To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 289
- compare with another revision
- download diff
- download tarball
- view history from revision 289
- Committer: Björn Påhlsson
- Date: 2011-10-15 16:48:03 UTC
- Revision ID: belorn@fukt.bsnet.se-20111015164803-61q3hzrv91d042mb
Tags: version-1.4.1-1
* Makefile (version): Changed to "1.4.1".
* NEWS (Version 1.4.1): New entry.
* debian/changelog (1.4.1-1): - '' -
* NEWS (Version 1.4.1): New entry.
* debian/changelog (1.4.1-1): - '' -
- files removed:
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import binascii
67
import tempfile
68
66
69
67
import dbus
70
68
import dbus.service
75
73
import ctypes.util
76
74
import xml.dom.minidom
77
75
import inspect
78
import GnuPGInterface
79
76
80
77
try:
81
78
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
82
except ImportError:
86
83
SO_BINDTODEVICE = None
87
84
85
88
86
version = "1.4.1"
89
stored_state_file = "clients.pickle"
90
87
91
logger = logging.getLogger()
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
92
90
syslogger = (logging.handlers.SysLogHandler
93
91
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
92
address = str("/dev/log")))
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(debug, level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
if debug:
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet',
146
'--no-use-agent'])
147
148
def __enter__(self):
149
return self
150
151
def __exit__ (self, exc_type, exc_value, traceback):
152
self._cleanup()
153
return False
154
155
def __del__(self):
156
self._cleanup()
157
158
def _cleanup(self):
159
if self.tempdir is not None:
160
# Delete contents of tempdir
161
for root, dirs, files in os.walk(self.tempdir,
162
topdown = False):
163
for filename in files:
164
os.remove(os.path.join(root, filename))
165
for dirname in dirs:
166
os.rmdir(os.path.join(root, dirname))
167
# Remove tempdir
168
os.rmdir(self.tempdir)
169
self.tempdir = None
170
171
def password_encode(self, password):
172
# Passphrase can not be empty and can not contain newlines or
173
# NUL bytes. So we prefix it and hex encode it.
174
return b"mandos" + binascii.hexlify(password)
175
176
def encrypt(self, data, password):
177
self.gnupg.passphrase = self.password_encode(password)
178
with open(os.devnull) as devnull:
179
try:
180
proc = self.gnupg.run(['--symmetric'],
181
create_fhs=['stdin', 'stdout'],
182
attach_fhs={'stderr': devnull})
183
with contextlib.closing(proc.handles['stdin']) as f:
184
f.write(data)
185
with contextlib.closing(proc.handles['stdout']) as f:
186
ciphertext = f.read()
187
proc.wait()
188
except IOError as e:
189
raise PGPError(e)
190
self.gnupg.passphrase = None
191
return ciphertext
192
193
def decrypt(self, data, password):
194
self.gnupg.passphrase = self.password_encode(password)
195
with open(os.devnull) as devnull:
196
try:
197
proc = self.gnupg.run(['--decrypt'],
198
create_fhs=['stdin', 'stdout'],
199
attach_fhs={'stderr': devnull})
200
with contextlib.closing(proc.handles['stdin'] ) as f:
201
f.write(data)
202
with contextlib.closing(proc.handles['stdout']) as f:
203
decrypted_plaintext = f.read()
204
proc.wait()
205
except IOError as e:
206
raise PGPError(e)
207
self.gnupg.passphrase = None
208
return decrypted_plaintext
209
210
93
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
96
logger.addHandler(syslogger)
97
98
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
102
logger.addHandler(console)
211
103
212
104
class AvahiError(Exception):
213
105
def __init__(self, value, *args, **kwargs):
272
164
.GetAlternativeServiceName(self.name))
273
165
logger.info("Changing Zeroconf service name to %r ...",
274
166
self.name)
167
syslogger.setFormatter(logging.Formatter
168
('Mandos (%s) [%%(process)d]:'
169
' %%(levelname)s: %%(message)s'
170
% self.name))
275
171
self.remove()
276
172
try:
277
173
self.add()
297
193
avahi.DBUS_INTERFACE_ENTRY_GROUP)
298
194
self.entry_group_state_changed_match = (
299
195
self.group.connect_to_signal(
300
'StateChanged', self.entry_group_state_changed))
196
'StateChanged', self .entry_group_state_changed))
301
197
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
302
198
self.name, self.type)
303
199
self.group.AddService(
329
225
try:
330
226
self.group.Free()
331
227
except (dbus.exceptions.UnknownMethodException,
332
dbus.exceptions.DBusException):
228
dbus.exceptions.DBusException) as e:
333
229
pass
334
230
self.group = None
335
231
self.remove()
369
265
self.server_state_changed)
370
266
self.server_state_changed(self.server.GetState())
371
267
372
class AvahiServiceToSyslog(AvahiService):
373
def rename(self):
374
"""Add the new name to the syslog messages"""
375
ret = AvahiService.rename(self)
376
syslogger.setFormatter(logging.Formatter
377
('Mandos (%s) [%%(process)d]:'
378
' %%(levelname)s: %%(message)s'
379
% self.name))
380
return ret
381
268
382
def timedelta_to_milliseconds(td):
269
def _timedelta_to_milliseconds(td):
383
270
"Convert a datetime.timedelta() to milliseconds"
384
271
return ((td.days * 24 * 60 * 60 * 1000)
385
272
+ (td.seconds * 1000)
389
276
"""A representation of a client host served by this server.
390
277
391
278
Attributes:
392
approved: bool(); 'None' if not yet approved/disapproved
279
_approved: bool(); 'None' if not yet approved/disapproved
393
280
approval_delay: datetime.timedelta(); Time to wait for approval
394
281
approval_duration: datetime.timedelta(); Duration of one approval
395
282
checker: subprocess.Popen(); a running checker process used
402
289
instance %(name)s can be used in the command.
403
290
checker_initiator_tag: a gobject event source tag, or None
404
291
created: datetime.datetime(); (UTC) object creation
405
client_structure: Object describing what attributes a client has
406
and is used for storing the client at exit
407
292
current_checker_command: string; current running checker_command
293
disable_hook: If set, called by disable() as disable_hook(self)
408
294
disable_initiator_tag: a gobject event source tag, or None
409
295
enabled: bool()
410
296
fingerprint: string (40 or 32 hexadecimal digits); used to
413
299
interval: datetime.timedelta(); How often to start a new checker
414
300
last_approval_request: datetime.datetime(); (UTC) or None
415
301
last_checked_ok: datetime.datetime(); (UTC) or None
416
last_checker_status: integer between 0 and 255 reflecting exit
417
status of last checker. -1 reflects crashed
418
checker, or None.
419
last_enabled: datetime.datetime(); (UTC) or None
302
last_enabled: datetime.datetime(); (UTC)
420
303
name: string; from the config file, used in log messages and
421
304
D-Bus identifiers
422
305
secret: bytestring; sent verbatim (over TLS) to client
432
315
"created", "enabled", "fingerprint",
433
316
"host", "interval", "last_checked_ok",
434
317
"last_enabled", "name", "timeout")
435
client_defaults = { "timeout": "5m",
436
"extended_timeout": "15m",
437
"interval": "2m",
438
"checker": "fping -q -- %%(host)s",
439
"host": "",
440
"approval_delay": "0s",
441
"approval_duration": "1s",
442
"approved_by_default": "True",
443
"enabled": "True",
444
}
445
318
446
319
def timeout_milliseconds(self):
447
320
"Return the 'timeout' attribute in milliseconds"
448
return timedelta_to_milliseconds(self.timeout)
321
return _timedelta_to_milliseconds(self.timeout)
449
322
450
323
def extended_timeout_milliseconds(self):
451
324
"Return the 'extended_timeout' attribute in milliseconds"
452
return timedelta_to_milliseconds(self.extended_timeout)
325
return _timedelta_to_milliseconds(self.extended_timeout)
453
326
454
327
def interval_milliseconds(self):
455
328
"Return the 'interval' attribute in milliseconds"
456
return timedelta_to_milliseconds(self.interval)
329
return _timedelta_to_milliseconds(self.interval)
457
330
458
331
def approval_delay_milliseconds(self):
459
return timedelta_to_milliseconds(self.approval_delay)
460
461
@staticmethod
462
def config_parser(config):
463
"""Construct a new dict of client settings of this form:
464
{ client_name: {setting_name: value, ...}, ...}
465
with exceptions for any special settings as defined above.
466
NOTE: Must be a pure function. Must return the same result
467
value given the same arguments.
468
"""
469
settings = {}
470
for client_name in config.sections():
471
section = dict(config.items(client_name))
472
client = settings[client_name] = {}
473
474
client["host"] = section["host"]
475
# Reformat values from string types to Python types
476
client["approved_by_default"] = config.getboolean(
477
client_name, "approved_by_default")
478
client["enabled"] = config.getboolean(client_name,
479
"enabled")
480
481
client["fingerprint"] = (section["fingerprint"].upper()
482
.replace(" ", ""))
483
if "secret" in section:
484
client["secret"] = section["secret"].decode("base64")
485
elif "secfile" in section:
486
with open(os.path.expanduser(os.path.expandvars
487
(section["secfile"])),
488
"rb") as secfile:
489
client["secret"] = secfile.read()
490
else:
491
raise TypeError("No secret or secfile for section %s"
492
% section)
493
client["timeout"] = string_to_delta(section["timeout"])
494
client["extended_timeout"] = string_to_delta(
495
section["extended_timeout"])
496
client["interval"] = string_to_delta(section["interval"])
497
client["approval_delay"] = string_to_delta(
498
section["approval_delay"])
499
client["approval_duration"] = string_to_delta(
500
section["approval_duration"])
501
client["checker_command"] = section["checker"]
502
client["last_approval_request"] = None
503
client["last_checked_ok"] = None
504
client["last_checker_status"] = None
505
506
return settings
507
508
509
def __init__(self, settings, name = None):
332
return _timedelta_to_milliseconds(self.approval_delay)
333
334
def __init__(self, name = None, disable_hook=None, config=None):
510
335
"""Note: the 'checker' key in 'config' sets the
511
336
'checker_command' attribute and *not* the 'checker'
512
337
attribute."""
513
338
self.name = name
514
# adding all client settings
515
for setting, value in settings.iteritems():
516
setattr(self, setting, value)
517
518
if self.enabled:
519
if not hasattr(self, "last_enabled"):
520
self.last_enabled = datetime.datetime.utcnow()
521
if not hasattr(self, "expires"):
522
self.expires = (datetime.datetime.utcnow()
523
+ self.timeout)
524
else:
525
self.last_enabled = None
526
self.expires = None
527
339
if config is None:
340
config = {}
528
341
logger.debug("Creating client %r", self.name)
529
342
# Uppercase and remove spaces from fingerprint for later
530
343
# comparison purposes with return value from the fingerprint()
531
344
# function
345
self.fingerprint = (config["fingerprint"].upper()
346
.replace(" ", ""))
532
347
logger.debug(" Fingerprint: %s", self.fingerprint)
533
self.created = settings.get("created",
534
datetime.datetime.utcnow())
535
536
# attributes specific for this server instance
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
351
with open(os.path.expanduser(os.path.expandvars
352
(config["secfile"])),
353
"rb") as secfile:
354
self.secret = secfile.read()
355
else:
356
raise TypeError("No secret or secfile for client %s"
357
% self.name)
358
self.host = config.get("host", "")
359
self.created = datetime.datetime.utcnow()
360
self.enabled = False
361
self.last_approval_request = None
362
self.last_enabled = None
363
self.last_checked_ok = None
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
368
self.disable_hook = disable_hook
537
369
self.checker = None
538
370
self.checker_initiator_tag = None
539
371
self.disable_initiator_tag = None
372
self.expires = None
540
373
self.checker_callback_tag = None
374
self.checker_command = config["checker"]
541
375
self.current_checker_command = None
542
self.approved = None
376
self.last_connect = None
377
self._approved = None
378
self.approved_by_default = config.get("approved_by_default",
379
True)
543
380
self.approvals_pending = 0
381
self.approval_delay = string_to_delta(
382
config["approval_delay"])
383
self.approval_duration = string_to_delta(
384
config["approval_duration"])
544
385
self.changedstate = (multiprocessing_manager
545
386
.Condition(multiprocessing_manager
546
387
.Lock()))
547
self.client_structure = [attr for attr in
548
self.__dict__.iterkeys()
549
if not attr.startswith("_")]
550
self.client_structure.append("client_structure")
551
552
for name, t in inspect.getmembers(type(self),
553
lambda obj:
554
isinstance(obj,
555
property)):
556
if not name.startswith("_"):
557
self.client_structure.append(name)
558
388
559
# Send notice to process children that client state has changed
560
389
def send_changedstate(self):
561
with self.changedstate:
562
self.changedstate.notify_all()
390
self.changedstate.acquire()
391
self.changedstate.notify_all()
392
self.changedstate.release()
563
393
564
394
def enable(self):
565
395
"""Start this client's checker and timeout hooks"""
567
397
# Already enabled
568
398
return
569
399
self.send_changedstate()
400
# Schedule a new checker to be started an 'interval' from now,
401
# and every interval from then on.
402
self.checker_initiator_tag = (gobject.timeout_add
403
(self.interval_milliseconds(),
404
self.start_checker))
405
# Schedule a disable() when 'timeout' has passed
570
406
self.expires = datetime.datetime.utcnow() + self.timeout
407
self.disable_initiator_tag = (gobject.timeout_add
408
(self.timeout_milliseconds(),
409
self.disable))
571
410
self.enabled = True
572
411
self.last_enabled = datetime.datetime.utcnow()
573
self.init_checker()
412
# Also start a new checker *right now*.
413
self.start_checker()
574
414
575
415
def disable(self, quiet=True):
576
416
"""Disable this client."""
588
428
gobject.source_remove(self.checker_initiator_tag)
589
429
self.checker_initiator_tag = None
590
430
self.stop_checker()
431
if self.disable_hook:
432
self.disable_hook(self)
591
433
self.enabled = False
592
434
# Do not run this again if called by a gobject.timeout_add
593
435
return False
594
436
595
437
def __del__(self):
438
self.disable_hook = None
596
439
self.disable()
597
440
598
def init_checker(self):
599
# Schedule a new checker to be started an 'interval' from now,
600
# and every interval from then on.
601
self.checker_initiator_tag = (gobject.timeout_add
602
(self.interval_milliseconds(),
603
self.start_checker))
604
# Schedule a disable() when 'timeout' has passed
605
self.disable_initiator_tag = (gobject.timeout_add
606
(self.timeout_milliseconds(),
607
self.disable))
608
# Also start a new checker *right now*.
609
self.start_checker()
610
611
441
def checker_callback(self, pid, condition, command):
612
442
"""The checker has completed, so take appropriate actions."""
613
443
self.checker_callback_tag = None
614
444
self.checker = None
615
445
if os.WIFEXITED(condition):
616
self.last_checker_status = os.WEXITSTATUS(condition)
617
if self.last_checker_status == 0:
446
exitstatus = os.WEXITSTATUS(condition)
447
if exitstatus == 0:
618
448
logger.info("Checker for %(name)s succeeded",
619
449
vars(self))
620
450
self.checked_ok()
622
452
logger.info("Checker for %(name)s failed",
623
453
vars(self))
624
454
else:
625
self.last_checker_status = -1
626
455
logger.warning("Checker for %(name)s crashed?",
627
456
vars(self))
628
457
639
468
gobject.source_remove(self.disable_initiator_tag)
640
469
if getattr(self, "enabled", False):
641
470
self.disable_initiator_tag = (gobject.timeout_add
642
(timedelta_to_milliseconds
471
(_timedelta_to_milliseconds
643
472
(timeout), self.disable))
644
473
self.expires = datetime.datetime.utcnow() + timeout
645
474
862
691
863
692
Note: Will not include properties with access="write".
864
693
"""
865
properties = {}
694
all = {}
866
695
for name, prop in self._get_all_dbus_properties():
867
696
if (interface_name
868
697
and interface_name != prop._dbus_interface):
873
702
continue
874
703
value = prop()
875
704
if not hasattr(value, "variant_level"):
876
properties[name] = value
705
all[name] = value
877
706
continue
878
properties[name] = type(value)(value, variant_level=
879
value.variant_level+1)
880
return dbus.Dictionary(properties, signature="sv")
707
all[name] = type(value)(value, variant_level=
708
value.variant_level+1)
709
return dbus.Dictionary(all, signature="sv")
881
710
882
711
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
883
712
out_signature="s",
934
763
return dbus.String(dt.isoformat(),
935
764
variant_level=variant_level)
936
765
937
938
766
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
939
767
.__metaclass__):
940
768
"""Applied to an empty subclass of a D-Bus object, this metaclass
1032
860
attribute.func_closure)))
1033
861
return type.__new__(mcs, name, bases, attr)
1034
862
1035
1036
863
class ClientDBus(Client, DBusObjectWithProperties):
1037
864
"""A Client class using D-Bus
1038
865
1047
874
# dbus.service.Object doesn't use super(), so we can't either.
1048
875
1049
876
def __init__(self, bus = None, *args, **kwargs):
877
self._approvals_pending = 0
1050
878
self.bus = bus
1051
879
Client.__init__(self, *args, **kwargs)
1052
self._approvals_pending = 0
1053
1054
self._approvals_pending = 0
1055
880
# Only now, when this client is initialized, can it show up on
1056
881
# the D-Bus
1057
882
client_object_name = unicode(self.name).translate(
1067
892
variant_level=1):
1068
893
""" Modify a variable so that it's a property which announces
1069
894
its changes to DBus.
1070
895
1071
896
transform_fun: Function that takes a value and a variant_level
1072
897
and transforms it to a D-Bus type.
1073
898
dbus_name: D-Bus name of the variable
1107
932
datetime_to_dbus, "LastApprovalRequest")
1108
933
approved_by_default = notifychangeproperty(dbus.Boolean,
1109
934
"ApprovedByDefault")
1110
approval_delay = notifychangeproperty(dbus.UInt64,
935
approval_delay = notifychangeproperty(dbus.UInt16,
1111
936
"ApprovalDelay",
1112
937
type_func =
1113
timedelta_to_milliseconds)
938
_timedelta_to_milliseconds)
1114
939
approval_duration = notifychangeproperty(
1115
dbus.UInt64, "ApprovalDuration",
1116
type_func = timedelta_to_milliseconds)
940
dbus.UInt16, "ApprovalDuration",
941
type_func = _timedelta_to_milliseconds)
1117
942
host = notifychangeproperty(dbus.String, "Host")
1118
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
943
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1119
944
type_func =
1120
timedelta_to_milliseconds)
945
_timedelta_to_milliseconds)
1121
946
extended_timeout = notifychangeproperty(
1122
dbus.UInt64, "ExtendedTimeout",
1123
type_func = timedelta_to_milliseconds)
1124
interval = notifychangeproperty(dbus.UInt64,
947
dbus.UInt16, "ExtendedTimeout",
948
type_func = _timedelta_to_milliseconds)
949
interval = notifychangeproperty(dbus.UInt16,
1125
950
"Interval",
1126
951
type_func =
1127
timedelta_to_milliseconds)
952
_timedelta_to_milliseconds)
1128
953
checker_command = notifychangeproperty(dbus.String, "Checker")
1129
954
1130
955
del notifychangeproperty
1172
997
return r
1173
998
1174
999
def _reset_approved(self):
1175
self.approved = None
1000
self._approved = None
1176
1001
return False
1177
1002
1178
1003
def approve(self, value=True):
1179
1004
self.send_changedstate()
1180
self.approved = value
1181
gobject.timeout_add(timedelta_to_milliseconds
1005
self._approved = value
1006
gobject.timeout_add(_timedelta_to_milliseconds
1182
1007
(self.approval_duration),
1183
1008
self._reset_approved)
1184
1009
1227
1052
"D-Bus signal"
1228
1053
return self.need_approval()
1229
1054
1230
# NeRwequest - signal
1231
@dbus.service.signal(_interface, signature="s")
1232
def NewRequest(self, ip):
1233
"""D-Bus signal
1234
Is sent after a client request a password.
1235
"""
1236
pass
1237
1238
1055
## Methods
1239
1056
1240
1057
# Approve - method
1298
1115
access="readwrite")
1299
1116
def ApprovalDuration_dbus_property(self, value=None):
1300
1117
if value is None: # get
1301
return dbus.UInt64(timedelta_to_milliseconds(
1118
return dbus.UInt64(_timedelta_to_milliseconds(
1302
1119
self.approval_duration))
1303
1120
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1304
1121
1318
1135
def Host_dbus_property(self, value=None):
1319
1136
if value is None: # get
1320
1137
return dbus.String(self.host)
1321
self.host = unicode(value)
1138
self.host = value
1322
1139
1323
1140
# Created - property
1324
1141
@dbus_service_property(_interface, signature="s", access="read")
1325
1142
def Created_dbus_property(self):
1326
return datetime_to_dbus(self.created)
1143
return dbus.String(datetime_to_dbus(self.created))
1327
1144
1328
1145
# LastEnabled - property
1329
1146
@dbus_service_property(_interface, signature="s", access="read")
1367
1184
if value is None: # get
1368
1185
return dbus.UInt64(self.timeout_milliseconds())
1369
1186
self.timeout = datetime.timedelta(0, 0, 0, value)
1187
if getattr(self, "disable_initiator_tag", None) is None:
1188
return
1370
1189
# Reschedule timeout
1371
if self.enabled:
1372
now = datetime.datetime.utcnow()
1373
time_to_die = timedelta_to_milliseconds(
1374
(self.last_checked_ok + self.timeout) - now)
1375
if time_to_die <= 0:
1376
# The timeout has passed
1377
self.disable()
1378
else:
1379
self.expires = (now +
1380
datetime.timedelta(milliseconds =
1381
time_to_die))
1382
if (getattr(self, "disable_initiator_tag", None)
1383
is None):
1384
return
1385
gobject.source_remove(self.disable_initiator_tag)
1386
self.disable_initiator_tag = (gobject.timeout_add
1387
(time_to_die,
1388
self.disable))
1190
gobject.source_remove(self.disable_initiator_tag)
1191
self.disable_initiator_tag = None
1192
self.expires = None
1193
time_to_die = _timedelta_to_milliseconds((self
1194
.last_checked_ok
1195
+ self.timeout)
1196
- datetime.datetime
1197
.utcnow())
1198
if time_to_die <= 0:
1199
# The timeout has passed
1200
self.disable()
1201
else:
1202
self.expires = (datetime.datetime.utcnow()
1203
+ datetime.timedelta(milliseconds =
1204
time_to_die))
1205
self.disable_initiator_tag = (gobject.timeout_add
1206
(time_to_die, self.disable))
1389
1207
1390
1208
# ExtendedTimeout - property
1391
1209
@dbus_service_property(_interface, signature="t",
1404
1222
self.interval = datetime.timedelta(0, 0, 0, value)
1405
1223
if getattr(self, "checker_initiator_tag", None) is None:
1406
1224
return
1407
if self.enabled:
1408
# Reschedule checker run
1409
gobject.source_remove(self.checker_initiator_tag)
1410
self.checker_initiator_tag = (gobject.timeout_add
1411
(value, self.start_checker))
1412
self.start_checker() # Start one now, too
1225
# Reschedule checker run
1226
gobject.source_remove(self.checker_initiator_tag)
1227
self.checker_initiator_tag = (gobject.timeout_add
1228
(value, self.start_checker))
1229
self.start_checker() # Start one now, too
1413
1230
1414
1231
# Checker - property
1415
1232
@dbus_service_property(_interface, signature="s",
1417
1234
def Checker_dbus_property(self, value=None):
1418
1235
if value is None: # get
1419
1236
return dbus.String(self.checker_command)
1420
self.checker_command = unicode(value)
1237
self.checker_command = value
1421
1238
1422
1239
# CheckerRunning - property
1423
1240
@dbus_service_property(_interface, signature="b",
1452
1269
raise KeyError()
1453
1270
1454
1271
def __getattribute__(self, name):
1455
if name == '_pipe':
1272
if(name == '_pipe'):
1456
1273
return super(ProxyClient, self).__getattribute__(name)
1457
1274
self._pipe.send(('getattr', name))
1458
1275
data = self._pipe.recv()
1465
1282
return func
1466
1283
1467
1284
def __setattr__(self, name, value):
1468
if name == '_pipe':
1285
if(name == '_pipe'):
1469
1286
return super(ProxyClient, self).__setattr__(name, value)
1470
1287
self._pipe.send(('setattr', name, value))
1471
1288
1472
1473
1289
class ClientDBusTransitional(ClientDBus):
1474
1290
__metaclass__ = AlternateDBusNamesMetaclass
1475
1291
1476
1477
1292
class ClientHandler(socketserver.BaseRequestHandler, object):
1478
1293
"""A class to handle client connections.
1479
1294
1547
1362
except KeyError:
1548
1363
return
1549
1364
1550
if self.server.use_dbus:
1551
# Emit D-Bus signal
1552
client.NewRequest(str(self.client_address))
1553
1554
1365
if client.approval_delay:
1555
1366
delay = client.approval_delay
1556
1367
client.approvals_pending += 1
1565
1376
client.Rejected("Disabled")
1566
1377
return
1567
1378
1568
if client.approved or not client.approval_delay:
1379
if client._approved or not client.approval_delay:
1569
1380
#We are approved or approval is disabled
1570
1381
break
1571
elif client.approved is None:
1382
elif client._approved is None:
1572
1383
logger.info("Client %s needs approval",
1573
1384
client.name)
1574
1385
if self.server.use_dbus:
1588
1399
time = datetime.datetime.now()
1589
1400
client.changedstate.acquire()
1590
1401
(client.changedstate.wait
1591
(float(client.timedelta_to_milliseconds(delay)
1402
(float(client._timedelta_to_milliseconds(delay)
1592
1403
/ 1000)))
1593
1404
client.changedstate.release()
1594
1405
time2 = datetime.datetime.now()
1693
1504
# Convert the buffer to a Python bytestring
1694
1505
fpr = ctypes.string_at(buf, buf_len.value)
1695
1506
# Convert the bytestring to hexadecimal notation
1696
hex_fpr = binascii.hexlify(fpr).upper()
1507
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1697
1508
return hex_fpr
1698
1509
1699
1510
1702
1513
def sub_process_main(self, request, address):
1703
1514
try:
1704
1515
self.finish_request(request, address)
1705
except Exception:
1516
except:
1706
1517
self.handle_error(request, address)
1707
1518
self.close_request(request)
1708
1519
1813
1624
self.enabled = False
1814
1625
self.clients = clients
1815
1626
if self.clients is None:
1816
self.clients = {}
1627
self.clients = set()
1817
1628
self.use_dbus = use_dbus
1818
1629
self.gnutls_priority = gnutls_priority
1819
1630
IPv6_TCPServer.__init__(self, server_address,
1866
1677
fpr = request[1]
1867
1678
address = request[2]
1868
1679
1869
for c in self.clients.itervalues():
1680
for c in self.clients:
1870
1681
if c.fingerprint == fpr:
1871
1682
client = c
1872
1683
break
1956
1767
return timevalue
1957
1768
1958
1769
1770
def if_nametoindex(interface):
1771
"""Call the C function if_nametoindex(), or equivalent
1772
1773
Note: This function cannot accept a unicode string."""
1774
global if_nametoindex
1775
try:
1776
if_nametoindex = (ctypes.cdll.LoadLibrary
1777
(ctypes.util.find_library("c"))
1778
.if_nametoindex)
1779
except (OSError, AttributeError):
1780
logger.warning("Doing if_nametoindex the hard way")
1781
def if_nametoindex(interface):
1782
"Get an interface index the hard way, i.e. using fcntl()"
1783
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1784
with contextlib.closing(socket.socket()) as s:
1785
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1786
struct.pack(str("16s16x"),
1787
interface))
1788
interface_index = struct.unpack(str("I"),
1789
ifreq[16:20])[0]
1790
return interface_index
1791
return if_nametoindex(interface)
1792
1793
1959
1794
def daemon(nochdir = False, noclose = False):
1960
1795
"""See daemon(3). Standard BSD Unix function.
1961
1796
2016
1851
" system bus interface")
2017
1852
parser.add_argument("--no-ipv6", action="store_false",
2018
1853
dest="use_ipv6", help="Do not use IPv6")
2019
parser.add_argument("--no-restore", action="store_false",
2020
dest="restore", help="Do not restore stored"
2021
" state")
2022
parser.add_argument("--statedir", metavar="DIR",
2023
help="Directory to save/restore state in")
2024
2025
1854
options = parser.parse_args()
2026
1855
2027
1856
if options.check:
2040
1869
"use_dbus": "True",
2041
1870
"use_ipv6": "True",
2042
1871
"debuglevel": "",
2043
"restore": "True",
2044
"statedir": "/var/lib/mandos"
2045
1872
}
2046
1873
2047
1874
# Parse config file for server-global settings
2064
1891
# options, if set.
2065
1892
for option in ("interface", "address", "port", "debug",
2066
1893
"priority", "servicename", "configdir",
2067
"use_dbus", "use_ipv6", "debuglevel", "restore",
2068
"statedir"):
1894
"use_dbus", "use_ipv6", "debuglevel"):
2069
1895
value = getattr(options, option)
2070
1896
if value is not None:
2071
1897
server_settings[option] = value
2083
1909
debuglevel = server_settings["debuglevel"]
2084
1910
use_dbus = server_settings["use_dbus"]
2085
1911
use_ipv6 = server_settings["use_ipv6"]
2086
stored_state_path = os.path.join(server_settings["statedir"],
2087
stored_state_file)
2088
2089
if debug:
2090
initlogger(debug, logging.DEBUG)
2091
else:
2092
if not debuglevel:
2093
initlogger(debug)
2094
else:
2095
level = getattr(logging, debuglevel.upper())
2096
initlogger(debug, level)
2097
1912
2098
1913
if server_settings["servicename"] != "Mandos":
2099
1914
syslogger.setFormatter(logging.Formatter
2102
1917
% server_settings["servicename"]))
2103
1918
2104
1919
# Parse config file with clients
2105
client_config = configparser.SafeConfigParser(Client
2106
.client_defaults)
1920
client_defaults = { "timeout": "5m",
1921
"extended_timeout": "15m",
1922
"interval": "2m",
1923
"checker": "fping -q -- %%(host)s",
1924
"host": "",
1925
"approval_delay": "0s",
1926
"approval_duration": "1s",
1927
}
1928
client_config = configparser.SafeConfigParser(client_defaults)
2107
1929
client_config.read(os.path.join(server_settings["configdir"],
2108
1930
"clients.conf"))
2109
1931
2147
1969
if error[0] != errno.EPERM:
2148
1970
raise error
2149
1971
1972
if not debug and not debuglevel:
1973
syslogger.setLevel(logging.WARNING)
1974
console.setLevel(logging.WARNING)
1975
if debuglevel:
1976
level = getattr(logging, debuglevel.upper())
1977
syslogger.setLevel(level)
1978
console.setLevel(level)
1979
2150
1980
if debug:
2151
1981
# Enable all possible GnuTLS debugging
2152
1982
2166
1996
os.dup2(null, sys.stdin.fileno())
2167
1997
if null > 2:
2168
1998
os.close(null)
1999
else:
2000
# No console logging
2001
logger.removeHandler(console)
2169
2002
2170
2003
# Need to fork before connecting to D-Bus
2171
2004
if not debug:
2172
2005
# Close all input and output, do double fork, etc.
2173
2006
daemon()
2174
2007
2175
gobject.threads_init()
2176
2177
2008
global main_loop
2178
2009
# From the Avahi example code
2179
2010
DBusGMainLoop(set_as_default=True )
2193
2024
server_settings["use_dbus"] = False
2194
2025
tcp_server.use_dbus = False
2195
2026
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2196
service = AvahiServiceToSyslog(name =
2197
server_settings["servicename"],
2198
servicetype = "_mandos._tcp",
2199
protocol = protocol, bus = bus)
2027
service = AvahiService(name = server_settings["servicename"],
2028
servicetype = "_mandos._tcp",
2029
protocol = protocol, bus = bus)
2200
2030
if server_settings["interface"]:
2201
2031
service.interface = (if_nametoindex
2202
2032
(str(server_settings["interface"])))
2208
2038
if use_dbus:
2209
2039
client_class = functools.partial(ClientDBusTransitional,
2210
2040
bus = bus)
2211
2212
client_settings = Client.config_parser(client_config)
2213
old_client_settings = {}
2214
clients_data = {}
2215
2216
# Get client data and settings from last running state.
2217
if server_settings["restore"]:
2218
try:
2219
with open(stored_state_path, "rb") as stored_state:
2220
clients_data, old_client_settings = (pickle.load
2221
(stored_state))
2222
os.remove(stored_state_path)
2223
except IOError as e:
2224
logger.warning("Could not load persistent state: {0}"
2225
.format(e))
2226
if e.errno != errno.ENOENT:
2227
raise
2228
except EOFError as e:
2229
logger.warning("Could not load persistent state: "
2230
"EOFError: {0}".format(e))
2231
2232
with PGPEngine() as pgp:
2233
for client_name, client in clients_data.iteritems():
2234
# Decide which value to use after restoring saved state.
2235
# We have three different values: Old config file,
2236
# new config file, and saved state.
2237
# New config value takes precedence if it differs from old
2238
# config value, otherwise use saved state.
2239
for name, value in client_settings[client_name].items():
2240
try:
2241
# For each value in new config, check if it
2242
# differs from the old config value (Except for
2243
# the "secret" attribute)
2244
if (name != "secret" and
2245
value != old_client_settings[client_name]
2246
[name]):
2247
client[name] = value
2248
except KeyError:
2249
pass
2250
2251
# Clients who has passed its expire date can still be
2252
# enabled if its last checker was successful. Clients
2253
# whose checker failed before we stored its state is
2254
# assumed to have failed all checkers during downtime.
2255
if client["enabled"]:
2256
if datetime.datetime.utcnow() >= client["expires"]:
2257
if not client["last_checked_ok"]:
2258
logger.warning(
2259
"disabling client {0} - Client never "
2260
"performed a successfull checker"
2261
.format(client["name"]))
2262
client["enabled"] = False
2263
elif client["last_checker_status"] != 0:
2264
logger.warning(
2265
"disabling client {0} - Client "
2266
"last checker failed with error code {1}"
2267
.format(client["name"],
2268
client["last_checker_status"]))
2269
client["enabled"] = False
2270
else:
2271
client["expires"] = (datetime.datetime
2272
.utcnow()
2273
+ client["timeout"])
2274
logger.debug("Last checker succeeded,"
2275
" keeping {0} enabled"
2276
.format(client["name"]))
2041
def client_config_items(config, section):
2042
special_settings = {
2043
"approved_by_default":
2044
lambda: config.getboolean(section,
2045
"approved_by_default"),
2046
}
2047
for name, value in config.items(section):
2277
2048
try:
2278
client["secret"] = (
2279
pgp.decrypt(client["encrypted_secret"],
2280
client_settings[client_name]
2281
["secret"]))
2282
except PGPError:
2283
# If decryption fails, we use secret from new settings
2284
logger.debug("Failed to decrypt {0} old secret"
2285
.format(client_name))
2286
client["secret"] = (
2287
client_settings[client_name]["secret"])
2288
2289
2290
# Add/remove clients based on new changes made to config
2291
for client_name in (set(old_client_settings)
2292
- set(client_settings)):
2293
del clients_data[client_name]
2294
for client_name in (set(client_settings)
2295
- set(old_client_settings)):
2296
clients_data[client_name] = client_settings[client_name]
2297
2298
# Create clients all clients
2299
for client_name, client in clients_data.iteritems():
2300
tcp_server.clients[client_name] = client_class(
2301
name = client_name, settings = client)
2302
2049
yield (name, special_settings[name]())
2050
except KeyError:
2051
yield (name, value)
2052
2053
tcp_server.clients.update(set(
2054
client_class(name = section,
2055
config= dict(client_config_items(
2056
client_config, section)))
2057
for section in client_config.sections()))
2303
2058
if not tcp_server.clients:
2304
2059
logger.warning("No clients defined")
2305
2060
2316
2071
# "pidfile" was never created
2317
2072
pass
2318
2073
del pidfilename
2074
2319
2075
signal.signal(signal.SIGINT, signal.SIG_IGN)
2320
2076
2321
2077
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2347
2103
def GetAllClients(self):
2348
2104
"D-Bus method"
2349
2105
return dbus.Array(c.dbus_object_path
2350
for c in
2351
tcp_server.clients.itervalues())
2106
for c in tcp_server.clients)
2352
2107
2353
2108
@dbus.service.method(_interface,
2354
2109
out_signature="a{oa{sv}}")
2356
2111
"D-Bus method"
2357
2112
return dbus.Dictionary(
2358
2113
((c.dbus_object_path, c.GetAll(""))
2359
for c in tcp_server.clients.itervalues()),
2114
for c in tcp_server.clients),
2360
2115
signature="oa{sv}")
2361
2116
2362
2117
@dbus.service.method(_interface, in_signature="o")
2363
2118
def RemoveClient(self, object_path):
2364
2119
"D-Bus method"
2365
for c in tcp_server.clients.itervalues():
2120
for c in tcp_server.clients:
2366
2121
if c.dbus_object_path == object_path:
2367
del tcp_server.clients[c.name]
2122
tcp_server.clients.remove(c)
2368
2123
c.remove_from_connection()
2369
2124
# Don't signal anything except ClientRemoved
2370
2125
c.disable(quiet=True)
2384
2139
service.cleanup()
2385
2140
2386
2141
multiprocessing.active_children()
2387
if not (tcp_server.clients or client_settings):
2388
return
2389
2390
# Store client before exiting. Secrets are encrypted with key
2391
# based on what config file has. If config file is
2392
# removed/edited, old secret will thus be unrecovable.
2393
clients = {}
2394
with PGPEngine() as pgp:
2395
for client in tcp_server.clients.itervalues():
2396
key = client_settings[client.name]["secret"]
2397
client.encrypted_secret = pgp.encrypt(client.secret,
2398
key)
2399
client_dict = {}
2400
2401
# A list of attributes that can not be pickled
2402
# + secret.
2403
exclude = set(("bus", "changedstate", "secret",
2404
"checker"))
2405
for name, typ in (inspect.getmembers
2406
(dbus.service.Object)):
2407
exclude.add(name)
2408
2409
client_dict["encrypted_secret"] = (client
2410
.encrypted_secret)
2411
for attr in client.client_structure:
2412
if attr not in exclude:
2413
client_dict[attr] = getattr(client, attr)
2414
2415
clients[client.name] = client_dict
2416
del client_settings[client.name]["secret"]
2417
2418
try:
2419
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2420
prefix="clients-",
2421
dir=os.path.dirname
2422
(stored_state_path))
2423
with os.fdopen(tempfd, "wb") as stored_state:
2424
pickle.dump((clients, client_settings), stored_state)
2425
os.rename(tempname, stored_state_path)
2426
except (IOError, OSError) as e:
2427
logger.warning("Could not save persistent state: {0}"
2428
.format(e))
2429
if not debug:
2430
try:
2431
os.remove(tempname)
2432
except NameError:
2433
pass
2434
if e.errno not in set((errno.ENOENT, errno.EACCES,
2435
errno.EEXIST)):
2436
raise e
2437
2438
# Delete all clients, and settings from config
2439
2142
while tcp_server.clients:
2440
name, client = tcp_server.clients.popitem()
2143
client = tcp_server.clients.pop()
2441
2144
if use_dbus:
2442
2145
client.remove_from_connection()
2146
client.disable_hook = None
2443
2147
# Don't signal anything except ClientRemoved
2444
2148
client.disable(quiet=True)
2445
2149
if use_dbus:
2447
2151
mandos_dbus_service.ClientRemoved(client
2448
2152
.dbus_object_path,
2449
2153
client.name)
2450
client_settings.clear()
2451
2154
2452
2155
atexit.register(cleanup)
2453
2156
2454
for client in tcp_server.clients.itervalues():
2157
for client in tcp_server.clients:
2455
2158
if use_dbus:
2456
2159
# Emit D-Bus signal
2457
2160
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2458
# Need to initiate checking of clients
2459
if client.enabled:
2460
client.init_checker()
2161
client.enable()
2461
2162
2462
2163
tcp_server.enable()
2463
2164
tcp_server.server_activate()
2503
2204
# Must run before the D-Bus bus name gets deregistered
2504
2205
cleanup()
2505
2206
2207
2506
2208
if __name__ == '__main__':
2507
2209
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0