To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 505.3.10
- compare with another revision
- download diff
- download tarball
- view history from revision 505.3.10
- Committer: Teddy Hogeborn
- Date: 2011-11-24 20:15:24 UTC
- mto: (505.2.8 mandos-client-network-hooks)
- mto: This revision was merged to the branch mainline in revision 525.
- Revision ID: teddy@recompile.se-20111124201524-5w9ovzpuw3drdlgf
* network-hooks.d: New directory.
* network-hooks.d/bridge: New example hook.
* network-hooks.d/bridge.conf: Config file for bridge example hook.
* network-hooks.d/bridge: New example hook.
* network-hooks.d/bridge.conf: Config file for bridge example hook.
- files removed:
- network-hooks.d/openvpn
- files modified:
- DBUS-API
added
removed
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import binascii
67
import tempfile
68
66
69
67
import dbus
70
68
import dbus.service
75
73
import ctypes.util
76
74
import xml.dom.minidom
77
75
import inspect
78
import GnuPGInterface
79
76
80
77
try:
81
78
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
82
except ImportError:
86
83
SO_BINDTODEVICE = None
87
84
85
88
86
version = "1.4.1"
89
stored_state_file = "clients.pickle"
90
87
91
logger = logging.getLogger()
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
92
90
syslogger = (logging.handlers.SysLogHandler
93
91
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
92
address = str("/dev/log")))
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(debug, level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
if debug:
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet',
146
'--no-use-agent'])
147
148
def __enter__(self):
149
return self
150
151
def __exit__ (self, exc_type, exc_value, traceback):
152
self._cleanup()
153
return False
154
155
def __del__(self):
156
self._cleanup()
157
158
def _cleanup(self):
159
if self.tempdir is not None:
160
# Delete contents of tempdir
161
for root, dirs, files in os.walk(self.tempdir,
162
topdown = False):
163
for filename in files:
164
os.remove(os.path.join(root, filename))
165
for dirname in dirs:
166
os.rmdir(os.path.join(root, dirname))
167
# Remove tempdir
168
os.rmdir(self.tempdir)
169
self.tempdir = None
170
171
def password_encode(self, password):
172
# Passphrase can not be empty and can not contain newlines or
173
# NUL bytes. So we prefix it and hex encode it.
174
return b"mandos" + binascii.hexlify(password)
175
176
def encrypt(self, data, password):
177
self.gnupg.passphrase = self.password_encode(password)
178
with open(os.devnull) as devnull:
179
try:
180
proc = self.gnupg.run(['--symmetric'],
181
create_fhs=['stdin', 'stdout'],
182
attach_fhs={'stderr': devnull})
183
with contextlib.closing(proc.handles['stdin']) as f:
184
f.write(data)
185
with contextlib.closing(proc.handles['stdout']) as f:
186
ciphertext = f.read()
187
proc.wait()
188
except IOError as e:
189
raise PGPError(e)
190
self.gnupg.passphrase = None
191
return ciphertext
192
193
def decrypt(self, data, password):
194
self.gnupg.passphrase = self.password_encode(password)
195
with open(os.devnull) as devnull:
196
try:
197
proc = self.gnupg.run(['--decrypt'],
198
create_fhs=['stdin', 'stdout'],
199
attach_fhs={'stderr': devnull})
200
with contextlib.closing(proc.handles['stdin'] ) as f:
201
f.write(data)
202
with contextlib.closing(proc.handles['stdout']) as f:
203
decrypted_plaintext = f.read()
204
proc.wait()
205
except IOError as e:
206
raise PGPError(e)
207
self.gnupg.passphrase = None
208
return decrypted_plaintext
209
210
93
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
96
logger.addHandler(syslogger)
97
98
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
102
logger.addHandler(console)
211
103
212
104
class AvahiError(Exception):
213
105
def __init__(self, value, *args, **kwargs):
272
164
.GetAlternativeServiceName(self.name))
273
165
logger.info("Changing Zeroconf service name to %r ...",
274
166
self.name)
167
syslogger.setFormatter(logging.Formatter
168
('Mandos (%s) [%%(process)d]:'
169
' %%(levelname)s: %%(message)s'
170
% self.name))
275
171
self.remove()
276
172
try:
277
173
self.add()
297
193
avahi.DBUS_INTERFACE_ENTRY_GROUP)
298
194
self.entry_group_state_changed_match = (
299
195
self.group.connect_to_signal(
300
'StateChanged', self.entry_group_state_changed))
196
'StateChanged', self .entry_group_state_changed))
301
197
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
302
198
self.name, self.type)
303
199
self.group.AddService(
329
225
try:
330
226
self.group.Free()
331
227
except (dbus.exceptions.UnknownMethodException,
332
dbus.exceptions.DBusException):
228
dbus.exceptions.DBusException) as e:
333
229
pass
334
230
self.group = None
335
231
self.remove()
369
265
self.server_state_changed)
370
266
self.server_state_changed(self.server.GetState())
371
267
372
class AvahiServiceToSyslog(AvahiService):
373
def rename(self):
374
"""Add the new name to the syslog messages"""
375
ret = AvahiService.rename(self)
376
syslogger.setFormatter(logging.Formatter
377
('Mandos (%s) [%%(process)d]:'
378
' %%(levelname)s: %%(message)s'
379
% self.name))
380
return ret
381
268
382
def timedelta_to_milliseconds(td):
269
def _timedelta_to_milliseconds(td):
383
270
"Convert a datetime.timedelta() to milliseconds"
384
271
return ((td.days * 24 * 60 * 60 * 1000)
385
272
+ (td.seconds * 1000)
389
276
"""A representation of a client host served by this server.
390
277
391
278
Attributes:
392
approved: bool(); 'None' if not yet approved/disapproved
279
_approved: bool(); 'None' if not yet approved/disapproved
393
280
approval_delay: datetime.timedelta(); Time to wait for approval
394
281
approval_duration: datetime.timedelta(); Duration of one approval
395
282
checker: subprocess.Popen(); a running checker process used
402
289
instance %(name)s can be used in the command.
403
290
checker_initiator_tag: a gobject event source tag, or None
404
291
created: datetime.datetime(); (UTC) object creation
405
client_structure: Object describing what attributes a client has
406
and is used for storing the client at exit
407
292
current_checker_command: string; current running checker_command
293
disable_hook: If set, called by disable() as disable_hook(self)
408
294
disable_initiator_tag: a gobject event source tag, or None
409
295
enabled: bool()
410
296
fingerprint: string (40 or 32 hexadecimal digits); used to
413
299
interval: datetime.timedelta(); How often to start a new checker
414
300
last_approval_request: datetime.datetime(); (UTC) or None
415
301
last_checked_ok: datetime.datetime(); (UTC) or None
416
last_checker_status: integer between 0 and 255 reflecting exit
417
status of last checker. -1 reflects crashed
418
checker, or None.
419
last_enabled: datetime.datetime(); (UTC) or None
302
last_enabled: datetime.datetime(); (UTC)
420
303
name: string; from the config file, used in log messages and
421
304
D-Bus identifiers
422
305
secret: bytestring; sent verbatim (over TLS) to client
432
315
"created", "enabled", "fingerprint",
433
316
"host", "interval", "last_checked_ok",
434
317
"last_enabled", "name", "timeout")
435
client_defaults = { "timeout": "5m",
436
"extended_timeout": "15m",
437
"interval": "2m",
438
"checker": "fping -q -- %%(host)s",
439
"host": "",
440
"approval_delay": "0s",
441
"approval_duration": "1s",
442
"approved_by_default": "True",
443
"enabled": "True",
444
}
445
318
446
319
def timeout_milliseconds(self):
447
320
"Return the 'timeout' attribute in milliseconds"
448
return timedelta_to_milliseconds(self.timeout)
321
return _timedelta_to_milliseconds(self.timeout)
449
322
450
323
def extended_timeout_milliseconds(self):
451
324
"Return the 'extended_timeout' attribute in milliseconds"
452
return timedelta_to_milliseconds(self.extended_timeout)
325
return _timedelta_to_milliseconds(self.extended_timeout)
453
326
454
327
def interval_milliseconds(self):
455
328
"Return the 'interval' attribute in milliseconds"
456
return timedelta_to_milliseconds(self.interval)
329
return _timedelta_to_milliseconds(self.interval)
457
330
458
331
def approval_delay_milliseconds(self):
459
return timedelta_to_milliseconds(self.approval_delay)
460
461
@staticmethod
462
def config_parser(config):
463
"""Construct a new dict of client settings of this form:
464
{ client_name: {setting_name: value, ...}, ...}
465
with exceptions for any special settings as defined above.
466
NOTE: Must be a pure function. Must return the same result
467
value given the same arguments.
468
"""
469
settings = {}
470
for client_name in config.sections():
471
section = dict(config.items(client_name))
472
client = settings[client_name] = {}
473
474
client["host"] = section["host"]
475
# Reformat values from string types to Python types
476
client["approved_by_default"] = config.getboolean(
477
client_name, "approved_by_default")
478
client["enabled"] = config.getboolean(client_name, "enabled")
479
480
client["fingerprint"] = (section["fingerprint"].upper()
481
.replace(" ", ""))
482
if "secret" in section:
483
client["secret"] = section["secret"].decode("base64")
484
elif "secfile" in section:
485
with open(os.path.expanduser(os.path.expandvars
486
(section["secfile"])),
487
"rb") as secfile:
488
client["secret"] = secfile.read()
489
else:
490
raise TypeError("No secret or secfile for section %s"
491
% section)
492
client["timeout"] = string_to_delta(section["timeout"])
493
client["extended_timeout"] = string_to_delta(
494
section["extended_timeout"])
495
client["interval"] = string_to_delta(section["interval"])
496
client["approval_delay"] = string_to_delta(
497
section["approval_delay"])
498
client["approval_duration"] = string_to_delta(
499
section["approval_duration"])
500
client["checker_command"] = section["checker"]
501
client["last_approval_request"] = None
502
client["last_checked_ok"] = None
503
client["last_checker_status"] = None
504
505
return settings
506
507
508
def __init__(self, settings, name = None):
332
return _timedelta_to_milliseconds(self.approval_delay)
333
334
def __init__(self, name = None, disable_hook=None, config=None):
509
335
"""Note: the 'checker' key in 'config' sets the
510
336
'checker_command' attribute and *not* the 'checker'
511
337
attribute."""
512
338
self.name = name
513
# adding all client settings
514
for setting, value in settings.iteritems():
515
setattr(self, setting, value)
516
517
if self.enabled:
518
if not hasattr(self, "last_enabled"):
519
self.last_enabled = datetime.datetime.utcnow()
520
if not hasattr(self, "expires"):
521
self.expires = (datetime.datetime.utcnow()
522
+ self.timeout)
523
else:
524
self.last_enabled = None
525
self.expires = None
526
339
if config is None:
340
config = {}
527
341
logger.debug("Creating client %r", self.name)
528
342
# Uppercase and remove spaces from fingerprint for later
529
343
# comparison purposes with return value from the fingerprint()
530
344
# function
345
self.fingerprint = (config["fingerprint"].upper()
346
.replace(" ", ""))
531
347
logger.debug(" Fingerprint: %s", self.fingerprint)
532
self.created = settings.get("created", datetime.datetime.utcnow())
533
534
# attributes specific for this server instance
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
351
with open(os.path.expanduser(os.path.expandvars
352
(config["secfile"])),
353
"rb") as secfile:
354
self.secret = secfile.read()
355
else:
356
raise TypeError("No secret or secfile for client %s"
357
% self.name)
358
self.host = config.get("host", "")
359
self.created = datetime.datetime.utcnow()
360
self.enabled = False
361
self.last_approval_request = None
362
self.last_enabled = None
363
self.last_checked_ok = None
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
368
self.disable_hook = disable_hook
535
369
self.checker = None
536
370
self.checker_initiator_tag = None
537
371
self.disable_initiator_tag = None
372
self.expires = None
538
373
self.checker_callback_tag = None
374
self.checker_command = config["checker"]
539
375
self.current_checker_command = None
540
self.approved = None
376
self.last_connect = None
377
self._approved = None
378
self.approved_by_default = config.get("approved_by_default",
379
True)
541
380
self.approvals_pending = 0
381
self.approval_delay = string_to_delta(
382
config["approval_delay"])
383
self.approval_duration = string_to_delta(
384
config["approval_duration"])
542
385
self.changedstate = (multiprocessing_manager
543
386
.Condition(multiprocessing_manager
544
387
.Lock()))
545
self.client_structure = [attr for attr in
546
self.__dict__.iterkeys()
547
if not attr.startswith("_")]
548
self.client_structure.append("client_structure")
549
550
for name, t in inspect.getmembers(type(self),
551
lambda obj:
552
isinstance(obj,
553
property)):
554
if not name.startswith("_"):
555
self.client_structure.append(name)
556
388
557
# Send notice to process children that client state has changed
558
389
def send_changedstate(self):
559
with self.changedstate:
560
self.changedstate.notify_all()
390
self.changedstate.acquire()
391
self.changedstate.notify_all()
392
self.changedstate.release()
561
393
562
394
def enable(self):
563
395
"""Start this client's checker and timeout hooks"""
565
397
# Already enabled
566
398
return
567
399
self.send_changedstate()
400
# Schedule a new checker to be started an 'interval' from now,
401
# and every interval from then on.
402
self.checker_initiator_tag = (gobject.timeout_add
403
(self.interval_milliseconds(),
404
self.start_checker))
405
# Schedule a disable() when 'timeout' has passed
568
406
self.expires = datetime.datetime.utcnow() + self.timeout
407
self.disable_initiator_tag = (gobject.timeout_add
408
(self.timeout_milliseconds(),
409
self.disable))
569
410
self.enabled = True
570
411
self.last_enabled = datetime.datetime.utcnow()
571
self.init_checker()
412
# Also start a new checker *right now*.
413
self.start_checker()
572
414
573
415
def disable(self, quiet=True):
574
416
"""Disable this client."""
586
428
gobject.source_remove(self.checker_initiator_tag)
587
429
self.checker_initiator_tag = None
588
430
self.stop_checker()
431
if self.disable_hook:
432
self.disable_hook(self)
589
433
self.enabled = False
590
434
# Do not run this again if called by a gobject.timeout_add
591
435
return False
592
436
593
437
def __del__(self):
438
self.disable_hook = None
594
439
self.disable()
595
440
596
def init_checker(self):
597
# Schedule a new checker to be started an 'interval' from now,
598
# and every interval from then on.
599
self.checker_initiator_tag = (gobject.timeout_add
600
(self.interval_milliseconds(),
601
self.start_checker))
602
# Schedule a disable() when 'timeout' has passed
603
self.disable_initiator_tag = (gobject.timeout_add
604
(self.timeout_milliseconds(),
605
self.disable))
606
# Also start a new checker *right now*.
607
self.start_checker()
608
609
441
def checker_callback(self, pid, condition, command):
610
442
"""The checker has completed, so take appropriate actions."""
611
443
self.checker_callback_tag = None
612
444
self.checker = None
613
445
if os.WIFEXITED(condition):
614
self.last_checker_status = os.WEXITSTATUS(condition)
615
if self.last_checker_status == 0:
446
exitstatus = os.WEXITSTATUS(condition)
447
if exitstatus == 0:
616
448
logger.info("Checker for %(name)s succeeded",
617
449
vars(self))
618
450
self.checked_ok()
620
452
logger.info("Checker for %(name)s failed",
621
453
vars(self))
622
454
else:
623
self.last_checker_status = -1
624
455
logger.warning("Checker for %(name)s crashed?",
625
456
vars(self))
626
457
637
468
gobject.source_remove(self.disable_initiator_tag)
638
469
if getattr(self, "enabled", False):
639
470
self.disable_initiator_tag = (gobject.timeout_add
640
(timedelta_to_milliseconds
471
(_timedelta_to_milliseconds
641
472
(timeout), self.disable))
642
473
self.expires = datetime.datetime.utcnow() + timeout
643
474
860
691
861
692
Note: Will not include properties with access="write".
862
693
"""
863
properties = {}
694
all = {}
864
695
for name, prop in self._get_all_dbus_properties():
865
696
if (interface_name
866
697
and interface_name != prop._dbus_interface):
871
702
continue
872
703
value = prop()
873
704
if not hasattr(value, "variant_level"):
874
properties[name] = value
705
all[name] = value
875
706
continue
876
properties[name] = type(value)(value, variant_level=
877
value.variant_level+1)
878
return dbus.Dictionary(properties, signature="sv")
707
all[name] = type(value)(value, variant_level=
708
value.variant_level+1)
709
return dbus.Dictionary(all, signature="sv")
879
710
880
711
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
881
712
out_signature="s",
932
763
return dbus.String(dt.isoformat(),
933
764
variant_level=variant_level)
934
765
935
936
766
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
937
767
.__metaclass__):
938
768
"""Applied to an empty subclass of a D-Bus object, this metaclass
1030
860
attribute.func_closure)))
1031
861
return type.__new__(mcs, name, bases, attr)
1032
862
1033
1034
863
class ClientDBus(Client, DBusObjectWithProperties):
1035
864
"""A Client class using D-Bus
1036
865
1045
874
# dbus.service.Object doesn't use super(), so we can't either.
1046
875
1047
876
def __init__(self, bus = None, *args, **kwargs):
877
self._approvals_pending = 0
1048
878
self.bus = bus
1049
879
Client.__init__(self, *args, **kwargs)
1050
self._approvals_pending = 0
1051
1052
self._approvals_pending = 0
1053
880
# Only now, when this client is initialized, can it show up on
1054
881
# the D-Bus
1055
882
client_object_name = unicode(self.name).translate(
1065
892
variant_level=1):
1066
893
""" Modify a variable so that it's a property which announces
1067
894
its changes to DBus.
1068
895
1069
896
transform_fun: Function that takes a value and a variant_level
1070
897
and transforms it to a D-Bus type.
1071
898
dbus_name: D-Bus name of the variable
1105
932
datetime_to_dbus, "LastApprovalRequest")
1106
933
approved_by_default = notifychangeproperty(dbus.Boolean,
1107
934
"ApprovedByDefault")
1108
approval_delay = notifychangeproperty(dbus.UInt64,
935
approval_delay = notifychangeproperty(dbus.UInt16,
1109
936
"ApprovalDelay",
1110
937
type_func =
1111
timedelta_to_milliseconds)
938
_timedelta_to_milliseconds)
1112
939
approval_duration = notifychangeproperty(
1113
dbus.UInt64, "ApprovalDuration",
1114
type_func = timedelta_to_milliseconds)
940
dbus.UInt16, "ApprovalDuration",
941
type_func = _timedelta_to_milliseconds)
1115
942
host = notifychangeproperty(dbus.String, "Host")
1116
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
943
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1117
944
type_func =
1118
timedelta_to_milliseconds)
945
_timedelta_to_milliseconds)
1119
946
extended_timeout = notifychangeproperty(
1120
dbus.UInt64, "ExtendedTimeout",
1121
type_func = timedelta_to_milliseconds)
1122
interval = notifychangeproperty(dbus.UInt64,
947
dbus.UInt16, "ExtendedTimeout",
948
type_func = _timedelta_to_milliseconds)
949
interval = notifychangeproperty(dbus.UInt16,
1123
950
"Interval",
1124
951
type_func =
1125
timedelta_to_milliseconds)
952
_timedelta_to_milliseconds)
1126
953
checker_command = notifychangeproperty(dbus.String, "Checker")
1127
954
1128
955
del notifychangeproperty
1170
997
return r
1171
998
1172
999
def _reset_approved(self):
1173
self.approved = None
1000
self._approved = None
1174
1001
return False
1175
1002
1176
1003
def approve(self, value=True):
1177
1004
self.send_changedstate()
1178
self.approved = value
1179
gobject.timeout_add(timedelta_to_milliseconds
1005
self._approved = value
1006
gobject.timeout_add(_timedelta_to_milliseconds
1180
1007
(self.approval_duration),
1181
1008
self._reset_approved)
1182
1009
1225
1052
"D-Bus signal"
1226
1053
return self.need_approval()
1227
1054
1228
# NeRwequest - signal
1229
@dbus.service.signal(_interface, signature="s")
1230
def NewRequest(self, ip):
1231
"""D-Bus signal
1232
Is sent after a client request a password.
1233
"""
1234
pass
1235
1236
1055
## Methods
1237
1056
1238
1057
# Approve - method
1296
1115
access="readwrite")
1297
1116
def ApprovalDuration_dbus_property(self, value=None):
1298
1117
if value is None: # get
1299
return dbus.UInt64(timedelta_to_milliseconds(
1118
return dbus.UInt64(_timedelta_to_milliseconds(
1300
1119
self.approval_duration))
1301
1120
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1302
1121
1316
1135
def Host_dbus_property(self, value=None):
1317
1136
if value is None: # get
1318
1137
return dbus.String(self.host)
1319
self.host = unicode(value)
1138
self.host = value
1320
1139
1321
1140
# Created - property
1322
1141
@dbus_service_property(_interface, signature="s", access="read")
1323
1142
def Created_dbus_property(self):
1324
return datetime_to_dbus(self.created)
1143
return dbus.String(datetime_to_dbus(self.created))
1325
1144
1326
1145
# LastEnabled - property
1327
1146
@dbus_service_property(_interface, signature="s", access="read")
1371
1190
gobject.source_remove(self.disable_initiator_tag)
1372
1191
self.disable_initiator_tag = None
1373
1192
self.expires = None
1374
time_to_die = timedelta_to_milliseconds((self
1375
.last_checked_ok
1376
+ self.timeout)
1377
- datetime.datetime
1378
.utcnow())
1193
time_to_die = _timedelta_to_milliseconds((self
1194
.last_checked_ok
1195
+ self.timeout)
1196
- datetime.datetime
1197
.utcnow())
1379
1198
if time_to_die <= 0:
1380
1199
# The timeout has passed
1381
1200
self.disable()
1403
1222
self.interval = datetime.timedelta(0, 0, 0, value)
1404
1223
if getattr(self, "checker_initiator_tag", None) is None:
1405
1224
return
1406
if self.enabled:
1407
# Reschedule checker run
1408
gobject.source_remove(self.checker_initiator_tag)
1409
self.checker_initiator_tag = (gobject.timeout_add
1410
(value, self.start_checker))
1411
self.start_checker() # Start one now, too
1225
# Reschedule checker run
1226
gobject.source_remove(self.checker_initiator_tag)
1227
self.checker_initiator_tag = (gobject.timeout_add
1228
(value, self.start_checker))
1229
self.start_checker() # Start one now, too
1412
1230
1413
1231
# Checker - property
1414
1232
@dbus_service_property(_interface, signature="s",
1416
1234
def Checker_dbus_property(self, value=None):
1417
1235
if value is None: # get
1418
1236
return dbus.String(self.checker_command)
1419
self.checker_command = unicode(value)
1237
self.checker_command = value
1420
1238
1421
1239
# CheckerRunning - property
1422
1240
@dbus_service_property(_interface, signature="b",
1451
1269
raise KeyError()
1452
1270
1453
1271
def __getattribute__(self, name):
1454
if name == '_pipe':
1272
if(name == '_pipe'):
1455
1273
return super(ProxyClient, self).__getattribute__(name)
1456
1274
self._pipe.send(('getattr', name))
1457
1275
data = self._pipe.recv()
1464
1282
return func
1465
1283
1466
1284
def __setattr__(self, name, value):
1467
if name == '_pipe':
1285
if(name == '_pipe'):
1468
1286
return super(ProxyClient, self).__setattr__(name, value)
1469
1287
self._pipe.send(('setattr', name, value))
1470
1288
1471
1472
1289
class ClientDBusTransitional(ClientDBus):
1473
1290
__metaclass__ = AlternateDBusNamesMetaclass
1474
1291
1475
1476
1292
class ClientHandler(socketserver.BaseRequestHandler, object):
1477
1293
"""A class to handle client connections.
1478
1294
1546
1362
except KeyError:
1547
1363
return
1548
1364
1549
if self.server.use_dbus:
1550
# Emit D-Bus signal
1551
client.NewRequest(str(self.client_address))
1552
1553
1365
if client.approval_delay:
1554
1366
delay = client.approval_delay
1555
1367
client.approvals_pending += 1
1564
1376
client.Rejected("Disabled")
1565
1377
return
1566
1378
1567
if client.approved or not client.approval_delay:
1379
if client._approved or not client.approval_delay:
1568
1380
#We are approved or approval is disabled
1569
1381
break
1570
elif client.approved is None:
1382
elif client._approved is None:
1571
1383
logger.info("Client %s needs approval",
1572
1384
client.name)
1573
1385
if self.server.use_dbus:
1587
1399
time = datetime.datetime.now()
1588
1400
client.changedstate.acquire()
1589
1401
(client.changedstate.wait
1590
(float(client.timedelta_to_milliseconds(delay)
1402
(float(client._timedelta_to_milliseconds(delay)
1591
1403
/ 1000)))
1592
1404
client.changedstate.release()
1593
1405
time2 = datetime.datetime.now()
1692
1504
# Convert the buffer to a Python bytestring
1693
1505
fpr = ctypes.string_at(buf, buf_len.value)
1694
1506
# Convert the bytestring to hexadecimal notation
1695
hex_fpr = binascii.hexlify(fpr).upper()
1507
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1696
1508
return hex_fpr
1697
1509
1698
1510
1701
1513
def sub_process_main(self, request, address):
1702
1514
try:
1703
1515
self.finish_request(request, address)
1704
except Exception:
1516
except:
1705
1517
self.handle_error(request, address)
1706
1518
self.close_request(request)
1707
1519
1812
1624
self.enabled = False
1813
1625
self.clients = clients
1814
1626
if self.clients is None:
1815
self.clients = {}
1627
self.clients = set()
1816
1628
self.use_dbus = use_dbus
1817
1629
self.gnutls_priority = gnutls_priority
1818
1630
IPv6_TCPServer.__init__(self, server_address,
1865
1677
fpr = request[1]
1866
1678
address = request[2]
1867
1679
1868
for c in self.clients.itervalues():
1680
for c in self.clients:
1869
1681
if c.fingerprint == fpr:
1870
1682
client = c
1871
1683
break
1955
1767
return timevalue
1956
1768
1957
1769
1770
def if_nametoindex(interface):
1771
"""Call the C function if_nametoindex(), or equivalent
1772
1773
Note: This function cannot accept a unicode string."""
1774
global if_nametoindex
1775
try:
1776
if_nametoindex = (ctypes.cdll.LoadLibrary
1777
(ctypes.util.find_library("c"))
1778
.if_nametoindex)
1779
except (OSError, AttributeError):
1780
logger.warning("Doing if_nametoindex the hard way")
1781
def if_nametoindex(interface):
1782
"Get an interface index the hard way, i.e. using fcntl()"
1783
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1784
with contextlib.closing(socket.socket()) as s:
1785
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1786
struct.pack(str("16s16x"),
1787
interface))
1788
interface_index = struct.unpack(str("I"),
1789
ifreq[16:20])[0]
1790
return interface_index
1791
return if_nametoindex(interface)
1792
1793
1958
1794
def daemon(nochdir = False, noclose = False):
1959
1795
"""See daemon(3). Standard BSD Unix function.
1960
1796
2015
1851
" system bus interface")
2016
1852
parser.add_argument("--no-ipv6", action="store_false",
2017
1853
dest="use_ipv6", help="Do not use IPv6")
2018
parser.add_argument("--no-restore", action="store_false",
2019
dest="restore", help="Do not restore stored"
2020
" state")
2021
parser.add_argument("--statedir", metavar="DIR",
2022
help="Directory to save/restore state in")
2023
2024
1854
options = parser.parse_args()
2025
1855
2026
1856
if options.check:
2039
1869
"use_dbus": "True",
2040
1870
"use_ipv6": "True",
2041
1871
"debuglevel": "",
2042
"restore": "True",
2043
"statedir": "/var/lib/mandos"
2044
1872
}
2045
1873
2046
1874
# Parse config file for server-global settings
2063
1891
# options, if set.
2064
1892
for option in ("interface", "address", "port", "debug",
2065
1893
"priority", "servicename", "configdir",
2066
"use_dbus", "use_ipv6", "debuglevel", "restore",
2067
"statedir"):
1894
"use_dbus", "use_ipv6", "debuglevel"):
2068
1895
value = getattr(options, option)
2069
1896
if value is not None:
2070
1897
server_settings[option] = value
2082
1909
debuglevel = server_settings["debuglevel"]
2083
1910
use_dbus = server_settings["use_dbus"]
2084
1911
use_ipv6 = server_settings["use_ipv6"]
2085
stored_state_path = os.path.join(server_settings["statedir"],
2086
stored_state_file)
2087
2088
if debug:
2089
initlogger(debug, logging.DEBUG)
2090
else:
2091
if not debuglevel:
2092
initlogger(debug)
2093
else:
2094
level = getattr(logging, debuglevel.upper())
2095
initlogger(debug, level)
2096
1912
2097
1913
if server_settings["servicename"] != "Mandos":
2098
1914
syslogger.setFormatter(logging.Formatter
2101
1917
% server_settings["servicename"]))
2102
1918
2103
1919
# Parse config file with clients
2104
client_config = configparser.SafeConfigParser(Client.client_defaults)
1920
client_defaults = { "timeout": "5m",
1921
"extended_timeout": "15m",
1922
"interval": "2m",
1923
"checker": "fping -q -- %%(host)s",
1924
"host": "",
1925
"approval_delay": "0s",
1926
"approval_duration": "1s",
1927
}
1928
client_config = configparser.SafeConfigParser(client_defaults)
2105
1929
client_config.read(os.path.join(server_settings["configdir"],
2106
1930
"clients.conf"))
2107
1931
2145
1969
if error[0] != errno.EPERM:
2146
1970
raise error
2147
1971
1972
if not debug and not debuglevel:
1973
syslogger.setLevel(logging.WARNING)
1974
console.setLevel(logging.WARNING)
1975
if debuglevel:
1976
level = getattr(logging, debuglevel.upper())
1977
syslogger.setLevel(level)
1978
console.setLevel(level)
1979
2148
1980
if debug:
2149
1981
# Enable all possible GnuTLS debugging
2150
1982
2164
1996
os.dup2(null, sys.stdin.fileno())
2165
1997
if null > 2:
2166
1998
os.close(null)
1999
else:
2000
# No console logging
2001
logger.removeHandler(console)
2167
2002
2168
2003
# Need to fork before connecting to D-Bus
2169
2004
if not debug:
2170
2005
# Close all input and output, do double fork, etc.
2171
2006
daemon()
2172
2007
2173
gobject.threads_init()
2174
2175
2008
global main_loop
2176
2009
# From the Avahi example code
2177
2010
DBusGMainLoop(set_as_default=True )
2191
2024
server_settings["use_dbus"] = False
2192
2025
tcp_server.use_dbus = False
2193
2026
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2194
service = AvahiServiceToSyslog(name =
2195
server_settings["servicename"],
2196
servicetype = "_mandos._tcp",
2197
protocol = protocol, bus = bus)
2027
service = AvahiService(name = server_settings["servicename"],
2028
servicetype = "_mandos._tcp",
2029
protocol = protocol, bus = bus)
2198
2030
if server_settings["interface"]:
2199
2031
service.interface = (if_nametoindex
2200
2032
(str(server_settings["interface"])))
2206
2038
if use_dbus:
2207
2039
client_class = functools.partial(ClientDBusTransitional,
2208
2040
bus = bus)
2209
2210
client_settings = Client.config_parser(client_config)
2211
old_client_settings = {}
2212
clients_data = {}
2213
2214
# Get client data and settings from last running state.
2215
if server_settings["restore"]:
2216
try:
2217
with open(stored_state_path, "rb") as stored_state:
2218
clients_data, old_client_settings = (pickle.load
2219
(stored_state))
2220
os.remove(stored_state_path)
2221
except IOError as e:
2222
logger.warning("Could not load persistent state: {0}"
2223
.format(e))
2224
if e.errno != errno.ENOENT:
2225
raise
2226
except EOFError as e:
2227
logger.warning("Could not load persistent state: "
2228
"EOFError: {0}".format(e))
2229
2230
with PGPEngine() as pgp:
2231
for client_name, client in clients_data.iteritems():
2232
# Decide which value to use after restoring saved state.
2233
# We have three different values: Old config file,
2234
# new config file, and saved state.
2235
# New config value takes precedence if it differs from old
2236
# config value, otherwise use saved state.
2237
for name, value in client_settings[client_name].items():
2238
try:
2239
# For each value in new config, check if it
2240
# differs from the old config value (Except for
2241
# the "secret" attribute)
2242
if (name != "secret" and
2243
value != old_client_settings[client_name]
2244
[name]):
2245
client[name] = value
2246
except KeyError:
2247
pass
2248
2249
# Clients who has passed its expire date can still be
2250
# enabled if its last checker was successful. Clients
2251
# whose checker failed before we stored its state is
2252
# assumed to have failed all checkers during downtime.
2253
if client["enabled"]:
2254
if datetime.datetime.utcnow() >= client["expires"]:
2255
if not client["last_checked_ok"]:
2256
logger.warning(
2257
"disabling client {0} - Client never "
2258
"performed a successfull checker"
2259
.format(client["name"]))
2260
client["enabled"] = False
2261
elif client["last_checker_status"] != 0:
2262
logger.warning(
2263
"disabling client {0} - Client "
2264
"last checker failed with error code {1}"
2265
.format(client["name"],
2266
client["last_checker_status"]))
2267
client["enabled"] = False
2268
else:
2269
client["expires"] = (datetime.datetime
2270
.utcnow()
2271
+ client["timeout"])
2272
logger.debug("Last checker succeeded,"
2273
" keeping {0} enabled"
2274
.format(client["name"]))
2041
def client_config_items(config, section):
2042
special_settings = {
2043
"approved_by_default":
2044
lambda: config.getboolean(section,
2045
"approved_by_default"),
2046
}
2047
for name, value in config.items(section):
2275
2048
try:
2276
client["secret"] = (
2277
pgp.decrypt(client["encrypted_secret"],
2278
client_settings[client_name]
2279
["secret"]))
2280
except PGPError:
2281
# If decryption fails, we use secret from new settings
2282
logger.debug("Failed to decrypt {0} old secret"
2283
.format(client_name))
2284
client["secret"] = (
2285
client_settings[client_name]["secret"])
2286
2287
2288
# Add/remove clients based on new changes made to config
2289
for client_name in set(old_client_settings) - set(client_settings):
2290
del clients_data[client_name]
2291
for client_name in set(client_settings) - set(old_client_settings):
2292
clients_data[client_name] = client_settings[client_name]
2293
2294
# Create clients all clients
2295
for client_name, client in clients_data.iteritems():
2296
tcp_server.clients[client_name] = client_class(
2297
name = client_name, settings = client)
2298
2049
yield (name, special_settings[name]())
2050
except KeyError:
2051
yield (name, value)
2052
2053
tcp_server.clients.update(set(
2054
client_class(name = section,
2055
config= dict(client_config_items(
2056
client_config, section)))
2057
for section in client_config.sections()))
2299
2058
if not tcp_server.clients:
2300
2059
logger.warning("No clients defined")
2301
2060
2312
2071
# "pidfile" was never created
2313
2072
pass
2314
2073
del pidfilename
2074
2315
2075
signal.signal(signal.SIGINT, signal.SIG_IGN)
2316
2076
2317
2077
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2343
2103
def GetAllClients(self):
2344
2104
"D-Bus method"
2345
2105
return dbus.Array(c.dbus_object_path
2346
for c in
2347
tcp_server.clients.itervalues())
2106
for c in tcp_server.clients)
2348
2107
2349
2108
@dbus.service.method(_interface,
2350
2109
out_signature="a{oa{sv}}")
2352
2111
"D-Bus method"
2353
2112
return dbus.Dictionary(
2354
2113
((c.dbus_object_path, c.GetAll(""))
2355
for c in tcp_server.clients.itervalues()),
2114
for c in tcp_server.clients),
2356
2115
signature="oa{sv}")
2357
2116
2358
2117
@dbus.service.method(_interface, in_signature="o")
2359
2118
def RemoveClient(self, object_path):
2360
2119
"D-Bus method"
2361
for c in tcp_server.clients.itervalues():
2120
for c in tcp_server.clients:
2362
2121
if c.dbus_object_path == object_path:
2363
del tcp_server.clients[c.name]
2122
tcp_server.clients.remove(c)
2364
2123
c.remove_from_connection()
2365
2124
# Don't signal anything except ClientRemoved
2366
2125
c.disable(quiet=True)
2380
2139
service.cleanup()
2381
2140
2382
2141
multiprocessing.active_children()
2383
if not (tcp_server.clients or client_settings):
2384
return
2385
2386
# Store client before exiting. Secrets are encrypted with key
2387
# based on what config file has. If config file is
2388
# removed/edited, old secret will thus be unrecovable.
2389
clients = {}
2390
with PGPEngine() as pgp:
2391
for client in tcp_server.clients.itervalues():
2392
key = client_settings[client.name]["secret"]
2393
client.encrypted_secret = pgp.encrypt(client.secret,
2394
key)
2395
client_dict = {}
2396
2397
# A list of attributes that can not be pickled
2398
# + secret.
2399
exclude = set(("bus", "changedstate", "secret",
2400
"checker"))
2401
for name, typ in (inspect.getmembers
2402
(dbus.service.Object)):
2403
exclude.add(name)
2404
2405
client_dict["encrypted_secret"] = (client
2406
.encrypted_secret)
2407
for attr in client.client_structure:
2408
if attr not in exclude:
2409
client_dict[attr] = getattr(client, attr)
2410
2411
clients[client.name] = client_dict
2412
del client_settings[client.name]["secret"]
2413
2414
try:
2415
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2416
prefix="clients-",
2417
dir=os.path.dirname
2418
(stored_state_path))
2419
with os.fdopen(tempfd, "wb") as stored_state:
2420
pickle.dump((clients, client_settings), stored_state)
2421
os.rename(tempname, stored_state_path)
2422
except (IOError, OSError) as e:
2423
logger.warning("Could not save persistent state: {0}"
2424
.format(e))
2425
if not debug:
2426
try:
2427
os.remove(tempname)
2428
except NameError:
2429
pass
2430
if e.errno not in set((errno.ENOENT, errno.EACCES,
2431
errno.EEXIST)):
2432
raise e
2433
2434
# Delete all clients, and settings from config
2435
2142
while tcp_server.clients:
2436
name, client = tcp_server.clients.popitem()
2143
client = tcp_server.clients.pop()
2437
2144
if use_dbus:
2438
2145
client.remove_from_connection()
2146
client.disable_hook = None
2439
2147
# Don't signal anything except ClientRemoved
2440
2148
client.disable(quiet=True)
2441
2149
if use_dbus:
2443
2151
mandos_dbus_service.ClientRemoved(client
2444
2152
.dbus_object_path,
2445
2153
client.name)
2446
client_settings.clear()
2447
2154
2448
2155
atexit.register(cleanup)
2449
2156
2450
for client in tcp_server.clients.itervalues():
2157
for client in tcp_server.clients:
2451
2158
if use_dbus:
2452
2159
# Emit D-Bus signal
2453
2160
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2454
# Need to initiate checking of clients
2455
if client.enabled:
2456
client.init_checker()
2161
client.enable()
2457
2162
2458
2163
tcp_server.enable()
2459
2164
tcp_server.server_activate()
2499
2204
# Must run before the D-Bus bus name gets deregistered
2500
2205
cleanup()
2501
2206
2207
2502
2208
if __name__ == '__main__':
2503
2209
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0