/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2011-11-26 20:59:56 UTC
  • mto: (518.1.8 mandos-persistent)
  • mto: This revision was merged to the branch mainline in revision 524.
  • Revision ID: teddy@recompile.se-20111126205956-vft6g0z2i6my0165
Use GPG to encrypt instead of AES.

* Makefile (run-server): Use "--no-restore" option.
* debian/control (mandos/Depends): Added "python-gnupginterface".
* mandos: (CryptoError, Crypto): New; uses GPG.
  (Client.encrypt_secret, Client.decrypt_secret): Removed.
  (ClientHandler.fingerprint): Use binascii.hexlify().
  (main): Use Crypto class to decrypt.
  (main/cleanup): Use Crypto class to encrypt.  Handle EACCES.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
 
import hashlib
 
66
import binascii
 
67
import tempfile
67
68
 
68
69
import dbus
69
70
import dbus.service
74
75
import ctypes.util
75
76
import xml.dom.minidom
76
77
import inspect
77
 
import Crypto.Cipher.AES
 
78
import GnuPGInterface
78
79
 
79
80
try:
80
81
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
127
128
    logger.setLevel(level)
128
129
 
129
130
 
 
131
class CryptoError(Exception):
 
132
    pass
 
133
 
 
134
 
 
135
class Crypto(object):
 
136
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
137
    def __init__(self):
 
138
        self.gnupg = GnuPGInterface.GnuPG()
 
139
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
140
        self.gnupg = GnuPGInterface.GnuPG()
 
141
        self.gnupg.options.meta_interactive = False
 
142
        self.gnupg.options.homedir = self.tempdir
 
143
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
144
                                              '--quiet'])
 
145
    
 
146
    def __enter__(self):
 
147
        return self
 
148
    
 
149
    def __exit__ (self, exc_type, exc_value, traceback):
 
150
        self._cleanup()
 
151
        return False
 
152
    
 
153
    def __del__(self):
 
154
        self._cleanup()
 
155
    
 
156
    def _cleanup(self):
 
157
        if self.tempdir is not None:
 
158
            # Delete contents of tempdir
 
159
            for root, dirs, files in os.walk(self.tempdir,
 
160
                                             topdown = False):
 
161
                for filename in files:
 
162
                    os.remove(os.path.join(root, filename))
 
163
                for dirname in dirs:
 
164
                    os.rmdir(os.path.join(root, dirname))
 
165
            # Remove tempdir
 
166
            os.rmdir(self.tempdir)
 
167
            self.tempdir = None
 
168
    
 
169
    def password_encode(self, password):
 
170
        # Passphrase can not be empty and can not contain newlines or
 
171
        # NUL bytes.  So we prefix it and hex encode it.
 
172
        return b"mandos" + binascii.hexlify(password)
 
173
    
 
174
    def encrypt(self, data, password):
 
175
        self.gnupg.passphrase = self.password_encode(password)
 
176
        with open(os.devnull) as devnull:
 
177
            try:
 
178
                proc = self.gnupg.run(['--symmetric'],
 
179
                                      create_fhs=['stdin', 'stdout'],
 
180
                                      attach_fhs={'stderr': devnull})
 
181
                with contextlib.closing(proc.handles['stdin']) as f:
 
182
                    f.write(data)
 
183
                with contextlib.closing(proc.handles['stdout']) as f:
 
184
                    ciphertext = f.read()
 
185
                proc.wait()
 
186
            except IOError as e:
 
187
                raise CryptoError(e)
 
188
        self.gnupg.passphrase = None
 
189
        return ciphertext
 
190
    
 
191
    def decrypt(self, data, password):
 
192
        self.gnupg.passphrase = self.password_encode(password)
 
193
        with open(os.devnull) as devnull:
 
194
            try:
 
195
                proc = self.gnupg.run(['--decrypt'],
 
196
                                      create_fhs=['stdin', 'stdout'],
 
197
                                      attach_fhs={'stderr': devnull})
 
198
                with contextlib.closing(proc.handles['stdin'] ) as f:
 
199
                    f.write(data)
 
200
                with contextlib.closing(proc.handles['stdout']) as f:
 
201
                    decrypted_plaintext = f.read()
 
202
                proc.wait()
 
203
            except IOError as e:
 
204
                raise CryptoError(e)
 
205
        self.gnupg.passphrase = None
 
206
        return decrypted_plaintext
 
207
 
 
208
 
 
209
 
130
210
class AvahiError(Exception):
131
211
    def __init__(self, value, *args, **kwargs):
132
212
        self.value = value
614
694
            if error.errno != errno.ESRCH: # No such process
615
695
                raise
616
696
        self.checker = None
617
 
    
618
 
    # Encrypts a client secret and stores it in a varible
619
 
    # encrypted_secret
620
 
    def encrypt_secret(self, key):
621
 
        # Encryption-key need to be of a specific size, so we hash
622
 
        # inputed key
623
 
        hasheng = hashlib.sha256()
624
 
        hasheng.update(key)
625
 
        encryptionkey = hasheng.digest()
626
 
        
627
 
        # Create validation hash so we know at decryption if it was
628
 
        # sucessful
629
 
        hasheng = hashlib.sha256()
630
 
        hasheng.update(self.secret)
631
 
        validationhash = hasheng.digest()
632
 
        
633
 
        # Encrypt secret
634
 
        iv = os.urandom(Crypto.Cipher.AES.block_size)
635
 
        ciphereng = Crypto.Cipher.AES.new(encryptionkey,
636
 
                                        Crypto.Cipher.AES.MODE_CFB,
637
 
                                          iv)
638
 
        ciphertext = ciphereng.encrypt(validationhash+self.secret)
639
 
        self.encrypted_secret = (ciphertext, iv)
640
 
    
641
 
    # Decrypt a encrypted client secret
642
 
    def decrypt_secret(self, key):
643
 
        # Decryption-key need to be of a specific size, so we hash inputed key
644
 
        hasheng = hashlib.sha256()
645
 
        hasheng.update(key)
646
 
        encryptionkey = hasheng.digest()
647
 
        
648
 
        # Decrypt encrypted secret
649
 
        ciphertext, iv = self.encrypted_secret
650
 
        ciphereng = Crypto.Cipher.AES.new(encryptionkey,
651
 
                                        Crypto.Cipher.AES.MODE_CFB,
652
 
                                          iv)
653
 
        plain = ciphereng.decrypt(ciphertext)
654
 
        
655
 
        # Validate decrypted secret to know if it was succesful
656
 
        hasheng = hashlib.sha256()
657
 
        validationhash = plain[:hasheng.digest_size]
658
 
        secret = plain[hasheng.digest_size:]
659
 
        hasheng.update(secret)
660
 
        
661
 
        # if validation fails, we use key as new secret. Otherwhise,
662
 
        # we use the decrypted secret
663
 
        if hasheng.digest() == validationhash:
664
 
            self.secret = secret
665
 
        else:
666
 
            self.secret = key
667
 
        del self.encrypted_secret
668
697
 
669
698
 
670
699
def dbus_service_property(dbus_interface, signature="v",
1618
1647
        # Convert the buffer to a Python bytestring
1619
1648
        fpr = ctypes.string_at(buf, buf_len.value)
1620
1649
        # Convert the bytestring to hexadecimal notation
1621
 
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
1650
        hex_fpr = binascii.hexlify(fpr).upper()
1622
1651
        return hex_fpr
1623
1652
 
1624
1653
 
2166
2195
                                                     (stored_state))
2167
2196
            os.remove(stored_state_path)
2168
2197
        except IOError as e:
2169
 
            logger.warning("Could not load persistant state: {0}"
 
2198
            logger.warning("Could not load persistent state: {0}"
2170
2199
                           .format(e))
2171
2200
            if e.errno != errno.ENOENT:
2172
2201
                raise
2173
2202
    
2174
 
    for client in clients_data:
2175
 
        client_name = client["name"]
2176
 
        
2177
 
        # Decide which value to use after restoring saved state.
2178
 
        # We have three different values: Old config file,
2179
 
        # new config file, and saved state.
2180
 
        # New config value takes precedence if it differs from old
2181
 
        # config value, otherwise use saved state.
2182
 
        for name, value in client_settings[client_name].items():
 
2203
    with Crypto() as crypt:
 
2204
        for client in clients_data:
 
2205
            client_name = client["name"]
 
2206
            
 
2207
            # Decide which value to use after restoring saved state.
 
2208
            # We have three different values: Old config file,
 
2209
            # new config file, and saved state.
 
2210
            # New config value takes precedence if it differs from old
 
2211
            # config value, otherwise use saved state.
 
2212
            for name, value in client_settings[client_name].items():
 
2213
                try:
 
2214
                    # For each value in new config, check if it
 
2215
                    # differs from the old config value (Except for
 
2216
                    # the "secret" attribute)
 
2217
                    if (name != "secret" and
 
2218
                        value != old_client_settings[client_name]
 
2219
                        [name]):
 
2220
                        setattr(client, name, value)
 
2221
                except KeyError:
 
2222
                    pass
 
2223
            
 
2224
            # Clients who has passed its expire date can still be
 
2225
            # enabled if its last checker was sucessful.  Clients
 
2226
            # whose checker failed before we stored its state is
 
2227
            # assumed to have failed all checkers during downtime.
 
2228
            if client["enabled"] and client["last_checked_ok"]:
 
2229
                if ((datetime.datetime.utcnow()
 
2230
                     - client["last_checked_ok"])
 
2231
                    > client["interval"]):
 
2232
                    if client["last_checker_status"] != 0:
 
2233
                        client["enabled"] = False
 
2234
                    else:
 
2235
                        client["expires"] = (datetime.datetime
 
2236
                                             .utcnow()
 
2237
                                             + client["timeout"])
 
2238
            
 
2239
            client["changedstate"] = (multiprocessing_manager
 
2240
                                      .Condition
 
2241
                                      (multiprocessing_manager
 
2242
                                       .Lock()))
 
2243
            if use_dbus:
 
2244
                new_client = (ClientDBusTransitional.__new__
 
2245
                              (ClientDBusTransitional))
 
2246
                tcp_server.clients[client_name] = new_client
 
2247
                new_client.bus = bus
 
2248
                for name, value in client.iteritems():
 
2249
                    setattr(new_client, name, value)
 
2250
                client_object_name = unicode(client_name).translate(
 
2251
                    {ord("."): ord("_"),
 
2252
                     ord("-"): ord("_")})
 
2253
                new_client.dbus_object_path = (dbus.ObjectPath
 
2254
                                               ("/clients/"
 
2255
                                                + client_object_name))
 
2256
                DBusObjectWithProperties.__init__(new_client,
 
2257
                                                  new_client.bus,
 
2258
                                                  new_client
 
2259
                                                  .dbus_object_path)
 
2260
            else:
 
2261
                tcp_server.clients[client_name] = (Client.__new__
 
2262
                                                   (Client))
 
2263
                for name, value in client.iteritems():
 
2264
                    setattr(tcp_server.clients[client_name],
 
2265
                            name, value)
 
2266
            
2183
2267
            try:
2184
 
                # For each value in new config, check if it differs
2185
 
                # from the old config value (Except for the "secret"
2186
 
                # attribute)
2187
 
                if (name != "secret" and
2188
 
                    value != old_client_settings[client_name][name]):
2189
 
                    setattr(client, name, value)
2190
 
            except KeyError:
2191
 
                pass
2192
 
        
2193
 
        # Clients who has passed its expire date, can still be enabled
2194
 
        # if its last checker was sucessful. Clients who checkers
2195
 
        # failed before we stored it state is asumed to had failed
2196
 
        # checker during downtime.
2197
 
        if client["enabled"] and client["last_checked_ok"]:
2198
 
            if ((datetime.datetime.utcnow()
2199
 
                 - client["last_checked_ok"]) > client["interval"]):
2200
 
                if client["last_checker_status"] != 0:
2201
 
                    client["enabled"] = False
2202
 
                else:
2203
 
                    client["expires"] = (datetime.datetime.utcnow()
2204
 
                                         + client["timeout"])
2205
 
        
2206
 
        client["changedstate"] = (multiprocessing_manager
2207
 
                                  .Condition(multiprocessing_manager
2208
 
                                             .Lock()))
2209
 
        if use_dbus:
2210
 
            new_client = (ClientDBusTransitional.__new__
2211
 
                          (ClientDBusTransitional))
2212
 
            tcp_server.clients[client_name] = new_client
2213
 
            new_client.bus = bus
2214
 
            for name, value in client.iteritems():
2215
 
                setattr(new_client, name, value)
2216
 
            client_object_name = unicode(client_name).translate(
2217
 
                {ord("."): ord("_"),
2218
 
                 ord("-"): ord("_")})
2219
 
            new_client.dbus_object_path = (dbus.ObjectPath
2220
 
                                           ("/clients/"
2221
 
                                            + client_object_name))
2222
 
            DBusObjectWithProperties.__init__(new_client,
2223
 
                                              new_client.bus,
2224
 
                                              new_client
2225
 
                                              .dbus_object_path)
2226
 
        else:
2227
 
            tcp_server.clients[client_name] = Client.__new__(Client)
2228
 
            for name, value in client.iteritems():
2229
 
                setattr(tcp_server.clients[client_name], name, value)
2230
 
                
2231
 
        tcp_server.clients[client_name].decrypt_secret(
2232
 
            client_settings[client_name]["secret"])
2233
 
        
 
2268
                tcp_server.clients[client_name].secret = (
 
2269
                    crypt.decrypt(tcp_server.clients[client_name]
 
2270
                                  .encrypted_secret,
 
2271
                                  client_settings[client_name]
 
2272
                                  ["secret"]))
 
2273
            except CryptoError:
 
2274
                # If decryption fails, we use secret from new settings
 
2275
                tcp_server.clients[client_name].secret = (
 
2276
                    client_settings[client_name]["secret"])
 
2277
    
2234
2278
    # Create/remove clients based on new changes made to config
2235
2279
    for clientname in set(old_client_settings) - set(client_settings):
2236
2280
        del tcp_server.clients[clientname]
2333
2377
        # based on what config file has. If config file is
2334
2378
        # removed/edited, old secret will thus be unrecovable.
2335
2379
        clients = []
2336
 
        for client in tcp_server.clients.itervalues():
2337
 
            client.encrypt_secret(client_settings[client.name]
2338
 
                                  ["secret"])
2339
 
            
2340
 
            client_dict = {}
2341
 
            
2342
 
            # A list of attributes that will not be stored when
2343
 
            # shutting down.
2344
 
            exclude = set(("bus", "changedstate", "secret"))
2345
 
            for name, typ in inspect.getmembers(dbus.service.Object):
2346
 
                exclude.add(name)
2347
 
                
2348
 
            client_dict["encrypted_secret"] = client.encrypted_secret
2349
 
            for attr in client.client_structure:
2350
 
                if attr not in exclude:
2351
 
                    client_dict[attr] = getattr(client, attr)
2352
 
            
2353
 
            clients.append(client_dict)
2354
 
            del client_settings[client.name]["secret"]
2355
 
            
 
2380
        with Crypto() as crypt:
 
2381
            for client in tcp_server.clients.itervalues():
 
2382
                key = client_settings[client.name]["secret"]
 
2383
                client.encrypted_secret = crypt.encrypt(client.secret,
 
2384
                                                        key)
 
2385
                client_dict = {}
 
2386
                
 
2387
                # A list of attributes that will not be stored when
 
2388
                # shutting down.
 
2389
                exclude = set(("bus", "changedstate", "secret"))
 
2390
                for name, typ in (inspect.getmembers
 
2391
                                  (dbus.service.Object)):
 
2392
                    exclude.add(name)
 
2393
                
 
2394
                client_dict["encrypted_secret"] = (client
 
2395
                                                   .encrypted_secret)
 
2396
                for attr in client.client_structure:
 
2397
                    if attr not in exclude:
 
2398
                        client_dict[attr] = getattr(client, attr)
 
2399
                
 
2400
                clients.append(client_dict)
 
2401
                del client_settings[client.name]["secret"]
 
2402
        
2356
2403
        try:
2357
2404
            with os.fdopen(os.open(stored_state_path,
2358
2405
                                   os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2359
2406
                                   0600), "wb") as stored_state:
2360
2407
                pickle.dump((clients, client_settings), stored_state)
2361
 
        except IOError as e:
2362
 
            logger.warning("Could not save persistant state: {0}"
 
2408
        except (IOError, OSError) as e:
 
2409
            logger.warning("Could not save persistent state: {0}"
2363
2410
                           .format(e))
2364
 
            if e.errno != errno.ENOENT:
 
2411
            if e.errno not in (errno.ENOENT, errno.EACCES):
2365
2412
                raise
2366
2413
        
2367
2414
        # Delete all clients, and settings from config
2387
2434
        # Need to initiate checking of clients
2388
2435
        if client.enabled:
2389
2436
            client.init_checker()
2390
 
 
2391
2437
    
2392
2438
    tcp_server.enable()
2393
2439
    tcp_server.server_activate()