To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 518.1.2
- compare with another revision
- download diff
- download tarball
- view history from revision 518.1.2
- Committer: Björn Påhlsson
- Date: 2011-11-11 13:37:05 UTC
- mfrom: (520 trunk)
- mto: (518.2.5 persistent-state-gpgme)
- mto: This revision was merged to the branch mainline in revision 524.
- Revision ID: belorn@fukt.bsnet.se-20111111133705-989sniickt4y3pb7
merge
- files removed:
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import binascii
67
import tempfile
66
import hashlib
68
67
69
68
import dbus
70
69
import dbus.service
75
74
import ctypes.util
76
75
import xml.dom.minidom
77
76
import inspect
78
import GnuPGInterface
77
import Crypto.Cipher.AES
79
78
80
79
try:
81
80
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
84
except ImportError:
86
85
SO_BINDTODEVICE = None
87
86
87
88
88
version = "1.4.1"
89
stored_state_file = "clients.pickle"
90
89
91
90
logger = logging.getLogger()
91
stored_state_path = "/var/lib/mandos/clients.pickle"
92
92
93
syslogger = (logging.handlers.SysLogHandler
93
94
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
95
address = str("/dev/log")))
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(debug, level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
if debug:
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet'])
146
147
def __enter__(self):
148
return self
149
150
def __exit__ (self, exc_type, exc_value, traceback):
151
self._cleanup()
152
return False
153
154
def __del__(self):
155
self._cleanup()
156
157
def _cleanup(self):
158
if self.tempdir is not None:
159
# Delete contents of tempdir
160
for root, dirs, files in os.walk(self.tempdir,
161
topdown = False):
162
for filename in files:
163
os.remove(os.path.join(root, filename))
164
for dirname in dirs:
165
os.rmdir(os.path.join(root, dirname))
166
# Remove tempdir
167
os.rmdir(self.tempdir)
168
self.tempdir = None
169
170
def password_encode(self, password):
171
# Passphrase can not be empty and can not contain newlines or
172
# NUL bytes. So we prefix it and hex encode it.
173
return b"mandos" + binascii.hexlify(password)
174
175
def encrypt(self, data, password):
176
self.gnupg.passphrase = self.password_encode(password)
177
with open(os.devnull) as devnull:
178
try:
179
proc = self.gnupg.run(['--symmetric'],
180
create_fhs=['stdin', 'stdout'],
181
attach_fhs={'stderr': devnull})
182
with contextlib.closing(proc.handles['stdin']) as f:
183
f.write(data)
184
with contextlib.closing(proc.handles['stdout']) as f:
185
ciphertext = f.read()
186
proc.wait()
187
except IOError as e:
188
raise PGPError(e)
189
self.gnupg.passphrase = None
190
return ciphertext
191
192
def decrypt(self, data, password):
193
self.gnupg.passphrase = self.password_encode(password)
194
with open(os.devnull) as devnull:
195
try:
196
proc = self.gnupg.run(['--decrypt'],
197
create_fhs=['stdin', 'stdout'],
198
attach_fhs={'stderr': devnull})
199
with contextlib.closing(proc.handles['stdin'] ) as f:
200
f.write(data)
201
with contextlib.closing(proc.handles['stdout']) as f:
202
decrypted_plaintext = f.read()
203
proc.wait()
204
except IOError as e:
205
raise PGPError(e)
206
self.gnupg.passphrase = None
207
return decrypted_plaintext
208
96
syslogger.setFormatter(logging.Formatter
97
('Mandos [%(process)d]: %(levelname)s:'
98
' %(message)s'))
99
logger.addHandler(syslogger)
100
101
console = logging.StreamHandler()
102
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
103
' [%(process)d]:'
104
' %(levelname)s:'
105
' %(message)s'))
106
logger.addHandler(console)
209
107
210
108
211
109
class AvahiError(Exception):
328
226
try:
329
227
self.group.Free()
330
228
except (dbus.exceptions.UnknownMethodException,
331
dbus.exceptions.DBusException):
229
dbus.exceptions.DBusException) as e:
332
230
pass
333
231
self.group = None
334
232
self.remove()
378
276
% self.name))
379
277
return ret
380
278
381
def timedelta_to_milliseconds(td):
279
def _timedelta_to_milliseconds(td):
382
280
"Convert a datetime.timedelta() to milliseconds"
383
281
return ((td.days * 24 * 60 * 60 * 1000)
384
282
+ (td.seconds * 1000)
388
286
"""A representation of a client host served by this server.
389
287
390
288
Attributes:
391
approved: bool(); 'None' if not yet approved/disapproved
289
_approved: bool(); 'None' if not yet approved/disapproved
392
290
approval_delay: datetime.timedelta(); Time to wait for approval
393
291
approval_duration: datetime.timedelta(); Duration of one approval
394
292
checker: subprocess.Popen(); a running checker process used
412
310
interval: datetime.timedelta(); How often to start a new checker
413
311
last_approval_request: datetime.datetime(); (UTC) or None
414
312
last_checked_ok: datetime.datetime(); (UTC) or None
415
last_checker_status: integer between 0 and 255 reflecting exit
416
status of last checker. -1 reflects crashed
417
checker, or None.
418
last_enabled: datetime.datetime(); (UTC) or None
313
last_checker_status: integer between 0 and 255 reflecting exit status
314
of last checker. -1 reflect crashed checker,
315
or None.
316
last_enabled: datetime.datetime(); (UTC)
419
317
name: string; from the config file, used in log messages and
420
318
D-Bus identifiers
421
319
secret: bytestring; sent verbatim (over TLS) to client
431
329
"created", "enabled", "fingerprint",
432
330
"host", "interval", "last_checked_ok",
433
331
"last_enabled", "name", "timeout")
434
client_defaults = { "timeout": "5m",
435
"extended_timeout": "15m",
436
"interval": "2m",
437
"checker": "fping -q -- %%(host)s",
438
"host": "",
439
"approval_delay": "0s",
440
"approval_duration": "1s",
441
"approved_by_default": "True",
442
"enabled": "True",
443
}
444
332
445
333
def timeout_milliseconds(self):
446
334
"Return the 'timeout' attribute in milliseconds"
447
return timedelta_to_milliseconds(self.timeout)
335
return _timedelta_to_milliseconds(self.timeout)
448
336
449
337
def extended_timeout_milliseconds(self):
450
338
"Return the 'extended_timeout' attribute in milliseconds"
451
return timedelta_to_milliseconds(self.extended_timeout)
339
return _timedelta_to_milliseconds(self.extended_timeout)
452
340
453
341
def interval_milliseconds(self):
454
342
"Return the 'interval' attribute in milliseconds"
455
return timedelta_to_milliseconds(self.interval)
343
return _timedelta_to_milliseconds(self.interval)
456
344
457
345
def approval_delay_milliseconds(self):
458
return timedelta_to_milliseconds(self.approval_delay)
459
460
@staticmethod
461
def config_parser(config):
462
""" Construct a new dict of client settings of this form:
463
{ client_name: {setting_name: value, ...}, ...}
464
with exceptions for any special settings as defined above"""
465
settings = {}
466
for client_name in config.sections():
467
section = dict(config.items(client_name))
468
client = settings[client_name] = {}
469
470
client["host"] = section["host"]
471
# Reformat values from string types to Python types
472
client["approved_by_default"] = config.getboolean(
473
client_name, "approved_by_default")
474
client["enabled"] = config.getboolean(client_name, "enabled")
475
476
client["fingerprint"] = (section["fingerprint"].upper()
477
.replace(" ", ""))
478
if "secret" in section:
479
client["secret"] = section["secret"].decode("base64")
480
elif "secfile" in section:
481
with open(os.path.expanduser(os.path.expandvars
482
(section["secfile"])),
483
"rb") as secfile:
484
client["secret"] = secfile.read()
485
else:
486
raise TypeError("No secret or secfile for section %s"
487
% section)
488
client["timeout"] = string_to_delta(section["timeout"])
489
client["extended_timeout"] = string_to_delta(
490
section["extended_timeout"])
491
client["interval"] = string_to_delta(section["interval"])
492
client["approval_delay"] = string_to_delta(
493
section["approval_delay"])
494
client["approval_duration"] = string_to_delta(
495
section["approval_duration"])
496
client["checker_command"] = section["checker"]
497
client["last_approval_request"] = None
498
client["last_checked_ok"] = None
499
client["last_checker_status"] = None
500
if client["enabled"]:
501
client["last_enabled"] = datetime.datetime.utcnow()
502
client["expires"] = (datetime.datetime.utcnow()
503
+ client["timeout"])
504
else:
505
client["last_enabled"] = None
506
client["expires"] = None
507
508
return settings
509
510
511
def __init__(self, settings, name = None):
346
return _timedelta_to_milliseconds(self.approval_delay)
347
348
def __init__(self, name = None, config=None):
512
349
"""Note: the 'checker' key in 'config' sets the
513
350
'checker_command' attribute and *not* the 'checker'
514
351
attribute."""
515
352
self.name = name
516
# adding all client settings
517
for setting, value in settings.iteritems():
518
setattr(self, setting, value)
519
353
if config is None:
354
config = {}
520
355
logger.debug("Creating client %r", self.name)
521
356
# Uppercase and remove spaces from fingerprint for later
522
357
# comparison purposes with return value from the fingerprint()
523
358
# function
359
self.fingerprint = (config["fingerprint"].upper()
360
.replace(" ", ""))
524
361
logger.debug(" Fingerprint: %s", self.fingerprint)
525
self.created = settings.get("created", datetime.datetime.utcnow())
526
527
# attributes specific for this server instance
362
if "secret" in config:
363
self.secret = config["secret"].decode("base64")
364
elif "secfile" in config:
365
with open(os.path.expanduser(os.path.expandvars
366
(config["secfile"])),
367
"rb") as secfile:
368
self.secret = secfile.read()
369
else:
370
raise TypeError("No secret or secfile for client %s"
371
% self.name)
372
self.host = config.get("host", "")
373
self.created = datetime.datetime.utcnow()
374
self.enabled = True
375
self.last_approval_request = None
376
self.last_enabled = datetime.datetime.utcnow()
377
self.last_checked_ok = None
378
self.last_checker_status = None
379
self.timeout = string_to_delta(config["timeout"])
380
self.extended_timeout = string_to_delta(config
381
["extended_timeout"])
382
self.interval = string_to_delta(config["interval"])
528
383
self.checker = None
529
384
self.checker_initiator_tag = None
530
385
self.disable_initiator_tag = None
386
self.expires = datetime.datetime.utcnow() + self.timeout
531
387
self.checker_callback_tag = None
388
self.checker_command = config["checker"]
532
389
self.current_checker_command = None
533
self.approved = None
390
self._approved = None
391
self.approved_by_default = config.get("approved_by_default",
392
True)
534
393
self.approvals_pending = 0
394
self.approval_delay = string_to_delta(
395
config["approval_delay"])
396
self.approval_duration = string_to_delta(
397
config["approval_duration"])
535
398
self.changedstate = (multiprocessing_manager
536
399
.Condition(multiprocessing_manager
537
400
.Lock()))
538
self.client_structure = [attr for attr in
539
self.__dict__.iterkeys()
540
if not attr.startswith("_")]
401
self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]
541
402
self.client_structure.append("client_structure")
542
403
404
543
405
for name, t in inspect.getmembers(type(self),
544
lambda obj:
545
isinstance(obj,
546
property)):
406
lambda obj: isinstance(obj, property)):
547
407
if not name.startswith("_"):
548
408
self.client_structure.append(name)
549
409
585
445
586
446
def __del__(self):
587
447
self.disable()
588
448
589
449
def init_checker(self):
590
450
# Schedule a new checker to be started an 'interval' from now,
591
451
# and every interval from then on.
598
458
self.disable))
599
459
# Also start a new checker *right now*.
600
460
self.start_checker()
601
461
462
602
463
def checker_callback(self, pid, condition, command):
603
464
"""The checker has completed, so take appropriate actions."""
604
465
self.checker_callback_tag = None
605
466
self.checker = None
606
467
if os.WIFEXITED(condition):
607
self.last_checker_status = os.WEXITSTATUS(condition)
468
self.last_checker_status = os.WEXITSTATUS(condition)
608
469
if self.last_checker_status == 0:
609
470
logger.info("Checker for %(name)s succeeded",
610
471
vars(self))
630
491
gobject.source_remove(self.disable_initiator_tag)
631
492
if getattr(self, "enabled", False):
632
493
self.disable_initiator_tag = (gobject.timeout_add
633
(timedelta_to_milliseconds
494
(_timedelta_to_milliseconds
634
495
(timeout), self.disable))
635
496
self.expires = datetime.datetime.utcnow() + timeout
636
497
730
591
raise
731
592
self.checker = None
732
593
594
# Encrypts a client secret and stores it in a varible encrypted_secret
595
def encrypt_secret(self, key):
596
# Encryption-key need to be of a specific size, so we hash inputed key
597
hasheng = hashlib.sha256()
598
hasheng.update(key)
599
encryptionkey = hasheng.digest()
600
601
# Create validation hash so we know at decryption if it was sucessful
602
hasheng = hashlib.sha256()
603
hasheng.update(self.secret)
604
validationhash = hasheng.digest()
605
606
# Encrypt secret
607
iv = os.urandom(Crypto.Cipher.AES.block_size)
608
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
609
Crypto.Cipher.AES.MODE_CFB, iv)
610
ciphertext = ciphereng.encrypt(validationhash+self.secret)
611
self.encrypted_secret = (ciphertext, iv)
612
613
# Decrypt a encrypted client secret
614
def decrypt_secret(self, key):
615
# Decryption-key need to be of a specific size, so we hash inputed key
616
hasheng = hashlib.sha256()
617
hasheng.update(key)
618
encryptionkey = hasheng.digest()
619
620
# Decrypt encrypted secret
621
ciphertext, iv = self.encrypted_secret
622
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
623
Crypto.Cipher.AES.MODE_CFB, iv)
624
plain = ciphereng.decrypt(ciphertext)
625
626
# Validate decrypted secret to know if it was succesful
627
hasheng = hashlib.sha256()
628
validationhash = plain[:hasheng.digest_size]
629
secret = plain[hasheng.digest_size:]
630
hasheng.update(secret)
631
632
# if validation fails, we use key as new secret. Otherwhise, we use
633
# the decrypted secret
634
if hasheng.digest() == validationhash:
635
self.secret = secret
636
else:
637
self.secret = key
638
del self.encrypted_secret
639
733
640
734
641
def dbus_service_property(dbus_interface, signature="v",
735
642
access="readwrite", byte_arrays=False):
853
760
854
761
Note: Will not include properties with access="write".
855
762
"""
856
properties = {}
763
all = {}
857
764
for name, prop in self._get_all_dbus_properties():
858
765
if (interface_name
859
766
and interface_name != prop._dbus_interface):
864
771
continue
865
772
value = prop()
866
773
if not hasattr(value, "variant_level"):
867
properties[name] = value
774
all[name] = value
868
775
continue
869
properties[name] = type(value)(value, variant_level=
870
value.variant_level+1)
871
return dbus.Dictionary(properties, signature="sv")
776
all[name] = type(value)(value, variant_level=
777
value.variant_level+1)
778
return dbus.Dictionary(all, signature="sv")
872
779
873
780
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
874
781
out_signature="s",
925
832
return dbus.String(dt.isoformat(),
926
833
variant_level=variant_level)
927
834
928
929
835
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
930
836
.__metaclass__):
931
837
"""Applied to an empty subclass of a D-Bus object, this metaclass
1023
929
attribute.func_closure)))
1024
930
return type.__new__(mcs, name, bases, attr)
1025
931
1026
1027
932
class ClientDBus(Client, DBusObjectWithProperties):
1028
933
"""A Client class using D-Bus
1029
934
1040
945
def __init__(self, bus = None, *args, **kwargs):
1041
946
self.bus = bus
1042
947
Client.__init__(self, *args, **kwargs)
1043
self._approvals_pending = 0
1044
948
1045
949
self._approvals_pending = 0
1046
950
# Only now, when this client is initialized, can it show up on
1047
951
# the D-Bus
1058
962
variant_level=1):
1059
963
""" Modify a variable so that it's a property which announces
1060
964
its changes to DBus.
1061
965
1062
966
transform_fun: Function that takes a value and a variant_level
1063
967
and transforms it to a D-Bus type.
1064
968
dbus_name: D-Bus name of the variable
1098
1002
datetime_to_dbus, "LastApprovalRequest")
1099
1003
approved_by_default = notifychangeproperty(dbus.Boolean,
1100
1004
"ApprovedByDefault")
1101
approval_delay = notifychangeproperty(dbus.UInt64,
1005
approval_delay = notifychangeproperty(dbus.UInt16,
1102
1006
"ApprovalDelay",
1103
1007
type_func =
1104
timedelta_to_milliseconds)
1008
_timedelta_to_milliseconds)
1105
1009
approval_duration = notifychangeproperty(
1106
dbus.UInt64, "ApprovalDuration",
1107
type_func = timedelta_to_milliseconds)
1010
dbus.UInt16, "ApprovalDuration",
1011
type_func = _timedelta_to_milliseconds)
1108
1012
host = notifychangeproperty(dbus.String, "Host")
1109
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1013
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1110
1014
type_func =
1111
timedelta_to_milliseconds)
1015
_timedelta_to_milliseconds)
1112
1016
extended_timeout = notifychangeproperty(
1113
dbus.UInt64, "ExtendedTimeout",
1114
type_func = timedelta_to_milliseconds)
1115
interval = notifychangeproperty(dbus.UInt64,
1017
dbus.UInt16, "ExtendedTimeout",
1018
type_func = _timedelta_to_milliseconds)
1019
interval = notifychangeproperty(dbus.UInt16,
1116
1020
"Interval",
1117
1021
type_func =
1118
timedelta_to_milliseconds)
1022
_timedelta_to_milliseconds)
1119
1023
checker_command = notifychangeproperty(dbus.String, "Checker")
1120
1024
1121
1025
del notifychangeproperty
1163
1067
return r
1164
1068
1165
1069
def _reset_approved(self):
1166
self.approved = None
1070
self._approved = None
1167
1071
return False
1168
1072
1169
1073
def approve(self, value=True):
1170
1074
self.send_changedstate()
1171
self.approved = value
1172
gobject.timeout_add(timedelta_to_milliseconds
1075
self._approved = value
1076
gobject.timeout_add(_timedelta_to_milliseconds
1173
1077
(self.approval_duration),
1174
1078
self._reset_approved)
1175
1079
1218
1122
"D-Bus signal"
1219
1123
return self.need_approval()
1220
1124
1221
# NeRwequest - signal
1222
@dbus.service.signal(_interface, signature="s")
1223
def NewRequest(self, ip):
1224
"""D-Bus signal
1225
Is sent after a client request a password.
1226
"""
1227
pass
1228
1229
1125
## Methods
1230
1126
1231
1127
# Approve - method
1289
1185
access="readwrite")
1290
1186
def ApprovalDuration_dbus_property(self, value=None):
1291
1187
if value is None: # get
1292
return dbus.UInt64(timedelta_to_milliseconds(
1188
return dbus.UInt64(_timedelta_to_milliseconds(
1293
1189
self.approval_duration))
1294
1190
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1295
1191
1309
1205
def Host_dbus_property(self, value=None):
1310
1206
if value is None: # get
1311
1207
return dbus.String(self.host)
1312
self.host = unicode(value)
1208
self.host = value
1313
1209
1314
1210
# Created - property
1315
1211
@dbus_service_property(_interface, signature="s", access="read")
1316
1212
def Created_dbus_property(self):
1317
return datetime_to_dbus(self.created)
1213
return dbus.String(datetime_to_dbus(self.created))
1318
1214
1319
1215
# LastEnabled - property
1320
1216
@dbus_service_property(_interface, signature="s", access="read")
1364
1260
gobject.source_remove(self.disable_initiator_tag)
1365
1261
self.disable_initiator_tag = None
1366
1262
self.expires = None
1367
time_to_die = timedelta_to_milliseconds((self
1368
.last_checked_ok
1369
+ self.timeout)
1370
- datetime.datetime
1371
.utcnow())
1263
time_to_die = _timedelta_to_milliseconds((self
1264
.last_checked_ok
1265
+ self.timeout)
1266
- datetime.datetime
1267
.utcnow())
1372
1268
if time_to_die <= 0:
1373
1269
# The timeout has passed
1374
1270
self.disable()
1396
1292
self.interval = datetime.timedelta(0, 0, 0, value)
1397
1293
if getattr(self, "checker_initiator_tag", None) is None:
1398
1294
return
1399
if self.enabled:
1400
# Reschedule checker run
1401
gobject.source_remove(self.checker_initiator_tag)
1402
self.checker_initiator_tag = (gobject.timeout_add
1403
(value, self.start_checker))
1404
self.start_checker() # Start one now, too
1295
# Reschedule checker run
1296
gobject.source_remove(self.checker_initiator_tag)
1297
self.checker_initiator_tag = (gobject.timeout_add
1298
(value, self.start_checker))
1299
self.start_checker() # Start one now, too
1405
1300
1406
1301
# Checker - property
1407
1302
@dbus_service_property(_interface, signature="s",
1409
1304
def Checker_dbus_property(self, value=None):
1410
1305
if value is None: # get
1411
1306
return dbus.String(self.checker_command)
1412
self.checker_command = unicode(value)
1307
self.checker_command = value
1413
1308
1414
1309
# CheckerRunning - property
1415
1310
@dbus_service_property(_interface, signature="b",
1444
1339
raise KeyError()
1445
1340
1446
1341
def __getattribute__(self, name):
1447
if name == '_pipe':
1342
if(name == '_pipe'):
1448
1343
return super(ProxyClient, self).__getattribute__(name)
1449
1344
self._pipe.send(('getattr', name))
1450
1345
data = self._pipe.recv()
1457
1352
return func
1458
1353
1459
1354
def __setattr__(self, name, value):
1460
if name == '_pipe':
1355
if(name == '_pipe'):
1461
1356
return super(ProxyClient, self).__setattr__(name, value)
1462
1357
self._pipe.send(('setattr', name, value))
1463
1358
1464
1465
1359
class ClientDBusTransitional(ClientDBus):
1466
1360
__metaclass__ = AlternateDBusNamesMetaclass
1467
1361
1468
1469
1362
class ClientHandler(socketserver.BaseRequestHandler, object):
1470
1363
"""A class to handle client connections.
1471
1364
1539
1432
except KeyError:
1540
1433
return
1541
1434
1542
if self.server.use_dbus:
1543
# Emit D-Bus signal
1544
client.NewRequest(str(self.client_address))
1545
1546
1435
if client.approval_delay:
1547
1436
delay = client.approval_delay
1548
1437
client.approvals_pending += 1
1557
1446
client.Rejected("Disabled")
1558
1447
return
1559
1448
1560
if client.approved or not client.approval_delay:
1449
if client._approved or not client.approval_delay:
1561
1450
#We are approved or approval is disabled
1562
1451
break
1563
elif client.approved is None:
1452
elif client._approved is None:
1564
1453
logger.info("Client %s needs approval",
1565
1454
client.name)
1566
1455
if self.server.use_dbus:
1580
1469
time = datetime.datetime.now()
1581
1470
client.changedstate.acquire()
1582
1471
(client.changedstate.wait
1583
(float(client.timedelta_to_milliseconds(delay)
1472
(float(client._timedelta_to_milliseconds(delay)
1584
1473
/ 1000)))
1585
1474
client.changedstate.release()
1586
1475
time2 = datetime.datetime.now()
1685
1574
# Convert the buffer to a Python bytestring
1686
1575
fpr = ctypes.string_at(buf, buf_len.value)
1687
1576
# Convert the bytestring to hexadecimal notation
1688
hex_fpr = binascii.hexlify(fpr).upper()
1577
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1689
1578
return hex_fpr
1690
1579
1691
1580
1694
1583
def sub_process_main(self, request, address):
1695
1584
try:
1696
1585
self.finish_request(request, address)
1697
except Exception:
1586
except:
1698
1587
self.handle_error(request, address)
1699
1588
self.close_request(request)
1700
1589
1948
1837
return timevalue
1949
1838
1950
1839
1840
def if_nametoindex(interface):
1841
"""Call the C function if_nametoindex(), or equivalent
1842
1843
Note: This function cannot accept a unicode string."""
1844
global if_nametoindex
1845
try:
1846
if_nametoindex = (ctypes.cdll.LoadLibrary
1847
(ctypes.util.find_library("c"))
1848
.if_nametoindex)
1849
except (OSError, AttributeError):
1850
logger.warning("Doing if_nametoindex the hard way")
1851
def if_nametoindex(interface):
1852
"Get an interface index the hard way, i.e. using fcntl()"
1853
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1854
with contextlib.closing(socket.socket()) as s:
1855
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1856
struct.pack(str("16s16x"),
1857
interface))
1858
interface_index = struct.unpack(str("I"),
1859
ifreq[16:20])[0]
1860
return interface_index
1861
return if_nametoindex(interface)
1862
1863
1951
1864
def daemon(nochdir = False, noclose = False):
1952
1865
"""See daemon(3). Standard BSD Unix function.
1953
1866
2009
1922
parser.add_argument("--no-ipv6", action="store_false",
2010
1923
dest="use_ipv6", help="Do not use IPv6")
2011
1924
parser.add_argument("--no-restore", action="store_false",
2012
dest="restore", help="Do not restore stored"
2013
" state")
2014
parser.add_argument("--statedir", metavar="DIR",
2015
help="Directory to save/restore state in")
2016
1925
dest="restore", help="Do not restore stored state",
1926
default=True)
1927
2017
1928
options = parser.parse_args()
2018
1929
2019
1930
if options.check:
2032
1943
"use_dbus": "True",
2033
1944
"use_ipv6": "True",
2034
1945
"debuglevel": "",
2035
"restore": "True",
2036
"statedir": "/var/lib/mandos"
2037
1946
}
2038
1947
2039
1948
# Parse config file for server-global settings
2056
1965
# options, if set.
2057
1966
for option in ("interface", "address", "port", "debug",
2058
1967
"priority", "servicename", "configdir",
2059
"use_dbus", "use_ipv6", "debuglevel", "restore",
2060
"statedir"):
1968
"use_dbus", "use_ipv6", "debuglevel", "restore"):
2061
1969
value = getattr(options, option)
2062
1970
if value is not None:
2063
1971
server_settings[option] = value
2075
1983
debuglevel = server_settings["debuglevel"]
2076
1984
use_dbus = server_settings["use_dbus"]
2077
1985
use_ipv6 = server_settings["use_ipv6"]
2078
stored_state_path = os.path.join(server_settings["statedir"],
2079
stored_state_file)
2080
2081
if debug:
2082
initlogger(debug, logging.DEBUG)
2083
else:
2084
if not debuglevel:
2085
initlogger(debug)
2086
else:
2087
level = getattr(logging, debuglevel.upper())
2088
initlogger(debug, level)
2089
1986
2090
1987
if server_settings["servicename"] != "Mandos":
2091
1988
syslogger.setFormatter(logging.Formatter
2094
1991
% server_settings["servicename"]))
2095
1992
2096
1993
# Parse config file with clients
2097
client_config = configparser.SafeConfigParser(Client.client_defaults)
1994
client_defaults = { "timeout": "5m",
1995
"extended_timeout": "15m",
1996
"interval": "2m",
1997
"checker": "fping -q -- %%(host)s",
1998
"host": "",
1999
"approval_delay": "0s",
2000
"approval_duration": "1s",
2001
}
2002
client_config = configparser.SafeConfigParser(client_defaults)
2098
2003
client_config.read(os.path.join(server_settings["configdir"],
2099
2004
"clients.conf"))
2100
2005
2138
2043
if error[0] != errno.EPERM:
2139
2044
raise error
2140
2045
2046
if not debug and not debuglevel:
2047
logger.setLevel(logging.WARNING)
2048
if debuglevel:
2049
level = getattr(logging, debuglevel.upper())
2050
logger.setLevel(level)
2051
2141
2052
if debug:
2053
logger.setLevel(logging.DEBUG)
2142
2054
# Enable all possible GnuTLS debugging
2143
2055
2144
2056
# "Use a log level over 10 to enable all debugging options."
2157
2069
os.dup2(null, sys.stdin.fileno())
2158
2070
if null > 2:
2159
2071
os.close(null)
2072
else:
2073
# No console logging
2074
logger.removeHandler(console)
2160
2075
2161
2076
# Need to fork before connecting to D-Bus
2162
2077
if not debug:
2163
2078
# Close all input and output, do double fork, etc.
2164
2079
daemon()
2165
2080
2166
gobject.threads_init()
2167
2168
2081
global main_loop
2169
2082
# From the Avahi example code
2170
2083
DBusGMainLoop(set_as_default=True )
2200
2113
client_class = functools.partial(ClientDBusTransitional,
2201
2114
bus = bus)
2202
2115
2203
client_settings = Client.config_parser(client_config)
2116
special_settings = {
2117
# Some settings need to be accessd by special methods;
2118
# booleans need .getboolean(), etc. Here is a list of them:
2119
"approved_by_default":
2120
lambda section:
2121
client_config.getboolean(section, "approved_by_default"),
2122
}
2123
# Construct a new dict of client settings of this form:
2124
# { client_name: {setting_name: value, ...}, ...}
2125
# with exceptions for any special settings as defined above
2126
client_settings = dict((clientname,
2127
dict((setting,
2128
(value if setting not in special_settings
2129
else special_settings[setting](clientname)))
2130
for setting, value in client_config.items(clientname)))
2131
for clientname in client_config.sections())
2132
2204
2133
old_client_settings = {}
2205
clients_data = {}
2206
2207
# Get client data and settings from last running state.
2134
clients_data = []
2135
2136
# Get client data and settings from last running state.
2208
2137
if server_settings["restore"]:
2209
2138
try:
2210
2139
with open(stored_state_path, "rb") as stored_state:
2211
clients_data, old_client_settings = (pickle.load
2212
(stored_state))
2140
clients_data, old_client_settings = pickle.load(stored_state)
2213
2141
os.remove(stored_state_path)
2214
2142
except IOError as e:
2215
logger.warning("Could not load persistent state: {0}"
2216
.format(e))
2143
logger.warning("Could not load persistant state: {0}".format(e))
2217
2144
if e.errno != errno.ENOENT:
2218
2145
raise
2219
except EOFError as e:
2220
logger.warning("Could not load persistent state: "
2221
"EOFError: {0}".format(e))
2222
2223
with PGPEngine() as pgp:
2224
for client_name, client in clients_data.iteritems():
2225
# Decide which value to use after restoring saved state.
2226
# We have three different values: Old config file,
2227
# new config file, and saved state.
2228
# New config value takes precedence if it differs from old
2229
# config value, otherwise use saved state.
2230
for name, value in client_settings[client_name].items():
2231
try:
2232
# For each value in new config, check if it
2233
# differs from the old config value (Except for
2234
# the "secret" attribute)
2235
if (name != "secret" and
2236
value != old_client_settings[client_name]
2237
[name]):
2238
client[name] = value
2239
except KeyError:
2240
pass
2241
2242
# Clients who has passed its expire date can still be
2243
# enabled if its last checker was successful. Clients
2244
# whose checker failed before we stored its state is
2245
# assumed to have failed all checkers during downtime.
2246
if client["enabled"]:
2247
if datetime.datetime.utcnow() >= client["expires"]:
2248
if not client["last_checked_ok"]:
2249
logger.warning(
2250
"disabling client {0} - Client never "
2251
"performed a successfull checker"
2252
.format(client["name"]))
2253
client["enabled"] = False
2254
elif client["last_checker_status"] != 0:
2255
logger.warning(
2256
"disabling client {0} - Client "
2257
"last checker failed with error code {1}"
2258
.format(client["name"],
2259
client["last_checker_status"]))
2260
client["enabled"] = False
2261
else:
2262
client["expires"] = (datetime.datetime
2263
.utcnow()
2264
+ client["timeout"])
2265
2146
2147
for client in clients_data:
2148
client_name = client["name"]
2149
2150
# Decide which value to use after restoring saved state.
2151
# We have three different values: Old config file,
2152
# new config file, and saved state.
2153
# New config value takes precedence if it differs from old
2154
# config value, otherwise use saved state.
2155
for name, value in client_settings[client_name].items():
2266
2156
try:
2267
client["secret"] = (
2268
pgp.decrypt(client["encrypted_secret"],
2269
client_settings[client_name]
2270
["secret"]))
2271
except PGPError:
2272
# If decryption fails, we use secret from new settings
2273
logger.debug("Failed to decrypt {0} old secret"
2274
.format(client_name))
2275
client["secret"] = (
2276
client_settings[client_name]["secret"])
2277
2278
2279
# Add/remove clients based on new changes made to config
2280
for client_name in set(old_client_settings) - set(client_settings):
2281
del clients_data[client_name]
2282
for client_name in set(client_settings) - set(old_client_settings):
2283
clients_data[client_name] = client_settings[client_name]
2284
2285
# Create clients all clients
2286
for client_name, client in clients_data.iteritems():
2287
tcp_server.clients[client_name] = client_class(
2288
name = client_name, settings = client)
2289
2157
# For each value in new config, check if it differs
2158
# from the old config value (Except for the "secret"
2159
# attribute)
2160
if name != "secret" and value != old_client_settings[client_name][name]:
2161
setattr(client, name, value)
2162
except KeyError:
2163
pass
2164
2165
# Clients who has passed its expire date, can still be enabled if its
2166
# last checker was sucessful. Clients who checkers failed before we
2167
# stored it state is asumed to had failed checker during downtime.
2168
if client["enabled"] and client["last_checked_ok"]:
2169
if ((datetime.datetime.utcnow() - client["last_checked_ok"])
2170
> client["interval"]):
2171
if client["last_checker_status"] != 0:
2172
client["enabled"] = False
2173
else:
2174
client["expires"] = datetime.datetime.utcnow() + client["timeout"]
2175
2176
client["changedstate"] = (multiprocessing_manager
2177
.Condition(multiprocessing_manager
2178
.Lock()))
2179
if use_dbus:
2180
new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)
2181
tcp_server.clients[client_name] = new_client
2182
new_client.bus = bus
2183
for name, value in client.iteritems():
2184
setattr(new_client, name, value)
2185
client_object_name = unicode(client_name).translate(
2186
{ord("."): ord("_"),
2187
ord("-"): ord("_")})
2188
new_client.dbus_object_path = (dbus.ObjectPath
2189
("/clients/" + client_object_name))
2190
DBusObjectWithProperties.__init__(new_client,
2191
new_client.bus,
2192
new_client.dbus_object_path)
2193
else:
2194
tcp_server.clients[client_name] = Client.__new__(Client)
2195
for name, value in client.iteritems():
2196
setattr(tcp_server.clients[client_name], name, value)
2197
2198
tcp_server.clients[client_name].decrypt_secret(
2199
client_settings[client_name]["secret"])
2200
2201
# Create/remove clients based on new changes made to config
2202
for clientname in set(old_client_settings) - set(client_settings):
2203
del tcp_server.clients[clientname]
2204
for clientname in set(client_settings) - set(old_client_settings):
2205
tcp_server.clients[clientname] = (client_class(name = clientname,
2206
config =
2207
client_settings
2208
[clientname]))
2209
2210
2290
2211
if not tcp_server.clients:
2291
2212
logger.warning("No clients defined")
2292
2213
2303
2224
# "pidfile" was never created
2304
2225
pass
2305
2226
del pidfilename
2227
2306
2228
signal.signal(signal.SIGINT, signal.SIG_IGN)
2307
2229
2308
2230
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2373
2295
multiprocessing.active_children()
2374
2296
if not (tcp_server.clients or client_settings):
2375
2297
return
2376
2377
# Store client before exiting. Secrets are encrypted with key
2378
# based on what config file has. If config file is
2379
# removed/edited, old secret will thus be unrecovable.
2380
clients = {}
2381
with PGPEngine() as pgp:
2382
for client in tcp_server.clients.itervalues():
2383
key = client_settings[client.name]["secret"]
2384
client.encrypted_secret = pgp.encrypt(client.secret,
2385
key)
2386
client_dict = {}
2387
2388
# A list of attributes that can not be pickled
2389
# + secret.
2390
exclude = set(("bus", "changedstate", "secret",
2391
"checker"))
2392
for name, typ in (inspect.getmembers
2393
(dbus.service.Object)):
2394
exclude.add(name)
2395
2396
client_dict["encrypted_secret"] = (client
2397
.encrypted_secret)
2398
for attr in client.client_structure:
2399
if attr not in exclude:
2400
client_dict[attr] = getattr(client, attr)
2401
2402
clients[client.name] = client_dict
2403
del client_settings[client.name]["secret"]
2404
2298
2299
# Store client before exiting. Secrets are encrypted with key based
2300
# on what config file has. If config file is removed/edited, old
2301
# secret will thus be unrecovable.
2302
clients = []
2303
for client in tcp_server.clients.itervalues():
2304
client.encrypt_secret(client_settings[client.name]["secret"])
2305
2306
client_dict = {}
2307
2308
# A list of attributes that will not be stored when shuting down.
2309
exclude = set(("bus", "changedstate", "secret"))
2310
for name, typ in inspect.getmembers(dbus.service.Object):
2311
exclude.add(name)
2312
2313
client_dict["encrypted_secret"] = client.encrypted_secret
2314
for attr in client.client_structure:
2315
if attr not in exclude:
2316
client_dict[attr] = getattr(client, attr)
2317
2318
clients.append(client_dict)
2319
del client_settings[client.name]["secret"]
2320
2405
2321
try:
2406
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2407
prefix="clients-",
2408
dir=os.path.dirname
2409
(stored_state_path))
2410
with os.fdopen(tempfd, "wb") as stored_state:
2322
with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:
2411
2323
pickle.dump((clients, client_settings), stored_state)
2412
os.rename(tempname, stored_state_path)
2413
except (IOError, OSError) as e:
2414
logger.warning("Could not save persistent state: {0}"
2415
.format(e))
2416
if not debug:
2417
try:
2418
os.remove(tempname)
2419
except NameError:
2420
pass
2421
if e.errno not in set((errno.ENOENT, errno.EACCES,
2422
errno.EEXIST)):
2423
raise e
2424
2324
except IOError as e:
2325
logger.warning("Could not save persistant state: {0}".format(e))
2326
if e.errno != errno.ENOENT:
2327
raise
2328
2425
2329
# Delete all clients, and settings from config
2426
2330
while tcp_server.clients:
2427
2331
name, client = tcp_server.clients.popitem()
2445
2349
# Need to initiate checking of clients
2446
2350
if client.enabled:
2447
2351
client.init_checker()
2352
2448
2353
2449
2354
tcp_server.enable()
2450
2355
tcp_server.server_activate()
2490
2395
# Must run before the D-Bus bus name gets deregistered
2491
2396
cleanup()
2492
2397
2398
2493
2399
if __name__ == '__main__':
2494
2400
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0