/mandos/trunk : revision 237.4.20

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

68

66

69

67

import dbus

70

68

import dbus.service

75

73

import ctypes.util

76

74

import xml.dom.minidom

77

75

import inspect

78

import GnuPGInterface

79

76

80

77

try:

81

78

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

82

except ImportError:

86

83

SO_BINDTODEVICE = None

87

84

85

88

86

version = "1.4.1"

89

stored_state_file = "clients.pickle"

90

87

91

logger = logging.getLogger()

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

92

90

syslogger = (logging.handlers.SysLogHandler

93

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

92

address = str("/dev/log")))

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(debug, level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

if debug:

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet'])

146

147

def __enter__(self):

148

return self

149

150

def __exit__ (self, exc_type, exc_value, traceback):

151

self._cleanup()

152

return False

153

154

def __del__(self):

155

self._cleanup()

156

157

def _cleanup(self):

158

if self.tempdir is not None:

159

# Delete contents of tempdir

160

for root, dirs, files in os.walk(self.tempdir,

161

topdown = False):

162

for filename in files:

163

os.remove(os.path.join(root, filename))

164

for dirname in dirs:

165

os.rmdir(os.path.join(root, dirname))

166

# Remove tempdir

167

os.rmdir(self.tempdir)

168

self.tempdir = None

169

170

def password_encode(self, password):

171

# Passphrase can not be empty and can not contain newlines or

172

# NUL bytes. So we prefix it and hex encode it.

173

return b"mandos" + binascii.hexlify(password)

174

175

def encrypt(self, data, password):

176

self.gnupg.passphrase = self.password_encode(password)

177

with open(os.devnull) as devnull:

178

try:

179

proc = self.gnupg.run(['--symmetric'],

180

create_fhs=['stdin', 'stdout'],

181

attach_fhs={'stderr': devnull})

182

with contextlib.closing(proc.handles['stdin']) as f:

183

f.write(data)

184

with contextlib.closing(proc.handles['stdout']) as f:

185

ciphertext = f.read()

186

proc.wait()

187

except IOError as e:

188

raise PGPError(e)

189

self.gnupg.passphrase = None

190

return ciphertext

191

192

def decrypt(self, data, password):

193

self.gnupg.passphrase = self.password_encode(password)

194

with open(os.devnull) as devnull:

195

try:

196

proc = self.gnupg.run(['--decrypt'],

197

create_fhs=['stdin', 'stdout'],

198

attach_fhs={'stderr': devnull})

199

with contextlib.closing(proc.handles['stdin'] ) as f:

200

f.write(data)

201

with contextlib.closing(proc.handles['stdout']) as f:

202

decrypted_plaintext = f.read()

203

proc.wait()

204

except IOError as e:

205

raise PGPError(e)

206

self.gnupg.passphrase = None

207

return decrypted_plaintext

208

209

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

210

103

211

104

class AvahiError(Exception):

212

105

def __init__(self, value, *args, **kwargs):

271

164

.GetAlternativeServiceName(self.name))

272

165

logger.info("Changing Zeroconf service name to %r ...",

273

166

self.name)

167

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

170

% self.name))

274

171

self.remove()

275

172

try:

276

173

self.add()

296

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

297

194

self.entry_group_state_changed_match = (

298

195

self.group.connect_to_signal(

299

'StateChanged', self.entry_group_state_changed))

196

'StateChanged', self .entry_group_state_changed))

300

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

301

198

self.name, self.type)

302

199

self.group.AddService(

328

225

try:

329

226

self.group.Free()

330

227

except (dbus.exceptions.UnknownMethodException,

331

dbus.exceptions.DBusException):

228

dbus.exceptions.DBusException) as e:

332

229

pass

333

230

self.group = None

334

231

self.remove()

368

265

self.server_state_changed)

369

266

self.server_state_changed(self.server.GetState())

370

267

371

class AvahiServiceToSyslog(AvahiService):

372

def rename(self):

373

"""Add the new name to the syslog messages"""

374

ret = AvahiService.rename(self)

375

syslogger.setFormatter(logging.Formatter

376

('Mandos (%s) [%%(process)d]:'

377

' %%(levelname)s: %%(message)s'

378

% self.name))

379

return ret

380

268

381

def timedelta_to_milliseconds(td):

269

def _timedelta_to_milliseconds(td):

382

270

"Convert a datetime.timedelta() to milliseconds"

383

271

return ((td.days * 24 * 60 * 60 * 1000)

384

272

+ (td.seconds * 1000)

388

276

"""A representation of a client host served by this server.

389

277

390

278

Attributes:

391

approved: bool(); 'None' if not yet approved/disapproved

279

_approved: bool(); 'None' if not yet approved/disapproved

392

280

approval_delay: datetime.timedelta(); Time to wait for approval

393

281

approval_duration: datetime.timedelta(); Duration of one approval

394

282

checker: subprocess.Popen(); a running checker process used

401

289

instance %(name)s can be used in the command.

402

290

checker_initiator_tag: a gobject event source tag, or None

403

291

created: datetime.datetime(); (UTC) object creation

404

client_structure: Object describing what attributes a client has

405

and is used for storing the client at exit

406

292

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

407

294

disable_initiator_tag: a gobject event source tag, or None

408

295

enabled: bool()

409

296

fingerprint: string (40 or 32 hexadecimal digits); used to

412

299

interval: datetime.timedelta(); How often to start a new checker

413

300

last_approval_request: datetime.datetime(); (UTC) or None

414

301

last_checked_ok: datetime.datetime(); (UTC) or None

415

last_checker_status: integer between 0 and 255 reflecting exit

416

status of last checker. -1 reflects crashed

417

checker, or None.

418

last_enabled: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

419

303

name: string; from the config file, used in log messages and

420

304

D-Bus identifiers

421

305

secret: bytestring; sent verbatim (over TLS) to client

431

315

"created", "enabled", "fingerprint",

432

316

"host", "interval", "last_checked_ok",

433

317

"last_enabled", "name", "timeout")

434

client_defaults = { "timeout": "5m",

435

"extended_timeout": "15m",

436

"interval": "2m",

437

"checker": "fping -q -- %%(host)s",

438

"host": "",

439

"approval_delay": "0s",

440

"approval_duration": "1s",

441

"approved_by_default": "True",

442

"enabled": "True",

443

}

444

318

445

319

def timeout_milliseconds(self):

446

320

"Return the 'timeout' attribute in milliseconds"

447

return timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

448

322

449

323

def extended_timeout_milliseconds(self):

450

324

"Return the 'extended_timeout' attribute in milliseconds"

451

return timedelta_to_milliseconds(self.extended_timeout)

325

return _timedelta_to_milliseconds(self.extended_timeout)

452

326

453

327

def interval_milliseconds(self):

454

328

"Return the 'interval' attribute in milliseconds"

455

return timedelta_to_milliseconds(self.interval)

329

return _timedelta_to_milliseconds(self.interval)

456

330

457

331

def approval_delay_milliseconds(self):

458

return timedelta_to_milliseconds(self.approval_delay)

459

460

@staticmethod

461

def config_parser(config):

462

""" Construct a new dict of client settings of this form:

463

{ client_name: {setting_name: value, ...}, ...}

464

with exceptions for any special settings as defined above"""

465

settings = {}

466

for client_name in config.sections():

467

section = dict(config.items(client_name))

468

client = settings[client_name] = {}

469

470

client["host"] = section["host"]

471

# Reformat values from string types to Python types

472

client["approved_by_default"] = config.getboolean(

473

client_name, "approved_by_default")

474

client["enabled"] = config.getboolean(client_name, "enabled")

475

476

client["fingerprint"] = (section["fingerprint"].upper()

477

.replace(" ", ""))

478

if "secret" in section:

479

client["secret"] = section["secret"].decode("base64")

480

elif "secfile" in section:

481

with open(os.path.expanduser(os.path.expandvars

482

(section["secfile"])),

483

"rb") as secfile:

484

client["secret"] = secfile.read()

485

else:

486

raise TypeError("No secret or secfile for section %s"

487

% section)

488

client["timeout"] = string_to_delta(section["timeout"])

489

client["extended_timeout"] = string_to_delta(

490

section["extended_timeout"])

491

client["interval"] = string_to_delta(section["interval"])

492

client["approval_delay"] = string_to_delta(

493

section["approval_delay"])

494

client["approval_duration"] = string_to_delta(

495

section["approval_duration"])

496

client["checker_command"] = section["checker"]

497

client["last_approval_request"] = None

498

client["last_checked_ok"] = None

499

client["last_checker_status"] = None

500

if client["enabled"]:

501

client["last_enabled"] = datetime.datetime.utcnow()

502

client["expires"] = (datetime.datetime.utcnow()

503

+ client["timeout"])

504

else:

505

client["last_enabled"] = None

506

client["expires"] = None

507

508

return settings

509

510

511

def __init__(self, settings, name = None):

332

return _timedelta_to_milliseconds(self.approval_delay)

333

334

def __init__(self, name = None, disable_hook=None, config=None):

512

335

"""Note: the 'checker' key in 'config' sets the

513

336

'checker_command' attribute and *not* the 'checker'

514

337

attribute."""

515

338

self.name = name

516

# adding all client settings

517

for setting, value in settings.iteritems():

518

setattr(self, setting, value)

519

339

if config is None:

340

config = {}

520

341

logger.debug("Creating client %r", self.name)

521

342

# Uppercase and remove spaces from fingerprint for later

522

343

# comparison purposes with return value from the fingerprint()

523

344

# function

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

524

347

logger.debug(" Fingerprint: %s", self.fingerprint)

525

self.created = settings.get("created", datetime.datetime.utcnow())

526

527

# attributes specific for this server instance

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

351

with open(os.path.expanduser(os.path.expandvars

352

(config["secfile"])),

353

"rb") as secfile:

354

self.secret = secfile.read()

355

else:

356

raise TypeError("No secret or secfile for client %s"

357

% self.name)

358

self.host = config.get("host", "")

359

self.created = datetime.datetime.utcnow()

360

self.enabled = False

361

self.last_approval_request = None

362

self.last_enabled = None

363

self.last_checked_ok = None

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

368

self.disable_hook = disable_hook

528

369

self.checker = None

529

370

self.checker_initiator_tag = None

530

371

self.disable_initiator_tag = None

372

self.expires = None

531

373

self.checker_callback_tag = None

374

self.checker_command = config["checker"]

532

375

self.current_checker_command = None

533

self.approved = None

376

self.last_connect = None

377

self._approved = None

378

self.approved_by_default = config.get("approved_by_default",

379

True)

534

380

self.approvals_pending = 0

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

535

385

self.changedstate = (multiprocessing_manager

536

386

.Condition(multiprocessing_manager

537

387

.Lock()))

538

self.client_structure = [attr for attr in

539

self.__dict__.iterkeys()

540

if not attr.startswith("_")]

541

self.client_structure.append("client_structure")

542

543

for name, t in inspect.getmembers(type(self),

544

lambda obj:

545

isinstance(obj,

546

property)):

547

if not name.startswith("_"):

548

self.client_structure.append(name)

549

388

550

# Send notice to process children that client state has changed

551

389

def send_changedstate(self):

552

with self.changedstate:

553

self.changedstate.notify_all()

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

554

393

555

394

def enable(self):

556

395

"""Start this client's checker and timeout hooks"""

558

397

# Already enabled

559

398

return

560

399

self.send_changedstate()

400

# Schedule a new checker to be started an 'interval' from now,

401

# and every interval from then on.

402

self.checker_initiator_tag = (gobject.timeout_add

403

(self.interval_milliseconds(),

404

self.start_checker))

405

# Schedule a disable() when 'timeout' has passed

561

406

self.expires = datetime.datetime.utcnow() + self.timeout

407

self.disable_initiator_tag = (gobject.timeout_add

408

(self.timeout_milliseconds(),

409

self.disable))

562

410

self.enabled = True

563

411

self.last_enabled = datetime.datetime.utcnow()

564

self.init_checker()

412

# Also start a new checker *right now*.

413

self.start_checker()

565

414

566

415

def disable(self, quiet=True):

567

416

"""Disable this client."""

579

428

gobject.source_remove(self.checker_initiator_tag)

580

429

self.checker_initiator_tag = None

581

430

self.stop_checker()

431

if self.disable_hook:

432

self.disable_hook(self)

582

433

self.enabled = False

583

434

# Do not run this again if called by a gobject.timeout_add

584

435

return False

585

436

586

437

def __del__(self):

438

self.disable_hook = None

587

439

self.disable()

588

440

589

def init_checker(self):

590

# Schedule a new checker to be started an 'interval' from now,

591

# and every interval from then on.

592

self.checker_initiator_tag = (gobject.timeout_add

593

(self.interval_milliseconds(),

594

self.start_checker))

595

# Schedule a disable() when 'timeout' has passed

596

self.disable_initiator_tag = (gobject.timeout_add

597

(self.timeout_milliseconds(),

598

self.disable))

599

# Also start a new checker *right now*.

600

self.start_checker()

601

602

441

def checker_callback(self, pid, condition, command):

603

442

"""The checker has completed, so take appropriate actions."""

604

443

self.checker_callback_tag = None

605

444

self.checker = None

606

445

if os.WIFEXITED(condition):

607

self.last_checker_status = os.WEXITSTATUS(condition)

608

if self.last_checker_status == 0:

446

exitstatus = os.WEXITSTATUS(condition)

447

if exitstatus == 0:

609

448

logger.info("Checker for %(name)s succeeded",

610

449

vars(self))

611

450

self.checked_ok()

613

452

logger.info("Checker for %(name)s failed",

614

453

vars(self))

615

454

else:

616

self.last_checker_status = -1

617

455

logger.warning("Checker for %(name)s crashed?",

618

456

vars(self))

619

457

630

468

gobject.source_remove(self.disable_initiator_tag)

631

469

if getattr(self, "enabled", False):

632

470

self.disable_initiator_tag = (gobject.timeout_add

633

(timedelta_to_milliseconds

471

(_timedelta_to_milliseconds

634

472

(timeout), self.disable))

635

473

self.expires = datetime.datetime.utcnow() + timeout

636

474

853

691

854

692

Note: Will not include properties with access="write".

855

693

"""

856

properties = {}

694

all = {}

857

695

for name, prop in self._get_all_dbus_properties():

858

696

if (interface_name

859

697

and interface_name != prop._dbus_interface):

864

702

continue

865

703

value = prop()

866

704

if not hasattr(value, "variant_level"):

867

properties[name] = value

705

all[name] = value

868

706

continue

869

properties[name] = type(value)(value, variant_level=

870

value.variant_level+1)

871

return dbus.Dictionary(properties, signature="sv")

707

all[name] = type(value)(value, variant_level=

708

value.variant_level+1)

709

return dbus.Dictionary(all, signature="sv")

872

710

873

711

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

874

712

out_signature="s",

925

763

return dbus.String(dt.isoformat(),

926

764

variant_level=variant_level)

927

765

928

929

766

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

930

767

.__metaclass__):

931

768

"""Applied to an empty subclass of a D-Bus object, this metaclass

1023

860

attribute.func_closure)))

1024

861

return type.__new__(mcs, name, bases, attr)

1025

862

1026

1027

863

class ClientDBus(Client, DBusObjectWithProperties):

1028

864

"""A Client class using D-Bus

1029

865

1038

874

# dbus.service.Object doesn't use super(), so we can't either.

1039

875

1040

876

def __init__(self, bus = None, *args, **kwargs):

877

self._approvals_pending = 0

1041

878

self.bus = bus

1042

879

Client.__init__(self, *args, **kwargs)

1043

self._approvals_pending = 0

1044

1045

self._approvals_pending = 0

1046

880

# Only now, when this client is initialized, can it show up on

1047

881

# the D-Bus

1048

882

client_object_name = unicode(self.name).translate(

1058

892

variant_level=1):

1059

893

""" Modify a variable so that it's a property which announces

1060

894

its changes to DBus.

1061

895

1062

896

transform_fun: Function that takes a value and a variant_level

1063

897

and transforms it to a D-Bus type.

1064

898

dbus_name: D-Bus name of the variable

1098

932

datetime_to_dbus, "LastApprovalRequest")

1099

933

approved_by_default = notifychangeproperty(dbus.Boolean,

1100

934

"ApprovedByDefault")

1101

approval_delay = notifychangeproperty(dbus.UInt64,

935

approval_delay = notifychangeproperty(dbus.UInt16,

1102

936

"ApprovalDelay",

1103

937

type_func =

1104

timedelta_to_milliseconds)

938

_timedelta_to_milliseconds)

1105

939

approval_duration = notifychangeproperty(

1106

dbus.UInt64, "ApprovalDuration",

1107

type_func = timedelta_to_milliseconds)

940

dbus.UInt16, "ApprovalDuration",

941

type_func = _timedelta_to_milliseconds)

1108

942

host = notifychangeproperty(dbus.String, "Host")

1109

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

943

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1110

944

type_func =

1111

timedelta_to_milliseconds)

945

_timedelta_to_milliseconds)

1112

946

extended_timeout = notifychangeproperty(

1113

dbus.UInt64, "ExtendedTimeout",

1114

type_func = timedelta_to_milliseconds)

1115

interval = notifychangeproperty(dbus.UInt64,

947

dbus.UInt16, "ExtendedTimeout",

948

type_func = _timedelta_to_milliseconds)

949

interval = notifychangeproperty(dbus.UInt16,

1116

950

"Interval",

1117

951

type_func =

1118

timedelta_to_milliseconds)

952

_timedelta_to_milliseconds)

1119

953

checker_command = notifychangeproperty(dbus.String, "Checker")

1120

954

1121

955

del notifychangeproperty

1163

997

return r

1164

998

1165

999

def _reset_approved(self):

1166

self.approved = None

1000

self._approved = None

1167

1001

return False

1168

1002

1169

1003

def approve(self, value=True):

1170

1004

self.send_changedstate()

1171

self.approved = value

1172

gobject.timeout_add(timedelta_to_milliseconds

1005

self._approved = value

1006

gobject.timeout_add(_timedelta_to_milliseconds

1173

1007

(self.approval_duration),

1174

1008

self._reset_approved)

1175

1009

1218

1052

"D-Bus signal"

1219

1053

return self.need_approval()

1220

1054

1221

# NeRwequest - signal

1222

@dbus.service.signal(_interface, signature="s")

1223

def NewRequest(self, ip):

1224

"""D-Bus signal

1225

Is sent after a client request a password.

1226

"""

1227

pass

1228

1229

1055

## Methods

1230

1056

1231

1057

# Approve - method

1289

1115

access="readwrite")

1290

1116

def ApprovalDuration_dbus_property(self, value=None):

1291

1117

if value is None: # get

1292

return dbus.UInt64(timedelta_to_milliseconds(

1118

return dbus.UInt64(_timedelta_to_milliseconds(

1293

1119

self.approval_duration))

1294

1120

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1295

1121

1309

1135

def Host_dbus_property(self, value=None):

1310

1136

if value is None: # get

1311

1137

return dbus.String(self.host)

1312

self.host = unicode(value)

1138

self.host = value

1313

1139

1314

1140

# Created - property

1315

1141

@dbus_service_property(_interface, signature="s", access="read")

1316

1142

def Created_dbus_property(self):

1317

return datetime_to_dbus(self.created)

1143

return dbus.String(datetime_to_dbus(self.created))

1318

1144

1319

1145

# LastEnabled - property

1320

1146

@dbus_service_property(_interface, signature="s", access="read")

1364

1190

gobject.source_remove(self.disable_initiator_tag)

1365

1191

self.disable_initiator_tag = None

1366

1192

self.expires = None

1367

time_to_die = timedelta_to_milliseconds((self

1368

.last_checked_ok

1369

+ self.timeout)

1370

- datetime.datetime

1371

.utcnow())

1193

time_to_die = _timedelta_to_milliseconds((self

1194

.last_checked_ok

1195

+ self.timeout)

1196

- datetime.datetime

1197

.utcnow())

1372

1198

if time_to_die <= 0:

1373

1199

# The timeout has passed

1374

1200

self.disable()

1396

1222

self.interval = datetime.timedelta(0, 0, 0, value)

1397

1223

if getattr(self, "checker_initiator_tag", None) is None:

1398

1224

return

1399

if self.enabled:

1400

# Reschedule checker run

1401

gobject.source_remove(self.checker_initiator_tag)

1402

self.checker_initiator_tag = (gobject.timeout_add

1403

(value, self.start_checker))

1404

self.start_checker() # Start one now, too

1225

# Reschedule checker run

1226

gobject.source_remove(self.checker_initiator_tag)

1227

self.checker_initiator_tag = (gobject.timeout_add

1228

(value, self.start_checker))

1229

self.start_checker() # Start one now, too

1405

1230

1406

1231

# Checker - property

1407

1232

@dbus_service_property(_interface, signature="s",

1409

1234

def Checker_dbus_property(self, value=None):

1410

1235

if value is None: # get

1411

1236

return dbus.String(self.checker_command)

1412

self.checker_command = unicode(value)

1237

self.checker_command = value

1413

1238

1414

1239

# CheckerRunning - property

1415

1240

@dbus_service_property(_interface, signature="b",

1444

1269

raise KeyError()

1445

1270

1446

1271

def __getattribute__(self, name):

1447

if name == '_pipe':

1272

if(name == '_pipe'):

1448

1273

return super(ProxyClient, self).__getattribute__(name)

1449

1274

self._pipe.send(('getattr', name))

1450

1275

data = self._pipe.recv()

1457

1282

return func

1458

1283

1459

1284

def __setattr__(self, name, value):

1460

if name == '_pipe':

1285

if(name == '_pipe'):

1461

1286

return super(ProxyClient, self).__setattr__(name, value)

1462

1287

self._pipe.send(('setattr', name, value))

1463

1288

1464

1465

1289

class ClientDBusTransitional(ClientDBus):

1466

1290

__metaclass__ = AlternateDBusNamesMetaclass

1467

1291

1468

1469

1292

class ClientHandler(socketserver.BaseRequestHandler, object):

1470

1293

"""A class to handle client connections.

1471

1294

1539

1362

except KeyError:

1540

1363

return

1541

1364

1542

if self.server.use_dbus:

1543

# Emit D-Bus signal

1544

client.NewRequest(str(self.client_address))

1545

1546

1365

if client.approval_delay:

1547

1366

delay = client.approval_delay

1548

1367

client.approvals_pending += 1

1557

1376

client.Rejected("Disabled")

1558

1377

return

1559

1378

1560

if client.approved or not client.approval_delay:

1379

if client._approved or not client.approval_delay:

1561

1380

#We are approved or approval is disabled

1562

1381

break

1563

elif client.approved is None:

1382

elif client._approved is None:

1564

1383

logger.info("Client %s needs approval",

1565

1384

client.name)

1566

1385

if self.server.use_dbus:

1580

1399

time = datetime.datetime.now()

1581

1400

client.changedstate.acquire()

1582

1401

(client.changedstate.wait

1583

(float(client.timedelta_to_milliseconds(delay)

1402

(float(client._timedelta_to_milliseconds(delay)

1584

1403

/ 1000)))

1585

1404

client.changedstate.release()

1586

1405

time2 = datetime.datetime.now()

1685

1504

# Convert the buffer to a Python bytestring

1686

1505

fpr = ctypes.string_at(buf, buf_len.value)

1687

1506

# Convert the bytestring to hexadecimal notation

1688

hex_fpr = binascii.hexlify(fpr).upper()

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1689

1508

return hex_fpr

1690

1509

1691

1510

1694

1513

def sub_process_main(self, request, address):

1695

1514

try:

1696

1515

self.finish_request(request, address)

1697

except Exception:

1516

except:

1698

1517

self.handle_error(request, address)

1699

1518

self.close_request(request)

1700

1519

1805

1624

self.enabled = False

1806

1625

self.clients = clients

1807

1626

if self.clients is None:

1808

self.clients = {}

1627

self.clients = set()

1809

1628

self.use_dbus = use_dbus

1810

1629

self.gnutls_priority = gnutls_priority

1811

1630

IPv6_TCPServer.__init__(self, server_address,

1858

1677

fpr = request[1]

1859

1678

address = request[2]

1860

1679

1861

for c in self.clients.itervalues():

1680

for c in self.clients:

1862

1681

if c.fingerprint == fpr:

1863

1682

client = c

1864

1683

break

1948

1767

return timevalue

1949

1768

1950

1769

1770

def if_nametoindex(interface):

1771

"""Call the C function if_nametoindex(), or equivalent

1772

1773

Note: This function cannot accept a unicode string."""

1774

global if_nametoindex

1775

try:

1776

if_nametoindex = (ctypes.cdll.LoadLibrary

1777

(ctypes.util.find_library("c"))

1778

.if_nametoindex)

1779

except (OSError, AttributeError):

1780

logger.warning("Doing if_nametoindex the hard way")

1781

def if_nametoindex(interface):

1782

"Get an interface index the hard way, i.e. using fcntl()"

1783

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1784

with contextlib.closing(socket.socket()) as s:

1785

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1786

struct.pack(str("16s16x"),

1787

interface))

1788

interface_index = struct.unpack(str("I"),

1789

ifreq[16:20])[0]

1790

return interface_index

1791

return if_nametoindex(interface)

1792

1793

1951

1794

def daemon(nochdir = False, noclose = False):

1952

1795

"""See daemon(3). Standard BSD Unix function.

1953

1796

2008

1851

" system bus interface")

2009

1852

parser.add_argument("--no-ipv6", action="store_false",

2010

1853

dest="use_ipv6", help="Do not use IPv6")

2011

parser.add_argument("--no-restore", action="store_false",

2012

dest="restore", help="Do not restore stored"

2013

" state")

2014

parser.add_argument("--statedir", metavar="DIR",

2015

help="Directory to save/restore state in")

2016

2017

1854

options = parser.parse_args()

2018

1855

2019

1856

if options.check:

2032

1869

"use_dbus": "True",

2033

1870

"use_ipv6": "True",

2034

1871

"debuglevel": "",

2035

"restore": "True",

2036

"statedir": "/var/lib/mandos"

2037

1872

}

2038

1873

2039

1874

# Parse config file for server-global settings

2056

1891

# options, if set.

2057

1892

for option in ("interface", "address", "port", "debug",

2058

1893

"priority", "servicename", "configdir",

2059

"use_dbus", "use_ipv6", "debuglevel", "restore",

2060

"statedir"):

1894

"use_dbus", "use_ipv6", "debuglevel"):

2061

1895

value = getattr(options, option)

2062

1896

if value is not None:

2063

1897

server_settings[option] = value

2075

1909

debuglevel = server_settings["debuglevel"]

2076

1910

use_dbus = server_settings["use_dbus"]

2077

1911

use_ipv6 = server_settings["use_ipv6"]

2078

stored_state_path = os.path.join(server_settings["statedir"],

2079

stored_state_file)

2080

2081

if debug:

2082

initlogger(debug, logging.DEBUG)

2083

else:

2084

if not debuglevel:

2085

initlogger(debug)

2086

else:

2087

level = getattr(logging, debuglevel.upper())

2088

initlogger(debug, level)

2089

1912

2090

1913

if server_settings["servicename"] != "Mandos":

2091

1914

syslogger.setFormatter(logging.Formatter

2094

1917

% server_settings["servicename"]))

2095

1918

2096

1919

# Parse config file with clients

2097

client_config = configparser.SafeConfigParser(Client.client_defaults)

1920

client_defaults = { "timeout": "5m",

1921

"extended_timeout": "15m",

1922

"interval": "2m",

1923

"checker": "fping -q -- %%(host)s",

1924

"host": "",

1925

"approval_delay": "0s",

1926

"approval_duration": "1s",

1927

}

1928

client_config = configparser.SafeConfigParser(client_defaults)

2098

1929

client_config.read(os.path.join(server_settings["configdir"],

2099

1930

"clients.conf"))

2100

1931

2138

1969

if error[0] != errno.EPERM:

2139

1970

raise error

2140

1971

1972

if not debug and not debuglevel:

1973

syslogger.setLevel(logging.WARNING)

1974

console.setLevel(logging.WARNING)

1975

if debuglevel:

1976

level = getattr(logging, debuglevel.upper())

1977

syslogger.setLevel(level)

1978

console.setLevel(level)

1979

2141

1980

if debug:

2142

1981

# Enable all possible GnuTLS debugging

2143

1982

2157

1996

os.dup2(null, sys.stdin.fileno())

2158

1997

if null > 2:

2159

1998

os.close(null)

1999

else:

2000

# No console logging

2001

logger.removeHandler(console)

2160

2002

2161

2003

# Need to fork before connecting to D-Bus

2162

2004

if not debug:

2163

2005

# Close all input and output, do double fork, etc.

2164

2006

daemon()

2165

2007

2166

gobject.threads_init()

2167

2168

2008

global main_loop

2169

2009

# From the Avahi example code

2170

2010

DBusGMainLoop(set_as_default=True )

2184

2024

server_settings["use_dbus"] = False

2185

2025

tcp_server.use_dbus = False

2186

2026

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2187

service = AvahiServiceToSyslog(name =

2188

server_settings["servicename"],

2189

servicetype = "_mandos._tcp",

2190

protocol = protocol, bus = bus)

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

2029

protocol = protocol, bus = bus)

2191

2030

if server_settings["interface"]:

2192

2031

service.interface = (if_nametoindex

2193

2032

(str(server_settings["interface"])))

2199

2038

if use_dbus:

2200

2039

client_class = functools.partial(ClientDBusTransitional,

2201

2040

bus = bus)

2202

2203

client_settings = Client.config_parser(client_config)

2204

old_client_settings = {}

2205

clients_data = {}

2206

2207

# Get client data and settings from last running state.

2208

if server_settings["restore"]:

2209

try:

2210

with open(stored_state_path, "rb") as stored_state:

2211

clients_data, old_client_settings = (pickle.load

2212

(stored_state))

2213

os.remove(stored_state_path)

2214

except IOError as e:

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2218

raise

2219

except EOFError as e:

2220

logger.warning("Could not load persistent state: "

2221

"EOFError: {0}".format(e))

2222

2223

with PGPEngine() as pgp:

2224

for client_name, client in clients_data.iteritems():

2225

# Decide which value to use after restoring saved state.

2226

# We have three different values: Old config file,

2227

# new config file, and saved state.

2228

# New config value takes precedence if it differs from old

2229

# config value, otherwise use saved state.

2230

for name, value in client_settings[client_name].items():

2231

try:

2232

# For each value in new config, check if it

2233

# differs from the old config value (Except for

2234

# the "secret" attribute)

2235

if (name != "secret" and

2236

value != old_client_settings[client_name]

2237

[name]):

2238

client[name] = value

2239

except KeyError:

2240

pass

2241

2242

# Clients who has passed its expire date can still be

2243

# enabled if its last checker was successful. Clients

2244

# whose checker failed before we stored its state is

2245

# assumed to have failed all checkers during downtime.

2246

if client["enabled"]:

2247

if datetime.datetime.utcnow() >= client["expires"]:

2248

if not client["last_checked_ok"]:

2249

logger.warning(

2250

"disabling client {0} - Client never "

2251

"performed a successfull checker"

2252

.format(client["name"]))

2253

client["enabled"] = False

2254

elif client["last_checker_status"] != 0:

2255

logger.warning(

2256

"disabling client {0} - Client "

2257

"last checker failed with error code {1}"

2258

.format(client["name"],

2259

client["last_checker_status"]))

2260

client["enabled"] = False

2261

else:

2262

client["expires"] = (datetime.datetime

2263

.utcnow()

2264

+ client["timeout"])

2265

2041

def client_config_items(config, section):

2042

special_settings = {

2043

"approved_by_default":

2044

lambda: config.getboolean(section,

2045

"approved_by_default"),

2046

}

2047

for name, value in config.items(section):

2266

2048

try:

2267

client["secret"] = (

2268

pgp.decrypt(client["encrypted_secret"],

2269

client_settings[client_name]

2270

["secret"]))

2271

except PGPError:

2272

# If decryption fails, we use secret from new settings

2273

logger.debug("Failed to decrypt {0} old secret"

2274

.format(client_name))

2275

client["secret"] = (

2276

client_settings[client_name]["secret"])

2277

2278

2279

# Add/remove clients based on new changes made to config

2280

for client_name in set(old_client_settings) - set(client_settings):

2281

del clients_data[client_name]

2282

for client_name in set(client_settings) - set(old_client_settings):

2283

clients_data[client_name] = client_settings[client_name]

2284

2285

# Create clients all clients

2286

for client_name, client in clients_data.iteritems():

2287

tcp_server.clients[client_name] = client_class(

2288

name = client_name, settings = client)

2289

2049

yield (name, special_settings[name]())

2050

except KeyError:

2051

yield (name, value)

2052

2053

tcp_server.clients.update(set(

2054

client_class(name = section,

2055

config= dict(client_config_items(

2056

client_config, section)))

2057

for section in client_config.sections()))

2290

2058

if not tcp_server.clients:

2291

2059

logger.warning("No clients defined")

2292

2060

2303

2071

# "pidfile" was never created

2304

2072

pass

2305

2073

del pidfilename

2074

2306

2075

signal.signal(signal.SIGINT, signal.SIG_IGN)

2307

2076

2308

2077

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2334

2103

def GetAllClients(self):

2335

2104

"D-Bus method"

2336

2105

return dbus.Array(c.dbus_object_path

2337

for c in

2338

tcp_server.clients.itervalues())

2106

for c in tcp_server.clients)

2339

2107

2340

2108

@dbus.service.method(_interface,

2341

2109

out_signature="a{oa{sv}}")

2343

2111

"D-Bus method"

2344

2112

return dbus.Dictionary(

2345

2113

((c.dbus_object_path, c.GetAll(""))

2346

for c in tcp_server.clients.itervalues()),

2114

for c in tcp_server.clients),

2347

2115

signature="oa{sv}")

2348

2116

2349

2117

@dbus.service.method(_interface, in_signature="o")

2350

2118

def RemoveClient(self, object_path):

2351

2119

"D-Bus method"

2352

for c in tcp_server.clients.itervalues():

2120

for c in tcp_server.clients:

2353

2121

if c.dbus_object_path == object_path:

2354

del tcp_server.clients[c.name]

2122

tcp_server.clients.remove(c)

2355

2123

c.remove_from_connection()

2356

2124

# Don't signal anything except ClientRemoved

2357

2125

c.disable(quiet=True)

2371

2139

service.cleanup()

2372

2140

2373

2141

multiprocessing.active_children()

2374

if not (tcp_server.clients or client_settings):

2375

return

2376

2377

# Store client before exiting. Secrets are encrypted with key

2378

# based on what config file has. If config file is

2379

# removed/edited, old secret will thus be unrecovable.

2380

clients = {}

2381

with PGPEngine() as pgp:

2382

for client in tcp_server.clients.itervalues():

2383

key = client_settings[client.name]["secret"]

2384

client.encrypted_secret = pgp.encrypt(client.secret,

2385

key)

2386

client_dict = {}

2387

2388

# A list of attributes that can not be pickled

2389

# + secret.

2390

exclude = set(("bus", "changedstate", "secret",

2391

"checker"))

2392

for name, typ in (inspect.getmembers

2393

(dbus.service.Object)):

2394

exclude.add(name)

2395

2396

client_dict["encrypted_secret"] = (client

2397

.encrypted_secret)

2398

for attr in client.client_structure:

2399

if attr not in exclude:

2400

client_dict[attr] = getattr(client, attr)

2401

2402

clients[client.name] = client_dict

2403

del client_settings[client.name]["secret"]

2404

2405

try:

2406

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2407

prefix="clients-",

2408

dir=os.path.dirname

2409

(stored_state_path))

2410

with os.fdopen(tempfd, "wb") as stored_state:

2411

pickle.dump((clients, client_settings), stored_state)

2412

os.rename(tempname, stored_state_path)

2413

except (IOError, OSError) as e:

2414

logger.warning("Could not save persistent state: {0}"

2415

.format(e))

2416

if not debug:

2417

try:

2418

os.remove(tempname)

2419

except NameError:

2420

pass

2421

if e.errno not in set((errno.ENOENT, errno.EACCES,

2422

errno.EEXIST)):

2423

raise e

2424

2425

# Delete all clients, and settings from config

2426

2142

while tcp_server.clients:

2427

name, client = tcp_server.clients.popitem()

2143

client = tcp_server.clients.pop()

2428

2144

if use_dbus:

2429

2145

client.remove_from_connection()

2146

client.disable_hook = None

2430

2147

# Don't signal anything except ClientRemoved

2431

2148

client.disable(quiet=True)

2432

2149

if use_dbus:

2434

2151

mandos_dbus_service.ClientRemoved(client

2435

2152

.dbus_object_path,

2436

2153

client.name)

2437

client_settings.clear()

2438

2154

2439

2155

atexit.register(cleanup)

2440

2156

2441

for client in tcp_server.clients.itervalues():

2157

for client in tcp_server.clients:

2442

2158

if use_dbus:

2443

2159

# Emit D-Bus signal

2444

2160

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2445

# Need to initiate checking of clients

2446

if client.enabled:

2447

client.init_checker()

2161

client.enable()

2448

2162

2449

2163

tcp_server.enable()

2450

2164

tcp_server.server_activate()

2490

2204

# Must run before the D-Bus bus name gets deregistered

2491

2205

cleanup()

2492

2206

2207

2493

2208

if __name__ == '__main__':

2494

2209

main()