/mandos/release : revision 289

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

66

69

67

import dbus

70

68

import dbus.service

75

73

import ctypes.util

76

74

import xml.dom.minidom

77

75

import inspect

78

import GnuPGInterface

79

76

80

77

try:

81

78

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

87

84

88

85

89

86

version = "1.4.1"

90

stored_state_file = "clients.pickle"

91

87

92

logger = logging.getLogger()

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

93

90

syslogger = (logging.handlers.SysLogHandler

94

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

92

address = str("/dev/log")))

96

97

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

101

except (OSError, AttributeError):

102

def if_nametoindex(interface):

103

"Get an interface index the hard way, i.e. using fcntl()"

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

with contextlib.closing(socket.socket()) as s:

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

111

return interface_index

112

113

114

def initlogger(level=logging.WARNING):

115

"""init logger and add loglevel"""

116

117

syslogger.setFormatter(logging.Formatter

118

('Mandos [%(process)d]: %(levelname)s:'

119

' %(message)s'))

120

logger.addHandler(syslogger)

121

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class CryptoError(Exception):

132

pass

133

134

135

class Crypto(object):

136

"""A simple class for OpenPGP symmetric encryption & decryption"""

137

def __init__(self):

138

self.gnupg = GnuPGInterface.GnuPG()

139

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

140

self.gnupg = GnuPGInterface.GnuPG()

141

self.gnupg.options.meta_interactive = False

142

self.gnupg.options.homedir = self.tempdir

143

self.gnupg.options.extra_args.extend(['--force-mdc',

144

'--quiet'])

145

146

def __enter__(self):

147

return self

148

149

def __exit__ (self, exc_type, exc_value, traceback):

150

self._cleanup()

151

return False

152

153

def __del__(self):

154

self._cleanup()

155

156

def _cleanup(self):

157

if self.tempdir is not None:

158

# Delete contents of tempdir

159

for root, dirs, files in os.walk(self.tempdir,

160

topdown = False):

161

for filename in files:

162

os.remove(os.path.join(root, filename))

163

for dirname in dirs:

164

os.rmdir(os.path.join(root, dirname))

165

# Remove tempdir

166

os.rmdir(self.tempdir)

167

self.tempdir = None

168

169

def password_encode(self, password):

170

# Passphrase can not be empty and can not contain newlines or

171

# NUL bytes. So we prefix it and hex encode it.

172

return b"mandos" + binascii.hexlify(password)

173

174

def encrypt(self, data, password):

175

self.gnupg.passphrase = self.password_encode(password)

176

with open(os.devnull) as devnull:

177

try:

178

proc = self.gnupg.run(['--symmetric'],

179

create_fhs=['stdin', 'stdout'],

180

attach_fhs={'stderr': devnull})

181

with contextlib.closing(proc.handles['stdin']) as f:

182

f.write(data)

183

with contextlib.closing(proc.handles['stdout']) as f:

184

ciphertext = f.read()

185

proc.wait()

186

except IOError as e:

187

raise CryptoError(e)

188

self.gnupg.passphrase = None

189

return ciphertext

190

191

def decrypt(self, data, password):

192

self.gnupg.passphrase = self.password_encode(password)

193

with open(os.devnull) as devnull:

194

try:

195

proc = self.gnupg.run(['--decrypt'],

196

create_fhs=['stdin', 'stdout'],

197

attach_fhs={'stderr': devnull})

198

with contextlib.closing(proc.handles['stdin'] ) as f:

199

f.write(data)

200

with contextlib.closing(proc.handles['stdout']) as f:

201

decrypted_plaintext = f.read()

202

proc.wait()

203

except IOError as e:

204

raise CryptoError(e)

205

self.gnupg.passphrase = None

206

return decrypted_plaintext

207

208

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

209

103

210

104

class AvahiError(Exception):

211

105

def __init__(self, value, *args, **kwargs):

270

164

.GetAlternativeServiceName(self.name))

271

165

logger.info("Changing Zeroconf service name to %r ...",

272

166

self.name)

167

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

170

% self.name))

273

171

self.remove()

274

172

try:

275

173

self.add()

295

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

296

194

self.entry_group_state_changed_match = (

297

195

self.group.connect_to_signal(

298

'StateChanged', self.entry_group_state_changed))

196

'StateChanged', self .entry_group_state_changed))

299

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

300

198

self.name, self.type)

301

199

self.group.AddService(

327

225

try:

328

226

self.group.Free()

329

227

except (dbus.exceptions.UnknownMethodException,

330

dbus.exceptions.DBusException):

228

dbus.exceptions.DBusException) as e:

331

229

pass

332

230

self.group = None

333

231

self.remove()

367

265

self.server_state_changed)

368

266

self.server_state_changed(self.server.GetState())

369

267

370

class AvahiServiceToSyslog(AvahiService):

371

def rename(self):

372

"""Add the new name to the syslog messages"""

373

ret = AvahiService.rename(self)

374

syslogger.setFormatter(logging.Formatter

375

('Mandos (%s) [%%(process)d]:'

376

' %%(levelname)s: %%(message)s'

377

% self.name))

378

return ret

379

268

380

269

def _timedelta_to_milliseconds(td):

381

270

"Convert a datetime.timedelta() to milliseconds"

400

289

instance %(name)s can be used in the command.

401

290

checker_initiator_tag: a gobject event source tag, or None

402

291

created: datetime.datetime(); (UTC) object creation

403

client_structure: Object describing what attributes a client has

404

and is used for storing the client at exit

405

292

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

406

294

disable_initiator_tag: a gobject event source tag, or None

407

295

enabled: bool()

408

296

fingerprint: string (40 or 32 hexadecimal digits); used to

411

299

interval: datetime.timedelta(); How often to start a new checker

412

300

last_approval_request: datetime.datetime(); (UTC) or None

413

301

last_checked_ok: datetime.datetime(); (UTC) or None

414

415

last_checker_status: integer between 0 and 255 reflecting exit

416

status of last checker. -1 reflects crashed

417

checker, or None.

418

last_enabled: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

419

303

name: string; from the config file, used in log messages and

420

304

D-Bus identifiers

421

305

secret: bytestring; sent verbatim (over TLS) to client

447

331

def approval_delay_milliseconds(self):

448

332

return _timedelta_to_milliseconds(self.approval_delay)

449

333

450

def __init__(self, name = None, config=None):

334

def __init__(self, name = None, disable_hook=None, config=None):

451

335

"""Note: the 'checker' key in 'config' sets the

452

336

'checker_command' attribute and *not* the 'checker'

453

337

attribute."""

473

357

% self.name)

474

358

self.host = config.get("host", "")

475

359

self.created = datetime.datetime.utcnow()

476

self.enabled = config.get("enabled", True)

360

self.enabled = False

477

361

self.last_approval_request = None

478

if self.enabled:

479

self.last_enabled = datetime.datetime.utcnow()

480

else:

481

self.last_enabled = None

362

self.last_enabled = None

482

363

self.last_checked_ok = None

483

self.last_checker_status = None

484

364

self.timeout = string_to_delta(config["timeout"])

485

365

self.extended_timeout = string_to_delta(config

486

366

["extended_timeout"])

487

367

self.interval = string_to_delta(config["interval"])

368

self.disable_hook = disable_hook

488

369

self.checker = None

489

370

self.checker_initiator_tag = None

490

371

self.disable_initiator_tag = None

491

if self.enabled:

492

self.expires = datetime.datetime.utcnow() + self.timeout

493

else:

494

self.expires = None

372

self.expires = None

495

373

self.checker_callback_tag = None

496

374

self.checker_command = config["checker"]

497

375

self.current_checker_command = None

376

self.last_connect = None

498

377

self._approved = None

499

378

self.approved_by_default = config.get("approved_by_default",

500

379

True)

506

385

self.changedstate = (multiprocessing_manager

507

386

.Condition(multiprocessing_manager

508

387

.Lock()))

509

self.client_structure = [attr for attr in

510

self.__dict__.iterkeys()

511

if not attr.startswith("_")]

512

self.client_structure.append("client_structure")

513

514

for name, t in inspect.getmembers(type(self),

515

lambda obj:

516

isinstance(obj,

517

property)):

518

if not name.startswith("_"):

519

self.client_structure.append(name)

520

388

521

# Send notice to process children that client state has changed

522

389

def send_changedstate(self):

523

with self.changedstate:

524

self.changedstate.notify_all()

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

525

393

526

394

def enable(self):

527

395

"""Start this client's checker and timeout hooks"""

529

397

# Already enabled

530

398

return

531

399

self.send_changedstate()

400

# Schedule a new checker to be started an 'interval' from now,

401

# and every interval from then on.

402

self.checker_initiator_tag = (gobject.timeout_add

403

(self.interval_milliseconds(),

404

self.start_checker))

405

# Schedule a disable() when 'timeout' has passed

532

406

self.expires = datetime.datetime.utcnow() + self.timeout

407

self.disable_initiator_tag = (gobject.timeout_add

408

(self.timeout_milliseconds(),

409

self.disable))

533

410

self.enabled = True

534

411

self.last_enabled = datetime.datetime.utcnow()

535

self.init_checker()

412

# Also start a new checker *right now*.

413

self.start_checker()

536

414

537

415

def disable(self, quiet=True):

538

416

"""Disable this client."""

550

428

gobject.source_remove(self.checker_initiator_tag)

551

429

self.checker_initiator_tag = None

552

430

self.stop_checker()

431

if self.disable_hook:

432

self.disable_hook(self)

553

433

self.enabled = False

554

434

# Do not run this again if called by a gobject.timeout_add

555

435

return False

556

436

557

437

def __del__(self):

438

self.disable_hook = None

558

439

self.disable()

559

440

560

def init_checker(self):

561

# Schedule a new checker to be started an 'interval' from now,

562

# and every interval from then on.

563

self.checker_initiator_tag = (gobject.timeout_add

564

(self.interval_milliseconds(),

565

self.start_checker))

566

# Schedule a disable() when 'timeout' has passed

567

self.disable_initiator_tag = (gobject.timeout_add

568

(self.timeout_milliseconds(),

569

self.disable))

570

# Also start a new checker *right now*.

571

self.start_checker()

572

573

441

def checker_callback(self, pid, condition, command):

574

442

"""The checker has completed, so take appropriate actions."""

575

443

self.checker_callback_tag = None

576

444

self.checker = None

577

445

if os.WIFEXITED(condition):

578

self.last_checker_status = os.WEXITSTATUS(condition)

579

if self.last_checker_status == 0:

446

exitstatus = os.WEXITSTATUS(condition)

447

if exitstatus == 0:

580

448

logger.info("Checker for %(name)s succeeded",

581

449

vars(self))

582

450

self.checked_ok()

584

452

logger.info("Checker for %(name)s failed",

585

453

vars(self))

586

454

else:

587

self.last_checker_status = -1

588

455

logger.warning("Checker for %(name)s crashed?",

589

456

vars(self))

590

457

824

691

825

692

Note: Will not include properties with access="write".

826

693

"""

827

properties = {}

694

all = {}

828

695

for name, prop in self._get_all_dbus_properties():

829

696

if (interface_name

830

697

and interface_name != prop._dbus_interface):

835

702

continue

836

703

value = prop()

837

704

if not hasattr(value, "variant_level"):

838

properties[name] = value

705

all[name] = value

839

706

continue

840

properties[name] = type(value)(value, variant_level=

841

value.variant_level+1)

842

return dbus.Dictionary(properties, signature="sv")

707

all[name] = type(value)(value, variant_level=

708

value.variant_level+1)

709

return dbus.Dictionary(all, signature="sv")

843

710

844

711

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

845

712

out_signature="s",

896

763

return dbus.String(dt.isoformat(),

897

764

variant_level=variant_level)

898

765

899

900

766

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

901

767

.__metaclass__):

902

768

"""Applied to an empty subclass of a D-Bus object, this metaclass

994

860

attribute.func_closure)))

995

861

return type.__new__(mcs, name, bases, attr)

996

862

997

998

863

class ClientDBus(Client, DBusObjectWithProperties):

999

864

"""A Client class using D-Bus

1000

865

1009

874

# dbus.service.Object doesn't use super(), so we can't either.

1010

875

1011

876

def __init__(self, bus = None, *args, **kwargs):

877

self._approvals_pending = 0

1012

878

self.bus = bus

1013

879

Client.__init__(self, *args, **kwargs)

1014

1015

self._approvals_pending = 0

1016

880

# Only now, when this client is initialized, can it show up on

1017

881

# the D-Bus

1018

882

client_object_name = unicode(self.name).translate(

1028

892

variant_level=1):

1029

893

""" Modify a variable so that it's a property which announces

1030

894

its changes to DBus.

1031

895

1032

896

transform_fun: Function that takes a value and a variant_level

1033

897

and transforms it to a D-Bus type.

1034

898

dbus_name: D-Bus name of the variable

1188

1052

"D-Bus signal"

1189

1053

return self.need_approval()

1190

1054

1191

# NeRwequest - signal

1192

@dbus.service.signal(_interface, signature="s")

1193

def NewRequest(self, ip):

1194

"""D-Bus signal

1195

Is sent after a client request a password.

1196

"""

1197

pass

1198

1199

1055

## Methods

1200

1056

1201

1057

# Approve - method

1284

1140

# Created - property

1285

1141

@dbus_service_property(_interface, signature="s", access="read")

1286

1142

def Created_dbus_property(self):

1287

return datetime_to_dbus(self.created)

1143

return dbus.String(datetime_to_dbus(self.created))

1288

1144

1289

1145

# LastEnabled - property

1290

1146

@dbus_service_property(_interface, signature="s", access="read")

1366

1222

self.interval = datetime.timedelta(0, 0, 0, value)

1367

1223

if getattr(self, "checker_initiator_tag", None) is None:

1368

1224

return

1369

if self.enabled:

1370

# Reschedule checker run

1371

gobject.source_remove(self.checker_initiator_tag)

1372

self.checker_initiator_tag = (gobject.timeout_add

1373

(value, self.start_checker))

1374

self.start_checker() # Start one now, too

1225

# Reschedule checker run

1226

gobject.source_remove(self.checker_initiator_tag)

1227

self.checker_initiator_tag = (gobject.timeout_add

1228

(value, self.start_checker))

1229

self.start_checker() # Start one now, too

1375

1230

1376

1231

# Checker - property

1377

1232

@dbus_service_property(_interface, signature="s",

1431

1286

return super(ProxyClient, self).__setattr__(name, value)

1432

1287

self._pipe.send(('setattr', name, value))

1433

1288

1434

1435

1289

class ClientDBusTransitional(ClientDBus):

1436

1290

__metaclass__ = AlternateDBusNamesMetaclass

1437

1291

1438

1439

1292

class ClientHandler(socketserver.BaseRequestHandler, object):

1440

1293

"""A class to handle client connections.

1441

1294

1502

1355

logger.warning("Bad certificate: %s", error)

1503

1356

return

1504

1357

logger.debug("Fingerprint: %s", fpr)

1505

if self.server.use_dbus:

1506

# Emit D-Bus signal

1507

client.NewRequest(str(self.client_address))

1508

1358

1509

1359

try:

1510

1360

client = ProxyClient(child_pipe, fpr,

1654

1504

# Convert the buffer to a Python bytestring

1655

1505

fpr = ctypes.string_at(buf, buf_len.value)

1656

1506

# Convert the bytestring to hexadecimal notation

1657

hex_fpr = binascii.hexlify(fpr).upper()

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1658

1508

return hex_fpr

1659

1509

1660

1510

1774

1624

self.enabled = False

1775

1625

self.clients = clients

1776

1626

if self.clients is None:

1777

self.clients = {}

1627

self.clients = set()

1778

1628

self.use_dbus = use_dbus

1779

1629

self.gnutls_priority = gnutls_priority

1780

1630

IPv6_TCPServer.__init__(self, server_address,

1827

1677

fpr = request[1]

1828

1678

address = request[2]

1829

1679

1830

for c in self.clients.itervalues():

1680

for c in self.clients:

1831

1681

if c.fingerprint == fpr:

1832

1682

client = c

1833

1683

break

1917

1767

return timevalue

1918

1768

1919

1769

1770

def if_nametoindex(interface):

1771

"""Call the C function if_nametoindex(), or equivalent

1772

1773

Note: This function cannot accept a unicode string."""

1774

global if_nametoindex

1775

try:

1776

if_nametoindex = (ctypes.cdll.LoadLibrary

1777

(ctypes.util.find_library("c"))

1778

.if_nametoindex)

1779

except (OSError, AttributeError):

1780

logger.warning("Doing if_nametoindex the hard way")

1781

def if_nametoindex(interface):

1782

"Get an interface index the hard way, i.e. using fcntl()"

1783

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1784

with contextlib.closing(socket.socket()) as s:

1785

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1786

struct.pack(str("16s16x"),

1787

interface))

1788

interface_index = struct.unpack(str("I"),

1789

ifreq[16:20])[0]

1790

return interface_index

1791

return if_nametoindex(interface)

1792

1793

1920

1794

def daemon(nochdir = False, noclose = False):

1921

1795

"""See daemon(3). Standard BSD Unix function.

1922

1796

1977

1851

" system bus interface")

1978

1852

parser.add_argument("--no-ipv6", action="store_false",

1979

1853

dest="use_ipv6", help="Do not use IPv6")

1980

parser.add_argument("--no-restore", action="store_false",

1981

dest="restore", help="Do not restore stored"

1982

" state")

1983

parser.add_argument("--statedir", metavar="DIR",

1984

help="Directory to save/restore state in")

1985

1986

1854

options = parser.parse_args()

1987

1855

1988

1856

if options.check:

2001

1869

"use_dbus": "True",

2002

1870

"use_ipv6": "True",

2003

1871

"debuglevel": "",

2004

"restore": "True",

2005

"statedir": "/var/lib/mandos"

2006

1872

}

2007

1873

2008

1874

# Parse config file for server-global settings

2025

1891

# options, if set.

2026

1892

for option in ("interface", "address", "port", "debug",

2027

1893

"priority", "servicename", "configdir",

2028

"use_dbus", "use_ipv6", "debuglevel", "restore",

2029

"statedir"):

1894

"use_dbus", "use_ipv6", "debuglevel"):

2030

1895

value = getattr(options, option)

2031

1896

if value is not None:

2032

1897

server_settings[option] = value

2044

1909

debuglevel = server_settings["debuglevel"]

2045

1910

use_dbus = server_settings["use_dbus"]

2046

1911

use_ipv6 = server_settings["use_ipv6"]

2047

stored_state_path = os.path.join(server_settings["statedir"],

2048

stored_state_file)

2049

2050

if debug:

2051

initlogger(logging.DEBUG)

2052

else:

2053

if not debuglevel:

2054

initlogger()

2055

else:

2056

level = getattr(logging, debuglevel.upper())

2057

initlogger(level)

2058

1912

2059

1913

if server_settings["servicename"] != "Mandos":

2060

1914

syslogger.setFormatter(logging.Formatter

2115

1969

if error[0] != errno.EPERM:

2116

1970

raise error

2117

1971

1972

if not debug and not debuglevel:

1973

syslogger.setLevel(logging.WARNING)

1974

console.setLevel(logging.WARNING)

1975

if debuglevel:

1976

level = getattr(logging, debuglevel.upper())

1977

syslogger.setLevel(level)

1978

console.setLevel(level)

1979

2118

1980

if debug:

2119

1981

# Enable all possible GnuTLS debugging

2120

1982

2162

2024

server_settings["use_dbus"] = False

2163

2025

tcp_server.use_dbus = False

2164

2026

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2165

service = AvahiServiceToSyslog(name =

2166

server_settings["servicename"],

2167

servicetype = "_mandos._tcp",

2168

protocol = protocol, bus = bus)

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

2029

protocol = protocol, bus = bus)

2169

2030

if server_settings["interface"]:

2170

2031

service.interface = (if_nametoindex

2171

2032

(str(server_settings["interface"])))

2177

2038

if use_dbus:

2178

2039

client_class = functools.partial(ClientDBusTransitional,

2179

2040

bus = bus)

2180

2181

special_settings = {

2182

# Some settings need to be accessd by special methods;

2183

# booleans need .getboolean(), etc. Here is a list of them:

2184

"approved_by_default":

2185

lambda section:

2186

client_config.getboolean(section, "approved_by_default"),

2187

"enabled":

2188

lambda section:

2189

client_config.getboolean(section, "enabled"),

2190

}

2191

# Construct a new dict of client settings of this form:

2192

# { client_name: {setting_name: value, ...}, ...}

2193

# with exceptions for any special settings as defined above

2194

client_settings = dict((clientname,

2195

dict((setting,

2196

(value

2197

if setting not in special_settings

2198

else special_settings[setting]

2199

(clientname)))

2200

for setting, value in

2201

client_config.items(clientname)))

2202

for clientname in client_config.sections())

2203

2204

old_client_settings = {}

2205

clients_data = []

2206

2207

# Get client data and settings from last running state.

2208

if server_settings["restore"]:

2209

try:

2210

with open(stored_state_path, "rb") as stored_state:

2211

clients_data, old_client_settings = (pickle.load

2212

(stored_state))

2213

os.remove(stored_state_path)

2214

except IOError as e:

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2218

raise

2219

2220

with Crypto() as crypt:

2221

for client in clients_data:

2222

client_name = client["name"]

2223

2224

# Decide which value to use after restoring saved state.

2225

# We have three different values: Old config file,

2226

# new config file, and saved state.

2227

# New config value takes precedence if it differs from old

2228

# config value, otherwise use saved state.

2229

for name, value in client_settings[client_name].items():

2230

try:

2231

# For each value in new config, check if it

2232

# differs from the old config value (Except for

2233

# the "secret" attribute)

2234

if (name != "secret" and

2235

value != old_client_settings[client_name]

2236

[name]):

2237

setattr(client, name, value)

2238

except KeyError:

2239

pass

2240

2241

# Clients who has passed its expire date can still be

2242

# enabled if its last checker was sucessful. Clients

2243

# whose checker failed before we stored its state is

2244

# assumed to have failed all checkers during downtime.

2245

if client["enabled"] and client["last_checked_ok"]:

2246

if ((datetime.datetime.utcnow()

2247

- client["last_checked_ok"])

2248

> client["interval"]):

2249

if client["last_checker_status"] != 0:

2250

client["enabled"] = False

2251

else:

2252

client["expires"] = (datetime.datetime

2253

.utcnow()

2254

+ client["timeout"])

2255

2256

client["changedstate"] = (multiprocessing_manager

2257

.Condition

2258

(multiprocessing_manager

2259

.Lock()))

2260

if use_dbus:

2261

new_client = (ClientDBusTransitional.__new__

2262

(ClientDBusTransitional))

2263

tcp_server.clients[client_name] = new_client

2264

new_client.bus = bus

2265

for name, value in client.iteritems():

2266

setattr(new_client, name, value)

2267

client_object_name = unicode(client_name).translate(

2268

{ord("."): ord("_"),

2269

ord("-"): ord("_")})

2270

new_client.dbus_object_path = (dbus.ObjectPath

2271

("/clients/"

2272

+ client_object_name))

2273

DBusObjectWithProperties.__init__(new_client,

2274

new_client.bus,

2275

new_client

2276

.dbus_object_path)

2277

else:

2278

tcp_server.clients[client_name] = (Client.__new__

2279

(Client))

2280

for name, value in client.iteritems():

2281

setattr(tcp_server.clients[client_name],

2282

name, value)

2283

2041

def client_config_items(config, section):

2042

special_settings = {

2043

"approved_by_default":

2044

lambda: config.getboolean(section,

2045

"approved_by_default"),

2046

}

2047

for name, value in config.items(section):

2284

2048

try:

2285

tcp_server.clients[client_name].secret = (

2286

crypt.decrypt(tcp_server.clients[client_name]

2287

.encrypted_secret,

2288

client_settings[client_name]

2289

["secret"]))

2290

except CryptoError:

2291

# If decryption fails, we use secret from new settings

2292

tcp_server.clients[client_name].secret = (

2293

client_settings[client_name]["secret"])

2294

2295

# Create/remove clients based on new changes made to config

2296

for clientname in set(old_client_settings) - set(client_settings):

2297

del tcp_server.clients[clientname]

2298

for clientname in set(client_settings) - set(old_client_settings):

2299

tcp_server.clients[clientname] = (client_class(name

2300

= clientname,

2301

config =

2302

client_settings

2303

[clientname]))

2304

2049

yield (name, special_settings[name]())

2050

except KeyError:

2051

yield (name, value)

2052

2053

tcp_server.clients.update(set(

2054

client_class(name = section,

2055

config= dict(client_config_items(

2056

client_config, section)))

2057

for section in client_config.sections()))

2305

2058

if not tcp_server.clients:

2306

2059

logger.warning("No clients defined")

2307

2060

2350

2103

def GetAllClients(self):

2351

2104

"D-Bus method"

2352

2105

return dbus.Array(c.dbus_object_path

2353

for c in

2354

tcp_server.clients.itervalues())

2106

for c in tcp_server.clients)

2355

2107

2356

2108

@dbus.service.method(_interface,

2357

2109

out_signature="a{oa{sv}}")

2359

2111

"D-Bus method"

2360

2112

return dbus.Dictionary(

2361

2113

((c.dbus_object_path, c.GetAll(""))

2362

for c in tcp_server.clients.itervalues()),

2114

for c in tcp_server.clients),

2363

2115

signature="oa{sv}")

2364

2116

2365

2117

@dbus.service.method(_interface, in_signature="o")

2366

2118

def RemoveClient(self, object_path):

2367

2119

"D-Bus method"

2368

for c in tcp_server.clients.itervalues():

2120

for c in tcp_server.clients:

2369

2121

if c.dbus_object_path == object_path:

2370

del tcp_server.clients[c.name]

2122

tcp_server.clients.remove(c)

2371

2123

c.remove_from_connection()

2372

2124

# Don't signal anything except ClientRemoved

2373

2125

c.disable(quiet=True)

2387

2139

service.cleanup()

2388

2140

2389

2141

multiprocessing.active_children()

2390

if not (tcp_server.clients or client_settings):

2391

return

2392

2393

# Store client before exiting. Secrets are encrypted with key

2394

# based on what config file has. If config file is

2395

# removed/edited, old secret will thus be unrecovable.

2396

clients = []

2397

with Crypto() as crypt:

2398

for client in tcp_server.clients.itervalues():

2399

key = client_settings[client.name]["secret"]

2400

client.encrypted_secret = crypt.encrypt(client.secret,

2401

key)

2402

client_dict = {}

2403

2404

# A list of attributes that will not be stored when

2405

# shutting down.

2406

exclude = set(("bus", "changedstate", "secret"))

2407

for name, typ in (inspect.getmembers

2408

(dbus.service.Object)):

2409

exclude.add(name)

2410

2411

client_dict["encrypted_secret"] = (client

2412

.encrypted_secret)

2413

for attr in client.client_structure:

2414

if attr not in exclude:

2415

client_dict[attr] = getattr(client, attr)

2416

2417

clients.append(client_dict)

2418

del client_settings[client.name]["secret"]

2419

2420

try:

2421

with os.fdopen(os.open(stored_state_path,

2422

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2423

0600), "wb") as stored_state:

2424

pickle.dump((clients, client_settings), stored_state)

2425

except (IOError, OSError) as e:

2426

logger.warning("Could not save persistent state: {0}"

2427

.format(e))

2428

if e.errno not in (errno.ENOENT, errno.EACCES):

2429

raise

2430

2431

# Delete all clients, and settings from config

2432

2142

while tcp_server.clients:

2433

name, client = tcp_server.clients.popitem()

2143

client = tcp_server.clients.pop()

2434

2144

if use_dbus:

2435

2145

client.remove_from_connection()

2146

client.disable_hook = None

2436

2147

# Don't signal anything except ClientRemoved

2437

2148

client.disable(quiet=True)

2438

2149

if use_dbus:

2440

2151

mandos_dbus_service.ClientRemoved(client

2441

2152

.dbus_object_path,

2442

2153

client.name)

2443

client_settings.clear()

2444

2154

2445

2155

atexit.register(cleanup)

2446

2156

2447

for client in tcp_server.clients.itervalues():

2157

for client in tcp_server.clients:

2448

2158

if use_dbus:

2449

2159

# Emit D-Bus signal

2450

2160

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2451

# Need to initiate checking of clients

2452

if client.enabled:

2453

client.init_checker()

2161

client.enable()

2454

2162

2455

2163

tcp_server.enable()

2456

2164

tcp_server.server_activate()