/mandos/release : revision 289

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

66

69

67

import dbus

70

68

import dbus.service

75

73

import ctypes.util

76

74

import xml.dom.minidom

77

75

import inspect

78

import GnuPGInterface

79

76

80

77

try:

81

78

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

87

84

88

85

89

86

version = "1.4.1"

90

stored_state_file = "clients.pickle"

91

87

92

logger = logging.getLogger()

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

93

90

syslogger = (logging.handlers.SysLogHandler

94

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

92

address = str("/dev/log")))

96

97

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

101

except (OSError, AttributeError):

102

def if_nametoindex(interface):

103

"Get an interface index the hard way, i.e. using fcntl()"

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

with contextlib.closing(socket.socket()) as s:

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

111

return interface_index

112

113

114

def initlogger(level=logging.WARNING):

115

"""init logger and add loglevel"""

116

117

syslogger.setFormatter(logging.Formatter

118

('Mandos [%(process)d]: %(levelname)s:'

119

' %(message)s'))

120

logger.addHandler(syslogger)

121

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet'])

146

147

def __enter__(self):

148

return self

149

150

def __exit__ (self, exc_type, exc_value, traceback):

151

self._cleanup()

152

return False

153

154

def __del__(self):

155

self._cleanup()

156

157

def _cleanup(self):

158

if self.tempdir is not None:

159

# Delete contents of tempdir

160

for root, dirs, files in os.walk(self.tempdir,

161

topdown = False):

162

for filename in files:

163

os.remove(os.path.join(root, filename))

164

for dirname in dirs:

165

os.rmdir(os.path.join(root, dirname))

166

# Remove tempdir

167

os.rmdir(self.tempdir)

168

self.tempdir = None

169

170

def password_encode(self, password):

171

# Passphrase can not be empty and can not contain newlines or

172

# NUL bytes. So we prefix it and hex encode it.

173

return b"mandos" + binascii.hexlify(password)

174

175

def encrypt(self, data, password):

176

self.gnupg.passphrase = self.password_encode(password)

177

with open(os.devnull) as devnull:

178

try:

179

proc = self.gnupg.run(['--symmetric'],

180

create_fhs=['stdin', 'stdout'],

181

attach_fhs={'stderr': devnull})

182

with contextlib.closing(proc.handles['stdin']) as f:

183

f.write(data)

184

with contextlib.closing(proc.handles['stdout']) as f:

185

ciphertext = f.read()

186

proc.wait()

187

except IOError as e:

188

raise PGPError(e)

189

self.gnupg.passphrase = None

190

return ciphertext

191

192

def decrypt(self, data, password):

193

self.gnupg.passphrase = self.password_encode(password)

194

with open(os.devnull) as devnull:

195

try:

196

proc = self.gnupg.run(['--decrypt'],

197

create_fhs=['stdin', 'stdout'],

198

attach_fhs={'stderr': devnull})

199

with contextlib.closing(proc.handles['stdin'] ) as f:

200

f.write(data)

201

with contextlib.closing(proc.handles['stdout']) as f:

202

decrypted_plaintext = f.read()

203

proc.wait()

204

except IOError as e:

205

raise PGPError(e)

206

self.gnupg.passphrase = None

207

return decrypted_plaintext

208

209

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

210

103

211

104

class AvahiError(Exception):

212

105

def __init__(self, value, *args, **kwargs):

271

164

.GetAlternativeServiceName(self.name))

272

165

logger.info("Changing Zeroconf service name to %r ...",

273

166

self.name)

167

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

170

% self.name))

274

171

self.remove()

275

172

try:

276

173

self.add()

296

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

297

194

self.entry_group_state_changed_match = (

298

195

self.group.connect_to_signal(

299

'StateChanged', self.entry_group_state_changed))

196

'StateChanged', self .entry_group_state_changed))

300

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

301

198

self.name, self.type)

302

199

self.group.AddService(

328

225

try:

329

226

self.group.Free()

330

227

except (dbus.exceptions.UnknownMethodException,

331

dbus.exceptions.DBusException):

228

dbus.exceptions.DBusException) as e:

332

229

pass

333

230

self.group = None

334

231

self.remove()

368

265

self.server_state_changed)

369

266

self.server_state_changed(self.server.GetState())

370

267

371

class AvahiServiceToSyslog(AvahiService):

372

def rename(self):

373

"""Add the new name to the syslog messages"""

374

ret = AvahiService.rename(self)

375

syslogger.setFormatter(logging.Formatter

376

('Mandos (%s) [%%(process)d]:'

377

' %%(levelname)s: %%(message)s'

378

% self.name))

379

return ret

380

268

381

def timedelta_to_milliseconds(td):

269

def _timedelta_to_milliseconds(td):

382

270

"Convert a datetime.timedelta() to milliseconds"

383

271

return ((td.days * 24 * 60 * 60 * 1000)

384

272

+ (td.seconds * 1000)

388

276

"""A representation of a client host served by this server.

389

277

390

278

Attributes:

391

approved: bool(); 'None' if not yet approved/disapproved

279

_approved: bool(); 'None' if not yet approved/disapproved

392

280

approval_delay: datetime.timedelta(); Time to wait for approval

393

281

approval_duration: datetime.timedelta(); Duration of one approval

394

282

checker: subprocess.Popen(); a running checker process used

401

289

instance %(name)s can be used in the command.

402

290

checker_initiator_tag: a gobject event source tag, or None

403

291

created: datetime.datetime(); (UTC) object creation

404

client_structure: Object describing what attributes a client has

405

and is used for storing the client at exit

406

292

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

407

294

disable_initiator_tag: a gobject event source tag, or None

408

295

enabled: bool()

409

296

fingerprint: string (40 or 32 hexadecimal digits); used to

412

299

interval: datetime.timedelta(); How often to start a new checker

413

300

last_approval_request: datetime.datetime(); (UTC) or None

414

301

last_checked_ok: datetime.datetime(); (UTC) or None

415

416

last_checker_status: integer between 0 and 255 reflecting exit

417

status of last checker. -1 reflects crashed

418

checker, or None.

419

last_enabled: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

420

303

name: string; from the config file, used in log messages and

421

304

D-Bus identifiers

422

305

secret: bytestring; sent verbatim (over TLS) to client

435

318

436

319

def timeout_milliseconds(self):

437

320

"Return the 'timeout' attribute in milliseconds"

438

return timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

439

322

440

323

def extended_timeout_milliseconds(self):

441

324

"Return the 'extended_timeout' attribute in milliseconds"

442

return timedelta_to_milliseconds(self.extended_timeout)

325

return _timedelta_to_milliseconds(self.extended_timeout)

443

326

444

327

def interval_milliseconds(self):

445

328

"Return the 'interval' attribute in milliseconds"

446

return timedelta_to_milliseconds(self.interval)

329

return _timedelta_to_milliseconds(self.interval)

447

330

448

331

def approval_delay_milliseconds(self):

449

return timedelta_to_milliseconds(self.approval_delay)

332

return _timedelta_to_milliseconds(self.approval_delay)

450

333

451

def __init__(self, name = None, config=None):

334

def __init__(self, name = None, disable_hook=None, config=None):

452

335

"""Note: the 'checker' key in 'config' sets the

453

336

'checker_command' attribute and *not* the 'checker'

454

337

attribute."""

474

357

% self.name)

475

358

self.host = config.get("host", "")

476

359

self.created = datetime.datetime.utcnow()

477

self.enabled = config.get("enabled", True)

360

self.enabled = False

478

361

self.last_approval_request = None

479

if self.enabled:

480

self.last_enabled = datetime.datetime.utcnow()

481

else:

482

self.last_enabled = None

362

self.last_enabled = None

483

363

self.last_checked_ok = None

484

self.last_checker_status = None

485

364

self.timeout = string_to_delta(config["timeout"])

486

365

self.extended_timeout = string_to_delta(config

487

366

["extended_timeout"])

488

367

self.interval = string_to_delta(config["interval"])

368

self.disable_hook = disable_hook

489

369

self.checker = None

490

370

self.checker_initiator_tag = None

491

371

self.disable_initiator_tag = None

492

if self.enabled:

493

self.expires = datetime.datetime.utcnow() + self.timeout

494

else:

495

self.expires = None

372

self.expires = None

496

373

self.checker_callback_tag = None

497

374

self.checker_command = config["checker"]

498

375

self.current_checker_command = None

499

self.approved = None

376

self.last_connect = None

377

self._approved = None

500

378

self.approved_by_default = config.get("approved_by_default",

501

379

True)

502

380

self.approvals_pending = 0

507

385

self.changedstate = (multiprocessing_manager

508

386

.Condition(multiprocessing_manager

509

387

.Lock()))

510

self.client_structure = [attr for attr in

511

self.__dict__.iterkeys()

512

if not attr.startswith("_")]

513

self.client_structure.append("client_structure")

514

515

for name, t in inspect.getmembers(type(self),

516

lambda obj:

517

isinstance(obj,

518

property)):

519

if not name.startswith("_"):

520

self.client_structure.append(name)

521

388

522

# Send notice to process children that client state has changed

523

389

def send_changedstate(self):

524

with self.changedstate:

525

self.changedstate.notify_all()

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

526

393

527

394

def enable(self):

528

395

"""Start this client's checker and timeout hooks"""

530

397

# Already enabled

531

398

return

532

399

self.send_changedstate()

400

# Schedule a new checker to be started an 'interval' from now,

401

# and every interval from then on.

402

self.checker_initiator_tag = (gobject.timeout_add

403

(self.interval_milliseconds(),

404

self.start_checker))

405

# Schedule a disable() when 'timeout' has passed

533

406

self.expires = datetime.datetime.utcnow() + self.timeout

407

self.disable_initiator_tag = (gobject.timeout_add

408

(self.timeout_milliseconds(),

409

self.disable))

534

410

self.enabled = True

535

411

self.last_enabled = datetime.datetime.utcnow()

536

self.init_checker()

412

# Also start a new checker *right now*.

413

self.start_checker()

537

414

538

415

def disable(self, quiet=True):

539

416

"""Disable this client."""

551

428

gobject.source_remove(self.checker_initiator_tag)

552

429

self.checker_initiator_tag = None

553

430

self.stop_checker()

431

if self.disable_hook:

432

self.disable_hook(self)

554

433

self.enabled = False

555

434

# Do not run this again if called by a gobject.timeout_add

556

435

return False

557

436

558

437

def __del__(self):

438

self.disable_hook = None

559

439

self.disable()

560

440

561

def init_checker(self):

562

# Schedule a new checker to be started an 'interval' from now,

563

# and every interval from then on.

564

self.checker_initiator_tag = (gobject.timeout_add

565

(self.interval_milliseconds(),

566

self.start_checker))

567

# Schedule a disable() when 'timeout' has passed

568

self.disable_initiator_tag = (gobject.timeout_add

569

(self.timeout_milliseconds(),

570

self.disable))

571

# Also start a new checker *right now*.

572

self.start_checker()

573

574

441

def checker_callback(self, pid, condition, command):

575

442

"""The checker has completed, so take appropriate actions."""

576

443

self.checker_callback_tag = None

577

444

self.checker = None

578

445

if os.WIFEXITED(condition):

579

self.last_checker_status = os.WEXITSTATUS(condition)

580

if self.last_checker_status == 0:

446

exitstatus = os.WEXITSTATUS(condition)

447

if exitstatus == 0:

581

448

logger.info("Checker for %(name)s succeeded",

582

449

vars(self))

583

450

self.checked_ok()

585

452

logger.info("Checker for %(name)s failed",

586

453

vars(self))

587

454

else:

588

self.last_checker_status = -1

589

455

logger.warning("Checker for %(name)s crashed?",

590

456

vars(self))

591

457

602

468

gobject.source_remove(self.disable_initiator_tag)

603

469

if getattr(self, "enabled", False):

604

470

self.disable_initiator_tag = (gobject.timeout_add

605

(timedelta_to_milliseconds

471

(_timedelta_to_milliseconds

606

472

(timeout), self.disable))

607

473

self.expires = datetime.datetime.utcnow() + timeout

608

474

825

691

826

692

Note: Will not include properties with access="write".

827

693

"""

828

properties = {}

694

all = {}

829

695

for name, prop in self._get_all_dbus_properties():

830

696

if (interface_name

831

697

and interface_name != prop._dbus_interface):

836

702

continue

837

703

value = prop()

838

704

if not hasattr(value, "variant_level"):

839

properties[name] = value

705

all[name] = value

840

706

continue

841

properties[name] = type(value)(value, variant_level=

842

value.variant_level+1)

843

return dbus.Dictionary(properties, signature="sv")

707

all[name] = type(value)(value, variant_level=

708

value.variant_level+1)

709

return dbus.Dictionary(all, signature="sv")

844

710

845

711

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

846

712

out_signature="s",

897

763

return dbus.String(dt.isoformat(),

898

764

variant_level=variant_level)

899

765

900

901

766

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

902

767

.__metaclass__):

903

768

"""Applied to an empty subclass of a D-Bus object, this metaclass

995

860

attribute.func_closure)))

996

861

return type.__new__(mcs, name, bases, attr)

997

862

998

999

863

class ClientDBus(Client, DBusObjectWithProperties):

1000

864

"""A Client class using D-Bus

1001

865

1010

874

# dbus.service.Object doesn't use super(), so we can't either.

1011

875

1012

876

def __init__(self, bus = None, *args, **kwargs):

877

self._approvals_pending = 0

1013

878

self.bus = bus

1014

879

Client.__init__(self, *args, **kwargs)

1015

1016

self._approvals_pending = 0

1017

880

# Only now, when this client is initialized, can it show up on

1018

881

# the D-Bus

1019

882

client_object_name = unicode(self.name).translate(

1029

892

variant_level=1):

1030

893

""" Modify a variable so that it's a property which announces

1031

894

its changes to DBus.

1032

895

1033

896

transform_fun: Function that takes a value and a variant_level

1034

897

and transforms it to a D-Bus type.

1035

898

dbus_name: D-Bus name of the variable

1069

932

datetime_to_dbus, "LastApprovalRequest")

1070

933

approved_by_default = notifychangeproperty(dbus.Boolean,

1071

934

"ApprovedByDefault")

1072

approval_delay = notifychangeproperty(dbus.UInt64,

935

approval_delay = notifychangeproperty(dbus.UInt16,

1073

936

"ApprovalDelay",

1074

937

type_func =

1075

timedelta_to_milliseconds)

938

_timedelta_to_milliseconds)

1076

939

approval_duration = notifychangeproperty(

1077

dbus.UInt64, "ApprovalDuration",

1078

type_func = timedelta_to_milliseconds)

940

dbus.UInt16, "ApprovalDuration",

941

type_func = _timedelta_to_milliseconds)

1079

942

host = notifychangeproperty(dbus.String, "Host")

1080

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

943

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1081

944

type_func =

1082

timedelta_to_milliseconds)

945

_timedelta_to_milliseconds)

1083

946

extended_timeout = notifychangeproperty(

1084

dbus.UInt64, "ExtendedTimeout",

1085

type_func = timedelta_to_milliseconds)

1086

interval = notifychangeproperty(dbus.UInt64,

947

dbus.UInt16, "ExtendedTimeout",

948

type_func = _timedelta_to_milliseconds)

949

interval = notifychangeproperty(dbus.UInt16,

1087

950

"Interval",

1088

951

type_func =

1089

timedelta_to_milliseconds)

952

_timedelta_to_milliseconds)

1090

953

checker_command = notifychangeproperty(dbus.String, "Checker")

1091

954

1092

955

del notifychangeproperty

1134

997

return r

1135

998

1136

999

def _reset_approved(self):

1137

self.approved = None

1000

self._approved = None

1138

1001

return False

1139

1002

1140

1003

def approve(self, value=True):

1141

1004

self.send_changedstate()

1142

self.approved = value

1143

gobject.timeout_add(timedelta_to_milliseconds

1005

self._approved = value

1006

gobject.timeout_add(_timedelta_to_milliseconds

1144

1007

(self.approval_duration),

1145

1008

self._reset_approved)

1146

1009

1189

1052

"D-Bus signal"

1190

1053

return self.need_approval()

1191

1054

1192

# NeRwequest - signal

1193

@dbus.service.signal(_interface, signature="s")

1194

def NewRequest(self, ip):

1195

"""D-Bus signal

1196

Is sent after a client request a password.

1197

"""

1198

pass

1199

1200

1055

## Methods

1201

1056

1202

1057

# Approve - method

1260

1115

access="readwrite")

1261

1116

def ApprovalDuration_dbus_property(self, value=None):

1262

1117

if value is None: # get

1263

return dbus.UInt64(timedelta_to_milliseconds(

1118

return dbus.UInt64(_timedelta_to_milliseconds(

1264

1119

self.approval_duration))

1265

1120

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1266

1121

1280

1135

def Host_dbus_property(self, value=None):

1281

1136

if value is None: # get

1282

1137

return dbus.String(self.host)

1283

self.host = unicode(value)

1138

self.host = value

1284

1139

1285

1140

# Created - property

1286

1141

@dbus_service_property(_interface, signature="s", access="read")

1287

1142

def Created_dbus_property(self):

1288

return datetime_to_dbus(self.created)

1143

return dbus.String(datetime_to_dbus(self.created))

1289

1144

1290

1145

# LastEnabled - property

1291

1146

@dbus_service_property(_interface, signature="s", access="read")

1335

1190

gobject.source_remove(self.disable_initiator_tag)

1336

1191

self.disable_initiator_tag = None

1337

1192

self.expires = None

1338

time_to_die = timedelta_to_milliseconds((self

1339

.last_checked_ok

1340

+ self.timeout)

1341

- datetime.datetime

1342

.utcnow())

1193

time_to_die = _timedelta_to_milliseconds((self

1194

.last_checked_ok

1195

+ self.timeout)

1196

- datetime.datetime

1197

.utcnow())

1343

1198

if time_to_die <= 0:

1344

1199

# The timeout has passed

1345

1200

self.disable()

1367

1222

self.interval = datetime.timedelta(0, 0, 0, value)

1368

1223

if getattr(self, "checker_initiator_tag", None) is None:

1369

1224

return

1370

if self.enabled:

1371

# Reschedule checker run

1372

gobject.source_remove(self.checker_initiator_tag)

1373

self.checker_initiator_tag = (gobject.timeout_add

1374

(value, self.start_checker))

1375

self.start_checker() # Start one now, too

1225

# Reschedule checker run

1226

gobject.source_remove(self.checker_initiator_tag)

1227

self.checker_initiator_tag = (gobject.timeout_add

1228

(value, self.start_checker))

1229

self.start_checker() # Start one now, too

1376

1230

1377

1231

# Checker - property

1378

1232

@dbus_service_property(_interface, signature="s",

1380

1234

def Checker_dbus_property(self, value=None):

1381

1235

if value is None: # get

1382

1236

return dbus.String(self.checker_command)

1383

self.checker_command = unicode(value)

1237

self.checker_command = value

1384

1238

1385

1239

# CheckerRunning - property

1386

1240

@dbus_service_property(_interface, signature="b",

1415

1269

raise KeyError()

1416

1270

1417

1271

def __getattribute__(self, name):

1418

if name == '_pipe':

1272

if(name == '_pipe'):

1419

1273

return super(ProxyClient, self).__getattribute__(name)

1420

1274

self._pipe.send(('getattr', name))

1421

1275

data = self._pipe.recv()

1428

1282

return func

1429

1283

1430

1284

def __setattr__(self, name, value):

1431

if name == '_pipe':

1285

if(name == '_pipe'):

1432

1286

return super(ProxyClient, self).__setattr__(name, value)

1433

1287

self._pipe.send(('setattr', name, value))

1434

1288

1435

1436

1289

class ClientDBusTransitional(ClientDBus):

1437

1290

__metaclass__ = AlternateDBusNamesMetaclass

1438

1291

1439

1440

1292

class ClientHandler(socketserver.BaseRequestHandler, object):

1441

1293

"""A class to handle client connections.

1442

1294

1510

1362

except KeyError:

1511

1363

return

1512

1364

1513

if self.server.use_dbus:

1514

# Emit D-Bus signal

1515

client.NewRequest(str(self.client_address))

1516

1517

1365

if client.approval_delay:

1518

1366

delay = client.approval_delay

1519

1367

client.approvals_pending += 1

1528

1376

client.Rejected("Disabled")

1529

1377

return

1530

1378

1531

if client.approved or not client.approval_delay:

1379

if client._approved or not client.approval_delay:

1532

1380

#We are approved or approval is disabled

1533

1381

break

1534

elif client.approved is None:

1382

elif client._approved is None:

1535

1383

logger.info("Client %s needs approval",

1536

1384

client.name)

1537

1385

if self.server.use_dbus:

1551

1399

time = datetime.datetime.now()

1552

1400

client.changedstate.acquire()

1553

1401

(client.changedstate.wait

1554

(float(client.timedelta_to_milliseconds(delay)

1402

(float(client._timedelta_to_milliseconds(delay)

1555

1403

/ 1000)))

1556

1404

client.changedstate.release()

1557

1405

time2 = datetime.datetime.now()

1656

1504

# Convert the buffer to a Python bytestring

1657

1505

fpr = ctypes.string_at(buf, buf_len.value)

1658

1506

# Convert the bytestring to hexadecimal notation

1659

hex_fpr = binascii.hexlify(fpr).upper()

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1660

1508

return hex_fpr

1661

1509

1662

1510

1776

1624

self.enabled = False

1777

1625

self.clients = clients

1778

1626

if self.clients is None:

1779

self.clients = {}

1627

self.clients = set()

1780

1628

self.use_dbus = use_dbus

1781

1629

self.gnutls_priority = gnutls_priority

1782

1630

IPv6_TCPServer.__init__(self, server_address,

1829

1677

fpr = request[1]

1830

1678

address = request[2]

1831

1679

1832

for c in self.clients.itervalues():

1680

for c in self.clients:

1833

1681

if c.fingerprint == fpr:

1834

1682

client = c

1835

1683

break

1919

1767

return timevalue

1920

1768

1921

1769

1770

def if_nametoindex(interface):

1771

"""Call the C function if_nametoindex(), or equivalent

1772

1773

Note: This function cannot accept a unicode string."""

1774

global if_nametoindex

1775

try:

1776

if_nametoindex = (ctypes.cdll.LoadLibrary

1777

(ctypes.util.find_library("c"))

1778

.if_nametoindex)

1779

except (OSError, AttributeError):

1780

logger.warning("Doing if_nametoindex the hard way")

1781

def if_nametoindex(interface):

1782

"Get an interface index the hard way, i.e. using fcntl()"

1783

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1784

with contextlib.closing(socket.socket()) as s:

1785

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1786

struct.pack(str("16s16x"),

1787

interface))

1788

interface_index = struct.unpack(str("I"),

1789

ifreq[16:20])[0]

1790

return interface_index

1791

return if_nametoindex(interface)

1792

1793

1922

1794

def daemon(nochdir = False, noclose = False):

1923

1795

"""See daemon(3). Standard BSD Unix function.

1924

1796

1979

1851

" system bus interface")

1980

1852

parser.add_argument("--no-ipv6", action="store_false",

1981

1853

dest="use_ipv6", help="Do not use IPv6")

1982

parser.add_argument("--no-restore", action="store_false",

1983

dest="restore", help="Do not restore stored"

1984

" state")

1985

parser.add_argument("--statedir", metavar="DIR",

1986

help="Directory to save/restore state in")

1987

1988

1854

options = parser.parse_args()

1989

1855

1990

1856

if options.check:

2003

1869

"use_dbus": "True",

2004

1870

"use_ipv6": "True",

2005

1871

"debuglevel": "",

2006

"restore": "True",

2007

"statedir": "/var/lib/mandos"

2008

1872

}

2009

1873

2010

1874

# Parse config file for server-global settings

2027

1891

# options, if set.

2028

1892

for option in ("interface", "address", "port", "debug",

2029

1893

"priority", "servicename", "configdir",

2030

"use_dbus", "use_ipv6", "debuglevel", "restore",

2031

"statedir"):

1894

"use_dbus", "use_ipv6", "debuglevel"):

2032

1895

value = getattr(options, option)

2033

1896

if value is not None:

2034

1897

server_settings[option] = value

2046

1909

debuglevel = server_settings["debuglevel"]

2047

1910

use_dbus = server_settings["use_dbus"]

2048

1911

use_ipv6 = server_settings["use_ipv6"]

2049

stored_state_path = os.path.join(server_settings["statedir"],

2050

stored_state_file)

2051

2052

if debug:

2053

initlogger(logging.DEBUG)

2054

else:

2055

if not debuglevel:

2056

initlogger()

2057

else:

2058

level = getattr(logging, debuglevel.upper())

2059

initlogger(level)

2060

1912

2061

1913

if server_settings["servicename"] != "Mandos":

2062

1914

syslogger.setFormatter(logging.Formatter

2117

1969

if error[0] != errno.EPERM:

2118

1970

raise error

2119

1971

1972

if not debug and not debuglevel:

1973

syslogger.setLevel(logging.WARNING)

1974

console.setLevel(logging.WARNING)

1975

if debuglevel:

1976

level = getattr(logging, debuglevel.upper())

1977

syslogger.setLevel(level)

1978

console.setLevel(level)

1979

2120

1980

if debug:

2121

1981

# Enable all possible GnuTLS debugging

2122

1982

2145

2005

# Close all input and output, do double fork, etc.

2146

2006

daemon()

2147

2007

2148

gobject.threads_init()

2149

2150

2008

global main_loop

2151

2009

# From the Avahi example code

2152

2010

DBusGMainLoop(set_as_default=True )

2166

2024

server_settings["use_dbus"] = False

2167

2025

tcp_server.use_dbus = False

2168

2026

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2169

service = AvahiServiceToSyslog(name =

2170

server_settings["servicename"],

2171

servicetype = "_mandos._tcp",

2172

protocol = protocol, bus = bus)

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

2029

protocol = protocol, bus = bus)

2173

2030

if server_settings["interface"]:

2174

2031

service.interface = (if_nametoindex

2175

2032

(str(server_settings["interface"])))

2181

2038

if use_dbus:

2182

2039

client_class = functools.partial(ClientDBusTransitional,

2183

2040

bus = bus)

2184

2185

special_settings = {

2186

# Some settings need to be accessd by special methods;

2187

# booleans need .getboolean(), etc. Here is a list of them:

2188

"approved_by_default":

2189

lambda section:

2190

client_config.getboolean(section, "approved_by_default"),

2191

"enabled":

2192

lambda section:

2193

client_config.getboolean(section, "enabled"),

2194

}

2195

# Construct a new dict of client settings of this form:

2196

# { client_name: {setting_name: value, ...}, ...}

2197

# with exceptions for any special settings as defined above

2198

client_settings = dict((clientname,

2199

dict((setting,

2200

(value

2201

if setting not in special_settings

2202

else special_settings[setting]

2203

(clientname)))

2204

for setting, value in

2205

client_config.items(clientname)))

2206

for clientname in client_config.sections())

2207

2208

old_client_settings = {}

2209

clients_data = []

2210

2211

# Get client data and settings from last running state.

2212

if server_settings["restore"]:

2213

try:

2214

with open(stored_state_path, "rb") as stored_state:

2215

clients_data, old_client_settings = (pickle.load

2216

(stored_state))

2217

os.remove(stored_state_path)

2218

except IOError as e:

2219

logger.warning("Could not load persistent state: {0}"

2220

.format(e))

2221

if e.errno != errno.ENOENT:

2222

raise

2223

2224

with PGPEngine() as pgp:

2225

for client in clients_data:

2226

client_name = client["name"]

2227

2228

# Decide which value to use after restoring saved state.

2229

# We have three different values: Old config file,

2230

# new config file, and saved state.

2231

# New config value takes precedence if it differs from old

2232

# config value, otherwise use saved state.

2233

for name, value in client_settings[client_name].items():

2234

try:

2235

# For each value in new config, check if it

2236

# differs from the old config value (Except for

2237

# the "secret" attribute)

2238

if (name != "secret" and

2239

value != old_client_settings[client_name]

2240

[name]):

2241

client[name] = value

2242

except KeyError:

2243

pass

2244

2245

# Clients who has passed its expire date can still be

2246

# enabled if its last checker was sucessful. Clients

2247

# whose checker failed before we stored its state is

2248

# assumed to have failed all checkers during downtime.

2249

if client["enabled"]:

2250

if client["expires"] <= (datetime.datetime

2251

.utcnow()):

2252

# Client has expired

2253

if client["last_checker_status"] != 0:

2254

client["enabled"] = False

2255

else:

2256

client["expires"] = (datetime.datetime

2257

.utcnow()

2258

+ client["timeout"])

2259

2260

client["changedstate"] = (multiprocessing_manager

2261

.Condition

2262

(multiprocessing_manager

2263

.Lock()))

2264

if use_dbus:

2265

new_client = (ClientDBusTransitional.__new__

2266

(ClientDBusTransitional))

2267

tcp_server.clients[client_name] = new_client

2268

new_client.bus = bus

2269

for name, value in client.iteritems():

2270

setattr(new_client, name, value)

2271

client_object_name = unicode(client_name).translate(

2272

{ord("."): ord("_"),

2273

ord("-"): ord("_")})

2274

new_client.dbus_object_path = (dbus.ObjectPath

2275

("/clients/"

2276

+ client_object_name))

2277

DBusObjectWithProperties.__init__(new_client,

2278

new_client.bus,

2279

new_client

2280

.dbus_object_path)

2281

else:

2282

tcp_server.clients[client_name] = (Client.__new__

2283

(Client))

2284

for name, value in client.iteritems():

2285

setattr(tcp_server.clients[client_name],

2286

name, value)

2287

2041

def client_config_items(config, section):

2042

special_settings = {

2043

"approved_by_default":

2044

lambda: config.getboolean(section,

2045

"approved_by_default"),

2046

}

2047

for name, value in config.items(section):

2288

2048

try:

2289

tcp_server.clients[client_name].secret = (

2290

pgp.decrypt(tcp_server.clients[client_name]

2291

.encrypted_secret,

2292

client_settings[client_name]

2293

["secret"]))

2294

except PGPError:

2295

# If decryption fails, we use secret from new settings

2296

logger.debug("Failed to decrypt {0} old secret"

2297

.format(client_name))

2298

tcp_server.clients[client_name].secret = (

2299

client_settings[client_name]["secret"])

2300

2301

# Create/remove clients based on new changes made to config

2302

for clientname in set(old_client_settings) - set(client_settings):

2303

del tcp_server.clients[clientname]

2304

for clientname in set(client_settings) - set(old_client_settings):

2305

tcp_server.clients[clientname] = (client_class(name

2306

= clientname,

2307

config =

2308

client_settings

2309

[clientname]))

2310

2049

yield (name, special_settings[name]())

2050

except KeyError:

2051

yield (name, value)

2052

2053

tcp_server.clients.update(set(

2054

client_class(name = section,

2055

config= dict(client_config_items(

2056

client_config, section)))

2057

for section in client_config.sections()))

2311

2058

if not tcp_server.clients:

2312

2059

logger.warning("No clients defined")

2313

2060

2356

2103

def GetAllClients(self):

2357

2104

"D-Bus method"

2358

2105

return dbus.Array(c.dbus_object_path

2359

for c in

2360

tcp_server.clients.itervalues())

2106

for c in tcp_server.clients)

2361

2107

2362

2108

@dbus.service.method(_interface,

2363

2109

out_signature="a{oa{sv}}")

2365

2111

"D-Bus method"

2366

2112

return dbus.Dictionary(

2367

2113

((c.dbus_object_path, c.GetAll(""))

2368

for c in tcp_server.clients.itervalues()),

2114

for c in tcp_server.clients),

2369

2115

signature="oa{sv}")

2370

2116

2371

2117

@dbus.service.method(_interface, in_signature="o")

2372

2118

def RemoveClient(self, object_path):

2373

2119

"D-Bus method"

2374

for c in tcp_server.clients.itervalues():

2120

for c in tcp_server.clients:

2375

2121

if c.dbus_object_path == object_path:

2376

del tcp_server.clients[c.name]

2122

tcp_server.clients.remove(c)

2377

2123

c.remove_from_connection()

2378

2124

# Don't signal anything except ClientRemoved

2379

2125

c.disable(quiet=True)

2393

2139

service.cleanup()

2394

2140

2395

2141

multiprocessing.active_children()

2396

if not (tcp_server.clients or client_settings):

2397

return

2398

2399

# Store client before exiting. Secrets are encrypted with key

2400

# based on what config file has. If config file is

2401

# removed/edited, old secret will thus be unrecovable.

2402

clients = []

2403

with PGPEngine() as pgp:

2404

for client in tcp_server.clients.itervalues():

2405

key = client_settings[client.name]["secret"]

2406

client.encrypted_secret = pgp.encrypt(client.secret,

2407

key)

2408

client_dict = {}

2409

2410

# A list of attributes that will not be stored when

2411

# shutting down.

2412

exclude = set(("bus", "changedstate", "secret"))

2413

for name, typ in (inspect.getmembers

2414

(dbus.service.Object)):

2415

exclude.add(name)

2416

2417

client_dict["encrypted_secret"] = (client

2418

.encrypted_secret)

2419

for attr in client.client_structure:

2420

if attr not in exclude:

2421

client_dict[attr] = getattr(client, attr)

2422

2423

clients.append(client_dict)

2424

del client_settings[client.name]["secret"]

2425

2426

try:

2427

with os.fdopen(os.open(stored_state_path,

2428

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2429

0600), "wb") as stored_state:

2430

pickle.dump((clients, client_settings), stored_state)

2431

except (IOError, OSError) as e:

2432

logger.warning("Could not save persistent state: {0}"

2433

.format(e))

2434

if e.errno not in (errno.ENOENT, errno.EACCES):

2435

raise

2436

2437

# Delete all clients, and settings from config

2438

2142

while tcp_server.clients:

2439

name, client = tcp_server.clients.popitem()

2143

client = tcp_server.clients.pop()

2440

2144

if use_dbus:

2441

2145

client.remove_from_connection()

2146

client.disable_hook = None

2442

2147

# Don't signal anything except ClientRemoved

2443

2148

client.disable(quiet=True)

2444

2149

if use_dbus:

2446

2151

mandos_dbus_service.ClientRemoved(client

2447

2152

.dbus_object_path,

2448

2153

client.name)

2449

client_settings.clear()

2450

2154

2451

2155

atexit.register(cleanup)

2452

2156

2453

for client in tcp_server.clients.itervalues():

2157

for client in tcp_server.clients:

2454

2158

if use_dbus:

2455

2159

# Emit D-Bus signal

2456

2160

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2457

# Need to initiate checking of clients

2458

if client.enabled:

2459

client.init_checker()

2161

client.enable()

2460

2162

2461

2163

tcp_server.enable()

2462

2164

tcp_server.server_activate()