To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 520
- compare with another revision
- download diff
- download tarball
- view history from revision 520
- Committer: Björn Påhlsson
- Date: 2011-11-09 17:16:03 UTC
- mfrom: (518.1.1 mandos-persistent)
- Revision ID: belorn@fukt.bsnet.se-20111109171603-srz21uoclpldp5ve
merge persistent state
- files removed:
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import binascii
67
import tempfile
66
import hashlib
68
67
69
68
import dbus
70
69
import dbus.service
75
74
import ctypes.util
76
75
import xml.dom.minidom
77
76
import inspect
78
import GnuPGInterface
77
import Crypto.Cipher.AES
79
78
80
79
try:
81
80
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
84
except ImportError:
86
85
SO_BINDTODEVICE = None
87
86
87
88
88
version = "1.4.1"
89
stored_state_file = "clients.pickle"
90
89
91
90
logger = logging.getLogger()
91
stored_state_path = "/var/lib/mandos/clients.pickle"
92
92
93
syslogger = (logging.handlers.SysLogHandler
93
94
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
95
address = str("/dev/log")))
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
console = logging.StreamHandler()
122
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
123
' [%(process)d]:'
124
' %(levelname)s:'
125
' %(message)s'))
126
logger.addHandler(console)
127
logger.setLevel(level)
128
129
130
class PGPError(Exception):
131
"""Exception if encryption/decryption fails"""
132
pass
133
134
135
class PGPEngine(object):
136
"""A simple class for OpenPGP symmetric encryption & decryption"""
137
def __init__(self):
138
self.gnupg = GnuPGInterface.GnuPG()
139
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
140
self.gnupg = GnuPGInterface.GnuPG()
141
self.gnupg.options.meta_interactive = False
142
self.gnupg.options.homedir = self.tempdir
143
self.gnupg.options.extra_args.extend(['--force-mdc',
144
'--quiet'])
145
146
def __enter__(self):
147
return self
148
149
def __exit__ (self, exc_type, exc_value, traceback):
150
self._cleanup()
151
return False
152
153
def __del__(self):
154
self._cleanup()
155
156
def _cleanup(self):
157
if self.tempdir is not None:
158
# Delete contents of tempdir
159
for root, dirs, files in os.walk(self.tempdir,
160
topdown = False):
161
for filename in files:
162
os.remove(os.path.join(root, filename))
163
for dirname in dirs:
164
os.rmdir(os.path.join(root, dirname))
165
# Remove tempdir
166
os.rmdir(self.tempdir)
167
self.tempdir = None
168
169
def password_encode(self, password):
170
# Passphrase can not be empty and can not contain newlines or
171
# NUL bytes. So we prefix it and hex encode it.
172
return b"mandos" + binascii.hexlify(password)
173
174
def encrypt(self, data, password):
175
self.gnupg.passphrase = self.password_encode(password)
176
with open(os.devnull) as devnull:
177
try:
178
proc = self.gnupg.run(['--symmetric'],
179
create_fhs=['stdin', 'stdout'],
180
attach_fhs={'stderr': devnull})
181
with contextlib.closing(proc.handles['stdin']) as f:
182
f.write(data)
183
with contextlib.closing(proc.handles['stdout']) as f:
184
ciphertext = f.read()
185
proc.wait()
186
except IOError as e:
187
raise PGPError(e)
188
self.gnupg.passphrase = None
189
return ciphertext
190
191
def decrypt(self, data, password):
192
self.gnupg.passphrase = self.password_encode(password)
193
with open(os.devnull) as devnull:
194
try:
195
proc = self.gnupg.run(['--decrypt'],
196
create_fhs=['stdin', 'stdout'],
197
attach_fhs={'stderr': devnull})
198
with contextlib.closing(proc.handles['stdin'] ) as f:
199
f.write(data)
200
with contextlib.closing(proc.handles['stdout']) as f:
201
decrypted_plaintext = f.read()
202
proc.wait()
203
except IOError as e:
204
raise PGPError(e)
205
self.gnupg.passphrase = None
206
return decrypted_plaintext
207
96
syslogger.setFormatter(logging.Formatter
97
('Mandos [%(process)d]: %(levelname)s:'
98
' %(message)s'))
99
logger.addHandler(syslogger)
100
101
console = logging.StreamHandler()
102
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
103
' [%(process)d]:'
104
' %(levelname)s:'
105
' %(message)s'))
106
logger.addHandler(console)
208
107
209
108
210
109
class AvahiError(Exception):
327
226
try:
328
227
self.group.Free()
329
228
except (dbus.exceptions.UnknownMethodException,
330
dbus.exceptions.DBusException):
229
dbus.exceptions.DBusException) as e:
331
230
pass
332
231
self.group = None
333
232
self.remove()
377
276
% self.name))
378
277
return ret
379
278
380
def timedelta_to_milliseconds(td):
279
def _timedelta_to_milliseconds(td):
381
280
"Convert a datetime.timedelta() to milliseconds"
382
281
return ((td.days * 24 * 60 * 60 * 1000)
383
282
+ (td.seconds * 1000)
387
286
"""A representation of a client host served by this server.
388
287
389
288
Attributes:
390
approved: bool(); 'None' if not yet approved/disapproved
289
_approved: bool(); 'None' if not yet approved/disapproved
391
290
approval_delay: datetime.timedelta(); Time to wait for approval
392
291
approval_duration: datetime.timedelta(); Duration of one approval
393
292
checker: subprocess.Popen(); a running checker process used
411
310
interval: datetime.timedelta(); How often to start a new checker
412
311
last_approval_request: datetime.datetime(); (UTC) or None
413
312
last_checked_ok: datetime.datetime(); (UTC) or None
414
last_checker_status: integer between 0 and 255 reflecting exit
415
status of last checker. -1 reflects crashed
416
checker, or None.
417
last_enabled: datetime.datetime(); (UTC) or None
313
last_checker_status: integer between 0 and 255 reflecting exit status
314
of last checker. -1 reflect crashed checker,
315
or None.
316
last_enabled: datetime.datetime(); (UTC)
418
317
name: string; from the config file, used in log messages and
419
318
D-Bus identifiers
420
319
secret: bytestring; sent verbatim (over TLS) to client
430
329
"created", "enabled", "fingerprint",
431
330
"host", "interval", "last_checked_ok",
432
331
"last_enabled", "name", "timeout")
433
client_defaults = { "timeout": "5m",
434
"extended_timeout": "15m",
435
"interval": "2m",
436
"checker": "fping -q -- %%(host)s",
437
"host": "",
438
"approval_delay": "0s",
439
"approval_duration": "1s",
440
"approved_by_default": "True",
441
"enabled": "True",
442
}
443
332
444
333
def timeout_milliseconds(self):
445
334
"Return the 'timeout' attribute in milliseconds"
446
return timedelta_to_milliseconds(self.timeout)
335
return _timedelta_to_milliseconds(self.timeout)
447
336
448
337
def extended_timeout_milliseconds(self):
449
338
"Return the 'extended_timeout' attribute in milliseconds"
450
return timedelta_to_milliseconds(self.extended_timeout)
339
return _timedelta_to_milliseconds(self.extended_timeout)
451
340
452
341
def interval_milliseconds(self):
453
342
"Return the 'interval' attribute in milliseconds"
454
return timedelta_to_milliseconds(self.interval)
343
return _timedelta_to_milliseconds(self.interval)
455
344
456
345
def approval_delay_milliseconds(self):
457
return timedelta_to_milliseconds(self.approval_delay)
458
459
@staticmethod
460
def config_parser(config):
461
""" Construct a new dict of client settings of this form:
462
{ client_name: {setting_name: value, ...}, ...}
463
with exceptions for any special settings as defined above"""
464
settings = {}
465
for client_name in config.sections():
466
section = dict(config.items(client_name))
467
client = settings[client_name] = {}
468
469
client["host"] = section["host"]
470
# Reformat values from string types to Python types
471
client["approved_by_default"] = config.getboolean(
472
client_name, "approved_by_default")
473
client["enabled"] = config.getboolean(client_name, "enabled")
474
475
client["fingerprint"] = (section["fingerprint"].upper()
476
.replace(" ", ""))
477
if "secret" in section:
478
client["secret"] = section["secret"].decode("base64")
479
elif "secfile" in section:
480
with open(os.path.expanduser(os.path.expandvars
481
(section["secfile"])),
482
"rb") as secfile:
483
client["secret"] = secfile.read()
484
else:
485
raise TypeError("No secret or secfile for section %s"
486
% section)
487
client["timeout"] = string_to_delta(section["timeout"])
488
client["extended_timeout"] = string_to_delta(
489
section["extended_timeout"])
490
client["interval"] = string_to_delta(section["interval"])
491
client["approval_delay"] = string_to_delta(
492
section["approval_delay"])
493
client["approval_duration"] = string_to_delta(
494
section["approval_duration"])
495
client["checker_command"] = section["checker"]
496
client["last_approval_request"] = None
497
client["last_checked_ok"] = None
498
client["last_checker_status"] = None
499
if client["enabled"]:
500
client["last_enabled"] = datetime.datetime.utcnow()
501
client["expires"] = (datetime.datetime.utcnow()
502
+ client["timeout"])
503
else:
504
client["last_enabled"] = None
505
client["expires"] = None
506
507
return settings
508
509
510
def __init__(self, settings, name = None):
346
return _timedelta_to_milliseconds(self.approval_delay)
347
348
def __init__(self, name = None, config=None):
511
349
"""Note: the 'checker' key in 'config' sets the
512
350
'checker_command' attribute and *not* the 'checker'
513
351
attribute."""
514
352
self.name = name
515
# adding all client settings
516
for setting, value in settings.iteritems():
517
setattr(self, setting, value)
518
353
if config is None:
354
config = {}
519
355
logger.debug("Creating client %r", self.name)
520
356
# Uppercase and remove spaces from fingerprint for later
521
357
# comparison purposes with return value from the fingerprint()
522
358
# function
359
self.fingerprint = (config["fingerprint"].upper()
360
.replace(" ", ""))
523
361
logger.debug(" Fingerprint: %s", self.fingerprint)
524
self.created = settings.get("created", datetime.datetime.utcnow())
525
526
# attributes specific for this server instance
362
if "secret" in config:
363
self.secret = config["secret"].decode("base64")
364
elif "secfile" in config:
365
with open(os.path.expanduser(os.path.expandvars
366
(config["secfile"])),
367
"rb") as secfile:
368
self.secret = secfile.read()
369
else:
370
raise TypeError("No secret or secfile for client %s"
371
% self.name)
372
self.host = config.get("host", "")
373
self.created = datetime.datetime.utcnow()
374
self.enabled = True
375
self.last_approval_request = None
376
self.last_enabled = datetime.datetime.utcnow()
377
self.last_checked_ok = None
378
self.last_checker_status = None
379
self.timeout = string_to_delta(config["timeout"])
380
self.extended_timeout = string_to_delta(config
381
["extended_timeout"])
382
self.interval = string_to_delta(config["interval"])
527
383
self.checker = None
528
384
self.checker_initiator_tag = None
529
385
self.disable_initiator_tag = None
386
self.expires = datetime.datetime.utcnow() + self.timeout
530
387
self.checker_callback_tag = None
388
self.checker_command = config["checker"]
531
389
self.current_checker_command = None
532
self.approved = None
390
self._approved = None
391
self.approved_by_default = config.get("approved_by_default",
392
True)
533
393
self.approvals_pending = 0
394
self.approval_delay = string_to_delta(
395
config["approval_delay"])
396
self.approval_duration = string_to_delta(
397
config["approval_duration"])
534
398
self.changedstate = (multiprocessing_manager
535
399
.Condition(multiprocessing_manager
536
400
.Lock()))
537
self.client_structure = [attr for attr in
538
self.__dict__.iterkeys()
539
if not attr.startswith("_")]
401
self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]
540
402
self.client_structure.append("client_structure")
541
403
404
542
405
for name, t in inspect.getmembers(type(self),
543
lambda obj:
544
isinstance(obj,
545
property)):
406
lambda obj: isinstance(obj, property)):
546
407
if not name.startswith("_"):
547
408
self.client_structure.append(name)
548
409
584
445
585
446
def __del__(self):
586
447
self.disable()
587
448
588
449
def init_checker(self):
589
450
# Schedule a new checker to be started an 'interval' from now,
590
451
# and every interval from then on.
597
458
self.disable))
598
459
# Also start a new checker *right now*.
599
460
self.start_checker()
600
461
462
601
463
def checker_callback(self, pid, condition, command):
602
464
"""The checker has completed, so take appropriate actions."""
603
465
self.checker_callback_tag = None
604
466
self.checker = None
605
467
if os.WIFEXITED(condition):
606
self.last_checker_status = os.WEXITSTATUS(condition)
468
self.last_checker_status = os.WEXITSTATUS(condition)
607
469
if self.last_checker_status == 0:
608
470
logger.info("Checker for %(name)s succeeded",
609
471
vars(self))
629
491
gobject.source_remove(self.disable_initiator_tag)
630
492
if getattr(self, "enabled", False):
631
493
self.disable_initiator_tag = (gobject.timeout_add
632
(timedelta_to_milliseconds
494
(_timedelta_to_milliseconds
633
495
(timeout), self.disable))
634
496
self.expires = datetime.datetime.utcnow() + timeout
635
497
729
591
raise
730
592
self.checker = None
731
593
594
# Encrypts a client secret and stores it in a varible encrypted_secret
595
def encrypt_secret(self, key):
596
# Encryption-key need to be of a specific size, so we hash inputed key
597
hasheng = hashlib.sha256()
598
hasheng.update(key)
599
encryptionkey = hasheng.digest()
600
601
# Create validation hash so we know at decryption if it was sucessful
602
hasheng = hashlib.sha256()
603
hasheng.update(self.secret)
604
validationhash = hasheng.digest()
605
606
# Encrypt secret
607
iv = os.urandom(Crypto.Cipher.AES.block_size)
608
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
609
Crypto.Cipher.AES.MODE_CFB, iv)
610
ciphertext = ciphereng.encrypt(validationhash+self.secret)
611
self.encrypted_secret = (ciphertext, iv)
612
613
# Decrypt a encrypted client secret
614
def decrypt_secret(self, key):
615
# Decryption-key need to be of a specific size, so we hash inputed key
616
hasheng = hashlib.sha256()
617
hasheng.update(key)
618
encryptionkey = hasheng.digest()
619
620
# Decrypt encrypted secret
621
ciphertext, iv = self.encrypted_secret
622
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
623
Crypto.Cipher.AES.MODE_CFB, iv)
624
plain = ciphereng.decrypt(ciphertext)
625
626
# Validate decrypted secret to know if it was succesful
627
hasheng = hashlib.sha256()
628
validationhash = plain[:hasheng.digest_size]
629
secret = plain[hasheng.digest_size:]
630
hasheng.update(secret)
631
632
# if validation fails, we use key as new secret. Otherwhise, we use
633
# the decrypted secret
634
if hasheng.digest() == validationhash:
635
self.secret = secret
636
else:
637
self.secret = key
638
del self.encrypted_secret
639
732
640
733
641
def dbus_service_property(dbus_interface, signature="v",
734
642
access="readwrite", byte_arrays=False):
852
760
853
761
Note: Will not include properties with access="write".
854
762
"""
855
properties = {}
763
all = {}
856
764
for name, prop in self._get_all_dbus_properties():
857
765
if (interface_name
858
766
and interface_name != prop._dbus_interface):
863
771
continue
864
772
value = prop()
865
773
if not hasattr(value, "variant_level"):
866
properties[name] = value
774
all[name] = value
867
775
continue
868
properties[name] = type(value)(value, variant_level=
869
value.variant_level+1)
870
return dbus.Dictionary(properties, signature="sv")
776
all[name] = type(value)(value, variant_level=
777
value.variant_level+1)
778
return dbus.Dictionary(all, signature="sv")
871
779
872
780
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
873
781
out_signature="s",
924
832
return dbus.String(dt.isoformat(),
925
833
variant_level=variant_level)
926
834
927
928
835
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
929
836
.__metaclass__):
930
837
"""Applied to an empty subclass of a D-Bus object, this metaclass
1022
929
attribute.func_closure)))
1023
930
return type.__new__(mcs, name, bases, attr)
1024
931
1025
1026
932
class ClientDBus(Client, DBusObjectWithProperties):
1027
933
"""A Client class using D-Bus
1028
934
1039
945
def __init__(self, bus = None, *args, **kwargs):
1040
946
self.bus = bus
1041
947
Client.__init__(self, *args, **kwargs)
1042
self._approvals_pending = 0
1043
948
1044
949
self._approvals_pending = 0
1045
950
# Only now, when this client is initialized, can it show up on
1046
951
# the D-Bus
1057
962
variant_level=1):
1058
963
""" Modify a variable so that it's a property which announces
1059
964
its changes to DBus.
1060
965
1061
966
transform_fun: Function that takes a value and a variant_level
1062
967
and transforms it to a D-Bus type.
1063
968
dbus_name: D-Bus name of the variable
1097
1002
datetime_to_dbus, "LastApprovalRequest")
1098
1003
approved_by_default = notifychangeproperty(dbus.Boolean,
1099
1004
"ApprovedByDefault")
1100
approval_delay = notifychangeproperty(dbus.UInt64,
1005
approval_delay = notifychangeproperty(dbus.UInt16,
1101
1006
"ApprovalDelay",
1102
1007
type_func =
1103
timedelta_to_milliseconds)
1008
_timedelta_to_milliseconds)
1104
1009
approval_duration = notifychangeproperty(
1105
dbus.UInt64, "ApprovalDuration",
1106
type_func = timedelta_to_milliseconds)
1010
dbus.UInt16, "ApprovalDuration",
1011
type_func = _timedelta_to_milliseconds)
1107
1012
host = notifychangeproperty(dbus.String, "Host")
1108
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1013
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1109
1014
type_func =
1110
timedelta_to_milliseconds)
1015
_timedelta_to_milliseconds)
1111
1016
extended_timeout = notifychangeproperty(
1112
dbus.UInt64, "ExtendedTimeout",
1113
type_func = timedelta_to_milliseconds)
1114
interval = notifychangeproperty(dbus.UInt64,
1017
dbus.UInt16, "ExtendedTimeout",
1018
type_func = _timedelta_to_milliseconds)
1019
interval = notifychangeproperty(dbus.UInt16,
1115
1020
"Interval",
1116
1021
type_func =
1117
timedelta_to_milliseconds)
1022
_timedelta_to_milliseconds)
1118
1023
checker_command = notifychangeproperty(dbus.String, "Checker")
1119
1024
1120
1025
del notifychangeproperty
1162
1067
return r
1163
1068
1164
1069
def _reset_approved(self):
1165
self.approved = None
1070
self._approved = None
1166
1071
return False
1167
1072
1168
1073
def approve(self, value=True):
1169
1074
self.send_changedstate()
1170
self.approved = value
1171
gobject.timeout_add(timedelta_to_milliseconds
1075
self._approved = value
1076
gobject.timeout_add(_timedelta_to_milliseconds
1172
1077
(self.approval_duration),
1173
1078
self._reset_approved)
1174
1079
1217
1122
"D-Bus signal"
1218
1123
return self.need_approval()
1219
1124
1220
# NeRwequest - signal
1221
@dbus.service.signal(_interface, signature="s")
1222
def NewRequest(self, ip):
1223
"""D-Bus signal
1224
Is sent after a client request a password.
1225
"""
1226
pass
1227
1228
1125
## Methods
1229
1126
1230
1127
# Approve - method
1288
1185
access="readwrite")
1289
1186
def ApprovalDuration_dbus_property(self, value=None):
1290
1187
if value is None: # get
1291
return dbus.UInt64(timedelta_to_milliseconds(
1188
return dbus.UInt64(_timedelta_to_milliseconds(
1292
1189
self.approval_duration))
1293
1190
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1294
1191
1308
1205
def Host_dbus_property(self, value=None):
1309
1206
if value is None: # get
1310
1207
return dbus.String(self.host)
1311
self.host = unicode(value)
1208
self.host = value
1312
1209
1313
1210
# Created - property
1314
1211
@dbus_service_property(_interface, signature="s", access="read")
1315
1212
def Created_dbus_property(self):
1316
return datetime_to_dbus(self.created)
1213
return dbus.String(datetime_to_dbus(self.created))
1317
1214
1318
1215
# LastEnabled - property
1319
1216
@dbus_service_property(_interface, signature="s", access="read")
1363
1260
gobject.source_remove(self.disable_initiator_tag)
1364
1261
self.disable_initiator_tag = None
1365
1262
self.expires = None
1366
time_to_die = timedelta_to_milliseconds((self
1367
.last_checked_ok
1368
+ self.timeout)
1369
- datetime.datetime
1370
.utcnow())
1263
time_to_die = _timedelta_to_milliseconds((self
1264
.last_checked_ok
1265
+ self.timeout)
1266
- datetime.datetime
1267
.utcnow())
1371
1268
if time_to_die <= 0:
1372
1269
# The timeout has passed
1373
1270
self.disable()
1395
1292
self.interval = datetime.timedelta(0, 0, 0, value)
1396
1293
if getattr(self, "checker_initiator_tag", None) is None:
1397
1294
return
1398
if self.enabled:
1399
# Reschedule checker run
1400
gobject.source_remove(self.checker_initiator_tag)
1401
self.checker_initiator_tag = (gobject.timeout_add
1402
(value, self.start_checker))
1403
self.start_checker() # Start one now, too
1295
# Reschedule checker run
1296
gobject.source_remove(self.checker_initiator_tag)
1297
self.checker_initiator_tag = (gobject.timeout_add
1298
(value, self.start_checker))
1299
self.start_checker() # Start one now, too
1404
1300
1405
1301
# Checker - property
1406
1302
@dbus_service_property(_interface, signature="s",
1408
1304
def Checker_dbus_property(self, value=None):
1409
1305
if value is None: # get
1410
1306
return dbus.String(self.checker_command)
1411
self.checker_command = unicode(value)
1307
self.checker_command = value
1412
1308
1413
1309
# CheckerRunning - property
1414
1310
@dbus_service_property(_interface, signature="b",
1443
1339
raise KeyError()
1444
1340
1445
1341
def __getattribute__(self, name):
1446
if name == '_pipe':
1342
if(name == '_pipe'):
1447
1343
return super(ProxyClient, self).__getattribute__(name)
1448
1344
self._pipe.send(('getattr', name))
1449
1345
data = self._pipe.recv()
1456
1352
return func
1457
1353
1458
1354
def __setattr__(self, name, value):
1459
if name == '_pipe':
1355
if(name == '_pipe'):
1460
1356
return super(ProxyClient, self).__setattr__(name, value)
1461
1357
self._pipe.send(('setattr', name, value))
1462
1358
1463
1464
1359
class ClientDBusTransitional(ClientDBus):
1465
1360
__metaclass__ = AlternateDBusNamesMetaclass
1466
1361
1467
1468
1362
class ClientHandler(socketserver.BaseRequestHandler, object):
1469
1363
"""A class to handle client connections.
1470
1364
1538
1432
except KeyError:
1539
1433
return
1540
1434
1541
if self.server.use_dbus:
1542
# Emit D-Bus signal
1543
client.NewRequest(str(self.client_address))
1544
1545
1435
if client.approval_delay:
1546
1436
delay = client.approval_delay
1547
1437
client.approvals_pending += 1
1556
1446
client.Rejected("Disabled")
1557
1447
return
1558
1448
1559
if client.approved or not client.approval_delay:
1449
if client._approved or not client.approval_delay:
1560
1450
#We are approved or approval is disabled
1561
1451
break
1562
elif client.approved is None:
1452
elif client._approved is None:
1563
1453
logger.info("Client %s needs approval",
1564
1454
client.name)
1565
1455
if self.server.use_dbus:
1579
1469
time = datetime.datetime.now()
1580
1470
client.changedstate.acquire()
1581
1471
(client.changedstate.wait
1582
(float(client.timedelta_to_milliseconds(delay)
1472
(float(client._timedelta_to_milliseconds(delay)
1583
1473
/ 1000)))
1584
1474
client.changedstate.release()
1585
1475
time2 = datetime.datetime.now()
1684
1574
# Convert the buffer to a Python bytestring
1685
1575
fpr = ctypes.string_at(buf, buf_len.value)
1686
1576
# Convert the bytestring to hexadecimal notation
1687
hex_fpr = binascii.hexlify(fpr).upper()
1577
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1688
1578
return hex_fpr
1689
1579
1690
1580
1693
1583
def sub_process_main(self, request, address):
1694
1584
try:
1695
1585
self.finish_request(request, address)
1696
except Exception:
1586
except:
1697
1587
self.handle_error(request, address)
1698
1588
self.close_request(request)
1699
1589
1947
1837
return timevalue
1948
1838
1949
1839
1840
def if_nametoindex(interface):
1841
"""Call the C function if_nametoindex(), or equivalent
1842
1843
Note: This function cannot accept a unicode string."""
1844
global if_nametoindex
1845
try:
1846
if_nametoindex = (ctypes.cdll.LoadLibrary
1847
(ctypes.util.find_library("c"))
1848
.if_nametoindex)
1849
except (OSError, AttributeError):
1850
logger.warning("Doing if_nametoindex the hard way")
1851
def if_nametoindex(interface):
1852
"Get an interface index the hard way, i.e. using fcntl()"
1853
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1854
with contextlib.closing(socket.socket()) as s:
1855
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1856
struct.pack(str("16s16x"),
1857
interface))
1858
interface_index = struct.unpack(str("I"),
1859
ifreq[16:20])[0]
1860
return interface_index
1861
return if_nametoindex(interface)
1862
1863
1950
1864
def daemon(nochdir = False, noclose = False):
1951
1865
"""See daemon(3). Standard BSD Unix function.
1952
1866
2008
1922
parser.add_argument("--no-ipv6", action="store_false",
2009
1923
dest="use_ipv6", help="Do not use IPv6")
2010
1924
parser.add_argument("--no-restore", action="store_false",
2011
dest="restore", help="Do not restore stored"
2012
" state")
2013
parser.add_argument("--statedir", metavar="DIR",
2014
help="Directory to save/restore state in")
2015
1925
dest="restore", help="Do not restore stored state",
1926
default=True)
1927
2016
1928
options = parser.parse_args()
2017
1929
2018
1930
if options.check:
2031
1943
"use_dbus": "True",
2032
1944
"use_ipv6": "True",
2033
1945
"debuglevel": "",
2034
"restore": "True",
2035
"statedir": "/var/lib/mandos"
2036
1946
}
2037
1947
2038
1948
# Parse config file for server-global settings
2055
1965
# options, if set.
2056
1966
for option in ("interface", "address", "port", "debug",
2057
1967
"priority", "servicename", "configdir",
2058
"use_dbus", "use_ipv6", "debuglevel", "restore",
2059
"statedir"):
1968
"use_dbus", "use_ipv6", "debuglevel", "restore"):
2060
1969
value = getattr(options, option)
2061
1970
if value is not None:
2062
1971
server_settings[option] = value
2074
1983
debuglevel = server_settings["debuglevel"]
2075
1984
use_dbus = server_settings["use_dbus"]
2076
1985
use_ipv6 = server_settings["use_ipv6"]
2077
stored_state_path = os.path.join(server_settings["statedir"],
2078
stored_state_file)
2079
2080
if debug:
2081
initlogger(logging.DEBUG)
2082
else:
2083
if not debuglevel:
2084
initlogger()
2085
else:
2086
level = getattr(logging, debuglevel.upper())
2087
initlogger(level)
2088
1986
2089
1987
if server_settings["servicename"] != "Mandos":
2090
1988
syslogger.setFormatter(logging.Formatter
2093
1991
% server_settings["servicename"]))
2094
1992
2095
1993
# Parse config file with clients
2096
client_config = configparser.SafeConfigParser(Client.client_defaults)
1994
client_defaults = { "timeout": "5m",
1995
"extended_timeout": "15m",
1996
"interval": "2m",
1997
"checker": "fping -q -- %%(host)s",
1998
"host": "",
1999
"approval_delay": "0s",
2000
"approval_duration": "1s",
2001
}
2002
client_config = configparser.SafeConfigParser(client_defaults)
2097
2003
client_config.read(os.path.join(server_settings["configdir"],
2098
2004
"clients.conf"))
2099
2005
2137
2043
if error[0] != errno.EPERM:
2138
2044
raise error
2139
2045
2046
if not debug and not debuglevel:
2047
logger.setLevel(logging.WARNING)
2048
if debuglevel:
2049
level = getattr(logging, debuglevel.upper())
2050
logger.setLevel(level)
2051
2140
2052
if debug:
2053
logger.setLevel(logging.DEBUG)
2141
2054
# Enable all possible GnuTLS debugging
2142
2055
2143
2056
# "Use a log level over 10 to enable all debugging options."
2165
2078
# Close all input and output, do double fork, etc.
2166
2079
daemon()
2167
2080
2168
gobject.threads_init()
2169
2170
2081
global main_loop
2171
2082
# From the Avahi example code
2172
2083
DBusGMainLoop(set_as_default=True )
2202
2113
client_class = functools.partial(ClientDBusTransitional,
2203
2114
bus = bus)
2204
2115
2205
client_settings = Client.config_parser(client_config)
2116
special_settings = {
2117
# Some settings need to be accessd by special methods;
2118
# booleans need .getboolean(), etc. Here is a list of them:
2119
"approved_by_default":
2120
lambda section:
2121
client_config.getboolean(section, "approved_by_default"),
2122
}
2123
# Construct a new dict of client settings of this form:
2124
# { client_name: {setting_name: value, ...}, ...}
2125
# with exceptions for any special settings as defined above
2126
client_settings = dict((clientname,
2127
dict((setting,
2128
(value if setting not in special_settings
2129
else special_settings[setting](clientname)))
2130
for setting, value in client_config.items(clientname)))
2131
for clientname in client_config.sections())
2132
2206
2133
old_client_settings = {}
2207
clients_data = {}
2208
2209
# Get client data and settings from last running state.
2134
clients_data = []
2135
2136
# Get client data and settings from last running state.
2210
2137
if server_settings["restore"]:
2211
2138
try:
2212
2139
with open(stored_state_path, "rb") as stored_state:
2213
clients_data, old_client_settings = (pickle.load
2214
(stored_state))
2140
clients_data, old_client_settings = pickle.load(stored_state)
2215
2141
os.remove(stored_state_path)
2216
2142
except IOError as e:
2217
logger.warning("Could not load persistent state: {0}"
2218
.format(e))
2143
logger.warning("Could not load persistant state: {0}".format(e))
2219
2144
if e.errno != errno.ENOENT:
2220
2145
raise
2221
except EOFError as e:
2222
logger.warning("Could not load persistent state: "
2223
"EOFError: {0}".format(e))
2224
2225
with PGPEngine() as pgp:
2226
for client_name, client in clients_data.iteritems():
2227
# Decide which value to use after restoring saved state.
2228
# We have three different values: Old config file,
2229
# new config file, and saved state.
2230
# New config value takes precedence if it differs from old
2231
# config value, otherwise use saved state.
2232
for name, value in client_settings[client_name].items():
2233
try:
2234
# For each value in new config, check if it
2235
# differs from the old config value (Except for
2236
# the "secret" attribute)
2237
if (name != "secret" and
2238
value != old_client_settings[client_name]
2239
[name]):
2240
client[name] = value
2241
except KeyError:
2242
pass
2243
2244
# Clients who has passed its expire date can still be
2245
# enabled if its last checker was successful. Clients
2246
# whose checker failed before we stored its state is
2247
# assumed to have failed all checkers during downtime.
2248
if client["enabled"]:
2249
if datetime.datetime.utcnow() >= client["expires"]:
2250
if not client["last_checked_ok"]:
2251
logger.warning(
2252
"disabling client {0} - Client never "
2253
"performed a successfull checker"
2254
.format(client["name"]))
2255
client["enabled"] = False
2256
elif client["last_checker_status"] != 0:
2257
logger.warning(
2258
"disabling client {0} - Client "
2259
"last checker failed with error code {1}"
2260
.format(client["name"],
2261
client["last_checker_status"]))
2262
client["enabled"] = False
2263
else:
2264
client["expires"] = (datetime.datetime
2265
.utcnow()
2266
+ client["timeout"])
2267
2146
2147
for client in clients_data:
2148
client_name = client["name"]
2149
2150
# Decide which value to use after restoring saved state.
2151
# We have three different values: Old config file,
2152
# new config file, and saved state.
2153
# New config value takes precedence if it differs from old
2154
# config value, otherwise use saved state.
2155
for name, value in client_settings[client_name].items():
2268
2156
try:
2269
client["secret"] = (
2270
pgp.decrypt(client["encrypted_secret"],
2271
client_settings[client_name]
2272
["secret"]))
2273
except PGPError:
2274
# If decryption fails, we use secret from new settings
2275
logger.debug("Failed to decrypt {0} old secret"
2276
.format(client_name))
2277
client["secret"] = (
2278
client_settings[client_name]["secret"])
2279
2280
2281
# Add/remove clients based on new changes made to config
2282
for client_name in set(old_client_settings) - set(client_settings):
2283
del clients_data[client_name]
2284
for client_name in set(client_settings) - set(old_client_settings):
2285
clients_data[client_name] = client_settings[client_name]
2286
2287
# Create clients all clients
2288
for client_name, client in clients_data.iteritems():
2289
tcp_server.clients[client_name] = client_class(
2290
name = client_name, settings = client)
2291
2157
# For each value in new config, check if it differs
2158
# from the old config value (Except for the "secret"
2159
# attribute)
2160
if name != "secret" and value != old_client_settings[client_name][name]:
2161
setattr(client, name, value)
2162
except KeyError:
2163
pass
2164
2165
# Clients who has passed its expire date, can still be enabled if its
2166
# last checker was sucessful. Clients who checkers failed before we
2167
# stored it state is asumed to had failed checker during downtime.
2168
if client["enabled"] and client["last_checked_ok"]:
2169
if ((datetime.datetime.utcnow() - client["last_checked_ok"])
2170
> client["interval"]):
2171
if client["last_checker_status"] != 0:
2172
client["enabled"] = False
2173
else:
2174
client["expires"] = datetime.datetime.utcnow() + client["timeout"]
2175
2176
client["changedstate"] = (multiprocessing_manager
2177
.Condition(multiprocessing_manager
2178
.Lock()))
2179
if use_dbus:
2180
new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)
2181
tcp_server.clients[client_name] = new_client
2182
new_client.bus = bus
2183
for name, value in client.iteritems():
2184
setattr(new_client, name, value)
2185
client_object_name = unicode(client_name).translate(
2186
{ord("."): ord("_"),
2187
ord("-"): ord("_")})
2188
new_client.dbus_object_path = (dbus.ObjectPath
2189
("/clients/" + client_object_name))
2190
DBusObjectWithProperties.__init__(new_client,
2191
new_client.bus,
2192
new_client.dbus_object_path)
2193
else:
2194
tcp_server.clients[client_name] = Client.__new__(Client)
2195
for name, value in client.iteritems():
2196
setattr(tcp_server.clients[client_name], name, value)
2197
2198
tcp_server.clients[client_name].decrypt_secret(
2199
client_settings[client_name]["secret"])
2200
2201
# Create/remove clients based on new changes made to config
2202
for clientname in set(old_client_settings) - set(client_settings):
2203
del tcp_server.clients[clientname]
2204
for clientname in set(client_settings) - set(old_client_settings):
2205
tcp_server.clients[clientname] = (client_class(name = clientname,
2206
config =
2207
client_settings
2208
[clientname]))
2209
2210
2292
2211
if not tcp_server.clients:
2293
2212
logger.warning("No clients defined")
2294
2213
2305
2224
# "pidfile" was never created
2306
2225
pass
2307
2226
del pidfilename
2227
2308
2228
signal.signal(signal.SIGINT, signal.SIG_IGN)
2309
2229
2310
2230
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2375
2295
multiprocessing.active_children()
2376
2296
if not (tcp_server.clients or client_settings):
2377
2297
return
2378
2379
# Store client before exiting. Secrets are encrypted with key
2380
# based on what config file has. If config file is
2381
# removed/edited, old secret will thus be unrecovable.
2382
clients = {}
2383
with PGPEngine() as pgp:
2384
for client in tcp_server.clients.itervalues():
2385
key = client_settings[client.name]["secret"]
2386
client.encrypted_secret = pgp.encrypt(client.secret,
2387
key)
2388
client_dict = {}
2389
2390
# A list of attributes that can not be pickled
2391
# + secret.
2392
exclude = set(("bus", "changedstate", "secret",
2393
"checker"))
2394
for name, typ in (inspect.getmembers
2395
(dbus.service.Object)):
2396
exclude.add(name)
2397
2398
client_dict["encrypted_secret"] = (client
2399
.encrypted_secret)
2400
for attr in client.client_structure:
2401
if attr not in exclude:
2402
client_dict[attr] = getattr(client, attr)
2403
2404
clients[client.name] = client_dict
2405
del client_settings[client.name]["secret"]
2406
2298
2299
# Store client before exiting. Secrets are encrypted with key based
2300
# on what config file has. If config file is removed/edited, old
2301
# secret will thus be unrecovable.
2302
clients = []
2303
for client in tcp_server.clients.itervalues():
2304
client.encrypt_secret(client_settings[client.name]["secret"])
2305
2306
client_dict = {}
2307
2308
# A list of attributes that will not be stored when shuting down.
2309
exclude = set(("bus", "changedstate", "secret"))
2310
for name, typ in inspect.getmembers(dbus.service.Object):
2311
exclude.add(name)
2312
2313
client_dict["encrypted_secret"] = client.encrypted_secret
2314
for attr in client.client_structure:
2315
if attr not in exclude:
2316
client_dict[attr] = getattr(client, attr)
2317
2318
clients.append(client_dict)
2319
del client_settings[client.name]["secret"]
2320
2407
2321
try:
2408
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2409
prefix="clients-",
2410
dir=os.path.dirname
2411
(stored_state_path))
2412
with os.fdopen(tempfd, "wb") as stored_state:
2322
with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:
2413
2323
pickle.dump((clients, client_settings), stored_state)
2414
os.rename(tempname, stored_state_path)
2415
except (IOError, OSError) as e:
2416
logger.warning("Could not save persistent state: {0}"
2417
.format(e))
2418
if e.errno not in set((errno.ENOENT, errno.EACCES,
2419
errno.EEXIST)):
2324
except IOError as e:
2325
logger.warning("Could not save persistant state: {0}".format(e))
2326
if e.errno != errno.ENOENT:
2420
2327
raise
2421
2328
2422
2329
# Delete all clients, and settings from config
2423
2330
while tcp_server.clients:
2424
2331
name, client = tcp_server.clients.popitem()
2442
2349
# Need to initiate checking of clients
2443
2350
if client.enabled:
2444
2351
client.init_checker()
2352
2445
2353
2446
2354
tcp_server.enable()
2447
2355
tcp_server.server_activate()
2487
2395
# Must run before the D-Bus bus name gets deregistered
2488
2396
cleanup()
2489
2397
2398
2490
2399
if __name__ == '__main__':
2491
2400
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0