/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

working new feature: network-hooks - Enables user-scripts to take up
                     interfaces during bootup

Show diffs side-by-side

added added

removed removed

Lines of Context:
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
31
# Contact the authors at <mandos@recompile.se>.
32
32
33
33
 
34
34
from __future__ import (division, absolute_import, print_function,
62
62
import functools
63
63
import cPickle as pickle
64
64
import multiprocessing
 
65
import types
 
66
import binascii
 
67
import tempfile
65
68
 
66
69
import dbus
67
70
import dbus.service
72
75
import ctypes.util
73
76
import xml.dom.minidom
74
77
import inspect
 
78
import GnuPGInterface
75
79
 
76
80
try:
77
81
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
81
85
    except ImportError:
82
86
        SO_BINDTODEVICE = None
83
87
 
84
 
 
85
 
version = "1.3.1"
86
 
 
87
 
#logger = logging.getLogger('mandos')
88
 
logger = logging.Logger('mandos')
 
88
version = "1.4.1"
 
89
stored_state_file = "clients.pickle"
 
90
 
 
91
logger = logging.getLogger()
89
92
syslogger = (logging.handlers.SysLogHandler
90
93
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
94
              address = str("/dev/log")))
92
 
syslogger.setFormatter(logging.Formatter
93
 
                       ('Mandos [%(process)d]: %(levelname)s:'
94
 
                        ' %(message)s'))
95
 
logger.addHandler(syslogger)
96
 
 
97
 
console = logging.StreamHandler()
98
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
 
                                       ' %(levelname)s:'
100
 
                                       ' %(message)s'))
101
 
logger.addHandler(console)
 
95
 
 
96
try:
 
97
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
98
                      (ctypes.util.find_library("c"))
 
99
                      .if_nametoindex)
 
100
except (OSError, AttributeError):
 
101
    def if_nametoindex(interface):
 
102
        "Get an interface index the hard way, i.e. using fcntl()"
 
103
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
104
        with contextlib.closing(socket.socket()) as s:
 
105
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
106
                                struct.pack(str("16s16x"),
 
107
                                            interface))
 
108
        interface_index = struct.unpack(str("I"),
 
109
                                        ifreq[16:20])[0]
 
110
        return interface_index
 
111
 
 
112
 
 
113
def initlogger(level=logging.WARNING):
 
114
    """init logger and add loglevel"""
 
115
    
 
116
    syslogger.setFormatter(logging.Formatter
 
117
                           ('Mandos [%(process)d]: %(levelname)s:'
 
118
                            ' %(message)s'))
 
119
    logger.addHandler(syslogger)
 
120
    
 
121
    console = logging.StreamHandler()
 
122
    console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
123
                                           ' [%(process)d]:'
 
124
                                           ' %(levelname)s:'
 
125
                                           ' %(message)s'))
 
126
    logger.addHandler(console)
 
127
    logger.setLevel(level)
 
128
 
 
129
 
 
130
class PGPError(Exception):
 
131
    """Exception if encryption/decryption fails"""
 
132
    pass
 
133
 
 
134
 
 
135
class PGPEngine(object):
 
136
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
137
    def __init__(self):
 
138
        self.gnupg = GnuPGInterface.GnuPG()
 
139
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
140
        self.gnupg = GnuPGInterface.GnuPG()
 
141
        self.gnupg.options.meta_interactive = False
 
142
        self.gnupg.options.homedir = self.tempdir
 
143
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
144
                                              '--quiet'])
 
145
    
 
146
    def __enter__(self):
 
147
        return self
 
148
    
 
149
    def __exit__ (self, exc_type, exc_value, traceback):
 
150
        self._cleanup()
 
151
        return False
 
152
    
 
153
    def __del__(self):
 
154
        self._cleanup()
 
155
    
 
156
    def _cleanup(self):
 
157
        if self.tempdir is not None:
 
158
            # Delete contents of tempdir
 
159
            for root, dirs, files in os.walk(self.tempdir,
 
160
                                             topdown = False):
 
161
                for filename in files:
 
162
                    os.remove(os.path.join(root, filename))
 
163
                for dirname in dirs:
 
164
                    os.rmdir(os.path.join(root, dirname))
 
165
            # Remove tempdir
 
166
            os.rmdir(self.tempdir)
 
167
            self.tempdir = None
 
168
    
 
169
    def password_encode(self, password):
 
170
        # Passphrase can not be empty and can not contain newlines or
 
171
        # NUL bytes.  So we prefix it and hex encode it.
 
172
        return b"mandos" + binascii.hexlify(password)
 
173
    
 
174
    def encrypt(self, data, password):
 
175
        self.gnupg.passphrase = self.password_encode(password)
 
176
        with open(os.devnull) as devnull:
 
177
            try:
 
178
                proc = self.gnupg.run(['--symmetric'],
 
179
                                      create_fhs=['stdin', 'stdout'],
 
180
                                      attach_fhs={'stderr': devnull})
 
181
                with contextlib.closing(proc.handles['stdin']) as f:
 
182
                    f.write(data)
 
183
                with contextlib.closing(proc.handles['stdout']) as f:
 
184
                    ciphertext = f.read()
 
185
                proc.wait()
 
186
            except IOError as e:
 
187
                raise PGPError(e)
 
188
        self.gnupg.passphrase = None
 
189
        return ciphertext
 
190
    
 
191
    def decrypt(self, data, password):
 
192
        self.gnupg.passphrase = self.password_encode(password)
 
193
        with open(os.devnull) as devnull:
 
194
            try:
 
195
                proc = self.gnupg.run(['--decrypt'],
 
196
                                      create_fhs=['stdin', 'stdout'],
 
197
                                      attach_fhs={'stderr': devnull})
 
198
                with contextlib.closing(proc.handles['stdin'] ) as f:
 
199
                    f.write(data)
 
200
                with contextlib.closing(proc.handles['stdout']) as f:
 
201
                    decrypted_plaintext = f.read()
 
202
                proc.wait()
 
203
            except IOError as e:
 
204
                raise PGPError(e)
 
205
        self.gnupg.passphrase = None
 
206
        return decrypted_plaintext
 
207
 
 
208
 
102
209
 
103
210
class AvahiError(Exception):
104
211
    def __init__(self, value, *args, **kwargs):
159
266
                            " after %i retries, exiting.",
160
267
                            self.rename_count)
161
268
            raise AvahiServiceError("Too many renames")
162
 
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
 
269
        self.name = unicode(self.server
 
270
                            .GetAlternativeServiceName(self.name))
163
271
        logger.info("Changing Zeroconf service name to %r ...",
164
272
                    self.name)
165
 
        syslogger.setFormatter(logging.Formatter
166
 
                               ('Mandos (%s) [%%(process)d]:'
167
 
                                ' %%(levelname)s: %%(message)s'
168
 
                                % self.name))
169
273
        self.remove()
170
274
        try:
171
275
            self.add()
191
295
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
192
296
        self.entry_group_state_changed_match = (
193
297
            self.group.connect_to_signal(
194
 
                'StateChanged', self .entry_group_state_changed))
 
298
                'StateChanged', self.entry_group_state_changed))
195
299
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
196
300
                     self.name, self.type)
197
301
        self.group.AddService(
223
327
            try:
224
328
                self.group.Free()
225
329
            except (dbus.exceptions.UnknownMethodException,
226
 
                    dbus.exceptions.DBusException) as e:
 
330
                    dbus.exceptions.DBusException):
227
331
                pass
228
332
            self.group = None
229
333
        self.remove()
263
367
                                 self.server_state_changed)
264
368
        self.server_state_changed(self.server.GetState())
265
369
 
 
370
class AvahiServiceToSyslog(AvahiService):
 
371
    def rename(self):
 
372
        """Add the new name to the syslog messages"""
 
373
        ret = AvahiService.rename(self)
 
374
        syslogger.setFormatter(logging.Formatter
 
375
                               ('Mandos (%s) [%%(process)d]:'
 
376
                                ' %%(levelname)s: %%(message)s'
 
377
                                % self.name))
 
378
        return ret
266
379
 
 
380
def timedelta_to_milliseconds(td):
 
381
    "Convert a datetime.timedelta() to milliseconds"
 
382
    return ((td.days * 24 * 60 * 60 * 1000)
 
383
            + (td.seconds * 1000)
 
384
            + (td.microseconds // 1000))
 
385
        
267
386
class Client(object):
268
387
    """A representation of a client host served by this server.
269
388
    
270
389
    Attributes:
271
 
    _approved:   bool(); 'None' if not yet approved/disapproved
 
390
    approved:   bool(); 'None' if not yet approved/disapproved
272
391
    approval_delay: datetime.timedelta(); Time to wait for approval
273
392
    approval_duration: datetime.timedelta(); Duration of one approval
274
393
    checker:    subprocess.Popen(); a running checker process used
281
400
                     instance %(name)s can be used in the command.
282
401
    checker_initiator_tag: a gobject event source tag, or None
283
402
    created:    datetime.datetime(); (UTC) object creation
 
403
    client_structure: Object describing what attributes a client has
 
404
                      and is used for storing the client at exit
284
405
    current_checker_command: string; current running checker_command
285
 
    disable_hook:  If set, called by disable() as disable_hook(self)
286
406
    disable_initiator_tag: a gobject event source tag, or None
287
407
    enabled:    bool()
288
408
    fingerprint: string (40 or 32 hexadecimal digits); used to
291
411
    interval:   datetime.timedelta(); How often to start a new checker
292
412
    last_approval_request: datetime.datetime(); (UTC) or None
293
413
    last_checked_ok: datetime.datetime(); (UTC) or None
294
 
    last_enabled: datetime.datetime(); (UTC)
 
414
    last_checker_status: integer between 0 and 255 reflecting exit
 
415
                         status of last checker. -1 reflects crashed
 
416
                         checker, or None.
 
417
    last_enabled: datetime.datetime(); (UTC) or None
295
418
    name:       string; from the config file, used in log messages and
296
419
                        D-Bus identifiers
297
420
    secret:     bytestring; sent verbatim (over TLS) to client
307
430
                          "created", "enabled", "fingerprint",
308
431
                          "host", "interval", "last_checked_ok",
309
432
                          "last_enabled", "name", "timeout")
310
 
    
311
 
    @staticmethod
312
 
    def _timedelta_to_milliseconds(td):
313
 
        "Convert a datetime.timedelta() to milliseconds"
314
 
        return ((td.days * 24 * 60 * 60 * 1000)
315
 
                + (td.seconds * 1000)
316
 
                + (td.microseconds // 1000))
 
433
    client_defaults = { "timeout": "5m",
 
434
                        "extended_timeout": "15m",
 
435
                        "interval": "2m",
 
436
                        "checker": "fping -q -- %%(host)s",
 
437
                        "host": "",
 
438
                        "approval_delay": "0s",
 
439
                        "approval_duration": "1s",
 
440
                        "approved_by_default": "True",
 
441
                        "enabled": "True",
 
442
                        }
317
443
    
318
444
    def timeout_milliseconds(self):
319
445
        "Return the 'timeout' attribute in milliseconds"
320
 
        return self._timedelta_to_milliseconds(self.timeout)
321
 
 
 
446
        return timedelta_to_milliseconds(self.timeout)
 
447
    
322
448
    def extended_timeout_milliseconds(self):
323
449
        "Return the 'extended_timeout' attribute in milliseconds"
324
 
        return self._timedelta_to_milliseconds(self.extended_timeout)    
 
450
        return timedelta_to_milliseconds(self.extended_timeout)
325
451
    
326
452
    def interval_milliseconds(self):
327
453
        "Return the 'interval' attribute in milliseconds"
328
 
        return self._timedelta_to_milliseconds(self.interval)
329
 
 
 
454
        return timedelta_to_milliseconds(self.interval)
 
455
    
330
456
    def approval_delay_milliseconds(self):
331
 
        return self._timedelta_to_milliseconds(self.approval_delay)
332
 
    
333
 
    def __init__(self, name = None, disable_hook=None, config=None):
 
457
        return timedelta_to_milliseconds(self.approval_delay)
 
458
 
 
459
    @staticmethod
 
460
    def config_parser(config):
 
461
        """ Construct a new dict of client settings of this form:
 
462
        { client_name: {setting_name: value, ...}, ...}
 
463
        with exceptions for any special settings as defined above"""
 
464
        settings = {}
 
465
        for client_name in config.sections():
 
466
            section = dict(config.items(client_name))
 
467
            client = settings[client_name] = {}
 
468
            
 
469
            client["host"] = section["host"]
 
470
            # Reformat values from string types to Python types
 
471
            client["approved_by_default"] = config.getboolean(
 
472
                client_name, "approved_by_default")
 
473
            client["enabled"] = config.getboolean(client_name, "enabled")
 
474
            
 
475
            client["fingerprint"] = (section["fingerprint"].upper()
 
476
                                     .replace(" ", ""))
 
477
            if "secret" in section:
 
478
                client["secret"] = section["secret"].decode("base64")
 
479
            elif "secfile" in section:
 
480
                with open(os.path.expanduser(os.path.expandvars
 
481
                                             (section["secfile"])),
 
482
                          "rb") as secfile:
 
483
                    client["secret"] = secfile.read()
 
484
            else:
 
485
                raise TypeError("No secret or secfile for section %s"
 
486
                                % section)
 
487
            client["timeout"] = string_to_delta(section["timeout"])
 
488
            client["extended_timeout"] = string_to_delta(
 
489
                section["extended_timeout"])
 
490
            client["interval"] = string_to_delta(section["interval"])
 
491
            client["approval_delay"] = string_to_delta(
 
492
                section["approval_delay"])
 
493
            client["approval_duration"] = string_to_delta(
 
494
                section["approval_duration"])
 
495
            client["checker_command"] = section["checker"]
 
496
            client["last_approval_request"] = None
 
497
            client["last_checked_ok"] = None
 
498
            client["last_checker_status"] = None
 
499
            if client["enabled"]:
 
500
                client["last_enabled"] = datetime.datetime.utcnow()
 
501
                client["expires"] = (datetime.datetime.utcnow()
 
502
                                     + client["timeout"])
 
503
            else:
 
504
                client["last_enabled"] = None
 
505
                client["expires"] = None
 
506
 
 
507
        return settings
 
508
        
 
509
        
 
510
    def __init__(self, settings, name = None):
334
511
        """Note: the 'checker' key in 'config' sets the
335
512
        'checker_command' attribute and *not* the 'checker'
336
513
        attribute."""
337
514
        self.name = name
338
 
        if config is None:
339
 
            config = {}
 
515
        # adding all client settings
 
516
        for setting, value in settings.iteritems():
 
517
            setattr(self, setting, value)
 
518
        
340
519
        logger.debug("Creating client %r", self.name)
341
520
        # Uppercase and remove spaces from fingerprint for later
342
521
        # comparison purposes with return value from the fingerprint()
343
522
        # function
344
 
        self.fingerprint = (config["fingerprint"].upper()
345
 
                            .replace(" ", ""))
346
523
        logger.debug("  Fingerprint: %s", self.fingerprint)
347
 
        if "secret" in config:
348
 
            self.secret = config["secret"].decode("base64")
349
 
        elif "secfile" in config:
350
 
            with open(os.path.expanduser(os.path.expandvars
351
 
                                         (config["secfile"])),
352
 
                      "rb") as secfile:
353
 
                self.secret = secfile.read()
354
 
        else:
355
 
            raise TypeError("No secret or secfile for client %s"
356
 
                            % self.name)
357
 
        self.host = config.get("host", "")
358
 
        self.created = datetime.datetime.utcnow()
359
 
        self.enabled = False
360
 
        self.last_approval_request = None
361
 
        self.last_enabled = None
362
 
        self.last_checked_ok = None
363
 
        self.timeout = string_to_delta(config["timeout"])
364
 
        self.extended_timeout = string_to_delta(config["extended_timeout"])
365
 
        self.interval = string_to_delta(config["interval"])
366
 
        self.disable_hook = disable_hook
 
524
        self.created = settings.get("created", datetime.datetime.utcnow())
 
525
 
 
526
        # attributes specific for this server instance
367
527
        self.checker = None
368
528
        self.checker_initiator_tag = None
369
529
        self.disable_initiator_tag = None
370
 
        self.expires = None
371
530
        self.checker_callback_tag = None
372
 
        self.checker_command = config["checker"]
373
531
        self.current_checker_command = None
374
 
        self.last_connect = None
375
 
        self._approved = None
376
 
        self.approved_by_default = config.get("approved_by_default",
377
 
                                              True)
 
532
        self.approved = None
378
533
        self.approvals_pending = 0
379
 
        self.approval_delay = string_to_delta(
380
 
            config["approval_delay"])
381
 
        self.approval_duration = string_to_delta(
382
 
            config["approval_duration"])
383
 
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
 
534
        self.changedstate = (multiprocessing_manager
 
535
                             .Condition(multiprocessing_manager
 
536
                                        .Lock()))
 
537
        self.client_structure = [attr for attr in
 
538
                                 self.__dict__.iterkeys()
 
539
                                 if not attr.startswith("_")]
 
540
        self.client_structure.append("client_structure")
 
541
        
 
542
        for name, t in inspect.getmembers(type(self),
 
543
                                          lambda obj:
 
544
                                              isinstance(obj,
 
545
                                                         property)):
 
546
            if not name.startswith("_"):
 
547
                self.client_structure.append(name)
384
548
    
 
549
    # Send notice to process children that client state has changed
385
550
    def send_changedstate(self):
386
 
        self.changedstate.acquire()
387
 
        self.changedstate.notify_all()
388
 
        self.changedstate.release()
389
 
        
 
551
        with self.changedstate:
 
552
            self.changedstate.notify_all()
 
553
    
390
554
    def enable(self):
391
555
        """Start this client's checker and timeout hooks"""
392
556
        if getattr(self, "enabled", False):
393
557
            # Already enabled
394
558
            return
395
559
        self.send_changedstate()
 
560
        self.expires = datetime.datetime.utcnow() + self.timeout
 
561
        self.enabled = True
396
562
        self.last_enabled = datetime.datetime.utcnow()
397
 
        # Schedule a new checker to be started an 'interval' from now,
398
 
        # and every interval from then on.
399
 
        self.checker_initiator_tag = (gobject.timeout_add
400
 
                                      (self.interval_milliseconds(),
401
 
                                       self.start_checker))
402
 
        # Schedule a disable() when 'timeout' has passed
403
 
        self.expires = datetime.datetime.utcnow() + self.timeout
404
 
        self.disable_initiator_tag = (gobject.timeout_add
405
 
                                   (self.timeout_milliseconds(),
406
 
                                    self.disable))
407
 
        self.enabled = True
408
 
        # Also start a new checker *right now*.
409
 
        self.start_checker()
 
563
        self.init_checker()
410
564
    
411
565
    def disable(self, quiet=True):
412
566
        """Disable this client."""
424
578
            gobject.source_remove(self.checker_initiator_tag)
425
579
            self.checker_initiator_tag = None
426
580
        self.stop_checker()
427
 
        if self.disable_hook:
428
 
            self.disable_hook(self)
429
581
        self.enabled = False
430
582
        # Do not run this again if called by a gobject.timeout_add
431
583
        return False
432
584
    
433
585
    def __del__(self):
434
 
        self.disable_hook = None
435
586
        self.disable()
436
587
    
 
588
    def init_checker(self):
 
589
        # Schedule a new checker to be started an 'interval' from now,
 
590
        # and every interval from then on.
 
591
        self.checker_initiator_tag = (gobject.timeout_add
 
592
                                      (self.interval_milliseconds(),
 
593
                                       self.start_checker))
 
594
        # Schedule a disable() when 'timeout' has passed
 
595
        self.disable_initiator_tag = (gobject.timeout_add
 
596
                                   (self.timeout_milliseconds(),
 
597
                                    self.disable))
 
598
        # Also start a new checker *right now*.
 
599
        self.start_checker()
 
600
    
437
601
    def checker_callback(self, pid, condition, command):
438
602
        """The checker has completed, so take appropriate actions."""
439
603
        self.checker_callback_tag = None
440
604
        self.checker = None
441
605
        if os.WIFEXITED(condition):
442
 
            exitstatus = os.WEXITSTATUS(condition)
443
 
            if exitstatus == 0:
 
606
            self.last_checker_status = os.WEXITSTATUS(condition)
 
607
            if self.last_checker_status == 0:
444
608
                logger.info("Checker for %(name)s succeeded",
445
609
                            vars(self))
446
610
                self.checked_ok()
448
612
                logger.info("Checker for %(name)s failed",
449
613
                            vars(self))
450
614
        else:
 
615
            self.last_checker_status = -1
451
616
            logger.warning("Checker for %(name)s crashed?",
452
617
                           vars(self))
453
618
    
460
625
        if timeout is None:
461
626
            timeout = self.timeout
462
627
        self.last_checked_ok = datetime.datetime.utcnow()
463
 
        gobject.source_remove(self.disable_initiator_tag)
464
 
        self.expires = datetime.datetime.utcnow() + timeout
465
 
        self.disable_initiator_tag = (gobject.timeout_add
466
 
                                      (self._timedelta_to_milliseconds(timeout),
467
 
                                       self.disable))
 
628
        if self.disable_initiator_tag is not None:
 
629
            gobject.source_remove(self.disable_initiator_tag)
 
630
        if getattr(self, "enabled", False):
 
631
            self.disable_initiator_tag = (gobject.timeout_add
 
632
                                          (timedelta_to_milliseconds
 
633
                                           (timeout), self.disable))
 
634
            self.expires = datetime.datetime.utcnow() + timeout
468
635
    
469
636
    def need_approval(self):
470
637
        self.last_approval_request = datetime.datetime.utcnow()
510
677
                                       'replace')))
511
678
                    for attr in
512
679
                    self.runtime_expansions)
513
 
 
 
680
                
514
681
                try:
515
682
                    command = self.checker_command % escaped_attrs
516
683
                except TypeError as error:
562
729
                raise
563
730
        self.checker = None
564
731
 
 
732
 
565
733
def dbus_service_property(dbus_interface, signature="v",
566
734
                          access="readwrite", byte_arrays=False):
567
735
    """Decorators for marking methods of a DBusObjectWithProperties to
613
781
 
614
782
class DBusObjectWithProperties(dbus.service.Object):
615
783
    """A D-Bus object with properties.
616
 
 
 
784
    
617
785
    Classes inheriting from this can use the dbus_service_property
618
786
    decorator to expose methods as D-Bus properties.  It exposes the
619
787
    standard Get(), Set(), and GetAll() methods on the D-Bus.
626
794
    def _get_all_dbus_properties(self):
627
795
        """Returns a generator of (name, attribute) pairs
628
796
        """
629
 
        return ((prop._dbus_name, prop)
 
797
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
 
798
                for cls in self.__class__.__mro__
630
799
                for name, prop in
631
 
                inspect.getmembers(self, self._is_dbus_property))
 
800
                inspect.getmembers(cls, self._is_dbus_property))
632
801
    
633
802
    def _get_dbus_property(self, interface_name, property_name):
634
803
        """Returns a bound method if one exists which is a D-Bus
635
804
        property with the specified name and interface.
636
805
        """
637
 
        for name in (property_name,
638
 
                     property_name + "_dbus_property"):
639
 
            prop = getattr(self, name, None)
640
 
            if (prop is None
641
 
                or not self._is_dbus_property(prop)
642
 
                or prop._dbus_name != property_name
643
 
                or (interface_name and prop._dbus_interface
644
 
                    and interface_name != prop._dbus_interface)):
645
 
                continue
646
 
            return prop
 
806
        for cls in  self.__class__.__mro__:
 
807
            for name, value in (inspect.getmembers
 
808
                                (cls, self._is_dbus_property)):
 
809
                if (value._dbus_name == property_name
 
810
                    and value._dbus_interface == interface_name):
 
811
                    return value.__get__(self)
 
812
        
647
813
        # No such property
648
814
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
649
815
                                   + interface_name + "."
683
849
    def GetAll(self, interface_name):
684
850
        """Standard D-Bus property GetAll() method, see D-Bus
685
851
        standard.
686
 
 
 
852
        
687
853
        Note: Will not include properties with access="write".
688
854
        """
689
 
        all = {}
 
855
        properties = {}
690
856
        for name, prop in self._get_all_dbus_properties():
691
857
            if (interface_name
692
858
                and interface_name != prop._dbus_interface):
697
863
                continue
698
864
            value = prop()
699
865
            if not hasattr(value, "variant_level"):
700
 
                all[name] = value
 
866
                properties[name] = value
701
867
                continue
702
 
            all[name] = type(value)(value, variant_level=
703
 
                                    value.variant_level+1)
704
 
        return dbus.Dictionary(all, signature="sv")
 
868
            properties[name] = type(value)(value, variant_level=
 
869
                                           value.variant_level+1)
 
870
        return dbus.Dictionary(properties, signature="sv")
705
871
    
706
872
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
707
873
                         out_signature="s",
751
917
        return xmlstring
752
918
 
753
919
 
 
920
def datetime_to_dbus (dt, variant_level=0):
 
921
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
922
    if dt is None:
 
923
        return dbus.String("", variant_level = variant_level)
 
924
    return dbus.String(dt.isoformat(),
 
925
                       variant_level=variant_level)
 
926
 
 
927
 
 
928
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
 
929
                                  .__metaclass__):
 
930
    """Applied to an empty subclass of a D-Bus object, this metaclass
 
931
    will add additional D-Bus attributes matching a certain pattern.
 
932
    """
 
933
    def __new__(mcs, name, bases, attr):
 
934
        # Go through all the base classes which could have D-Bus
 
935
        # methods, signals, or properties in them
 
936
        for base in (b for b in bases
 
937
                     if issubclass(b, dbus.service.Object)):
 
938
            # Go though all attributes of the base class
 
939
            for attrname, attribute in inspect.getmembers(base):
 
940
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
941
                # with the wrong interface name
 
942
                if (not hasattr(attribute, "_dbus_interface")
 
943
                    or not attribute._dbus_interface
 
944
                    .startswith("se.recompile.Mandos")):
 
945
                    continue
 
946
                # Create an alternate D-Bus interface name based on
 
947
                # the current name
 
948
                alt_interface = (attribute._dbus_interface
 
949
                                 .replace("se.recompile.Mandos",
 
950
                                          "se.bsnet.fukt.Mandos"))
 
951
                # Is this a D-Bus signal?
 
952
                if getattr(attribute, "_dbus_is_signal", False):
 
953
                    # Extract the original non-method function by
 
954
                    # black magic
 
955
                    nonmethod_func = (dict(
 
956
                            zip(attribute.func_code.co_freevars,
 
957
                                attribute.__closure__))["func"]
 
958
                                      .cell_contents)
 
959
                    # Create a new, but exactly alike, function
 
960
                    # object, and decorate it to be a new D-Bus signal
 
961
                    # with the alternate D-Bus interface name
 
962
                    new_function = (dbus.service.signal
 
963
                                    (alt_interface,
 
964
                                     attribute._dbus_signature)
 
965
                                    (types.FunctionType(
 
966
                                nonmethod_func.func_code,
 
967
                                nonmethod_func.func_globals,
 
968
                                nonmethod_func.func_name,
 
969
                                nonmethod_func.func_defaults,
 
970
                                nonmethod_func.func_closure)))
 
971
                    # Define a creator of a function to call both the
 
972
                    # old and new functions, so both the old and new
 
973
                    # signals gets sent when the function is called
 
974
                    def fixscope(func1, func2):
 
975
                        """This function is a scope container to pass
 
976
                        func1 and func2 to the "call_both" function
 
977
                        outside of its arguments"""
 
978
                        def call_both(*args, **kwargs):
 
979
                            """This function will emit two D-Bus
 
980
                            signals by calling func1 and func2"""
 
981
                            func1(*args, **kwargs)
 
982
                            func2(*args, **kwargs)
 
983
                        return call_both
 
984
                    # Create the "call_both" function and add it to
 
985
                    # the class
 
986
                    attr[attrname] = fixscope(attribute,
 
987
                                              new_function)
 
988
                # Is this a D-Bus method?
 
989
                elif getattr(attribute, "_dbus_is_method", False):
 
990
                    # Create a new, but exactly alike, function
 
991
                    # object.  Decorate it to be a new D-Bus method
 
992
                    # with the alternate D-Bus interface name.  Add it
 
993
                    # to the class.
 
994
                    attr[attrname] = (dbus.service.method
 
995
                                      (alt_interface,
 
996
                                       attribute._dbus_in_signature,
 
997
                                       attribute._dbus_out_signature)
 
998
                                      (types.FunctionType
 
999
                                       (attribute.func_code,
 
1000
                                        attribute.func_globals,
 
1001
                                        attribute.func_name,
 
1002
                                        attribute.func_defaults,
 
1003
                                        attribute.func_closure)))
 
1004
                # Is this a D-Bus property?
 
1005
                elif getattr(attribute, "_dbus_is_property", False):
 
1006
                    # Create a new, but exactly alike, function
 
1007
                    # object, and decorate it to be a new D-Bus
 
1008
                    # property with the alternate D-Bus interface
 
1009
                    # name.  Add it to the class.
 
1010
                    attr[attrname] = (dbus_service_property
 
1011
                                      (alt_interface,
 
1012
                                       attribute._dbus_signature,
 
1013
                                       attribute._dbus_access,
 
1014
                                       attribute
 
1015
                                       ._dbus_get_args_options
 
1016
                                       ["byte_arrays"])
 
1017
                                      (types.FunctionType
 
1018
                                       (attribute.func_code,
 
1019
                                        attribute.func_globals,
 
1020
                                        attribute.func_name,
 
1021
                                        attribute.func_defaults,
 
1022
                                        attribute.func_closure)))
 
1023
        return type.__new__(mcs, name, bases, attr)
 
1024
 
 
1025
 
754
1026
class ClientDBus(Client, DBusObjectWithProperties):
755
1027
    """A Client class using D-Bus
756
1028
    
765
1037
    # dbus.service.Object doesn't use super(), so we can't either.
766
1038
    
767
1039
    def __init__(self, bus = None, *args, **kwargs):
768
 
        self._approvals_pending = 0
769
1040
        self.bus = bus
770
1041
        Client.__init__(self, *args, **kwargs)
 
1042
        self._approvals_pending = 0
 
1043
        
 
1044
        self._approvals_pending = 0
771
1045
        # Only now, when this client is initialized, can it show up on
772
1046
        # the D-Bus
773
1047
        client_object_name = unicode(self.name).translate(
777
1051
                                 ("/clients/" + client_object_name))
778
1052
        DBusObjectWithProperties.__init__(self, self.bus,
779
1053
                                          self.dbus_object_path)
780
 
    def _set_expires(self, value):
781
 
        old_value = getattr(self, "_expires", None)
782
 
        self._expires = value
783
 
        if hasattr(self, "dbus_object_path") and old_value != value:
784
 
            dbus_time = (self._datetime_to_dbus(self._expires,
785
 
                                                variant_level=1))
786
 
            self.PropertyChanged(dbus.String("Expires"),
787
 
                                 dbus_time)
788
 
    expires = property(lambda self: self._expires, _set_expires)
789
 
    del _set_expires
790
 
        
791
 
    def _get_approvals_pending(self):
792
 
        return self._approvals_pending
793
 
    def _set_approvals_pending(self, value):
794
 
        old_value = self._approvals_pending
795
 
        self._approvals_pending = value
796
 
        bval = bool(value)
797
 
        if (hasattr(self, "dbus_object_path")
798
 
            and bval is not bool(old_value)):
799
 
            dbus_bool = dbus.Boolean(bval, variant_level=1)
800
 
            self.PropertyChanged(dbus.String("ApprovalPending"),
801
 
                                 dbus_bool)
802
 
 
803
 
    approvals_pending = property(_get_approvals_pending,
804
 
                                 _set_approvals_pending)
805
 
    del _get_approvals_pending, _set_approvals_pending
806
 
    
807
 
    @staticmethod
808
 
    def _datetime_to_dbus(dt, variant_level=0):
809
 
        """Convert a UTC datetime.datetime() to a D-Bus type."""
810
 
        if dt is None:
811
 
            return dbus.String("", variant_level = variant_level)
812
 
        return dbus.String(dt.isoformat(),
813
 
                           variant_level=variant_level)
814
 
    
815
 
    def enable(self):
816
 
        oldstate = getattr(self, "enabled", False)
817
 
        r = Client.enable(self)
818
 
        if oldstate != self.enabled:
819
 
            # Emit D-Bus signals
820
 
            self.PropertyChanged(dbus.String("Enabled"),
821
 
                                 dbus.Boolean(True, variant_level=1))
822
 
            self.PropertyChanged(
823
 
                dbus.String("LastEnabled"),
824
 
                self._datetime_to_dbus(self.last_enabled,
825
 
                                       variant_level=1))
826
 
        return r
827
 
    
828
 
    def disable(self, quiet = False):
829
 
        oldstate = getattr(self, "enabled", False)
830
 
        r = Client.disable(self, quiet=quiet)
831
 
        if not quiet and oldstate != self.enabled:
832
 
            # Emit D-Bus signal
833
 
            self.PropertyChanged(dbus.String("Enabled"),
834
 
                                 dbus.Boolean(False, variant_level=1))
835
 
        return r
 
1054
        
 
1055
    def notifychangeproperty(transform_func,
 
1056
                             dbus_name, type_func=lambda x: x,
 
1057
                             variant_level=1):
 
1058
        """ Modify a variable so that it's a property which announces
 
1059
        its changes to DBus.
 
1060
        
 
1061
        transform_fun: Function that takes a value and a variant_level
 
1062
                       and transforms it to a D-Bus type.
 
1063
        dbus_name: D-Bus name of the variable
 
1064
        type_func: Function that transform the value before sending it
 
1065
                   to the D-Bus.  Default: no transform
 
1066
        variant_level: D-Bus variant level.  Default: 1
 
1067
        """
 
1068
        attrname = "_{0}".format(dbus_name)
 
1069
        def setter(self, value):
 
1070
            if hasattr(self, "dbus_object_path"):
 
1071
                if (not hasattr(self, attrname) or
 
1072
                    type_func(getattr(self, attrname, None))
 
1073
                    != type_func(value)):
 
1074
                    dbus_value = transform_func(type_func(value),
 
1075
                                                variant_level
 
1076
                                                =variant_level)
 
1077
                    self.PropertyChanged(dbus.String(dbus_name),
 
1078
                                         dbus_value)
 
1079
            setattr(self, attrname, value)
 
1080
        
 
1081
        return property(lambda self: getattr(self, attrname), setter)
 
1082
    
 
1083
    
 
1084
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
1085
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
1086
                                             "ApprovalPending",
 
1087
                                             type_func = bool)
 
1088
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
1089
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
1090
                                        "LastEnabled")
 
1091
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1092
                                   type_func = lambda checker:
 
1093
                                       checker is not None)
 
1094
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
1095
                                           "LastCheckedOK")
 
1096
    last_approval_request = notifychangeproperty(
 
1097
        datetime_to_dbus, "LastApprovalRequest")
 
1098
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
1099
                                               "ApprovedByDefault")
 
1100
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1101
                                          "ApprovalDelay",
 
1102
                                          type_func =
 
1103
                                          timedelta_to_milliseconds)
 
1104
    approval_duration = notifychangeproperty(
 
1105
        dbus.UInt64, "ApprovalDuration",
 
1106
        type_func = timedelta_to_milliseconds)
 
1107
    host = notifychangeproperty(dbus.String, "Host")
 
1108
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1109
                                   type_func =
 
1110
                                   timedelta_to_milliseconds)
 
1111
    extended_timeout = notifychangeproperty(
 
1112
        dbus.UInt64, "ExtendedTimeout",
 
1113
        type_func = timedelta_to_milliseconds)
 
1114
    interval = notifychangeproperty(dbus.UInt64,
 
1115
                                    "Interval",
 
1116
                                    type_func =
 
1117
                                    timedelta_to_milliseconds)
 
1118
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1119
    
 
1120
    del notifychangeproperty
836
1121
    
837
1122
    def __del__(self, *args, **kwargs):
838
1123
        try:
847
1132
                         *args, **kwargs):
848
1133
        self.checker_callback_tag = None
849
1134
        self.checker = None
850
 
        # Emit D-Bus signal
851
 
        self.PropertyChanged(dbus.String("CheckerRunning"),
852
 
                             dbus.Boolean(False, variant_level=1))
853
1135
        if os.WIFEXITED(condition):
854
1136
            exitstatus = os.WEXITSTATUS(condition)
855
1137
            # Emit D-Bus signal
865
1147
        return Client.checker_callback(self, pid, condition, command,
866
1148
                                       *args, **kwargs)
867
1149
    
868
 
    def checked_ok(self, *args, **kwargs):
869
 
        Client.checked_ok(self, *args, **kwargs)
870
 
        # Emit D-Bus signal
871
 
        self.PropertyChanged(
872
 
            dbus.String("LastCheckedOK"),
873
 
            (self._datetime_to_dbus(self.last_checked_ok,
874
 
                                    variant_level=1)))
875
 
    
876
 
    def need_approval(self, *args, **kwargs):
877
 
        r = Client.need_approval(self, *args, **kwargs)
878
 
        # Emit D-Bus signal
879
 
        self.PropertyChanged(
880
 
            dbus.String("LastApprovalRequest"),
881
 
            (self._datetime_to_dbus(self.last_approval_request,
882
 
                                    variant_level=1)))
883
 
        return r
884
 
    
885
1150
    def start_checker(self, *args, **kwargs):
886
1151
        old_checker = self.checker
887
1152
        if self.checker is not None:
894
1159
            and old_checker_pid != self.checker.pid):
895
1160
            # Emit D-Bus signal
896
1161
            self.CheckerStarted(self.current_checker_command)
897
 
            self.PropertyChanged(
898
 
                dbus.String("CheckerRunning"),
899
 
                dbus.Boolean(True, variant_level=1))
900
1162
        return r
901
1163
    
902
 
    def stop_checker(self, *args, **kwargs):
903
 
        old_checker = getattr(self, "checker", None)
904
 
        r = Client.stop_checker(self, *args, **kwargs)
905
 
        if (old_checker is not None
906
 
            and getattr(self, "checker", None) is None):
907
 
            self.PropertyChanged(dbus.String("CheckerRunning"),
908
 
                                 dbus.Boolean(False, variant_level=1))
909
 
        return r
910
 
 
911
1164
    def _reset_approved(self):
912
 
        self._approved = None
 
1165
        self.approved = None
913
1166
        return False
914
1167
    
915
1168
    def approve(self, value=True):
916
1169
        self.send_changedstate()
917
 
        self._approved = value
918
 
        gobject.timeout_add(self._timedelta_to_milliseconds
 
1170
        self.approved = value
 
1171
        gobject.timeout_add(timedelta_to_milliseconds
919
1172
                            (self.approval_duration),
920
1173
                            self._reset_approved)
921
1174
    
922
1175
    
923
1176
    ## D-Bus methods, signals & properties
924
 
    _interface = "se.bsnet.fukt.Mandos.Client"
 
1177
    _interface = "se.recompile.Mandos.Client"
925
1178
    
926
1179
    ## Signals
927
1180
    
964
1217
        "D-Bus signal"
965
1218
        return self.need_approval()
966
1219
    
 
1220
    # NeRwequest - signal
 
1221
    @dbus.service.signal(_interface, signature="s")
 
1222
    def NewRequest(self, ip):
 
1223
        """D-Bus signal
 
1224
        Is sent after a client request a password.
 
1225
        """
 
1226
        pass
 
1227
    
967
1228
    ## Methods
968
1229
    
969
1230
    # Approve - method
1012
1273
    def ApprovedByDefault_dbus_property(self, value=None):
1013
1274
        if value is None:       # get
1014
1275
            return dbus.Boolean(self.approved_by_default)
1015
 
        old_value = self.approved_by_default
1016
1276
        self.approved_by_default = bool(value)
1017
 
        # Emit D-Bus signal
1018
 
        if old_value != self.approved_by_default:
1019
 
            self.PropertyChanged(dbus.String("ApprovedByDefault"),
1020
 
                                 dbus.Boolean(value, variant_level=1))
1021
1277
    
1022
1278
    # ApprovalDelay - property
1023
1279
    @dbus_service_property(_interface, signature="t",
1025
1281
    def ApprovalDelay_dbus_property(self, value=None):
1026
1282
        if value is None:       # get
1027
1283
            return dbus.UInt64(self.approval_delay_milliseconds())
1028
 
        old_value = self.approval_delay
1029
1284
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1030
 
        # Emit D-Bus signal
1031
 
        if old_value != self.approval_delay:
1032
 
            self.PropertyChanged(dbus.String("ApprovalDelay"),
1033
 
                                 dbus.UInt64(value, variant_level=1))
1034
1285
    
1035
1286
    # ApprovalDuration - property
1036
1287
    @dbus_service_property(_interface, signature="t",
1037
1288
                           access="readwrite")
1038
1289
    def ApprovalDuration_dbus_property(self, value=None):
1039
1290
        if value is None:       # get
1040
 
            return dbus.UInt64(self._timedelta_to_milliseconds(
 
1291
            return dbus.UInt64(timedelta_to_milliseconds(
1041
1292
                    self.approval_duration))
1042
 
        old_value = self.approval_duration
1043
1293
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1044
 
        # Emit D-Bus signal
1045
 
        if old_value != self.approval_duration:
1046
 
            self.PropertyChanged(dbus.String("ApprovalDuration"),
1047
 
                                 dbus.UInt64(value, variant_level=1))
1048
1294
    
1049
1295
    # Name - property
1050
1296
    @dbus_service_property(_interface, signature="s", access="read")
1062
1308
    def Host_dbus_property(self, value=None):
1063
1309
        if value is None:       # get
1064
1310
            return dbus.String(self.host)
1065
 
        old_value = self.host
1066
 
        self.host = value
1067
 
        # Emit D-Bus signal
1068
 
        if old_value != self.host:
1069
 
            self.PropertyChanged(dbus.String("Host"),
1070
 
                                 dbus.String(value, variant_level=1))
 
1311
        self.host = unicode(value)
1071
1312
    
1072
1313
    # Created - property
1073
1314
    @dbus_service_property(_interface, signature="s", access="read")
1074
1315
    def Created_dbus_property(self):
1075
 
        return dbus.String(self._datetime_to_dbus(self.created))
 
1316
        return datetime_to_dbus(self.created)
1076
1317
    
1077
1318
    # LastEnabled - property
1078
1319
    @dbus_service_property(_interface, signature="s", access="read")
1079
1320
    def LastEnabled_dbus_property(self):
1080
 
        return self._datetime_to_dbus(self.last_enabled)
 
1321
        return datetime_to_dbus(self.last_enabled)
1081
1322
    
1082
1323
    # Enabled - property
1083
1324
    @dbus_service_property(_interface, signature="b",
1097
1338
        if value is not None:
1098
1339
            self.checked_ok()
1099
1340
            return
1100
 
        return self._datetime_to_dbus(self.last_checked_ok)
 
1341
        return datetime_to_dbus(self.last_checked_ok)
1101
1342
    
1102
1343
    # Expires - property
1103
1344
    @dbus_service_property(_interface, signature="s", access="read")
1104
1345
    def Expires_dbus_property(self):
1105
 
        return self._datetime_to_dbus(self.expires)
 
1346
        return datetime_to_dbus(self.expires)
1106
1347
    
1107
1348
    # LastApprovalRequest - property
1108
1349
    @dbus_service_property(_interface, signature="s", access="read")
1109
1350
    def LastApprovalRequest_dbus_property(self):
1110
 
        return self._datetime_to_dbus(self.last_approval_request)
 
1351
        return datetime_to_dbus(self.last_approval_request)
1111
1352
    
1112
1353
    # Timeout - property
1113
1354
    @dbus_service_property(_interface, signature="t",
1115
1356
    def Timeout_dbus_property(self, value=None):
1116
1357
        if value is None:       # get
1117
1358
            return dbus.UInt64(self.timeout_milliseconds())
1118
 
        old_value = self.timeout
1119
1359
        self.timeout = datetime.timedelta(0, 0, 0, value)
1120
 
        # Emit D-Bus signal
1121
 
        if old_value != self.timeout:
1122
 
            self.PropertyChanged(dbus.String("Timeout"),
1123
 
                                 dbus.UInt64(value, variant_level=1))
1124
1360
        if getattr(self, "disable_initiator_tag", None) is None:
1125
1361
            return
1126
1362
        # Reschedule timeout
1127
1363
        gobject.source_remove(self.disable_initiator_tag)
1128
1364
        self.disable_initiator_tag = None
1129
1365
        self.expires = None
1130
 
        time_to_die = (self.
1131
 
                       _timedelta_to_milliseconds((self
1132
 
                                                   .last_checked_ok
1133
 
                                                   + self.timeout)
1134
 
                                                  - datetime.datetime
1135
 
                                                  .utcnow()))
 
1366
        time_to_die = timedelta_to_milliseconds((self
 
1367
                                                 .last_checked_ok
 
1368
                                                 + self.timeout)
 
1369
                                                - datetime.datetime
 
1370
                                                .utcnow())
1136
1371
        if time_to_die <= 0:
1137
1372
            # The timeout has passed
1138
1373
            self.disable()
1139
1374
        else:
1140
1375
            self.expires = (datetime.datetime.utcnow()
1141
 
                            + datetime.timedelta(milliseconds = time_to_die))
 
1376
                            + datetime.timedelta(milliseconds =
 
1377
                                                 time_to_die))
1142
1378
            self.disable_initiator_tag = (gobject.timeout_add
1143
1379
                                          (time_to_die, self.disable))
1144
 
 
 
1380
    
1145
1381
    # ExtendedTimeout - property
1146
1382
    @dbus_service_property(_interface, signature="t",
1147
1383
                           access="readwrite")
1148
1384
    def ExtendedTimeout_dbus_property(self, value=None):
1149
1385
        if value is None:       # get
1150
1386
            return dbus.UInt64(self.extended_timeout_milliseconds())
1151
 
        old_value = self.extended_timeout
1152
1387
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1153
 
        # Emit D-Bus signal
1154
 
        if old_value != self.extended_timeout:
1155
 
            self.PropertyChanged(dbus.String("ExtendedTimeout"),
1156
 
                                 dbus.UInt64(value, variant_level=1))
1157
 
 
 
1388
    
1158
1389
    # Interval - property
1159
1390
    @dbus_service_property(_interface, signature="t",
1160
1391
                           access="readwrite")
1161
1392
    def Interval_dbus_property(self, value=None):
1162
1393
        if value is None:       # get
1163
1394
            return dbus.UInt64(self.interval_milliseconds())
1164
 
        old_value = self.interval
1165
1395
        self.interval = datetime.timedelta(0, 0, 0, value)
1166
 
        # Emit D-Bus signal
1167
 
        if old_value != self.interval:
1168
 
            self.PropertyChanged(dbus.String("Interval"),
1169
 
                                 dbus.UInt64(value, variant_level=1))
1170
1396
        if getattr(self, "checker_initiator_tag", None) is None:
1171
1397
            return
1172
 
        # Reschedule checker run
1173
 
        gobject.source_remove(self.checker_initiator_tag)
1174
 
        self.checker_initiator_tag = (gobject.timeout_add
1175
 
                                      (value, self.start_checker))
1176
 
        self.start_checker()    # Start one now, too
1177
 
 
 
1398
        if self.enabled:
 
1399
            # Reschedule checker run
 
1400
            gobject.source_remove(self.checker_initiator_tag)
 
1401
            self.checker_initiator_tag = (gobject.timeout_add
 
1402
                                          (value, self.start_checker))
 
1403
            self.start_checker()    # Start one now, too
 
1404
    
1178
1405
    # Checker - property
1179
1406
    @dbus_service_property(_interface, signature="s",
1180
1407
                           access="readwrite")
1181
1408
    def Checker_dbus_property(self, value=None):
1182
1409
        if value is None:       # get
1183
1410
            return dbus.String(self.checker_command)
1184
 
        old_value = self.checker_command
1185
 
        self.checker_command = value
1186
 
        # Emit D-Bus signal
1187
 
        if old_value != self.checker_command:
1188
 
            self.PropertyChanged(dbus.String("Checker"),
1189
 
                                 dbus.String(self.checker_command,
1190
 
                                             variant_level=1))
 
1411
        self.checker_command = unicode(value)
1191
1412
    
1192
1413
    # CheckerRunning - property
1193
1414
    @dbus_service_property(_interface, signature="b",
1220
1441
        self._pipe.send(('init', fpr, address))
1221
1442
        if not self._pipe.recv():
1222
1443
            raise KeyError()
1223
 
 
 
1444
    
1224
1445
    def __getattribute__(self, name):
1225
 
        if(name == '_pipe'):
 
1446
        if name == '_pipe':
1226
1447
            return super(ProxyClient, self).__getattribute__(name)
1227
1448
        self._pipe.send(('getattr', name))
1228
1449
        data = self._pipe.recv()
1233
1454
                self._pipe.send(('funcall', name, args, kwargs))
1234
1455
                return self._pipe.recv()[1]
1235
1456
            return func
1236
 
 
 
1457
    
1237
1458
    def __setattr__(self, name, value):
1238
 
        if(name == '_pipe'):
 
1459
        if name == '_pipe':
1239
1460
            return super(ProxyClient, self).__setattr__(name, value)
1240
1461
        self._pipe.send(('setattr', name, value))
1241
1462
 
1242
1463
 
 
1464
class ClientDBusTransitional(ClientDBus):
 
1465
    __metaclass__ = AlternateDBusNamesMetaclass
 
1466
 
 
1467
 
1243
1468
class ClientHandler(socketserver.BaseRequestHandler, object):
1244
1469
    """A class to handle client connections.
1245
1470
    
1252
1477
                        unicode(self.client_address))
1253
1478
            logger.debug("Pipe FD: %d",
1254
1479
                         self.server.child_pipe.fileno())
1255
 
 
 
1480
            
1256
1481
            session = (gnutls.connection
1257
1482
                       .ClientSession(self.request,
1258
1483
                                      gnutls.connection
1259
1484
                                      .X509Credentials()))
1260
 
 
 
1485
            
1261
1486
            # Note: gnutls.connection.X509Credentials is really a
1262
1487
            # generic GnuTLS certificate credentials object so long as
1263
1488
            # no X.509 keys are added to it.  Therefore, we can use it
1264
1489
            # here despite using OpenPGP certificates.
1265
 
 
 
1490
            
1266
1491
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1267
1492
            #                      "+AES-256-CBC", "+SHA1",
1268
1493
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1274
1499
            (gnutls.library.functions
1275
1500
             .gnutls_priority_set_direct(session._c_object,
1276
1501
                                         priority, None))
1277
 
 
 
1502
            
1278
1503
            # Start communication using the Mandos protocol
1279
1504
            # Get protocol number
1280
1505
            line = self.request.makefile().readline()
1285
1510
            except (ValueError, IndexError, RuntimeError) as error:
1286
1511
                logger.error("Unknown protocol version: %s", error)
1287
1512
                return
1288
 
 
 
1513
            
1289
1514
            # Start GnuTLS connection
1290
1515
            try:
1291
1516
                session.handshake()
1295
1520
                # established.  Just abandon the request.
1296
1521
                return
1297
1522
            logger.debug("Handshake succeeded")
1298
 
 
 
1523
            
1299
1524
            approval_required = False
1300
1525
            try:
1301
1526
                try:
1306
1531
                    logger.warning("Bad certificate: %s", error)
1307
1532
                    return
1308
1533
                logger.debug("Fingerprint: %s", fpr)
1309
 
 
 
1534
                
1310
1535
                try:
1311
1536
                    client = ProxyClient(child_pipe, fpr,
1312
1537
                                         self.client_address)
1313
1538
                except KeyError:
1314
1539
                    return
1315
1540
                
 
1541
                if self.server.use_dbus:
 
1542
                    # Emit D-Bus signal
 
1543
                    client.NewRequest(str(self.client_address))
 
1544
                
1316
1545
                if client.approval_delay:
1317
1546
                    delay = client.approval_delay
1318
1547
                    client.approvals_pending += 1
1324
1553
                                       client.name)
1325
1554
                        if self.server.use_dbus:
1326
1555
                            # Emit D-Bus signal
1327
 
                            client.Rejected("Disabled")                    
 
1556
                            client.Rejected("Disabled")
1328
1557
                        return
1329
1558
                    
1330
 
                    if client._approved or not client.approval_delay:
 
1559
                    if client.approved or not client.approval_delay:
1331
1560
                        #We are approved or approval is disabled
1332
1561
                        break
1333
 
                    elif client._approved is None:
 
1562
                    elif client.approved is None:
1334
1563
                        logger.info("Client %s needs approval",
1335
1564
                                    client.name)
1336
1565
                        if self.server.use_dbus:
1347
1576
                        return
1348
1577
                    
1349
1578
                    #wait until timeout or approved
1350
 
                    #x = float(client._timedelta_to_milliseconds(delay))
1351
1579
                    time = datetime.datetime.now()
1352
1580
                    client.changedstate.acquire()
1353
 
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1581
                    (client.changedstate.wait
 
1582
                     (float(client.timedelta_to_milliseconds(delay)
 
1583
                            / 1000)))
1354
1584
                    client.changedstate.release()
1355
1585
                    time2 = datetime.datetime.now()
1356
1586
                    if (time2 - time) >= delay:
1378
1608
                                 sent, len(client.secret)
1379
1609
                                 - (sent_size + sent))
1380
1610
                    sent_size += sent
1381
 
 
 
1611
                
1382
1612
                logger.info("Sending secret to %s", client.name)
1383
 
                # bump the timeout as if seen
 
1613
                # bump the timeout using extended_timeout
1384
1614
                client.checked_ok(client.extended_timeout)
1385
1615
                if self.server.use_dbus:
1386
1616
                    # Emit D-Bus signal
1454
1684
        # Convert the buffer to a Python bytestring
1455
1685
        fpr = ctypes.string_at(buf, buf_len.value)
1456
1686
        # Convert the bytestring to hexadecimal notation
1457
 
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
1687
        hex_fpr = binascii.hexlify(fpr).upper()
1458
1688
        return hex_fpr
1459
1689
 
1460
1690
 
1463
1693
    def sub_process_main(self, request, address):
1464
1694
        try:
1465
1695
            self.finish_request(request, address)
1466
 
        except:
 
1696
        except Exception:
1467
1697
            self.handle_error(request, address)
1468
1698
        self.close_request(request)
1469
 
            
 
1699
    
1470
1700
    def process_request(self, request, address):
1471
1701
        """Start a new process to process the request."""
1472
 
        multiprocessing.Process(target = self.sub_process_main,
1473
 
                                args = (request, address)).start()
 
1702
        proc = multiprocessing.Process(target = self.sub_process_main,
 
1703
                                       args = (request,
 
1704
                                               address))
 
1705
        proc.start()
 
1706
        return proc
 
1707
 
1474
1708
 
1475
1709
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1476
1710
    """ adds a pipe to the MixIn """
1480
1714
        This function creates a new pipe in self.pipe
1481
1715
        """
1482
1716
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1483
 
 
1484
 
        super(MultiprocessingMixInWithPipe,
1485
 
              self).process_request(request, client_address)
 
1717
        
 
1718
        proc = MultiprocessingMixIn.process_request(self, request,
 
1719
                                                    client_address)
1486
1720
        self.child_pipe.close()
1487
 
        self.add_pipe(parent_pipe)
1488
 
 
1489
 
    def add_pipe(self, parent_pipe):
 
1721
        self.add_pipe(parent_pipe, proc)
 
1722
    
 
1723
    def add_pipe(self, parent_pipe, proc):
1490
1724
        """Dummy function; override as necessary"""
1491
1725
        raise NotImplementedError
1492
1726
 
 
1727
 
1493
1728
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1494
1729
                     socketserver.TCPServer, object):
1495
1730
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1569
1804
        self.enabled = False
1570
1805
        self.clients = clients
1571
1806
        if self.clients is None:
1572
 
            self.clients = set()
 
1807
            self.clients = {}
1573
1808
        self.use_dbus = use_dbus
1574
1809
        self.gnutls_priority = gnutls_priority
1575
1810
        IPv6_TCPServer.__init__(self, server_address,
1579
1814
    def server_activate(self):
1580
1815
        if self.enabled:
1581
1816
            return socketserver.TCPServer.server_activate(self)
 
1817
    
1582
1818
    def enable(self):
1583
1819
        self.enabled = True
1584
 
    def add_pipe(self, parent_pipe):
 
1820
    
 
1821
    def add_pipe(self, parent_pipe, proc):
1585
1822
        # Call "handle_ipc" for both data and EOF events
1586
1823
        gobject.io_add_watch(parent_pipe.fileno(),
1587
1824
                             gobject.IO_IN | gobject.IO_HUP,
1588
1825
                             functools.partial(self.handle_ipc,
1589
 
                                               parent_pipe = parent_pipe))
1590
 
        
 
1826
                                               parent_pipe =
 
1827
                                               parent_pipe,
 
1828
                                               proc = proc))
 
1829
    
1591
1830
    def handle_ipc(self, source, condition, parent_pipe=None,
1592
 
                   client_object=None):
 
1831
                   proc = None, client_object=None):
1593
1832
        condition_names = {
1594
1833
            gobject.IO_IN: "IN",   # There is data to read.
1595
1834
            gobject.IO_OUT: "OUT", # Data can be written (without
1604
1843
                                       for cond, name in
1605
1844
                                       condition_names.iteritems()
1606
1845
                                       if cond & condition)
1607
 
        # error or the other end of multiprocessing.Pipe has closed
 
1846
        # error, or the other end of multiprocessing.Pipe has closed
1608
1847
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1848
            # Wait for other process to exit
 
1849
            proc.join()
1609
1850
            return False
1610
1851
        
1611
1852
        # Read a request from the child
1616
1857
            fpr = request[1]
1617
1858
            address = request[2]
1618
1859
            
1619
 
            for c in self.clients:
 
1860
            for c in self.clients.itervalues():
1620
1861
                if c.fingerprint == fpr:
1621
1862
                    client = c
1622
1863
                    break
1625
1866
                            "dress: %s", fpr, address)
1626
1867
                if self.use_dbus:
1627
1868
                    # Emit D-Bus signal
1628
 
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
 
1869
                    mandos_dbus_service.ClientNotFound(fpr,
 
1870
                                                       address[0])
1629
1871
                parent_pipe.send(False)
1630
1872
                return False
1631
1873
            
1632
1874
            gobject.io_add_watch(parent_pipe.fileno(),
1633
1875
                                 gobject.IO_IN | gobject.IO_HUP,
1634
1876
                                 functools.partial(self.handle_ipc,
1635
 
                                                   parent_pipe = parent_pipe,
1636
 
                                                   client_object = client))
 
1877
                                                   parent_pipe =
 
1878
                                                   parent_pipe,
 
1879
                                                   proc = proc,
 
1880
                                                   client_object =
 
1881
                                                   client))
1637
1882
            parent_pipe.send(True)
1638
 
            # remove the old hook in favor of the new above hook on same fileno
 
1883
            # remove the old hook in favor of the new above hook on
 
1884
            # same fileno
1639
1885
            return False
1640
1886
        if command == 'funcall':
1641
1887
            funcname = request[1]
1642
1888
            args = request[2]
1643
1889
            kwargs = request[3]
1644
1890
            
1645
 
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1646
 
 
 
1891
            parent_pipe.send(('data', getattr(client_object,
 
1892
                                              funcname)(*args,
 
1893
                                                         **kwargs)))
 
1894
        
1647
1895
        if command == 'getattr':
1648
1896
            attrname = request[1]
1649
1897
            if callable(client_object.__getattribute__(attrname)):
1650
1898
                parent_pipe.send(('function',))
1651
1899
            else:
1652
 
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
1900
                parent_pipe.send(('data', client_object
 
1901
                                  .__getattribute__(attrname)))
1653
1902
        
1654
1903
        if command == 'setattr':
1655
1904
            attrname = request[1]
1656
1905
            value = request[2]
1657
1906
            setattr(client_object, attrname, value)
1658
 
 
 
1907
        
1659
1908
        return True
1660
1909
 
1661
1910
 
1698
1947
    return timevalue
1699
1948
 
1700
1949
 
1701
 
def if_nametoindex(interface):
1702
 
    """Call the C function if_nametoindex(), or equivalent
1703
 
    
1704
 
    Note: This function cannot accept a unicode string."""
1705
 
    global if_nametoindex
1706
 
    try:
1707
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1708
 
                          (ctypes.util.find_library("c"))
1709
 
                          .if_nametoindex)
1710
 
    except (OSError, AttributeError):
1711
 
        logger.warning("Doing if_nametoindex the hard way")
1712
 
        def if_nametoindex(interface):
1713
 
            "Get an interface index the hard way, i.e. using fcntl()"
1714
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1715
 
            with contextlib.closing(socket.socket()) as s:
1716
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1717
 
                                    struct.pack(str("16s16x"),
1718
 
                                                interface))
1719
 
            interface_index = struct.unpack(str("I"),
1720
 
                                            ifreq[16:20])[0]
1721
 
            return interface_index
1722
 
    return if_nametoindex(interface)
1723
 
 
1724
 
 
1725
1950
def daemon(nochdir = False, noclose = False):
1726
1951
    """See daemon(3).  Standard BSD Unix function.
1727
1952
    
1782
2007
                        " system bus interface")
1783
2008
    parser.add_argument("--no-ipv6", action="store_false",
1784
2009
                        dest="use_ipv6", help="Do not use IPv6")
 
2010
    parser.add_argument("--no-restore", action="store_false",
 
2011
                        dest="restore", help="Do not restore stored"
 
2012
                        " state")
 
2013
    parser.add_argument("--statedir", metavar="DIR",
 
2014
                        help="Directory to save/restore state in")
 
2015
    
1785
2016
    options = parser.parse_args()
1786
2017
    
1787
2018
    if options.check:
1800
2031
                        "use_dbus": "True",
1801
2032
                        "use_ipv6": "True",
1802
2033
                        "debuglevel": "",
 
2034
                        "restore": "True",
 
2035
                        "statedir": "/var/lib/mandos"
1803
2036
                        }
1804
2037
    
1805
2038
    # Parse config file for server-global settings
1822
2055
    # options, if set.
1823
2056
    for option in ("interface", "address", "port", "debug",
1824
2057
                   "priority", "servicename", "configdir",
1825
 
                   "use_dbus", "use_ipv6", "debuglevel"):
 
2058
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2059
                   "statedir"):
1826
2060
        value = getattr(options, option)
1827
2061
        if value is not None:
1828
2062
            server_settings[option] = value
1840
2074
    debuglevel = server_settings["debuglevel"]
1841
2075
    use_dbus = server_settings["use_dbus"]
1842
2076
    use_ipv6 = server_settings["use_ipv6"]
1843
 
 
 
2077
    stored_state_path = os.path.join(server_settings["statedir"],
 
2078
                                     stored_state_file)
 
2079
    
 
2080
    if debug:
 
2081
        initlogger(logging.DEBUG)
 
2082
    else:
 
2083
        if not debuglevel:
 
2084
            initlogger()
 
2085
        else:
 
2086
            level = getattr(logging, debuglevel.upper())
 
2087
            initlogger(level)
 
2088
    
1844
2089
    if server_settings["servicename"] != "Mandos":
1845
2090
        syslogger.setFormatter(logging.Formatter
1846
2091
                               ('Mandos (%s) [%%(process)d]:'
1848
2093
                                % server_settings["servicename"]))
1849
2094
    
1850
2095
    # Parse config file with clients
1851
 
    client_defaults = { "timeout": "5m",
1852
 
                        "extended_timeout": "15m",
1853
 
                        "interval": "2m",
1854
 
                        "checker": "fping -q -- %%(host)s",
1855
 
                        "host": "",
1856
 
                        "approval_delay": "0s",
1857
 
                        "approval_duration": "1s",
1858
 
                        }
1859
 
    client_config = configparser.SafeConfigParser(client_defaults)
 
2096
    client_config = configparser.SafeConfigParser(Client.client_defaults)
1860
2097
    client_config.read(os.path.join(server_settings["configdir"],
1861
2098
                                    "clients.conf"))
1862
2099
    
1900
2137
        if error[0] != errno.EPERM:
1901
2138
            raise error
1902
2139
    
1903
 
    if not debug and not debuglevel:
1904
 
        syslogger.setLevel(logging.WARNING)
1905
 
        console.setLevel(logging.WARNING)
1906
 
    if debuglevel:
1907
 
        level = getattr(logging, debuglevel.upper())
1908
 
        syslogger.setLevel(level)
1909
 
        console.setLevel(level)
1910
 
 
1911
2140
    if debug:
1912
2141
        # Enable all possible GnuTLS debugging
1913
2142
        
1944
2173
    # End of Avahi example code
1945
2174
    if use_dbus:
1946
2175
        try:
1947
 
            bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
 
2176
            bus_name = dbus.service.BusName("se.recompile.Mandos",
1948
2177
                                            bus, do_not_queue=True)
 
2178
            old_bus_name = (dbus.service.BusName
 
2179
                            ("se.bsnet.fukt.Mandos", bus,
 
2180
                             do_not_queue=True))
1949
2181
        except dbus.exceptions.NameExistsException as e:
1950
2182
            logger.error(unicode(e) + ", disabling D-Bus")
1951
2183
            use_dbus = False
1952
2184
            server_settings["use_dbus"] = False
1953
2185
            tcp_server.use_dbus = False
1954
2186
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1955
 
    service = AvahiService(name = server_settings["servicename"],
1956
 
                           servicetype = "_mandos._tcp",
1957
 
                           protocol = protocol, bus = bus)
 
2187
    service = AvahiServiceToSyslog(name =
 
2188
                                   server_settings["servicename"],
 
2189
                                   servicetype = "_mandos._tcp",
 
2190
                                   protocol = protocol, bus = bus)
1958
2191
    if server_settings["interface"]:
1959
2192
        service.interface = (if_nametoindex
1960
2193
                             (str(server_settings["interface"])))
1964
2197
    
1965
2198
    client_class = Client
1966
2199
    if use_dbus:
1967
 
        client_class = functools.partial(ClientDBus, bus = bus)
1968
 
    def client_config_items(config, section):
1969
 
        special_settings = {
1970
 
            "approved_by_default":
1971
 
                lambda: config.getboolean(section,
1972
 
                                          "approved_by_default"),
1973
 
            }
1974
 
        for name, value in config.items(section):
 
2200
        client_class = functools.partial(ClientDBusTransitional,
 
2201
                                         bus = bus)
 
2202
    
 
2203
    client_settings = Client.config_parser(client_config)
 
2204
    old_client_settings = {}
 
2205
    clients_data = {}
 
2206
    
 
2207
    # Get client data and settings from last running state.
 
2208
    if server_settings["restore"]:
 
2209
        try:
 
2210
            with open(stored_state_path, "rb") as stored_state:
 
2211
                clients_data, old_client_settings = (pickle.load
 
2212
                                                     (stored_state))
 
2213
            os.remove(stored_state_path)
 
2214
        except IOError as e:
 
2215
            logger.warning("Could not load persistent state: {0}"
 
2216
                           .format(e))
 
2217
            if e.errno != errno.ENOENT:
 
2218
                raise
 
2219
    
 
2220
    with PGPEngine() as pgp:
 
2221
        for client_name, client in clients_data.iteritems():
 
2222
            # Decide which value to use after restoring saved state.
 
2223
            # We have three different values: Old config file,
 
2224
            # new config file, and saved state.
 
2225
            # New config value takes precedence if it differs from old
 
2226
            # config value, otherwise use saved state.
 
2227
            for name, value in client_settings[client_name].items():
 
2228
                try:
 
2229
                    # For each value in new config, check if it
 
2230
                    # differs from the old config value (Except for
 
2231
                    # the "secret" attribute)
 
2232
                    if (name != "secret" and
 
2233
                        value != old_client_settings[client_name]
 
2234
                        [name]):
 
2235
                        client[name] = value
 
2236
                except KeyError:
 
2237
                    pass
 
2238
            
 
2239
            # Clients who has passed its expire date can still be
 
2240
            # enabled if its last checker was successful.  Clients
 
2241
            # whose checker failed before we stored its state is
 
2242
            # assumed to have failed all checkers during downtime.
 
2243
            if client["enabled"]:
 
2244
                if datetime.datetime.utcnow() >= client["expires"]:
 
2245
                    if not client["last_checked_ok"]:
 
2246
                        logger.warning(
 
2247
                            "disabling client {0} - Client never "
 
2248
                            "performed a successfull checker"
 
2249
                            .format(client["name"]))
 
2250
                        client["enabled"] = False
 
2251
                    elif client["last_checker_status"] != 0:
 
2252
                        logger.warning(
 
2253
                            "disabling client {0} - Client "
 
2254
                            "last checker failed with error code {1}"
 
2255
                            .format(client["name"],
 
2256
                                    client["last_checker_status"]))
 
2257
                        client["enabled"] = False
 
2258
                    else:
 
2259
                        client["expires"] = (datetime.datetime
 
2260
                                             .utcnow()
 
2261
                                             + client["timeout"])
 
2262
                    
1975
2263
            try:
1976
 
                yield (name, special_settings[name]())
1977
 
            except KeyError:
1978
 
                yield (name, value)
1979
 
    
1980
 
    tcp_server.clients.update(set(
1981
 
            client_class(name = section,
1982
 
                         config= dict(client_config_items(
1983
 
                        client_config, section)))
1984
 
            for section in client_config.sections()))
 
2264
                client["secret"] = (
 
2265
                    pgp.decrypt(client["encrypted_secret"],
 
2266
                                client_settings[client_name]
 
2267
                                ["secret"]))
 
2268
            except PGPError:
 
2269
                # If decryption fails, we use secret from new settings
 
2270
                logger.debug("Failed to decrypt {0} old secret"
 
2271
                             .format(client_name))
 
2272
                client["secret"] = (
 
2273
                    client_settings[client_name]["secret"])
 
2274
 
 
2275
    
 
2276
    # Add/remove clients based on new changes made to config
 
2277
    for client_name in set(old_client_settings) - set(client_settings):
 
2278
        del clients_data[client_name]
 
2279
    for client_name in set(client_settings) - set(old_client_settings):
 
2280
        clients_data[client_name] = client_settings[client_name]
 
2281
 
 
2282
    # Create clients all clients
 
2283
    for client_name, client in clients_data.iteritems():
 
2284
        tcp_server.clients[client_name] = client_class(
 
2285
            name = client_name, settings = client)
 
2286
    
1985
2287
    if not tcp_server.clients:
1986
2288
        logger.warning("No clients defined")
1987
2289
        
1998
2300
            # "pidfile" was never created
1999
2301
            pass
2000
2302
        del pidfilename
2001
 
        
2002
2303
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2003
 
 
 
2304
    
2004
2305
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2005
2306
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2006
2307
    
2009
2310
            """A D-Bus proxy object"""
2010
2311
            def __init__(self):
2011
2312
                dbus.service.Object.__init__(self, bus, "/")
2012
 
            _interface = "se.bsnet.fukt.Mandos"
 
2313
            _interface = "se.recompile.Mandos"
2013
2314
            
2014
2315
            @dbus.service.signal(_interface, signature="o")
2015
2316
            def ClientAdded(self, objpath):
2030
2331
            def GetAllClients(self):
2031
2332
                "D-Bus method"
2032
2333
                return dbus.Array(c.dbus_object_path
2033
 
                                  for c in tcp_server.clients)
 
2334
                                  for c in
 
2335
                                  tcp_server.clients.itervalues())
2034
2336
            
2035
2337
            @dbus.service.method(_interface,
2036
2338
                                 out_signature="a{oa{sv}}")
2038
2340
                "D-Bus method"
2039
2341
                return dbus.Dictionary(
2040
2342
                    ((c.dbus_object_path, c.GetAll(""))
2041
 
                     for c in tcp_server.clients),
 
2343
                     for c in tcp_server.clients.itervalues()),
2042
2344
                    signature="oa{sv}")
2043
2345
            
2044
2346
            @dbus.service.method(_interface, in_signature="o")
2045
2347
            def RemoveClient(self, object_path):
2046
2348
                "D-Bus method"
2047
 
                for c in tcp_server.clients:
 
2349
                for c in tcp_server.clients.itervalues():
2048
2350
                    if c.dbus_object_path == object_path:
2049
 
                        tcp_server.clients.remove(c)
 
2351
                        del tcp_server.clients[c.name]
2050
2352
                        c.remove_from_connection()
2051
2353
                        # Don't signal anything except ClientRemoved
2052
2354
                        c.disable(quiet=True)
2057
2359
            
2058
2360
            del _interface
2059
2361
        
2060
 
        mandos_dbus_service = MandosDBusService()
 
2362
        class MandosDBusServiceTransitional(MandosDBusService):
 
2363
            __metaclass__ = AlternateDBusNamesMetaclass
 
2364
        mandos_dbus_service = MandosDBusServiceTransitional()
2061
2365
    
2062
2366
    def cleanup():
2063
2367
        "Cleanup function; run on exit"
2064
2368
        service.cleanup()
2065
2369
        
 
2370
        multiprocessing.active_children()
 
2371
        if not (tcp_server.clients or client_settings):
 
2372
            return
 
2373
        
 
2374
        # Store client before exiting. Secrets are encrypted with key
 
2375
        # based on what config file has. If config file is
 
2376
        # removed/edited, old secret will thus be unrecovable.
 
2377
        clients = {}
 
2378
        with PGPEngine() as pgp:
 
2379
            for client in tcp_server.clients.itervalues():
 
2380
                key = client_settings[client.name]["secret"]
 
2381
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2382
                                                      key)
 
2383
                client_dict = {}
 
2384
                
 
2385
                # A list of attributes that can not be pickled
 
2386
                # + secret.
 
2387
                exclude = set(("bus", "changedstate", "secret",
 
2388
                               "checker"))
 
2389
                for name, typ in (inspect.getmembers
 
2390
                                  (dbus.service.Object)):
 
2391
                    exclude.add(name)
 
2392
                
 
2393
                client_dict["encrypted_secret"] = (client
 
2394
                                                   .encrypted_secret)
 
2395
                for attr in client.client_structure:
 
2396
                    if attr not in exclude:
 
2397
                        client_dict[attr] = getattr(client, attr)
 
2398
                
 
2399
                clients[client.name] = client_dict
 
2400
                del client_settings[client.name]["secret"]
 
2401
        
 
2402
        try:
 
2403
            with os.fdopen(os.open(stored_state_path,
 
2404
                                   os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
 
2405
                                   0600), "wb") as stored_state:
 
2406
                pickle.dump((clients, client_settings), stored_state)
 
2407
        except (IOError, OSError) as e:
 
2408
            logger.warning("Could not save persistent state: {0}"
 
2409
                           .format(e))
 
2410
            if e.errno not in (errno.ENOENT, errno.EACCES):
 
2411
                raise
 
2412
        
 
2413
        # Delete all clients, and settings from config
2066
2414
        while tcp_server.clients:
2067
 
            client = tcp_server.clients.pop()
 
2415
            name, client = tcp_server.clients.popitem()
2068
2416
            if use_dbus:
2069
2417
                client.remove_from_connection()
2070
 
            client.disable_hook = None
2071
2418
            # Don't signal anything except ClientRemoved
2072
2419
            client.disable(quiet=True)
2073
2420
            if use_dbus:
2074
2421
                # Emit D-Bus signal
2075
 
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
2422
                mandos_dbus_service.ClientRemoved(client
 
2423
                                                  .dbus_object_path,
2076
2424
                                                  client.name)
 
2425
        client_settings.clear()
2077
2426
    
2078
2427
    atexit.register(cleanup)
2079
2428
    
2080
 
    for client in tcp_server.clients:
 
2429
    for client in tcp_server.clients.itervalues():
2081
2430
        if use_dbus:
2082
2431
            # Emit D-Bus signal
2083
2432
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2084
 
        client.enable()
 
2433
        # Need to initiate checking of clients
 
2434
        if client.enabled:
 
2435
            client.init_checker()
2085
2436
    
2086
2437
    tcp_server.enable()
2087
2438
    tcp_server.server_activate()