/mandos/release : revision 237.16.24

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

66

69

67

import dbus

70

68

import dbus.service

75

73

import ctypes.util

76

74

import xml.dom.minidom

77

75

import inspect

78

import GnuPGInterface

79

76

80

77

try:

81

78

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

82

except ImportError:

86

83

SO_BINDTODEVICE = None

87

84

85

88

86

version = "1.4.1"

89

stored_state_file = "clients.pickle"

90

87

91

logger = logging.getLogger()

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

92

90

syslogger = (logging.handlers.SysLogHandler

93

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

92

address = str("/dev/log")))

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(debug, level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

if debug:

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet',

146

'--no-use-agent'])

147

148

def __enter__(self):

149

return self

150

151

def __exit__ (self, exc_type, exc_value, traceback):

152

self._cleanup()

153

return False

154

155

def __del__(self):

156

self._cleanup()

157

158

def _cleanup(self):

159

if self.tempdir is not None:

160

# Delete contents of tempdir

161

for root, dirs, files in os.walk(self.tempdir,

162

topdown = False):

163

for filename in files:

164

os.remove(os.path.join(root, filename))

165

for dirname in dirs:

166

os.rmdir(os.path.join(root, dirname))

167

# Remove tempdir

168

os.rmdir(self.tempdir)

169

self.tempdir = None

170

171

def password_encode(self, password):

172

# Passphrase can not be empty and can not contain newlines or

173

# NUL bytes. So we prefix it and hex encode it.

174

return b"mandos" + binascii.hexlify(password)

175

176

def encrypt(self, data, password):

177

self.gnupg.passphrase = self.password_encode(password)

178

with open(os.devnull) as devnull:

179

try:

180

proc = self.gnupg.run(['--symmetric'],

181

create_fhs=['stdin', 'stdout'],

182

attach_fhs={'stderr': devnull})

183

with contextlib.closing(proc.handles['stdin']) as f:

184

f.write(data)

185

with contextlib.closing(proc.handles['stdout']) as f:

186

ciphertext = f.read()

187

proc.wait()

188

except IOError as e:

189

raise PGPError(e)

190

self.gnupg.passphrase = None

191

return ciphertext

192

193

def decrypt(self, data, password):

194

self.gnupg.passphrase = self.password_encode(password)

195

with open(os.devnull) as devnull:

196

try:

197

proc = self.gnupg.run(['--decrypt'],

198

create_fhs=['stdin', 'stdout'],

199

attach_fhs={'stderr': devnull})

200

with contextlib.closing(proc.handles['stdin'] ) as f:

201

f.write(data)

202

with contextlib.closing(proc.handles['stdout']) as f:

203

decrypted_plaintext = f.read()

204

proc.wait()

205

except IOError as e:

206

raise PGPError(e)

207

self.gnupg.passphrase = None

208

return decrypted_plaintext

209

210

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

211

103

212

104

class AvahiError(Exception):

213

105

def __init__(self, value, *args, **kwargs):

272

164

.GetAlternativeServiceName(self.name))

273

165

logger.info("Changing Zeroconf service name to %r ...",

274

166

self.name)

167

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

170

% self.name))

275

171

self.remove()

276

172

try:

277

173

self.add()

297

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

298

194

self.entry_group_state_changed_match = (

299

195

self.group.connect_to_signal(

300

'StateChanged', self.entry_group_state_changed))

196

'StateChanged', self .entry_group_state_changed))

301

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

302

198

self.name, self.type)

303

199

self.group.AddService(

329

225

try:

330

226

self.group.Free()

331

227

except (dbus.exceptions.UnknownMethodException,

332

dbus.exceptions.DBusException):

228

dbus.exceptions.DBusException) as e:

333

229

pass

334

230

self.group = None

335

231

self.remove()

369

265

self.server_state_changed)

370

266

self.server_state_changed(self.server.GetState())

371

267

372

class AvahiServiceToSyslog(AvahiService):

373

def rename(self):

374

"""Add the new name to the syslog messages"""

375

ret = AvahiService.rename(self)

376

syslogger.setFormatter(logging.Formatter

377

('Mandos (%s) [%%(process)d]:'

378

' %%(levelname)s: %%(message)s'

379

% self.name))

380

return ret

381

268

382

def timedelta_to_milliseconds(td):

269

def _timedelta_to_milliseconds(td):

383

270

"Convert a datetime.timedelta() to milliseconds"

384

271

return ((td.days * 24 * 60 * 60 * 1000)

385

272

+ (td.seconds * 1000)

389

276

"""A representation of a client host served by this server.

390

277

391

278

Attributes:

392

approved: bool(); 'None' if not yet approved/disapproved

279

_approved: bool(); 'None' if not yet approved/disapproved

393

280

approval_delay: datetime.timedelta(); Time to wait for approval

394

281

approval_duration: datetime.timedelta(); Duration of one approval

395

282

checker: subprocess.Popen(); a running checker process used

402

289

instance %(name)s can be used in the command.

403

290

checker_initiator_tag: a gobject event source tag, or None

404

291

created: datetime.datetime(); (UTC) object creation

405

client_structure: Object describing what attributes a client has

406

and is used for storing the client at exit

407

292

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

408

294

disable_initiator_tag: a gobject event source tag, or None

409

295

enabled: bool()

410

296

fingerprint: string (40 or 32 hexadecimal digits); used to

413

299

interval: datetime.timedelta(); How often to start a new checker

414

300

last_approval_request: datetime.datetime(); (UTC) or None

415

301

last_checked_ok: datetime.datetime(); (UTC) or None

416

last_checker_status: integer between 0 and 255 reflecting exit

417

status of last checker. -1 reflects crashed

418

checker, or None.

419

last_enabled: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

420

303

name: string; from the config file, used in log messages and

421

304

D-Bus identifiers

422

305

secret: bytestring; sent verbatim (over TLS) to client

432

315

"created", "enabled", "fingerprint",

433

316

"host", "interval", "last_checked_ok",

434

317

"last_enabled", "name", "timeout")

435

client_defaults = { "timeout": "5m",

436

"extended_timeout": "15m",

437

"interval": "2m",

438

"checker": "fping -q -- %%(host)s",

439

"host": "",

440

"approval_delay": "0s",

441

"approval_duration": "1s",

442

"approved_by_default": "True",

443

"enabled": "True",

444

}

445

318

446

319

def timeout_milliseconds(self):

447

320

"Return the 'timeout' attribute in milliseconds"

448

return timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

449

322

450

323

def extended_timeout_milliseconds(self):

451

324

"Return the 'extended_timeout' attribute in milliseconds"

452

return timedelta_to_milliseconds(self.extended_timeout)

325

return _timedelta_to_milliseconds(self.extended_timeout)

453

326

454

327

def interval_milliseconds(self):

455

328

"Return the 'interval' attribute in milliseconds"

456

return timedelta_to_milliseconds(self.interval)

329

return _timedelta_to_milliseconds(self.interval)

457

330

458

331

def approval_delay_milliseconds(self):

459

return timedelta_to_milliseconds(self.approval_delay)

460

461

@staticmethod

462

def config_parser(config):

463

"""Construct a new dict of client settings of this form:

464

{ client_name: {setting_name: value, ...}, ...}

465

with exceptions for any special settings as defined above.

466

NOTE: Must be a pure function. Must return the same result

467

value given the same arguments.

468

"""

469

settings = {}

470

for client_name in config.sections():

471

section = dict(config.items(client_name))

472

client = settings[client_name] = {}

473

474

client["host"] = section["host"]

475

# Reformat values from string types to Python types

476

client["approved_by_default"] = config.getboolean(

477

client_name, "approved_by_default")

478

client["enabled"] = config.getboolean(client_name,

479

"enabled")

480

481

client["fingerprint"] = (section["fingerprint"].upper()

482

.replace(" ", ""))

483

if "secret" in section:

484

client["secret"] = section["secret"].decode("base64")

485

elif "secfile" in section:

486

with open(os.path.expanduser(os.path.expandvars

487

(section["secfile"])),

488

"rb") as secfile:

489

client["secret"] = secfile.read()

490

else:

491

raise TypeError("No secret or secfile for section %s"

492

% section)

493

client["timeout"] = string_to_delta(section["timeout"])

494

client["extended_timeout"] = string_to_delta(

495

section["extended_timeout"])

496

client["interval"] = string_to_delta(section["interval"])

497

client["approval_delay"] = string_to_delta(

498

section["approval_delay"])

499

client["approval_duration"] = string_to_delta(

500

section["approval_duration"])

501

client["checker_command"] = section["checker"]

502

client["last_approval_request"] = None

503

client["last_checked_ok"] = None

504

client["last_checker_status"] = None

505

506

return settings

507

508

509

def __init__(self, settings, name = None):

332

return _timedelta_to_milliseconds(self.approval_delay)

333

334

def __init__(self, name = None, disable_hook=None, config=None):

510

335

"""Note: the 'checker' key in 'config' sets the

511

336

'checker_command' attribute and *not* the 'checker'

512

337

attribute."""

513

338

self.name = name

514

# adding all client settings

515

for setting, value in settings.iteritems():

516

setattr(self, setting, value)

517

518

if self.enabled:

519

if not hasattr(self, "last_enabled"):

520

self.last_enabled = datetime.datetime.utcnow()

521

if not hasattr(self, "expires"):

522

self.expires = (datetime.datetime.utcnow()

523

+ self.timeout)

524

else:

525

self.last_enabled = None

526

self.expires = None

527

339

if config is None:

340

config = {}

528

341

logger.debug("Creating client %r", self.name)

529

342

# Uppercase and remove spaces from fingerprint for later

530

343

# comparison purposes with return value from the fingerprint()

531

344

# function

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

532

347

logger.debug(" Fingerprint: %s", self.fingerprint)

533

self.created = settings.get("created",

534

datetime.datetime.utcnow())

535

536

# attributes specific for this server instance

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

351

with open(os.path.expanduser(os.path.expandvars

352

(config["secfile"])),

353

"rb") as secfile:

354

self.secret = secfile.read()

355

else:

356

raise TypeError("No secret or secfile for client %s"

357

% self.name)

358

self.host = config.get("host", "")

359

self.created = datetime.datetime.utcnow()

360

self.enabled = False

361

self.last_approval_request = None

362

self.last_enabled = None

363

self.last_checked_ok = None

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

368

self.disable_hook = disable_hook

537

369

self.checker = None

538

370

self.checker_initiator_tag = None

539

371

self.disable_initiator_tag = None

372

self.expires = None

540

373

self.checker_callback_tag = None

374

self.checker_command = config["checker"]

541

375

self.current_checker_command = None

542

self.approved = None

376

self.last_connect = None

377

self._approved = None

378

self.approved_by_default = config.get("approved_by_default",

379

True)

543

380

self.approvals_pending = 0

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

544

385

self.changedstate = (multiprocessing_manager

545

386

.Condition(multiprocessing_manager

546

387

.Lock()))

547

self.client_structure = [attr for attr in

548

self.__dict__.iterkeys()

549

if not attr.startswith("_")]

550

self.client_structure.append("client_structure")

551

552

for name, t in inspect.getmembers(type(self),

553

lambda obj:

554

isinstance(obj,

555

property)):

556

if not name.startswith("_"):

557

self.client_structure.append(name)

558

388

559

# Send notice to process children that client state has changed

560

389

def send_changedstate(self):

561

with self.changedstate:

562

self.changedstate.notify_all()

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

563

393

564

394

def enable(self):

565

395

"""Start this client's checker and timeout hooks"""

567

397

# Already enabled

568

398

return

569

399

self.send_changedstate()

400

# Schedule a new checker to be started an 'interval' from now,

401

# and every interval from then on.

402

self.checker_initiator_tag = (gobject.timeout_add

403

(self.interval_milliseconds(),

404

self.start_checker))

405

# Schedule a disable() when 'timeout' has passed

570

406

self.expires = datetime.datetime.utcnow() + self.timeout

407

self.disable_initiator_tag = (gobject.timeout_add

408

(self.timeout_milliseconds(),

409

self.disable))

571

410

self.enabled = True

572

411

self.last_enabled = datetime.datetime.utcnow()

573

self.init_checker()

412

# Also start a new checker *right now*.

413

self.start_checker()

574

414

575

415

def disable(self, quiet=True):

576

416

"""Disable this client."""

588

428

gobject.source_remove(self.checker_initiator_tag)

589

429

self.checker_initiator_tag = None

590

430

self.stop_checker()

431

if self.disable_hook:

432

self.disable_hook(self)

591

433

self.enabled = False

592

434

# Do not run this again if called by a gobject.timeout_add

593

435

return False

594

436

595

437

def __del__(self):

438

self.disable_hook = None

596

439

self.disable()

597

440

598

def init_checker(self):

599

# Schedule a new checker to be started an 'interval' from now,

600

# and every interval from then on.

601

self.checker_initiator_tag = (gobject.timeout_add

602

(self.interval_milliseconds(),

603

self.start_checker))

604

# Schedule a disable() when 'timeout' has passed

605

self.disable_initiator_tag = (gobject.timeout_add

606

(self.timeout_milliseconds(),

607

self.disable))

608

# Also start a new checker *right now*.

609

self.start_checker()

610

611

441

def checker_callback(self, pid, condition, command):

612

442

"""The checker has completed, so take appropriate actions."""

613

443

self.checker_callback_tag = None

614

444

self.checker = None

615

445

if os.WIFEXITED(condition):

616

self.last_checker_status = os.WEXITSTATUS(condition)

617

if self.last_checker_status == 0:

446

exitstatus = os.WEXITSTATUS(condition)

447

if exitstatus == 0:

618

448

logger.info("Checker for %(name)s succeeded",

619

449

vars(self))

620

450

self.checked_ok()

622

452

logger.info("Checker for %(name)s failed",

623

453

vars(self))

624

454

else:

625

self.last_checker_status = -1

626

455

logger.warning("Checker for %(name)s crashed?",

627

456

vars(self))

628

457

639

468

gobject.source_remove(self.disable_initiator_tag)

640

469

if getattr(self, "enabled", False):

641

470

self.disable_initiator_tag = (gobject.timeout_add

642

(timedelta_to_milliseconds

471

(_timedelta_to_milliseconds

643

472

(timeout), self.disable))

644

473

self.expires = datetime.datetime.utcnow() + timeout

645

474

862

691

863

692

Note: Will not include properties with access="write".

864

693

"""

865

properties = {}

694

all = {}

866

695

for name, prop in self._get_all_dbus_properties():

867

696

if (interface_name

868

697

and interface_name != prop._dbus_interface):

873

702

continue

874

703

value = prop()

875

704

if not hasattr(value, "variant_level"):

876

properties[name] = value

705

all[name] = value

877

706

continue

878

properties[name] = type(value)(value, variant_level=

879

value.variant_level+1)

880

return dbus.Dictionary(properties, signature="sv")

707

all[name] = type(value)(value, variant_level=

708

value.variant_level+1)

709

return dbus.Dictionary(all, signature="sv")

881

710

882

711

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

883

712

out_signature="s",

934

763

return dbus.String(dt.isoformat(),

935

764

variant_level=variant_level)

936

765

937

938

766

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

939

767

.__metaclass__):

940

768

"""Applied to an empty subclass of a D-Bus object, this metaclass

1032

860

attribute.func_closure)))

1033

861

return type.__new__(mcs, name, bases, attr)

1034

862

1035

1036

863

class ClientDBus(Client, DBusObjectWithProperties):

1037

864

"""A Client class using D-Bus

1038

865

1047

874

# dbus.service.Object doesn't use super(), so we can't either.

1048

875

1049

876

def __init__(self, bus = None, *args, **kwargs):

877

self._approvals_pending = 0

1050

878

self.bus = bus

1051

879

Client.__init__(self, *args, **kwargs)

1052

self._approvals_pending = 0

1053

1054

self._approvals_pending = 0

1055

880

# Only now, when this client is initialized, can it show up on

1056

881

# the D-Bus

1057

882

client_object_name = unicode(self.name).translate(

1067

892

variant_level=1):

1068

893

""" Modify a variable so that it's a property which announces

1069

894

its changes to DBus.

1070

895

1071

896

transform_fun: Function that takes a value and a variant_level

1072

897

and transforms it to a D-Bus type.

1073

898

dbus_name: D-Bus name of the variable

1107

932

datetime_to_dbus, "LastApprovalRequest")

1108

933

approved_by_default = notifychangeproperty(dbus.Boolean,

1109

934

"ApprovedByDefault")

1110

approval_delay = notifychangeproperty(dbus.UInt64,

935

approval_delay = notifychangeproperty(dbus.UInt16,

1111

936

"ApprovalDelay",

1112

937

type_func =

1113

timedelta_to_milliseconds)

938

_timedelta_to_milliseconds)

1114

939

approval_duration = notifychangeproperty(

1115

dbus.UInt64, "ApprovalDuration",

1116

type_func = timedelta_to_milliseconds)

940

dbus.UInt16, "ApprovalDuration",

941

type_func = _timedelta_to_milliseconds)

1117

942

host = notifychangeproperty(dbus.String, "Host")

1118

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

943

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1119

944

type_func =

1120

timedelta_to_milliseconds)

945

_timedelta_to_milliseconds)

1121

946

extended_timeout = notifychangeproperty(

1122

dbus.UInt64, "ExtendedTimeout",

1123

type_func = timedelta_to_milliseconds)

1124

interval = notifychangeproperty(dbus.UInt64,

947

dbus.UInt16, "ExtendedTimeout",

948

type_func = _timedelta_to_milliseconds)

949

interval = notifychangeproperty(dbus.UInt16,

1125

950

"Interval",

1126

951

type_func =

1127

timedelta_to_milliseconds)

952

_timedelta_to_milliseconds)

1128

953

checker_command = notifychangeproperty(dbus.String, "Checker")

1129

954

1130

955

del notifychangeproperty

1172

997

return r

1173

998

1174

999

def _reset_approved(self):

1175

self.approved = None

1000

self._approved = None

1176

1001

return False

1177

1002

1178

1003

def approve(self, value=True):

1179

1004

self.send_changedstate()

1180

self.approved = value

1181

gobject.timeout_add(timedelta_to_milliseconds

1005

self._approved = value

1006

gobject.timeout_add(_timedelta_to_milliseconds

1182

1007

(self.approval_duration),

1183

1008

self._reset_approved)

1184

1009

1227

1052

"D-Bus signal"

1228

1053

return self.need_approval()

1229

1054

1230

# NeRwequest - signal

1231

@dbus.service.signal(_interface, signature="s")

1232

def NewRequest(self, ip):

1233

"""D-Bus signal

1234

Is sent after a client request a password.

1235

"""

1236

pass

1237

1238

1055

## Methods

1239

1056

1240

1057

# Approve - method

1298

1115

access="readwrite")

1299

1116

def ApprovalDuration_dbus_property(self, value=None):

1300

1117

if value is None: # get

1301

return dbus.UInt64(timedelta_to_milliseconds(

1118

return dbus.UInt64(_timedelta_to_milliseconds(

1302

1119

self.approval_duration))

1303

1120

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1304

1121

1318

1135

def Host_dbus_property(self, value=None):

1319

1136

if value is None: # get

1320

1137

return dbus.String(self.host)

1321

self.host = unicode(value)

1138

self.host = value

1322

1139

1323

1140

# Created - property

1324

1141

@dbus_service_property(_interface, signature="s", access="read")

1325

1142

def Created_dbus_property(self):

1326

return datetime_to_dbus(self.created)

1143

return dbus.String(datetime_to_dbus(self.created))

1327

1144

1328

1145

# LastEnabled - property

1329

1146

@dbus_service_property(_interface, signature="s", access="read")

1367

1184

if value is None: # get

1368

1185

return dbus.UInt64(self.timeout_milliseconds())

1369

1186

self.timeout = datetime.timedelta(0, 0, 0, value)

1187

if getattr(self, "disable_initiator_tag", None) is None:

1188

return

1370

1189

# Reschedule timeout

1371

if self.enabled:

1372

now = datetime.datetime.utcnow()

1373

time_to_die = timedelta_to_milliseconds(

1374

(self.last_checked_ok + self.timeout) - now)

1375

if time_to_die <= 0:

1376

# The timeout has passed

1377

self.disable()

1378

else:

1379

self.expires = (now +

1380

datetime.timedelta(milliseconds =

1381

time_to_die))

1382

if (getattr(self, "disable_initiator_tag", None)

1383

is None):

1384

return

1385

gobject.source_remove(self.disable_initiator_tag)

1386

self.disable_initiator_tag = (gobject.timeout_add

1387

(time_to_die,

1388

self.disable))

1190

gobject.source_remove(self.disable_initiator_tag)

1191

self.disable_initiator_tag = None

1192

self.expires = None

1193

time_to_die = _timedelta_to_milliseconds((self

1194

.last_checked_ok

1195

+ self.timeout)

1196

- datetime.datetime

1197

.utcnow())

1198

if time_to_die <= 0:

1199

# The timeout has passed

1200

self.disable()

1201

else:

1202

self.expires = (datetime.datetime.utcnow()

1203

+ datetime.timedelta(milliseconds =

1204

time_to_die))

1205

self.disable_initiator_tag = (gobject.timeout_add

1206

(time_to_die, self.disable))

1389

1207

1390

1208

# ExtendedTimeout - property

1391

1209

@dbus_service_property(_interface, signature="t",

1404

1222

self.interval = datetime.timedelta(0, 0, 0, value)

1405

1223

if getattr(self, "checker_initiator_tag", None) is None:

1406

1224

return

1407

if self.enabled:

1408

# Reschedule checker run

1409

gobject.source_remove(self.checker_initiator_tag)

1410

self.checker_initiator_tag = (gobject.timeout_add

1411

(value, self.start_checker))

1412

self.start_checker() # Start one now, too

1225

# Reschedule checker run

1226

gobject.source_remove(self.checker_initiator_tag)

1227

self.checker_initiator_tag = (gobject.timeout_add

1228

(value, self.start_checker))

1229

self.start_checker() # Start one now, too

1413

1230

1414

1231

# Checker - property

1415

1232

@dbus_service_property(_interface, signature="s",

1417

1234

def Checker_dbus_property(self, value=None):

1418

1235

if value is None: # get

1419

1236

return dbus.String(self.checker_command)

1420

self.checker_command = unicode(value)

1237

self.checker_command = value

1421

1238

1422

1239

# CheckerRunning - property

1423

1240

@dbus_service_property(_interface, signature="b",

1452

1269

raise KeyError()

1453

1270

1454

1271

def __getattribute__(self, name):

1455

if name == '_pipe':

1272

if(name == '_pipe'):

1456

1273

return super(ProxyClient, self).__getattribute__(name)

1457

1274

self._pipe.send(('getattr', name))

1458

1275

data = self._pipe.recv()

1465

1282

return func

1466

1283

1467

1284

def __setattr__(self, name, value):

1468

if name == '_pipe':

1285

if(name == '_pipe'):

1469

1286

return super(ProxyClient, self).__setattr__(name, value)

1470

1287

self._pipe.send(('setattr', name, value))

1471

1288

1472

1473

1289

class ClientDBusTransitional(ClientDBus):

1474

1290

__metaclass__ = AlternateDBusNamesMetaclass

1475

1291

1476

1477

1292

class ClientHandler(socketserver.BaseRequestHandler, object):

1478

1293

"""A class to handle client connections.

1479

1294

1547

1362

except KeyError:

1548

1363

return

1549

1364

1550

if self.server.use_dbus:

1551

# Emit D-Bus signal

1552

client.NewRequest(str(self.client_address))

1553

1554

1365

if client.approval_delay:

1555

1366

delay = client.approval_delay

1556

1367

client.approvals_pending += 1

1565

1376

client.Rejected("Disabled")

1566

1377

return

1567

1378

1568

if client.approved or not client.approval_delay:

1379

if client._approved or not client.approval_delay:

1569

1380

#We are approved or approval is disabled

1570

1381

break

1571

elif client.approved is None:

1382

elif client._approved is None:

1572

1383

logger.info("Client %s needs approval",

1573

1384

client.name)

1574

1385

if self.server.use_dbus:

1588

1399

time = datetime.datetime.now()

1589

1400

client.changedstate.acquire()

1590

1401

(client.changedstate.wait

1591

(float(client.timedelta_to_milliseconds(delay)

1402

(float(client._timedelta_to_milliseconds(delay)

1592

1403

/ 1000)))

1593

1404

client.changedstate.release()

1594

1405

time2 = datetime.datetime.now()

1693

1504

# Convert the buffer to a Python bytestring

1694

1505

fpr = ctypes.string_at(buf, buf_len.value)

1695

1506

# Convert the bytestring to hexadecimal notation

1696

hex_fpr = binascii.hexlify(fpr).upper()

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1697

1508

return hex_fpr

1698

1509

1699

1510

1702

1513

def sub_process_main(self, request, address):

1703

1514

try:

1704

1515

self.finish_request(request, address)

1705

except Exception:

1516

except:

1706

1517

self.handle_error(request, address)

1707

1518

self.close_request(request)

1708

1519

1813

1624

self.enabled = False

1814

1625

self.clients = clients

1815

1626

if self.clients is None:

1816

self.clients = {}

1627

self.clients = set()

1817

1628

self.use_dbus = use_dbus

1818

1629

self.gnutls_priority = gnutls_priority

1819

1630

IPv6_TCPServer.__init__(self, server_address,

1866

1677

fpr = request[1]

1867

1678

address = request[2]

1868

1679

1869

for c in self.clients.itervalues():

1680

for c in self.clients:

1870

1681

if c.fingerprint == fpr:

1871

1682

client = c

1872

1683

break

1956

1767

return timevalue

1957

1768

1958

1769

1770

def if_nametoindex(interface):

1771

"""Call the C function if_nametoindex(), or equivalent

1772

1773

Note: This function cannot accept a unicode string."""

1774

global if_nametoindex

1775

try:

1776

if_nametoindex = (ctypes.cdll.LoadLibrary

1777

(ctypes.util.find_library("c"))

1778

.if_nametoindex)

1779

except (OSError, AttributeError):

1780

logger.warning("Doing if_nametoindex the hard way")

1781

def if_nametoindex(interface):

1782

"Get an interface index the hard way, i.e. using fcntl()"

1783

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1784

with contextlib.closing(socket.socket()) as s:

1785

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1786

struct.pack(str("16s16x"),

1787

interface))

1788

interface_index = struct.unpack(str("I"),

1789

ifreq[16:20])[0]

1790

return interface_index

1791

return if_nametoindex(interface)

1792

1793

1959

1794

def daemon(nochdir = False, noclose = False):

1960

1795

"""See daemon(3). Standard BSD Unix function.

1961

1796

2016

1851

" system bus interface")

2017

1852

parser.add_argument("--no-ipv6", action="store_false",

2018

1853

dest="use_ipv6", help="Do not use IPv6")

2019

parser.add_argument("--no-restore", action="store_false",

2020

dest="restore", help="Do not restore stored"

2021

" state")

2022

parser.add_argument("--statedir", metavar="DIR",

2023

help="Directory to save/restore state in")

2024

2025

1854

options = parser.parse_args()

2026

1855

2027

1856

if options.check:

2040

1869

"use_dbus": "True",

2041

1870

"use_ipv6": "True",

2042

1871

"debuglevel": "",

2043

"restore": "True",

2044

"statedir": "/var/lib/mandos"

2045

1872

}

2046

1873

2047

1874

# Parse config file for server-global settings

2064

1891

# options, if set.

2065

1892

for option in ("interface", "address", "port", "debug",

2066

1893

"priority", "servicename", "configdir",

2067

"use_dbus", "use_ipv6", "debuglevel", "restore",

2068

"statedir"):

1894

"use_dbus", "use_ipv6", "debuglevel"):

2069

1895

value = getattr(options, option)

2070

1896

if value is not None:

2071

1897

server_settings[option] = value

2083

1909

debuglevel = server_settings["debuglevel"]

2084

1910

use_dbus = server_settings["use_dbus"]

2085

1911

use_ipv6 = server_settings["use_ipv6"]

2086

stored_state_path = os.path.join(server_settings["statedir"],

2087

stored_state_file)

2088

2089

if debug:

2090

initlogger(debug, logging.DEBUG)

2091

else:

2092

if not debuglevel:

2093

initlogger(debug)

2094

else:

2095

level = getattr(logging, debuglevel.upper())

2096

initlogger(debug, level)

2097

1912

2098

1913

if server_settings["servicename"] != "Mandos":

2099

1914

syslogger.setFormatter(logging.Formatter

2102

1917

% server_settings["servicename"]))

2103

1918

2104

1919

# Parse config file with clients

2105

client_config = configparser.SafeConfigParser(Client

2106

.client_defaults)

1920

client_defaults = { "timeout": "5m",

1921

"extended_timeout": "15m",

1922

"interval": "2m",

1923

"checker": "fping -q -- %%(host)s",

1924

"host": "",

1925

"approval_delay": "0s",

1926

"approval_duration": "1s",

1927

}

1928

client_config = configparser.SafeConfigParser(client_defaults)

2107

1929

client_config.read(os.path.join(server_settings["configdir"],

2108

1930

"clients.conf"))

2109

1931

2147

1969

if error[0] != errno.EPERM:

2148

1970

raise error

2149

1971

1972

if not debug and not debuglevel:

1973

syslogger.setLevel(logging.WARNING)

1974

console.setLevel(logging.WARNING)

1975

if debuglevel:

1976

level = getattr(logging, debuglevel.upper())

1977

syslogger.setLevel(level)

1978

console.setLevel(level)

1979

2150

1980

if debug:

2151

1981

# Enable all possible GnuTLS debugging

2152

1982

2166

1996

os.dup2(null, sys.stdin.fileno())

2167

1997

if null > 2:

2168

1998

os.close(null)

1999

else:

2000

# No console logging

2001

logger.removeHandler(console)

2169

2002

2170

2003

# Need to fork before connecting to D-Bus

2171

2004

if not debug:

2172

2005

# Close all input and output, do double fork, etc.

2173

2006

daemon()

2174

2007

2175

gobject.threads_init()

2176

2177

2008

global main_loop

2178

2009

# From the Avahi example code

2179

2010

DBusGMainLoop(set_as_default=True )

2193

2024

server_settings["use_dbus"] = False

2194

2025

tcp_server.use_dbus = False

2195

2026

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2196

service = AvahiServiceToSyslog(name =

2197

server_settings["servicename"],

2198

servicetype = "_mandos._tcp",

2199

protocol = protocol, bus = bus)

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

2029

protocol = protocol, bus = bus)

2200

2030

if server_settings["interface"]:

2201

2031

service.interface = (if_nametoindex

2202

2032

(str(server_settings["interface"])))

2208

2038

if use_dbus:

2209

2039

client_class = functools.partial(ClientDBusTransitional,

2210

2040

bus = bus)

2211

2212

client_settings = Client.config_parser(client_config)

2213

old_client_settings = {}

2214

clients_data = {}

2215

2216

# Get client data and settings from last running state.

2217

if server_settings["restore"]:

2218

try:

2219

with open(stored_state_path, "rb") as stored_state:

2220

clients_data, old_client_settings = (pickle.load

2221

(stored_state))

2222

os.remove(stored_state_path)

2223

except IOError as e:

2224

logger.warning("Could not load persistent state: {0}"

2225

.format(e))

2226

if e.errno != errno.ENOENT:

2227

raise

2228

except EOFError as e:

2229

logger.warning("Could not load persistent state: "

2230

"EOFError: {0}".format(e))

2231

2232

with PGPEngine() as pgp:

2233

for client_name, client in clients_data.iteritems():

2234

# Decide which value to use after restoring saved state.

2235

# We have three different values: Old config file,

2236

# new config file, and saved state.

2237

# New config value takes precedence if it differs from old

2238

# config value, otherwise use saved state.

2239

for name, value in client_settings[client_name].items():

2240

try:

2241

# For each value in new config, check if it

2242

# differs from the old config value (Except for

2243

# the "secret" attribute)

2244

if (name != "secret" and

2245

value != old_client_settings[client_name]

2246

[name]):

2247

client[name] = value

2248

except KeyError:

2249

pass

2250

2251

# Clients who has passed its expire date can still be

2252

# enabled if its last checker was successful. Clients

2253

# whose checker failed before we stored its state is

2254

# assumed to have failed all checkers during downtime.

2255

if client["enabled"]:

2256

if datetime.datetime.utcnow() >= client["expires"]:

2257

if not client["last_checked_ok"]:

2258

logger.warning(

2259

"disabling client {0} - Client never "

2260

"performed a successfull checker"

2261

.format(client["name"]))

2262

client["enabled"] = False

2263

elif client["last_checker_status"] != 0:

2264

logger.warning(

2265

"disabling client {0} - Client "

2266

"last checker failed with error code {1}"

2267

.format(client["name"],

2268

client["last_checker_status"]))

2269

client["enabled"] = False

2270

else:

2271

client["expires"] = (datetime.datetime

2272

.utcnow()

2273

+ client["timeout"])

2274

logger.debug("Last checker succeeded,"

2275

" keeping {0} enabled"

2276

.format(client["name"]))

2041

def client_config_items(config, section):

2042

special_settings = {

2043

"approved_by_default":

2044

lambda: config.getboolean(section,

2045

"approved_by_default"),

2046

}

2047

for name, value in config.items(section):

2277

2048

try:

2278

client["secret"] = (

2279

pgp.decrypt(client["encrypted_secret"],

2280

client_settings[client_name]

2281

["secret"]))

2282

except PGPError:

2283

# If decryption fails, we use secret from new settings

2284

logger.debug("Failed to decrypt {0} old secret"

2285

.format(client_name))

2286

client["secret"] = (

2287

client_settings[client_name]["secret"])

2288

2289

2290

# Add/remove clients based on new changes made to config

2291

for client_name in (set(old_client_settings)

2292

- set(client_settings)):

2293

del clients_data[client_name]

2294

for client_name in (set(client_settings)

2295

- set(old_client_settings)):

2296

clients_data[client_name] = client_settings[client_name]

2297

2298

# Create clients all clients

2299

for client_name, client in clients_data.iteritems():

2300

tcp_server.clients[client_name] = client_class(

2301

name = client_name, settings = client)

2302

2049

yield (name, special_settings[name]())

2050

except KeyError:

2051

yield (name, value)

2052

2053

tcp_server.clients.update(set(

2054

client_class(name = section,

2055

config= dict(client_config_items(

2056

client_config, section)))

2057

for section in client_config.sections()))

2303

2058

if not tcp_server.clients:

2304

2059

logger.warning("No clients defined")

2305

2060

2316

2071

# "pidfile" was never created

2317

2072

pass

2318

2073

del pidfilename

2074

2319

2075

signal.signal(signal.SIGINT, signal.SIG_IGN)

2320

2076

2321

2077

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2347

2103

def GetAllClients(self):

2348

2104

"D-Bus method"

2349

2105

return dbus.Array(c.dbus_object_path

2350

for c in

2351

tcp_server.clients.itervalues())

2106

for c in tcp_server.clients)

2352

2107

2353

2108

@dbus.service.method(_interface,

2354

2109

out_signature="a{oa{sv}}")

2356

2111

"D-Bus method"

2357

2112

return dbus.Dictionary(

2358

2113

((c.dbus_object_path, c.GetAll(""))

2359

for c in tcp_server.clients.itervalues()),

2114

for c in tcp_server.clients),

2360

2115

signature="oa{sv}")

2361

2116

2362

2117

@dbus.service.method(_interface, in_signature="o")

2363

2118

def RemoveClient(self, object_path):

2364

2119

"D-Bus method"

2365

for c in tcp_server.clients.itervalues():

2120

for c in tcp_server.clients:

2366

2121

if c.dbus_object_path == object_path:

2367

del tcp_server.clients[c.name]

2122

tcp_server.clients.remove(c)

2368

2123

c.remove_from_connection()

2369

2124

# Don't signal anything except ClientRemoved

2370

2125

c.disable(quiet=True)

2384

2139

service.cleanup()

2385

2140

2386

2141

multiprocessing.active_children()

2387

if not (tcp_server.clients or client_settings):

2388

return

2389

2390

# Store client before exiting. Secrets are encrypted with key

2391

# based on what config file has. If config file is

2392

# removed/edited, old secret will thus be unrecovable.

2393

clients = {}

2394

with PGPEngine() as pgp:

2395

for client in tcp_server.clients.itervalues():

2396

key = client_settings[client.name]["secret"]

2397

client.encrypted_secret = pgp.encrypt(client.secret,

2398

key)

2399

client_dict = {}

2400

2401

# A list of attributes that can not be pickled

2402

# + secret.

2403

exclude = set(("bus", "changedstate", "secret",

2404

"checker"))

2405

for name, typ in (inspect.getmembers

2406

(dbus.service.Object)):

2407

exclude.add(name)

2408

2409

client_dict["encrypted_secret"] = (client

2410

.encrypted_secret)

2411

for attr in client.client_structure:

2412

if attr not in exclude:

2413

client_dict[attr] = getattr(client, attr)

2414

2415

clients[client.name] = client_dict

2416

del client_settings[client.name]["secret"]

2417

2418

try:

2419

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2420

prefix="clients-",

2421

dir=os.path.dirname

2422

(stored_state_path))

2423

with os.fdopen(tempfd, "wb") as stored_state:

2424

pickle.dump((clients, client_settings), stored_state)

2425

os.rename(tempname, stored_state_path)

2426

except (IOError, OSError) as e:

2427

logger.warning("Could not save persistent state: {0}"

2428

.format(e))

2429

if not debug:

2430

try:

2431

os.remove(tempname)

2432

except NameError:

2433

pass

2434

if e.errno not in set((errno.ENOENT, errno.EACCES,

2435

errno.EEXIST)):

2436

raise e

2437

2438

# Delete all clients, and settings from config

2439

2142

while tcp_server.clients:

2440

name, client = tcp_server.clients.popitem()

2143

client = tcp_server.clients.pop()

2441

2144

if use_dbus:

2442

2145

client.remove_from_connection()

2146

client.disable_hook = None

2443

2147

# Don't signal anything except ClientRemoved

2444

2148

client.disable(quiet=True)

2445

2149

if use_dbus:

2447

2151

mandos_dbus_service.ClientRemoved(client

2448

2152

.dbus_object_path,

2449

2153

client.name)

2450

client_settings.clear()

2451

2154

2452

2155

atexit.register(cleanup)

2453

2156

2454

for client in tcp_server.clients.itervalues():

2157

for client in tcp_server.clients:

2455

2158

if use_dbus:

2456

2159

# Emit D-Bus signal

2457

2160

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2458

# Need to initiate checking of clients

2459

if client.enabled:

2460

client.init_checker()

2161

client.enable()

2461

2162

2462

2163

tcp_server.enable()

2463

2164

tcp_server.server_activate()

2503

2204

# Must run before the D-Bus bus name gets deregistered

2504

2205

cleanup()

2505

2206

2207

2506

2208

if __name__ == '__main__':

2507

2209

main()