/mandos/trunk : revision 505.3.1

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

import itertools

69

66

70

67

import dbus

71

68

import dbus.service

76

73

import ctypes.util

77

74

import xml.dom.minidom

78

75

import inspect

79

import GnuPGInterface

80

76

81

77

try:

82

78

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

86

82

except ImportError:

87

83

SO_BINDTODEVICE = None

88

84

89

version = "1.5.3"

90

stored_state_file = "clients.pickle"

91

92

logger = logging.getLogger()

85

86

version = "1.4.1"

87

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

93

90

syslogger = (logging.handlers.SysLogHandler

94

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

92

address = str("/dev/log")))

96

97

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

101

except (OSError, AttributeError):

102

def if_nametoindex(interface):

103

"Get an interface index the hard way, i.e. using fcntl()"

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

with contextlib.closing(socket.socket()) as s:

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

111

return interface_index

112

113

114

def initlogger(debug, level=logging.WARNING):

115

"""init logger and add loglevel"""

116

117

syslogger.setFormatter(logging.Formatter

118

('Mandos [%(process)d]: %(levelname)s:'

119

' %(message)s'))

120

logger.addHandler(syslogger)

121

122

if debug:

123

console = logging.StreamHandler()

124

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

125

' [%(process)d]:'

126

' %(levelname)s:'

127

' %(message)s'))

128

logger.addHandler(console)

129

logger.setLevel(level)

130

131

132

class PGPError(Exception):

133

"""Exception if encryption/decryption fails"""

134

pass

135

136

137

class PGPEngine(object):

138

"""A simple class for OpenPGP symmetric encryption & decryption"""

139

def __init__(self):

140

self.gnupg = GnuPGInterface.GnuPG()

141

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

142

self.gnupg = GnuPGInterface.GnuPG()

143

self.gnupg.options.meta_interactive = False

144

self.gnupg.options.homedir = self.tempdir

145

self.gnupg.options.extra_args.extend(['--force-mdc',

146

'--quiet',

147

'--no-use-agent'])

148

149

def __enter__(self):

150

return self

151

152

def __exit__ (self, exc_type, exc_value, traceback):

153

self._cleanup()

154

return False

155

156

def __del__(self):

157

self._cleanup()

158

159

def _cleanup(self):

160

if self.tempdir is not None:

161

# Delete contents of tempdir

162

for root, dirs, files in os.walk(self.tempdir,

163

topdown = False):

164

for filename in files:

165

os.remove(os.path.join(root, filename))

166

for dirname in dirs:

167

os.rmdir(os.path.join(root, dirname))

168

# Remove tempdir

169

os.rmdir(self.tempdir)

170

self.tempdir = None

171

172

def password_encode(self, password):

173

# Passphrase can not be empty and can not contain newlines or

174

# NUL bytes. So we prefix it and hex encode it.

175

return b"mandos" + binascii.hexlify(password)

176

177

def encrypt(self, data, password):

178

self.gnupg.passphrase = self.password_encode(password)

179

with open(os.devnull, "w") as devnull:

180

try:

181

proc = self.gnupg.run(['--symmetric'],

182

create_fhs=['stdin', 'stdout'],

183

attach_fhs={'stderr': devnull})

184

with contextlib.closing(proc.handles['stdin']) as f:

185

f.write(data)

186

with contextlib.closing(proc.handles['stdout']) as f:

187

ciphertext = f.read()

188

proc.wait()

189

except IOError as e:

190

raise PGPError(e)

191

self.gnupg.passphrase = None

192

return ciphertext

193

194

def decrypt(self, data, password):

195

self.gnupg.passphrase = self.password_encode(password)

196

with open(os.devnull, "w") as devnull:

197

try:

198

proc = self.gnupg.run(['--decrypt'],

199

create_fhs=['stdin', 'stdout'],

200

attach_fhs={'stderr': devnull})

201

with contextlib.closing(proc.handles['stdin']) as f:

202

f.write(data)

203

with contextlib.closing(proc.handles['stdout']) as f:

204

decrypted_plaintext = f.read()

205

proc.wait()

206

except IOError as e:

207

raise PGPError(e)

208

self.gnupg.passphrase = None

209

return decrypted_plaintext

210

211

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

212

103

213

104

class AvahiError(Exception):

214

105

def __init__(self, value, *args, **kwargs):

273

164

.GetAlternativeServiceName(self.name))

274

165

logger.info("Changing Zeroconf service name to %r ...",

275

166

self.name)

167

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

170

% self.name))

276

171

self.remove()

277

172

try:

278

173

self.add()

298

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

299

194

self.entry_group_state_changed_match = (

300

195

self.group.connect_to_signal(

301

'StateChanged', self.entry_group_state_changed))

196

'StateChanged', self .entry_group_state_changed))

302

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

303

198

self.name, self.type)

304

199

self.group.AddService(

330

225

try:

331

226

self.group.Free()

332

227

except (dbus.exceptions.UnknownMethodException,

333

dbus.exceptions.DBusException):

228

dbus.exceptions.DBusException) as e:

334

229

pass

335

230

self.group = None

336

231

self.remove()

370

265

self.server_state_changed)

371

266

self.server_state_changed(self.server.GetState())

372

267

373

class AvahiServiceToSyslog(AvahiService):

374

def rename(self):

375

"""Add the new name to the syslog messages"""

376

ret = AvahiService.rename(self)

377

syslogger.setFormatter(logging.Formatter

378

('Mandos (%s) [%%(process)d]:'

379

' %%(levelname)s: %%(message)s'

380

% self.name))

381

return ret

382

268

383

def timedelta_to_milliseconds(td):

269

def _timedelta_to_milliseconds(td):

384

270

"Convert a datetime.timedelta() to milliseconds"

385

271

return ((td.days * 24 * 60 * 60 * 1000)

386

272

+ (td.seconds * 1000)

390

276

"""A representation of a client host served by this server.

391

277

392

278

Attributes:

393

approved: bool(); 'None' if not yet approved/disapproved

279

_approved: bool(); 'None' if not yet approved/disapproved

394

280

approval_delay: datetime.timedelta(); Time to wait for approval

395

281

approval_duration: datetime.timedelta(); Duration of one approval

396

282

checker: subprocess.Popen(); a running checker process used

403

289

instance %(name)s can be used in the command.

404

290

checker_initiator_tag: a gobject event source tag, or None

405

291

created: datetime.datetime(); (UTC) object creation

406

client_structure: Object describing what attributes a client has

407

and is used for storing the client at exit

408

292

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

409

294

disable_initiator_tag: a gobject event source tag, or None

410

295

enabled: bool()

411

296

fingerprint: string (40 or 32 hexadecimal digits); used to

414

299

interval: datetime.timedelta(); How often to start a new checker

415

300

last_approval_request: datetime.datetime(); (UTC) or None

416

301

last_checked_ok: datetime.datetime(); (UTC) or None

417

last_checker_status: integer between 0 and 255 reflecting exit

418

status of last checker. -1 reflects crashed

419

checker, -2 means no checker completed yet.

420

last_enabled: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

421

303

name: string; from the config file, used in log messages and

422

304

D-Bus identifiers

423

305

secret: bytestring; sent verbatim (over TLS) to client

424

306

timeout: datetime.timedelta(); How long from last_checked_ok

425

307

until this client is disabled

426

extended_timeout: extra long timeout when secret has been sent

308

extended_timeout: extra long timeout when password has been sent

427

309

runtime_expansions: Allowed attributes for runtime expansion.

428

310

expires: datetime.datetime(); time (UTC) when a client will be

429

311

disabled, or None

433

315

"created", "enabled", "fingerprint",

434

316

"host", "interval", "last_checked_ok",

435

317

"last_enabled", "name", "timeout")

436

client_defaults = { "timeout": "5m",

437

"extended_timeout": "15m",

438

"interval": "2m",

439

"checker": "fping -q -- %%(host)s",

440

"host": "",

441

"approval_delay": "0s",

442

"approval_duration": "1s",

443

"approved_by_default": "True",

444

"enabled": "True",

445

}

446

318

447

319

def timeout_milliseconds(self):

448

320

"Return the 'timeout' attribute in milliseconds"

449

return timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

450

322

451

323

def extended_timeout_milliseconds(self):

452

324

"Return the 'extended_timeout' attribute in milliseconds"

453

return timedelta_to_milliseconds(self.extended_timeout)

325

return _timedelta_to_milliseconds(self.extended_timeout)

454

326

455

327

def interval_milliseconds(self):

456

328

"Return the 'interval' attribute in milliseconds"

457

return timedelta_to_milliseconds(self.interval)

329

return _timedelta_to_milliseconds(self.interval)

458

330

459

331

def approval_delay_milliseconds(self):

460

return timedelta_to_milliseconds(self.approval_delay)

461

462

@staticmethod

463

def config_parser(config):

464

"""Construct a new dict of client settings of this form:

465

{ client_name: {setting_name: value, ...}, ...}

466

with exceptions for any special settings as defined above.

467

NOTE: Must be a pure function. Must return the same result

468

value given the same arguments.

469

"""

470

settings = {}

471

for client_name in config.sections():

472

section = dict(config.items(client_name))

473

client = settings[client_name] = {}

474

475

client["host"] = section["host"]

476

# Reformat values from string types to Python types

477

client["approved_by_default"] = config.getboolean(

478

client_name, "approved_by_default")

479

client["enabled"] = config.getboolean(client_name,

480

"enabled")

481

482

client["fingerprint"] = (section["fingerprint"].upper()

483

.replace(" ", ""))

484

if "secret" in section:

485

client["secret"] = section["secret"].decode("base64")

486

elif "secfile" in section:

487

with open(os.path.expanduser(os.path.expandvars

488

(section["secfile"])),

489

"rb") as secfile:

490

client["secret"] = secfile.read()

491

else:

492

raise TypeError("No secret or secfile for section %s"

493

% section)

494

client["timeout"] = string_to_delta(section["timeout"])

495

client["extended_timeout"] = string_to_delta(

496

section["extended_timeout"])

497

client["interval"] = string_to_delta(section["interval"])

498

client["approval_delay"] = string_to_delta(

499

section["approval_delay"])

500

client["approval_duration"] = string_to_delta(

501

section["approval_duration"])

502

client["checker_command"] = section["checker"]

503

client["last_approval_request"] = None

504

client["last_checked_ok"] = None

505

client["last_checker_status"] = -2

506

507

return settings

508

509

510

def __init__(self, settings, name = None):

332

return _timedelta_to_milliseconds(self.approval_delay)

333

334

def __init__(self, name = None, disable_hook=None, config=None):

511

335

"""Note: the 'checker' key in 'config' sets the

512

336

'checker_command' attribute and *not* the 'checker'

513

337

attribute."""

514

338

self.name = name

515

# adding all client settings

516

for setting, value in settings.iteritems():

517

setattr(self, setting, value)

518

519

if self.enabled:

520

if not hasattr(self, "last_enabled"):

521

self.last_enabled = datetime.datetime.utcnow()

522

if not hasattr(self, "expires"):

523

self.expires = (datetime.datetime.utcnow()

524

+ self.timeout)

525

else:

526

self.last_enabled = None

527

self.expires = None

528

339

if config is None:

340

config = {}

529

341

logger.debug("Creating client %r", self.name)

530

342

# Uppercase and remove spaces from fingerprint for later

531

343

# comparison purposes with return value from the fingerprint()

532

344

# function

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

533

347

logger.debug(" Fingerprint: %s", self.fingerprint)

534

self.created = settings.get("created",

535

datetime.datetime.utcnow())

536

537

# attributes specific for this server instance

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

351

with open(os.path.expanduser(os.path.expandvars

352

(config["secfile"])),

353

"rb") as secfile:

354

self.secret = secfile.read()

355

else:

356

raise TypeError("No secret or secfile for client %s"

357

% self.name)

358

self.host = config.get("host", "")

359

self.created = datetime.datetime.utcnow()

360

self.enabled = False

361

self.last_approval_request = None

362

self.last_enabled = None

363

self.last_checked_ok = None

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

368

self.disable_hook = disable_hook

538

369

self.checker = None

539

370

self.checker_initiator_tag = None

540

371

self.disable_initiator_tag = None

372

self.expires = None

541

373

self.checker_callback_tag = None

374

self.checker_command = config["checker"]

542

375

self.current_checker_command = None

543

self.approved = None

376

self.last_connect = None

377

self._approved = None

378

self.approved_by_default = config.get("approved_by_default",

379

True)

544

380

self.approvals_pending = 0

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

545

385

self.changedstate = (multiprocessing_manager

546

386

.Condition(multiprocessing_manager

547

387

.Lock()))

548

self.client_structure = [attr for attr in

549

self.__dict__.iterkeys()

550

if not attr.startswith("_")]

551

self.client_structure.append("client_structure")

552

553

for name, t in inspect.getmembers(type(self),

554

lambda obj:

555

isinstance(obj,

556

property)):

557

if not name.startswith("_"):

558

self.client_structure.append(name)

559

388

560

# Send notice to process children that client state has changed

561

389

def send_changedstate(self):

562

with self.changedstate:

563

self.changedstate.notify_all()

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

564

393

565

394

def enable(self):

566

395

"""Start this client's checker and timeout hooks"""

568

397

# Already enabled

569

398

return

570

399

self.send_changedstate()

400

# Schedule a new checker to be started an 'interval' from now,

401

# and every interval from then on.

402

self.checker_initiator_tag = (gobject.timeout_add

403

(self.interval_milliseconds(),

404

self.start_checker))

405

# Schedule a disable() when 'timeout' has passed

571

406

self.expires = datetime.datetime.utcnow() + self.timeout

407

self.disable_initiator_tag = (gobject.timeout_add

408

(self.timeout_milliseconds(),

409

self.disable))

572

410

self.enabled = True

573

411

self.last_enabled = datetime.datetime.utcnow()

574

self.init_checker()

412

# Also start a new checker *right now*.

413

self.start_checker()

575

414

576

415

def disable(self, quiet=True):

577

416

"""Disable this client."""

589

428

gobject.source_remove(self.checker_initiator_tag)

590

429

self.checker_initiator_tag = None

591

430

self.stop_checker()

431

if self.disable_hook:

432

self.disable_hook(self)

592

433

self.enabled = False

593

434

# Do not run this again if called by a gobject.timeout_add

594

435

return False

595

436

596

437

def __del__(self):

438

self.disable_hook = None

597

439

self.disable()

598

440

599

def init_checker(self):

600

# Schedule a new checker to be started an 'interval' from now,

601

# and every interval from then on.

602

self.checker_initiator_tag = (gobject.timeout_add

603

(self.interval_milliseconds(),

604

self.start_checker))

605

# Schedule a disable() when 'timeout' has passed

606

self.disable_initiator_tag = (gobject.timeout_add

607

(self.timeout_milliseconds(),

608

self.disable))

609

# Also start a new checker *right now*.

610

self.start_checker()

611

612

441

def checker_callback(self, pid, condition, command):

613

442

"""The checker has completed, so take appropriate actions."""

614

443

self.checker_callback_tag = None

615

444

self.checker = None

616

445

if os.WIFEXITED(condition):

617

self.last_checker_status = os.WEXITSTATUS(condition)

618

if self.last_checker_status == 0:

446

exitstatus = os.WEXITSTATUS(condition)

447

if exitstatus == 0:

619

448

logger.info("Checker for %(name)s succeeded",

620

449

vars(self))

621

450

self.checked_ok()

623

452

logger.info("Checker for %(name)s failed",

624

453

vars(self))

625

454

else:

626

self.last_checker_status = -1

627

455

logger.warning("Checker for %(name)s crashed?",

628

456

vars(self))

629

457

630

def checked_ok(self):

631

"""Assert that the client has been seen, alive and well."""

632

self.last_checked_ok = datetime.datetime.utcnow()

633

self.last_checker_status = 0

634

self.bump_timeout()

635

636

def bump_timeout(self, timeout=None):

637

"""Bump up the timeout for this client."""

458

def checked_ok(self, timeout=None):

459

"""Bump up the timeout for this client.

460

461

This should only be called when the client has been seen,

462

alive and well.

463

"""

638

464

if timeout is None:

639

465

timeout = self.timeout

466

self.last_checked_ok = datetime.datetime.utcnow()

640

467

if self.disable_initiator_tag is not None:

641

468

gobject.source_remove(self.disable_initiator_tag)

642

469

if getattr(self, "enabled", False):

643

470

self.disable_initiator_tag = (gobject.timeout_add

644

(timedelta_to_milliseconds

471

(_timedelta_to_milliseconds

645

472

(timeout), self.disable))

646

473

self.expires = datetime.datetime.utcnow() + timeout

647

474

772

599

return decorator

773

600

774

601

775

def dbus_interface_annotations(dbus_interface):

776

"""Decorator for marking functions returning interface annotations.

777

778

Usage:

779

780

@dbus_interface_annotations("org.example.Interface")

781

def _foo(self): # Function name does not matter

782

return {"org.freedesktop.DBus.Deprecated": "true",

783

"org.freedesktop.DBus.Property.EmitsChangedSignal":

784

"false"}

785

"""

786

def decorator(func):

787

func._dbus_is_interface = True

788

func._dbus_interface = dbus_interface

789

func._dbus_name = dbus_interface

790

return func

791

return decorator

792

793

794

602

class DBusPropertyException(dbus.exceptions.DBusException):

795

603

"""A base class for D-Bus property-related exceptions

796

604

"""

819

627

"""

820

628

821

629

@staticmethod

822

def _is_dbus_thing(thing):

823

"""Returns a function testing if an attribute is a D-Bus thing

824

825

If called like _is_dbus_thing("method") it returns a function

826

suitable for use as predicate to inspect.getmembers().

827

"""

828

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

829

False)

630

def _is_dbus_property(obj):

631

return getattr(obj, "_dbus_is_property", False)

830

632

831

def _get_all_dbus_things(self, thing):

633

def _get_all_dbus_properties(self):

832

634

"""Returns a generator of (name, attribute) pairs

833

635

"""

834

return ((athing.__get__(self)._dbus_name,

835

athing.__get__(self))

636

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

836

637

for cls in self.__class__.__mro__

837

for name, athing in

838

inspect.getmembers(cls,

839

self._is_dbus_thing(thing)))

638

for name, prop in

639

inspect.getmembers(cls, self._is_dbus_property))

840

640

841

641

def _get_dbus_property(self, interface_name, property_name):

842

642

"""Returns a bound method if one exists which is a D-Bus

844

644

"""

845

645

for cls in self.__class__.__mro__:

846

646

for name, value in (inspect.getmembers

847

(cls,

848

self._is_dbus_thing("property"))):

647

(cls, self._is_dbus_property)):

849

648

if (value._dbus_name == property_name

850

649

and value._dbus_interface == interface_name):

851

650

return value.__get__(self)

880

679

# signatures other than "ay".

881

680

if prop._dbus_signature != "ay":

882

681

raise ValueError

883

value = dbus.ByteArray(b''.join(chr(byte)

884

for byte in value))

682

value = dbus.ByteArray(''.join(unichr(byte)

683

for byte in value))

885

684

prop(value)

886

685

887

686

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

892

691

893

692

Note: Will not include properties with access="write".

894

693

"""

895

properties = {}

896

for name, prop in self._get_all_dbus_things("property"):

694

all = {}

695

for name, prop in self._get_all_dbus_properties():

897

696

if (interface_name

898

697

and interface_name != prop._dbus_interface):

899

698

# Interface non-empty but did not match

903

702

continue

904

703

value = prop()

905

704

if not hasattr(value, "variant_level"):

906

properties[name] = value

705

all[name] = value

907

706

continue

908

properties[name] = type(value)(value, variant_level=

909

value.variant_level+1)

910

return dbus.Dictionary(properties, signature="sv")

707

all[name] = type(value)(value, variant_level=

708

value.variant_level+1)

709

return dbus.Dictionary(all, signature="sv")

911

710

912

711

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

913

712

out_signature="s",

914

713

path_keyword='object_path',

915

714

connection_keyword='connection')

916

715

def Introspect(self, object_path, connection):

917

"""Overloading of standard D-Bus method.

918

919

Inserts property tags and interface annotation tags.

716

"""Standard D-Bus method, overloaded to insert property tags.

920

717

"""

921

718

xmlstring = dbus.service.Object.Introspect(self, object_path,

922

719

connection)

929

726

e.setAttribute("access", prop._dbus_access)

930

727

return e

931

728

for if_tag in document.getElementsByTagName("interface"):

932

# Add property tags

933

729

for tag in (make_tag(document, name, prop)

934

730

for name, prop

935

in self._get_all_dbus_things("property")

731

in self._get_all_dbus_properties()

936

732

if prop._dbus_interface

937

733

== if_tag.getAttribute("name")):

938

734

if_tag.appendChild(tag)

939

# Add interface annotation tags

940

for annotation, value in dict(

941

itertools.chain(

942

*(annotations().iteritems()

943

for name, annotations in

944

self._get_all_dbus_things("interface")

945

if name == if_tag.getAttribute("name")

946

))).iteritems():

947

attr_tag = document.createElement("annotation")

948

attr_tag.setAttribute("name", annotation)

949

attr_tag.setAttribute("value", value)

950

if_tag.appendChild(attr_tag)

951

735

# Add the names to the return values for the

952

736

# "org.freedesktop.DBus.Properties" methods

953

737

if (if_tag.getAttribute("name")

979

763

return dbus.String(dt.isoformat(),

980

764

variant_level=variant_level)

981

765

982

983

766

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

984

767

.__metaclass__):

985

768

"""Applied to an empty subclass of a D-Bus object, this metaclass

988

771

def __new__(mcs, name, bases, attr):

989

772

# Go through all the base classes which could have D-Bus

990

773

# methods, signals, or properties in them

991

old_interface_names = []

992

774

for base in (b for b in bases

993

775

if issubclass(b, dbus.service.Object)):

994

776

# Go though all attributes of the base class

1004

786

alt_interface = (attribute._dbus_interface

1005

787

.replace("se.recompile.Mandos",

1006

788

"se.bsnet.fukt.Mandos"))

1007

if alt_interface != attribute._dbus_interface:

1008

old_interface_names.append(alt_interface)

1009

789

# Is this a D-Bus signal?

1010

790

if getattr(attribute, "_dbus_is_signal", False):

1011

791

# Extract the original non-method function by

1078

858

attribute.func_name,

1079

859

attribute.func_defaults,

1080

860

attribute.func_closure)))

1081

# Is this a D-Bus interface?

1082

elif getattr(attribute, "_dbus_is_interface", False):

1083

# Create a new, but exactly alike, function

1084

# object. Decorate it to be a new D-Bus interface

1085

# with the alternate D-Bus interface name. Add it

1086

# to the class.

1087

attr[attrname] = (dbus_interface_annotations

1088

(alt_interface)

1089

(types.FunctionType

1090

(attribute.func_code,

1091

attribute.func_globals,

1092

attribute.func_name,

1093

attribute.func_defaults,

1094

attribute.func_closure)))

1095

# Deprecate all old interfaces

1096

basename="_AlternateDBusNamesMetaclass_interface_annotation{0}"

1097

for old_interface_name in old_interface_names:

1098

@dbus_interface_annotations(old_interface_name)

1099

def func(self):

1100

return { "org.freedesktop.DBus.Deprecated": "true" }

1101

# Find an unused name

1102

for aname in (basename.format(i) for i in

1103

itertools.count()):

1104

if aname not in attr:

1105

attr[aname] = func

1106

break

1107

861

return type.__new__(mcs, name, bases, attr)

1108

862

1109

1110

863

class ClientDBus(Client, DBusObjectWithProperties):

1111

864

"""A Client class using D-Bus

1112

865

1121

874

# dbus.service.Object doesn't use super(), so we can't either.

1122

875

1123

876

def __init__(self, bus = None, *args, **kwargs):

877

self._approvals_pending = 0

1124

878

self.bus = bus

1125

879

Client.__init__(self, *args, **kwargs)

1126

880

# Only now, when this client is initialized, can it show up on

1138

892

variant_level=1):

1139

893

""" Modify a variable so that it's a property which announces

1140

894

its changes to DBus.

1141

895

1142

896

transform_fun: Function that takes a value and a variant_level

1143

897

and transforms it to a D-Bus type.

1144

898

dbus_name: D-Bus name of the variable

1174

928

checker is not None)

1175

929

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1176

930

"LastCheckedOK")

1177

last_checker_status = notifychangeproperty(dbus.Int16,

1178

"LastCheckerStatus")

1179

931

last_approval_request = notifychangeproperty(

1180

932

datetime_to_dbus, "LastApprovalRequest")

1181

933

approved_by_default = notifychangeproperty(dbus.Boolean,

1182

934

"ApprovedByDefault")

1183

approval_delay = notifychangeproperty(dbus.UInt64,

935

approval_delay = notifychangeproperty(dbus.UInt16,

1184

936

"ApprovalDelay",

1185

937

type_func =

1186

timedelta_to_milliseconds)

938

_timedelta_to_milliseconds)

1187

939

approval_duration = notifychangeproperty(

1188

dbus.UInt64, "ApprovalDuration",

1189

type_func = timedelta_to_milliseconds)

940

dbus.UInt16, "ApprovalDuration",

941

type_func = _timedelta_to_milliseconds)

1190

942

host = notifychangeproperty(dbus.String, "Host")

1191

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

943

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1192

944

type_func =

1193

timedelta_to_milliseconds)

945

_timedelta_to_milliseconds)

1194

946

extended_timeout = notifychangeproperty(

1195

dbus.UInt64, "ExtendedTimeout",

1196

type_func = timedelta_to_milliseconds)

1197

interval = notifychangeproperty(dbus.UInt64,

947

dbus.UInt16, "ExtendedTimeout",

948

type_func = _timedelta_to_milliseconds)

949

interval = notifychangeproperty(dbus.UInt16,

1198

950

"Interval",

1199

951

type_func =

1200

timedelta_to_milliseconds)

952

_timedelta_to_milliseconds)

1201

953

checker_command = notifychangeproperty(dbus.String, "Checker")

1202

954

1203

955

del notifychangeproperty

1245

997

return r

1246

998

1247

999

def _reset_approved(self):

1248

self.approved = None

1000

self._approved = None

1249

1001

return False

1250

1002

1251

1003

def approve(self, value=True):

1252

1004

self.send_changedstate()

1253

self.approved = value

1254

gobject.timeout_add(timedelta_to_milliseconds

1005

self._approved = value

1006

gobject.timeout_add(_timedelta_to_milliseconds

1255

1007

(self.approval_duration),

1256

1008

self._reset_approved)

1257

1009

1259

1011

## D-Bus methods, signals & properties

1260

1012

_interface = "se.recompile.Mandos.Client"

1261

1013

1262

## Interfaces

1263

1264

@dbus_interface_annotations(_interface)

1265

def _foo(self):

1266

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1267

"false"}

1268

1269

1014

## Signals

1270

1015

1271

1016

# CheckerCompleted - signal

1370

1115

access="readwrite")

1371

1116

def ApprovalDuration_dbus_property(self, value=None):

1372

1117

if value is None: # get

1373

return dbus.UInt64(timedelta_to_milliseconds(

1118

return dbus.UInt64(_timedelta_to_milliseconds(

1374

1119

self.approval_duration))

1375

1120

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1376

1121

1390

1135

def Host_dbus_property(self, value=None):

1391

1136

if value is None: # get

1392

1137

return dbus.String(self.host)

1393

self.host = unicode(value)

1138

self.host = value

1394

1139

1395

1140

# Created - property

1396

1141

@dbus_service_property(_interface, signature="s", access="read")

1397

1142

def Created_dbus_property(self):

1398

return datetime_to_dbus(self.created)

1143

return dbus.String(datetime_to_dbus(self.created))

1399

1144

1400

1145

# LastEnabled - property

1401

1146

@dbus_service_property(_interface, signature="s", access="read")

1422

1167

return

1423

1168

return datetime_to_dbus(self.last_checked_ok)

1424

1169

1425

# LastCheckerStatus - property

1426

@dbus_service_property(_interface, signature="n",

1427

access="read")

1428

def LastCheckerStatus_dbus_property(self):

1429

return dbus.Int16(self.last_checker_status)

1430

1431

1170

# Expires - property

1432

1171

@dbus_service_property(_interface, signature="s", access="read")

1433

1172

def Expires_dbus_property(self):

1445

1184

if value is None: # get

1446

1185

return dbus.UInt64(self.timeout_milliseconds())

1447

1186

self.timeout = datetime.timedelta(0, 0, 0, value)

1187

if getattr(self, "disable_initiator_tag", None) is None:

1188

return

1448

1189

# Reschedule timeout

1449

if self.enabled:

1450

now = datetime.datetime.utcnow()

1451

time_to_die = timedelta_to_milliseconds(

1452

(self.last_checked_ok + self.timeout) - now)

1453

if time_to_die <= 0:

1454

# The timeout has passed

1455

self.disable()

1456

else:

1457

self.expires = (now +

1458

datetime.timedelta(milliseconds =

1459

time_to_die))

1460

if (getattr(self, "disable_initiator_tag", None)

1461

is None):

1462

return

1463

gobject.source_remove(self.disable_initiator_tag)

1464

self.disable_initiator_tag = (gobject.timeout_add

1465

(time_to_die,

1466

self.disable))

1190

gobject.source_remove(self.disable_initiator_tag)

1191

self.disable_initiator_tag = None

1192

self.expires = None

1193

time_to_die = _timedelta_to_milliseconds((self

1194

.last_checked_ok

1195

+ self.timeout)

1196

- datetime.datetime

1197

.utcnow())

1198

if time_to_die <= 0:

1199

# The timeout has passed

1200

self.disable()

1201

else:

1202

self.expires = (datetime.datetime.utcnow()

1203

+ datetime.timedelta(milliseconds =

1204

time_to_die))

1205

self.disable_initiator_tag = (gobject.timeout_add

1206

(time_to_die, self.disable))

1467

1207

1468

1208

# ExtendedTimeout - property

1469

1209

@dbus_service_property(_interface, signature="t",

1482

1222

self.interval = datetime.timedelta(0, 0, 0, value)

1483

1223

if getattr(self, "checker_initiator_tag", None) is None:

1484

1224

return

1485

if self.enabled:

1486

# Reschedule checker run

1487

gobject.source_remove(self.checker_initiator_tag)

1488

self.checker_initiator_tag = (gobject.timeout_add

1489

(value, self.start_checker))

1490

self.start_checker() # Start one now, too

1225

# Reschedule checker run

1226

gobject.source_remove(self.checker_initiator_tag)

1227

self.checker_initiator_tag = (gobject.timeout_add

1228

(value, self.start_checker))

1229

self.start_checker() # Start one now, too

1491

1230

1492

1231

# Checker - property

1493

1232

@dbus_service_property(_interface, signature="s",

1495

1234

def Checker_dbus_property(self, value=None):

1496

1235

if value is None: # get

1497

1236

return dbus.String(self.checker_command)

1498

self.checker_command = unicode(value)

1237

self.checker_command = value

1499

1238

1500

1239

# CheckerRunning - property

1501

1240

@dbus_service_property(_interface, signature="b",

1530

1269

raise KeyError()

1531

1270

1532

1271

def __getattribute__(self, name):

1533

if name == '_pipe':

1272

if(name == '_pipe'):

1534

1273

return super(ProxyClient, self).__getattribute__(name)

1535

1274

self._pipe.send(('getattr', name))

1536

1275

data = self._pipe.recv()

1543

1282

return func

1544

1283

1545

1284

def __setattr__(self, name, value):

1546

if name == '_pipe':

1285

if(name == '_pipe'):

1547

1286

return super(ProxyClient, self).__setattr__(name, value)

1548

1287

self._pipe.send(('setattr', name, value))

1549

1288

1550

1551

1289

class ClientDBusTransitional(ClientDBus):

1552

1290

__metaclass__ = AlternateDBusNamesMetaclass

1553

1291

1554

1555

1292

class ClientHandler(socketserver.BaseRequestHandler, object):

1556

1293

"""A class to handle client connections.

1557

1294

1639

1376

client.Rejected("Disabled")

1640

1377

return

1641

1378

1642

if client.approved or not client.approval_delay:

1379

if client._approved or not client.approval_delay:

1643

1380

#We are approved or approval is disabled

1644

1381

break

1645

elif client.approved is None:

1382

elif client._approved is None:

1646

1383

logger.info("Client %s needs approval",

1647

1384

client.name)

1648

1385

if self.server.use_dbus:

1662

1399

time = datetime.datetime.now()

1663

1400

client.changedstate.acquire()

1664

1401

(client.changedstate.wait

1665

(float(client.timedelta_to_milliseconds(delay)

1402

(float(client._timedelta_to_milliseconds(delay)

1666

1403

/ 1000)))

1667

1404

client.changedstate.release()

1668

1405

time2 = datetime.datetime.now()

1694

1431

1695

1432

logger.info("Sending secret to %s", client.name)

1696

1433

# bump the timeout using extended_timeout

1697

client.bump_timeout(client.extended_timeout)

1434

client.checked_ok(client.extended_timeout)

1698

1435

if self.server.use_dbus:

1699

1436

# Emit D-Bus signal

1700

1437

client.GotSecret()

1767

1504

# Convert the buffer to a Python bytestring

1768

1505

fpr = ctypes.string_at(buf, buf_len.value)

1769

1506

# Convert the bytestring to hexadecimal notation

1770

hex_fpr = binascii.hexlify(fpr).upper()

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1771

1508

return hex_fpr

1772

1509

1773

1510

1776

1513

def sub_process_main(self, request, address):

1777

1514

try:

1778

1515

self.finish_request(request, address)

1779

except Exception:

1516

except:

1780

1517

self.handle_error(request, address)

1781

1518

self.close_request(request)

1782

1519

1887

1624

self.enabled = False

1888

1625

self.clients = clients

1889

1626

if self.clients is None:

1890

self.clients = {}

1627

self.clients = set()

1891

1628

self.use_dbus = use_dbus

1892

1629

self.gnutls_priority = gnutls_priority

1893

1630

IPv6_TCPServer.__init__(self, server_address,

1940

1677

fpr = request[1]

1941

1678

address = request[2]

1942

1679

1943

for c in self.clients.itervalues():

1680

for c in self.clients:

1944

1681

if c.fingerprint == fpr:

1945

1682

client = c

1946

1683

break

2030

1767

return timevalue

2031

1768

2032

1769

1770

def if_nametoindex(interface):

1771

"""Call the C function if_nametoindex(), or equivalent

1772

1773

Note: This function cannot accept a unicode string."""

1774

global if_nametoindex

1775

try:

1776

if_nametoindex = (ctypes.cdll.LoadLibrary

1777

(ctypes.util.find_library("c"))

1778

.if_nametoindex)

1779

except (OSError, AttributeError):

1780

logger.warning("Doing if_nametoindex the hard way")

1781

def if_nametoindex(interface):

1782

"Get an interface index the hard way, i.e. using fcntl()"

1783

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1784

with contextlib.closing(socket.socket()) as s:

1785

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1786

struct.pack(str("16s16x"),

1787

interface))

1788

interface_index = struct.unpack(str("I"),

1789

ifreq[16:20])[0]

1790

return interface_index

1791

return if_nametoindex(interface)

1792

1793

2033

1794

def daemon(nochdir = False, noclose = False):

2034

1795

"""See daemon(3). Standard BSD Unix function.

2035

1796

2043

1804

sys.exit()

2044

1805

if not noclose:

2045

1806

# Close all standard open file descriptors

2046

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1807

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2047

1808

if not stat.S_ISCHR(os.fstat(null).st_mode):

2048

1809

raise OSError(errno.ENODEV,

2049

1810

"%s not a character device"

2050

% os.devnull)

1811

% os.path.devnull)

2051

1812

os.dup2(null, sys.stdin.fileno())

2052

1813

os.dup2(null, sys.stdout.fileno())

2053

1814

os.dup2(null, sys.stderr.fileno())

2090

1851

" system bus interface")

2091

1852

parser.add_argument("--no-ipv6", action="store_false",

2092

1853

dest="use_ipv6", help="Do not use IPv6")

2093

parser.add_argument("--no-restore", action="store_false",

2094

dest="restore", help="Do not restore stored"

2095

" state")

2096

parser.add_argument("--statedir", metavar="DIR",

2097

help="Directory to save/restore state in")

2098

2099

1854

options = parser.parse_args()

2100

1855

2101

1856

if options.check:

2114

1869

"use_dbus": "True",

2115

1870

"use_ipv6": "True",

2116

1871

"debuglevel": "",

2117

"restore": "True",

2118

"statedir": "/var/lib/mandos"

2119

1872

}

2120

1873

2121

1874

# Parse config file for server-global settings

2138

1891

# options, if set.

2139

1892

for option in ("interface", "address", "port", "debug",

2140

1893

"priority", "servicename", "configdir",

2141

"use_dbus", "use_ipv6", "debuglevel", "restore",

2142

"statedir"):

1894

"use_dbus", "use_ipv6", "debuglevel"):

2143

1895

value = getattr(options, option)

2144

1896

if value is not None:

2145

1897

server_settings[option] = value

2157

1909

debuglevel = server_settings["debuglevel"]

2158

1910

use_dbus = server_settings["use_dbus"]

2159

1911

use_ipv6 = server_settings["use_ipv6"]

2160

stored_state_path = os.path.join(server_settings["statedir"],

2161

stored_state_file)

2162

2163

if debug:

2164

initlogger(debug, logging.DEBUG)

2165

else:

2166

if not debuglevel:

2167

initlogger(debug)

2168

else:

2169

level = getattr(logging, debuglevel.upper())

2170

initlogger(debug, level)

2171

1912

2172

1913

if server_settings["servicename"] != "Mandos":

2173

1914

syslogger.setFormatter(logging.Formatter

2176

1917

% server_settings["servicename"]))

2177

1918

2178

1919

# Parse config file with clients

2179

client_config = configparser.SafeConfigParser(Client

2180

.client_defaults)

1920

client_defaults = { "timeout": "5m",

1921

"extended_timeout": "15m",

1922

"interval": "2m",

1923

"checker": "fping -q -- %%(host)s",

1924

"host": "",

1925

"approval_delay": "0s",

1926

"approval_duration": "1s",

1927

}

1928

client_config = configparser.SafeConfigParser(client_defaults)

2181

1929

client_config.read(os.path.join(server_settings["configdir"],

2182

1930

"clients.conf"))

2183

1931

2221

1969

if error[0] != errno.EPERM:

2222

1970

raise error

2223

1971

1972

if not debug and not debuglevel:

1973

syslogger.setLevel(logging.WARNING)

1974

console.setLevel(logging.WARNING)

1975

if debuglevel:

1976

level = getattr(logging, debuglevel.upper())

1977

syslogger.setLevel(level)

1978

console.setLevel(level)

1979

2224

1980

if debug:

2225

1981

# Enable all possible GnuTLS debugging

2226

1982

2236

1992

.gnutls_global_set_log_function(debug_gnutls))

2237

1993

2238

1994

# Redirect stdin so all checkers get /dev/null

2239

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1995

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2240

1996

os.dup2(null, sys.stdin.fileno())

2241

1997

if null > 2:

2242

1998

os.close(null)

1999

else:

2000

# No console logging

2001

logger.removeHandler(console)

2243

2002

2244

2003

# Need to fork before connecting to D-Bus

2245

2004

if not debug:

2246

2005

# Close all input and output, do double fork, etc.

2247

2006

daemon()

2248

2007

2249

gobject.threads_init()

2250

2251

2008

global main_loop

2252

2009

# From the Avahi example code

2253

DBusGMainLoop(set_as_default=True)

2010

DBusGMainLoop(set_as_default=True )

2254

2011

main_loop = gobject.MainLoop()

2255

2012

bus = dbus.SystemBus()

2256

2013

# End of Avahi example code

2267

2024

server_settings["use_dbus"] = False

2268

2025

tcp_server.use_dbus = False

2269

2026

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2270

service = AvahiServiceToSyslog(name =

2271

server_settings["servicename"],

2272

servicetype = "_mandos._tcp",

2273

protocol = protocol, bus = bus)

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

2029

protocol = protocol, bus = bus)

2274

2030

if server_settings["interface"]:

2275

2031

service.interface = (if_nametoindex

2276

2032

(str(server_settings["interface"])))

2282

2038

if use_dbus:

2283

2039

client_class = functools.partial(ClientDBusTransitional,

2284

2040

bus = bus)

2285

2286

client_settings = Client.config_parser(client_config)

2287

old_client_settings = {}

2288

clients_data = {}

2289

2290

# Get client data and settings from last running state.

2291

if server_settings["restore"]:

2292

try:

2293

with open(stored_state_path, "rb") as stored_state:

2294

clients_data, old_client_settings = (pickle.load

2295

(stored_state))

2296

os.remove(stored_state_path)

2297

except IOError as e:

2298

logger.warning("Could not load persistent state: {0}"

2299

.format(e))

2300

if e.errno != errno.ENOENT:

2301

raise

2302

except EOFError as e:

2303

logger.warning("Could not load persistent state: "

2304

"EOFError: {0}".format(e))

2305

2306

with PGPEngine() as pgp:

2307

for client_name, client in clients_data.iteritems():

2308

# Decide which value to use after restoring saved state.

2309

# We have three different values: Old config file,

2310

# new config file, and saved state.

2311

# New config value takes precedence if it differs from old

2312

# config value, otherwise use saved state.

2313

for name, value in client_settings[client_name].items():

2314

try:

2315

# For each value in new config, check if it

2316

# differs from the old config value (Except for

2317

# the "secret" attribute)

2318

if (name != "secret" and

2319

value != old_client_settings[client_name]

2320

[name]):

2321

client[name] = value

2322

except KeyError:

2323

pass

2324

2325

# Clients who has passed its expire date can still be

2326

# enabled if its last checker was successful. Clients

2327

# whose checker succeeded before we stored its state is

2328

# assumed to have successfully run all checkers during

2329

# downtime.

2330

if client["enabled"]:

2331

if datetime.datetime.utcnow() >= client["expires"]:

2332

if not client["last_checked_ok"]:

2333

logger.warning(

2334

"disabling client {0} - Client never "

2335

"performed a successful checker"

2336

.format(client_name))

2337

client["enabled"] = False

2338

elif client["last_checker_status"] != 0:

2339

logger.warning(

2340

"disabling client {0} - Client "

2341

"last checker failed with error code {1}"

2342

.format(client_name,

2343

client["last_checker_status"]))

2344

client["enabled"] = False

2345

else:

2346

client["expires"] = (datetime.datetime

2347

.utcnow()

2348

+ client["timeout"])

2349

logger.debug("Last checker succeeded,"

2350

" keeping {0} enabled"

2351

.format(client_name))

2041

def client_config_items(config, section):

2042

special_settings = {

2043

"approved_by_default":

2044

lambda: config.getboolean(section,

2045

"approved_by_default"),

2046

}

2047

for name, value in config.items(section):

2352

2048

try:

2353

client["secret"] = (

2354

pgp.decrypt(client["encrypted_secret"],

2355

client_settings[client_name]

2356

["secret"]))

2357

except PGPError:

2358

# If decryption fails, we use secret from new settings

2359

logger.debug("Failed to decrypt {0} old secret"

2360

.format(client_name))

2361

client["secret"] = (

2362

client_settings[client_name]["secret"])

2363

2364

2365

# Add/remove clients based on new changes made to config

2366

for client_name in (set(old_client_settings)

2367

- set(client_settings)):

2368

del clients_data[client_name]

2369

for client_name in (set(client_settings)

2370

- set(old_client_settings)):

2371

clients_data[client_name] = client_settings[client_name]

2372

2373

# Create all client objects

2374

for client_name, client in clients_data.iteritems():

2375

tcp_server.clients[client_name] = client_class(

2376

name = client_name, settings = client)

2377

2049

yield (name, special_settings[name]())

2050

except KeyError:

2051

yield (name, value)

2052

2053

tcp_server.clients.update(set(

2054

client_class(name = section,

2055

config= dict(client_config_items(

2056

client_config, section)))

2057

for section in client_config.sections()))

2378

2058

if not tcp_server.clients:

2379

2059

logger.warning("No clients defined")

2380

2060

2391

2071

# "pidfile" was never created

2392

2072

pass

2393

2073

del pidfilename

2074

2394

2075

signal.signal(signal.SIGINT, signal.SIG_IGN)

2395

2076

2396

2077

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2397

2078

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2398

2079

2399

2080

if use_dbus:

2400

class MandosDBusService(DBusObjectWithProperties):

2081

class MandosDBusService(dbus.service.Object):

2401

2082

"""A D-Bus proxy object"""

2402

2083

def __init__(self):

2403

2084

dbus.service.Object.__init__(self, bus, "/")

2404

2085

_interface = "se.recompile.Mandos"

2405

2086

2406

@dbus_interface_annotations(_interface)

2407

def _foo(self):

2408

return { "org.freedesktop.DBus.Property"

2409

".EmitsChangedSignal":

2410

"false"}

2411

2412

2087

@dbus.service.signal(_interface, signature="o")

2413

2088

def ClientAdded(self, objpath):

2414

2089

"D-Bus signal"

2428

2103

def GetAllClients(self):

2429

2104

"D-Bus method"

2430

2105

return dbus.Array(c.dbus_object_path

2431

for c in

2432

tcp_server.clients.itervalues())

2106

for c in tcp_server.clients)

2433

2107

2434

2108

@dbus.service.method(_interface,

2435

2109

out_signature="a{oa{sv}}")

2437

2111

"D-Bus method"

2438

2112

return dbus.Dictionary(

2439

2113

((c.dbus_object_path, c.GetAll(""))

2440

for c in tcp_server.clients.itervalues()),

2114

for c in tcp_server.clients),

2441

2115

signature="oa{sv}")

2442

2116

2443

2117

@dbus.service.method(_interface, in_signature="o")

2444

2118

def RemoveClient(self, object_path):

2445

2119

"D-Bus method"

2446

for c in tcp_server.clients.itervalues():

2120

for c in tcp_server.clients:

2447

2121

if c.dbus_object_path == object_path:

2448

del tcp_server.clients[c.name]

2122

tcp_server.clients.remove(c)

2449

2123

c.remove_from_connection()

2450

2124

# Don't signal anything except ClientRemoved

2451

2125

c.disable(quiet=True)

2465

2139

service.cleanup()

2466

2140

2467

2141

multiprocessing.active_children()

2468

if not (tcp_server.clients or client_settings):

2469

return

2470

2471

# Store client before exiting. Secrets are encrypted with key

2472

# based on what config file has. If config file is

2473

# removed/edited, old secret will thus be unrecovable.

2474

clients = {}

2475

with PGPEngine() as pgp:

2476

for client in tcp_server.clients.itervalues():

2477

key = client_settings[client.name]["secret"]

2478

client.encrypted_secret = pgp.encrypt(client.secret,

2479

key)

2480

client_dict = {}

2481

2482

# A list of attributes that can not be pickled

2483

# + secret.

2484

exclude = set(("bus", "changedstate", "secret",

2485

"checker"))

2486

for name, typ in (inspect.getmembers

2487

(dbus.service.Object)):

2488

exclude.add(name)

2489

2490

client_dict["encrypted_secret"] = (client

2491

.encrypted_secret)

2492

for attr in client.client_structure:

2493

if attr not in exclude:

2494

client_dict[attr] = getattr(client, attr)

2495

2496

clients[client.name] = client_dict

2497

del client_settings[client.name]["secret"]

2498

2499

try:

2500

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2501

prefix="clients-",

2502

dir=os.path.dirname

2503

(stored_state_path))

2504

with os.fdopen(tempfd, "wb") as stored_state:

2505

pickle.dump((clients, client_settings), stored_state)

2506

os.rename(tempname, stored_state_path)

2507

except (IOError, OSError) as e:

2508

logger.warning("Could not save persistent state: {0}"

2509

.format(e))

2510

if not debug:

2511

try:

2512

os.remove(tempname)

2513

except NameError:

2514

pass

2515

if e.errno not in set((errno.ENOENT, errno.EACCES,

2516

errno.EEXIST)):

2517

raise e

2518

2519

# Delete all clients, and settings from config

2520

2142

while tcp_server.clients:

2521

name, client = tcp_server.clients.popitem()

2143

client = tcp_server.clients.pop()

2522

2144

if use_dbus:

2523

2145

client.remove_from_connection()

2146

client.disable_hook = None

2524

2147

# Don't signal anything except ClientRemoved

2525

2148

client.disable(quiet=True)

2526

2149

if use_dbus:

2528

2151

mandos_dbus_service.ClientRemoved(client

2529

2152

.dbus_object_path,

2530

2153

client.name)

2531

client_settings.clear()

2532

2154

2533

2155

atexit.register(cleanup)

2534

2156

2535

for client in tcp_server.clients.itervalues():

2157

for client in tcp_server.clients:

2536

2158

if use_dbus:

2537

2159

# Emit D-Bus signal

2538

2160

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2539

# Need to initiate checking of clients

2540

if client.enabled:

2541

client.init_checker()

2161

client.enable()

2542

2162

2543

2163

tcp_server.enable()

2544

2164

tcp_server.server_activate()

2584

2204

# Must run before the D-Bus bus name gets deregistered

2585

2205

cleanup()

2586

2206

2207

2587

2208

if __name__ == '__main__':

2588

2209

main()