/mandos/trunk : revision 505.1.22

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

66

68

67

69

import dbus

68

70

import dbus.service

73

75

import ctypes.util

74

76

import xml.dom.minidom

75

77

import inspect

78

import GnuPGInterface

76

79

77

80

try:

78

81

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

82

85

except ImportError:

83

86

SO_BINDTODEVICE = None

84

87

85

86

88

version = "1.4.1"

89

stored_state_file = "clients.pickle"

87

90

88

91

logger = logging.getLogger()

89

92

syslogger = (logging.handlers.SysLogHandler

90

93

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

94

address = str("/dev/log")))

92

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

95

logger.addHandler(syslogger)

96

97

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

99

' [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

console = logging.StreamHandler()

122

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

123

' [%(process)d]:'

124

' %(levelname)s:'

125

' %(message)s'))

126

logger.addHandler(console)

127

logger.setLevel(level)

128

129

130

class PGPError(Exception):

131

"""Exception if encryption/decryption fails"""

132

pass

133

134

135

class PGPEngine(object):

136

"""A simple class for OpenPGP symmetric encryption & decryption"""

137

def __init__(self):

138

self.gnupg = GnuPGInterface.GnuPG()

139

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

140

self.gnupg = GnuPGInterface.GnuPG()

141

self.gnupg.options.meta_interactive = False

142

self.gnupg.options.homedir = self.tempdir

143

self.gnupg.options.extra_args.extend(['--force-mdc',

144

'--quiet'])

145

146

def __enter__(self):

147

return self

148

149

def __exit__ (self, exc_type, exc_value, traceback):

150

self._cleanup()

151

return False

152

153

def __del__(self):

154

self._cleanup()

155

156

def _cleanup(self):

157

if self.tempdir is not None:

158

# Delete contents of tempdir

159

for root, dirs, files in os.walk(self.tempdir,

160

topdown = False):

161

for filename in files:

162

os.remove(os.path.join(root, filename))

163

for dirname in dirs:

164

os.rmdir(os.path.join(root, dirname))

165

# Remove tempdir

166

os.rmdir(self.tempdir)

167

self.tempdir = None

168

169

def password_encode(self, password):

170

# Passphrase can not be empty and can not contain newlines or

171

# NUL bytes. So we prefix it and hex encode it.

172

return b"mandos" + binascii.hexlify(password)

173

174

def encrypt(self, data, password):

175

self.gnupg.passphrase = self.password_encode(password)

176

with open(os.devnull) as devnull:

177

try:

178

proc = self.gnupg.run(['--symmetric'],

179

create_fhs=['stdin', 'stdout'],

180

attach_fhs={'stderr': devnull})

181

with contextlib.closing(proc.handles['stdin']) as f:

182

f.write(data)

183

with contextlib.closing(proc.handles['stdout']) as f:

184

ciphertext = f.read()

185

proc.wait()

186

except IOError as e:

187

raise PGPError(e)

188

self.gnupg.passphrase = None

189

return ciphertext

190

191

def decrypt(self, data, password):

192

self.gnupg.passphrase = self.password_encode(password)

193

with open(os.devnull) as devnull:

194

try:

195

proc = self.gnupg.run(['--decrypt'],

196

create_fhs=['stdin', 'stdout'],

197

attach_fhs={'stderr': devnull})

198

with contextlib.closing(proc.handles['stdin'] ) as f:

199

f.write(data)

200

with contextlib.closing(proc.handles['stdout']) as f:

201

decrypted_plaintext = f.read()

202

proc.wait()

203

except IOError as e:

204

raise PGPError(e)

205

self.gnupg.passphrase = None

206

return decrypted_plaintext

207

103

208

104

209

105

210

class AvahiError(Exception):

222

327

try:

223

328

self.group.Free()

224

329

except (dbus.exceptions.UnknownMethodException,

225

dbus.exceptions.DBusException) as e:

330

dbus.exceptions.DBusException):

226

331

pass

227

332

self.group = None

228

333

self.remove()

272

377

% self.name))

273

378

return ret

274

379

275

def _timedelta_to_milliseconds(td):

380

def timedelta_to_milliseconds(td):

276

381

"Convert a datetime.timedelta() to milliseconds"

277

382

return ((td.days * 24 * 60 * 60 * 1000)

278

383

+ (td.seconds * 1000)

282

387

"""A representation of a client host served by this server.

283

388

284

389

Attributes:

285

_approved: bool(); 'None' if not yet approved/disapproved

390

approved: bool(); 'None' if not yet approved/disapproved

286

391

approval_delay: datetime.timedelta(); Time to wait for approval

287

392

approval_duration: datetime.timedelta(); Duration of one approval

288

393

checker: subprocess.Popen(); a running checker process used

295

400

instance %(name)s can be used in the command.

296

401

checker_initiator_tag: a gobject event source tag, or None

297

402

created: datetime.datetime(); (UTC) object creation

403

client_structure: Object describing what attributes a client has

404

and is used for storing the client at exit

298

405

current_checker_command: string; current running checker_command

299

disable_hook: If set, called by disable() as disable_hook(self)

300

406

disable_initiator_tag: a gobject event source tag, or None

301

407

enabled: bool()

302

408

fingerprint: string (40 or 32 hexadecimal digits); used to

305

411

interval: datetime.timedelta(); How often to start a new checker

306

412

last_approval_request: datetime.datetime(); (UTC) or None

307

413

last_checked_ok: datetime.datetime(); (UTC) or None

308

last_enabled: datetime.datetime(); (UTC)

414

last_checker_status: integer between 0 and 255 reflecting exit

415

status of last checker. -1 reflects crashed

416

checker, or None.

417

last_enabled: datetime.datetime(); (UTC) or None

309

418

name: string; from the config file, used in log messages and

310

419

D-Bus identifiers

311

420

secret: bytestring; sent verbatim (over TLS) to client

321

430

"created", "enabled", "fingerprint",

322

431

"host", "interval", "last_checked_ok",

323

432

"last_enabled", "name", "timeout")

433

client_defaults = { "timeout": "5m",

434

"extended_timeout": "15m",

435

"interval": "2m",

436

"checker": "fping -q -- %%(host)s",

437

"host": "",

438

"approval_delay": "0s",

439

"approval_duration": "1s",

440

"approved_by_default": "True",

441

"enabled": "True",

442

}

324

443

325

444

def timeout_milliseconds(self):

326

445

"Return the 'timeout' attribute in milliseconds"

327

return _timedelta_to_milliseconds(self.timeout)

446

return timedelta_to_milliseconds(self.timeout)

328

447

329

448

def extended_timeout_milliseconds(self):

330

449

"Return the 'extended_timeout' attribute in milliseconds"

331

return _timedelta_to_milliseconds(self.extended_timeout)

450

return timedelta_to_milliseconds(self.extended_timeout)

332

451

333

452

def interval_milliseconds(self):

334

453

"Return the 'interval' attribute in milliseconds"

335

return _timedelta_to_milliseconds(self.interval)

454

return timedelta_to_milliseconds(self.interval)

336

455

337

456

def approval_delay_milliseconds(self):

338

return _timedelta_to_milliseconds(self.approval_delay)

339

340

def __init__(self, name = None, disable_hook=None, config=None):

457

return timedelta_to_milliseconds(self.approval_delay)

458

459

@staticmethod

460

def config_parser(config):

461

""" Construct a new dict of client settings of this form:

462

{ client_name: {setting_name: value, ...}, ...}

463

with exceptions for any special settings as defined above"""

464

settings = {}

465

for client_name in config.sections():

466

section = dict(config.items(client_name))

467

client = settings[client_name] = {}

468

469

client["host"] = section["host"]

470

# Reformat values from string types to Python types

471

client["approved_by_default"] = config.getboolean(

472

client_name, "approved_by_default")

473

client["enabled"] = config.getboolean(client_name, "enabled")

474

475

client["fingerprint"] = (section["fingerprint"].upper()

476

.replace(" ", ""))

477

if "secret" in section:

478

client["secret"] = section["secret"].decode("base64")

479

elif "secfile" in section:

480

with open(os.path.expanduser(os.path.expandvars

481

(section["secfile"])),

482

"rb") as secfile:

483

client["secret"] = secfile.read()

484

else:

485

raise TypeError("No secret or secfile for section %s"

486

% section)

487

client["timeout"] = string_to_delta(section["timeout"])

488

client["extended_timeout"] = string_to_delta(

489

section["extended_timeout"])

490

client["interval"] = string_to_delta(section["interval"])

491

client["approval_delay"] = string_to_delta(

492

section["approval_delay"])

493

client["approval_duration"] = string_to_delta(

494

section["approval_duration"])

495

client["checker_command"] = section["checker"]

496

client["last_approval_request"] = None

497

client["last_checked_ok"] = None

498

client["last_checker_status"] = None

499

if client["enabled"]:

500

client["last_enabled"] = datetime.datetime.utcnow()

501

client["expires"] = (datetime.datetime.utcnow()

502

+ client["timeout"])

503

else:

504

client["last_enabled"] = None

505

client["expires"] = None

506

507

return settings

508

509

510

def __init__(self, settings, name = None):

341

511

"""Note: the 'checker' key in 'config' sets the

342

512

'checker_command' attribute and *not* the 'checker'

343

513

attribute."""

344

514

self.name = name

345

if config is None:

346

config = {}

515

# adding all client settings

516

for setting, value in settings.iteritems():

517

setattr(self, setting, value)

518

347

519

logger.debug("Creating client %r", self.name)

348

520

# Uppercase and remove spaces from fingerprint for later

349

521

# comparison purposes with return value from the fingerprint()

350

522

# function

351

self.fingerprint = (config["fingerprint"].upper()

352

.replace(" ", ""))

353

523

logger.debug(" Fingerprint: %s", self.fingerprint)

354

if "secret" in config:

355

self.secret = config["secret"].decode("base64")

356

elif "secfile" in config:

357

with open(os.path.expanduser(os.path.expandvars

358

(config["secfile"])),

359

"rb") as secfile:

360

self.secret = secfile.read()

361

else:

362

raise TypeError("No secret or secfile for client %s"

363

% self.name)

364

self.host = config.get("host", "")

365

self.created = datetime.datetime.utcnow()

366

self.enabled = False

367

self.last_approval_request = None

368

self.last_enabled = None

369

self.last_checked_ok = None

370

self.timeout = string_to_delta(config["timeout"])

371

self.extended_timeout = string_to_delta(config

372

["extended_timeout"])

373

self.interval = string_to_delta(config["interval"])

374

self.disable_hook = disable_hook

524

self.created = settings.get("created", datetime.datetime.utcnow())

525

526

# attributes specific for this server instance

375

527

self.checker = None

376

528

self.checker_initiator_tag = None

377

529

self.disable_initiator_tag = None

378

self.expires = None

379

530

self.checker_callback_tag = None

380

self.checker_command = config["checker"]

381

531

self.current_checker_command = None

382

self.last_connect = None

383

self._approved = None

384

self.approved_by_default = config.get("approved_by_default",

385

True)

532

self.approved = None

386

533

self.approvals_pending = 0

387

self.approval_delay = string_to_delta(

388

config["approval_delay"])

389

self.approval_duration = string_to_delta(

390

config["approval_duration"])

391

534

self.changedstate = (multiprocessing_manager

392

535

.Condition(multiprocessing_manager

393

536

.Lock()))

537

self.client_structure = [attr for attr in

538

self.__dict__.iterkeys()

539

if not attr.startswith("_")]

540

self.client_structure.append("client_structure")

541

542

for name, t in inspect.getmembers(type(self),

543

lambda obj:

544

isinstance(obj,

545

property)):

546

if not name.startswith("_"):

547

self.client_structure.append(name)

394

548

549

# Send notice to process children that client state has changed

395

550

def send_changedstate(self):

396

self.changedstate.acquire()

397

self.changedstate.notify_all()

398

self.changedstate.release()

551

with self.changedstate:

552

self.changedstate.notify_all()

399

553

400

554

def enable(self):

401

555

"""Start this client's checker and timeout hooks"""

403

557

# Already enabled

404

558

return

405

559

self.send_changedstate()

406

# Schedule a new checker to be started an 'interval' from now,

407

# and every interval from then on.

408

self.checker_initiator_tag = (gobject.timeout_add

409

(self.interval_milliseconds(),

410

self.start_checker))

411

# Schedule a disable() when 'timeout' has passed

412

560

self.expires = datetime.datetime.utcnow() + self.timeout

413

self.disable_initiator_tag = (gobject.timeout_add

414

(self.timeout_milliseconds(),

415

self.disable))

416

561

self.enabled = True

417

562

self.last_enabled = datetime.datetime.utcnow()

418

# Also start a new checker *right now*.

419

self.start_checker()

563

self.init_checker()

420

564

421

565

def disable(self, quiet=True):

422

566

"""Disable this client."""

434

578

gobject.source_remove(self.checker_initiator_tag)

435

579

self.checker_initiator_tag = None

436

580

self.stop_checker()

437

if self.disable_hook:

438

self.disable_hook(self)

439

581

self.enabled = False

440

582

# Do not run this again if called by a gobject.timeout_add

441

583

return False

442

584

443

585

def __del__(self):

444

self.disable_hook = None

445

586

self.disable()

446

587

588

def init_checker(self):

589

# Schedule a new checker to be started an 'interval' from now,

590

# and every interval from then on.

591

self.checker_initiator_tag = (gobject.timeout_add

592

(self.interval_milliseconds(),

593

self.start_checker))

594

# Schedule a disable() when 'timeout' has passed

595

self.disable_initiator_tag = (gobject.timeout_add

596

(self.timeout_milliseconds(),

597

self.disable))

598

# Also start a new checker *right now*.

599

self.start_checker()

600

447

601

def checker_callback(self, pid, condition, command):

448

602

"""The checker has completed, so take appropriate actions."""

449

603

self.checker_callback_tag = None

450

604

self.checker = None

451

605

if os.WIFEXITED(condition):

452

exitstatus = os.WEXITSTATUS(condition)

453

if exitstatus == 0:

606

self.last_checker_status = os.WEXITSTATUS(condition)

607

if self.last_checker_status == 0:

454

608

logger.info("Checker for %(name)s succeeded",

455

609

vars(self))

456

610

self.checked_ok()

458

612

logger.info("Checker for %(name)s failed",

459

613

vars(self))

460

614

else:

615

self.last_checker_status = -1

461

616

logger.warning("Checker for %(name)s crashed?",

462

617

vars(self))

463

618

474

629

gobject.source_remove(self.disable_initiator_tag)

475

630

if getattr(self, "enabled", False):

476

631

self.disable_initiator_tag = (gobject.timeout_add

477

(_timedelta_to_milliseconds

632

(timedelta_to_milliseconds

478

633

(timeout), self.disable))

479

634

self.expires = datetime.datetime.utcnow() + timeout

480

635

697

852

698

853

Note: Will not include properties with access="write".

699

854

"""

700

all = {}

855

properties = {}

701

856

for name, prop in self._get_all_dbus_properties():

702

857

if (interface_name

703

858

and interface_name != prop._dbus_interface):

708

863

continue

709

864

value = prop()

710

865

if not hasattr(value, "variant_level"):

711

all[name] = value

866

properties[name] = value

712

867

continue

713

all[name] = type(value)(value, variant_level=

714

value.variant_level+1)

715

return dbus.Dictionary(all, signature="sv")

868

properties[name] = type(value)(value, variant_level=

869

value.variant_level+1)

870

return dbus.Dictionary(properties, signature="sv")

716

871

717

872

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

718

873

out_signature="s",

769

924

return dbus.String(dt.isoformat(),

770

925

variant_level=variant_level)

771

926

927

772

928

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

773

929

.__metaclass__):

774

930

"""Applied to an empty subclass of a D-Bus object, this metaclass

866

1022

attribute.func_closure)))

867

1023

return type.__new__(mcs, name, bases, attr)

868

1024

1025

869

1026

class ClientDBus(Client, DBusObjectWithProperties):

870

1027

"""A Client class using D-Bus

871

1028

880

1037

# dbus.service.Object doesn't use super(), so we can't either.

881

1038

882

1039

def __init__(self, bus = None, *args, **kwargs):

883

self._approvals_pending = 0

884

1040

self.bus = bus

885

1041

Client.__init__(self, *args, **kwargs)

1042

self._approvals_pending = 0

1043

1044

self._approvals_pending = 0

886

1045

# Only now, when this client is initialized, can it show up on

887

1046

# the D-Bus

888

1047

client_object_name = unicode(self.name).translate(

898

1057

variant_level=1):

899

1058

""" Modify a variable so that it's a property which announces

900

1059

its changes to DBus.

901

1060

902

1061

transform_fun: Function that takes a value and a variant_level

903

1062

and transforms it to a D-Bus type.

904

1063

dbus_name: D-Bus name of the variable

938

1097

datetime_to_dbus, "LastApprovalRequest")

939

1098

approved_by_default = notifychangeproperty(dbus.Boolean,

940

1099

"ApprovedByDefault")

941

approval_delay = notifychangeproperty(dbus.UInt16,

1100

approval_delay = notifychangeproperty(dbus.UInt64,

942

1101

"ApprovalDelay",

943

1102

type_func =

944

_timedelta_to_milliseconds)

1103

timedelta_to_milliseconds)

945

1104

approval_duration = notifychangeproperty(

946

dbus.UInt16, "ApprovalDuration",

947

type_func = _timedelta_to_milliseconds)

1105

dbus.UInt64, "ApprovalDuration",

1106

type_func = timedelta_to_milliseconds)

948

1107

host = notifychangeproperty(dbus.String, "Host")

949

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1108

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

950

1109

type_func =

951

_timedelta_to_milliseconds)

1110

timedelta_to_milliseconds)

952

1111

extended_timeout = notifychangeproperty(

953

dbus.UInt16, "ExtendedTimeout",

954

type_func = _timedelta_to_milliseconds)

955

interval = notifychangeproperty(dbus.UInt16,

1112

dbus.UInt64, "ExtendedTimeout",

1113

type_func = timedelta_to_milliseconds)

1114

interval = notifychangeproperty(dbus.UInt64,

956

1115

"Interval",

957

1116

type_func =

958

_timedelta_to_milliseconds)

1117

timedelta_to_milliseconds)

959

1118

checker_command = notifychangeproperty(dbus.String, "Checker")

960

1119

961

1120

del notifychangeproperty

1003

1162

return r

1004

1163

1005

1164

def _reset_approved(self):

1006

self._approved = None

1165

self.approved = None

1007

1166

return False

1008

1167

1009

1168

def approve(self, value=True):

1010

1169

self.send_changedstate()

1011

self._approved = value

1012

gobject.timeout_add(_timedelta_to_milliseconds

1170

self.approved = value

1171

gobject.timeout_add(timedelta_to_milliseconds

1013

1172

(self.approval_duration),

1014

1173

self._reset_approved)

1015

1174

1058

1217

"D-Bus signal"

1059

1218

return self.need_approval()

1060

1219

1220

# NeRwequest - signal

1221

@dbus.service.signal(_interface, signature="s")

1222

def NewRequest(self, ip):

1223

"""D-Bus signal

1224

Is sent after a client request a password.

1225

"""

1226

pass

1227

1061

1228

## Methods

1062

1229

1063

1230

# Approve - method

1121

1288

access="readwrite")

1122

1289

def ApprovalDuration_dbus_property(self, value=None):

1123

1290

if value is None: # get

1124

return dbus.UInt64(_timedelta_to_milliseconds(

1291

return dbus.UInt64(timedelta_to_milliseconds(

1125

1292

self.approval_duration))

1126

1293

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1127

1294

1141

1308

def Host_dbus_property(self, value=None):

1142

1309

if value is None: # get

1143

1310

return dbus.String(self.host)

1144

self.host = value

1311

self.host = unicode(value)

1145

1312

1146

1313

# Created - property

1147

1314

@dbus_service_property(_interface, signature="s", access="read")

1148

1315

def Created_dbus_property(self):

1149

return dbus.String(datetime_to_dbus(self.created))

1316

return datetime_to_dbus(self.created)

1150

1317

1151

1318

# LastEnabled - property

1152

1319

@dbus_service_property(_interface, signature="s", access="read")

1196

1363

gobject.source_remove(self.disable_initiator_tag)

1197

1364

self.disable_initiator_tag = None

1198

1365

self.expires = None

1199

time_to_die = _timedelta_to_milliseconds((self

1200

.last_checked_ok

1201

+ self.timeout)

1202

- datetime.datetime

1203

.utcnow())

1366

time_to_die = timedelta_to_milliseconds((self

1367

.last_checked_ok

1368

+ self.timeout)

1369

- datetime.datetime

1370

.utcnow())

1204

1371

if time_to_die <= 0:

1205

1372

# The timeout has passed

1206

1373

self.disable()

1228

1395

self.interval = datetime.timedelta(0, 0, 0, value)

1229

1396

if getattr(self, "checker_initiator_tag", None) is None:

1230

1397

return

1231

# Reschedule checker run

1232

gobject.source_remove(self.checker_initiator_tag)

1233

self.checker_initiator_tag = (gobject.timeout_add

1234

(value, self.start_checker))

1235

self.start_checker() # Start one now, too

1398

if self.enabled:

1399

# Reschedule checker run

1400

gobject.source_remove(self.checker_initiator_tag)

1401

self.checker_initiator_tag = (gobject.timeout_add

1402

(value, self.start_checker))

1403

self.start_checker() # Start one now, too

1236

1404

1237

1405

# Checker - property

1238

1406

@dbus_service_property(_interface, signature="s",

1240

1408

def Checker_dbus_property(self, value=None):

1241

1409

if value is None: # get

1242

1410

return dbus.String(self.checker_command)

1243

self.checker_command = value

1411

self.checker_command = unicode(value)

1244

1412

1245

1413

# CheckerRunning - property

1246

1414

@dbus_service_property(_interface, signature="b",

1275

1443

raise KeyError()

1276

1444

1277

1445

def __getattribute__(self, name):

1278

if(name == '_pipe'):

1446

if name == '_pipe':

1279

1447

return super(ProxyClient, self).__getattribute__(name)

1280

1448

self._pipe.send(('getattr', name))

1281

1449

data = self._pipe.recv()

1288

1456

return func

1289

1457

1290

1458

def __setattr__(self, name, value):

1291

if(name == '_pipe'):

1459

if name == '_pipe':

1292

1460

return super(ProxyClient, self).__setattr__(name, value)

1293

1461

self._pipe.send(('setattr', name, value))

1294

1462

1463

1295

1464

class ClientDBusTransitional(ClientDBus):

1296

1465

__metaclass__ = AlternateDBusNamesMetaclass

1297

1466

1467

1298

1468

class ClientHandler(socketserver.BaseRequestHandler, object):

1299

1469

"""A class to handle client connections.

1300

1470

1368

1538

except KeyError:

1369

1539

return

1370

1540

1541

if self.server.use_dbus:

1542

# Emit D-Bus signal

1543

client.NewRequest(str(self.client_address))

1544

1371

1545

if client.approval_delay:

1372

1546

delay = client.approval_delay

1373

1547

client.approvals_pending += 1

1382

1556

client.Rejected("Disabled")

1383

1557

return

1384

1558

1385

if client._approved or not client.approval_delay:

1559

if client.approved or not client.approval_delay:

1386

1560

#We are approved or approval is disabled

1387

1561

break

1388

elif client._approved is None:

1562

elif client.approved is None:

1389

1563

logger.info("Client %s needs approval",

1390

1564

client.name)

1391

1565

if self.server.use_dbus:

1405

1579

time = datetime.datetime.now()

1406

1580

client.changedstate.acquire()

1407

1581

(client.changedstate.wait

1408

(float(client._timedelta_to_milliseconds(delay)

1582

(float(client.timedelta_to_milliseconds(delay)

1409

1583

/ 1000)))

1410

1584

client.changedstate.release()

1411

1585

time2 = datetime.datetime.now()

1510

1684

# Convert the buffer to a Python bytestring

1511

1685

fpr = ctypes.string_at(buf, buf_len.value)

1512

1686

# Convert the bytestring to hexadecimal notation

1513

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1687

hex_fpr = binascii.hexlify(fpr).upper()

1514

1688

return hex_fpr

1515

1689

1516

1690

1519

1693

def sub_process_main(self, request, address):

1520

1694

try:

1521

1695

self.finish_request(request, address)

1522

except:

1696

except Exception:

1523

1697

self.handle_error(request, address)

1524

1698

self.close_request(request)

1525

1699

1630

1804

self.enabled = False

1631

1805

self.clients = clients

1632

1806

if self.clients is None:

1633

self.clients = set()

1807

self.clients = {}

1634

1808

self.use_dbus = use_dbus

1635

1809

self.gnutls_priority = gnutls_priority

1636

1810

IPv6_TCPServer.__init__(self, server_address,

1683

1857

fpr = request[1]

1684

1858

address = request[2]

1685

1859

1686

for c in self.clients:

1860

for c in self.clients.itervalues():

1687

1861

if c.fingerprint == fpr:

1688

1862

client = c

1689

1863

break

1773

1947

return timevalue

1774

1948

1775

1949

1776

def if_nametoindex(interface):

1777

"""Call the C function if_nametoindex(), or equivalent

1778

1779

Note: This function cannot accept a unicode string."""

1780

global if_nametoindex

1781

try:

1782

if_nametoindex = (ctypes.cdll.LoadLibrary

1783

(ctypes.util.find_library("c"))

1784

.if_nametoindex)

1785

except (OSError, AttributeError):

1786

logger.warning("Doing if_nametoindex the hard way")

1787

def if_nametoindex(interface):

1788

"Get an interface index the hard way, i.e. using fcntl()"

1789

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1790

with contextlib.closing(socket.socket()) as s:

1791

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1792

struct.pack(str("16s16x"),

1793

interface))

1794

interface_index = struct.unpack(str("I"),

1795

ifreq[16:20])[0]

1796

return interface_index

1797

return if_nametoindex(interface)

1798

1799

1800

1950

def daemon(nochdir = False, noclose = False):

1801

1951

"""See daemon(3). Standard BSD Unix function.

1802

1952

1857

2007

" system bus interface")

1858

2008

parser.add_argument("--no-ipv6", action="store_false",

1859

2009

dest="use_ipv6", help="Do not use IPv6")

2010

parser.add_argument("--no-restore", action="store_false",

2011

dest="restore", help="Do not restore stored"

2012

" state")

2013

parser.add_argument("--statedir", metavar="DIR",

2014

help="Directory to save/restore state in")

2015

1860

2016

options = parser.parse_args()

1861

2017

1862

2018

if options.check:

1875

2031

"use_dbus": "True",

1876

2032

"use_ipv6": "True",

1877

2033

"debuglevel": "",

2034

"restore": "True",

2035

"statedir": "/var/lib/mandos"

1878

2036

}

1879

2037

1880

2038

# Parse config file for server-global settings

1897

2055

# options, if set.

1898

2056

for option in ("interface", "address", "port", "debug",

1899

2057

"priority", "servicename", "configdir",

1900

"use_dbus", "use_ipv6", "debuglevel"):

2058

"use_dbus", "use_ipv6", "debuglevel", "restore",

2059

"statedir"):

1901

2060

value = getattr(options, option)

1902

2061

if value is not None:

1903

2062

server_settings[option] = value

1915

2074

debuglevel = server_settings["debuglevel"]

1916

2075

use_dbus = server_settings["use_dbus"]

1917

2076

use_ipv6 = server_settings["use_ipv6"]

2077

stored_state_path = os.path.join(server_settings["statedir"],

2078

stored_state_file)

2079

2080

if debug:

2081

initlogger(logging.DEBUG)

2082

else:

2083

if not debuglevel:

2084

initlogger()

2085

else:

2086

level = getattr(logging, debuglevel.upper())

2087

initlogger(level)

1918

2088

1919

2089

if server_settings["servicename"] != "Mandos":

1920

2090

syslogger.setFormatter(logging.Formatter

1923

2093

% server_settings["servicename"]))

1924

2094

1925

2095

# Parse config file with clients

1926

client_defaults = { "timeout": "5m",

1927

"extended_timeout": "15m",

1928

"interval": "2m",

1929

"checker": "fping -q -- %%(host)s",

1930

"host": "",

1931

"approval_delay": "0s",

1932

"approval_duration": "1s",

1933

}

1934

client_config = configparser.SafeConfigParser(client_defaults)

2096

client_config = configparser.SafeConfigParser(Client.client_defaults)

1935

2097

client_config.read(os.path.join(server_settings["configdir"],

1936

2098

"clients.conf"))

1937

2099

1975

2137

if error[0] != errno.EPERM:

1976

2138

raise error

1977

2139

1978

if not debug and not debuglevel:

1979

logger.setLevel(logging.WARNING)

1980

if debuglevel:

1981

level = getattr(logging, debuglevel.upper())

1982

logger.setLevel(level)

1983

1984

2140

if debug:

1985

logger.setLevel(logging.DEBUG)

1986

2141

# Enable all possible GnuTLS debugging

1987

2142

1988

2143

# "Use a log level over 10 to enable all debugging options."

2010

2165

# Close all input and output, do double fork, etc.

2011

2166

daemon()

2012

2167

2168

gobject.threads_init()

2169

2013

2170

global main_loop

2014

2171

# From the Avahi example code

2015

2172

DBusGMainLoop(set_as_default=True )

2044

2201

if use_dbus:

2045

2202

client_class = functools.partial(ClientDBusTransitional,

2046

2203

bus = bus)

2047

def client_config_items(config, section):

2048

special_settings = {

2049

"approved_by_default":

2050

lambda: config.getboolean(section,

2051

"approved_by_default"),

2052

}

2053

for name, value in config.items(section):

2204

2205

client_settings = Client.config_parser(client_config)

2206

old_client_settings = {}

2207

clients_data = {}

2208

2209

# Get client data and settings from last running state.

2210

if server_settings["restore"]:

2211

try:

2212

with open(stored_state_path, "rb") as stored_state:

2213

clients_data, old_client_settings = (pickle.load

2214

(stored_state))

2215

os.remove(stored_state_path)

2216

except IOError as e:

2217

logger.warning("Could not load persistent state: {0}"

2218

.format(e))

2219

if e.errno != errno.ENOENT:

2220

raise

2221

2222

with PGPEngine() as pgp:

2223

for client_name, client in clients_data.iteritems():

2224

# Decide which value to use after restoring saved state.

2225

# We have three different values: Old config file,

2226

# new config file, and saved state.

2227

# New config value takes precedence if it differs from old

2228

# config value, otherwise use saved state.

2229

for name, value in client_settings[client_name].items():

2230

try:

2231

# For each value in new config, check if it

2232

# differs from the old config value (Except for

2233

# the "secret" attribute)

2234

if (name != "secret" and

2235

value != old_client_settings[client_name]

2236

[name]):

2237

client[name] = value

2238

except KeyError:

2239

pass

2240

2241

# Clients who has passed its expire date can still be

2242

# enabled if its last checker was successful. Clients

2243

# whose checker failed before we stored its state is

2244

# assumed to have failed all checkers during downtime.

2245

if client["enabled"]:

2246

if datetime.datetime.utcnow() >= client["expires"]:

2247

if not client["last_checked_ok"]:

2248

logger.warning(

2249

"disabling client {0} - Client never "

2250

"performed a successfull checker"

2251

.format(client["name"]))

2252

client["enabled"] = False

2253

elif client["last_checker_status"] != 0:

2254

logger.warning(

2255

"disabling client {0} - Client "

2256

"last checker failed with error code {1}"

2257

.format(client["name"],

2258

client["last_checker_status"]))

2259

client["enabled"] = False

2260

else:

2261

client["expires"] = (datetime.datetime

2262

.utcnow()

2263

+ client["timeout"])

2264

2054

2265

try:

2055

yield (name, special_settings[name]())

2056

except KeyError:

2057

yield (name, value)

2058

2059

tcp_server.clients.update(set(

2060

client_class(name = section,

2061

config= dict(client_config_items(

2062

client_config, section)))

2063

for section in client_config.sections()))

2266

client["secret"] = (

2267

pgp.decrypt(client["encrypted_secret"],

2268

client_settings[client_name]

2269

["secret"]))

2270

except PGPError:

2271

# If decryption fails, we use secret from new settings

2272

logger.debug("Failed to decrypt {0} old secret"

2273

.format(client_name))

2274

client["secret"] = (

2275

client_settings[client_name]["secret"])

2276

2277

2278

# Add/remove clients based on new changes made to config

2279

for client_name in set(old_client_settings) - set(client_settings):

2280

del clients_data[client_name]

2281

for client_name in set(client_settings) - set(old_client_settings):

2282

clients_data[client_name] = client_settings[client_name]

2283

2284

# Create clients all clients

2285

for client_name, client in clients_data.iteritems():

2286

tcp_server.clients[client_name] = client_class(

2287

name = client_name, settings = client)

2288

2064

2289

if not tcp_server.clients:

2065

2290

logger.warning("No clients defined")

2066

2291

2077

2302

# "pidfile" was never created

2078

2303

pass

2079

2304

del pidfilename

2080

2081

2305

signal.signal(signal.SIGINT, signal.SIG_IGN)

2082

2306

2083

2307

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2109

2333

def GetAllClients(self):

2110

2334

"D-Bus method"

2111

2335

return dbus.Array(c.dbus_object_path

2112

for c in tcp_server.clients)

2336

for c in

2337

tcp_server.clients.itervalues())

2113

2338

2114

2339

@dbus.service.method(_interface,

2115

2340

out_signature="a{oa{sv}}")

2117

2342

"D-Bus method"

2118

2343

return dbus.Dictionary(

2119

2344

((c.dbus_object_path, c.GetAll(""))

2120

for c in tcp_server.clients),

2345

for c in tcp_server.clients.itervalues()),

2121

2346

signature="oa{sv}")

2122

2347

2123

2348

@dbus.service.method(_interface, in_signature="o")

2124

2349

def RemoveClient(self, object_path):

2125

2350

"D-Bus method"

2126

for c in tcp_server.clients:

2351

for c in tcp_server.clients.itervalues():

2127

2352

if c.dbus_object_path == object_path:

2128

tcp_server.clients.remove(c)

2353

del tcp_server.clients[c.name]

2129

2354

c.remove_from_connection()

2130

2355

# Don't signal anything except ClientRemoved

2131

2356

c.disable(quiet=True)

2145

2370

service.cleanup()

2146

2371

2147

2372

multiprocessing.active_children()

2373

if not (tcp_server.clients or client_settings):

2374

return

2375

2376

# Store client before exiting. Secrets are encrypted with key

2377

# based on what config file has. If config file is

2378

# removed/edited, old secret will thus be unrecovable.

2379

clients = {}

2380

with PGPEngine() as pgp:

2381

for client in tcp_server.clients.itervalues():

2382

key = client_settings[client.name]["secret"]

2383

client.encrypted_secret = pgp.encrypt(client.secret,

2384

key)

2385

client_dict = {}

2386

2387

# A list of attributes that can not be pickled

2388

# + secret.

2389

exclude = set(("bus", "changedstate", "secret",

2390

"checker"))

2391

for name, typ in (inspect.getmembers

2392

(dbus.service.Object)):

2393

exclude.add(name)

2394

2395

client_dict["encrypted_secret"] = (client

2396

.encrypted_secret)

2397

for attr in client.client_structure:

2398

if attr not in exclude:

2399

client_dict[attr] = getattr(client, attr)

2400

2401

clients[client.name] = client_dict

2402

del client_settings[client.name]["secret"]

2403

2404

try:

2405

with os.fdopen(os.open(stored_state_path,

2406

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2407

0600), "wb") as stored_state:

2408

pickle.dump((clients, client_settings), stored_state)

2409

except (IOError, OSError) as e:

2410

logger.warning("Could not save persistent state: {0}"

2411

.format(e))

2412

if e.errno not in (errno.ENOENT, errno.EACCES):

2413

raise

2414

2415

# Delete all clients, and settings from config

2148

2416

while tcp_server.clients:

2149

client = tcp_server.clients.pop()

2417

name, client = tcp_server.clients.popitem()

2150

2418

if use_dbus:

2151

2419

client.remove_from_connection()

2152

client.disable_hook = None

2153

2420

# Don't signal anything except ClientRemoved

2154

2421

client.disable(quiet=True)

2155

2422

if use_dbus:

2157

2424

mandos_dbus_service.ClientRemoved(client

2158

2425

.dbus_object_path,

2159

2426

client.name)

2427

client_settings.clear()

2160

2428

2161

2429

atexit.register(cleanup)

2162

2430

2163

for client in tcp_server.clients:

2431

for client in tcp_server.clients.itervalues():

2164

2432

if use_dbus:

2165

2433

# Emit D-Bus signal

2166

2434

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2167

client.enable()

2435

# Need to initiate checking of clients

2436

if client.enabled:

2437

client.init_checker()

2168

2438

2169

2439

tcp_server.enable()

2170

2440

tcp_server.server_activate()

2210

2480

# Must run before the D-Bus bus name gets deregistered

2211

2481

cleanup()

2212

2482

2213

2214

2483

if __name__ == '__main__':

2215

2484

main()