82
88
except ImportError:
83
89
SO_BINDTODEVICE = None
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
92
stored_state_file = "clients.pickle"
94
logger = logging.getLogger()
90
95
syslogger = (logging.handlers.SysLogHandler
91
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
97
address = str("/dev/log")))
93
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
96
logger.addHandler(syslogger)
98
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
102
logger.addHandler(console)
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
103
except (OSError, AttributeError):
104
def if_nametoindex(interface):
105
"Get an interface index the hard way, i.e. using fcntl()"
106
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
with contextlib.closing(socket.socket()) as s:
108
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
111
interface_index = struct.unpack(str("I"),
113
return interface_index
116
def initlogger(debug, level=logging.WARNING):
117
"""init logger and add loglevel"""
119
syslogger.setFormatter(logging.Formatter
120
('Mandos [%(process)d]: %(levelname)s:'
122
logger.addHandler(syslogger)
125
console = logging.StreamHandler()
126
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
130
logger.addHandler(console)
131
logger.setLevel(level)
134
class PGPError(Exception):
135
"""Exception if encryption/decryption fails"""
139
class PGPEngine(object):
140
"""A simple class for OpenPGP symmetric encryption & decryption"""
142
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
143
self.gnupgargs = ['--batch',
144
'--home', self.tempdir,
152
def __exit__(self, exc_type, exc_value, traceback):
160
if self.tempdir is not None:
161
# Delete contents of tempdir
162
for root, dirs, files in os.walk(self.tempdir,
164
for filename in files:
165
os.remove(os.path.join(root, filename))
167
os.rmdir(os.path.join(root, dirname))
169
os.rmdir(self.tempdir)
172
def password_encode(self, password):
173
# Passphrase can not be empty and can not contain newlines or
174
# NUL bytes. So we prefix it and hex encode it.
175
encoded = b"mandos" + binascii.hexlify(password)
176
if len(encoded) > 2048:
177
# GnuPG can't handle long passwords, so encode differently
178
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
179
.replace(b"\n", b"\\n")
180
.replace(b"\0", b"\\x00"))
183
def encrypt(self, data, password):
184
passphrase = self.password_encode(password)
185
with tempfile.NamedTemporaryFile(dir=self.tempdir
187
passfile.write(passphrase)
189
proc = subprocess.Popen(['gpg', '--symmetric',
193
stdin = subprocess.PIPE,
194
stdout = subprocess.PIPE,
195
stderr = subprocess.PIPE)
196
ciphertext, err = proc.communicate(input = data)
197
if proc.returncode != 0:
201
def decrypt(self, data, password):
202
passphrase = self.password_encode(password)
203
with tempfile.NamedTemporaryFile(dir = self.tempdir
205
passfile.write(passphrase)
207
proc = subprocess.Popen(['gpg', '--decrypt',
211
stdin = subprocess.PIPE,
212
stdout = subprocess.PIPE,
213
stderr = subprocess.PIPE)
214
decrypted_plaintext, err = proc.communicate(input
216
if proc.returncode != 0:
218
return decrypted_plaintext
104
221
class AvahiError(Exception):
105
222
def __init__(self, value, *args, **kwargs):
299
433
interval: datetime.timedelta(); How often to start a new checker
300
434
last_approval_request: datetime.datetime(); (UTC) or None
301
435
last_checked_ok: datetime.datetime(); (UTC) or None
302
last_enabled: datetime.datetime(); (UTC)
436
last_checker_status: integer between 0 and 255 reflecting exit
437
status of last checker. -1 reflects crashed
438
checker, -2 means no checker completed yet.
439
last_enabled: datetime.datetime(); (UTC) or None
303
440
name: string; from the config file, used in log messages and
304
441
D-Bus identifiers
305
442
secret: bytestring; sent verbatim (over TLS) to client
306
443
timeout: datetime.timedelta(); How long from last_checked_ok
307
444
until this client is disabled
308
extended_timeout: extra long timeout when password has been sent
445
extended_timeout: extra long timeout when secret has been sent
309
446
runtime_expansions: Allowed attributes for runtime expansion.
310
447
expires: datetime.datetime(); time (UTC) when a client will be
311
448
disabled, or None
449
server_settings: The server_settings dict from main()
314
452
runtime_expansions = ("approval_delay", "approval_duration",
315
"created", "enabled", "fingerprint",
316
"host", "interval", "last_checked_ok",
453
"created", "enabled", "expires",
454
"fingerprint", "host", "interval",
455
"last_approval_request", "last_checked_ok",
317
456
"last_enabled", "name", "timeout")
457
client_defaults = { "timeout": "PT5M",
458
"extended_timeout": "PT15M",
460
"checker": "fping -q -- %%(host)s",
462
"approval_delay": "PT0S",
463
"approval_duration": "PT1S",
464
"approved_by_default": "True",
319
468
def timeout_milliseconds(self):
320
469
"Return the 'timeout' attribute in milliseconds"
321
return _timedelta_to_milliseconds(self.timeout)
470
return timedelta_to_milliseconds(self.timeout)
323
472
def extended_timeout_milliseconds(self):
324
473
"Return the 'extended_timeout' attribute in milliseconds"
325
return _timedelta_to_milliseconds(self.extended_timeout)
474
return timedelta_to_milliseconds(self.extended_timeout)
327
476
def interval_milliseconds(self):
328
477
"Return the 'interval' attribute in milliseconds"
329
return _timedelta_to_milliseconds(self.interval)
478
return timedelta_to_milliseconds(self.interval)
331
480
def approval_delay_milliseconds(self):
332
return _timedelta_to_milliseconds(self.approval_delay)
334
def __init__(self, name = None, disable_hook=None, config=None):
335
"""Note: the 'checker' key in 'config' sets the
336
'checker_command' attribute and *not* the 'checker'
481
return timedelta_to_milliseconds(self.approval_delay)
484
def config_parser(config):
485
"""Construct a new dict of client settings of this form:
486
{ client_name: {setting_name: value, ...}, ...}
487
with exceptions for any special settings as defined above.
488
NOTE: Must be a pure function. Must return the same result
489
value given the same arguments.
492
for client_name in config.sections():
493
section = dict(config.items(client_name))
494
client = settings[client_name] = {}
496
client["host"] = section["host"]
497
# Reformat values from string types to Python types
498
client["approved_by_default"] = config.getboolean(
499
client_name, "approved_by_default")
500
client["enabled"] = config.getboolean(client_name,
503
client["fingerprint"] = (section["fingerprint"].upper()
505
if "secret" in section:
506
client["secret"] = section["secret"].decode("base64")
507
elif "secfile" in section:
508
with open(os.path.expanduser(os.path.expandvars
509
(section["secfile"])),
511
client["secret"] = secfile.read()
513
raise TypeError("No secret or secfile for section {0}"
515
client["timeout"] = string_to_delta(section["timeout"])
516
client["extended_timeout"] = string_to_delta(
517
section["extended_timeout"])
518
client["interval"] = string_to_delta(section["interval"])
519
client["approval_delay"] = string_to_delta(
520
section["approval_delay"])
521
client["approval_duration"] = string_to_delta(
522
section["approval_duration"])
523
client["checker_command"] = section["checker"]
524
client["last_approval_request"] = None
525
client["last_checked_ok"] = None
526
client["last_checker_status"] = -2
530
def __init__(self, settings, name = None, server_settings=None):
532
if server_settings is None:
534
self.server_settings = server_settings
535
# adding all client settings
536
for setting, value in settings.iteritems():
537
setattr(self, setting, value)
540
if not hasattr(self, "last_enabled"):
541
self.last_enabled = datetime.datetime.utcnow()
542
if not hasattr(self, "expires"):
543
self.expires = (datetime.datetime.utcnow()
546
self.last_enabled = None
341
549
logger.debug("Creating client %r", self.name)
342
550
# Uppercase and remove spaces from fingerprint for later
343
551
# comparison purposes with return value from the fingerprint()
345
self.fingerprint = (config["fingerprint"].upper()
347
553
logger.debug(" Fingerprint: %s", self.fingerprint)
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
351
with open(os.path.expanduser(os.path.expandvars
352
(config["secfile"])),
354
self.secret = secfile.read()
356
raise TypeError("No secret or secfile for client %s"
358
self.host = config.get("host", "")
359
self.created = datetime.datetime.utcnow()
361
self.last_approval_request = None
362
self.last_enabled = None
363
self.last_checked_ok = None
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
368
self.disable_hook = disable_hook
554
self.created = settings.get("created",
555
datetime.datetime.utcnow())
557
# attributes specific for this server instance
369
558
self.checker = None
370
559
self.checker_initiator_tag = None
371
560
self.disable_initiator_tag = None
373
561
self.checker_callback_tag = None
374
self.checker_command = config["checker"]
375
562
self.current_checker_command = None
376
self.last_connect = None
377
self._approved = None
378
self.approved_by_default = config.get("approved_by_default",
380
564
self.approvals_pending = 0
381
self.approval_delay = string_to_delta(
382
config["approval_delay"])
383
self.approval_duration = string_to_delta(
384
config["approval_duration"])
385
565
self.changedstate = (multiprocessing_manager
386
566
.Condition(multiprocessing_manager
568
self.client_structure = [attr for attr in
569
self.__dict__.iterkeys()
570
if not attr.startswith("_")]
571
self.client_structure.append("client_structure")
573
for name, t in inspect.getmembers(type(self),
577
if not name.startswith("_"):
578
self.client_structure.append(name)
580
# Send notice to process children that client state has changed
389
581
def send_changedstate(self):
390
self.changedstate.acquire()
391
self.changedstate.notify_all()
392
self.changedstate.release()
582
with self.changedstate:
583
self.changedstate.notify_all()
394
585
def enable(self):
395
586
"""Start this client's checker and timeout hooks"""
396
587
if getattr(self, "enabled", False):
397
588
# Already enabled
590
self.expires = datetime.datetime.utcnow() + self.timeout
592
self.last_enabled = datetime.datetime.utcnow()
399
594
self.send_changedstate()
596
def disable(self, quiet=True):
597
"""Disable this client."""
598
if not getattr(self, "enabled", False):
601
logger.info("Disabling client %s", self.name)
602
if getattr(self, "disable_initiator_tag", None) is not None:
603
gobject.source_remove(self.disable_initiator_tag)
604
self.disable_initiator_tag = None
606
if getattr(self, "checker_initiator_tag", None) is not None:
607
gobject.source_remove(self.checker_initiator_tag)
608
self.checker_initiator_tag = None
612
self.send_changedstate()
613
# Do not run this again if called by a gobject.timeout_add
619
def init_checker(self):
400
620
# Schedule a new checker to be started an 'interval' from now,
401
621
# and every interval from then on.
622
if self.checker_initiator_tag is not None:
623
gobject.source_remove(self.checker_initiator_tag)
402
624
self.checker_initiator_tag = (gobject.timeout_add
403
625
(self.interval_milliseconds(),
404
626
self.start_checker))
405
627
# Schedule a disable() when 'timeout' has passed
406
self.expires = datetime.datetime.utcnow() + self.timeout
628
if self.disable_initiator_tag is not None:
629
gobject.source_remove(self.disable_initiator_tag)
407
630
self.disable_initiator_tag = (gobject.timeout_add
408
631
(self.timeout_milliseconds(),
411
self.last_enabled = datetime.datetime.utcnow()
412
633
# Also start a new checker *right now*.
413
634
self.start_checker()
415
def disable(self, quiet=True):
416
"""Disable this client."""
417
if not getattr(self, "enabled", False):
420
self.send_changedstate()
422
logger.info("Disabling client %s", self.name)
423
if getattr(self, "disable_initiator_tag", False):
424
gobject.source_remove(self.disable_initiator_tag)
425
self.disable_initiator_tag = None
427
if getattr(self, "checker_initiator_tag", False):
428
gobject.source_remove(self.checker_initiator_tag)
429
self.checker_initiator_tag = None
431
if self.disable_hook:
432
self.disable_hook(self)
434
# Do not run this again if called by a gobject.timeout_add
438
self.disable_hook = None
441
636
def checker_callback(self, pid, condition, command):
442
637
"""The checker has completed, so take appropriate actions."""
443
638
self.checker_callback_tag = None
444
639
self.checker = None
445
640
if os.WIFEXITED(condition):
446
exitstatus = os.WEXITSTATUS(condition)
641
self.last_checker_status = os.WEXITSTATUS(condition)
642
if self.last_checker_status == 0:
448
643
logger.info("Checker for %(name)s succeeded",
450
645
self.checked_ok()
750
1044
except (AttributeError, xml.dom.DOMException,
751
1045
xml.parsers.expat.ExpatError) as error:
752
1046
logger.error("Failed to override Introspection method",
754
1048
return xmlstring
757
def datetime_to_dbus (dt, variant_level=0):
1051
def datetime_to_dbus(dt, variant_level=0):
758
1052
"""Convert a UTC datetime.datetime() to a D-Bus type."""
760
1054
return dbus.String("", variant_level = variant_level)
761
1055
return dbus.String(dt.isoformat(),
762
1056
variant_level=variant_level)
764
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
766
"""Applied to an empty subclass of a D-Bus object, this metaclass
767
will add additional D-Bus attributes matching a certain pattern.
1059
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1060
"""A class decorator; applied to a subclass of
1061
dbus.service.Object, it will add alternate D-Bus attributes with
1062
interface names according to the "alt_interface_names" mapping.
1065
@alternate_dbus_interfaces({"org.example.Interface":
1066
"net.example.AlternateInterface"})
1067
class SampleDBusObject(dbus.service.Object):
1068
@dbus.service.method("org.example.Interface")
1069
def SampleDBusMethod():
1072
The above "SampleDBusMethod" on "SampleDBusObject" will be
1073
reachable via two interfaces: "org.example.Interface" and
1074
"net.example.AlternateInterface", the latter of which will have
1075
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1076
"true", unless "deprecate" is passed with a False value.
1078
This works for methods and signals, and also for D-Bus properties
1079
(from DBusObjectWithProperties) and interfaces (from the
1080
dbus_interface_annotations decorator).
769
def __new__(mcs, name, bases, attr):
770
# Go through all the base classes which could have D-Bus
771
# methods, signals, or properties in them
772
for base in (b for b in bases
773
if issubclass(b, dbus.service.Object)):
774
# Go though all attributes of the base class
775
for attrname, attribute in inspect.getmembers(base):
1083
for orig_interface_name, alt_interface_name in (
1084
alt_interface_names.iteritems()):
1086
interface_names = set()
1087
# Go though all attributes of the class
1088
for attrname, attribute in inspect.getmembers(cls):
776
1089
# Ignore non-D-Bus attributes, and D-Bus attributes
777
1090
# with the wrong interface name
778
1091
if (not hasattr(attribute, "_dbus_interface")
779
1092
or not attribute._dbus_interface
780
.startswith("se.recompile.Mandos")):
1093
.startswith(orig_interface_name)):
782
1095
# Create an alternate D-Bus interface name based on
783
1096
# the current name
784
1097
alt_interface = (attribute._dbus_interface
785
.replace("se.recompile.Mandos",
786
"se.bsnet.fukt.Mandos"))
1098
.replace(orig_interface_name,
1099
alt_interface_name))
1100
interface_names.add(alt_interface)
787
1101
# Is this a D-Bus signal?
788
1102
if getattr(attribute, "_dbus_is_signal", False):
789
# Extract the original non-method function by
1103
# Extract the original non-method undecorated
1104
# function by black magic
791
1105
nonmethod_func = (dict(
792
1106
zip(attribute.func_code.co_freevars,
793
1107
attribute.__closure__))["func"]
2125
def rfc3339_duration_to_delta(duration):
2126
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2128
>>> rfc3339_duration_to_delta("P7D")
2129
datetime.timedelta(7)
2130
>>> rfc3339_duration_to_delta("PT60S")
2131
datetime.timedelta(0, 60)
2132
>>> rfc3339_duration_to_delta("PT60M")
2133
datetime.timedelta(0, 3600)
2134
>>> rfc3339_duration_to_delta("PT24H")
2135
datetime.timedelta(1)
2136
>>> rfc3339_duration_to_delta("P1W")
2137
datetime.timedelta(7)
2138
>>> rfc3339_duration_to_delta("PT5M30S")
2139
datetime.timedelta(0, 330)
2140
>>> rfc3339_duration_to_delta("P1DT3M20S")
2141
datetime.timedelta(1, 200)
2144
# Parsing an RFC 3339 duration with regular expressions is not
2145
# possible - there would have to be multiple places for the same
2146
# values, like seconds. The current code, while more esoteric, is
2147
# cleaner without depending on a parsing library. If Python had a
2148
# built-in library for parsing we would use it, but we'd like to
2149
# avoid excessive use of external libraries.
2151
# New type for defining tokens, syntax, and semantics all-in-one
2152
Token = collections.namedtuple("Token",
2153
("regexp", # To match token; if
2154
# "value" is not None,
2155
# must have a "group"
2157
"value", # datetime.timedelta or
2159
"followers")) # Tokens valid after
2161
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2162
# the "duration" ABNF definition in RFC 3339, Appendix A.
2163
token_end = Token(re.compile(r"$"), None, frozenset())
2164
token_second = Token(re.compile(r"(\d+)S"),
2165
datetime.timedelta(seconds=1),
2166
frozenset((token_end,)))
2167
token_minute = Token(re.compile(r"(\d+)M"),
2168
datetime.timedelta(minutes=1),
2169
frozenset((token_second, token_end)))
2170
token_hour = Token(re.compile(r"(\d+)H"),
2171
datetime.timedelta(hours=1),
2172
frozenset((token_minute, token_end)))
2173
token_time = Token(re.compile(r"T"),
2175
frozenset((token_hour, token_minute,
2177
token_day = Token(re.compile(r"(\d+)D"),
2178
datetime.timedelta(days=1),
2179
frozenset((token_time, token_end)))
2180
token_month = Token(re.compile(r"(\d+)M"),
2181
datetime.timedelta(weeks=4),
2182
frozenset((token_day, token_end)))
2183
token_year = Token(re.compile(r"(\d+)Y"),
2184
datetime.timedelta(weeks=52),
2185
frozenset((token_month, token_end)))
2186
token_week = Token(re.compile(r"(\d+)W"),
2187
datetime.timedelta(weeks=1),
2188
frozenset((token_end,)))
2189
token_duration = Token(re.compile(r"P"), None,
2190
frozenset((token_year, token_month,
2191
token_day, token_time,
2193
# Define starting values
2194
value = datetime.timedelta() # Value so far
2196
followers = frozenset(token_duration,) # Following valid tokens
2197
s = duration # String left to parse
2198
# Loop until end token is found
2199
while found_token is not token_end:
2200
# Search for any currently valid tokens
2201
for token in followers:
2202
match = token.regexp.match(s)
2203
if match is not None:
2205
if token.value is not None:
2206
# Value found, parse digits
2207
factor = int(match.group(1), 10)
2208
# Add to value so far
2209
value += factor * token.value
2210
# Strip token from string
2211
s = token.regexp.sub("", s, 1)
2214
# Set valid next tokens
2215
followers = found_token.followers
2218
# No currently valid tokens were found
2219
raise ValueError("Invalid RFC 3339 duration")
1729
2224
def string_to_delta(interval):
1730
2225
"""Parse a string and return a datetime.timedelta
2035
2548
client_class = Client
2037
client_class = functools.partial(ClientDBusTransitional,
2039
def client_config_items(config, section):
2040
special_settings = {
2041
"approved_by_default":
2042
lambda: config.getboolean(section,
2043
"approved_by_default"),
2045
for name, value in config.items(section):
2550
client_class = functools.partial(ClientDBus, bus = bus)
2552
client_settings = Client.config_parser(client_config)
2553
old_client_settings = {}
2556
# This is used to redirect stdout and stderr for checker processes
2558
wnull = open(os.devnull, "w") # A writable /dev/null
2559
# Only used if server is running in foreground but not in debug
2561
if debug or not foreground:
2564
# Get client data and settings from last running state.
2565
if server_settings["restore"]:
2567
with open(stored_state_path, "rb") as stored_state:
2568
clients_data, old_client_settings = (pickle.load
2570
os.remove(stored_state_path)
2571
except IOError as e:
2572
if e.errno == errno.ENOENT:
2573
logger.warning("Could not load persistent state: {0}"
2574
.format(os.strerror(e.errno)))
2576
logger.critical("Could not load persistent state:",
2579
except EOFError as e:
2580
logger.warning("Could not load persistent state: "
2581
"EOFError:", exc_info=e)
2583
with PGPEngine() as pgp:
2584
for client_name, client in clients_data.iteritems():
2585
# Skip removed clients
2586
if client_name not in client_settings:
2589
# Decide which value to use after restoring saved state.
2590
# We have three different values: Old config file,
2591
# new config file, and saved state.
2592
# New config value takes precedence if it differs from old
2593
# config value, otherwise use saved state.
2594
for name, value in client_settings[client_name].items():
2596
# For each value in new config, check if it
2597
# differs from the old config value (Except for
2598
# the "secret" attribute)
2599
if (name != "secret" and
2600
value != old_client_settings[client_name]
2602
client[name] = value
2606
# Clients who has passed its expire date can still be
2607
# enabled if its last checker was successful. Clients
2608
# whose checker succeeded before we stored its state is
2609
# assumed to have successfully run all checkers during
2611
if client["enabled"]:
2612
if datetime.datetime.utcnow() >= client["expires"]:
2613
if not client["last_checked_ok"]:
2615
"disabling client {0} - Client never "
2616
"performed a successful checker"
2617
.format(client_name))
2618
client["enabled"] = False
2619
elif client["last_checker_status"] != 0:
2621
"disabling client {0} - Client "
2622
"last checker failed with error code {1}"
2623
.format(client_name,
2624
client["last_checker_status"]))
2625
client["enabled"] = False
2627
client["expires"] = (datetime.datetime
2629
+ client["timeout"])
2630
logger.debug("Last checker succeeded,"
2631
" keeping {0} enabled"
2632
.format(client_name))
2047
yield (name, special_settings[name]())
2051
tcp_server.clients.update(set(
2052
client_class(name = section,
2053
config= dict(client_config_items(
2054
client_config, section)))
2055
for section in client_config.sections()))
2634
client["secret"] = (
2635
pgp.decrypt(client["encrypted_secret"],
2636
client_settings[client_name]
2639
# If decryption fails, we use secret from new settings
2640
logger.debug("Failed to decrypt {0} old secret"
2641
.format(client_name))
2642
client["secret"] = (
2643
client_settings[client_name]["secret"])
2645
# Add/remove clients based on new changes made to config
2646
for client_name in (set(old_client_settings)
2647
- set(client_settings)):
2648
del clients_data[client_name]
2649
for client_name in (set(client_settings)
2650
- set(old_client_settings)):
2651
clients_data[client_name] = client_settings[client_name]
2653
# Create all client objects
2654
for client_name, client in clients_data.iteritems():
2655
tcp_server.clients[client_name] = client_class(
2656
name = client_name, settings = client,
2657
server_settings = server_settings)
2056
2659
if not tcp_server.clients:
2057
2660
logger.warning("No clients defined")
2063
pidfile.write(str(pid) + "\n".encode("utf-8"))
2066
logger.error("Could not write to file %r with PID %d",
2069
# "pidfile" was never created
2663
if pidfile is not None:
2667
pidfile.write(str(pid) + "\n".encode("utf-8"))
2669
logger.error("Could not write to file %r with PID %d",
2071
2672
del pidfilename
2073
signal.signal(signal.SIGINT, signal.SIG_IGN)
2075
2674
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2076
2675
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2079
class MandosDBusService(dbus.service.Object):
2678
@alternate_dbus_interfaces({"se.recompile.Mandos":
2679
"se.bsnet.fukt.Mandos"})
2680
class MandosDBusService(DBusObjectWithProperties):
2080
2681
"""A D-Bus proxy object"""
2081
2682
def __init__(self):
2082
2683
dbus.service.Object.__init__(self, bus, "/")
2083
2684
_interface = "se.recompile.Mandos"
2686
@dbus_interface_annotations(_interface)
2688
return { "org.freedesktop.DBus.Property"
2689
".EmitsChangedSignal":
2085
2692
@dbus.service.signal(_interface, signature="o")
2086
2693
def ClientAdded(self, objpath):
2131
class MandosDBusServiceTransitional(MandosDBusService):
2132
__metaclass__ = AlternateDBusNamesMetaclass
2133
mandos_dbus_service = MandosDBusServiceTransitional()
2739
mandos_dbus_service = MandosDBusService()
2136
2742
"Cleanup function; run on exit"
2137
2743
service.cleanup()
2139
2745
multiprocessing.active_children()
2747
if not (tcp_server.clients or client_settings):
2750
# Store client before exiting. Secrets are encrypted with key
2751
# based on what config file has. If config file is
2752
# removed/edited, old secret will thus be unrecovable.
2754
with PGPEngine() as pgp:
2755
for client in tcp_server.clients.itervalues():
2756
key = client_settings[client.name]["secret"]
2757
client.encrypted_secret = pgp.encrypt(client.secret,
2761
# A list of attributes that can not be pickled
2763
exclude = set(("bus", "changedstate", "secret",
2764
"checker", "server_settings"))
2765
for name, typ in (inspect.getmembers
2766
(dbus.service.Object)):
2769
client_dict["encrypted_secret"] = (client
2771
for attr in client.client_structure:
2772
if attr not in exclude:
2773
client_dict[attr] = getattr(client, attr)
2775
clients[client.name] = client_dict
2776
del client_settings[client.name]["secret"]
2779
with (tempfile.NamedTemporaryFile
2780
(mode='wb', suffix=".pickle", prefix='clients-',
2781
dir=os.path.dirname(stored_state_path),
2782
delete=False)) as stored_state:
2783
pickle.dump((clients, client_settings), stored_state)
2784
tempname=stored_state.name
2785
os.rename(tempname, stored_state_path)
2786
except (IOError, OSError) as e:
2792
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2793
logger.warning("Could not save persistent state: {0}"
2794
.format(os.strerror(e.errno)))
2796
logger.warning("Could not save persistent state:",
2800
# Delete all clients, and settings from config
2140
2801
while tcp_server.clients:
2141
client = tcp_server.clients.pop()
2802
name, client = tcp_server.clients.popitem()
2143
2804
client.remove_from_connection()
2144
client.disable_hook = None
2145
2805
# Don't signal anything except ClientRemoved
2146
2806
client.disable(quiet=True)