82
86
except ImportError:
83
87
SO_BINDTODEVICE = None
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
90
stored_state_file = "clients.pickle"
92
logger = logging.getLogger()
90
93
syslogger = (logging.handlers.SysLogHandler
91
94
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
95
address = str("/dev/log")))
93
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
96
logger.addHandler(syslogger)
98
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
102
logger.addHandler(console)
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
101
except (OSError, AttributeError):
102
def if_nametoindex(interface):
103
"Get an interface index the hard way, i.e. using fcntl()"
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
105
with contextlib.closing(socket.socket()) as s:
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
struct.pack(str("16s16x"),
109
interface_index = struct.unpack(str("I"),
111
return interface_index
114
def initlogger(debug, level=logging.WARNING):
115
"""init logger and add loglevel"""
117
syslogger.setFormatter(logging.Formatter
118
('Mandos [%(process)d]: %(levelname)s:'
120
logger.addHandler(syslogger)
123
console = logging.StreamHandler()
124
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
128
logger.addHandler(console)
129
logger.setLevel(level)
132
class PGPError(Exception):
133
"""Exception if encryption/decryption fails"""
137
class PGPEngine(object):
138
"""A simple class for OpenPGP symmetric encryption & decryption"""
140
self.gnupg = GnuPGInterface.GnuPG()
141
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
142
self.gnupg = GnuPGInterface.GnuPG()
143
self.gnupg.options.meta_interactive = False
144
self.gnupg.options.homedir = self.tempdir
145
self.gnupg.options.extra_args.extend(['--force-mdc',
152
def __exit__ (self, exc_type, exc_value, traceback):
160
if self.tempdir is not None:
161
# Delete contents of tempdir
162
for root, dirs, files in os.walk(self.tempdir,
164
for filename in files:
165
os.remove(os.path.join(root, filename))
167
os.rmdir(os.path.join(root, dirname))
169
os.rmdir(self.tempdir)
172
def password_encode(self, password):
173
# Passphrase can not be empty and can not contain newlines or
174
# NUL bytes. So we prefix it and hex encode it.
175
return b"mandos" + binascii.hexlify(password)
177
def encrypt(self, data, password):
178
self.gnupg.passphrase = self.password_encode(password)
179
with open(os.devnull, "w") as devnull:
181
proc = self.gnupg.run(['--symmetric'],
182
create_fhs=['stdin', 'stdout'],
183
attach_fhs={'stderr': devnull})
184
with contextlib.closing(proc.handles['stdin']) as f:
186
with contextlib.closing(proc.handles['stdout']) as f:
187
ciphertext = f.read()
191
self.gnupg.passphrase = None
194
def decrypt(self, data, password):
195
self.gnupg.passphrase = self.password_encode(password)
196
with open(os.devnull, "w") as devnull:
198
proc = self.gnupg.run(['--decrypt'],
199
create_fhs=['stdin', 'stdout'],
200
attach_fhs={'stderr': devnull})
201
with contextlib.closing(proc.handles['stdin']) as f:
203
with contextlib.closing(proc.handles['stdout']) as f:
204
decrypted_plaintext = f.read()
208
self.gnupg.passphrase = None
209
return decrypted_plaintext
104
212
class AvahiError(Exception):
105
213
def __init__(self, value, *args, **kwargs):
315
440
"created", "enabled", "fingerprint",
316
441
"host", "interval", "last_checked_ok",
317
442
"last_enabled", "name", "timeout")
443
client_defaults = { "timeout": "5m",
444
"extended_timeout": "15m",
446
"checker": "fping -q -- %%(host)s",
448
"approval_delay": "0s",
449
"approval_duration": "1s",
450
"approved_by_default": "True",
319
454
def timeout_milliseconds(self):
320
455
"Return the 'timeout' attribute in milliseconds"
321
return _timedelta_to_milliseconds(self.timeout)
456
return timedelta_to_milliseconds(self.timeout)
323
458
def extended_timeout_milliseconds(self):
324
459
"Return the 'extended_timeout' attribute in milliseconds"
325
return _timedelta_to_milliseconds(self.extended_timeout)
460
return timedelta_to_milliseconds(self.extended_timeout)
327
462
def interval_milliseconds(self):
328
463
"Return the 'interval' attribute in milliseconds"
329
return _timedelta_to_milliseconds(self.interval)
464
return timedelta_to_milliseconds(self.interval)
331
466
def approval_delay_milliseconds(self):
332
return _timedelta_to_milliseconds(self.approval_delay)
334
def __init__(self, name = None, disable_hook=None, config=None):
335
"""Note: the 'checker' key in 'config' sets the
336
'checker_command' attribute and *not* the 'checker'
467
return timedelta_to_milliseconds(self.approval_delay)
470
def config_parser(config):
471
"""Construct a new dict of client settings of this form:
472
{ client_name: {setting_name: value, ...}, ...}
473
with exceptions for any special settings as defined above.
474
NOTE: Must be a pure function. Must return the same result
475
value given the same arguments.
478
for client_name in config.sections():
479
section = dict(config.items(client_name))
480
client = settings[client_name] = {}
482
client["host"] = section["host"]
483
# Reformat values from string types to Python types
484
client["approved_by_default"] = config.getboolean(
485
client_name, "approved_by_default")
486
client["enabled"] = config.getboolean(client_name,
489
client["fingerprint"] = (section["fingerprint"].upper()
491
if "secret" in section:
492
client["secret"] = section["secret"].decode("base64")
493
elif "secfile" in section:
494
with open(os.path.expanduser(os.path.expandvars
495
(section["secfile"])),
497
client["secret"] = secfile.read()
499
raise TypeError("No secret or secfile for section {0}"
501
client["timeout"] = string_to_delta(section["timeout"])
502
client["extended_timeout"] = string_to_delta(
503
section["extended_timeout"])
504
client["interval"] = string_to_delta(section["interval"])
505
client["approval_delay"] = string_to_delta(
506
section["approval_delay"])
507
client["approval_duration"] = string_to_delta(
508
section["approval_duration"])
509
client["checker_command"] = section["checker"]
510
client["last_approval_request"] = None
511
client["last_checked_ok"] = None
512
client["last_checker_status"] = -2
516
def __init__(self, settings, name = None):
518
# adding all client settings
519
for setting, value in settings.iteritems():
520
setattr(self, setting, value)
523
if not hasattr(self, "last_enabled"):
524
self.last_enabled = datetime.datetime.utcnow()
525
if not hasattr(self, "expires"):
526
self.expires = (datetime.datetime.utcnow()
529
self.last_enabled = None
341
532
logger.debug("Creating client %r", self.name)
342
533
# Uppercase and remove spaces from fingerprint for later
343
534
# comparison purposes with return value from the fingerprint()
345
self.fingerprint = (config["fingerprint"].upper()
347
536
logger.debug(" Fingerprint: %s", self.fingerprint)
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
351
with open(os.path.expanduser(os.path.expandvars
352
(config["secfile"])),
354
self.secret = secfile.read()
356
raise TypeError("No secret or secfile for client %s"
358
self.host = config.get("host", "")
359
self.created = datetime.datetime.utcnow()
361
self.last_approval_request = None
362
self.last_enabled = None
363
self.last_checked_ok = None
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
368
self.disable_hook = disable_hook
537
self.created = settings.get("created",
538
datetime.datetime.utcnow())
540
# attributes specific for this server instance
369
541
self.checker = None
370
542
self.checker_initiator_tag = None
371
543
self.disable_initiator_tag = None
373
544
self.checker_callback_tag = None
374
self.checker_command = config["checker"]
375
545
self.current_checker_command = None
376
self.last_connect = None
377
self._approved = None
378
self.approved_by_default = config.get("approved_by_default",
380
547
self.approvals_pending = 0
381
self.approval_delay = string_to_delta(
382
config["approval_delay"])
383
self.approval_duration = string_to_delta(
384
config["approval_duration"])
385
548
self.changedstate = (multiprocessing_manager
386
549
.Condition(multiprocessing_manager
551
self.client_structure = [attr for attr in
552
self.__dict__.iterkeys()
553
if not attr.startswith("_")]
554
self.client_structure.append("client_structure")
556
for name, t in inspect.getmembers(type(self),
560
if not name.startswith("_"):
561
self.client_structure.append(name)
563
# Send notice to process children that client state has changed
389
564
def send_changedstate(self):
390
self.changedstate.acquire()
391
self.changedstate.notify_all()
392
self.changedstate.release()
565
with self.changedstate:
566
self.changedstate.notify_all()
394
568
def enable(self):
395
569
"""Start this client's checker and timeout hooks"""
428
592
gobject.source_remove(self.checker_initiator_tag)
429
593
self.checker_initiator_tag = None
430
594
self.stop_checker()
431
if self.disable_hook:
432
self.disable_hook(self)
433
595
self.enabled = False
434
596
# Do not run this again if called by a gobject.timeout_add
437
599
def __del__(self):
438
self.disable_hook = None
602
def init_checker(self):
603
# Schedule a new checker to be started an 'interval' from now,
604
# and every interval from then on.
605
self.checker_initiator_tag = (gobject.timeout_add
606
(self.interval_milliseconds(),
608
# Schedule a disable() when 'timeout' has passed
609
self.disable_initiator_tag = (gobject.timeout_add
610
(self.timeout_milliseconds(),
612
# Also start a new checker *right now*.
441
615
def checker_callback(self, pid, condition, command):
442
616
"""The checker has completed, so take appropriate actions."""
443
617
self.checker_callback_tag = None
444
618
self.checker = None
445
619
if os.WIFEXITED(condition):
446
exitstatus = os.WEXITSTATUS(condition)
620
self.last_checker_status = os.WEXITSTATUS(condition)
621
if self.last_checker_status == 0:
448
622
logger.info("Checker for %(name)s succeeded",
450
624
self.checked_ok()
452
626
logger.info("Checker for %(name)s failed",
629
self.last_checker_status = -1
455
630
logger.warning("Checker for %(name)s crashed?",
458
def checked_ok(self, timeout=None):
459
"""Bump up the timeout for this client.
461
This should only be called when the client has been seen,
633
def checked_ok(self):
634
"""Assert that the client has been seen, alive and well."""
635
self.last_checked_ok = datetime.datetime.utcnow()
636
self.last_checker_status = 0
639
def bump_timeout(self, timeout=None):
640
"""Bump up the timeout for this client."""
464
641
if timeout is None:
465
642
timeout = self.timeout
466
self.last_checked_ok = datetime.datetime.utcnow()
467
gobject.source_remove(self.disable_initiator_tag)
468
self.expires = datetime.datetime.utcnow() + timeout
469
self.disable_initiator_tag = (gobject.timeout_add
470
(_timedelta_to_milliseconds
471
(timeout), self.disable))
643
if self.disable_initiator_tag is not None:
644
gobject.source_remove(self.disable_initiator_tag)
645
if getattr(self, "enabled", False):
646
self.disable_initiator_tag = (gobject.timeout_add
647
(timedelta_to_milliseconds
648
(timeout), self.disable))
649
self.expires = datetime.datetime.utcnow() + timeout
473
651
def need_approval(self):
474
652
self.last_approval_request = datetime.datetime.utcnow()
778
def dbus_interface_annotations(dbus_interface):
779
"""Decorator for marking functions returning interface annotations
783
@dbus_interface_annotations("org.example.Interface")
784
def _foo(self): # Function name does not matter
785
return {"org.freedesktop.DBus.Deprecated": "true",
786
"org.freedesktop.DBus.Property.EmitsChangedSignal":
790
func._dbus_is_interface = True
791
func._dbus_interface = dbus_interface
792
func._dbus_name = dbus_interface
797
def dbus_annotations(annotations):
798
"""Decorator to annotate D-Bus methods, signals or properties
801
@dbus_service_property("org.example.Interface", signature="b",
803
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
804
"org.freedesktop.DBus.Property."
805
"EmitsChangedSignal": "false"})
806
def Property_dbus_property(self):
807
return dbus.Boolean(False)
810
func._dbus_annotations = annotations
600
815
class DBusPropertyException(dbus.exceptions.DBusException):
601
816
"""A base class for D-Bus property-related exceptions
628
def _is_dbus_property(obj):
629
return getattr(obj, "_dbus_is_property", False)
843
def _is_dbus_thing(thing):
844
"""Returns a function testing if an attribute is a D-Bus thing
846
If called like _is_dbus_thing("method") it returns a function
847
suitable for use as predicate to inspect.getmembers().
849
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
631
def _get_all_dbus_properties(self):
852
def _get_all_dbus_things(self, thing):
632
853
"""Returns a generator of (name, attribute) pairs
634
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
855
return ((getattr(athing.__get__(self), "_dbus_name",
857
athing.__get__(self))
635
858
for cls in self.__class__.__mro__
637
inspect.getmembers(cls, self._is_dbus_property))
860
inspect.getmembers(cls,
861
self._is_dbus_thing(thing)))
639
863
def _get_dbus_property(self, interface_name, property_name):
640
864
"""Returns a bound method if one exists which is a D-Bus
724
951
e.setAttribute("access", prop._dbus_access)
726
953
for if_tag in document.getElementsByTagName("interface"):
727
955
for tag in (make_tag(document, name, prop)
729
in self._get_all_dbus_properties()
957
in self._get_all_dbus_things("property")
730
958
if prop._dbus_interface
731
959
== if_tag.getAttribute("name")):
732
960
if_tag.appendChild(tag)
961
# Add annotation tags
962
for typ in ("method", "signal", "property"):
963
for tag in if_tag.getElementsByTagName(typ):
965
for name, prop in (self.
966
_get_all_dbus_things(typ)):
967
if (name == tag.getAttribute("name")
968
and prop._dbus_interface
969
== if_tag.getAttribute("name")):
970
annots.update(getattr
974
for name, value in annots.iteritems():
975
ann_tag = document.createElement(
977
ann_tag.setAttribute("name", name)
978
ann_tag.setAttribute("value", value)
979
tag.appendChild(ann_tag)
980
# Add interface annotation tags
981
for annotation, value in dict(
983
*(annotations().iteritems()
984
for name, annotations in
985
self._get_all_dbus_things("interface")
986
if name == if_tag.getAttribute("name")
988
ann_tag = document.createElement("annotation")
989
ann_tag.setAttribute("name", annotation)
990
ann_tag.setAttribute("value", value)
991
if_tag.appendChild(ann_tag)
733
992
# Add the names to the return values for the
734
993
# "org.freedesktop.DBus.Properties" methods
735
994
if (if_tag.getAttribute("name")
761
1020
return dbus.String(dt.isoformat(),
762
1021
variant_level=variant_level)
764
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
766
"""Applied to an empty subclass of a D-Bus object, this metaclass
767
will add additional D-Bus attributes matching a certain pattern.
1024
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1025
"""A class decorator; applied to a subclass of
1026
dbus.service.Object, it will add alternate D-Bus attributes with
1027
interface names according to the "alt_interface_names" mapping.
1030
@alternate_dbus_names({"org.example.Interface":
1031
"net.example.AlternateInterface"})
1032
class SampleDBusObject(dbus.service.Object):
1033
@dbus.service.method("org.example.Interface")
1034
def SampleDBusMethod():
1037
The above "SampleDBusMethod" on "SampleDBusObject" will be
1038
reachable via two interfaces: "org.example.Interface" and
1039
"net.example.AlternateInterface", the latter of which will have
1040
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1041
"true", unless "deprecate" is passed with a False value.
1043
This works for methods and signals, and also for D-Bus properties
1044
(from DBusObjectWithProperties) and interfaces (from the
1045
dbus_interface_annotations decorator).
769
def __new__(mcs, name, bases, attr):
770
# Go through all the base classes which could have D-Bus
771
# methods, signals, or properties in them
772
for base in (b for b in bases
773
if issubclass(b, dbus.service.Object)):
774
# Go though all attributes of the base class
775
for attrname, attribute in inspect.getmembers(base):
1048
for orig_interface_name, alt_interface_name in (
1049
alt_interface_names.iteritems()):
1051
interface_names = set()
1052
# Go though all attributes of the class
1053
for attrname, attribute in inspect.getmembers(cls):
776
1054
# Ignore non-D-Bus attributes, and D-Bus attributes
777
1055
# with the wrong interface name
778
1056
if (not hasattr(attribute, "_dbus_interface")
779
1057
or not attribute._dbus_interface
780
.startswith("se.recompile.Mandos")):
1058
.startswith(orig_interface_name)):
782
1060
# Create an alternate D-Bus interface name based on
783
1061
# the current name
784
1062
alt_interface = (attribute._dbus_interface
785
.replace("se.recompile.Mandos",
786
"se.bsnet.fukt.Mandos"))
1063
.replace(orig_interface_name,
1064
alt_interface_name))
1065
interface_names.add(alt_interface)
787
1066
# Is this a D-Bus signal?
788
1067
if getattr(attribute, "_dbus_is_signal", False):
789
1068
# Extract the original non-method function by
856
1147
attribute.func_name,
857
1148
attribute.func_defaults,
858
1149
attribute.func_closure)))
859
return type.__new__(mcs, name, bases, attr)
1150
# Copy annotations, if any
1152
attr[attrname]._dbus_annotations = (
1153
dict(attribute._dbus_annotations))
1154
except AttributeError:
1156
# Is this a D-Bus interface?
1157
elif getattr(attribute, "_dbus_is_interface", False):
1158
# Create a new, but exactly alike, function
1159
# object. Decorate it to be a new D-Bus interface
1160
# with the alternate D-Bus interface name. Add it
1162
attr[attrname] = (dbus_interface_annotations
1165
(attribute.func_code,
1166
attribute.func_globals,
1167
attribute.func_name,
1168
attribute.func_defaults,
1169
attribute.func_closure)))
1171
# Deprecate all alternate interfaces
1172
iname="_AlternateDBusNames_interface_annotation{0}"
1173
for interface_name in interface_names:
1174
@dbus_interface_annotations(interface_name)
1176
return { "org.freedesktop.DBus.Deprecated":
1178
# Find an unused name
1179
for aname in (iname.format(i)
1180
for i in itertools.count()):
1181
if aname not in attr:
1185
# Replace the class with a new subclass of it with
1186
# methods, signals, etc. as created above.
1187
cls = type(b"{0}Alternate".format(cls.__name__),
1193
@alternate_dbus_interfaces({"se.recompile.Mandos":
1194
"se.bsnet.fukt.Mandos"})
861
1195
class ClientDBus(Client, DBusObjectWithProperties):
862
1196
"""A Client class using D-Bus
925
1258
checker is not None)
926
1259
last_checked_ok = notifychangeproperty(datetime_to_dbus,
927
1260
"LastCheckedOK")
1261
last_checker_status = notifychangeproperty(dbus.Int16,
1262
"LastCheckerStatus")
928
1263
last_approval_request = notifychangeproperty(
929
1264
datetime_to_dbus, "LastApprovalRequest")
930
1265
approved_by_default = notifychangeproperty(dbus.Boolean,
931
1266
"ApprovedByDefault")
932
approval_delay = notifychangeproperty(dbus.UInt16,
1267
approval_delay = notifychangeproperty(dbus.UInt64,
933
1268
"ApprovalDelay",
935
_timedelta_to_milliseconds)
1270
timedelta_to_milliseconds)
936
1271
approval_duration = notifychangeproperty(
937
dbus.UInt16, "ApprovalDuration",
938
type_func = _timedelta_to_milliseconds)
1272
dbus.UInt64, "ApprovalDuration",
1273
type_func = timedelta_to_milliseconds)
939
1274
host = notifychangeproperty(dbus.String, "Host")
940
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1275
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
942
_timedelta_to_milliseconds)
1277
timedelta_to_milliseconds)
943
1278
extended_timeout = notifychangeproperty(
944
dbus.UInt16, "ExtendedTimeout",
945
type_func = _timedelta_to_milliseconds)
946
interval = notifychangeproperty(dbus.UInt16,
1279
dbus.UInt64, "ExtendedTimeout",
1280
type_func = timedelta_to_milliseconds)
1281
interval = notifychangeproperty(dbus.UInt64,
949
_timedelta_to_milliseconds)
1284
timedelta_to_milliseconds)
950
1285
checker_command = notifychangeproperty(dbus.String, "Checker")
952
1287
del notifychangeproperty
1181
1528
if value is None: # get
1182
1529
return dbus.UInt64(self.timeout_milliseconds())
1183
1530
self.timeout = datetime.timedelta(0, 0, 0, value)
1184
if getattr(self, "disable_initiator_tag", None) is None:
1186
1531
# Reschedule timeout
1187
gobject.source_remove(self.disable_initiator_tag)
1188
self.disable_initiator_tag = None
1190
time_to_die = (self.
1191
_timedelta_to_milliseconds((self
1196
if time_to_die <= 0:
1197
# The timeout has passed
1200
self.expires = (datetime.datetime.utcnow()
1201
+ datetime.timedelta(milliseconds =
1203
self.disable_initiator_tag = (gobject.timeout_add
1204
(time_to_die, self.disable))
1533
now = datetime.datetime.utcnow()
1534
time_to_die = timedelta_to_milliseconds(
1535
(self.last_checked_ok + self.timeout) - now)
1536
if time_to_die <= 0:
1537
# The timeout has passed
1540
self.expires = (now +
1541
datetime.timedelta(milliseconds =
1543
if (getattr(self, "disable_initiator_tag", None)
1546
gobject.source_remove(self.disable_initiator_tag)
1547
self.disable_initiator_tag = (gobject.timeout_add
1206
1551
# ExtendedTimeout - property
1207
1552
@dbus_service_property(_interface, signature="t",
1751
2104
elif suffix == "w":
1752
2105
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1754
raise ValueError("Unknown suffix %r" % suffix)
2107
raise ValueError("Unknown suffix {0!r}"
1755
2109
except (ValueError, IndexError) as e:
1756
2110
raise ValueError(*(e.args))
1757
2111
timevalue += delta
1758
2112
return timevalue
1761
def if_nametoindex(interface):
1762
"""Call the C function if_nametoindex(), or equivalent
1764
Note: This function cannot accept a unicode string."""
1765
global if_nametoindex
1767
if_nametoindex = (ctypes.cdll.LoadLibrary
1768
(ctypes.util.find_library("c"))
1770
except (OSError, AttributeError):
1771
logger.warning("Doing if_nametoindex the hard way")
1772
def if_nametoindex(interface):
1773
"Get an interface index the hard way, i.e. using fcntl()"
1774
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1775
with contextlib.closing(socket.socket()) as s:
1776
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1777
struct.pack(str("16s16x"),
1779
interface_index = struct.unpack(str("I"),
1781
return interface_index
1782
return if_nametoindex(interface)
1785
2115
def daemon(nochdir = False, noclose = False):
1786
2116
"""See daemon(3). Standard BSD Unix function.
1900
2239
debuglevel = server_settings["debuglevel"]
1901
2240
use_dbus = server_settings["use_dbus"]
1902
2241
use_ipv6 = server_settings["use_ipv6"]
2242
stored_state_path = os.path.join(server_settings["statedir"],
2246
initlogger(debug, logging.DEBUG)
2251
level = getattr(logging, debuglevel.upper())
2252
initlogger(debug, level)
1904
2254
if server_settings["servicename"] != "Mandos":
1905
2255
syslogger.setFormatter(logging.Formatter
1906
('Mandos (%s) [%%(process)d]:'
1907
' %%(levelname)s: %%(message)s'
1908
% server_settings["servicename"]))
2256
('Mandos ({0}) [%(process)d]:'
2257
' %(levelname)s: %(message)s'
2258
.format(server_settings
1910
2261
# Parse config file with clients
1911
client_defaults = { "timeout": "5m",
1912
"extended_timeout": "15m",
1914
"checker": "fping -q -- %%(host)s",
1916
"approval_delay": "0s",
1917
"approval_duration": "1s",
1919
client_config = configparser.SafeConfigParser(client_defaults)
2262
client_config = configparser.SafeConfigParser(Client
1920
2264
client_config.read(os.path.join(server_settings["configdir"],
1921
2265
"clients.conf"))
2028
2361
client_class = Client
2030
client_class = functools.partial(ClientDBusTransitional,
2032
def client_config_items(config, section):
2033
special_settings = {
2034
"approved_by_default":
2035
lambda: config.getboolean(section,
2036
"approved_by_default"),
2038
for name, value in config.items(section):
2363
client_class = functools.partial(ClientDBus, bus = bus)
2365
client_settings = Client.config_parser(client_config)
2366
old_client_settings = {}
2369
# Get client data and settings from last running state.
2370
if server_settings["restore"]:
2372
with open(stored_state_path, "rb") as stored_state:
2373
clients_data, old_client_settings = (pickle.load
2375
os.remove(stored_state_path)
2376
except IOError as e:
2377
if e.errno == errno.ENOENT:
2378
logger.warning("Could not load persistent state: {0}"
2379
.format(os.strerror(e.errno)))
2381
logger.critical("Could not load persistent state:",
2384
except EOFError as e:
2385
logger.warning("Could not load persistent state: "
2386
"EOFError:", exc_info=e)
2388
with PGPEngine() as pgp:
2389
for client_name, client in clients_data.iteritems():
2390
# Decide which value to use after restoring saved state.
2391
# We have three different values: Old config file,
2392
# new config file, and saved state.
2393
# New config value takes precedence if it differs from old
2394
# config value, otherwise use saved state.
2395
for name, value in client_settings[client_name].items():
2397
# For each value in new config, check if it
2398
# differs from the old config value (Except for
2399
# the "secret" attribute)
2400
if (name != "secret" and
2401
value != old_client_settings[client_name]
2403
client[name] = value
2407
# Clients who has passed its expire date can still be
2408
# enabled if its last checker was successful. Clients
2409
# whose checker succeeded before we stored its state is
2410
# assumed to have successfully run all checkers during
2412
if client["enabled"]:
2413
if datetime.datetime.utcnow() >= client["expires"]:
2414
if not client["last_checked_ok"]:
2416
"disabling client {0} - Client never "
2417
"performed a successful checker"
2418
.format(client_name))
2419
client["enabled"] = False
2420
elif client["last_checker_status"] != 0:
2422
"disabling client {0} - Client "
2423
"last checker failed with error code {1}"
2424
.format(client_name,
2425
client["last_checker_status"]))
2426
client["enabled"] = False
2428
client["expires"] = (datetime.datetime
2430
+ client["timeout"])
2431
logger.debug("Last checker succeeded,"
2432
" keeping {0} enabled"
2433
.format(client_name))
2040
yield (name, special_settings[name]())
2044
tcp_server.clients.update(set(
2045
client_class(name = section,
2046
config= dict(client_config_items(
2047
client_config, section)))
2048
for section in client_config.sections()))
2435
client["secret"] = (
2436
pgp.decrypt(client["encrypted_secret"],
2437
client_settings[client_name]
2440
# If decryption fails, we use secret from new settings
2441
logger.debug("Failed to decrypt {0} old secret"
2442
.format(client_name))
2443
client["secret"] = (
2444
client_settings[client_name]["secret"])
2446
# Add/remove clients based on new changes made to config
2447
for client_name in (set(old_client_settings)
2448
- set(client_settings)):
2449
del clients_data[client_name]
2450
for client_name in (set(client_settings)
2451
- set(old_client_settings)):
2452
clients_data[client_name] = client_settings[client_name]
2454
# Create all client objects
2455
for client_name, client in clients_data.iteritems():
2456
tcp_server.clients[client_name] = client_class(
2457
name = client_name, settings = client)
2049
2459
if not tcp_server.clients:
2050
2460
logger.warning("No clients defined")
2124
class MandosDBusServiceTransitional(MandosDBusService):
2125
__metaclass__ = AlternateDBusNamesMetaclass
2126
mandos_dbus_service = MandosDBusServiceTransitional()
2542
mandos_dbus_service = MandosDBusService()
2129
2545
"Cleanup function; run on exit"
2130
2546
service.cleanup()
2548
multiprocessing.active_children()
2549
if not (tcp_server.clients or client_settings):
2552
# Store client before exiting. Secrets are encrypted with key
2553
# based on what config file has. If config file is
2554
# removed/edited, old secret will thus be unrecovable.
2556
with PGPEngine() as pgp:
2557
for client in tcp_server.clients.itervalues():
2558
key = client_settings[client.name]["secret"]
2559
client.encrypted_secret = pgp.encrypt(client.secret,
2563
# A list of attributes that can not be pickled
2565
exclude = set(("bus", "changedstate", "secret",
2567
for name, typ in (inspect.getmembers
2568
(dbus.service.Object)):
2571
client_dict["encrypted_secret"] = (client
2573
for attr in client.client_structure:
2574
if attr not in exclude:
2575
client_dict[attr] = getattr(client, attr)
2577
clients[client.name] = client_dict
2578
del client_settings[client.name]["secret"]
2581
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2584
(stored_state_path))
2585
with os.fdopen(tempfd, "wb") as stored_state:
2586
pickle.dump((clients, client_settings), stored_state)
2587
os.rename(tempname, stored_state_path)
2588
except (IOError, OSError) as e:
2594
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2595
logger.warning("Could not save persistent state: {0}"
2596
.format(os.strerror(e.errno)))
2598
logger.warning("Could not save persistent state:",
2602
# Delete all clients, and settings from config
2132
2603
while tcp_server.clients:
2133
client = tcp_server.clients.pop()
2604
name, client = tcp_server.clients.popitem()
2135
2606
client.remove_from_connection()
2136
client.disable_hook = None
2137
2607
# Don't signal anything except ClientRemoved
2138
2608
client.disable(quiet=True)