To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 518.1.3
- compare with another revision
- download diff
- download tarball
- view history from revision 518.1.3
- Committer: Björn Påhlsson
- Date: 2011-11-11 14:14:24 UTC
- mto: (518.2.5 persistent-state-gpgme)
- mto: This revision was merged to the branch mainline in revision 524.
- Revision ID: belorn@fukt.bsnet.se-20111111141424-405blpt3kwrla6lw
new signal: NewRequest(IP_address)
Sent when a client ask for its password
Sent when a client ask for its password
- files removed:
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import binascii
67
import tempfile
66
import hashlib
68
67
69
68
import dbus
70
69
import dbus.service
75
74
import ctypes.util
76
75
import xml.dom.minidom
77
76
import inspect
78
import GnuPGInterface
77
import Crypto.Cipher.AES
79
78
80
79
try:
81
80
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
84
except ImportError:
86
85
SO_BINDTODEVICE = None
87
86
87
88
88
version = "1.4.1"
89
stored_state_file = "clients.pickle"
90
89
91
90
logger = logging.getLogger()
91
stored_state_path = "/var/lib/mandos/clients.pickle"
92
92
93
syslogger = (logging.handlers.SysLogHandler
93
94
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
95
address = str("/dev/log")))
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(debug, level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
if debug:
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet'])
146
147
def __enter__(self):
148
return self
149
150
def __exit__ (self, exc_type, exc_value, traceback):
151
self._cleanup()
152
return False
153
154
def __del__(self):
155
self._cleanup()
156
157
def _cleanup(self):
158
if self.tempdir is not None:
159
# Delete contents of tempdir
160
for root, dirs, files in os.walk(self.tempdir,
161
topdown = False):
162
for filename in files:
163
os.remove(os.path.join(root, filename))
164
for dirname in dirs:
165
os.rmdir(os.path.join(root, dirname))
166
# Remove tempdir
167
os.rmdir(self.tempdir)
168
self.tempdir = None
169
170
def password_encode(self, password):
171
# Passphrase can not be empty and can not contain newlines or
172
# NUL bytes. So we prefix it and hex encode it.
173
return b"mandos" + binascii.hexlify(password)
174
175
def encrypt(self, data, password):
176
self.gnupg.passphrase = self.password_encode(password)
177
with open(os.devnull) as devnull:
178
try:
179
proc = self.gnupg.run(['--symmetric'],
180
create_fhs=['stdin', 'stdout'],
181
attach_fhs={'stderr': devnull})
182
with contextlib.closing(proc.handles['stdin']) as f:
183
f.write(data)
184
with contextlib.closing(proc.handles['stdout']) as f:
185
ciphertext = f.read()
186
proc.wait()
187
except IOError as e:
188
raise PGPError(e)
189
self.gnupg.passphrase = None
190
return ciphertext
191
192
def decrypt(self, data, password):
193
self.gnupg.passphrase = self.password_encode(password)
194
with open(os.devnull) as devnull:
195
try:
196
proc = self.gnupg.run(['--decrypt'],
197
create_fhs=['stdin', 'stdout'],
198
attach_fhs={'stderr': devnull})
199
with contextlib.closing(proc.handles['stdin'] ) as f:
200
f.write(data)
201
with contextlib.closing(proc.handles['stdout']) as f:
202
decrypted_plaintext = f.read()
203
proc.wait()
204
except IOError as e:
205
raise PGPError(e)
206
self.gnupg.passphrase = None
207
return decrypted_plaintext
208
96
syslogger.setFormatter(logging.Formatter
97
('Mandos [%(process)d]: %(levelname)s:'
98
' %(message)s'))
99
logger.addHandler(syslogger)
100
101
console = logging.StreamHandler()
102
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
103
' [%(process)d]:'
104
' %(levelname)s:'
105
' %(message)s'))
106
logger.addHandler(console)
209
107
210
108
211
109
class AvahiError(Exception):
328
226
try:
329
227
self.group.Free()
330
228
except (dbus.exceptions.UnknownMethodException,
331
dbus.exceptions.DBusException):
229
dbus.exceptions.DBusException) as e:
332
230
pass
333
231
self.group = None
334
232
self.remove()
378
276
% self.name))
379
277
return ret
380
278
381
def timedelta_to_milliseconds(td):
279
def _timedelta_to_milliseconds(td):
382
280
"Convert a datetime.timedelta() to milliseconds"
383
281
return ((td.days * 24 * 60 * 60 * 1000)
384
282
+ (td.seconds * 1000)
388
286
"""A representation of a client host served by this server.
389
287
390
288
Attributes:
391
approved: bool(); 'None' if not yet approved/disapproved
289
_approved: bool(); 'None' if not yet approved/disapproved
392
290
approval_delay: datetime.timedelta(); Time to wait for approval
393
291
approval_duration: datetime.timedelta(); Duration of one approval
394
292
checker: subprocess.Popen(); a running checker process used
412
310
interval: datetime.timedelta(); How often to start a new checker
413
311
last_approval_request: datetime.datetime(); (UTC) or None
414
312
last_checked_ok: datetime.datetime(); (UTC) or None
415
last_checker_status: integer between 0 and 255 reflecting exit
416
status of last checker. -1 reflects crashed
417
checker, or None.
418
last_enabled: datetime.datetime(); (UTC) or None
313
last_checker_status: integer between 0 and 255 reflecting exit status
314
of last checker. -1 reflect crashed checker,
315
or None.
316
last_enabled: datetime.datetime(); (UTC)
419
317
name: string; from the config file, used in log messages and
420
318
D-Bus identifiers
421
319
secret: bytestring; sent verbatim (over TLS) to client
431
329
"created", "enabled", "fingerprint",
432
330
"host", "interval", "last_checked_ok",
433
331
"last_enabled", "name", "timeout")
434
client_defaults = { "timeout": "5m",
435
"extended_timeout": "15m",
436
"interval": "2m",
437
"checker": "fping -q -- %%(host)s",
438
"host": "",
439
"approval_delay": "0s",
440
"approval_duration": "1s",
441
"approved_by_default": "True",
442
"enabled": "True",
443
}
444
332
445
333
def timeout_milliseconds(self):
446
334
"Return the 'timeout' attribute in milliseconds"
447
return timedelta_to_milliseconds(self.timeout)
335
return _timedelta_to_milliseconds(self.timeout)
448
336
449
337
def extended_timeout_milliseconds(self):
450
338
"Return the 'extended_timeout' attribute in milliseconds"
451
return timedelta_to_milliseconds(self.extended_timeout)
339
return _timedelta_to_milliseconds(self.extended_timeout)
452
340
453
341
def interval_milliseconds(self):
454
342
"Return the 'interval' attribute in milliseconds"
455
return timedelta_to_milliseconds(self.interval)
343
return _timedelta_to_milliseconds(self.interval)
456
344
457
345
def approval_delay_milliseconds(self):
458
return timedelta_to_milliseconds(self.approval_delay)
459
460
@staticmethod
461
def config_parser(config):
462
""" Construct a new dict of client settings of this form:
463
{ client_name: {setting_name: value, ...}, ...}
464
with exceptions for any special settings as defined above"""
465
settings = {}
466
for client_name in config.sections():
467
section = dict(config.items(client_name))
468
client = settings[client_name] = {}
469
470
client["host"] = section["host"]
471
# Reformat values from string types to Python types
472
client["approved_by_default"] = config.getboolean(
473
client_name, "approved_by_default")
474
client["enabled"] = config.getboolean(client_name, "enabled")
475
476
client["fingerprint"] = (section["fingerprint"].upper()
477
.replace(" ", ""))
478
if "secret" in section:
479
client["secret"] = section["secret"].decode("base64")
480
elif "secfile" in section:
481
with open(os.path.expanduser(os.path.expandvars
482
(section["secfile"])),
483
"rb") as secfile:
484
client["secret"] = secfile.read()
485
else:
486
raise TypeError("No secret or secfile for section %s"
487
% section)
488
client["timeout"] = string_to_delta(section["timeout"])
489
client["extended_timeout"] = string_to_delta(
490
section["extended_timeout"])
491
client["interval"] = string_to_delta(section["interval"])
492
client["approval_delay"] = string_to_delta(
493
section["approval_delay"])
494
client["approval_duration"] = string_to_delta(
495
section["approval_duration"])
496
client["checker_command"] = section["checker"]
497
client["last_approval_request"] = None
498
client["last_checked_ok"] = None
499
client["last_checker_status"] = None
500
if client["enabled"]:
501
client["last_enabled"] = datetime.datetime.utcnow()
502
client["expires"] = (datetime.datetime.utcnow()
503
+ client["timeout"])
504
else:
505
client["last_enabled"] = None
506
client["expires"] = None
507
508
return settings
509
510
511
def __init__(self, settings, name = None):
346
return _timedelta_to_milliseconds(self.approval_delay)
347
348
def __init__(self, name = None, config=None):
512
349
"""Note: the 'checker' key in 'config' sets the
513
350
'checker_command' attribute and *not* the 'checker'
514
351
attribute."""
515
352
self.name = name
516
# adding all client settings
517
for setting, value in settings.iteritems():
518
setattr(self, setting, value)
519
353
if config is None:
354
config = {}
520
355
logger.debug("Creating client %r", self.name)
521
356
# Uppercase and remove spaces from fingerprint for later
522
357
# comparison purposes with return value from the fingerprint()
523
358
# function
359
self.fingerprint = (config["fingerprint"].upper()
360
.replace(" ", ""))
524
361
logger.debug(" Fingerprint: %s", self.fingerprint)
525
self.created = settings.get("created", datetime.datetime.utcnow())
526
527
# attributes specific for this server instance
362
if "secret" in config:
363
self.secret = config["secret"].decode("base64")
364
elif "secfile" in config:
365
with open(os.path.expanduser(os.path.expandvars
366
(config["secfile"])),
367
"rb") as secfile:
368
self.secret = secfile.read()
369
else:
370
raise TypeError("No secret or secfile for client %s"
371
% self.name)
372
self.host = config.get("host", "")
373
self.created = datetime.datetime.utcnow()
374
self.enabled = True
375
self.last_approval_request = None
376
self.last_enabled = datetime.datetime.utcnow()
377
self.last_checked_ok = None
378
self.last_checker_status = None
379
self.timeout = string_to_delta(config["timeout"])
380
self.extended_timeout = string_to_delta(config
381
["extended_timeout"])
382
self.interval = string_to_delta(config["interval"])
528
383
self.checker = None
529
384
self.checker_initiator_tag = None
530
385
self.disable_initiator_tag = None
386
self.expires = datetime.datetime.utcnow() + self.timeout
531
387
self.checker_callback_tag = None
388
self.checker_command = config["checker"]
532
389
self.current_checker_command = None
533
self.approved = None
390
self._approved = None
391
self.approved_by_default = config.get("approved_by_default",
392
True)
534
393
self.approvals_pending = 0
394
self.approval_delay = string_to_delta(
395
config["approval_delay"])
396
self.approval_duration = string_to_delta(
397
config["approval_duration"])
535
398
self.changedstate = (multiprocessing_manager
536
399
.Condition(multiprocessing_manager
537
400
.Lock()))
538
self.client_structure = [attr for attr in
539
self.__dict__.iterkeys()
540
if not attr.startswith("_")]
401
self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]
541
402
self.client_structure.append("client_structure")
542
403
404
543
405
for name, t in inspect.getmembers(type(self),
544
lambda obj:
545
isinstance(obj,
546
property)):
406
lambda obj: isinstance(obj, property)):
547
407
if not name.startswith("_"):
548
408
self.client_structure.append(name)
549
409
585
445
586
446
def __del__(self):
587
447
self.disable()
588
448
589
449
def init_checker(self):
590
450
# Schedule a new checker to be started an 'interval' from now,
591
451
# and every interval from then on.
598
458
self.disable))
599
459
# Also start a new checker *right now*.
600
460
self.start_checker()
601
461
462
602
463
def checker_callback(self, pid, condition, command):
603
464
"""The checker has completed, so take appropriate actions."""
604
465
self.checker_callback_tag = None
605
466
self.checker = None
606
467
if os.WIFEXITED(condition):
607
self.last_checker_status = os.WEXITSTATUS(condition)
468
self.last_checker_status = os.WEXITSTATUS(condition)
608
469
if self.last_checker_status == 0:
609
470
logger.info("Checker for %(name)s succeeded",
610
471
vars(self))
630
491
gobject.source_remove(self.disable_initiator_tag)
631
492
if getattr(self, "enabled", False):
632
493
self.disable_initiator_tag = (gobject.timeout_add
633
(timedelta_to_milliseconds
494
(_timedelta_to_milliseconds
634
495
(timeout), self.disable))
635
496
self.expires = datetime.datetime.utcnow() + timeout
636
497
730
591
raise
731
592
self.checker = None
732
593
594
# Encrypts a client secret and stores it in a varible encrypted_secret
595
def encrypt_secret(self, key):
596
# Encryption-key need to be of a specific size, so we hash inputed key
597
hasheng = hashlib.sha256()
598
hasheng.update(key)
599
encryptionkey = hasheng.digest()
600
601
# Create validation hash so we know at decryption if it was sucessful
602
hasheng = hashlib.sha256()
603
hasheng.update(self.secret)
604
validationhash = hasheng.digest()
605
606
# Encrypt secret
607
iv = os.urandom(Crypto.Cipher.AES.block_size)
608
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
609
Crypto.Cipher.AES.MODE_CFB, iv)
610
ciphertext = ciphereng.encrypt(validationhash+self.secret)
611
self.encrypted_secret = (ciphertext, iv)
612
613
# Decrypt a encrypted client secret
614
def decrypt_secret(self, key):
615
# Decryption-key need to be of a specific size, so we hash inputed key
616
hasheng = hashlib.sha256()
617
hasheng.update(key)
618
encryptionkey = hasheng.digest()
619
620
# Decrypt encrypted secret
621
ciphertext, iv = self.encrypted_secret
622
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
623
Crypto.Cipher.AES.MODE_CFB, iv)
624
plain = ciphereng.decrypt(ciphertext)
625
626
# Validate decrypted secret to know if it was succesful
627
hasheng = hashlib.sha256()
628
validationhash = plain[:hasheng.digest_size]
629
secret = plain[hasheng.digest_size:]
630
hasheng.update(secret)
631
632
# if validation fails, we use key as new secret. Otherwhise, we use
633
# the decrypted secret
634
if hasheng.digest() == validationhash:
635
self.secret = secret
636
else:
637
self.secret = key
638
del self.encrypted_secret
639
733
640
734
641
def dbus_service_property(dbus_interface, signature="v",
735
642
access="readwrite", byte_arrays=False):
853
760
854
761
Note: Will not include properties with access="write".
855
762
"""
856
properties = {}
763
all = {}
857
764
for name, prop in self._get_all_dbus_properties():
858
765
if (interface_name
859
766
and interface_name != prop._dbus_interface):
864
771
continue
865
772
value = prop()
866
773
if not hasattr(value, "variant_level"):
867
properties[name] = value
774
all[name] = value
868
775
continue
869
properties[name] = type(value)(value, variant_level=
870
value.variant_level+1)
871
return dbus.Dictionary(properties, signature="sv")
776
all[name] = type(value)(value, variant_level=
777
value.variant_level+1)
778
return dbus.Dictionary(all, signature="sv")
872
779
873
780
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
874
781
out_signature="s",
925
832
return dbus.String(dt.isoformat(),
926
833
variant_level=variant_level)
927
834
928
929
835
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
930
836
.__metaclass__):
931
837
"""Applied to an empty subclass of a D-Bus object, this metaclass
1023
929
attribute.func_closure)))
1024
930
return type.__new__(mcs, name, bases, attr)
1025
931
1026
1027
932
class ClientDBus(Client, DBusObjectWithProperties):
1028
933
"""A Client class using D-Bus
1029
934
1040
945
def __init__(self, bus = None, *args, **kwargs):
1041
946
self.bus = bus
1042
947
Client.__init__(self, *args, **kwargs)
1043
self._approvals_pending = 0
1044
948
1045
949
self._approvals_pending = 0
1046
950
# Only now, when this client is initialized, can it show up on
1047
951
# the D-Bus
1058
962
variant_level=1):
1059
963
""" Modify a variable so that it's a property which announces
1060
964
its changes to DBus.
1061
965
1062
966
transform_fun: Function that takes a value and a variant_level
1063
967
and transforms it to a D-Bus type.
1064
968
dbus_name: D-Bus name of the variable
1098
1002
datetime_to_dbus, "LastApprovalRequest")
1099
1003
approved_by_default = notifychangeproperty(dbus.Boolean,
1100
1004
"ApprovedByDefault")
1101
approval_delay = notifychangeproperty(dbus.UInt64,
1005
approval_delay = notifychangeproperty(dbus.UInt16,
1102
1006
"ApprovalDelay",
1103
1007
type_func =
1104
timedelta_to_milliseconds)
1008
_timedelta_to_milliseconds)
1105
1009
approval_duration = notifychangeproperty(
1106
dbus.UInt64, "ApprovalDuration",
1107
type_func = timedelta_to_milliseconds)
1010
dbus.UInt16, "ApprovalDuration",
1011
type_func = _timedelta_to_milliseconds)
1108
1012
host = notifychangeproperty(dbus.String, "Host")
1109
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1013
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1110
1014
type_func =
1111
timedelta_to_milliseconds)
1015
_timedelta_to_milliseconds)
1112
1016
extended_timeout = notifychangeproperty(
1113
dbus.UInt64, "ExtendedTimeout",
1114
type_func = timedelta_to_milliseconds)
1115
interval = notifychangeproperty(dbus.UInt64,
1017
dbus.UInt16, "ExtendedTimeout",
1018
type_func = _timedelta_to_milliseconds)
1019
interval = notifychangeproperty(dbus.UInt16,
1116
1020
"Interval",
1117
1021
type_func =
1118
timedelta_to_milliseconds)
1022
_timedelta_to_milliseconds)
1119
1023
checker_command = notifychangeproperty(dbus.String, "Checker")
1120
1024
1121
1025
del notifychangeproperty
1163
1067
return r
1164
1068
1165
1069
def _reset_approved(self):
1166
self.approved = None
1070
self._approved = None
1167
1071
return False
1168
1072
1169
1073
def approve(self, value=True):
1170
1074
self.send_changedstate()
1171
self.approved = value
1172
gobject.timeout_add(timedelta_to_milliseconds
1075
self._approved = value
1076
gobject.timeout_add(_timedelta_to_milliseconds
1173
1077
(self.approval_duration),
1174
1078
self._reset_approved)
1175
1079
1225
1129
Is sent after a client request a password.
1226
1130
"""
1227
1131
pass
1228
1132
1229
1133
## Methods
1230
1134
1231
1135
# Approve - method
1289
1193
access="readwrite")
1290
1194
def ApprovalDuration_dbus_property(self, value=None):
1291
1195
if value is None: # get
1292
return dbus.UInt64(timedelta_to_milliseconds(
1196
return dbus.UInt64(_timedelta_to_milliseconds(
1293
1197
self.approval_duration))
1294
1198
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1295
1199
1309
1213
def Host_dbus_property(self, value=None):
1310
1214
if value is None: # get
1311
1215
return dbus.String(self.host)
1312
self.host = unicode(value)
1216
self.host = value
1313
1217
1314
1218
# Created - property
1315
1219
@dbus_service_property(_interface, signature="s", access="read")
1316
1220
def Created_dbus_property(self):
1317
return datetime_to_dbus(self.created)
1221
return dbus.String(datetime_to_dbus(self.created))
1318
1222
1319
1223
# LastEnabled - property
1320
1224
@dbus_service_property(_interface, signature="s", access="read")
1364
1268
gobject.source_remove(self.disable_initiator_tag)
1365
1269
self.disable_initiator_tag = None
1366
1270
self.expires = None
1367
time_to_die = timedelta_to_milliseconds((self
1368
.last_checked_ok
1369
+ self.timeout)
1370
- datetime.datetime
1371
.utcnow())
1271
time_to_die = _timedelta_to_milliseconds((self
1272
.last_checked_ok
1273
+ self.timeout)
1274
- datetime.datetime
1275
.utcnow())
1372
1276
if time_to_die <= 0:
1373
1277
# The timeout has passed
1374
1278
self.disable()
1396
1300
self.interval = datetime.timedelta(0, 0, 0, value)
1397
1301
if getattr(self, "checker_initiator_tag", None) is None:
1398
1302
return
1399
if self.enabled:
1400
# Reschedule checker run
1401
gobject.source_remove(self.checker_initiator_tag)
1402
self.checker_initiator_tag = (gobject.timeout_add
1403
(value, self.start_checker))
1404
self.start_checker() # Start one now, too
1303
# Reschedule checker run
1304
gobject.source_remove(self.checker_initiator_tag)
1305
self.checker_initiator_tag = (gobject.timeout_add
1306
(value, self.start_checker))
1307
self.start_checker() # Start one now, too
1405
1308
1406
1309
# Checker - property
1407
1310
@dbus_service_property(_interface, signature="s",
1409
1312
def Checker_dbus_property(self, value=None):
1410
1313
if value is None: # get
1411
1314
return dbus.String(self.checker_command)
1412
self.checker_command = unicode(value)
1315
self.checker_command = value
1413
1316
1414
1317
# CheckerRunning - property
1415
1318
@dbus_service_property(_interface, signature="b",
1444
1347
raise KeyError()
1445
1348
1446
1349
def __getattribute__(self, name):
1447
if name == '_pipe':
1350
if(name == '_pipe'):
1448
1351
return super(ProxyClient, self).__getattribute__(name)
1449
1352
self._pipe.send(('getattr', name))
1450
1353
data = self._pipe.recv()
1457
1360
return func
1458
1361
1459
1362
def __setattr__(self, name, value):
1460
if name == '_pipe':
1363
if(name == '_pipe'):
1461
1364
return super(ProxyClient, self).__setattr__(name, value)
1462
1365
self._pipe.send(('setattr', name, value))
1463
1366
1464
1465
1367
class ClientDBusTransitional(ClientDBus):
1466
1368
__metaclass__ = AlternateDBusNamesMetaclass
1467
1369
1468
1469
1370
class ClientHandler(socketserver.BaseRequestHandler, object):
1470
1371
"""A class to handle client connections.
1471
1372
1532
1433
logger.warning("Bad certificate: %s", error)
1533
1434
return
1534
1435
logger.debug("Fingerprint: %s", fpr)
1436
if self.server.use_dbus:
1437
# Emit D-Bus signal
1438
client.NewRequest(str(self.client_address))
1535
1439
1536
1440
try:
1537
1441
client = ProxyClient(child_pipe, fpr,
1539
1443
except KeyError:
1540
1444
return
1541
1445
1542
if self.server.use_dbus:
1543
# Emit D-Bus signal
1544
client.NewRequest(str(self.client_address))
1545
1546
1446
if client.approval_delay:
1547
1447
delay = client.approval_delay
1548
1448
client.approvals_pending += 1
1557
1457
client.Rejected("Disabled")
1558
1458
return
1559
1459
1560
if client.approved or not client.approval_delay:
1460
if client._approved or not client.approval_delay:
1561
1461
#We are approved or approval is disabled
1562
1462
break
1563
elif client.approved is None:
1463
elif client._approved is None:
1564
1464
logger.info("Client %s needs approval",
1565
1465
client.name)
1566
1466
if self.server.use_dbus:
1580
1480
time = datetime.datetime.now()
1581
1481
client.changedstate.acquire()
1582
1482
(client.changedstate.wait
1583
(float(client.timedelta_to_milliseconds(delay)
1483
(float(client._timedelta_to_milliseconds(delay)
1584
1484
/ 1000)))
1585
1485
client.changedstate.release()
1586
1486
time2 = datetime.datetime.now()
1685
1585
# Convert the buffer to a Python bytestring
1686
1586
fpr = ctypes.string_at(buf, buf_len.value)
1687
1587
# Convert the bytestring to hexadecimal notation
1688
hex_fpr = binascii.hexlify(fpr).upper()
1588
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1689
1589
return hex_fpr
1690
1590
1691
1591
1694
1594
def sub_process_main(self, request, address):
1695
1595
try:
1696
1596
self.finish_request(request, address)
1697
except Exception:
1597
except:
1698
1598
self.handle_error(request, address)
1699
1599
self.close_request(request)
1700
1600
1948
1848
return timevalue
1949
1849
1950
1850
1851
def if_nametoindex(interface):
1852
"""Call the C function if_nametoindex(), or equivalent
1853
1854
Note: This function cannot accept a unicode string."""
1855
global if_nametoindex
1856
try:
1857
if_nametoindex = (ctypes.cdll.LoadLibrary
1858
(ctypes.util.find_library("c"))
1859
.if_nametoindex)
1860
except (OSError, AttributeError):
1861
logger.warning("Doing if_nametoindex the hard way")
1862
def if_nametoindex(interface):
1863
"Get an interface index the hard way, i.e. using fcntl()"
1864
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1865
with contextlib.closing(socket.socket()) as s:
1866
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1867
struct.pack(str("16s16x"),
1868
interface))
1869
interface_index = struct.unpack(str("I"),
1870
ifreq[16:20])[0]
1871
return interface_index
1872
return if_nametoindex(interface)
1873
1874
1951
1875
def daemon(nochdir = False, noclose = False):
1952
1876
"""See daemon(3). Standard BSD Unix function.
1953
1877
2009
1933
parser.add_argument("--no-ipv6", action="store_false",
2010
1934
dest="use_ipv6", help="Do not use IPv6")
2011
1935
parser.add_argument("--no-restore", action="store_false",
2012
dest="restore", help="Do not restore stored"
2013
" state")
2014
parser.add_argument("--statedir", metavar="DIR",
2015
help="Directory to save/restore state in")
2016
1936
dest="restore", help="Do not restore stored state",
1937
default=True)
1938
2017
1939
options = parser.parse_args()
2018
1940
2019
1941
if options.check:
2032
1954
"use_dbus": "True",
2033
1955
"use_ipv6": "True",
2034
1956
"debuglevel": "",
2035
"restore": "True",
2036
"statedir": "/var/lib/mandos"
2037
1957
}
2038
1958
2039
1959
# Parse config file for server-global settings
2056
1976
# options, if set.
2057
1977
for option in ("interface", "address", "port", "debug",
2058
1978
"priority", "servicename", "configdir",
2059
"use_dbus", "use_ipv6", "debuglevel", "restore",
2060
"statedir"):
1979
"use_dbus", "use_ipv6", "debuglevel", "restore"):
2061
1980
value = getattr(options, option)
2062
1981
if value is not None:
2063
1982
server_settings[option] = value
2075
1994
debuglevel = server_settings["debuglevel"]
2076
1995
use_dbus = server_settings["use_dbus"]
2077
1996
use_ipv6 = server_settings["use_ipv6"]
2078
stored_state_path = os.path.join(server_settings["statedir"],
2079
stored_state_file)
2080
2081
if debug:
2082
initlogger(debug, logging.DEBUG)
2083
else:
2084
if not debuglevel:
2085
initlogger(debug)
2086
else:
2087
level = getattr(logging, debuglevel.upper())
2088
initlogger(debug, level)
2089
1997
2090
1998
if server_settings["servicename"] != "Mandos":
2091
1999
syslogger.setFormatter(logging.Formatter
2094
2002
% server_settings["servicename"]))
2095
2003
2096
2004
# Parse config file with clients
2097
client_config = configparser.SafeConfigParser(Client.client_defaults)
2005
client_defaults = { "timeout": "5m",
2006
"extended_timeout": "15m",
2007
"interval": "2m",
2008
"checker": "fping -q -- %%(host)s",
2009
"host": "",
2010
"approval_delay": "0s",
2011
"approval_duration": "1s",
2012
}
2013
client_config = configparser.SafeConfigParser(client_defaults)
2098
2014
client_config.read(os.path.join(server_settings["configdir"],
2099
2015
"clients.conf"))
2100
2016
2138
2054
if error[0] != errno.EPERM:
2139
2055
raise error
2140
2056
2057
if not debug and not debuglevel:
2058
logger.setLevel(logging.WARNING)
2059
if debuglevel:
2060
level = getattr(logging, debuglevel.upper())
2061
logger.setLevel(level)
2062
2141
2063
if debug:
2064
logger.setLevel(logging.DEBUG)
2142
2065
# Enable all possible GnuTLS debugging
2143
2066
2144
2067
# "Use a log level over 10 to enable all debugging options."
2157
2080
os.dup2(null, sys.stdin.fileno())
2158
2081
if null > 2:
2159
2082
os.close(null)
2083
else:
2084
# No console logging
2085
logger.removeHandler(console)
2160
2086
2161
2087
# Need to fork before connecting to D-Bus
2162
2088
if not debug:
2163
2089
# Close all input and output, do double fork, etc.
2164
2090
daemon()
2165
2091
2166
gobject.threads_init()
2167
2168
2092
global main_loop
2169
2093
# From the Avahi example code
2170
2094
DBusGMainLoop(set_as_default=True )
2200
2124
client_class = functools.partial(ClientDBusTransitional,
2201
2125
bus = bus)
2202
2126
2203
client_settings = Client.config_parser(client_config)
2127
special_settings = {
2128
# Some settings need to be accessd by special methods;
2129
# booleans need .getboolean(), etc. Here is a list of them:
2130
"approved_by_default":
2131
lambda section:
2132
client_config.getboolean(section, "approved_by_default"),
2133
}
2134
# Construct a new dict of client settings of this form:
2135
# { client_name: {setting_name: value, ...}, ...}
2136
# with exceptions for any special settings as defined above
2137
client_settings = dict((clientname,
2138
dict((setting,
2139
(value if setting not in special_settings
2140
else special_settings[setting](clientname)))
2141
for setting, value in client_config.items(clientname)))
2142
for clientname in client_config.sections())
2143
2204
2144
old_client_settings = {}
2205
clients_data = {}
2206
2207
# Get client data and settings from last running state.
2145
clients_data = []
2146
2147
# Get client data and settings from last running state.
2208
2148
if server_settings["restore"]:
2209
2149
try:
2210
2150
with open(stored_state_path, "rb") as stored_state:
2211
clients_data, old_client_settings = (pickle.load
2212
(stored_state))
2151
clients_data, old_client_settings = pickle.load(stored_state)
2213
2152
os.remove(stored_state_path)
2214
2153
except IOError as e:
2215
logger.warning("Could not load persistent state: {0}"
2216
.format(e))
2154
logger.warning("Could not load persistant state: {0}".format(e))
2217
2155
if e.errno != errno.ENOENT:
2218
2156
raise
2219
except EOFError as e:
2220
logger.warning("Could not load persistent state: "
2221
"EOFError: {0}".format(e))
2222
2223
with PGPEngine() as pgp:
2224
for client_name, client in clients_data.iteritems():
2225
# Decide which value to use after restoring saved state.
2226
# We have three different values: Old config file,
2227
# new config file, and saved state.
2228
# New config value takes precedence if it differs from old
2229
# config value, otherwise use saved state.
2230
for name, value in client_settings[client_name].items():
2231
try:
2232
# For each value in new config, check if it
2233
# differs from the old config value (Except for
2234
# the "secret" attribute)
2235
if (name != "secret" and
2236
value != old_client_settings[client_name]
2237
[name]):
2238
client[name] = value
2239
except KeyError:
2240
pass
2241
2242
# Clients who has passed its expire date can still be
2243
# enabled if its last checker was successful. Clients
2244
# whose checker failed before we stored its state is
2245
# assumed to have failed all checkers during downtime.
2246
if client["enabled"]:
2247
if datetime.datetime.utcnow() >= client["expires"]:
2248
if not client["last_checked_ok"]:
2249
logger.warning(
2250
"disabling client {0} - Client never "
2251
"performed a successfull checker"
2252
.format(client["name"]))
2253
client["enabled"] = False
2254
elif client["last_checker_status"] != 0:
2255
logger.warning(
2256
"disabling client {0} - Client "
2257
"last checker failed with error code {1}"
2258
.format(client["name"],
2259
client["last_checker_status"]))
2260
client["enabled"] = False
2261
else:
2262
client["expires"] = (datetime.datetime
2263
.utcnow()
2264
+ client["timeout"])
2265
2157
2158
for client in clients_data:
2159
client_name = client["name"]
2160
2161
# Decide which value to use after restoring saved state.
2162
# We have three different values: Old config file,
2163
# new config file, and saved state.
2164
# New config value takes precedence if it differs from old
2165
# config value, otherwise use saved state.
2166
for name, value in client_settings[client_name].items():
2266
2167
try:
2267
client["secret"] = (
2268
pgp.decrypt(client["encrypted_secret"],
2269
client_settings[client_name]
2270
["secret"]))
2271
except PGPError:
2272
# If decryption fails, we use secret from new settings
2273
logger.debug("Failed to decrypt {0} old secret"
2274
.format(client_name))
2275
client["secret"] = (
2276
client_settings[client_name]["secret"])
2277
2278
2279
# Add/remove clients based on new changes made to config
2280
for client_name in set(old_client_settings) - set(client_settings):
2281
del clients_data[client_name]
2282
for client_name in set(client_settings) - set(old_client_settings):
2283
clients_data[client_name] = client_settings[client_name]
2284
2285
# Create clients all clients
2286
for client_name, client in clients_data.iteritems():
2287
tcp_server.clients[client_name] = client_class(
2288
name = client_name, settings = client)
2289
2168
# For each value in new config, check if it differs
2169
# from the old config value (Except for the "secret"
2170
# attribute)
2171
if name != "secret" and value != old_client_settings[client_name][name]:
2172
setattr(client, name, value)
2173
except KeyError:
2174
pass
2175
2176
# Clients who has passed its expire date, can still be enabled if its
2177
# last checker was sucessful. Clients who checkers failed before we
2178
# stored it state is asumed to had failed checker during downtime.
2179
if client["enabled"] and client["last_checked_ok"]:
2180
if ((datetime.datetime.utcnow() - client["last_checked_ok"])
2181
> client["interval"]):
2182
if client["last_checker_status"] != 0:
2183
client["enabled"] = False
2184
else:
2185
client["expires"] = datetime.datetime.utcnow() + client["timeout"]
2186
2187
client["changedstate"] = (multiprocessing_manager
2188
.Condition(multiprocessing_manager
2189
.Lock()))
2190
if use_dbus:
2191
new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)
2192
tcp_server.clients[client_name] = new_client
2193
new_client.bus = bus
2194
for name, value in client.iteritems():
2195
setattr(new_client, name, value)
2196
client_object_name = unicode(client_name).translate(
2197
{ord("."): ord("_"),
2198
ord("-"): ord("_")})
2199
new_client.dbus_object_path = (dbus.ObjectPath
2200
("/clients/" + client_object_name))
2201
DBusObjectWithProperties.__init__(new_client,
2202
new_client.bus,
2203
new_client.dbus_object_path)
2204
else:
2205
tcp_server.clients[client_name] = Client.__new__(Client)
2206
for name, value in client.iteritems():
2207
setattr(tcp_server.clients[client_name], name, value)
2208
2209
tcp_server.clients[client_name].decrypt_secret(
2210
client_settings[client_name]["secret"])
2211
2212
# Create/remove clients based on new changes made to config
2213
for clientname in set(old_client_settings) - set(client_settings):
2214
del tcp_server.clients[clientname]
2215
for clientname in set(client_settings) - set(old_client_settings):
2216
tcp_server.clients[clientname] = (client_class(name = clientname,
2217
config =
2218
client_settings
2219
[clientname]))
2220
2221
2290
2222
if not tcp_server.clients:
2291
2223
logger.warning("No clients defined")
2292
2224
2303
2235
# "pidfile" was never created
2304
2236
pass
2305
2237
del pidfilename
2238
2306
2239
signal.signal(signal.SIGINT, signal.SIG_IGN)
2307
2240
2308
2241
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2373
2306
multiprocessing.active_children()
2374
2307
if not (tcp_server.clients or client_settings):
2375
2308
return
2376
2377
# Store client before exiting. Secrets are encrypted with key
2378
# based on what config file has. If config file is
2379
# removed/edited, old secret will thus be unrecovable.
2380
clients = {}
2381
with PGPEngine() as pgp:
2382
for client in tcp_server.clients.itervalues():
2383
key = client_settings[client.name]["secret"]
2384
client.encrypted_secret = pgp.encrypt(client.secret,
2385
key)
2386
client_dict = {}
2387
2388
# A list of attributes that can not be pickled
2389
# + secret.
2390
exclude = set(("bus", "changedstate", "secret",
2391
"checker"))
2392
for name, typ in (inspect.getmembers
2393
(dbus.service.Object)):
2394
exclude.add(name)
2395
2396
client_dict["encrypted_secret"] = (client
2397
.encrypted_secret)
2398
for attr in client.client_structure:
2399
if attr not in exclude:
2400
client_dict[attr] = getattr(client, attr)
2401
2402
clients[client.name] = client_dict
2403
del client_settings[client.name]["secret"]
2404
2309
2310
# Store client before exiting. Secrets are encrypted with key based
2311
# on what config file has. If config file is removed/edited, old
2312
# secret will thus be unrecovable.
2313
clients = []
2314
for client in tcp_server.clients.itervalues():
2315
client.encrypt_secret(client_settings[client.name]["secret"])
2316
2317
client_dict = {}
2318
2319
# A list of attributes that will not be stored when shuting down.
2320
exclude = set(("bus", "changedstate", "secret"))
2321
for name, typ in inspect.getmembers(dbus.service.Object):
2322
exclude.add(name)
2323
2324
client_dict["encrypted_secret"] = client.encrypted_secret
2325
for attr in client.client_structure:
2326
if attr not in exclude:
2327
client_dict[attr] = getattr(client, attr)
2328
2329
clients.append(client_dict)
2330
del client_settings[client.name]["secret"]
2331
2405
2332
try:
2406
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2407
prefix="clients-",
2408
dir=os.path.dirname
2409
(stored_state_path))
2410
with os.fdopen(tempfd, "wb") as stored_state:
2333
with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:
2411
2334
pickle.dump((clients, client_settings), stored_state)
2412
os.rename(tempname, stored_state_path)
2413
except (IOError, OSError) as e:
2414
logger.warning("Could not save persistent state: {0}"
2415
.format(e))
2416
if not debug:
2417
try:
2418
os.remove(tempname)
2419
except NameError:
2420
pass
2421
if e.errno not in set((errno.ENOENT, errno.EACCES,
2422
errno.EEXIST)):
2423
raise e
2424
2335
except IOError as e:
2336
logger.warning("Could not save persistant state: {0}".format(e))
2337
if e.errno != errno.ENOENT:
2338
raise
2339
2425
2340
# Delete all clients, and settings from config
2426
2341
while tcp_server.clients:
2427
2342
name, client = tcp_server.clients.popitem()
2445
2360
# Need to initiate checking of clients
2446
2361
if client.enabled:
2447
2362
client.init_checker()
2363
2448
2364
2449
2365
tcp_server.enable()
2450
2366
tcp_server.server_activate()
2490
2406
# Must run before the D-Bus bus name gets deregistered
2491
2407
cleanup()
2492
2408
2409
2493
2410
if __name__ == '__main__':
2494
2411
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0