/mandos/release : revision 289

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

66

69

67

import dbus

70

68

import dbus.service

75

73

import ctypes.util

76

74

import xml.dom.minidom

77

75

import inspect

78

import GnuPGInterface

79

76

80

77

try:

81

78

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

87

84

88

85

89

86

version = "1.4.1"

90

stored_state_file = "clients.pickle"

91

87

92

logger = logging.getLogger()

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

93

90

syslogger = (logging.handlers.SysLogHandler

94

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

92

address = str("/dev/log")))

96

97

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

101

except (OSError, AttributeError):

102

def if_nametoindex(interface):

103

"Get an interface index the hard way, i.e. using fcntl()"

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

with contextlib.closing(socket.socket()) as s:

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

111

return interface_index

112

113

114

def initlogger(level=logging.WARNING):

115

"""init logger and add loglevel"""

116

117

syslogger.setFormatter(logging.Formatter

118

('Mandos [%(process)d]: %(levelname)s:'

119

' %(message)s'))

120

logger.addHandler(syslogger)

121

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet'])

146

147

def __enter__(self):

148

return self

149

150

def __exit__ (self, exc_type, exc_value, traceback):

151

self._cleanup()

152

return False

153

154

def __del__(self):

155

self._cleanup()

156

157

def _cleanup(self):

158

if self.tempdir is not None:

159

# Delete contents of tempdir

160

for root, dirs, files in os.walk(self.tempdir,

161

topdown = False):

162

for filename in files:

163

os.remove(os.path.join(root, filename))

164

for dirname in dirs:

165

os.rmdir(os.path.join(root, dirname))

166

# Remove tempdir

167

os.rmdir(self.tempdir)

168

self.tempdir = None

169

170

def password_encode(self, password):

171

# Passphrase can not be empty and can not contain newlines or

172

# NUL bytes. So we prefix it and hex encode it.

173

return b"mandos" + binascii.hexlify(password)

174

175

def encrypt(self, data, password):

176

self.gnupg.passphrase = self.password_encode(password)

177

with open(os.devnull) as devnull:

178

try:

179

proc = self.gnupg.run(['--symmetric'],

180

create_fhs=['stdin', 'stdout'],

181

attach_fhs={'stderr': devnull})

182

with contextlib.closing(proc.handles['stdin']) as f:

183

f.write(data)

184

with contextlib.closing(proc.handles['stdout']) as f:

185

ciphertext = f.read()

186

proc.wait()

187

except IOError as e:

188

raise PGPError(e)

189

self.gnupg.passphrase = None

190

return ciphertext

191

192

def decrypt(self, data, password):

193

self.gnupg.passphrase = self.password_encode(password)

194

with open(os.devnull) as devnull:

195

try:

196

proc = self.gnupg.run(['--decrypt'],

197

create_fhs=['stdin', 'stdout'],

198

attach_fhs={'stderr': devnull})

199

with contextlib.closing(proc.handles['stdin'] ) as f:

200

f.write(data)

201

with contextlib.closing(proc.handles['stdout']) as f:

202

decrypted_plaintext = f.read()

203

proc.wait()

204

except IOError as e:

205

raise PGPError(e)

206

self.gnupg.passphrase = None

207

return decrypted_plaintext

208

209

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

210

103

211

104

class AvahiError(Exception):

212

105

def __init__(self, value, *args, **kwargs):

271

164

.GetAlternativeServiceName(self.name))

272

165

logger.info("Changing Zeroconf service name to %r ...",

273

166

self.name)

167

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

170

% self.name))

274

171

self.remove()

275

172

try:

276

173

self.add()

296

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

297

194

self.entry_group_state_changed_match = (

298

195

self.group.connect_to_signal(

299

'StateChanged', self.entry_group_state_changed))

196

'StateChanged', self .entry_group_state_changed))

300

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

301

198

self.name, self.type)

302

199

self.group.AddService(

328

225

try:

329

226

self.group.Free()

330

227

except (dbus.exceptions.UnknownMethodException,

331

dbus.exceptions.DBusException):

228

dbus.exceptions.DBusException) as e:

332

229

pass

333

230

self.group = None

334

231

self.remove()

368

265

self.server_state_changed)

369

266

self.server_state_changed(self.server.GetState())

370

267

371

class AvahiServiceToSyslog(AvahiService):

372

def rename(self):

373

"""Add the new name to the syslog messages"""

374

ret = AvahiService.rename(self)

375

syslogger.setFormatter(logging.Formatter

376

('Mandos (%s) [%%(process)d]:'

377

' %%(levelname)s: %%(message)s'

378

% self.name))

379

return ret

380

268

381

def timedelta_to_milliseconds(td):

269

def _timedelta_to_milliseconds(td):

382

270

"Convert a datetime.timedelta() to milliseconds"

383

271

return ((td.days * 24 * 60 * 60 * 1000)

384

272

+ (td.seconds * 1000)

388

276

"""A representation of a client host served by this server.

389

277

390

278

Attributes:

391

approved: bool(); 'None' if not yet approved/disapproved

279

_approved: bool(); 'None' if not yet approved/disapproved

392

280

approval_delay: datetime.timedelta(); Time to wait for approval

393

281

approval_duration: datetime.timedelta(); Duration of one approval

394

282

checker: subprocess.Popen(); a running checker process used

401

289

instance %(name)s can be used in the command.

402

290

checker_initiator_tag: a gobject event source tag, or None

403

291

created: datetime.datetime(); (UTC) object creation

404

client_structure: Object describing what attributes a client has

405

and is used for storing the client at exit

406

292

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

407

294

disable_initiator_tag: a gobject event source tag, or None

408

295

enabled: bool()

409

296

fingerprint: string (40 or 32 hexadecimal digits); used to

412

299

interval: datetime.timedelta(); How often to start a new checker

413

300

last_approval_request: datetime.datetime(); (UTC) or None

414

301

last_checked_ok: datetime.datetime(); (UTC) or None

415

416

last_checker_status: integer between 0 and 255 reflecting exit

417

status of last checker. -1 reflects crashed

418

checker, or None.

419

last_enabled: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

420

303

name: string; from the config file, used in log messages and

421

304

D-Bus identifiers

422

305

secret: bytestring; sent verbatim (over TLS) to client

435

318

436

319

def timeout_milliseconds(self):

437

320

"Return the 'timeout' attribute in milliseconds"

438

return timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

439

322

440

323

def extended_timeout_milliseconds(self):

441

324

"Return the 'extended_timeout' attribute in milliseconds"

442

return timedelta_to_milliseconds(self.extended_timeout)

325

return _timedelta_to_milliseconds(self.extended_timeout)

443

326

444

327

def interval_milliseconds(self):

445

328

"Return the 'interval' attribute in milliseconds"

446

return timedelta_to_milliseconds(self.interval)

329

return _timedelta_to_milliseconds(self.interval)

447

330

448

331

def approval_delay_milliseconds(self):

449

return timedelta_to_milliseconds(self.approval_delay)

332

return _timedelta_to_milliseconds(self.approval_delay)

450

333

451

def __init__(self, name = None, config=None):

334

def __init__(self, name = None, disable_hook=None, config=None):

452

335

"""Note: the 'checker' key in 'config' sets the

453

336

'checker_command' attribute and *not* the 'checker'

454

337

attribute."""

474

357

% self.name)

475

358

self.host = config.get("host", "")

476

359

self.created = datetime.datetime.utcnow()

477

self.enabled = config.get("enabled", True)

360

self.enabled = False

478

361

self.last_approval_request = None

479

if self.enabled:

480

self.last_enabled = datetime.datetime.utcnow()

481

else:

482

self.last_enabled = None

362

self.last_enabled = None

483

363

self.last_checked_ok = None

484

self.last_checker_status = None

485

364

self.timeout = string_to_delta(config["timeout"])

486

365

self.extended_timeout = string_to_delta(config

487

366

["extended_timeout"])

488

367

self.interval = string_to_delta(config["interval"])

368

self.disable_hook = disable_hook

489

369

self.checker = None

490

370

self.checker_initiator_tag = None

491

371

self.disable_initiator_tag = None

492

if self.enabled:

493

self.expires = datetime.datetime.utcnow() + self.timeout

494

else:

495

self.expires = None

372

self.expires = None

496

373

self.checker_callback_tag = None

497

374

self.checker_command = config["checker"]

498

375

self.current_checker_command = None

499

self.approved = None

376

self.last_connect = None

377

self._approved = None

500

378

self.approved_by_default = config.get("approved_by_default",

501

379

True)

502

380

self.approvals_pending = 0

507

385

self.changedstate = (multiprocessing_manager

508

386

.Condition(multiprocessing_manager

509

387

.Lock()))

510

self.client_structure = [attr for attr in

511

self.__dict__.iterkeys()

512

if not attr.startswith("_")]

513

self.client_structure.append("client_structure")

514

515

for name, t in inspect.getmembers(type(self),

516

lambda obj:

517

isinstance(obj,

518

property)):

519

if not name.startswith("_"):

520

self.client_structure.append(name)

521

388

522

# Send notice to process children that client state has changed

523

389

def send_changedstate(self):

524

with self.changedstate:

525

self.changedstate.notify_all()

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

526

393

527

394

def enable(self):

528

395

"""Start this client's checker and timeout hooks"""

530

397

# Already enabled

531

398

return

532

399

self.send_changedstate()

400

# Schedule a new checker to be started an 'interval' from now,

401

# and every interval from then on.

402

self.checker_initiator_tag = (gobject.timeout_add

403

(self.interval_milliseconds(),

404

self.start_checker))

405

# Schedule a disable() when 'timeout' has passed

533

406

self.expires = datetime.datetime.utcnow() + self.timeout

407

self.disable_initiator_tag = (gobject.timeout_add

408

(self.timeout_milliseconds(),

409

self.disable))

534

410

self.enabled = True

535

411

self.last_enabled = datetime.datetime.utcnow()

536

self.init_checker()

412

# Also start a new checker *right now*.

413

self.start_checker()

537

414

538

415

def disable(self, quiet=True):

539

416

"""Disable this client."""

551

428

gobject.source_remove(self.checker_initiator_tag)

552

429

self.checker_initiator_tag = None

553

430

self.stop_checker()

431

if self.disable_hook:

432

self.disable_hook(self)

554

433

self.enabled = False

555

434

# Do not run this again if called by a gobject.timeout_add

556

435

return False

557

436

558

437

def __del__(self):

438

self.disable_hook = None

559

439

self.disable()

560

440

561

def init_checker(self):

562

# Schedule a new checker to be started an 'interval' from now,

563

# and every interval from then on.

564

self.checker_initiator_tag = (gobject.timeout_add

565

(self.interval_milliseconds(),

566

self.start_checker))

567

# Schedule a disable() when 'timeout' has passed

568

self.disable_initiator_tag = (gobject.timeout_add

569

(self.timeout_milliseconds(),

570

self.disable))

571

# Also start a new checker *right now*.

572

self.start_checker()

573

574

441

def checker_callback(self, pid, condition, command):

575

442

"""The checker has completed, so take appropriate actions."""

576

443

self.checker_callback_tag = None

577

444

self.checker = None

578

445

if os.WIFEXITED(condition):

579

self.last_checker_status = os.WEXITSTATUS(condition)

580

if self.last_checker_status == 0:

446

exitstatus = os.WEXITSTATUS(condition)

447

if exitstatus == 0:

581

448

logger.info("Checker for %(name)s succeeded",

582

449

vars(self))

583

450

self.checked_ok()

585

452

logger.info("Checker for %(name)s failed",

586

453

vars(self))

587

454

else:

588

self.last_checker_status = -1

589

455

logger.warning("Checker for %(name)s crashed?",

590

456

vars(self))

591

457

602

468

gobject.source_remove(self.disable_initiator_tag)

603

469

if getattr(self, "enabled", False):

604

470

self.disable_initiator_tag = (gobject.timeout_add

605

(timedelta_to_milliseconds

471

(_timedelta_to_milliseconds

606

472

(timeout), self.disable))

607

473

self.expires = datetime.datetime.utcnow() + timeout

608

474

825

691

826

692

Note: Will not include properties with access="write".

827

693

"""

828

properties = {}

694

all = {}

829

695

for name, prop in self._get_all_dbus_properties():

830

696

if (interface_name

831

697

and interface_name != prop._dbus_interface):

836

702

continue

837

703

value = prop()

838

704

if not hasattr(value, "variant_level"):

839

properties[name] = value

705

all[name] = value

840

706

continue

841

properties[name] = type(value)(value, variant_level=

842

value.variant_level+1)

843

return dbus.Dictionary(properties, signature="sv")

707

all[name] = type(value)(value, variant_level=

708

value.variant_level+1)

709

return dbus.Dictionary(all, signature="sv")

844

710

845

711

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

846

712

out_signature="s",

897

763

return dbus.String(dt.isoformat(),

898

764

variant_level=variant_level)

899

765

900

901

766

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

902

767

.__metaclass__):

903

768

"""Applied to an empty subclass of a D-Bus object, this metaclass

995

860

attribute.func_closure)))

996

861

return type.__new__(mcs, name, bases, attr)

997

862

998

999

863

class ClientDBus(Client, DBusObjectWithProperties):

1000

864

"""A Client class using D-Bus

1001

865

1010

874

# dbus.service.Object doesn't use super(), so we can't either.

1011

875

1012

876

def __init__(self, bus = None, *args, **kwargs):

877

self._approvals_pending = 0

1013

878

self.bus = bus

1014

879

Client.__init__(self, *args, **kwargs)

1015

1016

self._approvals_pending = 0

1017

880

# Only now, when this client is initialized, can it show up on

1018

881

# the D-Bus

1019

882

client_object_name = unicode(self.name).translate(

1029

892

variant_level=1):

1030

893

""" Modify a variable so that it's a property which announces

1031

894

its changes to DBus.

1032

895

1033

896

transform_fun: Function that takes a value and a variant_level

1034

897

and transforms it to a D-Bus type.

1035

898

dbus_name: D-Bus name of the variable

1072

935

approval_delay = notifychangeproperty(dbus.UInt16,

1073

936

"ApprovalDelay",

1074

937

type_func =

1075

timedelta_to_milliseconds)

938

_timedelta_to_milliseconds)

1076

939

approval_duration = notifychangeproperty(

1077

940

dbus.UInt16, "ApprovalDuration",

1078

type_func = timedelta_to_milliseconds)

941

type_func = _timedelta_to_milliseconds)

1079

942

host = notifychangeproperty(dbus.String, "Host")

1080

943

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1081

944

type_func =

1082

timedelta_to_milliseconds)

945

_timedelta_to_milliseconds)

1083

946

extended_timeout = notifychangeproperty(

1084

947

dbus.UInt16, "ExtendedTimeout",

1085

type_func = timedelta_to_milliseconds)

948

type_func = _timedelta_to_milliseconds)

1086

949

interval = notifychangeproperty(dbus.UInt16,

1087

950

"Interval",

1088

951

type_func =

1089

timedelta_to_milliseconds)

952

_timedelta_to_milliseconds)

1090

953

checker_command = notifychangeproperty(dbus.String, "Checker")

1091

954

1092

955

del notifychangeproperty

1134

997

return r

1135

998

1136

999

def _reset_approved(self):

1137

self.approved = None

1000

self._approved = None

1138

1001

return False

1139

1002

1140

1003

def approve(self, value=True):

1141

1004

self.send_changedstate()

1142

self.approved = value

1143

gobject.timeout_add(timedelta_to_milliseconds

1005

self._approved = value

1006

gobject.timeout_add(_timedelta_to_milliseconds

1144

1007

(self.approval_duration),

1145

1008

self._reset_approved)

1146

1009

1189

1052

"D-Bus signal"

1190

1053

return self.need_approval()

1191

1054

1192

# NeRwequest - signal

1193

@dbus.service.signal(_interface, signature="s")

1194

def NewRequest(self, ip):

1195

"""D-Bus signal

1196

Is sent after a client request a password.

1197

"""

1198

pass

1199

1200

1055

## Methods

1201

1056

1202

1057

# Approve - method

1260

1115

access="readwrite")

1261

1116

def ApprovalDuration_dbus_property(self, value=None):

1262

1117

if value is None: # get

1263

return dbus.UInt64(timedelta_to_milliseconds(

1118

return dbus.UInt64(_timedelta_to_milliseconds(

1264

1119

self.approval_duration))

1265

1120

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1266

1121

1285

1140

# Created - property

1286

1141

@dbus_service_property(_interface, signature="s", access="read")

1287

1142

def Created_dbus_property(self):

1288

return datetime_to_dbus(self.created)

1143

return dbus.String(datetime_to_dbus(self.created))

1289

1144

1290

1145

# LastEnabled - property

1291

1146

@dbus_service_property(_interface, signature="s", access="read")

1335

1190

gobject.source_remove(self.disable_initiator_tag)

1336

1191

self.disable_initiator_tag = None

1337

1192

self.expires = None

1338

time_to_die = timedelta_to_milliseconds((self

1339

.last_checked_ok

1340

+ self.timeout)

1341

- datetime.datetime

1342

.utcnow())

1193

time_to_die = _timedelta_to_milliseconds((self

1194

.last_checked_ok

1195

+ self.timeout)

1196

- datetime.datetime

1197

.utcnow())

1343

1198

if time_to_die <= 0:

1344

1199

# The timeout has passed

1345

1200

self.disable()

1367

1222

self.interval = datetime.timedelta(0, 0, 0, value)

1368

1223

if getattr(self, "checker_initiator_tag", None) is None:

1369

1224

return

1370

if self.enabled:

1371

# Reschedule checker run

1372

gobject.source_remove(self.checker_initiator_tag)

1373

self.checker_initiator_tag = (gobject.timeout_add

1374

(value, self.start_checker))

1375

self.start_checker() # Start one now, too

1225

# Reschedule checker run

1226

gobject.source_remove(self.checker_initiator_tag)

1227

self.checker_initiator_tag = (gobject.timeout_add

1228

(value, self.start_checker))

1229

self.start_checker() # Start one now, too

1376

1230

1377

1231

# Checker - property

1378

1232

@dbus_service_property(_interface, signature="s",

1415

1269

raise KeyError()

1416

1270

1417

1271

def __getattribute__(self, name):

1418

if name == '_pipe':

1272

if(name == '_pipe'):

1419

1273

return super(ProxyClient, self).__getattribute__(name)

1420

1274

self._pipe.send(('getattr', name))

1421

1275

data = self._pipe.recv()

1428

1282

return func

1429

1283

1430

1284

def __setattr__(self, name, value):

1431

if name == '_pipe':

1285

if(name == '_pipe'):

1432

1286

return super(ProxyClient, self).__setattr__(name, value)

1433

1287

self._pipe.send(('setattr', name, value))

1434

1288

1435

1436

1289

class ClientDBusTransitional(ClientDBus):

1437

1290

__metaclass__ = AlternateDBusNamesMetaclass

1438

1291

1439

1440

1292

class ClientHandler(socketserver.BaseRequestHandler, object):

1441

1293

"""A class to handle client connections.

1442

1294

1510

1362

except KeyError:

1511

1363

return

1512

1364

1513

if self.server.use_dbus:

1514

# Emit D-Bus signal

1515

client.NewRequest(str(self.client_address))

1516

1517

1365

if client.approval_delay:

1518

1366

delay = client.approval_delay

1519

1367

client.approvals_pending += 1

1528

1376

client.Rejected("Disabled")

1529

1377

return

1530

1378

1531

if client.approved or not client.approval_delay:

1379

if client._approved or not client.approval_delay:

1532

1380

#We are approved or approval is disabled

1533

1381

break

1534

elif client.approved is None:

1382

elif client._approved is None:

1535

1383

logger.info("Client %s needs approval",

1536

1384

client.name)

1537

1385

if self.server.use_dbus:

1551

1399

time = datetime.datetime.now()

1552

1400

client.changedstate.acquire()

1553

1401

(client.changedstate.wait

1554

(float(client.timedelta_to_milliseconds(delay)

1402

(float(client._timedelta_to_milliseconds(delay)

1555

1403

/ 1000)))

1556

1404

client.changedstate.release()

1557

1405

time2 = datetime.datetime.now()

1656

1504

# Convert the buffer to a Python bytestring

1657

1505

fpr = ctypes.string_at(buf, buf_len.value)

1658

1506

# Convert the bytestring to hexadecimal notation

1659

hex_fpr = binascii.hexlify(fpr).upper()

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1660

1508

return hex_fpr

1661

1509

1662

1510

1776

1624

self.enabled = False

1777

1625

self.clients = clients

1778

1626

if self.clients is None:

1779

self.clients = {}

1627

self.clients = set()

1780

1628

self.use_dbus = use_dbus

1781

1629

self.gnutls_priority = gnutls_priority

1782

1630

IPv6_TCPServer.__init__(self, server_address,

1829

1677

fpr = request[1]

1830

1678

address = request[2]

1831

1679

1832

for c in self.clients.itervalues():

1680

for c in self.clients:

1833

1681

if c.fingerprint == fpr:

1834

1682

client = c

1835

1683

break

1919

1767

return timevalue

1920

1768

1921

1769

1770

def if_nametoindex(interface):

1771

"""Call the C function if_nametoindex(), or equivalent

1772

1773

Note: This function cannot accept a unicode string."""

1774

global if_nametoindex

1775

try:

1776

if_nametoindex = (ctypes.cdll.LoadLibrary

1777

(ctypes.util.find_library("c"))

1778

.if_nametoindex)

1779

except (OSError, AttributeError):

1780

logger.warning("Doing if_nametoindex the hard way")

1781

def if_nametoindex(interface):

1782

"Get an interface index the hard way, i.e. using fcntl()"

1783

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1784

with contextlib.closing(socket.socket()) as s:

1785

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1786

struct.pack(str("16s16x"),

1787

interface))

1788

interface_index = struct.unpack(str("I"),

1789

ifreq[16:20])[0]

1790

return interface_index

1791

return if_nametoindex(interface)

1792

1793

1922

1794

def daemon(nochdir = False, noclose = False):

1923

1795

"""See daemon(3). Standard BSD Unix function.

1924

1796

1979

1851

" system bus interface")

1980

1852

parser.add_argument("--no-ipv6", action="store_false",

1981

1853

dest="use_ipv6", help="Do not use IPv6")

1982

parser.add_argument("--no-restore", action="store_false",

1983

dest="restore", help="Do not restore stored"

1984

" state")

1985

parser.add_argument("--statedir", metavar="DIR",

1986

help="Directory to save/restore state in")

1987

1988

1854

options = parser.parse_args()

1989

1855

1990

1856

if options.check:

2003

1869

"use_dbus": "True",

2004

1870

"use_ipv6": "True",

2005

1871

"debuglevel": "",

2006

"restore": "True",

2007

"statedir": "/var/lib/mandos"

2008

1872

}

2009

1873

2010

1874

# Parse config file for server-global settings

2027

1891

# options, if set.

2028

1892

for option in ("interface", "address", "port", "debug",

2029

1893

"priority", "servicename", "configdir",

2030

"use_dbus", "use_ipv6", "debuglevel", "restore",

2031

"statedir"):

1894

"use_dbus", "use_ipv6", "debuglevel"):

2032

1895

value = getattr(options, option)

2033

1896

if value is not None:

2034

1897

server_settings[option] = value

2046

1909

debuglevel = server_settings["debuglevel"]

2047

1910

use_dbus = server_settings["use_dbus"]

2048

1911

use_ipv6 = server_settings["use_ipv6"]

2049

stored_state_path = os.path.join(server_settings["statedir"],

2050

stored_state_file)

2051

2052

if debug:

2053

initlogger(logging.DEBUG)

2054

else:

2055

if not debuglevel:

2056

initlogger()

2057

else:

2058

level = getattr(logging, debuglevel.upper())

2059

initlogger(level)

2060

1912

2061

1913

if server_settings["servicename"] != "Mandos":

2062

1914

syslogger.setFormatter(logging.Formatter

2117

1969

if error[0] != errno.EPERM:

2118

1970

raise error

2119

1971

1972

if not debug and not debuglevel:

1973

syslogger.setLevel(logging.WARNING)

1974

console.setLevel(logging.WARNING)

1975

if debuglevel:

1976

level = getattr(logging, debuglevel.upper())

1977

syslogger.setLevel(level)

1978

console.setLevel(level)

1979

2120

1980

if debug:

2121

1981

# Enable all possible GnuTLS debugging

2122

1982

2164

2024

server_settings["use_dbus"] = False

2165

2025

tcp_server.use_dbus = False

2166

2026

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2167

service = AvahiServiceToSyslog(name =

2168

server_settings["servicename"],

2169

servicetype = "_mandos._tcp",

2170

protocol = protocol, bus = bus)

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

2029

protocol = protocol, bus = bus)

2171

2030

if server_settings["interface"]:

2172

2031

service.interface = (if_nametoindex

2173

2032

(str(server_settings["interface"])))

2179

2038

if use_dbus:

2180

2039

client_class = functools.partial(ClientDBusTransitional,

2181

2040

bus = bus)

2182

2183

special_settings = {

2184

# Some settings need to be accessd by special methods;

2185

# booleans need .getboolean(), etc. Here is a list of them:

2186

"approved_by_default":

2187

lambda section:

2188

client_config.getboolean(section, "approved_by_default"),

2189

"enabled":

2190

lambda section:

2191

client_config.getboolean(section, "enabled"),

2192

}

2193

# Construct a new dict of client settings of this form:

2194

# { client_name: {setting_name: value, ...}, ...}

2195

# with exceptions for any special settings as defined above

2196

client_settings = dict((clientname,

2197

dict((setting,

2198

(value

2199

if setting not in special_settings

2200

else special_settings[setting]

2201

(clientname)))

2202

for setting, value in

2203

client_config.items(clientname)))

2204

for clientname in client_config.sections())

2205

2206

old_client_settings = {}

2207

clients_data = []

2208

2209

# Get client data and settings from last running state.

2210

if server_settings["restore"]:

2211

try:

2212

with open(stored_state_path, "rb") as stored_state:

2213

clients_data, old_client_settings = (pickle.load

2214

(stored_state))

2215

os.remove(stored_state_path)

2216

except IOError as e:

2217

logger.warning("Could not load persistent state: {0}"

2218

.format(e))

2219

if e.errno != errno.ENOENT:

2220

raise

2221

2222

with PGPEngine() as pgp:

2223

for client in clients_data:

2224

client_name = client["name"]

2225

2226

# Decide which value to use after restoring saved state.

2227

# We have three different values: Old config file,

2228

# new config file, and saved state.

2229

# New config value takes precedence if it differs from old

2230

# config value, otherwise use saved state.

2231

for name, value in client_settings[client_name].items():

2232

try:

2233

# For each value in new config, check if it

2234

# differs from the old config value (Except for

2235

# the "secret" attribute)

2236

if (name != "secret" and

2237

value != old_client_settings[client_name]

2238

[name]):

2239

setattr(client, name, value)

2240

except KeyError:

2241

pass

2242

2243

# Clients who has passed its expire date can still be

2244

# enabled if its last checker was sucessful. Clients

2245

# whose checker failed before we stored its state is

2246

# assumed to have failed all checkers during downtime.

2247

if client["enabled"] and client["last_checked_ok"]:

2248

if ((datetime.datetime.utcnow()

2249

- client["last_checked_ok"])

2250

> client["interval"]):

2251

if client["last_checker_status"] != 0:

2252

client["enabled"] = False

2253

else:

2254

client["expires"] = (datetime.datetime

2255

.utcnow()

2256

+ client["timeout"])

2257

2258

client["changedstate"] = (multiprocessing_manager

2259

.Condition

2260

(multiprocessing_manager

2261

.Lock()))

2262

if use_dbus:

2263

new_client = (ClientDBusTransitional.__new__

2264

(ClientDBusTransitional))

2265

tcp_server.clients[client_name] = new_client

2266

new_client.bus = bus

2267

for name, value in client.iteritems():

2268

setattr(new_client, name, value)

2269

client_object_name = unicode(client_name).translate(

2270

{ord("."): ord("_"),

2271

ord("-"): ord("_")})

2272

new_client.dbus_object_path = (dbus.ObjectPath

2273

("/clients/"

2274

+ client_object_name))

2275

DBusObjectWithProperties.__init__(new_client,

2276

new_client.bus,

2277

new_client

2278

.dbus_object_path)

2279

else:

2280

tcp_server.clients[client_name] = (Client.__new__

2281

(Client))

2282

for name, value in client.iteritems():

2283

setattr(tcp_server.clients[client_name],

2284

name, value)

2285

2041

def client_config_items(config, section):

2042

special_settings = {

2043

"approved_by_default":

2044

lambda: config.getboolean(section,

2045

"approved_by_default"),

2046

}

2047

for name, value in config.items(section):

2286

2048

try:

2287

tcp_server.clients[client_name].secret = (

2288

pgp.decrypt(tcp_server.clients[client_name]

2289

.encrypted_secret,

2290

client_settings[client_name]

2291

["secret"]))

2292

except PGPError:

2293

# If decryption fails, we use secret from new settings

2294

tcp_server.clients[client_name].secret = (

2295

client_settings[client_name]["secret"])

2296

2297

# Create/remove clients based on new changes made to config

2298

for clientname in set(old_client_settings) - set(client_settings):

2299

del tcp_server.clients[clientname]

2300

for clientname in set(client_settings) - set(old_client_settings):

2301

tcp_server.clients[clientname] = (client_class(name

2302

= clientname,

2303

config =

2304

client_settings

2305

[clientname]))

2306

2049

yield (name, special_settings[name]())

2050

except KeyError:

2051

yield (name, value)

2052

2053

tcp_server.clients.update(set(

2054

client_class(name = section,

2055

config= dict(client_config_items(

2056

client_config, section)))

2057

for section in client_config.sections()))

2307

2058

if not tcp_server.clients:

2308

2059

logger.warning("No clients defined")

2309

2060

2352

2103

def GetAllClients(self):

2353

2104

"D-Bus method"

2354

2105

return dbus.Array(c.dbus_object_path

2355

for c in

2356

tcp_server.clients.itervalues())

2106

for c in tcp_server.clients)

2357

2107

2358

2108

@dbus.service.method(_interface,

2359

2109

out_signature="a{oa{sv}}")

2361

2111

"D-Bus method"

2362

2112

return dbus.Dictionary(

2363

2113

((c.dbus_object_path, c.GetAll(""))

2364

for c in tcp_server.clients.itervalues()),

2114

for c in tcp_server.clients),

2365

2115

signature="oa{sv}")

2366

2116

2367

2117

@dbus.service.method(_interface, in_signature="o")

2368

2118

def RemoveClient(self, object_path):

2369

2119

"D-Bus method"

2370

for c in tcp_server.clients.itervalues():

2120

for c in tcp_server.clients:

2371

2121

if c.dbus_object_path == object_path:

2372

del tcp_server.clients[c.name]

2122

tcp_server.clients.remove(c)

2373

2123

c.remove_from_connection()

2374

2124

# Don't signal anything except ClientRemoved

2375

2125

c.disable(quiet=True)

2389

2139

service.cleanup()

2390

2140

2391

2141

multiprocessing.active_children()

2392

if not (tcp_server.clients or client_settings):

2393

return

2394

2395

# Store client before exiting. Secrets are encrypted with key

2396

# based on what config file has. If config file is

2397

# removed/edited, old secret will thus be unrecovable.

2398

clients = []

2399

with PGPEngine() as pgp:

2400

for client in tcp_server.clients.itervalues():

2401

key = client_settings[client.name]["secret"]

2402

client.encrypted_secret = pgp.encrypt(client.secret,

2403

key)

2404

client_dict = {}

2405

2406

# A list of attributes that will not be stored when

2407

# shutting down.

2408

exclude = set(("bus", "changedstate", "secret"))

2409

for name, typ in (inspect.getmembers

2410

(dbus.service.Object)):

2411

exclude.add(name)

2412

2413

client_dict["encrypted_secret"] = (client

2414

.encrypted_secret)

2415

for attr in client.client_structure:

2416

if attr not in exclude:

2417

client_dict[attr] = getattr(client, attr)

2418

2419

clients.append(client_dict)

2420

del client_settings[client.name]["secret"]

2421

2422

try:

2423

with os.fdopen(os.open(stored_state_path,

2424

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2425

0600), "wb") as stored_state:

2426

pickle.dump((clients, client_settings), stored_state)

2427

except (IOError, OSError) as e:

2428

logger.warning("Could not save persistent state: {0}"

2429

.format(e))

2430

if e.errno not in (errno.ENOENT, errno.EACCES):

2431

raise

2432

2433

# Delete all clients, and settings from config

2434

2142

while tcp_server.clients:

2435

name, client = tcp_server.clients.popitem()

2143

client = tcp_server.clients.pop()

2436

2144

if use_dbus:

2437

2145

client.remove_from_connection()

2146

client.disable_hook = None

2438

2147

# Don't signal anything except ClientRemoved

2439

2148

client.disable(quiet=True)

2440

2149

if use_dbus:

2442

2151

mandos_dbus_service.ClientRemoved(client

2443

2152

.dbus_object_path,

2444

2153

client.name)

2445

client_settings.clear()

2446

2154

2447

2155

atexit.register(cleanup)

2448

2156

2449

for client in tcp_server.clients.itervalues():

2157

for client in tcp_server.clients:

2450

2158

if use_dbus:

2451

2159

# Emit D-Bus signal

2452

2160

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2453

# Need to initiate checking of clients

2454

if client.enabled:

2455

client.init_checker()

2161

client.enable()

2456

2162

2457

2163

tcp_server.enable()

2458

2164

tcp_server.server_activate()