/mandos/trunk : revision 502.1.1

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

37

import SocketServer as socketserver

40

38

import socket

41

39

import argparse

64

62

import functools

65

63

import cPickle as pickle

66

64

import multiprocessing

67

import types

68

import binascii

69

import tempfile

70

import itertools

71

65

72

66

import dbus

73

67

import dbus.service

78

72

import ctypes.util

79

73

import xml.dom.minidom

80

74

import inspect

81

import GnuPGInterface

82

75

83

76

try:

84

77

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

88

81

except ImportError:

89

82

SO_BINDTODEVICE = None

90

83

91

version = "1.5.3"

92

stored_state_file = "clients.pickle"

93

94

logger = logging.getLogger()

84

85

version = "1.3.1"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

95

89

syslogger = (logging.handlers.SysLogHandler

96

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

91

address = str("/dev/log")))

98

99

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

103

except (OSError, AttributeError):

104

def if_nametoindex(interface):

105

"Get an interface index the hard way, i.e. using fcntl()"

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

107

with contextlib.closing(socket.socket()) as s:

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

113

return interface_index

114

115

116

def initlogger(debug, level=logging.WARNING):

117

"""init logger and add loglevel"""

118

119

syslogger.setFormatter(logging.Formatter

120

('Mandos [%(process)d]: %(levelname)s:'

121

' %(message)s'))

122

logger.addHandler(syslogger)

123

124

if debug:

125

console = logging.StreamHandler()

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

127

' [%(process)d]:'

128

' %(levelname)s:'

129

' %(message)s'))

130

logger.addHandler(console)

131

logger.setLevel(level)

132

133

134

class PGPError(Exception):

135

"""Exception if encryption/decryption fails"""

136

pass

137

138

139

class PGPEngine(object):

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

141

def __init__(self):

142

self.gnupg = GnuPGInterface.GnuPG()

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

144

self.gnupg = GnuPGInterface.GnuPG()

145

self.gnupg.options.meta_interactive = False

146

self.gnupg.options.homedir = self.tempdir

147

self.gnupg.options.extra_args.extend(['--force-mdc',

148

'--quiet',

149

'--no-use-agent'])

150

151

def __enter__(self):

152

return self

153

154

def __exit__ (self, exc_type, exc_value, traceback):

155

self._cleanup()

156

return False

157

158

def __del__(self):

159

self._cleanup()

160

161

def _cleanup(self):

162

if self.tempdir is not None:

163

# Delete contents of tempdir

164

for root, dirs, files in os.walk(self.tempdir,

165

topdown = False):

166

for filename in files:

167

os.remove(os.path.join(root, filename))

168

for dirname in dirs:

169

os.rmdir(os.path.join(root, dirname))

170

# Remove tempdir

171

os.rmdir(self.tempdir)

172

self.tempdir = None

173

174

def password_encode(self, password):

175

# Passphrase can not be empty and can not contain newlines or

176

# NUL bytes. So we prefix it and hex encode it.

177

return b"mandos" + binascii.hexlify(password)

178

179

def encrypt(self, data, password):

180

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

182

try:

183

proc = self.gnupg.run(['--symmetric'],

184

create_fhs=['stdin', 'stdout'],

185

attach_fhs={'stderr': devnull})

186

with contextlib.closing(proc.handles['stdin']) as f:

187

f.write(data)

188

with contextlib.closing(proc.handles['stdout']) as f:

189

ciphertext = f.read()

190

proc.wait()

191

except IOError as e:

192

raise PGPError(e)

193

self.gnupg.passphrase = None

194

return ciphertext

195

196

def decrypt(self, data, password):

197

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

199

try:

200

proc = self.gnupg.run(['--decrypt'],

201

create_fhs=['stdin', 'stdout'],

202

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

204

f.write(data)

205

with contextlib.closing(proc.handles['stdout']) as f:

206

decrypted_plaintext = f.read()

207

proc.wait()

208

except IOError as e:

209

raise PGPError(e)

210

self.gnupg.passphrase = None

211

return decrypted_plaintext

212

92

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

95

logger.addHandler(syslogger)

96

97

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

101

logger.addHandler(console)

213

102

214

103

class AvahiError(Exception):

215

104

def __init__(self, value, *args, **kwargs):

245

134

server: D-Bus Server

246

135

bus: dbus.SystemBus()

247

136

"""

248

249

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

250

138

servicetype = None, port = None, TXT = None,

251

139

domain = "", host = "", max_renames = 32768,

264

152

self.server = None

265

153

self.bus = bus

266

154

self.entry_group_state_changed_match = None

267

268

155

def rename(self):

269

156

"""Derived from the Avahi example code"""

270

157

if self.rename_count >= self.max_renames:

272

159

" after %i retries, exiting.",

273

160

self.rename_count)

274

161

raise AvahiServiceError("Too many renames")

275

self.name = unicode(self.server

276

.GetAlternativeServiceName(self.name))

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

277

163

logger.info("Changing Zeroconf service name to %r ...",

278

164

self.name)

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

279

169

self.remove()

280

170

try:

281

171

self.add()

282

172

except dbus.exceptions.DBusException as error:

283

logger.critical("D-Bus Exception", exc_info=error)

173

logger.critical("DBusException: %s", error)

284

174

self.cleanup()

285

175

os._exit(1)

286

176

self.rename_count += 1

287

288

177

def remove(self):

289

178

"""Derived from the Avahi example code"""

290

179

if self.entry_group_state_changed_match is not None:

292

181

self.entry_group_state_changed_match = None

293

182

if self.group is not None:

294

183

self.group.Reset()

295

296

184

def add(self):

297

185

"""Derived from the Avahi example code"""

298

186

self.remove()

303

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

304

192

self.entry_group_state_changed_match = (

305

193

self.group.connect_to_signal(

306

'StateChanged', self.entry_group_state_changed))

194

'StateChanged', self .entry_group_state_changed))

307

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

308

196

self.name, self.type)

309

197

self.group.AddService(

315

203

dbus.UInt16(self.port),

316

204

avahi.string_array_to_txt_array(self.TXT))

317

205

self.group.Commit()

318

319

206

def entry_group_state_changed(self, state, error):

320

207

"""Derived from the Avahi example code"""

321

208

logger.debug("Avahi entry group state change: %i", state)

328

215

elif state == avahi.ENTRY_GROUP_FAILURE:

329

216

logger.critical("Avahi: Error in group state changed %s",

330

217

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

333

218

raise AvahiGroupError("State changed: %s"

219

% unicode(error))

334

220

def cleanup(self):

335

221

"""Derived from the Avahi example code"""

336

222

if self.group is not None:

337

223

try:

338

224

self.group.Free()

339

225

except (dbus.exceptions.UnknownMethodException,

340

dbus.exceptions.DBusException):

226

dbus.exceptions.DBusException) as e:

341

227

pass

342

228

self.group = None

343

229

self.remove()

344

345

230

def server_state_changed(self, state, error=None):

346

231

"""Derived from the Avahi example code"""

347

232

logger.debug("Avahi server state change: %i", state)

366

251

logger.debug("Unknown state: %r", state)

367

252

else:

368

253

logger.debug("Unknown state: %r: %r", state, error)

369

370

254

def activate(self):

371

255

"""Derived from the Avahi example code"""

372

256

if self.server is None:

379

263

self.server_state_changed)

380

264

self.server_state_changed(self.server.GetState())

381

265

382

class AvahiServiceToSyslog(AvahiService):

383

def rename(self):

384

"""Add the new name to the syslog messages"""

385

ret = AvahiService.rename(self)

386

syslogger.setFormatter(logging.Formatter

387

('Mandos ({0}) [%(process)d]:'

388

' %(levelname)s: %(message)s'

389

.format(self.name)))

390

return ret

391

266

392

def timedelta_to_milliseconds(td):

267

def _timedelta_to_milliseconds(td):

393

268

"Convert a datetime.timedelta() to milliseconds"

394

269

return ((td.days * 24 * 60 * 60 * 1000)

395

270

+ (td.seconds * 1000)

396

271

+ (td.microseconds // 1000))

397

272

398

273

class Client(object):

399

274

"""A representation of a client host served by this server.

400

275

401

276

Attributes:

402

approved: bool(); 'None' if not yet approved/disapproved

277

_approved: bool(); 'None' if not yet approved/disapproved

403

278

approval_delay: datetime.timedelta(); Time to wait for approval

404

279

approval_duration: datetime.timedelta(); Duration of one approval

405

280

checker: subprocess.Popen(); a running checker process used

412

287

instance %(name)s can be used in the command.

413

288

checker_initiator_tag: a gobject event source tag, or None

414

289

created: datetime.datetime(); (UTC) object creation

415

client_structure: Object describing what attributes a client has

416

and is used for storing the client at exit

417

290

current_checker_command: string; current running checker_command

291

disable_hook: If set, called by disable() as disable_hook(self)

418

292

disable_initiator_tag: a gobject event source tag, or None

419

293

enabled: bool()

420

294

fingerprint: string (40 or 32 hexadecimal digits); used to

423

297

interval: datetime.timedelta(); How often to start a new checker

424

298

last_approval_request: datetime.datetime(); (UTC) or None

425

299

last_checked_ok: datetime.datetime(); (UTC) or None

426

last_checker_status: integer between 0 and 255 reflecting exit

427

status of last checker. -1 reflects crashed

428

checker, -2 means no checker completed yet.

429

last_enabled: datetime.datetime(); (UTC) or None

300

last_enabled: datetime.datetime(); (UTC)

430

301

name: string; from the config file, used in log messages and

431

302

D-Bus identifiers

432

303

secret: bytestring; sent verbatim (over TLS) to client

433

304

timeout: datetime.timedelta(); How long from last_checked_ok

434

305

until this client is disabled

435

extended_timeout: extra long timeout when secret has been sent

306

extended_timeout: extra long timeout when password has been sent

436

307

runtime_expansions: Allowed attributes for runtime expansion.

437

308

expires: datetime.datetime(); time (UTC) when a client will be

438

309

disabled, or None

442

313

"created", "enabled", "fingerprint",

443

314

"host", "interval", "last_checked_ok",

444

315

"last_enabled", "name", "timeout")

445

client_defaults = { "timeout": "5m",

446

"extended_timeout": "15m",

447

"interval": "2m",

448

"checker": "fping -q -- %%(host)s",

449

"host": "",

450

"approval_delay": "0s",

451

"approval_duration": "1s",

452

"approved_by_default": "True",

453

"enabled": "True",

454

}

455

316

456

317

def timeout_milliseconds(self):

457

318

"Return the 'timeout' attribute in milliseconds"

458

return timedelta_to_milliseconds(self.timeout)

319

return _timedelta_to_milliseconds(self.timeout)

459

320

460

321

def extended_timeout_milliseconds(self):

461

322

"Return the 'extended_timeout' attribute in milliseconds"

462

return timedelta_to_milliseconds(self.extended_timeout)

323

return _timedelta_to_milliseconds(self.extended_timeout)

463

324

464

325

def interval_milliseconds(self):

465

326

"Return the 'interval' attribute in milliseconds"

466

return timedelta_to_milliseconds(self.interval)

327

return _timedelta_to_milliseconds(self.interval)

467

328

468

329

def approval_delay_milliseconds(self):

469

return timedelta_to_milliseconds(self.approval_delay)

470

471

@staticmethod

472

def config_parser(config):

473

"""Construct a new dict of client settings of this form:

474

{ client_name: {setting_name: value, ...}, ...}

475

with exceptions for any special settings as defined above.

476

NOTE: Must be a pure function. Must return the same result

477

value given the same arguments.

478

"""

479

settings = {}

480

for client_name in config.sections():

481

section = dict(config.items(client_name))

482

client = settings[client_name] = {}

483

484

client["host"] = section["host"]

485

# Reformat values from string types to Python types

486

client["approved_by_default"] = config.getboolean(

487

client_name, "approved_by_default")

488

client["enabled"] = config.getboolean(client_name,

489

"enabled")

490

491

client["fingerprint"] = (section["fingerprint"].upper()

492

.replace(" ", ""))

493

if "secret" in section:

494

client["secret"] = section["secret"].decode("base64")

495

elif "secfile" in section:

496

with open(os.path.expanduser(os.path.expandvars

497

(section["secfile"])),

498

"rb") as secfile:

499

client["secret"] = secfile.read()

500

else:

501

raise TypeError("No secret or secfile for section {0}"

502

.format(section))

503

client["timeout"] = string_to_delta(section["timeout"])

504

client["extended_timeout"] = string_to_delta(

505

section["extended_timeout"])

506

client["interval"] = string_to_delta(section["interval"])

507

client["approval_delay"] = string_to_delta(

508

section["approval_delay"])

509

client["approval_duration"] = string_to_delta(

510

section["approval_duration"])

511

client["checker_command"] = section["checker"]

512

client["last_approval_request"] = None

513

client["last_checked_ok"] = None

514

client["last_checker_status"] = -2

515

516

return settings

517

518

def __init__(self, settings, name = None):

330

return _timedelta_to_milliseconds(self.approval_delay)

331

332

def __init__(self, name = None, disable_hook=None, config=None):

333

"""Note: the 'checker' key in 'config' sets the

334

'checker_command' attribute and *not* the 'checker'

335

attribute."""

519

336

self.name = name

520

# adding all client settings

521

for setting, value in settings.iteritems():

522

setattr(self, setting, value)

523

524

if self.enabled:

525

if not hasattr(self, "last_enabled"):

526

self.last_enabled = datetime.datetime.utcnow()

527

if not hasattr(self, "expires"):

528

self.expires = (datetime.datetime.utcnow()

529

+ self.timeout)

530

else:

531

self.last_enabled = None

532

self.expires = None

533

337

if config is None:

338

config = {}

534

339

logger.debug("Creating client %r", self.name)

535

340

# Uppercase and remove spaces from fingerprint for later

536

341

# comparison purposes with return value from the fingerprint()

537

342

# function

343

self.fingerprint = (config["fingerprint"].upper()

344

.replace(" ", ""))

538

345

logger.debug(" Fingerprint: %s", self.fingerprint)

539

self.created = settings.get("created",

540

datetime.datetime.utcnow())

541

542

# attributes specific for this server instance

346

if "secret" in config:

347

self.secret = config["secret"].decode("base64")

348

elif "secfile" in config:

349

with open(os.path.expanduser(os.path.expandvars

350

(config["secfile"])),

351

"rb") as secfile:

352

self.secret = secfile.read()

353

else:

354

raise TypeError("No secret or secfile for client %s"

355

% self.name)

356

self.host = config.get("host", "")

357

self.created = datetime.datetime.utcnow()

358

self.enabled = False

359

self.last_approval_request = None

360

self.last_enabled = None

361

self.last_checked_ok = None

362

self.timeout = string_to_delta(config["timeout"])

363

self.extended_timeout = string_to_delta(config["extended_timeout"])

364

self.interval = string_to_delta(config["interval"])

365

self.disable_hook = disable_hook

543

366

self.checker = None

544

367

self.checker_initiator_tag = None

545

368

self.disable_initiator_tag = None

369

self.expires = None

546

370

self.checker_callback_tag = None

371

self.checker_command = config["checker"]

547

372

self.current_checker_command = None

548

self.approved = None

373

self.last_connect = None

374

self._approved = None

375

self.approved_by_default = config.get("approved_by_default",

376

True)

549

377

self.approvals_pending = 0

550

self.changedstate = (multiprocessing_manager

551

.Condition(multiprocessing_manager

552

.Lock()))

553

self.client_structure = [attr for attr in

554

self.__dict__.iterkeys()

555

if not attr.startswith("_")]

556

self.client_structure.append("client_structure")

557

558

for name, t in inspect.getmembers(type(self),

559

lambda obj:

560

isinstance(obj,

561

property)):

562

if not name.startswith("_"):

563

self.client_structure.append(name)

378

self.approval_delay = string_to_delta(

379

config["approval_delay"])

380

self.approval_duration = string_to_delta(

381

config["approval_duration"])

382

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

564

383

565

# Send notice to process children that client state has changed

566

384

def send_changedstate(self):

567

with self.changedstate:

568

self.changedstate.notify_all()

569

385

self.changedstate.acquire()

386

self.changedstate.notify_all()

387

self.changedstate.release()

388

570

389

def enable(self):

571

390

"""Start this client's checker and timeout hooks"""

572

391

if getattr(self, "enabled", False):

573

392

# Already enabled

574

393

return

394

self.send_changedstate()

395

# Schedule a new checker to be started an 'interval' from now,

396

# and every interval from then on.

397

self.checker_initiator_tag = (gobject.timeout_add

398

(self.interval_milliseconds(),

399

self.start_checker))

400

# Schedule a disable() when 'timeout' has passed

575

401

self.expires = datetime.datetime.utcnow() + self.timeout

402

self.disable_initiator_tag = (gobject.timeout_add

403

(self.timeout_milliseconds(),

404

self.disable))

576

405

self.enabled = True

577

406

self.last_enabled = datetime.datetime.utcnow()

578

self.init_checker()

579

self.send_changedstate()

407

# Also start a new checker *right now*.

408

self.start_checker()

580

409

581

410

def disable(self, quiet=True):

582

411

"""Disable this client."""

583

412

if not getattr(self, "enabled", False):

584

413

return False

585

414

if not quiet:

415

self.send_changedstate()

416

if not quiet:

586

417

logger.info("Disabling client %s", self.name)

587

if getattr(self, "disable_initiator_tag", None) is not None:

418

if getattr(self, "disable_initiator_tag", False):

588

419

gobject.source_remove(self.disable_initiator_tag)

589

420

self.disable_initiator_tag = None

590

421

self.expires = None

591

if getattr(self, "checker_initiator_tag", None) is not None:

422

if getattr(self, "checker_initiator_tag", False):

592

423

gobject.source_remove(self.checker_initiator_tag)

593

424

self.checker_initiator_tag = None

594

425

self.stop_checker()

426

if self.disable_hook:

427

self.disable_hook(self)

595

428

self.enabled = False

596

if not quiet:

597

self.send_changedstate()

598

429

# Do not run this again if called by a gobject.timeout_add

599

430

return False

600

431

601

432

def __del__(self):

433

self.disable_hook = None

602

434

self.disable()

603

435

604

def init_checker(self):

605

# Schedule a new checker to be started an 'interval' from now,

606

# and every interval from then on.

607

if self.checker_initiator_tag is not None:

608

gobject.source_remove(self.checker_initiator_tag)

609

self.checker_initiator_tag = (gobject.timeout_add

610

(self.interval_milliseconds(),

611

self.start_checker))

612

# Schedule a disable() when 'timeout' has passed

613

if self.disable_initiator_tag is not None:

614

gobject.source_remove(self.disable_initiator_tag)

615

self.disable_initiator_tag = (gobject.timeout_add

616

(self.timeout_milliseconds(),

617

self.disable))

618

# Also start a new checker *right now*.

619

self.start_checker()

620

621

436

def checker_callback(self, pid, condition, command):

622

437

"""The checker has completed, so take appropriate actions."""

623

438

self.checker_callback_tag = None

624

439

self.checker = None

625

440

if os.WIFEXITED(condition):

626

self.last_checker_status = os.WEXITSTATUS(condition)

627

if self.last_checker_status == 0:

441

exitstatus = os.WEXITSTATUS(condition)

442

if exitstatus == 0:

628

443

logger.info("Checker for %(name)s succeeded",

629

444

vars(self))

630

445

self.checked_ok()

632

447

logger.info("Checker for %(name)s failed",

633

448

vars(self))

634

449

else:

635

self.last_checker_status = -1

636

450

logger.warning("Checker for %(name)s crashed?",

637

451

vars(self))

638

452

639

def checked_ok(self):

640

"""Assert that the client has been seen, alive and well."""

641

self.last_checked_ok = datetime.datetime.utcnow()

642

self.last_checker_status = 0

643

self.bump_timeout()

644

645

def bump_timeout(self, timeout=None):

646

"""Bump up the timeout for this client."""

453

def checked_ok(self, timeout=None):

454

"""Bump up the timeout for this client.

455

456

This should only be called when the client has been seen,

457

alive and well.

458

"""

647

459

if timeout is None:

648

460

timeout = self.timeout

649

if self.disable_initiator_tag is not None:

650

gobject.source_remove(self.disable_initiator_tag)

651

self.disable_initiator_tag = None

652

if getattr(self, "enabled", False):

653

self.disable_initiator_tag = (gobject.timeout_add

654

(timedelta_to_milliseconds

655

(timeout), self.disable))

656

self.expires = datetime.datetime.utcnow() + timeout

461

self.last_checked_ok = datetime.datetime.utcnow()

462

gobject.source_remove(self.disable_initiator_tag)

463

self.expires = datetime.datetime.utcnow() + timeout

464

self.disable_initiator_tag = (gobject.timeout_add

465

(_timedelta_to_milliseconds(timeout),

466

self.disable))

657

467

658

468

def need_approval(self):

659

469

self.last_approval_request = datetime.datetime.utcnow()

664

474

If a checker already exists, leave it running and do

665

475

nothing."""

666

476

# The reason for not killing a running checker is that if we

667

# did that, and if a checker (for some reason) started running

668

# slowly and taking more than 'interval' time, then the client

669

# would inevitably timeout, since no checker would get a

670

# chance to run to completion. If we instead leave running

477

# did that, then if a checker (for some reason) started

478

# running slowly and taking more than 'interval' time, the

479

# client would inevitably timeout, since no checker would get

480

# a chance to run to completion. If we instead leave running

671

481

# checkers alone, the checker would have to take more time

672

482

# than 'timeout' for the client to be disabled, which is as it

673

483

# should be.

703

513

try:

704

514

command = self.checker_command % escaped_attrs

705

515

except TypeError as error:

706

logger.error('Could not format string "%s"',

707

self.checker_command, exc_info=error)

516

logger.error('Could not format string "%s":'

517

' %s', self.checker_command, error)

708

518

return True # Try again later

709

519

self.current_checker_command = command

710

520

try:

728

538

gobject.source_remove(self.checker_callback_tag)

729

539

self.checker_callback(pid, status, command)

730

540

except OSError as error:

731

logger.error("Failed to start subprocess",

732

exc_info=error)

541

logger.error("Failed to start subprocess: %s",

542

error)

733

543

# Re-run this periodically if run by gobject.timeout_add

734

544

return True

735

545

742

552

return

743

553

logger.debug("Stopping checker for %(name)s", vars(self))

744

554

try:

745

self.checker.terminate()

555

os.kill(self.checker.pid, signal.SIGTERM)

746

556

#time.sleep(0.5)

747

557

#if self.checker.poll() is None:

748

# self.checker.kill()

558

# os.kill(self.checker.pid, signal.SIGKILL)

749

559

except OSError as error:

750

560

if error.errno != errno.ESRCH: # No such process

751

561

raise

768

578

# "Set" method, so we fail early here:

769

579

if byte_arrays and signature != "ay":

770

580

raise ValueError("Byte arrays not supported for non-'ay'"

771

" signature {0!r}".format(signature))

581

" signature %r" % signature)

772

582

def decorator(func):

773

583

func._dbus_is_property = True

774

584

func._dbus_interface = dbus_interface

782

592

return decorator

783

593

784

594

785

def dbus_interface_annotations(dbus_interface):

786

"""Decorator for marking functions returning interface annotations

787

788

Usage:

789

790

@dbus_interface_annotations("org.example.Interface")

791

def _foo(self): # Function name does not matter

792

return {"org.freedesktop.DBus.Deprecated": "true",

793

"org.freedesktop.DBus.Property.EmitsChangedSignal":

794

"false"}

795

"""

796

def decorator(func):

797

func._dbus_is_interface = True

798

func._dbus_interface = dbus_interface

799

func._dbus_name = dbus_interface

800

return func

801

return decorator

802

803

804

def dbus_annotations(annotations):

805

"""Decorator to annotate D-Bus methods, signals or properties

806

Usage:

807

808

@dbus_service_property("org.example.Interface", signature="b",

809

access="r")

810

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

811

"org.freedesktop.DBus.Property."

812

"EmitsChangedSignal": "false"})

813

def Property_dbus_property(self):

814

return dbus.Boolean(False)

815

"""

816

def decorator(func):

817

func._dbus_annotations = annotations

818

return func

819

return decorator

820

821

822

595

class DBusPropertyException(dbus.exceptions.DBusException):

823

596

"""A base class for D-Bus property-related exceptions

824

597

"""

847

620

"""

848

621

849

622

@staticmethod

850

def _is_dbus_thing(thing):

851

"""Returns a function testing if an attribute is a D-Bus thing

852

853

If called like _is_dbus_thing("method") it returns a function

854

suitable for use as predicate to inspect.getmembers().

855

"""

856

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

857

False)

623

def _is_dbus_property(obj):

624

return getattr(obj, "_dbus_is_property", False)

858

625

859

def _get_all_dbus_things(self, thing):

626

def _get_all_dbus_properties(self):

860

627

"""Returns a generator of (name, attribute) pairs

861

628

"""

862

return ((getattr(athing.__get__(self), "_dbus_name",

863

name),

864

athing.__get__(self))

865

for cls in self.__class__.__mro__

866

for name, athing in

867

inspect.getmembers(cls,

868

self._is_dbus_thing(thing)))

629

return ((prop._dbus_name, prop)

630

for name, prop in

631

inspect.getmembers(self, self._is_dbus_property))

869

632

870

633

def _get_dbus_property(self, interface_name, property_name):

871

634

"""Returns a bound method if one exists which is a D-Bus

872

635

property with the specified name and interface.

873

636

"""

874

for cls in self.__class__.__mro__:

875

for name, value in (inspect.getmembers

876

(cls,

877

self._is_dbus_thing("property"))):

878

if (value._dbus_name == property_name

879

and value._dbus_interface == interface_name):

880

return value.__get__(self)

881

637

for name in (property_name,

638

property_name + "_dbus_property"):

639

prop = getattr(self, name, None)

640

if (prop is None

641

or not self._is_dbus_property(prop)

642

or prop._dbus_name != property_name

643

or (interface_name and prop._dbus_interface

644

and interface_name != prop._dbus_interface)):

645

continue

646

return prop

882

647

# No such property

883

648

raise DBusPropertyNotFound(self.dbus_object_path + ":"

884

649

+ interface_name + "."

909

674

# signatures other than "ay".

910

675

if prop._dbus_signature != "ay":

911

676

raise ValueError

912

value = dbus.ByteArray(b''.join(chr(byte)

913

for byte in value))

677

value = dbus.ByteArray(''.join(unichr(byte)

678

for byte in value))

914

679

prop(value)

915

680

916

681

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

921

686

922

687

Note: Will not include properties with access="write".

923

688

"""

924

properties = {}

925

for name, prop in self._get_all_dbus_things("property"):

689

all = {}

690

for name, prop in self._get_all_dbus_properties():

926

691

if (interface_name

927

692

and interface_name != prop._dbus_interface):

928

693

# Interface non-empty but did not match

932

697

continue

933

698

value = prop()

934

699

if not hasattr(value, "variant_level"):

935

properties[name] = value

700

all[name] = value

936

701

continue

937

properties[name] = type(value)(value, variant_level=

938

value.variant_level+1)

939

return dbus.Dictionary(properties, signature="sv")

702

all[name] = type(value)(value, variant_level=

703

value.variant_level+1)

704

return dbus.Dictionary(all, signature="sv")

940

705

941

706

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

942

707

out_signature="s",

943

708

path_keyword='object_path',

944

709

connection_keyword='connection')

945

710

def Introspect(self, object_path, connection):

946

"""Overloading of standard D-Bus method.

947

948

Inserts property tags and interface annotation tags.

711

"""Standard D-Bus method, overloaded to insert property tags.

949

712

"""

950

713

xmlstring = dbus.service.Object.Introspect(self, object_path,

951

714

connection)

958

721

e.setAttribute("access", prop._dbus_access)

959

722

return e

960

723

for if_tag in document.getElementsByTagName("interface"):

961

# Add property tags

962

724

for tag in (make_tag(document, name, prop)

963

725

for name, prop

964

in self._get_all_dbus_things("property")

726

in self._get_all_dbus_properties()

965

727

if prop._dbus_interface

966

728

== if_tag.getAttribute("name")):

967

729

if_tag.appendChild(tag)

968

# Add annotation tags

969

for typ in ("method", "signal", "property"):

970

for tag in if_tag.getElementsByTagName(typ):

971

annots = dict()

972

for name, prop in (self.

973

_get_all_dbus_things(typ)):

974

if (name == tag.getAttribute("name")

975

and prop._dbus_interface

976

== if_tag.getAttribute("name")):

977

annots.update(getattr

978

(prop,

979

"_dbus_annotations",

980

{}))

981

for name, value in annots.iteritems():

982

ann_tag = document.createElement(

983

"annotation")

984

ann_tag.setAttribute("name", name)

985

ann_tag.setAttribute("value", value)

986

tag.appendChild(ann_tag)

987

# Add interface annotation tags

988

for annotation, value in dict(

989

itertools.chain.from_iterable(

990

annotations().iteritems()

991

for name, annotations in

992

self._get_all_dbus_things("interface")

993

if name == if_tag.getAttribute("name")

994

)).iteritems():

995

ann_tag = document.createElement("annotation")

996

ann_tag.setAttribute("name", annotation)

997

ann_tag.setAttribute("value", value)

998

if_tag.appendChild(ann_tag)

999

730

# Add the names to the return values for the

1000

731

# "org.freedesktop.DBus.Properties" methods

1001

732

if (if_tag.getAttribute("name")

1016

747

except (AttributeError, xml.dom.DOMException,

1017

748

xml.parsers.expat.ExpatError) as error:

1018

749

logger.error("Failed to override Introspection method",

1019

exc_info=error)

750

error)

1020

751

return xmlstring

1021

752

1022

753

1028

759

variant_level=variant_level)

1029

760

1030

761

1031

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1032

"""A class decorator; applied to a subclass of

1033

dbus.service.Object, it will add alternate D-Bus attributes with

1034

interface names according to the "alt_interface_names" mapping.

1035

Usage:

1036

1037

@alternate_dbus_names({"org.example.Interface":

1038

"net.example.AlternateInterface"})

1039

class SampleDBusObject(dbus.service.Object):

1040

@dbus.service.method("org.example.Interface")

1041

def SampleDBusMethod():

1042

pass

1043

1044

The above "SampleDBusMethod" on "SampleDBusObject" will be

1045

reachable via two interfaces: "org.example.Interface" and

1046

"net.example.AlternateInterface", the latter of which will have

1047

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1048

"true", unless "deprecate" is passed with a False value.

1049

1050

This works for methods and signals, and also for D-Bus properties

1051

(from DBusObjectWithProperties) and interfaces (from the

1052

dbus_interface_annotations decorator).

1053

"""

1054

def wrapper(cls):

1055

for orig_interface_name, alt_interface_name in (

1056

alt_interface_names.iteritems()):

1057

attr = {}

1058

interface_names = set()

1059

# Go though all attributes of the class

1060

for attrname, attribute in inspect.getmembers(cls):

1061

# Ignore non-D-Bus attributes, and D-Bus attributes

1062

# with the wrong interface name

1063

if (not hasattr(attribute, "_dbus_interface")

1064

or not attribute._dbus_interface

1065

.startswith(orig_interface_name)):

1066

continue

1067

# Create an alternate D-Bus interface name based on

1068

# the current name

1069

alt_interface = (attribute._dbus_interface

1070

.replace(orig_interface_name,

1071

alt_interface_name))

1072

interface_names.add(alt_interface)

1073

# Is this a D-Bus signal?

1074

if getattr(attribute, "_dbus_is_signal", False):

1075

# Extract the original non-method function by

1076

# black magic

1077

nonmethod_func = (dict(

1078

zip(attribute.func_code.co_freevars,

1079

attribute.__closure__))["func"]

1080

.cell_contents)

1081

# Create a new, but exactly alike, function

1082

# object, and decorate it to be a new D-Bus signal

1083

# with the alternate D-Bus interface name

1084

new_function = (dbus.service.signal

1085

(alt_interface,

1086

attribute._dbus_signature)

1087

(types.FunctionType(

1088

nonmethod_func.func_code,

1089

nonmethod_func.func_globals,

1090

nonmethod_func.func_name,

1091

nonmethod_func.func_defaults,

1092

nonmethod_func.func_closure)))

1093

# Copy annotations, if any

1094

try:

1095

new_function._dbus_annotations = (

1096

dict(attribute._dbus_annotations))

1097

except AttributeError:

1098

pass

1099

# Define a creator of a function to call both the

1100

# original and alternate functions, so both the

1101

# original and alternate signals gets sent when

1102

# the function is called

1103

def fixscope(func1, func2):

1104

"""This function is a scope container to pass

1105

func1 and func2 to the "call_both" function

1106

outside of its arguments"""

1107

def call_both(*args, **kwargs):

1108

"""This function will emit two D-Bus

1109

signals by calling func1 and func2"""

1110

func1(*args, **kwargs)

1111

func2(*args, **kwargs)

1112

return call_both

1113

# Create the "call_both" function and add it to

1114

# the class

1115

attr[attrname] = fixscope(attribute, new_function)

1116

# Is this a D-Bus method?

1117

elif getattr(attribute, "_dbus_is_method", False):

1118

# Create a new, but exactly alike, function

1119

# object. Decorate it to be a new D-Bus method

1120

# with the alternate D-Bus interface name. Add it

1121

# to the class.

1122

attr[attrname] = (dbus.service.method

1123

(alt_interface,

1124

attribute._dbus_in_signature,

1125

attribute._dbus_out_signature)

1126

(types.FunctionType

1127

(attribute.func_code,

1128

attribute.func_globals,

1129

attribute.func_name,

1130

attribute.func_defaults,

1131

attribute.func_closure)))

1132

# Copy annotations, if any

1133

try:

1134

attr[attrname]._dbus_annotations = (

1135

dict(attribute._dbus_annotations))

1136

except AttributeError:

1137

pass

1138

# Is this a D-Bus property?

1139

elif getattr(attribute, "_dbus_is_property", False):

1140

# Create a new, but exactly alike, function

1141

# object, and decorate it to be a new D-Bus

1142

# property with the alternate D-Bus interface

1143

# name. Add it to the class.

1144

attr[attrname] = (dbus_service_property

1145

(alt_interface,

1146

attribute._dbus_signature,

1147

attribute._dbus_access,

1148

attribute

1149

._dbus_get_args_options

1150

["byte_arrays"])

1151

(types.FunctionType

1152

(attribute.func_code,

1153

attribute.func_globals,

1154

attribute.func_name,

1155

attribute.func_defaults,

1156

attribute.func_closure)))

1157

# Copy annotations, if any

1158

try:

1159

attr[attrname]._dbus_annotations = (

1160

dict(attribute._dbus_annotations))

1161

except AttributeError:

1162

pass

1163

# Is this a D-Bus interface?

1164

elif getattr(attribute, "_dbus_is_interface", False):

1165

# Create a new, but exactly alike, function

1166

# object. Decorate it to be a new D-Bus interface

1167

# with the alternate D-Bus interface name. Add it

1168

# to the class.

1169

attr[attrname] = (dbus_interface_annotations

1170

(alt_interface)

1171

(types.FunctionType

1172

(attribute.func_code,

1173

attribute.func_globals,

1174

attribute.func_name,

1175

attribute.func_defaults,

1176

attribute.func_closure)))

1177

if deprecate:

1178

# Deprecate all alternate interfaces

1179

iname="_AlternateDBusNames_interface_annotation{0}"

1180

for interface_name in interface_names:

1181

@dbus_interface_annotations(interface_name)

1182

def func(self):

1183

return { "org.freedesktop.DBus.Deprecated":

1184

"true" }

1185

# Find an unused name

1186

for aname in (iname.format(i)

1187

for i in itertools.count()):

1188

if aname not in attr:

1189

attr[aname] = func

1190

break

1191

if interface_names:

1192

# Replace the class with a new subclass of it with

1193

# methods, signals, etc. as created above.

1194

cls = type(b"{0}Alternate".format(cls.__name__),

1195

(cls,), attr)

1196

return cls

1197

return wrapper

1198

1199

1200

@alternate_dbus_interfaces({"se.recompile.Mandos":

1201

"se.bsnet.fukt.Mandos"})

1202

762

class ClientDBus(Client, DBusObjectWithProperties):

1203

763

"""A Client class using D-Bus

1204

764

1213

773

# dbus.service.Object doesn't use super(), so we can't either.

1214

774

1215

775

def __init__(self, bus = None, *args, **kwargs):

776

self._approvals_pending = 0

1216

777

self.bus = bus

1217

778

Client.__init__(self, *args, **kwargs)

1218

779

# Only now, when this client is initialized, can it show up on

1224

785

("/clients/" + client_object_name))

1225

786

DBusObjectWithProperties.__init__(self, self.bus,

1226

787

self.dbus_object_path)

1227

788

1228

789

def notifychangeproperty(transform_func,

1229

790

dbus_name, type_func=lambda x: x,

1230

791

variant_level=1):

1231

""" Modify a variable so that it's a property which announces

1232

its changes to DBus.

1233

1234

transform_fun: Function that takes a value and a variant_level

1235

and transforms it to a D-Bus type.

1236

dbus_name: D-Bus name of the variable

792

""" Modify a variable so that its a property that announce its

793

changes to DBus.

794

transform_fun: Function that takes a value and transform it to

795

DBus type.

796

dbus_name: DBus name of the variable

1237

797

type_func: Function that transform the value before sending it

1238

to the D-Bus. Default: no transform

1239

variant_level: D-Bus variant level. Default: 1

798

to DBus

799

variant_level: DBus variant level. default: 1

1240

800

"""

1241

attrname = "_{0}".format(dbus_name)

801

real_value = [None,]

1242

802

def setter(self, value):

803

old_value = real_value[0]

804

real_value[0] = value

1243

805

if hasattr(self, "dbus_object_path"):

1244

if (not hasattr(self, attrname) or

1245

type_func(getattr(self, attrname, None))

1246

!= type_func(value)):

1247

dbus_value = transform_func(type_func(value),

1248

variant_level

1249

=variant_level)

806

if type_func(old_value) != type_func(real_value[0]):

807

dbus_value = transform_func(type_func(real_value[0]),

808

variant_level)

1250

809

self.PropertyChanged(dbus.String(dbus_name),

1251

810

dbus_value)

1252

setattr(self, attrname, value)

1253

811

1254

return property(lambda self: getattr(self, attrname), setter)

812

return property(lambda self: real_value[0], setter)

813

1255

814

1256

815

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1257

816

approvals_pending = notifychangeproperty(dbus.Boolean,

1261

820

last_enabled = notifychangeproperty(datetime_to_dbus,

1262

821

"LastEnabled")

1263

822

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1264

type_func = lambda checker:

1265

checker is not None)

823

type_func = lambda checker: checker is not None)

1266

824

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1267

825

"LastCheckedOK")

1268

last_checker_status = notifychangeproperty(dbus.Int16,

1269

"LastCheckerStatus")

1270

last_approval_request = notifychangeproperty(

1271

datetime_to_dbus, "LastApprovalRequest")

826

last_approval_request = notifychangeproperty(datetime_to_dbus,

827

"LastApprovalRequest")

1272

828

approved_by_default = notifychangeproperty(dbus.Boolean,

1273

829

"ApprovedByDefault")

1274

approval_delay = notifychangeproperty(dbus.UInt64,

1275

"ApprovalDelay",

1276

type_func =

1277

timedelta_to_milliseconds)

1278

approval_duration = notifychangeproperty(

1279

dbus.UInt64, "ApprovalDuration",

1280

type_func = timedelta_to_milliseconds)

830

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

831

type_func = _timedelta_to_milliseconds)

832

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

833

type_func = _timedelta_to_milliseconds)

1281

834

host = notifychangeproperty(dbus.String, "Host")

1282

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1283

type_func =

1284

timedelta_to_milliseconds)

1285

extended_timeout = notifychangeproperty(

1286

dbus.UInt64, "ExtendedTimeout",

1287

type_func = timedelta_to_milliseconds)

1288

interval = notifychangeproperty(dbus.UInt64,

1289

"Interval",

1290

type_func =

1291

timedelta_to_milliseconds)

835

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

836

type_func = _timedelta_to_milliseconds)

837

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

838

type_func = _timedelta_to_milliseconds)

839

interval = notifychangeproperty(dbus.UInt16, "Interval",

840

type_func = _timedelta_to_milliseconds)

1292

841

checker_command = notifychangeproperty(dbus.String, "Checker")

1293

842

1294

843

del notifychangeproperty

1336

885

return r

1337

886

1338

887

def _reset_approved(self):

1339

self.approved = None

888

self._approved = None

1340

889

return False

1341

890

1342

891

def approve(self, value=True):

1343

self.approved = value

1344

gobject.timeout_add(timedelta_to_milliseconds

892

self.send_changedstate()

893

self._approved = value

894

gobject.timeout_add(_timedelta_to_milliseconds

1345

895

(self.approval_duration),

1346

896

self._reset_approved)

1347

self.send_changedstate()

897

1348

898

1349

899

## D-Bus methods, signals & properties

1350

_interface = "se.recompile.Mandos.Client"

1351

1352

## Interfaces

1353

1354

@dbus_interface_annotations(_interface)

1355

def _foo(self):

1356

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1357

"false"}

900

_interface = "se.bsnet.fukt.Mandos.Client"

1358

901

1359

902

## Signals

1360

903

1460

1003

access="readwrite")

1461

1004

def ApprovalDuration_dbus_property(self, value=None):

1462

1005

if value is None: # get

1463

return dbus.UInt64(timedelta_to_milliseconds(

1006

return dbus.UInt64(_timedelta_to_milliseconds(

1464

1007

self.approval_duration))

1465

1008

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1466

1009

1480

1023

def Host_dbus_property(self, value=None):

1481

1024

if value is None: # get

1482

1025

return dbus.String(self.host)

1483

self.host = unicode(value)

1026

self.host = value

1484

1027

1485

1028

# Created - property

1486

1029

@dbus_service_property(_interface, signature="s", access="read")

1487

1030

def Created_dbus_property(self):

1488

return datetime_to_dbus(self.created)

1031

return dbus.String(datetime_to_dbus(self.created))

1489

1032

1490

1033

# LastEnabled - property

1491

1034

@dbus_service_property(_interface, signature="s", access="read")

1512

1055

return

1513

1056

return datetime_to_dbus(self.last_checked_ok)

1514

1057

1515

# LastCheckerStatus - property

1516

@dbus_service_property(_interface, signature="n",

1517

access="read")

1518

def LastCheckerStatus_dbus_property(self):

1519

return dbus.Int16(self.last_checker_status)

1520

1521

1058

# Expires - property

1522

1059

@dbus_service_property(_interface, signature="s", access="read")

1523

1060

def Expires_dbus_property(self):

1534

1071

def Timeout_dbus_property(self, value=None):

1535

1072

if value is None: # get

1536

1073

return dbus.UInt64(self.timeout_milliseconds())

1537

old_timeout = self.timeout

1538

1074

self.timeout = datetime.timedelta(0, 0, 0, value)

1539

# Reschedule disabling

1540

if self.enabled:

1541

now = datetime.datetime.utcnow()

1542

self.expires += self.timeout - old_timeout

1543

if self.expires <= now:

1544

# The timeout has passed

1545

self.disable()

1546

else:

1547

if (getattr(self, "disable_initiator_tag", None)

1548

is None):

1549

return

1550

gobject.source_remove(self.disable_initiator_tag)

1551

self.disable_initiator_tag = (

1552

gobject.timeout_add(

1553

timedelta_to_milliseconds(self.expires - now),

1554

self.disable))

1075

if getattr(self, "disable_initiator_tag", None) is None:

1076

return

1077

# Reschedule timeout

1078

gobject.source_remove(self.disable_initiator_tag)

1079

self.disable_initiator_tag = None

1080

self.expires = None

1081

time_to_die = (self.

1082

_timedelta_to_milliseconds((self

1083

.last_checked_ok

1084

+ self.timeout)

1085

- datetime.datetime

1086

.utcnow()))

1087

if time_to_die <= 0:

1088

# The timeout has passed

1089

self.disable()

1090

else:

1091

self.expires = (datetime.datetime.utcnow()

1092

+ datetime.timedelta(milliseconds = time_to_die))

1093

self.disable_initiator_tag = (gobject.timeout_add

1094

(time_to_die, self.disable))

1555

1095

1556

1096

# ExtendedTimeout - property

1557

1097

@dbus_service_property(_interface, signature="t",

1570

1110

self.interval = datetime.timedelta(0, 0, 0, value)

1571

1111

if getattr(self, "checker_initiator_tag", None) is None:

1572

1112

return

1573

if self.enabled:

1574

# Reschedule checker run

1575

gobject.source_remove(self.checker_initiator_tag)

1576

self.checker_initiator_tag = (gobject.timeout_add

1577

(value, self.start_checker))

1578

self.start_checker() # Start one now, too

1113

# Reschedule checker run

1114

gobject.source_remove(self.checker_initiator_tag)

1115

self.checker_initiator_tag = (gobject.timeout_add

1116

(value, self.start_checker))

1117

self.start_checker() # Start one now, too

1579

1118

1580

1119

# Checker - property

1581

1120

@dbus_service_property(_interface, signature="s",

1583

1122

def Checker_dbus_property(self, value=None):

1584

1123

if value is None: # get

1585

1124

return dbus.String(self.checker_command)

1586

self.checker_command = unicode(value)

1125

self.checker_command = value

1587

1126

1588

1127

# CheckerRunning - property

1589

1128

@dbus_service_property(_interface, signature="b",

1618

1157

raise KeyError()

1619

1158

1620

1159

def __getattribute__(self, name):

1621

if name == '_pipe':

1160

if(name == '_pipe'):

1622

1161

return super(ProxyClient, self).__getattribute__(name)

1623

1162

self._pipe.send(('getattr', name))

1624

1163

data = self._pipe.recv()

1631

1170

return func

1632

1171

1633

1172

def __setattr__(self, name, value):

1634

if name == '_pipe':

1173

if(name == '_pipe'):

1635

1174

return super(ProxyClient, self).__setattr__(name, value)

1636

1175

self._pipe.send(('setattr', name, value))

1637

1176

1720

1259

client.name)

1721

1260

if self.server.use_dbus:

1722

1261

# Emit D-Bus signal

1723

client.Rejected("Disabled")

1262

client.Rejected("Disabled")

1724

1263

return

1725

1264

1726

if client.approved or not client.approval_delay:

1265

if client._approved or not client.approval_delay:

1727

1266

#We are approved or approval is disabled

1728

1267

break

1729

elif client.approved is None:

1268

elif client._approved is None:

1730

1269

logger.info("Client %s needs approval",

1731

1270

client.name)

1732

1271

if self.server.use_dbus:

1743

1282

return

1744

1283

1745

1284

#wait until timeout or approved

1285

#x = float(client._timedelta_to_milliseconds(delay))

1746

1286

time = datetime.datetime.now()

1747

1287

client.changedstate.acquire()

1748

client.changedstate.wait(

1749

float(timedelta_to_milliseconds(delay)

1750

/ 1000))

1288

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1751

1289

client.changedstate.release()

1752

1290

time2 = datetime.datetime.now()

1753

1291

if (time2 - time) >= delay:

1769

1307

try:

1770

1308

sent = session.send(client.secret[sent_size:])

1771

1309

except gnutls.errors.GNUTLSError as error:

1772

logger.warning("gnutls send failed",

1773

exc_info=error)

1310

logger.warning("gnutls send failed")

1774

1311

return

1775

1312

logger.debug("Sent: %d, remaining: %d",

1776

1313

sent, len(client.secret)

1778

1315

sent_size += sent

1779

1316

1780

1317

logger.info("Sending secret to %s", client.name)

1781

# bump the timeout using extended_timeout

1782

client.bump_timeout(client.extended_timeout)

1318

# bump the timeout as if seen

1319

client.checked_ok(client.extended_timeout)

1783

1320

if self.server.use_dbus:

1784

1321

# Emit D-Bus signal

1785

1322

client.GotSecret()

1790

1327

try:

1791

1328

session.bye()

1792

1329

except gnutls.errors.GNUTLSError as error:

1793

logger.warning("GnuTLS bye failed",

1794

exc_info=error)

1330

logger.warning("GnuTLS bye failed")

1795

1331

1796

1332

@staticmethod

1797

1333

def peer_certificate(session):

1853

1389

# Convert the buffer to a Python bytestring

1854

1390

fpr = ctypes.string_at(buf, buf_len.value)

1855

1391

# Convert the bytestring to hexadecimal notation

1856

hex_fpr = binascii.hexlify(fpr).upper()

1392

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1857

1393

return hex_fpr

1858

1394

1859

1395

1862

1398

def sub_process_main(self, request, address):

1863

1399

try:

1864

1400

self.finish_request(request, address)

1865

except Exception:

1401

except:

1866

1402

self.handle_error(request, address)

1867

1403

self.close_request(request)

1868

1404

1869

1405

def process_request(self, request, address):

1870

1406

"""Start a new process to process the request."""

1871

proc = multiprocessing.Process(target = self.sub_process_main,

1872

args = (request, address))

1873

proc.start()

1874

return proc

1407

multiprocessing.Process(target = self.sub_process_main,

1408

args = (request, address)).start()

1875

1409

1876

1410

1877

1411

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1883

1417

"""

1884

1418

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1885

1419

1886

proc = MultiprocessingMixIn.process_request(self, request,

1887

client_address)

1420

super(MultiprocessingMixInWithPipe,

1421

self).process_request(request, client_address)

1888

1422

self.child_pipe.close()

1889

self.add_pipe(parent_pipe, proc)

1423

self.add_pipe(parent_pipe)

1890

1424

1891

def add_pipe(self, parent_pipe, proc):

1425

def add_pipe(self, parent_pipe):

1892

1426

"""Dummy function; override as necessary"""

1893

1427

raise NotImplementedError

1894

1428

1972

1506

self.enabled = False

1973

1507

self.clients = clients

1974

1508

if self.clients is None:

1975

self.clients = {}

1509

self.clients = set()

1976

1510

self.use_dbus = use_dbus

1977

1511

self.gnutls_priority = gnutls_priority

1978

1512

IPv6_TCPServer.__init__(self, server_address,

1982

1516

def server_activate(self):

1983

1517

if self.enabled:

1984

1518

return socketserver.TCPServer.server_activate(self)

1985

1986

1519

def enable(self):

1987

1520

self.enabled = True

1988

1989

def add_pipe(self, parent_pipe, proc):

1521

def add_pipe(self, parent_pipe):

1990

1522

# Call "handle_ipc" for both data and EOF events

1991

1523

gobject.io_add_watch(parent_pipe.fileno(),

1992

1524

gobject.IO_IN | gobject.IO_HUP,

1993

1525

functools.partial(self.handle_ipc,

1994

parent_pipe =

1995

parent_pipe,

1996

proc = proc))

1997

1526

parent_pipe = parent_pipe))

1527

1998

1528

def handle_ipc(self, source, condition, parent_pipe=None,

1999

proc = None, client_object=None):

2000

# error, or the other end of multiprocessing.Pipe has closed

2001

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2002

# Wait for other process to exit

2003

proc.join()

1529

client_object=None):

1530

condition_names = {

1531

gobject.IO_IN: "IN", # There is data to read.

1532

gobject.IO_OUT: "OUT", # Data can be written (without

1533

# blocking).

1534

gobject.IO_PRI: "PRI", # There is urgent data to read.

1535

gobject.IO_ERR: "ERR", # Error condition.

1536

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1537

# broken, usually for pipes and

1538

# sockets).

1539

}

1540

conditions_string = ' | '.join(name

1541

for cond, name in

1542

condition_names.iteritems()

1543

if cond & condition)

1544

# error or the other end of multiprocessing.Pipe has closed

1545

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2004

1546

return False

2005

1547

2006

1548

# Read a request from the child

2011

1553

fpr = request[1]

2012

1554

address = request[2]

2013

1555

2014

for c in self.clients.itervalues():

1556

for c in self.clients:

2015

1557

if c.fingerprint == fpr:

2016

1558

client = c

2017

1559

break

2020

1562

"dress: %s", fpr, address)

2021

1563

if self.use_dbus:

2022

1564

# Emit D-Bus signal

2023

mandos_dbus_service.ClientNotFound(fpr,

2024

address[0])

1565

mandos_dbus_service.ClientNotFound(fpr, address[0])

2025

1566

parent_pipe.send(False)

2026

1567

return False

2027

1568

2028

1569

gobject.io_add_watch(parent_pipe.fileno(),

2029

1570

gobject.IO_IN | gobject.IO_HUP,

2030

1571

functools.partial(self.handle_ipc,

2031

parent_pipe =

2032

parent_pipe,

2033

proc = proc,

2034

client_object =

2035

client))

1572

parent_pipe = parent_pipe,

1573

client_object = client))

2036

1574

parent_pipe.send(True)

2037

# remove the old hook in favor of the new above hook on

2038

# same fileno

1575

# remove the old hook in favor of the new above hook on same fileno

2039

1576

return False

2040

1577

if command == 'funcall':

2041

1578

funcname = request[1]

2042

1579

args = request[2]

2043

1580

kwargs = request[3]

2044

1581

2045

parent_pipe.send(('data', getattr(client_object,

2046

funcname)(*args,

2047

**kwargs)))

1582

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

2048

1583

2049

1584

if command == 'getattr':

2050

1585

attrname = request[1]

2051

1586

if callable(client_object.__getattribute__(attrname)):

2052

1587

parent_pipe.send(('function',))

2053

1588

else:

2054

parent_pipe.send(('data', client_object

2055

.__getattribute__(attrname)))

1589

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2056

1590

2057

1591

if command == 'setattr':

2058

1592

attrname = request[1]

2094

1628

elif suffix == "w":

2095

1629

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2096

1630

else:

2097

raise ValueError("Unknown suffix {0!r}"

2098

.format(suffix))

1631

raise ValueError("Unknown suffix %r" % suffix)

2099

1632

except (ValueError, IndexError) as e:

2100

1633

raise ValueError(*(e.args))

2101

1634

timevalue += delta

2102

1635

return timevalue

2103

1636

2104

1637

1638

def if_nametoindex(interface):

1639

"""Call the C function if_nametoindex(), or equivalent

1640

1641

Note: This function cannot accept a unicode string."""

1642

global if_nametoindex

1643

try:

1644

if_nametoindex = (ctypes.cdll.LoadLibrary

1645

(ctypes.util.find_library("c"))

1646

.if_nametoindex)

1647

except (OSError, AttributeError):

1648

logger.warning("Doing if_nametoindex the hard way")

1649

def if_nametoindex(interface):

1650

"Get an interface index the hard way, i.e. using fcntl()"

1651

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1652

with contextlib.closing(socket.socket()) as s:

1653

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1654

struct.pack(str("16s16x"),

1655

interface))

1656

interface_index = struct.unpack(str("I"),

1657

ifreq[16:20])[0]

1658

return interface_index

1659

return if_nametoindex(interface)

1660

1661

2105

1662

def daemon(nochdir = False, noclose = False):

2106

1663

"""See daemon(3). Standard BSD Unix function.

2107

1664

2115

1672

sys.exit()

2116

1673

if not noclose:

2117

1674

# Close all standard open file descriptors

2118

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1675

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2119

1676

if not stat.S_ISCHR(os.fstat(null).st_mode):

2120

1677

raise OSError(errno.ENODEV,

2121

"{0} not a character device"

2122

.format(os.devnull))

1678

"%s not a character device"

1679

% os.path.devnull)

2123

1680

os.dup2(null, sys.stdin.fileno())

2124

1681

os.dup2(null, sys.stdout.fileno())

2125

1682

os.dup2(null, sys.stderr.fileno())

2134

1691

2135

1692

parser = argparse.ArgumentParser()

2136

1693

parser.add_argument("-v", "--version", action="version",

2137

version = "%(prog)s {0}".format(version),

1694

version = "%%(prog)s %s" % version,

2138

1695

help="show version number and exit")

2139

1696

parser.add_argument("-i", "--interface", metavar="IF",

2140

1697

help="Bind to interface IF")

2162

1719

" system bus interface")

2163

1720

parser.add_argument("--no-ipv6", action="store_false",

2164

1721

dest="use_ipv6", help="Do not use IPv6")

2165

parser.add_argument("--no-restore", action="store_false",

2166

dest="restore", help="Do not restore stored"

2167

" state")

2168

parser.add_argument("--statedir", metavar="DIR",

2169

help="Directory to save/restore state in")

2170

2171

1722

options = parser.parse_args()

2172

1723

2173

1724

if options.check:

2186

1737

"use_dbus": "True",

2187

1738

"use_ipv6": "True",

2188

1739

"debuglevel": "",

2189

"restore": "True",

2190

"statedir": "/var/lib/mandos"

2191

1740

}

2192

1741

2193

1742

# Parse config file for server-global settings

2210

1759

# options, if set.

2211

1760

for option in ("interface", "address", "port", "debug",

2212

1761

"priority", "servicename", "configdir",

2213

"use_dbus", "use_ipv6", "debuglevel", "restore",

2214

"statedir"):

1762

"use_dbus", "use_ipv6", "debuglevel"):

2215

1763

value = getattr(options, option)

2216

1764

if value is not None:

2217

1765

server_settings[option] = value

2229

1777

debuglevel = server_settings["debuglevel"]

2230

1778

use_dbus = server_settings["use_dbus"]

2231

1779

use_ipv6 = server_settings["use_ipv6"]

2232

stored_state_path = os.path.join(server_settings["statedir"],

2233

stored_state_file)

2234

2235

if debug:

2236

initlogger(debug, logging.DEBUG)

2237

else:

2238

if not debuglevel:

2239

initlogger(debug)

2240

else:

2241

level = getattr(logging, debuglevel.upper())

2242

initlogger(debug, level)

2243

1780

2244

1781

if server_settings["servicename"] != "Mandos":

2245

1782

syslogger.setFormatter(logging.Formatter

2246

('Mandos ({0}) [%(process)d]:'

2247

' %(levelname)s: %(message)s'

2248

.format(server_settings

2249

["servicename"])))

1783

('Mandos (%s) [%%(process)d]:'

1784

' %%(levelname)s: %%(message)s'

1785

% server_settings["servicename"]))

2250

1786

2251

1787

# Parse config file with clients

2252

client_config = configparser.SafeConfigParser(Client

2253

.client_defaults)

1788

client_defaults = { "timeout": "5m",

1789

"extended_timeout": "15m",

1790

"interval": "2m",

1791

"checker": "fping -q -- %%(host)s",

1792

"host": "",

1793

"approval_delay": "0s",

1794

"approval_duration": "1s",

1795

}

1796

client_config = configparser.SafeConfigParser(client_defaults)

2254

1797

client_config.read(os.path.join(server_settings["configdir"],

2255

1798

"clients.conf"))

2256

1799

2270

1813

pidfilename = "/var/run/mandos.pid"

2271

1814

try:

2272

1815

pidfile = open(pidfilename, "w")

2273

except IOError as e:

2274

logger.error("Could not open file %r", pidfilename,

2275

exc_info=e)

1816

except IOError:

1817

logger.error("Could not open file %r", pidfilename)

2276

1818

2277

for name in ("_mandos", "mandos", "nobody"):

1819

try:

1820

uid = pwd.getpwnam("_mandos").pw_uid

1821

gid = pwd.getpwnam("_mandos").pw_gid

1822

except KeyError:

2278

1823

try:

2279

uid = pwd.getpwnam(name).pw_uid

2280

gid = pwd.getpwnam(name).pw_gid

2281

break

1824

uid = pwd.getpwnam("mandos").pw_uid

1825

gid = pwd.getpwnam("mandos").pw_gid

2282

1826

except KeyError:

2283

continue

2284

else:

2285

uid = 65534

2286

gid = 65534

1827

try:

1828

uid = pwd.getpwnam("nobody").pw_uid

1829

gid = pwd.getpwnam("nobody").pw_gid

1830

except KeyError:

1831

uid = 65534

1832

gid = 65534

2287

1833

try:

2288

1834

os.setgid(gid)

2289

1835

os.setuid(uid)

2291

1837

if error[0] != errno.EPERM:

2292

1838

raise error

2293

1839

1840

if not debug and not debuglevel:

1841

syslogger.setLevel(logging.WARNING)

1842

console.setLevel(logging.WARNING)

1843

if debuglevel:

1844

level = getattr(logging, debuglevel.upper())

1845

syslogger.setLevel(level)

1846

console.setLevel(level)

1847

2294

1848

if debug:

2295

1849

# Enable all possible GnuTLS debugging

2296

1850

2306

1860

.gnutls_global_set_log_function(debug_gnutls))

2307

1861

2308

1862

# Redirect stdin so all checkers get /dev/null

2309

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1863

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2310

1864

os.dup2(null, sys.stdin.fileno())

2311

1865

if null > 2:

2312

1866

os.close(null)

1867

else:

1868

# No console logging

1869

logger.removeHandler(console)

2313

1870

2314

1871

# Need to fork before connecting to D-Bus

2315

1872

if not debug:

2316

1873

# Close all input and output, do double fork, etc.

2317

1874

daemon()

2318

1875

2319

gobject.threads_init()

2320

2321

1876

global main_loop

2322

1877

# From the Avahi example code

2323

DBusGMainLoop(set_as_default=True)

1878

DBusGMainLoop(set_as_default=True )

2324

1879

main_loop = gobject.MainLoop()

2325

1880

bus = dbus.SystemBus()

2326

1881

# End of Avahi example code

2327

1882

if use_dbus:

2328

1883

try:

2329

bus_name = dbus.service.BusName("se.recompile.Mandos",

1884

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

2330

1885

bus, do_not_queue=True)

2331

old_bus_name = (dbus.service.BusName

2332

("se.bsnet.fukt.Mandos", bus,

2333

do_not_queue=True))

2334

1886

except dbus.exceptions.NameExistsException as e:

2335

logger.error("Disabling D-Bus:", exc_info=e)

1887

logger.error(unicode(e) + ", disabling D-Bus")

2336

1888

use_dbus = False

2337

1889

server_settings["use_dbus"] = False

2338

1890

tcp_server.use_dbus = False

2339

1891

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2340

service = AvahiServiceToSyslog(name =

2341

server_settings["servicename"],

2342

servicetype = "_mandos._tcp",

2343

protocol = protocol, bus = bus)

1892

service = AvahiService(name = server_settings["servicename"],

1893

servicetype = "_mandos._tcp",

1894

protocol = protocol, bus = bus)

2344

1895

if server_settings["interface"]:

2345

1896

service.interface = (if_nametoindex

2346

1897

(str(server_settings["interface"])))

2351

1902

client_class = Client

2352

1903

if use_dbus:

2353

1904

client_class = functools.partial(ClientDBus, bus = bus)

2354

2355

client_settings = Client.config_parser(client_config)

2356

old_client_settings = {}

2357

clients_data = {}

2358

2359

# Get client data and settings from last running state.

2360

if server_settings["restore"]:

2361

try:

2362

with open(stored_state_path, "rb") as stored_state:

2363

clients_data, old_client_settings = (pickle.load

2364

(stored_state))

2365

os.remove(stored_state_path)

2366

except IOError as e:

2367

if e.errno == errno.ENOENT:

2368

logger.warning("Could not load persistent state: {0}"

2369

.format(os.strerror(e.errno)))

2370

else:

2371

logger.critical("Could not load persistent state:",

2372

exc_info=e)

2373

raise

2374

except EOFError as e:

2375

logger.warning("Could not load persistent state: "

2376

"EOFError:", exc_info=e)

2377

2378

with PGPEngine() as pgp:

2379

for client_name, client in clients_data.iteritems():

2380

# Decide which value to use after restoring saved state.

2381

# We have three different values: Old config file,

2382

# new config file, and saved state.

2383

# New config value takes precedence if it differs from old

2384

# config value, otherwise use saved state.

2385

for name, value in client_settings[client_name].items():

2386

try:

2387

# For each value in new config, check if it

2388

# differs from the old config value (Except for

2389

# the "secret" attribute)

2390

if (name != "secret" and

2391

value != old_client_settings[client_name]

2392

[name]):

2393

client[name] = value

2394

except KeyError:

2395

pass

2396

2397

# Clients who has passed its expire date can still be

2398

# enabled if its last checker was successful. Clients

2399

# whose checker succeeded before we stored its state is

2400

# assumed to have successfully run all checkers during

2401

# downtime.

2402

if client["enabled"]:

2403

if datetime.datetime.utcnow() >= client["expires"]:

2404

if not client["last_checked_ok"]:

2405

logger.warning(

2406

"disabling client {0} - Client never "

2407

"performed a successful checker"

2408

.format(client_name))

2409

client["enabled"] = False

2410

elif client["last_checker_status"] != 0:

2411

logger.warning(

2412

"disabling client {0} - Client "

2413

"last checker failed with error code {1}"

2414

.format(client_name,

2415

client["last_checker_status"]))

2416

client["enabled"] = False

2417

else:

2418

client["expires"] = (datetime.datetime

2419

.utcnow()

2420

+ client["timeout"])

2421

logger.debug("Last checker succeeded,"

2422

" keeping {0} enabled"

2423

.format(client_name))

1905

def client_config_items(config, section):

1906

special_settings = {

1907

"approved_by_default":

1908

lambda: config.getboolean(section,

1909

"approved_by_default"),

1910

}

1911

for name, value in config.items(section):

2424

1912

try:

2425

client["secret"] = (

2426

pgp.decrypt(client["encrypted_secret"],

2427

client_settings[client_name]

2428

["secret"]))

2429

except PGPError:

2430

# If decryption fails, we use secret from new settings

2431

logger.debug("Failed to decrypt {0} old secret"

2432

.format(client_name))

2433

client["secret"] = (

2434

client_settings[client_name]["secret"])

2435

2436

# Add/remove clients based on new changes made to config

2437

for client_name in (set(old_client_settings)

2438

- set(client_settings)):

2439

del clients_data[client_name]

2440

for client_name in (set(client_settings)

2441

- set(old_client_settings)):

2442

clients_data[client_name] = client_settings[client_name]

2443

2444

# Create all client objects

2445

for client_name, client in clients_data.iteritems():

2446

tcp_server.clients[client_name] = client_class(

2447

name = client_name, settings = client)

2448

1913

yield (name, special_settings[name]())

1914

except KeyError:

1915

yield (name, value)

1916

1917

tcp_server.clients.update(set(

1918

client_class(name = section,

1919

config= dict(client_config_items(

1920

client_config, section)))

1921

for section in client_config.sections()))

2449

1922

if not tcp_server.clients:

2450

1923

logger.warning("No clients defined")

2451

1924

2452

1925

if not debug:

2453

1926

try:

2454

1927

with pidfile:

2462

1935

# "pidfile" was never created

2463

1936

pass

2464

1937

del pidfilename

1938

2465

1939

signal.signal(signal.SIGINT, signal.SIG_IGN)

2466

1940

2467

1941

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2468

1942

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2469

1943

2470

1944

if use_dbus:

2471

@alternate_dbus_interfaces({"se.recompile.Mandos":

2472

"se.bsnet.fukt.Mandos"})

2473

class MandosDBusService(DBusObjectWithProperties):

1945

class MandosDBusService(dbus.service.Object):

2474

1946

"""A D-Bus proxy object"""

2475

1947

def __init__(self):

2476

1948

dbus.service.Object.__init__(self, bus, "/")

2477

_interface = "se.recompile.Mandos"

2478

2479

@dbus_interface_annotations(_interface)

2480

def _foo(self):

2481

return { "org.freedesktop.DBus.Property"

2482

".EmitsChangedSignal":

2483

"false"}

1949

_interface = "se.bsnet.fukt.Mandos"

2484

1950

2485

1951

@dbus.service.signal(_interface, signature="o")

2486

1952

def ClientAdded(self, objpath):

2501

1967

def GetAllClients(self):

2502

1968

"D-Bus method"

2503

1969

return dbus.Array(c.dbus_object_path

2504

for c in

2505

tcp_server.clients.itervalues())

1970

for c in tcp_server.clients)

2506

1971

2507

1972

@dbus.service.method(_interface,

2508

1973

out_signature="a{oa{sv}}")

2510

1975

"D-Bus method"

2511

1976

return dbus.Dictionary(

2512

1977

((c.dbus_object_path, c.GetAll(""))

2513

for c in tcp_server.clients.itervalues()),

1978

for c in tcp_server.clients),

2514

1979

signature="oa{sv}")

2515

1980

2516

1981

@dbus.service.method(_interface, in_signature="o")

2517

1982

def RemoveClient(self, object_path):

2518

1983

"D-Bus method"

2519

for c in tcp_server.clients.itervalues():

1984

for c in tcp_server.clients:

2520

1985

if c.dbus_object_path == object_path:

2521

del tcp_server.clients[c.name]

1986

tcp_server.clients.remove(c)

2522

1987

c.remove_from_connection()

2523

1988

# Don't signal anything except ClientRemoved

2524

1989

c.disable(quiet=True)

2535

2000

"Cleanup function; run on exit"

2536

2001

service.cleanup()

2537

2002

2538

multiprocessing.active_children()

2539

if not (tcp_server.clients or client_settings):

2540

return

2541

2542

# Store client before exiting. Secrets are encrypted with key

2543

# based on what config file has. If config file is

2544

# removed/edited, old secret will thus be unrecovable.

2545

clients = {}

2546

with PGPEngine() as pgp:

2547

for client in tcp_server.clients.itervalues():

2548

key = client_settings[client.name]["secret"]

2549

client.encrypted_secret = pgp.encrypt(client.secret,

2550

key)

2551

client_dict = {}

2552

2553

# A list of attributes that can not be pickled

2554

# + secret.

2555

exclude = set(("bus", "changedstate", "secret",

2556

"checker"))

2557

for name, typ in (inspect.getmembers

2558

(dbus.service.Object)):

2559

exclude.add(name)

2560

2561

client_dict["encrypted_secret"] = (client

2562

.encrypted_secret)

2563

for attr in client.client_structure:

2564

if attr not in exclude:

2565

client_dict[attr] = getattr(client, attr)

2566

2567

clients[client.name] = client_dict

2568

del client_settings[client.name]["secret"]

2569

2570

try:

2571

with (tempfile.NamedTemporaryFile

2572

(mode='wb', suffix=".pickle", prefix='clients-',

2573

dir=os.path.dirname(stored_state_path),

2574

delete=False)) as stored_state:

2575

pickle.dump((clients, client_settings), stored_state)

2576

tempname=stored_state.name

2577

os.rename(tempname, stored_state_path)

2578

except (IOError, OSError) as e:

2579

if not debug:

2580

try:

2581

os.remove(tempname)

2582

except NameError:

2583

pass

2584

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2585

logger.warning("Could not save persistent state: {0}"

2586

.format(os.strerror(e.errno)))

2587

else:

2588

logger.warning("Could not save persistent state:",

2589

exc_info=e)

2590

raise e

2591

2592

# Delete all clients, and settings from config

2593

2003

while tcp_server.clients:

2594

name, client = tcp_server.clients.popitem()

2004

client = tcp_server.clients.pop()

2595

2005

if use_dbus:

2596

2006

client.remove_from_connection()

2007

client.disable_hook = None

2597

2008

# Don't signal anything except ClientRemoved

2598

2009

client.disable(quiet=True)

2599

2010

if use_dbus:

2600

2011

# Emit D-Bus signal

2601

mandos_dbus_service.ClientRemoved(client

2602

.dbus_object_path,

2012

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2603

2013

client.name)

2604

client_settings.clear()

2605

2014

2606

2015

atexit.register(cleanup)

2607

2016

2608

for client in tcp_server.clients.itervalues():

2017

for client in tcp_server.clients:

2609

2018

if use_dbus:

2610

2019

# Emit D-Bus signal

2611

2020

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2612

# Need to initiate checking of clients

2613

if client.enabled:

2614

client.init_checker()

2021

client.enable()

2615

2022

2616

2023

tcp_server.enable()

2617

2024

tcp_server.server_activate()

2620

2027

service.port = tcp_server.socket.getsockname()[1]

2621

2028

if use_ipv6:

2622

2029

logger.info("Now listening on address %r, port %d,"

2623

" flowinfo %d, scope_id %d",

2624

*tcp_server.socket.getsockname())

2030

" flowinfo %d, scope_id %d"

2031

% tcp_server.socket.getsockname())

2625

2032

else: # IPv4

2626

logger.info("Now listening on address %r, port %d",

2627

*tcp_server.socket.getsockname())

2033

logger.info("Now listening on address %r, port %d"

2034

% tcp_server.socket.getsockname())

2628

2035

2629

2036

#service.interface = tcp_server.socket.getsockname()[3]

2630

2037

2633

2040

try:

2634

2041

service.activate()

2635

2042

except dbus.exceptions.DBusException as error:

2636

logger.critical("D-Bus Exception", exc_info=error)

2043

logger.critical("DBusException: %s", error)

2637

2044

cleanup()

2638

2045

sys.exit(1)

2639

2046

# End of Avahi example code

2646

2053

logger.debug("Starting main loop")

2647

2054

main_loop.run()

2648

2055

except AvahiError as error:

2649

logger.critical("Avahi Error", exc_info=error)

2056

logger.critical("AvahiError: %s", error)

2650

2057

cleanup()

2651

2058

sys.exit(1)

2652

2059

except KeyboardInterrupt:

2657

2064

# Must run before the D-Bus bus name gets deregistered

2658

2065

cleanup()

2659

2066

2067

2660

2068

if __name__ == '__main__':

2661

2069

main()