To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 520
- compare with another revision
- download diff
- download tarball
- view history from revision 520
- Committer: Björn Påhlsson
- Date: 2011-11-09 17:16:03 UTC
- mfrom: (518.1.1 mandos-persistent)
- Revision ID: belorn@fukt.bsnet.se-20111109171603-srz21uoclpldp5ve
merge persistent state
- files removed:
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import binascii
67
import tempfile
66
import hashlib
68
67
69
68
import dbus
70
69
import dbus.service
75
74
import ctypes.util
76
75
import xml.dom.minidom
77
76
import inspect
78
import GnuPGInterface
77
import Crypto.Cipher.AES
79
78
80
79
try:
81
80
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
84
except ImportError:
86
85
SO_BINDTODEVICE = None
87
86
88
version = "1.5.0"
89
stored_state_file = "clients.pickle"
87
88
version = "1.4.1"
90
89
91
90
logger = logging.getLogger()
91
stored_state_path = "/var/lib/mandos/clients.pickle"
92
92
93
syslogger = (logging.handlers.SysLogHandler
93
94
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
95
address = str("/dev/log")))
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(debug, level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
if debug:
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet',
146
'--no-use-agent'])
147
148
def __enter__(self):
149
return self
150
151
def __exit__ (self, exc_type, exc_value, traceback):
152
self._cleanup()
153
return False
154
155
def __del__(self):
156
self._cleanup()
157
158
def _cleanup(self):
159
if self.tempdir is not None:
160
# Delete contents of tempdir
161
for root, dirs, files in os.walk(self.tempdir,
162
topdown = False):
163
for filename in files:
164
os.remove(os.path.join(root, filename))
165
for dirname in dirs:
166
os.rmdir(os.path.join(root, dirname))
167
# Remove tempdir
168
os.rmdir(self.tempdir)
169
self.tempdir = None
170
171
def password_encode(self, password):
172
# Passphrase can not be empty and can not contain newlines or
173
# NUL bytes. So we prefix it and hex encode it.
174
return b"mandos" + binascii.hexlify(password)
175
176
def encrypt(self, data, password):
177
self.gnupg.passphrase = self.password_encode(password)
178
with open(os.devnull) as devnull:
179
try:
180
proc = self.gnupg.run(['--symmetric'],
181
create_fhs=['stdin', 'stdout'],
182
attach_fhs={'stderr': devnull})
183
with contextlib.closing(proc.handles['stdin']) as f:
184
f.write(data)
185
with contextlib.closing(proc.handles['stdout']) as f:
186
ciphertext = f.read()
187
proc.wait()
188
except IOError as e:
189
raise PGPError(e)
190
self.gnupg.passphrase = None
191
return ciphertext
192
193
def decrypt(self, data, password):
194
self.gnupg.passphrase = self.password_encode(password)
195
with open(os.devnull) as devnull:
196
try:
197
proc = self.gnupg.run(['--decrypt'],
198
create_fhs=['stdin', 'stdout'],
199
attach_fhs={'stderr': devnull})
200
with contextlib.closing(proc.handles['stdin'] ) as f:
201
f.write(data)
202
with contextlib.closing(proc.handles['stdout']) as f:
203
decrypted_plaintext = f.read()
204
proc.wait()
205
except IOError as e:
206
raise PGPError(e)
207
self.gnupg.passphrase = None
208
return decrypted_plaintext
209
96
syslogger.setFormatter(logging.Formatter
97
('Mandos [%(process)d]: %(levelname)s:'
98
' %(message)s'))
99
logger.addHandler(syslogger)
100
101
console = logging.StreamHandler()
102
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
103
' [%(process)d]:'
104
' %(levelname)s:'
105
' %(message)s'))
106
logger.addHandler(console)
210
107
211
108
212
109
class AvahiError(Exception):
329
226
try:
330
227
self.group.Free()
331
228
except (dbus.exceptions.UnknownMethodException,
332
dbus.exceptions.DBusException):
229
dbus.exceptions.DBusException) as e:
333
230
pass
334
231
self.group = None
335
232
self.remove()
379
276
% self.name))
380
277
return ret
381
278
382
def timedelta_to_milliseconds(td):
279
def _timedelta_to_milliseconds(td):
383
280
"Convert a datetime.timedelta() to milliseconds"
384
281
return ((td.days * 24 * 60 * 60 * 1000)
385
282
+ (td.seconds * 1000)
389
286
"""A representation of a client host served by this server.
390
287
391
288
Attributes:
392
approved: bool(); 'None' if not yet approved/disapproved
289
_approved: bool(); 'None' if not yet approved/disapproved
393
290
approval_delay: datetime.timedelta(); Time to wait for approval
394
291
approval_duration: datetime.timedelta(); Duration of one approval
395
292
checker: subprocess.Popen(); a running checker process used
413
310
interval: datetime.timedelta(); How often to start a new checker
414
311
last_approval_request: datetime.datetime(); (UTC) or None
415
312
last_checked_ok: datetime.datetime(); (UTC) or None
416
last_checker_status: integer between 0 and 255 reflecting exit
417
status of last checker. -1 reflects crashed
418
checker, or None.
419
last_enabled: datetime.datetime(); (UTC) or None
313
last_checker_status: integer between 0 and 255 reflecting exit status
314
of last checker. -1 reflect crashed checker,
315
or None.
316
last_enabled: datetime.datetime(); (UTC)
420
317
name: string; from the config file, used in log messages and
421
318
D-Bus identifiers
422
319
secret: bytestring; sent verbatim (over TLS) to client
432
329
"created", "enabled", "fingerprint",
433
330
"host", "interval", "last_checked_ok",
434
331
"last_enabled", "name", "timeout")
435
client_defaults = { "timeout": "5m",
436
"extended_timeout": "15m",
437
"interval": "2m",
438
"checker": "fping -q -- %%(host)s",
439
"host": "",
440
"approval_delay": "0s",
441
"approval_duration": "1s",
442
"approved_by_default": "True",
443
"enabled": "True",
444
}
445
332
446
333
def timeout_milliseconds(self):
447
334
"Return the 'timeout' attribute in milliseconds"
448
return timedelta_to_milliseconds(self.timeout)
335
return _timedelta_to_milliseconds(self.timeout)
449
336
450
337
def extended_timeout_milliseconds(self):
451
338
"Return the 'extended_timeout' attribute in milliseconds"
452
return timedelta_to_milliseconds(self.extended_timeout)
339
return _timedelta_to_milliseconds(self.extended_timeout)
453
340
454
341
def interval_milliseconds(self):
455
342
"Return the 'interval' attribute in milliseconds"
456
return timedelta_to_milliseconds(self.interval)
343
return _timedelta_to_milliseconds(self.interval)
457
344
458
345
def approval_delay_milliseconds(self):
459
return timedelta_to_milliseconds(self.approval_delay)
460
461
@staticmethod
462
def config_parser(config):
463
"""Construct a new dict of client settings of this form:
464
{ client_name: {setting_name: value, ...}, ...}
465
with exceptions for any special settings as defined above.
466
NOTE: Must be a pure function. Must return the same result
467
value given the same arguments.
468
"""
469
settings = {}
470
for client_name in config.sections():
471
section = dict(config.items(client_name))
472
client = settings[client_name] = {}
473
474
client["host"] = section["host"]
475
# Reformat values from string types to Python types
476
client["approved_by_default"] = config.getboolean(
477
client_name, "approved_by_default")
478
client["enabled"] = config.getboolean(client_name,
479
"enabled")
480
481
client["fingerprint"] = (section["fingerprint"].upper()
482
.replace(" ", ""))
483
if "secret" in section:
484
client["secret"] = section["secret"].decode("base64")
485
elif "secfile" in section:
486
with open(os.path.expanduser(os.path.expandvars
487
(section["secfile"])),
488
"rb") as secfile:
489
client["secret"] = secfile.read()
490
else:
491
raise TypeError("No secret or secfile for section %s"
492
% section)
493
client["timeout"] = string_to_delta(section["timeout"])
494
client["extended_timeout"] = string_to_delta(
495
section["extended_timeout"])
496
client["interval"] = string_to_delta(section["interval"])
497
client["approval_delay"] = string_to_delta(
498
section["approval_delay"])
499
client["approval_duration"] = string_to_delta(
500
section["approval_duration"])
501
client["checker_command"] = section["checker"]
502
client["last_approval_request"] = None
503
client["last_checked_ok"] = None
504
client["last_checker_status"] = None
505
506
return settings
507
508
509
def __init__(self, settings, name = None):
346
return _timedelta_to_milliseconds(self.approval_delay)
347
348
def __init__(self, name = None, config=None):
510
349
"""Note: the 'checker' key in 'config' sets the
511
350
'checker_command' attribute and *not* the 'checker'
512
351
attribute."""
513
352
self.name = name
514
# adding all client settings
515
for setting, value in settings.iteritems():
516
setattr(self, setting, value)
517
518
if self.enabled:
519
if not hasattr(self, "last_enabled"):
520
self.last_enabled = datetime.datetime.utcnow()
521
if not hasattr(self, "expires"):
522
self.expires = (datetime.datetime.utcnow()
523
+ self.timeout)
524
else:
525
self.last_enabled = None
526
self.expires = None
527
353
if config is None:
354
config = {}
528
355
logger.debug("Creating client %r", self.name)
529
356
# Uppercase and remove spaces from fingerprint for later
530
357
# comparison purposes with return value from the fingerprint()
531
358
# function
359
self.fingerprint = (config["fingerprint"].upper()
360
.replace(" ", ""))
532
361
logger.debug(" Fingerprint: %s", self.fingerprint)
533
self.created = settings.get("created",
534
datetime.datetime.utcnow())
535
536
# attributes specific for this server instance
362
if "secret" in config:
363
self.secret = config["secret"].decode("base64")
364
elif "secfile" in config:
365
with open(os.path.expanduser(os.path.expandvars
366
(config["secfile"])),
367
"rb") as secfile:
368
self.secret = secfile.read()
369
else:
370
raise TypeError("No secret or secfile for client %s"
371
% self.name)
372
self.host = config.get("host", "")
373
self.created = datetime.datetime.utcnow()
374
self.enabled = True
375
self.last_approval_request = None
376
self.last_enabled = datetime.datetime.utcnow()
377
self.last_checked_ok = None
378
self.last_checker_status = None
379
self.timeout = string_to_delta(config["timeout"])
380
self.extended_timeout = string_to_delta(config
381
["extended_timeout"])
382
self.interval = string_to_delta(config["interval"])
537
383
self.checker = None
538
384
self.checker_initiator_tag = None
539
385
self.disable_initiator_tag = None
386
self.expires = datetime.datetime.utcnow() + self.timeout
540
387
self.checker_callback_tag = None
388
self.checker_command = config["checker"]
541
389
self.current_checker_command = None
542
self.approved = None
390
self._approved = None
391
self.approved_by_default = config.get("approved_by_default",
392
True)
543
393
self.approvals_pending = 0
394
self.approval_delay = string_to_delta(
395
config["approval_delay"])
396
self.approval_duration = string_to_delta(
397
config["approval_duration"])
544
398
self.changedstate = (multiprocessing_manager
545
399
.Condition(multiprocessing_manager
546
400
.Lock()))
547
self.client_structure = [attr for attr in
548
self.__dict__.iterkeys()
549
if not attr.startswith("_")]
401
self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]
550
402
self.client_structure.append("client_structure")
551
403
404
552
405
for name, t in inspect.getmembers(type(self),
553
lambda obj:
554
isinstance(obj,
555
property)):
406
lambda obj: isinstance(obj, property)):
556
407
if not name.startswith("_"):
557
408
self.client_structure.append(name)
558
409
594
445
595
446
def __del__(self):
596
447
self.disable()
597
448
598
449
def init_checker(self):
599
450
# Schedule a new checker to be started an 'interval' from now,
600
451
# and every interval from then on.
607
458
self.disable))
608
459
# Also start a new checker *right now*.
609
460
self.start_checker()
610
461
462
611
463
def checker_callback(self, pid, condition, command):
612
464
"""The checker has completed, so take appropriate actions."""
613
465
self.checker_callback_tag = None
614
466
self.checker = None
615
467
if os.WIFEXITED(condition):
616
self.last_checker_status = os.WEXITSTATUS(condition)
468
self.last_checker_status = os.WEXITSTATUS(condition)
617
469
if self.last_checker_status == 0:
618
470
logger.info("Checker for %(name)s succeeded",
619
471
vars(self))
639
491
gobject.source_remove(self.disable_initiator_tag)
640
492
if getattr(self, "enabled", False):
641
493
self.disable_initiator_tag = (gobject.timeout_add
642
(timedelta_to_milliseconds
494
(_timedelta_to_milliseconds
643
495
(timeout), self.disable))
644
496
self.expires = datetime.datetime.utcnow() + timeout
645
497
739
591
raise
740
592
self.checker = None
741
593
594
# Encrypts a client secret and stores it in a varible encrypted_secret
595
def encrypt_secret(self, key):
596
# Encryption-key need to be of a specific size, so we hash inputed key
597
hasheng = hashlib.sha256()
598
hasheng.update(key)
599
encryptionkey = hasheng.digest()
600
601
# Create validation hash so we know at decryption if it was sucessful
602
hasheng = hashlib.sha256()
603
hasheng.update(self.secret)
604
validationhash = hasheng.digest()
605
606
# Encrypt secret
607
iv = os.urandom(Crypto.Cipher.AES.block_size)
608
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
609
Crypto.Cipher.AES.MODE_CFB, iv)
610
ciphertext = ciphereng.encrypt(validationhash+self.secret)
611
self.encrypted_secret = (ciphertext, iv)
612
613
# Decrypt a encrypted client secret
614
def decrypt_secret(self, key):
615
# Decryption-key need to be of a specific size, so we hash inputed key
616
hasheng = hashlib.sha256()
617
hasheng.update(key)
618
encryptionkey = hasheng.digest()
619
620
# Decrypt encrypted secret
621
ciphertext, iv = self.encrypted_secret
622
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
623
Crypto.Cipher.AES.MODE_CFB, iv)
624
plain = ciphereng.decrypt(ciphertext)
625
626
# Validate decrypted secret to know if it was succesful
627
hasheng = hashlib.sha256()
628
validationhash = plain[:hasheng.digest_size]
629
secret = plain[hasheng.digest_size:]
630
hasheng.update(secret)
631
632
# if validation fails, we use key as new secret. Otherwhise, we use
633
# the decrypted secret
634
if hasheng.digest() == validationhash:
635
self.secret = secret
636
else:
637
self.secret = key
638
del self.encrypted_secret
639
742
640
743
641
def dbus_service_property(dbus_interface, signature="v",
744
642
access="readwrite", byte_arrays=False):
850
748
# signatures other than "ay".
851
749
if prop._dbus_signature != "ay":
852
750
raise ValueError
853
value = dbus.ByteArray(b''.join(chr(byte)
854
for byte in value))
751
value = dbus.ByteArray(''.join(unichr(byte)
752
for byte in value))
855
753
prop(value)
856
754
857
755
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
862
760
863
761
Note: Will not include properties with access="write".
864
762
"""
865
properties = {}
763
all = {}
866
764
for name, prop in self._get_all_dbus_properties():
867
765
if (interface_name
868
766
and interface_name != prop._dbus_interface):
873
771
continue
874
772
value = prop()
875
773
if not hasattr(value, "variant_level"):
876
properties[name] = value
774
all[name] = value
877
775
continue
878
properties[name] = type(value)(value, variant_level=
879
value.variant_level+1)
880
return dbus.Dictionary(properties, signature="sv")
776
all[name] = type(value)(value, variant_level=
777
value.variant_level+1)
778
return dbus.Dictionary(all, signature="sv")
881
779
882
780
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
883
781
out_signature="s",
934
832
return dbus.String(dt.isoformat(),
935
833
variant_level=variant_level)
936
834
937
938
835
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
939
836
.__metaclass__):
940
837
"""Applied to an empty subclass of a D-Bus object, this metaclass
1032
929
attribute.func_closure)))
1033
930
return type.__new__(mcs, name, bases, attr)
1034
931
1035
1036
932
class ClientDBus(Client, DBusObjectWithProperties):
1037
933
"""A Client class using D-Bus
1038
934
1049
945
def __init__(self, bus = None, *args, **kwargs):
1050
946
self.bus = bus
1051
947
Client.__init__(self, *args, **kwargs)
1052
self._approvals_pending = 0
1053
948
1054
949
self._approvals_pending = 0
1055
950
# Only now, when this client is initialized, can it show up on
1056
951
# the D-Bus
1067
962
variant_level=1):
1068
963
""" Modify a variable so that it's a property which announces
1069
964
its changes to DBus.
1070
965
1071
966
transform_fun: Function that takes a value and a variant_level
1072
967
and transforms it to a D-Bus type.
1073
968
dbus_name: D-Bus name of the variable
1107
1002
datetime_to_dbus, "LastApprovalRequest")
1108
1003
approved_by_default = notifychangeproperty(dbus.Boolean,
1109
1004
"ApprovedByDefault")
1110
approval_delay = notifychangeproperty(dbus.UInt64,
1005
approval_delay = notifychangeproperty(dbus.UInt16,
1111
1006
"ApprovalDelay",
1112
1007
type_func =
1113
timedelta_to_milliseconds)
1008
_timedelta_to_milliseconds)
1114
1009
approval_duration = notifychangeproperty(
1115
dbus.UInt64, "ApprovalDuration",
1116
type_func = timedelta_to_milliseconds)
1010
dbus.UInt16, "ApprovalDuration",
1011
type_func = _timedelta_to_milliseconds)
1117
1012
host = notifychangeproperty(dbus.String, "Host")
1118
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1013
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1119
1014
type_func =
1120
timedelta_to_milliseconds)
1015
_timedelta_to_milliseconds)
1121
1016
extended_timeout = notifychangeproperty(
1122
dbus.UInt64, "ExtendedTimeout",
1123
type_func = timedelta_to_milliseconds)
1124
interval = notifychangeproperty(dbus.UInt64,
1017
dbus.UInt16, "ExtendedTimeout",
1018
type_func = _timedelta_to_milliseconds)
1019
interval = notifychangeproperty(dbus.UInt16,
1125
1020
"Interval",
1126
1021
type_func =
1127
timedelta_to_milliseconds)
1022
_timedelta_to_milliseconds)
1128
1023
checker_command = notifychangeproperty(dbus.String, "Checker")
1129
1024
1130
1025
del notifychangeproperty
1172
1067
return r
1173
1068
1174
1069
def _reset_approved(self):
1175
self.approved = None
1070
self._approved = None
1176
1071
return False
1177
1072
1178
1073
def approve(self, value=True):
1179
1074
self.send_changedstate()
1180
self.approved = value
1181
gobject.timeout_add(timedelta_to_milliseconds
1075
self._approved = value
1076
gobject.timeout_add(_timedelta_to_milliseconds
1182
1077
(self.approval_duration),
1183
1078
self._reset_approved)
1184
1079
1227
1122
"D-Bus signal"
1228
1123
return self.need_approval()
1229
1124
1230
# NeRwequest - signal
1231
@dbus.service.signal(_interface, signature="s")
1232
def NewRequest(self, ip):
1233
"""D-Bus signal
1234
Is sent after a client request a password.
1235
"""
1236
pass
1237
1238
1125
## Methods
1239
1126
1240
1127
# Approve - method
1298
1185
access="readwrite")
1299
1186
def ApprovalDuration_dbus_property(self, value=None):
1300
1187
if value is None: # get
1301
return dbus.UInt64(timedelta_to_milliseconds(
1188
return dbus.UInt64(_timedelta_to_milliseconds(
1302
1189
self.approval_duration))
1303
1190
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1304
1191
1318
1205
def Host_dbus_property(self, value=None):
1319
1206
if value is None: # get
1320
1207
return dbus.String(self.host)
1321
self.host = unicode(value)
1208
self.host = value
1322
1209
1323
1210
# Created - property
1324
1211
@dbus_service_property(_interface, signature="s", access="read")
1325
1212
def Created_dbus_property(self):
1326
return datetime_to_dbus(self.created)
1213
return dbus.String(datetime_to_dbus(self.created))
1327
1214
1328
1215
# LastEnabled - property
1329
1216
@dbus_service_property(_interface, signature="s", access="read")
1367
1254
if value is None: # get
1368
1255
return dbus.UInt64(self.timeout_milliseconds())
1369
1256
self.timeout = datetime.timedelta(0, 0, 0, value)
1257
if getattr(self, "disable_initiator_tag", None) is None:
1258
return
1370
1259
# Reschedule timeout
1371
if self.enabled:
1372
now = datetime.datetime.utcnow()
1373
time_to_die = timedelta_to_milliseconds(
1374
(self.last_checked_ok + self.timeout) - now)
1375
if time_to_die <= 0:
1376
# The timeout has passed
1377
self.disable()
1378
else:
1379
self.expires = (now +
1380
datetime.timedelta(milliseconds =
1381
time_to_die))
1382
if (getattr(self, "disable_initiator_tag", None)
1383
is None):
1384
return
1385
gobject.source_remove(self.disable_initiator_tag)
1386
self.disable_initiator_tag = (gobject.timeout_add
1387
(time_to_die,
1388
self.disable))
1260
gobject.source_remove(self.disable_initiator_tag)
1261
self.disable_initiator_tag = None
1262
self.expires = None
1263
time_to_die = _timedelta_to_milliseconds((self
1264
.last_checked_ok
1265
+ self.timeout)
1266
- datetime.datetime
1267
.utcnow())
1268
if time_to_die <= 0:
1269
# The timeout has passed
1270
self.disable()
1271
else:
1272
self.expires = (datetime.datetime.utcnow()
1273
+ datetime.timedelta(milliseconds =
1274
time_to_die))
1275
self.disable_initiator_tag = (gobject.timeout_add
1276
(time_to_die, self.disable))
1389
1277
1390
1278
# ExtendedTimeout - property
1391
1279
@dbus_service_property(_interface, signature="t",
1404
1292
self.interval = datetime.timedelta(0, 0, 0, value)
1405
1293
if getattr(self, "checker_initiator_tag", None) is None:
1406
1294
return
1407
if self.enabled:
1408
# Reschedule checker run
1409
gobject.source_remove(self.checker_initiator_tag)
1410
self.checker_initiator_tag = (gobject.timeout_add
1411
(value, self.start_checker))
1412
self.start_checker() # Start one now, too
1295
# Reschedule checker run
1296
gobject.source_remove(self.checker_initiator_tag)
1297
self.checker_initiator_tag = (gobject.timeout_add
1298
(value, self.start_checker))
1299
self.start_checker() # Start one now, too
1413
1300
1414
1301
# Checker - property
1415
1302
@dbus_service_property(_interface, signature="s",
1417
1304
def Checker_dbus_property(self, value=None):
1418
1305
if value is None: # get
1419
1306
return dbus.String(self.checker_command)
1420
self.checker_command = unicode(value)
1307
self.checker_command = value
1421
1308
1422
1309
# CheckerRunning - property
1423
1310
@dbus_service_property(_interface, signature="b",
1452
1339
raise KeyError()
1453
1340
1454
1341
def __getattribute__(self, name):
1455
if name == '_pipe':
1342
if(name == '_pipe'):
1456
1343
return super(ProxyClient, self).__getattribute__(name)
1457
1344
self._pipe.send(('getattr', name))
1458
1345
data = self._pipe.recv()
1465
1352
return func
1466
1353
1467
1354
def __setattr__(self, name, value):
1468
if name == '_pipe':
1355
if(name == '_pipe'):
1469
1356
return super(ProxyClient, self).__setattr__(name, value)
1470
1357
self._pipe.send(('setattr', name, value))
1471
1358
1472
1473
1359
class ClientDBusTransitional(ClientDBus):
1474
1360
__metaclass__ = AlternateDBusNamesMetaclass
1475
1361
1476
1477
1362
class ClientHandler(socketserver.BaseRequestHandler, object):
1478
1363
"""A class to handle client connections.
1479
1364
1547
1432
except KeyError:
1548
1433
return
1549
1434
1550
if self.server.use_dbus:
1551
# Emit D-Bus signal
1552
client.NewRequest(str(self.client_address))
1553
1554
1435
if client.approval_delay:
1555
1436
delay = client.approval_delay
1556
1437
client.approvals_pending += 1
1565
1446
client.Rejected("Disabled")
1566
1447
return
1567
1448
1568
if client.approved or not client.approval_delay:
1449
if client._approved or not client.approval_delay:
1569
1450
#We are approved or approval is disabled
1570
1451
break
1571
elif client.approved is None:
1452
elif client._approved is None:
1572
1453
logger.info("Client %s needs approval",
1573
1454
client.name)
1574
1455
if self.server.use_dbus:
1588
1469
time = datetime.datetime.now()
1589
1470
client.changedstate.acquire()
1590
1471
(client.changedstate.wait
1591
(float(client.timedelta_to_milliseconds(delay)
1472
(float(client._timedelta_to_milliseconds(delay)
1592
1473
/ 1000)))
1593
1474
client.changedstate.release()
1594
1475
time2 = datetime.datetime.now()
1693
1574
# Convert the buffer to a Python bytestring
1694
1575
fpr = ctypes.string_at(buf, buf_len.value)
1695
1576
# Convert the bytestring to hexadecimal notation
1696
hex_fpr = binascii.hexlify(fpr).upper()
1577
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1697
1578
return hex_fpr
1698
1579
1699
1580
1702
1583
def sub_process_main(self, request, address):
1703
1584
try:
1704
1585
self.finish_request(request, address)
1705
except Exception:
1586
except:
1706
1587
self.handle_error(request, address)
1707
1588
self.close_request(request)
1708
1589
1956
1837
return timevalue
1957
1838
1958
1839
1840
def if_nametoindex(interface):
1841
"""Call the C function if_nametoindex(), or equivalent
1842
1843
Note: This function cannot accept a unicode string."""
1844
global if_nametoindex
1845
try:
1846
if_nametoindex = (ctypes.cdll.LoadLibrary
1847
(ctypes.util.find_library("c"))
1848
.if_nametoindex)
1849
except (OSError, AttributeError):
1850
logger.warning("Doing if_nametoindex the hard way")
1851
def if_nametoindex(interface):
1852
"Get an interface index the hard way, i.e. using fcntl()"
1853
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1854
with contextlib.closing(socket.socket()) as s:
1855
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1856
struct.pack(str("16s16x"),
1857
interface))
1858
interface_index = struct.unpack(str("I"),
1859
ifreq[16:20])[0]
1860
return interface_index
1861
return if_nametoindex(interface)
1862
1863
1959
1864
def daemon(nochdir = False, noclose = False):
1960
1865
"""See daemon(3). Standard BSD Unix function.
1961
1866
2017
1922
parser.add_argument("--no-ipv6", action="store_false",
2018
1923
dest="use_ipv6", help="Do not use IPv6")
2019
1924
parser.add_argument("--no-restore", action="store_false",
2020
dest="restore", help="Do not restore stored"
2021
" state")
2022
parser.add_argument("--statedir", metavar="DIR",
2023
help="Directory to save/restore state in")
2024
1925
dest="restore", help="Do not restore stored state",
1926
default=True)
1927
2025
1928
options = parser.parse_args()
2026
1929
2027
1930
if options.check:
2040
1943
"use_dbus": "True",
2041
1944
"use_ipv6": "True",
2042
1945
"debuglevel": "",
2043
"restore": "True",
2044
"statedir": "/var/lib/mandos"
2045
1946
}
2046
1947
2047
1948
# Parse config file for server-global settings
2064
1965
# options, if set.
2065
1966
for option in ("interface", "address", "port", "debug",
2066
1967
"priority", "servicename", "configdir",
2067
"use_dbus", "use_ipv6", "debuglevel", "restore",
2068
"statedir"):
1968
"use_dbus", "use_ipv6", "debuglevel", "restore"):
2069
1969
value = getattr(options, option)
2070
1970
if value is not None:
2071
1971
server_settings[option] = value
2083
1983
debuglevel = server_settings["debuglevel"]
2084
1984
use_dbus = server_settings["use_dbus"]
2085
1985
use_ipv6 = server_settings["use_ipv6"]
2086
stored_state_path = os.path.join(server_settings["statedir"],
2087
stored_state_file)
2088
2089
if debug:
2090
initlogger(debug, logging.DEBUG)
2091
else:
2092
if not debuglevel:
2093
initlogger(debug)
2094
else:
2095
level = getattr(logging, debuglevel.upper())
2096
initlogger(debug, level)
2097
1986
2098
1987
if server_settings["servicename"] != "Mandos":
2099
1988
syslogger.setFormatter(logging.Formatter
2102
1991
% server_settings["servicename"]))
2103
1992
2104
1993
# Parse config file with clients
2105
client_config = configparser.SafeConfigParser(Client
2106
.client_defaults)
1994
client_defaults = { "timeout": "5m",
1995
"extended_timeout": "15m",
1996
"interval": "2m",
1997
"checker": "fping -q -- %%(host)s",
1998
"host": "",
1999
"approval_delay": "0s",
2000
"approval_duration": "1s",
2001
}
2002
client_config = configparser.SafeConfigParser(client_defaults)
2107
2003
client_config.read(os.path.join(server_settings["configdir"],
2108
2004
"clients.conf"))
2109
2005
2147
2043
if error[0] != errno.EPERM:
2148
2044
raise error
2149
2045
2046
if not debug and not debuglevel:
2047
logger.setLevel(logging.WARNING)
2048
if debuglevel:
2049
level = getattr(logging, debuglevel.upper())
2050
logger.setLevel(level)
2051
2150
2052
if debug:
2053
logger.setLevel(logging.DEBUG)
2151
2054
# Enable all possible GnuTLS debugging
2152
2055
2153
2056
# "Use a log level over 10 to enable all debugging options."
2166
2069
os.dup2(null, sys.stdin.fileno())
2167
2070
if null > 2:
2168
2071
os.close(null)
2072
else:
2073
# No console logging
2074
logger.removeHandler(console)
2169
2075
2170
2076
# Need to fork before connecting to D-Bus
2171
2077
if not debug:
2172
2078
# Close all input and output, do double fork, etc.
2173
2079
daemon()
2174
2080
2175
gobject.threads_init()
2176
2177
2081
global main_loop
2178
2082
# From the Avahi example code
2179
2083
DBusGMainLoop(set_as_default=True )
2209
2113
client_class = functools.partial(ClientDBusTransitional,
2210
2114
bus = bus)
2211
2115
2212
client_settings = Client.config_parser(client_config)
2116
special_settings = {
2117
# Some settings need to be accessd by special methods;
2118
# booleans need .getboolean(), etc. Here is a list of them:
2119
"approved_by_default":
2120
lambda section:
2121
client_config.getboolean(section, "approved_by_default"),
2122
}
2123
# Construct a new dict of client settings of this form:
2124
# { client_name: {setting_name: value, ...}, ...}
2125
# with exceptions for any special settings as defined above
2126
client_settings = dict((clientname,
2127
dict((setting,
2128
(value if setting not in special_settings
2129
else special_settings[setting](clientname)))
2130
for setting, value in client_config.items(clientname)))
2131
for clientname in client_config.sections())
2132
2213
2133
old_client_settings = {}
2214
clients_data = {}
2215
2216
# Get client data and settings from last running state.
2134
clients_data = []
2135
2136
# Get client data and settings from last running state.
2217
2137
if server_settings["restore"]:
2218
2138
try:
2219
2139
with open(stored_state_path, "rb") as stored_state:
2220
clients_data, old_client_settings = (pickle.load
2221
(stored_state))
2140
clients_data, old_client_settings = pickle.load(stored_state)
2222
2141
os.remove(stored_state_path)
2223
2142
except IOError as e:
2224
logger.warning("Could not load persistent state: {0}"
2225
.format(e))
2143
logger.warning("Could not load persistant state: {0}".format(e))
2226
2144
if e.errno != errno.ENOENT:
2227
2145
raise
2228
except EOFError as e:
2229
logger.warning("Could not load persistent state: "
2230
"EOFError: {0}".format(e))
2231
2232
with PGPEngine() as pgp:
2233
for client_name, client in clients_data.iteritems():
2234
# Decide which value to use after restoring saved state.
2235
# We have three different values: Old config file,
2236
# new config file, and saved state.
2237
# New config value takes precedence if it differs from old
2238
# config value, otherwise use saved state.
2239
for name, value in client_settings[client_name].items():
2240
try:
2241
# For each value in new config, check if it
2242
# differs from the old config value (Except for
2243
# the "secret" attribute)
2244
if (name != "secret" and
2245
value != old_client_settings[client_name]
2246
[name]):
2247
client[name] = value
2248
except KeyError:
2249
pass
2250
2251
# Clients who has passed its expire date can still be
2252
# enabled if its last checker was successful. Clients
2253
# whose checker failed before we stored its state is
2254
# assumed to have failed all checkers during downtime.
2255
if client["enabled"]:
2256
if datetime.datetime.utcnow() >= client["expires"]:
2257
if not client["last_checked_ok"]:
2258
logger.warning(
2259
"disabling client {0} - Client never "
2260
"performed a successfull checker"
2261
.format(client["name"]))
2262
client["enabled"] = False
2263
elif client["last_checker_status"] != 0:
2264
logger.warning(
2265
"disabling client {0} - Client "
2266
"last checker failed with error code {1}"
2267
.format(client["name"],
2268
client["last_checker_status"]))
2269
client["enabled"] = False
2270
else:
2271
client["expires"] = (datetime.datetime
2272
.utcnow()
2273
+ client["timeout"])
2274
logger.debug("Last checker succeeded,"
2275
" keeping {0} enabled"
2276
.format(client["name"]))
2146
2147
for client in clients_data:
2148
client_name = client["name"]
2149
2150
# Decide which value to use after restoring saved state.
2151
# We have three different values: Old config file,
2152
# new config file, and saved state.
2153
# New config value takes precedence if it differs from old
2154
# config value, otherwise use saved state.
2155
for name, value in client_settings[client_name].items():
2277
2156
try:
2278
client["secret"] = (
2279
pgp.decrypt(client["encrypted_secret"],
2280
client_settings[client_name]
2281
["secret"]))
2282
except PGPError:
2283
# If decryption fails, we use secret from new settings
2284
logger.debug("Failed to decrypt {0} old secret"
2285
.format(client_name))
2286
client["secret"] = (
2287
client_settings[client_name]["secret"])
2288
2289
2290
# Add/remove clients based on new changes made to config
2291
for client_name in (set(old_client_settings)
2292
- set(client_settings)):
2293
del clients_data[client_name]
2294
for client_name in (set(client_settings)
2295
- set(old_client_settings)):
2296
clients_data[client_name] = client_settings[client_name]
2297
2298
# Create clients all clients
2299
for client_name, client in clients_data.iteritems():
2300
tcp_server.clients[client_name] = client_class(
2301
name = client_name, settings = client)
2302
2157
# For each value in new config, check if it differs
2158
# from the old config value (Except for the "secret"
2159
# attribute)
2160
if name != "secret" and value != old_client_settings[client_name][name]:
2161
setattr(client, name, value)
2162
except KeyError:
2163
pass
2164
2165
# Clients who has passed its expire date, can still be enabled if its
2166
# last checker was sucessful. Clients who checkers failed before we
2167
# stored it state is asumed to had failed checker during downtime.
2168
if client["enabled"] and client["last_checked_ok"]:
2169
if ((datetime.datetime.utcnow() - client["last_checked_ok"])
2170
> client["interval"]):
2171
if client["last_checker_status"] != 0:
2172
client["enabled"] = False
2173
else:
2174
client["expires"] = datetime.datetime.utcnow() + client["timeout"]
2175
2176
client["changedstate"] = (multiprocessing_manager
2177
.Condition(multiprocessing_manager
2178
.Lock()))
2179
if use_dbus:
2180
new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)
2181
tcp_server.clients[client_name] = new_client
2182
new_client.bus = bus
2183
for name, value in client.iteritems():
2184
setattr(new_client, name, value)
2185
client_object_name = unicode(client_name).translate(
2186
{ord("."): ord("_"),
2187
ord("-"): ord("_")})
2188
new_client.dbus_object_path = (dbus.ObjectPath
2189
("/clients/" + client_object_name))
2190
DBusObjectWithProperties.__init__(new_client,
2191
new_client.bus,
2192
new_client.dbus_object_path)
2193
else:
2194
tcp_server.clients[client_name] = Client.__new__(Client)
2195
for name, value in client.iteritems():
2196
setattr(tcp_server.clients[client_name], name, value)
2197
2198
tcp_server.clients[client_name].decrypt_secret(
2199
client_settings[client_name]["secret"])
2200
2201
# Create/remove clients based on new changes made to config
2202
for clientname in set(old_client_settings) - set(client_settings):
2203
del tcp_server.clients[clientname]
2204
for clientname in set(client_settings) - set(old_client_settings):
2205
tcp_server.clients[clientname] = (client_class(name = clientname,
2206
config =
2207
client_settings
2208
[clientname]))
2209
2210
2303
2211
if not tcp_server.clients:
2304
2212
logger.warning("No clients defined")
2305
2213
2316
2224
# "pidfile" was never created
2317
2225
pass
2318
2226
del pidfilename
2227
2319
2228
signal.signal(signal.SIGINT, signal.SIG_IGN)
2320
2229
2321
2230
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2386
2295
multiprocessing.active_children()
2387
2296
if not (tcp_server.clients or client_settings):
2388
2297
return
2389
2390
# Store client before exiting. Secrets are encrypted with key
2391
# based on what config file has. If config file is
2392
# removed/edited, old secret will thus be unrecovable.
2393
clients = {}
2394
with PGPEngine() as pgp:
2395
for client in tcp_server.clients.itervalues():
2396
key = client_settings[client.name]["secret"]
2397
client.encrypted_secret = pgp.encrypt(client.secret,
2398
key)
2399
client_dict = {}
2400
2401
# A list of attributes that can not be pickled
2402
# + secret.
2403
exclude = set(("bus", "changedstate", "secret",
2404
"checker"))
2405
for name, typ in (inspect.getmembers
2406
(dbus.service.Object)):
2407
exclude.add(name)
2408
2409
client_dict["encrypted_secret"] = (client
2410
.encrypted_secret)
2411
for attr in client.client_structure:
2412
if attr not in exclude:
2413
client_dict[attr] = getattr(client, attr)
2414
2415
clients[client.name] = client_dict
2416
del client_settings[client.name]["secret"]
2417
2298
2299
# Store client before exiting. Secrets are encrypted with key based
2300
# on what config file has. If config file is removed/edited, old
2301
# secret will thus be unrecovable.
2302
clients = []
2303
for client in tcp_server.clients.itervalues():
2304
client.encrypt_secret(client_settings[client.name]["secret"])
2305
2306
client_dict = {}
2307
2308
# A list of attributes that will not be stored when shuting down.
2309
exclude = set(("bus", "changedstate", "secret"))
2310
for name, typ in inspect.getmembers(dbus.service.Object):
2311
exclude.add(name)
2312
2313
client_dict["encrypted_secret"] = client.encrypted_secret
2314
for attr in client.client_structure:
2315
if attr not in exclude:
2316
client_dict[attr] = getattr(client, attr)
2317
2318
clients.append(client_dict)
2319
del client_settings[client.name]["secret"]
2320
2418
2321
try:
2419
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2420
prefix="clients-",
2421
dir=os.path.dirname
2422
(stored_state_path))
2423
with os.fdopen(tempfd, "wb") as stored_state:
2322
with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:
2424
2323
pickle.dump((clients, client_settings), stored_state)
2425
os.rename(tempname, stored_state_path)
2426
except (IOError, OSError) as e:
2427
logger.warning("Could not save persistent state: {0}"
2428
.format(e))
2429
if not debug:
2430
try:
2431
os.remove(tempname)
2432
except NameError:
2433
pass
2434
if e.errno not in set((errno.ENOENT, errno.EACCES,
2435
errno.EEXIST)):
2436
raise e
2437
2324
except IOError as e:
2325
logger.warning("Could not save persistant state: {0}".format(e))
2326
if e.errno != errno.ENOENT:
2327
raise
2328
2438
2329
# Delete all clients, and settings from config
2439
2330
while tcp_server.clients:
2440
2331
name, client = tcp_server.clients.popitem()
2458
2349
# Need to initiate checking of clients
2459
2350
if client.enabled:
2460
2351
client.init_checker()
2352
2461
2353
2462
2354
tcp_server.enable()
2463
2355
tcp_server.server_activate()
2503
2395
# Must run before the D-Bus bus name gets deregistered
2504
2396
cleanup()
2505
2397
2398
2506
2399
if __name__ == '__main__':
2507
2400
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0