/mandos/trunk : revision 518.2.3

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

66

68

67

69

import dbus

68

70

import dbus.service

73

75

import ctypes.util

74

76

import xml.dom.minidom

75

77

import inspect

78

import GnuPGInterface

76

79

77

80

try:

78

81

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

83

86

SO_BINDTODEVICE = None

84

87

85

88

86

version = "1.3.1"

89

version = "1.4.1"

90

stored_state_file = "clients.pickle"

87

91

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

92

logger = logging.getLogger()

90

93

syslogger = (logging.handlers.SysLogHandler

91

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

95

address = str("/dev/log")))

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

96

97

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

101

except (OSError, AttributeError):

102

def if_nametoindex(interface):

103

"Get an interface index the hard way, i.e. using fcntl()"

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

with contextlib.closing(socket.socket()) as s:

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

111

return interface_index

112

113

114

def initlogger(level=logging.WARNING):

115

"""init logger and add loglevel"""

116

117

syslogger.setFormatter(logging.Formatter

118

('Mandos [%(process)d]: %(levelname)s:'

119

' %(message)s'))

120

logger.addHandler(syslogger)

121

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class CryptoError(Exception):

132

pass

133

134

135

class Crypto(object):

136

"""A simple class for OpenPGP symmetric encryption & decryption"""

137

def __init__(self):

138

self.gnupg = GnuPGInterface.GnuPG()

139

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

140

self.gnupg = GnuPGInterface.GnuPG()

141

self.gnupg.options.meta_interactive = False

142

self.gnupg.options.homedir = self.tempdir

143

self.gnupg.options.extra_args.extend(['--force-mdc',

144

'--quiet'])

145

146

def __enter__(self):

147

return self

148

149

def __exit__ (self, exc_type, exc_value, traceback):

150

self._cleanup()

151

return False

152

153

def __del__(self):

154

self._cleanup()

155

156

def _cleanup(self):

157

if self.tempdir is not None:

158

# Delete contents of tempdir

159

for root, dirs, files in os.walk(self.tempdir,

160

topdown = False):

161

for filename in files:

162

os.remove(os.path.join(root, filename))

163

for dirname in dirs:

164

os.rmdir(os.path.join(root, dirname))

165

# Remove tempdir

166

os.rmdir(self.tempdir)

167

self.tempdir = None

168

169

def password_encode(self, password):

170

# Passphrase can not be empty and can not contain newlines or

171

# NUL bytes. So we prefix it and hex encode it.

172

return b"mandos" + binascii.hexlify(password)

173

174

def encrypt(self, data, password):

175

self.gnupg.passphrase = self.password_encode(password)

176

with open(os.devnull) as devnull:

177

try:

178

proc = self.gnupg.run(['--symmetric'],

179

create_fhs=['stdin', 'stdout'],

180

attach_fhs={'stderr': devnull})

181

with contextlib.closing(proc.handles['stdin']) as f:

182

f.write(data)

183

with contextlib.closing(proc.handles['stdout']) as f:

184

ciphertext = f.read()

185

proc.wait()

186

except IOError as e:

187

raise CryptoError(e)

188

self.gnupg.passphrase = None

189

return ciphertext

190

191

def decrypt(self, data, password):

192

self.gnupg.passphrase = self.password_encode(password)

193

with open(os.devnull) as devnull:

194

try:

195

proc = self.gnupg.run(['--decrypt'],

196

create_fhs=['stdin', 'stdout'],

197

attach_fhs={'stderr': devnull})

198

with contextlib.closing(proc.handles['stdin'] ) as f:

199

f.write(data)

200

with contextlib.closing(proc.handles['stdout']) as f:

201

decrypted_plaintext = f.read()

202

proc.wait()

203

except IOError as e:

204

raise CryptoError(e)

205

self.gnupg.passphrase = None

206

return decrypted_plaintext

207

208

103

209

104

210

class AvahiError(Exception):

105

211

def __init__(self, value, *args, **kwargs):

164

270

.GetAlternativeServiceName(self.name))

165

271

logger.info("Changing Zeroconf service name to %r ...",

166

272

self.name)

167

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

170

% self.name))

171

273

self.remove()

172

274

try:

173

275

self.add()

193

295

avahi.DBUS_INTERFACE_ENTRY_GROUP)

194

296

self.entry_group_state_changed_match = (

195

297

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

298

'StateChanged', self.entry_group_state_changed))

197

299

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

198

300

self.name, self.type)

199

301

self.group.AddService(

225

327

try:

226

328

self.group.Free()

227

329

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

330

dbus.exceptions.DBusException):

229

331

pass

230

332

self.group = None

231

333

self.remove()

265

367

self.server_state_changed)

266

368

self.server_state_changed(self.server.GetState())

267

369

370

class AvahiServiceToSyslog(AvahiService):

371

def rename(self):

372

"""Add the new name to the syslog messages"""

373

ret = AvahiService.rename(self)

374

syslogger.setFormatter(logging.Formatter

375

('Mandos (%s) [%%(process)d]:'

376

' %%(levelname)s: %%(message)s'

377

% self.name))

378

return ret

268

379

269

380

def _timedelta_to_milliseconds(td):

270

381

"Convert a datetime.timedelta() to milliseconds"

289

400

instance %(name)s can be used in the command.

290

401

checker_initiator_tag: a gobject event source tag, or None

291

402

created: datetime.datetime(); (UTC) object creation

403

client_structure: Object describing what attributes a client has

404

and is used for storing the client at exit

292

405

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

406

disable_initiator_tag: a gobject event source tag, or None

295

407

enabled: bool()

296

408

fingerprint: string (40 or 32 hexadecimal digits); used to

299

411

interval: datetime.timedelta(); How often to start a new checker

300

412

last_approval_request: datetime.datetime(); (UTC) or None

301

413

last_checked_ok: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

414

415

last_checker_status: integer between 0 and 255 reflecting exit

416

status of last checker. -1 reflects crashed

417

checker, or None.

418

last_enabled: datetime.datetime(); (UTC) or None

303

419

name: string; from the config file, used in log messages and

304

420

D-Bus identifiers

305

421

secret: bytestring; sent verbatim (over TLS) to client

331

447

def approval_delay_milliseconds(self):

332

448

return _timedelta_to_milliseconds(self.approval_delay)

333

449

334

def __init__(self, name = None, disable_hook=None, config=None):

450

def __init__(self, name = None, config=None):

335

451

"""Note: the 'checker' key in 'config' sets the

336

452

'checker_command' attribute and *not* the 'checker'

337

453

attribute."""

357

473

% self.name)

358

474

self.host = config.get("host", "")

359

475

self.created = datetime.datetime.utcnow()

360

self.enabled = False

476

self.enabled = config.get("enabled", True)

361

477

self.last_approval_request = None

362

self.last_enabled = None

478

if self.enabled:

479

self.last_enabled = datetime.datetime.utcnow()

480

else:

481

self.last_enabled = None

363

482

self.last_checked_ok = None

483

self.last_checker_status = None

364

484

self.timeout = string_to_delta(config["timeout"])

365

485

self.extended_timeout = string_to_delta(config

366

486

["extended_timeout"])

367

487

self.interval = string_to_delta(config["interval"])

368

self.disable_hook = disable_hook

369

488

self.checker = None

370

489

self.checker_initiator_tag = None

371

490

self.disable_initiator_tag = None

372

self.expires = None

491

if self.enabled:

492

self.expires = datetime.datetime.utcnow() + self.timeout

493

else:

494

self.expires = None

373

495

self.checker_callback_tag = None

374

496

self.checker_command = config["checker"]

375

497

self.current_checker_command = None

376

self.last_connect = None

377

498

self._approved = None

378

499

self.approved_by_default = config.get("approved_by_default",

379

500

True)

385

506

self.changedstate = (multiprocessing_manager

386

507

.Condition(multiprocessing_manager

387

508

.Lock()))

509

self.client_structure = [attr for attr in

510

self.__dict__.iterkeys()

511

if not attr.startswith("_")]

512

self.client_structure.append("client_structure")

513

514

for name, t in inspect.getmembers(type(self),

515

lambda obj:

516

isinstance(obj,

517

property)):

518

if not name.startswith("_"):

519

self.client_structure.append(name)

388

520

521

# Send notice to process children that client state has changed

389

522

def send_changedstate(self):

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

523

with self.changedstate:

524

self.changedstate.notify_all()

393

525

394

526

def enable(self):

395

527

"""Start this client's checker and timeout hooks"""

397

529

# Already enabled

398

530

return

399

531

self.send_changedstate()

400

# Schedule a new checker to be started an 'interval' from now,

401

# and every interval from then on.

402

self.checker_initiator_tag = (gobject.timeout_add

403

(self.interval_milliseconds(),

404

self.start_checker))

405

# Schedule a disable() when 'timeout' has passed

406

532

self.expires = datetime.datetime.utcnow() + self.timeout

407

self.disable_initiator_tag = (gobject.timeout_add

408

(self.timeout_milliseconds(),

409

self.disable))

410

533

self.enabled = True

411

534

self.last_enabled = datetime.datetime.utcnow()

412

# Also start a new checker *right now*.

413

self.start_checker()

535

self.init_checker()

414

536

415

537

def disable(self, quiet=True):

416

538

"""Disable this client."""

428

550

gobject.source_remove(self.checker_initiator_tag)

429

551

self.checker_initiator_tag = None

430

552

self.stop_checker()

431

if self.disable_hook:

432

self.disable_hook(self)

433

553

self.enabled = False

434

554

# Do not run this again if called by a gobject.timeout_add

435

555

return False

436

556

437

557

def __del__(self):

438

self.disable_hook = None

439

558

self.disable()

440

559

560

def init_checker(self):

561

# Schedule a new checker to be started an 'interval' from now,

562

# and every interval from then on.

563

self.checker_initiator_tag = (gobject.timeout_add

564

(self.interval_milliseconds(),

565

self.start_checker))

566

# Schedule a disable() when 'timeout' has passed

567

self.disable_initiator_tag = (gobject.timeout_add

568

(self.timeout_milliseconds(),

569

self.disable))

570

# Also start a new checker *right now*.

571

self.start_checker()

572

441

573

def checker_callback(self, pid, condition, command):

442

574

"""The checker has completed, so take appropriate actions."""

443

575

self.checker_callback_tag = None

444

576

self.checker = None

445

577

if os.WIFEXITED(condition):

446

exitstatus = os.WEXITSTATUS(condition)

447

if exitstatus == 0:

578

self.last_checker_status = os.WEXITSTATUS(condition)

579

if self.last_checker_status == 0:

448

580

logger.info("Checker for %(name)s succeeded",

449

581

vars(self))

450

582

self.checked_ok()

452

584

logger.info("Checker for %(name)s failed",

453

585

vars(self))

454

586

else:

587

self.last_checker_status = -1

455

588

logger.warning("Checker for %(name)s crashed?",

456

589

vars(self))

457

590

464

597

if timeout is None:

465

598

timeout = self.timeout

466

599

self.last_checked_ok = datetime.datetime.utcnow()

467

gobject.source_remove(self.disable_initiator_tag)

468

self.expires = datetime.datetime.utcnow() + timeout

469

self.disable_initiator_tag = (gobject.timeout_add

470

(_timedelta_to_milliseconds

471

(timeout), self.disable))

600

if self.disable_initiator_tag is not None:

601

gobject.source_remove(self.disable_initiator_tag)

602

if getattr(self, "enabled", False):

603

self.disable_initiator_tag = (gobject.timeout_add

604

(_timedelta_to_milliseconds

605

(timeout), self.disable))

606

self.expires = datetime.datetime.utcnow() + timeout

472

607

473

608

def need_approval(self):

474

609

self.last_approval_request = datetime.datetime.utcnow()

689

824

690

825

Note: Will not include properties with access="write".

691

826

"""

692

all = {}

827

properties = {}

693

828

for name, prop in self._get_all_dbus_properties():

694

829

if (interface_name

695

830

and interface_name != prop._dbus_interface):

700

835

continue

701

836

value = prop()

702

837

if not hasattr(value, "variant_level"):

703

all[name] = value

838

properties[name] = value

704

839

continue

705

all[name] = type(value)(value, variant_level=

706

value.variant_level+1)

707

return dbus.Dictionary(all, signature="sv")

840

properties[name] = type(value)(value, variant_level=

841

value.variant_level+1)

842

return dbus.Dictionary(properties, signature="sv")

708

843

709

844

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

710

845

out_signature="s",

761

896

return dbus.String(dt.isoformat(),

762

897

variant_level=variant_level)

763

898

899

764

900

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

765

901

.__metaclass__):

766

902

"""Applied to an empty subclass of a D-Bus object, this metaclass

858

994

attribute.func_closure)))

859

995

return type.__new__(mcs, name, bases, attr)

860

996

997

861

998

class ClientDBus(Client, DBusObjectWithProperties):

862

999

"""A Client class using D-Bus

863

1000

872

1009

# dbus.service.Object doesn't use super(), so we can't either.

873

1010

874

1011

def __init__(self, bus = None, *args, **kwargs):

1012

self.bus = bus

1013

Client.__init__(self, *args, **kwargs)

1014

875

1015

self._approvals_pending = 0

876

self.bus = bus

877

Client.__init__(self, *args, **kwargs)

878

1016

# Only now, when this client is initialized, can it show up on

879

1017

# the D-Bus

880

1018

client_object_name = unicode(self.name).translate(

890

1028

variant_level=1):

891

1029

""" Modify a variable so that it's a property which announces

892

1030

its changes to DBus.

893

894

transform_fun: Function that takes a value and transforms it

895

to a D-Bus type.

1031

1032

transform_fun: Function that takes a value and a variant_level

1033

and transforms it to a D-Bus type.

896

1034

dbus_name: D-Bus name of the variable

897

1035

type_func: Function that transform the value before sending it

898

1036

to the D-Bus. Default: no transform

905

1043

type_func(getattr(self, attrname, None))

906

1044

!= type_func(value)):

907

1045

dbus_value = transform_func(type_func(value),

908

variant_level)

1046

variant_level

1047

=variant_level)

909

1048

self.PropertyChanged(dbus.String(dbus_name),

910

1049

dbus_value)

911

1050

setattr(self, attrname, value)

1049

1188

"D-Bus signal"

1050

1189

return self.need_approval()

1051

1190

1191

# NeRwequest - signal

1192

@dbus.service.signal(_interface, signature="s")

1193

def NewRequest(self, ip):

1194

"""D-Bus signal

1195

Is sent after a client request a password.

1196

"""

1197

pass

1198

1052

1199

## Methods

1053

1200

1054

1201

# Approve - method

1137

1284

# Created - property

1138

1285

@dbus_service_property(_interface, signature="s", access="read")

1139

1286

def Created_dbus_property(self):

1140

return dbus.String(datetime_to_dbus(self.created))

1287

return datetime_to_dbus(self.created)

1141

1288

1142

1289

# LastEnabled - property

1143

1290

@dbus_service_property(_interface, signature="s", access="read")

1187

1334

gobject.source_remove(self.disable_initiator_tag)

1188

1335

self.disable_initiator_tag = None

1189

1336

self.expires = None

1190

time_to_die = (self.

1191

_timedelta_to_milliseconds((self

1192

.last_checked_ok

1193

+ self.timeout)

1194

- datetime.datetime

1195

.utcnow()))

1337

time_to_die = _timedelta_to_milliseconds((self

1338

.last_checked_ok

1339

+ self.timeout)

1340

- datetime.datetime

1341

.utcnow())

1196

1342

if time_to_die <= 0:

1197

1343

# The timeout has passed

1198

1344

self.disable()

1220

1366

self.interval = datetime.timedelta(0, 0, 0, value)

1221

1367

if getattr(self, "checker_initiator_tag", None) is None:

1222

1368

return

1223

# Reschedule checker run

1224

gobject.source_remove(self.checker_initiator_tag)

1225

self.checker_initiator_tag = (gobject.timeout_add

1226

(value, self.start_checker))

1227

self.start_checker() # Start one now, too

1369

if self.enabled:

1370

# Reschedule checker run

1371

gobject.source_remove(self.checker_initiator_tag)

1372

self.checker_initiator_tag = (gobject.timeout_add

1373

(value, self.start_checker))

1374

self.start_checker() # Start one now, too

1228

1375

1229

1376

# Checker - property

1230

1377

@dbus_service_property(_interface, signature="s",

1284

1431

return super(ProxyClient, self).__setattr__(name, value)

1285

1432

self._pipe.send(('setattr', name, value))

1286

1433

1434

1287

1435

class ClientDBusTransitional(ClientDBus):

1288

1436

__metaclass__ = AlternateDBusNamesMetaclass

1289

1437

1438

1290

1439

class ClientHandler(socketserver.BaseRequestHandler, object):

1291

1440

"""A class to handle client connections.

1292

1441

1353

1502

logger.warning("Bad certificate: %s", error)

1354

1503

return

1355

1504

logger.debug("Fingerprint: %s", fpr)

1505

if self.server.use_dbus:

1506

# Emit D-Bus signal

1507

client.NewRequest(str(self.client_address))

1356

1508

1357

1509

try:

1358

1510

client = ProxyClient(child_pipe, fpr,

1394

1546

return

1395

1547

1396

1548

#wait until timeout or approved

1397

#x = float(client

1398

# ._timedelta_to_milliseconds(delay))

1399

1549

time = datetime.datetime.now()

1400

1550

client.changedstate.acquire()

1401

1551

(client.changedstate.wait

1430

1580

sent_size += sent

1431

1581

1432

1582

logger.info("Sending secret to %s", client.name)

1433

# bump the timeout as if seen

1583

# bump the timeout using extended_timeout

1434

1584

client.checked_ok(client.extended_timeout)

1435

1585

if self.server.use_dbus:

1436

1586

# Emit D-Bus signal

1504

1654

# Convert the buffer to a Python bytestring

1505

1655

fpr = ctypes.string_at(buf, buf_len.value)

1506

1656

# Convert the bytestring to hexadecimal notation

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1657

hex_fpr = binascii.hexlify(fpr).upper()

1508

1658

return hex_fpr

1509

1659

1510

1660

1516

1666

except:

1517

1667

self.handle_error(request, address)

1518

1668

self.close_request(request)

1519

1669

1520

1670

def process_request(self, request, address):

1521

1671

"""Start a new process to process the request."""

1522

multiprocessing.Process(target = self.sub_process_main,

1523

args = (request, address)).start()

1672

proc = multiprocessing.Process(target = self.sub_process_main,

1673

args = (request,

1674

address))

1675

proc.start()

1676

return proc

1524

1677

1525

1678

1526

1679

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1532

1685

"""

1533

1686

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1534

1687

1535

super(MultiprocessingMixInWithPipe,

1536

self).process_request(request, client_address)

1688

proc = MultiprocessingMixIn.process_request(self, request,

1689

client_address)

1537

1690

self.child_pipe.close()

1538

self.add_pipe(parent_pipe)

1691

self.add_pipe(parent_pipe, proc)

1539

1692

1540

def add_pipe(self, parent_pipe):

1693

def add_pipe(self, parent_pipe, proc):

1541

1694

"""Dummy function; override as necessary"""

1542

1695

raise NotImplementedError

1543

1696

1621

1774

self.enabled = False

1622

1775

self.clients = clients

1623

1776

if self.clients is None:

1624

self.clients = set()

1777

self.clients = {}

1625

1778

self.use_dbus = use_dbus

1626

1779

self.gnutls_priority = gnutls_priority

1627

1780

IPv6_TCPServer.__init__(self, server_address,

1631

1784

def server_activate(self):

1632

1785

if self.enabled:

1633

1786

return socketserver.TCPServer.server_activate(self)

1787

1634

1788

def enable(self):

1635

1789

self.enabled = True

1636

def add_pipe(self, parent_pipe):

1790

1791

def add_pipe(self, parent_pipe, proc):

1637

1792

# Call "handle_ipc" for both data and EOF events

1638

1793

gobject.io_add_watch(parent_pipe.fileno(),

1639

1794

gobject.IO_IN | gobject.IO_HUP,

1640

1795

functools.partial(self.handle_ipc,

1641

1796

parent_pipe =

1642

parent_pipe))

1797

parent_pipe,

1798

proc = proc))

1643

1799

1644

1800

def handle_ipc(self, source, condition, parent_pipe=None,

1645

client_object=None):

1801

proc = None, client_object=None):

1646

1802

condition_names = {

1647

1803

gobject.IO_IN: "IN", # There is data to read.

1648

1804

gobject.IO_OUT: "OUT", # Data can be written (without

1657

1813

for cond, name in

1658

1814

condition_names.iteritems()

1659

1815

if cond & condition)

1660

# error or the other end of multiprocessing.Pipe has closed

1816

# error, or the other end of multiprocessing.Pipe has closed

1661

1817

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1818

# Wait for other process to exit

1819

proc.join()

1662

1820

return False

1663

1821

1664

1822

# Read a request from the child

1669

1827

fpr = request[1]

1670

1828

address = request[2]

1671

1829

1672

for c in self.clients:

1830

for c in self.clients.itervalues():

1673

1831

if c.fingerprint == fpr:

1674

1832

client = c

1675

1833

break

1688

1846

functools.partial(self.handle_ipc,

1689

1847

parent_pipe =

1690

1848

parent_pipe,

1849

proc = proc,

1691

1850

client_object =

1692

1851

client))

1693

1852

parent_pipe.send(True)

1758

1917

return timevalue

1759

1918

1760

1919

1761

def if_nametoindex(interface):

1762

"""Call the C function if_nametoindex(), or equivalent

1763

1764

Note: This function cannot accept a unicode string."""

1765

global if_nametoindex

1766

try:

1767

if_nametoindex = (ctypes.cdll.LoadLibrary

1768

(ctypes.util.find_library("c"))

1769

.if_nametoindex)

1770

except (OSError, AttributeError):

1771

logger.warning("Doing if_nametoindex the hard way")

1772

def if_nametoindex(interface):

1773

"Get an interface index the hard way, i.e. using fcntl()"

1774

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1775

with contextlib.closing(socket.socket()) as s:

1776

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1777

struct.pack(str("16s16x"),

1778

interface))

1779

interface_index = struct.unpack(str("I"),

1780

ifreq[16:20])[0]

1781

return interface_index

1782

return if_nametoindex(interface)

1783

1784

1785

1920

def daemon(nochdir = False, noclose = False):

1786

1921

"""See daemon(3). Standard BSD Unix function.

1787

1922

1842

1977

" system bus interface")

1843

1978

parser.add_argument("--no-ipv6", action="store_false",

1844

1979

dest="use_ipv6", help="Do not use IPv6")

1980

parser.add_argument("--no-restore", action="store_false",

1981

dest="restore", help="Do not restore stored"

1982

" state")

1983

parser.add_argument("--statedir", metavar="DIR",

1984

help="Directory to save/restore state in")

1985

1845

1986

options = parser.parse_args()

1846

1987

1847

1988

if options.check:

1860

2001

"use_dbus": "True",

1861

2002

"use_ipv6": "True",

1862

2003

"debuglevel": "",

2004

"restore": "True",

2005

"statedir": "/var/lib/mandos"

1863

2006

}

1864

2007

1865

2008

# Parse config file for server-global settings

1882

2025

# options, if set.

1883

2026

for option in ("interface", "address", "port", "debug",

1884

2027

"priority", "servicename", "configdir",

1885

"use_dbus", "use_ipv6", "debuglevel"):

2028

"use_dbus", "use_ipv6", "debuglevel", "restore",

2029

"statedir"):

1886

2030

value = getattr(options, option)

1887

2031

if value is not None:

1888

2032

server_settings[option] = value

1900

2044

debuglevel = server_settings["debuglevel"]

1901

2045

use_dbus = server_settings["use_dbus"]

1902

2046

use_ipv6 = server_settings["use_ipv6"]

2047

stored_state_path = os.path.join(server_settings["statedir"],

2048

stored_state_file)

2049

2050

if debug:

2051

initlogger(logging.DEBUG)

2052

else:

2053

if not debuglevel:

2054

initlogger()

2055

else:

2056

level = getattr(logging, debuglevel.upper())

2057

initlogger(level)

1903

2058

1904

2059

if server_settings["servicename"] != "Mandos":

1905

2060

syslogger.setFormatter(logging.Formatter

1960

2115

if error[0] != errno.EPERM:

1961

2116

raise error

1962

2117

1963

if not debug and not debuglevel:

1964

syslogger.setLevel(logging.WARNING)

1965

console.setLevel(logging.WARNING)

1966

if debuglevel:

1967

level = getattr(logging, debuglevel.upper())

1968

syslogger.setLevel(level)

1969

console.setLevel(level)

1970

1971

2118

if debug:

1972

2119

# Enable all possible GnuTLS debugging

1973

2120

2015

2162

server_settings["use_dbus"] = False

2016

2163

tcp_server.use_dbus = False

2017

2164

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2018

service = AvahiService(name = server_settings["servicename"],

2019

servicetype = "_mandos._tcp",

2020

protocol = protocol, bus = bus)

2165

service = AvahiServiceToSyslog(name =

2166

server_settings["servicename"],

2167

servicetype = "_mandos._tcp",

2168

protocol = protocol, bus = bus)

2021

2169

if server_settings["interface"]:

2022

2170

service.interface = (if_nametoindex

2023

2171

(str(server_settings["interface"])))

2029

2177

if use_dbus:

2030

2178

client_class = functools.partial(ClientDBusTransitional,

2031

2179

bus = bus)

2032

def client_config_items(config, section):

2033

special_settings = {

2034

"approved_by_default":

2035

lambda: config.getboolean(section,

2036

"approved_by_default"),

2037

}

2038

for name, value in config.items(section):

2180

2181

special_settings = {

2182

# Some settings need to be accessd by special methods;

2183

# booleans need .getboolean(), etc. Here is a list of them:

2184

"approved_by_default":

2185

lambda section:

2186

client_config.getboolean(section, "approved_by_default"),

2187

"enabled":

2188

lambda section:

2189

client_config.getboolean(section, "enabled"),

2190

}

2191

# Construct a new dict of client settings of this form:

2192

# { client_name: {setting_name: value, ...}, ...}

2193

# with exceptions for any special settings as defined above

2194

client_settings = dict((clientname,

2195

dict((setting,

2196

(value

2197

if setting not in special_settings

2198

else special_settings[setting]

2199

(clientname)))

2200

for setting, value in

2201

client_config.items(clientname)))

2202

for clientname in client_config.sections())

2203

2204

old_client_settings = {}

2205

clients_data = []

2206

2207

# Get client data and settings from last running state.

2208

if server_settings["restore"]:

2209

try:

2210

with open(stored_state_path, "rb") as stored_state:

2211

clients_data, old_client_settings = (pickle.load

2212

(stored_state))

2213

os.remove(stored_state_path)

2214

except IOError as e:

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2218

raise

2219

2220

with Crypto() as crypt:

2221

for client in clients_data:

2222

client_name = client["name"]

2223

2224

# Decide which value to use after restoring saved state.

2225

# We have three different values: Old config file,

2226

# new config file, and saved state.

2227

# New config value takes precedence if it differs from old

2228

# config value, otherwise use saved state.

2229

for name, value in client_settings[client_name].items():

2230

try:

2231

# For each value in new config, check if it

2232

# differs from the old config value (Except for

2233

# the "secret" attribute)

2234

if (name != "secret" and

2235

value != old_client_settings[client_name]

2236

[name]):

2237

setattr(client, name, value)

2238

except KeyError:

2239

pass

2240

2241

# Clients who has passed its expire date can still be

2242

# enabled if its last checker was sucessful. Clients

2243

# whose checker failed before we stored its state is

2244

# assumed to have failed all checkers during downtime.

2245

if client["enabled"] and client["last_checked_ok"]:

2246

if ((datetime.datetime.utcnow()

2247

- client["last_checked_ok"])

2248

> client["interval"]):

2249

if client["last_checker_status"] != 0:

2250

client["enabled"] = False

2251

else:

2252

client["expires"] = (datetime.datetime

2253

.utcnow()

2254

+ client["timeout"])

2255

2256

client["changedstate"] = (multiprocessing_manager

2257

.Condition

2258

(multiprocessing_manager

2259

.Lock()))

2260

if use_dbus:

2261

new_client = (ClientDBusTransitional.__new__

2262

(ClientDBusTransitional))

2263

tcp_server.clients[client_name] = new_client

2264

new_client.bus = bus

2265

for name, value in client.iteritems():

2266

setattr(new_client, name, value)

2267

client_object_name = unicode(client_name).translate(

2268

{ord("."): ord("_"),

2269

ord("-"): ord("_")})

2270

new_client.dbus_object_path = (dbus.ObjectPath

2271

("/clients/"

2272

+ client_object_name))

2273

DBusObjectWithProperties.__init__(new_client,

2274

new_client.bus,

2275

new_client

2276

.dbus_object_path)

2277

else:

2278

tcp_server.clients[client_name] = (Client.__new__

2279

(Client))

2280

for name, value in client.iteritems():

2281

setattr(tcp_server.clients[client_name],

2282

name, value)

2283

2039

2284

try:

2040

yield (name, special_settings[name]())

2041

except KeyError:

2042

yield (name, value)

2043

2044

tcp_server.clients.update(set(

2045

client_class(name = section,

2046

config= dict(client_config_items(

2047

client_config, section)))

2048

for section in client_config.sections()))

2285

tcp_server.clients[client_name].secret = (

2286

crypt.decrypt(tcp_server.clients[client_name]

2287

.encrypted_secret,

2288

client_settings[client_name]

2289

["secret"]))

2290

except CryptoError:

2291

# If decryption fails, we use secret from new settings

2292

tcp_server.clients[client_name].secret = (

2293

client_settings[client_name]["secret"])

2294

2295

# Create/remove clients based on new changes made to config

2296

for clientname in set(old_client_settings) - set(client_settings):

2297

del tcp_server.clients[clientname]

2298

for clientname in set(client_settings) - set(old_client_settings):

2299

tcp_server.clients[clientname] = (client_class(name

2300

= clientname,

2301

config =

2302

client_settings

2303

[clientname]))

2304

2049

2305

if not tcp_server.clients:

2050

2306

logger.warning("No clients defined")

2051

2307

2094

2350

def GetAllClients(self):

2095

2351

"D-Bus method"

2096

2352

return dbus.Array(c.dbus_object_path

2097

for c in tcp_server.clients)

2353

for c in

2354

tcp_server.clients.itervalues())

2098

2355

2099

2356

@dbus.service.method(_interface,

2100

2357

out_signature="a{oa{sv}}")

2102

2359

"D-Bus method"

2103

2360

return dbus.Dictionary(

2104

2361

((c.dbus_object_path, c.GetAll(""))

2105

for c in tcp_server.clients),

2362

for c in tcp_server.clients.itervalues()),

2106

2363

signature="oa{sv}")

2107

2364

2108

2365

@dbus.service.method(_interface, in_signature="o")

2109

2366

def RemoveClient(self, object_path):

2110

2367

"D-Bus method"

2111

for c in tcp_server.clients:

2368

for c in tcp_server.clients.itervalues():

2112

2369

if c.dbus_object_path == object_path:

2113

tcp_server.clients.remove(c)

2370

del tcp_server.clients[c.name]

2114

2371

c.remove_from_connection()

2115

2372

# Don't signal anything except ClientRemoved

2116

2373

c.disable(quiet=True)

2129

2386

"Cleanup function; run on exit"

2130

2387

service.cleanup()

2131

2388

2389

multiprocessing.active_children()

2390

if not (tcp_server.clients or client_settings):

2391

return

2392

2393

# Store client before exiting. Secrets are encrypted with key

2394

# based on what config file has. If config file is

2395

# removed/edited, old secret will thus be unrecovable.

2396

clients = []

2397

with Crypto() as crypt:

2398

for client in tcp_server.clients.itervalues():

2399

key = client_settings[client.name]["secret"]

2400

client.encrypted_secret = crypt.encrypt(client.secret,

2401

key)

2402

client_dict = {}

2403

2404

# A list of attributes that will not be stored when

2405

# shutting down.

2406

exclude = set(("bus", "changedstate", "secret"))

2407

for name, typ in (inspect.getmembers

2408

(dbus.service.Object)):

2409

exclude.add(name)

2410

2411

client_dict["encrypted_secret"] = (client

2412

.encrypted_secret)

2413

for attr in client.client_structure:

2414

if attr not in exclude:

2415

client_dict[attr] = getattr(client, attr)

2416

2417

clients.append(client_dict)

2418

del client_settings[client.name]["secret"]

2419

2420

try:

2421

with os.fdopen(os.open(stored_state_path,

2422

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2423

0600), "wb") as stored_state:

2424

pickle.dump((clients, client_settings), stored_state)

2425

except (IOError, OSError) as e:

2426

logger.warning("Could not save persistent state: {0}"

2427

.format(e))

2428

if e.errno not in (errno.ENOENT, errno.EACCES):

2429

raise

2430

2431

# Delete all clients, and settings from config

2132

2432

while tcp_server.clients:

2133

client = tcp_server.clients.pop()

2433

name, client = tcp_server.clients.popitem()

2134

2434

if use_dbus:

2135

2435

client.remove_from_connection()

2136

client.disable_hook = None

2137

2436

# Don't signal anything except ClientRemoved

2138

2437

client.disable(quiet=True)

2139

2438

if use_dbus:

2141

2440

mandos_dbus_service.ClientRemoved(client

2142

2441

.dbus_object_path,

2143

2442

client.name)

2443

client_settings.clear()

2144

2444

2145

2445

atexit.register(cleanup)

2146

2446

2147

for client in tcp_server.clients:

2447

for client in tcp_server.clients.itervalues():

2148

2448

if use_dbus:

2149

2449

# Emit D-Bus signal

2150

2450

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2151

client.enable()

2451

# Need to initiate checking of clients

2452

if client.enabled:

2453

client.init_checker()

2152

2454

2153

2455

tcp_server.enable()

2154

2456

tcp_server.server_activate()