/mandos/trunk : revision 505.1.23

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

66

68

67

69

import dbus

68

70

import dbus.service

73

75

import ctypes.util

74

76

import xml.dom.minidom

75

77

import inspect

78

import GnuPGInterface

76

79

77

80

try:

78

81

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

82

85

except ImportError:

83

86

SO_BINDTODEVICE = None

84

87

85

86

88

version = "1.4.1"

89

stored_state_file = "clients.pickle"

87

90

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

91

logger = logging.getLogger()

90

92

syslogger = (logging.handlers.SysLogHandler

91

93

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

94

address = str("/dev/log")))

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

console = logging.StreamHandler()

122

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

123

' [%(process)d]:'

124

' %(levelname)s:'

125

' %(message)s'))

126

logger.addHandler(console)

127

logger.setLevel(level)

128

129

130

class PGPError(Exception):

131

"""Exception if encryption/decryption fails"""

132

pass

133

134

135

class PGPEngine(object):

136

"""A simple class for OpenPGP symmetric encryption & decryption"""

137

def __init__(self):

138

self.gnupg = GnuPGInterface.GnuPG()

139

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

140

self.gnupg = GnuPGInterface.GnuPG()

141

self.gnupg.options.meta_interactive = False

142

self.gnupg.options.homedir = self.tempdir

143

self.gnupg.options.extra_args.extend(['--force-mdc',

144

'--quiet'])

145

146

def __enter__(self):

147

return self

148

149

def __exit__ (self, exc_type, exc_value, traceback):

150

self._cleanup()

151

return False

152

153

def __del__(self):

154

self._cleanup()

155

156

def _cleanup(self):

157

if self.tempdir is not None:

158

# Delete contents of tempdir

159

for root, dirs, files in os.walk(self.tempdir,

160

topdown = False):

161

for filename in files:

162

os.remove(os.path.join(root, filename))

163

for dirname in dirs:

164

os.rmdir(os.path.join(root, dirname))

165

# Remove tempdir

166

os.rmdir(self.tempdir)

167

self.tempdir = None

168

169

def password_encode(self, password):

170

# Passphrase can not be empty and can not contain newlines or

171

# NUL bytes. So we prefix it and hex encode it.

172

return b"mandos" + binascii.hexlify(password)

173

174

def encrypt(self, data, password):

175

self.gnupg.passphrase = self.password_encode(password)

176

with open(os.devnull) as devnull:

177

try:

178

proc = self.gnupg.run(['--symmetric'],

179

create_fhs=['stdin', 'stdout'],

180

attach_fhs={'stderr': devnull})

181

with contextlib.closing(proc.handles['stdin']) as f:

182

f.write(data)

183

with contextlib.closing(proc.handles['stdout']) as f:

184

ciphertext = f.read()

185

proc.wait()

186

except IOError as e:

187

raise PGPError(e)

188

self.gnupg.passphrase = None

189

return ciphertext

190

191

def decrypt(self, data, password):

192

self.gnupg.passphrase = self.password_encode(password)

193

with open(os.devnull) as devnull:

194

try:

195

proc = self.gnupg.run(['--decrypt'],

196

create_fhs=['stdin', 'stdout'],

197

attach_fhs={'stderr': devnull})

198

with contextlib.closing(proc.handles['stdin'] ) as f:

199

f.write(data)

200

with contextlib.closing(proc.handles['stdout']) as f:

201

decrypted_plaintext = f.read()

202

proc.wait()

203

except IOError as e:

204

raise PGPError(e)

205

self.gnupg.passphrase = None

206

return decrypted_plaintext

207

208

103

209

104

210

class AvahiError(Exception):

105

211

def __init__(self, value, *args, **kwargs):

164

270

.GetAlternativeServiceName(self.name))

165

271

logger.info("Changing Zeroconf service name to %r ...",

166

272

self.name)

167

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

170

% self.name))

171

273

self.remove()

172

274

try:

173

275

self.add()

193

295

avahi.DBUS_INTERFACE_ENTRY_GROUP)

194

296

self.entry_group_state_changed_match = (

195

297

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

298

'StateChanged', self.entry_group_state_changed))

197

299

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

198

300

self.name, self.type)

199

301

self.group.AddService(

225

327

try:

226

328

self.group.Free()

227

329

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

330

dbus.exceptions.DBusException):

229

331

pass

230

332

self.group = None

231

333

self.remove()

265

367

self.server_state_changed)

266

368

self.server_state_changed(self.server.GetState())

267

369

370

class AvahiServiceToSyslog(AvahiService):

371

def rename(self):

372

"""Add the new name to the syslog messages"""

373

ret = AvahiService.rename(self)

374

syslogger.setFormatter(logging.Formatter

375

('Mandos (%s) [%%(process)d]:'

376

' %%(levelname)s: %%(message)s'

377

% self.name))

378

return ret

268

379

269

def _timedelta_to_milliseconds(td):

380

def timedelta_to_milliseconds(td):

270

381

"Convert a datetime.timedelta() to milliseconds"

271

382

return ((td.days * 24 * 60 * 60 * 1000)

272

383

+ (td.seconds * 1000)

276

387

"""A representation of a client host served by this server.

277

388

278

389

Attributes:

279

_approved: bool(); 'None' if not yet approved/disapproved

390

approved: bool(); 'None' if not yet approved/disapproved

280

391

approval_delay: datetime.timedelta(); Time to wait for approval

281

392

approval_duration: datetime.timedelta(); Duration of one approval

282

393

checker: subprocess.Popen(); a running checker process used

289

400

instance %(name)s can be used in the command.

290

401

checker_initiator_tag: a gobject event source tag, or None

291

402

created: datetime.datetime(); (UTC) object creation

403

client_structure: Object describing what attributes a client has

404

and is used for storing the client at exit

292

405

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

406

disable_initiator_tag: a gobject event source tag, or None

295

407

enabled: bool()

296

408

fingerprint: string (40 or 32 hexadecimal digits); used to

299

411

interval: datetime.timedelta(); How often to start a new checker

300

412

last_approval_request: datetime.datetime(); (UTC) or None

301

413

last_checked_ok: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

414

last_checker_status: integer between 0 and 255 reflecting exit

415

status of last checker. -1 reflects crashed

416

checker, or None.

417

last_enabled: datetime.datetime(); (UTC) or None

303

418

name: string; from the config file, used in log messages and

304

419

D-Bus identifiers

305

420

secret: bytestring; sent verbatim (over TLS) to client

315

430

"created", "enabled", "fingerprint",

316

431

"host", "interval", "last_checked_ok",

317

432

"last_enabled", "name", "timeout")

433

client_defaults = { "timeout": "5m",

434

"extended_timeout": "15m",

435

"interval": "2m",

436

"checker": "fping -q -- %%(host)s",

437

"host": "",

438

"approval_delay": "0s",

439

"approval_duration": "1s",

440

"approved_by_default": "True",

441

"enabled": "True",

442

}

318

443

319

444

def timeout_milliseconds(self):

320

445

"Return the 'timeout' attribute in milliseconds"

321

return _timedelta_to_milliseconds(self.timeout)

446

return timedelta_to_milliseconds(self.timeout)

322

447

323

448

def extended_timeout_milliseconds(self):

324

449

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

450

return timedelta_to_milliseconds(self.extended_timeout)

326

451

327

452

def interval_milliseconds(self):

328

453

"Return the 'interval' attribute in milliseconds"

329

return _timedelta_to_milliseconds(self.interval)

454

return timedelta_to_milliseconds(self.interval)

330

455

331

456

def approval_delay_milliseconds(self):

332

return _timedelta_to_milliseconds(self.approval_delay)

333

334

def __init__(self, name = None, disable_hook=None, config=None):

457

return timedelta_to_milliseconds(self.approval_delay)

458

459

@staticmethod

460

def config_parser(config):

461

""" Construct a new dict of client settings of this form:

462

{ client_name: {setting_name: value, ...}, ...}

463

with exceptions for any special settings as defined above"""

464

settings = {}

465

for client_name in config.sections():

466

section = dict(config.items(client_name))

467

client = settings[client_name] = {}

468

469

client["host"] = section["host"]

470

# Reformat values from string types to Python types

471

client["approved_by_default"] = config.getboolean(

472

client_name, "approved_by_default")

473

client["enabled"] = config.getboolean(client_name, "enabled")

474

475

client["fingerprint"] = (section["fingerprint"].upper()

476

.replace(" ", ""))

477

if "secret" in section:

478

client["secret"] = section["secret"].decode("base64")

479

elif "secfile" in section:

480

with open(os.path.expanduser(os.path.expandvars

481

(section["secfile"])),

482

"rb") as secfile:

483

client["secret"] = secfile.read()

484

else:

485

raise TypeError("No secret or secfile for section %s"

486

% section)

487

client["timeout"] = string_to_delta(section["timeout"])

488

client["extended_timeout"] = string_to_delta(

489

section["extended_timeout"])

490

client["interval"] = string_to_delta(section["interval"])

491

client["approval_delay"] = string_to_delta(

492

section["approval_delay"])

493

client["approval_duration"] = string_to_delta(

494

section["approval_duration"])

495

client["checker_command"] = section["checker"]

496

client["last_approval_request"] = None

497

client["last_checked_ok"] = None

498

client["last_checker_status"] = None

499

if client["enabled"]:

500

client["last_enabled"] = datetime.datetime.utcnow()

501

client["expires"] = (datetime.datetime.utcnow()

502

+ client["timeout"])

503

else:

504

client["last_enabled"] = None

505

client["expires"] = None

506

507

return settings

508

509

510

def __init__(self, settings, name = None):

335

511

"""Note: the 'checker' key in 'config' sets the

336

512

'checker_command' attribute and *not* the 'checker'

337

513

attribute."""

338

514

self.name = name

339

if config is None:

340

config = {}

515

# adding all client settings

516

for setting, value in settings.iteritems():

517

setattr(self, setting, value)

518

341

519

logger.debug("Creating client %r", self.name)

342

520

# Uppercase and remove spaces from fingerprint for later

343

521

# comparison purposes with return value from the fingerprint()

344

522

# function

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

347

523

logger.debug(" Fingerprint: %s", self.fingerprint)

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

351

with open(os.path.expanduser(os.path.expandvars

352

(config["secfile"])),

353

"rb") as secfile:

354

self.secret = secfile.read()

355

else:

356

raise TypeError("No secret or secfile for client %s"

357

% self.name)

358

self.host = config.get("host", "")

359

self.created = datetime.datetime.utcnow()

360

self.enabled = False

361

self.last_approval_request = None

362

self.last_enabled = None

363

self.last_checked_ok = None

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

368

self.disable_hook = disable_hook

524

self.created = settings.get("created", datetime.datetime.utcnow())

525

526

# attributes specific for this server instance

369

527

self.checker = None

370

528

self.checker_initiator_tag = None

371

529

self.disable_initiator_tag = None

372

self.expires = None

373

530

self.checker_callback_tag = None

374

self.checker_command = config["checker"]

375

531

self.current_checker_command = None

376

self.last_connect = None

377

self._approved = None

378

self.approved_by_default = config.get("approved_by_default",

379

True)

532

self.approved = None

380

533

self.approvals_pending = 0

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

385

534

self.changedstate = (multiprocessing_manager

386

535

.Condition(multiprocessing_manager

387

536

.Lock()))

537

self.client_structure = [attr for attr in

538

self.__dict__.iterkeys()

539

if not attr.startswith("_")]

540

self.client_structure.append("client_structure")

541

542

for name, t in inspect.getmembers(type(self),

543

lambda obj:

544

isinstance(obj,

545

property)):

546

if not name.startswith("_"):

547

self.client_structure.append(name)

388

548

549

# Send notice to process children that client state has changed

389

550

def send_changedstate(self):

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

551

with self.changedstate:

552

self.changedstate.notify_all()

393

553

394

554

def enable(self):

395

555

"""Start this client's checker and timeout hooks"""

397

557

# Already enabled

398

558

return

399

559

self.send_changedstate()

400

# Schedule a new checker to be started an 'interval' from now,

401

# and every interval from then on.

402

self.checker_initiator_tag = (gobject.timeout_add

403

(self.interval_milliseconds(),

404

self.start_checker))

405

# Schedule a disable() when 'timeout' has passed

406

560

self.expires = datetime.datetime.utcnow() + self.timeout

407

self.disable_initiator_tag = (gobject.timeout_add

408

(self.timeout_milliseconds(),

409

self.disable))

410

561

self.enabled = True

411

562

self.last_enabled = datetime.datetime.utcnow()

412

# Also start a new checker *right now*.

413

self.start_checker()

563

self.init_checker()

414

564

415

565

def disable(self, quiet=True):

416

566

"""Disable this client."""

428

578

gobject.source_remove(self.checker_initiator_tag)

429

579

self.checker_initiator_tag = None

430

580

self.stop_checker()

431

if self.disable_hook:

432

self.disable_hook(self)

433

581

self.enabled = False

434

582

# Do not run this again if called by a gobject.timeout_add

435

583

return False

436

584

437

585

def __del__(self):

438

self.disable_hook = None

439

586

self.disable()

440

587

588

def init_checker(self):

589

# Schedule a new checker to be started an 'interval' from now,

590

# and every interval from then on.

591

self.checker_initiator_tag = (gobject.timeout_add

592

(self.interval_milliseconds(),

593

self.start_checker))

594

# Schedule a disable() when 'timeout' has passed

595

self.disable_initiator_tag = (gobject.timeout_add

596

(self.timeout_milliseconds(),

597

self.disable))

598

# Also start a new checker *right now*.

599

self.start_checker()

600

441

601

def checker_callback(self, pid, condition, command):

442

602

"""The checker has completed, so take appropriate actions."""

443

603

self.checker_callback_tag = None

444

604

self.checker = None

445

605

if os.WIFEXITED(condition):

446

exitstatus = os.WEXITSTATUS(condition)

447

if exitstatus == 0:

606

self.last_checker_status = os.WEXITSTATUS(condition)

607

if self.last_checker_status == 0:

448

608

logger.info("Checker for %(name)s succeeded",

449

609

vars(self))

450

610

self.checked_ok()

452

612

logger.info("Checker for %(name)s failed",

453

613

vars(self))

454

614

else:

615

self.last_checker_status = -1

455

616

logger.warning("Checker for %(name)s crashed?",

456

617

vars(self))

457

618

468

629

gobject.source_remove(self.disable_initiator_tag)

469

630

if getattr(self, "enabled", False):

470

631

self.disable_initiator_tag = (gobject.timeout_add

471

(_timedelta_to_milliseconds

632

(timedelta_to_milliseconds

472

633

(timeout), self.disable))

473

634

self.expires = datetime.datetime.utcnow() + timeout

474

635

691

852

692

853

Note: Will not include properties with access="write".

693

854

"""

694

all = {}

855

properties = {}

695

856

for name, prop in self._get_all_dbus_properties():

696

857

if (interface_name

697

858

and interface_name != prop._dbus_interface):

702

863

continue

703

864

value = prop()

704

865

if not hasattr(value, "variant_level"):

705

all[name] = value

866

properties[name] = value

706

867

continue

707

all[name] = type(value)(value, variant_level=

708

value.variant_level+1)

709

return dbus.Dictionary(all, signature="sv")

868

properties[name] = type(value)(value, variant_level=

869

value.variant_level+1)

870

return dbus.Dictionary(properties, signature="sv")

710

871

711

872

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

712

873

out_signature="s",

763

924

return dbus.String(dt.isoformat(),

764

925

variant_level=variant_level)

765

926

927

766

928

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

767

929

.__metaclass__):

768

930

"""Applied to an empty subclass of a D-Bus object, this metaclass

860

1022

attribute.func_closure)))

861

1023

return type.__new__(mcs, name, bases, attr)

862

1024

1025

863

1026

class ClientDBus(Client, DBusObjectWithProperties):

864

1027

"""A Client class using D-Bus

865

1028

874

1037

# dbus.service.Object doesn't use super(), so we can't either.

875

1038

876

1039

def __init__(self, bus = None, *args, **kwargs):

877

self._approvals_pending = 0

878

1040

self.bus = bus

879

1041

Client.__init__(self, *args, **kwargs)

1042

self._approvals_pending = 0

1043

1044

self._approvals_pending = 0

880

1045

# Only now, when this client is initialized, can it show up on

881

1046

# the D-Bus

882

1047

client_object_name = unicode(self.name).translate(

892

1057

variant_level=1):

893

1058

""" Modify a variable so that it's a property which announces

894

1059

its changes to DBus.

895

1060

896

1061

transform_fun: Function that takes a value and a variant_level

897

1062

and transforms it to a D-Bus type.

898

1063

dbus_name: D-Bus name of the variable

932

1097

datetime_to_dbus, "LastApprovalRequest")

933

1098

approved_by_default = notifychangeproperty(dbus.Boolean,

934

1099

"ApprovedByDefault")

935

approval_delay = notifychangeproperty(dbus.UInt16,

1100

approval_delay = notifychangeproperty(dbus.UInt64,

936

1101

"ApprovalDelay",

937

1102

type_func =

938

_timedelta_to_milliseconds)

1103

timedelta_to_milliseconds)

939

1104

approval_duration = notifychangeproperty(

940

dbus.UInt16, "ApprovalDuration",

941

type_func = _timedelta_to_milliseconds)

1105

dbus.UInt64, "ApprovalDuration",

1106

type_func = timedelta_to_milliseconds)

942

1107

host = notifychangeproperty(dbus.String, "Host")

943

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1108

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

944

1109

type_func =

945

_timedelta_to_milliseconds)

1110

timedelta_to_milliseconds)

946

1111

extended_timeout = notifychangeproperty(

947

dbus.UInt16, "ExtendedTimeout",

948

type_func = _timedelta_to_milliseconds)

949

interval = notifychangeproperty(dbus.UInt16,

1112

dbus.UInt64, "ExtendedTimeout",

1113

type_func = timedelta_to_milliseconds)

1114

interval = notifychangeproperty(dbus.UInt64,

950

1115

"Interval",

951

1116

type_func =

952

_timedelta_to_milliseconds)

1117

timedelta_to_milliseconds)

953

1118

checker_command = notifychangeproperty(dbus.String, "Checker")

954

1119

955

1120

del notifychangeproperty

997

1162

return r

998

1163

999

1164

def _reset_approved(self):

1000

self._approved = None

1165

self.approved = None

1001

1166

return False

1002

1167

1003

1168

def approve(self, value=True):

1004

1169

self.send_changedstate()

1005

self._approved = value

1006

gobject.timeout_add(_timedelta_to_milliseconds

1170

self.approved = value

1171

gobject.timeout_add(timedelta_to_milliseconds

1007

1172

(self.approval_duration),

1008

1173

self._reset_approved)

1009

1174

1052

1217

"D-Bus signal"

1053

1218

return self.need_approval()

1054

1219

1220

# NeRwequest - signal

1221

@dbus.service.signal(_interface, signature="s")

1222

def NewRequest(self, ip):

1223

"""D-Bus signal

1224

Is sent after a client request a password.

1225

"""

1226

pass

1227

1055

1228

## Methods

1056

1229

1057

1230

# Approve - method

1115

1288

access="readwrite")

1116

1289

def ApprovalDuration_dbus_property(self, value=None):

1117

1290

if value is None: # get

1118

return dbus.UInt64(_timedelta_to_milliseconds(

1291

return dbus.UInt64(timedelta_to_milliseconds(

1119

1292

self.approval_duration))

1120

1293

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1121

1294

1135

1308

def Host_dbus_property(self, value=None):

1136

1309

if value is None: # get

1137

1310

return dbus.String(self.host)

1138

self.host = value

1311

self.host = unicode(value)

1139

1312

1140

1313

# Created - property

1141

1314

@dbus_service_property(_interface, signature="s", access="read")

1142

1315

def Created_dbus_property(self):

1143

return dbus.String(datetime_to_dbus(self.created))

1316

return datetime_to_dbus(self.created)

1144

1317

1145

1318

# LastEnabled - property

1146

1319

@dbus_service_property(_interface, signature="s", access="read")

1190

1363

gobject.source_remove(self.disable_initiator_tag)

1191

1364

self.disable_initiator_tag = None

1192

1365

self.expires = None

1193

time_to_die = _timedelta_to_milliseconds((self

1194

.last_checked_ok

1195

+ self.timeout)

1196

- datetime.datetime

1197

.utcnow())

1366

time_to_die = timedelta_to_milliseconds((self

1367

.last_checked_ok

1368

+ self.timeout)

1369

- datetime.datetime

1370

.utcnow())

1198

1371

if time_to_die <= 0:

1199

1372

# The timeout has passed

1200

1373

self.disable()

1222

1395

self.interval = datetime.timedelta(0, 0, 0, value)

1223

1396

if getattr(self, "checker_initiator_tag", None) is None:

1224

1397

return

1225

# Reschedule checker run

1226

gobject.source_remove(self.checker_initiator_tag)

1227

self.checker_initiator_tag = (gobject.timeout_add

1228

(value, self.start_checker))

1229

self.start_checker() # Start one now, too

1398

if self.enabled:

1399

# Reschedule checker run

1400

gobject.source_remove(self.checker_initiator_tag)

1401

self.checker_initiator_tag = (gobject.timeout_add

1402

(value, self.start_checker))

1403

self.start_checker() # Start one now, too

1230

1404

1231

1405

# Checker - property

1232

1406

@dbus_service_property(_interface, signature="s",

1234

1408

def Checker_dbus_property(self, value=None):

1235

1409

if value is None: # get

1236

1410

return dbus.String(self.checker_command)

1237

self.checker_command = value

1411

self.checker_command = unicode(value)

1238

1412

1239

1413

# CheckerRunning - property

1240

1414

@dbus_service_property(_interface, signature="b",

1269

1443

raise KeyError()

1270

1444

1271

1445

def __getattribute__(self, name):

1272

if(name == '_pipe'):

1446

if name == '_pipe':

1273

1447

return super(ProxyClient, self).__getattribute__(name)

1274

1448

self._pipe.send(('getattr', name))

1275

1449

data = self._pipe.recv()

1282

1456

return func

1283

1457

1284

1458

def __setattr__(self, name, value):

1285

if(name == '_pipe'):

1459

if name == '_pipe':

1286

1460

return super(ProxyClient, self).__setattr__(name, value)

1287

1461

self._pipe.send(('setattr', name, value))

1288

1462

1463

1289

1464

class ClientDBusTransitional(ClientDBus):

1290

1465

__metaclass__ = AlternateDBusNamesMetaclass

1291

1466

1467

1292

1468

class ClientHandler(socketserver.BaseRequestHandler, object):

1293

1469

"""A class to handle client connections.

1294

1470

1362

1538

except KeyError:

1363

1539

return

1364

1540

1541

if self.server.use_dbus:

1542

# Emit D-Bus signal

1543

client.NewRequest(str(self.client_address))

1544

1365

1545

if client.approval_delay:

1366

1546

delay = client.approval_delay

1367

1547

client.approvals_pending += 1

1376

1556

client.Rejected("Disabled")

1377

1557

return

1378

1558

1379

if client._approved or not client.approval_delay:

1559

if client.approved or not client.approval_delay:

1380

1560

#We are approved or approval is disabled

1381

1561

break

1382

elif client._approved is None:

1562

elif client.approved is None:

1383

1563

logger.info("Client %s needs approval",

1384

1564

client.name)

1385

1565

if self.server.use_dbus:

1399

1579

time = datetime.datetime.now()

1400

1580

client.changedstate.acquire()

1401

1581

(client.changedstate.wait

1402

(float(client._timedelta_to_milliseconds(delay)

1582

(float(client.timedelta_to_milliseconds(delay)

1403

1583

/ 1000)))

1404

1584

client.changedstate.release()

1405

1585

time2 = datetime.datetime.now()

1504

1684

# Convert the buffer to a Python bytestring

1505

1685

fpr = ctypes.string_at(buf, buf_len.value)

1506

1686

# Convert the bytestring to hexadecimal notation

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1687

hex_fpr = binascii.hexlify(fpr).upper()

1508

1688

return hex_fpr

1509

1689

1510

1690

1513

1693

def sub_process_main(self, request, address):

1514

1694

try:

1515

1695

self.finish_request(request, address)

1516

except:

1696

except Exception:

1517

1697

self.handle_error(request, address)

1518

1698

self.close_request(request)

1519

1699

1624

1804

self.enabled = False

1625

1805

self.clients = clients

1626

1806

if self.clients is None:

1627

self.clients = set()

1807

self.clients = {}

1628

1808

self.use_dbus = use_dbus

1629

1809

self.gnutls_priority = gnutls_priority

1630

1810

IPv6_TCPServer.__init__(self, server_address,

1677

1857

fpr = request[1]

1678

1858

address = request[2]

1679

1859

1680

for c in self.clients:

1860

for c in self.clients.itervalues():

1681

1861

if c.fingerprint == fpr:

1682

1862

client = c

1683

1863

break

1767

1947

return timevalue

1768

1948

1769

1949

1770

def if_nametoindex(interface):

1771

"""Call the C function if_nametoindex(), or equivalent

1772

1773

Note: This function cannot accept a unicode string."""

1774

global if_nametoindex

1775

try:

1776

if_nametoindex = (ctypes.cdll.LoadLibrary

1777

(ctypes.util.find_library("c"))

1778

.if_nametoindex)

1779

except (OSError, AttributeError):

1780

logger.warning("Doing if_nametoindex the hard way")

1781

def if_nametoindex(interface):

1782

"Get an interface index the hard way, i.e. using fcntl()"

1783

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1784

with contextlib.closing(socket.socket()) as s:

1785

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1786

struct.pack(str("16s16x"),

1787

interface))

1788

interface_index = struct.unpack(str("I"),

1789

ifreq[16:20])[0]

1790

return interface_index

1791

return if_nametoindex(interface)

1792

1793

1794

1950

def daemon(nochdir = False, noclose = False):

1795

1951

"""See daemon(3). Standard BSD Unix function.

1796

1952

1851

2007

" system bus interface")

1852

2008

parser.add_argument("--no-ipv6", action="store_false",

1853

2009

dest="use_ipv6", help="Do not use IPv6")

2010

parser.add_argument("--no-restore", action="store_false",

2011

dest="restore", help="Do not restore stored"

2012

" state")

2013

parser.add_argument("--statedir", metavar="DIR",

2014

help="Directory to save/restore state in")

2015

1854

2016

options = parser.parse_args()

1855

2017

1856

2018

if options.check:

1869

2031

"use_dbus": "True",

1870

2032

"use_ipv6": "True",

1871

2033

"debuglevel": "",

2034

"restore": "True",

2035

"statedir": "/var/lib/mandos"

1872

2036

}

1873

2037

1874

2038

# Parse config file for server-global settings

1891

2055

# options, if set.

1892

2056

for option in ("interface", "address", "port", "debug",

1893

2057

"priority", "servicename", "configdir",

1894

"use_dbus", "use_ipv6", "debuglevel"):

2058

"use_dbus", "use_ipv6", "debuglevel", "restore",

2059

"statedir"):

1895

2060

value = getattr(options, option)

1896

2061

if value is not None:

1897

2062

server_settings[option] = value

1909

2074

debuglevel = server_settings["debuglevel"]

1910

2075

use_dbus = server_settings["use_dbus"]

1911

2076

use_ipv6 = server_settings["use_ipv6"]

2077

stored_state_path = os.path.join(server_settings["statedir"],

2078

stored_state_file)

2079

2080

if debug:

2081

initlogger(logging.DEBUG)

2082

else:

2083

if not debuglevel:

2084

initlogger()

2085

else:

2086

level = getattr(logging, debuglevel.upper())

2087

initlogger(level)

1912

2088

1913

2089

if server_settings["servicename"] != "Mandos":

1914

2090

syslogger.setFormatter(logging.Formatter

1917

2093

% server_settings["servicename"]))

1918

2094

1919

2095

# Parse config file with clients

1920

client_defaults = { "timeout": "5m",

1921

"extended_timeout": "15m",

1922

"interval": "2m",

1923

"checker": "fping -q -- %%(host)s",

1924

"host": "",

1925

"approval_delay": "0s",

1926

"approval_duration": "1s",

1927

}

1928

client_config = configparser.SafeConfigParser(client_defaults)

2096

client_config = configparser.SafeConfigParser(Client.client_defaults)

1929

2097

client_config.read(os.path.join(server_settings["configdir"],

1930

2098

"clients.conf"))

1931

2099

1969

2137

if error[0] != errno.EPERM:

1970

2138

raise error

1971

2139

1972

if not debug and not debuglevel:

1973

syslogger.setLevel(logging.WARNING)

1974

console.setLevel(logging.WARNING)

1975

if debuglevel:

1976

level = getattr(logging, debuglevel.upper())

1977

syslogger.setLevel(level)

1978

console.setLevel(level)

1979

1980

2140

if debug:

1981

2141

# Enable all possible GnuTLS debugging

1982

2142

2005

2165

# Close all input and output, do double fork, etc.

2006

2166

daemon()

2007

2167

2168

gobject.threads_init()

2169

2008

2170

global main_loop

2009

2171

# From the Avahi example code

2010

2172

DBusGMainLoop(set_as_default=True )

2024

2186

server_settings["use_dbus"] = False

2025

2187

tcp_server.use_dbus = False

2026

2188

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

2029

protocol = protocol, bus = bus)

2189

service = AvahiServiceToSyslog(name =

2190

server_settings["servicename"],

2191

servicetype = "_mandos._tcp",

2192

protocol = protocol, bus = bus)

2030

2193

if server_settings["interface"]:

2031

2194

service.interface = (if_nametoindex

2032

2195

(str(server_settings["interface"])))

2038

2201

if use_dbus:

2039

2202

client_class = functools.partial(ClientDBusTransitional,

2040

2203

bus = bus)

2041

def client_config_items(config, section):

2042

special_settings = {

2043

"approved_by_default":

2044

lambda: config.getboolean(section,

2045

"approved_by_default"),

2046

}

2047

for name, value in config.items(section):

2204

2205

client_settings = Client.config_parser(client_config)

2206

old_client_settings = {}

2207

clients_data = {}

2208

2209

# Get client data and settings from last running state.

2210

if server_settings["restore"]:

2211

try:

2212

with open(stored_state_path, "rb") as stored_state:

2213

clients_data, old_client_settings = (pickle.load

2214

(stored_state))

2215

os.remove(stored_state_path)

2216

except IOError as e:

2217

logger.warning("Could not load persistent state: {0}"

2218

.format(e))

2219

if e.errno != errno.ENOENT:

2220

raise

2221

except EOFError as e:

2222

logger.warning("Could not load persistent state: "

2223

"EOFError: {0}".format(e))

2224

2225

with PGPEngine() as pgp:

2226

for client_name, client in clients_data.iteritems():

2227

# Decide which value to use after restoring saved state.

2228

# We have three different values: Old config file,

2229

# new config file, and saved state.

2230

# New config value takes precedence if it differs from old

2231

# config value, otherwise use saved state.

2232

for name, value in client_settings[client_name].items():

2233

try:

2234

# For each value in new config, check if it

2235

# differs from the old config value (Except for

2236

# the "secret" attribute)

2237

if (name != "secret" and

2238

value != old_client_settings[client_name]

2239

[name]):

2240

client[name] = value

2241

except KeyError:

2242

pass

2243

2244

# Clients who has passed its expire date can still be

2245

# enabled if its last checker was successful. Clients

2246

# whose checker failed before we stored its state is

2247

# assumed to have failed all checkers during downtime.

2248

if client["enabled"]:

2249

if datetime.datetime.utcnow() >= client["expires"]:

2250

if not client["last_checked_ok"]:

2251

logger.warning(

2252

"disabling client {0} - Client never "

2253

"performed a successfull checker"

2254

.format(client["name"]))

2255

client["enabled"] = False

2256

elif client["last_checker_status"] != 0:

2257

logger.warning(

2258

"disabling client {0} - Client "

2259

"last checker failed with error code {1}"

2260

.format(client["name"],

2261

client["last_checker_status"]))

2262

client["enabled"] = False

2263

else:

2264

client["expires"] = (datetime.datetime

2265

.utcnow()

2266

+ client["timeout"])

2267

2048

2268

try:

2049

yield (name, special_settings[name]())

2050

except KeyError:

2051

yield (name, value)

2052

2053

tcp_server.clients.update(set(

2054

client_class(name = section,

2055

config= dict(client_config_items(

2056

client_config, section)))

2057

for section in client_config.sections()))

2269

client["secret"] = (

2270

pgp.decrypt(client["encrypted_secret"],

2271

client_settings[client_name]

2272

["secret"]))

2273

except PGPError:

2274

# If decryption fails, we use secret from new settings

2275

logger.debug("Failed to decrypt {0} old secret"

2276

.format(client_name))

2277

client["secret"] = (

2278

client_settings[client_name]["secret"])

2279

2280

2281

# Add/remove clients based on new changes made to config

2282

for client_name in set(old_client_settings) - set(client_settings):

2283

del clients_data[client_name]

2284

for client_name in set(client_settings) - set(old_client_settings):

2285

clients_data[client_name] = client_settings[client_name]

2286

2287

# Create clients all clients

2288

for client_name, client in clients_data.iteritems():

2289

tcp_server.clients[client_name] = client_class(

2290

name = client_name, settings = client)

2291

2058

2292

if not tcp_server.clients:

2059

2293

logger.warning("No clients defined")

2060

2294

2071

2305

# "pidfile" was never created

2072

2306

pass

2073

2307

del pidfilename

2074

2075

2308

signal.signal(signal.SIGINT, signal.SIG_IGN)

2076

2309

2077

2310

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2103

2336

def GetAllClients(self):

2104

2337

"D-Bus method"

2105

2338

return dbus.Array(c.dbus_object_path

2106

for c in tcp_server.clients)

2339

for c in

2340

tcp_server.clients.itervalues())

2107

2341

2108

2342

@dbus.service.method(_interface,

2109

2343

out_signature="a{oa{sv}}")

2111

2345

"D-Bus method"

2112

2346

return dbus.Dictionary(

2113

2347

((c.dbus_object_path, c.GetAll(""))

2114

for c in tcp_server.clients),

2348

for c in tcp_server.clients.itervalues()),

2115

2349

signature="oa{sv}")

2116

2350

2117

2351

@dbus.service.method(_interface, in_signature="o")

2118

2352

def RemoveClient(self, object_path):

2119

2353

"D-Bus method"

2120

for c in tcp_server.clients:

2354

for c in tcp_server.clients.itervalues():

2121

2355

if c.dbus_object_path == object_path:

2122

tcp_server.clients.remove(c)

2356

del tcp_server.clients[c.name]

2123

2357

c.remove_from_connection()

2124

2358

# Don't signal anything except ClientRemoved

2125

2359

c.disable(quiet=True)

2139

2373

service.cleanup()

2140

2374

2141

2375

multiprocessing.active_children()

2376

if not (tcp_server.clients or client_settings):

2377

return

2378

2379

# Store client before exiting. Secrets are encrypted with key

2380

# based on what config file has. If config file is

2381

# removed/edited, old secret will thus be unrecovable.

2382

clients = {}

2383

with PGPEngine() as pgp:

2384

for client in tcp_server.clients.itervalues():

2385

key = client_settings[client.name]["secret"]

2386

client.encrypted_secret = pgp.encrypt(client.secret,

2387

key)

2388

client_dict = {}

2389

2390

# A list of attributes that can not be pickled

2391

# + secret.

2392

exclude = set(("bus", "changedstate", "secret",

2393

"checker"))

2394

for name, typ in (inspect.getmembers

2395

(dbus.service.Object)):

2396

exclude.add(name)

2397

2398

client_dict["encrypted_secret"] = (client

2399

.encrypted_secret)

2400

for attr in client.client_structure:

2401

if attr not in exclude:

2402

client_dict[attr] = getattr(client, attr)

2403

2404

clients[client.name] = client_dict

2405

del client_settings[client.name]["secret"]

2406

2407

try:

2408

with os.fdopen(os.open(stored_state_path,

2409

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2410

0600), "wb") as stored_state:

2411

pickle.dump((clients, client_settings), stored_state)

2412

except (IOError, OSError) as e:

2413

logger.warning("Could not save persistent state: {0}"

2414

.format(e))

2415

if e.errno not in (errno.ENOENT, errno.EACCES):

2416

raise

2417

2418

# Delete all clients, and settings from config

2142

2419

while tcp_server.clients:

2143

client = tcp_server.clients.pop()

2420

name, client = tcp_server.clients.popitem()

2144

2421

if use_dbus:

2145

2422

client.remove_from_connection()

2146

client.disable_hook = None

2147

2423

# Don't signal anything except ClientRemoved

2148

2424

client.disable(quiet=True)

2149

2425

if use_dbus:

2151

2427

mandos_dbus_service.ClientRemoved(client

2152

2428

.dbus_object_path,

2153

2429

client.name)

2430

client_settings.clear()

2154

2431

2155

2432

atexit.register(cleanup)

2156

2433

2157

for client in tcp_server.clients:

2434

for client in tcp_server.clients.itervalues():

2158

2435

if use_dbus:

2159

2436

# Emit D-Bus signal

2160

2437

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2161

client.enable()

2438

# Need to initiate checking of clients

2439

if client.enabled:

2440

client.init_checker()

2162

2441

2163

2442

tcp_server.enable()

2164

2443

tcp_server.server_activate()

2204

2483

# Must run before the D-Bus bus name gets deregistered

2205

2484

cleanup()

2206

2485

2207

2208

2486

if __name__ == '__main__':

2209

2487

main()