372
357
self.host = config.get("host", "")
373
358
self.created = datetime.datetime.utcnow()
375
360
self.last_approval_request = None
376
self.last_enabled = datetime.datetime.utcnow()
361
self.last_enabled = None
377
362
self.last_checked_ok = None
378
self.last_checker_status = None
379
363
self.timeout = string_to_delta(config["timeout"])
380
self.extended_timeout = string_to_delta(config
381
["extended_timeout"])
364
self.extended_timeout = string_to_delta(config["extended_timeout"])
382
365
self.interval = string_to_delta(config["interval"])
366
self.disable_hook = disable_hook
383
367
self.checker = None
384
368
self.checker_initiator_tag = None
385
369
self.disable_initiator_tag = None
386
self.expires = datetime.datetime.utcnow() + self.timeout
387
371
self.checker_callback_tag = None
388
372
self.checker_command = config["checker"]
389
373
self.current_checker_command = None
374
self.last_connect = None
390
375
self._approved = None
391
376
self.approved_by_default = config.get("approved_by_default",
395
380
config["approval_delay"])
396
381
self.approval_duration = string_to_delta(
397
382
config["approval_duration"])
398
self.changedstate = (multiprocessing_manager
399
.Condition(multiprocessing_manager
401
self.client_structure = [attr for attr
402
in self.__dict__.iterkeys()
403
if not attr.startswith("_")]
404
self.client_structure.append("client_structure")
407
for name, t in inspect.getmembers(type(self),
411
if not name.startswith("_"):
412
self.client_structure.append(name)
383
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
414
# Send notice to process children that client state has changed
415
385
def send_changedstate(self):
416
with self.changedstate:
417
self.changedstate.notify_all()
386
self.changedstate.acquire()
387
self.changedstate.notify_all()
388
self.changedstate.release()
419
390
def enable(self):
420
391
"""Start this client's checker and timeout hooks"""
421
392
if getattr(self, "enabled", False):
422
393
# Already enabled
424
395
self.send_changedstate()
396
# Schedule a new checker to be started an 'interval' from now,
397
# and every interval from then on.
398
self.checker_initiator_tag = (gobject.timeout_add
399
(self.interval_milliseconds(),
401
# Schedule a disable() when 'timeout' has passed
425
402
self.expires = datetime.datetime.utcnow() + self.timeout
403
self.disable_initiator_tag = (gobject.timeout_add
404
(self.timeout_milliseconds(),
426
406
self.enabled = True
427
407
self.last_enabled = datetime.datetime.utcnow()
408
# Also start a new checker *right now*.
430
411
def disable(self, quiet=True):
431
412
"""Disable this client."""
443
424
gobject.source_remove(self.checker_initiator_tag)
444
425
self.checker_initiator_tag = None
445
426
self.stop_checker()
427
if self.disable_hook:
428
self.disable_hook(self)
446
429
self.enabled = False
447
430
# Do not run this again if called by a gobject.timeout_add
450
433
def __del__(self):
434
self.disable_hook = None
453
def init_checker(self):
454
# Schedule a new checker to be started an 'interval' from now,
455
# and every interval from then on.
456
self.checker_initiator_tag = (gobject.timeout_add
457
(self.interval_milliseconds(),
459
# Schedule a disable() when 'timeout' has passed
460
self.disable_initiator_tag = (gobject.timeout_add
461
(self.timeout_milliseconds(),
463
# Also start a new checker *right now*.
467
437
def checker_callback(self, pid, condition, command):
468
438
"""The checker has completed, so take appropriate actions."""
469
439
self.checker_callback_tag = None
470
440
self.checker = None
471
441
if os.WIFEXITED(condition):
472
self.last_checker_status = os.WEXITSTATUS(condition)
473
if self.last_checker_status == 0:
442
exitstatus = os.WEXITSTATUS(condition)
474
444
logger.info("Checker for %(name)s succeeded",
476
446
self.checked_ok()
491
460
if timeout is None:
492
461
timeout = self.timeout
493
462
self.last_checked_ok = datetime.datetime.utcnow()
494
if self.disable_initiator_tag is not None:
495
gobject.source_remove(self.disable_initiator_tag)
496
if getattr(self, "enabled", False):
497
self.disable_initiator_tag = (gobject.timeout_add
498
(_timedelta_to_milliseconds
499
(timeout), self.disable))
500
self.expires = datetime.datetime.utcnow() + timeout
463
gobject.source_remove(self.disable_initiator_tag)
464
self.expires = datetime.datetime.utcnow() + timeout
465
self.disable_initiator_tag = (gobject.timeout_add
466
(_timedelta_to_milliseconds(timeout),
502
469
def need_approval(self):
503
470
self.last_approval_request = datetime.datetime.utcnow()
596
563
self.checker = None
598
# Encrypts a client secret and stores it in a varible
600
def encrypt_secret(self, key):
601
# Encryption-key need to be of a specific size, so we hash
603
hasheng = hashlib.sha256()
605
encryptionkey = hasheng.digest()
607
# Create validation hash so we know at decryption if it was
609
hasheng = hashlib.sha256()
610
hasheng.update(self.secret)
611
validationhash = hasheng.digest()
614
iv = os.urandom(Crypto.Cipher.AES.block_size)
615
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
616
Crypto.Cipher.AES.MODE_CFB, iv)
617
ciphertext = ciphereng.encrypt(validationhash+self.secret)
618
self.encrypted_secret = (ciphertext, iv)
620
# Decrypt a encrypted client secret
621
def decrypt_secret(self, key):
622
# Decryption-key need to be of a specific size, so we hash
624
hasheng = hashlib.sha256()
626
encryptionkey = hasheng.digest()
628
# Decrypt encrypted secret
629
ciphertext, iv = self.encrypted_secret
630
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
631
Crypto.Cipher.AES.MODE_CFB, iv)
632
plain = ciphereng.decrypt(ciphertext)
634
# Validate decrypted secret to know if it was succesful
635
hasheng = hashlib.sha256()
636
validationhash = plain[:hasheng.digest_size]
637
secret = plain[hasheng.digest_size:]
638
hasheng.update(secret)
640
# If validation fails, we use key as new secret. Otherwise, we
641
# use the decrypted secret
642
if hasheng.digest() == validationhash:
646
del self.encrypted_secret
649
566
def dbus_service_property(dbus_interface, signature="v",
650
567
access="readwrite", byte_arrays=False):
713
630
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
714
631
for cls in self.__class__.__mro__
716
inspect.getmembers(cls, self._is_dbus_property))
632
for name, prop in inspect.getmembers(cls, self._is_dbus_property))
718
634
def _get_dbus_property(self, interface_name, property_name):
719
635
"""Returns a bound method if one exists which is a D-Bus
720
636
property with the specified name and interface.
722
638
for cls in self.__class__.__mro__:
723
for name, value in (inspect.getmembers
724
(cls, self._is_dbus_property)):
725
if (value._dbus_name == property_name
726
and value._dbus_interface == interface_name):
639
for name, value in inspect.getmembers(cls, self._is_dbus_property):
640
if value._dbus_name == property_name and value._dbus_interface == interface_name:
727
641
return value.__get__(self)
729
643
# No such property
973
883
""" Modify a variable so that it's a property which announces
974
884
its changes to DBus.
976
transform_fun: Function that takes a value and a variant_level
977
and transforms it to a D-Bus type.
886
transform_fun: Function that takes a value and transforms it
978
888
dbus_name: D-Bus name of the variable
979
889
type_func: Function that transform the value before sending it
980
890
to the D-Bus. Default: no transform
981
891
variant_level: D-Bus variant level. Default: 1
983
attrname = "_{0}".format(dbus_name)
984
894
def setter(self, value):
895
old_value = real_value[0]
896
real_value[0] = value
985
897
if hasattr(self, "dbus_object_path"):
986
if (not hasattr(self, attrname) or
987
type_func(getattr(self, attrname, None))
988
!= type_func(value)):
989
dbus_value = transform_func(type_func(value),
898
if type_func(old_value) != type_func(real_value[0]):
899
dbus_value = transform_func(type_func(real_value[0]),
992
901
self.PropertyChanged(dbus.String(dbus_name),
994
setattr(self, attrname, value)
996
return property(lambda self: getattr(self, attrname), setter)
904
return property(lambda self: real_value[0], setter)
999
907
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1004
912
last_enabled = notifychangeproperty(datetime_to_dbus,
1006
914
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1007
type_func = lambda checker:
1008
checker is not None)
915
type_func = lambda checker: checker is not None)
1009
916
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1010
917
"LastCheckedOK")
1011
last_approval_request = notifychangeproperty(
1012
datetime_to_dbus, "LastApprovalRequest")
918
last_approval_request = notifychangeproperty(datetime_to_dbus,
919
"LastApprovalRequest")
1013
920
approved_by_default = notifychangeproperty(dbus.Boolean,
1014
921
"ApprovedByDefault")
1015
approval_delay = notifychangeproperty(dbus.UInt16,
1018
_timedelta_to_milliseconds)
1019
approval_duration = notifychangeproperty(
1020
dbus.UInt16, "ApprovalDuration",
1021
type_func = _timedelta_to_milliseconds)
922
approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",
923
type_func = _timedelta_to_milliseconds)
924
approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",
925
type_func = _timedelta_to_milliseconds)
1022
926
host = notifychangeproperty(dbus.String, "Host")
1023
927
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1025
_timedelta_to_milliseconds)
1026
extended_timeout = notifychangeproperty(
1027
dbus.UInt16, "ExtendedTimeout",
1028
type_func = _timedelta_to_milliseconds)
1029
interval = notifychangeproperty(dbus.UInt16,
1032
_timedelta_to_milliseconds)
928
type_func = _timedelta_to_milliseconds)
929
extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",
930
type_func = _timedelta_to_milliseconds)
931
interval = notifychangeproperty(dbus.UInt16, "Interval",
932
type_func = _timedelta_to_milliseconds)
1033
933
checker_command = notifychangeproperty(dbus.String, "Checker")
1035
935
del notifychangeproperty
1616
1512
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1618
proc = MultiprocessingMixIn.process_request(self, request,
1514
super(MultiprocessingMixInWithPipe,
1515
self).process_request(request, client_address)
1620
1516
self.child_pipe.close()
1621
self.add_pipe(parent_pipe, proc)
1517
self.add_pipe(parent_pipe)
1623
def add_pipe(self, parent_pipe, proc):
1519
def add_pipe(self, parent_pipe):
1624
1520
"""Dummy function; override as necessary"""
1625
1521
raise NotImplementedError
1714
1610
def server_activate(self):
1715
1611
if self.enabled:
1716
1612
return socketserver.TCPServer.server_activate(self)
1718
1613
def enable(self):
1719
1614
self.enabled = True
1721
def add_pipe(self, parent_pipe, proc):
1615
def add_pipe(self, parent_pipe):
1722
1616
# Call "handle_ipc" for both data and EOF events
1723
1617
gobject.io_add_watch(parent_pipe.fileno(),
1724
1618
gobject.IO_IN | gobject.IO_HUP,
1725
1619
functools.partial(self.handle_ipc,
1620
parent_pipe = parent_pipe))
1730
1622
def handle_ipc(self, source, condition, parent_pipe=None,
1731
proc = None, client_object=None):
1623
client_object=None):
1732
1624
condition_names = {
1733
1625
gobject.IO_IN: "IN", # There is data to read.
1734
1626
gobject.IO_OUT: "OUT", # Data can be written (without
1766
1656
"dress: %s", fpr, address)
1767
1657
if self.use_dbus:
1768
1658
# Emit D-Bus signal
1769
mandos_dbus_service.ClientNotFound(fpr,
1659
mandos_dbus_service.ClientNotFound(fpr, address[0])
1771
1660
parent_pipe.send(False)
1774
1663
gobject.io_add_watch(parent_pipe.fileno(),
1775
1664
gobject.IO_IN | gobject.IO_HUP,
1776
1665
functools.partial(self.handle_ipc,
1666
parent_pipe = parent_pipe,
1667
client_object = client))
1782
1668
parent_pipe.send(True)
1783
# remove the old hook in favor of the new above hook on
1669
# remove the old hook in favor of the new above hook on same fileno
1786
1671
if command == 'funcall':
1787
1672
funcname = request[1]
1788
1673
args = request[2]
1789
1674
kwargs = request[3]
1791
parent_pipe.send(('data', getattr(client_object,
1676
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1795
1678
if command == 'getattr':
1796
1679
attrname = request[1]
1797
1680
if callable(client_object.__getattribute__(attrname)):
1798
1681
parent_pipe.send(('function',))
1800
parent_pipe.send(('data', client_object
1801
.__getattribute__(attrname)))
1683
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1803
1685
if command == 'setattr':
1804
1686
attrname = request[1]
2100
1978
bus_name = dbus.service.BusName("se.recompile.Mandos",
2101
1979
bus, do_not_queue=True)
2102
old_bus_name = (dbus.service.BusName
2103
("se.bsnet.fukt.Mandos", bus,
1980
old_bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1981
bus, do_not_queue=True)
2105
1982
except dbus.exceptions.NameExistsException as e:
2106
1983
logger.error(unicode(e) + ", disabling D-Bus")
2107
1984
use_dbus = False
2108
1985
server_settings["use_dbus"] = False
2109
1986
tcp_server.use_dbus = False
2110
1987
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2111
service = AvahiServiceToSyslog(name =
2112
server_settings["servicename"],
2113
servicetype = "_mandos._tcp",
2114
protocol = protocol, bus = bus)
1988
service = AvahiService(name = server_settings["servicename"],
1989
servicetype = "_mandos._tcp",
1990
protocol = protocol, bus = bus)
2115
1991
if server_settings["interface"]:
2116
1992
service.interface = (if_nametoindex
2117
1993
(str(server_settings["interface"])))
2122
1998
client_class = Client
2124
client_class = functools.partial(ClientDBusTransitional,
2127
special_settings = {
2128
# Some settings need to be accessd by special methods;
2129
# booleans need .getboolean(), etc. Here is a list of them:
2130
"approved_by_default":
2132
client_config.getboolean(section, "approved_by_default"),
2134
# Construct a new dict of client settings of this form:
2135
# { client_name: {setting_name: value, ...}, ...}
2136
# with exceptions for any special settings as defined above
2137
client_settings = dict((clientname,
2140
setting not in special_settings
2141
else special_settings[setting]
2144
in client_config.items(clientname)))
2145
for clientname in client_config.sections())
2147
old_client_settings = {}
2150
# Get client data and settings from last running state.
2151
if server_settings["restore"]:
2153
with open(stored_state_path, "rb") as stored_state:
2154
clients_data, old_client_settings = (
2155
pickle.load(stored_state))
2156
os.remove(stored_state_path)
2157
except IOError as e:
2158
logger.warning("Could not load persistant state: {0}"
2160
if e.errno != errno.ENOENT:
2163
for client in clients_data:
2164
client_name = client["name"]
2166
# Decide which value to use after restoring saved state.
2167
# We have three different values: Old config file,
2168
# new config file, and saved state.
2169
# New config value takes precedence if it differs from old
2170
# config value, otherwise use saved state.
2171
for name, value in client_settings[client_name].items():
2000
client_class = functools.partial(ClientDBusTransitional, bus = bus)
2001
def client_config_items(config, section):
2002
special_settings = {
2003
"approved_by_default":
2004
lambda: config.getboolean(section,
2005
"approved_by_default"),
2007
for name, value in config.items(section):
2173
# For each value in new config, check if it differs
2174
# from the old config value (Except for the "secret"
2176
if (name != "secret" and
2177
value != old_client_settings[client_name][name]):
2178
setattr(client, name, value)
2009
yield (name, special_settings[name]())
2179
2010
except KeyError:
2182
# Clients who has passed its expire date, can still be enabled
2183
# if its last checker was sucessful. Clients who checkers
2184
# failed before we stored it state is asumed to had failed
2185
# checker during downtime.
2186
if client["enabled"] and client["last_checked_ok"]:
2187
if ((datetime.datetime.utcnow()
2188
- client["last_checked_ok"]) > client["interval"]):
2189
if client["last_checker_status"] != 0:
2190
client["enabled"] = False
2192
client["expires"] = (datetime.datetime.utcnow()
2193
+ client["timeout"])
2195
client["changedstate"] = (multiprocessing_manager
2196
.Condition(multiprocessing_manager
2199
new_client = ClientDBusTransitional.__new__(
2200
ClientDBusTransitional)
2201
tcp_server.clients[client_name] = new_client
2202
new_client.bus = bus
2203
for name, value in client.iteritems():
2204
setattr(new_client, name, value)
2205
new_client._approvals_pending = 0
2206
new_client.add_to_dbus()
2208
tcp_server.clients[client_name] = Client.__new__(Client)
2209
for name, value in client.iteritems():
2210
setattr(tcp_server.clients[client_name], name, value)
2212
tcp_server.clients[client_name].decrypt_secret(
2213
client_settings[client_name]["secret"])
2215
# Create/remove clients based on new changes made to config
2216
for clientname in set(old_client_settings) - set(client_settings):
2217
del tcp_server.clients[clientname]
2218
for clientname in set(client_settings) - set(old_client_settings):
2219
tcp_server.clients[clientname] = client_class(name
2013
tcp_server.clients.update(set(
2014
client_class(name = section,
2015
config= dict(client_config_items(
2016
client_config, section)))
2017
for section in client_config.sections()))
2225
2018
if not tcp_server.clients:
2226
2019
logger.warning("No clients defined")
2280
2072
return dbus.Dictionary(
2281
2073
((c.dbus_object_path, c.GetAll(""))
2282
for c in tcp_server.clients.itervalues()),
2074
for c in tcp_server.clients),
2283
2075
signature="oa{sv}")
2285
2077
@dbus.service.method(_interface, in_signature="o")
2286
2078
def RemoveClient(self, object_path):
2288
for c in tcp_server.clients.itervalues():
2080
for c in tcp_server.clients:
2289
2081
if c.dbus_object_path == object_path:
2290
del tcp_server.clients[c.name]
2082
tcp_server.clients.remove(c)
2291
2083
c.remove_from_connection()
2292
2084
# Don't signal anything except ClientRemoved
2293
2085
c.disable(quiet=True)
2306
2098
"Cleanup function; run on exit"
2307
2099
service.cleanup()
2309
multiprocessing.active_children()
2310
if not (tcp_server.clients or client_settings):
2313
# Store client before exiting. Secrets are encrypted with key
2314
# based on what config file has. If config file is
2315
# removed/edited, old secret will thus be unrecovable.
2317
for client in tcp_server.clients.itervalues():
2318
client.encrypt_secret(
2319
client_settings[client.name]["secret"])
2323
# A list of attributes that will not be stored when
2325
exclude = set(("bus", "changedstate", "secret"))
2326
for name, typ in inspect.getmembers(dbus.service.Object):
2329
client_dict["encrypted_secret"] = client.encrypted_secret
2330
for attr in client.client_structure:
2331
if attr not in exclude:
2332
client_dict[attr] = getattr(client, attr)
2334
clients.append(client_dict)
2335
del client_settings[client.name]["secret"]
2338
with os.fdopen(os.open(stored_state_path,
2339
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2340
stat.S_IRUSR | stat.S_IWUSR),
2341
"wb") as stored_state:
2342
pickle.dump((clients, client_settings), stored_state)
2343
except IOError as e:
2344
logger.warning("Could not save persistant state: {0}"
2346
if e.errno != errno.ENOENT:
2349
# Delete all clients, and settings from config
2350
2101
while tcp_server.clients:
2351
name, client = tcp_server.clients.popitem()
2102
client = tcp_server.clients.pop()
2353
2104
client.remove_from_connection()
2105
client.disable_hook = None
2354
2106
# Don't signal anything except ClientRemoved
2355
2107
client.disable(quiet=True)
2357
2109
# Emit D-Bus signal
2358
mandos_dbus_service.ClientRemoved(client
2110
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2361
client_settings.clear()
2363
2113
atexit.register(cleanup)
2365
for client in tcp_server.clients.itervalues():
2115
for client in tcp_server.clients:
2367
2117
# Emit D-Bus signal
2368
2118
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2369
# Need to initiate checking of clients
2371
client.init_checker()
2374
2121
tcp_server.enable()
2375
2122
tcp_server.server_activate()