82
88
except ImportError:
83
89
SO_BINDTODEVICE = None
92
stored_state_file = "clients.pickle"
88
94
logger = logging.getLogger()
89
95
syslogger = (logging.handlers.SysLogHandler
90
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
97
address = str("/dev/log")))
92
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
95
logger.addHandler(syslogger)
97
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
102
logger.addHandler(console)
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
103
except (OSError, AttributeError):
104
def if_nametoindex(interface):
105
"Get an interface index the hard way, i.e. using fcntl()"
106
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
with contextlib.closing(socket.socket()) as s:
108
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
111
interface_index = struct.unpack(str("I"),
113
return interface_index
116
def initlogger(debug, level=logging.WARNING):
117
"""init logger and add loglevel"""
119
syslogger.setFormatter(logging.Formatter
120
('Mandos [%(process)d]: %(levelname)s:'
122
logger.addHandler(syslogger)
125
console = logging.StreamHandler()
126
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
130
logger.addHandler(console)
131
logger.setLevel(level)
134
class PGPError(Exception):
135
"""Exception if encryption/decryption fails"""
139
class PGPEngine(object):
140
"""A simple class for OpenPGP symmetric encryption & decryption"""
142
self.gnupg = GnuPGInterface.GnuPG()
143
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
self.gnupg = GnuPGInterface.GnuPG()
145
self.gnupg.options.meta_interactive = False
146
self.gnupg.options.homedir = self.tempdir
147
self.gnupg.options.extra_args.extend(['--force-mdc',
154
def __exit__ (self, exc_type, exc_value, traceback):
162
if self.tempdir is not None:
163
# Delete contents of tempdir
164
for root, dirs, files in os.walk(self.tempdir,
166
for filename in files:
167
os.remove(os.path.join(root, filename))
169
os.rmdir(os.path.join(root, dirname))
171
os.rmdir(self.tempdir)
174
def password_encode(self, password):
175
# Passphrase can not be empty and can not contain newlines or
176
# NUL bytes. So we prefix it and hex encode it.
177
return b"mandos" + binascii.hexlify(password)
179
def encrypt(self, data, password):
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
193
self.gnupg.passphrase = None
196
def decrypt(self, data, password):
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
210
self.gnupg.passphrase = None
211
return decrypted_plaintext
105
214
class AvahiError(Exception):
321
442
"created", "enabled", "fingerprint",
322
443
"host", "interval", "last_checked_ok",
323
444
"last_enabled", "name", "timeout")
445
client_defaults = { "timeout": "5m",
446
"extended_timeout": "15m",
448
"checker": "fping -q -- %%(host)s",
450
"approval_delay": "0s",
451
"approval_duration": "1s",
452
"approved_by_default": "True",
325
456
def timeout_milliseconds(self):
326
457
"Return the 'timeout' attribute in milliseconds"
327
return _timedelta_to_milliseconds(self.timeout)
458
return timedelta_to_milliseconds(self.timeout)
329
460
def extended_timeout_milliseconds(self):
330
461
"Return the 'extended_timeout' attribute in milliseconds"
331
return _timedelta_to_milliseconds(self.extended_timeout)
462
return timedelta_to_milliseconds(self.extended_timeout)
333
464
def interval_milliseconds(self):
334
465
"Return the 'interval' attribute in milliseconds"
335
return _timedelta_to_milliseconds(self.interval)
466
return timedelta_to_milliseconds(self.interval)
337
468
def approval_delay_milliseconds(self):
338
return _timedelta_to_milliseconds(self.approval_delay)
340
def __init__(self, name = None, disable_hook=None, config=None):
341
"""Note: the 'checker' key in 'config' sets the
342
'checker_command' attribute and *not* the 'checker'
469
return timedelta_to_milliseconds(self.approval_delay)
472
def config_parser(config):
473
"""Construct a new dict of client settings of this form:
474
{ client_name: {setting_name: value, ...}, ...}
475
with exceptions for any special settings as defined above.
476
NOTE: Must be a pure function. Must return the same result
477
value given the same arguments.
480
for client_name in config.sections():
481
section = dict(config.items(client_name))
482
client = settings[client_name] = {}
484
client["host"] = section["host"]
485
# Reformat values from string types to Python types
486
client["approved_by_default"] = config.getboolean(
487
client_name, "approved_by_default")
488
client["enabled"] = config.getboolean(client_name,
491
client["fingerprint"] = (section["fingerprint"].upper()
493
if "secret" in section:
494
client["secret"] = section["secret"].decode("base64")
495
elif "secfile" in section:
496
with open(os.path.expanduser(os.path.expandvars
497
(section["secfile"])),
499
client["secret"] = secfile.read()
501
raise TypeError("No secret or secfile for section {0}"
503
client["timeout"] = string_to_delta(section["timeout"])
504
client["extended_timeout"] = string_to_delta(
505
section["extended_timeout"])
506
client["interval"] = string_to_delta(section["interval"])
507
client["approval_delay"] = string_to_delta(
508
section["approval_delay"])
509
client["approval_duration"] = string_to_delta(
510
section["approval_duration"])
511
client["checker_command"] = section["checker"]
512
client["last_approval_request"] = None
513
client["last_checked_ok"] = None
514
client["last_checker_status"] = -2
518
def __init__(self, settings, name = None):
520
# adding all client settings
521
for setting, value in settings.iteritems():
522
setattr(self, setting, value)
525
if not hasattr(self, "last_enabled"):
526
self.last_enabled = datetime.datetime.utcnow()
527
if not hasattr(self, "expires"):
528
self.expires = (datetime.datetime.utcnow()
531
self.last_enabled = None
347
534
logger.debug("Creating client %r", self.name)
348
535
# Uppercase and remove spaces from fingerprint for later
349
536
# comparison purposes with return value from the fingerprint()
351
self.fingerprint = (config["fingerprint"].upper()
353
538
logger.debug(" Fingerprint: %s", self.fingerprint)
354
if "secret" in config:
355
self.secret = config["secret"].decode("base64")
356
elif "secfile" in config:
357
with open(os.path.expanduser(os.path.expandvars
358
(config["secfile"])),
360
self.secret = secfile.read()
362
raise TypeError("No secret or secfile for client %s"
364
self.host = config.get("host", "")
365
self.created = datetime.datetime.utcnow()
367
self.last_approval_request = None
368
self.last_enabled = None
369
self.last_checked_ok = None
370
self.timeout = string_to_delta(config["timeout"])
371
self.extended_timeout = string_to_delta(config
372
["extended_timeout"])
373
self.interval = string_to_delta(config["interval"])
374
self.disable_hook = disable_hook
539
self.created = settings.get("created",
540
datetime.datetime.utcnow())
542
# attributes specific for this server instance
375
543
self.checker = None
376
544
self.checker_initiator_tag = None
377
545
self.disable_initiator_tag = None
379
546
self.checker_callback_tag = None
380
self.checker_command = config["checker"]
381
547
self.current_checker_command = None
382
self.last_connect = None
383
self._approved = None
384
self.approved_by_default = config.get("approved_by_default",
386
549
self.approvals_pending = 0
387
self.approval_delay = string_to_delta(
388
config["approval_delay"])
389
self.approval_duration = string_to_delta(
390
config["approval_duration"])
391
550
self.changedstate = (multiprocessing_manager
392
551
.Condition(multiprocessing_manager
553
self.client_structure = [attr for attr in
554
self.__dict__.iterkeys()
555
if not attr.startswith("_")]
556
self.client_structure.append("client_structure")
558
for name, t in inspect.getmembers(type(self),
562
if not name.startswith("_"):
563
self.client_structure.append(name)
565
# Send notice to process children that client state has changed
395
566
def send_changedstate(self):
396
self.changedstate.acquire()
397
self.changedstate.notify_all()
398
self.changedstate.release()
567
with self.changedstate:
568
self.changedstate.notify_all()
400
570
def enable(self):
401
571
"""Start this client's checker and timeout hooks"""
434
594
gobject.source_remove(self.checker_initiator_tag)
435
595
self.checker_initiator_tag = None
436
596
self.stop_checker()
437
if self.disable_hook:
438
self.disable_hook(self)
439
597
self.enabled = False
440
598
# Do not run this again if called by a gobject.timeout_add
443
601
def __del__(self):
444
self.disable_hook = None
604
def init_checker(self):
605
# Schedule a new checker to be started an 'interval' from now,
606
# and every interval from then on.
607
self.checker_initiator_tag = (gobject.timeout_add
608
(self.interval_milliseconds(),
610
# Schedule a disable() when 'timeout' has passed
611
self.disable_initiator_tag = (gobject.timeout_add
612
(self.timeout_milliseconds(),
614
# Also start a new checker *right now*.
447
617
def checker_callback(self, pid, condition, command):
448
618
"""The checker has completed, so take appropriate actions."""
449
619
self.checker_callback_tag = None
450
620
self.checker = None
451
621
if os.WIFEXITED(condition):
452
exitstatus = os.WEXITSTATUS(condition)
622
self.last_checker_status = os.WEXITSTATUS(condition)
623
if self.last_checker_status == 0:
454
624
logger.info("Checker for %(name)s succeeded",
456
626
self.checked_ok()
458
628
logger.info("Checker for %(name)s failed",
631
self.last_checker_status = -1
461
632
logger.warning("Checker for %(name)s crashed?",
464
def checked_ok(self, timeout=None):
465
"""Bump up the timeout for this client.
467
This should only be called when the client has been seen,
635
def checked_ok(self):
636
"""Assert that the client has been seen, alive and well."""
637
self.last_checked_ok = datetime.datetime.utcnow()
638
self.last_checker_status = 0
641
def bump_timeout(self, timeout=None):
642
"""Bump up the timeout for this client."""
470
643
if timeout is None:
471
644
timeout = self.timeout
472
self.last_checked_ok = datetime.datetime.utcnow()
473
645
if self.disable_initiator_tag is not None:
474
646
gobject.source_remove(self.disable_initiator_tag)
475
647
if getattr(self, "enabled", False):
476
648
self.disable_initiator_tag = (gobject.timeout_add
477
(_timedelta_to_milliseconds
649
(timedelta_to_milliseconds
478
650
(timeout), self.disable))
479
651
self.expires = datetime.datetime.utcnow() + timeout
780
def dbus_interface_annotations(dbus_interface):
781
"""Decorator for marking functions returning interface annotations
785
@dbus_interface_annotations("org.example.Interface")
786
def _foo(self): # Function name does not matter
787
return {"org.freedesktop.DBus.Deprecated": "true",
788
"org.freedesktop.DBus.Property.EmitsChangedSignal":
792
func._dbus_is_interface = True
793
func._dbus_interface = dbus_interface
794
func._dbus_name = dbus_interface
799
def dbus_annotations(annotations):
800
"""Decorator to annotate D-Bus methods, signals or properties
803
@dbus_service_property("org.example.Interface", signature="b",
805
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
806
"org.freedesktop.DBus.Property."
807
"EmitsChangedSignal": "false"})
808
def Property_dbus_property(self):
809
return dbus.Boolean(False)
812
func._dbus_annotations = annotations
608
817
class DBusPropertyException(dbus.exceptions.DBusException):
609
818
"""A base class for D-Bus property-related exceptions
636
def _is_dbus_property(obj):
637
return getattr(obj, "_dbus_is_property", False)
845
def _is_dbus_thing(thing):
846
"""Returns a function testing if an attribute is a D-Bus thing
848
If called like _is_dbus_thing("method") it returns a function
849
suitable for use as predicate to inspect.getmembers().
851
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
639
def _get_all_dbus_properties(self):
854
def _get_all_dbus_things(self, thing):
640
855
"""Returns a generator of (name, attribute) pairs
642
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
857
return ((getattr(athing.__get__(self), "_dbus_name",
859
athing.__get__(self))
643
860
for cls in self.__class__.__mro__
645
inspect.getmembers(cls, self._is_dbus_property))
862
inspect.getmembers(cls,
863
self._is_dbus_thing(thing)))
647
865
def _get_dbus_property(self, interface_name, property_name):
648
866
"""Returns a bound method if one exists which is a D-Bus
732
953
e.setAttribute("access", prop._dbus_access)
734
955
for if_tag in document.getElementsByTagName("interface"):
735
957
for tag in (make_tag(document, name, prop)
737
in self._get_all_dbus_properties()
959
in self._get_all_dbus_things("property")
738
960
if prop._dbus_interface
739
961
== if_tag.getAttribute("name")):
740
962
if_tag.appendChild(tag)
963
# Add annotation tags
964
for typ in ("method", "signal", "property"):
965
for tag in if_tag.getElementsByTagName(typ):
967
for name, prop in (self.
968
_get_all_dbus_things(typ)):
969
if (name == tag.getAttribute("name")
970
and prop._dbus_interface
971
== if_tag.getAttribute("name")):
972
annots.update(getattr
976
for name, value in annots.iteritems():
977
ann_tag = document.createElement(
979
ann_tag.setAttribute("name", name)
980
ann_tag.setAttribute("value", value)
981
tag.appendChild(ann_tag)
982
# Add interface annotation tags
983
for annotation, value in dict(
984
itertools.chain.from_iterable(
985
annotations().iteritems()
986
for name, annotations in
987
self._get_all_dbus_things("interface")
988
if name == if_tag.getAttribute("name")
990
ann_tag = document.createElement("annotation")
991
ann_tag.setAttribute("name", annotation)
992
ann_tag.setAttribute("value", value)
993
if_tag.appendChild(ann_tag)
741
994
# Add the names to the return values for the
742
995
# "org.freedesktop.DBus.Properties" methods
743
996
if (if_tag.getAttribute("name")
769
1022
return dbus.String(dt.isoformat(),
770
1023
variant_level=variant_level)
772
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
774
"""Applied to an empty subclass of a D-Bus object, this metaclass
775
will add additional D-Bus attributes matching a certain pattern.
1026
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1027
"""A class decorator; applied to a subclass of
1028
dbus.service.Object, it will add alternate D-Bus attributes with
1029
interface names according to the "alt_interface_names" mapping.
1032
@alternate_dbus_names({"org.example.Interface":
1033
"net.example.AlternateInterface"})
1034
class SampleDBusObject(dbus.service.Object):
1035
@dbus.service.method("org.example.Interface")
1036
def SampleDBusMethod():
1039
The above "SampleDBusMethod" on "SampleDBusObject" will be
1040
reachable via two interfaces: "org.example.Interface" and
1041
"net.example.AlternateInterface", the latter of which will have
1042
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1043
"true", unless "deprecate" is passed with a False value.
1045
This works for methods and signals, and also for D-Bus properties
1046
(from DBusObjectWithProperties) and interfaces (from the
1047
dbus_interface_annotations decorator).
777
def __new__(mcs, name, bases, attr):
778
# Go through all the base classes which could have D-Bus
779
# methods, signals, or properties in them
780
for base in (b for b in bases
781
if issubclass(b, dbus.service.Object)):
782
# Go though all attributes of the base class
783
for attrname, attribute in inspect.getmembers(base):
1050
for orig_interface_name, alt_interface_name in (
1051
alt_interface_names.iteritems()):
1053
interface_names = set()
1054
# Go though all attributes of the class
1055
for attrname, attribute in inspect.getmembers(cls):
784
1056
# Ignore non-D-Bus attributes, and D-Bus attributes
785
1057
# with the wrong interface name
786
1058
if (not hasattr(attribute, "_dbus_interface")
787
1059
or not attribute._dbus_interface
788
.startswith("se.recompile.Mandos")):
1060
.startswith(orig_interface_name)):
790
1062
# Create an alternate D-Bus interface name based on
791
1063
# the current name
792
1064
alt_interface = (attribute._dbus_interface
793
.replace("se.recompile.Mandos",
794
"se.bsnet.fukt.Mandos"))
1065
.replace(orig_interface_name,
1066
alt_interface_name))
1067
interface_names.add(alt_interface)
795
1068
# Is this a D-Bus signal?
796
1069
if getattr(attribute, "_dbus_is_signal", False):
797
1070
# Extract the original non-method function by
864
1149
attribute.func_name,
865
1150
attribute.func_defaults,
866
1151
attribute.func_closure)))
867
return type.__new__(mcs, name, bases, attr)
1152
# Copy annotations, if any
1154
attr[attrname]._dbus_annotations = (
1155
dict(attribute._dbus_annotations))
1156
except AttributeError:
1158
# Is this a D-Bus interface?
1159
elif getattr(attribute, "_dbus_is_interface", False):
1160
# Create a new, but exactly alike, function
1161
# object. Decorate it to be a new D-Bus interface
1162
# with the alternate D-Bus interface name. Add it
1164
attr[attrname] = (dbus_interface_annotations
1167
(attribute.func_code,
1168
attribute.func_globals,
1169
attribute.func_name,
1170
attribute.func_defaults,
1171
attribute.func_closure)))
1173
# Deprecate all alternate interfaces
1174
iname="_AlternateDBusNames_interface_annotation{0}"
1175
for interface_name in interface_names:
1176
@dbus_interface_annotations(interface_name)
1178
return { "org.freedesktop.DBus.Deprecated":
1180
# Find an unused name
1181
for aname in (iname.format(i)
1182
for i in itertools.count()):
1183
if aname not in attr:
1187
# Replace the class with a new subclass of it with
1188
# methods, signals, etc. as created above.
1189
cls = type(b"{0}Alternate".format(cls.__name__),
1195
@alternate_dbus_interfaces({"se.recompile.Mandos":
1196
"se.bsnet.fukt.Mandos"})
869
1197
class ClientDBus(Client, DBusObjectWithProperties):
870
1198
"""A Client class using D-Bus
934
1260
checker is not None)
935
1261
last_checked_ok = notifychangeproperty(datetime_to_dbus,
936
1262
"LastCheckedOK")
1263
last_checker_status = notifychangeproperty(dbus.Int16,
1264
"LastCheckerStatus")
937
1265
last_approval_request = notifychangeproperty(
938
1266
datetime_to_dbus, "LastApprovalRequest")
939
1267
approved_by_default = notifychangeproperty(dbus.Boolean,
940
1268
"ApprovedByDefault")
941
approval_delay = notifychangeproperty(dbus.UInt16,
1269
approval_delay = notifychangeproperty(dbus.UInt64,
942
1270
"ApprovalDelay",
944
_timedelta_to_milliseconds)
1272
timedelta_to_milliseconds)
945
1273
approval_duration = notifychangeproperty(
946
dbus.UInt16, "ApprovalDuration",
947
type_func = _timedelta_to_milliseconds)
1274
dbus.UInt64, "ApprovalDuration",
1275
type_func = timedelta_to_milliseconds)
948
1276
host = notifychangeproperty(dbus.String, "Host")
949
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1277
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
951
_timedelta_to_milliseconds)
1279
timedelta_to_milliseconds)
952
1280
extended_timeout = notifychangeproperty(
953
dbus.UInt16, "ExtendedTimeout",
954
type_func = _timedelta_to_milliseconds)
955
interval = notifychangeproperty(dbus.UInt16,
1281
dbus.UInt64, "ExtendedTimeout",
1282
type_func = timedelta_to_milliseconds)
1283
interval = notifychangeproperty(dbus.UInt64,
958
_timedelta_to_milliseconds)
1286
timedelta_to_milliseconds)
959
1287
checker_command = notifychangeproperty(dbus.String, "Checker")
961
1289
del notifychangeproperty
1190
1530
if value is None: # get
1191
1531
return dbus.UInt64(self.timeout_milliseconds())
1192
1532
self.timeout = datetime.timedelta(0, 0, 0, value)
1193
if getattr(self, "disable_initiator_tag", None) is None:
1195
1533
# Reschedule timeout
1196
gobject.source_remove(self.disable_initiator_tag)
1197
self.disable_initiator_tag = None
1199
time_to_die = _timedelta_to_milliseconds((self
1204
if time_to_die <= 0:
1205
# The timeout has passed
1208
self.expires = (datetime.datetime.utcnow()
1209
+ datetime.timedelta(milliseconds =
1211
self.disable_initiator_tag = (gobject.timeout_add
1212
(time_to_die, self.disable))
1535
now = datetime.datetime.utcnow()
1536
time_to_die = timedelta_to_milliseconds(
1537
(self.last_checked_ok + self.timeout) - now)
1538
if time_to_die <= 0:
1539
# The timeout has passed
1542
self.expires = (now +
1543
datetime.timedelta(milliseconds =
1545
if (getattr(self, "disable_initiator_tag", None)
1548
gobject.source_remove(self.disable_initiator_tag)
1549
self.disable_initiator_tag = (gobject.timeout_add
1214
1553
# ExtendedTimeout - property
1215
1554
@dbus_service_property(_interface, signature="t",
1766
2091
elif suffix == "w":
1767
2092
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1769
raise ValueError("Unknown suffix %r" % suffix)
2094
raise ValueError("Unknown suffix {0!r}"
1770
2096
except (ValueError, IndexError) as e:
1771
2097
raise ValueError(*(e.args))
1772
2098
timevalue += delta
1773
2099
return timevalue
1776
def if_nametoindex(interface):
1777
"""Call the C function if_nametoindex(), or equivalent
1779
Note: This function cannot accept a unicode string."""
1780
global if_nametoindex
1782
if_nametoindex = (ctypes.cdll.LoadLibrary
1783
(ctypes.util.find_library("c"))
1785
except (OSError, AttributeError):
1786
logger.warning("Doing if_nametoindex the hard way")
1787
def if_nametoindex(interface):
1788
"Get an interface index the hard way, i.e. using fcntl()"
1789
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1790
with contextlib.closing(socket.socket()) as s:
1791
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1792
struct.pack(str("16s16x"),
1794
interface_index = struct.unpack(str("I"),
1796
return interface_index
1797
return if_nametoindex(interface)
1800
2102
def daemon(nochdir = False, noclose = False):
1801
2103
"""See daemon(3). Standard BSD Unix function.
1915
2226
debuglevel = server_settings["debuglevel"]
1916
2227
use_dbus = server_settings["use_dbus"]
1917
2228
use_ipv6 = server_settings["use_ipv6"]
2229
stored_state_path = os.path.join(server_settings["statedir"],
2233
initlogger(debug, logging.DEBUG)
2238
level = getattr(logging, debuglevel.upper())
2239
initlogger(debug, level)
1919
2241
if server_settings["servicename"] != "Mandos":
1920
2242
syslogger.setFormatter(logging.Formatter
1921
('Mandos (%s) [%%(process)d]:'
1922
' %%(levelname)s: %%(message)s'
1923
% server_settings["servicename"]))
2243
('Mandos ({0}) [%(process)d]:'
2244
' %(levelname)s: %(message)s'
2245
.format(server_settings
1925
2248
# Parse config file with clients
1926
client_defaults = { "timeout": "5m",
1927
"extended_timeout": "15m",
1929
"checker": "fping -q -- %%(host)s",
1931
"approval_delay": "0s",
1932
"approval_duration": "1s",
1934
client_config = configparser.SafeConfigParser(client_defaults)
2249
client_config = configparser.SafeConfigParser(Client
1935
2251
client_config.read(os.path.join(server_settings["configdir"],
1936
2252
"clients.conf"))
2043
2348
client_class = Client
2045
client_class = functools.partial(ClientDBusTransitional,
2047
def client_config_items(config, section):
2048
special_settings = {
2049
"approved_by_default":
2050
lambda: config.getboolean(section,
2051
"approved_by_default"),
2053
for name, value in config.items(section):
2350
client_class = functools.partial(ClientDBus, bus = bus)
2352
client_settings = Client.config_parser(client_config)
2353
old_client_settings = {}
2356
# Get client data and settings from last running state.
2357
if server_settings["restore"]:
2359
with open(stored_state_path, "rb") as stored_state:
2360
clients_data, old_client_settings = (pickle.load
2362
os.remove(stored_state_path)
2363
except IOError as e:
2364
if e.errno == errno.ENOENT:
2365
logger.warning("Could not load persistent state: {0}"
2366
.format(os.strerror(e.errno)))
2368
logger.critical("Could not load persistent state:",
2371
except EOFError as e:
2372
logger.warning("Could not load persistent state: "
2373
"EOFError:", exc_info=e)
2375
with PGPEngine() as pgp:
2376
for client_name, client in clients_data.iteritems():
2377
# Decide which value to use after restoring saved state.
2378
# We have three different values: Old config file,
2379
# new config file, and saved state.
2380
# New config value takes precedence if it differs from old
2381
# config value, otherwise use saved state.
2382
for name, value in client_settings[client_name].items():
2384
# For each value in new config, check if it
2385
# differs from the old config value (Except for
2386
# the "secret" attribute)
2387
if (name != "secret" and
2388
value != old_client_settings[client_name]
2390
client[name] = value
2394
# Clients who has passed its expire date can still be
2395
# enabled if its last checker was successful. Clients
2396
# whose checker succeeded before we stored its state is
2397
# assumed to have successfully run all checkers during
2399
if client["enabled"]:
2400
if datetime.datetime.utcnow() >= client["expires"]:
2401
if not client["last_checked_ok"]:
2403
"disabling client {0} - Client never "
2404
"performed a successful checker"
2405
.format(client_name))
2406
client["enabled"] = False
2407
elif client["last_checker_status"] != 0:
2409
"disabling client {0} - Client "
2410
"last checker failed with error code {1}"
2411
.format(client_name,
2412
client["last_checker_status"]))
2413
client["enabled"] = False
2415
client["expires"] = (datetime.datetime
2417
+ client["timeout"])
2418
logger.debug("Last checker succeeded,"
2419
" keeping {0} enabled"
2420
.format(client_name))
2055
yield (name, special_settings[name]())
2059
tcp_server.clients.update(set(
2060
client_class(name = section,
2061
config= dict(client_config_items(
2062
client_config, section)))
2063
for section in client_config.sections()))
2422
client["secret"] = (
2423
pgp.decrypt(client["encrypted_secret"],
2424
client_settings[client_name]
2427
# If decryption fails, we use secret from new settings
2428
logger.debug("Failed to decrypt {0} old secret"
2429
.format(client_name))
2430
client["secret"] = (
2431
client_settings[client_name]["secret"])
2433
# Add/remove clients based on new changes made to config
2434
for client_name in (set(old_client_settings)
2435
- set(client_settings)):
2436
del clients_data[client_name]
2437
for client_name in (set(client_settings)
2438
- set(old_client_settings)):
2439
clients_data[client_name] = client_settings[client_name]
2441
# Create all client objects
2442
for client_name, client in clients_data.iteritems():
2443
tcp_server.clients[client_name] = client_class(
2444
name = client_name, settings = client)
2064
2446
if not tcp_server.clients:
2065
2447
logger.warning("No clients defined")
2139
class MandosDBusServiceTransitional(MandosDBusService):
2140
__metaclass__ = AlternateDBusNamesMetaclass
2141
mandos_dbus_service = MandosDBusServiceTransitional()
2529
mandos_dbus_service = MandosDBusService()
2144
2532
"Cleanup function; run on exit"
2145
2533
service.cleanup()
2147
2535
multiprocessing.active_children()
2536
if not (tcp_server.clients or client_settings):
2539
# Store client before exiting. Secrets are encrypted with key
2540
# based on what config file has. If config file is
2541
# removed/edited, old secret will thus be unrecovable.
2543
with PGPEngine() as pgp:
2544
for client in tcp_server.clients.itervalues():
2545
key = client_settings[client.name]["secret"]
2546
client.encrypted_secret = pgp.encrypt(client.secret,
2550
# A list of attributes that can not be pickled
2552
exclude = set(("bus", "changedstate", "secret",
2554
for name, typ in (inspect.getmembers
2555
(dbus.service.Object)):
2558
client_dict["encrypted_secret"] = (client
2560
for attr in client.client_structure:
2561
if attr not in exclude:
2562
client_dict[attr] = getattr(client, attr)
2564
clients[client.name] = client_dict
2565
del client_settings[client.name]["secret"]
2568
with (tempfile.NamedTemporaryFile
2569
(mode='wb', suffix=".pickle", prefix='clients-',
2570
dir=os.path.dirname(stored_state_path),
2571
delete=False)) as stored_state:
2572
pickle.dump((clients, client_settings), stored_state)
2573
tempname=stored_state.name
2574
os.rename(tempname, stored_state_path)
2575
except (IOError, OSError) as e:
2581
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2582
logger.warning("Could not save persistent state: {0}"
2583
.format(os.strerror(e.errno)))
2585
logger.warning("Could not save persistent state:",
2589
# Delete all clients, and settings from config
2148
2590
while tcp_server.clients:
2149
client = tcp_server.clients.pop()
2591
name, client = tcp_server.clients.popitem()
2151
2593
client.remove_from_connection()
2152
client.disable_hook = None
2153
2594
# Don't signal anything except ClientRemoved
2154
2595
client.disable(quiet=True)