To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 502
- compare with another revision
- download diff
- download tarball
- view history from revision 502
- Committer: Teddy Hogeborn
- Date: 2011-09-26 19:36:18 UTC
- mfrom: (24.1.184 mandos)
- Revision ID: teddy@fukt.bsnet.se-20110926193618-vtj5c9hena1maixx
Merge from Björn
- files removed:
- debian/source/local-options
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
62
62
import functools
63
63
import cPickle as pickle
64
64
import multiprocessing
65
import types
66
import binascii
67
import tempfile
68
65
69
66
import dbus
70
67
import dbus.service
75
72
import ctypes.util
76
73
import xml.dom.minidom
77
74
import inspect
78
import GnuPGInterface
79
75
80
76
try:
81
77
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
81
except ImportError:
86
82
SO_BINDTODEVICE = None
87
83
88
version = "1.5.1"
89
stored_state_file = "clients.pickle"
90
91
logger = logging.getLogger()
84
85
version = "1.3.1"
86
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
92
89
syslogger = (logging.handlers.SysLogHandler
93
90
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
91
address = str("/dev/log")))
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(debug, level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
if debug:
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet',
146
'--no-use-agent'])
147
148
def __enter__(self):
149
return self
150
151
def __exit__ (self, exc_type, exc_value, traceback):
152
self._cleanup()
153
return False
154
155
def __del__(self):
156
self._cleanup()
157
158
def _cleanup(self):
159
if self.tempdir is not None:
160
# Delete contents of tempdir
161
for root, dirs, files in os.walk(self.tempdir,
162
topdown = False):
163
for filename in files:
164
os.remove(os.path.join(root, filename))
165
for dirname in dirs:
166
os.rmdir(os.path.join(root, dirname))
167
# Remove tempdir
168
os.rmdir(self.tempdir)
169
self.tempdir = None
170
171
def password_encode(self, password):
172
# Passphrase can not be empty and can not contain newlines or
173
# NUL bytes. So we prefix it and hex encode it.
174
return b"mandos" + binascii.hexlify(password)
175
176
def encrypt(self, data, password):
177
self.gnupg.passphrase = self.password_encode(password)
178
with open(os.devnull) as devnull:
179
try:
180
proc = self.gnupg.run(['--symmetric'],
181
create_fhs=['stdin', 'stdout'],
182
attach_fhs={'stderr': devnull})
183
with contextlib.closing(proc.handles['stdin']) as f:
184
f.write(data)
185
with contextlib.closing(proc.handles['stdout']) as f:
186
ciphertext = f.read()
187
proc.wait()
188
except IOError as e:
189
raise PGPError(e)
190
self.gnupg.passphrase = None
191
return ciphertext
192
193
def decrypt(self, data, password):
194
self.gnupg.passphrase = self.password_encode(password)
195
with open(os.devnull) as devnull:
196
try:
197
proc = self.gnupg.run(['--decrypt'],
198
create_fhs=['stdin', 'stdout'],
199
attach_fhs={'stderr': devnull})
200
with contextlib.closing(proc.handles['stdin'] ) as f:
201
f.write(data)
202
with contextlib.closing(proc.handles['stdout']) as f:
203
decrypted_plaintext = f.read()
204
proc.wait()
205
except IOError as e:
206
raise PGPError(e)
207
self.gnupg.passphrase = None
208
return decrypted_plaintext
209
210
92
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
95
logger.addHandler(syslogger)
96
97
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
101
logger.addHandler(console)
211
102
212
103
class AvahiError(Exception):
213
104
def __init__(self, value, *args, **kwargs):
268
159
" after %i retries, exiting.",
269
160
self.rename_count)
270
161
raise AvahiServiceError("Too many renames")
271
self.name = unicode(self.server
272
.GetAlternativeServiceName(self.name))
162
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
273
163
logger.info("Changing Zeroconf service name to %r ...",
274
164
self.name)
165
syslogger.setFormatter(logging.Formatter
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
168
% self.name))
275
169
self.remove()
276
170
try:
277
171
self.add()
297
191
avahi.DBUS_INTERFACE_ENTRY_GROUP)
298
192
self.entry_group_state_changed_match = (
299
193
self.group.connect_to_signal(
300
'StateChanged', self.entry_group_state_changed))
194
'StateChanged', self .entry_group_state_changed))
301
195
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
302
196
self.name, self.type)
303
197
self.group.AddService(
329
223
try:
330
224
self.group.Free()
331
225
except (dbus.exceptions.UnknownMethodException,
332
dbus.exceptions.DBusException):
226
dbus.exceptions.DBusException) as e:
333
227
pass
334
228
self.group = None
335
229
self.remove()
369
263
self.server_state_changed)
370
264
self.server_state_changed(self.server.GetState())
371
265
372
class AvahiServiceToSyslog(AvahiService):
373
def rename(self):
374
"""Add the new name to the syslog messages"""
375
ret = AvahiService.rename(self)
376
syslogger.setFormatter(logging.Formatter
377
('Mandos (%s) [%%(process)d]:'
378
' %%(levelname)s: %%(message)s'
379
% self.name))
380
return ret
381
266
382
def timedelta_to_milliseconds(td):
267
def _timedelta_to_milliseconds(td):
383
268
"Convert a datetime.timedelta() to milliseconds"
384
269
return ((td.days * 24 * 60 * 60 * 1000)
385
270
+ (td.seconds * 1000)
389
274
"""A representation of a client host served by this server.
390
275
391
276
Attributes:
392
approved: bool(); 'None' if not yet approved/disapproved
277
_approved: bool(); 'None' if not yet approved/disapproved
393
278
approval_delay: datetime.timedelta(); Time to wait for approval
394
279
approval_duration: datetime.timedelta(); Duration of one approval
395
280
checker: subprocess.Popen(); a running checker process used
402
287
instance %(name)s can be used in the command.
403
288
checker_initiator_tag: a gobject event source tag, or None
404
289
created: datetime.datetime(); (UTC) object creation
405
client_structure: Object describing what attributes a client has
406
and is used for storing the client at exit
407
290
current_checker_command: string; current running checker_command
291
disable_hook: If set, called by disable() as disable_hook(self)
408
292
disable_initiator_tag: a gobject event source tag, or None
409
293
enabled: bool()
410
294
fingerprint: string (40 or 32 hexadecimal digits); used to
413
297
interval: datetime.timedelta(); How often to start a new checker
414
298
last_approval_request: datetime.datetime(); (UTC) or None
415
299
last_checked_ok: datetime.datetime(); (UTC) or None
416
last_checker_status: integer between 0 and 255 reflecting exit
417
status of last checker. -1 reflects crashed
418
checker, or None.
419
last_enabled: datetime.datetime(); (UTC) or None
300
last_enabled: datetime.datetime(); (UTC)
420
301
name: string; from the config file, used in log messages and
421
302
D-Bus identifiers
422
303
secret: bytestring; sent verbatim (over TLS) to client
423
304
timeout: datetime.timedelta(); How long from last_checked_ok
424
305
until this client is disabled
425
extended_timeout: extra long timeout when secret has been sent
306
extended_timeout: extra long timeout when password has been sent
426
307
runtime_expansions: Allowed attributes for runtime expansion.
427
308
expires: datetime.datetime(); time (UTC) when a client will be
428
309
disabled, or None
432
313
"created", "enabled", "fingerprint",
433
314
"host", "interval", "last_checked_ok",
434
315
"last_enabled", "name", "timeout")
435
client_defaults = { "timeout": "5m",
436
"extended_timeout": "15m",
437
"interval": "2m",
438
"checker": "fping -q -- %%(host)s",
439
"host": "",
440
"approval_delay": "0s",
441
"approval_duration": "1s",
442
"approved_by_default": "True",
443
"enabled": "True",
444
}
445
316
446
317
def timeout_milliseconds(self):
447
318
"Return the 'timeout' attribute in milliseconds"
448
return timedelta_to_milliseconds(self.timeout)
449
319
return _timedelta_to_milliseconds(self.timeout)
320
450
321
def extended_timeout_milliseconds(self):
451
322
"Return the 'extended_timeout' attribute in milliseconds"
452
return timedelta_to_milliseconds(self.extended_timeout)
323
return _timedelta_to_milliseconds(self.extended_timeout)
453
324
454
325
def interval_milliseconds(self):
455
326
"Return the 'interval' attribute in milliseconds"
456
return timedelta_to_milliseconds(self.interval)
457
327
return _timedelta_to_milliseconds(self.interval)
328
458
329
def approval_delay_milliseconds(self):
459
return timedelta_to_milliseconds(self.approval_delay)
460
461
@staticmethod
462
def config_parser(config):
463
"""Construct a new dict of client settings of this form:
464
{ client_name: {setting_name: value, ...}, ...}
465
with exceptions for any special settings as defined above.
466
NOTE: Must be a pure function. Must return the same result
467
value given the same arguments.
468
"""
469
settings = {}
470
for client_name in config.sections():
471
section = dict(config.items(client_name))
472
client = settings[client_name] = {}
473
474
client["host"] = section["host"]
475
# Reformat values from string types to Python types
476
client["approved_by_default"] = config.getboolean(
477
client_name, "approved_by_default")
478
client["enabled"] = config.getboolean(client_name,
479
"enabled")
480
481
client["fingerprint"] = (section["fingerprint"].upper()
482
.replace(" ", ""))
483
if "secret" in section:
484
client["secret"] = section["secret"].decode("base64")
485
elif "secfile" in section:
486
with open(os.path.expanduser(os.path.expandvars
487
(section["secfile"])),
488
"rb") as secfile:
489
client["secret"] = secfile.read()
490
else:
491
raise TypeError("No secret or secfile for section %s"
492
% section)
493
client["timeout"] = string_to_delta(section["timeout"])
494
client["extended_timeout"] = string_to_delta(
495
section["extended_timeout"])
496
client["interval"] = string_to_delta(section["interval"])
497
client["approval_delay"] = string_to_delta(
498
section["approval_delay"])
499
client["approval_duration"] = string_to_delta(
500
section["approval_duration"])
501
client["checker_command"] = section["checker"]
502
client["last_approval_request"] = None
503
client["last_checked_ok"] = None
504
client["last_checker_status"] = None
505
506
return settings
507
508
509
def __init__(self, settings, name = None):
330
return _timedelta_to_milliseconds(self.approval_delay)
331
332
def __init__(self, name = None, disable_hook=None, config=None):
510
333
"""Note: the 'checker' key in 'config' sets the
511
334
'checker_command' attribute and *not* the 'checker'
512
335
attribute."""
513
336
self.name = name
514
# adding all client settings
515
for setting, value in settings.iteritems():
516
setattr(self, setting, value)
517
518
if self.enabled:
519
if not hasattr(self, "last_enabled"):
520
self.last_enabled = datetime.datetime.utcnow()
521
if not hasattr(self, "expires"):
522
self.expires = (datetime.datetime.utcnow()
523
+ self.timeout)
524
else:
525
self.last_enabled = None
526
self.expires = None
527
337
if config is None:
338
config = {}
528
339
logger.debug("Creating client %r", self.name)
529
340
# Uppercase and remove spaces from fingerprint for later
530
341
# comparison purposes with return value from the fingerprint()
531
342
# function
343
self.fingerprint = (config["fingerprint"].upper()
344
.replace(" ", ""))
532
345
logger.debug(" Fingerprint: %s", self.fingerprint)
533
self.created = settings.get("created",
534
datetime.datetime.utcnow())
535
536
# attributes specific for this server instance
346
if "secret" in config:
347
self.secret = config["secret"].decode("base64")
348
elif "secfile" in config:
349
with open(os.path.expanduser(os.path.expandvars
350
(config["secfile"])),
351
"rb") as secfile:
352
self.secret = secfile.read()
353
else:
354
raise TypeError("No secret or secfile for client %s"
355
% self.name)
356
self.host = config.get("host", "")
357
self.created = datetime.datetime.utcnow()
358
self.enabled = False
359
self.last_approval_request = None
360
self.last_enabled = None
361
self.last_checked_ok = None
362
self.timeout = string_to_delta(config["timeout"])
363
self.extended_timeout = string_to_delta(config["extended_timeout"])
364
self.interval = string_to_delta(config["interval"])
365
self.disable_hook = disable_hook
537
366
self.checker = None
538
367
self.checker_initiator_tag = None
539
368
self.disable_initiator_tag = None
369
self.expires = None
540
370
self.checker_callback_tag = None
371
self.checker_command = config["checker"]
541
372
self.current_checker_command = None
542
self.approved = None
373
self.last_connect = None
374
self._approved = None
375
self.approved_by_default = config.get("approved_by_default",
376
True)
543
377
self.approvals_pending = 0
544
self.changedstate = (multiprocessing_manager
545
.Condition(multiprocessing_manager
546
.Lock()))
547
self.client_structure = [attr for attr in
548
self.__dict__.iterkeys()
549
if not attr.startswith("_")]
550
self.client_structure.append("client_structure")
551
552
for name, t in inspect.getmembers(type(self),
553
lambda obj:
554
isinstance(obj,
555
property)):
556
if not name.startswith("_"):
557
self.client_structure.append(name)
378
self.approval_delay = string_to_delta(
379
config["approval_delay"])
380
self.approval_duration = string_to_delta(
381
config["approval_duration"])
382
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
558
383
559
# Send notice to process children that client state has changed
560
384
def send_changedstate(self):
561
with self.changedstate:
562
self.changedstate.notify_all()
563
385
self.changedstate.acquire()
386
self.changedstate.notify_all()
387
self.changedstate.release()
388
564
389
def enable(self):
565
390
"""Start this client's checker and timeout hooks"""
566
391
if getattr(self, "enabled", False):
567
392
# Already enabled
568
393
return
569
394
self.send_changedstate()
395
# Schedule a new checker to be started an 'interval' from now,
396
# and every interval from then on.
397
self.checker_initiator_tag = (gobject.timeout_add
398
(self.interval_milliseconds(),
399
self.start_checker))
400
# Schedule a disable() when 'timeout' has passed
570
401
self.expires = datetime.datetime.utcnow() + self.timeout
402
self.disable_initiator_tag = (gobject.timeout_add
403
(self.timeout_milliseconds(),
404
self.disable))
571
405
self.enabled = True
572
406
self.last_enabled = datetime.datetime.utcnow()
573
self.init_checker()
407
# Also start a new checker *right now*.
408
self.start_checker()
574
409
575
410
def disable(self, quiet=True):
576
411
"""Disable this client."""
588
423
gobject.source_remove(self.checker_initiator_tag)
589
424
self.checker_initiator_tag = None
590
425
self.stop_checker()
426
if self.disable_hook:
427
self.disable_hook(self)
591
428
self.enabled = False
592
429
# Do not run this again if called by a gobject.timeout_add
593
430
return False
594
431
595
432
def __del__(self):
433
self.disable_hook = None
596
434
self.disable()
597
435
598
def init_checker(self):
599
# Schedule a new checker to be started an 'interval' from now,
600
# and every interval from then on.
601
self.checker_initiator_tag = (gobject.timeout_add
602
(self.interval_milliseconds(),
603
self.start_checker))
604
# Schedule a disable() when 'timeout' has passed
605
self.disable_initiator_tag = (gobject.timeout_add
606
(self.timeout_milliseconds(),
607
self.disable))
608
# Also start a new checker *right now*.
609
self.start_checker()
610
611
436
def checker_callback(self, pid, condition, command):
612
437
"""The checker has completed, so take appropriate actions."""
613
438
self.checker_callback_tag = None
614
439
self.checker = None
615
440
if os.WIFEXITED(condition):
616
self.last_checker_status = os.WEXITSTATUS(condition)
617
if self.last_checker_status == 0:
441
exitstatus = os.WEXITSTATUS(condition)
442
if exitstatus == 0:
618
443
logger.info("Checker for %(name)s succeeded",
619
444
vars(self))
620
445
self.checked_ok()
622
447
logger.info("Checker for %(name)s failed",
623
448
vars(self))
624
449
else:
625
self.last_checker_status = -1
626
450
logger.warning("Checker for %(name)s crashed?",
627
451
vars(self))
628
452
635
459
if timeout is None:
636
460
timeout = self.timeout
637
461
self.last_checked_ok = datetime.datetime.utcnow()
638
if self.disable_initiator_tag is not None:
639
gobject.source_remove(self.disable_initiator_tag)
640
if getattr(self, "enabled", False):
641
self.disable_initiator_tag = (gobject.timeout_add
642
(timedelta_to_milliseconds
643
(timeout), self.disable))
644
self.expires = datetime.datetime.utcnow() + timeout
462
gobject.source_remove(self.disable_initiator_tag)
463
self.expires = datetime.datetime.utcnow() + timeout
464
self.disable_initiator_tag = (gobject.timeout_add
465
(_timedelta_to_milliseconds(timeout),
466
self.disable))
645
467
646
468
def need_approval(self):
647
469
self.last_approval_request = datetime.datetime.utcnow()
687
509
'replace')))
688
510
for attr in
689
511
self.runtime_expansions)
690
512
691
513
try:
692
514
command = self.checker_command % escaped_attrs
693
515
except TypeError as error:
739
561
raise
740
562
self.checker = None
741
563
742
743
564
def dbus_service_property(dbus_interface, signature="v",
744
565
access="readwrite", byte_arrays=False):
745
566
"""Decorators for marking methods of a DBusObjectWithProperties to
791
612
792
613
class DBusObjectWithProperties(dbus.service.Object):
793
614
"""A D-Bus object with properties.
794
615
795
616
Classes inheriting from this can use the dbus_service_property
796
617
decorator to expose methods as D-Bus properties. It exposes the
797
618
standard Get(), Set(), and GetAll() methods on the D-Bus.
804
625
def _get_all_dbus_properties(self):
805
626
"""Returns a generator of (name, attribute) pairs
806
627
"""
807
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
808
for cls in self.__class__.__mro__
628
return ((prop._dbus_name, prop)
809
629
for name, prop in
810
inspect.getmembers(cls, self._is_dbus_property))
630
inspect.getmembers(self, self._is_dbus_property))
811
631
812
632
def _get_dbus_property(self, interface_name, property_name):
813
633
"""Returns a bound method if one exists which is a D-Bus
814
634
property with the specified name and interface.
815
635
"""
816
for cls in self.__class__.__mro__:
817
for name, value in (inspect.getmembers
818
(cls, self._is_dbus_property)):
819
if (value._dbus_name == property_name
820
and value._dbus_interface == interface_name):
821
return value.__get__(self)
822
636
for name in (property_name,
637
property_name + "_dbus_property"):
638
prop = getattr(self, name, None)
639
if (prop is None
640
or not self._is_dbus_property(prop)
641
or prop._dbus_name != property_name
642
or (interface_name and prop._dbus_interface
643
and interface_name != prop._dbus_interface)):
644
continue
645
return prop
823
646
# No such property
824
647
raise DBusPropertyNotFound(self.dbus_object_path + ":"
825
648
+ interface_name + "."
850
673
# signatures other than "ay".
851
674
if prop._dbus_signature != "ay":
852
675
raise ValueError
853
value = dbus.ByteArray(b''.join(chr(byte)
854
for byte in value))
676
value = dbus.ByteArray(''.join(unichr(byte)
677
for byte in value))
855
678
prop(value)
856
679
857
680
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
859
682
def GetAll(self, interface_name):
860
683
"""Standard D-Bus property GetAll() method, see D-Bus
861
684
standard.
862
685
863
686
Note: Will not include properties with access="write".
864
687
"""
865
properties = {}
688
all = {}
866
689
for name, prop in self._get_all_dbus_properties():
867
690
if (interface_name
868
691
and interface_name != prop._dbus_interface):
873
696
continue
874
697
value = prop()
875
698
if not hasattr(value, "variant_level"):
876
properties[name] = value
699
all[name] = value
877
700
continue
878
properties[name] = type(value)(value, variant_level=
879
value.variant_level+1)
880
return dbus.Dictionary(properties, signature="sv")
701
all[name] = type(value)(value, variant_level=
702
value.variant_level+1)
703
return dbus.Dictionary(all, signature="sv")
881
704
882
705
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
883
706
out_signature="s",
934
757
return dbus.String(dt.isoformat(),
935
758
variant_level=variant_level)
936
759
937
938
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
939
.__metaclass__):
940
"""Applied to an empty subclass of a D-Bus object, this metaclass
941
will add additional D-Bus attributes matching a certain pattern.
942
"""
943
def __new__(mcs, name, bases, attr):
944
# Go through all the base classes which could have D-Bus
945
# methods, signals, or properties in them
946
for base in (b for b in bases
947
if issubclass(b, dbus.service.Object)):
948
# Go though all attributes of the base class
949
for attrname, attribute in inspect.getmembers(base):
950
# Ignore non-D-Bus attributes, and D-Bus attributes
951
# with the wrong interface name
952
if (not hasattr(attribute, "_dbus_interface")
953
or not attribute._dbus_interface
954
.startswith("se.recompile.Mandos")):
955
continue
956
# Create an alternate D-Bus interface name based on
957
# the current name
958
alt_interface = (attribute._dbus_interface
959
.replace("se.recompile.Mandos",
960
"se.bsnet.fukt.Mandos"))
961
# Is this a D-Bus signal?
962
if getattr(attribute, "_dbus_is_signal", False):
963
# Extract the original non-method function by
964
# black magic
965
nonmethod_func = (dict(
966
zip(attribute.func_code.co_freevars,
967
attribute.__closure__))["func"]
968
.cell_contents)
969
# Create a new, but exactly alike, function
970
# object, and decorate it to be a new D-Bus signal
971
# with the alternate D-Bus interface name
972
new_function = (dbus.service.signal
973
(alt_interface,
974
attribute._dbus_signature)
975
(types.FunctionType(
976
nonmethod_func.func_code,
977
nonmethod_func.func_globals,
978
nonmethod_func.func_name,
979
nonmethod_func.func_defaults,
980
nonmethod_func.func_closure)))
981
# Define a creator of a function to call both the
982
# old and new functions, so both the old and new
983
# signals gets sent when the function is called
984
def fixscope(func1, func2):
985
"""This function is a scope container to pass
986
func1 and func2 to the "call_both" function
987
outside of its arguments"""
988
def call_both(*args, **kwargs):
989
"""This function will emit two D-Bus
990
signals by calling func1 and func2"""
991
func1(*args, **kwargs)
992
func2(*args, **kwargs)
993
return call_both
994
# Create the "call_both" function and add it to
995
# the class
996
attr[attrname] = fixscope(attribute,
997
new_function)
998
# Is this a D-Bus method?
999
elif getattr(attribute, "_dbus_is_method", False):
1000
# Create a new, but exactly alike, function
1001
# object. Decorate it to be a new D-Bus method
1002
# with the alternate D-Bus interface name. Add it
1003
# to the class.
1004
attr[attrname] = (dbus.service.method
1005
(alt_interface,
1006
attribute._dbus_in_signature,
1007
attribute._dbus_out_signature)
1008
(types.FunctionType
1009
(attribute.func_code,
1010
attribute.func_globals,
1011
attribute.func_name,
1012
attribute.func_defaults,
1013
attribute.func_closure)))
1014
# Is this a D-Bus property?
1015
elif getattr(attribute, "_dbus_is_property", False):
1016
# Create a new, but exactly alike, function
1017
# object, and decorate it to be a new D-Bus
1018
# property with the alternate D-Bus interface
1019
# name. Add it to the class.
1020
attr[attrname] = (dbus_service_property
1021
(alt_interface,
1022
attribute._dbus_signature,
1023
attribute._dbus_access,
1024
attribute
1025
._dbus_get_args_options
1026
["byte_arrays"])
1027
(types.FunctionType
1028
(attribute.func_code,
1029
attribute.func_globals,
1030
attribute.func_name,
1031
attribute.func_defaults,
1032
attribute.func_closure)))
1033
return type.__new__(mcs, name, bases, attr)
1034
1035
1036
760
class ClientDBus(Client, DBusObjectWithProperties):
1037
761
"""A Client class using D-Bus
1038
762
1047
771
# dbus.service.Object doesn't use super(), so we can't either.
1048
772
1049
773
def __init__(self, bus = None, *args, **kwargs):
774
self._approvals_pending = 0
1050
775
self.bus = bus
1051
776
Client.__init__(self, *args, **kwargs)
1052
777
# Only now, when this client is initialized, can it show up on
1062
787
def notifychangeproperty(transform_func,
1063
788
dbus_name, type_func=lambda x: x,
1064
789
variant_level=1):
1065
""" Modify a variable so that it's a property which announces
1066
its changes to DBus.
1067
1068
transform_fun: Function that takes a value and a variant_level
1069
and transforms it to a D-Bus type.
1070
dbus_name: D-Bus name of the variable
790
""" Modify a variable so that its a property that announce its
791
changes to DBus.
792
transform_fun: Function that takes a value and transform it to
793
DBus type.
794
dbus_name: DBus name of the variable
1071
795
type_func: Function that transform the value before sending it
1072
to the D-Bus. Default: no transform
1073
variant_level: D-Bus variant level. Default: 1
796
to DBus
797
variant_level: DBus variant level. default: 1
1074
798
"""
1075
attrname = "_{0}".format(dbus_name)
799
real_value = [None,]
1076
800
def setter(self, value):
801
old_value = real_value[0]
802
real_value[0] = value
1077
803
if hasattr(self, "dbus_object_path"):
1078
if (not hasattr(self, attrname) or
1079
type_func(getattr(self, attrname, None))
1080
!= type_func(value)):
1081
dbus_value = transform_func(type_func(value),
1082
variant_level
1083
=variant_level)
804
if type_func(old_value) != type_func(real_value[0]):
805
dbus_value = transform_func(type_func(real_value[0]),
806
variant_level)
1084
807
self.PropertyChanged(dbus.String(dbus_name),
1085
808
dbus_value)
1086
setattr(self, attrname, value)
1087
1088
return property(lambda self: getattr(self, attrname), setter)
1089
1090
809
810
return property(lambda self: real_value[0], setter)
811
812
1091
813
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1092
814
approvals_pending = notifychangeproperty(dbus.Boolean,
1093
815
"ApprovalPending",
1096
818
last_enabled = notifychangeproperty(datetime_to_dbus,
1097
819
"LastEnabled")
1098
820
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1099
type_func = lambda checker:
1100
checker is not None)
821
type_func = lambda checker: checker is not None)
1101
822
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1102
823
"LastCheckedOK")
1103
last_approval_request = notifychangeproperty(
1104
datetime_to_dbus, "LastApprovalRequest")
824
last_approval_request = notifychangeproperty(datetime_to_dbus,
825
"LastApprovalRequest")
1105
826
approved_by_default = notifychangeproperty(dbus.Boolean,
1106
827
"ApprovedByDefault")
1107
approval_delay = notifychangeproperty(dbus.UInt64,
1108
"ApprovalDelay",
1109
type_func =
1110
timedelta_to_milliseconds)
1111
approval_duration = notifychangeproperty(
1112
dbus.UInt64, "ApprovalDuration",
1113
type_func = timedelta_to_milliseconds)
828
approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",
829
type_func = _timedelta_to_milliseconds)
830
approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",
831
type_func = _timedelta_to_milliseconds)
1114
832
host = notifychangeproperty(dbus.String, "Host")
1115
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1116
type_func =
1117
timedelta_to_milliseconds)
1118
extended_timeout = notifychangeproperty(
1119
dbus.UInt64, "ExtendedTimeout",
1120
type_func = timedelta_to_milliseconds)
1121
interval = notifychangeproperty(dbus.UInt64,
1122
"Interval",
1123
type_func =
1124
timedelta_to_milliseconds)
833
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
834
type_func = _timedelta_to_milliseconds)
835
extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",
836
type_func = _timedelta_to_milliseconds)
837
interval = notifychangeproperty(dbus.UInt16, "Interval",
838
type_func = _timedelta_to_milliseconds)
1125
839
checker_command = notifychangeproperty(dbus.String, "Checker")
1126
840
1127
841
del notifychangeproperty
1153
867
1154
868
return Client.checker_callback(self, pid, condition, command,
1155
869
*args, **kwargs)
1156
870
1157
871
def start_checker(self, *args, **kwargs):
1158
872
old_checker = self.checker
1159
873
if self.checker is not None:
1169
883
return r
1170
884
1171
885
def _reset_approved(self):
1172
self.approved = None
886
self._approved = None
1173
887
return False
1174
888
1175
889
def approve(self, value=True):
1176
890
self.send_changedstate()
1177
self.approved = value
1178
gobject.timeout_add(timedelta_to_milliseconds
891
self._approved = value
892
gobject.timeout_add(_timedelta_to_milliseconds
1179
893
(self.approval_duration),
1180
894
self._reset_approved)
1181
895
1182
896
1183
897
## D-Bus methods, signals & properties
1184
_interface = "se.recompile.Mandos.Client"
898
_interface = "se.bsnet.fukt.Mandos.Client"
1185
899
1186
900
## Signals
1187
901
1224
938
"D-Bus signal"
1225
939
return self.need_approval()
1226
940
1227
# NewRequest - signal
1228
@dbus.service.signal(_interface, signature="s")
1229
def NewRequest(self, ip):
1230
"""D-Bus signal
1231
Is sent after a client request a secret.
1232
"""
1233
pass
1234
1235
941
## Methods
1236
942
1237
943
# Approve - method
1295
1001
access="readwrite")
1296
1002
def ApprovalDuration_dbus_property(self, value=None):
1297
1003
if value is None: # get
1298
return dbus.UInt64(timedelta_to_milliseconds(
1004
return dbus.UInt64(_timedelta_to_milliseconds(
1299
1005
self.approval_duration))
1300
1006
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1301
1007
1315
1021
def Host_dbus_property(self, value=None):
1316
1022
if value is None: # get
1317
1023
return dbus.String(self.host)
1318
self.host = unicode(value)
1024
self.host = value
1319
1025
1320
1026
# Created - property
1321
1027
@dbus_service_property(_interface, signature="s", access="read")
1322
1028
def Created_dbus_property(self):
1323
return datetime_to_dbus(self.created)
1029
return dbus.String(datetime_to_dbus(self.created))
1324
1030
1325
1031
# LastEnabled - property
1326
1032
@dbus_service_property(_interface, signature="s", access="read")
1364
1070
if value is None: # get
1365
1071
return dbus.UInt64(self.timeout_milliseconds())
1366
1072
self.timeout = datetime.timedelta(0, 0, 0, value)
1073
if getattr(self, "disable_initiator_tag", None) is None:
1074
return
1367
1075
# Reschedule timeout
1368
if self.enabled:
1369
now = datetime.datetime.utcnow()
1370
time_to_die = timedelta_to_milliseconds(
1371
(self.last_checked_ok + self.timeout) - now)
1372
if time_to_die <= 0:
1373
# The timeout has passed
1374
self.disable()
1375
else:
1376
self.expires = (now +
1377
datetime.timedelta(milliseconds =
1378
time_to_die))
1379
if (getattr(self, "disable_initiator_tag", None)
1380
is None):
1381
return
1382
gobject.source_remove(self.disable_initiator_tag)
1383
self.disable_initiator_tag = (gobject.timeout_add
1384
(time_to_die,
1385
self.disable))
1386
1076
gobject.source_remove(self.disable_initiator_tag)
1077
self.disable_initiator_tag = None
1078
self.expires = None
1079
time_to_die = (self.
1080
_timedelta_to_milliseconds((self
1081
.last_checked_ok
1082
+ self.timeout)
1083
- datetime.datetime
1084
.utcnow()))
1085
if time_to_die <= 0:
1086
# The timeout has passed
1087
self.disable()
1088
else:
1089
self.expires = (datetime.datetime.utcnow()
1090
+ datetime.timedelta(milliseconds = time_to_die))
1091
self.disable_initiator_tag = (gobject.timeout_add
1092
(time_to_die, self.disable))
1093
1387
1094
# ExtendedTimeout - property
1388
1095
@dbus_service_property(_interface, signature="t",
1389
1096
access="readwrite")
1391
1098
if value is None: # get
1392
1099
return dbus.UInt64(self.extended_timeout_milliseconds())
1393
1100
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1394
1101
1395
1102
# Interval - property
1396
1103
@dbus_service_property(_interface, signature="t",
1397
1104
access="readwrite")
1401
1108
self.interval = datetime.timedelta(0, 0, 0, value)
1402
1109
if getattr(self, "checker_initiator_tag", None) is None:
1403
1110
return
1404
if self.enabled:
1405
# Reschedule checker run
1406
gobject.source_remove(self.checker_initiator_tag)
1407
self.checker_initiator_tag = (gobject.timeout_add
1408
(value, self.start_checker))
1409
self.start_checker() # Start one now, too
1410
1111
# Reschedule checker run
1112
gobject.source_remove(self.checker_initiator_tag)
1113
self.checker_initiator_tag = (gobject.timeout_add
1114
(value, self.start_checker))
1115
self.start_checker() # Start one now, too
1116
1411
1117
# Checker - property
1412
1118
@dbus_service_property(_interface, signature="s",
1413
1119
access="readwrite")
1414
1120
def Checker_dbus_property(self, value=None):
1415
1121
if value is None: # get
1416
1122
return dbus.String(self.checker_command)
1417
self.checker_command = unicode(value)
1123
self.checker_command = value
1418
1124
1419
1125
# CheckerRunning - property
1420
1126
@dbus_service_property(_interface, signature="b",
1447
1153
self._pipe.send(('init', fpr, address))
1448
1154
if not self._pipe.recv():
1449
1155
raise KeyError()
1450
1156
1451
1157
def __getattribute__(self, name):
1452
if name == '_pipe':
1158
if(name == '_pipe'):
1453
1159
return super(ProxyClient, self).__getattribute__(name)
1454
1160
self._pipe.send(('getattr', name))
1455
1161
data = self._pipe.recv()
1460
1166
self._pipe.send(('funcall', name, args, kwargs))
1461
1167
return self._pipe.recv()[1]
1462
1168
return func
1463
1169
1464
1170
def __setattr__(self, name, value):
1465
if name == '_pipe':
1171
if(name == '_pipe'):
1466
1172
return super(ProxyClient, self).__setattr__(name, value)
1467
1173
self._pipe.send(('setattr', name, value))
1468
1174
1469
1175
1470
class ClientDBusTransitional(ClientDBus):
1471
__metaclass__ = AlternateDBusNamesMetaclass
1472
1473
1474
1176
class ClientHandler(socketserver.BaseRequestHandler, object):
1475
1177
"""A class to handle client connections.
1476
1178
1483
1185
unicode(self.client_address))
1484
1186
logger.debug("Pipe FD: %d",
1485
1187
self.server.child_pipe.fileno())
1486
1188
1487
1189
session = (gnutls.connection
1488
1190
.ClientSession(self.request,
1489
1191
gnutls.connection
1490
1192
.X509Credentials()))
1491
1193
1492
1194
# Note: gnutls.connection.X509Credentials is really a
1493
1195
# generic GnuTLS certificate credentials object so long as
1494
1196
# no X.509 keys are added to it. Therefore, we can use it
1495
1197
# here despite using OpenPGP certificates.
1496
1198
1497
1199
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1498
1200
# "+AES-256-CBC", "+SHA1",
1499
1201
# "+COMP-NULL", "+CTYPE-OPENPGP",
1505
1207
(gnutls.library.functions
1506
1208
.gnutls_priority_set_direct(session._c_object,
1507
1209
priority, None))
1508
1210
1509
1211
# Start communication using the Mandos protocol
1510
1212
# Get protocol number
1511
1213
line = self.request.makefile().readline()
1516
1218
except (ValueError, IndexError, RuntimeError) as error:
1517
1219
logger.error("Unknown protocol version: %s", error)
1518
1220
return
1519
1221
1520
1222
# Start GnuTLS connection
1521
1223
try:
1522
1224
session.handshake()
1526
1228
# established. Just abandon the request.
1527
1229
return
1528
1230
logger.debug("Handshake succeeded")
1529
1231
1530
1232
approval_required = False
1531
1233
try:
1532
1234
try:
1537
1239
logger.warning("Bad certificate: %s", error)
1538
1240
return
1539
1241
logger.debug("Fingerprint: %s", fpr)
1540
1242
1541
1243
try:
1542
1244
client = ProxyClient(child_pipe, fpr,
1543
1245
self.client_address)
1544
1246
except KeyError:
1545
1247
return
1546
1248
1547
if self.server.use_dbus:
1548
# Emit D-Bus signal
1549
client.NewRequest(unicode(self.client_address)[0])
1550
1551
1249
if client.approval_delay:
1552
1250
delay = client.approval_delay
1553
1251
client.approvals_pending += 1
1559
1257
client.name)
1560
1258
if self.server.use_dbus:
1561
1259
# Emit D-Bus signal
1562
client.Rejected("Disabled")
1260
client.Rejected("Disabled")
1563
1261
return
1564
1262
1565
if client.approved or not client.approval_delay:
1263
if client._approved or not client.approval_delay:
1566
1264
#We are approved or approval is disabled
1567
1265
break
1568
elif client.approved is None:
1266
elif client._approved is None:
1569
1267
logger.info("Client %s needs approval",
1570
1268
client.name)
1571
1269
if self.server.use_dbus:
1582
1280
return
1583
1281
1584
1282
#wait until timeout or approved
1283
#x = float(client._timedelta_to_milliseconds(delay))
1585
1284
time = datetime.datetime.now()
1586
1285
client.changedstate.acquire()
1587
(client.changedstate.wait
1588
(float(client.timedelta_to_milliseconds(delay)
1589
/ 1000)))
1286
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1590
1287
client.changedstate.release()
1591
1288
time2 = datetime.datetime.now()
1592
1289
if (time2 - time) >= delay:
1614
1311
sent, len(client.secret)
1615
1312
- (sent_size + sent))
1616
1313
sent_size += sent
1617
1314
1618
1315
logger.info("Sending secret to %s", client.name)
1619
# bump the timeout using extended_timeout
1316
# bump the timeout as if seen
1620
1317
client.checked_ok(client.extended_timeout)
1621
1318
if self.server.use_dbus:
1622
1319
# Emit D-Bus signal
1690
1387
# Convert the buffer to a Python bytestring
1691
1388
fpr = ctypes.string_at(buf, buf_len.value)
1692
1389
# Convert the bytestring to hexadecimal notation
1693
hex_fpr = binascii.hexlify(fpr).upper()
1390
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1694
1391
return hex_fpr
1695
1392
1696
1393
1699
1396
def sub_process_main(self, request, address):
1700
1397
try:
1701
1398
self.finish_request(request, address)
1702
except Exception:
1399
except:
1703
1400
self.handle_error(request, address)
1704
1401
self.close_request(request)
1705
1402
1706
1403
def process_request(self, request, address):
1707
1404
"""Start a new process to process the request."""
1708
proc = multiprocessing.Process(target = self.sub_process_main,
1709
args = (request,
1710
address))
1711
proc.start()
1712
return proc
1713
1405
multiprocessing.Process(target = self.sub_process_main,
1406
args = (request, address)).start()
1714
1407
1715
1408
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1716
1409
""" adds a pipe to the MixIn """
1720
1413
This function creates a new pipe in self.pipe
1721
1414
"""
1722
1415
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1723
1724
proc = MultiprocessingMixIn.process_request(self, request,
1725
client_address)
1416
1417
super(MultiprocessingMixInWithPipe,
1418
self).process_request(request, client_address)
1726
1419
self.child_pipe.close()
1727
self.add_pipe(parent_pipe, proc)
1728
1729
def add_pipe(self, parent_pipe, proc):
1420
self.add_pipe(parent_pipe)
1421
1422
def add_pipe(self, parent_pipe):
1730
1423
"""Dummy function; override as necessary"""
1731
1424
raise NotImplementedError
1732
1425
1733
1734
1426
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1735
1427
socketserver.TCPServer, object):
1736
1428
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1810
1502
self.enabled = False
1811
1503
self.clients = clients
1812
1504
if self.clients is None:
1813
self.clients = {}
1505
self.clients = set()
1814
1506
self.use_dbus = use_dbus
1815
1507
self.gnutls_priority = gnutls_priority
1816
1508
IPv6_TCPServer.__init__(self, server_address,
1820
1512
def server_activate(self):
1821
1513
if self.enabled:
1822
1514
return socketserver.TCPServer.server_activate(self)
1823
1824
1515
def enable(self):
1825
1516
self.enabled = True
1826
1827
def add_pipe(self, parent_pipe, proc):
1517
def add_pipe(self, parent_pipe):
1828
1518
# Call "handle_ipc" for both data and EOF events
1829
1519
gobject.io_add_watch(parent_pipe.fileno(),
1830
1520
gobject.IO_IN | gobject.IO_HUP,
1831
1521
functools.partial(self.handle_ipc,
1832
parent_pipe =
1833
parent_pipe,
1834
proc = proc))
1835
1522
parent_pipe = parent_pipe))
1523
1836
1524
def handle_ipc(self, source, condition, parent_pipe=None,
1837
proc = None, client_object=None):
1525
client_object=None):
1838
1526
condition_names = {
1839
1527
gobject.IO_IN: "IN", # There is data to read.
1840
1528
gobject.IO_OUT: "OUT", # Data can be written (without
1849
1537
for cond, name in
1850
1538
condition_names.iteritems()
1851
1539
if cond & condition)
1852
# error, or the other end of multiprocessing.Pipe has closed
1540
# error or the other end of multiprocessing.Pipe has closed
1853
1541
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1854
# Wait for other process to exit
1855
proc.join()
1856
1542
return False
1857
1543
1858
1544
# Read a request from the child
1863
1549
fpr = request[1]
1864
1550
address = request[2]
1865
1551
1866
for c in self.clients.itervalues():
1552
for c in self.clients:
1867
1553
if c.fingerprint == fpr:
1868
1554
client = c
1869
1555
break
1872
1558
"dress: %s", fpr, address)
1873
1559
if self.use_dbus:
1874
1560
# Emit D-Bus signal
1875
mandos_dbus_service.ClientNotFound(fpr,
1876
address[0])
1561
mandos_dbus_service.ClientNotFound(fpr, address[0])
1877
1562
parent_pipe.send(False)
1878
1563
return False
1879
1564
1880
1565
gobject.io_add_watch(parent_pipe.fileno(),
1881
1566
gobject.IO_IN | gobject.IO_HUP,
1882
1567
functools.partial(self.handle_ipc,
1883
parent_pipe =
1884
parent_pipe,
1885
proc = proc,
1886
client_object =
1887
client))
1568
parent_pipe = parent_pipe,
1569
client_object = client))
1888
1570
parent_pipe.send(True)
1889
# remove the old hook in favor of the new above hook on
1890
# same fileno
1571
# remove the old hook in favor of the new above hook on same fileno
1891
1572
return False
1892
1573
if command == 'funcall':
1893
1574
funcname = request[1]
1894
1575
args = request[2]
1895
1576
kwargs = request[3]
1896
1577
1897
parent_pipe.send(('data', getattr(client_object,
1898
funcname)(*args,
1899
**kwargs)))
1900
1578
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1579
1901
1580
if command == 'getattr':
1902
1581
attrname = request[1]
1903
1582
if callable(client_object.__getattribute__(attrname)):
1904
1583
parent_pipe.send(('function',))
1905
1584
else:
1906
parent_pipe.send(('data', client_object
1907
.__getattribute__(attrname)))
1585
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1908
1586
1909
1587
if command == 'setattr':
1910
1588
attrname = request[1]
1911
1589
value = request[2]
1912
1590
setattr(client_object, attrname, value)
1913
1591
1914
1592
return True
1915
1593
1916
1594
1953
1631
return timevalue
1954
1632
1955
1633
1634
def if_nametoindex(interface):
1635
"""Call the C function if_nametoindex(), or equivalent
1636
1637
Note: This function cannot accept a unicode string."""
1638
global if_nametoindex
1639
try:
1640
if_nametoindex = (ctypes.cdll.LoadLibrary
1641
(ctypes.util.find_library("c"))
1642
.if_nametoindex)
1643
except (OSError, AttributeError):
1644
logger.warning("Doing if_nametoindex the hard way")
1645
def if_nametoindex(interface):
1646
"Get an interface index the hard way, i.e. using fcntl()"
1647
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1648
with contextlib.closing(socket.socket()) as s:
1649
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1650
struct.pack(str("16s16x"),
1651
interface))
1652
interface_index = struct.unpack(str("I"),
1653
ifreq[16:20])[0]
1654
return interface_index
1655
return if_nametoindex(interface)
1656
1657
1956
1658
def daemon(nochdir = False, noclose = False):
1957
1659
"""See daemon(3). Standard BSD Unix function.
1958
1660
2013
1715
" system bus interface")
2014
1716
parser.add_argument("--no-ipv6", action="store_false",
2015
1717
dest="use_ipv6", help="Do not use IPv6")
2016
parser.add_argument("--no-restore", action="store_false",
2017
dest="restore", help="Do not restore stored"
2018
" state")
2019
parser.add_argument("--statedir", metavar="DIR",
2020
help="Directory to save/restore state in")
2021
2022
1718
options = parser.parse_args()
2023
1719
2024
1720
if options.check:
2037
1733
"use_dbus": "True",
2038
1734
"use_ipv6": "True",
2039
1735
"debuglevel": "",
2040
"restore": "True",
2041
"statedir": "/var/lib/mandos"
2042
1736
}
2043
1737
2044
1738
# Parse config file for server-global settings
2061
1755
# options, if set.
2062
1756
for option in ("interface", "address", "port", "debug",
2063
1757
"priority", "servicename", "configdir",
2064
"use_dbus", "use_ipv6", "debuglevel", "restore",
2065
"statedir"):
1758
"use_dbus", "use_ipv6", "debuglevel"):
2066
1759
value = getattr(options, option)
2067
1760
if value is not None:
2068
1761
server_settings[option] = value
2080
1773
debuglevel = server_settings["debuglevel"]
2081
1774
use_dbus = server_settings["use_dbus"]
2082
1775
use_ipv6 = server_settings["use_ipv6"]
2083
stored_state_path = os.path.join(server_settings["statedir"],
2084
stored_state_file)
2085
2086
if debug:
2087
initlogger(debug, logging.DEBUG)
2088
else:
2089
if not debuglevel:
2090
initlogger(debug)
2091
else:
2092
level = getattr(logging, debuglevel.upper())
2093
initlogger(debug, level)
2094
1776
2095
1777
if server_settings["servicename"] != "Mandos":
2096
1778
syslogger.setFormatter(logging.Formatter
2097
1779
('Mandos (%s) [%%(process)d]:'
2099
1781
% server_settings["servicename"]))
2100
1782
2101
1783
# Parse config file with clients
2102
client_config = configparser.SafeConfigParser(Client
2103
.client_defaults)
1784
client_defaults = { "timeout": "5m",
1785
"extended_timeout": "15m",
1786
"interval": "2m",
1787
"checker": "fping -q -- %%(host)s",
1788
"host": "",
1789
"approval_delay": "0s",
1790
"approval_duration": "1s",
1791
}
1792
client_config = configparser.SafeConfigParser(client_defaults)
2104
1793
client_config.read(os.path.join(server_settings["configdir"],
2105
1794
"clients.conf"))
2106
1795
2144
1833
if error[0] != errno.EPERM:
2145
1834
raise error
2146
1835
1836
if not debug and not debuglevel:
1837
syslogger.setLevel(logging.WARNING)
1838
console.setLevel(logging.WARNING)
1839
if debuglevel:
1840
level = getattr(logging, debuglevel.upper())
1841
syslogger.setLevel(level)
1842
console.setLevel(level)
1843
2147
1844
if debug:
2148
1845
# Enable all possible GnuTLS debugging
2149
1846
2163
1860
os.dup2(null, sys.stdin.fileno())
2164
1861
if null > 2:
2165
1862
os.close(null)
1863
else:
1864
# No console logging
1865
logger.removeHandler(console)
2166
1866
2167
1867
# Need to fork before connecting to D-Bus
2168
1868
if not debug:
2169
1869
# Close all input and output, do double fork, etc.
2170
1870
daemon()
2171
1871
2172
gobject.threads_init()
2173
2174
1872
global main_loop
2175
1873
# From the Avahi example code
2176
1874
DBusGMainLoop(set_as_default=True )
2179
1877
# End of Avahi example code
2180
1878
if use_dbus:
2181
1879
try:
2182
bus_name = dbus.service.BusName("se.recompile.Mandos",
1880
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
2183
1881
bus, do_not_queue=True)
2184
old_bus_name = (dbus.service.BusName
2185
("se.bsnet.fukt.Mandos", bus,
2186
do_not_queue=True))
2187
1882
except dbus.exceptions.NameExistsException as e:
2188
1883
logger.error(unicode(e) + ", disabling D-Bus")
2189
1884
use_dbus = False
2190
1885
server_settings["use_dbus"] = False
2191
1886
tcp_server.use_dbus = False
2192
1887
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2193
service = AvahiServiceToSyslog(name =
2194
server_settings["servicename"],
2195
servicetype = "_mandos._tcp",
2196
protocol = protocol, bus = bus)
1888
service = AvahiService(name = server_settings["servicename"],
1889
servicetype = "_mandos._tcp",
1890
protocol = protocol, bus = bus)
2197
1891
if server_settings["interface"]:
2198
1892
service.interface = (if_nametoindex
2199
1893
(str(server_settings["interface"])))
2203
1897
2204
1898
client_class = Client
2205
1899
if use_dbus:
2206
client_class = functools.partial(ClientDBusTransitional,
2207
bus = bus)
2208
2209
client_settings = Client.config_parser(client_config)
2210
old_client_settings = {}
2211
clients_data = {}
2212
2213
# Get client data and settings from last running state.
2214
if server_settings["restore"]:
2215
try:
2216
with open(stored_state_path, "rb") as stored_state:
2217
clients_data, old_client_settings = (pickle.load
2218
(stored_state))
2219
os.remove(stored_state_path)
2220
except IOError as e:
2221
logger.warning("Could not load persistent state: {0}"
2222
.format(e))
2223
if e.errno != errno.ENOENT:
2224
raise
2225
except EOFError as e:
2226
logger.warning("Could not load persistent state: "
2227
"EOFError: {0}".format(e))
2228
2229
with PGPEngine() as pgp:
2230
for client_name, client in clients_data.iteritems():
2231
# Decide which value to use after restoring saved state.
2232
# We have three different values: Old config file,
2233
# new config file, and saved state.
2234
# New config value takes precedence if it differs from old
2235
# config value, otherwise use saved state.
2236
for name, value in client_settings[client_name].items():
2237
try:
2238
# For each value in new config, check if it
2239
# differs from the old config value (Except for
2240
# the "secret" attribute)
2241
if (name != "secret" and
2242
value != old_client_settings[client_name]
2243
[name]):
2244
client[name] = value
2245
except KeyError:
2246
pass
2247
2248
# Clients who has passed its expire date can still be
2249
# enabled if its last checker was successful. Clients
2250
# whose checker succeeded before we stored its state is
2251
# assumed to have successfully run all checkers during
2252
# downtime.
2253
if client["enabled"]:
2254
if datetime.datetime.utcnow() >= client["expires"]:
2255
if not client["last_checked_ok"]:
2256
logger.warning(
2257
"disabling client {0} - Client never "
2258
"performed a successful checker"
2259
.format(client_name))
2260
client["enabled"] = False
2261
elif client["last_checker_status"] != 0:
2262
logger.warning(
2263
"disabling client {0} - Client "
2264
"last checker failed with error code {1}"
2265
.format(client_name,
2266
client["last_checker_status"]))
2267
client["enabled"] = False
2268
else:
2269
client["expires"] = (datetime.datetime
2270
.utcnow()
2271
+ client["timeout"])
2272
logger.debug("Last checker succeeded,"
2273
" keeping {0} enabled"
2274
.format(client_name))
1900
client_class = functools.partial(ClientDBus, bus = bus)
1901
def client_config_items(config, section):
1902
special_settings = {
1903
"approved_by_default":
1904
lambda: config.getboolean(section,
1905
"approved_by_default"),
1906
}
1907
for name, value in config.items(section):
2275
1908
try:
2276
client["secret"] = (
2277
pgp.decrypt(client["encrypted_secret"],
2278
client_settings[client_name]
2279
["secret"]))
2280
except PGPError:
2281
# If decryption fails, we use secret from new settings
2282
logger.debug("Failed to decrypt {0} old secret"
2283
.format(client_name))
2284
client["secret"] = (
2285
client_settings[client_name]["secret"])
2286
2287
2288
# Add/remove clients based on new changes made to config
2289
for client_name in (set(old_client_settings)
2290
- set(client_settings)):
2291
del clients_data[client_name]
2292
for client_name in (set(client_settings)
2293
- set(old_client_settings)):
2294
clients_data[client_name] = client_settings[client_name]
2295
2296
# Create all client objects
2297
for client_name, client in clients_data.iteritems():
2298
tcp_server.clients[client_name] = client_class(
2299
name = client_name, settings = client)
2300
1909
yield (name, special_settings[name]())
1910
except KeyError:
1911
yield (name, value)
1912
1913
tcp_server.clients.update(set(
1914
client_class(name = section,
1915
config= dict(client_config_items(
1916
client_config, section)))
1917
for section in client_config.sections()))
2301
1918
if not tcp_server.clients:
2302
1919
logger.warning("No clients defined")
2303
1920
2314
1931
# "pidfile" was never created
2315
1932
pass
2316
1933
del pidfilename
1934
2317
1935
signal.signal(signal.SIGINT, signal.SIG_IGN)
2318
1936
2319
1937
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2320
1938
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2321
1939
2324
1942
"""A D-Bus proxy object"""
2325
1943
def __init__(self):
2326
1944
dbus.service.Object.__init__(self, bus, "/")
2327
_interface = "se.recompile.Mandos"
1945
_interface = "se.bsnet.fukt.Mandos"
2328
1946
2329
1947
@dbus.service.signal(_interface, signature="o")
2330
1948
def ClientAdded(self, objpath):
2345
1963
def GetAllClients(self):
2346
1964
"D-Bus method"
2347
1965
return dbus.Array(c.dbus_object_path
2348
for c in
2349
tcp_server.clients.itervalues())
1966
for c in tcp_server.clients)
2350
1967
2351
1968
@dbus.service.method(_interface,
2352
1969
out_signature="a{oa{sv}}")
2354
1971
"D-Bus method"
2355
1972
return dbus.Dictionary(
2356
1973
((c.dbus_object_path, c.GetAll(""))
2357
for c in tcp_server.clients.itervalues()),
1974
for c in tcp_server.clients),
2358
1975
signature="oa{sv}")
2359
1976
2360
1977
@dbus.service.method(_interface, in_signature="o")
2361
1978
def RemoveClient(self, object_path):
2362
1979
"D-Bus method"
2363
for c in tcp_server.clients.itervalues():
1980
for c in tcp_server.clients:
2364
1981
if c.dbus_object_path == object_path:
2365
del tcp_server.clients[c.name]
1982
tcp_server.clients.remove(c)
2366
1983
c.remove_from_connection()
2367
1984
# Don't signal anything except ClientRemoved
2368
1985
c.disable(quiet=True)
2373
1990
2374
1991
del _interface
2375
1992
2376
class MandosDBusServiceTransitional(MandosDBusService):
2377
__metaclass__ = AlternateDBusNamesMetaclass
2378
mandos_dbus_service = MandosDBusServiceTransitional()
1993
mandos_dbus_service = MandosDBusService()
2379
1994
2380
1995
def cleanup():
2381
1996
"Cleanup function; run on exit"
2382
1997
service.cleanup()
2383
1998
2384
multiprocessing.active_children()
2385
if not (tcp_server.clients or client_settings):
2386
return
2387
2388
# Store client before exiting. Secrets are encrypted with key
2389
# based on what config file has. If config file is
2390
# removed/edited, old secret will thus be unrecovable.
2391
clients = {}
2392
with PGPEngine() as pgp:
2393
for client in tcp_server.clients.itervalues():
2394
key = client_settings[client.name]["secret"]
2395
client.encrypted_secret = pgp.encrypt(client.secret,
2396
key)
2397
client_dict = {}
2398
2399
# A list of attributes that can not be pickled
2400
# + secret.
2401
exclude = set(("bus", "changedstate", "secret",
2402
"checker"))
2403
for name, typ in (inspect.getmembers
2404
(dbus.service.Object)):
2405
exclude.add(name)
2406
2407
client_dict["encrypted_secret"] = (client
2408
.encrypted_secret)
2409
for attr in client.client_structure:
2410
if attr not in exclude:
2411
client_dict[attr] = getattr(client, attr)
2412
2413
clients[client.name] = client_dict
2414
del client_settings[client.name]["secret"]
2415
2416
try:
2417
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2418
prefix="clients-",
2419
dir=os.path.dirname
2420
(stored_state_path))
2421
with os.fdopen(tempfd, "wb") as stored_state:
2422
pickle.dump((clients, client_settings), stored_state)
2423
os.rename(tempname, stored_state_path)
2424
except (IOError, OSError) as e:
2425
logger.warning("Could not save persistent state: {0}"
2426
.format(e))
2427
if not debug:
2428
try:
2429
os.remove(tempname)
2430
except NameError:
2431
pass
2432
if e.errno not in set((errno.ENOENT, errno.EACCES,
2433
errno.EEXIST)):
2434
raise e
2435
2436
# Delete all clients, and settings from config
2437
1999
while tcp_server.clients:
2438
name, client = tcp_server.clients.popitem()
2000
client = tcp_server.clients.pop()
2439
2001
if use_dbus:
2440
2002
client.remove_from_connection()
2003
client.disable_hook = None
2441
2004
# Don't signal anything except ClientRemoved
2442
2005
client.disable(quiet=True)
2443
2006
if use_dbus:
2444
2007
# Emit D-Bus signal
2445
mandos_dbus_service.ClientRemoved(client
2446
.dbus_object_path,
2008
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2447
2009
client.name)
2448
client_settings.clear()
2449
2010
2450
2011
atexit.register(cleanup)
2451
2012
2452
for client in tcp_server.clients.itervalues():
2013
for client in tcp_server.clients:
2453
2014
if use_dbus:
2454
2015
# Emit D-Bus signal
2455
2016
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2456
# Need to initiate checking of clients
2457
if client.enabled:
2458
client.init_checker()
2017
client.enable()
2459
2018
2460
2019
tcp_server.enable()
2461
2020
tcp_server.server_activate()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0