/mandos/trunk : revision 520

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import hashlib

66

67

68

import dbus

68

69

import dbus.service

73

74

import ctypes.util

74

75

import xml.dom.minidom

75

76

import inspect

77

import Crypto.Cipher.AES

76

78

77

79

try:

78

80

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

83

85

SO_BINDTODEVICE = None

84

86

85

87

86

version = "1.3.1"

87

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

88

version = "1.4.1"

89

90

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

90

93

syslogger = (logging.handlers.SysLogHandler

91

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

95

address = str("/dev/log")))

96

99

logger.addHandler(syslogger)

97

100

98

101

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

100

104

' %(levelname)s:'

101

105

' %(message)s'))

102

106

logger.addHandler(console)

103

107

108

104

109

class AvahiError(Exception):

105

110

def __init__(self, value, *args, **kwargs):

106

111

self.value = value

164

169

.GetAlternativeServiceName(self.name))

165

170

logger.info("Changing Zeroconf service name to %r ...",

166

171

self.name)

167

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

170

% self.name))

171

172

self.remove()

172

173

try:

173

174

self.add()

193

194

avahi.DBUS_INTERFACE_ENTRY_GROUP)

194

195

self.entry_group_state_changed_match = (

195

196

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

197

'StateChanged', self.entry_group_state_changed))

197

198

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

198

199

self.name, self.type)

199

200

self.group.AddService(

265

266

self.server_state_changed)

266

267

self.server_state_changed(self.server.GetState())

267

268

269

class AvahiServiceToSyslog(AvahiService):

270

def rename(self):

271

"""Add the new name to the syslog messages"""

272

ret = AvahiService.rename(self)

273

syslogger.setFormatter(logging.Formatter

274

('Mandos (%s) [%%(process)d]:'

275

' %%(levelname)s: %%(message)s'

276

% self.name))

277

return ret

268

278

269

279

def _timedelta_to_milliseconds(td):

270

280

"Convert a datetime.timedelta() to milliseconds"

289

299

instance %(name)s can be used in the command.

290

300

checker_initiator_tag: a gobject event source tag, or None

291

301

created: datetime.datetime(); (UTC) object creation

302

client_structure: Object describing what attributes a client has

303

and is used for storing the client at exit

292

304

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

305

disable_initiator_tag: a gobject event source tag, or None

295

306

enabled: bool()

296

307

fingerprint: string (40 or 32 hexadecimal digits); used to

299

310

interval: datetime.timedelta(); How often to start a new checker

300

311

last_approval_request: datetime.datetime(); (UTC) or None

301

312

last_checked_ok: datetime.datetime(); (UTC) or None

313

last_checker_status: integer between 0 and 255 reflecting exit status

314

of last checker. -1 reflect crashed checker,

315

or None.

302

316

last_enabled: datetime.datetime(); (UTC)

303

317

name: string; from the config file, used in log messages and

304

318

D-Bus identifiers

331

345

def approval_delay_milliseconds(self):

332

346

return _timedelta_to_milliseconds(self.approval_delay)

333

347

334

def __init__(self, name = None, disable_hook=None, config=None):

348

def __init__(self, name = None, config=None):

335

349

"""Note: the 'checker' key in 'config' sets the

336

350

'checker_command' attribute and *not* the 'checker'

337

351

attribute."""

357

371

% self.name)

358

372

self.host = config.get("host", "")

359

373

self.created = datetime.datetime.utcnow()

360

self.enabled = False

374

self.enabled = True

361

375

self.last_approval_request = None

362

self.last_enabled = None

376

self.last_enabled = datetime.datetime.utcnow()

363

377

self.last_checked_ok = None

378

self.last_checker_status = None

364

379

self.timeout = string_to_delta(config["timeout"])

365

380

self.extended_timeout = string_to_delta(config

366

381

["extended_timeout"])

367

382

self.interval = string_to_delta(config["interval"])

368

self.disable_hook = disable_hook

369

383

self.checker = None

370

384

self.checker_initiator_tag = None

371

385

self.disable_initiator_tag = None

372

self.expires = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

373

387

self.checker_callback_tag = None

374

388

self.checker_command = config["checker"]

375

389

self.current_checker_command = None

376

self.last_connect = None

377

390

self._approved = None

378

391

self.approved_by_default = config.get("approved_by_default",

379

392

True)

385

398

self.changedstate = (multiprocessing_manager

386

399

.Condition(multiprocessing_manager

387

400

.Lock()))

401

self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]

402

self.client_structure.append("client_structure")

403

404

405

for name, t in inspect.getmembers(type(self),

406

lambda obj: isinstance(obj, property)):

407

if not name.startswith("_"):

408

self.client_structure.append(name)

388

409

410

# Send notice to process children that client state has changed

389

411

def send_changedstate(self):

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

412

with self.changedstate:

413

self.changedstate.notify_all()

393

414

394

415

def enable(self):

395

416

"""Start this client's checker and timeout hooks"""

397

418

# Already enabled

398

419

return

399

420

self.send_changedstate()

400

# Schedule a new checker to be started an 'interval' from now,

401

# and every interval from then on.

402

self.checker_initiator_tag = (gobject.timeout_add

403

(self.interval_milliseconds(),

404

self.start_checker))

405

# Schedule a disable() when 'timeout' has passed

406

421

self.expires = datetime.datetime.utcnow() + self.timeout

407

self.disable_initiator_tag = (gobject.timeout_add

408

(self.timeout_milliseconds(),

409

self.disable))

410

422

self.enabled = True

411

423

self.last_enabled = datetime.datetime.utcnow()

412

# Also start a new checker *right now*.

413

self.start_checker()

424

self.init_checker()

414

425

415

426

def disable(self, quiet=True):

416

427

"""Disable this client."""

428

439

gobject.source_remove(self.checker_initiator_tag)

429

440

self.checker_initiator_tag = None

430

441

self.stop_checker()

431

if self.disable_hook:

432

self.disable_hook(self)

433

442

self.enabled = False

434

443

# Do not run this again if called by a gobject.timeout_add

435

444

return False

436

445

437

446

def __del__(self):

438

self.disable_hook = None

439

447

self.disable()

440

448

449

def init_checker(self):

450

# Schedule a new checker to be started an 'interval' from now,

451

# and every interval from then on.

452

self.checker_initiator_tag = (gobject.timeout_add

453

(self.interval_milliseconds(),

454

self.start_checker))

455

# Schedule a disable() when 'timeout' has passed

456

self.disable_initiator_tag = (gobject.timeout_add

457

(self.timeout_milliseconds(),

458

self.disable))

459

# Also start a new checker *right now*.

460

self.start_checker()

461

462

441

463

def checker_callback(self, pid, condition, command):

442

464

"""The checker has completed, so take appropriate actions."""

443

465

self.checker_callback_tag = None

444

466

self.checker = None

445

467

if os.WIFEXITED(condition):

446

exitstatus = os.WEXITSTATUS(condition)

447

if exitstatus == 0:

468

self.last_checker_status = os.WEXITSTATUS(condition)

469

if self.last_checker_status == 0:

448

470

logger.info("Checker for %(name)s succeeded",

449

471

vars(self))

450

472

self.checked_ok()

452

474

logger.info("Checker for %(name)s failed",

453

475

vars(self))

454

476

else:

477

self.last_checker_status = -1

455

478

logger.warning("Checker for %(name)s crashed?",

456

479

vars(self))

457

480

464

487

if timeout is None:

465

488

timeout = self.timeout

466

489

self.last_checked_ok = datetime.datetime.utcnow()

467

gobject.source_remove(self.disable_initiator_tag)

468

self.expires = datetime.datetime.utcnow() + timeout

469

self.disable_initiator_tag = (gobject.timeout_add

470

(_timedelta_to_milliseconds

471

(timeout), self.disable))

490

if self.disable_initiator_tag is not None:

491

gobject.source_remove(self.disable_initiator_tag)

492

if getattr(self, "enabled", False):

493

self.disable_initiator_tag = (gobject.timeout_add

494

(_timedelta_to_milliseconds

495

(timeout), self.disable))

496

self.expires = datetime.datetime.utcnow() + timeout

472

497

473

498

def need_approval(self):

474

499

self.last_approval_request = datetime.datetime.utcnow()

566

591

raise

567

592

self.checker = None

568

593

594

# Encrypts a client secret and stores it in a varible encrypted_secret

595

def encrypt_secret(self, key):

596

# Encryption-key need to be of a specific size, so we hash inputed key

597

hasheng = hashlib.sha256()

598

hasheng.update(key)

599

encryptionkey = hasheng.digest()

600

601

# Create validation hash so we know at decryption if it was sucessful

602

hasheng = hashlib.sha256()

603

hasheng.update(self.secret)

604

validationhash = hasheng.digest()

605

606

# Encrypt secret

607

iv = os.urandom(Crypto.Cipher.AES.block_size)

608

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

609

Crypto.Cipher.AES.MODE_CFB, iv)

610

ciphertext = ciphereng.encrypt(validationhash+self.secret)

611

self.encrypted_secret = (ciphertext, iv)

612

613

# Decrypt a encrypted client secret

614

def decrypt_secret(self, key):

615

# Decryption-key need to be of a specific size, so we hash inputed key

616

hasheng = hashlib.sha256()

617

hasheng.update(key)

618

encryptionkey = hasheng.digest()

619

620

# Decrypt encrypted secret

621

ciphertext, iv = self.encrypted_secret

622

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

623

Crypto.Cipher.AES.MODE_CFB, iv)

624

plain = ciphereng.decrypt(ciphertext)

625

626

# Validate decrypted secret to know if it was succesful

627

hasheng = hashlib.sha256()

628

validationhash = plain[:hasheng.digest_size]

629

secret = plain[hasheng.digest_size:]

630

hasheng.update(secret)

631

632

# if validation fails, we use key as new secret. Otherwhise, we use

633

# the decrypted secret

634

if hasheng.digest() == validationhash:

635

self.secret = secret

636

else:

637

self.secret = key

638

del self.encrypted_secret

639

569

640

570

641

def dbus_service_property(dbus_interface, signature="v",

571

642

access="readwrite", byte_arrays=False):

872

943

# dbus.service.Object doesn't use super(), so we can't either.

873

944

874

945

def __init__(self, bus = None, *args, **kwargs):

946

self.bus = bus

947

Client.__init__(self, *args, **kwargs)

948

875

949

self._approvals_pending = 0

876

self.bus = bus

877

Client.__init__(self, *args, **kwargs)

878

950

# Only now, when this client is initialized, can it show up on

879

951

# the D-Bus

880

952

client_object_name = unicode(self.name).translate(

891

963

""" Modify a variable so that it's a property which announces

892

964

its changes to DBus.

893

965

894

transform_fun: Function that takes a value and transforms it

895

to a D-Bus type.

966

transform_fun: Function that takes a value and a variant_level

967

and transforms it to a D-Bus type.

896

968

dbus_name: D-Bus name of the variable

897

969

type_func: Function that transform the value before sending it

898

970

to the D-Bus. Default: no transform

905

977

type_func(getattr(self, attrname, None))

906

978

!= type_func(value)):

907

979

dbus_value = transform_func(type_func(value),

908

variant_level)

980

variant_level

981

=variant_level)

909

982

self.PropertyChanged(dbus.String(dbus_name),

910

983

dbus_value)

911

984

setattr(self, attrname, value)

1187

1260

gobject.source_remove(self.disable_initiator_tag)

1188

1261

self.disable_initiator_tag = None

1189

1262

self.expires = None

1190

time_to_die = (self.

1191

_timedelta_to_milliseconds((self

1192

.last_checked_ok

1193

+ self.timeout)

1194

- datetime.datetime

1195

.utcnow()))

1263

time_to_die = _timedelta_to_milliseconds((self

1264

.last_checked_ok

1265

+ self.timeout)

1266

- datetime.datetime

1267

.utcnow())

1196

1268

if time_to_die <= 0:

1197

1269

# The timeout has passed

1198

1270

self.disable()

1394

1466

return

1395

1467

1396

1468

#wait until timeout or approved

1397

#x = float(client

1398

# ._timedelta_to_milliseconds(delay))

1399

1469

time = datetime.datetime.now()

1400

1470

client.changedstate.acquire()

1401

1471

(client.changedstate.wait

1430

1500

sent_size += sent

1431

1501

1432

1502

logger.info("Sending secret to %s", client.name)

1433

# bump the timeout as if seen

1503

# bump the timeout using extended_timeout

1434

1504

client.checked_ok(client.extended_timeout)

1435

1505

if self.server.use_dbus:

1436

1506

# Emit D-Bus signal

1516

1586

except:

1517

1587

self.handle_error(request, address)

1518

1588

self.close_request(request)

1519

1589

1520

1590

def process_request(self, request, address):

1521

1591

"""Start a new process to process the request."""

1522

multiprocessing.Process(target = self.sub_process_main,

1523

args = (request, address)).start()

1592

proc = multiprocessing.Process(target = self.sub_process_main,

1593

args = (request,

1594

address))

1595

proc.start()

1596

return proc

1524

1597

1525

1598

1526

1599

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1532

1605

"""

1533

1606

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1534

1607

1535

super(MultiprocessingMixInWithPipe,

1536

self).process_request(request, client_address)

1608

proc = MultiprocessingMixIn.process_request(self, request,

1609

client_address)

1537

1610

self.child_pipe.close()

1538

self.add_pipe(parent_pipe)

1611

self.add_pipe(parent_pipe, proc)

1539

1612

1540

def add_pipe(self, parent_pipe):

1613

def add_pipe(self, parent_pipe, proc):

1541

1614

"""Dummy function; override as necessary"""

1542

1615

raise NotImplementedError

1543

1616

1621

1694

self.enabled = False

1622

1695

self.clients = clients

1623

1696

if self.clients is None:

1624

self.clients = set()

1697

self.clients = {}

1625

1698

self.use_dbus = use_dbus

1626

1699

self.gnutls_priority = gnutls_priority

1627

1700

IPv6_TCPServer.__init__(self, server_address,

1631

1704

def server_activate(self):

1632

1705

if self.enabled:

1633

1706

return socketserver.TCPServer.server_activate(self)

1707

1634

1708

def enable(self):

1635

1709

self.enabled = True

1636

def add_pipe(self, parent_pipe):

1710

1711

def add_pipe(self, parent_pipe, proc):

1637

1712

# Call "handle_ipc" for both data and EOF events

1638

1713

gobject.io_add_watch(parent_pipe.fileno(),

1639

1714

gobject.IO_IN | gobject.IO_HUP,

1640

1715

functools.partial(self.handle_ipc,

1641

1716

parent_pipe =

1642

parent_pipe))

1717

parent_pipe,

1718

proc = proc))

1643

1719

1644

1720

def handle_ipc(self, source, condition, parent_pipe=None,

1645

client_object=None):

1721

proc = None, client_object=None):

1646

1722

condition_names = {

1647

1723

gobject.IO_IN: "IN", # There is data to read.

1648

1724

gobject.IO_OUT: "OUT", # Data can be written (without

1657

1733

for cond, name in

1658

1734

condition_names.iteritems()

1659

1735

if cond & condition)

1660

# error or the other end of multiprocessing.Pipe has closed

1736

# error, or the other end of multiprocessing.Pipe has closed

1661

1737

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1738

# Wait for other process to exit

1739

proc.join()

1662

1740

return False

1663

1741

1664

1742

# Read a request from the child

1669

1747

fpr = request[1]

1670

1748

address = request[2]

1671

1749

1672

for c in self.clients:

1750

for c in self.clients.itervalues():

1673

1751

if c.fingerprint == fpr:

1674

1752

client = c

1675

1753

break

1688

1766

functools.partial(self.handle_ipc,

1689

1767

parent_pipe =

1690

1768

parent_pipe,

1769

proc = proc,

1691

1770

client_object =

1692

1771

client))

1693

1772

parent_pipe.send(True)

1842

1921

" system bus interface")

1843

1922

parser.add_argument("--no-ipv6", action="store_false",

1844

1923

dest="use_ipv6", help="Do not use IPv6")

1924

parser.add_argument("--no-restore", action="store_false",

1925

dest="restore", help="Do not restore stored state",

1926

default=True)

1927

1845

1928

options = parser.parse_args()

1846

1929

1847

1930

if options.check:

1882

1965

# options, if set.

1883

1966

for option in ("interface", "address", "port", "debug",

1884

1967

"priority", "servicename", "configdir",

1885

"use_dbus", "use_ipv6", "debuglevel"):

1968

"use_dbus", "use_ipv6", "debuglevel", "restore"):

1886

1969

value = getattr(options, option)

1887

1970

if value is not None:

1888

1971

server_settings[option] = value

1961

2044

raise error

1962

2045

1963

2046

if not debug and not debuglevel:

1964

syslogger.setLevel(logging.WARNING)

1965

console.setLevel(logging.WARNING)

2047

logger.setLevel(logging.WARNING)

1966

2048

if debuglevel:

1967

2049

level = getattr(logging, debuglevel.upper())

1968

syslogger.setLevel(level)

1969

console.setLevel(level)

2050

logger.setLevel(level)

1970

2051

1971

2052

if debug:

2053

logger.setLevel(logging.DEBUG)

1972

2054

# Enable all possible GnuTLS debugging

1973

2055

1974

2056

# "Use a log level over 10 to enable all debugging options."

2015

2097

server_settings["use_dbus"] = False

2016

2098

tcp_server.use_dbus = False

2017

2099

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2018

service = AvahiService(name = server_settings["servicename"],

2019

servicetype = "_mandos._tcp",

2020

protocol = protocol, bus = bus)

2100

service = AvahiServiceToSyslog(name =

2101

server_settings["servicename"],

2102

servicetype = "_mandos._tcp",

2103

protocol = protocol, bus = bus)

2021

2104

if server_settings["interface"]:

2022

2105

service.interface = (if_nametoindex

2023

2106

(str(server_settings["interface"])))

2029

2112

if use_dbus:

2030

2113

client_class = functools.partial(ClientDBusTransitional,

2031

2114

bus = bus)

2032

def client_config_items(config, section):

2033

special_settings = {

2034

"approved_by_default":

2035

lambda: config.getboolean(section,

2036

"approved_by_default"),

2037

}

2038

for name, value in config.items(section):

2115

2116

special_settings = {

2117

# Some settings need to be accessd by special methods;

2118

# booleans need .getboolean(), etc. Here is a list of them:

2119

"approved_by_default":

2120

lambda section:

2121

client_config.getboolean(section, "approved_by_default"),

2122

}

2123

# Construct a new dict of client settings of this form:

2124

# { client_name: {setting_name: value, ...}, ...}

2125

# with exceptions for any special settings as defined above

2126

client_settings = dict((clientname,

2127

dict((setting,

2128

(value if setting not in special_settings

2129

else special_settings[setting](clientname)))

2130

for setting, value in client_config.items(clientname)))

2131

for clientname in client_config.sections())

2132

2133

old_client_settings = {}

2134

clients_data = []

2135

2136

# Get client data and settings from last running state.

2137

if server_settings["restore"]:

2138

try:

2139

with open(stored_state_path, "rb") as stored_state:

2140

clients_data, old_client_settings = pickle.load(stored_state)

2141

os.remove(stored_state_path)

2142

except IOError as e:

2143

logger.warning("Could not load persistant state: {0}".format(e))

2144

if e.errno != errno.ENOENT:

2145

raise

2146

2147

for client in clients_data:

2148

client_name = client["name"]

2149

2150

# Decide which value to use after restoring saved state.

2151

# We have three different values: Old config file,

2152

# new config file, and saved state.

2153

# New config value takes precedence if it differs from old

2154

# config value, otherwise use saved state.

2155

for name, value in client_settings[client_name].items():

2039

2156

try:

2040

yield (name, special_settings[name]())

2157

# For each value in new config, check if it differs

2158

# from the old config value (Except for the "secret"

2159

# attribute)

2160

if name != "secret" and value != old_client_settings[client_name][name]:

2161

setattr(client, name, value)

2041

2162

except KeyError:

2042

yield (name, value)

2163

pass

2164

2165

# Clients who has passed its expire date, can still be enabled if its

2166

# last checker was sucessful. Clients who checkers failed before we

2167

# stored it state is asumed to had failed checker during downtime.

2168

if client["enabled"] and client["last_checked_ok"]:

2169

if ((datetime.datetime.utcnow() - client["last_checked_ok"])

2170

> client["interval"]):

2171

if client["last_checker_status"] != 0:

2172

client["enabled"] = False

2173

else:

2174

client["expires"] = datetime.datetime.utcnow() + client["timeout"]

2175

2176

client["changedstate"] = (multiprocessing_manager

2177

.Condition(multiprocessing_manager

2178

.Lock()))

2179

if use_dbus:

2180

new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)

2181

tcp_server.clients[client_name] = new_client

2182

new_client.bus = bus

2183

for name, value in client.iteritems():

2184

setattr(new_client, name, value)

2185

client_object_name = unicode(client_name).translate(

2186

{ord("."): ord("_"),

2187

ord("-"): ord("_")})

2188

new_client.dbus_object_path = (dbus.ObjectPath

2189

("/clients/" + client_object_name))

2190

DBusObjectWithProperties.__init__(new_client,

2191

new_client.bus,

2192

new_client.dbus_object_path)

2193

else:

2194

tcp_server.clients[client_name] = Client.__new__(Client)

2195

for name, value in client.iteritems():

2196

setattr(tcp_server.clients[client_name], name, value)

2197

2198

tcp_server.clients[client_name].decrypt_secret(

2199

client_settings[client_name]["secret"])

2200

2201

# Create/remove clients based on new changes made to config

2202

for clientname in set(old_client_settings) - set(client_settings):

2203

del tcp_server.clients[clientname]

2204

for clientname in set(client_settings) - set(old_client_settings):

2205

tcp_server.clients[clientname] = (client_class(name = clientname,

2206

config =

2207

client_settings

2208

[clientname]))

2043

2209

2044

tcp_server.clients.update(set(

2045

client_class(name = section,

2046

config= dict(client_config_items(

2047

client_config, section)))

2048

for section in client_config.sections()))

2210

2049

2211

if not tcp_server.clients:

2050

2212

logger.warning("No clients defined")

2051

2213

2094

2256

def GetAllClients(self):

2095

2257

"D-Bus method"

2096

2258

return dbus.Array(c.dbus_object_path

2097

for c in tcp_server.clients)

2259

for c in

2260

tcp_server.clients.itervalues())

2098

2261

2099

2262

@dbus.service.method(_interface,

2100

2263

out_signature="a{oa{sv}}")

2102

2265

"D-Bus method"

2103

2266

return dbus.Dictionary(

2104

2267

((c.dbus_object_path, c.GetAll(""))

2105

for c in tcp_server.clients),

2268

for c in tcp_server.clients.itervalues()),

2106

2269

signature="oa{sv}")

2107

2270

2108

2271

@dbus.service.method(_interface, in_signature="o")

2109

2272

def RemoveClient(self, object_path):

2110

2273

"D-Bus method"

2111

for c in tcp_server.clients:

2274

for c in tcp_server.clients.itervalues():

2112

2275

if c.dbus_object_path == object_path:

2113

tcp_server.clients.remove(c)

2276

del tcp_server.clients[c.name]

2114

2277

c.remove_from_connection()

2115

2278

# Don't signal anything except ClientRemoved

2116

2279

c.disable(quiet=True)

2129

2292

"Cleanup function; run on exit"

2130

2293

service.cleanup()

2131

2294

2295

multiprocessing.active_children()

2296

if not (tcp_server.clients or client_settings):

2297

return

2298

2299

# Store client before exiting. Secrets are encrypted with key based

2300

# on what config file has. If config file is removed/edited, old

2301

# secret will thus be unrecovable.

2302

clients = []

2303

for client in tcp_server.clients.itervalues():

2304

client.encrypt_secret(client_settings[client.name]["secret"])

2305

2306

client_dict = {}

2307

2308

# A list of attributes that will not be stored when shuting down.

2309

exclude = set(("bus", "changedstate", "secret"))

2310

for name, typ in inspect.getmembers(dbus.service.Object):

2311

exclude.add(name)

2312

2313

client_dict["encrypted_secret"] = client.encrypted_secret

2314

for attr in client.client_structure:

2315

if attr not in exclude:

2316

client_dict[attr] = getattr(client, attr)

2317

2318

clients.append(client_dict)

2319

del client_settings[client.name]["secret"]

2320

2321

try:

2322

with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:

2323

pickle.dump((clients, client_settings), stored_state)

2324

except IOError as e:

2325

logger.warning("Could not save persistant state: {0}".format(e))

2326

if e.errno != errno.ENOENT:

2327

raise

2328

2329

# Delete all clients, and settings from config

2132

2330

while tcp_server.clients:

2133

client = tcp_server.clients.pop()

2331

name, client = tcp_server.clients.popitem()

2134

2332

if use_dbus:

2135

2333

client.remove_from_connection()

2136

client.disable_hook = None

2137

2334

# Don't signal anything except ClientRemoved

2138

2335

client.disable(quiet=True)

2139

2336

if use_dbus:

2141

2338

mandos_dbus_service.ClientRemoved(client

2142

2339

.dbus_object_path,

2143

2340

client.name)

2341

client_settings.clear()

2144

2342

2145

2343

atexit.register(cleanup)

2146

2344

2147

for client in tcp_server.clients:

2345

for client in tcp_server.clients.itervalues():

2148

2346

if use_dbus:

2149

2347

# Emit D-Bus signal

2150

2348

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2151

client.enable()

2349

# Need to initiate checking of clients

2350

if client.enabled:

2351

client.init_checker()

2352

2152

2353

2153

2354

tcp_server.enable()

2154

2355

tcp_server.server_activate()