/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2011-11-26 22:22:20 UTC
  • mto: (518.1.8 mandos-persistent)
  • mto: This revision was merged to the branch mainline in revision 524.
  • Revision ID: teddy@recompile.se-20111126222220-1ubwjpb5ugqnrhec
Directory with persistent state can now be changed with the "statedir"
option.  The state directory /var/lib/mandos now gets created on
installation.  Added documentation about "restore" and "statedir"
options.

* Makefile (USER, GROUP, STATEDIR): New.
  (maintainer-clean): Also remove "statedir".
  (run-server): Replaced "--no-restore" with "--statedir=statedir".
  (statedir): New.
  (install-server): Make $(STATEDIR) directory.
* debian/mandos.dirs (var/lib/mandos): Added.
* debian/mandos.postinst: Fix ownership of /var/lib/mandos.
* mandos: New --statedir option.
  (stored_state_path): Not global anymore.
  (stored_state_file): New global.
* mandos.conf: Fix whitespace.
  (restore, statedir): Added.
* mandos.conf.xml (OPTIONS, EXAMPLE): Added "restore" and "statedir".
  mandos.xml (SYNOPSIS, OPTIONS): Added "--statedir".
  (FILES): Added "/var/lib/mandos".

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008-2012 Teddy Hogeborn
15
 
# Copyright © 2008-2012 Björn Påhlsson
 
14
# Copyright © 2008-2011 Teddy Hogeborn
 
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
65
65
import types
66
66
import binascii
67
67
import tempfile
68
 
import itertools
69
68
 
70
69
import dbus
71
70
import dbus.service
86
85
    except ImportError:
87
86
        SO_BINDTODEVICE = None
88
87
 
89
 
version = "1.5.3"
 
88
 
 
89
version = "1.4.1"
90
90
stored_state_file = "clients.pickle"
91
91
 
92
92
logger = logging.getLogger()
111
111
        return interface_index
112
112
 
113
113
 
114
 
def initlogger(debug, level=logging.WARNING):
 
114
def initlogger(level=logging.WARNING):
115
115
    """init logger and add loglevel"""
116
116
    
117
117
    syslogger.setFormatter(logging.Formatter
119
119
                            ' %(message)s'))
120
120
    logger.addHandler(syslogger)
121
121
    
122
 
    if debug:
123
 
        console = logging.StreamHandler()
124
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
125
 
                                               ' [%(process)d]:'
126
 
                                               ' %(levelname)s:'
127
 
                                               ' %(message)s'))
128
 
        logger.addHandler(console)
 
122
    console = logging.StreamHandler()
 
123
    console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
124
                                           ' [%(process)d]:'
 
125
                                           ' %(levelname)s:'
 
126
                                           ' %(message)s'))
 
127
    logger.addHandler(console)
129
128
    logger.setLevel(level)
130
129
 
131
130
 
132
 
class PGPError(Exception):
133
 
    """Exception if encryption/decryption fails"""
 
131
class CryptoError(Exception):
134
132
    pass
135
133
 
136
134
 
137
 
class PGPEngine(object):
 
135
class Crypto(object):
138
136
    """A simple class for OpenPGP symmetric encryption & decryption"""
139
137
    def __init__(self):
140
138
        self.gnupg = GnuPGInterface.GnuPG()
143
141
        self.gnupg.options.meta_interactive = False
144
142
        self.gnupg.options.homedir = self.tempdir
145
143
        self.gnupg.options.extra_args.extend(['--force-mdc',
146
 
                                              '--quiet',
147
 
                                              '--no-use-agent'])
 
144
                                              '--quiet'])
148
145
    
149
146
    def __enter__(self):
150
147
        return self
176
173
    
177
174
    def encrypt(self, data, password):
178
175
        self.gnupg.passphrase = self.password_encode(password)
179
 
        with open(os.devnull, "w") as devnull:
 
176
        with open(os.devnull) as devnull:
180
177
            try:
181
178
                proc = self.gnupg.run(['--symmetric'],
182
179
                                      create_fhs=['stdin', 'stdout'],
187
184
                    ciphertext = f.read()
188
185
                proc.wait()
189
186
            except IOError as e:
190
 
                raise PGPError(e)
 
187
                raise CryptoError(e)
191
188
        self.gnupg.passphrase = None
192
189
        return ciphertext
193
190
    
194
191
    def decrypt(self, data, password):
195
192
        self.gnupg.passphrase = self.password_encode(password)
196
 
        with open(os.devnull, "w") as devnull:
 
193
        with open(os.devnull) as devnull:
197
194
            try:
198
195
                proc = self.gnupg.run(['--decrypt'],
199
196
                                      create_fhs=['stdin', 'stdout'],
200
197
                                      attach_fhs={'stderr': devnull})
201
 
                with contextlib.closing(proc.handles['stdin']) as f:
 
198
                with contextlib.closing(proc.handles['stdin'] ) as f:
202
199
                    f.write(data)
203
200
                with contextlib.closing(proc.handles['stdout']) as f:
204
201
                    decrypted_plaintext = f.read()
205
202
                proc.wait()
206
203
            except IOError as e:
207
 
                raise PGPError(e)
 
204
                raise CryptoError(e)
208
205
        self.gnupg.passphrase = None
209
206
        return decrypted_plaintext
210
207
 
380
377
                                % self.name))
381
378
        return ret
382
379
 
383
 
def timedelta_to_milliseconds(td):
 
380
def _timedelta_to_milliseconds(td):
384
381
    "Convert a datetime.timedelta() to milliseconds"
385
382
    return ((td.days * 24 * 60 * 60 * 1000)
386
383
            + (td.seconds * 1000)
390
387
    """A representation of a client host served by this server.
391
388
    
392
389
    Attributes:
393
 
    approved:   bool(); 'None' if not yet approved/disapproved
 
390
    _approved:   bool(); 'None' if not yet approved/disapproved
394
391
    approval_delay: datetime.timedelta(); Time to wait for approval
395
392
    approval_duration: datetime.timedelta(); Duration of one approval
396
393
    checker:    subprocess.Popen(); a running checker process used
414
411
    interval:   datetime.timedelta(); How often to start a new checker
415
412
    last_approval_request: datetime.datetime(); (UTC) or None
416
413
    last_checked_ok: datetime.datetime(); (UTC) or None
 
414
 
417
415
    last_checker_status: integer between 0 and 255 reflecting exit
418
416
                         status of last checker. -1 reflects crashed
419
 
                         checker, -2 means no checker completed yet.
420
 
    last_enabled: datetime.datetime(); (UTC) or None
 
417
                         checker, or None.
 
418
    last_enabled: datetime.datetime(); (UTC)
421
419
    name:       string; from the config file, used in log messages and
422
420
                        D-Bus identifiers
423
421
    secret:     bytestring; sent verbatim (over TLS) to client
424
422
    timeout:    datetime.timedelta(); How long from last_checked_ok
425
423
                                      until this client is disabled
426
 
    extended_timeout:   extra long timeout when secret has been sent
 
424
    extended_timeout:   extra long timeout when password has been sent
427
425
    runtime_expansions: Allowed attributes for runtime expansion.
428
426
    expires:    datetime.datetime(); time (UTC) when a client will be
429
427
                disabled, or None
433
431
                          "created", "enabled", "fingerprint",
434
432
                          "host", "interval", "last_checked_ok",
435
433
                          "last_enabled", "name", "timeout")
436
 
    client_defaults = { "timeout": "5m",
437
 
                        "extended_timeout": "15m",
438
 
                        "interval": "2m",
439
 
                        "checker": "fping -q -- %%(host)s",
440
 
                        "host": "",
441
 
                        "approval_delay": "0s",
442
 
                        "approval_duration": "1s",
443
 
                        "approved_by_default": "True",
444
 
                        "enabled": "True",
445
 
                        }
446
434
    
447
435
    def timeout_milliseconds(self):
448
436
        "Return the 'timeout' attribute in milliseconds"
449
 
        return timedelta_to_milliseconds(self.timeout)
 
437
        return _timedelta_to_milliseconds(self.timeout)
450
438
    
451
439
    def extended_timeout_milliseconds(self):
452
440
        "Return the 'extended_timeout' attribute in milliseconds"
453
 
        return timedelta_to_milliseconds(self.extended_timeout)
 
441
        return _timedelta_to_milliseconds(self.extended_timeout)
454
442
    
455
443
    def interval_milliseconds(self):
456
444
        "Return the 'interval' attribute in milliseconds"
457
 
        return timedelta_to_milliseconds(self.interval)
 
445
        return _timedelta_to_milliseconds(self.interval)
458
446
    
459
447
    def approval_delay_milliseconds(self):
460
 
        return timedelta_to_milliseconds(self.approval_delay)
461
 
 
462
 
    @staticmethod
463
 
    def config_parser(config):
464
 
        """Construct a new dict of client settings of this form:
465
 
        { client_name: {setting_name: value, ...}, ...}
466
 
        with exceptions for any special settings as defined above.
467
 
        NOTE: Must be a pure function. Must return the same result
468
 
        value given the same arguments.
469
 
        """
470
 
        settings = {}
471
 
        for client_name in config.sections():
472
 
            section = dict(config.items(client_name))
473
 
            client = settings[client_name] = {}
474
 
            
475
 
            client["host"] = section["host"]
476
 
            # Reformat values from string types to Python types
477
 
            client["approved_by_default"] = config.getboolean(
478
 
                client_name, "approved_by_default")
479
 
            client["enabled"] = config.getboolean(client_name,
480
 
                                                  "enabled")
481
 
            
482
 
            client["fingerprint"] = (section["fingerprint"].upper()
483
 
                                     .replace(" ", ""))
484
 
            if "secret" in section:
485
 
                client["secret"] = section["secret"].decode("base64")
486
 
            elif "secfile" in section:
487
 
                with open(os.path.expanduser(os.path.expandvars
488
 
                                             (section["secfile"])),
489
 
                          "rb") as secfile:
490
 
                    client["secret"] = secfile.read()
491
 
            else:
492
 
                raise TypeError("No secret or secfile for section %s"
493
 
                                % section)
494
 
            client["timeout"] = string_to_delta(section["timeout"])
495
 
            client["extended_timeout"] = string_to_delta(
496
 
                section["extended_timeout"])
497
 
            client["interval"] = string_to_delta(section["interval"])
498
 
            client["approval_delay"] = string_to_delta(
499
 
                section["approval_delay"])
500
 
            client["approval_duration"] = string_to_delta(
501
 
                section["approval_duration"])
502
 
            client["checker_command"] = section["checker"]
503
 
            client["last_approval_request"] = None
504
 
            client["last_checked_ok"] = None
505
 
            client["last_checker_status"] = -2
506
 
        
507
 
        return settings
508
 
        
509
 
        
510
 
    def __init__(self, settings, name = None):
 
448
        return _timedelta_to_milliseconds(self.approval_delay)
 
449
    
 
450
    def __init__(self, name = None, config=None):
511
451
        """Note: the 'checker' key in 'config' sets the
512
452
        'checker_command' attribute and *not* the 'checker'
513
453
        attribute."""
514
454
        self.name = name
515
 
        # adding all client settings
516
 
        for setting, value in settings.iteritems():
517
 
            setattr(self, setting, value)
518
 
        
519
 
        if self.enabled:
520
 
            if not hasattr(self, "last_enabled"):
521
 
                self.last_enabled = datetime.datetime.utcnow()
522
 
            if not hasattr(self, "expires"):
523
 
                self.expires = (datetime.datetime.utcnow()
524
 
                                + self.timeout)
525
 
        else:
526
 
            self.last_enabled = None
527
 
            self.expires = None
528
 
       
 
455
        if config is None:
 
456
            config = {}
529
457
        logger.debug("Creating client %r", self.name)
530
458
        # Uppercase and remove spaces from fingerprint for later
531
459
        # comparison purposes with return value from the fingerprint()
532
460
        # function
 
461
        self.fingerprint = (config["fingerprint"].upper()
 
462
                            .replace(" ", ""))
533
463
        logger.debug("  Fingerprint: %s", self.fingerprint)
534
 
        self.created = settings.get("created",
535
 
                                    datetime.datetime.utcnow())
536
 
 
537
 
        # attributes specific for this server instance
 
464
        if "secret" in config:
 
465
            self.secret = config["secret"].decode("base64")
 
466
        elif "secfile" in config:
 
467
            with open(os.path.expanduser(os.path.expandvars
 
468
                                         (config["secfile"])),
 
469
                      "rb") as secfile:
 
470
                self.secret = secfile.read()
 
471
        else:
 
472
            raise TypeError("No secret or secfile for client %s"
 
473
                            % self.name)
 
474
        self.host = config.get("host", "")
 
475
        self.created = datetime.datetime.utcnow()
 
476
        self.enabled = True
 
477
        self.last_approval_request = None
 
478
        self.last_enabled = datetime.datetime.utcnow()
 
479
        self.last_checked_ok = None
 
480
        self.last_checker_status = None
 
481
        self.timeout = string_to_delta(config["timeout"])
 
482
        self.extended_timeout = string_to_delta(config
 
483
                                                ["extended_timeout"])
 
484
        self.interval = string_to_delta(config["interval"])
538
485
        self.checker = None
539
486
        self.checker_initiator_tag = None
540
487
        self.disable_initiator_tag = None
 
488
        self.expires = datetime.datetime.utcnow() + self.timeout
541
489
        self.checker_callback_tag = None
 
490
        self.checker_command = config["checker"]
542
491
        self.current_checker_command = None
543
 
        self.approved = None
 
492
        self._approved = None
 
493
        self.approved_by_default = config.get("approved_by_default",
 
494
                                              True)
544
495
        self.approvals_pending = 0
 
496
        self.approval_delay = string_to_delta(
 
497
            config["approval_delay"])
 
498
        self.approval_duration = string_to_delta(
 
499
            config["approval_duration"])
545
500
        self.changedstate = (multiprocessing_manager
546
501
                             .Condition(multiprocessing_manager
547
502
                                        .Lock()))
614
569
        self.checker_callback_tag = None
615
570
        self.checker = None
616
571
        if os.WIFEXITED(condition):
617
 
            self.last_checker_status = os.WEXITSTATUS(condition)
 
572
            self.last_checker_status =  os.WEXITSTATUS(condition)
618
573
            if self.last_checker_status == 0:
619
574
                logger.info("Checker for %(name)s succeeded",
620
575
                            vars(self))
627
582
            logger.warning("Checker for %(name)s crashed?",
628
583
                           vars(self))
629
584
    
630
 
    def checked_ok(self):
631
 
        """Assert that the client has been seen, alive and well."""
632
 
        self.last_checked_ok = datetime.datetime.utcnow()
633
 
        self.last_checker_status = 0
634
 
        self.bump_timeout()
635
 
    
636
 
    def bump_timeout(self, timeout=None):
637
 
        """Bump up the timeout for this client."""
 
585
    def checked_ok(self, timeout=None):
 
586
        """Bump up the timeout for this client.
 
587
        
 
588
        This should only be called when the client has been seen,
 
589
        alive and well.
 
590
        """
638
591
        if timeout is None:
639
592
            timeout = self.timeout
 
593
        self.last_checked_ok = datetime.datetime.utcnow()
640
594
        if self.disable_initiator_tag is not None:
641
595
            gobject.source_remove(self.disable_initiator_tag)
642
596
        if getattr(self, "enabled", False):
643
597
            self.disable_initiator_tag = (gobject.timeout_add
644
 
                                          (timedelta_to_milliseconds
 
598
                                          (_timedelta_to_milliseconds
645
599
                                           (timeout), self.disable))
646
600
            self.expires = datetime.datetime.utcnow() + timeout
647
601
    
772
726
    return decorator
773
727
 
774
728
 
775
 
def dbus_interface_annotations(dbus_interface):
776
 
    """Decorator for marking functions returning interface annotations.
777
 
    
778
 
    Usage:
779
 
    
780
 
    @dbus_interface_annotations("org.example.Interface")
781
 
    def _foo(self):  # Function name does not matter
782
 
        return {"org.freedesktop.DBus.Deprecated": "true",
783
 
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
784
 
                    "false"}
785
 
    """
786
 
    def decorator(func):
787
 
        func._dbus_is_interface = True
788
 
        func._dbus_interface = dbus_interface
789
 
        func._dbus_name = dbus_interface
790
 
        return func
791
 
    return decorator
792
 
 
793
 
 
794
 
def dbus_annotations(annotations):
795
 
    """Decorator to annotate D-Bus methods, signals or properties
796
 
    Usage:
797
 
    
798
 
    @dbus_service_property("org.example.Interface", signature="b",
799
 
                           access="r")
800
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
801
 
                        "org.freedesktop.DBus.Property."
802
 
                        "EmitsChangedSignal": "false"})
803
 
    def Property_dbus_property(self):
804
 
        return dbus.Boolean(False)
805
 
    """
806
 
    def decorator(func):
807
 
        func._dbus_annotations = annotations
808
 
        return func
809
 
    return decorator
810
 
 
811
 
 
812
729
class DBusPropertyException(dbus.exceptions.DBusException):
813
730
    """A base class for D-Bus property-related exceptions
814
731
    """
837
754
    """
838
755
    
839
756
    @staticmethod
840
 
    def _is_dbus_thing(thing):
841
 
        """Returns a function testing if an attribute is a D-Bus thing
842
 
        
843
 
        If called like _is_dbus_thing("method") it returns a function
844
 
        suitable for use as predicate to inspect.getmembers().
845
 
        """
846
 
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
847
 
                                   False)
 
757
    def _is_dbus_property(obj):
 
758
        return getattr(obj, "_dbus_is_property", False)
848
759
    
849
 
    def _get_all_dbus_things(self, thing):
 
760
    def _get_all_dbus_properties(self):
850
761
        """Returns a generator of (name, attribute) pairs
851
762
        """
852
 
        return ((getattr(athing.__get__(self), "_dbus_name",
853
 
                         name),
854
 
                 athing.__get__(self))
 
763
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
855
764
                for cls in self.__class__.__mro__
856
 
                for name, athing in
857
 
                inspect.getmembers(cls,
858
 
                                   self._is_dbus_thing(thing)))
 
765
                for name, prop in
 
766
                inspect.getmembers(cls, self._is_dbus_property))
859
767
    
860
768
    def _get_dbus_property(self, interface_name, property_name):
861
769
        """Returns a bound method if one exists which is a D-Bus
863
771
        """
864
772
        for cls in  self.__class__.__mro__:
865
773
            for name, value in (inspect.getmembers
866
 
                                (cls,
867
 
                                 self._is_dbus_thing("property"))):
 
774
                                (cls, self._is_dbus_property)):
868
775
                if (value._dbus_name == property_name
869
776
                    and value._dbus_interface == interface_name):
870
777
                    return value.__get__(self)
899
806
            # signatures other than "ay".
900
807
            if prop._dbus_signature != "ay":
901
808
                raise ValueError
902
 
            value = dbus.ByteArray(b''.join(chr(byte)
903
 
                                            for byte in value))
 
809
            value = dbus.ByteArray(''.join(unichr(byte)
 
810
                                           for byte in value))
904
811
        prop(value)
905
812
    
906
813
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
912
819
        Note: Will not include properties with access="write".
913
820
        """
914
821
        properties = {}
915
 
        for name, prop in self._get_all_dbus_things("property"):
 
822
        for name, prop in self._get_all_dbus_properties():
916
823
            if (interface_name
917
824
                and interface_name != prop._dbus_interface):
918
825
                # Interface non-empty but did not match
933
840
                         path_keyword='object_path',
934
841
                         connection_keyword='connection')
935
842
    def Introspect(self, object_path, connection):
936
 
        """Overloading of standard D-Bus method.
937
 
        
938
 
        Inserts property tags and interface annotation tags.
 
843
        """Standard D-Bus method, overloaded to insert property tags.
939
844
        """
940
845
        xmlstring = dbus.service.Object.Introspect(self, object_path,
941
846
                                                   connection)
948
853
                e.setAttribute("access", prop._dbus_access)
949
854
                return e
950
855
            for if_tag in document.getElementsByTagName("interface"):
951
 
                # Add property tags
952
856
                for tag in (make_tag(document, name, prop)
953
857
                            for name, prop
954
 
                            in self._get_all_dbus_things("property")
 
858
                            in self._get_all_dbus_properties()
955
859
                            if prop._dbus_interface
956
860
                            == if_tag.getAttribute("name")):
957
861
                    if_tag.appendChild(tag)
958
 
                # Add annotation tags
959
 
                for typ in ("method", "signal", "property"):
960
 
                    for tag in if_tag.getElementsByTagName(typ):
961
 
                        annots = dict()
962
 
                        for name, prop in (self.
963
 
                                           _get_all_dbus_things(typ)):
964
 
                            if (name == tag.getAttribute("name")
965
 
                                and prop._dbus_interface
966
 
                                == if_tag.getAttribute("name")):
967
 
                                annots.update(getattr
968
 
                                              (prop,
969
 
                                               "_dbus_annotations",
970
 
                                               {}))
971
 
                        for name, value in annots.iteritems():
972
 
                            ann_tag = document.createElement(
973
 
                                "annotation")
974
 
                            ann_tag.setAttribute("name", name)
975
 
                            ann_tag.setAttribute("value", value)
976
 
                            tag.appendChild(ann_tag)
977
 
                # Add interface annotation tags
978
 
                for annotation, value in dict(
979
 
                    itertools.chain(
980
 
                        *(annotations().iteritems()
981
 
                          for name, annotations in
982
 
                          self._get_all_dbus_things("interface")
983
 
                          if name == if_tag.getAttribute("name")
984
 
                          ))).iteritems():
985
 
                    ann_tag = document.createElement("annotation")
986
 
                    ann_tag.setAttribute("name", annotation)
987
 
                    ann_tag.setAttribute("value", value)
988
 
                    if_tag.appendChild(ann_tag)
989
862
                # Add the names to the return values for the
990
863
                # "org.freedesktop.DBus.Properties" methods
991
864
                if (if_tag.getAttribute("name")
1026
899
    def __new__(mcs, name, bases, attr):
1027
900
        # Go through all the base classes which could have D-Bus
1028
901
        # methods, signals, or properties in them
1029
 
        old_interface_names = []
1030
902
        for base in (b for b in bases
1031
903
                     if issubclass(b, dbus.service.Object)):
1032
904
            # Go though all attributes of the base class
1042
914
                alt_interface = (attribute._dbus_interface
1043
915
                                 .replace("se.recompile.Mandos",
1044
916
                                          "se.bsnet.fukt.Mandos"))
1045
 
                if alt_interface != attribute._dbus_interface:
1046
 
                    old_interface_names.append(alt_interface)
1047
917
                # Is this a D-Bus signal?
1048
918
                if getattr(attribute, "_dbus_is_signal", False):
1049
919
                    # Extract the original non-method function by
1064
934
                                nonmethod_func.func_name,
1065
935
                                nonmethod_func.func_defaults,
1066
936
                                nonmethod_func.func_closure)))
1067
 
                    # Copy annotations, if any
1068
 
                    try:
1069
 
                        new_function._dbus_annotations = (
1070
 
                            dict(attribute._dbus_annotations))
1071
 
                    except AttributeError:
1072
 
                        pass
1073
937
                    # Define a creator of a function to call both the
1074
938
                    # old and new functions, so both the old and new
1075
939
                    # signals gets sent when the function is called
1103
967
                                        attribute.func_name,
1104
968
                                        attribute.func_defaults,
1105
969
                                        attribute.func_closure)))
1106
 
                    # Copy annotations, if any
1107
 
                    try:
1108
 
                        attr[attrname]._dbus_annotations = (
1109
 
                            dict(attribute._dbus_annotations))
1110
 
                    except AttributeError:
1111
 
                        pass
1112
970
                # Is this a D-Bus property?
1113
971
                elif getattr(attribute, "_dbus_is_property", False):
1114
972
                    # Create a new, but exactly alike, function
1128
986
                                        attribute.func_name,
1129
987
                                        attribute.func_defaults,
1130
988
                                        attribute.func_closure)))
1131
 
                    # Copy annotations, if any
1132
 
                    try:
1133
 
                        attr[attrname]._dbus_annotations = (
1134
 
                            dict(attribute._dbus_annotations))
1135
 
                    except AttributeError:
1136
 
                        pass
1137
 
                # Is this a D-Bus interface?
1138
 
                elif getattr(attribute, "_dbus_is_interface", False):
1139
 
                    # Create a new, but exactly alike, function
1140
 
                    # object.  Decorate it to be a new D-Bus interface
1141
 
                    # with the alternate D-Bus interface name.  Add it
1142
 
                    # to the class.
1143
 
                    attr[attrname] = (dbus_interface_annotations
1144
 
                                      (alt_interface)
1145
 
                                      (types.FunctionType
1146
 
                                       (attribute.func_code,
1147
 
                                        attribute.func_globals,
1148
 
                                        attribute.func_name,
1149
 
                                        attribute.func_defaults,
1150
 
                                        attribute.func_closure)))
1151
 
        # Deprecate all old interfaces
1152
 
        basename="_AlternateDBusNamesMetaclass_interface_annotation{0}"
1153
 
        for old_interface_name in old_interface_names:
1154
 
            @dbus_interface_annotations(old_interface_name)
1155
 
            def func(self):
1156
 
                return { "org.freedesktop.DBus.Deprecated": "true" }
1157
 
            # Find an unused name
1158
 
            for aname in (basename.format(i) for i in
1159
 
                          itertools.count()):
1160
 
                if aname not in attr:
1161
 
                    attr[aname] = func
1162
 
                    break
1163
989
        return type.__new__(mcs, name, bases, attr)
1164
990
 
1165
991
 
1179
1005
    def __init__(self, bus = None, *args, **kwargs):
1180
1006
        self.bus = bus
1181
1007
        Client.__init__(self, *args, **kwargs)
 
1008
        
 
1009
        self._approvals_pending = 0
1182
1010
        # Only now, when this client is initialized, can it show up on
1183
1011
        # the D-Bus
1184
1012
        client_object_name = unicode(self.name).translate(
1230
1058
                                       checker is not None)
1231
1059
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1232
1060
                                           "LastCheckedOK")
1233
 
    last_checker_status = notifychangeproperty(dbus.Int16,
1234
 
                                               "LastCheckerStatus")
1235
1061
    last_approval_request = notifychangeproperty(
1236
1062
        datetime_to_dbus, "LastApprovalRequest")
1237
1063
    approved_by_default = notifychangeproperty(dbus.Boolean,
1238
1064
                                               "ApprovedByDefault")
1239
 
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1065
    approval_delay = notifychangeproperty(dbus.UInt16,
1240
1066
                                          "ApprovalDelay",
1241
1067
                                          type_func =
1242
 
                                          timedelta_to_milliseconds)
 
1068
                                          _timedelta_to_milliseconds)
1243
1069
    approval_duration = notifychangeproperty(
1244
 
        dbus.UInt64, "ApprovalDuration",
1245
 
        type_func = timedelta_to_milliseconds)
 
1070
        dbus.UInt16, "ApprovalDuration",
 
1071
        type_func = _timedelta_to_milliseconds)
1246
1072
    host = notifychangeproperty(dbus.String, "Host")
1247
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1073
    timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1248
1074
                                   type_func =
1249
 
                                   timedelta_to_milliseconds)
 
1075
                                   _timedelta_to_milliseconds)
1250
1076
    extended_timeout = notifychangeproperty(
1251
 
        dbus.UInt64, "ExtendedTimeout",
1252
 
        type_func = timedelta_to_milliseconds)
1253
 
    interval = notifychangeproperty(dbus.UInt64,
 
1077
        dbus.UInt16, "ExtendedTimeout",
 
1078
        type_func = _timedelta_to_milliseconds)
 
1079
    interval = notifychangeproperty(dbus.UInt16,
1254
1080
                                    "Interval",
1255
1081
                                    type_func =
1256
 
                                    timedelta_to_milliseconds)
 
1082
                                    _timedelta_to_milliseconds)
1257
1083
    checker_command = notifychangeproperty(dbus.String, "Checker")
1258
1084
    
1259
1085
    del notifychangeproperty
1301
1127
        return r
1302
1128
    
1303
1129
    def _reset_approved(self):
1304
 
        self.approved = None
 
1130
        self._approved = None
1305
1131
        return False
1306
1132
    
1307
1133
    def approve(self, value=True):
1308
1134
        self.send_changedstate()
1309
 
        self.approved = value
1310
 
        gobject.timeout_add(timedelta_to_milliseconds
 
1135
        self._approved = value
 
1136
        gobject.timeout_add(_timedelta_to_milliseconds
1311
1137
                            (self.approval_duration),
1312
1138
                            self._reset_approved)
1313
1139
    
1315
1141
    ## D-Bus methods, signals & properties
1316
1142
    _interface = "se.recompile.Mandos.Client"
1317
1143
    
1318
 
    ## Interfaces
1319
 
    
1320
 
    @dbus_interface_annotations(_interface)
1321
 
    def _foo(self):
1322
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1323
 
                     "false"}
1324
 
    
1325
1144
    ## Signals
1326
1145
    
1327
1146
    # CheckerCompleted - signal
1363
1182
        "D-Bus signal"
1364
1183
        return self.need_approval()
1365
1184
    
 
1185
    # NeRwequest - signal
 
1186
    @dbus.service.signal(_interface, signature="s")
 
1187
    def NewRequest(self, ip):
 
1188
        """D-Bus signal
 
1189
        Is sent after a client request a password.
 
1190
        """
 
1191
        pass
 
1192
    
1366
1193
    ## Methods
1367
1194
    
1368
1195
    # Approve - method
1426
1253
                           access="readwrite")
1427
1254
    def ApprovalDuration_dbus_property(self, value=None):
1428
1255
        if value is None:       # get
1429
 
            return dbus.UInt64(timedelta_to_milliseconds(
 
1256
            return dbus.UInt64(_timedelta_to_milliseconds(
1430
1257
                    self.approval_duration))
1431
1258
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1432
1259
    
1446
1273
    def Host_dbus_property(self, value=None):
1447
1274
        if value is None:       # get
1448
1275
            return dbus.String(self.host)
1449
 
        self.host = unicode(value)
 
1276
        self.host = value
1450
1277
    
1451
1278
    # Created - property
1452
1279
    @dbus_service_property(_interface, signature="s", access="read")
1453
1280
    def Created_dbus_property(self):
1454
 
        return datetime_to_dbus(self.created)
 
1281
        return dbus.String(datetime_to_dbus(self.created))
1455
1282
    
1456
1283
    # LastEnabled - property
1457
1284
    @dbus_service_property(_interface, signature="s", access="read")
1478
1305
            return
1479
1306
        return datetime_to_dbus(self.last_checked_ok)
1480
1307
    
1481
 
    # LastCheckerStatus - property
1482
 
    @dbus_service_property(_interface, signature="n",
1483
 
                           access="read")
1484
 
    def LastCheckerStatus_dbus_property(self):
1485
 
        return dbus.Int16(self.last_checker_status)
1486
 
    
1487
1308
    # Expires - property
1488
1309
    @dbus_service_property(_interface, signature="s", access="read")
1489
1310
    def Expires_dbus_property(self):
1501
1322
        if value is None:       # get
1502
1323
            return dbus.UInt64(self.timeout_milliseconds())
1503
1324
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
1325
        if getattr(self, "disable_initiator_tag", None) is None:
 
1326
            return
1504
1327
        # Reschedule timeout
1505
 
        if self.enabled:
1506
 
            now = datetime.datetime.utcnow()
1507
 
            time_to_die = timedelta_to_milliseconds(
1508
 
                (self.last_checked_ok + self.timeout) - now)
1509
 
            if time_to_die <= 0:
1510
 
                # The timeout has passed
1511
 
                self.disable()
1512
 
            else:
1513
 
                self.expires = (now +
1514
 
                                datetime.timedelta(milliseconds =
1515
 
                                                   time_to_die))
1516
 
                if (getattr(self, "disable_initiator_tag", None)
1517
 
                    is None):
1518
 
                    return
1519
 
                gobject.source_remove(self.disable_initiator_tag)
1520
 
                self.disable_initiator_tag = (gobject.timeout_add
1521
 
                                              (time_to_die,
1522
 
                                               self.disable))
 
1328
        gobject.source_remove(self.disable_initiator_tag)
 
1329
        self.disable_initiator_tag = None
 
1330
        self.expires = None
 
1331
        time_to_die = _timedelta_to_milliseconds((self
 
1332
                                                  .last_checked_ok
 
1333
                                                  + self.timeout)
 
1334
                                                 - datetime.datetime
 
1335
                                                 .utcnow())
 
1336
        if time_to_die <= 0:
 
1337
            # The timeout has passed
 
1338
            self.disable()
 
1339
        else:
 
1340
            self.expires = (datetime.datetime.utcnow()
 
1341
                            + datetime.timedelta(milliseconds =
 
1342
                                                 time_to_die))
 
1343
            self.disable_initiator_tag = (gobject.timeout_add
 
1344
                                          (time_to_die, self.disable))
1523
1345
    
1524
1346
    # ExtendedTimeout - property
1525
1347
    @dbus_service_property(_interface, signature="t",
1538
1360
        self.interval = datetime.timedelta(0, 0, 0, value)
1539
1361
        if getattr(self, "checker_initiator_tag", None) is None:
1540
1362
            return
1541
 
        if self.enabled:
1542
 
            # Reschedule checker run
1543
 
            gobject.source_remove(self.checker_initiator_tag)
1544
 
            self.checker_initiator_tag = (gobject.timeout_add
1545
 
                                          (value, self.start_checker))
1546
 
            self.start_checker()    # Start one now, too
 
1363
        # Reschedule checker run
 
1364
        gobject.source_remove(self.checker_initiator_tag)
 
1365
        self.checker_initiator_tag = (gobject.timeout_add
 
1366
                                      (value, self.start_checker))
 
1367
        self.start_checker()    # Start one now, too
1547
1368
    
1548
1369
    # Checker - property
1549
1370
    @dbus_service_property(_interface, signature="s",
1551
1372
    def Checker_dbus_property(self, value=None):
1552
1373
        if value is None:       # get
1553
1374
            return dbus.String(self.checker_command)
1554
 
        self.checker_command = unicode(value)
 
1375
        self.checker_command = value
1555
1376
    
1556
1377
    # CheckerRunning - property
1557
1378
    @dbus_service_property(_interface, signature="b",
1586
1407
            raise KeyError()
1587
1408
    
1588
1409
    def __getattribute__(self, name):
1589
 
        if name == '_pipe':
 
1410
        if(name == '_pipe'):
1590
1411
            return super(ProxyClient, self).__getattribute__(name)
1591
1412
        self._pipe.send(('getattr', name))
1592
1413
        data = self._pipe.recv()
1599
1420
            return func
1600
1421
    
1601
1422
    def __setattr__(self, name, value):
1602
 
        if name == '_pipe':
 
1423
        if(name == '_pipe'):
1603
1424
            return super(ProxyClient, self).__setattr__(name, value)
1604
1425
        self._pipe.send(('setattr', name, value))
1605
1426
 
1674
1495
                    logger.warning("Bad certificate: %s", error)
1675
1496
                    return
1676
1497
                logger.debug("Fingerprint: %s", fpr)
 
1498
                if self.server.use_dbus:
 
1499
                    # Emit D-Bus signal
 
1500
                    client.NewRequest(str(self.client_address))
1677
1501
                
1678
1502
                try:
1679
1503
                    client = ProxyClient(child_pipe, fpr,
1695
1519
                            client.Rejected("Disabled")
1696
1520
                        return
1697
1521
                    
1698
 
                    if client.approved or not client.approval_delay:
 
1522
                    if client._approved or not client.approval_delay:
1699
1523
                        #We are approved or approval is disabled
1700
1524
                        break
1701
 
                    elif client.approved is None:
 
1525
                    elif client._approved is None:
1702
1526
                        logger.info("Client %s needs approval",
1703
1527
                                    client.name)
1704
1528
                        if self.server.use_dbus:
1718
1542
                    time = datetime.datetime.now()
1719
1543
                    client.changedstate.acquire()
1720
1544
                    (client.changedstate.wait
1721
 
                     (float(client.timedelta_to_milliseconds(delay)
 
1545
                     (float(client._timedelta_to_milliseconds(delay)
1722
1546
                            / 1000)))
1723
1547
                    client.changedstate.release()
1724
1548
                    time2 = datetime.datetime.now()
1750
1574
                
1751
1575
                logger.info("Sending secret to %s", client.name)
1752
1576
                # bump the timeout using extended_timeout
1753
 
                client.bump_timeout(client.extended_timeout)
 
1577
                client.checked_ok(client.extended_timeout)
1754
1578
                if self.server.use_dbus:
1755
1579
                    # Emit D-Bus signal
1756
1580
                    client.GotSecret()
1832
1656
    def sub_process_main(self, request, address):
1833
1657
        try:
1834
1658
            self.finish_request(request, address)
1835
 
        except Exception:
 
1659
        except:
1836
1660
            self.handle_error(request, address)
1837
1661
        self.close_request(request)
1838
1662
    
2099
1923
        sys.exit()
2100
1924
    if not noclose:
2101
1925
        # Close all standard open file descriptors
2102
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1926
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2103
1927
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2104
1928
            raise OSError(errno.ENODEV,
2105
1929
                          "%s not a character device"
2106
 
                          % os.devnull)
 
1930
                          % os.path.devnull)
2107
1931
        os.dup2(null, sys.stdin.fileno())
2108
1932
        os.dup2(null, sys.stdout.fileno())
2109
1933
        os.dup2(null, sys.stderr.fileno())
2217
2041
                                     stored_state_file)
2218
2042
    
2219
2043
    if debug:
2220
 
        initlogger(debug, logging.DEBUG)
 
2044
        initlogger(logging.DEBUG)
2221
2045
    else:
2222
2046
        if not debuglevel:
2223
 
            initlogger(debug)
 
2047
            initlogger()
2224
2048
        else:
2225
2049
            level = getattr(logging, debuglevel.upper())
2226
 
            initlogger(debug, level)
 
2050
            initlogger(level)
2227
2051
    
2228
2052
    if server_settings["servicename"] != "Mandos":
2229
2053
        syslogger.setFormatter(logging.Formatter
2232
2056
                                % server_settings["servicename"]))
2233
2057
    
2234
2058
    # Parse config file with clients
2235
 
    client_config = configparser.SafeConfigParser(Client
2236
 
                                                  .client_defaults)
 
2059
    client_defaults = { "timeout": "5m",
 
2060
                        "extended_timeout": "15m",
 
2061
                        "interval": "2m",
 
2062
                        "checker": "fping -q -- %%(host)s",
 
2063
                        "host": "",
 
2064
                        "approval_delay": "0s",
 
2065
                        "approval_duration": "1s",
 
2066
                        }
 
2067
    client_config = configparser.SafeConfigParser(client_defaults)
2237
2068
    client_config.read(os.path.join(server_settings["configdir"],
2238
2069
                                    "clients.conf"))
2239
2070
    
2292
2123
         .gnutls_global_set_log_function(debug_gnutls))
2293
2124
        
2294
2125
        # Redirect stdin so all checkers get /dev/null
2295
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
2126
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2296
2127
        os.dup2(null, sys.stdin.fileno())
2297
2128
        if null > 2:
2298
2129
            os.close(null)
 
2130
    else:
 
2131
        # No console logging
 
2132
        logger.removeHandler(console)
2299
2133
    
2300
2134
    # Need to fork before connecting to D-Bus
2301
2135
    if not debug:
2302
2136
        # Close all input and output, do double fork, etc.
2303
2137
        daemon()
2304
2138
    
2305
 
    gobject.threads_init()
2306
 
    
2307
2139
    global main_loop
2308
2140
    # From the Avahi example code
2309
 
    DBusGMainLoop(set_as_default=True)
 
2141
    DBusGMainLoop(set_as_default=True )
2310
2142
    main_loop = gobject.MainLoop()
2311
2143
    bus = dbus.SystemBus()
2312
2144
    # End of Avahi example code
2339
2171
        client_class = functools.partial(ClientDBusTransitional,
2340
2172
                                         bus = bus)
2341
2173
    
2342
 
    client_settings = Client.config_parser(client_config)
 
2174
    special_settings = {
 
2175
        # Some settings need to be accessd by special methods;
 
2176
        # booleans need .getboolean(), etc.  Here is a list of them:
 
2177
        "approved_by_default":
 
2178
            lambda section:
 
2179
            client_config.getboolean(section, "approved_by_default"),
 
2180
        }
 
2181
    # Construct a new dict of client settings of this form:
 
2182
    # { client_name: {setting_name: value, ...}, ...}
 
2183
    # with exceptions for any special settings as defined above
 
2184
    client_settings = dict((clientname,
 
2185
                           dict((setting,
 
2186
                                 (value
 
2187
                                  if setting not in special_settings
 
2188
                                  else special_settings[setting]
 
2189
                                  (clientname)))
 
2190
                                for setting, value in
 
2191
                                client_config.items(clientname)))
 
2192
                          for clientname in client_config.sections())
 
2193
    
2343
2194
    old_client_settings = {}
2344
 
    clients_data = {}
 
2195
    clients_data = []
2345
2196
    
2346
2197
    # Get client data and settings from last running state.
2347
2198
    if server_settings["restore"]:
2355
2206
                           .format(e))
2356
2207
            if e.errno != errno.ENOENT:
2357
2208
                raise
2358
 
        except EOFError as e:
2359
 
            logger.warning("Could not load persistent state: "
2360
 
                           "EOFError: {0}".format(e))
2361
2209
    
2362
 
    with PGPEngine() as pgp:
2363
 
        for client_name, client in clients_data.iteritems():
 
2210
    with Crypto() as crypt:
 
2211
        for client in clients_data:
 
2212
            client_name = client["name"]
 
2213
            
2364
2214
            # Decide which value to use after restoring saved state.
2365
2215
            # We have three different values: Old config file,
2366
2216
            # new config file, and saved state.
2374
2224
                    if (name != "secret" and
2375
2225
                        value != old_client_settings[client_name]
2376
2226
                        [name]):
2377
 
                        client[name] = value
 
2227
                        setattr(client, name, value)
2378
2228
                except KeyError:
2379
2229
                    pass
2380
2230
            
2381
2231
            # Clients who has passed its expire date can still be
2382
 
            # enabled if its last checker was successful.  Clients
2383
 
            # whose checker succeeded before we stored its state is
2384
 
            # assumed to have successfully run all checkers during
2385
 
            # downtime.
2386
 
            if client["enabled"]:
2387
 
                if datetime.datetime.utcnow() >= client["expires"]:
2388
 
                    if not client["last_checked_ok"]:
2389
 
                        logger.warning(
2390
 
                            "disabling client {0} - Client never "
2391
 
                            "performed a successful checker"
2392
 
                            .format(client_name))
2393
 
                        client["enabled"] = False
2394
 
                    elif client["last_checker_status"] != 0:
2395
 
                        logger.warning(
2396
 
                            "disabling client {0} - Client "
2397
 
                            "last checker failed with error code {1}"
2398
 
                            .format(client_name,
2399
 
                                    client["last_checker_status"]))
 
2232
            # enabled if its last checker was sucessful.  Clients
 
2233
            # whose checker failed before we stored its state is
 
2234
            # assumed to have failed all checkers during downtime.
 
2235
            if client["enabled"] and client["last_checked_ok"]:
 
2236
                if ((datetime.datetime.utcnow()
 
2237
                     - client["last_checked_ok"])
 
2238
                    > client["interval"]):
 
2239
                    if client["last_checker_status"] != 0:
2400
2240
                        client["enabled"] = False
2401
2241
                    else:
2402
2242
                        client["expires"] = (datetime.datetime
2403
2243
                                             .utcnow()
2404
2244
                                             + client["timeout"])
2405
 
                        logger.debug("Last checker succeeded,"
2406
 
                                     " keeping {0} enabled"
2407
 
                                     .format(client_name))
 
2245
            
 
2246
            client["changedstate"] = (multiprocessing_manager
 
2247
                                      .Condition
 
2248
                                      (multiprocessing_manager
 
2249
                                       .Lock()))
 
2250
            if use_dbus:
 
2251
                new_client = (ClientDBusTransitional.__new__
 
2252
                              (ClientDBusTransitional))
 
2253
                tcp_server.clients[client_name] = new_client
 
2254
                new_client.bus = bus
 
2255
                for name, value in client.iteritems():
 
2256
                    setattr(new_client, name, value)
 
2257
                client_object_name = unicode(client_name).translate(
 
2258
                    {ord("."): ord("_"),
 
2259
                     ord("-"): ord("_")})
 
2260
                new_client.dbus_object_path = (dbus.ObjectPath
 
2261
                                               ("/clients/"
 
2262
                                                + client_object_name))
 
2263
                DBusObjectWithProperties.__init__(new_client,
 
2264
                                                  new_client.bus,
 
2265
                                                  new_client
 
2266
                                                  .dbus_object_path)
 
2267
            else:
 
2268
                tcp_server.clients[client_name] = (Client.__new__
 
2269
                                                   (Client))
 
2270
                for name, value in client.iteritems():
 
2271
                    setattr(tcp_server.clients[client_name],
 
2272
                            name, value)
 
2273
            
2408
2274
            try:
2409
 
                client["secret"] = (
2410
 
                    pgp.decrypt(client["encrypted_secret"],
2411
 
                                client_settings[client_name]
2412
 
                                ["secret"]))
2413
 
            except PGPError:
 
2275
                tcp_server.clients[client_name].secret = (
 
2276
                    crypt.decrypt(tcp_server.clients[client_name]
 
2277
                                  .encrypted_secret,
 
2278
                                  client_settings[client_name]
 
2279
                                  ["secret"]))
 
2280
            except CryptoError:
2414
2281
                # If decryption fails, we use secret from new settings
2415
 
                logger.debug("Failed to decrypt {0} old secret"
2416
 
                             .format(client_name))
2417
 
                client["secret"] = (
 
2282
                tcp_server.clients[client_name].secret = (
2418
2283
                    client_settings[client_name]["secret"])
2419
 
 
2420
2284
    
2421
 
    # Add/remove clients based on new changes made to config
2422
 
    for client_name in (set(old_client_settings)
2423
 
                        - set(client_settings)):
2424
 
        del clients_data[client_name]
2425
 
    for client_name in (set(client_settings)
2426
 
                        - set(old_client_settings)):
2427
 
        clients_data[client_name] = client_settings[client_name]
2428
 
 
2429
 
    # Create all client objects
2430
 
    for client_name, client in clients_data.iteritems():
2431
 
        tcp_server.clients[client_name] = client_class(
2432
 
            name = client_name, settings = client)
 
2285
    # Create/remove clients based on new changes made to config
 
2286
    for clientname in set(old_client_settings) - set(client_settings):
 
2287
        del tcp_server.clients[clientname]
 
2288
    for clientname in set(client_settings) - set(old_client_settings):
 
2289
        tcp_server.clients[clientname] = (client_class(name
 
2290
                                                       = clientname,
 
2291
                                                       config =
 
2292
                                                       client_settings
 
2293
                                                       [clientname]))
2433
2294
    
2434
2295
    if not tcp_server.clients:
2435
2296
        logger.warning("No clients defined")
2447
2308
            # "pidfile" was never created
2448
2309
            pass
2449
2310
        del pidfilename
 
2311
        
2450
2312
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2451
2313
    
2452
2314
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2453
2315
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2454
2316
    
2455
2317
    if use_dbus:
2456
 
        class MandosDBusService(DBusObjectWithProperties):
 
2318
        class MandosDBusService(dbus.service.Object):
2457
2319
            """A D-Bus proxy object"""
2458
2320
            def __init__(self):
2459
2321
                dbus.service.Object.__init__(self, bus, "/")
2460
2322
            _interface = "se.recompile.Mandos"
2461
2323
            
2462
 
            @dbus_interface_annotations(_interface)
2463
 
            def _foo(self):
2464
 
                return { "org.freedesktop.DBus.Property"
2465
 
                         ".EmitsChangedSignal":
2466
 
                             "false"}
2467
 
            
2468
2324
            @dbus.service.signal(_interface, signature="o")
2469
2325
            def ClientAdded(self, objpath):
2470
2326
                "D-Bus signal"
2527
2383
        # Store client before exiting. Secrets are encrypted with key
2528
2384
        # based on what config file has. If config file is
2529
2385
        # removed/edited, old secret will thus be unrecovable.
2530
 
        clients = {}
2531
 
        with PGPEngine() as pgp:
 
2386
        clients = []
 
2387
        with Crypto() as crypt:
2532
2388
            for client in tcp_server.clients.itervalues():
2533
2389
                key = client_settings[client.name]["secret"]
2534
 
                client.encrypted_secret = pgp.encrypt(client.secret,
2535
 
                                                      key)
 
2390
                client.encrypted_secret = crypt.encrypt(client.secret,
 
2391
                                                        key)
2536
2392
                client_dict = {}
2537
2393
                
2538
 
                # A list of attributes that can not be pickled
2539
 
                # + secret.
2540
 
                exclude = set(("bus", "changedstate", "secret",
2541
 
                               "checker"))
 
2394
                # A list of attributes that will not be stored when
 
2395
                # shutting down.
 
2396
                exclude = set(("bus", "changedstate", "secret"))
2542
2397
                for name, typ in (inspect.getmembers
2543
2398
                                  (dbus.service.Object)):
2544
2399
                    exclude.add(name)
2549
2404
                    if attr not in exclude:
2550
2405
                        client_dict[attr] = getattr(client, attr)
2551
2406
                
2552
 
                clients[client.name] = client_dict
 
2407
                clients.append(client_dict)
2553
2408
                del client_settings[client.name]["secret"]
2554
2409
        
2555
2410
        try:
2556
 
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2557
 
                                                prefix="clients-",
2558
 
                                                dir=os.path.dirname
2559
 
                                                (stored_state_path))
2560
 
            with os.fdopen(tempfd, "wb") as stored_state:
 
2411
            with os.fdopen(os.open(stored_state_path,
 
2412
                                   os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
 
2413
                                   0600), "wb") as stored_state:
2561
2414
                pickle.dump((clients, client_settings), stored_state)
2562
 
            os.rename(tempname, stored_state_path)
2563
2415
        except (IOError, OSError) as e:
2564
2416
            logger.warning("Could not save persistent state: {0}"
2565
2417
                           .format(e))
2566
 
            if not debug:
2567
 
                try:
2568
 
                    os.remove(tempname)
2569
 
                except NameError:
2570
 
                    pass
2571
 
            if e.errno not in set((errno.ENOENT, errno.EACCES,
2572
 
                                   errno.EEXIST)):
2573
 
                raise e
 
2418
            if e.errno not in (errno.ENOENT, errno.EACCES):
 
2419
                raise
2574
2420
        
2575
2421
        # Delete all clients, and settings from config
2576
2422
        while tcp_server.clients:
2640
2486
    # Must run before the D-Bus bus name gets deregistered
2641
2487
    cleanup()
2642
2488
 
 
2489
 
2643
2490
if __name__ == '__main__':
2644
2491
    main()