/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2012-01-01 05:42:51 UTC
  • mfrom: (237.4.22 release)
  • Revision ID: teddy@recompile.se-20120101054251-26jflhej4znq2mzq
Merge from release branch.

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2011 Teddy Hogeborn
15
 
# Copyright © 2008-2011 Björn Påhlsson
 
14
# Copyright © 2008-2012 Teddy Hogeborn
 
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
 
66
import binascii
 
67
import tempfile
66
68
 
67
69
import dbus
68
70
import dbus.service
73
75
import ctypes.util
74
76
import xml.dom.minidom
75
77
import inspect
 
78
import GnuPGInterface
76
79
 
77
80
try:
78
81
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
82
85
    except ImportError:
83
86
        SO_BINDTODEVICE = None
84
87
 
85
 
 
86
 
version = "1.4.1"
87
 
 
88
 
#logger = logging.getLogger('mandos')
89
 
logger = logging.Logger('mandos')
 
88
version = "1.5.0"
 
89
stored_state_file = "clients.pickle"
 
90
 
 
91
logger = logging.getLogger()
90
92
syslogger = (logging.handlers.SysLogHandler
91
93
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
94
              address = str("/dev/log")))
93
 
syslogger.setFormatter(logging.Formatter
94
 
                       ('Mandos [%(process)d]: %(levelname)s:'
95
 
                        ' %(message)s'))
96
 
logger.addHandler(syslogger)
97
 
 
98
 
console = logging.StreamHandler()
99
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
 
                                       ' %(levelname)s:'
101
 
                                       ' %(message)s'))
102
 
logger.addHandler(console)
 
95
 
 
96
try:
 
97
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
98
                      (ctypes.util.find_library("c"))
 
99
                      .if_nametoindex)
 
100
except (OSError, AttributeError):
 
101
    def if_nametoindex(interface):
 
102
        "Get an interface index the hard way, i.e. using fcntl()"
 
103
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
104
        with contextlib.closing(socket.socket()) as s:
 
105
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
106
                                struct.pack(str("16s16x"),
 
107
                                            interface))
 
108
        interface_index = struct.unpack(str("I"),
 
109
                                        ifreq[16:20])[0]
 
110
        return interface_index
 
111
 
 
112
 
 
113
def initlogger(debug, level=logging.WARNING):
 
114
    """init logger and add loglevel"""
 
115
    
 
116
    syslogger.setFormatter(logging.Formatter
 
117
                           ('Mandos [%(process)d]: %(levelname)s:'
 
118
                            ' %(message)s'))
 
119
    logger.addHandler(syslogger)
 
120
    
 
121
    if debug:
 
122
        console = logging.StreamHandler()
 
123
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
124
                                               ' [%(process)d]:'
 
125
                                               ' %(levelname)s:'
 
126
                                               ' %(message)s'))
 
127
        logger.addHandler(console)
 
128
    logger.setLevel(level)
 
129
 
 
130
 
 
131
class PGPError(Exception):
 
132
    """Exception if encryption/decryption fails"""
 
133
    pass
 
134
 
 
135
 
 
136
class PGPEngine(object):
 
137
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
138
    def __init__(self):
 
139
        self.gnupg = GnuPGInterface.GnuPG()
 
140
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
141
        self.gnupg = GnuPGInterface.GnuPG()
 
142
        self.gnupg.options.meta_interactive = False
 
143
        self.gnupg.options.homedir = self.tempdir
 
144
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
145
                                              '--quiet',
 
146
                                              '--no-use-agent'])
 
147
    
 
148
    def __enter__(self):
 
149
        return self
 
150
    
 
151
    def __exit__ (self, exc_type, exc_value, traceback):
 
152
        self._cleanup()
 
153
        return False
 
154
    
 
155
    def __del__(self):
 
156
        self._cleanup()
 
157
    
 
158
    def _cleanup(self):
 
159
        if self.tempdir is not None:
 
160
            # Delete contents of tempdir
 
161
            for root, dirs, files in os.walk(self.tempdir,
 
162
                                             topdown = False):
 
163
                for filename in files:
 
164
                    os.remove(os.path.join(root, filename))
 
165
                for dirname in dirs:
 
166
                    os.rmdir(os.path.join(root, dirname))
 
167
            # Remove tempdir
 
168
            os.rmdir(self.tempdir)
 
169
            self.tempdir = None
 
170
    
 
171
    def password_encode(self, password):
 
172
        # Passphrase can not be empty and can not contain newlines or
 
173
        # NUL bytes.  So we prefix it and hex encode it.
 
174
        return b"mandos" + binascii.hexlify(password)
 
175
    
 
176
    def encrypt(self, data, password):
 
177
        self.gnupg.passphrase = self.password_encode(password)
 
178
        with open(os.devnull) as devnull:
 
179
            try:
 
180
                proc = self.gnupg.run(['--symmetric'],
 
181
                                      create_fhs=['stdin', 'stdout'],
 
182
                                      attach_fhs={'stderr': devnull})
 
183
                with contextlib.closing(proc.handles['stdin']) as f:
 
184
                    f.write(data)
 
185
                with contextlib.closing(proc.handles['stdout']) as f:
 
186
                    ciphertext = f.read()
 
187
                proc.wait()
 
188
            except IOError as e:
 
189
                raise PGPError(e)
 
190
        self.gnupg.passphrase = None
 
191
        return ciphertext
 
192
    
 
193
    def decrypt(self, data, password):
 
194
        self.gnupg.passphrase = self.password_encode(password)
 
195
        with open(os.devnull) as devnull:
 
196
            try:
 
197
                proc = self.gnupg.run(['--decrypt'],
 
198
                                      create_fhs=['stdin', 'stdout'],
 
199
                                      attach_fhs={'stderr': devnull})
 
200
                with contextlib.closing(proc.handles['stdin'] ) as f:
 
201
                    f.write(data)
 
202
                with contextlib.closing(proc.handles['stdout']) as f:
 
203
                    decrypted_plaintext = f.read()
 
204
                proc.wait()
 
205
            except IOError as e:
 
206
                raise PGPError(e)
 
207
        self.gnupg.passphrase = None
 
208
        return decrypted_plaintext
 
209
 
 
210
 
103
211
 
104
212
class AvahiError(Exception):
105
213
    def __init__(self, value, *args, **kwargs):
164
272
                            .GetAlternativeServiceName(self.name))
165
273
        logger.info("Changing Zeroconf service name to %r ...",
166
274
                    self.name)
167
 
        syslogger.setFormatter(logging.Formatter
168
 
                               ('Mandos (%s) [%%(process)d]:'
169
 
                                ' %%(levelname)s: %%(message)s'
170
 
                                % self.name))
171
275
        self.remove()
172
276
        try:
173
277
            self.add()
193
297
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
194
298
        self.entry_group_state_changed_match = (
195
299
            self.group.connect_to_signal(
196
 
                'StateChanged', self .entry_group_state_changed))
 
300
                'StateChanged', self.entry_group_state_changed))
197
301
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
198
302
                     self.name, self.type)
199
303
        self.group.AddService(
225
329
            try:
226
330
                self.group.Free()
227
331
            except (dbus.exceptions.UnknownMethodException,
228
 
                    dbus.exceptions.DBusException) as e:
 
332
                    dbus.exceptions.DBusException):
229
333
                pass
230
334
            self.group = None
231
335
        self.remove()
265
369
                                 self.server_state_changed)
266
370
        self.server_state_changed(self.server.GetState())
267
371
 
 
372
class AvahiServiceToSyslog(AvahiService):
 
373
    def rename(self):
 
374
        """Add the new name to the syslog messages"""
 
375
        ret = AvahiService.rename(self)
 
376
        syslogger.setFormatter(logging.Formatter
 
377
                               ('Mandos (%s) [%%(process)d]:'
 
378
                                ' %%(levelname)s: %%(message)s'
 
379
                                % self.name))
 
380
        return ret
268
381
 
269
 
def _timedelta_to_milliseconds(td):
 
382
def timedelta_to_milliseconds(td):
270
383
    "Convert a datetime.timedelta() to milliseconds"
271
384
    return ((td.days * 24 * 60 * 60 * 1000)
272
385
            + (td.seconds * 1000)
276
389
    """A representation of a client host served by this server.
277
390
    
278
391
    Attributes:
279
 
    _approved:   bool(); 'None' if not yet approved/disapproved
 
392
    approved:   bool(); 'None' if not yet approved/disapproved
280
393
    approval_delay: datetime.timedelta(); Time to wait for approval
281
394
    approval_duration: datetime.timedelta(); Duration of one approval
282
395
    checker:    subprocess.Popen(); a running checker process used
289
402
                     instance %(name)s can be used in the command.
290
403
    checker_initiator_tag: a gobject event source tag, or None
291
404
    created:    datetime.datetime(); (UTC) object creation
 
405
    client_structure: Object describing what attributes a client has
 
406
                      and is used for storing the client at exit
292
407
    current_checker_command: string; current running checker_command
293
 
    disable_hook:  If set, called by disable() as disable_hook(self)
294
408
    disable_initiator_tag: a gobject event source tag, or None
295
409
    enabled:    bool()
296
410
    fingerprint: string (40 or 32 hexadecimal digits); used to
299
413
    interval:   datetime.timedelta(); How often to start a new checker
300
414
    last_approval_request: datetime.datetime(); (UTC) or None
301
415
    last_checked_ok: datetime.datetime(); (UTC) or None
302
 
    last_enabled: datetime.datetime(); (UTC)
 
416
    last_checker_status: integer between 0 and 255 reflecting exit
 
417
                         status of last checker. -1 reflects crashed
 
418
                         checker, or None.
 
419
    last_enabled: datetime.datetime(); (UTC) or None
303
420
    name:       string; from the config file, used in log messages and
304
421
                        D-Bus identifiers
305
422
    secret:     bytestring; sent verbatim (over TLS) to client
315
432
                          "created", "enabled", "fingerprint",
316
433
                          "host", "interval", "last_checked_ok",
317
434
                          "last_enabled", "name", "timeout")
 
435
    client_defaults = { "timeout": "5m",
 
436
                        "extended_timeout": "15m",
 
437
                        "interval": "2m",
 
438
                        "checker": "fping -q -- %%(host)s",
 
439
                        "host": "",
 
440
                        "approval_delay": "0s",
 
441
                        "approval_duration": "1s",
 
442
                        "approved_by_default": "True",
 
443
                        "enabled": "True",
 
444
                        }
318
445
    
319
446
    def timeout_milliseconds(self):
320
447
        "Return the 'timeout' attribute in milliseconds"
321
 
        return _timedelta_to_milliseconds(self.timeout)
 
448
        return timedelta_to_milliseconds(self.timeout)
322
449
    
323
450
    def extended_timeout_milliseconds(self):
324
451
        "Return the 'extended_timeout' attribute in milliseconds"
325
 
        return _timedelta_to_milliseconds(self.extended_timeout)
 
452
        return timedelta_to_milliseconds(self.extended_timeout)
326
453
    
327
454
    def interval_milliseconds(self):
328
455
        "Return the 'interval' attribute in milliseconds"
329
 
        return _timedelta_to_milliseconds(self.interval)
 
456
        return timedelta_to_milliseconds(self.interval)
330
457
    
331
458
    def approval_delay_milliseconds(self):
332
 
        return _timedelta_to_milliseconds(self.approval_delay)
333
 
    
334
 
    def __init__(self, name = None, disable_hook=None, config=None):
 
459
        return timedelta_to_milliseconds(self.approval_delay)
 
460
 
 
461
    @staticmethod
 
462
    def config_parser(config):
 
463
        """Construct a new dict of client settings of this form:
 
464
        { client_name: {setting_name: value, ...}, ...}
 
465
        with exceptions for any special settings as defined above.
 
466
        NOTE: Must be a pure function. Must return the same result
 
467
        value given the same arguments.
 
468
        """
 
469
        settings = {}
 
470
        for client_name in config.sections():
 
471
            section = dict(config.items(client_name))
 
472
            client = settings[client_name] = {}
 
473
            
 
474
            client["host"] = section["host"]
 
475
            # Reformat values from string types to Python types
 
476
            client["approved_by_default"] = config.getboolean(
 
477
                client_name, "approved_by_default")
 
478
            client["enabled"] = config.getboolean(client_name,
 
479
                                                  "enabled")
 
480
            
 
481
            client["fingerprint"] = (section["fingerprint"].upper()
 
482
                                     .replace(" ", ""))
 
483
            if "secret" in section:
 
484
                client["secret"] = section["secret"].decode("base64")
 
485
            elif "secfile" in section:
 
486
                with open(os.path.expanduser(os.path.expandvars
 
487
                                             (section["secfile"])),
 
488
                          "rb") as secfile:
 
489
                    client["secret"] = secfile.read()
 
490
            else:
 
491
                raise TypeError("No secret or secfile for section %s"
 
492
                                % section)
 
493
            client["timeout"] = string_to_delta(section["timeout"])
 
494
            client["extended_timeout"] = string_to_delta(
 
495
                section["extended_timeout"])
 
496
            client["interval"] = string_to_delta(section["interval"])
 
497
            client["approval_delay"] = string_to_delta(
 
498
                section["approval_delay"])
 
499
            client["approval_duration"] = string_to_delta(
 
500
                section["approval_duration"])
 
501
            client["checker_command"] = section["checker"]
 
502
            client["last_approval_request"] = None
 
503
            client["last_checked_ok"] = None
 
504
            client["last_checker_status"] = None
 
505
        
 
506
        return settings
 
507
        
 
508
        
 
509
    def __init__(self, settings, name = None):
335
510
        """Note: the 'checker' key in 'config' sets the
336
511
        'checker_command' attribute and *not* the 'checker'
337
512
        attribute."""
338
513
        self.name = name
339
 
        if config is None:
340
 
            config = {}
 
514
        # adding all client settings
 
515
        for setting, value in settings.iteritems():
 
516
            setattr(self, setting, value)
 
517
        
 
518
        if self.enabled:
 
519
            if not hasattr(self, "last_enabled"):
 
520
                self.last_enabled = datetime.datetime.utcnow()
 
521
            if not hasattr(self, "expires"):
 
522
                self.expires = (datetime.datetime.utcnow()
 
523
                                + self.timeout)
 
524
        else:
 
525
            self.last_enabled = None
 
526
            self.expires = None
 
527
       
341
528
        logger.debug("Creating client %r", self.name)
342
529
        # Uppercase and remove spaces from fingerprint for later
343
530
        # comparison purposes with return value from the fingerprint()
344
531
        # function
345
 
        self.fingerprint = (config["fingerprint"].upper()
346
 
                            .replace(" ", ""))
347
532
        logger.debug("  Fingerprint: %s", self.fingerprint)
348
 
        if "secret" in config:
349
 
            self.secret = config["secret"].decode("base64")
350
 
        elif "secfile" in config:
351
 
            with open(os.path.expanduser(os.path.expandvars
352
 
                                         (config["secfile"])),
353
 
                      "rb") as secfile:
354
 
                self.secret = secfile.read()
355
 
        else:
356
 
            raise TypeError("No secret or secfile for client %s"
357
 
                            % self.name)
358
 
        self.host = config.get("host", "")
359
 
        self.created = datetime.datetime.utcnow()
360
 
        self.enabled = False
361
 
        self.last_approval_request = None
362
 
        self.last_enabled = None
363
 
        self.last_checked_ok = None
364
 
        self.timeout = string_to_delta(config["timeout"])
365
 
        self.extended_timeout = string_to_delta(config
366
 
                                                ["extended_timeout"])
367
 
        self.interval = string_to_delta(config["interval"])
368
 
        self.disable_hook = disable_hook
 
533
        self.created = settings.get("created",
 
534
                                    datetime.datetime.utcnow())
 
535
 
 
536
        # attributes specific for this server instance
369
537
        self.checker = None
370
538
        self.checker_initiator_tag = None
371
539
        self.disable_initiator_tag = None
372
 
        self.expires = None
373
540
        self.checker_callback_tag = None
374
 
        self.checker_command = config["checker"]
375
541
        self.current_checker_command = None
376
 
        self.last_connect = None
377
 
        self._approved = None
378
 
        self.approved_by_default = config.get("approved_by_default",
379
 
                                              True)
 
542
        self.approved = None
380
543
        self.approvals_pending = 0
381
 
        self.approval_delay = string_to_delta(
382
 
            config["approval_delay"])
383
 
        self.approval_duration = string_to_delta(
384
 
            config["approval_duration"])
385
544
        self.changedstate = (multiprocessing_manager
386
545
                             .Condition(multiprocessing_manager
387
546
                                        .Lock()))
 
547
        self.client_structure = [attr for attr in
 
548
                                 self.__dict__.iterkeys()
 
549
                                 if not attr.startswith("_")]
 
550
        self.client_structure.append("client_structure")
 
551
        
 
552
        for name, t in inspect.getmembers(type(self),
 
553
                                          lambda obj:
 
554
                                              isinstance(obj,
 
555
                                                         property)):
 
556
            if not name.startswith("_"):
 
557
                self.client_structure.append(name)
388
558
    
 
559
    # Send notice to process children that client state has changed
389
560
    def send_changedstate(self):
390
 
        self.changedstate.acquire()
391
 
        self.changedstate.notify_all()
392
 
        self.changedstate.release()
 
561
        with self.changedstate:
 
562
            self.changedstate.notify_all()
393
563
    
394
564
    def enable(self):
395
565
        """Start this client's checker and timeout hooks"""
397
567
            # Already enabled
398
568
            return
399
569
        self.send_changedstate()
400
 
        # Schedule a new checker to be started an 'interval' from now,
401
 
        # and every interval from then on.
402
 
        self.checker_initiator_tag = (gobject.timeout_add
403
 
                                      (self.interval_milliseconds(),
404
 
                                       self.start_checker))
405
 
        # Schedule a disable() when 'timeout' has passed
406
570
        self.expires = datetime.datetime.utcnow() + self.timeout
407
 
        self.disable_initiator_tag = (gobject.timeout_add
408
 
                                   (self.timeout_milliseconds(),
409
 
                                    self.disable))
410
571
        self.enabled = True
411
572
        self.last_enabled = datetime.datetime.utcnow()
412
 
        # Also start a new checker *right now*.
413
 
        self.start_checker()
 
573
        self.init_checker()
414
574
    
415
575
    def disable(self, quiet=True):
416
576
        """Disable this client."""
428
588
            gobject.source_remove(self.checker_initiator_tag)
429
589
            self.checker_initiator_tag = None
430
590
        self.stop_checker()
431
 
        if self.disable_hook:
432
 
            self.disable_hook(self)
433
591
        self.enabled = False
434
592
        # Do not run this again if called by a gobject.timeout_add
435
593
        return False
436
594
    
437
595
    def __del__(self):
438
 
        self.disable_hook = None
439
596
        self.disable()
440
597
    
 
598
    def init_checker(self):
 
599
        # Schedule a new checker to be started an 'interval' from now,
 
600
        # and every interval from then on.
 
601
        self.checker_initiator_tag = (gobject.timeout_add
 
602
                                      (self.interval_milliseconds(),
 
603
                                       self.start_checker))
 
604
        # Schedule a disable() when 'timeout' has passed
 
605
        self.disable_initiator_tag = (gobject.timeout_add
 
606
                                   (self.timeout_milliseconds(),
 
607
                                    self.disable))
 
608
        # Also start a new checker *right now*.
 
609
        self.start_checker()
 
610
    
441
611
    def checker_callback(self, pid, condition, command):
442
612
        """The checker has completed, so take appropriate actions."""
443
613
        self.checker_callback_tag = None
444
614
        self.checker = None
445
615
        if os.WIFEXITED(condition):
446
 
            exitstatus = os.WEXITSTATUS(condition)
447
 
            if exitstatus == 0:
 
616
            self.last_checker_status = os.WEXITSTATUS(condition)
 
617
            if self.last_checker_status == 0:
448
618
                logger.info("Checker for %(name)s succeeded",
449
619
                            vars(self))
450
620
                self.checked_ok()
452
622
                logger.info("Checker for %(name)s failed",
453
623
                            vars(self))
454
624
        else:
 
625
            self.last_checker_status = -1
455
626
            logger.warning("Checker for %(name)s crashed?",
456
627
                           vars(self))
457
628
    
468
639
            gobject.source_remove(self.disable_initiator_tag)
469
640
        if getattr(self, "enabled", False):
470
641
            self.disable_initiator_tag = (gobject.timeout_add
471
 
                                          (_timedelta_to_milliseconds
 
642
                                          (timedelta_to_milliseconds
472
643
                                           (timeout), self.disable))
473
644
            self.expires = datetime.datetime.utcnow() + timeout
474
645
    
679
850
            # signatures other than "ay".
680
851
            if prop._dbus_signature != "ay":
681
852
                raise ValueError
682
 
            value = dbus.ByteArray(''.join(unichr(byte)
683
 
                                           for byte in value))
 
853
            value = dbus.ByteArray(b''.join(chr(byte)
 
854
                                            for byte in value))
684
855
        prop(value)
685
856
    
686
857
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
691
862
        
692
863
        Note: Will not include properties with access="write".
693
864
        """
694
 
        all = {}
 
865
        properties = {}
695
866
        for name, prop in self._get_all_dbus_properties():
696
867
            if (interface_name
697
868
                and interface_name != prop._dbus_interface):
702
873
                continue
703
874
            value = prop()
704
875
            if not hasattr(value, "variant_level"):
705
 
                all[name] = value
 
876
                properties[name] = value
706
877
                continue
707
 
            all[name] = type(value)(value, variant_level=
708
 
                                    value.variant_level+1)
709
 
        return dbus.Dictionary(all, signature="sv")
 
878
            properties[name] = type(value)(value, variant_level=
 
879
                                           value.variant_level+1)
 
880
        return dbus.Dictionary(properties, signature="sv")
710
881
    
711
882
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
712
883
                         out_signature="s",
763
934
    return dbus.String(dt.isoformat(),
764
935
                       variant_level=variant_level)
765
936
 
 
937
 
766
938
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
767
939
                                  .__metaclass__):
768
940
    """Applied to an empty subclass of a D-Bus object, this metaclass
860
1032
                                        attribute.func_closure)))
861
1033
        return type.__new__(mcs, name, bases, attr)
862
1034
 
 
1035
 
863
1036
class ClientDBus(Client, DBusObjectWithProperties):
864
1037
    """A Client class using D-Bus
865
1038
    
874
1047
    # dbus.service.Object doesn't use super(), so we can't either.
875
1048
    
876
1049
    def __init__(self, bus = None, *args, **kwargs):
877
 
        self._approvals_pending = 0
878
1050
        self.bus = bus
879
1051
        Client.__init__(self, *args, **kwargs)
 
1052
        self._approvals_pending = 0
 
1053
        
 
1054
        self._approvals_pending = 0
880
1055
        # Only now, when this client is initialized, can it show up on
881
1056
        # the D-Bus
882
1057
        client_object_name = unicode(self.name).translate(
892
1067
                             variant_level=1):
893
1068
        """ Modify a variable so that it's a property which announces
894
1069
        its changes to DBus.
895
 
 
 
1070
        
896
1071
        transform_fun: Function that takes a value and a variant_level
897
1072
                       and transforms it to a D-Bus type.
898
1073
        dbus_name: D-Bus name of the variable
932
1107
        datetime_to_dbus, "LastApprovalRequest")
933
1108
    approved_by_default = notifychangeproperty(dbus.Boolean,
934
1109
                                               "ApprovedByDefault")
935
 
    approval_delay = notifychangeproperty(dbus.UInt16,
 
1110
    approval_delay = notifychangeproperty(dbus.UInt64,
936
1111
                                          "ApprovalDelay",
937
1112
                                          type_func =
938
 
                                          _timedelta_to_milliseconds)
 
1113
                                          timedelta_to_milliseconds)
939
1114
    approval_duration = notifychangeproperty(
940
 
        dbus.UInt16, "ApprovalDuration",
941
 
        type_func = _timedelta_to_milliseconds)
 
1115
        dbus.UInt64, "ApprovalDuration",
 
1116
        type_func = timedelta_to_milliseconds)
942
1117
    host = notifychangeproperty(dbus.String, "Host")
943
 
    timeout = notifychangeproperty(dbus.UInt16, "Timeout",
 
1118
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
944
1119
                                   type_func =
945
 
                                   _timedelta_to_milliseconds)
 
1120
                                   timedelta_to_milliseconds)
946
1121
    extended_timeout = notifychangeproperty(
947
 
        dbus.UInt16, "ExtendedTimeout",
948
 
        type_func = _timedelta_to_milliseconds)
949
 
    interval = notifychangeproperty(dbus.UInt16,
 
1122
        dbus.UInt64, "ExtendedTimeout",
 
1123
        type_func = timedelta_to_milliseconds)
 
1124
    interval = notifychangeproperty(dbus.UInt64,
950
1125
                                    "Interval",
951
1126
                                    type_func =
952
 
                                    _timedelta_to_milliseconds)
 
1127
                                    timedelta_to_milliseconds)
953
1128
    checker_command = notifychangeproperty(dbus.String, "Checker")
954
1129
    
955
1130
    del notifychangeproperty
997
1172
        return r
998
1173
    
999
1174
    def _reset_approved(self):
1000
 
        self._approved = None
 
1175
        self.approved = None
1001
1176
        return False
1002
1177
    
1003
1178
    def approve(self, value=True):
1004
1179
        self.send_changedstate()
1005
 
        self._approved = value
1006
 
        gobject.timeout_add(_timedelta_to_milliseconds
 
1180
        self.approved = value
 
1181
        gobject.timeout_add(timedelta_to_milliseconds
1007
1182
                            (self.approval_duration),
1008
1183
                            self._reset_approved)
1009
1184
    
1052
1227
        "D-Bus signal"
1053
1228
        return self.need_approval()
1054
1229
    
 
1230
    # NeRwequest - signal
 
1231
    @dbus.service.signal(_interface, signature="s")
 
1232
    def NewRequest(self, ip):
 
1233
        """D-Bus signal
 
1234
        Is sent after a client request a password.
 
1235
        """
 
1236
        pass
 
1237
    
1055
1238
    ## Methods
1056
1239
    
1057
1240
    # Approve - method
1115
1298
                           access="readwrite")
1116
1299
    def ApprovalDuration_dbus_property(self, value=None):
1117
1300
        if value is None:       # get
1118
 
            return dbus.UInt64(_timedelta_to_milliseconds(
 
1301
            return dbus.UInt64(timedelta_to_milliseconds(
1119
1302
                    self.approval_duration))
1120
1303
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1121
1304
    
1135
1318
    def Host_dbus_property(self, value=None):
1136
1319
        if value is None:       # get
1137
1320
            return dbus.String(self.host)
1138
 
        self.host = value
 
1321
        self.host = unicode(value)
1139
1322
    
1140
1323
    # Created - property
1141
1324
    @dbus_service_property(_interface, signature="s", access="read")
1142
1325
    def Created_dbus_property(self):
1143
 
        return dbus.String(datetime_to_dbus(self.created))
 
1326
        return datetime_to_dbus(self.created)
1144
1327
    
1145
1328
    # LastEnabled - property
1146
1329
    @dbus_service_property(_interface, signature="s", access="read")
1184
1367
        if value is None:       # get
1185
1368
            return dbus.UInt64(self.timeout_milliseconds())
1186
1369
        self.timeout = datetime.timedelta(0, 0, 0, value)
1187
 
        if getattr(self, "disable_initiator_tag", None) is None:
1188
 
            return
1189
1370
        # Reschedule timeout
1190
 
        gobject.source_remove(self.disable_initiator_tag)
1191
 
        self.disable_initiator_tag = None
1192
 
        self.expires = None
1193
 
        time_to_die = _timedelta_to_milliseconds((self
1194
 
                                                  .last_checked_ok
1195
 
                                                  + self.timeout)
1196
 
                                                 - datetime.datetime
1197
 
                                                 .utcnow())
1198
 
        if time_to_die <= 0:
1199
 
            # The timeout has passed
1200
 
            self.disable()
1201
 
        else:
1202
 
            self.expires = (datetime.datetime.utcnow()
1203
 
                            + datetime.timedelta(milliseconds =
1204
 
                                                 time_to_die))
1205
 
            self.disable_initiator_tag = (gobject.timeout_add
1206
 
                                          (time_to_die, self.disable))
 
1371
        if self.enabled:
 
1372
            now = datetime.datetime.utcnow()
 
1373
            time_to_die = timedelta_to_milliseconds(
 
1374
                (self.last_checked_ok + self.timeout) - now)
 
1375
            if time_to_die <= 0:
 
1376
                # The timeout has passed
 
1377
                self.disable()
 
1378
            else:
 
1379
                self.expires = (now +
 
1380
                                datetime.timedelta(milliseconds =
 
1381
                                                   time_to_die))
 
1382
                if (getattr(self, "disable_initiator_tag", None)
 
1383
                    is None):
 
1384
                    return
 
1385
                gobject.source_remove(self.disable_initiator_tag)
 
1386
                self.disable_initiator_tag = (gobject.timeout_add
 
1387
                                              (time_to_die,
 
1388
                                               self.disable))
1207
1389
    
1208
1390
    # ExtendedTimeout - property
1209
1391
    @dbus_service_property(_interface, signature="t",
1222
1404
        self.interval = datetime.timedelta(0, 0, 0, value)
1223
1405
        if getattr(self, "checker_initiator_tag", None) is None:
1224
1406
            return
1225
 
        # Reschedule checker run
1226
 
        gobject.source_remove(self.checker_initiator_tag)
1227
 
        self.checker_initiator_tag = (gobject.timeout_add
1228
 
                                      (value, self.start_checker))
1229
 
        self.start_checker()    # Start one now, too
 
1407
        if self.enabled:
 
1408
            # Reschedule checker run
 
1409
            gobject.source_remove(self.checker_initiator_tag)
 
1410
            self.checker_initiator_tag = (gobject.timeout_add
 
1411
                                          (value, self.start_checker))
 
1412
            self.start_checker()    # Start one now, too
1230
1413
    
1231
1414
    # Checker - property
1232
1415
    @dbus_service_property(_interface, signature="s",
1234
1417
    def Checker_dbus_property(self, value=None):
1235
1418
        if value is None:       # get
1236
1419
            return dbus.String(self.checker_command)
1237
 
        self.checker_command = value
 
1420
        self.checker_command = unicode(value)
1238
1421
    
1239
1422
    # CheckerRunning - property
1240
1423
    @dbus_service_property(_interface, signature="b",
1269
1452
            raise KeyError()
1270
1453
    
1271
1454
    def __getattribute__(self, name):
1272
 
        if(name == '_pipe'):
 
1455
        if name == '_pipe':
1273
1456
            return super(ProxyClient, self).__getattribute__(name)
1274
1457
        self._pipe.send(('getattr', name))
1275
1458
        data = self._pipe.recv()
1282
1465
            return func
1283
1466
    
1284
1467
    def __setattr__(self, name, value):
1285
 
        if(name == '_pipe'):
 
1468
        if name == '_pipe':
1286
1469
            return super(ProxyClient, self).__setattr__(name, value)
1287
1470
        self._pipe.send(('setattr', name, value))
1288
1471
 
 
1472
 
1289
1473
class ClientDBusTransitional(ClientDBus):
1290
1474
    __metaclass__ = AlternateDBusNamesMetaclass
1291
1475
 
 
1476
 
1292
1477
class ClientHandler(socketserver.BaseRequestHandler, object):
1293
1478
    """A class to handle client connections.
1294
1479
    
1362
1547
                except KeyError:
1363
1548
                    return
1364
1549
                
 
1550
                if self.server.use_dbus:
 
1551
                    # Emit D-Bus signal
 
1552
                    client.NewRequest(str(self.client_address))
 
1553
                
1365
1554
                if client.approval_delay:
1366
1555
                    delay = client.approval_delay
1367
1556
                    client.approvals_pending += 1
1376
1565
                            client.Rejected("Disabled")
1377
1566
                        return
1378
1567
                    
1379
 
                    if client._approved or not client.approval_delay:
 
1568
                    if client.approved or not client.approval_delay:
1380
1569
                        #We are approved or approval is disabled
1381
1570
                        break
1382
 
                    elif client._approved is None:
 
1571
                    elif client.approved is None:
1383
1572
                        logger.info("Client %s needs approval",
1384
1573
                                    client.name)
1385
1574
                        if self.server.use_dbus:
1399
1588
                    time = datetime.datetime.now()
1400
1589
                    client.changedstate.acquire()
1401
1590
                    (client.changedstate.wait
1402
 
                     (float(client._timedelta_to_milliseconds(delay)
 
1591
                     (float(client.timedelta_to_milliseconds(delay)
1403
1592
                            / 1000)))
1404
1593
                    client.changedstate.release()
1405
1594
                    time2 = datetime.datetime.now()
1504
1693
        # Convert the buffer to a Python bytestring
1505
1694
        fpr = ctypes.string_at(buf, buf_len.value)
1506
1695
        # Convert the bytestring to hexadecimal notation
1507
 
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
1696
        hex_fpr = binascii.hexlify(fpr).upper()
1508
1697
        return hex_fpr
1509
1698
 
1510
1699
 
1513
1702
    def sub_process_main(self, request, address):
1514
1703
        try:
1515
1704
            self.finish_request(request, address)
1516
 
        except:
 
1705
        except Exception:
1517
1706
            self.handle_error(request, address)
1518
1707
        self.close_request(request)
1519
1708
    
1624
1813
        self.enabled = False
1625
1814
        self.clients = clients
1626
1815
        if self.clients is None:
1627
 
            self.clients = set()
 
1816
            self.clients = {}
1628
1817
        self.use_dbus = use_dbus
1629
1818
        self.gnutls_priority = gnutls_priority
1630
1819
        IPv6_TCPServer.__init__(self, server_address,
1677
1866
            fpr = request[1]
1678
1867
            address = request[2]
1679
1868
            
1680
 
            for c in self.clients:
 
1869
            for c in self.clients.itervalues():
1681
1870
                if c.fingerprint == fpr:
1682
1871
                    client = c
1683
1872
                    break
1767
1956
    return timevalue
1768
1957
 
1769
1958
 
1770
 
def if_nametoindex(interface):
1771
 
    """Call the C function if_nametoindex(), or equivalent
1772
 
    
1773
 
    Note: This function cannot accept a unicode string."""
1774
 
    global if_nametoindex
1775
 
    try:
1776
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1777
 
                          (ctypes.util.find_library("c"))
1778
 
                          .if_nametoindex)
1779
 
    except (OSError, AttributeError):
1780
 
        logger.warning("Doing if_nametoindex the hard way")
1781
 
        def if_nametoindex(interface):
1782
 
            "Get an interface index the hard way, i.e. using fcntl()"
1783
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1784
 
            with contextlib.closing(socket.socket()) as s:
1785
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1786
 
                                    struct.pack(str("16s16x"),
1787
 
                                                interface))
1788
 
            interface_index = struct.unpack(str("I"),
1789
 
                                            ifreq[16:20])[0]
1790
 
            return interface_index
1791
 
    return if_nametoindex(interface)
1792
 
 
1793
 
 
1794
1959
def daemon(nochdir = False, noclose = False):
1795
1960
    """See daemon(3).  Standard BSD Unix function.
1796
1961
    
1851
2016
                        " system bus interface")
1852
2017
    parser.add_argument("--no-ipv6", action="store_false",
1853
2018
                        dest="use_ipv6", help="Do not use IPv6")
 
2019
    parser.add_argument("--no-restore", action="store_false",
 
2020
                        dest="restore", help="Do not restore stored"
 
2021
                        " state")
 
2022
    parser.add_argument("--statedir", metavar="DIR",
 
2023
                        help="Directory to save/restore state in")
 
2024
    
1854
2025
    options = parser.parse_args()
1855
2026
    
1856
2027
    if options.check:
1869
2040
                        "use_dbus": "True",
1870
2041
                        "use_ipv6": "True",
1871
2042
                        "debuglevel": "",
 
2043
                        "restore": "True",
 
2044
                        "statedir": "/var/lib/mandos"
1872
2045
                        }
1873
2046
    
1874
2047
    # Parse config file for server-global settings
1891
2064
    # options, if set.
1892
2065
    for option in ("interface", "address", "port", "debug",
1893
2066
                   "priority", "servicename", "configdir",
1894
 
                   "use_dbus", "use_ipv6", "debuglevel"):
 
2067
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2068
                   "statedir"):
1895
2069
        value = getattr(options, option)
1896
2070
        if value is not None:
1897
2071
            server_settings[option] = value
1909
2083
    debuglevel = server_settings["debuglevel"]
1910
2084
    use_dbus = server_settings["use_dbus"]
1911
2085
    use_ipv6 = server_settings["use_ipv6"]
 
2086
    stored_state_path = os.path.join(server_settings["statedir"],
 
2087
                                     stored_state_file)
 
2088
    
 
2089
    if debug:
 
2090
        initlogger(debug, logging.DEBUG)
 
2091
    else:
 
2092
        if not debuglevel:
 
2093
            initlogger(debug)
 
2094
        else:
 
2095
            level = getattr(logging, debuglevel.upper())
 
2096
            initlogger(debug, level)
1912
2097
    
1913
2098
    if server_settings["servicename"] != "Mandos":
1914
2099
        syslogger.setFormatter(logging.Formatter
1917
2102
                                % server_settings["servicename"]))
1918
2103
    
1919
2104
    # Parse config file with clients
1920
 
    client_defaults = { "timeout": "5m",
1921
 
                        "extended_timeout": "15m",
1922
 
                        "interval": "2m",
1923
 
                        "checker": "fping -q -- %%(host)s",
1924
 
                        "host": "",
1925
 
                        "approval_delay": "0s",
1926
 
                        "approval_duration": "1s",
1927
 
                        }
1928
 
    client_config = configparser.SafeConfigParser(client_defaults)
 
2105
    client_config = configparser.SafeConfigParser(Client
 
2106
                                                  .client_defaults)
1929
2107
    client_config.read(os.path.join(server_settings["configdir"],
1930
2108
                                    "clients.conf"))
1931
2109
    
1969
2147
        if error[0] != errno.EPERM:
1970
2148
            raise error
1971
2149
    
1972
 
    if not debug and not debuglevel:
1973
 
        syslogger.setLevel(logging.WARNING)
1974
 
        console.setLevel(logging.WARNING)
1975
 
    if debuglevel:
1976
 
        level = getattr(logging, debuglevel.upper())
1977
 
        syslogger.setLevel(level)
1978
 
        console.setLevel(level)
1979
 
    
1980
2150
    if debug:
1981
2151
        # Enable all possible GnuTLS debugging
1982
2152
        
1996
2166
        os.dup2(null, sys.stdin.fileno())
1997
2167
        if null > 2:
1998
2168
            os.close(null)
1999
 
    else:
2000
 
        # No console logging
2001
 
        logger.removeHandler(console)
2002
2169
    
2003
2170
    # Need to fork before connecting to D-Bus
2004
2171
    if not debug:
2005
2172
        # Close all input and output, do double fork, etc.
2006
2173
        daemon()
2007
2174
    
 
2175
    gobject.threads_init()
 
2176
    
2008
2177
    global main_loop
2009
2178
    # From the Avahi example code
2010
2179
    DBusGMainLoop(set_as_default=True )
2024
2193
            server_settings["use_dbus"] = False
2025
2194
            tcp_server.use_dbus = False
2026
2195
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2027
 
    service = AvahiService(name = server_settings["servicename"],
2028
 
                           servicetype = "_mandos._tcp",
2029
 
                           protocol = protocol, bus = bus)
 
2196
    service = AvahiServiceToSyslog(name =
 
2197
                                   server_settings["servicename"],
 
2198
                                   servicetype = "_mandos._tcp",
 
2199
                                   protocol = protocol, bus = bus)
2030
2200
    if server_settings["interface"]:
2031
2201
        service.interface = (if_nametoindex
2032
2202
                             (str(server_settings["interface"])))
2038
2208
    if use_dbus:
2039
2209
        client_class = functools.partial(ClientDBusTransitional,
2040
2210
                                         bus = bus)
2041
 
    def client_config_items(config, section):
2042
 
        special_settings = {
2043
 
            "approved_by_default":
2044
 
                lambda: config.getboolean(section,
2045
 
                                          "approved_by_default"),
2046
 
            }
2047
 
        for name, value in config.items(section):
 
2211
    
 
2212
    client_settings = Client.config_parser(client_config)
 
2213
    old_client_settings = {}
 
2214
    clients_data = {}
 
2215
    
 
2216
    # Get client data and settings from last running state.
 
2217
    if server_settings["restore"]:
 
2218
        try:
 
2219
            with open(stored_state_path, "rb") as stored_state:
 
2220
                clients_data, old_client_settings = (pickle.load
 
2221
                                                     (stored_state))
 
2222
            os.remove(stored_state_path)
 
2223
        except IOError as e:
 
2224
            logger.warning("Could not load persistent state: {0}"
 
2225
                           .format(e))
 
2226
            if e.errno != errno.ENOENT:
 
2227
                raise
 
2228
        except EOFError as e:
 
2229
            logger.warning("Could not load persistent state: "
 
2230
                           "EOFError: {0}".format(e))
 
2231
    
 
2232
    with PGPEngine() as pgp:
 
2233
        for client_name, client in clients_data.iteritems():
 
2234
            # Decide which value to use after restoring saved state.
 
2235
            # We have three different values: Old config file,
 
2236
            # new config file, and saved state.
 
2237
            # New config value takes precedence if it differs from old
 
2238
            # config value, otherwise use saved state.
 
2239
            for name, value in client_settings[client_name].items():
 
2240
                try:
 
2241
                    # For each value in new config, check if it
 
2242
                    # differs from the old config value (Except for
 
2243
                    # the "secret" attribute)
 
2244
                    if (name != "secret" and
 
2245
                        value != old_client_settings[client_name]
 
2246
                        [name]):
 
2247
                        client[name] = value
 
2248
                except KeyError:
 
2249
                    pass
 
2250
            
 
2251
            # Clients who has passed its expire date can still be
 
2252
            # enabled if its last checker was successful.  Clients
 
2253
            # whose checker failed before we stored its state is
 
2254
            # assumed to have failed all checkers during downtime.
 
2255
            if client["enabled"]:
 
2256
                if datetime.datetime.utcnow() >= client["expires"]:
 
2257
                    if not client["last_checked_ok"]:
 
2258
                        logger.warning(
 
2259
                            "disabling client {0} - Client never "
 
2260
                            "performed a successfull checker"
 
2261
                            .format(client["name"]))
 
2262
                        client["enabled"] = False
 
2263
                    elif client["last_checker_status"] != 0:
 
2264
                        logger.warning(
 
2265
                            "disabling client {0} - Client "
 
2266
                            "last checker failed with error code {1}"
 
2267
                            .format(client["name"],
 
2268
                                    client["last_checker_status"]))
 
2269
                        client["enabled"] = False
 
2270
                    else:
 
2271
                        client["expires"] = (datetime.datetime
 
2272
                                             .utcnow()
 
2273
                                             + client["timeout"])
 
2274
                        logger.debug("Last checker succeeded,"
 
2275
                                     " keeping {0} enabled"
 
2276
                                     .format(client["name"]))
2048
2277
            try:
2049
 
                yield (name, special_settings[name]())
2050
 
            except KeyError:
2051
 
                yield (name, value)
2052
 
    
2053
 
    tcp_server.clients.update(set(
2054
 
            client_class(name = section,
2055
 
                         config= dict(client_config_items(
2056
 
                        client_config, section)))
2057
 
            for section in client_config.sections()))
 
2278
                client["secret"] = (
 
2279
                    pgp.decrypt(client["encrypted_secret"],
 
2280
                                client_settings[client_name]
 
2281
                                ["secret"]))
 
2282
            except PGPError:
 
2283
                # If decryption fails, we use secret from new settings
 
2284
                logger.debug("Failed to decrypt {0} old secret"
 
2285
                             .format(client_name))
 
2286
                client["secret"] = (
 
2287
                    client_settings[client_name]["secret"])
 
2288
 
 
2289
    
 
2290
    # Add/remove clients based on new changes made to config
 
2291
    for client_name in (set(old_client_settings)
 
2292
                        - set(client_settings)):
 
2293
        del clients_data[client_name]
 
2294
    for client_name in (set(client_settings)
 
2295
                        - set(old_client_settings)):
 
2296
        clients_data[client_name] = client_settings[client_name]
 
2297
 
 
2298
    # Create clients all clients
 
2299
    for client_name, client in clients_data.iteritems():
 
2300
        tcp_server.clients[client_name] = client_class(
 
2301
            name = client_name, settings = client)
 
2302
    
2058
2303
    if not tcp_server.clients:
2059
2304
        logger.warning("No clients defined")
2060
2305
        
2071
2316
            # "pidfile" was never created
2072
2317
            pass
2073
2318
        del pidfilename
2074
 
        
2075
2319
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2076
2320
    
2077
2321
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2103
2347
            def GetAllClients(self):
2104
2348
                "D-Bus method"
2105
2349
                return dbus.Array(c.dbus_object_path
2106
 
                                  for c in tcp_server.clients)
 
2350
                                  for c in
 
2351
                                  tcp_server.clients.itervalues())
2107
2352
            
2108
2353
            @dbus.service.method(_interface,
2109
2354
                                 out_signature="a{oa{sv}}")
2111
2356
                "D-Bus method"
2112
2357
                return dbus.Dictionary(
2113
2358
                    ((c.dbus_object_path, c.GetAll(""))
2114
 
                     for c in tcp_server.clients),
 
2359
                     for c in tcp_server.clients.itervalues()),
2115
2360
                    signature="oa{sv}")
2116
2361
            
2117
2362
            @dbus.service.method(_interface, in_signature="o")
2118
2363
            def RemoveClient(self, object_path):
2119
2364
                "D-Bus method"
2120
 
                for c in tcp_server.clients:
 
2365
                for c in tcp_server.clients.itervalues():
2121
2366
                    if c.dbus_object_path == object_path:
2122
 
                        tcp_server.clients.remove(c)
 
2367
                        del tcp_server.clients[c.name]
2123
2368
                        c.remove_from_connection()
2124
2369
                        # Don't signal anything except ClientRemoved
2125
2370
                        c.disable(quiet=True)
2139
2384
        service.cleanup()
2140
2385
        
2141
2386
        multiprocessing.active_children()
 
2387
        if not (tcp_server.clients or client_settings):
 
2388
            return
 
2389
        
 
2390
        # Store client before exiting. Secrets are encrypted with key
 
2391
        # based on what config file has. If config file is
 
2392
        # removed/edited, old secret will thus be unrecovable.
 
2393
        clients = {}
 
2394
        with PGPEngine() as pgp:
 
2395
            for client in tcp_server.clients.itervalues():
 
2396
                key = client_settings[client.name]["secret"]
 
2397
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2398
                                                      key)
 
2399
                client_dict = {}
 
2400
                
 
2401
                # A list of attributes that can not be pickled
 
2402
                # + secret.
 
2403
                exclude = set(("bus", "changedstate", "secret",
 
2404
                               "checker"))
 
2405
                for name, typ in (inspect.getmembers
 
2406
                                  (dbus.service.Object)):
 
2407
                    exclude.add(name)
 
2408
                
 
2409
                client_dict["encrypted_secret"] = (client
 
2410
                                                   .encrypted_secret)
 
2411
                for attr in client.client_structure:
 
2412
                    if attr not in exclude:
 
2413
                        client_dict[attr] = getattr(client, attr)
 
2414
                
 
2415
                clients[client.name] = client_dict
 
2416
                del client_settings[client.name]["secret"]
 
2417
        
 
2418
        try:
 
2419
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
 
2420
                                                prefix="clients-",
 
2421
                                                dir=os.path.dirname
 
2422
                                                (stored_state_path))
 
2423
            with os.fdopen(tempfd, "wb") as stored_state:
 
2424
                pickle.dump((clients, client_settings), stored_state)
 
2425
            os.rename(tempname, stored_state_path)
 
2426
        except (IOError, OSError) as e:
 
2427
            logger.warning("Could not save persistent state: {0}"
 
2428
                           .format(e))
 
2429
            if not debug:
 
2430
                try:
 
2431
                    os.remove(tempname)
 
2432
                except NameError:
 
2433
                    pass
 
2434
            if e.errno not in set((errno.ENOENT, errno.EACCES,
 
2435
                                   errno.EEXIST)):
 
2436
                raise e
 
2437
        
 
2438
        # Delete all clients, and settings from config
2142
2439
        while tcp_server.clients:
2143
 
            client = tcp_server.clients.pop()
 
2440
            name, client = tcp_server.clients.popitem()
2144
2441
            if use_dbus:
2145
2442
                client.remove_from_connection()
2146
 
            client.disable_hook = None
2147
2443
            # Don't signal anything except ClientRemoved
2148
2444
            client.disable(quiet=True)
2149
2445
            if use_dbus:
2151
2447
                mandos_dbus_service.ClientRemoved(client
2152
2448
                                                  .dbus_object_path,
2153
2449
                                                  client.name)
 
2450
        client_settings.clear()
2154
2451
    
2155
2452
    atexit.register(cleanup)
2156
2453
    
2157
 
    for client in tcp_server.clients:
 
2454
    for client in tcp_server.clients.itervalues():
2158
2455
        if use_dbus:
2159
2456
            # Emit D-Bus signal
2160
2457
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2161
 
        client.enable()
 
2458
        # Need to initiate checking of clients
 
2459
        if client.enabled:
 
2460
            client.init_checker()
2162
2461
    
2163
2462
    tcp_server.enable()
2164
2463
    tcp_server.server_activate()
2204
2503
    # Must run before the D-Bus bus name gets deregistered
2205
2504
    cleanup()
2206
2505
 
2207
 
 
2208
2506
if __name__ == '__main__':
2209
2507
    main()