/mandos/release : revision 237.11.16

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

66

69

67

import dbus

70

68

import dbus.service

75

73

import ctypes.util

76

74

import xml.dom.minidom

77

75

import inspect

78

import GnuPGInterface

79

76

80

77

try:

81

78

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

82

except ImportError:

86

83

SO_BINDTODEVICE = None

87

84

88

version = "1.5.0"

89

stored_state_file = "clients.pickle"

90

91

logger = logging.getLogger()

85

86

version = "1.4.0"

87

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

92

90

syslogger = (logging.handlers.SysLogHandler

93

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

92

address = str("/dev/log")))

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(debug, level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

if debug:

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet',

146

'--no-use-agent'])

147

148

def __enter__(self):

149

return self

150

151

def __exit__ (self, exc_type, exc_value, traceback):

152

self._cleanup()

153

return False

154

155

def __del__(self):

156

self._cleanup()

157

158

def _cleanup(self):

159

if self.tempdir is not None:

160

# Delete contents of tempdir

161

for root, dirs, files in os.walk(self.tempdir,

162

topdown = False):

163

for filename in files:

164

os.remove(os.path.join(root, filename))

165

for dirname in dirs:

166

os.rmdir(os.path.join(root, dirname))

167

# Remove tempdir

168

os.rmdir(self.tempdir)

169

self.tempdir = None

170

171

def password_encode(self, password):

172

# Passphrase can not be empty and can not contain newlines or

173

# NUL bytes. So we prefix it and hex encode it.

174

return b"mandos" + binascii.hexlify(password)

175

176

def encrypt(self, data, password):

177

self.gnupg.passphrase = self.password_encode(password)

178

with open(os.devnull) as devnull:

179

try:

180

proc = self.gnupg.run(['--symmetric'],

181

create_fhs=['stdin', 'stdout'],

182

attach_fhs={'stderr': devnull})

183

with contextlib.closing(proc.handles['stdin']) as f:

184

f.write(data)

185

with contextlib.closing(proc.handles['stdout']) as f:

186

ciphertext = f.read()

187

proc.wait()

188

except IOError as e:

189

raise PGPError(e)

190

self.gnupg.passphrase = None

191

return ciphertext

192

193

def decrypt(self, data, password):

194

self.gnupg.passphrase = self.password_encode(password)

195

with open(os.devnull) as devnull:

196

try:

197

proc = self.gnupg.run(['--decrypt'],

198

create_fhs=['stdin', 'stdout'],

199

attach_fhs={'stderr': devnull})

200

with contextlib.closing(proc.handles['stdin'] ) as f:

201

f.write(data)

202

with contextlib.closing(proc.handles['stdout']) as f:

203

decrypted_plaintext = f.read()

204

proc.wait()

205

except IOError as e:

206

raise PGPError(e)

207

self.gnupg.passphrase = None

208

return decrypted_plaintext

209

210

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

211

103

212

104

class AvahiError(Exception):

213

105

def __init__(self, value, *args, **kwargs):

272

164

.GetAlternativeServiceName(self.name))

273

165

logger.info("Changing Zeroconf service name to %r ...",

274

166

self.name)

167

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

170

% self.name))

275

171

self.remove()

276

172

try:

277

173

self.add()

297

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

298

194

self.entry_group_state_changed_match = (

299

195

self.group.connect_to_signal(

300

'StateChanged', self.entry_group_state_changed))

196

'StateChanged', self .entry_group_state_changed))

301

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

302

198

self.name, self.type)

303

199

self.group.AddService(

329

225

try:

330

226

self.group.Free()

331

227

except (dbus.exceptions.UnknownMethodException,

332

dbus.exceptions.DBusException):

228

dbus.exceptions.DBusException) as e:

333

229

pass

334

230

self.group = None

335

231

self.remove()

369

265

self.server_state_changed)

370

266

self.server_state_changed(self.server.GetState())

371

267

372

class AvahiServiceToSyslog(AvahiService):

373

def rename(self):

374

"""Add the new name to the syslog messages"""

375

ret = AvahiService.rename(self)

376

syslogger.setFormatter(logging.Formatter

377

('Mandos (%s) [%%(process)d]:'

378

' %%(levelname)s: %%(message)s'

379

% self.name))

380

return ret

381

268

382

def timedelta_to_milliseconds(td):

269

def _timedelta_to_milliseconds(td):

383

270

"Convert a datetime.timedelta() to milliseconds"

384

271

return ((td.days * 24 * 60 * 60 * 1000)

385

272

+ (td.seconds * 1000)

389

276

"""A representation of a client host served by this server.

390

277

391

278

Attributes:

392

approved: bool(); 'None' if not yet approved/disapproved

279

_approved: bool(); 'None' if not yet approved/disapproved

393

280

approval_delay: datetime.timedelta(); Time to wait for approval

394

281

approval_duration: datetime.timedelta(); Duration of one approval

395

282

checker: subprocess.Popen(); a running checker process used

402

289

instance %(name)s can be used in the command.

403

290

checker_initiator_tag: a gobject event source tag, or None

404

291

created: datetime.datetime(); (UTC) object creation

405

client_structure: Object describing what attributes a client has

406

and is used for storing the client at exit

407

292

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

408

294

disable_initiator_tag: a gobject event source tag, or None

409

295

enabled: bool()

410

296

fingerprint: string (40 or 32 hexadecimal digits); used to

413

299

interval: datetime.timedelta(); How often to start a new checker

414

300

last_approval_request: datetime.datetime(); (UTC) or None

415

301

last_checked_ok: datetime.datetime(); (UTC) or None

416

last_checker_status: integer between 0 and 255 reflecting exit

417

status of last checker. -1 reflects crashed

418

checker, or None.

419

last_enabled: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

420

303

name: string; from the config file, used in log messages and

421

304

D-Bus identifiers

422

305

secret: bytestring; sent verbatim (over TLS) to client

432

315

"created", "enabled", "fingerprint",

433

316

"host", "interval", "last_checked_ok",

434

317

"last_enabled", "name", "timeout")

435

client_defaults = { "timeout": "5m",

436

"extended_timeout": "15m",

437

"interval": "2m",

438

"checker": "fping -q -- %%(host)s",

439

"host": "",

440

"approval_delay": "0s",

441

"approval_duration": "1s",

442

"approved_by_default": "True",

443

"enabled": "True",

444

}

445

318

446

319

def timeout_milliseconds(self):

447

320

"Return the 'timeout' attribute in milliseconds"

448

return timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

449

322

450

323

def extended_timeout_milliseconds(self):

451

324

"Return the 'extended_timeout' attribute in milliseconds"

452

return timedelta_to_milliseconds(self.extended_timeout)

325

return _timedelta_to_milliseconds(self.extended_timeout)

453

326

454

327

def interval_milliseconds(self):

455

328

"Return the 'interval' attribute in milliseconds"

456

return timedelta_to_milliseconds(self.interval)

329

return _timedelta_to_milliseconds(self.interval)

457

330

458

331

def approval_delay_milliseconds(self):

459

return timedelta_to_milliseconds(self.approval_delay)

460

461

@staticmethod

462

def config_parser(config):

463

"""Construct a new dict of client settings of this form:

464

{ client_name: {setting_name: value, ...}, ...}

465

with exceptions for any special settings as defined above.

466

NOTE: Must be a pure function. Must return the same result

467

value given the same arguments.

468

"""

469

settings = {}

470

for client_name in config.sections():

471

section = dict(config.items(client_name))

472

client = settings[client_name] = {}

473

474

client["host"] = section["host"]

475

# Reformat values from string types to Python types

476

client["approved_by_default"] = config.getboolean(

477

client_name, "approved_by_default")

478

client["enabled"] = config.getboolean(client_name,

479

"enabled")

480

481

client["fingerprint"] = (section["fingerprint"].upper()

482

.replace(" ", ""))

483

if "secret" in section:

484

client["secret"] = section["secret"].decode("base64")

485

elif "secfile" in section:

486

with open(os.path.expanduser(os.path.expandvars

487

(section["secfile"])),

488

"rb") as secfile:

489

client["secret"] = secfile.read()

490

else:

491

raise TypeError("No secret or secfile for section %s"

492

% section)

493

client["timeout"] = string_to_delta(section["timeout"])

494

client["extended_timeout"] = string_to_delta(

495

section["extended_timeout"])

496

client["interval"] = string_to_delta(section["interval"])

497

client["approval_delay"] = string_to_delta(

498

section["approval_delay"])

499

client["approval_duration"] = string_to_delta(

500

section["approval_duration"])

501

client["checker_command"] = section["checker"]

502

client["last_approval_request"] = None

503

client["last_checked_ok"] = None

504

client["last_checker_status"] = None

505

506

return settings

507

508

509

def __init__(self, settings, name = None):

332

return _timedelta_to_milliseconds(self.approval_delay)

333

334

def __init__(self, name = None, disable_hook=None, config=None):

510

335

"""Note: the 'checker' key in 'config' sets the

511

336

'checker_command' attribute and *not* the 'checker'

512

337

attribute."""

513

338

self.name = name

514

# adding all client settings

515

for setting, value in settings.iteritems():

516

setattr(self, setting, value)

517

518

if self.enabled:

519

if not hasattr(self, "last_enabled"):

520

self.last_enabled = datetime.datetime.utcnow()

521

if not hasattr(self, "expires"):

522

self.expires = (datetime.datetime.utcnow()

523

+ self.timeout)

524

else:

525

self.last_enabled = None

526

self.expires = None

527

339

if config is None:

340

config = {}

528

341

logger.debug("Creating client %r", self.name)

529

342

# Uppercase and remove spaces from fingerprint for later

530

343

# comparison purposes with return value from the fingerprint()

531

344

# function

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

532

347

logger.debug(" Fingerprint: %s", self.fingerprint)

533

self.created = settings.get("created",

534

datetime.datetime.utcnow())

535

536

# attributes specific for this server instance

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

351

with open(os.path.expanduser(os.path.expandvars

352

(config["secfile"])),

353

"rb") as secfile:

354

self.secret = secfile.read()

355

else:

356

raise TypeError("No secret or secfile for client %s"

357

% self.name)

358

self.host = config.get("host", "")

359

self.created = datetime.datetime.utcnow()

360

self.enabled = False

361

self.last_approval_request = None

362

self.last_enabled = None

363

self.last_checked_ok = None

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

368

self.disable_hook = disable_hook

537

369

self.checker = None

538

370

self.checker_initiator_tag = None

539

371

self.disable_initiator_tag = None

372

self.expires = None

540

373

self.checker_callback_tag = None

374

self.checker_command = config["checker"]

541

375

self.current_checker_command = None

542

self.approved = None

376

self.last_connect = None

377

self._approved = None

378

self.approved_by_default = config.get("approved_by_default",

379

True)

543

380

self.approvals_pending = 0

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

544

385

self.changedstate = (multiprocessing_manager

545

386

.Condition(multiprocessing_manager

546

387

.Lock()))

547

self.client_structure = [attr for attr in

548

self.__dict__.iterkeys()

549

if not attr.startswith("_")]

550

self.client_structure.append("client_structure")

551

552

for name, t in inspect.getmembers(type(self),

553

lambda obj:

554

isinstance(obj,

555

property)):

556

if not name.startswith("_"):

557

self.client_structure.append(name)

558

388

559

# Send notice to process children that client state has changed

560

389

def send_changedstate(self):

561

with self.changedstate:

562

self.changedstate.notify_all()

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

563

393

564

394

def enable(self):

565

395

"""Start this client's checker and timeout hooks"""

567

397

# Already enabled

568

398

return

569

399

self.send_changedstate()

400

# Schedule a new checker to be started an 'interval' from now,

401

# and every interval from then on.

402

self.checker_initiator_tag = (gobject.timeout_add

403

(self.interval_milliseconds(),

404

self.start_checker))

405

# Schedule a disable() when 'timeout' has passed

570

406

self.expires = datetime.datetime.utcnow() + self.timeout

407

self.disable_initiator_tag = (gobject.timeout_add

408

(self.timeout_milliseconds(),

409

self.disable))

571

410

self.enabled = True

572

411

self.last_enabled = datetime.datetime.utcnow()

573

self.init_checker()

412

# Also start a new checker *right now*.

413

self.start_checker()

574

414

575

415

def disable(self, quiet=True):

576

416

"""Disable this client."""

588

428

gobject.source_remove(self.checker_initiator_tag)

589

429

self.checker_initiator_tag = None

590

430

self.stop_checker()

431

if self.disable_hook:

432

self.disable_hook(self)

591

433

self.enabled = False

592

434

# Do not run this again if called by a gobject.timeout_add

593

435

return False

594

436

595

437

def __del__(self):

438

self.disable_hook = None

596

439

self.disable()

597

440

598

def init_checker(self):

599

# Schedule a new checker to be started an 'interval' from now,

600

# and every interval from then on.

601

self.checker_initiator_tag = (gobject.timeout_add

602

(self.interval_milliseconds(),

603

self.start_checker))

604

# Schedule a disable() when 'timeout' has passed

605

self.disable_initiator_tag = (gobject.timeout_add

606

(self.timeout_milliseconds(),

607

self.disable))

608

# Also start a new checker *right now*.

609

self.start_checker()

610

611

441

def checker_callback(self, pid, condition, command):

612

442

"""The checker has completed, so take appropriate actions."""

613

443

self.checker_callback_tag = None

614

444

self.checker = None

615

445

if os.WIFEXITED(condition):

616

self.last_checker_status = os.WEXITSTATUS(condition)

617

if self.last_checker_status == 0:

446

exitstatus = os.WEXITSTATUS(condition)

447

if exitstatus == 0:

618

448

logger.info("Checker for %(name)s succeeded",

619

449

vars(self))

620

450

self.checked_ok()

622

452

logger.info("Checker for %(name)s failed",

623

453

vars(self))

624

454

else:

625

self.last_checker_status = -1

626

455

logger.warning("Checker for %(name)s crashed?",

627

456

vars(self))

628

457

635

464

if timeout is None:

636

465

timeout = self.timeout

637

466

self.last_checked_ok = datetime.datetime.utcnow()

638

if self.disable_initiator_tag is not None:

639

gobject.source_remove(self.disable_initiator_tag)

640

if getattr(self, "enabled", False):

641

self.disable_initiator_tag = (gobject.timeout_add

642

(timedelta_to_milliseconds

643

(timeout), self.disable))

644

self.expires = datetime.datetime.utcnow() + timeout

467

gobject.source_remove(self.disable_initiator_tag)

468

self.disable_initiator_tag = (gobject.timeout_add

469

(_timedelta_to_milliseconds

470

(timeout), self.disable))

471

self.expires = datetime.datetime.utcnow() + timeout

645

472

646

473

def need_approval(self):

647

474

self.last_approval_request = datetime.datetime.utcnow()

850

677

# signatures other than "ay".

851

678

if prop._dbus_signature != "ay":

852

679

raise ValueError

853

value = dbus.ByteArray(b''.join(chr(byte)

854

for byte in value))

680

value = dbus.ByteArray(''.join(unichr(byte)

681

for byte in value))

855

682

prop(value)

856

683

857

684

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

862

689

863

690

Note: Will not include properties with access="write".

864

691

"""

865

properties = {}

692

all = {}

866

693

for name, prop in self._get_all_dbus_properties():

867

694

if (interface_name

868

695

and interface_name != prop._dbus_interface):

873

700

continue

874

701

value = prop()

875

702

if not hasattr(value, "variant_level"):

876

properties[name] = value

703

all[name] = value

877

704

continue

878

properties[name] = type(value)(value, variant_level=

879

value.variant_level+1)

880

return dbus.Dictionary(properties, signature="sv")

705

all[name] = type(value)(value, variant_level=

706

value.variant_level+1)

707

return dbus.Dictionary(all, signature="sv")

881

708

882

709

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

883

710

out_signature="s",

934

761

return dbus.String(dt.isoformat(),

935

762

variant_level=variant_level)

936

763

937

938

764

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

939

765

.__metaclass__):

940

766

"""Applied to an empty subclass of a D-Bus object, this metaclass

1032

858

attribute.func_closure)))

1033

859

return type.__new__(mcs, name, bases, attr)

1034

860

1035

1036

861

class ClientDBus(Client, DBusObjectWithProperties):

1037

862

"""A Client class using D-Bus

1038

863

1047

872

# dbus.service.Object doesn't use super(), so we can't either.

1048

873

1049

874

def __init__(self, bus = None, *args, **kwargs):

875

self._approvals_pending = 0

1050

876

self.bus = bus

1051

877

Client.__init__(self, *args, **kwargs)

1052

self._approvals_pending = 0

1053

1054

self._approvals_pending = 0

1055

878

# Only now, when this client is initialized, can it show up on

1056

879

# the D-Bus

1057

880

client_object_name = unicode(self.name).translate(

1067

890

variant_level=1):

1068

891

""" Modify a variable so that it's a property which announces

1069

892

its changes to DBus.

1070

893

1071

894

transform_fun: Function that takes a value and a variant_level

1072

895

and transforms it to a D-Bus type.

1073

896

dbus_name: D-Bus name of the variable

1107

930

datetime_to_dbus, "LastApprovalRequest")

1108

931

approved_by_default = notifychangeproperty(dbus.Boolean,

1109

932

"ApprovedByDefault")

1110

approval_delay = notifychangeproperty(dbus.UInt64,

933

approval_delay = notifychangeproperty(dbus.UInt16,

1111

934

"ApprovalDelay",

1112

935

type_func =

1113

timedelta_to_milliseconds)

936

_timedelta_to_milliseconds)

1114

937

approval_duration = notifychangeproperty(

1115

dbus.UInt64, "ApprovalDuration",

1116

type_func = timedelta_to_milliseconds)

938

dbus.UInt16, "ApprovalDuration",

939

type_func = _timedelta_to_milliseconds)

1117

940

host = notifychangeproperty(dbus.String, "Host")

1118

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

941

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1119

942

type_func =

1120

timedelta_to_milliseconds)

943

_timedelta_to_milliseconds)

1121

944

extended_timeout = notifychangeproperty(

1122

dbus.UInt64, "ExtendedTimeout",

1123

type_func = timedelta_to_milliseconds)

1124

interval = notifychangeproperty(dbus.UInt64,

945

dbus.UInt16, "ExtendedTimeout",

946

type_func = _timedelta_to_milliseconds)

947

interval = notifychangeproperty(dbus.UInt16,

1125

948

"Interval",

1126

949

type_func =

1127

timedelta_to_milliseconds)

950

_timedelta_to_milliseconds)

1128

951

checker_command = notifychangeproperty(dbus.String, "Checker")

1129

952

1130

953

del notifychangeproperty

1172

995

return r

1173

996

1174

997

def _reset_approved(self):

1175

self.approved = None

998

self._approved = None

1176

999

return False

1177

1000

1178

1001

def approve(self, value=True):

1179

1002

self.send_changedstate()

1180

self.approved = value

1181

gobject.timeout_add(timedelta_to_milliseconds

1003

self._approved = value

1004

gobject.timeout_add(_timedelta_to_milliseconds

1182

1005

(self.approval_duration),

1183

1006

self._reset_approved)

1184

1007

1227

1050

"D-Bus signal"

1228

1051

return self.need_approval()

1229

1052

1230

# NeRwequest - signal

1231

@dbus.service.signal(_interface, signature="s")

1232

def NewRequest(self, ip):

1233

"""D-Bus signal

1234

Is sent after a client request a password.

1235

"""

1236

pass

1237

1238

1053

## Methods

1239

1054

1240

1055

# Approve - method

1298

1113

access="readwrite")

1299

1114

def ApprovalDuration_dbus_property(self, value=None):

1300

1115

if value is None: # get

1301

return dbus.UInt64(timedelta_to_milliseconds(

1116

return dbus.UInt64(_timedelta_to_milliseconds(

1302

1117

self.approval_duration))

1303

1118

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1304

1119

1318

1133

def Host_dbus_property(self, value=None):

1319

1134

if value is None: # get

1320

1135

return dbus.String(self.host)

1321

self.host = unicode(value)

1136

self.host = value

1322

1137

1323

1138

# Created - property

1324

1139

@dbus_service_property(_interface, signature="s", access="read")

1325

1140

def Created_dbus_property(self):

1326

return datetime_to_dbus(self.created)

1141

return dbus.String(datetime_to_dbus(self.created))

1327

1142

1328

1143

# LastEnabled - property

1329

1144

@dbus_service_property(_interface, signature="s", access="read")

1367

1182

if value is None: # get

1368

1183

return dbus.UInt64(self.timeout_milliseconds())

1369

1184

self.timeout = datetime.timedelta(0, 0, 0, value)

1185

if getattr(self, "disable_initiator_tag", None) is None:

1186

return

1370

1187

# Reschedule timeout

1371

if self.enabled:

1372

now = datetime.datetime.utcnow()

1373

time_to_die = timedelta_to_milliseconds(

1374

(self.last_checked_ok + self.timeout) - now)

1375

if time_to_die <= 0:

1376

# The timeout has passed

1377

self.disable()

1378

else:

1379

self.expires = (now +

1380

datetime.timedelta(milliseconds =

1381

time_to_die))

1382

if (getattr(self, "disable_initiator_tag", None)

1383

is None):

1384

return

1385

gobject.source_remove(self.disable_initiator_tag)

1386

self.disable_initiator_tag = (gobject.timeout_add

1387

(time_to_die,

1388

self.disable))

1188

gobject.source_remove(self.disable_initiator_tag)

1189

self.disable_initiator_tag = None

1190

self.expires = None

1191

time_to_die = _timedelta_to_milliseconds((self

1192

.last_checked_ok

1193

+ self.timeout)

1194

- datetime.datetime

1195

.utcnow())

1196

if time_to_die <= 0:

1197

# The timeout has passed

1198

self.disable()

1199

else:

1200

self.expires = (datetime.datetime.utcnow()

1201

+ datetime.timedelta(milliseconds =

1202

time_to_die))

1203

self.disable_initiator_tag = (gobject.timeout_add

1204

(time_to_die, self.disable))

1389

1205

1390

1206

# ExtendedTimeout - property

1391

1207

@dbus_service_property(_interface, signature="t",

1404

1220

self.interval = datetime.timedelta(0, 0, 0, value)

1405

1221

if getattr(self, "checker_initiator_tag", None) is None:

1406

1222

return

1407

if self.enabled:

1408

# Reschedule checker run

1409

gobject.source_remove(self.checker_initiator_tag)

1410

self.checker_initiator_tag = (gobject.timeout_add

1411

(value, self.start_checker))

1412

self.start_checker() # Start one now, too

1223

# Reschedule checker run

1224

gobject.source_remove(self.checker_initiator_tag)

1225

self.checker_initiator_tag = (gobject.timeout_add

1226

(value, self.start_checker))

1227

self.start_checker() # Start one now, too

1413

1228

1414

1229

# Checker - property

1415

1230

@dbus_service_property(_interface, signature="s",

1417

1232

def Checker_dbus_property(self, value=None):

1418

1233

if value is None: # get

1419

1234

return dbus.String(self.checker_command)

1420

self.checker_command = unicode(value)

1235

self.checker_command = value

1421

1236

1422

1237

# CheckerRunning - property

1423

1238

@dbus_service_property(_interface, signature="b",

1452

1267

raise KeyError()

1453

1268

1454

1269

def __getattribute__(self, name):

1455

if name == '_pipe':

1270

if(name == '_pipe'):

1456

1271

return super(ProxyClient, self).__getattribute__(name)

1457

1272

self._pipe.send(('getattr', name))

1458

1273

data = self._pipe.recv()

1465

1280

return func

1466

1281

1467

1282

def __setattr__(self, name, value):

1468

if name == '_pipe':

1283

if(name == '_pipe'):

1469

1284

return super(ProxyClient, self).__setattr__(name, value)

1470

1285

self._pipe.send(('setattr', name, value))

1471

1286

1472

1473

1287

class ClientDBusTransitional(ClientDBus):

1474

1288

__metaclass__ = AlternateDBusNamesMetaclass

1475

1289

1476

1477

1290

class ClientHandler(socketserver.BaseRequestHandler, object):

1478

1291

"""A class to handle client connections.

1479

1292

1547

1360

except KeyError:

1548

1361

return

1549

1362

1550

if self.server.use_dbus:

1551

# Emit D-Bus signal

1552

client.NewRequest(str(self.client_address))

1553

1554

1363

if client.approval_delay:

1555

1364

delay = client.approval_delay

1556

1365

client.approvals_pending += 1

1565

1374

client.Rejected("Disabled")

1566

1375

return

1567

1376

1568

if client.approved or not client.approval_delay:

1377

if client._approved or not client.approval_delay:

1569

1378

#We are approved or approval is disabled

1570

1379

break

1571

elif client.approved is None:

1380

elif client._approved is None:

1572

1381

logger.info("Client %s needs approval",

1573

1382

client.name)

1574

1383

if self.server.use_dbus:

1588

1397

time = datetime.datetime.now()

1589

1398

client.changedstate.acquire()

1590

1399

(client.changedstate.wait

1591

(float(client.timedelta_to_milliseconds(delay)

1400

(float(client._timedelta_to_milliseconds(delay)

1592

1401

/ 1000)))

1593

1402

client.changedstate.release()

1594

1403

time2 = datetime.datetime.now()

1693

1502

# Convert the buffer to a Python bytestring

1694

1503

fpr = ctypes.string_at(buf, buf_len.value)

1695

1504

# Convert the bytestring to hexadecimal notation

1696

hex_fpr = binascii.hexlify(fpr).upper()

1505

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1697

1506

return hex_fpr

1698

1507

1699

1508

1702

1511

def sub_process_main(self, request, address):

1703

1512

try:

1704

1513

self.finish_request(request, address)

1705

except Exception:

1514

except:

1706

1515

self.handle_error(request, address)

1707

1516

self.close_request(request)

1708

1517

1813

1622

self.enabled = False

1814

1623

self.clients = clients

1815

1624

if self.clients is None:

1816

self.clients = {}

1625

self.clients = set()

1817

1626

self.use_dbus = use_dbus

1818

1627

self.gnutls_priority = gnutls_priority

1819

1628

IPv6_TCPServer.__init__(self, server_address,

1866

1675

fpr = request[1]

1867

1676

address = request[2]

1868

1677

1869

for c in self.clients.itervalues():

1678

for c in self.clients:

1870

1679

if c.fingerprint == fpr:

1871

1680

client = c

1872

1681

break

1956

1765

return timevalue

1957

1766

1958

1767

1768

def if_nametoindex(interface):

1769

"""Call the C function if_nametoindex(), or equivalent

1770

1771

Note: This function cannot accept a unicode string."""

1772

global if_nametoindex

1773

try:

1774

if_nametoindex = (ctypes.cdll.LoadLibrary

1775

(ctypes.util.find_library("c"))

1776

.if_nametoindex)

1777

except (OSError, AttributeError):

1778

logger.warning("Doing if_nametoindex the hard way")

1779

def if_nametoindex(interface):

1780

"Get an interface index the hard way, i.e. using fcntl()"

1781

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1782

with contextlib.closing(socket.socket()) as s:

1783

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1784

struct.pack(str("16s16x"),

1785

interface))

1786

interface_index = struct.unpack(str("I"),

1787

ifreq[16:20])[0]

1788

return interface_index

1789

return if_nametoindex(interface)

1790

1791

1959

1792

def daemon(nochdir = False, noclose = False):

1960

1793

"""See daemon(3). Standard BSD Unix function.

1961

1794

2016

1849

" system bus interface")

2017

1850

parser.add_argument("--no-ipv6", action="store_false",

2018

1851

dest="use_ipv6", help="Do not use IPv6")

2019

parser.add_argument("--no-restore", action="store_false",

2020

dest="restore", help="Do not restore stored"

2021

" state")

2022

parser.add_argument("--statedir", metavar="DIR",

2023

help="Directory to save/restore state in")

2024

2025

1852

options = parser.parse_args()

2026

1853

2027

1854

if options.check:

2040

1867

"use_dbus": "True",

2041

1868

"use_ipv6": "True",

2042

1869

"debuglevel": "",

2043

"restore": "True",

2044

"statedir": "/var/lib/mandos"

2045

1870

}

2046

1871

2047

1872

# Parse config file for server-global settings

2064

1889

# options, if set.

2065

1890

for option in ("interface", "address", "port", "debug",

2066

1891

"priority", "servicename", "configdir",

2067

"use_dbus", "use_ipv6", "debuglevel", "restore",

2068

"statedir"):

1892

"use_dbus", "use_ipv6", "debuglevel"):

2069

1893

value = getattr(options, option)

2070

1894

if value is not None:

2071

1895

server_settings[option] = value

2083

1907

debuglevel = server_settings["debuglevel"]

2084

1908

use_dbus = server_settings["use_dbus"]

2085

1909

use_ipv6 = server_settings["use_ipv6"]

2086

stored_state_path = os.path.join(server_settings["statedir"],

2087

stored_state_file)

2088

2089

if debug:

2090

initlogger(debug, logging.DEBUG)

2091

else:

2092

if not debuglevel:

2093

initlogger(debug)

2094

else:

2095

level = getattr(logging, debuglevel.upper())

2096

initlogger(debug, level)

2097

1910

2098

1911

if server_settings["servicename"] != "Mandos":

2099

1912

syslogger.setFormatter(logging.Formatter

2102

1915

% server_settings["servicename"]))

2103

1916

2104

1917

# Parse config file with clients

2105

client_config = configparser.SafeConfigParser(Client

2106

.client_defaults)

1918

client_defaults = { "timeout": "5m",

1919

"extended_timeout": "15m",

1920

"interval": "2m",

1921

"checker": "fping -q -- %%(host)s",

1922

"host": "",

1923

"approval_delay": "0s",

1924

"approval_duration": "1s",

1925

}

1926

client_config = configparser.SafeConfigParser(client_defaults)

2107

1927

client_config.read(os.path.join(server_settings["configdir"],

2108

1928

"clients.conf"))

2109

1929

2147

1967

if error[0] != errno.EPERM:

2148

1968

raise error

2149

1969

1970

if not debug and not debuglevel:

1971

syslogger.setLevel(logging.WARNING)

1972

console.setLevel(logging.WARNING)

1973

if debuglevel:

1974

level = getattr(logging, debuglevel.upper())

1975

syslogger.setLevel(level)

1976

console.setLevel(level)

1977

2150

1978

if debug:

2151

1979

# Enable all possible GnuTLS debugging

2152

1980

2166

1994

os.dup2(null, sys.stdin.fileno())

2167

1995

if null > 2:

2168

1996

os.close(null)

1997

else:

1998

# No console logging

1999

logger.removeHandler(console)

2169

2000

2170

2001

# Need to fork before connecting to D-Bus

2171

2002

if not debug:

2172

2003

# Close all input and output, do double fork, etc.

2173

2004

daemon()

2174

2005

2175

gobject.threads_init()

2176

2177

2006

global main_loop

2178

2007

# From the Avahi example code

2179

2008

DBusGMainLoop(set_as_default=True )

2193

2022

server_settings["use_dbus"] = False

2194

2023

tcp_server.use_dbus = False

2195

2024

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2196

service = AvahiServiceToSyslog(name =

2197

server_settings["servicename"],

2198

servicetype = "_mandos._tcp",

2199

protocol = protocol, bus = bus)

2025

service = AvahiService(name = server_settings["servicename"],

2026

servicetype = "_mandos._tcp",

2027

protocol = protocol, bus = bus)

2200

2028

if server_settings["interface"]:

2201

2029

service.interface = (if_nametoindex

2202

2030

(str(server_settings["interface"])))

2208

2036

if use_dbus:

2209

2037

client_class = functools.partial(ClientDBusTransitional,

2210

2038

bus = bus)

2211

2212

client_settings = Client.config_parser(client_config)

2213

old_client_settings = {}

2214

clients_data = {}

2215

2216

# Get client data and settings from last running state.

2217

if server_settings["restore"]:

2218

try:

2219

with open(stored_state_path, "rb") as stored_state:

2220

clients_data, old_client_settings = (pickle.load

2221

(stored_state))

2222

os.remove(stored_state_path)

2223

except IOError as e:

2224

logger.warning("Could not load persistent state: {0}"

2225

.format(e))

2226

if e.errno != errno.ENOENT:

2227

raise

2228

except EOFError as e:

2229

logger.warning("Could not load persistent state: "

2230

"EOFError: {0}".format(e))

2231

2232

with PGPEngine() as pgp:

2233

for client_name, client in clients_data.iteritems():

2234

# Decide which value to use after restoring saved state.

2235

# We have three different values: Old config file,

2236

# new config file, and saved state.

2237

# New config value takes precedence if it differs from old

2238

# config value, otherwise use saved state.

2239

for name, value in client_settings[client_name].items():

2240

try:

2241

# For each value in new config, check if it

2242

# differs from the old config value (Except for

2243

# the "secret" attribute)

2244

if (name != "secret" and

2245

value != old_client_settings[client_name]

2246

[name]):

2247

client[name] = value

2248

except KeyError:

2249

pass

2250

2251

# Clients who has passed its expire date can still be

2252

# enabled if its last checker was successful. Clients

2253

# whose checker failed before we stored its state is

2254

# assumed to have failed all checkers during downtime.

2255

if client["enabled"]:

2256

if datetime.datetime.utcnow() >= client["expires"]:

2257

if not client["last_checked_ok"]:

2258

logger.warning(

2259

"disabling client {0} - Client never "

2260

"performed a successfull checker"

2261

.format(client["name"]))

2262

client["enabled"] = False

2263

elif client["last_checker_status"] != 0:

2264

logger.warning(

2265

"disabling client {0} - Client "

2266

"last checker failed with error code {1}"

2267

.format(client["name"],

2268

client["last_checker_status"]))

2269

client["enabled"] = False

2270

else:

2271

client["expires"] = (datetime.datetime

2272

.utcnow()

2273

+ client["timeout"])

2274

logger.debug("Last checker succeeded,"

2275

" keeping {0} enabled"

2276

.format(client["name"]))

2039

def client_config_items(config, section):

2040

special_settings = {

2041

"approved_by_default":

2042

lambda: config.getboolean(section,

2043

"approved_by_default"),

2044

}

2045

for name, value in config.items(section):

2277

2046

try:

2278

client["secret"] = (

2279

pgp.decrypt(client["encrypted_secret"],

2280

client_settings[client_name]

2281

["secret"]))

2282

except PGPError:

2283

# If decryption fails, we use secret from new settings

2284

logger.debug("Failed to decrypt {0} old secret"

2285

.format(client_name))

2286

client["secret"] = (

2287

client_settings[client_name]["secret"])

2288

2289

2290

# Add/remove clients based on new changes made to config

2291

for client_name in (set(old_client_settings)

2292

- set(client_settings)):

2293

del clients_data[client_name]

2294

for client_name in (set(client_settings)

2295

- set(old_client_settings)):

2296

clients_data[client_name] = client_settings[client_name]

2297

2298

# Create clients all clients

2299

for client_name, client in clients_data.iteritems():

2300

tcp_server.clients[client_name] = client_class(

2301

name = client_name, settings = client)

2302

2047

yield (name, special_settings[name]())

2048

except KeyError:

2049

yield (name, value)

2050

2051

tcp_server.clients.update(set(

2052

client_class(name = section,

2053

config= dict(client_config_items(

2054

client_config, section)))

2055

for section in client_config.sections()))

2303

2056

if not tcp_server.clients:

2304

2057

logger.warning("No clients defined")

2305

2058

2316

2069

# "pidfile" was never created

2317

2070

pass

2318

2071

del pidfilename

2072

2319

2073

signal.signal(signal.SIGINT, signal.SIG_IGN)

2320

2074

2321

2075

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2347

2101

def GetAllClients(self):

2348

2102

"D-Bus method"

2349

2103

return dbus.Array(c.dbus_object_path

2350

for c in

2351

tcp_server.clients.itervalues())

2104

for c in tcp_server.clients)

2352

2105

2353

2106

@dbus.service.method(_interface,

2354

2107

out_signature="a{oa{sv}}")

2356

2109

"D-Bus method"

2357

2110

return dbus.Dictionary(

2358

2111

((c.dbus_object_path, c.GetAll(""))

2359

for c in tcp_server.clients.itervalues()),

2112

for c in tcp_server.clients),

2360

2113

signature="oa{sv}")

2361

2114

2362

2115

@dbus.service.method(_interface, in_signature="o")

2363

2116

def RemoveClient(self, object_path):

2364

2117

"D-Bus method"

2365

for c in tcp_server.clients.itervalues():

2118

for c in tcp_server.clients:

2366

2119

if c.dbus_object_path == object_path:

2367

del tcp_server.clients[c.name]

2120

tcp_server.clients.remove(c)

2368

2121

c.remove_from_connection()

2369

2122

# Don't signal anything except ClientRemoved

2370

2123

c.disable(quiet=True)

2384

2137

service.cleanup()

2385

2138

2386

2139

multiprocessing.active_children()

2387

if not (tcp_server.clients or client_settings):

2388

return

2389

2390

# Store client before exiting. Secrets are encrypted with key

2391

# based on what config file has. If config file is

2392

# removed/edited, old secret will thus be unrecovable.

2393

clients = {}

2394

with PGPEngine() as pgp:

2395

for client in tcp_server.clients.itervalues():

2396

key = client_settings[client.name]["secret"]

2397

client.encrypted_secret = pgp.encrypt(client.secret,

2398

key)

2399

client_dict = {}

2400

2401

# A list of attributes that can not be pickled

2402

# + secret.

2403

exclude = set(("bus", "changedstate", "secret",

2404

"checker"))

2405

for name, typ in (inspect.getmembers

2406

(dbus.service.Object)):

2407

exclude.add(name)

2408

2409

client_dict["encrypted_secret"] = (client

2410

.encrypted_secret)

2411

for attr in client.client_structure:

2412

if attr not in exclude:

2413

client_dict[attr] = getattr(client, attr)

2414

2415

clients[client.name] = client_dict

2416

del client_settings[client.name]["secret"]

2417

2418

try:

2419

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2420

prefix="clients-",

2421

dir=os.path.dirname

2422

(stored_state_path))

2423

with os.fdopen(tempfd, "wb") as stored_state:

2424

pickle.dump((clients, client_settings), stored_state)

2425

os.rename(tempname, stored_state_path)

2426

except (IOError, OSError) as e:

2427

logger.warning("Could not save persistent state: {0}"

2428

.format(e))

2429

if not debug:

2430

try:

2431

os.remove(tempname)

2432

except NameError:

2433

pass

2434

if e.errno not in set((errno.ENOENT, errno.EACCES,

2435

errno.EEXIST)):

2436

raise e

2437

2438

# Delete all clients, and settings from config

2439

2140

while tcp_server.clients:

2440

name, client = tcp_server.clients.popitem()

2141

client = tcp_server.clients.pop()

2441

2142

if use_dbus:

2442

2143

client.remove_from_connection()

2144

client.disable_hook = None

2443

2145

# Don't signal anything except ClientRemoved

2444

2146

client.disable(quiet=True)

2445

2147

if use_dbus:

2447

2149

mandos_dbus_service.ClientRemoved(client

2448

2150

.dbus_object_path,

2449

2151

client.name)

2450

client_settings.clear()

2451

2152

2452

2153

atexit.register(cleanup)

2453

2154

2454

for client in tcp_server.clients.itervalues():

2155

for client in tcp_server.clients:

2455

2156

if use_dbus:

2456

2157

# Emit D-Bus signal

2457

2158

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2458

# Need to initiate checking of clients

2459

if client.enabled:

2460

client.init_checker()

2159

client.enable()

2461

2160

2462

2161

tcp_server.enable()

2463

2162

tcp_server.server_activate()

2503

2202

# Must run before the D-Bus bus name gets deregistered

2504

2203

cleanup()

2505

2204

2205

2506

2206

if __name__ == '__main__':

2507

2207

main()