/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

merge

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
 
import hashlib
 
66
import binascii
 
67
import tempfile
67
68
 
68
69
import dbus
69
70
import dbus.service
74
75
import ctypes.util
75
76
import xml.dom.minidom
76
77
import inspect
77
 
import Crypto.Cipher.AES
 
78
import GnuPGInterface
78
79
 
79
80
try:
80
81
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
86
87
 
87
88
 
88
89
version = "1.4.1"
89
 
stored_state_path = "/var/lib/mandos/clients.pickle"
 
90
stored_state_file = "clients.pickle"
90
91
 
91
92
logger = logging.getLogger()
92
93
syslogger = (logging.handlers.SysLogHandler
127
128
    logger.setLevel(level)
128
129
 
129
130
 
 
131
class CryptoError(Exception):
 
132
    pass
 
133
 
 
134
 
 
135
class Crypto(object):
 
136
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
137
    def __init__(self):
 
138
        self.gnupg = GnuPGInterface.GnuPG()
 
139
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
140
        self.gnupg = GnuPGInterface.GnuPG()
 
141
        self.gnupg.options.meta_interactive = False
 
142
        self.gnupg.options.homedir = self.tempdir
 
143
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
144
                                              '--quiet'])
 
145
    
 
146
    def __enter__(self):
 
147
        return self
 
148
    
 
149
    def __exit__ (self, exc_type, exc_value, traceback):
 
150
        self._cleanup()
 
151
        return False
 
152
    
 
153
    def __del__(self):
 
154
        self._cleanup()
 
155
    
 
156
    def _cleanup(self):
 
157
        if self.tempdir is not None:
 
158
            # Delete contents of tempdir
 
159
            for root, dirs, files in os.walk(self.tempdir,
 
160
                                             topdown = False):
 
161
                for filename in files:
 
162
                    os.remove(os.path.join(root, filename))
 
163
                for dirname in dirs:
 
164
                    os.rmdir(os.path.join(root, dirname))
 
165
            # Remove tempdir
 
166
            os.rmdir(self.tempdir)
 
167
            self.tempdir = None
 
168
    
 
169
    def password_encode(self, password):
 
170
        # Passphrase can not be empty and can not contain newlines or
 
171
        # NUL bytes.  So we prefix it and hex encode it.
 
172
        return b"mandos" + binascii.hexlify(password)
 
173
    
 
174
    def encrypt(self, data, password):
 
175
        self.gnupg.passphrase = self.password_encode(password)
 
176
        with open(os.devnull) as devnull:
 
177
            try:
 
178
                proc = self.gnupg.run(['--symmetric'],
 
179
                                      create_fhs=['stdin', 'stdout'],
 
180
                                      attach_fhs={'stderr': devnull})
 
181
                with contextlib.closing(proc.handles['stdin']) as f:
 
182
                    f.write(data)
 
183
                with contextlib.closing(proc.handles['stdout']) as f:
 
184
                    ciphertext = f.read()
 
185
                proc.wait()
 
186
            except IOError as e:
 
187
                raise CryptoError(e)
 
188
        self.gnupg.passphrase = None
 
189
        return ciphertext
 
190
    
 
191
    def decrypt(self, data, password):
 
192
        self.gnupg.passphrase = self.password_encode(password)
 
193
        with open(os.devnull) as devnull:
 
194
            try:
 
195
                proc = self.gnupg.run(['--decrypt'],
 
196
                                      create_fhs=['stdin', 'stdout'],
 
197
                                      attach_fhs={'stderr': devnull})
 
198
                with contextlib.closing(proc.handles['stdin'] ) as f:
 
199
                    f.write(data)
 
200
                with contextlib.closing(proc.handles['stdout']) as f:
 
201
                    decrypted_plaintext = f.read()
 
202
                proc.wait()
 
203
            except IOError as e:
 
204
                raise CryptoError(e)
 
205
        self.gnupg.passphrase = None
 
206
        return decrypted_plaintext
 
207
 
 
208
 
 
209
 
130
210
class AvahiError(Exception):
131
211
    def __init__(self, value, *args, **kwargs):
132
212
        self.value = value
335
415
    last_checker_status: integer between 0 and 255 reflecting exit
336
416
                         status of last checker. -1 reflects crashed
337
417
                         checker, or None.
338
 
    last_enabled: datetime.datetime(); (UTC)
 
418
    last_enabled: datetime.datetime(); (UTC) or None
339
419
    name:       string; from the config file, used in log messages and
340
420
                        D-Bus identifiers
341
421
    secret:     bytestring; sent verbatim (over TLS) to client
393
473
                            % self.name)
394
474
        self.host = config.get("host", "")
395
475
        self.created = datetime.datetime.utcnow()
396
 
        self.enabled = True
 
476
        self.enabled = config.get("enabled", True)
397
477
        self.last_approval_request = None
398
 
        self.last_enabled = datetime.datetime.utcnow()
 
478
        if self.enabled:
 
479
            self.last_enabled = datetime.datetime.utcnow()
 
480
        else:
 
481
            self.last_enabled = None
399
482
        self.last_checked_ok = None
400
483
        self.last_checker_status = None
401
484
        self.timeout = string_to_delta(config["timeout"])
405
488
        self.checker = None
406
489
        self.checker_initiator_tag = None
407
490
        self.disable_initiator_tag = None
408
 
        self.expires = datetime.datetime.utcnow() + self.timeout
 
491
        if self.enabled:
 
492
            self.expires = datetime.datetime.utcnow() + self.timeout
 
493
        else:
 
494
            self.expires = None
409
495
        self.checker_callback_tag = None
410
496
        self.checker_command = config["checker"]
411
497
        self.current_checker_command = None
614
700
            if error.errno != errno.ESRCH: # No such process
615
701
                raise
616
702
        self.checker = None
617
 
    
618
 
    # Encrypts a client secret and stores it in a varible
619
 
    # encrypted_secret
620
 
    def encrypt_secret(self, key):
621
 
        # Encryption-key need to be of a specific size, so we hash
622
 
        # inputed key
623
 
        hasheng = hashlib.sha256()
624
 
        hasheng.update(key)
625
 
        encryptionkey = hasheng.digest()
626
 
        
627
 
        # Create validation hash so we know at decryption if it was
628
 
        # sucessful
629
 
        hasheng = hashlib.sha256()
630
 
        hasheng.update(self.secret)
631
 
        validationhash = hasheng.digest()
632
 
        
633
 
        # Encrypt secret
634
 
        iv = os.urandom(Crypto.Cipher.AES.block_size)
635
 
        ciphereng = Crypto.Cipher.AES.new(encryptionkey,
636
 
                                        Crypto.Cipher.AES.MODE_CFB,
637
 
                                          iv)
638
 
        ciphertext = ciphereng.encrypt(validationhash+self.secret)
639
 
        self.encrypted_secret = (ciphertext, iv)
640
 
    
641
 
    # Decrypt a encrypted client secret
642
 
    def decrypt_secret(self, key):
643
 
        # Decryption-key need to be of a specific size, so we hash inputed key
644
 
        hasheng = hashlib.sha256()
645
 
        hasheng.update(key)
646
 
        encryptionkey = hasheng.digest()
647
 
        
648
 
        # Decrypt encrypted secret
649
 
        ciphertext, iv = self.encrypted_secret
650
 
        ciphereng = Crypto.Cipher.AES.new(encryptionkey,
651
 
                                        Crypto.Cipher.AES.MODE_CFB,
652
 
                                          iv)
653
 
        plain = ciphereng.decrypt(ciphertext)
654
 
        
655
 
        # Validate decrypted secret to know if it was succesful
656
 
        hasheng = hashlib.sha256()
657
 
        validationhash = plain[:hasheng.digest_size]
658
 
        secret = plain[hasheng.digest_size:]
659
 
        hasheng.update(secret)
660
 
        
661
 
        # if validation fails, we use key as new secret. Otherwhise,
662
 
        # we use the decrypted secret
663
 
        if hasheng.digest() == validationhash:
664
 
            self.secret = secret
665
 
        else:
666
 
            self.secret = key
667
 
        del self.encrypted_secret
668
703
 
669
704
 
670
705
def dbus_service_property(dbus_interface, signature="v",
1249
1284
    # Created - property
1250
1285
    @dbus_service_property(_interface, signature="s", access="read")
1251
1286
    def Created_dbus_property(self):
1252
 
        return dbus.String(datetime_to_dbus(self.created))
 
1287
        return datetime_to_dbus(self.created)
1253
1288
    
1254
1289
    # LastEnabled - property
1255
1290
    @dbus_service_property(_interface, signature="s", access="read")
1331
1366
        self.interval = datetime.timedelta(0, 0, 0, value)
1332
1367
        if getattr(self, "checker_initiator_tag", None) is None:
1333
1368
            return
1334
 
        # Reschedule checker run
1335
 
        gobject.source_remove(self.checker_initiator_tag)
1336
 
        self.checker_initiator_tag = (gobject.timeout_add
1337
 
                                      (value, self.start_checker))
1338
 
        self.start_checker()    # Start one now, too
 
1369
        if self.enabled:
 
1370
            # Reschedule checker run
 
1371
            gobject.source_remove(self.checker_initiator_tag)
 
1372
            self.checker_initiator_tag = (gobject.timeout_add
 
1373
                                          (value, self.start_checker))
 
1374
            self.start_checker()    # Start one now, too
1339
1375
    
1340
1376
    # Checker - property
1341
1377
    @dbus_service_property(_interface, signature="s",
1618
1654
        # Convert the buffer to a Python bytestring
1619
1655
        fpr = ctypes.string_at(buf, buf_len.value)
1620
1656
        # Convert the bytestring to hexadecimal notation
1621
 
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
1657
        hex_fpr = binascii.hexlify(fpr).upper()
1622
1658
        return hex_fpr
1623
1659
 
1624
1660
 
1943
1979
                        dest="use_ipv6", help="Do not use IPv6")
1944
1980
    parser.add_argument("--no-restore", action="store_false",
1945
1981
                        dest="restore", help="Do not restore stored"
1946
 
                        " state", default=True)
 
1982
                        " state")
 
1983
    parser.add_argument("--statedir", metavar="DIR",
 
1984
                        help="Directory to save/restore state in")
1947
1985
    
1948
1986
    options = parser.parse_args()
1949
1987
    
1963
2001
                        "use_dbus": "True",
1964
2002
                        "use_ipv6": "True",
1965
2003
                        "debuglevel": "",
 
2004
                        "restore": "True",
 
2005
                        "statedir": "/var/lib/mandos"
1966
2006
                        }
1967
2007
    
1968
2008
    # Parse config file for server-global settings
1985
2025
    # options, if set.
1986
2026
    for option in ("interface", "address", "port", "debug",
1987
2027
                   "priority", "servicename", "configdir",
1988
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore"):
 
2028
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2029
                   "statedir"):
1989
2030
        value = getattr(options, option)
1990
2031
        if value is not None:
1991
2032
            server_settings[option] = value
2003
2044
    debuglevel = server_settings["debuglevel"]
2004
2045
    use_dbus = server_settings["use_dbus"]
2005
2046
    use_ipv6 = server_settings["use_ipv6"]
 
2047
    stored_state_path = os.path.join(server_settings["statedir"],
 
2048
                                     stored_state_file)
2006
2049
    
2007
2050
    if debug:
2008
2051
        initlogger(logging.DEBUG)
2141
2184
        "approved_by_default":
2142
2185
            lambda section:
2143
2186
            client_config.getboolean(section, "approved_by_default"),
 
2187
        "enabled":
 
2188
            lambda section:
 
2189
            client_config.getboolean(section, "enabled"),
2144
2190
        }
2145
2191
    # Construct a new dict of client settings of this form:
2146
2192
    # { client_name: {setting_name: value, ...}, ...}
2166
2212
                                                     (stored_state))
2167
2213
            os.remove(stored_state_path)
2168
2214
        except IOError as e:
2169
 
            logger.warning("Could not load persistant state: {0}"
 
2215
            logger.warning("Could not load persistent state: {0}"
2170
2216
                           .format(e))
2171
2217
            if e.errno != errno.ENOENT:
2172
2218
                raise
2173
2219
    
2174
 
    for client in clients_data:
2175
 
        client_name = client["name"]
2176
 
        
2177
 
        # Decide which value to use after restoring saved state.
2178
 
        # We have three different values: Old config file,
2179
 
        # new config file, and saved state.
2180
 
        # New config value takes precedence if it differs from old
2181
 
        # config value, otherwise use saved state.
2182
 
        for name, value in client_settings[client_name].items():
 
2220
    with Crypto() as crypt:
 
2221
        for client in clients_data:
 
2222
            client_name = client["name"]
 
2223
            
 
2224
            # Decide which value to use after restoring saved state.
 
2225
            # We have three different values: Old config file,
 
2226
            # new config file, and saved state.
 
2227
            # New config value takes precedence if it differs from old
 
2228
            # config value, otherwise use saved state.
 
2229
            for name, value in client_settings[client_name].items():
 
2230
                try:
 
2231
                    # For each value in new config, check if it
 
2232
                    # differs from the old config value (Except for
 
2233
                    # the "secret" attribute)
 
2234
                    if (name != "secret" and
 
2235
                        value != old_client_settings[client_name]
 
2236
                        [name]):
 
2237
                        setattr(client, name, value)
 
2238
                except KeyError:
 
2239
                    pass
 
2240
            
 
2241
            # Clients who has passed its expire date can still be
 
2242
            # enabled if its last checker was sucessful.  Clients
 
2243
            # whose checker failed before we stored its state is
 
2244
            # assumed to have failed all checkers during downtime.
 
2245
            if client["enabled"] and client["last_checked_ok"]:
 
2246
                if ((datetime.datetime.utcnow()
 
2247
                     - client["last_checked_ok"])
 
2248
                    > client["interval"]):
 
2249
                    if client["last_checker_status"] != 0:
 
2250
                        client["enabled"] = False
 
2251
                    else:
 
2252
                        client["expires"] = (datetime.datetime
 
2253
                                             .utcnow()
 
2254
                                             + client["timeout"])
 
2255
            
 
2256
            client["changedstate"] = (multiprocessing_manager
 
2257
                                      .Condition
 
2258
                                      (multiprocessing_manager
 
2259
                                       .Lock()))
 
2260
            if use_dbus:
 
2261
                new_client = (ClientDBusTransitional.__new__
 
2262
                              (ClientDBusTransitional))
 
2263
                tcp_server.clients[client_name] = new_client
 
2264
                new_client.bus = bus
 
2265
                for name, value in client.iteritems():
 
2266
                    setattr(new_client, name, value)
 
2267
                client_object_name = unicode(client_name).translate(
 
2268
                    {ord("."): ord("_"),
 
2269
                     ord("-"): ord("_")})
 
2270
                new_client.dbus_object_path = (dbus.ObjectPath
 
2271
                                               ("/clients/"
 
2272
                                                + client_object_name))
 
2273
                DBusObjectWithProperties.__init__(new_client,
 
2274
                                                  new_client.bus,
 
2275
                                                  new_client
 
2276
                                                  .dbus_object_path)
 
2277
            else:
 
2278
                tcp_server.clients[client_name] = (Client.__new__
 
2279
                                                   (Client))
 
2280
                for name, value in client.iteritems():
 
2281
                    setattr(tcp_server.clients[client_name],
 
2282
                            name, value)
 
2283
            
2183
2284
            try:
2184
 
                # For each value in new config, check if it differs
2185
 
                # from the old config value (Except for the "secret"
2186
 
                # attribute)
2187
 
                if (name != "secret" and
2188
 
                    value != old_client_settings[client_name][name]):
2189
 
                    setattr(client, name, value)
2190
 
            except KeyError:
2191
 
                pass
2192
 
        
2193
 
        # Clients who has passed its expire date, can still be enabled
2194
 
        # if its last checker was sucessful. Clients who checkers
2195
 
        # failed before we stored it state is asumed to had failed
2196
 
        # checker during downtime.
2197
 
        if client["enabled"] and client["last_checked_ok"]:
2198
 
            if ((datetime.datetime.utcnow()
2199
 
                 - client["last_checked_ok"]) > client["interval"]):
2200
 
                if client["last_checker_status"] != 0:
2201
 
                    client["enabled"] = False
2202
 
                else:
2203
 
                    client["expires"] = (datetime.datetime.utcnow()
2204
 
                                         + client["timeout"])
2205
 
        
2206
 
        client["changedstate"] = (multiprocessing_manager
2207
 
                                  .Condition(multiprocessing_manager
2208
 
                                             .Lock()))
2209
 
        if use_dbus:
2210
 
            new_client = (ClientDBusTransitional.__new__
2211
 
                          (ClientDBusTransitional))
2212
 
            tcp_server.clients[client_name] = new_client
2213
 
            new_client.bus = bus
2214
 
            for name, value in client.iteritems():
2215
 
                setattr(new_client, name, value)
2216
 
            client_object_name = unicode(client_name).translate(
2217
 
                {ord("."): ord("_"),
2218
 
                 ord("-"): ord("_")})
2219
 
            new_client.dbus_object_path = (dbus.ObjectPath
2220
 
                                           ("/clients/"
2221
 
                                            + client_object_name))
2222
 
            DBusObjectWithProperties.__init__(new_client,
2223
 
                                              new_client.bus,
2224
 
                                              new_client
2225
 
                                              .dbus_object_path)
2226
 
        else:
2227
 
            tcp_server.clients[client_name] = Client.__new__(Client)
2228
 
            for name, value in client.iteritems():
2229
 
                setattr(tcp_server.clients[client_name], name, value)
2230
 
                
2231
 
        tcp_server.clients[client_name].decrypt_secret(
2232
 
            client_settings[client_name]["secret"])
2233
 
        
 
2285
                tcp_server.clients[client_name].secret = (
 
2286
                    crypt.decrypt(tcp_server.clients[client_name]
 
2287
                                  .encrypted_secret,
 
2288
                                  client_settings[client_name]
 
2289
                                  ["secret"]))
 
2290
            except CryptoError:
 
2291
                # If decryption fails, we use secret from new settings
 
2292
                tcp_server.clients[client_name].secret = (
 
2293
                    client_settings[client_name]["secret"])
 
2294
    
2234
2295
    # Create/remove clients based on new changes made to config
2235
2296
    for clientname in set(old_client_settings) - set(client_settings):
2236
2297
        del tcp_server.clients[clientname]
2333
2394
        # based on what config file has. If config file is
2334
2395
        # removed/edited, old secret will thus be unrecovable.
2335
2396
        clients = []
2336
 
        for client in tcp_server.clients.itervalues():
2337
 
            client.encrypt_secret(client_settings[client.name]
2338
 
                                  ["secret"])
2339
 
            
2340
 
            client_dict = {}
2341
 
            
2342
 
            # A list of attributes that will not be stored when
2343
 
            # shutting down.
2344
 
            exclude = set(("bus", "changedstate", "secret"))
2345
 
            for name, typ in inspect.getmembers(dbus.service.Object):
2346
 
                exclude.add(name)
2347
 
                
2348
 
            client_dict["encrypted_secret"] = client.encrypted_secret
2349
 
            for attr in client.client_structure:
2350
 
                if attr not in exclude:
2351
 
                    client_dict[attr] = getattr(client, attr)
2352
 
            
2353
 
            clients.append(client_dict)
2354
 
            del client_settings[client.name]["secret"]
2355
 
            
 
2397
        with Crypto() as crypt:
 
2398
            for client in tcp_server.clients.itervalues():
 
2399
                key = client_settings[client.name]["secret"]
 
2400
                client.encrypted_secret = crypt.encrypt(client.secret,
 
2401
                                                        key)
 
2402
                client_dict = {}
 
2403
                
 
2404
                # A list of attributes that will not be stored when
 
2405
                # shutting down.
 
2406
                exclude = set(("bus", "changedstate", "secret"))
 
2407
                for name, typ in (inspect.getmembers
 
2408
                                  (dbus.service.Object)):
 
2409
                    exclude.add(name)
 
2410
                
 
2411
                client_dict["encrypted_secret"] = (client
 
2412
                                                   .encrypted_secret)
 
2413
                for attr in client.client_structure:
 
2414
                    if attr not in exclude:
 
2415
                        client_dict[attr] = getattr(client, attr)
 
2416
                
 
2417
                clients.append(client_dict)
 
2418
                del client_settings[client.name]["secret"]
 
2419
        
2356
2420
        try:
2357
2421
            with os.fdopen(os.open(stored_state_path,
2358
2422
                                   os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2359
2423
                                   0600), "wb") as stored_state:
2360
2424
                pickle.dump((clients, client_settings), stored_state)
2361
 
        except IOError as e:
2362
 
            logger.warning("Could not save persistant state: {0}"
 
2425
        except (IOError, OSError) as e:
 
2426
            logger.warning("Could not save persistent state: {0}"
2363
2427
                           .format(e))
2364
 
            if e.errno != errno.ENOENT:
 
2428
            if e.errno not in (errno.ENOENT, errno.EACCES):
2365
2429
                raise
2366
2430
        
2367
2431
        # Delete all clients, and settings from config
2387
2451
        # Need to initiate checking of clients
2388
2452
        if client.enabled:
2389
2453
            client.init_checker()
2390
 
 
2391
2454
    
2392
2455
    tcp_server.enable()
2393
2456
    tcp_server.server_activate()