tag", None) is None:

1603

1568

return

1614

1579

def Checker_dbus_property(self, value=None):

1615

1580

if value is None: # get

1616

1581

return dbus.String(self.checker_command)

1617

self.checker_command = str(value)

1582

self.checker_command = unicode(value)

1618

1583

1619

1584

# CheckerRunning - property

1620

1585

@dbus_service_property(_interface, signature="b",

1636

1601

@dbus_service_property(_interface, signature="ay",

1637

1602

access="write", byte_arrays=True)

1638

1603

def Secret_dbus_property(self, value):

1639

self.secret = bytes(value)

1604

self.secret = str(value)

1640

1605

1641

1606

del _interface

1642

1607

1676

1641

def handle(self):

1677

1642

with contextlib.closing(self.server.child_pipe) as child_pipe:

1678

1643

logger.info("TCP connection from: %s",

1679

str(self.client_address))

1644

unicode(self.client_address))

1680

1645

logger.debug("Pipe FD: %d",

1681

1646

self.server.child_pipe.fileno())

1682

1647

1708

1673

logger.debug("Protocol version: %r", line)

1709

1674

try:

1710

1675

if int(line.strip().split()[0]) > 1:

1711

raise RuntimeError(line)

1676

raise RuntimeError

1712

1677

except (ValueError, IndexError, RuntimeError) as error:

1713

1678

logger.error("Unknown protocol version: %s", error)

1714

1679

return

1763

1728

if self.server.use_dbus:

1764

1729

# Emit D-Bus signal

1765

1730

client.NeedApproval(

1766

client.approval_delay.total_seconds()

1767

* 1000, client.approved_by_default)

1731

client.approval_delay_milliseconds(),

1732

client.approved_by_default)

1768

1733

else:

1769

1734

logger.warning("Client %s was not approved",

1770

1735

client.name)

1776

1741

#wait until timeout or approved

1777

1742

time = datetime.datetime.now()

1778

1743

client.changedstate.acquire()

1779

client.changedstate.wait(delay.total_seconds())

1744

client.changedstate.wait(

1745

float(timedelta_to_milliseconds(delay)

1746

/ 1000))

1780

1747

client.changedstate.release()

1781

1748

time2 = datetime.datetime.now()

1782

1749

if (time2 - time) >= delay:

1919

1886

1920

1887

def add_pipe(self, parent_pipe, proc):

1921

1888

"""Dummy function; override as necessary"""

1922

raise NotImplementedError()

1889

raise NotImplementedError

1923

1890

1924

1891

1925

1892

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1981

1948

try:

1982

1949

self.socket.setsockopt(socket.SOL_SOCKET,

1983

1950

SO_BINDTODEVICE,

1984

(self.interface + "\0")

1985

.encode("utf-8"))

1951

str(self.interface + '\0'))

1986

1952

except socket.error as error:

1987

1953

if error.errno == errno.EPERM:

1988

1954

logger.error("No permission to bind to"

2002

1968

if self.address_family == socket.AF_INET6:

2003

1969

any_address = "::" # in6addr_any

2004

1970

else:

2005

any_address = "0.0.0.0" # INADDR_ANY

1971

any_address = socket.INADDR_ANY

2006

1972

self.server_address = (any_address,

2007

1973

self.server_address[1])

2008

1974

elif not self.server_address[1]:

2124

2090

return True

2125

2091

2126

2092

2127

def rfc3339_duration_to_delta(duration):

2128

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2129

2130

>>> rfc3339_duration_to_delta("P7D")

2131

datetime.timedelta(7)

2132

>>> rfc3339_duration_to_delta("PT60S")

2133

datetime.timedelta(0, 60)

2134

>>> rfc3339_duration_to_delta("PT60M")

2135

datetime.timedelta(0, 3600)

2136

>>> rfc3339_duration_to_delta("PT24H")

2137

datetime.timedelta(1)

2138

>>> rfc3339_duration_to_delta("P1W")

2139

datetime.timedelta(7)

2140

>>> rfc3339_duration_to_delta("PT5M30S")

2141

datetime.timedelta(0, 330)

2142

>>> rfc3339_duration_to_delta("P1DT3M20S")

2143

datetime.timedelta(1, 200)

2144

"""

2145

2146

# Parsing an RFC 3339 duration with regular expressions is not

2147

# possible - there would have to be multiple places for the same

2148

# values, like seconds. The current code, while more esoteric, is

2149

# cleaner without depending on a parsing library. If Python had a

2150

# built-in library for parsing we would use it, but we'd like to

2151

# avoid excessive use of external libraries.

2152

2153

# New type for defining tokens, syntax, and semantics all-in-one

2154

Token = collections.namedtuple("Token",

2155

("regexp", # To match token; if

2156

# "value" is not None,

2157

# must have a "group"

2158

# containing digits

2159

"value", # datetime.timedelta or

2160

# None

2161

"followers")) # Tokens valid after

2162

# this token

2163

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2164

# the "duration" ABNF definition in RFC 3339, Appendix A.

2165

token_end = Token(re.compile(r"$"), None, frozenset())

2166

token_second = Token(re.compile(r"(\d+)S"),

2167

datetime.timedelta(seconds=1),

2168

frozenset((token_end,)))

2169

token_minute = Token(re.compile(r"(\d+)M"),

2170

datetime.timedelta(minutes=1),

2171

frozenset((token_second, token_end)))

2172

token_hour = Token(re.compile(r"(\d+)H"),

2173

datetime.timedelta(hours=1),

2174

frozenset((token_minute, token_end)))

2175

token_time = Token(re.compile(r"T"),

2176

None,

2177

frozenset((token_hour, token_minute,

2178

token_second)))

2179

token_day = Token(re.compile(r"(\d+)D"),

2180

datetime.timedelta(days=1),

2181

frozenset((token_time, token_end)))

2182

token_month = Token(re.compile(r"(\d+)M"),

2183

datetime.timedelta(weeks=4),

2184

frozenset((token_day, token_end)))

2185

token_year = Token(re.compile(r"(\d+)Y"),

2186

datetime.timedelta(weeks=52),

2187

frozenset((token_month, token_end)))

2188

token_week = Token(re.compile(r"(\d+)W"),

2189

datetime.timedelta(weeks=1),

2190

frozenset((token_end,)))

2191

token_duration = Token(re.compile(r"P"), None,

2192

frozenset((token_year, token_month,

2193

token_day, token_time,

2194

token_week)))

2195

# Define starting values

2196

value = datetime.timedelta() # Value so far

2197

found_token = None

2198

followers = frozenset((token_duration,)) # Following valid tokens

2199

s = duration # String left to parse

2200

# Loop until end token is found

2201

while found_token is not token_end:

2202

# Search for any currently valid tokens

2203

for token in followers:

2204

match = token.regexp.match(s)

2205

if match is not None:

2206

# Token found

2207

if token.value is not None:

2208

# Value found, parse digits

2209

factor = int(match.group(1), 10)

2210

# Add to value so far

2211

value += factor * token.value

2212

# Strip token from string

2213

s = token.regexp.sub("", s, 1)

2214

# Go to found token

2215

found_token = token

2216

# Set valid next tokens

2217

followers = found_token.followers

2218

break

2219

else:

2220

# No currently valid tokens were found

2221

raise ValueError("Invalid RFC 3339 duration")

2222

# End token found

2223

return value

2224

2225

2226

2093

def string_to_delta(interval):

2227

2094

"""Parse a string and return a datetime.timedelta

2228

2095

2239

2106

>>> string_to_delta('5m 30s')

2240

2107

datetime.timedelta(0, 330)

2241

2108

"""

2242

2243

try:

2244

return rfc3339_duration_to_delta(interval)

2245

except ValueError:

2246

pass

2247

2248

2109

timevalue = datetime.timedelta(0)

2249

2110

for s in interval.split():

2250

2111

try:

2251

suffix = s[-1]

2112

suffix = unicode(s[-1])

2252

2113

value = int(s[:-1])

2253

2114

if suffix == "d":

2254

2115

delta = datetime.timedelta(value)

2261

2122

elif suffix == "w":

2262

2123

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2263

2124

else:

2264

raise ValueError("Unknown suffix {!r}"

2125

raise ValueError("Unknown suffix {0!r}"

2265

2126

.format(suffix))

2266

except IndexError as e:

2127

except (ValueError, IndexError) as e:

2267

2128

raise ValueError(*(e.args))

2268

2129

timevalue += delta

2269

2130

return timevalue

2284

2145

# Close all standard open file descriptors

2285

2146

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2286

2147

if not stat.S_ISCHR(os.fstat(null).st_mode):

2287

raise OSError(errno.ENODEV, "{} not a character device"

2148

raise OSError(errno.ENODEV,

2149

"{0} not a character device"

2288

2150

.format(os.devnull))

2289

2151

os.dup2(null, sys.stdin.fileno())

2290

2152

os.dup2(null, sys.stdout.fileno())

2300

2162

2301

2163

parser = argparse.ArgumentParser()

2302

2164

parser.add_argument("-v", "--version", action="version",

2303

version = "%(prog)s {}".format(version),

2165

version = "%(prog)s {0}".format(version),

2304

2166

help="show version number and exit")

2305

2167

parser.add_argument("-i", "--interface", metavar="IF",

2306

2168

help="Bind to interface IF")

2312

2174

help="Run self-test")

2313

2175

parser.add_argument("--debug", action="store_true",

2314

2176

help="Debug mode; run in foreground and log"

2315

" to terminal", default=None)

2177

" to terminal")

2316

2178

parser.add_argument("--debuglevel", metavar="LEVEL",

2317

2179

help="Debug level for stdout output")

2318

2180

parser.add_argument("--priority", help="GnuTLS"

2325

2187

" files")

2326

2188

parser.add_argument("--no-dbus", action="store_false",

2327

2189

dest="use_dbus", help="Do not provide D-Bus"

2328

" system bus interface", default=None)

2190

" system bus interface")

2329

2191

parser.add_argument("--no-ipv6", action="store_false",

2330

dest="use_ipv6", help="Do not use IPv6",

2331

default=None)

2192

dest="use_ipv6", help="Do not use IPv6")

2332

2193

parser.add_argument("--no-restore", action="store_false",

2333

2194

dest="restore", help="Do not restore stored"

2334

" state", default=None)

2195

" state")

2335

2196

parser.add_argument("--socket", type=int,

2336

2197

help="Specify a file descriptor to a network"

2337

2198

" socket to use instead of creating one")

2338

2199

parser.add_argument("--statedir", metavar="DIR",

2339

2200

help="Directory to save/restore state in")

2340

2201

parser.add_argument("--foreground", action="store_true",

2341

help="Run in foreground", default=None)

2342

parser.add_argument("--no-zeroconf", action="store_false",

2343

dest="zeroconf", help="Do not use Zeroconf",

2344

default=None)

2202

help="Run in foreground")

2345

2203

2346

2204

options = parser.parse_args()

2347

2205

2348

2206

if options.check:

2349

2207

import doctest

2350

fail_count, test_count = doctest.testmod()

2351

sys.exit(os.EX_OK if fail_count == 0 else 1)

2208

doctest.testmod()

2209

sys.exit()

2352

2210

2353

2211

# Default values for config file for server-global settings

2354

2212

server_defaults = { "interface": "",

2356

2214

"port": "",

2357

2215

"debug": "False",

2358

2216

"priority":

2359

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2217

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2360

2218

"servicename": "Mandos",

2361

2219

"use_dbus": "True",

2362

2220

"use_ipv6": "True",

2365

2223

"socket": "",

2366

2224

"statedir": "/var/lib/mandos",

2367

2225

"foreground": "False",

2368

"zeroconf": "True",

2369

2226

}

2370

2227

2371

2228

# Parse config file for server-global settings

2398

2255

for option in ("interface", "address", "port", "debug",

2399

2256

"priority", "servicename", "configdir",

2400

2257

"use_dbus", "use_ipv6", "debuglevel", "restore",

2401

"statedir", "socket", "foreground", "zeroconf"):

2258

"statedir", "socket", "foreground"):

2402

2259

value = getattr(options, option)

2403

2260

if value is not None:

2404

2261

server_settings[option] = value

2405

2262

del options

2406

2263

# Force all strings to be unicode

2407

2264

for option in server_settings.keys():

2408

if isinstance(server_settings[option], bytes):

2409

server_settings[option] = (server_settings[option]

2410

.decode("utf-8"))

2411

# Force all boolean options to be boolean

2412

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2413

"foreground", "zeroconf"):

2414

server_settings[option] = bool(server_settings[option])

2265

if type(server_settings[option]) is str:

2266

server_settings[option] = unicode(server_settings[option])

2415

2267

# Debug implies foreground

2416

2268

if server_settings["debug"]:

2417

2269

server_settings["foreground"] = True

2419

2271

2420

2272

##################################################################

2421

2273

2422

if (not server_settings["zeroconf"] and

2423

not (server_settings["port"]

2424

or server_settings["socket"] != "")):

2425

parser.error("Needs port or socket to work without"

2426

" Zeroconf")

2427

2428

2274

# For convenience

2429

2275

debug = server_settings["debug"]

2430

2276

debuglevel = server_settings["debuglevel"]

2433

2279

stored_state_path = os.path.join(server_settings["statedir"],

2434

2280

stored_state_file)

2435

2281

foreground = server_settings["foreground"]

2436

zeroconf = server_settings["zeroconf"]

2437

2282

2438

2283

if debug:

2439

2284

initlogger(debug, logging.DEBUG)

2446

2291

2447

2292

if server_settings["servicename"] != "Mandos":

2448

2293

syslogger.setFormatter(logging.Formatter

2449

('Mandos ({}) [%(process)d]:'

2294

('Mandos ({0}) [%(process)d]:'

2450

2295

' %(levelname)s: %(message)s'

2451

2296

.format(server_settings

2452

2297

["servicename"])))

2460

2305

global mandos_dbus_service

2461

2306

mandos_dbus_service = None

2462

2307

2463

socketfd = None

2464

if server_settings["socket"] != "":

2465

socketfd = server_settings["socket"]

2466

2308

tcp_server = MandosServer((server_settings["address"],

2467

2309

server_settings["port"]),

2468

2310

ClientHandler,

2472

2314

gnutls_priority=

2473

2315

server_settings["priority"],

2474

2316

use_dbus=use_dbus,

2475

socketfd=socketfd)

2317

socketfd=(server_settings["socket"]

2318

or None))

2476

2319

if not foreground:

2477

pidfilename = "/run/mandos.pid"

2478

if not os.path.isdir("/run/."):

2479

pidfilename = "/var/run/mandos.pid"

2320

pidfilename = "/var/run/mandos.pid"

2480

2321

pidfile = None

2481

2322

try:

2482

2323

pidfile = open(pidfilename, "w")

2499

2340

os.setuid(uid)

2500

2341

except OSError as error:

2501

2342

if error.errno != errno.EPERM:

2502

raise

2343

raise error

2503

2344

2504

2345

if debug:

2505

2346

# Enable all possible GnuTLS debugging

2548

2389

use_dbus = False

2549

2390

server_settings["use_dbus"] = False

2550

2391

tcp_server.use_dbus = False

2551

if zeroconf:

2552

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2553

service = AvahiServiceToSyslog(name =

2554

server_settings["servicename"],

2555

servicetype = "_mandos._tcp",

2556

protocol = protocol, bus = bus)

2557

if server_settings["interface"]:

2558

service.interface = (if_nametoindex

2559

(server_settings["interface"]

2560

.encode("utf-8")))

2392

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2393

service = AvahiServiceToSyslog(name =

2394

server_settings["servicename"],

2395

servicetype = "_mandos._tcp",

2396

protocol = protocol, bus = bus)

2397

if server_settings["interface"]:

2398

service.interface = (if_nametoindex

2399

(str(server_settings["interface"])))

2561

2400

2562

2401

global multiprocessing_manager

2563

2402

multiprocessing_manager = multiprocessing.Manager()

2570

2409

old_client_settings = {}

2571

2410

clients_data = {}

2572

2411

2573

# This is used to redirect stdout and stderr for checker processes

2574

global wnull

2575

wnull = open(os.devnull, "w") # A writable /dev/null

2576

# Only used if server is running in foreground but not in debug

2577

# mode

2578

if debug or not foreground:

2579

wnull.close()

2580

2581

2412

# Get client data and settings from last running state.

2582

2413

if server_settings["restore"]:

2583

2414

try:

2587

2418

os.remove(stored_state_path)

2588

2419

except IOError as e:

2589

2420

if e.errno == errno.ENOENT:

2590

logger.warning("Could not load persistent state: {}"

2421

logger.warning("Could not load persistent state: {0}"

2591

2422

.format(os.strerror(e.errno)))

2592

2423

else:

2593

2424

logger.critical("Could not load persistent state:",

2598

2429

"EOFError:", exc_info=e)

2599

2430

2600

2431

with PGPEngine() as pgp:

2601

for client_name, client in clients_data.items():

2602

# Skip removed clients

2603

if client_name not in client_settings:

2604

continue

2605

2432

for client_name, client in clients_data.iteritems():

2606

2433

# Decide which value to use after restoring saved state.

2607

2434

# We have three different values: Old config file,

2608

2435

# new config file, and saved state.

2629

2456

if datetime.datetime.utcnow() >= client["expires"]:

2630

2457

if not client["last_checked_ok"]:

2631

2458

logger.warning(

2632

"disabling client {} - Client never "

2459

"disabling client {0} - Client never "

2633

2460

"performed a successful checker"

2634

2461

.format(client_name))

2635

2462

client["enabled"] = False

2636

2463

elif client["last_checker_status"] != 0:

2637

2464

logger.warning(

2638

"disabling client {} - Client last"

2639

" checker failed with error code {}"

2465

"disabling client {0} - Client "

2466

"last checker failed with error code {1}"

2640

2467

.format(client_name,

2641

2468

client["last_checker_status"]))

2642

2469

client["enabled"] = False

2645

2472

.utcnow()

2646

2473

+ client["timeout"])

2647

2474

logger.debug("Last checker succeeded,"

2648

" keeping {} enabled"

2475

" keeping {0} enabled"

2649

2476

.format(client_name))

2650

2477

try:

2651

2478

client["secret"] = (

2654

2481

["secret"]))

2655

2482

except PGPError:

2656

2483

# If decryption fails, we use secret from new settings

2657

logger.debug("Failed to decrypt {} old secret"

2484

logger.debug("Failed to decrypt {0} old secret"

2658

2485

.format(client_name))

2659

2486

client["secret"] = (

2660

2487

client_settings[client_name]["secret"])

2668

2495

clients_data[client_name] = client_settings[client_name]

2669

2496

2670

2497

# Create all client objects

2671

for client_name, client in clients_data.items():

2498

for client_name, client in clients_data.iteritems():

2672

2499

tcp_server.clients[client_name] = client_class(

2673

name = client_name, settings = client,

2674

server_settings = server_settings)

2500

name = client_name, settings = client)

2675

2501

2676

2502

if not tcp_server.clients:

2677

2503

logger.warning("No clients defined")

2681

2507

try:

2682

2508

with pidfile:

2683

2509

pid = os.getpid()

2684

pidfile.write("{}\n".format(pid).encode("utf-8"))

2510

pidfile.write(str(pid) + "\n".encode("utf-8"))

2685

2511

except IOError:

2686

2512

logger.error("Could not write to file %r with PID %d",

2687

2513

pidfilename, pid)

2733

2559

def GetAllClientsWithProperties(self):

2734

2560

"D-Bus method"

2735

2561

return dbus.Dictionary(

2736

{ c.dbus_object_path: c.GetAll("")

2737

for c in tcp_server.clients.itervalues() },

2562

((c.dbus_object_path, c.GetAll(""))

2563

for c in tcp_server.clients.itervalues()),

2738

2564

signature="oa{sv}")

2739

2565

2740

2566

@dbus.service.method(_interface, in_signature="o")

2757

2583

2758

2584

def cleanup():

2759

2585

"Cleanup function; run on exit"

2760

if zeroconf:

2761

service.cleanup()

2586

service.cleanup()

2762

2587

2763

2588

multiprocessing.active_children()

2764

wnull.close()

2765

2589

if not (tcp_server.clients or client_settings):

2766

2590

return

2767

2591

2778

2602

2779

2603

# A list of attributes that can not be pickled

2780

2604

# + secret.

2781

exclude = { "bus", "changedstate", "secret",

2782

"checker", "server_settings" }

2605

exclude = set(("bus", "changedstate", "secret",

2606

"checker"))

2783

2607

for name, typ in (inspect.getmembers

2784

2608

(dbus.service.Object)):

2785

2609

exclude.add(name)

2808

2632

except NameError:

2809

2633

pass

2810

2634

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2811

logger.warning("Could not save persistent state: {}"

2635

logger.warning("Could not save persistent state: {0}"

2812

2636

.format(os.strerror(e.errno)))

2813

2637

else:

2814

2638

logger.warning("Could not save persistent state:",

2815

2639

exc_info=e)

2816

raise

2640

raise e

2817

2641

2818

2642

# Delete all clients, and settings from config

2819

2643

while tcp_server.clients:

2843

2667

tcp_server.server_activate()

2844

2668

2845

2669

# Find out what port we got

2846

if zeroconf:

2847

service.port = tcp_server.socket.getsockname()[1]

2670

service.port = tcp_server.socket.getsockname()[1]

2848

2671

if use_ipv6:

2849

2672

logger.info("Now listening on address %r, port %d,"

2850

2673

" flowinfo %d, scope_id %d",

2856

2679

#service.interface = tcp_server.socket.getsockname()[3]

2857

2680

2858

2681

try:

2859

if zeroconf:

2860

# From the Avahi example code

2861

try:

2862

service.activate()

2863

except dbus.exceptions.DBusException as error:

2864

logger.critical("D-Bus Exception", exc_info=error)

2865

cleanup()

2866

sys.exit(1)

2867

# End of Avahi example code

2682

# From the Avahi example code

2683

try:

2684

service.activate()

2685

except dbus.exceptions.DBusException as error:

2686

logger.critical("D-Bus Exception", exc_info=error)

2687

cleanup()

2688

sys.exit(1)

2689

# End of Avahi example code

2868

2690

2869

2691

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2870

2692

lambda *args, **kwargs: