88
82
except ImportError:
89
83
SO_BINDTODEVICE = None
92
stored_state_file = "clients.pickle"
94
logger = logging.getLogger()
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
95
90
syslogger = (logging.handlers.SysLogHandler
96
91
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
92
address = str("/dev/log")))
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
103
except (OSError, AttributeError):
104
def if_nametoindex(interface):
105
"Get an interface index the hard way, i.e. using fcntl()"
106
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
with contextlib.closing(socket.socket()) as s:
108
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
111
interface_index = struct.unpack(str("I"),
113
return interface_index
116
def initlogger(debug, level=logging.WARNING):
117
"""init logger and add loglevel"""
119
syslogger.setFormatter(logging.Formatter
120
('Mandos [%(process)d]: %(levelname)s:'
122
logger.addHandler(syslogger)
125
console = logging.StreamHandler()
126
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
130
logger.addHandler(console)
131
logger.setLevel(level)
134
class PGPError(Exception):
135
"""Exception if encryption/decryption fails"""
139
class PGPEngine(object):
140
"""A simple class for OpenPGP symmetric encryption & decryption"""
142
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
143
self.gnupgargs = ['--batch',
144
'--home', self.tempdir,
152
def __exit__(self, exc_type, exc_value, traceback):
160
if self.tempdir is not None:
161
# Delete contents of tempdir
162
for root, dirs, files in os.walk(self.tempdir,
164
for filename in files:
165
os.remove(os.path.join(root, filename))
167
os.rmdir(os.path.join(root, dirname))
169
os.rmdir(self.tempdir)
172
def password_encode(self, password):
173
# Passphrase can not be empty and can not contain newlines or
174
# NUL bytes. So we prefix it and hex encode it.
175
encoded = b"mandos" + binascii.hexlify(password)
176
if len(encoded) > 2048:
177
# GnuPG can't handle long passwords, so encode differently
178
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
179
.replace(b"\n", b"\\n")
180
.replace(b"\0", b"\\x00"))
183
def encrypt(self, data, password):
184
passphrase = self.password_encode(password)
185
with tempfile.NamedTemporaryFile(dir=self.tempdir
187
passfile.write(passphrase)
189
proc = subprocess.Popen(['gpg', '--symmetric',
193
stdin = subprocess.PIPE,
194
stdout = subprocess.PIPE,
195
stderr = subprocess.PIPE)
196
ciphertext, err = proc.communicate(input = data)
197
if proc.returncode != 0:
201
def decrypt(self, data, password):
202
passphrase = self.password_encode(password)
203
with tempfile.NamedTemporaryFile(dir = self.tempdir
205
passfile.write(passphrase)
207
proc = subprocess.Popen(['gpg', '--decrypt',
211
stdin = subprocess.PIPE,
212
stdout = subprocess.PIPE,
213
stderr = subprocess.PIPE)
214
decrypted_plaintext, err = proc.communicate(input
216
if proc.returncode != 0:
218
return decrypted_plaintext
93
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
96
logger.addHandler(syslogger)
98
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
102
logger.addHandler(console)
221
104
class AvahiError(Exception):
222
105
def __init__(self, value, *args, **kwargs):
433
299
interval: datetime.timedelta(); How often to start a new checker
434
300
last_approval_request: datetime.datetime(); (UTC) or None
435
301
last_checked_ok: datetime.datetime(); (UTC) or None
436
last_checker_status: integer between 0 and 255 reflecting exit
437
status of last checker. -1 reflects crashed
438
checker, -2 means no checker completed yet.
439
last_enabled: datetime.datetime(); (UTC) or None
302
last_enabled: datetime.datetime(); (UTC)
440
303
name: string; from the config file, used in log messages and
441
304
D-Bus identifiers
442
305
secret: bytestring; sent verbatim (over TLS) to client
443
306
timeout: datetime.timedelta(); How long from last_checked_ok
444
307
until this client is disabled
445
extended_timeout: extra long timeout when secret has been sent
308
extended_timeout: extra long timeout when password has been sent
446
309
runtime_expansions: Allowed attributes for runtime expansion.
447
310
expires: datetime.datetime(); time (UTC) when a client will be
448
311
disabled, or None
449
server_settings: The server_settings dict from main()
452
314
runtime_expansions = ("approval_delay", "approval_duration",
453
"created", "enabled", "expires",
454
"fingerprint", "host", "interval",
455
"last_approval_request", "last_checked_ok",
315
"created", "enabled", "fingerprint",
316
"host", "interval", "last_checked_ok",
456
317
"last_enabled", "name", "timeout")
457
client_defaults = { "timeout": "PT5M",
458
"extended_timeout": "PT15M",
460
"checker": "fping -q -- %%(host)s",
462
"approval_delay": "PT0S",
463
"approval_duration": "PT1S",
464
"approved_by_default": "True",
468
319
def timeout_milliseconds(self):
469
320
"Return the 'timeout' attribute in milliseconds"
470
return timedelta_to_milliseconds(self.timeout)
321
return _timedelta_to_milliseconds(self.timeout)
472
323
def extended_timeout_milliseconds(self):
473
324
"Return the 'extended_timeout' attribute in milliseconds"
474
return timedelta_to_milliseconds(self.extended_timeout)
325
return _timedelta_to_milliseconds(self.extended_timeout)
476
327
def interval_milliseconds(self):
477
328
"Return the 'interval' attribute in milliseconds"
478
return timedelta_to_milliseconds(self.interval)
329
return _timedelta_to_milliseconds(self.interval)
480
331
def approval_delay_milliseconds(self):
481
return timedelta_to_milliseconds(self.approval_delay)
484
def config_parser(config):
485
"""Construct a new dict of client settings of this form:
486
{ client_name: {setting_name: value, ...}, ...}
487
with exceptions for any special settings as defined above.
488
NOTE: Must be a pure function. Must return the same result
489
value given the same arguments.
492
for client_name in config.sections():
493
section = dict(config.items(client_name))
494
client = settings[client_name] = {}
496
client["host"] = section["host"]
497
# Reformat values from string types to Python types
498
client["approved_by_default"] = config.getboolean(
499
client_name, "approved_by_default")
500
client["enabled"] = config.getboolean(client_name,
503
client["fingerprint"] = (section["fingerprint"].upper()
505
if "secret" in section:
506
client["secret"] = section["secret"].decode("base64")
507
elif "secfile" in section:
508
with open(os.path.expanduser(os.path.expandvars
509
(section["secfile"])),
511
client["secret"] = secfile.read()
513
raise TypeError("No secret or secfile for section {0}"
515
client["timeout"] = string_to_delta(section["timeout"])
516
client["extended_timeout"] = string_to_delta(
517
section["extended_timeout"])
518
client["interval"] = string_to_delta(section["interval"])
519
client["approval_delay"] = string_to_delta(
520
section["approval_delay"])
521
client["approval_duration"] = string_to_delta(
522
section["approval_duration"])
523
client["checker_command"] = section["checker"]
524
client["last_approval_request"] = None
525
client["last_checked_ok"] = None
526
client["last_checker_status"] = -2
530
def __init__(self, settings, name = None, server_settings=None):
332
return _timedelta_to_milliseconds(self.approval_delay)
334
def __init__(self, name = None, disable_hook=None, config=None):
335
"""Note: the 'checker' key in 'config' sets the
336
'checker_command' attribute and *not* the 'checker'
532
if server_settings is None:
534
self.server_settings = server_settings
535
# adding all client settings
536
for setting, value in settings.iteritems():
537
setattr(self, setting, value)
540
if not hasattr(self, "last_enabled"):
541
self.last_enabled = datetime.datetime.utcnow()
542
if not hasattr(self, "expires"):
543
self.expires = (datetime.datetime.utcnow()
546
self.last_enabled = None
549
341
logger.debug("Creating client %r", self.name)
550
342
# Uppercase and remove spaces from fingerprint for later
551
343
# comparison purposes with return value from the fingerprint()
345
self.fingerprint = (config["fingerprint"].upper()
553
347
logger.debug(" Fingerprint: %s", self.fingerprint)
554
self.created = settings.get("created",
555
datetime.datetime.utcnow())
557
# attributes specific for this server instance
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
351
with open(os.path.expanduser(os.path.expandvars
352
(config["secfile"])),
354
self.secret = secfile.read()
356
raise TypeError("No secret or secfile for client %s"
358
self.host = config.get("host", "")
359
self.created = datetime.datetime.utcnow()
361
self.last_approval_request = None
362
self.last_enabled = None
363
self.last_checked_ok = None
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
368
self.disable_hook = disable_hook
558
369
self.checker = None
559
370
self.checker_initiator_tag = None
560
371
self.disable_initiator_tag = None
561
373
self.checker_callback_tag = None
374
self.checker_command = config["checker"]
562
375
self.current_checker_command = None
376
self.last_connect = None
377
self._approved = None
378
self.approved_by_default = config.get("approved_by_default",
564
380
self.approvals_pending = 0
381
self.approval_delay = string_to_delta(
382
config["approval_delay"])
383
self.approval_duration = string_to_delta(
384
config["approval_duration"])
565
385
self.changedstate = (multiprocessing_manager
566
386
.Condition(multiprocessing_manager
568
self.client_structure = [attr for attr in
569
self.__dict__.iterkeys()
570
if not attr.startswith("_")]
571
self.client_structure.append("client_structure")
573
for name, t in inspect.getmembers(type(self),
577
if not name.startswith("_"):
578
self.client_structure.append(name)
580
# Send notice to process children that client state has changed
581
389
def send_changedstate(self):
582
with self.changedstate:
583
self.changedstate.notify_all()
390
self.changedstate.acquire()
391
self.changedstate.notify_all()
392
self.changedstate.release()
585
394
def enable(self):
586
395
"""Start this client's checker and timeout hooks"""
587
396
if getattr(self, "enabled", False):
588
397
# Already enabled
399
self.send_changedstate()
400
# Schedule a new checker to be started an 'interval' from now,
401
# and every interval from then on.
402
self.checker_initiator_tag = (gobject.timeout_add
403
(self.interval_milliseconds(),
405
# Schedule a disable() when 'timeout' has passed
590
406
self.expires = datetime.datetime.utcnow() + self.timeout
407
self.disable_initiator_tag = (gobject.timeout_add
408
(self.timeout_milliseconds(),
591
410
self.enabled = True
592
411
self.last_enabled = datetime.datetime.utcnow()
594
self.send_changedstate()
412
# Also start a new checker *right now*.
596
415
def disable(self, quiet=True):
597
416
"""Disable this client."""
598
417
if not getattr(self, "enabled", False):
420
self.send_changedstate()
601
422
logger.info("Disabling client %s", self.name)
602
if getattr(self, "disable_initiator_tag", None) is not None:
423
if getattr(self, "disable_initiator_tag", False):
603
424
gobject.source_remove(self.disable_initiator_tag)
604
425
self.disable_initiator_tag = None
605
426
self.expires = None
606
if getattr(self, "checker_initiator_tag", None) is not None:
427
if getattr(self, "checker_initiator_tag", False):
607
428
gobject.source_remove(self.checker_initiator_tag)
608
429
self.checker_initiator_tag = None
609
430
self.stop_checker()
431
if self.disable_hook:
432
self.disable_hook(self)
610
433
self.enabled = False
612
self.send_changedstate()
613
434
# Do not run this again if called by a gobject.timeout_add
616
437
def __del__(self):
438
self.disable_hook = None
619
def init_checker(self):
620
# Schedule a new checker to be started an 'interval' from now,
621
# and every interval from then on.
622
if self.checker_initiator_tag is not None:
623
gobject.source_remove(self.checker_initiator_tag)
624
self.checker_initiator_tag = (gobject.timeout_add
625
(self.interval_milliseconds(),
627
# Schedule a disable() when 'timeout' has passed
628
if self.disable_initiator_tag is not None:
629
gobject.source_remove(self.disable_initiator_tag)
630
self.disable_initiator_tag = (gobject.timeout_add
631
(self.timeout_milliseconds(),
633
# Also start a new checker *right now*.
636
441
def checker_callback(self, pid, condition, command):
637
442
"""The checker has completed, so take appropriate actions."""
638
443
self.checker_callback_tag = None
639
444
self.checker = None
640
445
if os.WIFEXITED(condition):
641
self.last_checker_status = os.WEXITSTATUS(condition)
642
if self.last_checker_status == 0:
446
exitstatus = os.WEXITSTATUS(condition)
643
448
logger.info("Checker for %(name)s succeeded",
645
450
self.checked_ok()
1041
750
except (AttributeError, xml.dom.DOMException,
1042
751
xml.parsers.expat.ExpatError) as error:
1043
752
logger.error("Failed to override Introspection method",
1045
754
return xmlstring
1048
def datetime_to_dbus(dt, variant_level=0):
757
def datetime_to_dbus (dt, variant_level=0):
1049
758
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1051
760
return dbus.String("", variant_level = variant_level)
1052
761
return dbus.String(dt.isoformat(),
1053
762
variant_level=variant_level)
1056
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1057
"""A class decorator; applied to a subclass of
1058
dbus.service.Object, it will add alternate D-Bus attributes with
1059
interface names according to the "alt_interface_names" mapping.
1062
@alternate_dbus_interfaces({"org.example.Interface":
1063
"net.example.AlternateInterface"})
1064
class SampleDBusObject(dbus.service.Object):
1065
@dbus.service.method("org.example.Interface")
1066
def SampleDBusMethod():
1069
The above "SampleDBusMethod" on "SampleDBusObject" will be
1070
reachable via two interfaces: "org.example.Interface" and
1071
"net.example.AlternateInterface", the latter of which will have
1072
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1073
"true", unless "deprecate" is passed with a False value.
1075
This works for methods and signals, and also for D-Bus properties
1076
(from DBusObjectWithProperties) and interfaces (from the
1077
dbus_interface_annotations decorator).
764
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
766
"""Applied to an empty subclass of a D-Bus object, this metaclass
767
will add additional D-Bus attributes matching a certain pattern.
1080
for orig_interface_name, alt_interface_name in (
1081
alt_interface_names.iteritems()):
1083
interface_names = set()
1084
# Go though all attributes of the class
1085
for attrname, attribute in inspect.getmembers(cls):
769
def __new__(mcs, name, bases, attr):
770
# Go through all the base classes which could have D-Bus
771
# methods, signals, or properties in them
772
for base in (b for b in bases
773
if issubclass(b, dbus.service.Object)):
774
# Go though all attributes of the base class
775
for attrname, attribute in inspect.getmembers(base):
1086
776
# Ignore non-D-Bus attributes, and D-Bus attributes
1087
777
# with the wrong interface name
1088
778
if (not hasattr(attribute, "_dbus_interface")
1089
779
or not attribute._dbus_interface
1090
.startswith(orig_interface_name)):
780
.startswith("se.recompile.Mandos")):
1092
782
# Create an alternate D-Bus interface name based on
1093
783
# the current name
1094
784
alt_interface = (attribute._dbus_interface
1095
.replace(orig_interface_name,
1096
alt_interface_name))
1097
interface_names.add(alt_interface)
785
.replace("se.recompile.Mandos",
786
"se.bsnet.fukt.Mandos"))
1098
787
# Is this a D-Bus signal?
1099
788
if getattr(attribute, "_dbus_is_signal", False):
1100
# Extract the original non-method undecorated
1101
# function by black magic
789
# Extract the original non-method function by
1102
791
nonmethod_func = (dict(
1103
792
zip(attribute.func_code.co_freevars,
1104
793
attribute.__closure__))["func"]
2122
def rfc3339_duration_to_delta(duration):
2123
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2125
>>> rfc3339_duration_to_delta("P7D")
2126
datetime.timedelta(7)
2127
>>> rfc3339_duration_to_delta("PT60S")
2128
datetime.timedelta(0, 60)
2129
>>> rfc3339_duration_to_delta("PT60M")
2130
datetime.timedelta(0, 3600)
2131
>>> rfc3339_duration_to_delta("PT24H")
2132
datetime.timedelta(1)
2133
>>> rfc3339_duration_to_delta("P1W")
2134
datetime.timedelta(7)
2135
>>> rfc3339_duration_to_delta("PT5M30S")
2136
datetime.timedelta(0, 330)
2137
>>> rfc3339_duration_to_delta("P1DT3M20S")
2138
datetime.timedelta(1, 200)
2141
# Parsing an RFC 3339 duration with regular expressions is not
2142
# possible - there would have to be multiple places for the same
2143
# values, like seconds. The current code, while more esoteric, is
2144
# cleaner without depending on a parsing library. If Python had a
2145
# built-in library for parsing we would use it, but we'd like to
2146
# avoid excessive use of external libraries.
2148
# New type for defining tokens, syntax, and semantics all-in-one
2149
Token = collections.namedtuple("Token",
2150
("regexp", # To match token; if
2151
# "value" is not None,
2152
# must have a "group"
2154
"value", # datetime.timedelta or
2156
"followers")) # Tokens valid after
2158
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2159
# the "duration" ABNF definition in RFC 3339, Appendix A.
2160
token_end = Token(re.compile(r"$"), None, frozenset())
2161
token_second = Token(re.compile(r"(\d+)S"),
2162
datetime.timedelta(seconds=1),
2163
frozenset((token_end,)))
2164
token_minute = Token(re.compile(r"(\d+)M"),
2165
datetime.timedelta(minutes=1),
2166
frozenset((token_second, token_end)))
2167
token_hour = Token(re.compile(r"(\d+)H"),
2168
datetime.timedelta(hours=1),
2169
frozenset((token_minute, token_end)))
2170
token_time = Token(re.compile(r"T"),
2172
frozenset((token_hour, token_minute,
2174
token_day = Token(re.compile(r"(\d+)D"),
2175
datetime.timedelta(days=1),
2176
frozenset((token_time, token_end)))
2177
token_month = Token(re.compile(r"(\d+)M"),
2178
datetime.timedelta(weeks=4),
2179
frozenset((token_day, token_end)))
2180
token_year = Token(re.compile(r"(\d+)Y"),
2181
datetime.timedelta(weeks=52),
2182
frozenset((token_month, token_end)))
2183
token_week = Token(re.compile(r"(\d+)W"),
2184
datetime.timedelta(weeks=1),
2185
frozenset((token_end,)))
2186
token_duration = Token(re.compile(r"P"), None,
2187
frozenset((token_year, token_month,
2188
token_day, token_time,
2190
# Define starting values
2191
value = datetime.timedelta() # Value so far
2193
followers = frozenset(token_duration,) # Following valid tokens
2194
s = duration # String left to parse
2195
# Loop until end token is found
2196
while found_token is not token_end:
2197
# Search for any currently valid tokens
2198
for token in followers:
2199
match = token.regexp.match(s)
2200
if match is not None:
2202
if token.value is not None:
2203
# Value found, parse digits
2204
factor = int(match.group(1), 10)
2205
# Add to value so far
2206
value += factor * token.value
2207
# Strip token from string
2208
s = token.regexp.sub("", s, 1)
2211
# Set valid next tokens
2212
followers = found_token.followers
2215
# No currently valid tokens were found
2216
raise ValueError("Invalid RFC 3339 duration")
2221
1728
def string_to_delta(interval):
2222
1729
"""Parse a string and return a datetime.timedelta
2545
2034
client_class = Client
2547
client_class = functools.partial(ClientDBus, bus = bus)
2549
client_settings = Client.config_parser(client_config)
2550
old_client_settings = {}
2553
# This is used to redirect stdout and stderr for checker processes
2555
wnull = open(os.devnull, "w") # A writable /dev/null
2556
# Only used if server is running in foreground but not in debug
2558
if debug or not foreground:
2561
# Get client data and settings from last running state.
2562
if server_settings["restore"]:
2564
with open(stored_state_path, "rb") as stored_state:
2565
clients_data, old_client_settings = (pickle.load
2567
os.remove(stored_state_path)
2568
except IOError as e:
2569
if e.errno == errno.ENOENT:
2570
logger.warning("Could not load persistent state: {0}"
2571
.format(os.strerror(e.errno)))
2573
logger.critical("Could not load persistent state:",
2576
except EOFError as e:
2577
logger.warning("Could not load persistent state: "
2578
"EOFError:", exc_info=e)
2580
with PGPEngine() as pgp:
2581
for client_name, client in clients_data.iteritems():
2582
# Skip removed clients
2583
if client_name not in client_settings:
2586
# Decide which value to use after restoring saved state.
2587
# We have three different values: Old config file,
2588
# new config file, and saved state.
2589
# New config value takes precedence if it differs from old
2590
# config value, otherwise use saved state.
2591
for name, value in client_settings[client_name].items():
2593
# For each value in new config, check if it
2594
# differs from the old config value (Except for
2595
# the "secret" attribute)
2596
if (name != "secret" and
2597
value != old_client_settings[client_name]
2599
client[name] = value
2603
# Clients who has passed its expire date can still be
2604
# enabled if its last checker was successful. Clients
2605
# whose checker succeeded before we stored its state is
2606
# assumed to have successfully run all checkers during
2608
if client["enabled"]:
2609
if datetime.datetime.utcnow() >= client["expires"]:
2610
if not client["last_checked_ok"]:
2612
"disabling client {0} - Client never "
2613
"performed a successful checker"
2614
.format(client_name))
2615
client["enabled"] = False
2616
elif client["last_checker_status"] != 0:
2618
"disabling client {0} - Client "
2619
"last checker failed with error code {1}"
2620
.format(client_name,
2621
client["last_checker_status"]))
2622
client["enabled"] = False
2624
client["expires"] = (datetime.datetime
2626
+ client["timeout"])
2627
logger.debug("Last checker succeeded,"
2628
" keeping {0} enabled"
2629
.format(client_name))
2036
client_class = functools.partial(ClientDBusTransitional,
2038
def client_config_items(config, section):
2039
special_settings = {
2040
"approved_by_default":
2041
lambda: config.getboolean(section,
2042
"approved_by_default"),
2044
for name, value in config.items(section):
2631
client["secret"] = (
2632
pgp.decrypt(client["encrypted_secret"],
2633
client_settings[client_name]
2636
# If decryption fails, we use secret from new settings
2637
logger.debug("Failed to decrypt {0} old secret"
2638
.format(client_name))
2639
client["secret"] = (
2640
client_settings[client_name]["secret"])
2642
# Add/remove clients based on new changes made to config
2643
for client_name in (set(old_client_settings)
2644
- set(client_settings)):
2645
del clients_data[client_name]
2646
for client_name in (set(client_settings)
2647
- set(old_client_settings)):
2648
clients_data[client_name] = client_settings[client_name]
2650
# Create all client objects
2651
for client_name, client in clients_data.iteritems():
2652
tcp_server.clients[client_name] = client_class(
2653
name = client_name, settings = client,
2654
server_settings = server_settings)
2046
yield (name, special_settings[name]())
2050
tcp_server.clients.update(set(
2051
client_class(name = section,
2052
config= dict(client_config_items(
2053
client_config, section)))
2054
for section in client_config.sections()))
2656
2055
if not tcp_server.clients:
2657
2056
logger.warning("No clients defined")
2660
if pidfile is not None:
2664
pidfile.write(str(pid) + "\n".encode("utf-8"))
2666
logger.error("Could not write to file %r with PID %d",
2062
pidfile.write(str(pid) + "\n".encode("utf-8"))
2065
logger.error("Could not write to file %r with PID %d",
2068
# "pidfile" was never created
2669
2070
del pidfilename
2072
signal.signal(signal.SIGINT, signal.SIG_IGN)
2671
2074
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2672
2075
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2675
@alternate_dbus_interfaces({"se.recompile.Mandos":
2676
"se.bsnet.fukt.Mandos"})
2677
class MandosDBusService(DBusObjectWithProperties):
2078
class MandosDBusService(dbus.service.Object):
2678
2079
"""A D-Bus proxy object"""
2679
2080
def __init__(self):
2680
2081
dbus.service.Object.__init__(self, bus, "/")
2681
2082
_interface = "se.recompile.Mandos"
2683
@dbus_interface_annotations(_interface)
2685
return { "org.freedesktop.DBus.Property"
2686
".EmitsChangedSignal":
2689
2084
@dbus.service.signal(_interface, signature="o")
2690
2085
def ClientAdded(self, objpath):
2736
mandos_dbus_service = MandosDBusService()
2130
class MandosDBusServiceTransitional(MandosDBusService):
2131
__metaclass__ = AlternateDBusNamesMetaclass
2132
mandos_dbus_service = MandosDBusServiceTransitional()
2739
2135
"Cleanup function; run on exit"
2740
2136
service.cleanup()
2742
2138
multiprocessing.active_children()
2744
if not (tcp_server.clients or client_settings):
2747
# Store client before exiting. Secrets are encrypted with key
2748
# based on what config file has. If config file is
2749
# removed/edited, old secret will thus be unrecovable.
2751
with PGPEngine() as pgp:
2752
for client in tcp_server.clients.itervalues():
2753
key = client_settings[client.name]["secret"]
2754
client.encrypted_secret = pgp.encrypt(client.secret,
2758
# A list of attributes that can not be pickled
2760
exclude = set(("bus", "changedstate", "secret",
2761
"checker", "server_settings"))
2762
for name, typ in (inspect.getmembers
2763
(dbus.service.Object)):
2766
client_dict["encrypted_secret"] = (client
2768
for attr in client.client_structure:
2769
if attr not in exclude:
2770
client_dict[attr] = getattr(client, attr)
2772
clients[client.name] = client_dict
2773
del client_settings[client.name]["secret"]
2776
with (tempfile.NamedTemporaryFile
2777
(mode='wb', suffix=".pickle", prefix='clients-',
2778
dir=os.path.dirname(stored_state_path),
2779
delete=False)) as stored_state:
2780
pickle.dump((clients, client_settings), stored_state)
2781
tempname=stored_state.name
2782
os.rename(tempname, stored_state_path)
2783
except (IOError, OSError) as e:
2789
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2790
logger.warning("Could not save persistent state: {0}"
2791
.format(os.strerror(e.errno)))
2793
logger.warning("Could not save persistent state:",
2797
# Delete all clients, and settings from config
2798
2139
while tcp_server.clients:
2799
name, client = tcp_server.clients.popitem()
2140
client = tcp_server.clients.pop()
2801
2142
client.remove_from_connection()
2143
client.disable_hook = None
2802
2144
# Don't signal anything except ClientRemoved
2803
2145
client.disable(quiet=True)