To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 505.3.10
- compare with another revision
- download diff
- download tarball
- view history from revision 505.3.10
- Committer: Teddy Hogeborn
- Date: 2011-11-24 20:15:24 UTC
- mto: (505.2.8 mandos-client-network-hooks)
- mto: This revision was merged to the branch mainline in revision 525.
- Revision ID: teddy@recompile.se-20111124201524-5w9ovzpuw3drdlgf
* network-hooks.d: New directory.
* network-hooks.d/bridge: New example hook.
* network-hooks.d/bridge.conf: Config file for bridge example hook.
* network-hooks.d/bridge: New example hook.
* network-hooks.d/bridge.conf: Config file for bridge example hook.
- files removed:
- network-hooks.d/openvpn
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import binascii
67
import tempfile
68
66
69
67
import dbus
70
68
import dbus.service
75
73
import ctypes.util
76
74
import xml.dom.minidom
77
75
import inspect
78
import GnuPGInterface
79
76
80
77
try:
81
78
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
82
except ImportError:
86
83
SO_BINDTODEVICE = None
87
84
88
version = "1.5.2"
89
stored_state_file = "clients.pickle"
90
91
logger = logging.getLogger()
85
86
version = "1.4.1"
87
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
92
90
syslogger = (logging.handlers.SysLogHandler
93
91
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
92
address = str("/dev/log")))
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(debug, level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
if debug:
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet',
146
'--no-use-agent'])
147
148
def __enter__(self):
149
return self
150
151
def __exit__ (self, exc_type, exc_value, traceback):
152
self._cleanup()
153
return False
154
155
def __del__(self):
156
self._cleanup()
157
158
def _cleanup(self):
159
if self.tempdir is not None:
160
# Delete contents of tempdir
161
for root, dirs, files in os.walk(self.tempdir,
162
topdown = False):
163
for filename in files:
164
os.remove(os.path.join(root, filename))
165
for dirname in dirs:
166
os.rmdir(os.path.join(root, dirname))
167
# Remove tempdir
168
os.rmdir(self.tempdir)
169
self.tempdir = None
170
171
def password_encode(self, password):
172
# Passphrase can not be empty and can not contain newlines or
173
# NUL bytes. So we prefix it and hex encode it.
174
return b"mandos" + binascii.hexlify(password)
175
176
def encrypt(self, data, password):
177
self.gnupg.passphrase = self.password_encode(password)
178
with open(os.devnull) as devnull:
179
try:
180
proc = self.gnupg.run(['--symmetric'],
181
create_fhs=['stdin', 'stdout'],
182
attach_fhs={'stderr': devnull})
183
with contextlib.closing(proc.handles['stdin']) as f:
184
f.write(data)
185
with contextlib.closing(proc.handles['stdout']) as f:
186
ciphertext = f.read()
187
proc.wait()
188
except IOError as e:
189
raise PGPError(e)
190
self.gnupg.passphrase = None
191
return ciphertext
192
193
def decrypt(self, data, password):
194
self.gnupg.passphrase = self.password_encode(password)
195
with open(os.devnull) as devnull:
196
try:
197
proc = self.gnupg.run(['--decrypt'],
198
create_fhs=['stdin', 'stdout'],
199
attach_fhs={'stderr': devnull})
200
with contextlib.closing(proc.handles['stdin'] ) as f:
201
f.write(data)
202
with contextlib.closing(proc.handles['stdout']) as f:
203
decrypted_plaintext = f.read()
204
proc.wait()
205
except IOError as e:
206
raise PGPError(e)
207
self.gnupg.passphrase = None
208
return decrypted_plaintext
209
210
93
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
96
logger.addHandler(syslogger)
97
98
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
102
logger.addHandler(console)
211
103
212
104
class AvahiError(Exception):
213
105
def __init__(self, value, *args, **kwargs):
272
164
.GetAlternativeServiceName(self.name))
273
165
logger.info("Changing Zeroconf service name to %r ...",
274
166
self.name)
167
syslogger.setFormatter(logging.Formatter
168
('Mandos (%s) [%%(process)d]:'
169
' %%(levelname)s: %%(message)s'
170
% self.name))
275
171
self.remove()
276
172
try:
277
173
self.add()
297
193
avahi.DBUS_INTERFACE_ENTRY_GROUP)
298
194
self.entry_group_state_changed_match = (
299
195
self.group.connect_to_signal(
300
'StateChanged', self.entry_group_state_changed))
196
'StateChanged', self .entry_group_state_changed))
301
197
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
302
198
self.name, self.type)
303
199
self.group.AddService(
329
225
try:
330
226
self.group.Free()
331
227
except (dbus.exceptions.UnknownMethodException,
332
dbus.exceptions.DBusException):
228
dbus.exceptions.DBusException) as e:
333
229
pass
334
230
self.group = None
335
231
self.remove()
369
265
self.server_state_changed)
370
266
self.server_state_changed(self.server.GetState())
371
267
372
class AvahiServiceToSyslog(AvahiService):
373
def rename(self):
374
"""Add the new name to the syslog messages"""
375
ret = AvahiService.rename(self)
376
syslogger.setFormatter(logging.Formatter
377
('Mandos (%s) [%%(process)d]:'
378
' %%(levelname)s: %%(message)s'
379
% self.name))
380
return ret
381
268
382
def timedelta_to_milliseconds(td):
269
def _timedelta_to_milliseconds(td):
383
270
"Convert a datetime.timedelta() to milliseconds"
384
271
return ((td.days * 24 * 60 * 60 * 1000)
385
272
+ (td.seconds * 1000)
389
276
"""A representation of a client host served by this server.
390
277
391
278
Attributes:
392
approved: bool(); 'None' if not yet approved/disapproved
279
_approved: bool(); 'None' if not yet approved/disapproved
393
280
approval_delay: datetime.timedelta(); Time to wait for approval
394
281
approval_duration: datetime.timedelta(); Duration of one approval
395
282
checker: subprocess.Popen(); a running checker process used
402
289
instance %(name)s can be used in the command.
403
290
checker_initiator_tag: a gobject event source tag, or None
404
291
created: datetime.datetime(); (UTC) object creation
405
client_structure: Object describing what attributes a client has
406
and is used for storing the client at exit
407
292
current_checker_command: string; current running checker_command
293
disable_hook: If set, called by disable() as disable_hook(self)
408
294
disable_initiator_tag: a gobject event source tag, or None
409
295
enabled: bool()
410
296
fingerprint: string (40 or 32 hexadecimal digits); used to
413
299
interval: datetime.timedelta(); How often to start a new checker
414
300
last_approval_request: datetime.datetime(); (UTC) or None
415
301
last_checked_ok: datetime.datetime(); (UTC) or None
416
last_checker_status: integer between 0 and 255 reflecting exit
417
status of last checker. -1 reflects crashed
418
checker, or None.
419
last_enabled: datetime.datetime(); (UTC) or None
302
last_enabled: datetime.datetime(); (UTC)
420
303
name: string; from the config file, used in log messages and
421
304
D-Bus identifiers
422
305
secret: bytestring; sent verbatim (over TLS) to client
423
306
timeout: datetime.timedelta(); How long from last_checked_ok
424
307
until this client is disabled
425
extended_timeout: extra long timeout when secret has been sent
308
extended_timeout: extra long timeout when password has been sent
426
309
runtime_expansions: Allowed attributes for runtime expansion.
427
310
expires: datetime.datetime(); time (UTC) when a client will be
428
311
disabled, or None
432
315
"created", "enabled", "fingerprint",
433
316
"host", "interval", "last_checked_ok",
434
317
"last_enabled", "name", "timeout")
435
client_defaults = { "timeout": "5m",
436
"extended_timeout": "15m",
437
"interval": "2m",
438
"checker": "fping -q -- %%(host)s",
439
"host": "",
440
"approval_delay": "0s",
441
"approval_duration": "1s",
442
"approved_by_default": "True",
443
"enabled": "True",
444
}
445
318
446
319
def timeout_milliseconds(self):
447
320
"Return the 'timeout' attribute in milliseconds"
448
return timedelta_to_milliseconds(self.timeout)
321
return _timedelta_to_milliseconds(self.timeout)
449
322
450
323
def extended_timeout_milliseconds(self):
451
324
"Return the 'extended_timeout' attribute in milliseconds"
452
return timedelta_to_milliseconds(self.extended_timeout)
325
return _timedelta_to_milliseconds(self.extended_timeout)
453
326
454
327
def interval_milliseconds(self):
455
328
"Return the 'interval' attribute in milliseconds"
456
return timedelta_to_milliseconds(self.interval)
329
return _timedelta_to_milliseconds(self.interval)
457
330
458
331
def approval_delay_milliseconds(self):
459
return timedelta_to_milliseconds(self.approval_delay)
460
461
@staticmethod
462
def config_parser(config):
463
"""Construct a new dict of client settings of this form:
464
{ client_name: {setting_name: value, ...}, ...}
465
with exceptions for any special settings as defined above.
466
NOTE: Must be a pure function. Must return the same result
467
value given the same arguments.
468
"""
469
settings = {}
470
for client_name in config.sections():
471
section = dict(config.items(client_name))
472
client = settings[client_name] = {}
473
474
client["host"] = section["host"]
475
# Reformat values from string types to Python types
476
client["approved_by_default"] = config.getboolean(
477
client_name, "approved_by_default")
478
client["enabled"] = config.getboolean(client_name,
479
"enabled")
480
481
client["fingerprint"] = (section["fingerprint"].upper()
482
.replace(" ", ""))
483
if "secret" in section:
484
client["secret"] = section["secret"].decode("base64")
485
elif "secfile" in section:
486
with open(os.path.expanduser(os.path.expandvars
487
(section["secfile"])),
488
"rb") as secfile:
489
client["secret"] = secfile.read()
490
else:
491
raise TypeError("No secret or secfile for section %s"
492
% section)
493
client["timeout"] = string_to_delta(section["timeout"])
494
client["extended_timeout"] = string_to_delta(
495
section["extended_timeout"])
496
client["interval"] = string_to_delta(section["interval"])
497
client["approval_delay"] = string_to_delta(
498
section["approval_delay"])
499
client["approval_duration"] = string_to_delta(
500
section["approval_duration"])
501
client["checker_command"] = section["checker"]
502
client["last_approval_request"] = None
503
client["last_checked_ok"] = None
504
client["last_checker_status"] = None
505
506
return settings
507
508
509
def __init__(self, settings, name = None):
332
return _timedelta_to_milliseconds(self.approval_delay)
333
334
def __init__(self, name = None, disable_hook=None, config=None):
510
335
"""Note: the 'checker' key in 'config' sets the
511
336
'checker_command' attribute and *not* the 'checker'
512
337
attribute."""
513
338
self.name = name
514
# adding all client settings
515
for setting, value in settings.iteritems():
516
setattr(self, setting, value)
517
518
if self.enabled:
519
if not hasattr(self, "last_enabled"):
520
self.last_enabled = datetime.datetime.utcnow()
521
if not hasattr(self, "expires"):
522
self.expires = (datetime.datetime.utcnow()
523
+ self.timeout)
524
else:
525
self.last_enabled = None
526
self.expires = None
527
339
if config is None:
340
config = {}
528
341
logger.debug("Creating client %r", self.name)
529
342
# Uppercase and remove spaces from fingerprint for later
530
343
# comparison purposes with return value from the fingerprint()
531
344
# function
345
self.fingerprint = (config["fingerprint"].upper()
346
.replace(" ", ""))
532
347
logger.debug(" Fingerprint: %s", self.fingerprint)
533
self.created = settings.get("created",
534
datetime.datetime.utcnow())
535
536
# attributes specific for this server instance
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
351
with open(os.path.expanduser(os.path.expandvars
352
(config["secfile"])),
353
"rb") as secfile:
354
self.secret = secfile.read()
355
else:
356
raise TypeError("No secret or secfile for client %s"
357
% self.name)
358
self.host = config.get("host", "")
359
self.created = datetime.datetime.utcnow()
360
self.enabled = False
361
self.last_approval_request = None
362
self.last_enabled = None
363
self.last_checked_ok = None
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
368
self.disable_hook = disable_hook
537
369
self.checker = None
538
370
self.checker_initiator_tag = None
539
371
self.disable_initiator_tag = None
372
self.expires = None
540
373
self.checker_callback_tag = None
374
self.checker_command = config["checker"]
541
375
self.current_checker_command = None
542
self.approved = None
376
self.last_connect = None
377
self._approved = None
378
self.approved_by_default = config.get("approved_by_default",
379
True)
543
380
self.approvals_pending = 0
381
self.approval_delay = string_to_delta(
382
config["approval_delay"])
383
self.approval_duration = string_to_delta(
384
config["approval_duration"])
544
385
self.changedstate = (multiprocessing_manager
545
386
.Condition(multiprocessing_manager
546
387
.Lock()))
547
self.client_structure = [attr for attr in
548
self.__dict__.iterkeys()
549
if not attr.startswith("_")]
550
self.client_structure.append("client_structure")
551
552
for name, t in inspect.getmembers(type(self),
553
lambda obj:
554
isinstance(obj,
555
property)):
556
if not name.startswith("_"):
557
self.client_structure.append(name)
558
388
559
# Send notice to process children that client state has changed
560
389
def send_changedstate(self):
561
with self.changedstate:
562
self.changedstate.notify_all()
390
self.changedstate.acquire()
391
self.changedstate.notify_all()
392
self.changedstate.release()
563
393
564
394
def enable(self):
565
395
"""Start this client's checker and timeout hooks"""
567
397
# Already enabled
568
398
return
569
399
self.send_changedstate()
400
# Schedule a new checker to be started an 'interval' from now,
401
# and every interval from then on.
402
self.checker_initiator_tag = (gobject.timeout_add
403
(self.interval_milliseconds(),
404
self.start_checker))
405
# Schedule a disable() when 'timeout' has passed
570
406
self.expires = datetime.datetime.utcnow() + self.timeout
407
self.disable_initiator_tag = (gobject.timeout_add
408
(self.timeout_milliseconds(),
409
self.disable))
571
410
self.enabled = True
572
411
self.last_enabled = datetime.datetime.utcnow()
573
self.init_checker()
412
# Also start a new checker *right now*.
413
self.start_checker()
574
414
575
415
def disable(self, quiet=True):
576
416
"""Disable this client."""
588
428
gobject.source_remove(self.checker_initiator_tag)
589
429
self.checker_initiator_tag = None
590
430
self.stop_checker()
431
if self.disable_hook:
432
self.disable_hook(self)
591
433
self.enabled = False
592
434
# Do not run this again if called by a gobject.timeout_add
593
435
return False
594
436
595
437
def __del__(self):
438
self.disable_hook = None
596
439
self.disable()
597
440
598
def init_checker(self):
599
# Schedule a new checker to be started an 'interval' from now,
600
# and every interval from then on.
601
self.checker_initiator_tag = (gobject.timeout_add
602
(self.interval_milliseconds(),
603
self.start_checker))
604
# Schedule a disable() when 'timeout' has passed
605
self.disable_initiator_tag = (gobject.timeout_add
606
(self.timeout_milliseconds(),
607
self.disable))
608
# Also start a new checker *right now*.
609
self.start_checker()
610
611
441
def checker_callback(self, pid, condition, command):
612
442
"""The checker has completed, so take appropriate actions."""
613
443
self.checker_callback_tag = None
614
444
self.checker = None
615
445
if os.WIFEXITED(condition):
616
self.last_checker_status = os.WEXITSTATUS(condition)
617
if self.last_checker_status == 0:
446
exitstatus = os.WEXITSTATUS(condition)
447
if exitstatus == 0:
618
448
logger.info("Checker for %(name)s succeeded",
619
449
vars(self))
620
450
self.checked_ok()
622
452
logger.info("Checker for %(name)s failed",
623
453
vars(self))
624
454
else:
625
self.last_checker_status = -1
626
455
logger.warning("Checker for %(name)s crashed?",
627
456
vars(self))
628
457
639
468
gobject.source_remove(self.disable_initiator_tag)
640
469
if getattr(self, "enabled", False):
641
470
self.disable_initiator_tag = (gobject.timeout_add
642
(timedelta_to_milliseconds
471
(_timedelta_to_milliseconds
643
472
(timeout), self.disable))
644
473
self.expires = datetime.datetime.utcnow() + timeout
645
474
850
679
# signatures other than "ay".
851
680
if prop._dbus_signature != "ay":
852
681
raise ValueError
853
value = dbus.ByteArray(b''.join(chr(byte)
854
for byte in value))
682
value = dbus.ByteArray(''.join(unichr(byte)
683
for byte in value))
855
684
prop(value)
856
685
857
686
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
862
691
863
692
Note: Will not include properties with access="write".
864
693
"""
865
properties = {}
694
all = {}
866
695
for name, prop in self._get_all_dbus_properties():
867
696
if (interface_name
868
697
and interface_name != prop._dbus_interface):
873
702
continue
874
703
value = prop()
875
704
if not hasattr(value, "variant_level"):
876
properties[name] = value
705
all[name] = value
877
706
continue
878
properties[name] = type(value)(value, variant_level=
879
value.variant_level+1)
880
return dbus.Dictionary(properties, signature="sv")
707
all[name] = type(value)(value, variant_level=
708
value.variant_level+1)
709
return dbus.Dictionary(all, signature="sv")
881
710
882
711
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
883
712
out_signature="s",
934
763
return dbus.String(dt.isoformat(),
935
764
variant_level=variant_level)
936
765
937
938
766
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
939
767
.__metaclass__):
940
768
"""Applied to an empty subclass of a D-Bus object, this metaclass
1032
860
attribute.func_closure)))
1033
861
return type.__new__(mcs, name, bases, attr)
1034
862
1035
1036
863
class ClientDBus(Client, DBusObjectWithProperties):
1037
864
"""A Client class using D-Bus
1038
865
1047
874
# dbus.service.Object doesn't use super(), so we can't either.
1048
875
1049
876
def __init__(self, bus = None, *args, **kwargs):
877
self._approvals_pending = 0
1050
878
self.bus = bus
1051
879
Client.__init__(self, *args, **kwargs)
1052
880
# Only now, when this client is initialized, can it show up on
1064
892
variant_level=1):
1065
893
""" Modify a variable so that it's a property which announces
1066
894
its changes to DBus.
1067
895
1068
896
transform_fun: Function that takes a value and a variant_level
1069
897
and transforms it to a D-Bus type.
1070
898
dbus_name: D-Bus name of the variable
1104
932
datetime_to_dbus, "LastApprovalRequest")
1105
933
approved_by_default = notifychangeproperty(dbus.Boolean,
1106
934
"ApprovedByDefault")
1107
approval_delay = notifychangeproperty(dbus.UInt64,
935
approval_delay = notifychangeproperty(dbus.UInt16,
1108
936
"ApprovalDelay",
1109
937
type_func =
1110
timedelta_to_milliseconds)
938
_timedelta_to_milliseconds)
1111
939
approval_duration = notifychangeproperty(
1112
dbus.UInt64, "ApprovalDuration",
1113
type_func = timedelta_to_milliseconds)
940
dbus.UInt16, "ApprovalDuration",
941
type_func = _timedelta_to_milliseconds)
1114
942
host = notifychangeproperty(dbus.String, "Host")
1115
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
943
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1116
944
type_func =
1117
timedelta_to_milliseconds)
945
_timedelta_to_milliseconds)
1118
946
extended_timeout = notifychangeproperty(
1119
dbus.UInt64, "ExtendedTimeout",
1120
type_func = timedelta_to_milliseconds)
1121
interval = notifychangeproperty(dbus.UInt64,
947
dbus.UInt16, "ExtendedTimeout",
948
type_func = _timedelta_to_milliseconds)
949
interval = notifychangeproperty(dbus.UInt16,
1122
950
"Interval",
1123
951
type_func =
1124
timedelta_to_milliseconds)
952
_timedelta_to_milliseconds)
1125
953
checker_command = notifychangeproperty(dbus.String, "Checker")
1126
954
1127
955
del notifychangeproperty
1169
997
return r
1170
998
1171
999
def _reset_approved(self):
1172
self.approved = None
1000
self._approved = None
1173
1001
return False
1174
1002
1175
1003
def approve(self, value=True):
1176
1004
self.send_changedstate()
1177
self.approved = value
1178
gobject.timeout_add(timedelta_to_milliseconds
1005
self._approved = value
1006
gobject.timeout_add(_timedelta_to_milliseconds
1179
1007
(self.approval_duration),
1180
1008
self._reset_approved)
1181
1009
1287
1115
access="readwrite")
1288
1116
def ApprovalDuration_dbus_property(self, value=None):
1289
1117
if value is None: # get
1290
return dbus.UInt64(timedelta_to_milliseconds(
1118
return dbus.UInt64(_timedelta_to_milliseconds(
1291
1119
self.approval_duration))
1292
1120
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1293
1121
1307
1135
def Host_dbus_property(self, value=None):
1308
1136
if value is None: # get
1309
1137
return dbus.String(self.host)
1310
self.host = unicode(value)
1138
self.host = value
1311
1139
1312
1140
# Created - property
1313
1141
@dbus_service_property(_interface, signature="s", access="read")
1314
1142
def Created_dbus_property(self):
1315
return datetime_to_dbus(self.created)
1143
return dbus.String(datetime_to_dbus(self.created))
1316
1144
1317
1145
# LastEnabled - property
1318
1146
@dbus_service_property(_interface, signature="s", access="read")
1356
1184
if value is None: # get
1357
1185
return dbus.UInt64(self.timeout_milliseconds())
1358
1186
self.timeout = datetime.timedelta(0, 0, 0, value)
1187
if getattr(self, "disable_initiator_tag", None) is None:
1188
return
1359
1189
# Reschedule timeout
1360
if self.enabled:
1361
now = datetime.datetime.utcnow()
1362
time_to_die = timedelta_to_milliseconds(
1363
(self.last_checked_ok + self.timeout) - now)
1364
if time_to_die <= 0:
1365
# The timeout has passed
1366
self.disable()
1367
else:
1368
self.expires = (now +
1369
datetime.timedelta(milliseconds =
1370
time_to_die))
1371
if (getattr(self, "disable_initiator_tag", None)
1372
is None):
1373
return
1374
gobject.source_remove(self.disable_initiator_tag)
1375
self.disable_initiator_tag = (gobject.timeout_add
1376
(time_to_die,
1377
self.disable))
1190
gobject.source_remove(self.disable_initiator_tag)
1191
self.disable_initiator_tag = None
1192
self.expires = None
1193
time_to_die = _timedelta_to_milliseconds((self
1194
.last_checked_ok
1195
+ self.timeout)
1196
- datetime.datetime
1197
.utcnow())
1198
if time_to_die <= 0:
1199
# The timeout has passed
1200
self.disable()
1201
else:
1202
self.expires = (datetime.datetime.utcnow()
1203
+ datetime.timedelta(milliseconds =
1204
time_to_die))
1205
self.disable_initiator_tag = (gobject.timeout_add
1206
(time_to_die, self.disable))
1378
1207
1379
1208
# ExtendedTimeout - property
1380
1209
@dbus_service_property(_interface, signature="t",
1393
1222
self.interval = datetime.timedelta(0, 0, 0, value)
1394
1223
if getattr(self, "checker_initiator_tag", None) is None:
1395
1224
return
1396
if self.enabled:
1397
# Reschedule checker run
1398
gobject.source_remove(self.checker_initiator_tag)
1399
self.checker_initiator_tag = (gobject.timeout_add
1400
(value, self.start_checker))
1401
self.start_checker() # Start one now, too
1225
# Reschedule checker run
1226
gobject.source_remove(self.checker_initiator_tag)
1227
self.checker_initiator_tag = (gobject.timeout_add
1228
(value, self.start_checker))
1229
self.start_checker() # Start one now, too
1402
1230
1403
1231
# Checker - property
1404
1232
@dbus_service_property(_interface, signature="s",
1406
1234
def Checker_dbus_property(self, value=None):
1407
1235
if value is None: # get
1408
1236
return dbus.String(self.checker_command)
1409
self.checker_command = unicode(value)
1237
self.checker_command = value
1410
1238
1411
1239
# CheckerRunning - property
1412
1240
@dbus_service_property(_interface, signature="b",
1441
1269
raise KeyError()
1442
1270
1443
1271
def __getattribute__(self, name):
1444
if name == '_pipe':
1272
if(name == '_pipe'):
1445
1273
return super(ProxyClient, self).__getattribute__(name)
1446
1274
self._pipe.send(('getattr', name))
1447
1275
data = self._pipe.recv()
1454
1282
return func
1455
1283
1456
1284
def __setattr__(self, name, value):
1457
if name == '_pipe':
1285
if(name == '_pipe'):
1458
1286
return super(ProxyClient, self).__setattr__(name, value)
1459
1287
self._pipe.send(('setattr', name, value))
1460
1288
1461
1462
1289
class ClientDBusTransitional(ClientDBus):
1463
1290
__metaclass__ = AlternateDBusNamesMetaclass
1464
1291
1465
1466
1292
class ClientHandler(socketserver.BaseRequestHandler, object):
1467
1293
"""A class to handle client connections.
1468
1294
1550
1376
client.Rejected("Disabled")
1551
1377
return
1552
1378
1553
if client.approved or not client.approval_delay:
1379
if client._approved or not client.approval_delay:
1554
1380
#We are approved or approval is disabled
1555
1381
break
1556
elif client.approved is None:
1382
elif client._approved is None:
1557
1383
logger.info("Client %s needs approval",
1558
1384
client.name)
1559
1385
if self.server.use_dbus:
1573
1399
time = datetime.datetime.now()
1574
1400
client.changedstate.acquire()
1575
1401
(client.changedstate.wait
1576
(float(client.timedelta_to_milliseconds(delay)
1402
(float(client._timedelta_to_milliseconds(delay)
1577
1403
/ 1000)))
1578
1404
client.changedstate.release()
1579
1405
time2 = datetime.datetime.now()
1678
1504
# Convert the buffer to a Python bytestring
1679
1505
fpr = ctypes.string_at(buf, buf_len.value)
1680
1506
# Convert the bytestring to hexadecimal notation
1681
hex_fpr = binascii.hexlify(fpr).upper()
1507
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1682
1508
return hex_fpr
1683
1509
1684
1510
1687
1513
def sub_process_main(self, request, address):
1688
1514
try:
1689
1515
self.finish_request(request, address)
1690
except Exception:
1516
except:
1691
1517
self.handle_error(request, address)
1692
1518
self.close_request(request)
1693
1519
1798
1624
self.enabled = False
1799
1625
self.clients = clients
1800
1626
if self.clients is None:
1801
self.clients = {}
1627
self.clients = set()
1802
1628
self.use_dbus = use_dbus
1803
1629
self.gnutls_priority = gnutls_priority
1804
1630
IPv6_TCPServer.__init__(self, server_address,
1851
1677
fpr = request[1]
1852
1678
address = request[2]
1853
1679
1854
for c in self.clients.itervalues():
1680
for c in self.clients:
1855
1681
if c.fingerprint == fpr:
1856
1682
client = c
1857
1683
break
1941
1767
return timevalue
1942
1768
1943
1769
1770
def if_nametoindex(interface):
1771
"""Call the C function if_nametoindex(), or equivalent
1772
1773
Note: This function cannot accept a unicode string."""
1774
global if_nametoindex
1775
try:
1776
if_nametoindex = (ctypes.cdll.LoadLibrary
1777
(ctypes.util.find_library("c"))
1778
.if_nametoindex)
1779
except (OSError, AttributeError):
1780
logger.warning("Doing if_nametoindex the hard way")
1781
def if_nametoindex(interface):
1782
"Get an interface index the hard way, i.e. using fcntl()"
1783
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1784
with contextlib.closing(socket.socket()) as s:
1785
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1786
struct.pack(str("16s16x"),
1787
interface))
1788
interface_index = struct.unpack(str("I"),
1789
ifreq[16:20])[0]
1790
return interface_index
1791
return if_nametoindex(interface)
1792
1793
1944
1794
def daemon(nochdir = False, noclose = False):
1945
1795
"""See daemon(3). Standard BSD Unix function.
1946
1796
2001
1851
" system bus interface")
2002
1852
parser.add_argument("--no-ipv6", action="store_false",
2003
1853
dest="use_ipv6", help="Do not use IPv6")
2004
parser.add_argument("--no-restore", action="store_false",
2005
dest="restore", help="Do not restore stored"
2006
" state")
2007
parser.add_argument("--statedir", metavar="DIR",
2008
help="Directory to save/restore state in")
2009
2010
1854
options = parser.parse_args()
2011
1855
2012
1856
if options.check:
2025
1869
"use_dbus": "True",
2026
1870
"use_ipv6": "True",
2027
1871
"debuglevel": "",
2028
"restore": "True",
2029
"statedir": "/var/lib/mandos"
2030
1872
}
2031
1873
2032
1874
# Parse config file for server-global settings
2049
1891
# options, if set.
2050
1892
for option in ("interface", "address", "port", "debug",
2051
1893
"priority", "servicename", "configdir",
2052
"use_dbus", "use_ipv6", "debuglevel", "restore",
2053
"statedir"):
1894
"use_dbus", "use_ipv6", "debuglevel"):
2054
1895
value = getattr(options, option)
2055
1896
if value is not None:
2056
1897
server_settings[option] = value
2068
1909
debuglevel = server_settings["debuglevel"]
2069
1910
use_dbus = server_settings["use_dbus"]
2070
1911
use_ipv6 = server_settings["use_ipv6"]
2071
stored_state_path = os.path.join(server_settings["statedir"],
2072
stored_state_file)
2073
2074
if debug:
2075
initlogger(debug, logging.DEBUG)
2076
else:
2077
if not debuglevel:
2078
initlogger(debug)
2079
else:
2080
level = getattr(logging, debuglevel.upper())
2081
initlogger(debug, level)
2082
1912
2083
1913
if server_settings["servicename"] != "Mandos":
2084
1914
syslogger.setFormatter(logging.Formatter
2087
1917
% server_settings["servicename"]))
2088
1918
2089
1919
# Parse config file with clients
2090
client_config = configparser.SafeConfigParser(Client
2091
.client_defaults)
1920
client_defaults = { "timeout": "5m",
1921
"extended_timeout": "15m",
1922
"interval": "2m",
1923
"checker": "fping -q -- %%(host)s",
1924
"host": "",
1925
"approval_delay": "0s",
1926
"approval_duration": "1s",
1927
}
1928
client_config = configparser.SafeConfigParser(client_defaults)
2092
1929
client_config.read(os.path.join(server_settings["configdir"],
2093
1930
"clients.conf"))
2094
1931
2132
1969
if error[0] != errno.EPERM:
2133
1970
raise error
2134
1971
1972
if not debug and not debuglevel:
1973
syslogger.setLevel(logging.WARNING)
1974
console.setLevel(logging.WARNING)
1975
if debuglevel:
1976
level = getattr(logging, debuglevel.upper())
1977
syslogger.setLevel(level)
1978
console.setLevel(level)
1979
2135
1980
if debug:
2136
1981
# Enable all possible GnuTLS debugging
2137
1982
2151
1996
os.dup2(null, sys.stdin.fileno())
2152
1997
if null > 2:
2153
1998
os.close(null)
1999
else:
2000
# No console logging
2001
logger.removeHandler(console)
2154
2002
2155
2003
# Need to fork before connecting to D-Bus
2156
2004
if not debug:
2157
2005
# Close all input and output, do double fork, etc.
2158
2006
daemon()
2159
2007
2160
gobject.threads_init()
2161
2162
2008
global main_loop
2163
2009
# From the Avahi example code
2164
2010
DBusGMainLoop(set_as_default=True )
2178
2024
server_settings["use_dbus"] = False
2179
2025
tcp_server.use_dbus = False
2180
2026
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2181
service = AvahiServiceToSyslog(name =
2182
server_settings["servicename"],
2183
servicetype = "_mandos._tcp",
2184
protocol = protocol, bus = bus)
2027
service = AvahiService(name = server_settings["servicename"],
2028
servicetype = "_mandos._tcp",
2029
protocol = protocol, bus = bus)
2185
2030
if server_settings["interface"]:
2186
2031
service.interface = (if_nametoindex
2187
2032
(str(server_settings["interface"])))
2193
2038
if use_dbus:
2194
2039
client_class = functools.partial(ClientDBusTransitional,
2195
2040
bus = bus)
2196
2197
client_settings = Client.config_parser(client_config)
2198
old_client_settings = {}
2199
clients_data = {}
2200
2201
# Get client data and settings from last running state.
2202
if server_settings["restore"]:
2203
try:
2204
with open(stored_state_path, "rb") as stored_state:
2205
clients_data, old_client_settings = (pickle.load
2206
(stored_state))
2207
os.remove(stored_state_path)
2208
except IOError as e:
2209
logger.warning("Could not load persistent state: {0}"
2210
.format(e))
2211
if e.errno != errno.ENOENT:
2212
raise
2213
except EOFError as e:
2214
logger.warning("Could not load persistent state: "
2215
"EOFError: {0}".format(e))
2216
2217
with PGPEngine() as pgp:
2218
for client_name, client in clients_data.iteritems():
2219
# Decide which value to use after restoring saved state.
2220
# We have three different values: Old config file,
2221
# new config file, and saved state.
2222
# New config value takes precedence if it differs from old
2223
# config value, otherwise use saved state.
2224
for name, value in client_settings[client_name].items():
2225
try:
2226
# For each value in new config, check if it
2227
# differs from the old config value (Except for
2228
# the "secret" attribute)
2229
if (name != "secret" and
2230
value != old_client_settings[client_name]
2231
[name]):
2232
client[name] = value
2233
except KeyError:
2234
pass
2235
2236
# Clients who has passed its expire date can still be
2237
# enabled if its last checker was successful. Clients
2238
# whose checker succeeded before we stored its state is
2239
# assumed to have successfully run all checkers during
2240
# downtime.
2241
if client["enabled"]:
2242
if datetime.datetime.utcnow() >= client["expires"]:
2243
if not client["last_checked_ok"]:
2244
logger.warning(
2245
"disabling client {0} - Client never "
2246
"performed a successful checker"
2247
.format(client_name))
2248
client["enabled"] = False
2249
elif client["last_checker_status"] != 0:
2250
logger.warning(
2251
"disabling client {0} - Client "
2252
"last checker failed with error code {1}"
2253
.format(client_name,
2254
client["last_checker_status"]))
2255
client["enabled"] = False
2256
else:
2257
client["expires"] = (datetime.datetime
2258
.utcnow()
2259
+ client["timeout"])
2260
logger.debug("Last checker succeeded,"
2261
" keeping {0} enabled"
2262
.format(client_name))
2041
def client_config_items(config, section):
2042
special_settings = {
2043
"approved_by_default":
2044
lambda: config.getboolean(section,
2045
"approved_by_default"),
2046
}
2047
for name, value in config.items(section):
2263
2048
try:
2264
client["secret"] = (
2265
pgp.decrypt(client["encrypted_secret"],
2266
client_settings[client_name]
2267
["secret"]))
2268
except PGPError:
2269
# If decryption fails, we use secret from new settings
2270
logger.debug("Failed to decrypt {0} old secret"
2271
.format(client_name))
2272
client["secret"] = (
2273
client_settings[client_name]["secret"])
2274
2275
2276
# Add/remove clients based on new changes made to config
2277
for client_name in (set(old_client_settings)
2278
- set(client_settings)):
2279
del clients_data[client_name]
2280
for client_name in (set(client_settings)
2281
- set(old_client_settings)):
2282
clients_data[client_name] = client_settings[client_name]
2283
2284
# Create all client objects
2285
for client_name, client in clients_data.iteritems():
2286
tcp_server.clients[client_name] = client_class(
2287
name = client_name, settings = client)
2288
2049
yield (name, special_settings[name]())
2050
except KeyError:
2051
yield (name, value)
2052
2053
tcp_server.clients.update(set(
2054
client_class(name = section,
2055
config= dict(client_config_items(
2056
client_config, section)))
2057
for section in client_config.sections()))
2289
2058
if not tcp_server.clients:
2290
2059
logger.warning("No clients defined")
2291
2060
2302
2071
# "pidfile" was never created
2303
2072
pass
2304
2073
del pidfilename
2074
2305
2075
signal.signal(signal.SIGINT, signal.SIG_IGN)
2306
2076
2307
2077
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2333
2103
def GetAllClients(self):
2334
2104
"D-Bus method"
2335
2105
return dbus.Array(c.dbus_object_path
2336
for c in
2337
tcp_server.clients.itervalues())
2106
for c in tcp_server.clients)
2338
2107
2339
2108
@dbus.service.method(_interface,
2340
2109
out_signature="a{oa{sv}}")
2342
2111
"D-Bus method"
2343
2112
return dbus.Dictionary(
2344
2113
((c.dbus_object_path, c.GetAll(""))
2345
for c in tcp_server.clients.itervalues()),
2114
for c in tcp_server.clients),
2346
2115
signature="oa{sv}")
2347
2116
2348
2117
@dbus.service.method(_interface, in_signature="o")
2349
2118
def RemoveClient(self, object_path):
2350
2119
"D-Bus method"
2351
for c in tcp_server.clients.itervalues():
2120
for c in tcp_server.clients:
2352
2121
if c.dbus_object_path == object_path:
2353
del tcp_server.clients[c.name]
2122
tcp_server.clients.remove(c)
2354
2123
c.remove_from_connection()
2355
2124
# Don't signal anything except ClientRemoved
2356
2125
c.disable(quiet=True)
2370
2139
service.cleanup()
2371
2140
2372
2141
multiprocessing.active_children()
2373
if not (tcp_server.clients or client_settings):
2374
return
2375
2376
# Store client before exiting. Secrets are encrypted with key
2377
# based on what config file has. If config file is
2378
# removed/edited, old secret will thus be unrecovable.
2379
clients = {}
2380
with PGPEngine() as pgp:
2381
for client in tcp_server.clients.itervalues():
2382
key = client_settings[client.name]["secret"]
2383
client.encrypted_secret = pgp.encrypt(client.secret,
2384
key)
2385
client_dict = {}
2386
2387
# A list of attributes that can not be pickled
2388
# + secret.
2389
exclude = set(("bus", "changedstate", "secret",
2390
"checker"))
2391
for name, typ in (inspect.getmembers
2392
(dbus.service.Object)):
2393
exclude.add(name)
2394
2395
client_dict["encrypted_secret"] = (client
2396
.encrypted_secret)
2397
for attr in client.client_structure:
2398
if attr not in exclude:
2399
client_dict[attr] = getattr(client, attr)
2400
2401
clients[client.name] = client_dict
2402
del client_settings[client.name]["secret"]
2403
2404
try:
2405
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2406
prefix="clients-",
2407
dir=os.path.dirname
2408
(stored_state_path))
2409
with os.fdopen(tempfd, "wb") as stored_state:
2410
pickle.dump((clients, client_settings), stored_state)
2411
os.rename(tempname, stored_state_path)
2412
except (IOError, OSError) as e:
2413
logger.warning("Could not save persistent state: {0}"
2414
.format(e))
2415
if not debug:
2416
try:
2417
os.remove(tempname)
2418
except NameError:
2419
pass
2420
if e.errno not in set((errno.ENOENT, errno.EACCES,
2421
errno.EEXIST)):
2422
raise e
2423
2424
# Delete all clients, and settings from config
2425
2142
while tcp_server.clients:
2426
name, client = tcp_server.clients.popitem()
2143
client = tcp_server.clients.pop()
2427
2144
if use_dbus:
2428
2145
client.remove_from_connection()
2146
client.disable_hook = None
2429
2147
# Don't signal anything except ClientRemoved
2430
2148
client.disable(quiet=True)
2431
2149
if use_dbus:
2433
2151
mandos_dbus_service.ClientRemoved(client
2434
2152
.dbus_object_path,
2435
2153
client.name)
2436
client_settings.clear()
2437
2154
2438
2155
atexit.register(cleanup)
2439
2156
2440
for client in tcp_server.clients.itervalues():
2157
for client in tcp_server.clients:
2441
2158
if use_dbus:
2442
2159
# Emit D-Bus signal
2443
2160
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2444
# Need to initiate checking of clients
2445
if client.enabled:
2446
client.init_checker()
2161
client.enable()
2447
2162
2448
2163
tcp_server.enable()
2449
2164
tcp_server.server_activate()
2489
2204
# Must run before the D-Bus bus name gets deregistered
2490
2205
cleanup()
2491
2206
2207
2492
2208
if __name__ == '__main__':
2493
2209
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0