/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

Reorder TODO entries

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
85
85
    except ImportError:
86
86
        SO_BINDTODEVICE = None
87
87
 
88
 
 
89
88
version = "1.4.1"
90
 
stored_state_path = "/var/lib/mandos/clients.pickle"
 
89
stored_state_file = "clients.pickle"
91
90
 
92
91
logger = logging.getLogger()
93
92
syslogger = (logging.handlers.SysLogHandler
111
110
        return interface_index
112
111
 
113
112
 
114
 
def initlogger(level=logging.WARNING):
 
113
def initlogger(debug, level=logging.WARNING):
115
114
    """init logger and add loglevel"""
116
115
    
117
116
    syslogger.setFormatter(logging.Formatter
119
118
                            ' %(message)s'))
120
119
    logger.addHandler(syslogger)
121
120
    
122
 
    console = logging.StreamHandler()
123
 
    console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
 
                                           ' [%(process)d]:'
125
 
                                           ' %(levelname)s:'
126
 
                                           ' %(message)s'))
127
 
    logger.addHandler(console)
 
121
    if debug:
 
122
        console = logging.StreamHandler()
 
123
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
124
                                               ' [%(process)d]:'
 
125
                                               ' %(levelname)s:'
 
126
                                               ' %(message)s'))
 
127
        logger.addHandler(console)
128
128
    logger.setLevel(level)
129
129
 
130
130
 
131
 
class CryptoError(Exception):
 
131
class PGPError(Exception):
 
132
    """Exception if encryption/decryption fails"""
132
133
    pass
133
134
 
134
135
 
135
 
class Crypto(object):
 
136
class PGPEngine(object):
136
137
    """A simple class for OpenPGP symmetric encryption & decryption"""
137
138
    def __init__(self):
138
139
        self.gnupg = GnuPGInterface.GnuPG()
184
185
                    ciphertext = f.read()
185
186
                proc.wait()
186
187
            except IOError as e:
187
 
                raise CryptoError(e)
 
188
                raise PGPError(e)
188
189
        self.gnupg.passphrase = None
189
190
        return ciphertext
190
191
    
201
202
                    decrypted_plaintext = f.read()
202
203
                proc.wait()
203
204
            except IOError as e:
204
 
                raise CryptoError(e)
 
205
                raise PGPError(e)
205
206
        self.gnupg.passphrase = None
206
207
        return decrypted_plaintext
207
208
 
377
378
                                % self.name))
378
379
        return ret
379
380
 
380
 
def _timedelta_to_milliseconds(td):
 
381
def timedelta_to_milliseconds(td):
381
382
    "Convert a datetime.timedelta() to milliseconds"
382
383
    return ((td.days * 24 * 60 * 60 * 1000)
383
384
            + (td.seconds * 1000)
387
388
    """A representation of a client host served by this server.
388
389
    
389
390
    Attributes:
390
 
    _approved:   bool(); 'None' if not yet approved/disapproved
 
391
    approved:   bool(); 'None' if not yet approved/disapproved
391
392
    approval_delay: datetime.timedelta(); Time to wait for approval
392
393
    approval_duration: datetime.timedelta(); Duration of one approval
393
394
    checker:    subprocess.Popen(); a running checker process used
411
412
    interval:   datetime.timedelta(); How often to start a new checker
412
413
    last_approval_request: datetime.datetime(); (UTC) or None
413
414
    last_checked_ok: datetime.datetime(); (UTC) or None
414
 
 
415
415
    last_checker_status: integer between 0 and 255 reflecting exit
416
416
                         status of last checker. -1 reflects crashed
417
417
                         checker, or None.
418
 
    last_enabled: datetime.datetime(); (UTC)
 
418
    last_enabled: datetime.datetime(); (UTC) or None
419
419
    name:       string; from the config file, used in log messages and
420
420
                        D-Bus identifiers
421
421
    secret:     bytestring; sent verbatim (over TLS) to client
431
431
                          "created", "enabled", "fingerprint",
432
432
                          "host", "interval", "last_checked_ok",
433
433
                          "last_enabled", "name", "timeout")
 
434
    client_defaults = { "timeout": "5m",
 
435
                        "extended_timeout": "15m",
 
436
                        "interval": "2m",
 
437
                        "checker": "fping -q -- %%(host)s",
 
438
                        "host": "",
 
439
                        "approval_delay": "0s",
 
440
                        "approval_duration": "1s",
 
441
                        "approved_by_default": "True",
 
442
                        "enabled": "True",
 
443
                        }
434
444
    
435
445
    def timeout_milliseconds(self):
436
446
        "Return the 'timeout' attribute in milliseconds"
437
 
        return _timedelta_to_milliseconds(self.timeout)
 
447
        return timedelta_to_milliseconds(self.timeout)
438
448
    
439
449
    def extended_timeout_milliseconds(self):
440
450
        "Return the 'extended_timeout' attribute in milliseconds"
441
 
        return _timedelta_to_milliseconds(self.extended_timeout)
 
451
        return timedelta_to_milliseconds(self.extended_timeout)
442
452
    
443
453
    def interval_milliseconds(self):
444
454
        "Return the 'interval' attribute in milliseconds"
445
 
        return _timedelta_to_milliseconds(self.interval)
 
455
        return timedelta_to_milliseconds(self.interval)
446
456
    
447
457
    def approval_delay_milliseconds(self):
448
 
        return _timedelta_to_milliseconds(self.approval_delay)
449
 
    
450
 
    def __init__(self, name = None, config=None):
 
458
        return timedelta_to_milliseconds(self.approval_delay)
 
459
 
 
460
    @staticmethod
 
461
    def config_parser(config):
 
462
        """ Construct a new dict of client settings of this form:
 
463
        { client_name: {setting_name: value, ...}, ...}
 
464
        with exceptions for any special settings as defined above"""
 
465
        settings = {}
 
466
        for client_name in config.sections():
 
467
            section = dict(config.items(client_name))
 
468
            client = settings[client_name] = {}
 
469
            
 
470
            client["host"] = section["host"]
 
471
            # Reformat values from string types to Python types
 
472
            client["approved_by_default"] = config.getboolean(
 
473
                client_name, "approved_by_default")
 
474
            client["enabled"] = config.getboolean(client_name, "enabled")
 
475
            
 
476
            client["fingerprint"] = (section["fingerprint"].upper()
 
477
                                     .replace(" ", ""))
 
478
            if "secret" in section:
 
479
                client["secret"] = section["secret"].decode("base64")
 
480
            elif "secfile" in section:
 
481
                with open(os.path.expanduser(os.path.expandvars
 
482
                                             (section["secfile"])),
 
483
                          "rb") as secfile:
 
484
                    client["secret"] = secfile.read()
 
485
            else:
 
486
                raise TypeError("No secret or secfile for section %s"
 
487
                                % section)
 
488
            client["timeout"] = string_to_delta(section["timeout"])
 
489
            client["extended_timeout"] = string_to_delta(
 
490
                section["extended_timeout"])
 
491
            client["interval"] = string_to_delta(section["interval"])
 
492
            client["approval_delay"] = string_to_delta(
 
493
                section["approval_delay"])
 
494
            client["approval_duration"] = string_to_delta(
 
495
                section["approval_duration"])
 
496
            client["checker_command"] = section["checker"]
 
497
            client["last_approval_request"] = None
 
498
            client["last_checked_ok"] = None
 
499
            client["last_checker_status"] = None
 
500
            if client["enabled"]:
 
501
                client["last_enabled"] = datetime.datetime.utcnow()
 
502
                client["expires"] = (datetime.datetime.utcnow()
 
503
                                     + client["timeout"])
 
504
            else:
 
505
                client["last_enabled"] = None
 
506
                client["expires"] = None
 
507
 
 
508
        return settings
 
509
        
 
510
        
 
511
    def __init__(self, settings, name = None):
451
512
        """Note: the 'checker' key in 'config' sets the
452
513
        'checker_command' attribute and *not* the 'checker'
453
514
        attribute."""
454
515
        self.name = name
455
 
        if config is None:
456
 
            config = {}
 
516
        # adding all client settings
 
517
        for setting, value in settings.iteritems():
 
518
            setattr(self, setting, value)
 
519
        
457
520
        logger.debug("Creating client %r", self.name)
458
521
        # Uppercase and remove spaces from fingerprint for later
459
522
        # comparison purposes with return value from the fingerprint()
460
523
        # function
461
 
        self.fingerprint = (config["fingerprint"].upper()
462
 
                            .replace(" ", ""))
463
524
        logger.debug("  Fingerprint: %s", self.fingerprint)
464
 
        if "secret" in config:
465
 
            self.secret = config["secret"].decode("base64")
466
 
        elif "secfile" in config:
467
 
            with open(os.path.expanduser(os.path.expandvars
468
 
                                         (config["secfile"])),
469
 
                      "rb") as secfile:
470
 
                self.secret = secfile.read()
471
 
        else:
472
 
            raise TypeError("No secret or secfile for client %s"
473
 
                            % self.name)
474
 
        self.host = config.get("host", "")
475
 
        self.created = datetime.datetime.utcnow()
476
 
        self.enabled = True
477
 
        self.last_approval_request = None
478
 
        self.last_enabled = datetime.datetime.utcnow()
479
 
        self.last_checked_ok = None
480
 
        self.last_checker_status = None
481
 
        self.timeout = string_to_delta(config["timeout"])
482
 
        self.extended_timeout = string_to_delta(config
483
 
                                                ["extended_timeout"])
484
 
        self.interval = string_to_delta(config["interval"])
 
525
        self.created = settings.get("created", datetime.datetime.utcnow())
 
526
 
 
527
        # attributes specific for this server instance
485
528
        self.checker = None
486
529
        self.checker_initiator_tag = None
487
530
        self.disable_initiator_tag = None
488
 
        self.expires = datetime.datetime.utcnow() + self.timeout
489
531
        self.checker_callback_tag = None
490
 
        self.checker_command = config["checker"]
491
532
        self.current_checker_command = None
492
 
        self._approved = None
493
 
        self.approved_by_default = config.get("approved_by_default",
494
 
                                              True)
 
533
        self.approved = None
495
534
        self.approvals_pending = 0
496
 
        self.approval_delay = string_to_delta(
497
 
            config["approval_delay"])
498
 
        self.approval_duration = string_to_delta(
499
 
            config["approval_duration"])
500
535
        self.changedstate = (multiprocessing_manager
501
536
                             .Condition(multiprocessing_manager
502
537
                                        .Lock()))
569
604
        self.checker_callback_tag = None
570
605
        self.checker = None
571
606
        if os.WIFEXITED(condition):
572
 
            self.last_checker_status =  os.WEXITSTATUS(condition)
 
607
            self.last_checker_status = os.WEXITSTATUS(condition)
573
608
            if self.last_checker_status == 0:
574
609
                logger.info("Checker for %(name)s succeeded",
575
610
                            vars(self))
595
630
            gobject.source_remove(self.disable_initiator_tag)
596
631
        if getattr(self, "enabled", False):
597
632
            self.disable_initiator_tag = (gobject.timeout_add
598
 
                                          (_timedelta_to_milliseconds
 
633
                                          (timedelta_to_milliseconds
599
634
                                           (timeout), self.disable))
600
635
            self.expires = datetime.datetime.utcnow() + timeout
601
636
    
1005
1040
    def __init__(self, bus = None, *args, **kwargs):
1006
1041
        self.bus = bus
1007
1042
        Client.__init__(self, *args, **kwargs)
 
1043
        self._approvals_pending = 0
1008
1044
        
1009
1045
        self._approvals_pending = 0
1010
1046
        # Only now, when this client is initialized, can it show up on
1062
1098
        datetime_to_dbus, "LastApprovalRequest")
1063
1099
    approved_by_default = notifychangeproperty(dbus.Boolean,
1064
1100
                                               "ApprovedByDefault")
1065
 
    approval_delay = notifychangeproperty(dbus.UInt16,
 
1101
    approval_delay = notifychangeproperty(dbus.UInt64,
1066
1102
                                          "ApprovalDelay",
1067
1103
                                          type_func =
1068
 
                                          _timedelta_to_milliseconds)
 
1104
                                          timedelta_to_milliseconds)
1069
1105
    approval_duration = notifychangeproperty(
1070
 
        dbus.UInt16, "ApprovalDuration",
1071
 
        type_func = _timedelta_to_milliseconds)
 
1106
        dbus.UInt64, "ApprovalDuration",
 
1107
        type_func = timedelta_to_milliseconds)
1072
1108
    host = notifychangeproperty(dbus.String, "Host")
1073
 
    timeout = notifychangeproperty(dbus.UInt16, "Timeout",
 
1109
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1074
1110
                                   type_func =
1075
 
                                   _timedelta_to_milliseconds)
 
1111
                                   timedelta_to_milliseconds)
1076
1112
    extended_timeout = notifychangeproperty(
1077
 
        dbus.UInt16, "ExtendedTimeout",
1078
 
        type_func = _timedelta_to_milliseconds)
1079
 
    interval = notifychangeproperty(dbus.UInt16,
 
1113
        dbus.UInt64, "ExtendedTimeout",
 
1114
        type_func = timedelta_to_milliseconds)
 
1115
    interval = notifychangeproperty(dbus.UInt64,
1080
1116
                                    "Interval",
1081
1117
                                    type_func =
1082
 
                                    _timedelta_to_milliseconds)
 
1118
                                    timedelta_to_milliseconds)
1083
1119
    checker_command = notifychangeproperty(dbus.String, "Checker")
1084
1120
    
1085
1121
    del notifychangeproperty
1127
1163
        return r
1128
1164
    
1129
1165
    def _reset_approved(self):
1130
 
        self._approved = None
 
1166
        self.approved = None
1131
1167
        return False
1132
1168
    
1133
1169
    def approve(self, value=True):
1134
1170
        self.send_changedstate()
1135
 
        self._approved = value
1136
 
        gobject.timeout_add(_timedelta_to_milliseconds
 
1171
        self.approved = value
 
1172
        gobject.timeout_add(timedelta_to_milliseconds
1137
1173
                            (self.approval_duration),
1138
1174
                            self._reset_approved)
1139
1175
    
1253
1289
                           access="readwrite")
1254
1290
    def ApprovalDuration_dbus_property(self, value=None):
1255
1291
        if value is None:       # get
1256
 
            return dbus.UInt64(_timedelta_to_milliseconds(
 
1292
            return dbus.UInt64(timedelta_to_milliseconds(
1257
1293
                    self.approval_duration))
1258
1294
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1259
1295
    
1273
1309
    def Host_dbus_property(self, value=None):
1274
1310
        if value is None:       # get
1275
1311
            return dbus.String(self.host)
1276
 
        self.host = value
 
1312
        self.host = unicode(value)
1277
1313
    
1278
1314
    # Created - property
1279
1315
    @dbus_service_property(_interface, signature="s", access="read")
1280
1316
    def Created_dbus_property(self):
1281
 
        return dbus.String(datetime_to_dbus(self.created))
 
1317
        return datetime_to_dbus(self.created)
1282
1318
    
1283
1319
    # LastEnabled - property
1284
1320
    @dbus_service_property(_interface, signature="s", access="read")
1328
1364
        gobject.source_remove(self.disable_initiator_tag)
1329
1365
        self.disable_initiator_tag = None
1330
1366
        self.expires = None
1331
 
        time_to_die = _timedelta_to_milliseconds((self
1332
 
                                                  .last_checked_ok
1333
 
                                                  + self.timeout)
1334
 
                                                 - datetime.datetime
1335
 
                                                 .utcnow())
 
1367
        time_to_die = timedelta_to_milliseconds((self
 
1368
                                                 .last_checked_ok
 
1369
                                                 + self.timeout)
 
1370
                                                - datetime.datetime
 
1371
                                                .utcnow())
1336
1372
        if time_to_die <= 0:
1337
1373
            # The timeout has passed
1338
1374
            self.disable()
1360
1396
        self.interval = datetime.timedelta(0, 0, 0, value)
1361
1397
        if getattr(self, "checker_initiator_tag", None) is None:
1362
1398
            return
1363
 
        # Reschedule checker run
1364
 
        gobject.source_remove(self.checker_initiator_tag)
1365
 
        self.checker_initiator_tag = (gobject.timeout_add
1366
 
                                      (value, self.start_checker))
1367
 
        self.start_checker()    # Start one now, too
 
1399
        if self.enabled:
 
1400
            # Reschedule checker run
 
1401
            gobject.source_remove(self.checker_initiator_tag)
 
1402
            self.checker_initiator_tag = (gobject.timeout_add
 
1403
                                          (value, self.start_checker))
 
1404
            self.start_checker()    # Start one now, too
1368
1405
    
1369
1406
    # Checker - property
1370
1407
    @dbus_service_property(_interface, signature="s",
1372
1409
    def Checker_dbus_property(self, value=None):
1373
1410
        if value is None:       # get
1374
1411
            return dbus.String(self.checker_command)
1375
 
        self.checker_command = value
 
1412
        self.checker_command = unicode(value)
1376
1413
    
1377
1414
    # CheckerRunning - property
1378
1415
    @dbus_service_property(_interface, signature="b",
1407
1444
            raise KeyError()
1408
1445
    
1409
1446
    def __getattribute__(self, name):
1410
 
        if(name == '_pipe'):
 
1447
        if name == '_pipe':
1411
1448
            return super(ProxyClient, self).__getattribute__(name)
1412
1449
        self._pipe.send(('getattr', name))
1413
1450
        data = self._pipe.recv()
1420
1457
            return func
1421
1458
    
1422
1459
    def __setattr__(self, name, value):
1423
 
        if(name == '_pipe'):
 
1460
        if name == '_pipe':
1424
1461
            return super(ProxyClient, self).__setattr__(name, value)
1425
1462
        self._pipe.send(('setattr', name, value))
1426
1463
 
1495
1532
                    logger.warning("Bad certificate: %s", error)
1496
1533
                    return
1497
1534
                logger.debug("Fingerprint: %s", fpr)
1498
 
                if self.server.use_dbus:
1499
 
                    # Emit D-Bus signal
1500
 
                    client.NewRequest(str(self.client_address))
1501
1535
                
1502
1536
                try:
1503
1537
                    client = ProxyClient(child_pipe, fpr,
1505
1539
                except KeyError:
1506
1540
                    return
1507
1541
                
 
1542
                if self.server.use_dbus:
 
1543
                    # Emit D-Bus signal
 
1544
                    client.NewRequest(str(self.client_address))
 
1545
                
1508
1546
                if client.approval_delay:
1509
1547
                    delay = client.approval_delay
1510
1548
                    client.approvals_pending += 1
1519
1557
                            client.Rejected("Disabled")
1520
1558
                        return
1521
1559
                    
1522
 
                    if client._approved or not client.approval_delay:
 
1560
                    if client.approved or not client.approval_delay:
1523
1561
                        #We are approved or approval is disabled
1524
1562
                        break
1525
 
                    elif client._approved is None:
 
1563
                    elif client.approved is None:
1526
1564
                        logger.info("Client %s needs approval",
1527
1565
                                    client.name)
1528
1566
                        if self.server.use_dbus:
1542
1580
                    time = datetime.datetime.now()
1543
1581
                    client.changedstate.acquire()
1544
1582
                    (client.changedstate.wait
1545
 
                     (float(client._timedelta_to_milliseconds(delay)
 
1583
                     (float(client.timedelta_to_milliseconds(delay)
1546
1584
                            / 1000)))
1547
1585
                    client.changedstate.release()
1548
1586
                    time2 = datetime.datetime.now()
1656
1694
    def sub_process_main(self, request, address):
1657
1695
        try:
1658
1696
            self.finish_request(request, address)
1659
 
        except:
 
1697
        except Exception:
1660
1698
            self.handle_error(request, address)
1661
1699
        self.close_request(request)
1662
1700
    
1972
2010
                        dest="use_ipv6", help="Do not use IPv6")
1973
2011
    parser.add_argument("--no-restore", action="store_false",
1974
2012
                        dest="restore", help="Do not restore stored"
1975
 
                        " state", default=True)
 
2013
                        " state")
 
2014
    parser.add_argument("--statedir", metavar="DIR",
 
2015
                        help="Directory to save/restore state in")
1976
2016
    
1977
2017
    options = parser.parse_args()
1978
2018
    
1992
2032
                        "use_dbus": "True",
1993
2033
                        "use_ipv6": "True",
1994
2034
                        "debuglevel": "",
 
2035
                        "restore": "True",
 
2036
                        "statedir": "/var/lib/mandos"
1995
2037
                        }
1996
2038
    
1997
2039
    # Parse config file for server-global settings
2014
2056
    # options, if set.
2015
2057
    for option in ("interface", "address", "port", "debug",
2016
2058
                   "priority", "servicename", "configdir",
2017
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore"):
 
2059
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2060
                   "statedir"):
2018
2061
        value = getattr(options, option)
2019
2062
        if value is not None:
2020
2063
            server_settings[option] = value
2032
2075
    debuglevel = server_settings["debuglevel"]
2033
2076
    use_dbus = server_settings["use_dbus"]
2034
2077
    use_ipv6 = server_settings["use_ipv6"]
 
2078
    stored_state_path = os.path.join(server_settings["statedir"],
 
2079
                                     stored_state_file)
2035
2080
    
2036
2081
    if debug:
2037
 
        initlogger(logging.DEBUG)
 
2082
        initlogger(debug, logging.DEBUG)
2038
2083
    else:
2039
2084
        if not debuglevel:
2040
 
            initlogger()
 
2085
            initlogger(debug)
2041
2086
        else:
2042
2087
            level = getattr(logging, debuglevel.upper())
2043
 
            initlogger(level)
 
2088
            initlogger(debug, level)
2044
2089
    
2045
2090
    if server_settings["servicename"] != "Mandos":
2046
2091
        syslogger.setFormatter(logging.Formatter
2049
2094
                                % server_settings["servicename"]))
2050
2095
    
2051
2096
    # Parse config file with clients
2052
 
    client_defaults = { "timeout": "5m",
2053
 
                        "extended_timeout": "15m",
2054
 
                        "interval": "2m",
2055
 
                        "checker": "fping -q -- %%(host)s",
2056
 
                        "host": "",
2057
 
                        "approval_delay": "0s",
2058
 
                        "approval_duration": "1s",
2059
 
                        }
2060
 
    client_config = configparser.SafeConfigParser(client_defaults)
 
2097
    client_config = configparser.SafeConfigParser(Client.client_defaults)
2061
2098
    client_config.read(os.path.join(server_settings["configdir"],
2062
2099
                                    "clients.conf"))
2063
2100
    
2120
2157
        os.dup2(null, sys.stdin.fileno())
2121
2158
        if null > 2:
2122
2159
            os.close(null)
2123
 
    else:
2124
 
        # No console logging
2125
 
        logger.removeHandler(console)
2126
2160
    
2127
2161
    # Need to fork before connecting to D-Bus
2128
2162
    if not debug:
2129
2163
        # Close all input and output, do double fork, etc.
2130
2164
        daemon()
2131
2165
    
 
2166
    gobject.threads_init()
 
2167
    
2132
2168
    global main_loop
2133
2169
    # From the Avahi example code
2134
2170
    DBusGMainLoop(set_as_default=True )
2164
2200
        client_class = functools.partial(ClientDBusTransitional,
2165
2201
                                         bus = bus)
2166
2202
    
2167
 
    special_settings = {
2168
 
        # Some settings need to be accessd by special methods;
2169
 
        # booleans need .getboolean(), etc.  Here is a list of them:
2170
 
        "approved_by_default":
2171
 
            lambda section:
2172
 
            client_config.getboolean(section, "approved_by_default"),
2173
 
        }
2174
 
    # Construct a new dict of client settings of this form:
2175
 
    # { client_name: {setting_name: value, ...}, ...}
2176
 
    # with exceptions for any special settings as defined above
2177
 
    client_settings = dict((clientname,
2178
 
                           dict((setting,
2179
 
                                 (value
2180
 
                                  if setting not in special_settings
2181
 
                                  else special_settings[setting]
2182
 
                                  (clientname)))
2183
 
                                for setting, value in
2184
 
                                client_config.items(clientname)))
2185
 
                          for clientname in client_config.sections())
2186
 
    
 
2203
    client_settings = Client.config_parser(client_config)
2187
2204
    old_client_settings = {}
2188
 
    clients_data = []
 
2205
    clients_data = {}
2189
2206
    
2190
2207
    # Get client data and settings from last running state.
2191
2208
    if server_settings["restore"]:
2199
2216
                           .format(e))
2200
2217
            if e.errno != errno.ENOENT:
2201
2218
                raise
 
2219
        except EOFError as e:
 
2220
            logger.warning("Could not load persistent state: "
 
2221
                           "EOFError: {0}".format(e))
2202
2222
    
2203
 
    with Crypto() as crypt:
2204
 
        for client in clients_data:
2205
 
            client_name = client["name"]
2206
 
            
 
2223
    with PGPEngine() as pgp:
 
2224
        for client_name, client in clients_data.iteritems():
2207
2225
            # Decide which value to use after restoring saved state.
2208
2226
            # We have three different values: Old config file,
2209
2227
            # new config file, and saved state.
2217
2235
                    if (name != "secret" and
2218
2236
                        value != old_client_settings[client_name]
2219
2237
                        [name]):
2220
 
                        setattr(client, name, value)
 
2238
                        client[name] = value
2221
2239
                except KeyError:
2222
2240
                    pass
2223
2241
            
2224
2242
            # Clients who has passed its expire date can still be
2225
 
            # enabled if its last checker was sucessful.  Clients
 
2243
            # enabled if its last checker was successful.  Clients
2226
2244
            # whose checker failed before we stored its state is
2227
2245
            # assumed to have failed all checkers during downtime.
2228
 
            if client["enabled"] and client["last_checked_ok"]:
2229
 
                if ((datetime.datetime.utcnow()
2230
 
                     - client["last_checked_ok"])
2231
 
                    > client["interval"]):
2232
 
                    if client["last_checker_status"] != 0:
 
2246
            if client["enabled"]:
 
2247
                if datetime.datetime.utcnow() >= client["expires"]:
 
2248
                    if not client["last_checked_ok"]:
 
2249
                        logger.warning(
 
2250
                            "disabling client {0} - Client never "
 
2251
                            "performed a successfull checker"
 
2252
                            .format(client["name"]))
 
2253
                        client["enabled"] = False
 
2254
                    elif client["last_checker_status"] != 0:
 
2255
                        logger.warning(
 
2256
                            "disabling client {0} - Client "
 
2257
                            "last checker failed with error code {1}"
 
2258
                            .format(client["name"],
 
2259
                                    client["last_checker_status"]))
2233
2260
                        client["enabled"] = False
2234
2261
                    else:
2235
2262
                        client["expires"] = (datetime.datetime
2236
2263
                                             .utcnow()
2237
2264
                                             + client["timeout"])
2238
 
            
2239
 
            client["changedstate"] = (multiprocessing_manager
2240
 
                                      .Condition
2241
 
                                      (multiprocessing_manager
2242
 
                                       .Lock()))
2243
 
            if use_dbus:
2244
 
                new_client = (ClientDBusTransitional.__new__
2245
 
                              (ClientDBusTransitional))
2246
 
                tcp_server.clients[client_name] = new_client
2247
 
                new_client.bus = bus
2248
 
                for name, value in client.iteritems():
2249
 
                    setattr(new_client, name, value)
2250
 
                client_object_name = unicode(client_name).translate(
2251
 
                    {ord("."): ord("_"),
2252
 
                     ord("-"): ord("_")})
2253
 
                new_client.dbus_object_path = (dbus.ObjectPath
2254
 
                                               ("/clients/"
2255
 
                                                + client_object_name))
2256
 
                DBusObjectWithProperties.__init__(new_client,
2257
 
                                                  new_client.bus,
2258
 
                                                  new_client
2259
 
                                                  .dbus_object_path)
2260
 
            else:
2261
 
                tcp_server.clients[client_name] = (Client.__new__
2262
 
                                                   (Client))
2263
 
                for name, value in client.iteritems():
2264
 
                    setattr(tcp_server.clients[client_name],
2265
 
                            name, value)
2266
 
            
 
2265
                    
2267
2266
            try:
2268
 
                tcp_server.clients[client_name].secret = (
2269
 
                    crypt.decrypt(tcp_server.clients[client_name]
2270
 
                                  .encrypted_secret,
2271
 
                                  client_settings[client_name]
2272
 
                                  ["secret"]))
2273
 
            except CryptoError:
 
2267
                client["secret"] = (
 
2268
                    pgp.decrypt(client["encrypted_secret"],
 
2269
                                client_settings[client_name]
 
2270
                                ["secret"]))
 
2271
            except PGPError:
2274
2272
                # If decryption fails, we use secret from new settings
2275
 
                tcp_server.clients[client_name].secret = (
 
2273
                logger.debug("Failed to decrypt {0} old secret"
 
2274
                             .format(client_name))
 
2275
                client["secret"] = (
2276
2276
                    client_settings[client_name]["secret"])
 
2277
 
2277
2278
    
2278
 
    # Create/remove clients based on new changes made to config
2279
 
    for clientname in set(old_client_settings) - set(client_settings):
2280
 
        del tcp_server.clients[clientname]
2281
 
    for clientname in set(client_settings) - set(old_client_settings):
2282
 
        tcp_server.clients[clientname] = (client_class(name
2283
 
                                                       = clientname,
2284
 
                                                       config =
2285
 
                                                       client_settings
2286
 
                                                       [clientname]))
 
2279
    # Add/remove clients based on new changes made to config
 
2280
    for client_name in set(old_client_settings) - set(client_settings):
 
2281
        del clients_data[client_name]
 
2282
    for client_name in set(client_settings) - set(old_client_settings):
 
2283
        clients_data[client_name] = client_settings[client_name]
 
2284
 
 
2285
    # Create clients all clients
 
2286
    for client_name, client in clients_data.iteritems():
 
2287
        tcp_server.clients[client_name] = client_class(
 
2288
            name = client_name, settings = client)
2287
2289
    
2288
2290
    if not tcp_server.clients:
2289
2291
        logger.warning("No clients defined")
2301
2303
            # "pidfile" was never created
2302
2304
            pass
2303
2305
        del pidfilename
2304
 
        
2305
2306
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2306
2307
    
2307
2308
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2376
2377
        # Store client before exiting. Secrets are encrypted with key
2377
2378
        # based on what config file has. If config file is
2378
2379
        # removed/edited, old secret will thus be unrecovable.
2379
 
        clients = []
2380
 
        with Crypto() as crypt:
 
2380
        clients = {}
 
2381
        with PGPEngine() as pgp:
2381
2382
            for client in tcp_server.clients.itervalues():
2382
2383
                key = client_settings[client.name]["secret"]
2383
 
                client.encrypted_secret = crypt.encrypt(client.secret,
2384
 
                                                        key)
 
2384
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2385
                                                      key)
2385
2386
                client_dict = {}
2386
2387
                
2387
 
                # A list of attributes that will not be stored when
2388
 
                # shutting down.
2389
 
                exclude = set(("bus", "changedstate", "secret"))
 
2388
                # A list of attributes that can not be pickled
 
2389
                # + secret.
 
2390
                exclude = set(("bus", "changedstate", "secret",
 
2391
                               "checker"))
2390
2392
                for name, typ in (inspect.getmembers
2391
2393
                                  (dbus.service.Object)):
2392
2394
                    exclude.add(name)
2397
2399
                    if attr not in exclude:
2398
2400
                        client_dict[attr] = getattr(client, attr)
2399
2401
                
2400
 
                clients.append(client_dict)
 
2402
                clients[client.name] = client_dict
2401
2403
                del client_settings[client.name]["secret"]
2402
2404
        
2403
2405
        try:
2404
 
            with os.fdopen(os.open(stored_state_path,
2405
 
                                   os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2406
 
                                   0600), "wb") as stored_state:
 
2406
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
 
2407
                                                prefix="clients-",
 
2408
                                                dir=os.path.dirname
 
2409
                                                (stored_state_path))
 
2410
            with os.fdopen(tempfd, "wb") as stored_state:
2407
2411
                pickle.dump((clients, client_settings), stored_state)
 
2412
            os.rename(tempname, stored_state_path)
2408
2413
        except (IOError, OSError) as e:
2409
2414
            logger.warning("Could not save persistent state: {0}"
2410
2415
                           .format(e))
2411
 
            if e.errno not in (errno.ENOENT, errno.EACCES):
2412
 
                raise
 
2416
            if not debug:
 
2417
                try:
 
2418
                    os.remove(tempname)
 
2419
                except NameError:
 
2420
                    pass
 
2421
            if e.errno not in set((errno.ENOENT, errno.EACCES,
 
2422
                                   errno.EEXIST)):
 
2423
                raise e
2413
2424
        
2414
2425
        # Delete all clients, and settings from config
2415
2426
        while tcp_server.clients:
2479
2490
    # Must run before the D-Bus bus name gets deregistered
2480
2491
    cleanup()
2481
2492
 
2482
 
 
2483
2493
if __name__ == '__main__':
2484
2494
    main()