/mandos/trunk : revision 518.2.3

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

66

68

67

69

import dbus

68

70

import dbus.service

73

75

import ctypes.util

74

76

import xml.dom.minidom

75

77

import inspect

78

import GnuPGInterface

76

79

77

80

try:

78

81

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

83

86

SO_BINDTODEVICE = None

84

87

85

88

86

version = "1.4.0"

89

version = "1.4.1"

90

stored_state_file = "clients.pickle"

87

91

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

92

logger = logging.getLogger()

90

93

syslogger = (logging.handlers.SysLogHandler

91

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

95

address = str("/dev/log")))

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

96

97

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

101

except (OSError, AttributeError):

102

def if_nametoindex(interface):

103

"Get an interface index the hard way, i.e. using fcntl()"

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

with contextlib.closing(socket.socket()) as s:

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

111

return interface_index

112

113

114

def initlogger(level=logging.WARNING):

115

"""init logger and add loglevel"""

116

117

syslogger.setFormatter(logging.Formatter

118

('Mandos [%(process)d]: %(levelname)s:'

119

' %(message)s'))

120

logger.addHandler(syslogger)

121

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class CryptoError(Exception):

132

pass

133

134

135

class Crypto(object):

136

"""A simple class for OpenPGP symmetric encryption & decryption"""

137

def __init__(self):

138

self.gnupg = GnuPGInterface.GnuPG()

139

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

140

self.gnupg = GnuPGInterface.GnuPG()

141

self.gnupg.options.meta_interactive = False

142

self.gnupg.options.homedir = self.tempdir

143

self.gnupg.options.extra_args.extend(['--force-mdc',

144

'--quiet'])

145

146

def __enter__(self):

147

return self

148

149

def __exit__ (self, exc_type, exc_value, traceback):

150

self._cleanup()

151

return False

152

153

def __del__(self):

154

self._cleanup()

155

156

def _cleanup(self):

157

if self.tempdir is not None:

158

# Delete contents of tempdir

159

for root, dirs, files in os.walk(self.tempdir,

160

topdown = False):

161

for filename in files:

162

os.remove(os.path.join(root, filename))

163

for dirname in dirs:

164

os.rmdir(os.path.join(root, dirname))

165

# Remove tempdir

166

os.rmdir(self.tempdir)

167

self.tempdir = None

168

169

def password_encode(self, password):

170

# Passphrase can not be empty and can not contain newlines or

171

# NUL bytes. So we prefix it and hex encode it.

172

return b"mandos" + binascii.hexlify(password)

173

174

def encrypt(self, data, password):

175

self.gnupg.passphrase = self.password_encode(password)

176

with open(os.devnull) as devnull:

177

try:

178

proc = self.gnupg.run(['--symmetric'],

179

create_fhs=['stdin', 'stdout'],

180

attach_fhs={'stderr': devnull})

181

with contextlib.closing(proc.handles['stdin']) as f:

182

f.write(data)

183

with contextlib.closing(proc.handles['stdout']) as f:

184

ciphertext = f.read()

185

proc.wait()

186

except IOError as e:

187

raise CryptoError(e)

188

self.gnupg.passphrase = None

189

return ciphertext

190

191

def decrypt(self, data, password):

192

self.gnupg.passphrase = self.password_encode(password)

193

with open(os.devnull) as devnull:

194

try:

195

proc = self.gnupg.run(['--decrypt'],

196

create_fhs=['stdin', 'stdout'],

197

attach_fhs={'stderr': devnull})

198

with contextlib.closing(proc.handles['stdin'] ) as f:

199

f.write(data)

200

with contextlib.closing(proc.handles['stdout']) as f:

201

decrypted_plaintext = f.read()

202

proc.wait()

203

except IOError as e:

204

raise CryptoError(e)

205

self.gnupg.passphrase = None

206

return decrypted_plaintext

207

208

103

209

104

210

class AvahiError(Exception):

105

211

def __init__(self, value, *args, **kwargs):

164

270

.GetAlternativeServiceName(self.name))

165

271

logger.info("Changing Zeroconf service name to %r ...",

166

272

self.name)

167

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

170

% self.name))

171

273

self.remove()

172

274

try:

173

275

self.add()

193

295

avahi.DBUS_INTERFACE_ENTRY_GROUP)

194

296

self.entry_group_state_changed_match = (

195

297

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

298

'StateChanged', self.entry_group_state_changed))

197

299

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

198

300

self.name, self.type)

199

301

self.group.AddService(

225

327

try:

226

328

self.group.Free()

227

329

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

330

dbus.exceptions.DBusException):

229

331

pass

230

332

self.group = None

231

333

self.remove()

265

367

self.server_state_changed)

266

368

self.server_state_changed(self.server.GetState())

267

369

370

class AvahiServiceToSyslog(AvahiService):

371

def rename(self):

372

"""Add the new name to the syslog messages"""

373

ret = AvahiService.rename(self)

374

syslogger.setFormatter(logging.Formatter

375

('Mandos (%s) [%%(process)d]:'

376

' %%(levelname)s: %%(message)s'

377

% self.name))

378

return ret

268

379

269

380

def _timedelta_to_milliseconds(td):

270

381

"Convert a datetime.timedelta() to milliseconds"

289

400

instance %(name)s can be used in the command.

290

401

checker_initiator_tag: a gobject event source tag, or None

291

402

created: datetime.datetime(); (UTC) object creation

403

client_structure: Object describing what attributes a client has

404

and is used for storing the client at exit

292

405

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

406

disable_initiator_tag: a gobject event source tag, or None

295

407

enabled: bool()

296

408

fingerprint: string (40 or 32 hexadecimal digits); used to

299

411

interval: datetime.timedelta(); How often to start a new checker

300

412

last_approval_request: datetime.datetime(); (UTC) or None

301

413

last_checked_ok: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

414

415

last_checker_status: integer between 0 and 255 reflecting exit

416

status of last checker. -1 reflects crashed

417

checker, or None.

418

last_enabled: datetime.datetime(); (UTC) or None

303

419

name: string; from the config file, used in log messages and

304

420

D-Bus identifiers

305

421

secret: bytestring; sent verbatim (over TLS) to client

331

447

def approval_delay_milliseconds(self):

332

448

return _timedelta_to_milliseconds(self.approval_delay)

333

449

334

def __init__(self, name = None, disable_hook=None, config=None):

450

def __init__(self, name = None, config=None):

335

451

"""Note: the 'checker' key in 'config' sets the

336

452

'checker_command' attribute and *not* the 'checker'

337

453

attribute."""

357

473

% self.name)

358

474

self.host = config.get("host", "")

359

475

self.created = datetime.datetime.utcnow()

360

self.enabled = False

476

self.enabled = config.get("enabled", True)

361

477

self.last_approval_request = None

362

self.last_enabled = None

478

if self.enabled:

479

self.last_enabled = datetime.datetime.utcnow()

480

else:

481

self.last_enabled = None

363

482

self.last_checked_ok = None

483

self.last_checker_status = None

364

484

self.timeout = string_to_delta(config["timeout"])

365

485

self.extended_timeout = string_to_delta(config

366

486

["extended_timeout"])

367

487

self.interval = string_to_delta(config["interval"])

368

self.disable_hook = disable_hook

369

488

self.checker = None

370

489

self.checker_initiator_tag = None

371

490

self.disable_initiator_tag = None

372

self.expires = None

491

if self.enabled:

492

self.expires = datetime.datetime.utcnow() + self.timeout

493

else:

494

self.expires = None

373

495

self.checker_callback_tag = None

374

496

self.checker_command = config["checker"]

375

497

self.current_checker_command = None

376

self.last_connect = None

377

498

self._approved = None

378

499

self.approved_by_default = config.get("approved_by_default",

379

500

True)

385

506

self.changedstate = (multiprocessing_manager

386

507

.Condition(multiprocessing_manager

387

508

.Lock()))

509

self.client_structure = [attr for attr in

510

self.__dict__.iterkeys()

511

if not attr.startswith("_")]

512

self.client_structure.append("client_structure")

513

514

for name, t in inspect.getmembers(type(self),

515

lambda obj:

516

isinstance(obj,

517

property)):

518

if not name.startswith("_"):

519

self.client_structure.append(name)

388

520

521

# Send notice to process children that client state has changed

389

522

def send_changedstate(self):

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

523

with self.changedstate:

524

self.changedstate.notify_all()

393

525

394

526

def enable(self):

395

527

"""Start this client's checker and timeout hooks"""

397

529

# Already enabled

398

530

return

399

531

self.send_changedstate()

400

# Schedule a new checker to be started an 'interval' from now,

401

# and every interval from then on.

402

self.checker_initiator_tag = (gobject.timeout_add

403

(self.interval_milliseconds(),

404

self.start_checker))

405

# Schedule a disable() when 'timeout' has passed

406

532

self.expires = datetime.datetime.utcnow() + self.timeout

407

self.disable_initiator_tag = (gobject.timeout_add

408

(self.timeout_milliseconds(),

409

self.disable))

410

533

self.enabled = True

411

534

self.last_enabled = datetime.datetime.utcnow()

412

# Also start a new checker *right now*.

413

self.start_checker()

535

self.init_checker()

414

536

415

537

def disable(self, quiet=True):

416

538

"""Disable this client."""

428

550

gobject.source_remove(self.checker_initiator_tag)

429

551

self.checker_initiator_tag = None

430

552

self.stop_checker()

431

if self.disable_hook:

432

self.disable_hook(self)

433

553

self.enabled = False

434

554

# Do not run this again if called by a gobject.timeout_add

435

555

return False

436

556

437

557

def __del__(self):

438

self.disable_hook = None

439

558

self.disable()

440

559

560

def init_checker(self):

561

# Schedule a new checker to be started an 'interval' from now,

562

# and every interval from then on.

563

self.checker_initiator_tag = (gobject.timeout_add

564

(self.interval_milliseconds(),

565

self.start_checker))

566

# Schedule a disable() when 'timeout' has passed

567

self.disable_initiator_tag = (gobject.timeout_add

568

(self.timeout_milliseconds(),

569

self.disable))

570

# Also start a new checker *right now*.

571

self.start_checker()

572

441

573

def checker_callback(self, pid, condition, command):

442

574

"""The checker has completed, so take appropriate actions."""

443

575

self.checker_callback_tag = None

444

576

self.checker = None

445

577

if os.WIFEXITED(condition):

446

exitstatus = os.WEXITSTATUS(condition)

447

if exitstatus == 0:

578

self.last_checker_status = os.WEXITSTATUS(condition)

579

if self.last_checker_status == 0:

448

580

logger.info("Checker for %(name)s succeeded",

449

581

vars(self))

450

582

self.checked_ok()

452

584

logger.info("Checker for %(name)s failed",

453

585

vars(self))

454

586

else:

587

self.last_checker_status = -1

455

588

logger.warning("Checker for %(name)s crashed?",

456

589

vars(self))

457

590

464

597

if timeout is None:

465

598

timeout = self.timeout

466

599

self.last_checked_ok = datetime.datetime.utcnow()

467

gobject.source_remove(self.disable_initiator_tag)

468

self.disable_initiator_tag = (gobject.timeout_add

469

(_timedelta_to_milliseconds

470

(timeout), self.disable))

471

self.expires = datetime.datetime.utcnow() + timeout

600

if self.disable_initiator_tag is not None:

601

gobject.source_remove(self.disable_initiator_tag)

602

if getattr(self, "enabled", False):

603

self.disable_initiator_tag = (gobject.timeout_add

604

(_timedelta_to_milliseconds

605

(timeout), self.disable))

606

self.expires = datetime.datetime.utcnow() + timeout

472

607

473

608

def need_approval(self):

474

609

self.last_approval_request = datetime.datetime.utcnow()

689

824

690

825

Note: Will not include properties with access="write".

691

826

"""

692

all = {}

827

properties = {}

693

828

for name, prop in self._get_all_dbus_properties():

694

829

if (interface_name

695

830

and interface_name != prop._dbus_interface):

700

835

continue

701

836

value = prop()

702

837

if not hasattr(value, "variant_level"):

703

all[name] = value

838

properties[name] = value

704

839

continue

705

all[name] = type(value)(value, variant_level=

706

value.variant_level+1)

707

return dbus.Dictionary(all, signature="sv")

840

properties[name] = type(value)(value, variant_level=

841

value.variant_level+1)

842

return dbus.Dictionary(properties, signature="sv")

708

843

709

844

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

710

845

out_signature="s",

761

896

return dbus.String(dt.isoformat(),

762

897

variant_level=variant_level)

763

898

899

764

900

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

765

901

.__metaclass__):

766

902

"""Applied to an empty subclass of a D-Bus object, this metaclass

858

994

attribute.func_closure)))

859

995

return type.__new__(mcs, name, bases, attr)

860

996

997

861

998

class ClientDBus(Client, DBusObjectWithProperties):

862

999

"""A Client class using D-Bus

863

1000

872

1009

# dbus.service.Object doesn't use super(), so we can't either.

873

1010

874

1011

def __init__(self, bus = None, *args, **kwargs):

1012

self.bus = bus

1013

Client.__init__(self, *args, **kwargs)

1014

875

1015

self._approvals_pending = 0

876

self.bus = bus

877

Client.__init__(self, *args, **kwargs)

878

1016

# Only now, when this client is initialized, can it show up on

879

1017

# the D-Bus

880

1018

client_object_name = unicode(self.name).translate(

890

1028

variant_level=1):

891

1029

""" Modify a variable so that it's a property which announces

892

1030

its changes to DBus.

893

894

transform_fun: Function that takes a value and transforms it

895

to a D-Bus type.

1031

1032

transform_fun: Function that takes a value and a variant_level

1033

and transforms it to a D-Bus type.

896

1034

dbus_name: D-Bus name of the variable

897

1035

type_func: Function that transform the value before sending it

898

1036

to the D-Bus. Default: no transform

905

1043

type_func(getattr(self, attrname, None))

906

1044

!= type_func(value)):

907

1045

dbus_value = transform_func(type_func(value),

908

variant_level)

1046

variant_level

1047

=variant_level)

909

1048

self.PropertyChanged(dbus.String(dbus_name),

910

1049

dbus_value)

911

1050

setattr(self, attrname, value)

1049

1188

"D-Bus signal"

1050

1189

return self.need_approval()

1051

1190

1191

# NeRwequest - signal

1192

@dbus.service.signal(_interface, signature="s")

1193

def NewRequest(self, ip):

1194

"""D-Bus signal

1195

Is sent after a client request a password.

1196

"""

1197

pass

1198

1052

1199

## Methods

1053

1200

1054

1201

# Approve - method

1137

1284

# Created - property

1138

1285

@dbus_service_property(_interface, signature="s", access="read")

1139

1286

def Created_dbus_property(self):

1140

return dbus.String(datetime_to_dbus(self.created))

1287

return datetime_to_dbus(self.created)

1141

1288

1142

1289

# LastEnabled - property

1143

1290

@dbus_service_property(_interface, signature="s", access="read")

1187

1334

gobject.source_remove(self.disable_initiator_tag)

1188

1335

self.disable_initiator_tag = None

1189

1336

self.expires = None

1190

time_to_die = (self.

1191

_timedelta_to_milliseconds((self

1192

.last_checked_ok

1193

+ self.timeout)

1194

- datetime.datetime

1195

.utcnow()))

1337

time_to_die = _timedelta_to_milliseconds((self

1338

.last_checked_ok

1339

+ self.timeout)

1340

- datetime.datetime

1341

.utcnow())

1196

1342

if time_to_die <= 0:

1197

1343

# The timeout has passed

1198

1344

self.disable()

1220

1366

self.interval = datetime.timedelta(0, 0, 0, value)

1221

1367

if getattr(self, "checker_initiator_tag", None) is None:

1222

1368

return

1223

# Reschedule checker run

1224

gobject.source_remove(self.checker_initiator_tag)

1225

self.checker_initiator_tag = (gobject.timeout_add

1226

(value, self.start_checker))

1227

self.start_checker() # Start one now, too

1369

if self.enabled:

1370

# Reschedule checker run

1371

gobject.source_remove(self.checker_initiator_tag)

1372

self.checker_initiator_tag = (gobject.timeout_add

1373

(value, self.start_checker))

1374

self.start_checker() # Start one now, too

1228

1375

1229

1376

# Checker - property

1230

1377

@dbus_service_property(_interface, signature="s",

1284

1431

return super(ProxyClient, self).__setattr__(name, value)

1285

1432

self._pipe.send(('setattr', name, value))

1286

1433

1434

1287

1435

class ClientDBusTransitional(ClientDBus):

1288

1436

__metaclass__ = AlternateDBusNamesMetaclass

1289

1437

1438

1290

1439

class ClientHandler(socketserver.BaseRequestHandler, object):

1291

1440

"""A class to handle client connections.

1292

1441

1353

1502

logger.warning("Bad certificate: %s", error)

1354

1503

return

1355

1504

logger.debug("Fingerprint: %s", fpr)

1505

if self.server.use_dbus:

1506

# Emit D-Bus signal

1507

client.NewRequest(str(self.client_address))

1356

1508

1357

1509

try:

1358

1510

client = ProxyClient(child_pipe, fpr,

1502

1654

# Convert the buffer to a Python bytestring

1503

1655

fpr = ctypes.string_at(buf, buf_len.value)

1504

1656

# Convert the bytestring to hexadecimal notation

1505

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1657

hex_fpr = binascii.hexlify(fpr).upper()

1506

1658

return hex_fpr

1507

1659

1508

1660

1622

1774

self.enabled = False

1623

1775

self.clients = clients

1624

1776

if self.clients is None:

1625

self.clients = set()

1777

self.clients = {}

1626

1778

self.use_dbus = use_dbus

1627

1779

self.gnutls_priority = gnutls_priority

1628

1780

IPv6_TCPServer.__init__(self, server_address,

1675

1827

fpr = request[1]

1676

1828

address = request[2]

1677

1829

1678

for c in self.clients:

1830

for c in self.clients.itervalues():

1679

1831

if c.fingerprint == fpr:

1680

1832

client = c

1681

1833

break

1765

1917

return timevalue

1766

1918

1767

1919

1768

def if_nametoindex(interface):

1769

"""Call the C function if_nametoindex(), or equivalent

1770

1771

Note: This function cannot accept a unicode string."""

1772

global if_nametoindex

1773

try:

1774

if_nametoindex = (ctypes.cdll.LoadLibrary

1775

(ctypes.util.find_library("c"))

1776

.if_nametoindex)

1777

except (OSError, AttributeError):

1778

logger.warning("Doing if_nametoindex the hard way")

1779

def if_nametoindex(interface):

1780

"Get an interface index the hard way, i.e. using fcntl()"

1781

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1782

with contextlib.closing(socket.socket()) as s:

1783

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1784

struct.pack(str("16s16x"),

1785

interface))

1786

interface_index = struct.unpack(str("I"),

1787

ifreq[16:20])[0]

1788

return interface_index

1789

return if_nametoindex(interface)

1790

1791

1792

1920

def daemon(nochdir = False, noclose = False):

1793

1921

"""See daemon(3). Standard BSD Unix function.

1794

1922

1849

1977

" system bus interface")

1850

1978

parser.add_argument("--no-ipv6", action="store_false",

1851

1979

dest="use_ipv6", help="Do not use IPv6")

1980

parser.add_argument("--no-restore", action="store_false",

1981

dest="restore", help="Do not restore stored"

1982

" state")

1983

parser.add_argument("--statedir", metavar="DIR",

1984

help="Directory to save/restore state in")

1985

1852

1986

options = parser.parse_args()

1853

1987

1854

1988

if options.check:

1867

2001

"use_dbus": "True",

1868

2002

"use_ipv6": "True",

1869

2003

"debuglevel": "",

2004

"restore": "True",

2005

"statedir": "/var/lib/mandos"

1870

2006

}

1871

2007

1872

2008

# Parse config file for server-global settings

1889

2025

# options, if set.

1890

2026

for option in ("interface", "address", "port", "debug",

1891

2027

"priority", "servicename", "configdir",

1892

"use_dbus", "use_ipv6", "debuglevel"):

2028

"use_dbus", "use_ipv6", "debuglevel", "restore",

2029

"statedir"):

1893

2030

value = getattr(options, option)

1894

2031

if value is not None:

1895

2032

server_settings[option] = value

1907

2044

debuglevel = server_settings["debuglevel"]

1908

2045

use_dbus = server_settings["use_dbus"]

1909

2046

use_ipv6 = server_settings["use_ipv6"]

2047

stored_state_path = os.path.join(server_settings["statedir"],

2048

stored_state_file)

2049

2050

if debug:

2051

initlogger(logging.DEBUG)

2052

else:

2053

if not debuglevel:

2054

initlogger()

2055

else:

2056

level = getattr(logging, debuglevel.upper())

2057

initlogger(level)

1910

2058

1911

2059

if server_settings["servicename"] != "Mandos":

1912

2060

syslogger.setFormatter(logging.Formatter

1967

2115

if error[0] != errno.EPERM:

1968

2116

raise error

1969

2117

1970

if not debug and not debuglevel:

1971

syslogger.setLevel(logging.WARNING)

1972

console.setLevel(logging.WARNING)

1973

if debuglevel:

1974

level = getattr(logging, debuglevel.upper())

1975

syslogger.setLevel(level)

1976

console.setLevel(level)

1977

1978

2118

if debug:

1979

2119

# Enable all possible GnuTLS debugging

1980

2120

2022

2162

server_settings["use_dbus"] = False

2023

2163

tcp_server.use_dbus = False

2024

2164

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2025

service = AvahiService(name = server_settings["servicename"],

2026

servicetype = "_mandos._tcp",

2027

protocol = protocol, bus = bus)

2165

service = AvahiServiceToSyslog(name =

2166

server_settings["servicename"],

2167

servicetype = "_mandos._tcp",

2168

protocol = protocol, bus = bus)

2028

2169

if server_settings["interface"]:

2029

2170

service.interface = (if_nametoindex

2030

2171

(str(server_settings["interface"])))

2036

2177

if use_dbus:

2037

2178

client_class = functools.partial(ClientDBusTransitional,

2038

2179

bus = bus)

2039

def client_config_items(config, section):

2040

special_settings = {

2041

"approved_by_default":

2042

lambda: config.getboolean(section,

2043

"approved_by_default"),

2044

}

2045

for name, value in config.items(section):

2180

2181

special_settings = {

2182

# Some settings need to be accessd by special methods;

2183

# booleans need .getboolean(), etc. Here is a list of them:

2184

"approved_by_default":

2185

lambda section:

2186

client_config.getboolean(section, "approved_by_default"),

2187

"enabled":

2188

lambda section:

2189

client_config.getboolean(section, "enabled"),

2190

}

2191

# Construct a new dict of client settings of this form:

2192

# { client_name: {setting_name: value, ...}, ...}

2193

# with exceptions for any special settings as defined above

2194

client_settings = dict((clientname,

2195

dict((setting,

2196

(value

2197

if setting not in special_settings

2198

else special_settings[setting]

2199

(clientname)))

2200

for setting, value in

2201

client_config.items(clientname)))

2202

for clientname in client_config.sections())

2203

2204

old_client_settings = {}

2205

clients_data = []

2206

2207

# Get client data and settings from last running state.

2208

if server_settings["restore"]:

2209

try:

2210

with open(stored_state_path, "rb") as stored_state:

2211

clients_data, old_client_settings = (pickle.load

2212

(stored_state))

2213

os.remove(stored_state_path)

2214

except IOError as e:

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2218

raise

2219

2220

with Crypto() as crypt:

2221

for client in clients_data:

2222

client_name = client["name"]

2223

2224

# Decide which value to use after restoring saved state.

2225

# We have three different values: Old config file,

2226

# new config file, and saved state.

2227

# New config value takes precedence if it differs from old

2228

# config value, otherwise use saved state.

2229

for name, value in client_settings[client_name].items():

2230

try:

2231

# For each value in new config, check if it

2232

# differs from the old config value (Except for

2233

# the "secret" attribute)

2234

if (name != "secret" and

2235

value != old_client_settings[client_name]

2236

[name]):

2237

setattr(client, name, value)

2238

except KeyError:

2239

pass

2240

2241

# Clients who has passed its expire date can still be

2242

# enabled if its last checker was sucessful. Clients

2243

# whose checker failed before we stored its state is

2244

# assumed to have failed all checkers during downtime.

2245

if client["enabled"] and client["last_checked_ok"]:

2246

if ((datetime.datetime.utcnow()

2247

- client["last_checked_ok"])

2248

> client["interval"]):

2249

if client["last_checker_status"] != 0:

2250

client["enabled"] = False

2251

else:

2252

client["expires"] = (datetime.datetime

2253

.utcnow()

2254

+ client["timeout"])

2255

2256

client["changedstate"] = (multiprocessing_manager

2257

.Condition

2258

(multiprocessing_manager

2259

.Lock()))

2260

if use_dbus:

2261

new_client = (ClientDBusTransitional.__new__

2262

(ClientDBusTransitional))

2263

tcp_server.clients[client_name] = new_client

2264

new_client.bus = bus

2265

for name, value in client.iteritems():

2266

setattr(new_client, name, value)

2267

client_object_name = unicode(client_name).translate(

2268

{ord("."): ord("_"),

2269

ord("-"): ord("_")})

2270

new_client.dbus_object_path = (dbus.ObjectPath

2271

("/clients/"

2272

+ client_object_name))

2273

DBusObjectWithProperties.__init__(new_client,

2274

new_client.bus,

2275

new_client

2276

.dbus_object_path)

2277

else:

2278

tcp_server.clients[client_name] = (Client.__new__

2279

(Client))

2280

for name, value in client.iteritems():

2281

setattr(tcp_server.clients[client_name],

2282

name, value)

2283

2046

2284

try:

2047

yield (name, special_settings[name]())

2048

except KeyError:

2049

yield (name, value)

2050

2051

tcp_server.clients.update(set(

2052

client_class(name = section,

2053

config= dict(client_config_items(

2054

client_config, section)))

2055

for section in client_config.sections()))

2285

tcp_server.clients[client_name].secret = (

2286

crypt.decrypt(tcp_server.clients[client_name]

2287

.encrypted_secret,

2288

client_settings[client_name]

2289

["secret"]))

2290

except CryptoError:

2291

# If decryption fails, we use secret from new settings

2292

tcp_server.clients[client_name].secret = (

2293

client_settings[client_name]["secret"])

2294

2295

# Create/remove clients based on new changes made to config

2296

for clientname in set(old_client_settings) - set(client_settings):

2297

del tcp_server.clients[clientname]

2298

for clientname in set(client_settings) - set(old_client_settings):

2299

tcp_server.clients[clientname] = (client_class(name

2300

= clientname,

2301

config =

2302

client_settings

2303

[clientname]))

2304

2056

2305

if not tcp_server.clients:

2057

2306

logger.warning("No clients defined")

2058

2307

2101

2350

def GetAllClients(self):

2102

2351

"D-Bus method"

2103

2352

return dbus.Array(c.dbus_object_path

2104

for c in tcp_server.clients)

2353

for c in

2354

tcp_server.clients.itervalues())

2105

2355

2106

2356

@dbus.service.method(_interface,

2107

2357

out_signature="a{oa{sv}}")

2109

2359

"D-Bus method"

2110

2360

return dbus.Dictionary(

2111

2361

((c.dbus_object_path, c.GetAll(""))

2112

for c in tcp_server.clients),

2362

for c in tcp_server.clients.itervalues()),

2113

2363

signature="oa{sv}")

2114

2364

2115

2365

@dbus.service.method(_interface, in_signature="o")

2116

2366

def RemoveClient(self, object_path):

2117

2367

"D-Bus method"

2118

for c in tcp_server.clients:

2368

for c in tcp_server.clients.itervalues():

2119

2369

if c.dbus_object_path == object_path:

2120

tcp_server.clients.remove(c)

2370

del tcp_server.clients[c.name]

2121

2371

c.remove_from_connection()

2122

2372

# Don't signal anything except ClientRemoved

2123

2373

c.disable(quiet=True)

2137

2387

service.cleanup()

2138

2388

2139

2389

multiprocessing.active_children()

2390

if not (tcp_server.clients or client_settings):

2391

return

2392

2393

# Store client before exiting. Secrets are encrypted with key

2394

# based on what config file has. If config file is

2395

# removed/edited, old secret will thus be unrecovable.

2396

clients = []

2397

with Crypto() as crypt:

2398

for client in tcp_server.clients.itervalues():

2399

key = client_settings[client.name]["secret"]

2400

client.encrypted_secret = crypt.encrypt(client.secret,

2401

key)

2402

client_dict = {}

2403

2404

# A list of attributes that will not be stored when

2405

# shutting down.

2406

exclude = set(("bus", "changedstate", "secret"))

2407

for name, typ in (inspect.getmembers

2408

(dbus.service.Object)):

2409

exclude.add(name)

2410

2411

client_dict["encrypted_secret"] = (client

2412

.encrypted_secret)

2413

for attr in client.client_structure:

2414

if attr not in exclude:

2415

client_dict[attr] = getattr(client, attr)

2416

2417

clients.append(client_dict)

2418

del client_settings[client.name]["secret"]

2419

2420

try:

2421

with os.fdopen(os.open(stored_state_path,

2422

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2423

0600), "wb") as stored_state:

2424

pickle.dump((clients, client_settings), stored_state)

2425

except (IOError, OSError) as e:

2426

logger.warning("Could not save persistent state: {0}"

2427

.format(e))

2428

if e.errno not in (errno.ENOENT, errno.EACCES):

2429

raise

2430

2431

# Delete all clients, and settings from config

2140

2432

while tcp_server.clients:

2141

client = tcp_server.clients.pop()

2433

name, client = tcp_server.clients.popitem()

2142

2434

if use_dbus:

2143

2435

client.remove_from_connection()

2144

client.disable_hook = None

2145

2436

# Don't signal anything except ClientRemoved

2146

2437

client.disable(quiet=True)

2147

2438

if use_dbus:

2149

2440

mandos_dbus_service.ClientRemoved(client

2150

2441

.dbus_object_path,

2151

2442

client.name)

2443

client_settings.clear()

2152

2444

2153

2445

atexit.register(cleanup)

2154

2446

2155

for client in tcp_server.clients:

2447

for client in tcp_server.clients.itervalues():

2156

2448

if use_dbus:

2157

2449

# Emit D-Bus signal

2158

2450

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2159

client.enable()

2451

# Need to initiate checking of clients

2452

if client.enabled:

2453

client.init_checker()

2160

2454

2161

2455

tcp_server.enable()

2162

2456

tcp_server.server_activate()