To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 506
- compare with another revision
- download diff
- download tarball
- view history from revision 506
- Committer: Teddy Hogeborn
- Date: 2011-10-03 16:17:11 UTC
- mfrom: (505.1.1 teddy)
- Revision ID: teddy@recompile.se-20111003161711-q9bjy1hlov9xanxh
Some cleanup
- files removed:
- debian/source/local-options
- files modified:
- Makefile
added
removed
mandos
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import hashlib
67
66
68
67
import dbus
69
68
import dbus.service
74
73
import ctypes.util
75
74
import xml.dom.minidom
76
75
import inspect
77
import Crypto.Cipher.AES
78
76
79
77
try:
80
78
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
83
SO_BINDTODEVICE = None
86
84
87
85
88
version = "1.4.1"
89
90
logger = logging.getLogger()
91
stored_state_path = "/var/lib/mandos/clients.pickle"
92
86
version = "1.3.1"
87
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
93
90
syslogger = (logging.handlers.SysLogHandler
94
91
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
95
92
address = str("/dev/log")))
99
96
logger.addHandler(syslogger)
100
97
101
98
console = logging.StreamHandler()
102
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
103
' [%(process)d]:'
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
104
100
' %(levelname)s:'
105
101
' %(message)s'))
106
102
logger.addHandler(console)
107
103
108
109
104
class AvahiError(Exception):
110
105
def __init__(self, value, *args, **kwargs):
111
106
self.value = value
165
160
" after %i retries, exiting.",
166
161
self.rename_count)
167
162
raise AvahiServiceError("Too many renames")
168
self.name = unicode(self.server
169
.GetAlternativeServiceName(self.name))
163
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
170
164
logger.info("Changing Zeroconf service name to %r ...",
171
165
self.name)
166
syslogger.setFormatter(logging.Formatter
167
('Mandos (%s) [%%(process)d]:'
168
' %%(levelname)s: %%(message)s'
169
% self.name))
172
170
self.remove()
173
171
try:
174
172
self.add()
194
192
avahi.DBUS_INTERFACE_ENTRY_GROUP)
195
193
self.entry_group_state_changed_match = (
196
194
self.group.connect_to_signal(
197
'StateChanged', self.entry_group_state_changed))
195
'StateChanged', self .entry_group_state_changed))
198
196
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
199
197
self.name, self.type)
200
198
self.group.AddService(
266
264
self.server_state_changed)
267
265
self.server_state_changed(self.server.GetState())
268
266
269
class AvahiServiceToSyslog(AvahiService):
270
def rename(self):
271
"""Add the new name to the syslog messages"""
272
ret = AvahiService.rename(self)
273
syslogger.setFormatter(logging.Formatter
274
('Mandos (%s) [%%(process)d]:'
275
' %%(levelname)s: %%(message)s'
276
% self.name))
277
return ret
278
267
279
268
def _timedelta_to_milliseconds(td):
280
269
"Convert a datetime.timedelta() to milliseconds"
299
288
instance %(name)s can be used in the command.
300
289
checker_initiator_tag: a gobject event source tag, or None
301
290
created: datetime.datetime(); (UTC) object creation
302
client_structure: Object describing what attributes a client has
303
and is used for storing the client at exit
304
291
current_checker_command: string; current running checker_command
292
disable_hook: If set, called by disable() as disable_hook(self)
305
293
disable_initiator_tag: a gobject event source tag, or None
306
294
enabled: bool()
307
295
fingerprint: string (40 or 32 hexadecimal digits); used to
310
298
interval: datetime.timedelta(); How often to start a new checker
311
299
last_approval_request: datetime.datetime(); (UTC) or None
312
300
last_checked_ok: datetime.datetime(); (UTC) or None
313
last_checker_status: integer between 0 and 255 reflecting exit
314
status of last checker. -1 reflect crashed
315
checker, or None.
316
301
last_enabled: datetime.datetime(); (UTC)
317
302
name: string; from the config file, used in log messages and
318
303
D-Bus identifiers
336
321
337
322
def extended_timeout_milliseconds(self):
338
323
"Return the 'extended_timeout' attribute in milliseconds"
339
return _timedelta_to_milliseconds(self.extended_timeout)
324
return _timedelta_to_milliseconds(self.extended_timeout)
340
325
341
326
def interval_milliseconds(self):
342
327
"Return the 'interval' attribute in milliseconds"
345
330
def approval_delay_milliseconds(self):
346
331
return _timedelta_to_milliseconds(self.approval_delay)
347
332
348
def __init__(self, name = None, config=None):
333
def __init__(self, name = None, disable_hook=None, config=None):
349
334
"""Note: the 'checker' key in 'config' sets the
350
335
'checker_command' attribute and *not* the 'checker'
351
336
attribute."""
371
356
% self.name)
372
357
self.host = config.get("host", "")
373
358
self.created = datetime.datetime.utcnow()
374
self.enabled = True
359
self.enabled = False
375
360
self.last_approval_request = None
376
self.last_enabled = datetime.datetime.utcnow()
361
self.last_enabled = None
377
362
self.last_checked_ok = None
378
self.last_checker_status = None
379
363
self.timeout = string_to_delta(config["timeout"])
380
self.extended_timeout = string_to_delta(config
381
["extended_timeout"])
364
self.extended_timeout = string_to_delta(config["extended_timeout"])
382
365
self.interval = string_to_delta(config["interval"])
366
self.disable_hook = disable_hook
383
367
self.checker = None
384
368
self.checker_initiator_tag = None
385
369
self.disable_initiator_tag = None
386
self.expires = datetime.datetime.utcnow() + self.timeout
370
self.expires = None
387
371
self.checker_callback_tag = None
388
372
self.checker_command = config["checker"]
389
373
self.current_checker_command = None
374
self.last_connect = None
390
375
self._approved = None
391
376
self.approved_by_default = config.get("approved_by_default",
392
377
True)
395
380
config["approval_delay"])
396
381
self.approval_duration = string_to_delta(
397
382
config["approval_duration"])
398
self.changedstate = (multiprocessing_manager
399
.Condition(multiprocessing_manager
400
.Lock()))
401
self.client_structure = [attr for attr
402
in self.__dict__.iterkeys()
403
if not attr.startswith("_")]
404
self.client_structure.append("client_structure")
405
406
407
for name, t in inspect.getmembers(type(self),
408
lambda obj:
409
isinstance(obj,
410
property)):
411
if not name.startswith("_"):
412
self.client_structure.append(name)
383
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
413
384
414
# Send notice to process children that client state has changed
415
385
def send_changedstate(self):
416
with self.changedstate:
417
self.changedstate.notify_all()
418
386
self.changedstate.acquire()
387
self.changedstate.notify_all()
388
self.changedstate.release()
389
419
390
def enable(self):
420
391
"""Start this client's checker and timeout hooks"""
421
392
if getattr(self, "enabled", False):
422
393
# Already enabled
423
394
return
424
395
self.send_changedstate()
396
# Schedule a new checker to be started an 'interval' from now,
397
# and every interval from then on.
398
self.checker_initiator_tag = (gobject.timeout_add
399
(self.interval_milliseconds(),
400
self.start_checker))
401
# Schedule a disable() when 'timeout' has passed
425
402
self.expires = datetime.datetime.utcnow() + self.timeout
403
self.disable_initiator_tag = (gobject.timeout_add
404
(self.timeout_milliseconds(),
405
self.disable))
426
406
self.enabled = True
427
407
self.last_enabled = datetime.datetime.utcnow()
428
self.init_checker()
408
# Also start a new checker *right now*.
409
self.start_checker()
429
410
430
411
def disable(self, quiet=True):
431
412
"""Disable this client."""
443
424
gobject.source_remove(self.checker_initiator_tag)
444
425
self.checker_initiator_tag = None
445
426
self.stop_checker()
427
if self.disable_hook:
428
self.disable_hook(self)
446
429
self.enabled = False
447
430
# Do not run this again if called by a gobject.timeout_add
448
431
return False
449
432
450
433
def __del__(self):
434
self.disable_hook = None
451
435
self.disable()
452
453
def init_checker(self):
454
# Schedule a new checker to be started an 'interval' from now,
455
# and every interval from then on.
456
self.checker_initiator_tag = (gobject.timeout_add
457
(self.interval_milliseconds(),
458
self.start_checker))
459
# Schedule a disable() when 'timeout' has passed
460
self.disable_initiator_tag = (gobject.timeout_add
461
(self.timeout_milliseconds(),
462
self.disable))
463
# Also start a new checker *right now*.
464
self.start_checker()
465
466
436
467
437
def checker_callback(self, pid, condition, command):
468
438
"""The checker has completed, so take appropriate actions."""
469
439
self.checker_callback_tag = None
470
440
self.checker = None
471
441
if os.WIFEXITED(condition):
472
self.last_checker_status = os.WEXITSTATUS(condition)
473
if self.last_checker_status == 0:
442
exitstatus = os.WEXITSTATUS(condition)
443
if exitstatus == 0:
474
444
logger.info("Checker for %(name)s succeeded",
475
445
vars(self))
476
446
self.checked_ok()
478
448
logger.info("Checker for %(name)s failed",
479
449
vars(self))
480
450
else:
481
self.last_checker_status = -1
482
451
logger.warning("Checker for %(name)s crashed?",
483
452
vars(self))
484
453
491
460
if timeout is None:
492
461
timeout = self.timeout
493
462
self.last_checked_ok = datetime.datetime.utcnow()
494
if self.disable_initiator_tag is not None:
495
gobject.source_remove(self.disable_initiator_tag)
496
if getattr(self, "enabled", False):
497
self.disable_initiator_tag = (gobject.timeout_add
498
(_timedelta_to_milliseconds
499
(timeout), self.disable))
500
self.expires = datetime.datetime.utcnow() + timeout
463
gobject.source_remove(self.disable_initiator_tag)
464
self.expires = datetime.datetime.utcnow() + timeout
465
self.disable_initiator_tag = (gobject.timeout_add
466
(_timedelta_to_milliseconds(timeout),
467
self.disable))
501
468
502
469
def need_approval(self):
503
470
self.last_approval_request = datetime.datetime.utcnow()
595
562
raise
596
563
self.checker = None
597
564
598
# Encrypts a client secret and stores it in a varible
599
# encrypted_secret
600
def encrypt_secret(self, key):
601
# Encryption-key need to be of a specific size, so we hash
602
# supplied key
603
hasheng = hashlib.sha256()
604
hasheng.update(key)
605
encryptionkey = hasheng.digest()
606
607
# Create validation hash so we know at decryption if it was
608
# sucessful
609
hasheng = hashlib.sha256()
610
hasheng.update(self.secret)
611
validationhash = hasheng.digest()
612
613
# Encrypt secret
614
iv = os.urandom(Crypto.Cipher.AES.block_size)
615
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
616
Crypto.Cipher.AES.MODE_CFB, iv)
617
ciphertext = ciphereng.encrypt(validationhash+self.secret)
618
self.encrypted_secret = (ciphertext, iv)
619
620
# Decrypt a encrypted client secret
621
def decrypt_secret(self, key):
622
# Decryption-key need to be of a specific size, so we hash
623
# supplied key
624
hasheng = hashlib.sha256()
625
hasheng.update(key)
626
encryptionkey = hasheng.digest()
627
628
# Decrypt encrypted secret
629
ciphertext, iv = self.encrypted_secret
630
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
631
Crypto.Cipher.AES.MODE_CFB, iv)
632
plain = ciphereng.decrypt(ciphertext)
633
634
# Validate decrypted secret to know if it was succesful
635
hasheng = hashlib.sha256()
636
validationhash = plain[:hasheng.digest_size]
637
secret = plain[hasheng.digest_size:]
638
hasheng.update(secret)
639
640
# If validation fails, we use key as new secret. Otherwise, we
641
# use the decrypted secret
642
if hasheng.digest() == validationhash:
643
self.secret = secret
644
else:
645
self.secret = key
646
del self.encrypted_secret
647
648
565
649
566
def dbus_service_property(dbus_interface, signature="v",
650
567
access="readwrite", byte_arrays=False):
712
629
"""
713
630
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
714
631
for cls in self.__class__.__mro__
715
for name, prop in
716
inspect.getmembers(cls, self._is_dbus_property))
632
for name, prop in inspect.getmembers(cls, self._is_dbus_property))
717
633
718
634
def _get_dbus_property(self, interface_name, property_name):
719
635
"""Returns a bound method if one exists which is a D-Bus
720
636
property with the specified name and interface.
721
637
"""
722
638
for cls in self.__class__.__mro__:
723
for name, value in (inspect.getmembers
724
(cls, self._is_dbus_property)):
725
if (value._dbus_name == property_name
726
and value._dbus_interface == interface_name):
639
for name, value in inspect.getmembers(cls, self._is_dbus_property):
640
if value._dbus_name == property_name and value._dbus_interface == interface_name:
727
641
return value.__get__(self)
728
642
729
643
# No such property
840
754
return dbus.String(dt.isoformat(),
841
755
variant_level=variant_level)
842
756
843
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
844
.__metaclass__):
757
class AlternateDBusNamesMetaclass(DBusObjectWithProperties.__metaclass__):
845
758
"""Applied to an empty subclass of a D-Bus object, this metaclass
846
759
will add additional D-Bus attributes matching a certain pattern.
847
760
"""
951
864
# dbus.service.Object doesn't use super(), so we can't either.
952
865
953
866
def __init__(self, bus = None, *args, **kwargs):
954
self.bus = bus
955
867
self._approvals_pending = 0
868
self.bus = bus
956
869
Client.__init__(self, *args, **kwargs)
957
self.add_to_dbus()
958
959
def add_to_dbus(self):
960
870
# Only now, when this client is initialized, can it show up on
961
871
# the D-Bus
962
872
client_object_name = unicode(self.name).translate(
973
883
""" Modify a variable so that it's a property which announces
974
884
its changes to DBus.
975
885
976
transform_fun: Function that takes a value and a variant_level
977
and transforms it to a D-Bus type.
886
transform_fun: Function that takes a value and transforms it
887
to a D-Bus type.
978
888
dbus_name: D-Bus name of the variable
979
889
type_func: Function that transform the value before sending it
980
890
to the D-Bus. Default: no transform
981
891
variant_level: D-Bus variant level. Default: 1
982
892
"""
983
attrname = "_{0}".format(dbus_name)
893
real_value = [None,]
984
894
def setter(self, value):
895
old_value = real_value[0]
896
real_value[0] = value
985
897
if hasattr(self, "dbus_object_path"):
986
if (not hasattr(self, attrname) or
987
type_func(getattr(self, attrname, None))
988
!= type_func(value)):
989
dbus_value = transform_func(type_func(value),
990
variant_level
991
=variant_level)
898
if type_func(old_value) != type_func(real_value[0]):
899
dbus_value = transform_func(type_func(real_value[0]),
900
variant_level)
992
901
self.PropertyChanged(dbus.String(dbus_name),
993
902
dbus_value)
994
setattr(self, attrname, value)
995
903
996
return property(lambda self: getattr(self, attrname), setter)
904
return property(lambda self: real_value[0], setter)
997
905
998
906
999
907
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1004
912
last_enabled = notifychangeproperty(datetime_to_dbus,
1005
913
"LastEnabled")
1006
914
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1007
type_func = lambda checker:
1008
checker is not None)
915
type_func = lambda checker: checker is not None)
1009
916
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1010
917
"LastCheckedOK")
1011
last_approval_request = notifychangeproperty(
1012
datetime_to_dbus, "LastApprovalRequest")
918
last_approval_request = notifychangeproperty(datetime_to_dbus,
919
"LastApprovalRequest")
1013
920
approved_by_default = notifychangeproperty(dbus.Boolean,
1014
921
"ApprovedByDefault")
1015
approval_delay = notifychangeproperty(dbus.UInt16,
1016
"ApprovalDelay",
1017
type_func =
1018
_timedelta_to_milliseconds)
1019
approval_duration = notifychangeproperty(
1020
dbus.UInt16, "ApprovalDuration",
1021
type_func = _timedelta_to_milliseconds)
922
approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",
923
type_func = _timedelta_to_milliseconds)
924
approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",
925
type_func = _timedelta_to_milliseconds)
1022
926
host = notifychangeproperty(dbus.String, "Host")
1023
927
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1024
type_func =
1025
_timedelta_to_milliseconds)
1026
extended_timeout = notifychangeproperty(
1027
dbus.UInt16, "ExtendedTimeout",
1028
type_func = _timedelta_to_milliseconds)
1029
interval = notifychangeproperty(dbus.UInt16,
1030
"Interval",
1031
type_func =
1032
_timedelta_to_milliseconds)
928
type_func = _timedelta_to_milliseconds)
929
extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",
930
type_func = _timedelta_to_milliseconds)
931
interval = notifychangeproperty(dbus.UInt16, "Interval",
932
type_func = _timedelta_to_milliseconds)
1033
933
checker_command = notifychangeproperty(dbus.String, "Checker")
1034
934
1035
935
del notifychangeproperty
1270
1170
gobject.source_remove(self.disable_initiator_tag)
1271
1171
self.disable_initiator_tag = None
1272
1172
self.expires = None
1273
time_to_die = _timedelta_to_milliseconds((self
1274
.last_checked_ok
1275
+ self.timeout)
1276
- datetime.datetime
1277
.utcnow())
1173
time_to_die = (self.
1174
_timedelta_to_milliseconds((self
1175
.last_checked_ok
1176
+ self.timeout)
1177
- datetime.datetime
1178
.utcnow()))
1278
1179
if time_to_die <= 0:
1279
1180
# The timeout has passed
1280
1181
self.disable()
1281
1182
else:
1282
1183
self.expires = (datetime.datetime.utcnow()
1283
+ datetime.timedelta(milliseconds =
1284
time_to_die))
1184
+ datetime.timedelta(milliseconds = time_to_die))
1285
1185
self.disable_initiator_tag = (gobject.timeout_add
1286
1186
(time_to_die, self.disable))
1287
1187
1453
1353
client.name)
1454
1354
if self.server.use_dbus:
1455
1355
# Emit D-Bus signal
1456
client.Rejected("Disabled")
1356
client.Rejected("Disabled")
1457
1357
return
1458
1358
1459
1359
if client._approved or not client.approval_delay:
1476
1376
return
1477
1377
1478
1378
#wait until timeout or approved
1379
#x = float(client._timedelta_to_milliseconds(delay))
1479
1380
time = datetime.datetime.now()
1480
1381
client.changedstate.acquire()
1481
(client.changedstate.wait
1482
(float(client._timedelta_to_milliseconds(delay)
1483
/ 1000)))
1382
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1484
1383
client.changedstate.release()
1485
1384
time2 = datetime.datetime.now()
1486
1385
if (time2 - time) >= delay:
1510
1409
sent_size += sent
1511
1410
1512
1411
logger.info("Sending secret to %s", client.name)
1513
# bump the timeout using extended_timeout
1412
# bump the timeout as if seen
1514
1413
client.checked_ok(client.extended_timeout)
1515
1414
if self.server.use_dbus:
1516
1415
# Emit D-Bus signal
1596
1495
except:
1597
1496
self.handle_error(request, address)
1598
1497
self.close_request(request)
1599
1498
1600
1499
def process_request(self, request, address):
1601
1500
"""Start a new process to process the request."""
1602
proc = multiprocessing.Process(target = self.sub_process_main,
1603
args = (request,
1604
address))
1605
proc.start()
1606
return proc
1501
multiprocessing.Process(target = self.sub_process_main,
1502
args = (request, address)).start()
1607
1503
1608
1504
1609
1505
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1615
1511
"""
1616
1512
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1617
1513
1618
proc = MultiprocessingMixIn.process_request(self, request,
1619
client_address)
1514
super(MultiprocessingMixInWithPipe,
1515
self).process_request(request, client_address)
1620
1516
self.child_pipe.close()
1621
self.add_pipe(parent_pipe, proc)
1517
self.add_pipe(parent_pipe)
1622
1518
1623
def add_pipe(self, parent_pipe, proc):
1519
def add_pipe(self, parent_pipe):
1624
1520
"""Dummy function; override as necessary"""
1625
1521
raise NotImplementedError
1626
1522
1704
1600
self.enabled = False
1705
1601
self.clients = clients
1706
1602
if self.clients is None:
1707
self.clients = {}
1603
self.clients = set()
1708
1604
self.use_dbus = use_dbus
1709
1605
self.gnutls_priority = gnutls_priority
1710
1606
IPv6_TCPServer.__init__(self, server_address,
1714
1610
def server_activate(self):
1715
1611
if self.enabled:
1716
1612
return socketserver.TCPServer.server_activate(self)
1717
1718
1613
def enable(self):
1719
1614
self.enabled = True
1720
1721
def add_pipe(self, parent_pipe, proc):
1615
def add_pipe(self, parent_pipe):
1722
1616
# Call "handle_ipc" for both data and EOF events
1723
1617
gobject.io_add_watch(parent_pipe.fileno(),
1724
1618
gobject.IO_IN | gobject.IO_HUP,
1725
1619
functools.partial(self.handle_ipc,
1726
parent_pipe =
1727
parent_pipe,
1728
proc = proc))
1729
1620
parent_pipe = parent_pipe))
1621
1730
1622
def handle_ipc(self, source, condition, parent_pipe=None,
1731
proc = None, client_object=None):
1623
client_object=None):
1732
1624
condition_names = {
1733
1625
gobject.IO_IN: "IN", # There is data to read.
1734
1626
gobject.IO_OUT: "OUT", # Data can be written (without
1743
1635
for cond, name in
1744
1636
condition_names.iteritems()
1745
1637
if cond & condition)
1746
# error, or the other end of multiprocessing.Pipe has closed
1638
# error or the other end of multiprocessing.Pipe has closed
1747
1639
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1748
# Wait for other process to exit
1749
proc.join()
1750
1640
return False
1751
1641
1752
1642
# Read a request from the child
1757
1647
fpr = request[1]
1758
1648
address = request[2]
1759
1649
1760
for c in self.clients.itervalues():
1650
for c in self.clients:
1761
1651
if c.fingerprint == fpr:
1762
1652
client = c
1763
1653
break
1766
1656
"dress: %s", fpr, address)
1767
1657
if self.use_dbus:
1768
1658
# Emit D-Bus signal
1769
mandos_dbus_service.ClientNotFound(fpr,
1770
address[0])
1659
mandos_dbus_service.ClientNotFound(fpr, address[0])
1771
1660
parent_pipe.send(False)
1772
1661
return False
1773
1662
1774
1663
gobject.io_add_watch(parent_pipe.fileno(),
1775
1664
gobject.IO_IN | gobject.IO_HUP,
1776
1665
functools.partial(self.handle_ipc,
1777
parent_pipe =
1778
parent_pipe,
1779
proc = proc,
1780
client_object =
1781
client))
1666
parent_pipe = parent_pipe,
1667
client_object = client))
1782
1668
parent_pipe.send(True)
1783
# remove the old hook in favor of the new above hook on
1784
# same fileno
1669
# remove the old hook in favor of the new above hook on same fileno
1785
1670
return False
1786
1671
if command == 'funcall':
1787
1672
funcname = request[1]
1788
1673
args = request[2]
1789
1674
kwargs = request[3]
1790
1675
1791
parent_pipe.send(('data', getattr(client_object,
1792
funcname)(*args,
1793
**kwargs)))
1676
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1794
1677
1795
1678
if command == 'getattr':
1796
1679
attrname = request[1]
1797
1680
if callable(client_object.__getattribute__(attrname)):
1798
1681
parent_pipe.send(('function',))
1799
1682
else:
1800
parent_pipe.send(('data', client_object
1801
.__getattribute__(attrname)))
1683
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1802
1684
1803
1685
if command == 'setattr':
1804
1686
attrname = request[1]
1931
1813
" system bus interface")
1932
1814
parser.add_argument("--no-ipv6", action="store_false",
1933
1815
dest="use_ipv6", help="Do not use IPv6")
1934
parser.add_argument("--no-restore", action="store_false",
1935
dest="restore",
1936
help="Do not restore stored state",
1937
default=True)
1938
1939
1816
options = parser.parse_args()
1940
1817
1941
1818
if options.check:
1976
1853
# options, if set.
1977
1854
for option in ("interface", "address", "port", "debug",
1978
1855
"priority", "servicename", "configdir",
1979
"use_dbus", "use_ipv6", "debuglevel", "restore"):
1856
"use_dbus", "use_ipv6", "debuglevel"):
1980
1857
value = getattr(options, option)
1981
1858
if value is not None:
1982
1859
server_settings[option] = value
2055
1932
raise error
2056
1933
2057
1934
if not debug and not debuglevel:
2058
logger.setLevel(logging.WARNING)
1935
syslogger.setLevel(logging.WARNING)
1936
console.setLevel(logging.WARNING)
2059
1937
if debuglevel:
2060
1938
level = getattr(logging, debuglevel.upper())
2061
logger.setLevel(level)
1939
syslogger.setLevel(level)
1940
console.setLevel(level)
2062
1941
2063
1942
if debug:
2064
logger.setLevel(logging.DEBUG)
2065
1943
# Enable all possible GnuTLS debugging
2066
1944
2067
1945
# "Use a log level over 10 to enable all debugging options."
2099
1977
try:
2100
1978
bus_name = dbus.service.BusName("se.recompile.Mandos",
2101
1979
bus, do_not_queue=True)
2102
old_bus_name = (dbus.service.BusName
2103
("se.bsnet.fukt.Mandos", bus,
2104
do_not_queue=True))
1980
old_bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1981
bus, do_not_queue=True)
2105
1982
except dbus.exceptions.NameExistsException as e:
2106
1983
logger.error(unicode(e) + ", disabling D-Bus")
2107
1984
use_dbus = False
2108
1985
server_settings["use_dbus"] = False
2109
1986
tcp_server.use_dbus = False
2110
1987
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2111
service = AvahiServiceToSyslog(name =
2112
server_settings["servicename"],
2113
servicetype = "_mandos._tcp",
2114
protocol = protocol, bus = bus)
1988
service = AvahiService(name = server_settings["servicename"],
1989
servicetype = "_mandos._tcp",
1990
protocol = protocol, bus = bus)
2115
1991
if server_settings["interface"]:
2116
1992
service.interface = (if_nametoindex
2117
1993
(str(server_settings["interface"])))
2121
1997
2122
1998
client_class = Client
2123
1999
if use_dbus:
2124
client_class = functools.partial(ClientDBusTransitional,
2125
bus = bus)
2126
2127
special_settings = {
2128
# Some settings need to be accessd by special methods;
2129
# booleans need .getboolean(), etc. Here is a list of them:
2130
"approved_by_default":
2131
lambda section:
2132
client_config.getboolean(section, "approved_by_default"),
2133
}
2134
# Construct a new dict of client settings of this form:
2135
# { client_name: {setting_name: value, ...}, ...}
2136
# with exceptions for any special settings as defined above
2137
client_settings = dict((clientname,
2138
dict((setting,
2139
(value if
2140
setting not in special_settings
2141
else special_settings[setting]
2142
(clientname)))
2143
for setting, value
2144
in client_config.items(clientname)))
2145
for clientname in client_config.sections())
2146
2147
old_client_settings = {}
2148
clients_data = []
2149
2150
# Get client data and settings from last running state.
2151
if server_settings["restore"]:
2152
try:
2153
with open(stored_state_path, "rb") as stored_state:
2154
clients_data, old_client_settings = (
2155
pickle.load(stored_state))
2156
os.remove(stored_state_path)
2157
except IOError as e:
2158
logger.warning("Could not load persistant state: {0}"
2159
.format(e))
2160
if e.errno != errno.ENOENT:
2161
raise
2162
2163
for client in clients_data:
2164
client_name = client["name"]
2165
2166
# Decide which value to use after restoring saved state.
2167
# We have three different values: Old config file,
2168
# new config file, and saved state.
2169
# New config value takes precedence if it differs from old
2170
# config value, otherwise use saved state.
2171
for name, value in client_settings[client_name].items():
2000
client_class = functools.partial(ClientDBusTransitional, bus = bus)
2001
def client_config_items(config, section):
2002
special_settings = {
2003
"approved_by_default":
2004
lambda: config.getboolean(section,
2005
"approved_by_default"),
2006
}
2007
for name, value in config.items(section):
2172
2008
try:
2173
# For each value in new config, check if it differs
2174
# from the old config value (Except for the "secret"
2175
# attribute)
2176
if (name != "secret" and
2177
value != old_client_settings[client_name][name]):
2178
setattr(client, name, value)
2009
yield (name, special_settings[name]())
2179
2010
except KeyError:
2180
pass
2181
2182
# Clients who has passed its expire date, can still be enabled
2183
# if its last checker was sucessful. Clients who checkers
2184
# failed before we stored it state is asumed to had failed
2185
# checker during downtime.
2186
if client["enabled"] and client["last_checked_ok"]:
2187
if ((datetime.datetime.utcnow()
2188
- client["last_checked_ok"]) > client["interval"]):
2189
if client["last_checker_status"] != 0:
2190
client["enabled"] = False
2191
else:
2192
client["expires"] = (datetime.datetime.utcnow()
2193
+ client["timeout"])
2194
2195
client["changedstate"] = (multiprocessing_manager
2196
.Condition(multiprocessing_manager
2197
.Lock()))
2198
if use_dbus:
2199
new_client = ClientDBusTransitional.__new__(
2200
ClientDBusTransitional)
2201
tcp_server.clients[client_name] = new_client
2202
new_client.bus = bus
2203
for name, value in client.iteritems():
2204
setattr(new_client, name, value)
2205
new_client._approvals_pending = 0
2206
new_client.add_to_dbus()
2207
else:
2208
tcp_server.clients[client_name] = Client.__new__(Client)
2209
for name, value in client.iteritems():
2210
setattr(tcp_server.clients[client_name], name, value)
2211
2212
tcp_server.clients[client_name].decrypt_secret(
2213
client_settings[client_name]["secret"])
2214
2215
# Create/remove clients based on new changes made to config
2216
for clientname in set(old_client_settings) - set(client_settings):
2217
del tcp_server.clients[clientname]
2218
for clientname in set(client_settings) - set(old_client_settings):
2219
tcp_server.clients[clientname] = client_class(name
2220
= clientname,
2221
config =
2222
client_settings
2223
[clientname])
2011
yield (name, value)
2224
2012
2013
tcp_server.clients.update(set(
2014
client_class(name = section,
2015
config= dict(client_config_items(
2016
client_config, section)))
2017
for section in client_config.sections()))
2225
2018
if not tcp_server.clients:
2226
2019
logger.warning("No clients defined")
2227
2020
2270
2063
def GetAllClients(self):
2271
2064
"D-Bus method"
2272
2065
return dbus.Array(c.dbus_object_path
2273
for c in
2274
tcp_server.clients.itervalues())
2066
for c in tcp_server.clients)
2275
2067
2276
2068
@dbus.service.method(_interface,
2277
2069
out_signature="a{oa{sv}}")
2279
2071
"D-Bus method"
2280
2072
return dbus.Dictionary(
2281
2073
((c.dbus_object_path, c.GetAll(""))
2282
for c in tcp_server.clients.itervalues()),
2074
for c in tcp_server.clients),
2283
2075
signature="oa{sv}")
2284
2076
2285
2077
@dbus.service.method(_interface, in_signature="o")
2286
2078
def RemoveClient(self, object_path):
2287
2079
"D-Bus method"
2288
for c in tcp_server.clients.itervalues():
2080
for c in tcp_server.clients:
2289
2081
if c.dbus_object_path == object_path:
2290
del tcp_server.clients[c.name]
2082
tcp_server.clients.remove(c)
2291
2083
c.remove_from_connection()
2292
2084
# Don't signal anything except ClientRemoved
2293
2085
c.disable(quiet=True)
2306
2098
"Cleanup function; run on exit"
2307
2099
service.cleanup()
2308
2100
2309
multiprocessing.active_children()
2310
if not (tcp_server.clients or client_settings):
2311
return
2312
2313
# Store client before exiting. Secrets are encrypted with key
2314
# based on what config file has. If config file is
2315
# removed/edited, old secret will thus be unrecovable.
2316
clients = []
2317
for client in tcp_server.clients.itervalues():
2318
client.encrypt_secret(
2319
client_settings[client.name]["secret"])
2320
2321
client_dict = {}
2322
2323
# A list of attributes that will not be stored when
2324
# shutting down.
2325
exclude = set(("bus", "changedstate", "secret"))
2326
for name, typ in inspect.getmembers(dbus.service.Object):
2327
exclude.add(name)
2328
2329
client_dict["encrypted_secret"] = client.encrypted_secret
2330
for attr in client.client_structure:
2331
if attr not in exclude:
2332
client_dict[attr] = getattr(client, attr)
2333
2334
clients.append(client_dict)
2335
del client_settings[client.name]["secret"]
2336
2337
try:
2338
with os.fdopen(os.open(stored_state_path,
2339
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2340
stat.S_IRUSR | stat.S_IWUSR),
2341
"wb") as stored_state:
2342
pickle.dump((clients, client_settings), stored_state)
2343
except IOError as e:
2344
logger.warning("Could not save persistant state: {0}"
2345
.format(e))
2346
if e.errno != errno.ENOENT:
2347
raise
2348
2349
# Delete all clients, and settings from config
2350
2101
while tcp_server.clients:
2351
name, client = tcp_server.clients.popitem()
2102
client = tcp_server.clients.pop()
2352
2103
if use_dbus:
2353
2104
client.remove_from_connection()
2105
client.disable_hook = None
2354
2106
# Don't signal anything except ClientRemoved
2355
2107
client.disable(quiet=True)
2356
2108
if use_dbus:
2357
2109
# Emit D-Bus signal
2358
mandos_dbus_service.ClientRemoved(client
2359
.dbus_object_path,
2110
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2360
2111
client.name)
2361
client_settings.clear()
2362
2112
2363
2113
atexit.register(cleanup)
2364
2114
2365
for client in tcp_server.clients.itervalues():
2115
for client in tcp_server.clients:
2366
2116
if use_dbus:
2367
2117
# Emit D-Bus signal
2368
2118
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2369
# Need to initiate checking of clients
2370
if client.enabled:
2371
client.init_checker()
2372
2119
client.enable()
2373
2120
2374
2121
tcp_server.enable()
2375
2122
tcp_server.server_activate()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0