To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 520
- compare with another revision
- download diff
- download tarball
- view history from revision 520
- Committer: Björn Påhlsson
- Date: 2011-11-09 17:16:03 UTC
- mfrom: (518.1.1 mandos-persistent)
- Revision ID: belorn@fukt.bsnet.se-20111109171603-srz21uoclpldp5ve
merge persistent state
- files removed:
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import binascii
67
import tempfile
66
import hashlib
68
67
69
68
import dbus
70
69
import dbus.service
75
74
import ctypes.util
76
75
import xml.dom.minidom
77
76
import inspect
78
import GnuPGInterface
77
import Crypto.Cipher.AES
79
78
80
79
try:
81
80
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
84
except ImportError:
86
85
SO_BINDTODEVICE = None
87
86
87
88
88
version = "1.4.1"
89
stored_state_file = "clients.pickle"
90
89
91
90
logger = logging.getLogger()
91
stored_state_path = "/var/lib/mandos/clients.pickle"
92
92
93
syslogger = (logging.handlers.SysLogHandler
93
94
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
95
address = str("/dev/log")))
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(debug, level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
if debug:
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet',
146
'--no-use-agent'])
147
148
def __enter__(self):
149
return self
150
151
def __exit__ (self, exc_type, exc_value, traceback):
152
self._cleanup()
153
return False
154
155
def __del__(self):
156
self._cleanup()
157
158
def _cleanup(self):
159
if self.tempdir is not None:
160
# Delete contents of tempdir
161
for root, dirs, files in os.walk(self.tempdir,
162
topdown = False):
163
for filename in files:
164
os.remove(os.path.join(root, filename))
165
for dirname in dirs:
166
os.rmdir(os.path.join(root, dirname))
167
# Remove tempdir
168
os.rmdir(self.tempdir)
169
self.tempdir = None
170
171
def password_encode(self, password):
172
# Passphrase can not be empty and can not contain newlines or
173
# NUL bytes. So we prefix it and hex encode it.
174
return b"mandos" + binascii.hexlify(password)
175
176
def encrypt(self, data, password):
177
self.gnupg.passphrase = self.password_encode(password)
178
with open(os.devnull) as devnull:
179
try:
180
proc = self.gnupg.run(['--symmetric'],
181
create_fhs=['stdin', 'stdout'],
182
attach_fhs={'stderr': devnull})
183
with contextlib.closing(proc.handles['stdin']) as f:
184
f.write(data)
185
with contextlib.closing(proc.handles['stdout']) as f:
186
ciphertext = f.read()
187
proc.wait()
188
except IOError as e:
189
raise PGPError(e)
190
self.gnupg.passphrase = None
191
return ciphertext
192
193
def decrypt(self, data, password):
194
self.gnupg.passphrase = self.password_encode(password)
195
with open(os.devnull) as devnull:
196
try:
197
proc = self.gnupg.run(['--decrypt'],
198
create_fhs=['stdin', 'stdout'],
199
attach_fhs={'stderr': devnull})
200
with contextlib.closing(proc.handles['stdin'] ) as f:
201
f.write(data)
202
with contextlib.closing(proc.handles['stdout']) as f:
203
decrypted_plaintext = f.read()
204
proc.wait()
205
except IOError as e:
206
raise PGPError(e)
207
self.gnupg.passphrase = None
208
return decrypted_plaintext
209
96
syslogger.setFormatter(logging.Formatter
97
('Mandos [%(process)d]: %(levelname)s:'
98
' %(message)s'))
99
logger.addHandler(syslogger)
100
101
console = logging.StreamHandler()
102
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
103
' [%(process)d]:'
104
' %(levelname)s:'
105
' %(message)s'))
106
logger.addHandler(console)
210
107
211
108
212
109
class AvahiError(Exception):
329
226
try:
330
227
self.group.Free()
331
228
except (dbus.exceptions.UnknownMethodException,
332
dbus.exceptions.DBusException):
229
dbus.exceptions.DBusException) as e:
333
230
pass
334
231
self.group = None
335
232
self.remove()
379
276
% self.name))
380
277
return ret
381
278
382
def timedelta_to_milliseconds(td):
279
def _timedelta_to_milliseconds(td):
383
280
"Convert a datetime.timedelta() to milliseconds"
384
281
return ((td.days * 24 * 60 * 60 * 1000)
385
282
+ (td.seconds * 1000)
389
286
"""A representation of a client host served by this server.
390
287
391
288
Attributes:
392
approved: bool(); 'None' if not yet approved/disapproved
289
_approved: bool(); 'None' if not yet approved/disapproved
393
290
approval_delay: datetime.timedelta(); Time to wait for approval
394
291
approval_duration: datetime.timedelta(); Duration of one approval
395
292
checker: subprocess.Popen(); a running checker process used
413
310
interval: datetime.timedelta(); How often to start a new checker
414
311
last_approval_request: datetime.datetime(); (UTC) or None
415
312
last_checked_ok: datetime.datetime(); (UTC) or None
416
last_checker_status: integer between 0 and 255 reflecting exit
417
status of last checker. -1 reflects crashed
418
checker, or None.
419
last_enabled: datetime.datetime(); (UTC) or None
313
last_checker_status: integer between 0 and 255 reflecting exit status
314
of last checker. -1 reflect crashed checker,
315
or None.
316
last_enabled: datetime.datetime(); (UTC)
420
317
name: string; from the config file, used in log messages and
421
318
D-Bus identifiers
422
319
secret: bytestring; sent verbatim (over TLS) to client
432
329
"created", "enabled", "fingerprint",
433
330
"host", "interval", "last_checked_ok",
434
331
"last_enabled", "name", "timeout")
435
client_defaults = { "timeout": "5m",
436
"extended_timeout": "15m",
437
"interval": "2m",
438
"checker": "fping -q -- %%(host)s",
439
"host": "",
440
"approval_delay": "0s",
441
"approval_duration": "1s",
442
"approved_by_default": "True",
443
"enabled": "True",
444
}
445
332
446
333
def timeout_milliseconds(self):
447
334
"Return the 'timeout' attribute in milliseconds"
448
return timedelta_to_milliseconds(self.timeout)
335
return _timedelta_to_milliseconds(self.timeout)
449
336
450
337
def extended_timeout_milliseconds(self):
451
338
"Return the 'extended_timeout' attribute in milliseconds"
452
return timedelta_to_milliseconds(self.extended_timeout)
339
return _timedelta_to_milliseconds(self.extended_timeout)
453
340
454
341
def interval_milliseconds(self):
455
342
"Return the 'interval' attribute in milliseconds"
456
return timedelta_to_milliseconds(self.interval)
343
return _timedelta_to_milliseconds(self.interval)
457
344
458
345
def approval_delay_milliseconds(self):
459
return timedelta_to_milliseconds(self.approval_delay)
460
461
@staticmethod
462
def config_parser(config):
463
""" Construct a new dict of client settings of this form:
464
{ client_name: {setting_name: value, ...}, ...}
465
with exceptions for any special settings as defined above"""
466
settings = {}
467
for client_name in config.sections():
468
section = dict(config.items(client_name))
469
client = settings[client_name] = {}
470
471
client["host"] = section["host"]
472
# Reformat values from string types to Python types
473
client["approved_by_default"] = config.getboolean(
474
client_name, "approved_by_default")
475
client["enabled"] = config.getboolean(client_name, "enabled")
476
477
client["fingerprint"] = (section["fingerprint"].upper()
478
.replace(" ", ""))
479
if "secret" in section:
480
client["secret"] = section["secret"].decode("base64")
481
elif "secfile" in section:
482
with open(os.path.expanduser(os.path.expandvars
483
(section["secfile"])),
484
"rb") as secfile:
485
client["secret"] = secfile.read()
486
else:
487
raise TypeError("No secret or secfile for section %s"
488
% section)
489
client["timeout"] = string_to_delta(section["timeout"])
490
client["extended_timeout"] = string_to_delta(
491
section["extended_timeout"])
492
client["interval"] = string_to_delta(section["interval"])
493
client["approval_delay"] = string_to_delta(
494
section["approval_delay"])
495
client["approval_duration"] = string_to_delta(
496
section["approval_duration"])
497
client["checker_command"] = section["checker"]
498
client["last_approval_request"] = None
499
client["last_checked_ok"] = None
500
client["last_checker_status"] = None
501
if client["enabled"]:
502
client["last_enabled"] = datetime.datetime.utcnow()
503
client["expires"] = (datetime.datetime.utcnow()
504
+ client["timeout"])
505
else:
506
client["last_enabled"] = None
507
client["expires"] = None
508
509
return settings
510
511
512
def __init__(self, settings, name = None):
346
return _timedelta_to_milliseconds(self.approval_delay)
347
348
def __init__(self, name = None, config=None):
513
349
"""Note: the 'checker' key in 'config' sets the
514
350
'checker_command' attribute and *not* the 'checker'
515
351
attribute."""
516
352
self.name = name
517
# adding all client settings
518
for setting, value in settings.iteritems():
519
setattr(self, setting, value)
520
353
if config is None:
354
config = {}
521
355
logger.debug("Creating client %r", self.name)
522
356
# Uppercase and remove spaces from fingerprint for later
523
357
# comparison purposes with return value from the fingerprint()
524
358
# function
359
self.fingerprint = (config["fingerprint"].upper()
360
.replace(" ", ""))
525
361
logger.debug(" Fingerprint: %s", self.fingerprint)
526
self.created = settings.get("created", datetime.datetime.utcnow())
527
528
# attributes specific for this server instance
362
if "secret" in config:
363
self.secret = config["secret"].decode("base64")
364
elif "secfile" in config:
365
with open(os.path.expanduser(os.path.expandvars
366
(config["secfile"])),
367
"rb") as secfile:
368
self.secret = secfile.read()
369
else:
370
raise TypeError("No secret or secfile for client %s"
371
% self.name)
372
self.host = config.get("host", "")
373
self.created = datetime.datetime.utcnow()
374
self.enabled = True
375
self.last_approval_request = None
376
self.last_enabled = datetime.datetime.utcnow()
377
self.last_checked_ok = None
378
self.last_checker_status = None
379
self.timeout = string_to_delta(config["timeout"])
380
self.extended_timeout = string_to_delta(config
381
["extended_timeout"])
382
self.interval = string_to_delta(config["interval"])
529
383
self.checker = None
530
384
self.checker_initiator_tag = None
531
385
self.disable_initiator_tag = None
386
self.expires = datetime.datetime.utcnow() + self.timeout
532
387
self.checker_callback_tag = None
388
self.checker_command = config["checker"]
533
389
self.current_checker_command = None
534
self.approved = None
390
self._approved = None
391
self.approved_by_default = config.get("approved_by_default",
392
True)
535
393
self.approvals_pending = 0
394
self.approval_delay = string_to_delta(
395
config["approval_delay"])
396
self.approval_duration = string_to_delta(
397
config["approval_duration"])
536
398
self.changedstate = (multiprocessing_manager
537
399
.Condition(multiprocessing_manager
538
400
.Lock()))
539
self.client_structure = [attr for attr in
540
self.__dict__.iterkeys()
541
if not attr.startswith("_")]
401
self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]
542
402
self.client_structure.append("client_structure")
543
403
404
544
405
for name, t in inspect.getmembers(type(self),
545
lambda obj:
546
isinstance(obj,
547
property)):
406
lambda obj: isinstance(obj, property)):
548
407
if not name.startswith("_"):
549
408
self.client_structure.append(name)
550
409
586
445
587
446
def __del__(self):
588
447
self.disable()
589
448
590
449
def init_checker(self):
591
450
# Schedule a new checker to be started an 'interval' from now,
592
451
# and every interval from then on.
599
458
self.disable))
600
459
# Also start a new checker *right now*.
601
460
self.start_checker()
602
461
462
603
463
def checker_callback(self, pid, condition, command):
604
464
"""The checker has completed, so take appropriate actions."""
605
465
self.checker_callback_tag = None
606
466
self.checker = None
607
467
if os.WIFEXITED(condition):
608
self.last_checker_status = os.WEXITSTATUS(condition)
468
self.last_checker_status = os.WEXITSTATUS(condition)
609
469
if self.last_checker_status == 0:
610
470
logger.info("Checker for %(name)s succeeded",
611
471
vars(self))
631
491
gobject.source_remove(self.disable_initiator_tag)
632
492
if getattr(self, "enabled", False):
633
493
self.disable_initiator_tag = (gobject.timeout_add
634
(timedelta_to_milliseconds
494
(_timedelta_to_milliseconds
635
495
(timeout), self.disable))
636
496
self.expires = datetime.datetime.utcnow() + timeout
637
497
731
591
raise
732
592
self.checker = None
733
593
594
# Encrypts a client secret and stores it in a varible encrypted_secret
595
def encrypt_secret(self, key):
596
# Encryption-key need to be of a specific size, so we hash inputed key
597
hasheng = hashlib.sha256()
598
hasheng.update(key)
599
encryptionkey = hasheng.digest()
600
601
# Create validation hash so we know at decryption if it was sucessful
602
hasheng = hashlib.sha256()
603
hasheng.update(self.secret)
604
validationhash = hasheng.digest()
605
606
# Encrypt secret
607
iv = os.urandom(Crypto.Cipher.AES.block_size)
608
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
609
Crypto.Cipher.AES.MODE_CFB, iv)
610
ciphertext = ciphereng.encrypt(validationhash+self.secret)
611
self.encrypted_secret = (ciphertext, iv)
612
613
# Decrypt a encrypted client secret
614
def decrypt_secret(self, key):
615
# Decryption-key need to be of a specific size, so we hash inputed key
616
hasheng = hashlib.sha256()
617
hasheng.update(key)
618
encryptionkey = hasheng.digest()
619
620
# Decrypt encrypted secret
621
ciphertext, iv = self.encrypted_secret
622
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
623
Crypto.Cipher.AES.MODE_CFB, iv)
624
plain = ciphereng.decrypt(ciphertext)
625
626
# Validate decrypted secret to know if it was succesful
627
hasheng = hashlib.sha256()
628
validationhash = plain[:hasheng.digest_size]
629
secret = plain[hasheng.digest_size:]
630
hasheng.update(secret)
631
632
# if validation fails, we use key as new secret. Otherwhise, we use
633
# the decrypted secret
634
if hasheng.digest() == validationhash:
635
self.secret = secret
636
else:
637
self.secret = key
638
del self.encrypted_secret
639
734
640
735
641
def dbus_service_property(dbus_interface, signature="v",
736
642
access="readwrite", byte_arrays=False):
854
760
855
761
Note: Will not include properties with access="write".
856
762
"""
857
properties = {}
763
all = {}
858
764
for name, prop in self._get_all_dbus_properties():
859
765
if (interface_name
860
766
and interface_name != prop._dbus_interface):
865
771
continue
866
772
value = prop()
867
773
if not hasattr(value, "variant_level"):
868
properties[name] = value
774
all[name] = value
869
775
continue
870
properties[name] = type(value)(value, variant_level=
871
value.variant_level+1)
872
return dbus.Dictionary(properties, signature="sv")
776
all[name] = type(value)(value, variant_level=
777
value.variant_level+1)
778
return dbus.Dictionary(all, signature="sv")
873
779
874
780
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
875
781
out_signature="s",
926
832
return dbus.String(dt.isoformat(),
927
833
variant_level=variant_level)
928
834
929
930
835
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
931
836
.__metaclass__):
932
837
"""Applied to an empty subclass of a D-Bus object, this metaclass
1024
929
attribute.func_closure)))
1025
930
return type.__new__(mcs, name, bases, attr)
1026
931
1027
1028
932
class ClientDBus(Client, DBusObjectWithProperties):
1029
933
"""A Client class using D-Bus
1030
934
1041
945
def __init__(self, bus = None, *args, **kwargs):
1042
946
self.bus = bus
1043
947
Client.__init__(self, *args, **kwargs)
1044
self._approvals_pending = 0
1045
948
1046
949
self._approvals_pending = 0
1047
950
# Only now, when this client is initialized, can it show up on
1048
951
# the D-Bus
1059
962
variant_level=1):
1060
963
""" Modify a variable so that it's a property which announces
1061
964
its changes to DBus.
1062
965
1063
966
transform_fun: Function that takes a value and a variant_level
1064
967
and transforms it to a D-Bus type.
1065
968
dbus_name: D-Bus name of the variable
1099
1002
datetime_to_dbus, "LastApprovalRequest")
1100
1003
approved_by_default = notifychangeproperty(dbus.Boolean,
1101
1004
"ApprovedByDefault")
1102
approval_delay = notifychangeproperty(dbus.UInt64,
1005
approval_delay = notifychangeproperty(dbus.UInt16,
1103
1006
"ApprovalDelay",
1104
1007
type_func =
1105
timedelta_to_milliseconds)
1008
_timedelta_to_milliseconds)
1106
1009
approval_duration = notifychangeproperty(
1107
dbus.UInt64, "ApprovalDuration",
1108
type_func = timedelta_to_milliseconds)
1010
dbus.UInt16, "ApprovalDuration",
1011
type_func = _timedelta_to_milliseconds)
1109
1012
host = notifychangeproperty(dbus.String, "Host")
1110
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1013
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1111
1014
type_func =
1112
timedelta_to_milliseconds)
1015
_timedelta_to_milliseconds)
1113
1016
extended_timeout = notifychangeproperty(
1114
dbus.UInt64, "ExtendedTimeout",
1115
type_func = timedelta_to_milliseconds)
1116
interval = notifychangeproperty(dbus.UInt64,
1017
dbus.UInt16, "ExtendedTimeout",
1018
type_func = _timedelta_to_milliseconds)
1019
interval = notifychangeproperty(dbus.UInt16,
1117
1020
"Interval",
1118
1021
type_func =
1119
timedelta_to_milliseconds)
1022
_timedelta_to_milliseconds)
1120
1023
checker_command = notifychangeproperty(dbus.String, "Checker")
1121
1024
1122
1025
del notifychangeproperty
1164
1067
return r
1165
1068
1166
1069
def _reset_approved(self):
1167
self.approved = None
1070
self._approved = None
1168
1071
return False
1169
1072
1170
1073
def approve(self, value=True):
1171
1074
self.send_changedstate()
1172
self.approved = value
1173
gobject.timeout_add(timedelta_to_milliseconds
1075
self._approved = value
1076
gobject.timeout_add(_timedelta_to_milliseconds
1174
1077
(self.approval_duration),
1175
1078
self._reset_approved)
1176
1079
1219
1122
"D-Bus signal"
1220
1123
return self.need_approval()
1221
1124
1222
# NeRwequest - signal
1223
@dbus.service.signal(_interface, signature="s")
1224
def NewRequest(self, ip):
1225
"""D-Bus signal
1226
Is sent after a client request a password.
1227
"""
1228
pass
1229
1230
1125
## Methods
1231
1126
1232
1127
# Approve - method
1290
1185
access="readwrite")
1291
1186
def ApprovalDuration_dbus_property(self, value=None):
1292
1187
if value is None: # get
1293
return dbus.UInt64(timedelta_to_milliseconds(
1188
return dbus.UInt64(_timedelta_to_milliseconds(
1294
1189
self.approval_duration))
1295
1190
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1296
1191
1310
1205
def Host_dbus_property(self, value=None):
1311
1206
if value is None: # get
1312
1207
return dbus.String(self.host)
1313
self.host = unicode(value)
1208
self.host = value
1314
1209
1315
1210
# Created - property
1316
1211
@dbus_service_property(_interface, signature="s", access="read")
1317
1212
def Created_dbus_property(self):
1318
return datetime_to_dbus(self.created)
1213
return dbus.String(datetime_to_dbus(self.created))
1319
1214
1320
1215
# LastEnabled - property
1321
1216
@dbus_service_property(_interface, signature="s", access="read")
1365
1260
gobject.source_remove(self.disable_initiator_tag)
1366
1261
self.disable_initiator_tag = None
1367
1262
self.expires = None
1368
time_to_die = timedelta_to_milliseconds((self
1369
.last_checked_ok
1370
+ self.timeout)
1371
- datetime.datetime
1372
.utcnow())
1263
time_to_die = _timedelta_to_milliseconds((self
1264
.last_checked_ok
1265
+ self.timeout)
1266
- datetime.datetime
1267
.utcnow())
1373
1268
if time_to_die <= 0:
1374
1269
# The timeout has passed
1375
1270
self.disable()
1397
1292
self.interval = datetime.timedelta(0, 0, 0, value)
1398
1293
if getattr(self, "checker_initiator_tag", None) is None:
1399
1294
return
1400
if self.enabled:
1401
# Reschedule checker run
1402
gobject.source_remove(self.checker_initiator_tag)
1403
self.checker_initiator_tag = (gobject.timeout_add
1404
(value, self.start_checker))
1405
self.start_checker() # Start one now, too
1295
# Reschedule checker run
1296
gobject.source_remove(self.checker_initiator_tag)
1297
self.checker_initiator_tag = (gobject.timeout_add
1298
(value, self.start_checker))
1299
self.start_checker() # Start one now, too
1406
1300
1407
1301
# Checker - property
1408
1302
@dbus_service_property(_interface, signature="s",
1410
1304
def Checker_dbus_property(self, value=None):
1411
1305
if value is None: # get
1412
1306
return dbus.String(self.checker_command)
1413
self.checker_command = unicode(value)
1307
self.checker_command = value
1414
1308
1415
1309
# CheckerRunning - property
1416
1310
@dbus_service_property(_interface, signature="b",
1445
1339
raise KeyError()
1446
1340
1447
1341
def __getattribute__(self, name):
1448
if name == '_pipe':
1342
if(name == '_pipe'):
1449
1343
return super(ProxyClient, self).__getattribute__(name)
1450
1344
self._pipe.send(('getattr', name))
1451
1345
data = self._pipe.recv()
1458
1352
return func
1459
1353
1460
1354
def __setattr__(self, name, value):
1461
if name == '_pipe':
1355
if(name == '_pipe'):
1462
1356
return super(ProxyClient, self).__setattr__(name, value)
1463
1357
self._pipe.send(('setattr', name, value))
1464
1358
1465
1466
1359
class ClientDBusTransitional(ClientDBus):
1467
1360
__metaclass__ = AlternateDBusNamesMetaclass
1468
1361
1469
1470
1362
class ClientHandler(socketserver.BaseRequestHandler, object):
1471
1363
"""A class to handle client connections.
1472
1364
1540
1432
except KeyError:
1541
1433
return
1542
1434
1543
if self.server.use_dbus:
1544
# Emit D-Bus signal
1545
client.NewRequest(str(self.client_address))
1546
1547
1435
if client.approval_delay:
1548
1436
delay = client.approval_delay
1549
1437
client.approvals_pending += 1
1558
1446
client.Rejected("Disabled")
1559
1447
return
1560
1448
1561
if client.approved or not client.approval_delay:
1449
if client._approved or not client.approval_delay:
1562
1450
#We are approved or approval is disabled
1563
1451
break
1564
elif client.approved is None:
1452
elif client._approved is None:
1565
1453
logger.info("Client %s needs approval",
1566
1454
client.name)
1567
1455
if self.server.use_dbus:
1581
1469
time = datetime.datetime.now()
1582
1470
client.changedstate.acquire()
1583
1471
(client.changedstate.wait
1584
(float(client.timedelta_to_milliseconds(delay)
1472
(float(client._timedelta_to_milliseconds(delay)
1585
1473
/ 1000)))
1586
1474
client.changedstate.release()
1587
1475
time2 = datetime.datetime.now()
1686
1574
# Convert the buffer to a Python bytestring
1687
1575
fpr = ctypes.string_at(buf, buf_len.value)
1688
1576
# Convert the bytestring to hexadecimal notation
1689
hex_fpr = binascii.hexlify(fpr).upper()
1577
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1690
1578
return hex_fpr
1691
1579
1692
1580
1695
1583
def sub_process_main(self, request, address):
1696
1584
try:
1697
1585
self.finish_request(request, address)
1698
except Exception:
1586
except:
1699
1587
self.handle_error(request, address)
1700
1588
self.close_request(request)
1701
1589
1949
1837
return timevalue
1950
1838
1951
1839
1840
def if_nametoindex(interface):
1841
"""Call the C function if_nametoindex(), or equivalent
1842
1843
Note: This function cannot accept a unicode string."""
1844
global if_nametoindex
1845
try:
1846
if_nametoindex = (ctypes.cdll.LoadLibrary
1847
(ctypes.util.find_library("c"))
1848
.if_nametoindex)
1849
except (OSError, AttributeError):
1850
logger.warning("Doing if_nametoindex the hard way")
1851
def if_nametoindex(interface):
1852
"Get an interface index the hard way, i.e. using fcntl()"
1853
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1854
with contextlib.closing(socket.socket()) as s:
1855
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1856
struct.pack(str("16s16x"),
1857
interface))
1858
interface_index = struct.unpack(str("I"),
1859
ifreq[16:20])[0]
1860
return interface_index
1861
return if_nametoindex(interface)
1862
1863
1952
1864
def daemon(nochdir = False, noclose = False):
1953
1865
"""See daemon(3). Standard BSD Unix function.
1954
1866
2010
1922
parser.add_argument("--no-ipv6", action="store_false",
2011
1923
dest="use_ipv6", help="Do not use IPv6")
2012
1924
parser.add_argument("--no-restore", action="store_false",
2013
dest="restore", help="Do not restore stored"
2014
" state")
2015
parser.add_argument("--statedir", metavar="DIR",
2016
help="Directory to save/restore state in")
2017
1925
dest="restore", help="Do not restore stored state",
1926
default=True)
1927
2018
1928
options = parser.parse_args()
2019
1929
2020
1930
if options.check:
2033
1943
"use_dbus": "True",
2034
1944
"use_ipv6": "True",
2035
1945
"debuglevel": "",
2036
"restore": "True",
2037
"statedir": "/var/lib/mandos"
2038
1946
}
2039
1947
2040
1948
# Parse config file for server-global settings
2057
1965
# options, if set.
2058
1966
for option in ("interface", "address", "port", "debug",
2059
1967
"priority", "servicename", "configdir",
2060
"use_dbus", "use_ipv6", "debuglevel", "restore",
2061
"statedir"):
1968
"use_dbus", "use_ipv6", "debuglevel", "restore"):
2062
1969
value = getattr(options, option)
2063
1970
if value is not None:
2064
1971
server_settings[option] = value
2076
1983
debuglevel = server_settings["debuglevel"]
2077
1984
use_dbus = server_settings["use_dbus"]
2078
1985
use_ipv6 = server_settings["use_ipv6"]
2079
stored_state_path = os.path.join(server_settings["statedir"],
2080
stored_state_file)
2081
2082
if debug:
2083
initlogger(debug, logging.DEBUG)
2084
else:
2085
if not debuglevel:
2086
initlogger(debug)
2087
else:
2088
level = getattr(logging, debuglevel.upper())
2089
initlogger(debug, level)
2090
1986
2091
1987
if server_settings["servicename"] != "Mandos":
2092
1988
syslogger.setFormatter(logging.Formatter
2095
1991
% server_settings["servicename"]))
2096
1992
2097
1993
# Parse config file with clients
2098
client_config = configparser.SafeConfigParser(Client.client_defaults)
1994
client_defaults = { "timeout": "5m",
1995
"extended_timeout": "15m",
1996
"interval": "2m",
1997
"checker": "fping -q -- %%(host)s",
1998
"host": "",
1999
"approval_delay": "0s",
2000
"approval_duration": "1s",
2001
}
2002
client_config = configparser.SafeConfigParser(client_defaults)
2099
2003
client_config.read(os.path.join(server_settings["configdir"],
2100
2004
"clients.conf"))
2101
2005
2139
2043
if error[0] != errno.EPERM:
2140
2044
raise error
2141
2045
2046
if not debug and not debuglevel:
2047
logger.setLevel(logging.WARNING)
2048
if debuglevel:
2049
level = getattr(logging, debuglevel.upper())
2050
logger.setLevel(level)
2051
2142
2052
if debug:
2053
logger.setLevel(logging.DEBUG)
2143
2054
# Enable all possible GnuTLS debugging
2144
2055
2145
2056
# "Use a log level over 10 to enable all debugging options."
2158
2069
os.dup2(null, sys.stdin.fileno())
2159
2070
if null > 2:
2160
2071
os.close(null)
2072
else:
2073
# No console logging
2074
logger.removeHandler(console)
2161
2075
2162
2076
# Need to fork before connecting to D-Bus
2163
2077
if not debug:
2164
2078
# Close all input and output, do double fork, etc.
2165
2079
daemon()
2166
2080
2167
gobject.threads_init()
2168
2169
2081
global main_loop
2170
2082
# From the Avahi example code
2171
2083
DBusGMainLoop(set_as_default=True )
2201
2113
client_class = functools.partial(ClientDBusTransitional,
2202
2114
bus = bus)
2203
2115
2204
client_settings = Client.config_parser(client_config)
2116
special_settings = {
2117
# Some settings need to be accessd by special methods;
2118
# booleans need .getboolean(), etc. Here is a list of them:
2119
"approved_by_default":
2120
lambda section:
2121
client_config.getboolean(section, "approved_by_default"),
2122
}
2123
# Construct a new dict of client settings of this form:
2124
# { client_name: {setting_name: value, ...}, ...}
2125
# with exceptions for any special settings as defined above
2126
client_settings = dict((clientname,
2127
dict((setting,
2128
(value if setting not in special_settings
2129
else special_settings[setting](clientname)))
2130
for setting, value in client_config.items(clientname)))
2131
for clientname in client_config.sections())
2132
2205
2133
old_client_settings = {}
2206
clients_data = {}
2207
2208
# Get client data and settings from last running state.
2134
clients_data = []
2135
2136
# Get client data and settings from last running state.
2209
2137
if server_settings["restore"]:
2210
2138
try:
2211
2139
with open(stored_state_path, "rb") as stored_state:
2212
clients_data, old_client_settings = (pickle.load
2213
(stored_state))
2140
clients_data, old_client_settings = pickle.load(stored_state)
2214
2141
os.remove(stored_state_path)
2215
2142
except IOError as e:
2216
logger.warning("Could not load persistent state: {0}"
2217
.format(e))
2143
logger.warning("Could not load persistant state: {0}".format(e))
2218
2144
if e.errno != errno.ENOENT:
2219
2145
raise
2220
except EOFError as e:
2221
logger.warning("Could not load persistent state: "
2222
"EOFError: {0}".format(e))
2223
2224
with PGPEngine() as pgp:
2225
for client_name, client in clients_data.iteritems():
2226
# Decide which value to use after restoring saved state.
2227
# We have three different values: Old config file,
2228
# new config file, and saved state.
2229
# New config value takes precedence if it differs from old
2230
# config value, otherwise use saved state.
2231
for name, value in client_settings[client_name].items():
2232
try:
2233
# For each value in new config, check if it
2234
# differs from the old config value (Except for
2235
# the "secret" attribute)
2236
if (name != "secret" and
2237
value != old_client_settings[client_name]
2238
[name]):
2239
client[name] = value
2240
except KeyError:
2241
pass
2242
2243
# Clients who has passed its expire date can still be
2244
# enabled if its last checker was successful. Clients
2245
# whose checker failed before we stored its state is
2246
# assumed to have failed all checkers during downtime.
2247
if client["enabled"]:
2248
if datetime.datetime.utcnow() >= client["expires"]:
2249
if not client["last_checked_ok"]:
2250
logger.warning(
2251
"disabling client {0} - Client never "
2252
"performed a successfull checker"
2253
.format(client["name"]))
2254
client["enabled"] = False
2255
elif client["last_checker_status"] != 0:
2256
logger.warning(
2257
"disabling client {0} - Client "
2258
"last checker failed with error code {1}"
2259
.format(client["name"],
2260
client["last_checker_status"]))
2261
client["enabled"] = False
2262
else:
2263
client["expires"] = (datetime.datetime
2264
.utcnow()
2265
+ client["timeout"])
2266
2146
2147
for client in clients_data:
2148
client_name = client["name"]
2149
2150
# Decide which value to use after restoring saved state.
2151
# We have three different values: Old config file,
2152
# new config file, and saved state.
2153
# New config value takes precedence if it differs from old
2154
# config value, otherwise use saved state.
2155
for name, value in client_settings[client_name].items():
2267
2156
try:
2268
client["secret"] = (
2269
pgp.decrypt(client["encrypted_secret"],
2270
client_settings[client_name]
2271
["secret"]))
2272
except PGPError:
2273
# If decryption fails, we use secret from new settings
2274
logger.debug("Failed to decrypt {0} old secret"
2275
.format(client_name))
2276
client["secret"] = (
2277
client_settings[client_name]["secret"])
2278
2279
2280
# Add/remove clients based on new changes made to config
2281
for client_name in set(old_client_settings) - set(client_settings):
2282
del clients_data[client_name]
2283
for client_name in set(client_settings) - set(old_client_settings):
2284
clients_data[client_name] = client_settings[client_name]
2285
2286
# Create clients all clients
2287
for client_name, client in clients_data.iteritems():
2288
tcp_server.clients[client_name] = client_class(
2289
name = client_name, settings = client)
2290
2157
# For each value in new config, check if it differs
2158
# from the old config value (Except for the "secret"
2159
# attribute)
2160
if name != "secret" and value != old_client_settings[client_name][name]:
2161
setattr(client, name, value)
2162
except KeyError:
2163
pass
2164
2165
# Clients who has passed its expire date, can still be enabled if its
2166
# last checker was sucessful. Clients who checkers failed before we
2167
# stored it state is asumed to had failed checker during downtime.
2168
if client["enabled"] and client["last_checked_ok"]:
2169
if ((datetime.datetime.utcnow() - client["last_checked_ok"])
2170
> client["interval"]):
2171
if client["last_checker_status"] != 0:
2172
client["enabled"] = False
2173
else:
2174
client["expires"] = datetime.datetime.utcnow() + client["timeout"]
2175
2176
client["changedstate"] = (multiprocessing_manager
2177
.Condition(multiprocessing_manager
2178
.Lock()))
2179
if use_dbus:
2180
new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)
2181
tcp_server.clients[client_name] = new_client
2182
new_client.bus = bus
2183
for name, value in client.iteritems():
2184
setattr(new_client, name, value)
2185
client_object_name = unicode(client_name).translate(
2186
{ord("."): ord("_"),
2187
ord("-"): ord("_")})
2188
new_client.dbus_object_path = (dbus.ObjectPath
2189
("/clients/" + client_object_name))
2190
DBusObjectWithProperties.__init__(new_client,
2191
new_client.bus,
2192
new_client.dbus_object_path)
2193
else:
2194
tcp_server.clients[client_name] = Client.__new__(Client)
2195
for name, value in client.iteritems():
2196
setattr(tcp_server.clients[client_name], name, value)
2197
2198
tcp_server.clients[client_name].decrypt_secret(
2199
client_settings[client_name]["secret"])
2200
2201
# Create/remove clients based on new changes made to config
2202
for clientname in set(old_client_settings) - set(client_settings):
2203
del tcp_server.clients[clientname]
2204
for clientname in set(client_settings) - set(old_client_settings):
2205
tcp_server.clients[clientname] = (client_class(name = clientname,
2206
config =
2207
client_settings
2208
[clientname]))
2209
2210
2291
2211
if not tcp_server.clients:
2292
2212
logger.warning("No clients defined")
2293
2213
2304
2224
# "pidfile" was never created
2305
2225
pass
2306
2226
del pidfilename
2227
2307
2228
signal.signal(signal.SIGINT, signal.SIG_IGN)
2308
2229
2309
2230
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2374
2295
multiprocessing.active_children()
2375
2296
if not (tcp_server.clients or client_settings):
2376
2297
return
2377
2378
# Store client before exiting. Secrets are encrypted with key
2379
# based on what config file has. If config file is
2380
# removed/edited, old secret will thus be unrecovable.
2381
clients = {}
2382
with PGPEngine() as pgp:
2383
for client in tcp_server.clients.itervalues():
2384
key = client_settings[client.name]["secret"]
2385
client.encrypted_secret = pgp.encrypt(client.secret,
2386
key)
2387
client_dict = {}
2388
2389
# A list of attributes that can not be pickled
2390
# + secret.
2391
exclude = set(("bus", "changedstate", "secret",
2392
"checker"))
2393
for name, typ in (inspect.getmembers
2394
(dbus.service.Object)):
2395
exclude.add(name)
2396
2397
client_dict["encrypted_secret"] = (client
2398
.encrypted_secret)
2399
for attr in client.client_structure:
2400
if attr not in exclude:
2401
client_dict[attr] = getattr(client, attr)
2402
2403
clients[client.name] = client_dict
2404
del client_settings[client.name]["secret"]
2405
2298
2299
# Store client before exiting. Secrets are encrypted with key based
2300
# on what config file has. If config file is removed/edited, old
2301
# secret will thus be unrecovable.
2302
clients = []
2303
for client in tcp_server.clients.itervalues():
2304
client.encrypt_secret(client_settings[client.name]["secret"])
2305
2306
client_dict = {}
2307
2308
# A list of attributes that will not be stored when shuting down.
2309
exclude = set(("bus", "changedstate", "secret"))
2310
for name, typ in inspect.getmembers(dbus.service.Object):
2311
exclude.add(name)
2312
2313
client_dict["encrypted_secret"] = client.encrypted_secret
2314
for attr in client.client_structure:
2315
if attr not in exclude:
2316
client_dict[attr] = getattr(client, attr)
2317
2318
clients.append(client_dict)
2319
del client_settings[client.name]["secret"]
2320
2406
2321
try:
2407
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2408
prefix="clients-",
2409
dir=os.path.dirname
2410
(stored_state_path))
2411
with os.fdopen(tempfd, "wb") as stored_state:
2322
with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:
2412
2323
pickle.dump((clients, client_settings), stored_state)
2413
os.rename(tempname, stored_state_path)
2414
except (IOError, OSError) as e:
2415
logger.warning("Could not save persistent state: {0}"
2416
.format(e))
2417
if not debug:
2418
try:
2419
os.remove(tempname)
2420
except NameError:
2421
pass
2422
if e.errno not in set((errno.ENOENT, errno.EACCES,
2423
errno.EEXIST)):
2424
raise e
2425
2324
except IOError as e:
2325
logger.warning("Could not save persistant state: {0}".format(e))
2326
if e.errno != errno.ENOENT:
2327
raise
2328
2426
2329
# Delete all clients, and settings from config
2427
2330
while tcp_server.clients:
2428
2331
name, client = tcp_server.clients.popitem()
2446
2349
# Need to initiate checking of clients
2447
2350
if client.enabled:
2448
2351
client.init_checker()
2352
2449
2353
2450
2354
tcp_server.enable()
2451
2355
tcp_server.server_activate()
2491
2395
# Must run before the D-Bus bus name gets deregistered
2492
2396
cleanup()
2493
2397
2398
2494
2399
if __name__ == '__main__':
2495
2400
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0