To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.7.57
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.57
- Committer: Teddy Hogeborn
- Date: 2011-10-06 19:01:08 UTC
- mfrom: (237.11.5 teddy)
- mto: (237.12.2 mandos-persistent) (299.1.1 release) (300.1.1 release) (301.1.1 release)
- mto: This revision was merged to the branch mainline in revision 286.
- Revision ID: teddy@recompile.se-20111006190108-zlf8j730nahdh7c4
Bump debian policy version and fix whitespace.
- files removed:
- debian/source/local-options
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import binascii
67
import tempfile
68
66
69
67
import dbus
70
68
import dbus.service
75
73
import ctypes.util
76
74
import xml.dom.minidom
77
75
import inspect
78
import GnuPGInterface
79
76
80
77
try:
81
78
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
82
except ImportError:
86
83
SO_BINDTODEVICE = None
87
84
88
version = "1.4.1"
89
stored_state_file = "clients.pickle"
90
91
logger = logging.getLogger()
85
86
version = "1.3.1"
87
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
92
90
syslogger = (logging.handlers.SysLogHandler
93
91
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
92
address = str("/dev/log")))
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(debug, level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
if debug:
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet'])
146
147
def __enter__(self):
148
return self
149
150
def __exit__ (self, exc_type, exc_value, traceback):
151
self._cleanup()
152
return False
153
154
def __del__(self):
155
self._cleanup()
156
157
def _cleanup(self):
158
if self.tempdir is not None:
159
# Delete contents of tempdir
160
for root, dirs, files in os.walk(self.tempdir,
161
topdown = False):
162
for filename in files:
163
os.remove(os.path.join(root, filename))
164
for dirname in dirs:
165
os.rmdir(os.path.join(root, dirname))
166
# Remove tempdir
167
os.rmdir(self.tempdir)
168
self.tempdir = None
169
170
def password_encode(self, password):
171
# Passphrase can not be empty and can not contain newlines or
172
# NUL bytes. So we prefix it and hex encode it.
173
return b"mandos" + binascii.hexlify(password)
174
175
def encrypt(self, data, password):
176
self.gnupg.passphrase = self.password_encode(password)
177
with open(os.devnull) as devnull:
178
try:
179
proc = self.gnupg.run(['--symmetric'],
180
create_fhs=['stdin', 'stdout'],
181
attach_fhs={'stderr': devnull})
182
with contextlib.closing(proc.handles['stdin']) as f:
183
f.write(data)
184
with contextlib.closing(proc.handles['stdout']) as f:
185
ciphertext = f.read()
186
proc.wait()
187
except IOError as e:
188
raise PGPError(e)
189
self.gnupg.passphrase = None
190
return ciphertext
191
192
def decrypt(self, data, password):
193
self.gnupg.passphrase = self.password_encode(password)
194
with open(os.devnull) as devnull:
195
try:
196
proc = self.gnupg.run(['--decrypt'],
197
create_fhs=['stdin', 'stdout'],
198
attach_fhs={'stderr': devnull})
199
with contextlib.closing(proc.handles['stdin'] ) as f:
200
f.write(data)
201
with contextlib.closing(proc.handles['stdout']) as f:
202
decrypted_plaintext = f.read()
203
proc.wait()
204
except IOError as e:
205
raise PGPError(e)
206
self.gnupg.passphrase = None
207
return decrypted_plaintext
208
209
93
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
96
logger.addHandler(syslogger)
97
98
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
102
logger.addHandler(console)
210
103
211
104
class AvahiError(Exception):
212
105
def __init__(self, value, *args, **kwargs):
271
164
.GetAlternativeServiceName(self.name))
272
165
logger.info("Changing Zeroconf service name to %r ...",
273
166
self.name)
167
syslogger.setFormatter(logging.Formatter
168
('Mandos (%s) [%%(process)d]:'
169
' %%(levelname)s: %%(message)s'
170
% self.name))
274
171
self.remove()
275
172
try:
276
173
self.add()
296
193
avahi.DBUS_INTERFACE_ENTRY_GROUP)
297
194
self.entry_group_state_changed_match = (
298
195
self.group.connect_to_signal(
299
'StateChanged', self.entry_group_state_changed))
196
'StateChanged', self .entry_group_state_changed))
300
197
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
301
198
self.name, self.type)
302
199
self.group.AddService(
328
225
try:
329
226
self.group.Free()
330
227
except (dbus.exceptions.UnknownMethodException,
331
dbus.exceptions.DBusException):
228
dbus.exceptions.DBusException) as e:
332
229
pass
333
230
self.group = None
334
231
self.remove()
368
265
self.server_state_changed)
369
266
self.server_state_changed(self.server.GetState())
370
267
371
class AvahiServiceToSyslog(AvahiService):
372
def rename(self):
373
"""Add the new name to the syslog messages"""
374
ret = AvahiService.rename(self)
375
syslogger.setFormatter(logging.Formatter
376
('Mandos (%s) [%%(process)d]:'
377
' %%(levelname)s: %%(message)s'
378
% self.name))
379
return ret
380
268
381
def timedelta_to_milliseconds(td):
269
def _timedelta_to_milliseconds(td):
382
270
"Convert a datetime.timedelta() to milliseconds"
383
271
return ((td.days * 24 * 60 * 60 * 1000)
384
272
+ (td.seconds * 1000)
388
276
"""A representation of a client host served by this server.
389
277
390
278
Attributes:
391
approved: bool(); 'None' if not yet approved/disapproved
279
_approved: bool(); 'None' if not yet approved/disapproved
392
280
approval_delay: datetime.timedelta(); Time to wait for approval
393
281
approval_duration: datetime.timedelta(); Duration of one approval
394
282
checker: subprocess.Popen(); a running checker process used
401
289
instance %(name)s can be used in the command.
402
290
checker_initiator_tag: a gobject event source tag, or None
403
291
created: datetime.datetime(); (UTC) object creation
404
client_structure: Object describing what attributes a client has
405
and is used for storing the client at exit
406
292
current_checker_command: string; current running checker_command
293
disable_hook: If set, called by disable() as disable_hook(self)
407
294
disable_initiator_tag: a gobject event source tag, or None
408
295
enabled: bool()
409
296
fingerprint: string (40 or 32 hexadecimal digits); used to
412
299
interval: datetime.timedelta(); How often to start a new checker
413
300
last_approval_request: datetime.datetime(); (UTC) or None
414
301
last_checked_ok: datetime.datetime(); (UTC) or None
415
last_checker_status: integer between 0 and 255 reflecting exit
416
status of last checker. -1 reflects crashed
417
checker, or None.
418
last_enabled: datetime.datetime(); (UTC) or None
302
last_enabled: datetime.datetime(); (UTC)
419
303
name: string; from the config file, used in log messages and
420
304
D-Bus identifiers
421
305
secret: bytestring; sent verbatim (over TLS) to client
431
315
"created", "enabled", "fingerprint",
432
316
"host", "interval", "last_checked_ok",
433
317
"last_enabled", "name", "timeout")
434
client_defaults = { "timeout": "5m",
435
"extended_timeout": "15m",
436
"interval": "2m",
437
"checker": "fping -q -- %%(host)s",
438
"host": "",
439
"approval_delay": "0s",
440
"approval_duration": "1s",
441
"approved_by_default": "True",
442
"enabled": "True",
443
}
444
318
445
319
def timeout_milliseconds(self):
446
320
"Return the 'timeout' attribute in milliseconds"
447
return timedelta_to_milliseconds(self.timeout)
321
return _timedelta_to_milliseconds(self.timeout)
448
322
449
323
def extended_timeout_milliseconds(self):
450
324
"Return the 'extended_timeout' attribute in milliseconds"
451
return timedelta_to_milliseconds(self.extended_timeout)
325
return _timedelta_to_milliseconds(self.extended_timeout)
452
326
453
327
def interval_milliseconds(self):
454
328
"Return the 'interval' attribute in milliseconds"
455
return timedelta_to_milliseconds(self.interval)
329
return _timedelta_to_milliseconds(self.interval)
456
330
457
331
def approval_delay_milliseconds(self):
458
return timedelta_to_milliseconds(self.approval_delay)
459
460
@staticmethod
461
def config_parser(config):
462
""" Construct a new dict of client settings of this form:
463
{ client_name: {setting_name: value, ...}, ...}
464
with exceptions for any special settings as defined above"""
465
settings = {}
466
for client_name in config.sections():
467
section = dict(config.items(client_name))
468
client = settings[client_name] = {}
469
470
client["host"] = section["host"]
471
# Reformat values from string types to Python types
472
client["approved_by_default"] = config.getboolean(
473
client_name, "approved_by_default")
474
client["enabled"] = config.getboolean(client_name, "enabled")
475
476
client["fingerprint"] = (section["fingerprint"].upper()
477
.replace(" ", ""))
478
if "secret" in section:
479
client["secret"] = section["secret"].decode("base64")
480
elif "secfile" in section:
481
with open(os.path.expanduser(os.path.expandvars
482
(section["secfile"])),
483
"rb") as secfile:
484
client["secret"] = secfile.read()
485
else:
486
raise TypeError("No secret or secfile for section %s"
487
% section)
488
client["timeout"] = string_to_delta(section["timeout"])
489
client["extended_timeout"] = string_to_delta(
490
section["extended_timeout"])
491
client["interval"] = string_to_delta(section["interval"])
492
client["approval_delay"] = string_to_delta(
493
section["approval_delay"])
494
client["approval_duration"] = string_to_delta(
495
section["approval_duration"])
496
client["checker_command"] = section["checker"]
497
client["last_approval_request"] = None
498
client["last_checked_ok"] = None
499
client["last_checker_status"] = None
500
if client["enabled"]:
501
client["last_enabled"] = datetime.datetime.utcnow()
502
client["expires"] = (datetime.datetime.utcnow()
503
+ client["timeout"])
504
else:
505
client["last_enabled"] = None
506
client["expires"] = None
507
508
return settings
509
510
511
def __init__(self, settings, name = None):
332
return _timedelta_to_milliseconds(self.approval_delay)
333
334
def __init__(self, name = None, disable_hook=None, config=None):
512
335
"""Note: the 'checker' key in 'config' sets the
513
336
'checker_command' attribute and *not* the 'checker'
514
337
attribute."""
515
338
self.name = name
516
# adding all client settings
517
for setting, value in settings.iteritems():
518
setattr(self, setting, value)
519
339
if config is None:
340
config = {}
520
341
logger.debug("Creating client %r", self.name)
521
342
# Uppercase and remove spaces from fingerprint for later
522
343
# comparison purposes with return value from the fingerprint()
523
344
# function
345
self.fingerprint = (config["fingerprint"].upper()
346
.replace(" ", ""))
524
347
logger.debug(" Fingerprint: %s", self.fingerprint)
525
self.created = settings.get("created", datetime.datetime.utcnow())
526
527
# attributes specific for this server instance
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
351
with open(os.path.expanduser(os.path.expandvars
352
(config["secfile"])),
353
"rb") as secfile:
354
self.secret = secfile.read()
355
else:
356
raise TypeError("No secret or secfile for client %s"
357
% self.name)
358
self.host = config.get("host", "")
359
self.created = datetime.datetime.utcnow()
360
self.enabled = False
361
self.last_approval_request = None
362
self.last_enabled = None
363
self.last_checked_ok = None
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
368
self.disable_hook = disable_hook
528
369
self.checker = None
529
370
self.checker_initiator_tag = None
530
371
self.disable_initiator_tag = None
372
self.expires = None
531
373
self.checker_callback_tag = None
374
self.checker_command = config["checker"]
532
375
self.current_checker_command = None
533
self.approved = None
376
self.last_connect = None
377
self._approved = None
378
self.approved_by_default = config.get("approved_by_default",
379
True)
534
380
self.approvals_pending = 0
381
self.approval_delay = string_to_delta(
382
config["approval_delay"])
383
self.approval_duration = string_to_delta(
384
config["approval_duration"])
535
385
self.changedstate = (multiprocessing_manager
536
386
.Condition(multiprocessing_manager
537
387
.Lock()))
538
self.client_structure = [attr for attr in
539
self.__dict__.iterkeys()
540
if not attr.startswith("_")]
541
self.client_structure.append("client_structure")
542
543
for name, t in inspect.getmembers(type(self),
544
lambda obj:
545
isinstance(obj,
546
property)):
547
if not name.startswith("_"):
548
self.client_structure.append(name)
549
388
550
# Send notice to process children that client state has changed
551
389
def send_changedstate(self):
552
with self.changedstate:
553
self.changedstate.notify_all()
390
self.changedstate.acquire()
391
self.changedstate.notify_all()
392
self.changedstate.release()
554
393
555
394
def enable(self):
556
395
"""Start this client's checker and timeout hooks"""
558
397
# Already enabled
559
398
return
560
399
self.send_changedstate()
400
# Schedule a new checker to be started an 'interval' from now,
401
# and every interval from then on.
402
self.checker_initiator_tag = (gobject.timeout_add
403
(self.interval_milliseconds(),
404
self.start_checker))
405
# Schedule a disable() when 'timeout' has passed
561
406
self.expires = datetime.datetime.utcnow() + self.timeout
407
self.disable_initiator_tag = (gobject.timeout_add
408
(self.timeout_milliseconds(),
409
self.disable))
562
410
self.enabled = True
563
411
self.last_enabled = datetime.datetime.utcnow()
564
self.init_checker()
412
# Also start a new checker *right now*.
413
self.start_checker()
565
414
566
415
def disable(self, quiet=True):
567
416
"""Disable this client."""
579
428
gobject.source_remove(self.checker_initiator_tag)
580
429
self.checker_initiator_tag = None
581
430
self.stop_checker()
431
if self.disable_hook:
432
self.disable_hook(self)
582
433
self.enabled = False
583
434
# Do not run this again if called by a gobject.timeout_add
584
435
return False
585
436
586
437
def __del__(self):
438
self.disable_hook = None
587
439
self.disable()
588
440
589
def init_checker(self):
590
# Schedule a new checker to be started an 'interval' from now,
591
# and every interval from then on.
592
self.checker_initiator_tag = (gobject.timeout_add
593
(self.interval_milliseconds(),
594
self.start_checker))
595
# Schedule a disable() when 'timeout' has passed
596
self.disable_initiator_tag = (gobject.timeout_add
597
(self.timeout_milliseconds(),
598
self.disable))
599
# Also start a new checker *right now*.
600
self.start_checker()
601
602
441
def checker_callback(self, pid, condition, command):
603
442
"""The checker has completed, so take appropriate actions."""
604
443
self.checker_callback_tag = None
605
444
self.checker = None
606
445
if os.WIFEXITED(condition):
607
self.last_checker_status = os.WEXITSTATUS(condition)
608
if self.last_checker_status == 0:
446
exitstatus = os.WEXITSTATUS(condition)
447
if exitstatus == 0:
609
448
logger.info("Checker for %(name)s succeeded",
610
449
vars(self))
611
450
self.checked_ok()
613
452
logger.info("Checker for %(name)s failed",
614
453
vars(self))
615
454
else:
616
self.last_checker_status = -1
617
455
logger.warning("Checker for %(name)s crashed?",
618
456
vars(self))
619
457
626
464
if timeout is None:
627
465
timeout = self.timeout
628
466
self.last_checked_ok = datetime.datetime.utcnow()
629
if self.disable_initiator_tag is not None:
630
gobject.source_remove(self.disable_initiator_tag)
631
if getattr(self, "enabled", False):
632
self.disable_initiator_tag = (gobject.timeout_add
633
(timedelta_to_milliseconds
634
(timeout), self.disable))
635
self.expires = datetime.datetime.utcnow() + timeout
467
gobject.source_remove(self.disable_initiator_tag)
468
self.expires = datetime.datetime.utcnow() + timeout
469
self.disable_initiator_tag = (gobject.timeout_add
470
(_timedelta_to_milliseconds
471
(timeout), self.disable))
636
472
637
473
def need_approval(self):
638
474
self.last_approval_request = datetime.datetime.utcnow()
853
689
854
690
Note: Will not include properties with access="write".
855
691
"""
856
properties = {}
692
all = {}
857
693
for name, prop in self._get_all_dbus_properties():
858
694
if (interface_name
859
695
and interface_name != prop._dbus_interface):
864
700
continue
865
701
value = prop()
866
702
if not hasattr(value, "variant_level"):
867
properties[name] = value
703
all[name] = value
868
704
continue
869
properties[name] = type(value)(value, variant_level=
870
value.variant_level+1)
871
return dbus.Dictionary(properties, signature="sv")
705
all[name] = type(value)(value, variant_level=
706
value.variant_level+1)
707
return dbus.Dictionary(all, signature="sv")
872
708
873
709
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
874
710
out_signature="s",
925
761
return dbus.String(dt.isoformat(),
926
762
variant_level=variant_level)
927
763
928
929
764
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
930
765
.__metaclass__):
931
766
"""Applied to an empty subclass of a D-Bus object, this metaclass
1023
858
attribute.func_closure)))
1024
859
return type.__new__(mcs, name, bases, attr)
1025
860
1026
1027
861
class ClientDBus(Client, DBusObjectWithProperties):
1028
862
"""A Client class using D-Bus
1029
863
1038
872
# dbus.service.Object doesn't use super(), so we can't either.
1039
873
1040
874
def __init__(self, bus = None, *args, **kwargs):
875
self._approvals_pending = 0
1041
876
self.bus = bus
1042
877
Client.__init__(self, *args, **kwargs)
1043
self._approvals_pending = 0
1044
1045
self._approvals_pending = 0
1046
878
# Only now, when this client is initialized, can it show up on
1047
879
# the D-Bus
1048
880
client_object_name = unicode(self.name).translate(
1058
890
variant_level=1):
1059
891
""" Modify a variable so that it's a property which announces
1060
892
its changes to DBus.
1061
1062
transform_fun: Function that takes a value and a variant_level
1063
and transforms it to a D-Bus type.
893
894
transform_fun: Function that takes a value and transforms it
895
to a D-Bus type.
1064
896
dbus_name: D-Bus name of the variable
1065
897
type_func: Function that transform the value before sending it
1066
898
to the D-Bus. Default: no transform
1067
899
variant_level: D-Bus variant level. Default: 1
1068
900
"""
1069
attrname = "_{0}".format(dbus_name)
901
real_value = [None,]
1070
902
def setter(self, value):
903
old_value = real_value[0]
904
real_value[0] = value
1071
905
if hasattr(self, "dbus_object_path"):
1072
if (not hasattr(self, attrname) or
1073
type_func(getattr(self, attrname, None))
1074
!= type_func(value)):
1075
dbus_value = transform_func(type_func(value),
1076
variant_level
1077
=variant_level)
906
if type_func(old_value) != type_func(real_value[0]):
907
dbus_value = transform_func(type_func
908
(real_value[0]),
909
variant_level)
1078
910
self.PropertyChanged(dbus.String(dbus_name),
1079
911
dbus_value)
1080
setattr(self, attrname, value)
1081
912
1082
return property(lambda self: getattr(self, attrname), setter)
913
return property(lambda self: real_value[0], setter)
1083
914
1084
915
1085
916
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1098
929
datetime_to_dbus, "LastApprovalRequest")
1099
930
approved_by_default = notifychangeproperty(dbus.Boolean,
1100
931
"ApprovedByDefault")
1101
approval_delay = notifychangeproperty(dbus.UInt64,
932
approval_delay = notifychangeproperty(dbus.UInt16,
1102
933
"ApprovalDelay",
1103
934
type_func =
1104
timedelta_to_milliseconds)
935
_timedelta_to_milliseconds)
1105
936
approval_duration = notifychangeproperty(
1106
dbus.UInt64, "ApprovalDuration",
1107
type_func = timedelta_to_milliseconds)
937
dbus.UInt16, "ApprovalDuration",
938
type_func = _timedelta_to_milliseconds)
1108
939
host = notifychangeproperty(dbus.String, "Host")
1109
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
940
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1110
941
type_func =
1111
timedelta_to_milliseconds)
942
_timedelta_to_milliseconds)
1112
943
extended_timeout = notifychangeproperty(
1113
dbus.UInt64, "ExtendedTimeout",
1114
type_func = timedelta_to_milliseconds)
1115
interval = notifychangeproperty(dbus.UInt64,
944
dbus.UInt16, "ExtendedTimeout",
945
type_func = _timedelta_to_milliseconds)
946
interval = notifychangeproperty(dbus.UInt16,
1116
947
"Interval",
1117
948
type_func =
1118
timedelta_to_milliseconds)
949
_timedelta_to_milliseconds)
1119
950
checker_command = notifychangeproperty(dbus.String, "Checker")
1120
951
1121
952
del notifychangeproperty
1163
994
return r
1164
995
1165
996
def _reset_approved(self):
1166
self.approved = None
997
self._approved = None
1167
998
return False
1168
999
1169
1000
def approve(self, value=True):
1170
1001
self.send_changedstate()
1171
self.approved = value
1172
gobject.timeout_add(timedelta_to_milliseconds
1002
self._approved = value
1003
gobject.timeout_add(_timedelta_to_milliseconds
1173
1004
(self.approval_duration),
1174
1005
self._reset_approved)
1175
1006
1218
1049
"D-Bus signal"
1219
1050
return self.need_approval()
1220
1051
1221
# NeRwequest - signal
1222
@dbus.service.signal(_interface, signature="s")
1223
def NewRequest(self, ip):
1224
"""D-Bus signal
1225
Is sent after a client request a password.
1226
"""
1227
pass
1228
1229
1052
## Methods
1230
1053
1231
1054
# Approve - method
1289
1112
access="readwrite")
1290
1113
def ApprovalDuration_dbus_property(self, value=None):
1291
1114
if value is None: # get
1292
return dbus.UInt64(timedelta_to_milliseconds(
1115
return dbus.UInt64(_timedelta_to_milliseconds(
1293
1116
self.approval_duration))
1294
1117
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1295
1118
1309
1132
def Host_dbus_property(self, value=None):
1310
1133
if value is None: # get
1311
1134
return dbus.String(self.host)
1312
self.host = unicode(value)
1135
self.host = value
1313
1136
1314
1137
# Created - property
1315
1138
@dbus_service_property(_interface, signature="s", access="read")
1316
1139
def Created_dbus_property(self):
1317
return datetime_to_dbus(self.created)
1140
return dbus.String(datetime_to_dbus(self.created))
1318
1141
1319
1142
# LastEnabled - property
1320
1143
@dbus_service_property(_interface, signature="s", access="read")
1364
1187
gobject.source_remove(self.disable_initiator_tag)
1365
1188
self.disable_initiator_tag = None
1366
1189
self.expires = None
1367
time_to_die = timedelta_to_milliseconds((self
1368
.last_checked_ok
1369
+ self.timeout)
1370
- datetime.datetime
1371
.utcnow())
1190
time_to_die = (self.
1191
_timedelta_to_milliseconds((self
1192
.last_checked_ok
1193
+ self.timeout)
1194
- datetime.datetime
1195
.utcnow()))
1372
1196
if time_to_die <= 0:
1373
1197
# The timeout has passed
1374
1198
self.disable()
1396
1220
self.interval = datetime.timedelta(0, 0, 0, value)
1397
1221
if getattr(self, "checker_initiator_tag", None) is None:
1398
1222
return
1399
if self.enabled:
1400
# Reschedule checker run
1401
gobject.source_remove(self.checker_initiator_tag)
1402
self.checker_initiator_tag = (gobject.timeout_add
1403
(value, self.start_checker))
1404
self.start_checker() # Start one now, too
1223
# Reschedule checker run
1224
gobject.source_remove(self.checker_initiator_tag)
1225
self.checker_initiator_tag = (gobject.timeout_add
1226
(value, self.start_checker))
1227
self.start_checker() # Start one now, too
1405
1228
1406
1229
# Checker - property
1407
1230
@dbus_service_property(_interface, signature="s",
1409
1232
def Checker_dbus_property(self, value=None):
1410
1233
if value is None: # get
1411
1234
return dbus.String(self.checker_command)
1412
self.checker_command = unicode(value)
1235
self.checker_command = value
1413
1236
1414
1237
# CheckerRunning - property
1415
1238
@dbus_service_property(_interface, signature="b",
1444
1267
raise KeyError()
1445
1268
1446
1269
def __getattribute__(self, name):
1447
if name == '_pipe':
1270
if(name == '_pipe'):
1448
1271
return super(ProxyClient, self).__getattribute__(name)
1449
1272
self._pipe.send(('getattr', name))
1450
1273
data = self._pipe.recv()
1457
1280
return func
1458
1281
1459
1282
def __setattr__(self, name, value):
1460
if name == '_pipe':
1283
if(name == '_pipe'):
1461
1284
return super(ProxyClient, self).__setattr__(name, value)
1462
1285
self._pipe.send(('setattr', name, value))
1463
1286
1464
1465
1287
class ClientDBusTransitional(ClientDBus):
1466
1288
__metaclass__ = AlternateDBusNamesMetaclass
1467
1289
1468
1469
1290
class ClientHandler(socketserver.BaseRequestHandler, object):
1470
1291
"""A class to handle client connections.
1471
1292
1539
1360
except KeyError:
1540
1361
return
1541
1362
1542
if self.server.use_dbus:
1543
# Emit D-Bus signal
1544
client.NewRequest(str(self.client_address))
1545
1546
1363
if client.approval_delay:
1547
1364
delay = client.approval_delay
1548
1365
client.approvals_pending += 1
1557
1374
client.Rejected("Disabled")
1558
1375
return
1559
1376
1560
if client.approved or not client.approval_delay:
1377
if client._approved or not client.approval_delay:
1561
1378
#We are approved or approval is disabled
1562
1379
break
1563
elif client.approved is None:
1380
elif client._approved is None:
1564
1381
logger.info("Client %s needs approval",
1565
1382
client.name)
1566
1383
if self.server.use_dbus:
1577
1394
return
1578
1395
1579
1396
#wait until timeout or approved
1397
#x = float(client
1398
# ._timedelta_to_milliseconds(delay))
1580
1399
time = datetime.datetime.now()
1581
1400
client.changedstate.acquire()
1582
1401
(client.changedstate.wait
1583
(float(client.timedelta_to_milliseconds(delay)
1402
(float(client._timedelta_to_milliseconds(delay)
1584
1403
/ 1000)))
1585
1404
client.changedstate.release()
1586
1405
time2 = datetime.datetime.now()
1611
1430
sent_size += sent
1612
1431
1613
1432
logger.info("Sending secret to %s", client.name)
1614
# bump the timeout using extended_timeout
1433
# bump the timeout as if seen
1615
1434
client.checked_ok(client.extended_timeout)
1616
1435
if self.server.use_dbus:
1617
1436
# Emit D-Bus signal
1685
1504
# Convert the buffer to a Python bytestring
1686
1505
fpr = ctypes.string_at(buf, buf_len.value)
1687
1506
# Convert the bytestring to hexadecimal notation
1688
hex_fpr = binascii.hexlify(fpr).upper()
1507
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1689
1508
return hex_fpr
1690
1509
1691
1510
1694
1513
def sub_process_main(self, request, address):
1695
1514
try:
1696
1515
self.finish_request(request, address)
1697
except Exception:
1516
except:
1698
1517
self.handle_error(request, address)
1699
1518
self.close_request(request)
1700
1519
1701
1520
def process_request(self, request, address):
1702
1521
"""Start a new process to process the request."""
1703
proc = multiprocessing.Process(target = self.sub_process_main,
1704
args = (request,
1705
address))
1706
proc.start()
1707
return proc
1522
multiprocessing.Process(target = self.sub_process_main,
1523
args = (request, address)).start()
1708
1524
1709
1525
1710
1526
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1716
1532
"""
1717
1533
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1718
1534
1719
proc = MultiprocessingMixIn.process_request(self, request,
1720
client_address)
1535
super(MultiprocessingMixInWithPipe,
1536
self).process_request(request, client_address)
1721
1537
self.child_pipe.close()
1722
self.add_pipe(parent_pipe, proc)
1538
self.add_pipe(parent_pipe)
1723
1539
1724
def add_pipe(self, parent_pipe, proc):
1540
def add_pipe(self, parent_pipe):
1725
1541
"""Dummy function; override as necessary"""
1726
1542
raise NotImplementedError
1727
1543
1805
1621
self.enabled = False
1806
1622
self.clients = clients
1807
1623
if self.clients is None:
1808
self.clients = {}
1624
self.clients = set()
1809
1625
self.use_dbus = use_dbus
1810
1626
self.gnutls_priority = gnutls_priority
1811
1627
IPv6_TCPServer.__init__(self, server_address,
1815
1631
def server_activate(self):
1816
1632
if self.enabled:
1817
1633
return socketserver.TCPServer.server_activate(self)
1818
1819
1634
def enable(self):
1820
1635
self.enabled = True
1821
1822
def add_pipe(self, parent_pipe, proc):
1636
def add_pipe(self, parent_pipe):
1823
1637
# Call "handle_ipc" for both data and EOF events
1824
1638
gobject.io_add_watch(parent_pipe.fileno(),
1825
1639
gobject.IO_IN | gobject.IO_HUP,
1826
1640
functools.partial(self.handle_ipc,
1827
1641
parent_pipe =
1828
parent_pipe,
1829
proc = proc))
1830
1642
parent_pipe))
1643
1831
1644
def handle_ipc(self, source, condition, parent_pipe=None,
1832
proc = None, client_object=None):
1645
client_object=None):
1833
1646
condition_names = {
1834
1647
gobject.IO_IN: "IN", # There is data to read.
1835
1648
gobject.IO_OUT: "OUT", # Data can be written (without
1844
1657
for cond, name in
1845
1658
condition_names.iteritems()
1846
1659
if cond & condition)
1847
# error, or the other end of multiprocessing.Pipe has closed
1660
# error or the other end of multiprocessing.Pipe has closed
1848
1661
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1849
# Wait for other process to exit
1850
proc.join()
1851
1662
return False
1852
1663
1853
1664
# Read a request from the child
1858
1669
fpr = request[1]
1859
1670
address = request[2]
1860
1671
1861
for c in self.clients.itervalues():
1672
for c in self.clients:
1862
1673
if c.fingerprint == fpr:
1863
1674
client = c
1864
1675
break
1877
1688
functools.partial(self.handle_ipc,
1878
1689
parent_pipe =
1879
1690
parent_pipe,
1880
proc = proc,
1881
1691
client_object =
1882
1692
client))
1883
1693
parent_pipe.send(True)
1948
1758
return timevalue
1949
1759
1950
1760
1761
def if_nametoindex(interface):
1762
"""Call the C function if_nametoindex(), or equivalent
1763
1764
Note: This function cannot accept a unicode string."""
1765
global if_nametoindex
1766
try:
1767
if_nametoindex = (ctypes.cdll.LoadLibrary
1768
(ctypes.util.find_library("c"))
1769
.if_nametoindex)
1770
except (OSError, AttributeError):
1771
logger.warning("Doing if_nametoindex the hard way")
1772
def if_nametoindex(interface):
1773
"Get an interface index the hard way, i.e. using fcntl()"
1774
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1775
with contextlib.closing(socket.socket()) as s:
1776
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1777
struct.pack(str("16s16x"),
1778
interface))
1779
interface_index = struct.unpack(str("I"),
1780
ifreq[16:20])[0]
1781
return interface_index
1782
return if_nametoindex(interface)
1783
1784
1951
1785
def daemon(nochdir = False, noclose = False):
1952
1786
"""See daemon(3). Standard BSD Unix function.
1953
1787
2008
1842
" system bus interface")
2009
1843
parser.add_argument("--no-ipv6", action="store_false",
2010
1844
dest="use_ipv6", help="Do not use IPv6")
2011
parser.add_argument("--no-restore", action="store_false",
2012
dest="restore", help="Do not restore stored"
2013
" state")
2014
parser.add_argument("--statedir", metavar="DIR",
2015
help="Directory to save/restore state in")
2016
2017
1845
options = parser.parse_args()
2018
1846
2019
1847
if options.check:
2032
1860
"use_dbus": "True",
2033
1861
"use_ipv6": "True",
2034
1862
"debuglevel": "",
2035
"restore": "True",
2036
"statedir": "/var/lib/mandos"
2037
1863
}
2038
1864
2039
1865
# Parse config file for server-global settings
2056
1882
# options, if set.
2057
1883
for option in ("interface", "address", "port", "debug",
2058
1884
"priority", "servicename", "configdir",
2059
"use_dbus", "use_ipv6", "debuglevel", "restore",
2060
"statedir"):
1885
"use_dbus", "use_ipv6", "debuglevel"):
2061
1886
value = getattr(options, option)
2062
1887
if value is not None:
2063
1888
server_settings[option] = value
2075
1900
debuglevel = server_settings["debuglevel"]
2076
1901
use_dbus = server_settings["use_dbus"]
2077
1902
use_ipv6 = server_settings["use_ipv6"]
2078
stored_state_path = os.path.join(server_settings["statedir"],
2079
stored_state_file)
2080
2081
if debug:
2082
initlogger(debug, logging.DEBUG)
2083
else:
2084
if not debuglevel:
2085
initlogger(debug)
2086
else:
2087
level = getattr(logging, debuglevel.upper())
2088
initlogger(debug, level)
2089
1903
2090
1904
if server_settings["servicename"] != "Mandos":
2091
1905
syslogger.setFormatter(logging.Formatter
2094
1908
% server_settings["servicename"]))
2095
1909
2096
1910
# Parse config file with clients
2097
client_config = configparser.SafeConfigParser(Client.client_defaults)
1911
client_defaults = { "timeout": "5m",
1912
"extended_timeout": "15m",
1913
"interval": "2m",
1914
"checker": "fping -q -- %%(host)s",
1915
"host": "",
1916
"approval_delay": "0s",
1917
"approval_duration": "1s",
1918
}
1919
client_config = configparser.SafeConfigParser(client_defaults)
2098
1920
client_config.read(os.path.join(server_settings["configdir"],
2099
1921
"clients.conf"))
2100
1922
2138
1960
if error[0] != errno.EPERM:
2139
1961
raise error
2140
1962
1963
if not debug and not debuglevel:
1964
syslogger.setLevel(logging.WARNING)
1965
console.setLevel(logging.WARNING)
1966
if debuglevel:
1967
level = getattr(logging, debuglevel.upper())
1968
syslogger.setLevel(level)
1969
console.setLevel(level)
1970
2141
1971
if debug:
2142
1972
# Enable all possible GnuTLS debugging
2143
1973
2157
1987
os.dup2(null, sys.stdin.fileno())
2158
1988
if null > 2:
2159
1989
os.close(null)
1990
else:
1991
# No console logging
1992
logger.removeHandler(console)
2160
1993
2161
1994
# Need to fork before connecting to D-Bus
2162
1995
if not debug:
2163
1996
# Close all input and output, do double fork, etc.
2164
1997
daemon()
2165
1998
2166
gobject.threads_init()
2167
2168
1999
global main_loop
2169
2000
# From the Avahi example code
2170
2001
DBusGMainLoop(set_as_default=True )
2184
2015
server_settings["use_dbus"] = False
2185
2016
tcp_server.use_dbus = False
2186
2017
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2187
service = AvahiServiceToSyslog(name =
2188
server_settings["servicename"],
2189
servicetype = "_mandos._tcp",
2190
protocol = protocol, bus = bus)
2018
service = AvahiService(name = server_settings["servicename"],
2019
servicetype = "_mandos._tcp",
2020
protocol = protocol, bus = bus)
2191
2021
if server_settings["interface"]:
2192
2022
service.interface = (if_nametoindex
2193
2023
(str(server_settings["interface"])))
2199
2029
if use_dbus:
2200
2030
client_class = functools.partial(ClientDBusTransitional,
2201
2031
bus = bus)
2202
2203
client_settings = Client.config_parser(client_config)
2204
old_client_settings = {}
2205
clients_data = {}
2206
2207
# Get client data and settings from last running state.
2208
if server_settings["restore"]:
2209
try:
2210
with open(stored_state_path, "rb") as stored_state:
2211
clients_data, old_client_settings = (pickle.load
2212
(stored_state))
2213
os.remove(stored_state_path)
2214
except IOError as e:
2215
logger.warning("Could not load persistent state: {0}"
2216
.format(e))
2217
if e.errno != errno.ENOENT:
2218
raise
2219
except EOFError as e:
2220
logger.warning("Could not load persistent state: "
2221
"EOFError: {0}".format(e))
2222
2223
with PGPEngine() as pgp:
2224
for client_name, client in clients_data.iteritems():
2225
# Decide which value to use after restoring saved state.
2226
# We have three different values: Old config file,
2227
# new config file, and saved state.
2228
# New config value takes precedence if it differs from old
2229
# config value, otherwise use saved state.
2230
for name, value in client_settings[client_name].items():
2231
try:
2232
# For each value in new config, check if it
2233
# differs from the old config value (Except for
2234
# the "secret" attribute)
2235
if (name != "secret" and
2236
value != old_client_settings[client_name]
2237
[name]):
2238
client[name] = value
2239
except KeyError:
2240
pass
2241
2242
# Clients who has passed its expire date can still be
2243
# enabled if its last checker was successful. Clients
2244
# whose checker failed before we stored its state is
2245
# assumed to have failed all checkers during downtime.
2246
if client["enabled"]:
2247
if datetime.datetime.utcnow() >= client["expires"]:
2248
if not client["last_checked_ok"]:
2249
logger.warning(
2250
"disabling client {0} - Client never "
2251
"performed a successfull checker"
2252
.format(client["name"]))
2253
client["enabled"] = False
2254
elif client["last_checker_status"] != 0:
2255
logger.warning(
2256
"disabling client {0} - Client "
2257
"last checker failed with error code {1}"
2258
.format(client["name"],
2259
client["last_checker_status"]))
2260
client["enabled"] = False
2261
else:
2262
client["expires"] = (datetime.datetime
2263
.utcnow()
2264
+ client["timeout"])
2265
2032
def client_config_items(config, section):
2033
special_settings = {
2034
"approved_by_default":
2035
lambda: config.getboolean(section,
2036
"approved_by_default"),
2037
}
2038
for name, value in config.items(section):
2266
2039
try:
2267
client["secret"] = (
2268
pgp.decrypt(client["encrypted_secret"],
2269
client_settings[client_name]
2270
["secret"]))
2271
except PGPError:
2272
# If decryption fails, we use secret from new settings
2273
logger.debug("Failed to decrypt {0} old secret"
2274
.format(client_name))
2275
client["secret"] = (
2276
client_settings[client_name]["secret"])
2277
2278
2279
# Add/remove clients based on new changes made to config
2280
for client_name in set(old_client_settings) - set(client_settings):
2281
del clients_data[client_name]
2282
for client_name in set(client_settings) - set(old_client_settings):
2283
clients_data[client_name] = client_settings[client_name]
2284
2285
# Create clients all clients
2286
for client_name, client in clients_data.iteritems():
2287
tcp_server.clients[client_name] = client_class(
2288
name = client_name, settings = client)
2289
2040
yield (name, special_settings[name]())
2041
except KeyError:
2042
yield (name, value)
2043
2044
tcp_server.clients.update(set(
2045
client_class(name = section,
2046
config= dict(client_config_items(
2047
client_config, section)))
2048
for section in client_config.sections()))
2290
2049
if not tcp_server.clients:
2291
2050
logger.warning("No clients defined")
2292
2051
2303
2062
# "pidfile" was never created
2304
2063
pass
2305
2064
del pidfilename
2065
2306
2066
signal.signal(signal.SIGINT, signal.SIG_IGN)
2307
2067
2308
2068
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2334
2094
def GetAllClients(self):
2335
2095
"D-Bus method"
2336
2096
return dbus.Array(c.dbus_object_path
2337
for c in
2338
tcp_server.clients.itervalues())
2097
for c in tcp_server.clients)
2339
2098
2340
2099
@dbus.service.method(_interface,
2341
2100
out_signature="a{oa{sv}}")
2343
2102
"D-Bus method"
2344
2103
return dbus.Dictionary(
2345
2104
((c.dbus_object_path, c.GetAll(""))
2346
for c in tcp_server.clients.itervalues()),
2105
for c in tcp_server.clients),
2347
2106
signature="oa{sv}")
2348
2107
2349
2108
@dbus.service.method(_interface, in_signature="o")
2350
2109
def RemoveClient(self, object_path):
2351
2110
"D-Bus method"
2352
for c in tcp_server.clients.itervalues():
2111
for c in tcp_server.clients:
2353
2112
if c.dbus_object_path == object_path:
2354
del tcp_server.clients[c.name]
2113
tcp_server.clients.remove(c)
2355
2114
c.remove_from_connection()
2356
2115
# Don't signal anything except ClientRemoved
2357
2116
c.disable(quiet=True)
2370
2129
"Cleanup function; run on exit"
2371
2130
service.cleanup()
2372
2131
2373
multiprocessing.active_children()
2374
if not (tcp_server.clients or client_settings):
2375
return
2376
2377
# Store client before exiting. Secrets are encrypted with key
2378
# based on what config file has. If config file is
2379
# removed/edited, old secret will thus be unrecovable.
2380
clients = {}
2381
with PGPEngine() as pgp:
2382
for client in tcp_server.clients.itervalues():
2383
key = client_settings[client.name]["secret"]
2384
client.encrypted_secret = pgp.encrypt(client.secret,
2385
key)
2386
client_dict = {}
2387
2388
# A list of attributes that can not be pickled
2389
# + secret.
2390
exclude = set(("bus", "changedstate", "secret",
2391
"checker"))
2392
for name, typ in (inspect.getmembers
2393
(dbus.service.Object)):
2394
exclude.add(name)
2395
2396
client_dict["encrypted_secret"] = (client
2397
.encrypted_secret)
2398
for attr in client.client_structure:
2399
if attr not in exclude:
2400
client_dict[attr] = getattr(client, attr)
2401
2402
clients[client.name] = client_dict
2403
del client_settings[client.name]["secret"]
2404
2405
try:
2406
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2407
prefix="clients-",
2408
dir=os.path.dirname
2409
(stored_state_path))
2410
with os.fdopen(tempfd, "wb") as stored_state:
2411
pickle.dump((clients, client_settings), stored_state)
2412
os.rename(tempname, stored_state_path)
2413
except (IOError, OSError) as e:
2414
logger.warning("Could not save persistent state: {0}"
2415
.format(e))
2416
if not debug:
2417
try:
2418
os.remove(tempname)
2419
except NameError:
2420
pass
2421
if e.errno not in set((errno.ENOENT, errno.EACCES,
2422
errno.EEXIST)):
2423
raise e
2424
2425
# Delete all clients, and settings from config
2426
2132
while tcp_server.clients:
2427
name, client = tcp_server.clients.popitem()
2133
client = tcp_server.clients.pop()
2428
2134
if use_dbus:
2429
2135
client.remove_from_connection()
2136
client.disable_hook = None
2430
2137
# Don't signal anything except ClientRemoved
2431
2138
client.disable(quiet=True)
2432
2139
if use_dbus:
2434
2141
mandos_dbus_service.ClientRemoved(client
2435
2142
.dbus_object_path,
2436
2143
client.name)
2437
client_settings.clear()
2438
2144
2439
2145
atexit.register(cleanup)
2440
2146
2441
for client in tcp_server.clients.itervalues():
2147
for client in tcp_server.clients:
2442
2148
if use_dbus:
2443
2149
# Emit D-Bus signal
2444
2150
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2445
# Need to initiate checking of clients
2446
if client.enabled:
2447
client.init_checker()
2151
client.enable()
2448
2152
2449
2153
tcp_server.enable()
2450
2154
tcp_server.server_activate()
2490
2194
# Must run before the D-Bus bus name gets deregistered
2491
2195
cleanup()
2492
2196
2197
2493
2198
if __name__ == '__main__':
2494
2199
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0