/mandos/trunk : revision 518.2.3

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

66

68

67

69

import dbus

68

70

import dbus.service

73

75

import ctypes.util

74

76

import xml.dom.minidom

75

77

import inspect

78

import GnuPGInterface

76

79

77

80

try:

78

81

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

84

87

85

88

86

89

version = "1.4.1"

90

stored_state_file = "clients.pickle"

87

91

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

92

logger = logging.getLogger()

90

93

syslogger = (logging.handlers.SysLogHandler

91

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

95

address = str("/dev/log")))

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

96

97

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

101

except (OSError, AttributeError):

102

def if_nametoindex(interface):

103

"Get an interface index the hard way, i.e. using fcntl()"

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

with contextlib.closing(socket.socket()) as s:

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

111

return interface_index

112

113

114

def initlogger(level=logging.WARNING):

115

"""init logger and add loglevel"""

116

117

syslogger.setFormatter(logging.Formatter

118

('Mandos [%(process)d]: %(levelname)s:'

119

' %(message)s'))

120

logger.addHandler(syslogger)

121

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class CryptoError(Exception):

132

pass

133

134

135

class Crypto(object):

136

"""A simple class for OpenPGP symmetric encryption & decryption"""

137

def __init__(self):

138

self.gnupg = GnuPGInterface.GnuPG()

139

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

140

self.gnupg = GnuPGInterface.GnuPG()

141

self.gnupg.options.meta_interactive = False

142

self.gnupg.options.homedir = self.tempdir

143

self.gnupg.options.extra_args.extend(['--force-mdc',

144

'--quiet'])

145

146

def __enter__(self):

147

return self

148

149

def __exit__ (self, exc_type, exc_value, traceback):

150

self._cleanup()

151

return False

152

153

def __del__(self):

154

self._cleanup()

155

156

def _cleanup(self):

157

if self.tempdir is not None:

158

# Delete contents of tempdir

159

for root, dirs, files in os.walk(self.tempdir,

160

topdown = False):

161

for filename in files:

162

os.remove(os.path.join(root, filename))

163

for dirname in dirs:

164

os.rmdir(os.path.join(root, dirname))

165

# Remove tempdir

166

os.rmdir(self.tempdir)

167

self.tempdir = None

168

169

def password_encode(self, password):

170

# Passphrase can not be empty and can not contain newlines or

171

# NUL bytes. So we prefix it and hex encode it.

172

return b"mandos" + binascii.hexlify(password)

173

174

def encrypt(self, data, password):

175

self.gnupg.passphrase = self.password_encode(password)

176

with open(os.devnull) as devnull:

177

try:

178

proc = self.gnupg.run(['--symmetric'],

179

create_fhs=['stdin', 'stdout'],

180

attach_fhs={'stderr': devnull})

181

with contextlib.closing(proc.handles['stdin']) as f:

182

f.write(data)

183

with contextlib.closing(proc.handles['stdout']) as f:

184

ciphertext = f.read()

185

proc.wait()

186

except IOError as e:

187

raise CryptoError(e)

188

self.gnupg.passphrase = None

189

return ciphertext

190

191

def decrypt(self, data, password):

192

self.gnupg.passphrase = self.password_encode(password)

193

with open(os.devnull) as devnull:

194

try:

195

proc = self.gnupg.run(['--decrypt'],

196

create_fhs=['stdin', 'stdout'],

197

attach_fhs={'stderr': devnull})

198

with contextlib.closing(proc.handles['stdin'] ) as f:

199

f.write(data)

200

with contextlib.closing(proc.handles['stdout']) as f:

201

decrypted_plaintext = f.read()

202

proc.wait()

203

except IOError as e:

204

raise CryptoError(e)

205

self.gnupg.passphrase = None

206

return decrypted_plaintext

207

208

103

209

104

210

class AvahiError(Exception):

105

211

def __init__(self, value, *args, **kwargs):

164

270

.GetAlternativeServiceName(self.name))

165

271

logger.info("Changing Zeroconf service name to %r ...",

166

272

self.name)

167

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

170

% self.name))

171

273

self.remove()

172

274

try:

173

275

self.add()

193

295

avahi.DBUS_INTERFACE_ENTRY_GROUP)

194

296

self.entry_group_state_changed_match = (

195

297

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

298

'StateChanged', self.entry_group_state_changed))

197

299

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

198

300

self.name, self.type)

199

301

self.group.AddService(

225

327

try:

226

328

self.group.Free()

227

329

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

330

dbus.exceptions.DBusException):

229

331

pass

230

332

self.group = None

231

333

self.remove()

265

367

self.server_state_changed)

266

368

self.server_state_changed(self.server.GetState())

267

369

370

class AvahiServiceToSyslog(AvahiService):

371

def rename(self):

372

"""Add the new name to the syslog messages"""

373

ret = AvahiService.rename(self)

374

syslogger.setFormatter(logging.Formatter

375

('Mandos (%s) [%%(process)d]:'

376

' %%(levelname)s: %%(message)s'

377

% self.name))

378

return ret

268

379

269

380

def _timedelta_to_milliseconds(td):

270

381

"Convert a datetime.timedelta() to milliseconds"

289

400

instance %(name)s can be used in the command.

290

401

checker_initiator_tag: a gobject event source tag, or None

291

402

created: datetime.datetime(); (UTC) object creation

403

client_structure: Object describing what attributes a client has

404

and is used for storing the client at exit

292

405

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

406

disable_initiator_tag: a gobject event source tag, or None

295

407

enabled: bool()

296

408

fingerprint: string (40 or 32 hexadecimal digits); used to

299

411

interval: datetime.timedelta(); How often to start a new checker

300

412

last_approval_request: datetime.datetime(); (UTC) or None

301

413

last_checked_ok: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

414

415

last_checker_status: integer between 0 and 255 reflecting exit

416

status of last checker. -1 reflects crashed

417

checker, or None.

418

last_enabled: datetime.datetime(); (UTC) or None

303

419

name: string; from the config file, used in log messages and

304

420

D-Bus identifiers

305

421

secret: bytestring; sent verbatim (over TLS) to client

331

447

def approval_delay_milliseconds(self):

332

448

return _timedelta_to_milliseconds(self.approval_delay)

333

449

334

def __init__(self, name = None, disable_hook=None, config=None):

450

def __init__(self, name = None, config=None):

335

451

"""Note: the 'checker' key in 'config' sets the

336

452

'checker_command' attribute and *not* the 'checker'

337

453

attribute."""

357

473

% self.name)

358

474

self.host = config.get("host", "")

359

475

self.created = datetime.datetime.utcnow()

360

self.enabled = False

476

self.enabled = config.get("enabled", True)

361

477

self.last_approval_request = None

362

self.last_enabled = None

478

if self.enabled:

479

self.last_enabled = datetime.datetime.utcnow()

480

else:

481

self.last_enabled = None

363

482

self.last_checked_ok = None

483

self.last_checker_status = None

364

484

self.timeout = string_to_delta(config["timeout"])

365

485

self.extended_timeout = string_to_delta(config

366

486

["extended_timeout"])

367

487

self.interval = string_to_delta(config["interval"])

368

self.disable_hook = disable_hook

369

488

self.checker = None

370

489

self.checker_initiator_tag = None

371

490

self.disable_initiator_tag = None

372

self.expires = None

491

if self.enabled:

492

self.expires = datetime.datetime.utcnow() + self.timeout

493

else:

494

self.expires = None

373

495

self.checker_callback_tag = None

374

496

self.checker_command = config["checker"]

375

497

self.current_checker_command = None

376

self.last_connect = None

377

498

self._approved = None

378

499

self.approved_by_default = config.get("approved_by_default",

379

500

True)

385

506

self.changedstate = (multiprocessing_manager

386

507

.Condition(multiprocessing_manager

387

508

.Lock()))

509

self.client_structure = [attr for attr in

510

self.__dict__.iterkeys()

511

if not attr.startswith("_")]

512

self.client_structure.append("client_structure")

513

514

for name, t in inspect.getmembers(type(self),

515

lambda obj:

516

isinstance(obj,

517

property)):

518

if not name.startswith("_"):

519

self.client_structure.append(name)

388

520

521

# Send notice to process children that client state has changed

389

522

def send_changedstate(self):

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

523

with self.changedstate:

524

self.changedstate.notify_all()

393

525

394

526

def enable(self):

395

527

"""Start this client's checker and timeout hooks"""

397

529

# Already enabled

398

530

return

399

531

self.send_changedstate()

400

# Schedule a new checker to be started an 'interval' from now,

401

# and every interval from then on.

402

self.checker_initiator_tag = (gobject.timeout_add

403

(self.interval_milliseconds(),

404

self.start_checker))

405

# Schedule a disable() when 'timeout' has passed

406

532

self.expires = datetime.datetime.utcnow() + self.timeout

407

self.disable_initiator_tag = (gobject.timeout_add

408

(self.timeout_milliseconds(),

409

self.disable))

410

533

self.enabled = True

411

534

self.last_enabled = datetime.datetime.utcnow()

412

# Also start a new checker *right now*.

413

self.start_checker()

535

self.init_checker()

414

536

415

537

def disable(self, quiet=True):

416

538

"""Disable this client."""

428

550

gobject.source_remove(self.checker_initiator_tag)

429

551

self.checker_initiator_tag = None

430

552

self.stop_checker()

431

if self.disable_hook:

432

self.disable_hook(self)

433

553

self.enabled = False

434

554

# Do not run this again if called by a gobject.timeout_add

435

555

return False

436

556

437

557

def __del__(self):

438

self.disable_hook = None

439

558

self.disable()

440

559

560

def init_checker(self):

561

# Schedule a new checker to be started an 'interval' from now,

562

# and every interval from then on.

563

self.checker_initiator_tag = (gobject.timeout_add

564

(self.interval_milliseconds(),

565

self.start_checker))

566

# Schedule a disable() when 'timeout' has passed

567

self.disable_initiator_tag = (gobject.timeout_add

568

(self.timeout_milliseconds(),

569

self.disable))

570

# Also start a new checker *right now*.

571

self.start_checker()

572

441

573

def checker_callback(self, pid, condition, command):

442

574

"""The checker has completed, so take appropriate actions."""

443

575

self.checker_callback_tag = None

444

576

self.checker = None

445

577

if os.WIFEXITED(condition):

446

exitstatus = os.WEXITSTATUS(condition)

447

if exitstatus == 0:

578

self.last_checker_status = os.WEXITSTATUS(condition)

579

if self.last_checker_status == 0:

448

580

logger.info("Checker for %(name)s succeeded",

449

581

vars(self))

450

582

self.checked_ok()

452

584

logger.info("Checker for %(name)s failed",

453

585

vars(self))

454

586

else:

587

self.last_checker_status = -1

455

588

logger.warning("Checker for %(name)s crashed?",

456

589

vars(self))

457

590

691

824

692

825

Note: Will not include properties with access="write".

693

826

"""

694

all = {}

827

properties = {}

695

828

for name, prop in self._get_all_dbus_properties():

696

829

if (interface_name

697

830

and interface_name != prop._dbus_interface):

702

835

continue

703

836

value = prop()

704

837

if not hasattr(value, "variant_level"):

705

all[name] = value

838

properties[name] = value

706

839

continue

707

all[name] = type(value)(value, variant_level=

708

value.variant_level+1)

709

return dbus.Dictionary(all, signature="sv")

840

properties[name] = type(value)(value, variant_level=

841

value.variant_level+1)

842

return dbus.Dictionary(properties, signature="sv")

710

843

711

844

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

712

845

out_signature="s",

763

896

return dbus.String(dt.isoformat(),

764

897

variant_level=variant_level)

765

898

899

766

900

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

767

901

.__metaclass__):

768

902

"""Applied to an empty subclass of a D-Bus object, this metaclass

860

994

attribute.func_closure)))

861

995

return type.__new__(mcs, name, bases, attr)

862

996

997

863

998

class ClientDBus(Client, DBusObjectWithProperties):

864

999

"""A Client class using D-Bus

865

1000

874

1009

# dbus.service.Object doesn't use super(), so we can't either.

875

1010

876

1011

def __init__(self, bus = None, *args, **kwargs):

1012

self.bus = bus

1013

Client.__init__(self, *args, **kwargs)

1014

877

1015

self._approvals_pending = 0

878

self.bus = bus

879

Client.__init__(self, *args, **kwargs)

880

1016

# Only now, when this client is initialized, can it show up on

881

1017

# the D-Bus

882

1018

client_object_name = unicode(self.name).translate(

892

1028

variant_level=1):

893

1029

""" Modify a variable so that it's a property which announces

894

1030

its changes to DBus.

895

1031

896

1032

transform_fun: Function that takes a value and a variant_level

897

1033

and transforms it to a D-Bus type.

898

1034

dbus_name: D-Bus name of the variable

1052

1188

"D-Bus signal"

1053

1189

return self.need_approval()

1054

1190

1191

# NeRwequest - signal

1192

@dbus.service.signal(_interface, signature="s")

1193

def NewRequest(self, ip):

1194

"""D-Bus signal

1195

Is sent after a client request a password.

1196

"""

1197

pass

1198

1055

1199

## Methods

1056

1200

1057

1201

# Approve - method

1140

1284

# Created - property

1141

1285

@dbus_service_property(_interface, signature="s", access="read")

1142

1286

def Created_dbus_property(self):

1143

return dbus.String(datetime_to_dbus(self.created))

1287

return datetime_to_dbus(self.created)

1144

1288

1145

1289

# LastEnabled - property

1146

1290

@dbus_service_property(_interface, signature="s", access="read")

1222

1366

self.interval = datetime.timedelta(0, 0, 0, value)

1223

1367

if getattr(self, "checker_initiator_tag", None) is None:

1224

1368

return

1225

# Reschedule checker run

1226

gobject.source_remove(self.checker_initiator_tag)

1227

self.checker_initiator_tag = (gobject.timeout_add

1228

(value, self.start_checker))

1229

self.start_checker() # Start one now, too

1369

if self.enabled:

1370

# Reschedule checker run

1371

gobject.source_remove(self.checker_initiator_tag)

1372

self.checker_initiator_tag = (gobject.timeout_add

1373

(value, self.start_checker))

1374

self.start_checker() # Start one now, too

1230

1375

1231

1376

# Checker - property

1232

1377

@dbus_service_property(_interface, signature="s",

1286

1431

return super(ProxyClient, self).__setattr__(name, value)

1287

1432

self._pipe.send(('setattr', name, value))

1288

1433

1434

1289

1435

class ClientDBusTransitional(ClientDBus):

1290

1436

__metaclass__ = AlternateDBusNamesMetaclass

1291

1437

1438

1292

1439

class ClientHandler(socketserver.BaseRequestHandler, object):

1293

1440

"""A class to handle client connections.

1294

1441

1355

1502

logger.warning("Bad certificate: %s", error)

1356

1503

return

1357

1504

logger.debug("Fingerprint: %s", fpr)

1505

if self.server.use_dbus:

1506

# Emit D-Bus signal

1507

client.NewRequest(str(self.client_address))

1358

1508

1359

1509

try:

1360

1510

client = ProxyClient(child_pipe, fpr,

1504

1654

# Convert the buffer to a Python bytestring

1505

1655

fpr = ctypes.string_at(buf, buf_len.value)

1506

1656

# Convert the bytestring to hexadecimal notation

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1657

hex_fpr = binascii.hexlify(fpr).upper()

1508

1658

return hex_fpr

1509

1659

1510

1660

1624

1774

self.enabled = False

1625

1775

self.clients = clients

1626

1776

if self.clients is None:

1627

self.clients = set()

1777

self.clients = {}

1628

1778

self.use_dbus = use_dbus

1629

1779

self.gnutls_priority = gnutls_priority

1630

1780

IPv6_TCPServer.__init__(self, server_address,

1677

1827

fpr = request[1]

1678

1828

address = request[2]

1679

1829

1680

for c in self.clients:

1830

for c in self.clients.itervalues():

1681

1831

if c.fingerprint == fpr:

1682

1832

client = c

1683

1833

break

1767

1917

return timevalue

1768

1918

1769

1919

1770

def if_nametoindex(interface):

1771

"""Call the C function if_nametoindex(), or equivalent

1772

1773

Note: This function cannot accept a unicode string."""

1774

global if_nametoindex

1775

try:

1776

if_nametoindex = (ctypes.cdll.LoadLibrary

1777

(ctypes.util.find_library("c"))

1778

.if_nametoindex)

1779

except (OSError, AttributeError):

1780

logger.warning("Doing if_nametoindex the hard way")

1781

def if_nametoindex(interface):

1782

"Get an interface index the hard way, i.e. using fcntl()"

1783

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1784

with contextlib.closing(socket.socket()) as s:

1785

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1786

struct.pack(str("16s16x"),

1787

interface))

1788

interface_index = struct.unpack(str("I"),

1789

ifreq[16:20])[0]

1790

return interface_index

1791

return if_nametoindex(interface)

1792

1793

1794

1920

def daemon(nochdir = False, noclose = False):

1795

1921

"""See daemon(3). Standard BSD Unix function.

1796

1922

1851

1977

" system bus interface")

1852

1978

parser.add_argument("--no-ipv6", action="store_false",

1853

1979

dest="use_ipv6", help="Do not use IPv6")

1980

parser.add_argument("--no-restore", action="store_false",

1981

dest="restore", help="Do not restore stored"

1982

" state")

1983

parser.add_argument("--statedir", metavar="DIR",

1984

help="Directory to save/restore state in")

1985

1854

1986

options = parser.parse_args()

1855

1987

1856

1988

if options.check:

1869

2001

"use_dbus": "True",

1870

2002

"use_ipv6": "True",

1871

2003

"debuglevel": "",

2004

"restore": "True",

2005

"statedir": "/var/lib/mandos"

1872

2006

}

1873

2007

1874

2008

# Parse config file for server-global settings

1891

2025

# options, if set.

1892

2026

for option in ("interface", "address", "port", "debug",

1893

2027

"priority", "servicename", "configdir",

1894

"use_dbus", "use_ipv6", "debuglevel"):

2028

"use_dbus", "use_ipv6", "debuglevel", "restore",

2029

"statedir"):

1895

2030

value = getattr(options, option)

1896

2031

if value is not None:

1897

2032

server_settings[option] = value

1909

2044

debuglevel = server_settings["debuglevel"]

1910

2045

use_dbus = server_settings["use_dbus"]

1911

2046

use_ipv6 = server_settings["use_ipv6"]

2047

stored_state_path = os.path.join(server_settings["statedir"],

2048

stored_state_file)

2049

2050

if debug:

2051

initlogger(logging.DEBUG)

2052

else:

2053

if not debuglevel:

2054

initlogger()

2055

else:

2056

level = getattr(logging, debuglevel.upper())

2057

initlogger(level)

1912

2058

1913

2059

if server_settings["servicename"] != "Mandos":

1914

2060

syslogger.setFormatter(logging.Formatter

1969

2115

if error[0] != errno.EPERM:

1970

2116

raise error

1971

2117

1972

if not debug and not debuglevel:

1973

syslogger.setLevel(logging.WARNING)

1974

console.setLevel(logging.WARNING)

1975

if debuglevel:

1976

level = getattr(logging, debuglevel.upper())

1977

syslogger.setLevel(level)

1978

console.setLevel(level)

1979

1980

2118

if debug:

1981

2119

# Enable all possible GnuTLS debugging

1982

2120

2024

2162

server_settings["use_dbus"] = False

2025

2163

tcp_server.use_dbus = False

2026

2164

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

2029

protocol = protocol, bus = bus)

2165

service = AvahiServiceToSyslog(name =

2166

server_settings["servicename"],

2167

servicetype = "_mandos._tcp",

2168

protocol = protocol, bus = bus)

2030

2169

if server_settings["interface"]:

2031

2170

service.interface = (if_nametoindex

2032

2171

(str(server_settings["interface"])))

2038

2177

if use_dbus:

2039

2178

client_class = functools.partial(ClientDBusTransitional,

2040

2179

bus = bus)

2041

def client_config_items(config, section):

2042

special_settings = {

2043

"approved_by_default":

2044

lambda: config.getboolean(section,

2045

"approved_by_default"),

2046

}

2047

for name, value in config.items(section):

2180

2181

special_settings = {

2182

# Some settings need to be accessd by special methods;

2183

# booleans need .getboolean(), etc. Here is a list of them:

2184

"approved_by_default":

2185

lambda section:

2186

client_config.getboolean(section, "approved_by_default"),

2187

"enabled":

2188

lambda section:

2189

client_config.getboolean(section, "enabled"),

2190

}

2191

# Construct a new dict of client settings of this form:

2192

# { client_name: {setting_name: value, ...}, ...}

2193

# with exceptions for any special settings as defined above

2194

client_settings = dict((clientname,

2195

dict((setting,

2196

(value

2197

if setting not in special_settings

2198

else special_settings[setting]

2199

(clientname)))

2200

for setting, value in

2201

client_config.items(clientname)))

2202

for clientname in client_config.sections())

2203

2204

old_client_settings = {}

2205

clients_data = []

2206

2207

# Get client data and settings from last running state.

2208

if server_settings["restore"]:

2209

try:

2210

with open(stored_state_path, "rb") as stored_state:

2211

clients_data, old_client_settings = (pickle.load

2212

(stored_state))

2213

os.remove(stored_state_path)

2214

except IOError as e:

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2218

raise

2219

2220

with Crypto() as crypt:

2221

for client in clients_data:

2222

client_name = client["name"]

2223

2224

# Decide which value to use after restoring saved state.

2225

# We have three different values: Old config file,

2226

# new config file, and saved state.

2227

# New config value takes precedence if it differs from old

2228

# config value, otherwise use saved state.

2229

for name, value in client_settings[client_name].items():

2230

try:

2231

# For each value in new config, check if it

2232

# differs from the old config value (Except for

2233

# the "secret" attribute)

2234

if (name != "secret" and

2235

value != old_client_settings[client_name]

2236

[name]):

2237

setattr(client, name, value)

2238

except KeyError:

2239

pass

2240

2241

# Clients who has passed its expire date can still be

2242

# enabled if its last checker was sucessful. Clients

2243

# whose checker failed before we stored its state is

2244

# assumed to have failed all checkers during downtime.

2245

if client["enabled"] and client["last_checked_ok"]:

2246

if ((datetime.datetime.utcnow()

2247

- client["last_checked_ok"])

2248

> client["interval"]):

2249

if client["last_checker_status"] != 0:

2250

client["enabled"] = False

2251

else:

2252

client["expires"] = (datetime.datetime

2253

.utcnow()

2254

+ client["timeout"])

2255

2256

client["changedstate"] = (multiprocessing_manager

2257

.Condition

2258

(multiprocessing_manager

2259

.Lock()))

2260

if use_dbus:

2261

new_client = (ClientDBusTransitional.__new__

2262

(ClientDBusTransitional))

2263

tcp_server.clients[client_name] = new_client

2264

new_client.bus = bus

2265

for name, value in client.iteritems():

2266

setattr(new_client, name, value)

2267

client_object_name = unicode(client_name).translate(

2268

{ord("."): ord("_"),

2269

ord("-"): ord("_")})

2270

new_client.dbus_object_path = (dbus.ObjectPath

2271

("/clients/"

2272

+ client_object_name))

2273

DBusObjectWithProperties.__init__(new_client,

2274

new_client.bus,

2275

new_client

2276

.dbus_object_path)

2277

else:

2278

tcp_server.clients[client_name] = (Client.__new__

2279

(Client))

2280

for name, value in client.iteritems():

2281

setattr(tcp_server.clients[client_name],

2282

name, value)

2283

2048

2284

try:

2049

yield (name, special_settings[name]())

2050

except KeyError:

2051

yield (name, value)

2052

2053

tcp_server.clients.update(set(

2054

client_class(name = section,

2055

config= dict(client_config_items(

2056

client_config, section)))

2057

for section in client_config.sections()))

2285

tcp_server.clients[client_name].secret = (

2286

crypt.decrypt(tcp_server.clients[client_name]

2287

.encrypted_secret,

2288

client_settings[client_name]

2289

["secret"]))

2290

except CryptoError:

2291

# If decryption fails, we use secret from new settings

2292

tcp_server.clients[client_name].secret = (

2293

client_settings[client_name]["secret"])

2294

2295

# Create/remove clients based on new changes made to config

2296

for clientname in set(old_client_settings) - set(client_settings):

2297

del tcp_server.clients[clientname]

2298

for clientname in set(client_settings) - set(old_client_settings):

2299

tcp_server.clients[clientname] = (client_class(name

2300

= clientname,

2301

config =

2302

client_settings

2303

[clientname]))

2304

2058

2305

if not tcp_server.clients:

2059

2306

logger.warning("No clients defined")

2060

2307

2103

2350

def GetAllClients(self):

2104

2351

"D-Bus method"

2105

2352

return dbus.Array(c.dbus_object_path

2106

for c in tcp_server.clients)

2353

for c in

2354

tcp_server.clients.itervalues())

2107

2355

2108

2356

@dbus.service.method(_interface,

2109

2357

out_signature="a{oa{sv}}")

2111

2359

"D-Bus method"

2112

2360

return dbus.Dictionary(

2113

2361

((c.dbus_object_path, c.GetAll(""))

2114

for c in tcp_server.clients),

2362

for c in tcp_server.clients.itervalues()),

2115

2363

signature="oa{sv}")

2116

2364

2117

2365

@dbus.service.method(_interface, in_signature="o")

2118

2366

def RemoveClient(self, object_path):

2119

2367

"D-Bus method"

2120

for c in tcp_server.clients:

2368

for c in tcp_server.clients.itervalues():

2121

2369

if c.dbus_object_path == object_path:

2122

tcp_server.clients.remove(c)

2370

del tcp_server.clients[c.name]

2123

2371

c.remove_from_connection()

2124

2372

# Don't signal anything except ClientRemoved

2125

2373

c.disable(quiet=True)

2139

2387

service.cleanup()

2140

2388

2141

2389

multiprocessing.active_children()

2390

if not (tcp_server.clients or client_settings):

2391

return

2392

2393

# Store client before exiting. Secrets are encrypted with key

2394

# based on what config file has. If config file is

2395

# removed/edited, old secret will thus be unrecovable.

2396

clients = []

2397

with Crypto() as crypt:

2398

for client in tcp_server.clients.itervalues():

2399

key = client_settings[client.name]["secret"]

2400

client.encrypted_secret = crypt.encrypt(client.secret,

2401

key)

2402

client_dict = {}

2403

2404

# A list of attributes that will not be stored when

2405

# shutting down.

2406

exclude = set(("bus", "changedstate", "secret"))

2407

for name, typ in (inspect.getmembers

2408

(dbus.service.Object)):

2409

exclude.add(name)

2410

2411

client_dict["encrypted_secret"] = (client

2412

.encrypted_secret)

2413

for attr in client.client_structure:

2414

if attr not in exclude:

2415

client_dict[attr] = getattr(client, attr)

2416

2417

clients.append(client_dict)

2418

del client_settings[client.name]["secret"]

2419

2420

try:

2421

with os.fdopen(os.open(stored_state_path,

2422

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2423

0600), "wb") as stored_state:

2424

pickle.dump((clients, client_settings), stored_state)

2425

except (IOError, OSError) as e:

2426

logger.warning("Could not save persistent state: {0}"

2427

.format(e))

2428

if e.errno not in (errno.ENOENT, errno.EACCES):

2429

raise

2430

2431

# Delete all clients, and settings from config

2142

2432

while tcp_server.clients:

2143

client = tcp_server.clients.pop()

2433

name, client = tcp_server.clients.popitem()

2144

2434

if use_dbus:

2145

2435

client.remove_from_connection()

2146

client.disable_hook = None

2147

2436

# Don't signal anything except ClientRemoved

2148

2437

client.disable(quiet=True)

2149

2438

if use_dbus:

2151

2440

mandos_dbus_service.ClientRemoved(client

2152

2441

.dbus_object_path,

2153

2442

client.name)

2443

client_settings.clear()

2154

2444

2155

2445

atexit.register(cleanup)

2156

2446

2157

for client in tcp_server.clients:

2447

for client in tcp_server.clients.itervalues():

2158

2448

if use_dbus:

2159

2449

# Emit D-Bus signal

2160

2450

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2161

client.enable()

2451

# Need to initiate checking of clients

2452

if client.enabled:

2453

client.init_checker()

2162

2454

2163

2455

tcp_server.enable()

2164

2456

tcp_server.server_activate()