To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.16.10
- compare with another revision
- download diff
- download tarball
- view history from revision 237.16.10
- Committer: Teddy Hogeborn
- Date: 2011-11-24 20:15:24 UTC
- mto: (237.15.8 mandos-client-network-hooks)
- mto: This revision was merged to the branch mainline in revision 290.
- Revision ID: teddy@recompile.se-20111124201524-5w9ovzpuw3drdlgf
* network-hooks.d: New directory.
* network-hooks.d/bridge: New example hook.
* network-hooks.d/bridge.conf: Config file for bridge example hook.
* network-hooks.d/bridge: New example hook.
* network-hooks.d/bridge.conf: Config file for bridge example hook.
- files added:
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import binascii
67
import tempfile
68
66
69
67
import dbus
70
68
import dbus.service
75
73
import ctypes.util
76
74
import xml.dom.minidom
77
75
import inspect
78
import GnuPGInterface
79
76
80
77
try:
81
78
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
87
84
88
85
89
86
version = "1.4.1"
90
stored_state_file = "clients.pickle"
91
87
92
logger = logging.getLogger()
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
93
90
syslogger = (logging.handlers.SysLogHandler
94
91
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
95
92
address = str("/dev/log")))
96
97
try:
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
100
.if_nametoindex)
101
except (OSError, AttributeError):
102
def if_nametoindex(interface):
103
"Get an interface index the hard way, i.e. using fcntl()"
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
105
with contextlib.closing(socket.socket()) as s:
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
struct.pack(str("16s16x"),
108
interface))
109
interface_index = struct.unpack(str("I"),
110
ifreq[16:20])[0]
111
return interface_index
112
113
114
def initlogger(level=logging.WARNING):
115
"""init logger and add loglevel"""
116
117
syslogger.setFormatter(logging.Formatter
118
('Mandos [%(process)d]: %(levelname)s:'
119
' %(message)s'))
120
logger.addHandler(syslogger)
121
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet'])
146
147
def __enter__(self):
148
return self
149
150
def __exit__ (self, exc_type, exc_value, traceback):
151
self._cleanup()
152
return False
153
154
def __del__(self):
155
self._cleanup()
156
157
def _cleanup(self):
158
if self.tempdir is not None:
159
# Delete contents of tempdir
160
for root, dirs, files in os.walk(self.tempdir,
161
topdown = False):
162
for filename in files:
163
os.remove(os.path.join(root, filename))
164
for dirname in dirs:
165
os.rmdir(os.path.join(root, dirname))
166
# Remove tempdir
167
os.rmdir(self.tempdir)
168
self.tempdir = None
169
170
def password_encode(self, password):
171
# Passphrase can not be empty and can not contain newlines or
172
# NUL bytes. So we prefix it and hex encode it.
173
return b"mandos" + binascii.hexlify(password)
174
175
def encrypt(self, data, password):
176
self.gnupg.passphrase = self.password_encode(password)
177
with open(os.devnull) as devnull:
178
try:
179
proc = self.gnupg.run(['--symmetric'],
180
create_fhs=['stdin', 'stdout'],
181
attach_fhs={'stderr': devnull})
182
with contextlib.closing(proc.handles['stdin']) as f:
183
f.write(data)
184
with contextlib.closing(proc.handles['stdout']) as f:
185
ciphertext = f.read()
186
proc.wait()
187
except IOError as e:
188
raise PGPError(e)
189
self.gnupg.passphrase = None
190
return ciphertext
191
192
def decrypt(self, data, password):
193
self.gnupg.passphrase = self.password_encode(password)
194
with open(os.devnull) as devnull:
195
try:
196
proc = self.gnupg.run(['--decrypt'],
197
create_fhs=['stdin', 'stdout'],
198
attach_fhs={'stderr': devnull})
199
with contextlib.closing(proc.handles['stdin'] ) as f:
200
f.write(data)
201
with contextlib.closing(proc.handles['stdout']) as f:
202
decrypted_plaintext = f.read()
203
proc.wait()
204
except IOError as e:
205
raise PGPError(e)
206
self.gnupg.passphrase = None
207
return decrypted_plaintext
208
209
93
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
96
logger.addHandler(syslogger)
97
98
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
102
logger.addHandler(console)
210
103
211
104
class AvahiError(Exception):
212
105
def __init__(self, value, *args, **kwargs):
271
164
.GetAlternativeServiceName(self.name))
272
165
logger.info("Changing Zeroconf service name to %r ...",
273
166
self.name)
167
syslogger.setFormatter(logging.Formatter
168
('Mandos (%s) [%%(process)d]:'
169
' %%(levelname)s: %%(message)s'
170
% self.name))
274
171
self.remove()
275
172
try:
276
173
self.add()
296
193
avahi.DBUS_INTERFACE_ENTRY_GROUP)
297
194
self.entry_group_state_changed_match = (
298
195
self.group.connect_to_signal(
299
'StateChanged', self.entry_group_state_changed))
196
'StateChanged', self .entry_group_state_changed))
300
197
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
301
198
self.name, self.type)
302
199
self.group.AddService(
328
225
try:
329
226
self.group.Free()
330
227
except (dbus.exceptions.UnknownMethodException,
331
dbus.exceptions.DBusException):
228
dbus.exceptions.DBusException) as e:
332
229
pass
333
230
self.group = None
334
231
self.remove()
368
265
self.server_state_changed)
369
266
self.server_state_changed(self.server.GetState())
370
267
371
class AvahiServiceToSyslog(AvahiService):
372
def rename(self):
373
"""Add the new name to the syslog messages"""
374
ret = AvahiService.rename(self)
375
syslogger.setFormatter(logging.Formatter
376
('Mandos (%s) [%%(process)d]:'
377
' %%(levelname)s: %%(message)s'
378
% self.name))
379
return ret
380
268
381
def timedelta_to_milliseconds(td):
269
def _timedelta_to_milliseconds(td):
382
270
"Convert a datetime.timedelta() to milliseconds"
383
271
return ((td.days * 24 * 60 * 60 * 1000)
384
272
+ (td.seconds * 1000)
388
276
"""A representation of a client host served by this server.
389
277
390
278
Attributes:
391
approved: bool(); 'None' if not yet approved/disapproved
279
_approved: bool(); 'None' if not yet approved/disapproved
392
280
approval_delay: datetime.timedelta(); Time to wait for approval
393
281
approval_duration: datetime.timedelta(); Duration of one approval
394
282
checker: subprocess.Popen(); a running checker process used
401
289
instance %(name)s can be used in the command.
402
290
checker_initiator_tag: a gobject event source tag, or None
403
291
created: datetime.datetime(); (UTC) object creation
404
client_structure: Object describing what attributes a client has
405
and is used for storing the client at exit
406
292
current_checker_command: string; current running checker_command
293
disable_hook: If set, called by disable() as disable_hook(self)
407
294
disable_initiator_tag: a gobject event source tag, or None
408
295
enabled: bool()
409
296
fingerprint: string (40 or 32 hexadecimal digits); used to
412
299
interval: datetime.timedelta(); How often to start a new checker
413
300
last_approval_request: datetime.datetime(); (UTC) or None
414
301
last_checked_ok: datetime.datetime(); (UTC) or None
415
416
last_checker_status: integer between 0 and 255 reflecting exit
417
status of last checker. -1 reflects crashed
418
checker, or None.
419
last_enabled: datetime.datetime(); (UTC) or None
302
last_enabled: datetime.datetime(); (UTC)
420
303
name: string; from the config file, used in log messages and
421
304
D-Bus identifiers
422
305
secret: bytestring; sent verbatim (over TLS) to client
435
318
436
319
def timeout_milliseconds(self):
437
320
"Return the 'timeout' attribute in milliseconds"
438
return timedelta_to_milliseconds(self.timeout)
321
return _timedelta_to_milliseconds(self.timeout)
439
322
440
323
def extended_timeout_milliseconds(self):
441
324
"Return the 'extended_timeout' attribute in milliseconds"
442
return timedelta_to_milliseconds(self.extended_timeout)
325
return _timedelta_to_milliseconds(self.extended_timeout)
443
326
444
327
def interval_milliseconds(self):
445
328
"Return the 'interval' attribute in milliseconds"
446
return timedelta_to_milliseconds(self.interval)
329
return _timedelta_to_milliseconds(self.interval)
447
330
448
331
def approval_delay_milliseconds(self):
449
return timedelta_to_milliseconds(self.approval_delay)
332
return _timedelta_to_milliseconds(self.approval_delay)
450
333
451
def __init__(self, name = None, config=None):
334
def __init__(self, name = None, disable_hook=None, config=None):
452
335
"""Note: the 'checker' key in 'config' sets the
453
336
'checker_command' attribute and *not* the 'checker'
454
337
attribute."""
474
357
% self.name)
475
358
self.host = config.get("host", "")
476
359
self.created = datetime.datetime.utcnow()
477
self.enabled = config.get("enabled", True)
360
self.enabled = False
478
361
self.last_approval_request = None
479
if self.enabled:
480
self.last_enabled = datetime.datetime.utcnow()
481
else:
482
self.last_enabled = None
362
self.last_enabled = None
483
363
self.last_checked_ok = None
484
self.last_checker_status = None
485
364
self.timeout = string_to_delta(config["timeout"])
486
365
self.extended_timeout = string_to_delta(config
487
366
["extended_timeout"])
488
367
self.interval = string_to_delta(config["interval"])
368
self.disable_hook = disable_hook
489
369
self.checker = None
490
370
self.checker_initiator_tag = None
491
371
self.disable_initiator_tag = None
492
if self.enabled:
493
self.expires = datetime.datetime.utcnow() + self.timeout
494
else:
495
self.expires = None
372
self.expires = None
496
373
self.checker_callback_tag = None
497
374
self.checker_command = config["checker"]
498
375
self.current_checker_command = None
499
self.approved = None
376
self.last_connect = None
377
self._approved = None
500
378
self.approved_by_default = config.get("approved_by_default",
501
379
True)
502
380
self.approvals_pending = 0
507
385
self.changedstate = (multiprocessing_manager
508
386
.Condition(multiprocessing_manager
509
387
.Lock()))
510
self.client_structure = [attr for attr in
511
self.__dict__.iterkeys()
512
if not attr.startswith("_")]
513
self.client_structure.append("client_structure")
514
515
for name, t in inspect.getmembers(type(self),
516
lambda obj:
517
isinstance(obj,
518
property)):
519
if not name.startswith("_"):
520
self.client_structure.append(name)
521
388
522
# Send notice to process children that client state has changed
523
389
def send_changedstate(self):
524
with self.changedstate:
525
self.changedstate.notify_all()
390
self.changedstate.acquire()
391
self.changedstate.notify_all()
392
self.changedstate.release()
526
393
527
394
def enable(self):
528
395
"""Start this client's checker and timeout hooks"""
530
397
# Already enabled
531
398
return
532
399
self.send_changedstate()
400
# Schedule a new checker to be started an 'interval' from now,
401
# and every interval from then on.
402
self.checker_initiator_tag = (gobject.timeout_add
403
(self.interval_milliseconds(),
404
self.start_checker))
405
# Schedule a disable() when 'timeout' has passed
533
406
self.expires = datetime.datetime.utcnow() + self.timeout
407
self.disable_initiator_tag = (gobject.timeout_add
408
(self.timeout_milliseconds(),
409
self.disable))
534
410
self.enabled = True
535
411
self.last_enabled = datetime.datetime.utcnow()
536
self.init_checker()
412
# Also start a new checker *right now*.
413
self.start_checker()
537
414
538
415
def disable(self, quiet=True):
539
416
"""Disable this client."""
551
428
gobject.source_remove(self.checker_initiator_tag)
552
429
self.checker_initiator_tag = None
553
430
self.stop_checker()
431
if self.disable_hook:
432
self.disable_hook(self)
554
433
self.enabled = False
555
434
# Do not run this again if called by a gobject.timeout_add
556
435
return False
557
436
558
437
def __del__(self):
438
self.disable_hook = None
559
439
self.disable()
560
440
561
def init_checker(self):
562
# Schedule a new checker to be started an 'interval' from now,
563
# and every interval from then on.
564
self.checker_initiator_tag = (gobject.timeout_add
565
(self.interval_milliseconds(),
566
self.start_checker))
567
# Schedule a disable() when 'timeout' has passed
568
self.disable_initiator_tag = (gobject.timeout_add
569
(self.timeout_milliseconds(),
570
self.disable))
571
# Also start a new checker *right now*.
572
self.start_checker()
573
574
441
def checker_callback(self, pid, condition, command):
575
442
"""The checker has completed, so take appropriate actions."""
576
443
self.checker_callback_tag = None
577
444
self.checker = None
578
445
if os.WIFEXITED(condition):
579
self.last_checker_status = os.WEXITSTATUS(condition)
580
if self.last_checker_status == 0:
446
exitstatus = os.WEXITSTATUS(condition)
447
if exitstatus == 0:
581
448
logger.info("Checker for %(name)s succeeded",
582
449
vars(self))
583
450
self.checked_ok()
585
452
logger.info("Checker for %(name)s failed",
586
453
vars(self))
587
454
else:
588
self.last_checker_status = -1
589
455
logger.warning("Checker for %(name)s crashed?",
590
456
vars(self))
591
457
602
468
gobject.source_remove(self.disable_initiator_tag)
603
469
if getattr(self, "enabled", False):
604
470
self.disable_initiator_tag = (gobject.timeout_add
605
(timedelta_to_milliseconds
471
(_timedelta_to_milliseconds
606
472
(timeout), self.disable))
607
473
self.expires = datetime.datetime.utcnow() + timeout
608
474
825
691
826
692
Note: Will not include properties with access="write".
827
693
"""
828
properties = {}
694
all = {}
829
695
for name, prop in self._get_all_dbus_properties():
830
696
if (interface_name
831
697
and interface_name != prop._dbus_interface):
836
702
continue
837
703
value = prop()
838
704
if not hasattr(value, "variant_level"):
839
properties[name] = value
705
all[name] = value
840
706
continue
841
properties[name] = type(value)(value, variant_level=
842
value.variant_level+1)
843
return dbus.Dictionary(properties, signature="sv")
707
all[name] = type(value)(value, variant_level=
708
value.variant_level+1)
709
return dbus.Dictionary(all, signature="sv")
844
710
845
711
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
846
712
out_signature="s",
897
763
return dbus.String(dt.isoformat(),
898
764
variant_level=variant_level)
899
765
900
901
766
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
902
767
.__metaclass__):
903
768
"""Applied to an empty subclass of a D-Bus object, this metaclass
995
860
attribute.func_closure)))
996
861
return type.__new__(mcs, name, bases, attr)
997
862
998
999
863
class ClientDBus(Client, DBusObjectWithProperties):
1000
864
"""A Client class using D-Bus
1001
865
1010
874
# dbus.service.Object doesn't use super(), so we can't either.
1011
875
1012
876
def __init__(self, bus = None, *args, **kwargs):
877
self._approvals_pending = 0
1013
878
self.bus = bus
1014
879
Client.__init__(self, *args, **kwargs)
1015
1016
self._approvals_pending = 0
1017
880
# Only now, when this client is initialized, can it show up on
1018
881
# the D-Bus
1019
882
client_object_name = unicode(self.name).translate(
1029
892
variant_level=1):
1030
893
""" Modify a variable so that it's a property which announces
1031
894
its changes to DBus.
1032
895
1033
896
transform_fun: Function that takes a value and a variant_level
1034
897
and transforms it to a D-Bus type.
1035
898
dbus_name: D-Bus name of the variable
1069
932
datetime_to_dbus, "LastApprovalRequest")
1070
933
approved_by_default = notifychangeproperty(dbus.Boolean,
1071
934
"ApprovedByDefault")
1072
approval_delay = notifychangeproperty(dbus.UInt64,
935
approval_delay = notifychangeproperty(dbus.UInt16,
1073
936
"ApprovalDelay",
1074
937
type_func =
1075
timedelta_to_milliseconds)
938
_timedelta_to_milliseconds)
1076
939
approval_duration = notifychangeproperty(
1077
dbus.UInt64, "ApprovalDuration",
1078
type_func = timedelta_to_milliseconds)
940
dbus.UInt16, "ApprovalDuration",
941
type_func = _timedelta_to_milliseconds)
1079
942
host = notifychangeproperty(dbus.String, "Host")
1080
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
943
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1081
944
type_func =
1082
timedelta_to_milliseconds)
945
_timedelta_to_milliseconds)
1083
946
extended_timeout = notifychangeproperty(
1084
dbus.UInt64, "ExtendedTimeout",
1085
type_func = timedelta_to_milliseconds)
1086
interval = notifychangeproperty(dbus.UInt64,
947
dbus.UInt16, "ExtendedTimeout",
948
type_func = _timedelta_to_milliseconds)
949
interval = notifychangeproperty(dbus.UInt16,
1087
950
"Interval",
1088
951
type_func =
1089
timedelta_to_milliseconds)
952
_timedelta_to_milliseconds)
1090
953
checker_command = notifychangeproperty(dbus.String, "Checker")
1091
954
1092
955
del notifychangeproperty
1134
997
return r
1135
998
1136
999
def _reset_approved(self):
1137
self.approved = None
1000
self._approved = None
1138
1001
return False
1139
1002
1140
1003
def approve(self, value=True):
1141
1004
self.send_changedstate()
1142
self.approved = value
1143
gobject.timeout_add(timedelta_to_milliseconds
1005
self._approved = value
1006
gobject.timeout_add(_timedelta_to_milliseconds
1144
1007
(self.approval_duration),
1145
1008
self._reset_approved)
1146
1009
1189
1052
"D-Bus signal"
1190
1053
return self.need_approval()
1191
1054
1192
# NeRwequest - signal
1193
@dbus.service.signal(_interface, signature="s")
1194
def NewRequest(self, ip):
1195
"""D-Bus signal
1196
Is sent after a client request a password.
1197
"""
1198
pass
1199
1200
1055
## Methods
1201
1056
1202
1057
# Approve - method
1260
1115
access="readwrite")
1261
1116
def ApprovalDuration_dbus_property(self, value=None):
1262
1117
if value is None: # get
1263
return dbus.UInt64(timedelta_to_milliseconds(
1118
return dbus.UInt64(_timedelta_to_milliseconds(
1264
1119
self.approval_duration))
1265
1120
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1266
1121
1280
1135
def Host_dbus_property(self, value=None):
1281
1136
if value is None: # get
1282
1137
return dbus.String(self.host)
1283
self.host = unicode(value)
1138
self.host = value
1284
1139
1285
1140
# Created - property
1286
1141
@dbus_service_property(_interface, signature="s", access="read")
1287
1142
def Created_dbus_property(self):
1288
return datetime_to_dbus(self.created)
1143
return dbus.String(datetime_to_dbus(self.created))
1289
1144
1290
1145
# LastEnabled - property
1291
1146
@dbus_service_property(_interface, signature="s", access="read")
1335
1190
gobject.source_remove(self.disable_initiator_tag)
1336
1191
self.disable_initiator_tag = None
1337
1192
self.expires = None
1338
time_to_die = timedelta_to_milliseconds((self
1339
.last_checked_ok
1340
+ self.timeout)
1341
- datetime.datetime
1342
.utcnow())
1193
time_to_die = _timedelta_to_milliseconds((self
1194
.last_checked_ok
1195
+ self.timeout)
1196
- datetime.datetime
1197
.utcnow())
1343
1198
if time_to_die <= 0:
1344
1199
# The timeout has passed
1345
1200
self.disable()
1367
1222
self.interval = datetime.timedelta(0, 0, 0, value)
1368
1223
if getattr(self, "checker_initiator_tag", None) is None:
1369
1224
return
1370
if self.enabled:
1371
# Reschedule checker run
1372
gobject.source_remove(self.checker_initiator_tag)
1373
self.checker_initiator_tag = (gobject.timeout_add
1374
(value, self.start_checker))
1375
self.start_checker() # Start one now, too
1225
# Reschedule checker run
1226
gobject.source_remove(self.checker_initiator_tag)
1227
self.checker_initiator_tag = (gobject.timeout_add
1228
(value, self.start_checker))
1229
self.start_checker() # Start one now, too
1376
1230
1377
1231
# Checker - property
1378
1232
@dbus_service_property(_interface, signature="s",
1380
1234
def Checker_dbus_property(self, value=None):
1381
1235
if value is None: # get
1382
1236
return dbus.String(self.checker_command)
1383
self.checker_command = unicode(value)
1237
self.checker_command = value
1384
1238
1385
1239
# CheckerRunning - property
1386
1240
@dbus_service_property(_interface, signature="b",
1415
1269
raise KeyError()
1416
1270
1417
1271
def __getattribute__(self, name):
1418
if name == '_pipe':
1272
if(name == '_pipe'):
1419
1273
return super(ProxyClient, self).__getattribute__(name)
1420
1274
self._pipe.send(('getattr', name))
1421
1275
data = self._pipe.recv()
1428
1282
return func
1429
1283
1430
1284
def __setattr__(self, name, value):
1431
if name == '_pipe':
1285
if(name == '_pipe'):
1432
1286
return super(ProxyClient, self).__setattr__(name, value)
1433
1287
self._pipe.send(('setattr', name, value))
1434
1288
1435
1436
1289
class ClientDBusTransitional(ClientDBus):
1437
1290
__metaclass__ = AlternateDBusNamesMetaclass
1438
1291
1439
1440
1292
class ClientHandler(socketserver.BaseRequestHandler, object):
1441
1293
"""A class to handle client connections.
1442
1294
1510
1362
except KeyError:
1511
1363
return
1512
1364
1513
if self.server.use_dbus:
1514
# Emit D-Bus signal
1515
client.NewRequest(str(self.client_address))
1516
1517
1365
if client.approval_delay:
1518
1366
delay = client.approval_delay
1519
1367
client.approvals_pending += 1
1528
1376
client.Rejected("Disabled")
1529
1377
return
1530
1378
1531
if client.approved or not client.approval_delay:
1379
if client._approved or not client.approval_delay:
1532
1380
#We are approved or approval is disabled
1533
1381
break
1534
elif client.approved is None:
1382
elif client._approved is None:
1535
1383
logger.info("Client %s needs approval",
1536
1384
client.name)
1537
1385
if self.server.use_dbus:
1551
1399
time = datetime.datetime.now()
1552
1400
client.changedstate.acquire()
1553
1401
(client.changedstate.wait
1554
(float(client.timedelta_to_milliseconds(delay)
1402
(float(client._timedelta_to_milliseconds(delay)
1555
1403
/ 1000)))
1556
1404
client.changedstate.release()
1557
1405
time2 = datetime.datetime.now()
1656
1504
# Convert the buffer to a Python bytestring
1657
1505
fpr = ctypes.string_at(buf, buf_len.value)
1658
1506
# Convert the bytestring to hexadecimal notation
1659
hex_fpr = binascii.hexlify(fpr).upper()
1507
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1660
1508
return hex_fpr
1661
1509
1662
1510
1776
1624
self.enabled = False
1777
1625
self.clients = clients
1778
1626
if self.clients is None:
1779
self.clients = {}
1627
self.clients = set()
1780
1628
self.use_dbus = use_dbus
1781
1629
self.gnutls_priority = gnutls_priority
1782
1630
IPv6_TCPServer.__init__(self, server_address,
1829
1677
fpr = request[1]
1830
1678
address = request[2]
1831
1679
1832
for c in self.clients.itervalues():
1680
for c in self.clients:
1833
1681
if c.fingerprint == fpr:
1834
1682
client = c
1835
1683
break
1919
1767
return timevalue
1920
1768
1921
1769
1770
def if_nametoindex(interface):
1771
"""Call the C function if_nametoindex(), or equivalent
1772
1773
Note: This function cannot accept a unicode string."""
1774
global if_nametoindex
1775
try:
1776
if_nametoindex = (ctypes.cdll.LoadLibrary
1777
(ctypes.util.find_library("c"))
1778
.if_nametoindex)
1779
except (OSError, AttributeError):
1780
logger.warning("Doing if_nametoindex the hard way")
1781
def if_nametoindex(interface):
1782
"Get an interface index the hard way, i.e. using fcntl()"
1783
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1784
with contextlib.closing(socket.socket()) as s:
1785
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1786
struct.pack(str("16s16x"),
1787
interface))
1788
interface_index = struct.unpack(str("I"),
1789
ifreq[16:20])[0]
1790
return interface_index
1791
return if_nametoindex(interface)
1792
1793
1922
1794
def daemon(nochdir = False, noclose = False):
1923
1795
"""See daemon(3). Standard BSD Unix function.
1924
1796
1979
1851
" system bus interface")
1980
1852
parser.add_argument("--no-ipv6", action="store_false",
1981
1853
dest="use_ipv6", help="Do not use IPv6")
1982
parser.add_argument("--no-restore", action="store_false",
1983
dest="restore", help="Do not restore stored"
1984
" state")
1985
parser.add_argument("--statedir", metavar="DIR",
1986
help="Directory to save/restore state in")
1987
1988
1854
options = parser.parse_args()
1989
1855
1990
1856
if options.check:
2003
1869
"use_dbus": "True",
2004
1870
"use_ipv6": "True",
2005
1871
"debuglevel": "",
2006
"restore": "True",
2007
"statedir": "/var/lib/mandos"
2008
1872
}
2009
1873
2010
1874
# Parse config file for server-global settings
2027
1891
# options, if set.
2028
1892
for option in ("interface", "address", "port", "debug",
2029
1893
"priority", "servicename", "configdir",
2030
"use_dbus", "use_ipv6", "debuglevel", "restore",
2031
"statedir"):
1894
"use_dbus", "use_ipv6", "debuglevel"):
2032
1895
value = getattr(options, option)
2033
1896
if value is not None:
2034
1897
server_settings[option] = value
2046
1909
debuglevel = server_settings["debuglevel"]
2047
1910
use_dbus = server_settings["use_dbus"]
2048
1911
use_ipv6 = server_settings["use_ipv6"]
2049
stored_state_path = os.path.join(server_settings["statedir"],
2050
stored_state_file)
2051
2052
if debug:
2053
initlogger(logging.DEBUG)
2054
else:
2055
if not debuglevel:
2056
initlogger()
2057
else:
2058
level = getattr(logging, debuglevel.upper())
2059
initlogger(level)
2060
1912
2061
1913
if server_settings["servicename"] != "Mandos":
2062
1914
syslogger.setFormatter(logging.Formatter
2117
1969
if error[0] != errno.EPERM:
2118
1970
raise error
2119
1971
1972
if not debug and not debuglevel:
1973
syslogger.setLevel(logging.WARNING)
1974
console.setLevel(logging.WARNING)
1975
if debuglevel:
1976
level = getattr(logging, debuglevel.upper())
1977
syslogger.setLevel(level)
1978
console.setLevel(level)
1979
2120
1980
if debug:
2121
1981
# Enable all possible GnuTLS debugging
2122
1982
2164
2024
server_settings["use_dbus"] = False
2165
2025
tcp_server.use_dbus = False
2166
2026
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2167
service = AvahiServiceToSyslog(name =
2168
server_settings["servicename"],
2169
servicetype = "_mandos._tcp",
2170
protocol = protocol, bus = bus)
2027
service = AvahiService(name = server_settings["servicename"],
2028
servicetype = "_mandos._tcp",
2029
protocol = protocol, bus = bus)
2171
2030
if server_settings["interface"]:
2172
2031
service.interface = (if_nametoindex
2173
2032
(str(server_settings["interface"])))
2179
2038
if use_dbus:
2180
2039
client_class = functools.partial(ClientDBusTransitional,
2181
2040
bus = bus)
2182
2183
special_settings = {
2184
# Some settings need to be accessd by special methods;
2185
# booleans need .getboolean(), etc. Here is a list of them:
2186
"approved_by_default":
2187
lambda section:
2188
client_config.getboolean(section, "approved_by_default"),
2189
"enabled":
2190
lambda section:
2191
client_config.getboolean(section, "enabled"),
2192
}
2193
# Construct a new dict of client settings of this form:
2194
# { client_name: {setting_name: value, ...}, ...}
2195
# with exceptions for any special settings as defined above
2196
client_settings = dict((clientname,
2197
dict((setting,
2198
(value
2199
if setting not in special_settings
2200
else special_settings[setting]
2201
(clientname)))
2202
for setting, value in
2203
client_config.items(clientname)))
2204
for clientname in client_config.sections())
2205
2206
old_client_settings = {}
2207
clients_data = []
2208
2209
# Get client data and settings from last running state.
2210
if server_settings["restore"]:
2211
try:
2212
with open(stored_state_path, "rb") as stored_state:
2213
clients_data, old_client_settings = (pickle.load
2214
(stored_state))
2215
os.remove(stored_state_path)
2216
except IOError as e:
2217
logger.warning("Could not load persistent state: {0}"
2218
.format(e))
2219
if e.errno != errno.ENOENT:
2220
raise
2221
2222
with PGPEngine() as pgp:
2223
for client in clients_data:
2224
client_name = client["name"]
2225
2226
# Decide which value to use after restoring saved state.
2227
# We have three different values: Old config file,
2228
# new config file, and saved state.
2229
# New config value takes precedence if it differs from old
2230
# config value, otherwise use saved state.
2231
for name, value in client_settings[client_name].items():
2232
try:
2233
# For each value in new config, check if it
2234
# differs from the old config value (Except for
2235
# the "secret" attribute)
2236
if (name != "secret" and
2237
value != old_client_settings[client_name]
2238
[name]):
2239
setattr(client, name, value)
2240
except KeyError:
2241
pass
2242
2243
# Clients who has passed its expire date can still be
2244
# enabled if its last checker was sucessful. Clients
2245
# whose checker failed before we stored its state is
2246
# assumed to have failed all checkers during downtime.
2247
if client["enabled"]:
2248
if client["expires"] <= (datetime.datetime
2249
.utcnow()):
2250
# Client has expired
2251
if client["last_checker_status"] != 0:
2252
client["enabled"] = False
2253
else:
2254
client["expires"] = (datetime.datetime
2255
.utcnow()
2256
+ client["timeout"])
2257
2258
client["changedstate"] = (multiprocessing_manager
2259
.Condition
2260
(multiprocessing_manager
2261
.Lock()))
2262
if use_dbus:
2263
new_client = (ClientDBusTransitional.__new__
2264
(ClientDBusTransitional))
2265
tcp_server.clients[client_name] = new_client
2266
new_client.bus = bus
2267
for name, value in client.iteritems():
2268
setattr(new_client, name, value)
2269
client_object_name = unicode(client_name).translate(
2270
{ord("."): ord("_"),
2271
ord("-"): ord("_")})
2272
new_client.dbus_object_path = (dbus.ObjectPath
2273
("/clients/"
2274
+ client_object_name))
2275
DBusObjectWithProperties.__init__(new_client,
2276
new_client.bus,
2277
new_client
2278
.dbus_object_path)
2279
else:
2280
tcp_server.clients[client_name] = (Client.__new__
2281
(Client))
2282
for name, value in client.iteritems():
2283
setattr(tcp_server.clients[client_name],
2284
name, value)
2285
2041
def client_config_items(config, section):
2042
special_settings = {
2043
"approved_by_default":
2044
lambda: config.getboolean(section,
2045
"approved_by_default"),
2046
}
2047
for name, value in config.items(section):
2286
2048
try:
2287
tcp_server.clients[client_name].secret = (
2288
pgp.decrypt(tcp_server.clients[client_name]
2289
.encrypted_secret,
2290
client_settings[client_name]
2291
["secret"]))
2292
except PGPError:
2293
# If decryption fails, we use secret from new settings
2294
logger.debug("Failed to decrypt {0} old secret"
2295
.format(client_name))
2296
tcp_server.clients[client_name].secret = (
2297
client_settings[client_name]["secret"])
2298
2299
# Create/remove clients based on new changes made to config
2300
for clientname in set(old_client_settings) - set(client_settings):
2301
del tcp_server.clients[clientname]
2302
for clientname in set(client_settings) - set(old_client_settings):
2303
tcp_server.clients[clientname] = (client_class(name
2304
= clientname,
2305
config =
2306
client_settings
2307
[clientname]))
2308
2049
yield (name, special_settings[name]())
2050
except KeyError:
2051
yield (name, value)
2052
2053
tcp_server.clients.update(set(
2054
client_class(name = section,
2055
config= dict(client_config_items(
2056
client_config, section)))
2057
for section in client_config.sections()))
2309
2058
if not tcp_server.clients:
2310
2059
logger.warning("No clients defined")
2311
2060
2354
2103
def GetAllClients(self):
2355
2104
"D-Bus method"
2356
2105
return dbus.Array(c.dbus_object_path
2357
for c in
2358
tcp_server.clients.itervalues())
2106
for c in tcp_server.clients)
2359
2107
2360
2108
@dbus.service.method(_interface,
2361
2109
out_signature="a{oa{sv}}")
2363
2111
"D-Bus method"
2364
2112
return dbus.Dictionary(
2365
2113
((c.dbus_object_path, c.GetAll(""))
2366
for c in tcp_server.clients.itervalues()),
2114
for c in tcp_server.clients),
2367
2115
signature="oa{sv}")
2368
2116
2369
2117
@dbus.service.method(_interface, in_signature="o")
2370
2118
def RemoveClient(self, object_path):
2371
2119
"D-Bus method"
2372
for c in tcp_server.clients.itervalues():
2120
for c in tcp_server.clients:
2373
2121
if c.dbus_object_path == object_path:
2374
del tcp_server.clients[c.name]
2122
tcp_server.clients.remove(c)
2375
2123
c.remove_from_connection()
2376
2124
# Don't signal anything except ClientRemoved
2377
2125
c.disable(quiet=True)
2391
2139
service.cleanup()
2392
2140
2393
2141
multiprocessing.active_children()
2394
if not (tcp_server.clients or client_settings):
2395
return
2396
2397
# Store client before exiting. Secrets are encrypted with key
2398
# based on what config file has. If config file is
2399
# removed/edited, old secret will thus be unrecovable.
2400
clients = []
2401
with PGPEngine() as pgp:
2402
for client in tcp_server.clients.itervalues():
2403
key = client_settings[client.name]["secret"]
2404
client.encrypted_secret = pgp.encrypt(client.secret,
2405
key)
2406
client_dict = {}
2407
2408
# A list of attributes that will not be stored when
2409
# shutting down.
2410
exclude = set(("bus", "changedstate", "secret"))
2411
for name, typ in (inspect.getmembers
2412
(dbus.service.Object)):
2413
exclude.add(name)
2414
2415
client_dict["encrypted_secret"] = (client
2416
.encrypted_secret)
2417
for attr in client.client_structure:
2418
if attr not in exclude:
2419
client_dict[attr] = getattr(client, attr)
2420
2421
clients.append(client_dict)
2422
del client_settings[client.name]["secret"]
2423
2424
try:
2425
with os.fdopen(os.open(stored_state_path,
2426
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2427
0600), "wb") as stored_state:
2428
pickle.dump((clients, client_settings), stored_state)
2429
except (IOError, OSError) as e:
2430
logger.warning("Could not save persistent state: {0}"
2431
.format(e))
2432
if e.errno not in (errno.ENOENT, errno.EACCES):
2433
raise
2434
2435
# Delete all clients, and settings from config
2436
2142
while tcp_server.clients:
2437
name, client = tcp_server.clients.popitem()
2143
client = tcp_server.clients.pop()
2438
2144
if use_dbus:
2439
2145
client.remove_from_connection()
2146
client.disable_hook = None
2440
2147
# Don't signal anything except ClientRemoved
2441
2148
client.disable(quiet=True)
2442
2149
if use_dbus:
2444
2151
mandos_dbus_service.ClientRemoved(client
2445
2152
.dbus_object_path,
2446
2153
client.name)
2447
client_settings.clear()
2448
2154
2449
2155
atexit.register(cleanup)
2450
2156
2451
for client in tcp_server.clients.itervalues():
2157
for client in tcp_server.clients:
2452
2158
if use_dbus:
2453
2159
# Emit D-Bus signal
2454
2160
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2455
# Need to initiate checking of clients
2456
if client.enabled:
2457
client.init_checker()
2161
client.enable()
2458
2162
2459
2163
tcp_server.enable()
2460
2164
tcp_server.server_activate()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0