To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 521
- compare with another revision
- download diff
- download tarball
- view history from revision 521
- Committer: teddy at bsnet
- Date: 2011-11-10 11:08:50 UTC
- Revision ID: teddy@fukt.bsnet.se-20111110110850-ztybq08hduf85vx6
* debian/control (mandos/Depends): Added "python-crypto".
* mandos: Break long lines.
(ClientDBus.add_to_dbus): New.
(ClientDBus.__init__): Call add_to_dbus().
(main): - '' -
* mandos: Break long lines.
(ClientDBus.add_to_dbus): New.
(ClientDBus.__init__): Call add_to_dbus().
(main): - '' -
- files removed:
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import binascii
67
import tempfile
66
import hashlib
68
67
69
68
import dbus
70
69
import dbus.service
75
74
import ctypes.util
76
75
import xml.dom.minidom
77
76
import inspect
78
import GnuPGInterface
77
import Crypto.Cipher.AES
79
78
80
79
try:
81
80
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
84
except ImportError:
86
85
SO_BINDTODEVICE = None
87
86
88
version = "1.5.1"
89
stored_state_file = "clients.pickle"
87
88
version = "1.4.1"
90
89
91
90
logger = logging.getLogger()
91
stored_state_path = "/var/lib/mandos/clients.pickle"
92
92
93
syslogger = (logging.handlers.SysLogHandler
93
94
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
95
address = str("/dev/log")))
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(debug, level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
if debug:
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet',
146
'--no-use-agent'])
147
148
def __enter__(self):
149
return self
150
151
def __exit__ (self, exc_type, exc_value, traceback):
152
self._cleanup()
153
return False
154
155
def __del__(self):
156
self._cleanup()
157
158
def _cleanup(self):
159
if self.tempdir is not None:
160
# Delete contents of tempdir
161
for root, dirs, files in os.walk(self.tempdir,
162
topdown = False):
163
for filename in files:
164
os.remove(os.path.join(root, filename))
165
for dirname in dirs:
166
os.rmdir(os.path.join(root, dirname))
167
# Remove tempdir
168
os.rmdir(self.tempdir)
169
self.tempdir = None
170
171
def password_encode(self, password):
172
# Passphrase can not be empty and can not contain newlines or
173
# NUL bytes. So we prefix it and hex encode it.
174
return b"mandos" + binascii.hexlify(password)
175
176
def encrypt(self, data, password):
177
self.gnupg.passphrase = self.password_encode(password)
178
with open(os.devnull) as devnull:
179
try:
180
proc = self.gnupg.run(['--symmetric'],
181
create_fhs=['stdin', 'stdout'],
182
attach_fhs={'stderr': devnull})
183
with contextlib.closing(proc.handles['stdin']) as f:
184
f.write(data)
185
with contextlib.closing(proc.handles['stdout']) as f:
186
ciphertext = f.read()
187
proc.wait()
188
except IOError as e:
189
raise PGPError(e)
190
self.gnupg.passphrase = None
191
return ciphertext
192
193
def decrypt(self, data, password):
194
self.gnupg.passphrase = self.password_encode(password)
195
with open(os.devnull) as devnull:
196
try:
197
proc = self.gnupg.run(['--decrypt'],
198
create_fhs=['stdin', 'stdout'],
199
attach_fhs={'stderr': devnull})
200
with contextlib.closing(proc.handles['stdin'] ) as f:
201
f.write(data)
202
with contextlib.closing(proc.handles['stdout']) as f:
203
decrypted_plaintext = f.read()
204
proc.wait()
205
except IOError as e:
206
raise PGPError(e)
207
self.gnupg.passphrase = None
208
return decrypted_plaintext
209
96
syslogger.setFormatter(logging.Formatter
97
('Mandos [%(process)d]: %(levelname)s:'
98
' %(message)s'))
99
logger.addHandler(syslogger)
100
101
console = logging.StreamHandler()
102
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
103
' [%(process)d]:'
104
' %(levelname)s:'
105
' %(message)s'))
106
logger.addHandler(console)
210
107
211
108
212
109
class AvahiError(Exception):
329
226
try:
330
227
self.group.Free()
331
228
except (dbus.exceptions.UnknownMethodException,
332
dbus.exceptions.DBusException):
229
dbus.exceptions.DBusException) as e:
333
230
pass
334
231
self.group = None
335
232
self.remove()
379
276
% self.name))
380
277
return ret
381
278
382
def timedelta_to_milliseconds(td):
279
def _timedelta_to_milliseconds(td):
383
280
"Convert a datetime.timedelta() to milliseconds"
384
281
return ((td.days * 24 * 60 * 60 * 1000)
385
282
+ (td.seconds * 1000)
389
286
"""A representation of a client host served by this server.
390
287
391
288
Attributes:
392
approved: bool(); 'None' if not yet approved/disapproved
289
_approved: bool(); 'None' if not yet approved/disapproved
393
290
approval_delay: datetime.timedelta(); Time to wait for approval
394
291
approval_duration: datetime.timedelta(); Duration of one approval
395
292
checker: subprocess.Popen(); a running checker process used
414
311
last_approval_request: datetime.datetime(); (UTC) or None
415
312
last_checked_ok: datetime.datetime(); (UTC) or None
416
313
last_checker_status: integer between 0 and 255 reflecting exit
417
status of last checker. -1 reflects crashed
314
status of last checker. -1 reflect crashed
418
315
checker, or None.
419
last_enabled: datetime.datetime(); (UTC) or None
316
last_enabled: datetime.datetime(); (UTC)
420
317
name: string; from the config file, used in log messages and
421
318
D-Bus identifiers
422
319
secret: bytestring; sent verbatim (over TLS) to client
432
329
"created", "enabled", "fingerprint",
433
330
"host", "interval", "last_checked_ok",
434
331
"last_enabled", "name", "timeout")
435
client_defaults = { "timeout": "5m",
436
"extended_timeout": "15m",
437
"interval": "2m",
438
"checker": "fping -q -- %%(host)s",
439
"host": "",
440
"approval_delay": "0s",
441
"approval_duration": "1s",
442
"approved_by_default": "True",
443
"enabled": "True",
444
}
445
332
446
333
def timeout_milliseconds(self):
447
334
"Return the 'timeout' attribute in milliseconds"
448
return timedelta_to_milliseconds(self.timeout)
335
return _timedelta_to_milliseconds(self.timeout)
449
336
450
337
def extended_timeout_milliseconds(self):
451
338
"Return the 'extended_timeout' attribute in milliseconds"
452
return timedelta_to_milliseconds(self.extended_timeout)
339
return _timedelta_to_milliseconds(self.extended_timeout)
453
340
454
341
def interval_milliseconds(self):
455
342
"Return the 'interval' attribute in milliseconds"
456
return timedelta_to_milliseconds(self.interval)
343
return _timedelta_to_milliseconds(self.interval)
457
344
458
345
def approval_delay_milliseconds(self):
459
return timedelta_to_milliseconds(self.approval_delay)
460
461
@staticmethod
462
def config_parser(config):
463
"""Construct a new dict of client settings of this form:
464
{ client_name: {setting_name: value, ...}, ...}
465
with exceptions for any special settings as defined above.
466
NOTE: Must be a pure function. Must return the same result
467
value given the same arguments.
468
"""
469
settings = {}
470
for client_name in config.sections():
471
section = dict(config.items(client_name))
472
client = settings[client_name] = {}
473
474
client["host"] = section["host"]
475
# Reformat values from string types to Python types
476
client["approved_by_default"] = config.getboolean(
477
client_name, "approved_by_default")
478
client["enabled"] = config.getboolean(client_name,
479
"enabled")
480
481
client["fingerprint"] = (section["fingerprint"].upper()
482
.replace(" ", ""))
483
if "secret" in section:
484
client["secret"] = section["secret"].decode("base64")
485
elif "secfile" in section:
486
with open(os.path.expanduser(os.path.expandvars
487
(section["secfile"])),
488
"rb") as secfile:
489
client["secret"] = secfile.read()
490
else:
491
raise TypeError("No secret or secfile for section %s"
492
% section)
493
client["timeout"] = string_to_delta(section["timeout"])
494
client["extended_timeout"] = string_to_delta(
495
section["extended_timeout"])
496
client["interval"] = string_to_delta(section["interval"])
497
client["approval_delay"] = string_to_delta(
498
section["approval_delay"])
499
client["approval_duration"] = string_to_delta(
500
section["approval_duration"])
501
client["checker_command"] = section["checker"]
502
client["last_approval_request"] = None
503
client["last_checked_ok"] = None
504
client["last_checker_status"] = None
505
506
return settings
507
508
509
def __init__(self, settings, name = None):
346
return _timedelta_to_milliseconds(self.approval_delay)
347
348
def __init__(self, name = None, config=None):
510
349
"""Note: the 'checker' key in 'config' sets the
511
350
'checker_command' attribute and *not* the 'checker'
512
351
attribute."""
513
352
self.name = name
514
# adding all client settings
515
for setting, value in settings.iteritems():
516
setattr(self, setting, value)
517
518
if self.enabled:
519
if not hasattr(self, "last_enabled"):
520
self.last_enabled = datetime.datetime.utcnow()
521
if not hasattr(self, "expires"):
522
self.expires = (datetime.datetime.utcnow()
523
+ self.timeout)
524
else:
525
self.last_enabled = None
526
self.expires = None
527
353
if config is None:
354
config = {}
528
355
logger.debug("Creating client %r", self.name)
529
356
# Uppercase and remove spaces from fingerprint for later
530
357
# comparison purposes with return value from the fingerprint()
531
358
# function
359
self.fingerprint = (config["fingerprint"].upper()
360
.replace(" ", ""))
532
361
logger.debug(" Fingerprint: %s", self.fingerprint)
533
self.created = settings.get("created",
534
datetime.datetime.utcnow())
535
536
# attributes specific for this server instance
362
if "secret" in config:
363
self.secret = config["secret"].decode("base64")
364
elif "secfile" in config:
365
with open(os.path.expanduser(os.path.expandvars
366
(config["secfile"])),
367
"rb") as secfile:
368
self.secret = secfile.read()
369
else:
370
raise TypeError("No secret or secfile for client %s"
371
% self.name)
372
self.host = config.get("host", "")
373
self.created = datetime.datetime.utcnow()
374
self.enabled = True
375
self.last_approval_request = None
376
self.last_enabled = datetime.datetime.utcnow()
377
self.last_checked_ok = None
378
self.last_checker_status = None
379
self.timeout = string_to_delta(config["timeout"])
380
self.extended_timeout = string_to_delta(config
381
["extended_timeout"])
382
self.interval = string_to_delta(config["interval"])
537
383
self.checker = None
538
384
self.checker_initiator_tag = None
539
385
self.disable_initiator_tag = None
386
self.expires = datetime.datetime.utcnow() + self.timeout
540
387
self.checker_callback_tag = None
388
self.checker_command = config["checker"]
541
389
self.current_checker_command = None
542
self.approved = None
390
self._approved = None
391
self.approved_by_default = config.get("approved_by_default",
392
True)
543
393
self.approvals_pending = 0
394
self.approval_delay = string_to_delta(
395
config["approval_delay"])
396
self.approval_duration = string_to_delta(
397
config["approval_duration"])
544
398
self.changedstate = (multiprocessing_manager
545
399
.Condition(multiprocessing_manager
546
400
.Lock()))
547
self.client_structure = [attr for attr in
548
self.__dict__.iterkeys()
401
self.client_structure = [attr for attr
402
in self.__dict__.iterkeys()
549
403
if not attr.startswith("_")]
550
404
self.client_structure.append("client_structure")
551
405
406
552
407
for name, t in inspect.getmembers(type(self),
553
408
lambda obj:
554
409
isinstance(obj,
594
449
595
450
def __del__(self):
596
451
self.disable()
597
452
598
453
def init_checker(self):
599
454
# Schedule a new checker to be started an 'interval' from now,
600
455
# and every interval from then on.
607
462
self.disable))
608
463
# Also start a new checker *right now*.
609
464
self.start_checker()
610
465
466
611
467
def checker_callback(self, pid, condition, command):
612
468
"""The checker has completed, so take appropriate actions."""
613
469
self.checker_callback_tag = None
614
470
self.checker = None
615
471
if os.WIFEXITED(condition):
616
self.last_checker_status = os.WEXITSTATUS(condition)
472
self.last_checker_status = os.WEXITSTATUS(condition)
617
473
if self.last_checker_status == 0:
618
474
logger.info("Checker for %(name)s succeeded",
619
475
vars(self))
639
495
gobject.source_remove(self.disable_initiator_tag)
640
496
if getattr(self, "enabled", False):
641
497
self.disable_initiator_tag = (gobject.timeout_add
642
(timedelta_to_milliseconds
498
(_timedelta_to_milliseconds
643
499
(timeout), self.disable))
644
500
self.expires = datetime.datetime.utcnow() + timeout
645
501
739
595
raise
740
596
self.checker = None
741
597
598
# Encrypts a client secret and stores it in a varible
599
# encrypted_secret
600
def encrypt_secret(self, key):
601
# Encryption-key need to be of a specific size, so we hash
602
# supplied key
603
hasheng = hashlib.sha256()
604
hasheng.update(key)
605
encryptionkey = hasheng.digest()
606
607
# Create validation hash so we know at decryption if it was
608
# sucessful
609
hasheng = hashlib.sha256()
610
hasheng.update(self.secret)
611
validationhash = hasheng.digest()
612
613
# Encrypt secret
614
iv = os.urandom(Crypto.Cipher.AES.block_size)
615
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
616
Crypto.Cipher.AES.MODE_CFB, iv)
617
ciphertext = ciphereng.encrypt(validationhash+self.secret)
618
self.encrypted_secret = (ciphertext, iv)
619
620
# Decrypt a encrypted client secret
621
def decrypt_secret(self, key):
622
# Decryption-key need to be of a specific size, so we hash
623
# supplied key
624
hasheng = hashlib.sha256()
625
hasheng.update(key)
626
encryptionkey = hasheng.digest()
627
628
# Decrypt encrypted secret
629
ciphertext, iv = self.encrypted_secret
630
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
631
Crypto.Cipher.AES.MODE_CFB, iv)
632
plain = ciphereng.decrypt(ciphertext)
633
634
# Validate decrypted secret to know if it was succesful
635
hasheng = hashlib.sha256()
636
validationhash = plain[:hasheng.digest_size]
637
secret = plain[hasheng.digest_size:]
638
hasheng.update(secret)
639
640
# If validation fails, we use key as new secret. Otherwise, we
641
# use the decrypted secret
642
if hasheng.digest() == validationhash:
643
self.secret = secret
644
else:
645
self.secret = key
646
del self.encrypted_secret
647
742
648
743
649
def dbus_service_property(dbus_interface, signature="v",
744
650
access="readwrite", byte_arrays=False):
850
756
# signatures other than "ay".
851
757
if prop._dbus_signature != "ay":
852
758
raise ValueError
853
value = dbus.ByteArray(b''.join(chr(byte)
854
for byte in value))
759
value = dbus.ByteArray(''.join(unichr(byte)
760
for byte in value))
855
761
prop(value)
856
762
857
763
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
862
768
863
769
Note: Will not include properties with access="write".
864
770
"""
865
properties = {}
771
all = {}
866
772
for name, prop in self._get_all_dbus_properties():
867
773
if (interface_name
868
774
and interface_name != prop._dbus_interface):
873
779
continue
874
780
value = prop()
875
781
if not hasattr(value, "variant_level"):
876
properties[name] = value
782
all[name] = value
877
783
continue
878
properties[name] = type(value)(value, variant_level=
879
value.variant_level+1)
880
return dbus.Dictionary(properties, signature="sv")
784
all[name] = type(value)(value, variant_level=
785
value.variant_level+1)
786
return dbus.Dictionary(all, signature="sv")
881
787
882
788
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
883
789
out_signature="s",
934
840
return dbus.String(dt.isoformat(),
935
841
variant_level=variant_level)
936
842
937
938
843
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
939
844
.__metaclass__):
940
845
"""Applied to an empty subclass of a D-Bus object, this metaclass
1032
937
attribute.func_closure)))
1033
938
return type.__new__(mcs, name, bases, attr)
1034
939
1035
1036
940
class ClientDBus(Client, DBusObjectWithProperties):
1037
941
"""A Client class using D-Bus
1038
942
1048
952
1049
953
def __init__(self, bus = None, *args, **kwargs):
1050
954
self.bus = bus
955
self._approvals_pending = 0
1051
956
Client.__init__(self, *args, **kwargs)
1052
self._approvals_pending = 0
1053
1054
self._approvals_pending = 0
957
self.add_to_dbus()
958
959
def add_to_dbus(self):
1055
960
# Only now, when this client is initialized, can it show up on
1056
961
# the D-Bus
1057
962
client_object_name = unicode(self.name).translate(
1067
972
variant_level=1):
1068
973
""" Modify a variable so that it's a property which announces
1069
974
its changes to DBus.
1070
975
1071
976
transform_fun: Function that takes a value and a variant_level
1072
977
and transforms it to a D-Bus type.
1073
978
dbus_name: D-Bus name of the variable
1107
1012
datetime_to_dbus, "LastApprovalRequest")
1108
1013
approved_by_default = notifychangeproperty(dbus.Boolean,
1109
1014
"ApprovedByDefault")
1110
approval_delay = notifychangeproperty(dbus.UInt64,
1015
approval_delay = notifychangeproperty(dbus.UInt16,
1111
1016
"ApprovalDelay",
1112
1017
type_func =
1113
timedelta_to_milliseconds)
1018
_timedelta_to_milliseconds)
1114
1019
approval_duration = notifychangeproperty(
1115
dbus.UInt64, "ApprovalDuration",
1116
type_func = timedelta_to_milliseconds)
1020
dbus.UInt16, "ApprovalDuration",
1021
type_func = _timedelta_to_milliseconds)
1117
1022
host = notifychangeproperty(dbus.String, "Host")
1118
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1023
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1119
1024
type_func =
1120
timedelta_to_milliseconds)
1025
_timedelta_to_milliseconds)
1121
1026
extended_timeout = notifychangeproperty(
1122
dbus.UInt64, "ExtendedTimeout",
1123
type_func = timedelta_to_milliseconds)
1124
interval = notifychangeproperty(dbus.UInt64,
1027
dbus.UInt16, "ExtendedTimeout",
1028
type_func = _timedelta_to_milliseconds)
1029
interval = notifychangeproperty(dbus.UInt16,
1125
1030
"Interval",
1126
1031
type_func =
1127
timedelta_to_milliseconds)
1032
_timedelta_to_milliseconds)
1128
1033
checker_command = notifychangeproperty(dbus.String, "Checker")
1129
1034
1130
1035
del notifychangeproperty
1172
1077
return r
1173
1078
1174
1079
def _reset_approved(self):
1175
self.approved = None
1080
self._approved = None
1176
1081
return False
1177
1082
1178
1083
def approve(self, value=True):
1179
1084
self.send_changedstate()
1180
self.approved = value
1181
gobject.timeout_add(timedelta_to_milliseconds
1085
self._approved = value
1086
gobject.timeout_add(_timedelta_to_milliseconds
1182
1087
(self.approval_duration),
1183
1088
self._reset_approved)
1184
1089
1227
1132
"D-Bus signal"
1228
1133
return self.need_approval()
1229
1134
1230
# NeRwequest - signal
1231
@dbus.service.signal(_interface, signature="s")
1232
def NewRequest(self, ip):
1233
"""D-Bus signal
1234
Is sent after a client request a password.
1235
"""
1236
pass
1237
1238
1135
## Methods
1239
1136
1240
1137
# Approve - method
1298
1195
access="readwrite")
1299
1196
def ApprovalDuration_dbus_property(self, value=None):
1300
1197
if value is None: # get
1301
return dbus.UInt64(timedelta_to_milliseconds(
1198
return dbus.UInt64(_timedelta_to_milliseconds(
1302
1199
self.approval_duration))
1303
1200
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1304
1201
1318
1215
def Host_dbus_property(self, value=None):
1319
1216
if value is None: # get
1320
1217
return dbus.String(self.host)
1321
self.host = unicode(value)
1218
self.host = value
1322
1219
1323
1220
# Created - property
1324
1221
@dbus_service_property(_interface, signature="s", access="read")
1325
1222
def Created_dbus_property(self):
1326
return datetime_to_dbus(self.created)
1223
return dbus.String(datetime_to_dbus(self.created))
1327
1224
1328
1225
# LastEnabled - property
1329
1226
@dbus_service_property(_interface, signature="s", access="read")
1367
1264
if value is None: # get
1368
1265
return dbus.UInt64(self.timeout_milliseconds())
1369
1266
self.timeout = datetime.timedelta(0, 0, 0, value)
1267
if getattr(self, "disable_initiator_tag", None) is None:
1268
return
1370
1269
# Reschedule timeout
1371
if self.enabled:
1372
now = datetime.datetime.utcnow()
1373
time_to_die = timedelta_to_milliseconds(
1374
(self.last_checked_ok + self.timeout) - now)
1375
if time_to_die <= 0:
1376
# The timeout has passed
1377
self.disable()
1378
else:
1379
self.expires = (now +
1380
datetime.timedelta(milliseconds =
1381
time_to_die))
1382
if (getattr(self, "disable_initiator_tag", None)
1383
is None):
1384
return
1385
gobject.source_remove(self.disable_initiator_tag)
1386
self.disable_initiator_tag = (gobject.timeout_add
1387
(time_to_die,
1388
self.disable))
1270
gobject.source_remove(self.disable_initiator_tag)
1271
self.disable_initiator_tag = None
1272
self.expires = None
1273
time_to_die = _timedelta_to_milliseconds((self
1274
.last_checked_ok
1275
+ self.timeout)
1276
- datetime.datetime
1277
.utcnow())
1278
if time_to_die <= 0:
1279
# The timeout has passed
1280
self.disable()
1281
else:
1282
self.expires = (datetime.datetime.utcnow()
1283
+ datetime.timedelta(milliseconds =
1284
time_to_die))
1285
self.disable_initiator_tag = (gobject.timeout_add
1286
(time_to_die, self.disable))
1389
1287
1390
1288
# ExtendedTimeout - property
1391
1289
@dbus_service_property(_interface, signature="t",
1404
1302
self.interval = datetime.timedelta(0, 0, 0, value)
1405
1303
if getattr(self, "checker_initiator_tag", None) is None:
1406
1304
return
1407
if self.enabled:
1408
# Reschedule checker run
1409
gobject.source_remove(self.checker_initiator_tag)
1410
self.checker_initiator_tag = (gobject.timeout_add
1411
(value, self.start_checker))
1412
self.start_checker() # Start one now, too
1305
# Reschedule checker run
1306
gobject.source_remove(self.checker_initiator_tag)
1307
self.checker_initiator_tag = (gobject.timeout_add
1308
(value, self.start_checker))
1309
self.start_checker() # Start one now, too
1413
1310
1414
1311
# Checker - property
1415
1312
@dbus_service_property(_interface, signature="s",
1417
1314
def Checker_dbus_property(self, value=None):
1418
1315
if value is None: # get
1419
1316
return dbus.String(self.checker_command)
1420
self.checker_command = unicode(value)
1317
self.checker_command = value
1421
1318
1422
1319
# CheckerRunning - property
1423
1320
@dbus_service_property(_interface, signature="b",
1452
1349
raise KeyError()
1453
1350
1454
1351
def __getattribute__(self, name):
1455
if name == '_pipe':
1352
if(name == '_pipe'):
1456
1353
return super(ProxyClient, self).__getattribute__(name)
1457
1354
self._pipe.send(('getattr', name))
1458
1355
data = self._pipe.recv()
1465
1362
return func
1466
1363
1467
1364
def __setattr__(self, name, value):
1468
if name == '_pipe':
1365
if(name == '_pipe'):
1469
1366
return super(ProxyClient, self).__setattr__(name, value)
1470
1367
self._pipe.send(('setattr', name, value))
1471
1368
1472
1473
1369
class ClientDBusTransitional(ClientDBus):
1474
1370
__metaclass__ = AlternateDBusNamesMetaclass
1475
1371
1476
1477
1372
class ClientHandler(socketserver.BaseRequestHandler, object):
1478
1373
"""A class to handle client connections.
1479
1374
1547
1442
except KeyError:
1548
1443
return
1549
1444
1550
if self.server.use_dbus:
1551
# Emit D-Bus signal
1552
client.NewRequest(str(self.client_address))
1553
1554
1445
if client.approval_delay:
1555
1446
delay = client.approval_delay
1556
1447
client.approvals_pending += 1
1565
1456
client.Rejected("Disabled")
1566
1457
return
1567
1458
1568
if client.approved or not client.approval_delay:
1459
if client._approved or not client.approval_delay:
1569
1460
#We are approved or approval is disabled
1570
1461
break
1571
elif client.approved is None:
1462
elif client._approved is None:
1572
1463
logger.info("Client %s needs approval",
1573
1464
client.name)
1574
1465
if self.server.use_dbus:
1588
1479
time = datetime.datetime.now()
1589
1480
client.changedstate.acquire()
1590
1481
(client.changedstate.wait
1591
(float(client.timedelta_to_milliseconds(delay)
1482
(float(client._timedelta_to_milliseconds(delay)
1592
1483
/ 1000)))
1593
1484
client.changedstate.release()
1594
1485
time2 = datetime.datetime.now()
1693
1584
# Convert the buffer to a Python bytestring
1694
1585
fpr = ctypes.string_at(buf, buf_len.value)
1695
1586
# Convert the bytestring to hexadecimal notation
1696
hex_fpr = binascii.hexlify(fpr).upper()
1587
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1697
1588
return hex_fpr
1698
1589
1699
1590
1702
1593
def sub_process_main(self, request, address):
1703
1594
try:
1704
1595
self.finish_request(request, address)
1705
except Exception:
1596
except:
1706
1597
self.handle_error(request, address)
1707
1598
self.close_request(request)
1708
1599
1956
1847
return timevalue
1957
1848
1958
1849
1850
def if_nametoindex(interface):
1851
"""Call the C function if_nametoindex(), or equivalent
1852
1853
Note: This function cannot accept a unicode string."""
1854
global if_nametoindex
1855
try:
1856
if_nametoindex = (ctypes.cdll.LoadLibrary
1857
(ctypes.util.find_library("c"))
1858
.if_nametoindex)
1859
except (OSError, AttributeError):
1860
logger.warning("Doing if_nametoindex the hard way")
1861
def if_nametoindex(interface):
1862
"Get an interface index the hard way, i.e. using fcntl()"
1863
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1864
with contextlib.closing(socket.socket()) as s:
1865
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1866
struct.pack(str("16s16x"),
1867
interface))
1868
interface_index = struct.unpack(str("I"),
1869
ifreq[16:20])[0]
1870
return interface_index
1871
return if_nametoindex(interface)
1872
1873
1959
1874
def daemon(nochdir = False, noclose = False):
1960
1875
"""See daemon(3). Standard BSD Unix function.
1961
1876
2017
1932
parser.add_argument("--no-ipv6", action="store_false",
2018
1933
dest="use_ipv6", help="Do not use IPv6")
2019
1934
parser.add_argument("--no-restore", action="store_false",
2020
dest="restore", help="Do not restore stored"
2021
" state")
2022
parser.add_argument("--statedir", metavar="DIR",
2023
help="Directory to save/restore state in")
2024
1935
dest="restore",
1936
help="Do not restore stored state",
1937
default=True)
1938
2025
1939
options = parser.parse_args()
2026
1940
2027
1941
if options.check:
2040
1954
"use_dbus": "True",
2041
1955
"use_ipv6": "True",
2042
1956
"debuglevel": "",
2043
"restore": "True",
2044
"statedir": "/var/lib/mandos"
2045
1957
}
2046
1958
2047
1959
# Parse config file for server-global settings
2064
1976
# options, if set.
2065
1977
for option in ("interface", "address", "port", "debug",
2066
1978
"priority", "servicename", "configdir",
2067
"use_dbus", "use_ipv6", "debuglevel", "restore",
2068
"statedir"):
1979
"use_dbus", "use_ipv6", "debuglevel", "restore"):
2069
1980
value = getattr(options, option)
2070
1981
if value is not None:
2071
1982
server_settings[option] = value
2083
1994
debuglevel = server_settings["debuglevel"]
2084
1995
use_dbus = server_settings["use_dbus"]
2085
1996
use_ipv6 = server_settings["use_ipv6"]
2086
stored_state_path = os.path.join(server_settings["statedir"],
2087
stored_state_file)
2088
2089
if debug:
2090
initlogger(debug, logging.DEBUG)
2091
else:
2092
if not debuglevel:
2093
initlogger(debug)
2094
else:
2095
level = getattr(logging, debuglevel.upper())
2096
initlogger(debug, level)
2097
1997
2098
1998
if server_settings["servicename"] != "Mandos":
2099
1999
syslogger.setFormatter(logging.Formatter
2102
2002
% server_settings["servicename"]))
2103
2003
2104
2004
# Parse config file with clients
2105
client_config = configparser.SafeConfigParser(Client
2106
.client_defaults)
2005
client_defaults = { "timeout": "5m",
2006
"extended_timeout": "15m",
2007
"interval": "2m",
2008
"checker": "fping -q -- %%(host)s",
2009
"host": "",
2010
"approval_delay": "0s",
2011
"approval_duration": "1s",
2012
}
2013
client_config = configparser.SafeConfigParser(client_defaults)
2107
2014
client_config.read(os.path.join(server_settings["configdir"],
2108
2015
"clients.conf"))
2109
2016
2147
2054
if error[0] != errno.EPERM:
2148
2055
raise error
2149
2056
2057
if not debug and not debuglevel:
2058
logger.setLevel(logging.WARNING)
2059
if debuglevel:
2060
level = getattr(logging, debuglevel.upper())
2061
logger.setLevel(level)
2062
2150
2063
if debug:
2064
logger.setLevel(logging.DEBUG)
2151
2065
# Enable all possible GnuTLS debugging
2152
2066
2153
2067
# "Use a log level over 10 to enable all debugging options."
2166
2080
os.dup2(null, sys.stdin.fileno())
2167
2081
if null > 2:
2168
2082
os.close(null)
2083
else:
2084
# No console logging
2085
logger.removeHandler(console)
2169
2086
2170
2087
# Need to fork before connecting to D-Bus
2171
2088
if not debug:
2172
2089
# Close all input and output, do double fork, etc.
2173
2090
daemon()
2174
2091
2175
gobject.threads_init()
2176
2177
2092
global main_loop
2178
2093
# From the Avahi example code
2179
2094
DBusGMainLoop(set_as_default=True )
2209
2124
client_class = functools.partial(ClientDBusTransitional,
2210
2125
bus = bus)
2211
2126
2212
client_settings = Client.config_parser(client_config)
2127
special_settings = {
2128
# Some settings need to be accessd by special methods;
2129
# booleans need .getboolean(), etc. Here is a list of them:
2130
"approved_by_default":
2131
lambda section:
2132
client_config.getboolean(section, "approved_by_default"),
2133
}
2134
# Construct a new dict of client settings of this form:
2135
# { client_name: {setting_name: value, ...}, ...}
2136
# with exceptions for any special settings as defined above
2137
client_settings = dict((clientname,
2138
dict((setting,
2139
(value if
2140
setting not in special_settings
2141
else special_settings[setting]
2142
(clientname)))
2143
for setting, value
2144
in client_config.items(clientname)))
2145
for clientname in client_config.sections())
2146
2213
2147
old_client_settings = {}
2214
clients_data = {}
2215
2216
# Get client data and settings from last running state.
2148
clients_data = []
2149
2150
# Get client data and settings from last running state.
2217
2151
if server_settings["restore"]:
2218
2152
try:
2219
2153
with open(stored_state_path, "rb") as stored_state:
2220
clients_data, old_client_settings = (pickle.load
2221
(stored_state))
2154
clients_data, old_client_settings = (
2155
pickle.load(stored_state))
2222
2156
os.remove(stored_state_path)
2223
2157
except IOError as e:
2224
logger.warning("Could not load persistent state: {0}"
2158
logger.warning("Could not load persistant state: {0}"
2225
2159
.format(e))
2226
2160
if e.errno != errno.ENOENT:
2227
2161
raise
2228
except EOFError as e:
2229
logger.warning("Could not load persistent state: "
2230
"EOFError: {0}".format(e))
2231
2232
with PGPEngine() as pgp:
2233
for client_name, client in clients_data.iteritems():
2234
# Decide which value to use after restoring saved state.
2235
# We have three different values: Old config file,
2236
# new config file, and saved state.
2237
# New config value takes precedence if it differs from old
2238
# config value, otherwise use saved state.
2239
for name, value in client_settings[client_name].items():
2240
try:
2241
# For each value in new config, check if it
2242
# differs from the old config value (Except for
2243
# the "secret" attribute)
2244
if (name != "secret" and
2245
value != old_client_settings[client_name]
2246
[name]):
2247
client[name] = value
2248
except KeyError:
2249
pass
2250
2251
# Clients who has passed its expire date can still be
2252
# enabled if its last checker was successful. Clients
2253
# whose checker failed before we stored its state is
2254
# assumed to have failed all checkers during downtime.
2255
if client["enabled"]:
2256
if datetime.datetime.utcnow() >= client["expires"]:
2257
if not client["last_checked_ok"]:
2258
logger.warning(
2259
"disabling client {0} - Client never "
2260
"performed a successfull checker"
2261
.format(client["name"]))
2262
client["enabled"] = False
2263
elif client["last_checker_status"] != 0:
2264
logger.warning(
2265
"disabling client {0} - Client "
2266
"last checker failed with error code {1}"
2267
.format(client["name"],
2268
client["last_checker_status"]))
2269
client["enabled"] = False
2270
else:
2271
client["expires"] = (datetime.datetime
2272
.utcnow()
2273
+ client["timeout"])
2274
logger.debug("Last checker succeeded,"
2275
" keeping {0} enabled"
2276
.format(client["name"]))
2162
2163
for client in clients_data:
2164
client_name = client["name"]
2165
2166
# Decide which value to use after restoring saved state.
2167
# We have three different values: Old config file,
2168
# new config file, and saved state.
2169
# New config value takes precedence if it differs from old
2170
# config value, otherwise use saved state.
2171
for name, value in client_settings[client_name].items():
2277
2172
try:
2278
client["secret"] = (
2279
pgp.decrypt(client["encrypted_secret"],
2280
client_settings[client_name]
2281
["secret"]))
2282
except PGPError:
2283
# If decryption fails, we use secret from new settings
2284
logger.debug("Failed to decrypt {0} old secret"
2285
.format(client_name))
2286
client["secret"] = (
2287
client_settings[client_name]["secret"])
2288
2289
2290
# Add/remove clients based on new changes made to config
2291
for client_name in (set(old_client_settings)
2292
- set(client_settings)):
2293
del clients_data[client_name]
2294
for client_name in (set(client_settings)
2295
- set(old_client_settings)):
2296
clients_data[client_name] = client_settings[client_name]
2297
2298
# Create clients all clients
2299
for client_name, client in clients_data.iteritems():
2300
tcp_server.clients[client_name] = client_class(
2301
name = client_name, settings = client)
2173
# For each value in new config, check if it differs
2174
# from the old config value (Except for the "secret"
2175
# attribute)
2176
if (name != "secret" and
2177
value != old_client_settings[client_name][name]):
2178
setattr(client, name, value)
2179
except KeyError:
2180
pass
2181
2182
# Clients who has passed its expire date, can still be enabled
2183
# if its last checker was sucessful. Clients who checkers
2184
# failed before we stored it state is asumed to had failed
2185
# checker during downtime.
2186
if client["enabled"] and client["last_checked_ok"]:
2187
if ((datetime.datetime.utcnow()
2188
- client["last_checked_ok"]) > client["interval"]):
2189
if client["last_checker_status"] != 0:
2190
client["enabled"] = False
2191
else:
2192
client["expires"] = (datetime.datetime.utcnow()
2193
+ client["timeout"])
2194
2195
client["changedstate"] = (multiprocessing_manager
2196
.Condition(multiprocessing_manager
2197
.Lock()))
2198
if use_dbus:
2199
new_client = ClientDBusTransitional.__new__(
2200
ClientDBusTransitional)
2201
tcp_server.clients[client_name] = new_client
2202
new_client.bus = bus
2203
for name, value in client.iteritems():
2204
setattr(new_client, name, value)
2205
new_client._approvals_pending = 0
2206
new_client.add_to_dbus()
2207
else:
2208
tcp_server.clients[client_name] = Client.__new__(Client)
2209
for name, value in client.iteritems():
2210
setattr(tcp_server.clients[client_name], name, value)
2211
2212
tcp_server.clients[client_name].decrypt_secret(
2213
client_settings[client_name]["secret"])
2214
2215
# Create/remove clients based on new changes made to config
2216
for clientname in set(old_client_settings) - set(client_settings):
2217
del tcp_server.clients[clientname]
2218
for clientname in set(client_settings) - set(old_client_settings):
2219
tcp_server.clients[clientname] = client_class(name
2220
= clientname,
2221
config =
2222
client_settings
2223
[clientname])
2302
2224
2303
2225
if not tcp_server.clients:
2304
2226
logger.warning("No clients defined")
2316
2238
# "pidfile" was never created
2317
2239
pass
2318
2240
del pidfilename
2241
2319
2242
signal.signal(signal.SIGINT, signal.SIG_IGN)
2320
2243
2321
2244
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2386
2309
multiprocessing.active_children()
2387
2310
if not (tcp_server.clients or client_settings):
2388
2311
return
2389
2312
2390
2313
# Store client before exiting. Secrets are encrypted with key
2391
2314
# based on what config file has. If config file is
2392
2315
# removed/edited, old secret will thus be unrecovable.
2393
clients = {}
2394
with PGPEngine() as pgp:
2395
for client in tcp_server.clients.itervalues():
2396
key = client_settings[client.name]["secret"]
2397
client.encrypted_secret = pgp.encrypt(client.secret,
2398
key)
2399
client_dict = {}
2400
2401
# A list of attributes that can not be pickled
2402
# + secret.
2403
exclude = set(("bus", "changedstate", "secret",
2404
"checker"))
2405
for name, typ in (inspect.getmembers
2406
(dbus.service.Object)):
2407
exclude.add(name)
2408
2409
client_dict["encrypted_secret"] = (client
2410
.encrypted_secret)
2411
for attr in client.client_structure:
2412
if attr not in exclude:
2413
client_dict[attr] = getattr(client, attr)
2414
2415
clients[client.name] = client_dict
2416
del client_settings[client.name]["secret"]
2417
2316
clients = []
2317
for client in tcp_server.clients.itervalues():
2318
client.encrypt_secret(
2319
client_settings[client.name]["secret"])
2320
2321
client_dict = {}
2322
2323
# A list of attributes that will not be stored when
2324
# shutting down.
2325
exclude = set(("bus", "changedstate", "secret"))
2326
for name, typ in inspect.getmembers(dbus.service.Object):
2327
exclude.add(name)
2328
2329
client_dict["encrypted_secret"] = client.encrypted_secret
2330
for attr in client.client_structure:
2331
if attr not in exclude:
2332
client_dict[attr] = getattr(client, attr)
2333
2334
clients.append(client_dict)
2335
del client_settings[client.name]["secret"]
2336
2418
2337
try:
2419
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2420
prefix="clients-",
2421
dir=os.path.dirname
2422
(stored_state_path))
2423
with os.fdopen(tempfd, "wb") as stored_state:
2338
with os.fdopen(os.open(stored_state_path,
2339
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2340
stat.S_IRUSR | stat.S_IWUSR),
2341
"wb") as stored_state:
2424
2342
pickle.dump((clients, client_settings), stored_state)
2425
os.rename(tempname, stored_state_path)
2426
except (IOError, OSError) as e:
2427
logger.warning("Could not save persistent state: {0}"
2343
except IOError as e:
2344
logger.warning("Could not save persistant state: {0}"
2428
2345
.format(e))
2429
if not debug:
2430
try:
2431
os.remove(tempname)
2432
except NameError:
2433
pass
2434
if e.errno not in set((errno.ENOENT, errno.EACCES,
2435
errno.EEXIST)):
2436
raise e
2437
2346
if e.errno != errno.ENOENT:
2347
raise
2348
2438
2349
# Delete all clients, and settings from config
2439
2350
while tcp_server.clients:
2440
2351
name, client = tcp_server.clients.popitem()
2458
2369
# Need to initiate checking of clients
2459
2370
if client.enabled:
2460
2371
client.init_checker()
2372
2461
2373
2462
2374
tcp_server.enable()
2463
2375
tcp_server.server_activate()
2503
2415
# Must run before the D-Bus bus name gets deregistered
2504
2416
cleanup()
2505
2417
2418
2506
2419
if __name__ == '__main__':
2507
2420
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0