/mandos/release : revision 24.1.186

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

66

69

67

import dbus

70

68

import dbus.service

75

73

import ctypes.util

76

74

import xml.dom.minidom

77

75

import inspect

78

import GnuPGInterface

79

76

80

77

try:

81

78

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

86

83

SO_BINDTODEVICE = None

87

84

88

85

89

version = "1.4.1"

90

stored_state_file = "clients.pickle"

86

version = "1.3.1"

91

87

92

logger = logging.getLogger()

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

93

90

syslogger = (logging.handlers.SysLogHandler

94

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

92

address = str("/dev/log")))

96

97

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

101

except (OSError, AttributeError):

102

def if_nametoindex(interface):

103

"Get an interface index the hard way, i.e. using fcntl()"

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

with contextlib.closing(socket.socket()) as s:

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

111

return interface_index

112

113

114

def initlogger(level=logging.WARNING):

115

"""init logger and add loglevel"""

116

117

syslogger.setFormatter(logging.Formatter

118

('Mandos [%(process)d]: %(levelname)s:'

119

' %(message)s'))

120

logger.addHandler(syslogger)

121

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class CryptoError(Exception):

132

pass

133

134

135

class Crypto(object):

136

"""A simple class for OpenPGP symmetric encryption & decryption"""

137

def __init__(self):

138

self.gnupg = GnuPGInterface.GnuPG()

139

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

140

self.gnupg = GnuPGInterface.GnuPG()

141

self.gnupg.options.meta_interactive = False

142

self.gnupg.options.homedir = self.tempdir

143

self.gnupg.options.extra_args.extend(['--force-mdc',

144

'--quiet'])

145

146

def __enter__(self):

147

return self

148

149

def __exit__ (self, exc_type, exc_value, traceback):

150

self._cleanup()

151

return False

152

153

def __del__(self):

154

self._cleanup()

155

156

def _cleanup(self):

157

if self.tempdir is not None:

158

# Delete contents of tempdir

159

for root, dirs, files in os.walk(self.tempdir,

160

topdown = False):

161

for filename in files:

162

os.remove(os.path.join(root, filename))

163

for dirname in dirs:

164

os.rmdir(os.path.join(root, dirname))

165

# Remove tempdir

166

os.rmdir(self.tempdir)

167

self.tempdir = None

168

169

def password_encode(self, password):

170

# Passphrase can not be empty and can not contain newlines or

171

# NUL bytes. So we prefix it and hex encode it.

172

return b"mandos" + binascii.hexlify(password)

173

174

def encrypt(self, data, password):

175

self.gnupg.passphrase = self.password_encode(password)

176

with open(os.devnull) as devnull:

177

try:

178

proc = self.gnupg.run(['--symmetric'],

179

create_fhs=['stdin', 'stdout'],

180

attach_fhs={'stderr': devnull})

181

with contextlib.closing(proc.handles['stdin']) as f:

182

f.write(data)

183

with contextlib.closing(proc.handles['stdout']) as f:

184

ciphertext = f.read()

185

proc.wait()

186

except IOError as e:

187

raise CryptoError(e)

188

self.gnupg.passphrase = None

189

return ciphertext

190

191

def decrypt(self, data, password):

192

self.gnupg.passphrase = self.password_encode(password)

193

with open(os.devnull) as devnull:

194

try:

195

proc = self.gnupg.run(['--decrypt'],

196

create_fhs=['stdin', 'stdout'],

197

attach_fhs={'stderr': devnull})

198

with contextlib.closing(proc.handles['stdin'] ) as f:

199

f.write(data)

200

with contextlib.closing(proc.handles['stdout']) as f:

201

decrypted_plaintext = f.read()

202

proc.wait()

203

except IOError as e:

204

raise CryptoError(e)

205

self.gnupg.passphrase = None

206

return decrypted_plaintext

207

208

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

209

103

210

104

class AvahiError(Exception):

211

105

def __init__(self, value, *args, **kwargs):

266

160

" after %i retries, exiting.",

267

161

self.rename_count)

268

162

raise AvahiServiceError("Too many renames")

269

self.name = unicode(self.server

270

.GetAlternativeServiceName(self.name))

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

271

164

logger.info("Changing Zeroconf service name to %r ...",

272

165

self.name)

166

syslogger.setFormatter(logging.Formatter

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

169

% self.name))

273

170

self.remove()

274

171

try:

275

172

self.add()

295

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

296

193

self.entry_group_state_changed_match = (

297

194

self.group.connect_to_signal(

298

'StateChanged', self.entry_group_state_changed))

195

'StateChanged', self .entry_group_state_changed))

299

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

300

197

self.name, self.type)

301

198

self.group.AddService(

327

224

try:

328

225

self.group.Free()

329

226

except (dbus.exceptions.UnknownMethodException,

330

dbus.exceptions.DBusException):

227

dbus.exceptions.DBusException) as e:

331

228

pass

332

229

self.group = None

333

230

self.remove()

367

264

self.server_state_changed)

368

265

self.server_state_changed(self.server.GetState())

369

266

370

class AvahiServiceToSyslog(AvahiService):

371

def rename(self):

372

"""Add the new name to the syslog messages"""

373

ret = AvahiService.rename(self)

374

syslogger.setFormatter(logging.Formatter

375

('Mandos (%s) [%%(process)d]:'

376

' %%(levelname)s: %%(message)s'

377

% self.name))

378

return ret

379

267

380

268

def _timedelta_to_milliseconds(td):

381

269

"Convert a datetime.timedelta() to milliseconds"

400

288

instance %(name)s can be used in the command.

401

289

checker_initiator_tag: a gobject event source tag, or None

402

290

created: datetime.datetime(); (UTC) object creation

403

client_structure: Object describing what attributes a client has

404

and is used for storing the client at exit

405

291

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

406

293

disable_initiator_tag: a gobject event source tag, or None

407

294

enabled: bool()

408

295

fingerprint: string (40 or 32 hexadecimal digits); used to

411

298

interval: datetime.timedelta(); How often to start a new checker

412

299

last_approval_request: datetime.datetime(); (UTC) or None

413

300

last_checked_ok: datetime.datetime(); (UTC) or None

414

415

last_checker_status: integer between 0 and 255 reflecting exit

416

status of last checker. -1 reflects crashed

417

checker, or None.

418

last_enabled: datetime.datetime(); (UTC) or None

301

last_enabled: datetime.datetime(); (UTC)

419

302

name: string; from the config file, used in log messages and

420

303

D-Bus identifiers

421

304

secret: bytestring; sent verbatim (over TLS) to client

438

321

439

322

def extended_timeout_milliseconds(self):

440

323

"Return the 'extended_timeout' attribute in milliseconds"

441

return _timedelta_to_milliseconds(self.extended_timeout)

324

return _timedelta_to_milliseconds(self.extended_timeout)

442

325

443

326

def interval_milliseconds(self):

444

327

"Return the 'interval' attribute in milliseconds"

447

330

def approval_delay_milliseconds(self):

448

331

return _timedelta_to_milliseconds(self.approval_delay)

449

332

450

def __init__(self, name = None, config=None):

333

def __init__(self, name = None, disable_hook=None, config=None):

451

334

"""Note: the 'checker' key in 'config' sets the

452

335

'checker_command' attribute and *not* the 'checker'

453

336

attribute."""

473

356

% self.name)

474

357

self.host = config.get("host", "")

475

358

self.created = datetime.datetime.utcnow()

476

self.enabled = config.get("enabled", True)

359

self.enabled = False

477

360

self.last_approval_request = None

478

if self.enabled:

479

self.last_enabled = datetime.datetime.utcnow()

480

else:

481

self.last_enabled = None

361

self.last_enabled = None

482

362

self.last_checked_ok = None

483

self.last_checker_status = None

484

363

self.timeout = string_to_delta(config["timeout"])

485

self.extended_timeout = string_to_delta(config

486

["extended_timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

487

365

self.interval = string_to_delta(config["interval"])

366

self.disable_hook = disable_hook

488

367

self.checker = None

489

368

self.checker_initiator_tag = None

490

369

self.disable_initiator_tag = None

491

if self.enabled:

492

self.expires = datetime.datetime.utcnow() + self.timeout

493

else:

494

self.expires = None

370

self.expires = None

495

371

self.checker_callback_tag = None

496

372

self.checker_command = config["checker"]

497

373

self.current_checker_command = None

374

self.last_connect = None

498

375

self._approved = None

499

376

self.approved_by_default = config.get("approved_by_default",

500

377

True)

503

380

config["approval_delay"])

504

381

self.approval_duration = string_to_delta(

505

382

config["approval_duration"])

506

self.changedstate = (multiprocessing_manager

507

.Condition(multiprocessing_manager

508

.Lock()))

509

self.client_structure = [attr for attr in

510

self.__dict__.iterkeys()

511

if not attr.startswith("_")]

512

self.client_structure.append("client_structure")

513

514

for name, t in inspect.getmembers(type(self),

515

lambda obj:

516

isinstance(obj,

517

property)):

518

if not name.startswith("_"):

519

self.client_structure.append(name)

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

520

384

521

# Send notice to process children that client state has changed

522

385

def send_changedstate(self):

523

with self.changedstate:

524

self.changedstate.notify_all()

525

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

526

390

def enable(self):

527

391

"""Start this client's checker and timeout hooks"""

528

392

if getattr(self, "enabled", False):

529

393

# Already enabled

530

394

return

531

395

self.send_changedstate()

396

# Schedule a new checker to be started an 'interval' from now,

397

# and every interval from then on.

398

self.checker_initiator_tag = (gobject.timeout_add

399

(self.interval_milliseconds(),

400

self.start_checker))

401

# Schedule a disable() when 'timeout' has passed

532

402

self.expires = datetime.datetime.utcnow() + self.timeout

403

self.disable_initiator_tag = (gobject.timeout_add

404

(self.timeout_milliseconds(),

405

self.disable))

533

406

self.enabled = True

534

407

self.last_enabled = datetime.datetime.utcnow()

535

self.init_checker()

408

# Also start a new checker *right now*.

409

self.start_checker()

536

410

537

411

def disable(self, quiet=True):

538

412

"""Disable this client."""

550

424

gobject.source_remove(self.checker_initiator_tag)

551

425

self.checker_initiator_tag = None

552

426

self.stop_checker()

427

if self.disable_hook:

428

self.disable_hook(self)

553

429

self.enabled = False

554

430

# Do not run this again if called by a gobject.timeout_add

555

431

return False

556

432

557

433

def __del__(self):

434

self.disable_hook = None

558

435

self.disable()

559

436

560

def init_checker(self):

561

# Schedule a new checker to be started an 'interval' from now,

562

# and every interval from then on.

563

self.checker_initiator_tag = (gobject.timeout_add

564

(self.interval_milliseconds(),

565

self.start_checker))

566

# Schedule a disable() when 'timeout' has passed

567

self.disable_initiator_tag = (gobject.timeout_add

568

(self.timeout_milliseconds(),

569

self.disable))

570

# Also start a new checker *right now*.

571

self.start_checker()

572

573

437

def checker_callback(self, pid, condition, command):

574

438

"""The checker has completed, so take appropriate actions."""

575

439

self.checker_callback_tag = None

576

440

self.checker = None

577

441

if os.WIFEXITED(condition):

578

self.last_checker_status = os.WEXITSTATUS(condition)

579

if self.last_checker_status == 0:

442

exitstatus = os.WEXITSTATUS(condition)

443

if exitstatus == 0:

580

444

logger.info("Checker for %(name)s succeeded",

581

445

vars(self))

582

446

self.checked_ok()

584

448

logger.info("Checker for %(name)s failed",

585

449

vars(self))

586

450

else:

587

self.last_checker_status = -1

588

451

logger.warning("Checker for %(name)s crashed?",

589

452

vars(self))

590

453

597

460

if timeout is None:

598

461

timeout = self.timeout

599

462

self.last_checked_ok = datetime.datetime.utcnow()

600

if self.disable_initiator_tag is not None:

601

gobject.source_remove(self.disable_initiator_tag)

602

if getattr(self, "enabled", False):

603

self.disable_initiator_tag = (gobject.timeout_add

604

(_timedelta_to_milliseconds

605

(timeout), self.disable))

606

self.expires = datetime.datetime.utcnow() + timeout

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

self.disable_initiator_tag = (gobject.timeout_add

466

(_timedelta_to_milliseconds(timeout),

467

self.disable))

607

468

608

469

def need_approval(self):

609

470

self.last_approval_request = datetime.datetime.utcnow()

768

629

"""

769

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

770

631

for cls in self.__class__.__mro__

771

for name, prop in

772

inspect.getmembers(cls, self._is_dbus_property))

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

773

633

774

634

def _get_dbus_property(self, interface_name, property_name):

775

635

"""Returns a bound method if one exists which is a D-Bus

776

636

property with the specified name and interface.

777

637

"""

778

638

for cls in self.__class__.__mro__:

779

for name, value in (inspect.getmembers

780

(cls, self._is_dbus_property)):

781

if (value._dbus_name == property_name

782

and value._dbus_interface == interface_name):

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

783

641

return value.__get__(self)

784

642

785

643

# No such property

786

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

787

645

+ interface_name + "."

788

646

+ property_name)

647

789

648

790

649

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

791

650

out_signature="v")

824

683

825

684

Note: Will not include properties with access="write".

826

685

"""

827

properties = {}

686

all = {}

828

687

for name, prop in self._get_all_dbus_properties():

829

688

if (interface_name

830

689

and interface_name != prop._dbus_interface):

835

694

continue

836

695

value = prop()

837

696

if not hasattr(value, "variant_level"):

838

properties[name] = value

697

all[name] = value

839

698

continue

840

properties[name] = type(value)(value, variant_level=

841

value.variant_level+1)

842

return dbus.Dictionary(properties, signature="sv")

699

all[name] = type(value)(value, variant_level=

700

value.variant_level+1)

701

return dbus.Dictionary(all, signature="sv")

843

702

844

703

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

845

704

out_signature="s",

896

755

return dbus.String(dt.isoformat(),

897

756

variant_level=variant_level)

898

757

899

900

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

901

.__metaclass__):

902

"""Applied to an empty subclass of a D-Bus object, this metaclass

903

will add additional D-Bus attributes matching a certain pattern.

904

"""

758

class transitional_dbus_metaclass(DBusObjectWithProperties.__metaclass__):

905

759

def __new__(mcs, name, bases, attr):

906

# Go through all the base classes which could have D-Bus

907

# methods, signals, or properties in them

908

for base in (b for b in bases

909

if issubclass(b, dbus.service.Object)):

910

# Go though all attributes of the base class

911

for attrname, attribute in inspect.getmembers(base):

912

# Ignore non-D-Bus attributes, and D-Bus attributes

913

# with the wrong interface name

914

if (not hasattr(attribute, "_dbus_interface")

915

or not attribute._dbus_interface

916

.startswith("se.recompile.Mandos")):

917

continue

918

# Create an alternate D-Bus interface name based on

919

# the current name

920

alt_interface = (attribute._dbus_interface

921

.replace("se.recompile.Mandos",

922

"se.bsnet.fukt.Mandos"))

923

# Is this a D-Bus signal?

924

if getattr(attribute, "_dbus_is_signal", False):

925

# Extract the original non-method function by

926

# black magic

927

nonmethod_func = (dict(

928

zip(attribute.func_code.co_freevars,

929

attribute.__closure__))["func"]

930

.cell_contents)

931

# Create a new, but exactly alike, function

932

# object, and decorate it to be a new D-Bus signal

933

# with the alternate D-Bus interface name

934

new_function = (dbus.service.signal

935

(alt_interface,

936

attribute._dbus_signature)

937

(types.FunctionType(

938

nonmethod_func.func_code,

939

nonmethod_func.func_globals,

940

nonmethod_func.func_name,

941

nonmethod_func.func_defaults,

942

nonmethod_func.func_closure)))

943

# Define a creator of a function to call both the

944

# old and new functions, so both the old and new

945

# signals gets sent when the function is called

946

def fixscope(func1, func2):

947

"""This function is a scope container to pass

948

func1 and func2 to the "call_both" function

949

outside of its arguments"""

950

def call_both(*args, **kwargs):

951

"""This function will emit two D-Bus

952

signals by calling func1 and func2"""

953

func1(*args, **kwargs)

954

func2(*args, **kwargs)

955

return call_both

956

# Create the "call_both" function and add it to

957

# the class

958

attr[attrname] = fixscope(attribute,

959

new_function)

960

# Is this a D-Bus method?

961

elif getattr(attribute, "_dbus_is_method", False):

962

# Create a new, but exactly alike, function

963

# object. Decorate it to be a new D-Bus method

964

# with the alternate D-Bus interface name. Add it

965

# to the class.

966

attr[attrname] = (dbus.service.method

967

(alt_interface,

968

attribute._dbus_in_signature,

969

attribute._dbus_out_signature)

970

(types.FunctionType

971

(attribute.func_code,

972

attribute.func_globals,

973

attribute.func_name,

974

attribute.func_defaults,

975

attribute.func_closure)))

976

# Is this a D-Bus property?

977

elif getattr(attribute, "_dbus_is_property", False):

978

# Create a new, but exactly alike, function

979

# object, and decorate it to be a new D-Bus

980

# property with the alternate D-Bus interface

981

# name. Add it to the class.

982

attr[attrname] = (dbus_service_property

983

(alt_interface,

984

attribute._dbus_signature,

985

attribute._dbus_access,

986

attribute

987

._dbus_get_args_options

988

["byte_arrays"])

989

(types.FunctionType

990

(attribute.func_code,

991

attribute.func_globals,

992

attribute.func_name,

993

attribute.func_defaults,

994

attribute.func_closure)))

760

for attrname, old_dbusobj in inspect.getmembers(bases[0]):

761

new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")

762

if (getattr(old_dbusobj, "_dbus_is_signal", False)

763

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

764

unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,

765

old_dbusobj.__closure__))["func"].cell_contents

766

newfunc = types.FunctionType(unwrappedfunc.func_code,

767

unwrappedfunc.func_globals,

768

unwrappedfunc.func_name,

769

unwrappedfunc.func_defaults,

770

unwrappedfunc.func_closure)

771

new_dbusfunc = dbus.service.signal(

772

new_interface, old_dbusobj._dbus_signature)(newfunc)

773

attr["_transitional_" + attrname] = new_dbusfunc

774

775

def fixscope(func1, func2):

776

def newcall(*args, **kwargs):

777

func1(*args, **kwargs)

778

func2(*args, **kwargs)

779

return newcall

780

781

attr[attrname] = fixscope(old_dbusobj, new_dbusfunc)

782

783

elif (getattr(old_dbusobj, "_dbus_is_method", False)

784

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

785

new_dbusfunc = (dbus.service.method

786

(new_interface,

787

old_dbusobj._dbus_in_signature,

788

old_dbusobj._dbus_out_signature)

789

(types.FunctionType

790

(old_dbusobj.func_code,

791

old_dbusobj.func_globals,

792

old_dbusobj.func_name,

793

old_dbusobj.func_defaults,

794

old_dbusobj.func_closure)))

795

796

attr[attrname] = new_dbusfunc

797

elif (getattr(old_dbusobj, "_dbus_is_property", False)

798

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

799

new_dbusfunc = (dbus_service_property

800

(new_interface,

801

old_dbusobj._dbus_signature,

802

old_dbusobj._dbus_access,

803

old_dbusobj._dbus_get_args_options["byte_arrays"])

804

(types.FunctionType

805

(old_dbusobj.func_code,

806

old_dbusobj.func_globals,

807

old_dbusobj.func_name,

808

old_dbusobj.func_defaults,

809

old_dbusobj.func_closure)))

810

811

attr[attrname] = new_dbusfunc

995

812

return type.__new__(mcs, name, bases, attr)

996

813

997

998

814

class ClientDBus(Client, DBusObjectWithProperties):

999

815

"""A Client class using D-Bus

1000

816

1009

825

# dbus.service.Object doesn't use super(), so we can't either.

1010

826

1011

827

def __init__(self, bus = None, *args, **kwargs):

828

self._approvals_pending = 0

1012

829

self.bus = bus

1013

830

Client.__init__(self, *args, **kwargs)

1014

1015

self._approvals_pending = 0

1016

831

# Only now, when this client is initialized, can it show up on

1017

832

# the D-Bus

1018

833

client_object_name = unicode(self.name).translate(

1026

841

def notifychangeproperty(transform_func,

1027

842

dbus_name, type_func=lambda x: x,

1028

843

variant_level=1):

1029

""" Modify a variable so that it's a property which announces

1030

its changes to DBus.

1031

1032

transform_fun: Function that takes a value and a variant_level

1033

and transforms it to a D-Bus type.

1034

dbus_name: D-Bus name of the variable

844

""" Modify a variable so that its a property that announce its

845

changes to DBus.

846

transform_fun: Function that takes a value and transform it to

847

DBus type.

848

dbus_name: DBus name of the variable

1035

849

type_func: Function that transform the value before sending it

1036

to the D-Bus. Default: no transform

1037

variant_level: D-Bus variant level. Default: 1

850

to DBus

851

variant_level: DBus variant level. default: 1

1038

852

"""

1039

attrname = "_{0}".format(dbus_name)

853

real_value = [None,]

1040

854

def setter(self, value):

855

old_value = real_value[0]

856

real_value[0] = value

1041

857

if hasattr(self, "dbus_object_path"):

1042

if (not hasattr(self, attrname) or

1043

type_func(getattr(self, attrname, None))

1044

!= type_func(value)):

1045

dbus_value = transform_func(type_func(value),

1046

variant_level

1047

=variant_level)

858

if type_func(old_value) != type_func(real_value[0]):

859

dbus_value = transform_func(type_func(real_value[0]),

860

variant_level)

1048

861

self.PropertyChanged(dbus.String(dbus_name),

1049

862

dbus_value)

1050

setattr(self, attrname, value)

1051

863

1052

return property(lambda self: getattr(self, attrname), setter)

864

return property(lambda self: real_value[0], setter)

1053

865

1054

866

1055

867

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1060

872

last_enabled = notifychangeproperty(datetime_to_dbus,

1061

873

"LastEnabled")

1062

874

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1063

type_func = lambda checker:

1064

checker is not None)

875

type_func = lambda checker: checker is not None)

1065

876

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1066

877

"LastCheckedOK")

1067

last_approval_request = notifychangeproperty(

1068

datetime_to_dbus, "LastApprovalRequest")

878

last_approval_request = notifychangeproperty(datetime_to_dbus,

879

"LastApprovalRequest")

1069

880

approved_by_default = notifychangeproperty(dbus.Boolean,

1070

881

"ApprovedByDefault")

1071

approval_delay = notifychangeproperty(dbus.UInt16,

1072

"ApprovalDelay",

1073

type_func =

1074

_timedelta_to_milliseconds)

1075

approval_duration = notifychangeproperty(

1076

dbus.UInt16, "ApprovalDuration",

1077

type_func = _timedelta_to_milliseconds)

882

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

883

type_func = _timedelta_to_milliseconds)

884

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

885

type_func = _timedelta_to_milliseconds)

1078

886

host = notifychangeproperty(dbus.String, "Host")

1079

887

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1080

type_func =

1081

_timedelta_to_milliseconds)

1082

extended_timeout = notifychangeproperty(

1083

dbus.UInt16, "ExtendedTimeout",

1084

type_func = _timedelta_to_milliseconds)

1085

interval = notifychangeproperty(dbus.UInt16,

1086

"Interval",

1087

type_func =

1088

_timedelta_to_milliseconds)

888

type_func = _timedelta_to_milliseconds)

889

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

890

type_func = _timedelta_to_milliseconds)

891

interval = notifychangeproperty(dbus.UInt16, "Interval",

892

type_func = _timedelta_to_milliseconds)

1089

893

checker_command = notifychangeproperty(dbus.String, "Checker")

1090

894

1091

895

del notifychangeproperty

1145

949

1146

950

1147

951

## D-Bus methods, signals & properties

1148

_interface = "se.recompile.Mandos.Client"

1149

952

_interface = "se.bsnet.fukt.Mandos.Client"

953

1150

954

## Signals

1151

955

1152

956

# CheckerCompleted - signal

1188

992

"D-Bus signal"

1189

993

return self.need_approval()

1190

994

1191

# NeRwequest - signal

1192

@dbus.service.signal(_interface, signature="s")

1193

def NewRequest(self, ip):

1194

"""D-Bus signal

1195

Is sent after a client request a password.

1196

"""

1197

pass

1198

1199

995

## Methods

1200

996

1201

997

# Approve - method

1284

1080

# Created - property

1285

1081

@dbus_service_property(_interface, signature="s", access="read")

1286

1082

def Created_dbus_property(self):

1287

return datetime_to_dbus(self.created)

1083

return dbus.String(datetime_to_dbus(self.created))

1288

1084

1289

1085

# LastEnabled - property

1290

1086

@dbus_service_property(_interface, signature="s", access="read")

1334

1130

gobject.source_remove(self.disable_initiator_tag)

1335

1131

self.disable_initiator_tag = None

1336

1132

self.expires = None

1337

time_to_die = _timedelta_to_milliseconds((self

1338

.last_checked_ok

1339

+ self.timeout)

1340

- datetime.datetime

1341

.utcnow())

1133

time_to_die = (self.

1134

_timedelta_to_milliseconds((self

1135

.last_checked_ok

1136

+ self.timeout)

1137

- datetime.datetime

1138

.utcnow()))

1342

1139

if time_to_die <= 0:

1343

1140

# The timeout has passed

1344

1141

self.disable()

1345

1142

else:

1346

1143

self.expires = (datetime.datetime.utcnow()

1347

+ datetime.timedelta(milliseconds =

1348

time_to_die))

1144

+ datetime.timedelta(milliseconds = time_to_die))

1349

1145

self.disable_initiator_tag = (gobject.timeout_add

1350

1146

(time_to_die, self.disable))

1351

1147

1366

1162

self.interval = datetime.timedelta(0, 0, 0, value)

1367

1163

if getattr(self, "checker_initiator_tag", None) is None:

1368

1164

return

1369

if self.enabled:

1370

# Reschedule checker run

1371

gobject.source_remove(self.checker_initiator_tag)

1372

self.checker_initiator_tag = (gobject.timeout_add

1373

(value, self.start_checker))

1374

self.start_checker() # Start one now, too

1165

# Reschedule checker run

1166

gobject.source_remove(self.checker_initiator_tag)

1167

self.checker_initiator_tag = (gobject.timeout_add

1168

(value, self.start_checker))

1169

self.start_checker() # Start one now, too

1375

1170

1376

1171

# Checker - property

1377

1172

@dbus_service_property(_interface, signature="s",

1431

1226

return super(ProxyClient, self).__setattr__(name, value)

1432

1227

self._pipe.send(('setattr', name, value))

1433

1228

1434

1435

1229

class ClientDBusTransitional(ClientDBus):

1436

__metaclass__ = AlternateDBusNamesMetaclass

1437

1230

__metaclass__ = transitional_dbus_metaclass

1438

1231

1439

1232

class ClientHandler(socketserver.BaseRequestHandler, object):

1440

1233

"""A class to handle client connections.

1502

1295

logger.warning("Bad certificate: %s", error)

1503

1296

return

1504

1297

logger.debug("Fingerprint: %s", fpr)

1505

if self.server.use_dbus:

1506

# Emit D-Bus signal

1507

client.NewRequest(str(self.client_address))

1508

1298

1509

1299

try:

1510

1300

client = ProxyClient(child_pipe, fpr,

1523

1313

client.name)

1524

1314

if self.server.use_dbus:

1525

1315

# Emit D-Bus signal

1526

client.Rejected("Disabled")

1316

client.Rejected("Disabled")

1527

1317

return

1528

1318

1529

1319

if client._approved or not client.approval_delay:

1546

1336

return

1547

1337

1548

1338

#wait until timeout or approved

1339

#x = float(client._timedelta_to_milliseconds(delay))

1549

1340

time = datetime.datetime.now()

1550

1341

client.changedstate.acquire()

1551

(client.changedstate.wait

1552

(float(client._timedelta_to_milliseconds(delay)

1553

/ 1000)))

1342

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1554

1343

client.changedstate.release()

1555

1344

time2 = datetime.datetime.now()

1556

1345

if (time2 - time) >= delay:

1580

1369

sent_size += sent

1581

1370

1582

1371

logger.info("Sending secret to %s", client.name)

1583

# bump the timeout using extended_timeout

1372

# bump the timeout as if seen

1584

1373

client.checked_ok(client.extended_timeout)

1585

1374

if self.server.use_dbus:

1586

1375

# Emit D-Bus signal

1654

1443

# Convert the buffer to a Python bytestring

1655

1444

fpr = ctypes.string_at(buf, buf_len.value)

1656

1445

# Convert the bytestring to hexadecimal notation

1657

hex_fpr = binascii.hexlify(fpr).upper()

1446

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1658

1447

return hex_fpr

1659

1448

1660

1449

1666

1455

except:

1667

1456

self.handle_error(request, address)

1668

1457

self.close_request(request)

1669

1458

1670

1459

def process_request(self, request, address):

1671

1460

"""Start a new process to process the request."""

1672

proc = multiprocessing.Process(target = self.sub_process_main,

1673

args = (request,

1674

address))

1675

proc.start()

1676

return proc

1461

multiprocessing.Process(target = self.sub_process_main,

1462

args = (request, address)).start()

1677

1463

1678

1464

1679

1465

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1685

1471

"""

1686

1472

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1687

1473

1688

proc = MultiprocessingMixIn.process_request(self, request,

1689

client_address)

1474

super(MultiprocessingMixInWithPipe,

1475

self).process_request(request, client_address)

1690

1476

self.child_pipe.close()

1691

self.add_pipe(parent_pipe, proc)

1477

self.add_pipe(parent_pipe)

1692

1478

1693

def add_pipe(self, parent_pipe, proc):

1479

def add_pipe(self, parent_pipe):

1694

1480

"""Dummy function; override as necessary"""

1695

1481

raise NotImplementedError

1696

1482

1774

1560

self.enabled = False

1775

1561

self.clients = clients

1776

1562

if self.clients is None:

1777

self.clients = {}

1563

self.clients = set()

1778

1564

self.use_dbus = use_dbus

1779

1565

self.gnutls_priority = gnutls_priority

1780

1566

IPv6_TCPServer.__init__(self, server_address,

1784

1570

def server_activate(self):

1785

1571

if self.enabled:

1786

1572

return socketserver.TCPServer.server_activate(self)

1787

1788

1573

def enable(self):

1789

1574

self.enabled = True

1790

1791

def add_pipe(self, parent_pipe, proc):

1575

def add_pipe(self, parent_pipe):

1792

1576

# Call "handle_ipc" for both data and EOF events

1793

1577

gobject.io_add_watch(parent_pipe.fileno(),

1794

1578

gobject.IO_IN | gobject.IO_HUP,

1795

1579

functools.partial(self.handle_ipc,

1796

parent_pipe =

1797

parent_pipe,

1798

proc = proc))

1799

1580

parent_pipe = parent_pipe))

1581

1800

1582

def handle_ipc(self, source, condition, parent_pipe=None,

1801

proc = None, client_object=None):

1583

client_object=None):

1802

1584

condition_names = {

1803

1585

gobject.IO_IN: "IN", # There is data to read.

1804

1586

gobject.IO_OUT: "OUT", # Data can be written (without

1813

1595

for cond, name in

1814

1596

condition_names.iteritems()

1815

1597

if cond & condition)

1816

# error, or the other end of multiprocessing.Pipe has closed

1598

# error or the other end of multiprocessing.Pipe has closed

1817

1599

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1818

# Wait for other process to exit

1819

proc.join()

1820

1600

return False

1821

1601

1822

1602

# Read a request from the child

1827

1607

fpr = request[1]

1828

1608

address = request[2]

1829

1609

1830

for c in self.clients.itervalues():

1610

for c in self.clients:

1831

1611

if c.fingerprint == fpr:

1832

1612

client = c

1833

1613

break

1836

1616

"dress: %s", fpr, address)

1837

1617

if self.use_dbus:

1838

1618

# Emit D-Bus signal

1839

mandos_dbus_service.ClientNotFound(fpr,

1840

address[0])

1619

mandos_dbus_service.ClientNotFound(fpr, address[0])

1841

1620

parent_pipe.send(False)

1842

1621

return False

1843

1622

1844

1623

gobject.io_add_watch(parent_pipe.fileno(),

1845

1624

gobject.IO_IN | gobject.IO_HUP,

1846

1625

functools.partial(self.handle_ipc,

1847

parent_pipe =

1848

parent_pipe,

1849

proc = proc,

1850

client_object =

1851

client))

1626

parent_pipe = parent_pipe,

1627

client_object = client))

1852

1628

parent_pipe.send(True)

1853

# remove the old hook in favor of the new above hook on

1854

# same fileno

1629

# remove the old hook in favor of the new above hook on same fileno

1855

1630

return False

1856

1631

if command == 'funcall':

1857

1632

funcname = request[1]

1858

1633

args = request[2]

1859

1634

kwargs = request[3]

1860

1635

1861

parent_pipe.send(('data', getattr(client_object,

1862

funcname)(*args,

1863

**kwargs)))

1636

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1864

1637

1865

1638

if command == 'getattr':

1866

1639

attrname = request[1]

1867

1640

if callable(client_object.__getattribute__(attrname)):

1868

1641

parent_pipe.send(('function',))

1869

1642

else:

1870

parent_pipe.send(('data', client_object

1871

.__getattribute__(attrname)))

1643

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1872

1644

1873

1645

if command == 'setattr':

1874

1646

attrname = request[1]

1917

1689

return timevalue

1918

1690

1919

1691

1692

def if_nametoindex(interface):

1693

"""Call the C function if_nametoindex(), or equivalent

1694

1695

Note: This function cannot accept a unicode string."""

1696

global if_nametoindex

1697

try:

1698

if_nametoindex = (ctypes.cdll.LoadLibrary

1699

(ctypes.util.find_library("c"))

1700

.if_nametoindex)

1701

except (OSError, AttributeError):

1702

logger.warning("Doing if_nametoindex the hard way")

1703

def if_nametoindex(interface):

1704

"Get an interface index the hard way, i.e. using fcntl()"

1705

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1706

with contextlib.closing(socket.socket()) as s:

1707

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1708

struct.pack(str("16s16x"),

1709

interface))

1710

interface_index = struct.unpack(str("I"),

1711

ifreq[16:20])[0]

1712

return interface_index

1713

return if_nametoindex(interface)

1714

1715

1920

1716

def daemon(nochdir = False, noclose = False):

1921

1717

"""See daemon(3). Standard BSD Unix function.

1922

1718

1977

1773

" system bus interface")

1978

1774

parser.add_argument("--no-ipv6", action="store_false",

1979

1775

dest="use_ipv6", help="Do not use IPv6")

1980

parser.add_argument("--no-restore", action="store_false",

1981

dest="restore", help="Do not restore stored"

1982

" state")

1983

parser.add_argument("--statedir", metavar="DIR",

1984

help="Directory to save/restore state in")

1985

1986

1776

options = parser.parse_args()

1987

1777

1988

1778

if options.check:

2001

1791

"use_dbus": "True",

2002

1792

"use_ipv6": "True",

2003

1793

"debuglevel": "",

2004

"restore": "True",

2005

"statedir": "/var/lib/mandos"

2006

1794

}

2007

1795

2008

1796

# Parse config file for server-global settings

2025

1813

# options, if set.

2026

1814

for option in ("interface", "address", "port", "debug",

2027

1815

"priority", "servicename", "configdir",

2028

"use_dbus", "use_ipv6", "debuglevel", "restore",

2029

"statedir"):

1816

"use_dbus", "use_ipv6", "debuglevel"):

2030

1817

value = getattr(options, option)

2031

1818

if value is not None:

2032

1819

server_settings[option] = value

2044

1831

debuglevel = server_settings["debuglevel"]

2045

1832

use_dbus = server_settings["use_dbus"]

2046

1833

use_ipv6 = server_settings["use_ipv6"]

2047

stored_state_path = os.path.join(server_settings["statedir"],

2048

stored_state_file)

2049

2050

if debug:

2051

initlogger(logging.DEBUG)

2052

else:

2053

if not debuglevel:

2054

initlogger()

2055

else:

2056

level = getattr(logging, debuglevel.upper())

2057

initlogger(level)

2058

1834

2059

1835

if server_settings["servicename"] != "Mandos":

2060

1836

syslogger.setFormatter(logging.Formatter

2115

1891

if error[0] != errno.EPERM:

2116

1892

raise error

2117

1893

1894

if not debug and not debuglevel:

1895

syslogger.setLevel(logging.WARNING)

1896

console.setLevel(logging.WARNING)

1897

if debuglevel:

1898

level = getattr(logging, debuglevel.upper())

1899

syslogger.setLevel(level)

1900

console.setLevel(level)

1901

2118

1902

if debug:

2119

1903

# Enable all possible GnuTLS debugging

2120

1904

2151

1935

# End of Avahi example code

2152

1936

if use_dbus:

2153

1937

try:

2154

bus_name = dbus.service.BusName("se.recompile.Mandos",

2155

bus, do_not_queue=True)

2156

old_bus_name = (dbus.service.BusName

2157

("se.bsnet.fukt.Mandos", bus,

2158

do_not_queue=True))

1938

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1939

bus, do_not_queue=True)

1940

bus_name2 = dbus.service.BusName("se.recompile.Mandos",

1941

bus, do_not_queue=True)

2159

1942

except dbus.exceptions.NameExistsException as e:

2160

1943

logger.error(unicode(e) + ", disabling D-Bus")

2161

1944

use_dbus = False

2162

1945

server_settings["use_dbus"] = False

2163

1946

tcp_server.use_dbus = False

2164

1947

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2165

service = AvahiServiceToSyslog(name =

2166

server_settings["servicename"],

2167

servicetype = "_mandos._tcp",

2168

protocol = protocol, bus = bus)

1948

service = AvahiService(name = server_settings["servicename"],

1949

servicetype = "_mandos._tcp",

1950

protocol = protocol, bus = bus)

2169

1951

if server_settings["interface"]:

2170

1952

service.interface = (if_nametoindex

2171

1953

(str(server_settings["interface"])))

2175

1957

2176

1958

client_class = Client

2177

1959

if use_dbus:

2178

client_class = functools.partial(ClientDBusTransitional,

2179

bus = bus)

2180

2181

special_settings = {

2182

# Some settings need to be accessd by special methods;

2183

# booleans need .getboolean(), etc. Here is a list of them:

2184

"approved_by_default":

2185

lambda section:

2186

client_config.getboolean(section, "approved_by_default"),

2187

"enabled":

2188

lambda section:

2189

client_config.getboolean(section, "enabled"),

2190

}

2191

# Construct a new dict of client settings of this form:

2192

# { client_name: {setting_name: value, ...}, ...}

2193

# with exceptions for any special settings as defined above

2194

client_settings = dict((clientname,

2195

dict((setting,

2196

(value

2197

if setting not in special_settings

2198

else special_settings[setting]

2199

(clientname)))

2200

for setting, value in

2201

client_config.items(clientname)))

2202

for clientname in client_config.sections())

2203

2204

old_client_settings = {}

2205

clients_data = []

2206

2207

# Get client data and settings from last running state.

2208

if server_settings["restore"]:

2209

try:

2210

with open(stored_state_path, "rb") as stored_state:

2211

clients_data, old_client_settings = (pickle.load

2212

(stored_state))

2213

os.remove(stored_state_path)

2214

except IOError as e:

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2218

raise

2219

2220

with Crypto() as crypt:

2221

for client in clients_data:

2222

client_name = client["name"]

2223

2224

# Decide which value to use after restoring saved state.

2225

# We have three different values: Old config file,

2226

# new config file, and saved state.

2227

# New config value takes precedence if it differs from old

2228

# config value, otherwise use saved state.

2229

for name, value in client_settings[client_name].items():

2230

try:

2231

# For each value in new config, check if it

2232

# differs from the old config value (Except for

2233

# the "secret" attribute)

2234

if (name != "secret" and

2235

value != old_client_settings[client_name]

2236

[name]):

2237

setattr(client, name, value)

2238

except KeyError:

2239

pass

2240

2241

# Clients who has passed its expire date can still be

2242

# enabled if its last checker was sucessful. Clients

2243

# whose checker failed before we stored its state is

2244

# assumed to have failed all checkers during downtime.

2245

if client["enabled"] and client["last_checked_ok"]:

2246

if ((datetime.datetime.utcnow()

2247

- client["last_checked_ok"])

2248

> client["interval"]):

2249

if client["last_checker_status"] != 0:

2250

client["enabled"] = False

2251

else:

2252

client["expires"] = (datetime.datetime

2253

.utcnow()

2254

+ client["timeout"])

2255

2256

client["changedstate"] = (multiprocessing_manager

2257

.Condition

2258

(multiprocessing_manager

2259

.Lock()))

2260

if use_dbus:

2261

new_client = (ClientDBusTransitional.__new__

2262

(ClientDBusTransitional))

2263

tcp_server.clients[client_name] = new_client

2264

new_client.bus = bus

2265

for name, value in client.iteritems():

2266

setattr(new_client, name, value)

2267

client_object_name = unicode(client_name).translate(

2268

{ord("."): ord("_"),

2269

ord("-"): ord("_")})

2270

new_client.dbus_object_path = (dbus.ObjectPath

2271

("/clients/"

2272

+ client_object_name))

2273

DBusObjectWithProperties.__init__(new_client,

2274

new_client.bus,

2275

new_client

2276

.dbus_object_path)

2277

else:

2278

tcp_server.clients[client_name] = (Client.__new__

2279

(Client))

2280

for name, value in client.iteritems():

2281

setattr(tcp_server.clients[client_name],

2282

name, value)

2283

1960

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1961

def client_config_items(config, section):

1962

special_settings = {

1963

"approved_by_default":

1964

lambda: config.getboolean(section,

1965

"approved_by_default"),

1966

}

1967

for name, value in config.items(section):

2284

1968

try:

2285

tcp_server.clients[client_name].secret = (

2286

crypt.decrypt(tcp_server.clients[client_name]

2287

.encrypted_secret,

2288

client_settings[client_name]

2289

["secret"]))

2290

except CryptoError:

2291

# If decryption fails, we use secret from new settings

2292

tcp_server.clients[client_name].secret = (

2293

client_settings[client_name]["secret"])

2294

2295

# Create/remove clients based on new changes made to config

2296

for clientname in set(old_client_settings) - set(client_settings):

2297

del tcp_server.clients[clientname]

2298

for clientname in set(client_settings) - set(old_client_settings):

2299

tcp_server.clients[clientname] = (client_class(name

2300

= clientname,

2301

config =

2302

client_settings

2303

[clientname]))

2304

1969

yield (name, special_settings[name]())

1970

except KeyError:

1971

yield (name, value)

1972

1973

tcp_server.clients.update(set(

1974

client_class(name = section,

1975

config= dict(client_config_items(

1976

client_config, section)))

1977

for section in client_config.sections()))

2305

1978

if not tcp_server.clients:

2306

1979

logger.warning("No clients defined")

2307

1980

2329

2002

"""A D-Bus proxy object"""

2330

2003

def __init__(self):

2331

2004

dbus.service.Object.__init__(self, bus, "/")

2332

_interface = "se.recompile.Mandos"

2005

_interface = "se.bsnet.fukt.Mandos"

2333

2006

2334

2007

@dbus.service.signal(_interface, signature="o")

2335

2008

def ClientAdded(self, objpath):

2350

2023

def GetAllClients(self):

2351

2024

"D-Bus method"

2352

2025

return dbus.Array(c.dbus_object_path

2353

for c in

2354

tcp_server.clients.itervalues())

2026

for c in tcp_server.clients)

2355

2027

2356

2028

@dbus.service.method(_interface,

2357

2029

out_signature="a{oa{sv}}")

2359

2031

"D-Bus method"

2360

2032

return dbus.Dictionary(

2361

2033

((c.dbus_object_path, c.GetAll(""))

2362

for c in tcp_server.clients.itervalues()),

2034

for c in tcp_server.clients),

2363

2035

signature="oa{sv}")

2364

2036

2365

2037

@dbus.service.method(_interface, in_signature="o")

2366

2038

def RemoveClient(self, object_path):

2367

2039

"D-Bus method"

2368

for c in tcp_server.clients.itervalues():

2040

for c in tcp_server.clients:

2369

2041

if c.dbus_object_path == object_path:

2370

del tcp_server.clients[c.name]

2042

tcp_server.clients.remove(c)

2371

2043

c.remove_from_connection()

2372

2044

# Don't signal anything except ClientRemoved

2373

2045

c.disable(quiet=True)

2379

2051

del _interface

2380

2052

2381

2053

class MandosDBusServiceTransitional(MandosDBusService):

2382

__metaclass__ = AlternateDBusNamesMetaclass

2054

__metaclass__ = transitional_dbus_metaclass

2383

2055

mandos_dbus_service = MandosDBusServiceTransitional()

2384

2056

2385

2057

def cleanup():

2386

2058

"Cleanup function; run on exit"

2387

2059

service.cleanup()

2388

2060

2389

multiprocessing.active_children()

2390

if not (tcp_server.clients or client_settings):

2391

return

2392

2393

# Store client before exiting. Secrets are encrypted with key

2394

# based on what config file has. If config file is

2395

# removed/edited, old secret will thus be unrecovable.

2396

clients = []

2397

with Crypto() as crypt:

2398

for client in tcp_server.clients.itervalues():

2399

key = client_settings[client.name]["secret"]

2400

client.encrypted_secret = crypt.encrypt(client.secret,

2401

key)

2402

client_dict = {}

2403

2404

# A list of attributes that will not be stored when

2405

# shutting down.

2406

exclude = set(("bus", "changedstate", "secret"))

2407

for name, typ in (inspect.getmembers

2408

(dbus.service.Object)):

2409

exclude.add(name)

2410

2411

client_dict["encrypted_secret"] = (client

2412

.encrypted_secret)

2413

for attr in client.client_structure:

2414

if attr not in exclude:

2415

client_dict[attr] = getattr(client, attr)

2416

2417

clients.append(client_dict)

2418

del client_settings[client.name]["secret"]

2419

2420

try:

2421

with os.fdopen(os.open(stored_state_path,

2422

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2423

0600), "wb") as stored_state:

2424

pickle.dump((clients, client_settings), stored_state)

2425

except (IOError, OSError) as e:

2426

logger.warning("Could not save persistent state: {0}"

2427

.format(e))

2428

if e.errno not in (errno.ENOENT, errno.EACCES):

2429

raise

2430

2431

# Delete all clients, and settings from config

2432

2061

while tcp_server.clients:

2433

name, client = tcp_server.clients.popitem()

2062

client = tcp_server.clients.pop()

2434

2063

if use_dbus:

2435

2064

client.remove_from_connection()

2065

client.disable_hook = None

2436

2066

# Don't signal anything except ClientRemoved

2437

2067

client.disable(quiet=True)

2438

2068

if use_dbus:

2439

2069

# Emit D-Bus signal

2440

mandos_dbus_service.ClientRemoved(client

2441

.dbus_object_path,

2070

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2442

2071

client.name)

2443

client_settings.clear()

2444

2072

2445

2073

atexit.register(cleanup)

2446

2074

2447

for client in tcp_server.clients.itervalues():

2075

for client in tcp_server.clients:

2448

2076

if use_dbus:

2449

2077

# Emit D-Bus signal

2450

2078

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2451

# Need to initiate checking of clients

2452

if client.enabled:

2453

client.init_checker()

2079

client.enable()

2454

2080

2455

2081

tcp_server.enable()

2456

2082

tcp_server.server_activate()