74
84
from IN import SO_BINDTODEVICE
75
85
except ImportError:
76
# From /usr/include/asm/socket.h
82
logger = logging.Logger(u'mandos')
86
SO_BINDTODEVICE = None
89
stored_state_file = "clients.pickle"
91
logger = logging.getLogger()
83
92
syslogger = (logging.handlers.SysLogHandler
84
93
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
85
address = "/dev/log"))
86
syslogger.setFormatter(logging.Formatter
87
(u'Mandos [%(process)d]: %(levelname)s:'
89
logger.addHandler(syslogger)
91
console = logging.StreamHandler()
92
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
95
logger.addHandler(console)
94
address = str("/dev/log")))
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
108
interface_index = struct.unpack(str("I"),
110
return interface_index
113
def initlogger(debug, level=logging.WARNING):
114
"""init logger and add loglevel"""
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
119
logger.addHandler(syslogger)
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
127
logger.addHandler(console)
128
logger.setLevel(level)
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
150
def __exit__ (self, exc_type, exc_value, traceback):
158
if self.tempdir is not None:
159
# Delete contents of tempdir
160
for root, dirs, files in os.walk(self.tempdir,
162
for filename in files:
163
os.remove(os.path.join(root, filename))
165
os.rmdir(os.path.join(root, dirname))
167
os.rmdir(self.tempdir)
170
def password_encode(self, password):
171
# Passphrase can not be empty and can not contain newlines or
172
# NUL bytes. So we prefix it and hex encode it.
173
return b"mandos" + binascii.hexlify(password)
175
def encrypt(self, data, password):
176
self.gnupg.passphrase = self.password_encode(password)
177
with open(os.devnull) as devnull:
179
proc = self.gnupg.run(['--symmetric'],
180
create_fhs=['stdin', 'stdout'],
181
attach_fhs={'stderr': devnull})
182
with contextlib.closing(proc.handles['stdin']) as f:
184
with contextlib.closing(proc.handles['stdout']) as f:
185
ciphertext = f.read()
189
self.gnupg.passphrase = None
192
def decrypt(self, data, password):
193
self.gnupg.passphrase = self.password_encode(password)
194
with open(os.devnull) as devnull:
196
proc = self.gnupg.run(['--decrypt'],
197
create_fhs=['stdin', 'stdout'],
198
attach_fhs={'stderr': devnull})
199
with contextlib.closing(proc.handles['stdin'] ) as f:
201
with contextlib.closing(proc.handles['stdout']) as f:
202
decrypted_plaintext = f.read()
206
self.gnupg.passphrase = None
207
return decrypted_plaintext
97
211
class AvahiError(Exception):
98
212
def __init__(self, value, *args, **kwargs):
139
256
self.rename_count = 0
140
257
self.max_renames = max_renames
141
258
self.protocol = protocol
259
self.group = None # our entry group
262
self.entry_group_state_changed_match = None
142
263
def rename(self):
143
264
"""Derived from the Avahi example code"""
144
265
if self.rename_count >= self.max_renames:
145
logger.critical(u"No suitable Zeroconf service name found"
146
u" after %i retries, exiting.",
266
logger.critical("No suitable Zeroconf service name found"
267
" after %i retries, exiting.",
147
268
self.rename_count)
148
raise AvahiServiceError(u"Too many renames")
149
self.name = server.GetAlternativeServiceName(self.name)
150
logger.info(u"Changing Zeroconf service name to %r ...",
269
raise AvahiServiceError("Too many renames")
270
self.name = unicode(self.server
271
.GetAlternativeServiceName(self.name))
272
logger.info("Changing Zeroconf service name to %r ...",
152
syslogger.setFormatter(logging.Formatter
153
(u'Mandos (%s) [%%(process)d]:'
154
u' %%(levelname)s: %%(message)s'
277
except dbus.exceptions.DBusException as error:
278
logger.critical("DBusException: %s", error)
158
281
self.rename_count += 1
159
282
def remove(self):
160
283
"""Derived from the Avahi example code"""
161
if group is not None:
284
if self.entry_group_state_changed_match is not None:
285
self.entry_group_state_changed_match.remove()
286
self.entry_group_state_changed_match = None
287
if self.group is not None:
164
290
"""Derived from the Avahi example code"""
167
group = dbus.Interface(bus.get_object
169
server.EntryGroupNew()),
170
avahi.DBUS_INTERFACE_ENTRY_GROUP)
171
group.connect_to_signal('StateChanged',
172
entry_group_state_changed)
173
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
174
service.name, service.type)
176
self.interface, # interface
177
self.protocol, # protocol
178
dbus.UInt32(0), # flags
179
self.name, self.type,
180
self.domain, self.host,
181
dbus.UInt16(self.port),
182
avahi.string_array_to_txt_array(self.TXT))
185
# From the Avahi example code:
186
group = None # our entry group
187
# End of Avahi example code
190
def _datetime_to_dbus(dt, variant_level=0):
191
"""Convert a UTC datetime.datetime() to a D-Bus type."""
192
return dbus.String(dt.isoformat(), variant_level=variant_level)
292
if self.group is None:
293
self.group = dbus.Interface(
294
self.bus.get_object(avahi.DBUS_NAME,
295
self.server.EntryGroupNew()),
296
avahi.DBUS_INTERFACE_ENTRY_GROUP)
297
self.entry_group_state_changed_match = (
298
self.group.connect_to_signal(
299
'StateChanged', self.entry_group_state_changed))
300
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
301
self.name, self.type)
302
self.group.AddService(
305
dbus.UInt32(0), # flags
306
self.name, self.type,
307
self.domain, self.host,
308
dbus.UInt16(self.port),
309
avahi.string_array_to_txt_array(self.TXT))
311
def entry_group_state_changed(self, state, error):
312
"""Derived from the Avahi example code"""
313
logger.debug("Avahi entry group state change: %i", state)
315
if state == avahi.ENTRY_GROUP_ESTABLISHED:
316
logger.debug("Zeroconf service established.")
317
elif state == avahi.ENTRY_GROUP_COLLISION:
318
logger.info("Zeroconf service name collision.")
320
elif state == avahi.ENTRY_GROUP_FAILURE:
321
logger.critical("Avahi: Error in group state changed %s",
323
raise AvahiGroupError("State changed: %s"
326
"""Derived from the Avahi example code"""
327
if self.group is not None:
330
except (dbus.exceptions.UnknownMethodException,
331
dbus.exceptions.DBusException):
335
def server_state_changed(self, state, error=None):
336
"""Derived from the Avahi example code"""
337
logger.debug("Avahi server state change: %i", state)
338
bad_states = { avahi.SERVER_INVALID:
339
"Zeroconf server invalid",
340
avahi.SERVER_REGISTERING: None,
341
avahi.SERVER_COLLISION:
342
"Zeroconf server name collision",
343
avahi.SERVER_FAILURE:
344
"Zeroconf server failure" }
345
if state in bad_states:
346
if bad_states[state] is not None:
348
logger.error(bad_states[state])
350
logger.error(bad_states[state] + ": %r", error)
352
elif state == avahi.SERVER_RUNNING:
356
logger.debug("Unknown state: %r", state)
358
logger.debug("Unknown state: %r: %r", state, error)
360
"""Derived from the Avahi example code"""
361
if self.server is None:
362
self.server = dbus.Interface(
363
self.bus.get_object(avahi.DBUS_NAME,
364
avahi.DBUS_PATH_SERVER,
365
follow_name_owner_changes=True),
366
avahi.DBUS_INTERFACE_SERVER)
367
self.server.connect_to_signal("StateChanged",
368
self.server_state_changed)
369
self.server_state_changed(self.server.GetState())
371
class AvahiServiceToSyslog(AvahiService):
373
"""Add the new name to the syslog messages"""
374
ret = AvahiService.rename(self)
375
syslogger.setFormatter(logging.Formatter
376
('Mandos (%s) [%%(process)d]:'
377
' %%(levelname)s: %%(message)s'
381
def timedelta_to_milliseconds(td):
382
"Convert a datetime.timedelta() to milliseconds"
383
return ((td.days * 24 * 60 * 60 * 1000)
384
+ (td.seconds * 1000)
385
+ (td.microseconds // 1000))
195
387
class Client(object):
196
388
"""A representation of a client host served by this server.
199
name: string; from the config file, used in log messages and
201
fingerprint: string (40 or 32 hexadecimal digits); used to
202
uniquely identify the client
203
secret: bytestring; sent verbatim (over TLS) to client
204
host: string; available for use by the checker command
205
created: datetime.datetime(); (UTC) object creation
206
last_enabled: datetime.datetime(); (UTC)
208
last_checked_ok: datetime.datetime(); (UTC) or None
209
timeout: datetime.timedelta(); How long from last_checked_ok
210
until this client is invalid
211
interval: datetime.timedelta(); How often to start a new checker
212
disable_hook: If set, called by disable() as disable_hook(self)
391
approved: bool(); 'None' if not yet approved/disapproved
392
approval_delay: datetime.timedelta(); Time to wait for approval
393
approval_duration: datetime.timedelta(); Duration of one approval
213
394
checker: subprocess.Popen(); a running checker process used
214
395
to see if the client lives.
215
396
'None' if no process is running.
216
checker_initiator_tag: a gobject event source tag, or None
217
disable_initiator_tag: - '' -
218
checker_callback_tag: - '' -
219
checker_command: string; External command which is run to check if
220
client lives. %() expansions are done at
397
checker_callback_tag: a gobject event source tag, or None
398
checker_command: string; External command which is run to check
399
if client lives. %() expansions are done at
221
400
runtime with vars(self) as dict, so that for
222
401
instance %(name)s can be used in the command.
402
checker_initiator_tag: a gobject event source tag, or None
403
created: datetime.datetime(); (UTC) object creation
404
client_structure: Object describing what attributes a client has
405
and is used for storing the client at exit
223
406
current_checker_command: string; current running checker_command
407
disable_initiator_tag: a gobject event source tag, or None
409
fingerprint: string (40 or 32 hexadecimal digits); used to
410
uniquely identify the client
411
host: string; available for use by the checker command
412
interval: datetime.timedelta(); How often to start a new checker
413
last_approval_request: datetime.datetime(); (UTC) or None
414
last_checked_ok: datetime.datetime(); (UTC) or None
415
last_checker_status: integer between 0 and 255 reflecting exit
416
status of last checker. -1 reflects crashed
418
last_enabled: datetime.datetime(); (UTC) or None
419
name: string; from the config file, used in log messages and
421
secret: bytestring; sent verbatim (over TLS) to client
422
timeout: datetime.timedelta(); How long from last_checked_ok
423
until this client is disabled
424
extended_timeout: extra long timeout when password has been sent
425
runtime_expansions: Allowed attributes for runtime expansion.
426
expires: datetime.datetime(); time (UTC) when a client will be
227
def _datetime_to_milliseconds(dt):
228
"Convert a datetime.datetime() to milliseconds"
229
return ((dt.days * 24 * 60 * 60 * 1000)
230
+ (dt.seconds * 1000)
231
+ (dt.microseconds // 1000))
430
runtime_expansions = ("approval_delay", "approval_duration",
431
"created", "enabled", "fingerprint",
432
"host", "interval", "last_checked_ok",
433
"last_enabled", "name", "timeout")
434
client_defaults = { "timeout": "5m",
435
"extended_timeout": "15m",
437
"checker": "fping -q -- %%(host)s",
439
"approval_delay": "0s",
440
"approval_duration": "1s",
441
"approved_by_default": "True",
233
445
def timeout_milliseconds(self):
234
446
"Return the 'timeout' attribute in milliseconds"
235
return self._datetime_to_milliseconds(self.timeout)
447
return timedelta_to_milliseconds(self.timeout)
449
def extended_timeout_milliseconds(self):
450
"Return the 'extended_timeout' attribute in milliseconds"
451
return timedelta_to_milliseconds(self.extended_timeout)
237
453
def interval_milliseconds(self):
238
454
"Return the 'interval' attribute in milliseconds"
239
return self._datetime_to_milliseconds(self.interval)
455
return timedelta_to_milliseconds(self.interval)
241
def __init__(self, name = None, disable_hook=None, config=None):
457
def approval_delay_milliseconds(self):
458
return timedelta_to_milliseconds(self.approval_delay)
461
def config_parser(config):
462
""" Construct a new dict of client settings of this form:
463
{ client_name: {setting_name: value, ...}, ...}
464
with exceptions for any special settings as defined above"""
466
for client_name in config.sections():
467
section = dict(config.items(client_name))
468
client = settings[client_name] = {}
470
client["host"] = section["host"]
471
# Reformat values from string types to Python types
472
client["approved_by_default"] = config.getboolean(
473
client_name, "approved_by_default")
474
client["enabled"] = config.getboolean(client_name, "enabled")
476
client["fingerprint"] = (section["fingerprint"].upper()
478
if "secret" in section:
479
client["secret"] = section["secret"].decode("base64")
480
elif "secfile" in section:
481
with open(os.path.expanduser(os.path.expandvars
482
(section["secfile"])),
484
client["secret"] = secfile.read()
486
raise TypeError("No secret or secfile for section %s"
488
client["timeout"] = string_to_delta(section["timeout"])
489
client["extended_timeout"] = string_to_delta(
490
section["extended_timeout"])
491
client["interval"] = string_to_delta(section["interval"])
492
client["approval_delay"] = string_to_delta(
493
section["approval_delay"])
494
client["approval_duration"] = string_to_delta(
495
section["approval_duration"])
496
client["checker_command"] = section["checker"]
497
client["last_approval_request"] = None
498
client["last_checked_ok"] = None
499
client["last_checker_status"] = None
500
if client["enabled"]:
501
client["last_enabled"] = datetime.datetime.utcnow()
502
client["expires"] = (datetime.datetime.utcnow()
505
client["last_enabled"] = None
506
client["expires"] = None
511
def __init__(self, settings, name = None):
242
512
"""Note: the 'checker' key in 'config' sets the
243
513
'checker_command' attribute and *not* the 'checker'
248
logger.debug(u"Creating client %r", self.name)
516
# adding all client settings
517
for setting, value in settings.iteritems():
518
setattr(self, setting, value)
520
logger.debug("Creating client %r", self.name)
249
521
# Uppercase and remove spaces from fingerprint for later
250
522
# comparison purposes with return value from the fingerprint()
252
self.fingerprint = (config[u"fingerprint"].upper()
254
logger.debug(u" Fingerprint: %s", self.fingerprint)
255
if u"secret" in config:
256
self.secret = config[u"secret"].decode(u"base64")
257
elif u"secfile" in config:
258
with closing(open(os.path.expanduser
260
(config[u"secfile"])))) as secfile:
261
self.secret = secfile.read()
263
raise TypeError(u"No secret or secfile for client %s"
265
self.host = config.get(u"host", u"")
266
self.created = datetime.datetime.utcnow()
268
self.last_enabled = None
269
self.last_checked_ok = None
270
self.timeout = string_to_delta(config[u"timeout"])
271
self.interval = string_to_delta(config[u"interval"])
272
self.disable_hook = disable_hook
524
logger.debug(" Fingerprint: %s", self.fingerprint)
525
self.created = settings.get("created", datetime.datetime.utcnow())
527
# attributes specific for this server instance
273
528
self.checker = None
274
529
self.checker_initiator_tag = None
275
530
self.disable_initiator_tag = None
276
531
self.checker_callback_tag = None
277
self.checker_command = config[u"checker"]
278
532
self.current_checker_command = None
279
self.last_connect = None
534
self.approvals_pending = 0
535
self.changedstate = (multiprocessing_manager
536
.Condition(multiprocessing_manager
538
self.client_structure = [attr for attr in
539
self.__dict__.iterkeys()
540
if not attr.startswith("_")]
541
self.client_structure.append("client_structure")
543
for name, t in inspect.getmembers(type(self),
547
if not name.startswith("_"):
548
self.client_structure.append(name)
550
# Send notice to process children that client state has changed
551
def send_changedstate(self):
552
with self.changedstate:
553
self.changedstate.notify_all()
281
555
def enable(self):
282
556
"""Start this client's checker and timeout hooks"""
557
if getattr(self, "enabled", False):
560
self.send_changedstate()
561
self.expires = datetime.datetime.utcnow() + self.timeout
283
563
self.last_enabled = datetime.datetime.utcnow()
566
def disable(self, quiet=True):
567
"""Disable this client."""
568
if not getattr(self, "enabled", False):
571
self.send_changedstate()
573
logger.info("Disabling client %s", self.name)
574
if getattr(self, "disable_initiator_tag", False):
575
gobject.source_remove(self.disable_initiator_tag)
576
self.disable_initiator_tag = None
578
if getattr(self, "checker_initiator_tag", False):
579
gobject.source_remove(self.checker_initiator_tag)
580
self.checker_initiator_tag = None
583
# Do not run this again if called by a gobject.timeout_add
589
def init_checker(self):
284
590
# Schedule a new checker to be started an 'interval' from now,
285
591
# and every interval from then on.
286
592
self.checker_initiator_tag = (gobject.timeout_add
287
593
(self.interval_milliseconds(),
288
594
self.start_checker))
289
# Also start a new checker *right now*.
291
595
# Schedule a disable() when 'timeout' has passed
292
596
self.disable_initiator_tag = (gobject.timeout_add
293
597
(self.timeout_milliseconds(),
298
"""Disable this client."""
299
if not getattr(self, "enabled", False):
301
logger.info(u"Disabling client %s", self.name)
302
if getattr(self, u"disable_initiator_tag", False):
303
gobject.source_remove(self.disable_initiator_tag)
304
self.disable_initiator_tag = None
305
if getattr(self, u"checker_initiator_tag", False):
306
gobject.source_remove(self.checker_initiator_tag)
307
self.checker_initiator_tag = None
309
if self.disable_hook:
310
self.disable_hook(self)
312
# Do not run this again if called by a gobject.timeout_add
316
self.disable_hook = None
599
# Also start a new checker *right now*.
319
602
def checker_callback(self, pid, condition, command):
320
603
"""The checker has completed, so take appropriate actions."""
321
604
self.checker_callback_tag = None
322
605
self.checker = None
323
606
if os.WIFEXITED(condition):
324
exitstatus = os.WEXITSTATUS(condition)
326
logger.info(u"Checker for %(name)s succeeded",
607
self.last_checker_status = os.WEXITSTATUS(condition)
608
if self.last_checker_status == 0:
609
logger.info("Checker for %(name)s succeeded",
328
611
self.checked_ok()
330
logger.info(u"Checker for %(name)s failed",
613
logger.info("Checker for %(name)s failed",
333
logger.warning(u"Checker for %(name)s crashed?",
616
self.last_checker_status = -1
617
logger.warning("Checker for %(name)s crashed?",
336
def checked_ok(self):
620
def checked_ok(self, timeout=None):
337
621
"""Bump up the timeout for this client.
339
623
This should only be called when the client has been seen,
627
timeout = self.timeout
342
628
self.last_checked_ok = datetime.datetime.utcnow()
343
gobject.source_remove(self.disable_initiator_tag)
344
self.disable_initiator_tag = (gobject.timeout_add
345
(self.timeout_milliseconds(),
629
if self.disable_initiator_tag is not None:
630
gobject.source_remove(self.disable_initiator_tag)
631
if getattr(self, "enabled", False):
632
self.disable_initiator_tag = (gobject.timeout_add
633
(timedelta_to_milliseconds
634
(timeout), self.disable))
635
self.expires = datetime.datetime.utcnow() + timeout
637
def need_approval(self):
638
self.last_approval_request = datetime.datetime.utcnow()
348
640
def start_checker(self):
349
641
"""Start a new checker subprocess if one is not running.
418
717
if self.checker_callback_tag:
419
718
gobject.source_remove(self.checker_callback_tag)
420
719
self.checker_callback_tag = None
421
if getattr(self, u"checker", None) is None:
720
if getattr(self, "checker", None) is None:
423
logger.debug(u"Stopping checker for %(name)s", vars(self))
722
logger.debug("Stopping checker for %(name)s", vars(self))
425
724
os.kill(self.checker.pid, signal.SIGTERM)
427
726
#if self.checker.poll() is None:
428
727
# os.kill(self.checker.pid, signal.SIGKILL)
429
except OSError, error:
728
except OSError as error:
430
729
if error.errno != errno.ESRCH: # No such process
432
731
self.checker = None
434
def still_valid(self):
435
"""Has the timeout not yet passed for this client?"""
436
if not getattr(self, u"enabled", False):
438
now = datetime.datetime.utcnow()
439
if self.last_checked_ok is None:
440
return now < (self.created + self.timeout)
442
return now < (self.last_checked_ok + self.timeout)
445
class ClientDBus(Client, dbus.service.Object):
734
def dbus_service_property(dbus_interface, signature="v",
735
access="readwrite", byte_arrays=False):
736
"""Decorators for marking methods of a DBusObjectWithProperties to
737
become properties on the D-Bus.
739
The decorated method will be called with no arguments by "Get"
740
and with one argument by "Set".
742
The parameters, where they are supported, are the same as
743
dbus.service.method, except there is only "signature", since the
744
type from Get() and the type sent to Set() is the same.
746
# Encoding deeply encoded byte arrays is not supported yet by the
747
# "Set" method, so we fail early here:
748
if byte_arrays and signature != "ay":
749
raise ValueError("Byte arrays not supported for non-'ay'"
750
" signature %r" % signature)
752
func._dbus_is_property = True
753
func._dbus_interface = dbus_interface
754
func._dbus_signature = signature
755
func._dbus_access = access
756
func._dbus_name = func.__name__
757
if func._dbus_name.endswith("_dbus_property"):
758
func._dbus_name = func._dbus_name[:-14]
759
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
764
class DBusPropertyException(dbus.exceptions.DBusException):
765
"""A base class for D-Bus property-related exceptions
767
def __unicode__(self):
768
return unicode(str(self))
771
class DBusPropertyAccessException(DBusPropertyException):
772
"""A property's access permissions disallows an operation.
777
class DBusPropertyNotFound(DBusPropertyException):
778
"""An attempt was made to access a non-existing property.
783
class DBusObjectWithProperties(dbus.service.Object):
784
"""A D-Bus object with properties.
786
Classes inheriting from this can use the dbus_service_property
787
decorator to expose methods as D-Bus properties. It exposes the
788
standard Get(), Set(), and GetAll() methods on the D-Bus.
792
def _is_dbus_property(obj):
793
return getattr(obj, "_dbus_is_property", False)
795
def _get_all_dbus_properties(self):
796
"""Returns a generator of (name, attribute) pairs
798
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
799
for cls in self.__class__.__mro__
801
inspect.getmembers(cls, self._is_dbus_property))
803
def _get_dbus_property(self, interface_name, property_name):
804
"""Returns a bound method if one exists which is a D-Bus
805
property with the specified name and interface.
807
for cls in self.__class__.__mro__:
808
for name, value in (inspect.getmembers
809
(cls, self._is_dbus_property)):
810
if (value._dbus_name == property_name
811
and value._dbus_interface == interface_name):
812
return value.__get__(self)
815
raise DBusPropertyNotFound(self.dbus_object_path + ":"
816
+ interface_name + "."
819
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
821
def Get(self, interface_name, property_name):
822
"""Standard D-Bus property Get() method, see D-Bus standard.
824
prop = self._get_dbus_property(interface_name, property_name)
825
if prop._dbus_access == "write":
826
raise DBusPropertyAccessException(property_name)
828
if not hasattr(value, "variant_level"):
830
return type(value)(value, variant_level=value.variant_level+1)
832
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
833
def Set(self, interface_name, property_name, value):
834
"""Standard D-Bus property Set() method, see D-Bus standard.
836
prop = self._get_dbus_property(interface_name, property_name)
837
if prop._dbus_access == "read":
838
raise DBusPropertyAccessException(property_name)
839
if prop._dbus_get_args_options["byte_arrays"]:
840
# The byte_arrays option is not supported yet on
841
# signatures other than "ay".
842
if prop._dbus_signature != "ay":
844
value = dbus.ByteArray(''.join(unichr(byte)
848
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
849
out_signature="a{sv}")
850
def GetAll(self, interface_name):
851
"""Standard D-Bus property GetAll() method, see D-Bus
854
Note: Will not include properties with access="write".
857
for name, prop in self._get_all_dbus_properties():
859
and interface_name != prop._dbus_interface):
860
# Interface non-empty but did not match
862
# Ignore write-only properties
863
if prop._dbus_access == "write":
866
if not hasattr(value, "variant_level"):
867
properties[name] = value
869
properties[name] = type(value)(value, variant_level=
870
value.variant_level+1)
871
return dbus.Dictionary(properties, signature="sv")
873
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
875
path_keyword='object_path',
876
connection_keyword='connection')
877
def Introspect(self, object_path, connection):
878
"""Standard D-Bus method, overloaded to insert property tags.
880
xmlstring = dbus.service.Object.Introspect(self, object_path,
883
document = xml.dom.minidom.parseString(xmlstring)
884
def make_tag(document, name, prop):
885
e = document.createElement("property")
886
e.setAttribute("name", name)
887
e.setAttribute("type", prop._dbus_signature)
888
e.setAttribute("access", prop._dbus_access)
890
for if_tag in document.getElementsByTagName("interface"):
891
for tag in (make_tag(document, name, prop)
893
in self._get_all_dbus_properties()
894
if prop._dbus_interface
895
== if_tag.getAttribute("name")):
896
if_tag.appendChild(tag)
897
# Add the names to the return values for the
898
# "org.freedesktop.DBus.Properties" methods
899
if (if_tag.getAttribute("name")
900
== "org.freedesktop.DBus.Properties"):
901
for cn in if_tag.getElementsByTagName("method"):
902
if cn.getAttribute("name") == "Get":
903
for arg in cn.getElementsByTagName("arg"):
904
if (arg.getAttribute("direction")
906
arg.setAttribute("name", "value")
907
elif cn.getAttribute("name") == "GetAll":
908
for arg in cn.getElementsByTagName("arg"):
909
if (arg.getAttribute("direction")
911
arg.setAttribute("name", "props")
912
xmlstring = document.toxml("utf-8")
914
except (AttributeError, xml.dom.DOMException,
915
xml.parsers.expat.ExpatError) as error:
916
logger.error("Failed to override Introspection method",
921
def datetime_to_dbus (dt, variant_level=0):
922
"""Convert a UTC datetime.datetime() to a D-Bus type."""
924
return dbus.String("", variant_level = variant_level)
925
return dbus.String(dt.isoformat(),
926
variant_level=variant_level)
929
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
931
"""Applied to an empty subclass of a D-Bus object, this metaclass
932
will add additional D-Bus attributes matching a certain pattern.
934
def __new__(mcs, name, bases, attr):
935
# Go through all the base classes which could have D-Bus
936
# methods, signals, or properties in them
937
for base in (b for b in bases
938
if issubclass(b, dbus.service.Object)):
939
# Go though all attributes of the base class
940
for attrname, attribute in inspect.getmembers(base):
941
# Ignore non-D-Bus attributes, and D-Bus attributes
942
# with the wrong interface name
943
if (not hasattr(attribute, "_dbus_interface")
944
or not attribute._dbus_interface
945
.startswith("se.recompile.Mandos")):
947
# Create an alternate D-Bus interface name based on
949
alt_interface = (attribute._dbus_interface
950
.replace("se.recompile.Mandos",
951
"se.bsnet.fukt.Mandos"))
952
# Is this a D-Bus signal?
953
if getattr(attribute, "_dbus_is_signal", False):
954
# Extract the original non-method function by
956
nonmethod_func = (dict(
957
zip(attribute.func_code.co_freevars,
958
attribute.__closure__))["func"]
960
# Create a new, but exactly alike, function
961
# object, and decorate it to be a new D-Bus signal
962
# with the alternate D-Bus interface name
963
new_function = (dbus.service.signal
965
attribute._dbus_signature)
967
nonmethod_func.func_code,
968
nonmethod_func.func_globals,
969
nonmethod_func.func_name,
970
nonmethod_func.func_defaults,
971
nonmethod_func.func_closure)))
972
# Define a creator of a function to call both the
973
# old and new functions, so both the old and new
974
# signals gets sent when the function is called
975
def fixscope(func1, func2):
976
"""This function is a scope container to pass
977
func1 and func2 to the "call_both" function
978
outside of its arguments"""
979
def call_both(*args, **kwargs):
980
"""This function will emit two D-Bus
981
signals by calling func1 and func2"""
982
func1(*args, **kwargs)
983
func2(*args, **kwargs)
985
# Create the "call_both" function and add it to
987
attr[attrname] = fixscope(attribute,
989
# Is this a D-Bus method?
990
elif getattr(attribute, "_dbus_is_method", False):
991
# Create a new, but exactly alike, function
992
# object. Decorate it to be a new D-Bus method
993
# with the alternate D-Bus interface name. Add it
995
attr[attrname] = (dbus.service.method
997
attribute._dbus_in_signature,
998
attribute._dbus_out_signature)
1000
(attribute.func_code,
1001
attribute.func_globals,
1002
attribute.func_name,
1003
attribute.func_defaults,
1004
attribute.func_closure)))
1005
# Is this a D-Bus property?
1006
elif getattr(attribute, "_dbus_is_property", False):
1007
# Create a new, but exactly alike, function
1008
# object, and decorate it to be a new D-Bus
1009
# property with the alternate D-Bus interface
1010
# name. Add it to the class.
1011
attr[attrname] = (dbus_service_property
1013
attribute._dbus_signature,
1014
attribute._dbus_access,
1016
._dbus_get_args_options
1019
(attribute.func_code,
1020
attribute.func_globals,
1021
attribute.func_name,
1022
attribute.func_defaults,
1023
attribute.func_closure)))
1024
return type.__new__(mcs, name, bases, attr)
1027
class ClientDBus(Client, DBusObjectWithProperties):
446
1028
"""A Client class using D-Bus
449
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
1031
dbus_object_path: dbus.ObjectPath
1032
bus: dbus.SystemBus()
1035
runtime_expansions = (Client.runtime_expansions
1036
+ ("dbus_object_path",))
451
1038
# dbus.service.Object doesn't use super(), so we can't either.
453
def __init__(self, *args, **kwargs):
1040
def __init__(self, bus = None, *args, **kwargs):
454
1042
Client.__init__(self, *args, **kwargs)
1043
self._approvals_pending = 0
1045
self._approvals_pending = 0
455
1046
# Only now, when this client is initialized, can it show up on
1048
client_object_name = unicode(self.name).translate(
1049
{ord("."): ord("_"),
1050
ord("-"): ord("_")})
457
1051
self.dbus_object_path = (dbus.ObjectPath
459
+ self.name.replace(u".", u"_")))
460
dbus.service.Object.__init__(self, bus,
461
self.dbus_object_path)
463
oldstate = getattr(self, u"enabled", False)
464
r = Client.enable(self)
465
if oldstate != self.enabled:
467
self.PropertyChanged(dbus.String(u"enabled"),
468
dbus.Boolean(True, variant_level=1))
469
self.PropertyChanged(dbus.String(u"last_enabled"),
470
(_datetime_to_dbus(self.last_enabled,
474
def disable(self, signal = True):
475
oldstate = getattr(self, u"enabled", False)
476
r = Client.disable(self)
477
if signal and oldstate != self.enabled:
479
self.PropertyChanged(dbus.String(u"enabled"),
480
dbus.Boolean(False, variant_level=1))
1052
("/clients/" + client_object_name))
1053
DBusObjectWithProperties.__init__(self, self.bus,
1054
self.dbus_object_path)
1056
def notifychangeproperty(transform_func,
1057
dbus_name, type_func=lambda x: x,
1059
""" Modify a variable so that it's a property which announces
1060
its changes to DBus.
1062
transform_fun: Function that takes a value and a variant_level
1063
and transforms it to a D-Bus type.
1064
dbus_name: D-Bus name of the variable
1065
type_func: Function that transform the value before sending it
1066
to the D-Bus. Default: no transform
1067
variant_level: D-Bus variant level. Default: 1
1069
attrname = "_{0}".format(dbus_name)
1070
def setter(self, value):
1071
if hasattr(self, "dbus_object_path"):
1072
if (not hasattr(self, attrname) or
1073
type_func(getattr(self, attrname, None))
1074
!= type_func(value)):
1075
dbus_value = transform_func(type_func(value),
1078
self.PropertyChanged(dbus.String(dbus_name),
1080
setattr(self, attrname, value)
1082
return property(lambda self: getattr(self, attrname), setter)
1085
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1086
approvals_pending = notifychangeproperty(dbus.Boolean,
1089
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1090
last_enabled = notifychangeproperty(datetime_to_dbus,
1092
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1093
type_func = lambda checker:
1094
checker is not None)
1095
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1097
last_approval_request = notifychangeproperty(
1098
datetime_to_dbus, "LastApprovalRequest")
1099
approved_by_default = notifychangeproperty(dbus.Boolean,
1100
"ApprovedByDefault")
1101
approval_delay = notifychangeproperty(dbus.UInt64,
1104
timedelta_to_milliseconds)
1105
approval_duration = notifychangeproperty(
1106
dbus.UInt64, "ApprovalDuration",
1107
type_func = timedelta_to_milliseconds)
1108
host = notifychangeproperty(dbus.String, "Host")
1109
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1111
timedelta_to_milliseconds)
1112
extended_timeout = notifychangeproperty(
1113
dbus.UInt64, "ExtendedTimeout",
1114
type_func = timedelta_to_milliseconds)
1115
interval = notifychangeproperty(dbus.UInt64,
1118
timedelta_to_milliseconds)
1119
checker_command = notifychangeproperty(dbus.String, "Checker")
1121
del notifychangeproperty
483
1123
def __del__(self, *args, **kwargs):
485
1125
self.remove_from_connection()
486
1126
except LookupError:
488
if hasattr(dbus.service.Object, u"__del__"):
489
dbus.service.Object.__del__(self, *args, **kwargs)
1128
if hasattr(DBusObjectWithProperties, "__del__"):
1129
DBusObjectWithProperties.__del__(self, *args, **kwargs)
490
1130
Client.__del__(self, *args, **kwargs)
492
1132
def checker_callback(self, pid, condition, command,
493
1133
*args, **kwargs):
494
1134
self.checker_callback_tag = None
495
1135
self.checker = None
497
self.PropertyChanged(dbus.String(u"checker_running"),
498
dbus.Boolean(False, variant_level=1))
499
1136
if os.WIFEXITED(condition):
500
1137
exitstatus = os.WEXITSTATUS(condition)
501
1138
# Emit D-Bus signal
532
1160
and old_checker_pid != self.checker.pid):
533
1161
# Emit D-Bus signal
534
1162
self.CheckerStarted(self.current_checker_command)
535
self.PropertyChanged(
536
dbus.String(u"checker_running"),
537
dbus.Boolean(True, variant_level=1))
540
def stop_checker(self, *args, **kwargs):
541
old_checker = getattr(self, u"checker", None)
542
r = Client.stop_checker(self, *args, **kwargs)
543
if (old_checker is not None
544
and getattr(self, u"checker", None) is None):
545
self.PropertyChanged(dbus.String(u"checker_running"),
546
dbus.Boolean(False, variant_level=1))
549
## D-Bus methods & signals
550
_interface = u"se.bsnet.fukt.Mandos.Client"
553
@dbus.service.method(_interface)
555
return self.checked_ok()
1165
def _reset_approved(self):
1166
self.approved = None
1169
def approve(self, value=True):
1170
self.send_changedstate()
1171
self.approved = value
1172
gobject.timeout_add(timedelta_to_milliseconds
1173
(self.approval_duration),
1174
self._reset_approved)
1177
## D-Bus methods, signals & properties
1178
_interface = "se.recompile.Mandos.Client"
557
1182
# CheckerCompleted - signal
558
@dbus.service.signal(_interface, signature=u"nxs")
1183
@dbus.service.signal(_interface, signature="nxs")
559
1184
def CheckerCompleted(self, exitcode, waitstatus, command):
563
1188
# CheckerStarted - signal
564
@dbus.service.signal(_interface, signature=u"s")
1189
@dbus.service.signal(_interface, signature="s")
565
1190
def CheckerStarted(self, command):
569
# GetAllProperties - method
570
@dbus.service.method(_interface, out_signature=u"a{sv}")
571
def GetAllProperties(self):
573
return dbus.Dictionary({
574
dbus.String(u"name"):
575
dbus.String(self.name, variant_level=1),
576
dbus.String(u"fingerprint"):
577
dbus.String(self.fingerprint, variant_level=1),
578
dbus.String(u"host"):
579
dbus.String(self.host, variant_level=1),
580
dbus.String(u"created"):
581
_datetime_to_dbus(self.created, variant_level=1),
582
dbus.String(u"last_enabled"):
583
(_datetime_to_dbus(self.last_enabled,
585
if self.last_enabled is not None
586
else dbus.Boolean(False, variant_level=1)),
587
dbus.String(u"enabled"):
588
dbus.Boolean(self.enabled, variant_level=1),
589
dbus.String(u"last_checked_ok"):
590
(_datetime_to_dbus(self.last_checked_ok,
592
if self.last_checked_ok is not None
593
else dbus.Boolean (False, variant_level=1)),
594
dbus.String(u"timeout"):
595
dbus.UInt64(self.timeout_milliseconds(),
597
dbus.String(u"interval"):
598
dbus.UInt64(self.interval_milliseconds(),
600
dbus.String(u"checker"):
601
dbus.String(self.checker_command,
603
dbus.String(u"checker_running"):
604
dbus.Boolean(self.checker is not None,
606
dbus.String(u"object_path"):
607
dbus.ObjectPath(self.dbus_object_path,
611
# IsStillValid - method
612
@dbus.service.method(_interface, out_signature=u"b")
613
def IsStillValid(self):
614
return self.still_valid()
616
1194
# PropertyChanged - signal
617
@dbus.service.signal(_interface, signature=u"sv")
1195
@dbus.service.signal(_interface, signature="sv")
618
1196
def PropertyChanged(self, property, value):
622
# ReceivedSecret - signal
1200
# GotSecret - signal
623
1201
@dbus.service.signal(_interface)
624
def ReceivedSecret(self):
1202
def GotSecret(self):
1204
Is sent after a successful transfer of secret from the Mandos
1205
server to mandos-client
628
1209
# Rejected - signal
629
@dbus.service.signal(_interface)
634
# SetChecker - method
635
@dbus.service.method(_interface, in_signature=u"s")
636
def SetChecker(self, checker):
637
"D-Bus setter method"
638
self.checker_command = checker
640
self.PropertyChanged(dbus.String(u"checker"),
641
dbus.String(self.checker_command,
645
@dbus.service.method(_interface, in_signature=u"s")
646
def SetHost(self, host):
647
"D-Bus setter method"
650
self.PropertyChanged(dbus.String(u"host"),
651
dbus.String(self.host, variant_level=1))
653
# SetInterval - method
654
@dbus.service.method(_interface, in_signature=u"t")
655
def SetInterval(self, milliseconds):
656
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
658
self.PropertyChanged(dbus.String(u"interval"),
659
(dbus.UInt64(self.interval_milliseconds(),
663
@dbus.service.method(_interface, in_signature=u"ay",
665
def SetSecret(self, secret):
666
"D-Bus setter method"
667
self.secret = str(secret)
669
# SetTimeout - method
670
@dbus.service.method(_interface, in_signature=u"t")
671
def SetTimeout(self, milliseconds):
672
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
674
self.PropertyChanged(dbus.String(u"timeout"),
675
(dbus.UInt64(self.timeout_milliseconds(),
1210
@dbus.service.signal(_interface, signature="s")
1211
def Rejected(self, reason):
1215
# NeedApproval - signal
1216
@dbus.service.signal(_interface, signature="tb")
1217
def NeedApproval(self, timeout, default):
1219
return self.need_approval()
1221
# NeRwequest - signal
1222
@dbus.service.signal(_interface, signature="s")
1223
def NewRequest(self, ip):
1225
Is sent after a client request a password.
1232
@dbus.service.method(_interface, in_signature="b")
1233
def Approve(self, value):
1236
# CheckedOK - method
1237
@dbus.service.method(_interface)
1238
def CheckedOK(self):
678
1241
# Enable - method
679
1242
@dbus.service.method(_interface)
698
1261
def StopChecker(self):
699
1262
self.stop_checker()
1266
# ApprovalPending - property
1267
@dbus_service_property(_interface, signature="b", access="read")
1268
def ApprovalPending_dbus_property(self):
1269
return dbus.Boolean(bool(self.approvals_pending))
1271
# ApprovedByDefault - property
1272
@dbus_service_property(_interface, signature="b",
1274
def ApprovedByDefault_dbus_property(self, value=None):
1275
if value is None: # get
1276
return dbus.Boolean(self.approved_by_default)
1277
self.approved_by_default = bool(value)
1279
# ApprovalDelay - property
1280
@dbus_service_property(_interface, signature="t",
1282
def ApprovalDelay_dbus_property(self, value=None):
1283
if value is None: # get
1284
return dbus.UInt64(self.approval_delay_milliseconds())
1285
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1287
# ApprovalDuration - property
1288
@dbus_service_property(_interface, signature="t",
1290
def ApprovalDuration_dbus_property(self, value=None):
1291
if value is None: # get
1292
return dbus.UInt64(timedelta_to_milliseconds(
1293
self.approval_duration))
1294
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1297
@dbus_service_property(_interface, signature="s", access="read")
1298
def Name_dbus_property(self):
1299
return dbus.String(self.name)
1301
# Fingerprint - property
1302
@dbus_service_property(_interface, signature="s", access="read")
1303
def Fingerprint_dbus_property(self):
1304
return dbus.String(self.fingerprint)
1307
@dbus_service_property(_interface, signature="s",
1309
def Host_dbus_property(self, value=None):
1310
if value is None: # get
1311
return dbus.String(self.host)
1312
self.host = unicode(value)
1314
# Created - property
1315
@dbus_service_property(_interface, signature="s", access="read")
1316
def Created_dbus_property(self):
1317
return datetime_to_dbus(self.created)
1319
# LastEnabled - property
1320
@dbus_service_property(_interface, signature="s", access="read")
1321
def LastEnabled_dbus_property(self):
1322
return datetime_to_dbus(self.last_enabled)
1324
# Enabled - property
1325
@dbus_service_property(_interface, signature="b",
1327
def Enabled_dbus_property(self, value=None):
1328
if value is None: # get
1329
return dbus.Boolean(self.enabled)
1335
# LastCheckedOK - property
1336
@dbus_service_property(_interface, signature="s",
1338
def LastCheckedOK_dbus_property(self, value=None):
1339
if value is not None:
1342
return datetime_to_dbus(self.last_checked_ok)
1344
# Expires - property
1345
@dbus_service_property(_interface, signature="s", access="read")
1346
def Expires_dbus_property(self):
1347
return datetime_to_dbus(self.expires)
1349
# LastApprovalRequest - property
1350
@dbus_service_property(_interface, signature="s", access="read")
1351
def LastApprovalRequest_dbus_property(self):
1352
return datetime_to_dbus(self.last_approval_request)
1354
# Timeout - property
1355
@dbus_service_property(_interface, signature="t",
1357
def Timeout_dbus_property(self, value=None):
1358
if value is None: # get
1359
return dbus.UInt64(self.timeout_milliseconds())
1360
self.timeout = datetime.timedelta(0, 0, 0, value)
1361
if getattr(self, "disable_initiator_tag", None) is None:
1363
# Reschedule timeout
1364
gobject.source_remove(self.disable_initiator_tag)
1365
self.disable_initiator_tag = None
1367
time_to_die = timedelta_to_milliseconds((self
1372
if time_to_die <= 0:
1373
# The timeout has passed
1376
self.expires = (datetime.datetime.utcnow()
1377
+ datetime.timedelta(milliseconds =
1379
self.disable_initiator_tag = (gobject.timeout_add
1380
(time_to_die, self.disable))
1382
# ExtendedTimeout - property
1383
@dbus_service_property(_interface, signature="t",
1385
def ExtendedTimeout_dbus_property(self, value=None):
1386
if value is None: # get
1387
return dbus.UInt64(self.extended_timeout_milliseconds())
1388
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1390
# Interval - property
1391
@dbus_service_property(_interface, signature="t",
1393
def Interval_dbus_property(self, value=None):
1394
if value is None: # get
1395
return dbus.UInt64(self.interval_milliseconds())
1396
self.interval = datetime.timedelta(0, 0, 0, value)
1397
if getattr(self, "checker_initiator_tag", None) is None:
1400
# Reschedule checker run
1401
gobject.source_remove(self.checker_initiator_tag)
1402
self.checker_initiator_tag = (gobject.timeout_add
1403
(value, self.start_checker))
1404
self.start_checker() # Start one now, too
1406
# Checker - property
1407
@dbus_service_property(_interface, signature="s",
1409
def Checker_dbus_property(self, value=None):
1410
if value is None: # get
1411
return dbus.String(self.checker_command)
1412
self.checker_command = unicode(value)
1414
# CheckerRunning - property
1415
@dbus_service_property(_interface, signature="b",
1417
def CheckerRunning_dbus_property(self, value=None):
1418
if value is None: # get
1419
return dbus.Boolean(self.checker is not None)
1421
self.start_checker()
1425
# ObjectPath - property
1426
@dbus_service_property(_interface, signature="o", access="read")
1427
def ObjectPath_dbus_property(self):
1428
return self.dbus_object_path # is already a dbus.ObjectPath
1431
@dbus_service_property(_interface, signature="ay",
1432
access="write", byte_arrays=True)
1433
def Secret_dbus_property(self, value):
1434
self.secret = str(value)
1439
class ProxyClient(object):
1440
def __init__(self, child_pipe, fpr, address):
1441
self._pipe = child_pipe
1442
self._pipe.send(('init', fpr, address))
1443
if not self._pipe.recv():
1446
def __getattribute__(self, name):
1448
return super(ProxyClient, self).__getattribute__(name)
1449
self._pipe.send(('getattr', name))
1450
data = self._pipe.recv()
1451
if data[0] == 'data':
1453
if data[0] == 'function':
1454
def func(*args, **kwargs):
1455
self._pipe.send(('funcall', name, args, kwargs))
1456
return self._pipe.recv()[1]
1459
def __setattr__(self, name, value):
1461
return super(ProxyClient, self).__setattr__(name, value)
1462
self._pipe.send(('setattr', name, value))
1465
class ClientDBusTransitional(ClientDBus):
1466
__metaclass__ = AlternateDBusNamesMetaclass
704
1469
class ClientHandler(socketserver.BaseRequestHandler, object):
705
1470
"""A class to handle client connections.
708
1473
Note: This will run in its own forked process."""
710
1475
def handle(self):
711
logger.info(u"TCP connection from: %s",
712
unicode(self.client_address))
713
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
714
# Open IPC pipe to parent process
715
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
1476
with contextlib.closing(self.server.child_pipe) as child_pipe:
1477
logger.info("TCP connection from: %s",
1478
unicode(self.client_address))
1479
logger.debug("Pipe FD: %d",
1480
self.server.child_pipe.fileno())
716
1482
session = (gnutls.connection
717
1483
.ClientSession(self.request,
718
1484
gnutls.connection
719
1485
.X509Credentials()))
721
line = self.request.makefile().readline()
722
logger.debug(u"Protocol version: %r", line)
724
if int(line.strip().split()[0]) > 1:
726
except (ValueError, IndexError, RuntimeError), error:
727
logger.error(u"Unknown protocol version: %s", error)
730
1487
# Note: gnutls.connection.X509Credentials is really a
731
1488
# generic GnuTLS certificate credentials object so long as
732
1489
# no X.509 keys are added to it. Therefore, we can use it
733
1490
# here despite using OpenPGP certificates.
735
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
736
# u"+AES-256-CBC", u"+SHA1",
737
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1492
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1493
# "+AES-256-CBC", "+SHA1",
1494
# "+COMP-NULL", "+CTYPE-OPENPGP",
739
1496
# Use a fallback default, since this MUST be set.
740
1497
priority = self.server.gnutls_priority
741
1498
if priority is None:
743
1500
(gnutls.library.functions
744
1501
.gnutls_priority_set_direct(session._c_object,
745
1502
priority, None))
1504
# Start communication using the Mandos protocol
1505
# Get protocol number
1506
line = self.request.makefile().readline()
1507
logger.debug("Protocol version: %r", line)
1509
if int(line.strip().split()[0]) > 1:
1511
except (ValueError, IndexError, RuntimeError) as error:
1512
logger.error("Unknown protocol version: %s", error)
1515
# Start GnuTLS connection
748
1517
session.handshake()
749
except gnutls.errors.GNUTLSError, error:
750
logger.warning(u"Handshake failed: %s", error)
1518
except gnutls.errors.GNUTLSError as error:
1519
logger.warning("Handshake failed: %s", error)
751
1520
# Do not run session.bye() here: the session is not
752
1521
# established. Just abandon the request.
754
logger.debug(u"Handshake succeeded")
1523
logger.debug("Handshake succeeded")
1525
approval_required = False
756
fpr = self.fingerprint(self.peer_certificate(session))
757
except (TypeError, gnutls.errors.GNUTLSError), error:
758
logger.warning(u"Bad certificate: %s", error)
761
logger.debug(u"Fingerprint: %s", fpr)
1528
fpr = self.fingerprint(self.peer_certificate
1531
gnutls.errors.GNUTLSError) as error:
1532
logger.warning("Bad certificate: %s", error)
1534
logger.debug("Fingerprint: %s", fpr)
1537
client = ProxyClient(child_pipe, fpr,
1538
self.client_address)
1542
if self.server.use_dbus:
1544
client.NewRequest(str(self.client_address))
1546
if client.approval_delay:
1547
delay = client.approval_delay
1548
client.approvals_pending += 1
1549
approval_required = True
1552
if not client.enabled:
1553
logger.info("Client %s is disabled",
1555
if self.server.use_dbus:
1557
client.Rejected("Disabled")
1560
if client.approved or not client.approval_delay:
1561
#We are approved or approval is disabled
1563
elif client.approved is None:
1564
logger.info("Client %s needs approval",
1566
if self.server.use_dbus:
1568
client.NeedApproval(
1569
client.approval_delay_milliseconds(),
1570
client.approved_by_default)
1572
logger.warning("Client %s was not approved",
1574
if self.server.use_dbus:
1576
client.Rejected("Denied")
1579
#wait until timeout or approved
1580
time = datetime.datetime.now()
1581
client.changedstate.acquire()
1582
(client.changedstate.wait
1583
(float(client.timedelta_to_milliseconds(delay)
1585
client.changedstate.release()
1586
time2 = datetime.datetime.now()
1587
if (time2 - time) >= delay:
1588
if not client.approved_by_default:
1589
logger.warning("Client %s timed out while"
1590
" waiting for approval",
1592
if self.server.use_dbus:
1594
client.Rejected("Approval timed out")
1599
delay -= time2 - time
1602
while sent_size < len(client.secret):
1604
sent = session.send(client.secret[sent_size:])
1605
except gnutls.errors.GNUTLSError as error:
1606
logger.warning("gnutls send failed")
1608
logger.debug("Sent: %d, remaining: %d",
1609
sent, len(client.secret)
1610
- (sent_size + sent))
1613
logger.info("Sending secret to %s", client.name)
1614
# bump the timeout using extended_timeout
1615
client.checked_ok(client.extended_timeout)
1616
if self.server.use_dbus:
763
for c in self.server.clients:
764
if c.fingerprint == fpr:
768
ipc.write(u"NOTFOUND %s\n" % fpr)
771
# Have to check if client.still_valid(), since it is
772
# possible that the client timed out while establishing
773
# the GnuTLS session.
774
if not client.still_valid():
775
ipc.write(u"INVALID %s\n" % client.name)
778
ipc.write(u"SENDING %s\n" % client.name)
780
while sent_size < len(client.secret):
781
sent = session.send(client.secret[sent_size:])
782
logger.debug(u"Sent: %d, remaining: %d",
783
sent, len(client.secret)
784
- (sent_size + sent))
1621
if approval_required:
1622
client.approvals_pending -= 1
1625
except gnutls.errors.GNUTLSError as error:
1626
logger.warning("GnuTLS bye failed")
789
1629
def peer_certificate(session):
953
1844
for cond, name in
954
1845
condition_names.iteritems()
955
1846
if cond & condition)
956
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
959
# Turn the pipe file descriptor into a Python file object
960
if source not in file_objects:
961
file_objects[source] = os.fdopen(source, u"r", 1)
963
# Read a line from the file object
964
cmdline = file_objects[source].readline()
965
if not cmdline: # Empty line means end of file
967
file_objects[source].close()
968
del file_objects[source]
970
# Stop calling this function
973
logger.debug(u"IPC command: %r", cmdline)
975
# Parse and act on command
976
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
978
if cmd == u"NOTFOUND":
979
logger.warning(u"Client not found for fingerprint: %s",
983
mandos_dbus_service.ClientNotFound(args)
984
elif cmd == u"INVALID":
985
for client in self.clients:
986
if client.name == args:
987
logger.warning(u"Client %s is invalid", args)
993
logger.error(u"Unknown client %s is invalid", args)
994
elif cmd == u"SENDING":
995
for client in self.clients:
996
if client.name == args:
997
logger.info(u"Sending secret to %s", client.name)
1001
client.ReceivedSecret()
1004
logger.error(u"Sending secret to unknown client %s",
1007
logger.error(u"Unknown IPC command: %r", cmdline)
1009
# Keep calling this function
1847
# error, or the other end of multiprocessing.Pipe has closed
1848
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1849
# Wait for other process to exit
1853
# Read a request from the child
1854
request = parent_pipe.recv()
1855
command = request[0]
1857
if command == 'init':
1859
address = request[2]
1861
for c in self.clients.itervalues():
1862
if c.fingerprint == fpr:
1866
logger.info("Client not found for fingerprint: %s, ad"
1867
"dress: %s", fpr, address)
1870
mandos_dbus_service.ClientNotFound(fpr,
1872
parent_pipe.send(False)
1875
gobject.io_add_watch(parent_pipe.fileno(),
1876
gobject.IO_IN | gobject.IO_HUP,
1877
functools.partial(self.handle_ipc,
1883
parent_pipe.send(True)
1884
# remove the old hook in favor of the new above hook on
1887
if command == 'funcall':
1888
funcname = request[1]
1892
parent_pipe.send(('data', getattr(client_object,
1896
if command == 'getattr':
1897
attrname = request[1]
1898
if callable(client_object.__getattribute__(attrname)):
1899
parent_pipe.send(('function',))
1901
parent_pipe.send(('data', client_object
1902
.__getattribute__(attrname)))
1904
if command == 'setattr':
1905
attrname = request[1]
1907
setattr(client_object, attrname, value)
1013
1912
def string_to_delta(interval):
1014
1913
"""Parse a string and return a datetime.timedelta
1016
>>> string_to_delta(u'7d')
1915
>>> string_to_delta('7d')
1017
1916
datetime.timedelta(7)
1018
>>> string_to_delta(u'60s')
1917
>>> string_to_delta('60s')
1019
1918
datetime.timedelta(0, 60)
1020
>>> string_to_delta(u'60m')
1919
>>> string_to_delta('60m')
1021
1920
datetime.timedelta(0, 3600)
1022
>>> string_to_delta(u'24h')
1921
>>> string_to_delta('24h')
1023
1922
datetime.timedelta(1)
1024
>>> string_to_delta(u'1w')
1923
>>> string_to_delta('1w')
1025
1924
datetime.timedelta(7)
1026
>>> string_to_delta(u'5m 30s')
1925
>>> string_to_delta('5m 30s')
1027
1926
datetime.timedelta(0, 330)
1029
1928
timevalue = datetime.timedelta(0)
1125
######################################################################
1978
##################################################################
1126
1979
# Parsing of options, both command line and config file
1128
parser = optparse.OptionParser(version = "%%prog %s" % version)
1129
parser.add_option("-i", u"--interface", type=u"string",
1130
metavar="IF", help=u"Bind to interface IF")
1131
parser.add_option("-a", u"--address", type=u"string",
1132
help=u"Address to listen for requests on")
1133
parser.add_option("-p", u"--port", type=u"int",
1134
help=u"Port number to receive requests on")
1135
parser.add_option("--check", action=u"store_true",
1136
help=u"Run self-test")
1137
parser.add_option("--debug", action=u"store_true",
1138
help=u"Debug mode; run in foreground and log to"
1140
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1141
u" priority string (see GnuTLS documentation)")
1142
parser.add_option("--servicename", type=u"string",
1143
metavar=u"NAME", help=u"Zeroconf service name")
1144
parser.add_option("--configdir", type=u"string",
1145
default=u"/etc/mandos", metavar=u"DIR",
1146
help=u"Directory to search for configuration"
1148
parser.add_option("--no-dbus", action=u"store_false",
1149
dest=u"use_dbus", help=u"Do not provide D-Bus"
1150
u" system bus interface")
1151
parser.add_option("--no-ipv6", action=u"store_false",
1152
dest=u"use_ipv6", help=u"Do not use IPv6")
1153
options = parser.parse_args()[0]
1981
parser = argparse.ArgumentParser()
1982
parser.add_argument("-v", "--version", action="version",
1983
version = "%%(prog)s %s" % version,
1984
help="show version number and exit")
1985
parser.add_argument("-i", "--interface", metavar="IF",
1986
help="Bind to interface IF")
1987
parser.add_argument("-a", "--address",
1988
help="Address to listen for requests on")
1989
parser.add_argument("-p", "--port", type=int,
1990
help="Port number to receive requests on")
1991
parser.add_argument("--check", action="store_true",
1992
help="Run self-test")
1993
parser.add_argument("--debug", action="store_true",
1994
help="Debug mode; run in foreground and log"
1996
parser.add_argument("--debuglevel", metavar="LEVEL",
1997
help="Debug level for stdout output")
1998
parser.add_argument("--priority", help="GnuTLS"
1999
" priority string (see GnuTLS documentation)")
2000
parser.add_argument("--servicename",
2001
metavar="NAME", help="Zeroconf service name")
2002
parser.add_argument("--configdir",
2003
default="/etc/mandos", metavar="DIR",
2004
help="Directory to search for configuration"
2006
parser.add_argument("--no-dbus", action="store_false",
2007
dest="use_dbus", help="Do not provide D-Bus"
2008
" system bus interface")
2009
parser.add_argument("--no-ipv6", action="store_false",
2010
dest="use_ipv6", help="Do not use IPv6")
2011
parser.add_argument("--no-restore", action="store_false",
2012
dest="restore", help="Do not restore stored"
2014
parser.add_argument("--statedir", metavar="DIR",
2015
help="Directory to save/restore state in")
2017
options = parser.parse_args()
1155
2019
if options.check:
1203
2071
##################################################################
1205
2073
# For convenience
1206
debug = server_settings[u"debug"]
1207
use_dbus = server_settings[u"use_dbus"]
1208
use_ipv6 = server_settings[u"use_ipv6"]
1211
syslogger.setLevel(logging.WARNING)
1212
console.setLevel(logging.WARNING)
1214
if server_settings[u"servicename"] != u"Mandos":
2074
debug = server_settings["debug"]
2075
debuglevel = server_settings["debuglevel"]
2076
use_dbus = server_settings["use_dbus"]
2077
use_ipv6 = server_settings["use_ipv6"]
2078
stored_state_path = os.path.join(server_settings["statedir"],
2082
initlogger(debug, logging.DEBUG)
2087
level = getattr(logging, debuglevel.upper())
2088
initlogger(debug, level)
2090
if server_settings["servicename"] != "Mandos":
1215
2091
syslogger.setFormatter(logging.Formatter
1216
(u'Mandos (%s) [%%(process)d]:'
1217
u' %%(levelname)s: %%(message)s'
1218
% server_settings[u"servicename"]))
2092
('Mandos (%s) [%%(process)d]:'
2093
' %%(levelname)s: %%(message)s'
2094
% server_settings["servicename"]))
1220
2096
# Parse config file with clients
1221
client_defaults = { u"timeout": u"1h",
1223
u"checker": u"fping -q -- %%(host)s",
1226
client_config = configparser.SafeConfigParser(client_defaults)
1227
client_config.read(os.path.join(server_settings[u"configdir"],
2097
client_config = configparser.SafeConfigParser(Client.client_defaults)
2098
client_config.read(os.path.join(server_settings["configdir"],
1230
2101
global mandos_dbus_service
1231
2102
mandos_dbus_service = None
1234
tcp_server = IPv6_TCPServer((server_settings[u"address"],
1235
server_settings[u"port"]),
1238
server_settings[u"interface"],
1242
server_settings[u"priority"],
1244
pidfilename = u"/var/run/mandos.pid"
1246
pidfile = open(pidfilename, u"w")
1248
logger.error(u"Could not open file %r", pidfilename)
2104
tcp_server = MandosServer((server_settings["address"],
2105
server_settings["port"]),
2107
interface=(server_settings["interface"]
2111
server_settings["priority"],
2114
pidfilename = "/var/run/mandos.pid"
2116
pidfile = open(pidfilename, "w")
2118
logger.error("Could not open file %r", pidfilename)
1251
uid = pwd.getpwnam(u"_mandos").pw_uid
1252
gid = pwd.getpwnam(u"_mandos").pw_gid
2121
uid = pwd.getpwnam("_mandos").pw_uid
2122
gid = pwd.getpwnam("_mandos").pw_gid
1253
2123
except KeyError:
1255
uid = pwd.getpwnam(u"mandos").pw_uid
1256
gid = pwd.getpwnam(u"mandos").pw_gid
2125
uid = pwd.getpwnam("mandos").pw_uid
2126
gid = pwd.getpwnam("mandos").pw_gid
1257
2127
except KeyError:
1259
uid = pwd.getpwnam(u"nobody").pw_uid
1260
gid = pwd.getpwnam(u"nobody").pw_gid
2129
uid = pwd.getpwnam("nobody").pw_uid
2130
gid = pwd.getpwnam("nobody").pw_gid
1261
2131
except KeyError:
1267
except OSError, error:
2137
except OSError as error:
1268
2138
if error[0] != errno.EPERM:
1271
# Enable all possible GnuTLS debugging
2142
# Enable all possible GnuTLS debugging
1273
2144
# "Use a log level over 10 to enable all debugging options."
1274
2145
# - GnuTLS manual
1275
2146
gnutls.library.functions.gnutls_global_set_log_level(11)
1277
2148
@gnutls.library.types.gnutls_log_func
1278
2149
def debug_gnutls(level, string):
1279
logger.debug(u"GnuTLS: %s", string[:-1])
2150
logger.debug("GnuTLS: %s", string[:-1])
1281
2152
(gnutls.library.functions
1282
2153
.gnutls_global_set_log_function(debug_gnutls))
1285
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1286
service = AvahiService(name = server_settings[u"servicename"],
1287
servicetype = u"_mandos._tcp",
1288
protocol = protocol)
1289
if server_settings["interface"]:
1290
service.interface = (if_nametoindex
1291
(str(server_settings[u"interface"])))
2155
# Redirect stdin so all checkers get /dev/null
2156
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2157
os.dup2(null, sys.stdin.fileno())
2161
# Need to fork before connecting to D-Bus
2163
# Close all input and output, do double fork, etc.
2166
gobject.threads_init()
1293
2168
global main_loop
1296
2169
# From the Avahi example code
1297
2170
DBusGMainLoop(set_as_default=True )
1298
2171
main_loop = gobject.MainLoop()
1299
2172
bus = dbus.SystemBus()
1300
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1301
avahi.DBUS_PATH_SERVER),
1302
avahi.DBUS_INTERFACE_SERVER)
1303
2173
# End of Avahi example code
1305
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
2176
bus_name = dbus.service.BusName("se.recompile.Mandos",
2177
bus, do_not_queue=True)
2178
old_bus_name = (dbus.service.BusName
2179
("se.bsnet.fukt.Mandos", bus,
2181
except dbus.exceptions.NameExistsException as e:
2182
logger.error(unicode(e) + ", disabling D-Bus")
2184
server_settings["use_dbus"] = False
2185
tcp_server.use_dbus = False
2186
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2187
service = AvahiServiceToSyslog(name =
2188
server_settings["servicename"],
2189
servicetype = "_mandos._tcp",
2190
protocol = protocol, bus = bus)
2191
if server_settings["interface"]:
2192
service.interface = (if_nametoindex
2193
(str(server_settings["interface"])))
2195
global multiprocessing_manager
2196
multiprocessing_manager = multiprocessing.Manager()
1307
2198
client_class = Client
1309
client_class = ClientDBus
1311
client_class(name = section,
1312
config= dict(client_config.items(section)))
1313
for section in client_config.sections()))
1315
logger.warning(u"No clients defined")
1318
# Redirect stdin so all checkers get /dev/null
1319
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1320
os.dup2(null, sys.stdin.fileno())
1324
# No console logging
1325
logger.removeHandler(console)
1326
# Close all input and output, do double fork, etc.
1330
with closing(pidfile):
1332
pidfile.write(str(pid) + "\n")
1335
logger.error(u"Could not write to file %r with PID %d",
1338
# "pidfile" was never created
1343
"Cleanup function; run on exit"
1345
# From the Avahi example code
1346
if not group is None:
1349
# End of Avahi example code
2200
client_class = functools.partial(ClientDBusTransitional,
2203
client_settings = Client.config_parser(client_config)
2204
old_client_settings = {}
2207
# Get client data and settings from last running state.
2208
if server_settings["restore"]:
2210
with open(stored_state_path, "rb") as stored_state:
2211
clients_data, old_client_settings = (pickle.load
2213
os.remove(stored_state_path)
2214
except IOError as e:
2215
logger.warning("Could not load persistent state: {0}"
2217
if e.errno != errno.ENOENT:
2219
except EOFError as e:
2220
logger.warning("Could not load persistent state: "
2221
"EOFError: {0}".format(e))
2223
with PGPEngine() as pgp:
2224
for client_name, client in clients_data.iteritems():
2225
# Decide which value to use after restoring saved state.
2226
# We have three different values: Old config file,
2227
# new config file, and saved state.
2228
# New config value takes precedence if it differs from old
2229
# config value, otherwise use saved state.
2230
for name, value in client_settings[client_name].items():
2232
# For each value in new config, check if it
2233
# differs from the old config value (Except for
2234
# the "secret" attribute)
2235
if (name != "secret" and
2236
value != old_client_settings[client_name]
2238
client[name] = value
2242
# Clients who has passed its expire date can still be
2243
# enabled if its last checker was successful. Clients
2244
# whose checker failed before we stored its state is
2245
# assumed to have failed all checkers during downtime.
2246
if client["enabled"]:
2247
if datetime.datetime.utcnow() >= client["expires"]:
2248
if not client["last_checked_ok"]:
2250
"disabling client {0} - Client never "
2251
"performed a successfull checker"
2252
.format(client["name"]))
2253
client["enabled"] = False
2254
elif client["last_checker_status"] != 0:
2256
"disabling client {0} - Client "
2257
"last checker failed with error code {1}"
2258
.format(client["name"],
2259
client["last_checker_status"]))
2260
client["enabled"] = False
2262
client["expires"] = (datetime.datetime
2264
+ client["timeout"])
2267
client["secret"] = (
2268
pgp.decrypt(client["encrypted_secret"],
2269
client_settings[client_name]
2272
# If decryption fails, we use secret from new settings
2273
logger.debug("Failed to decrypt {0} old secret"
2274
.format(client_name))
2275
client["secret"] = (
2276
client_settings[client_name]["secret"])
2279
# Add/remove clients based on new changes made to config
2280
for client_name in set(old_client_settings) - set(client_settings):
2281
del clients_data[client_name]
2282
for client_name in set(client_settings) - set(old_client_settings):
2283
clients_data[client_name] = client_settings[client_name]
2285
# Create clients all clients
2286
for client_name, client in clients_data.iteritems():
2287
tcp_server.clients[client_name] = client_class(
2288
name = client_name, settings = client)
2290
if not tcp_server.clients:
2291
logger.warning("No clients defined")
1352
client = clients.pop()
1353
client.disable_hook = None
1356
atexit.register(cleanup)
2297
pidfile.write(str(pid) + "\n".encode("utf-8"))
2300
logger.error("Could not write to file %r with PID %d",
2303
# "pidfile" was never created
1359
2306
signal.signal(signal.SIGINT, signal.SIG_IGN)
1360
2308
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1361
2309
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1364
2312
class MandosDBusService(dbus.service.Object):
1365
2313
"""A D-Bus proxy object"""
1366
2314
def __init__(self):
1367
dbus.service.Object.__init__(self, bus, u"/")
1368
_interface = u"se.bsnet.fukt.Mandos"
1370
@dbus.service.signal(_interface, signature=u"oa{sv}")
1371
def ClientAdded(self, objpath, properties):
1375
@dbus.service.signal(_interface, signature=u"s")
1376
def ClientNotFound(self, fingerprint):
1380
@dbus.service.signal(_interface, signature=u"os")
2315
dbus.service.Object.__init__(self, bus, "/")
2316
_interface = "se.recompile.Mandos"
2318
@dbus.service.signal(_interface, signature="o")
2319
def ClientAdded(self, objpath):
2323
@dbus.service.signal(_interface, signature="ss")
2324
def ClientNotFound(self, fingerprint, address):
2328
@dbus.service.signal(_interface, signature="os")
1381
2329
def ClientRemoved(self, objpath, name):
1385
@dbus.service.method(_interface, out_signature=u"ao")
2333
@dbus.service.method(_interface, out_signature="ao")
1386
2334
def GetAllClients(self):
1388
return dbus.Array(c.dbus_object_path for c in clients)
2336
return dbus.Array(c.dbus_object_path
2338
tcp_server.clients.itervalues())
1390
2340
@dbus.service.method(_interface,
1391
out_signature=u"a{oa{sv}}")
2341
out_signature="a{oa{sv}}")
1392
2342
def GetAllClientsWithProperties(self):
1394
2344
return dbus.Dictionary(
1395
((c.dbus_object_path, c.GetAllProperties())
1397
signature=u"oa{sv}")
2345
((c.dbus_object_path, c.GetAll(""))
2346
for c in tcp_server.clients.itervalues()),
1399
@dbus.service.method(_interface, in_signature=u"o")
2349
@dbus.service.method(_interface, in_signature="o")
1400
2350
def RemoveClient(self, object_path):
2352
for c in tcp_server.clients.itervalues():
1403
2353
if c.dbus_object_path == object_path:
2354
del tcp_server.clients[c.name]
1405
2355
c.remove_from_connection()
1406
2356
# Don't signal anything except ClientRemoved
1407
c.disable(signal=False)
2357
c.disable(quiet=True)
1408
2358
# Emit D-Bus signal
1409
2359
self.ClientRemoved(object_path, c.name)
2361
raise KeyError(object_path)
1415
mandos_dbus_service = MandosDBusService()
1417
for client in clients:
2365
class MandosDBusServiceTransitional(MandosDBusService):
2366
__metaclass__ = AlternateDBusNamesMetaclass
2367
mandos_dbus_service = MandosDBusServiceTransitional()
2370
"Cleanup function; run on exit"
2373
multiprocessing.active_children()
2374
if not (tcp_server.clients or client_settings):
2377
# Store client before exiting. Secrets are encrypted with key
2378
# based on what config file has. If config file is
2379
# removed/edited, old secret will thus be unrecovable.
2381
with PGPEngine() as pgp:
2382
for client in tcp_server.clients.itervalues():
2383
key = client_settings[client.name]["secret"]
2384
client.encrypted_secret = pgp.encrypt(client.secret,
2388
# A list of attributes that can not be pickled
2390
exclude = set(("bus", "changedstate", "secret",
2392
for name, typ in (inspect.getmembers
2393
(dbus.service.Object)):
2396
client_dict["encrypted_secret"] = (client
2398
for attr in client.client_structure:
2399
if attr not in exclude:
2400
client_dict[attr] = getattr(client, attr)
2402
clients[client.name] = client_dict
2403
del client_settings[client.name]["secret"]
2406
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2409
(stored_state_path))
2410
with os.fdopen(tempfd, "wb") as stored_state:
2411
pickle.dump((clients, client_settings), stored_state)
2412
os.rename(tempname, stored_state_path)
2413
except (IOError, OSError) as e:
2414
logger.warning("Could not save persistent state: {0}"
2421
if e.errno not in set((errno.ENOENT, errno.EACCES,
2425
# Delete all clients, and settings from config
2426
while tcp_server.clients:
2427
name, client = tcp_server.clients.popitem()
2429
client.remove_from_connection()
2430
# Don't signal anything except ClientRemoved
2431
client.disable(quiet=True)
2434
mandos_dbus_service.ClientRemoved(client
2437
client_settings.clear()
2439
atexit.register(cleanup)
2441
for client in tcp_server.clients.itervalues():
1419
2443
# Emit D-Bus signal
1420
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1421
client.GetAllProperties())
2444
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2445
# Need to initiate checking of clients
2447
client.init_checker()
1424
2449
tcp_server.enable()
1425
2450
tcp_server.server_activate()