/mandos/trunk : revision 520

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import binascii

67

import tempfile

66

import hashlib

68

67

69

68

import dbus

70

69

import dbus.service

75

74

import ctypes.util

76

75

import xml.dom.minidom

77

76

import inspect

78

import GnuPGInterface

77

import Crypto.Cipher.AES

79

78

80

79

try:

81

80

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

84

except ImportError:

86

85

SO_BINDTODEVICE = None

87

86

88

version = "1.5.1"

89

stored_state_file = "clients.pickle"

87

88

version = "1.4.1"

90

89

91

90

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

93

syslogger = (logging.handlers.SysLogHandler

93

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

95

address = str("/dev/log")))

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(debug, level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

if debug:

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet',

146

'--no-use-agent'])

147

148

def __enter__(self):

149

return self

150

151

def __exit__ (self, exc_type, exc_value, traceback):

152

self._cleanup()

153

return False

154

155

def __del__(self):

156

self._cleanup()

157

158

def _cleanup(self):

159

if self.tempdir is not None:

160

# Delete contents of tempdir

161

for root, dirs, files in os.walk(self.tempdir,

162

topdown = False):

163

for filename in files:

164

os.remove(os.path.join(root, filename))

165

for dirname in dirs:

166

os.rmdir(os.path.join(root, dirname))

167

# Remove tempdir

168

os.rmdir(self.tempdir)

169

self.tempdir = None

170

171

def password_encode(self, password):

172

# Passphrase can not be empty and can not contain newlines or

173

# NUL bytes. So we prefix it and hex encode it.

174

return b"mandos" + binascii.hexlify(password)

175

176

def encrypt(self, data, password):

177

self.gnupg.passphrase = self.password_encode(password)

178

with open(os.devnull) as devnull:

179

try:

180

proc = self.gnupg.run(['--symmetric'],

181

create_fhs=['stdin', 'stdout'],

182

attach_fhs={'stderr': devnull})

183

with contextlib.closing(proc.handles['stdin']) as f:

184

f.write(data)

185

with contextlib.closing(proc.handles['stdout']) as f:

186

ciphertext = f.read()

187

proc.wait()

188

except IOError as e:

189

raise PGPError(e)

190

self.gnupg.passphrase = None

191

return ciphertext

192

193

def decrypt(self, data, password):

194

self.gnupg.passphrase = self.password_encode(password)

195

with open(os.devnull) as devnull:

196

try:

197

proc = self.gnupg.run(['--decrypt'],

198

create_fhs=['stdin', 'stdout'],

199

attach_fhs={'stderr': devnull})

200

with contextlib.closing(proc.handles['stdin'] ) as f:

201

f.write(data)

202

with contextlib.closing(proc.handles['stdout']) as f:

203

decrypted_plaintext = f.read()

204

proc.wait()

205

except IOError as e:

206

raise PGPError(e)

207

self.gnupg.passphrase = None

208

return decrypted_plaintext

209

96

syslogger.setFormatter(logging.Formatter

97

('Mandos [%(process)d]: %(levelname)s:'

98

' %(message)s'))

99

logger.addHandler(syslogger)

100

101

console = logging.StreamHandler()

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

104

' %(levelname)s:'

105

' %(message)s'))

106

logger.addHandler(console)

210

107

211

108

212

109

class AvahiError(Exception):

329

226

try:

330

227

self.group.Free()

331

228

except (dbus.exceptions.UnknownMethodException,

332

dbus.exceptions.DBusException):

229

dbus.exceptions.DBusException) as e:

333

230

pass

334

231

self.group = None

335

232

self.remove()

379

276

% self.name))

380

277

return ret

381

278

382

def timedelta_to_milliseconds(td):

279

def _timedelta_to_milliseconds(td):

383

280

"Convert a datetime.timedelta() to milliseconds"

384

281

return ((td.days * 24 * 60 * 60 * 1000)

385

282

+ (td.seconds * 1000)

389

286

"""A representation of a client host served by this server.

390

287

391

288

Attributes:

392

approved: bool(); 'None' if not yet approved/disapproved

289

_approved: bool(); 'None' if not yet approved/disapproved

393

290

approval_delay: datetime.timedelta(); Time to wait for approval

394

291

approval_duration: datetime.timedelta(); Duration of one approval

395

292

checker: subprocess.Popen(); a running checker process used

413

310

interval: datetime.timedelta(); How often to start a new checker

414

311

last_approval_request: datetime.datetime(); (UTC) or None

415

312

last_checked_ok: datetime.datetime(); (UTC) or None

416

last_checker_status: integer between 0 and 255 reflecting exit

417

status of last checker. -1 reflects crashed

418

checker, or None.

419

last_enabled: datetime.datetime(); (UTC) or None

313

last_checker_status: integer between 0 and 255 reflecting exit status

314

of last checker. -1 reflect crashed checker,

315

or None.

316

last_enabled: datetime.datetime(); (UTC)

420

317

name: string; from the config file, used in log messages and

421

318

D-Bus identifiers

422

319

secret: bytestring; sent verbatim (over TLS) to client

423

320

timeout: datetime.timedelta(); How long from last_checked_ok

424

321

until this client is disabled

425

extended_timeout: extra long timeout when secret has been sent

322

extended_timeout: extra long timeout when password has been sent

426

323

runtime_expansions: Allowed attributes for runtime expansion.

427

324

expires: datetime.datetime(); time (UTC) when a client will be

428

325

disabled, or None

432

329

"created", "enabled", "fingerprint",

433

330

"host", "interval", "last_checked_ok",

434

331

"last_enabled", "name", "timeout")

435

client_defaults = { "timeout": "5m",

436

"extended_timeout": "15m",

437

"interval": "2m",

438

"checker": "fping -q -- %%(host)s",

439

"host": "",

440

"approval_delay": "0s",

441

"approval_duration": "1s",

442

"approved_by_default": "True",

443

"enabled": "True",

444

}

445

332

446

333

def timeout_milliseconds(self):

447

334

"Return the 'timeout' attribute in milliseconds"

448

return timedelta_to_milliseconds(self.timeout)

335

return _timedelta_to_milliseconds(self.timeout)

449

336

450

337

def extended_timeout_milliseconds(self):

451

338

"Return the 'extended_timeout' attribute in milliseconds"

452

return timedelta_to_milliseconds(self.extended_timeout)

339

return _timedelta_to_milliseconds(self.extended_timeout)

453

340

454

341

def interval_milliseconds(self):

455

342

"Return the 'interval' attribute in milliseconds"

456

return timedelta_to_milliseconds(self.interval)

343

return _timedelta_to_milliseconds(self.interval)

457

344

458

345

def approval_delay_milliseconds(self):

459

return timedelta_to_milliseconds(self.approval_delay)

460

461

@staticmethod

462

def config_parser(config):

463

"""Construct a new dict of client settings of this form:

464

{ client_name: {setting_name: value, ...}, ...}

465

with exceptions for any special settings as defined above.

466

NOTE: Must be a pure function. Must return the same result

467

value given the same arguments.

468

"""

469

settings = {}

470

for client_name in config.sections():

471

section = dict(config.items(client_name))

472

client = settings[client_name] = {}

473

474

client["host"] = section["host"]

475

# Reformat values from string types to Python types

476

client["approved_by_default"] = config.getboolean(

477

client_name, "approved_by_default")

478

client["enabled"] = config.getboolean(client_name,

479

"enabled")

480

481

client["fingerprint"] = (section["fingerprint"].upper()

482

.replace(" ", ""))

483

if "secret" in section:

484

client["secret"] = section["secret"].decode("base64")

485

elif "secfile" in section:

486

with open(os.path.expanduser(os.path.expandvars

487

(section["secfile"])),

488

"rb") as secfile:

489

client["secret"] = secfile.read()

490

else:

491

raise TypeError("No secret or secfile for section %s"

492

% section)

493

client["timeout"] = string_to_delta(section["timeout"])

494

client["extended_timeout"] = string_to_delta(

495

section["extended_timeout"])

496

client["interval"] = string_to_delta(section["interval"])

497

client["approval_delay"] = string_to_delta(

498

section["approval_delay"])

499

client["approval_duration"] = string_to_delta(

500

section["approval_duration"])

501

client["checker_command"] = section["checker"]

502

client["last_approval_request"] = None

503

client["last_checked_ok"] = None

504

client["last_checker_status"] = None

505

506

return settings

507

508

509

def __init__(self, settings, name = None):

346

return _timedelta_to_milliseconds(self.approval_delay)

347

348

def __init__(self, name = None, config=None):

510

349

"""Note: the 'checker' key in 'config' sets the

511

350

'checker_command' attribute and *not* the 'checker'

512

351

attribute."""

513

352

self.name = name

514

# adding all client settings

515

for setting, value in settings.iteritems():

516

setattr(self, setting, value)

517

518

if self.enabled:

519

if not hasattr(self, "last_enabled"):

520

self.last_enabled = datetime.datetime.utcnow()

521

if not hasattr(self, "expires"):

522

self.expires = (datetime.datetime.utcnow()

523

+ self.timeout)

524

else:

525

self.last_enabled = None

526

self.expires = None

527

353

if config is None:

354

config = {}

528

355

logger.debug("Creating client %r", self.name)

529

356

# Uppercase and remove spaces from fingerprint for later

530

357

# comparison purposes with return value from the fingerprint()

531

358

# function

359

self.fingerprint = (config["fingerprint"].upper()

360

.replace(" ", ""))

532

361

logger.debug(" Fingerprint: %s", self.fingerprint)

533

self.created = settings.get("created",

534

datetime.datetime.utcnow())

535

536

# attributes specific for this server instance

362

if "secret" in config:

363

self.secret = config["secret"].decode("base64")

364

elif "secfile" in config:

365

with open(os.path.expanduser(os.path.expandvars

366

(config["secfile"])),

367

"rb") as secfile:

368

self.secret = secfile.read()

369

else:

370

raise TypeError("No secret or secfile for client %s"

371

% self.name)

372

self.host = config.get("host", "")

373

self.created = datetime.datetime.utcnow()

374

self.enabled = True

375

self.last_approval_request = None

376

self.last_enabled = datetime.datetime.utcnow()

377

self.last_checked_ok = None

378

self.last_checker_status = None

379

self.timeout = string_to_delta(config["timeout"])

380

self.extended_timeout = string_to_delta(config

381

["extended_timeout"])

382

self.interval = string_to_delta(config["interval"])

537

383

self.checker = None

538

384

self.checker_initiator_tag = None

539

385

self.disable_initiator_tag = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

540

387

self.checker_callback_tag = None

388

self.checker_command = config["checker"]

541

389

self.current_checker_command = None

542

self.approved = None

390

self._approved = None

391

self.approved_by_default = config.get("approved_by_default",

392

True)

543

393

self.approvals_pending = 0

394

self.approval_delay = string_to_delta(

395

config["approval_delay"])

396

self.approval_duration = string_to_delta(

397

config["approval_duration"])

544

398

self.changedstate = (multiprocessing_manager

545

399

.Condition(multiprocessing_manager

546

400

.Lock()))

547

self.client_structure = [attr for attr in

548

self.__dict__.iterkeys()

549

if not attr.startswith("_")]

401

self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]

550

402

self.client_structure.append("client_structure")

551

403

404

552

405

for name, t in inspect.getmembers(type(self),

553

lambda obj:

554

isinstance(obj,

555

property)):

406

lambda obj: isinstance(obj, property)):

556

407

if not name.startswith("_"):

557

408

self.client_structure.append(name)

558

409

594

445

595

446

def __del__(self):

596

447

self.disable()

597

448

598

449

def init_checker(self):

599

450

# Schedule a new checker to be started an 'interval' from now,

600

451

# and every interval from then on.

607

458

self.disable))

608

459

# Also start a new checker *right now*.

609

460

self.start_checker()

610

461

462

611

463

def checker_callback(self, pid, condition, command):

612

464

"""The checker has completed, so take appropriate actions."""

613

465

self.checker_callback_tag = None

614

466

self.checker = None

615

467

if os.WIFEXITED(condition):

616

self.last_checker_status = os.WEXITSTATUS(condition)

468

self.last_checker_status = os.WEXITSTATUS(condition)

617

469

if self.last_checker_status == 0:

618

470

logger.info("Checker for %(name)s succeeded",

619

471

vars(self))

639

491

gobject.source_remove(self.disable_initiator_tag)

640

492

if getattr(self, "enabled", False):

641

493

self.disable_initiator_tag = (gobject.timeout_add

642

(timedelta_to_milliseconds

494

(_timedelta_to_milliseconds

643

495

(timeout), self.disable))

644

496

self.expires = datetime.datetime.utcnow() + timeout

645

497

739

591

raise

740

592

self.checker = None

741

593

594

# Encrypts a client secret and stores it in a varible encrypted_secret

595

def encrypt_secret(self, key):

596

# Encryption-key need to be of a specific size, so we hash inputed key

597

hasheng = hashlib.sha256()

598

hasheng.update(key)

599

encryptionkey = hasheng.digest()

600

601

# Create validation hash so we know at decryption if it was sucessful

602

hasheng = hashlib.sha256()

603

hasheng.update(self.secret)

604

validationhash = hasheng.digest()

605

606

# Encrypt secret

607

iv = os.urandom(Crypto.Cipher.AES.block_size)

608

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

609

Crypto.Cipher.AES.MODE_CFB, iv)

610

ciphertext = ciphereng.encrypt(validationhash+self.secret)

611

self.encrypted_secret = (ciphertext, iv)

612

613

# Decrypt a encrypted client secret

614

def decrypt_secret(self, key):

615

# Decryption-key need to be of a specific size, so we hash inputed key

616

hasheng = hashlib.sha256()

617

hasheng.update(key)

618

encryptionkey = hasheng.digest()

619

620

# Decrypt encrypted secret

621

ciphertext, iv = self.encrypted_secret

622

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

623

Crypto.Cipher.AES.MODE_CFB, iv)

624

plain = ciphereng.decrypt(ciphertext)

625

626

# Validate decrypted secret to know if it was succesful

627

hasheng = hashlib.sha256()

628

validationhash = plain[:hasheng.digest_size]

629

secret = plain[hasheng.digest_size:]

630

hasheng.update(secret)

631

632

# if validation fails, we use key as new secret. Otherwhise, we use

633

# the decrypted secret

634

if hasheng.digest() == validationhash:

635

self.secret = secret

636

else:

637

self.secret = key

638

del self.encrypted_secret

639

742

640

743

641

def dbus_service_property(dbus_interface, signature="v",

744

642

access="readwrite", byte_arrays=False):

850

748

# signatures other than "ay".

851

749

if prop._dbus_signature != "ay":

852

750

raise ValueError

853

value = dbus.ByteArray(b''.join(chr(byte)

854

for byte in value))

751

value = dbus.ByteArray(''.join(unichr(byte)

752

for byte in value))

855

753

prop(value)

856

754

857

755

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

862

760

863

761

Note: Will not include properties with access="write".

864

762

"""

865

properties = {}

763

all = {}

866

764

for name, prop in self._get_all_dbus_properties():

867

765

if (interface_name

868

766

and interface_name != prop._dbus_interface):

873

771

continue

874

772

value = prop()

875

773

if not hasattr(value, "variant_level"):

876

properties[name] = value

774

all[name] = value

877

775

continue

878

properties[name] = type(value)(value, variant_level=

879

value.variant_level+1)

880

return dbus.Dictionary(properties, signature="sv")

776

all[name] = type(value)(value, variant_level=

777

value.variant_level+1)

778

return dbus.Dictionary(all, signature="sv")

881

779

882

780

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

883

781

out_signature="s",

934

832

return dbus.String(dt.isoformat(),

935

833

variant_level=variant_level)

936

834

937

938

835

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

939

836

.__metaclass__):

940

837

"""Applied to an empty subclass of a D-Bus object, this metaclass

1032

929

attribute.func_closure)))

1033

930

return type.__new__(mcs, name, bases, attr)

1034

931

1035

1036

932

class ClientDBus(Client, DBusObjectWithProperties):

1037

933

"""A Client class using D-Bus

1038

934

1049

945

def __init__(self, bus = None, *args, **kwargs):

1050

946

self.bus = bus

1051

947

Client.__init__(self, *args, **kwargs)

948

949

self._approvals_pending = 0

1052

950

# Only now, when this client is initialized, can it show up on

1053

951

# the D-Bus

1054

952

client_object_name = unicode(self.name).translate(

1064

962

variant_level=1):

1065

963

""" Modify a variable so that it's a property which announces

1066

964

its changes to DBus.

1067

965

1068

966

transform_fun: Function that takes a value and a variant_level

1069

967

and transforms it to a D-Bus type.

1070

968

dbus_name: D-Bus name of the variable

1104

1002

datetime_to_dbus, "LastApprovalRequest")

1105

1003

approved_by_default = notifychangeproperty(dbus.Boolean,

1106

1004

"ApprovedByDefault")

1107

approval_delay = notifychangeproperty(dbus.UInt64,

1005

approval_delay = notifychangeproperty(dbus.UInt16,

1108

1006

"ApprovalDelay",

1109

1007

type_func =

1110

timedelta_to_milliseconds)

1008

_timedelta_to_milliseconds)

1111

1009

approval_duration = notifychangeproperty(

1112

dbus.UInt64, "ApprovalDuration",

1113

type_func = timedelta_to_milliseconds)

1010

dbus.UInt16, "ApprovalDuration",

1011

type_func = _timedelta_to_milliseconds)

1114

1012

host = notifychangeproperty(dbus.String, "Host")

1115

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1013

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1116

1014

type_func =

1117

timedelta_to_milliseconds)

1015

_timedelta_to_milliseconds)

1118

1016

extended_timeout = notifychangeproperty(

1119

dbus.UInt64, "ExtendedTimeout",

1120

type_func = timedelta_to_milliseconds)

1121

interval = notifychangeproperty(dbus.UInt64,

1017

dbus.UInt16, "ExtendedTimeout",

1018

type_func = _timedelta_to_milliseconds)

1019

interval = notifychangeproperty(dbus.UInt16,

1122

1020

"Interval",

1123

1021

type_func =

1124

timedelta_to_milliseconds)

1022

_timedelta_to_milliseconds)

1125

1023

checker_command = notifychangeproperty(dbus.String, "Checker")

1126

1024

1127

1025

del notifychangeproperty

1169

1067

return r

1170

1068

1171

1069

def _reset_approved(self):

1172

self.approved = None

1070

self._approved = None

1173

1071

return False

1174

1072

1175

1073

def approve(self, value=True):

1176

1074

self.send_changedstate()

1177

self.approved = value

1178

gobject.timeout_add(timedelta_to_milliseconds

1075

self._approved = value

1076

gobject.timeout_add(_timedelta_to_milliseconds

1179

1077

(self.approval_duration),

1180

1078

self._reset_approved)

1181

1079

1287

1185

access="readwrite")

1288

1186

def ApprovalDuration_dbus_property(self, value=None):

1289

1187

if value is None: # get

1290

return dbus.UInt64(timedelta_to_milliseconds(

1188

return dbus.UInt64(_timedelta_to_milliseconds(

1291

1189

self.approval_duration))

1292

1190

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1293

1191

1307

1205

def Host_dbus_property(self, value=None):

1308

1206

if value is None: # get

1309

1207

return dbus.String(self.host)

1310

self.host = unicode(value)

1208

self.host = value

1311

1209

1312

1210

# Created - property

1313

1211

@dbus_service_property(_interface, signature="s", access="read")

1314

1212

def Created_dbus_property(self):

1315

return datetime_to_dbus(self.created)

1213

return dbus.String(datetime_to_dbus(self.created))

1316

1214

1317

1215

# LastEnabled - property

1318

1216

@dbus_service_property(_interface, signature="s", access="read")

1356

1254

if value is None: # get

1357

1255

return dbus.UInt64(self.timeout_milliseconds())

1358

1256

self.timeout = datetime.timedelta(0, 0, 0, value)

1257

if getattr(self, "disable_initiator_tag", None) is None:

1258

return

1359

1259

# Reschedule timeout

1360

if self.enabled:

1361

now = datetime.datetime.utcnow()

1362

time_to_die = timedelta_to_milliseconds(

1363

(self.last_checked_ok + self.timeout) - now)

1364

if time_to_die <= 0:

1365

# The timeout has passed

1366

self.disable()

1367

else:

1368

self.expires = (now +

1369

datetime.timedelta(milliseconds =

1370

time_to_die))

1371

if (getattr(self, "disable_initiator_tag", None)

1372

is None):

1373

return

1374

gobject.source_remove(self.disable_initiator_tag)

1375

self.disable_initiator_tag = (gobject.timeout_add

1376

(time_to_die,

1377

self.disable))

1260

gobject.source_remove(self.disable_initiator_tag)

1261

self.disable_initiator_tag = None

1262

self.expires = None

1263

time_to_die = _timedelta_to_milliseconds((self

1264

.last_checked_ok

1265

+ self.timeout)

1266

- datetime.datetime

1267

.utcnow())

1268

if time_to_die <= 0:

1269

# The timeout has passed

1270

self.disable()

1271

else:

1272

self.expires = (datetime.datetime.utcnow()

1273

+ datetime.timedelta(milliseconds =

1274

time_to_die))

1275

self.disable_initiator_tag = (gobject.timeout_add

1276

(time_to_die, self.disable))

1378

1277

1379

1278

# ExtendedTimeout - property

1380

1279

@dbus_service_property(_interface, signature="t",

1393

1292

self.interval = datetime.timedelta(0, 0, 0, value)

1394

1293

if getattr(self, "checker_initiator_tag", None) is None:

1395

1294

return

1396

if self.enabled:

1397

# Reschedule checker run

1398

gobject.source_remove(self.checker_initiator_tag)

1399

self.checker_initiator_tag = (gobject.timeout_add

1400

(value, self.start_checker))

1401

self.start_checker() # Start one now, too

1295

# Reschedule checker run

1296

gobject.source_remove(self.checker_initiator_tag)

1297

self.checker_initiator_tag = (gobject.timeout_add

1298

(value, self.start_checker))

1299

self.start_checker() # Start one now, too

1402

1300

1403

1301

# Checker - property

1404

1302

@dbus_service_property(_interface, signature="s",

1406

1304

def Checker_dbus_property(self, value=None):

1407

1305

if value is None: # get

1408

1306

return dbus.String(self.checker_command)

1409

self.checker_command = unicode(value)

1307

self.checker_command = value

1410

1308

1411

1309

# CheckerRunning - property

1412

1310

@dbus_service_property(_interface, signature="b",

1441

1339

raise KeyError()

1442

1340

1443

1341

def __getattribute__(self, name):

1444

if name == '_pipe':

1342

if(name == '_pipe'):

1445

1343

return super(ProxyClient, self).__getattribute__(name)

1446

1344

self._pipe.send(('getattr', name))

1447

1345

data = self._pipe.recv()

1454

1352

return func

1455

1353

1456

1354

def __setattr__(self, name, value):

1457

if name == '_pipe':

1355

if(name == '_pipe'):

1458

1356

return super(ProxyClient, self).__setattr__(name, value)

1459

1357

self._pipe.send(('setattr', name, value))

1460

1358

1461

1462

1359

class ClientDBusTransitional(ClientDBus):

1463

1360

__metaclass__ = AlternateDBusNamesMetaclass

1464

1361

1465

1466

1362

class ClientHandler(socketserver.BaseRequestHandler, object):

1467

1363

"""A class to handle client connections.

1468

1364

1550

1446

client.Rejected("Disabled")

1551

1447

return

1552

1448

1553

if client.approved or not client.approval_delay:

1449

if client._approved or not client.approval_delay:

1554

1450

#We are approved or approval is disabled

1555

1451

break

1556

elif client.approved is None:

1452

elif client._approved is None:

1557

1453

logger.info("Client %s needs approval",

1558

1454

client.name)

1559

1455

if self.server.use_dbus:

1573

1469

time = datetime.datetime.now()

1574

1470

client.changedstate.acquire()

1575

1471

(client.changedstate.wait

1576

(float(client.timedelta_to_milliseconds(delay)

1472

(float(client._timedelta_to_milliseconds(delay)

1577

1473

/ 1000)))

1578

1474

client.changedstate.release()

1579

1475

time2 = datetime.datetime.now()

1678

1574

# Convert the buffer to a Python bytestring

1679

1575

fpr = ctypes.string_at(buf, buf_len.value)

1680

1576

# Convert the bytestring to hexadecimal notation

1681

hex_fpr = binascii.hexlify(fpr).upper()

1577

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1682

1578

return hex_fpr

1683

1579

1684

1580

1687

1583

def sub_process_main(self, request, address):

1688

1584

try:

1689

1585

self.finish_request(request, address)

1690

except Exception:

1586

except:

1691

1587

self.handle_error(request, address)

1692

1588

self.close_request(request)

1693

1589

1941

1837

return timevalue

1942

1838

1943

1839

1840

def if_nametoindex(interface):

1841

"""Call the C function if_nametoindex(), or equivalent

1842

1843

Note: This function cannot accept a unicode string."""

1844

global if_nametoindex

1845

try:

1846

if_nametoindex = (ctypes.cdll.LoadLibrary

1847

(ctypes.util.find_library("c"))

1848

.if_nametoindex)

1849

except (OSError, AttributeError):

1850

logger.warning("Doing if_nametoindex the hard way")

1851

def if_nametoindex(interface):

1852

"Get an interface index the hard way, i.e. using fcntl()"

1853

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1854

with contextlib.closing(socket.socket()) as s:

1855

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1856

struct.pack(str("16s16x"),

1857

interface))

1858

interface_index = struct.unpack(str("I"),

1859

ifreq[16:20])[0]

1860

return interface_index

1861

return if_nametoindex(interface)

1862

1863

1944

1864

def daemon(nochdir = False, noclose = False):

1945

1865

"""See daemon(3). Standard BSD Unix function.

1946

1866

2002

1922

parser.add_argument("--no-ipv6", action="store_false",

2003

1923

dest="use_ipv6", help="Do not use IPv6")

2004

1924

parser.add_argument("--no-restore", action="store_false",

2005

dest="restore", help="Do not restore stored"

2006

" state")

2007

parser.add_argument("--statedir", metavar="DIR",

2008

help="Directory to save/restore state in")

2009

1925

dest="restore", help="Do not restore stored state",

1926

default=True)

1927

2010

1928

options = parser.parse_args()

2011

1929

2012

1930

if options.check:

2025

1943

"use_dbus": "True",

2026

1944

"use_ipv6": "True",

2027

1945

"debuglevel": "",

2028

"restore": "True",

2029

"statedir": "/var/lib/mandos"

2030

1946

}

2031

1947

2032

1948

# Parse config file for server-global settings

2049

1965

# options, if set.

2050

1966

for option in ("interface", "address", "port", "debug",

2051

1967

"priority", "servicename", "configdir",

2052

"use_dbus", "use_ipv6", "debuglevel", "restore",

2053

"statedir"):

1968

"use_dbus", "use_ipv6", "debuglevel", "restore"):

2054

1969

value = getattr(options, option)

2055

1970

if value is not None:

2056

1971

server_settings[option] = value

2068

1983

debuglevel = server_settings["debuglevel"]

2069

1984

use_dbus = server_settings["use_dbus"]

2070

1985

use_ipv6 = server_settings["use_ipv6"]

2071

stored_state_path = os.path.join(server_settings["statedir"],

2072

stored_state_file)

2073

2074

if debug:

2075

initlogger(debug, logging.DEBUG)

2076

else:

2077

if not debuglevel:

2078

initlogger(debug)

2079

else:

2080

level = getattr(logging, debuglevel.upper())

2081

initlogger(debug, level)

2082

1986

2083

1987

if server_settings["servicename"] != "Mandos":

2084

1988

syslogger.setFormatter(logging.Formatter

2087

1991

% server_settings["servicename"]))

2088

1992

2089

1993

# Parse config file with clients

2090

client_config = configparser.SafeConfigParser(Client

2091

.client_defaults)

1994

client_defaults = { "timeout": "5m",

1995

"extended_timeout": "15m",

1996

"interval": "2m",

1997

"checker": "fping -q -- %%(host)s",

1998

"host": "",

1999

"approval_delay": "0s",

2000

"approval_duration": "1s",

2001

}

2002

client_config = configparser.SafeConfigParser(client_defaults)

2092

2003

client_config.read(os.path.join(server_settings["configdir"],

2093

2004

"clients.conf"))

2094

2005

2132

2043

if error[0] != errno.EPERM:

2133

2044

raise error

2134

2045

2046

if not debug and not debuglevel:

2047

logger.setLevel(logging.WARNING)

2048

if debuglevel:

2049

level = getattr(logging, debuglevel.upper())

2050

logger.setLevel(level)

2051

2135

2052

if debug:

2053

logger.setLevel(logging.DEBUG)

2136

2054

# Enable all possible GnuTLS debugging

2137

2055

2138

2056

# "Use a log level over 10 to enable all debugging options."

2151

2069

os.dup2(null, sys.stdin.fileno())

2152

2070

if null > 2:

2153

2071

os.close(null)

2072

else:

2073

# No console logging

2074

logger.removeHandler(console)

2154

2075

2155

2076

# Need to fork before connecting to D-Bus

2156

2077

if not debug:

2157

2078

# Close all input and output, do double fork, etc.

2158

2079

daemon()

2159

2080

2160

gobject.threads_init()

2161

2162

2081

global main_loop

2163

2082

# From the Avahi example code

2164

2083

DBusGMainLoop(set_as_default=True )

2194

2113

client_class = functools.partial(ClientDBusTransitional,

2195

2114

bus = bus)

2196

2115

2197

client_settings = Client.config_parser(client_config)

2116

special_settings = {

2117

# Some settings need to be accessd by special methods;

2118

# booleans need .getboolean(), etc. Here is a list of them:

2119

"approved_by_default":

2120

lambda section:

2121

client_config.getboolean(section, "approved_by_default"),

2122

}

2123

# Construct a new dict of client settings of this form:

2124

# { client_name: {setting_name: value, ...}, ...}

2125

# with exceptions for any special settings as defined above

2126

client_settings = dict((clientname,

2127

dict((setting,

2128

(value if setting not in special_settings

2129

else special_settings[setting](clientname)))

2130

for setting, value in client_config.items(clientname)))

2131

for clientname in client_config.sections())

2132

2198

2133

old_client_settings = {}

2199

clients_data = {}

2200

2201

# Get client data and settings from last running state.

2134

clients_data = []

2135

2136

# Get client data and settings from last running state.

2202

2137

if server_settings["restore"]:

2203

2138

try:

2204

2139

with open(stored_state_path, "rb") as stored_state:

2205

clients_data, old_client_settings = (pickle.load

2206

(stored_state))

2140

clients_data, old_client_settings = pickle.load(stored_state)

2207

2141

os.remove(stored_state_path)

2208

2142

except IOError as e:

2209

logger.warning("Could not load persistent state: {0}"

2210

.format(e))

2143

logger.warning("Could not load persistant state: {0}".format(e))

2211

2144

if e.errno != errno.ENOENT:

2212

2145

raise

2213

except EOFError as e:

2214

logger.warning("Could not load persistent state: "

2215

"EOFError: {0}".format(e))

2216

2217

with PGPEngine() as pgp:

2218

for client_name, client in clients_data.iteritems():

2219

# Decide which value to use after restoring saved state.

2220

# We have three different values: Old config file,

2221

# new config file, and saved state.

2222

# New config value takes precedence if it differs from old

2223

# config value, otherwise use saved state.

2224

for name, value in client_settings[client_name].items():

2225

try:

2226

# For each value in new config, check if it

2227

# differs from the old config value (Except for

2228

# the "secret" attribute)

2229

if (name != "secret" and

2230

value != old_client_settings[client_name]

2231

[name]):

2232

client[name] = value

2233

except KeyError:

2234

pass

2235

2236

# Clients who has passed its expire date can still be

2237

# enabled if its last checker was successful. Clients

2238

# whose checker succeeded before we stored its state is

2239

# assumed to have successfully run all checkers during

2240

# downtime.

2241

if client["enabled"]:

2242

if datetime.datetime.utcnow() >= client["expires"]:

2243

if not client["last_checked_ok"]:

2244

logger.warning(

2245

"disabling client {0} - Client never "

2246

"performed a successful checker"

2247

.format(client_name))

2248

client["enabled"] = False

2249

elif client["last_checker_status"] != 0:

2250

logger.warning(

2251

"disabling client {0} - Client "

2252

"last checker failed with error code {1}"

2253

.format(client_name,

2254

client["last_checker_status"]))

2255

client["enabled"] = False

2256

else:

2257

client["expires"] = (datetime.datetime

2258

.utcnow()

2259

+ client["timeout"])

2260

logger.debug("Last checker succeeded,"

2261

" keeping {0} enabled"

2262

.format(client_name))

2146

2147

for client in clients_data:

2148

client_name = client["name"]

2149

2150

# Decide which value to use after restoring saved state.

2151

# We have three different values: Old config file,

2152

# new config file, and saved state.

2153

# New config value takes precedence if it differs from old

2154

# config value, otherwise use saved state.

2155

for name, value in client_settings[client_name].items():

2263

2156

try:

2264

client["secret"] = (

2265

pgp.decrypt(client["encrypted_secret"],

2266

client_settings[client_name]

2267

["secret"]))

2268

except PGPError:

2269

# If decryption fails, we use secret from new settings

2270

logger.debug("Failed to decrypt {0} old secret"

2271

.format(client_name))

2272

client["secret"] = (

2273

client_settings[client_name]["secret"])

2274

2275

2276

# Add/remove clients based on new changes made to config

2277

for client_name in (set(old_client_settings)

2278

- set(client_settings)):

2279

del clients_data[client_name]

2280

for client_name in (set(client_settings)

2281

- set(old_client_settings)):

2282

clients_data[client_name] = client_settings[client_name]

2283

2284

# Create all client objects

2285

for client_name, client in clients_data.iteritems():

2286

tcp_server.clients[client_name] = client_class(

2287

name = client_name, settings = client)

2288

2157

# For each value in new config, check if it differs

2158

# from the old config value (Except for the "secret"

2159

# attribute)

2160

if name != "secret" and value != old_client_settings[client_name][name]:

2161

setattr(client, name, value)

2162

except KeyError:

2163

pass

2164

2165

# Clients who has passed its expire date, can still be enabled if its

2166

# last checker was sucessful. Clients who checkers failed before we

2167

# stored it state is asumed to had failed checker during downtime.

2168

if client["enabled"] and client["last_checked_ok"]:

2169

if ((datetime.datetime.utcnow() - client["last_checked_ok"])

2170

> client["interval"]):

2171

if client["last_checker_status"] != 0:

2172

client["enabled"] = False

2173

else:

2174

client["expires"] = datetime.datetime.utcnow() + client["timeout"]

2175

2176

client["changedstate"] = (multiprocessing_manager

2177

.Condition(multiprocessing_manager

2178

.Lock()))

2179

if use_dbus:

2180

new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)

2181

tcp_server.clients[client_name] = new_client

2182

new_client.bus = bus

2183

for name, value in client.iteritems():

2184

setattr(new_client, name, value)

2185

client_object_name = unicode(client_name).translate(

2186

{ord("."): ord("_"),

2187

ord("-"): ord("_")})

2188

new_client.dbus_object_path = (dbus.ObjectPath

2189

("/clients/" + client_object_name))

2190

DBusObjectWithProperties.__init__(new_client,

2191

new_client.bus,

2192

new_client.dbus_object_path)

2193

else:

2194

tcp_server.clients[client_name] = Client.__new__(Client)

2195

for name, value in client.iteritems():

2196

setattr(tcp_server.clients[client_name], name, value)

2197

2198

tcp_server.clients[client_name].decrypt_secret(

2199

client_settings[client_name]["secret"])

2200

2201

# Create/remove clients based on new changes made to config

2202

for clientname in set(old_client_settings) - set(client_settings):

2203

del tcp_server.clients[clientname]

2204

for clientname in set(client_settings) - set(old_client_settings):

2205

tcp_server.clients[clientname] = (client_class(name = clientname,

2206

config =

2207

client_settings

2208

[clientname]))

2209

2210

2289

2211

if not tcp_server.clients:

2290

2212

logger.warning("No clients defined")

2291

2213

2302

2224

# "pidfile" was never created

2303

2225

pass

2304

2226

del pidfilename

2227

2305

2228

signal.signal(signal.SIGINT, signal.SIG_IGN)

2306

2229

2307

2230

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2372

2295

multiprocessing.active_children()

2373

2296

if not (tcp_server.clients or client_settings):

2374

2297

return

2375

2376

# Store client before exiting. Secrets are encrypted with key

2377

# based on what config file has. If config file is

2378

# removed/edited, old secret will thus be unrecovable.

2379

clients = {}

2380

with PGPEngine() as pgp:

2381

for client in tcp_server.clients.itervalues():

2382

key = client_settings[client.name]["secret"]

2383

client.encrypted_secret = pgp.encrypt(client.secret,

2384

key)

2385

client_dict = {}

2386

2387

# A list of attributes that can not be pickled

2388

# + secret.

2389

exclude = set(("bus", "changedstate", "secret",

2390

"checker"))

2391

for name, typ in (inspect.getmembers

2392

(dbus.service.Object)):

2393

exclude.add(name)

2394

2395

client_dict["encrypted_secret"] = (client

2396

.encrypted_secret)

2397

for attr in client.client_structure:

2398

if attr not in exclude:

2399

client_dict[attr] = getattr(client, attr)

2400

2401

clients[client.name] = client_dict

2402

del client_settings[client.name]["secret"]

2403

2298

2299

# Store client before exiting. Secrets are encrypted with key based

2300

# on what config file has. If config file is removed/edited, old

2301

# secret will thus be unrecovable.

2302

clients = []

2303

for client in tcp_server.clients.itervalues():

2304

client.encrypt_secret(client_settings[client.name]["secret"])

2305

2306

client_dict = {}

2307

2308

# A list of attributes that will not be stored when shuting down.

2309

exclude = set(("bus", "changedstate", "secret"))

2310

for name, typ in inspect.getmembers(dbus.service.Object):

2311

exclude.add(name)

2312

2313

client_dict["encrypted_secret"] = client.encrypted_secret

2314

for attr in client.client_structure:

2315

if attr not in exclude:

2316

client_dict[attr] = getattr(client, attr)

2317

2318

clients.append(client_dict)

2319

del client_settings[client.name]["secret"]

2320

2404

2321

try:

2405

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2406

prefix="clients-",

2407

dir=os.path.dirname

2408

(stored_state_path))

2409

with os.fdopen(tempfd, "wb") as stored_state:

2322

with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:

2410

2323

pickle.dump((clients, client_settings), stored_state)

2411

os.rename(tempname, stored_state_path)

2412

except (IOError, OSError) as e:

2413

logger.warning("Could not save persistent state: {0}"

2414

.format(e))

2415

if not debug:

2416

try:

2417

os.remove(tempname)

2418

except NameError:

2419

pass

2420

if e.errno not in set((errno.ENOENT, errno.EACCES,

2421

errno.EEXIST)):

2422

raise e

2423

2324

except IOError as e:

2325

logger.warning("Could not save persistant state: {0}".format(e))

2326

if e.errno != errno.ENOENT:

2327

raise

2328

2424

2329

# Delete all clients, and settings from config

2425

2330

while tcp_server.clients:

2426

2331

name, client = tcp_server.clients.popitem()

2444

2349

# Need to initiate checking of clients

2445

2350

if client.enabled:

2446

2351

client.init_checker()

2352

2447

2353

2448

2354

tcp_server.enable()

2449

2355

tcp_server.server_activate()

2489

2395

# Must run before the D-Bus bus name gets deregistered

2490

2396

cleanup()

2491

2397

2398

2492

2399

if __name__ == '__main__':

2493

2400

main()