/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Björn Påhlsson
  • Date: 2011-12-21 00:29:33 UTC
  • mfrom: (518.1.15 mandos-persistent)
  • Revision ID: belorn@recompile.se-20111221002933-6sc0a64o1ns2s2s8
Working persistant state

Show diffs side-by-side

added added

removed removed

Lines of Context:
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
 
import hashlib
 
66
import binascii
 
67
import tempfile
67
68
 
68
69
import dbus
69
70
import dbus.service
74
75
import ctypes.util
75
76
import xml.dom.minidom
76
77
import inspect
77
 
import Crypto.Cipher.AES
 
78
import GnuPGInterface
78
79
 
79
80
try:
80
81
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
84
85
    except ImportError:
85
86
        SO_BINDTODEVICE = None
86
87
 
87
 
 
88
88
version = "1.4.1"
 
89
stored_state_file = "clients.pickle"
89
90
 
90
91
logger = logging.getLogger()
91
 
stored_state_path = "/var/lib/mandos/clients.pickle"
92
 
 
93
92
syslogger = (logging.handlers.SysLogHandler
94
93
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
95
94
              address = str("/dev/log")))
96
 
syslogger.setFormatter(logging.Formatter
97
 
                       ('Mandos [%(process)d]: %(levelname)s:'
98
 
                        ' %(message)s'))
99
 
logger.addHandler(syslogger)
100
 
 
101
 
console = logging.StreamHandler()
102
 
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
103
 
                                       ' [%(process)d]:'
104
 
                                       ' %(levelname)s:'
105
 
                                       ' %(message)s'))
106
 
logger.addHandler(console)
 
95
 
 
96
try:
 
97
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
98
                      (ctypes.util.find_library("c"))
 
99
                      .if_nametoindex)
 
100
except (OSError, AttributeError):
 
101
    def if_nametoindex(interface):
 
102
        "Get an interface index the hard way, i.e. using fcntl()"
 
103
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
104
        with contextlib.closing(socket.socket()) as s:
 
105
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
106
                                struct.pack(str("16s16x"),
 
107
                                            interface))
 
108
        interface_index = struct.unpack(str("I"),
 
109
                                        ifreq[16:20])[0]
 
110
        return interface_index
 
111
 
 
112
 
 
113
def initlogger(level=logging.WARNING):
 
114
    """init logger and add loglevel"""
 
115
    
 
116
    syslogger.setFormatter(logging.Formatter
 
117
                           ('Mandos [%(process)d]: %(levelname)s:'
 
118
                            ' %(message)s'))
 
119
    logger.addHandler(syslogger)
 
120
    
 
121
    console = logging.StreamHandler()
 
122
    console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
123
                                           ' [%(process)d]:'
 
124
                                           ' %(levelname)s:'
 
125
                                           ' %(message)s'))
 
126
    logger.addHandler(console)
 
127
    logger.setLevel(level)
 
128
 
 
129
 
 
130
class PGPError(Exception):
 
131
    """Exception if encryption/decryption fails"""
 
132
    pass
 
133
 
 
134
 
 
135
class PGPEngine(object):
 
136
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
137
    def __init__(self):
 
138
        self.gnupg = GnuPGInterface.GnuPG()
 
139
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
140
        self.gnupg = GnuPGInterface.GnuPG()
 
141
        self.gnupg.options.meta_interactive = False
 
142
        self.gnupg.options.homedir = self.tempdir
 
143
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
144
                                              '--quiet'])
 
145
    
 
146
    def __enter__(self):
 
147
        return self
 
148
    
 
149
    def __exit__ (self, exc_type, exc_value, traceback):
 
150
        self._cleanup()
 
151
        return False
 
152
    
 
153
    def __del__(self):
 
154
        self._cleanup()
 
155
    
 
156
    def _cleanup(self):
 
157
        if self.tempdir is not None:
 
158
            # Delete contents of tempdir
 
159
            for root, dirs, files in os.walk(self.tempdir,
 
160
                                             topdown = False):
 
161
                for filename in files:
 
162
                    os.remove(os.path.join(root, filename))
 
163
                for dirname in dirs:
 
164
                    os.rmdir(os.path.join(root, dirname))
 
165
            # Remove tempdir
 
166
            os.rmdir(self.tempdir)
 
167
            self.tempdir = None
 
168
    
 
169
    def password_encode(self, password):
 
170
        # Passphrase can not be empty and can not contain newlines or
 
171
        # NUL bytes.  So we prefix it and hex encode it.
 
172
        return b"mandos" + binascii.hexlify(password)
 
173
    
 
174
    def encrypt(self, data, password):
 
175
        self.gnupg.passphrase = self.password_encode(password)
 
176
        with open(os.devnull) as devnull:
 
177
            try:
 
178
                proc = self.gnupg.run(['--symmetric'],
 
179
                                      create_fhs=['stdin', 'stdout'],
 
180
                                      attach_fhs={'stderr': devnull})
 
181
                with contextlib.closing(proc.handles['stdin']) as f:
 
182
                    f.write(data)
 
183
                with contextlib.closing(proc.handles['stdout']) as f:
 
184
                    ciphertext = f.read()
 
185
                proc.wait()
 
186
            except IOError as e:
 
187
                raise PGPError(e)
 
188
        self.gnupg.passphrase = None
 
189
        return ciphertext
 
190
    
 
191
    def decrypt(self, data, password):
 
192
        self.gnupg.passphrase = self.password_encode(password)
 
193
        with open(os.devnull) as devnull:
 
194
            try:
 
195
                proc = self.gnupg.run(['--decrypt'],
 
196
                                      create_fhs=['stdin', 'stdout'],
 
197
                                      attach_fhs={'stderr': devnull})
 
198
                with contextlib.closing(proc.handles['stdin'] ) as f:
 
199
                    f.write(data)
 
200
                with contextlib.closing(proc.handles['stdout']) as f:
 
201
                    decrypted_plaintext = f.read()
 
202
                proc.wait()
 
203
            except IOError as e:
 
204
                raise PGPError(e)
 
205
        self.gnupg.passphrase = None
 
206
        return decrypted_plaintext
 
207
 
107
208
 
108
209
 
109
210
class AvahiError(Exception):
226
327
            try:
227
328
                self.group.Free()
228
329
            except (dbus.exceptions.UnknownMethodException,
229
 
                    dbus.exceptions.DBusException) as e:
 
330
                    dbus.exceptions.DBusException):
230
331
                pass
231
332
            self.group = None
232
333
        self.remove()
276
377
                                % self.name))
277
378
        return ret
278
379
 
279
 
def _timedelta_to_milliseconds(td):
 
380
def timedelta_to_milliseconds(td):
280
381
    "Convert a datetime.timedelta() to milliseconds"
281
382
    return ((td.days * 24 * 60 * 60 * 1000)
282
383
            + (td.seconds * 1000)
286
387
    """A representation of a client host served by this server.
287
388
    
288
389
    Attributes:
289
 
    _approved:   bool(); 'None' if not yet approved/disapproved
 
390
    approved:   bool(); 'None' if not yet approved/disapproved
290
391
    approval_delay: datetime.timedelta(); Time to wait for approval
291
392
    approval_duration: datetime.timedelta(); Duration of one approval
292
393
    checker:    subprocess.Popen(); a running checker process used
311
412
    last_approval_request: datetime.datetime(); (UTC) or None
312
413
    last_checked_ok: datetime.datetime(); (UTC) or None
313
414
    last_checker_status: integer between 0 and 255 reflecting exit
314
 
                         status of last checker. -1 reflect crashed
 
415
                         status of last checker. -1 reflects crashed
315
416
                         checker, or None.
316
 
    last_enabled: datetime.datetime(); (UTC)
 
417
    last_enabled: datetime.datetime(); (UTC) or None
317
418
    name:       string; from the config file, used in log messages and
318
419
                        D-Bus identifiers
319
420
    secret:     bytestring; sent verbatim (over TLS) to client
329
430
                          "created", "enabled", "fingerprint",
330
431
                          "host", "interval", "last_checked_ok",
331
432
                          "last_enabled", "name", "timeout")
 
433
    client_defaults = { "timeout": "5m",
 
434
                        "extended_timeout": "15m",
 
435
                        "interval": "2m",
 
436
                        "checker": "fping -q -- %%(host)s",
 
437
                        "host": "",
 
438
                        "approval_delay": "0s",
 
439
                        "approval_duration": "1s",
 
440
                        "approved_by_default": "True",
 
441
                        "enabled": "True",
 
442
                        }
332
443
    
333
444
    def timeout_milliseconds(self):
334
445
        "Return the 'timeout' attribute in milliseconds"
335
 
        return _timedelta_to_milliseconds(self.timeout)
 
446
        return timedelta_to_milliseconds(self.timeout)
336
447
    
337
448
    def extended_timeout_milliseconds(self):
338
449
        "Return the 'extended_timeout' attribute in milliseconds"
339
 
        return _timedelta_to_milliseconds(self.extended_timeout)
 
450
        return timedelta_to_milliseconds(self.extended_timeout)
340
451
    
341
452
    def interval_milliseconds(self):
342
453
        "Return the 'interval' attribute in milliseconds"
343
 
        return _timedelta_to_milliseconds(self.interval)
 
454
        return timedelta_to_milliseconds(self.interval)
344
455
    
345
456
    def approval_delay_milliseconds(self):
346
 
        return _timedelta_to_milliseconds(self.approval_delay)
347
 
    
348
 
    def __init__(self, name = None, config=None):
 
457
        return timedelta_to_milliseconds(self.approval_delay)
 
458
 
 
459
    @staticmethod
 
460
    def config_parser(config):
 
461
        """ Construct a new dict of client settings of this form:
 
462
        { client_name: {setting_name: value, ...}, ...}
 
463
        with exceptions for any special settings as defined above"""
 
464
        settings = {}
 
465
        for client_name in config.sections():
 
466
            section = dict(config.items(client_name))
 
467
            client = settings[client_name] = {}
 
468
            
 
469
            client["host"] = section["host"]
 
470
            # Reformat values from string types to Python types
 
471
            client["approved_by_default"] = config.getboolean(
 
472
                client_name, "approved_by_default")
 
473
            client["enabled"] = config.getboolean(client_name, "enabled")
 
474
            
 
475
            client["fingerprint"] = (section["fingerprint"].upper()
 
476
                                     .replace(" ", ""))
 
477
            if "secret" in section:
 
478
                client["secret"] = section["secret"].decode("base64")
 
479
            elif "secfile" in section:
 
480
                with open(os.path.expanduser(os.path.expandvars
 
481
                                             (section["secfile"])),
 
482
                          "rb") as secfile:
 
483
                    client["secret"] = secfile.read()
 
484
            else:
 
485
                raise TypeError("No secret or secfile for section %s"
 
486
                                % section)
 
487
            client["timeout"] = string_to_delta(section["timeout"])
 
488
            client["extended_timeout"] = string_to_delta(
 
489
                section["extended_timeout"])
 
490
            client["interval"] = string_to_delta(section["interval"])
 
491
            client["approval_delay"] = string_to_delta(
 
492
                section["approval_delay"])
 
493
            client["approval_duration"] = string_to_delta(
 
494
                section["approval_duration"])
 
495
            client["checker_command"] = section["checker"]
 
496
            client["last_approval_request"] = None
 
497
            client["last_checked_ok"] = None
 
498
            client["last_checker_status"] = None
 
499
            if client["enabled"]:
 
500
                client["last_enabled"] = datetime.datetime.utcnow()
 
501
                client["expires"] = (datetime.datetime.utcnow()
 
502
                                     + client["timeout"])
 
503
            else:
 
504
                client["last_enabled"] = None
 
505
                client["expires"] = None
 
506
 
 
507
        return settings
 
508
        
 
509
        
 
510
    def __init__(self, settings, name = None):
349
511
        """Note: the 'checker' key in 'config' sets the
350
512
        'checker_command' attribute and *not* the 'checker'
351
513
        attribute."""
352
514
        self.name = name
353
 
        if config is None:
354
 
            config = {}
 
515
        # adding all client settings
 
516
        for setting, value in settings.iteritems():
 
517
            setattr(self, setting, value)
 
518
        
355
519
        logger.debug("Creating client %r", self.name)
356
520
        # Uppercase and remove spaces from fingerprint for later
357
521
        # comparison purposes with return value from the fingerprint()
358
522
        # function
359
 
        self.fingerprint = (config["fingerprint"].upper()
360
 
                            .replace(" ", ""))
361
523
        logger.debug("  Fingerprint: %s", self.fingerprint)
362
 
        if "secret" in config:
363
 
            self.secret = config["secret"].decode("base64")
364
 
        elif "secfile" in config:
365
 
            with open(os.path.expanduser(os.path.expandvars
366
 
                                         (config["secfile"])),
367
 
                      "rb") as secfile:
368
 
                self.secret = secfile.read()
369
 
        else:
370
 
            raise TypeError("No secret or secfile for client %s"
371
 
                            % self.name)
372
 
        self.host = config.get("host", "")
373
 
        self.created = datetime.datetime.utcnow()
374
 
        self.enabled = True
375
 
        self.last_approval_request = None
376
 
        self.last_enabled = datetime.datetime.utcnow()
377
 
        self.last_checked_ok = None
378
 
        self.last_checker_status = None
379
 
        self.timeout = string_to_delta(config["timeout"])
380
 
        self.extended_timeout = string_to_delta(config
381
 
                                                ["extended_timeout"])
382
 
        self.interval = string_to_delta(config["interval"])
 
524
        self.created = settings.get("created", datetime.datetime.utcnow())
 
525
 
 
526
        # attributes specific for this server instance
383
527
        self.checker = None
384
528
        self.checker_initiator_tag = None
385
529
        self.disable_initiator_tag = None
386
 
        self.expires = datetime.datetime.utcnow() + self.timeout
387
530
        self.checker_callback_tag = None
388
 
        self.checker_command = config["checker"]
389
531
        self.current_checker_command = None
390
 
        self._approved = None
391
 
        self.approved_by_default = config.get("approved_by_default",
392
 
                                              True)
 
532
        self.approved = None
393
533
        self.approvals_pending = 0
394
 
        self.approval_delay = string_to_delta(
395
 
            config["approval_delay"])
396
 
        self.approval_duration = string_to_delta(
397
 
            config["approval_duration"])
398
534
        self.changedstate = (multiprocessing_manager
399
535
                             .Condition(multiprocessing_manager
400
536
                                        .Lock()))
401
 
        self.client_structure = [attr for attr
402
 
                                 in self.__dict__.iterkeys()
 
537
        self.client_structure = [attr for attr in
 
538
                                 self.__dict__.iterkeys()
403
539
                                 if not attr.startswith("_")]
404
540
        self.client_structure.append("client_structure")
405
 
 
406
 
 
 
541
        
407
542
        for name, t in inspect.getmembers(type(self),
408
543
                                          lambda obj:
409
544
                                              isinstance(obj,
449
584
    
450
585
    def __del__(self):
451
586
        self.disable()
452
 
 
 
587
    
453
588
    def init_checker(self):
454
589
        # Schedule a new checker to be started an 'interval' from now,
455
590
        # and every interval from then on.
462
597
                                    self.disable))
463
598
        # Also start a new checker *right now*.
464
599
        self.start_checker()
465
 
 
466
 
        
 
600
    
467
601
    def checker_callback(self, pid, condition, command):
468
602
        """The checker has completed, so take appropriate actions."""
469
603
        self.checker_callback_tag = None
470
604
        self.checker = None
471
605
        if os.WIFEXITED(condition):
472
 
            self.last_checker_status =  os.WEXITSTATUS(condition)
 
606
            self.last_checker_status = os.WEXITSTATUS(condition)
473
607
            if self.last_checker_status == 0:
474
608
                logger.info("Checker for %(name)s succeeded",
475
609
                            vars(self))
495
629
            gobject.source_remove(self.disable_initiator_tag)
496
630
        if getattr(self, "enabled", False):
497
631
            self.disable_initiator_tag = (gobject.timeout_add
498
 
                                          (_timedelta_to_milliseconds
 
632
                                          (timedelta_to_milliseconds
499
633
                                           (timeout), self.disable))
500
634
            self.expires = datetime.datetime.utcnow() + timeout
501
635
    
595
729
                raise
596
730
        self.checker = None
597
731
 
598
 
    # Encrypts a client secret and stores it in a varible
599
 
    # encrypted_secret
600
 
    def encrypt_secret(self, key):
601
 
        # Encryption-key need to be of a specific size, so we hash
602
 
        # supplied key
603
 
        hasheng = hashlib.sha256()
604
 
        hasheng.update(key)
605
 
        encryptionkey = hasheng.digest()
606
 
 
607
 
        # Create validation hash so we know at decryption if it was
608
 
        # sucessful
609
 
        hasheng = hashlib.sha256()
610
 
        hasheng.update(self.secret)
611
 
        validationhash = hasheng.digest()
612
 
 
613
 
        # Encrypt secret
614
 
        iv = os.urandom(Crypto.Cipher.AES.block_size)
615
 
        ciphereng = Crypto.Cipher.AES.new(encryptionkey,
616
 
                                        Crypto.Cipher.AES.MODE_CFB, iv)
617
 
        ciphertext = ciphereng.encrypt(validationhash+self.secret)
618
 
        self.encrypted_secret = (ciphertext, iv)
619
 
 
620
 
    # Decrypt a encrypted client secret
621
 
    def decrypt_secret(self, key):
622
 
        # Decryption-key need to be of a specific size, so we hash
623
 
        # supplied key
624
 
        hasheng = hashlib.sha256()
625
 
        hasheng.update(key)
626
 
        encryptionkey = hasheng.digest()
627
 
 
628
 
        # Decrypt encrypted secret
629
 
        ciphertext, iv = self.encrypted_secret
630
 
        ciphereng = Crypto.Cipher.AES.new(encryptionkey,
631
 
                                        Crypto.Cipher.AES.MODE_CFB, iv)
632
 
        plain = ciphereng.decrypt(ciphertext)
633
 
 
634
 
        # Validate decrypted secret to know if it was succesful
635
 
        hasheng = hashlib.sha256()
636
 
        validationhash = plain[:hasheng.digest_size]
637
 
        secret = plain[hasheng.digest_size:]
638
 
        hasheng.update(secret)
639
 
 
640
 
        # If validation fails, we use key as new secret. Otherwise, we
641
 
        # use the decrypted secret
642
 
        if hasheng.digest() == validationhash:
643
 
            self.secret = secret
644
 
        else:
645
 
            self.secret = key
646
 
        del self.encrypted_secret
647
 
 
648
732
 
649
733
def dbus_service_property(dbus_interface, signature="v",
650
734
                          access="readwrite", byte_arrays=False):
768
852
        
769
853
        Note: Will not include properties with access="write".
770
854
        """
771
 
        all = {}
 
855
        properties = {}
772
856
        for name, prop in self._get_all_dbus_properties():
773
857
            if (interface_name
774
858
                and interface_name != prop._dbus_interface):
779
863
                continue
780
864
            value = prop()
781
865
            if not hasattr(value, "variant_level"):
782
 
                all[name] = value
 
866
                properties[name] = value
783
867
                continue
784
 
            all[name] = type(value)(value, variant_level=
785
 
                                    value.variant_level+1)
786
 
        return dbus.Dictionary(all, signature="sv")
 
868
            properties[name] = type(value)(value, variant_level=
 
869
                                           value.variant_level+1)
 
870
        return dbus.Dictionary(properties, signature="sv")
787
871
    
788
872
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
789
873
                         out_signature="s",
840
924
    return dbus.String(dt.isoformat(),
841
925
                       variant_level=variant_level)
842
926
 
 
927
 
843
928
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
844
929
                                  .__metaclass__):
845
930
    """Applied to an empty subclass of a D-Bus object, this metaclass
937
1022
                                        attribute.func_closure)))
938
1023
        return type.__new__(mcs, name, bases, attr)
939
1024
 
 
1025
 
940
1026
class ClientDBus(Client, DBusObjectWithProperties):
941
1027
    """A Client class using D-Bus
942
1028
    
952
1038
    
953
1039
    def __init__(self, bus = None, *args, **kwargs):
954
1040
        self.bus = bus
955
 
        self._approvals_pending = 0
956
1041
        Client.__init__(self, *args, **kwargs)
957
 
        self.add_to_dbus()
958
 
    
959
 
    def add_to_dbus(self):
 
1042
        self._approvals_pending = 0
 
1043
        
 
1044
        self._approvals_pending = 0
960
1045
        # Only now, when this client is initialized, can it show up on
961
1046
        # the D-Bus
962
1047
        client_object_name = unicode(self.name).translate(
972
1057
                             variant_level=1):
973
1058
        """ Modify a variable so that it's a property which announces
974
1059
        its changes to DBus.
975
 
 
 
1060
        
976
1061
        transform_fun: Function that takes a value and a variant_level
977
1062
                       and transforms it to a D-Bus type.
978
1063
        dbus_name: D-Bus name of the variable
1015
1100
    approval_delay = notifychangeproperty(dbus.UInt64,
1016
1101
                                          "ApprovalDelay",
1017
1102
                                          type_func =
1018
 
                                          _timedelta_to_milliseconds)
 
1103
                                          timedelta_to_milliseconds)
1019
1104
    approval_duration = notifychangeproperty(
1020
1105
        dbus.UInt64, "ApprovalDuration",
1021
 
        type_func = _timedelta_to_milliseconds)
 
1106
        type_func = timedelta_to_milliseconds)
1022
1107
    host = notifychangeproperty(dbus.String, "Host")
1023
1108
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1024
1109
                                   type_func =
1025
 
                                   _timedelta_to_milliseconds)
 
1110
                                   timedelta_to_milliseconds)
1026
1111
    extended_timeout = notifychangeproperty(
1027
1112
        dbus.UInt64, "ExtendedTimeout",
1028
 
        type_func = _timedelta_to_milliseconds)
 
1113
        type_func = timedelta_to_milliseconds)
1029
1114
    interval = notifychangeproperty(dbus.UInt64,
1030
1115
                                    "Interval",
1031
1116
                                    type_func =
1032
 
                                    _timedelta_to_milliseconds)
 
1117
                                    timedelta_to_milliseconds)
1033
1118
    checker_command = notifychangeproperty(dbus.String, "Checker")
1034
1119
    
1035
1120
    del notifychangeproperty
1077
1162
        return r
1078
1163
    
1079
1164
    def _reset_approved(self):
1080
 
        self._approved = None
 
1165
        self.approved = None
1081
1166
        return False
1082
1167
    
1083
1168
    def approve(self, value=True):
1084
1169
        self.send_changedstate()
1085
 
        self._approved = value
1086
 
        gobject.timeout_add(_timedelta_to_milliseconds
 
1170
        self.approved = value
 
1171
        gobject.timeout_add(timedelta_to_milliseconds
1087
1172
                            (self.approval_duration),
1088
1173
                            self._reset_approved)
1089
1174
    
1132
1217
        "D-Bus signal"
1133
1218
        return self.need_approval()
1134
1219
    
 
1220
    # NeRwequest - signal
 
1221
    @dbus.service.signal(_interface, signature="s")
 
1222
    def NewRequest(self, ip):
 
1223
        """D-Bus signal
 
1224
        Is sent after a client request a password.
 
1225
        """
 
1226
        pass
 
1227
    
1135
1228
    ## Methods
1136
1229
    
1137
1230
    # Approve - method
1195
1288
                           access="readwrite")
1196
1289
    def ApprovalDuration_dbus_property(self, value=None):
1197
1290
        if value is None:       # get
1198
 
            return dbus.UInt64(_timedelta_to_milliseconds(
 
1291
            return dbus.UInt64(timedelta_to_milliseconds(
1199
1292
                    self.approval_duration))
1200
1293
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1201
1294
    
1215
1308
    def Host_dbus_property(self, value=None):
1216
1309
        if value is None:       # get
1217
1310
            return dbus.String(self.host)
1218
 
        self.host = value
 
1311
        self.host = unicode(value)
1219
1312
    
1220
1313
    # Created - property
1221
1314
    @dbus_service_property(_interface, signature="s", access="read")
1222
1315
    def Created_dbus_property(self):
1223
 
        return dbus.String(datetime_to_dbus(self.created))
 
1316
        return datetime_to_dbus(self.created)
1224
1317
    
1225
1318
    # LastEnabled - property
1226
1319
    @dbus_service_property(_interface, signature="s", access="read")
1270
1363
        gobject.source_remove(self.disable_initiator_tag)
1271
1364
        self.disable_initiator_tag = None
1272
1365
        self.expires = None
1273
 
        time_to_die = _timedelta_to_milliseconds((self
1274
 
                                                  .last_checked_ok
1275
 
                                                  + self.timeout)
1276
 
                                                 - datetime.datetime
1277
 
                                                 .utcnow())
 
1366
        time_to_die = timedelta_to_milliseconds((self
 
1367
                                                 .last_checked_ok
 
1368
                                                 + self.timeout)
 
1369
                                                - datetime.datetime
 
1370
                                                .utcnow())
1278
1371
        if time_to_die <= 0:
1279
1372
            # The timeout has passed
1280
1373
            self.disable()
1302
1395
        self.interval = datetime.timedelta(0, 0, 0, value)
1303
1396
        if getattr(self, "checker_initiator_tag", None) is None:
1304
1397
            return
1305
 
        # Reschedule checker run
1306
 
        gobject.source_remove(self.checker_initiator_tag)
1307
 
        self.checker_initiator_tag = (gobject.timeout_add
1308
 
                                      (value, self.start_checker))
1309
 
        self.start_checker()    # Start one now, too
 
1398
        if self.enabled:
 
1399
            # Reschedule checker run
 
1400
            gobject.source_remove(self.checker_initiator_tag)
 
1401
            self.checker_initiator_tag = (gobject.timeout_add
 
1402
                                          (value, self.start_checker))
 
1403
            self.start_checker()    # Start one now, too
1310
1404
    
1311
1405
    # Checker - property
1312
1406
    @dbus_service_property(_interface, signature="s",
1314
1408
    def Checker_dbus_property(self, value=None):
1315
1409
        if value is None:       # get
1316
1410
            return dbus.String(self.checker_command)
1317
 
        self.checker_command = value
 
1411
        self.checker_command = unicode(value)
1318
1412
    
1319
1413
    # CheckerRunning - property
1320
1414
    @dbus_service_property(_interface, signature="b",
1349
1443
            raise KeyError()
1350
1444
    
1351
1445
    def __getattribute__(self, name):
1352
 
        if(name == '_pipe'):
 
1446
        if name == '_pipe':
1353
1447
            return super(ProxyClient, self).__getattribute__(name)
1354
1448
        self._pipe.send(('getattr', name))
1355
1449
        data = self._pipe.recv()
1362
1456
            return func
1363
1457
    
1364
1458
    def __setattr__(self, name, value):
1365
 
        if(name == '_pipe'):
 
1459
        if name == '_pipe':
1366
1460
            return super(ProxyClient, self).__setattr__(name, value)
1367
1461
        self._pipe.send(('setattr', name, value))
1368
1462
 
 
1463
 
1369
1464
class ClientDBusTransitional(ClientDBus):
1370
1465
    __metaclass__ = AlternateDBusNamesMetaclass
1371
1466
 
 
1467
 
1372
1468
class ClientHandler(socketserver.BaseRequestHandler, object):
1373
1469
    """A class to handle client connections.
1374
1470
    
1442
1538
                except KeyError:
1443
1539
                    return
1444
1540
                
 
1541
                if self.server.use_dbus:
 
1542
                    # Emit D-Bus signal
 
1543
                    client.NewRequest(str(self.client_address))
 
1544
                
1445
1545
                if client.approval_delay:
1446
1546
                    delay = client.approval_delay
1447
1547
                    client.approvals_pending += 1
1456
1556
                            client.Rejected("Disabled")
1457
1557
                        return
1458
1558
                    
1459
 
                    if client._approved or not client.approval_delay:
 
1559
                    if client.approved or not client.approval_delay:
1460
1560
                        #We are approved or approval is disabled
1461
1561
                        break
1462
 
                    elif client._approved is None:
 
1562
                    elif client.approved is None:
1463
1563
                        logger.info("Client %s needs approval",
1464
1564
                                    client.name)
1465
1565
                        if self.server.use_dbus:
1479
1579
                    time = datetime.datetime.now()
1480
1580
                    client.changedstate.acquire()
1481
1581
                    (client.changedstate.wait
1482
 
                     (float(client._timedelta_to_milliseconds(delay)
 
1582
                     (float(client.timedelta_to_milliseconds(delay)
1483
1583
                            / 1000)))
1484
1584
                    client.changedstate.release()
1485
1585
                    time2 = datetime.datetime.now()
1584
1684
        # Convert the buffer to a Python bytestring
1585
1685
        fpr = ctypes.string_at(buf, buf_len.value)
1586
1686
        # Convert the bytestring to hexadecimal notation
1587
 
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
1687
        hex_fpr = binascii.hexlify(fpr).upper()
1588
1688
        return hex_fpr
1589
1689
 
1590
1690
 
1593
1693
    def sub_process_main(self, request, address):
1594
1694
        try:
1595
1695
            self.finish_request(request, address)
1596
 
        except:
 
1696
        except Exception:
1597
1697
            self.handle_error(request, address)
1598
1698
        self.close_request(request)
1599
1699
    
1847
1947
    return timevalue
1848
1948
 
1849
1949
 
1850
 
def if_nametoindex(interface):
1851
 
    """Call the C function if_nametoindex(), or equivalent
1852
 
    
1853
 
    Note: This function cannot accept a unicode string."""
1854
 
    global if_nametoindex
1855
 
    try:
1856
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1857
 
                          (ctypes.util.find_library("c"))
1858
 
                          .if_nametoindex)
1859
 
    except (OSError, AttributeError):
1860
 
        logger.warning("Doing if_nametoindex the hard way")
1861
 
        def if_nametoindex(interface):
1862
 
            "Get an interface index the hard way, i.e. using fcntl()"
1863
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1864
 
            with contextlib.closing(socket.socket()) as s:
1865
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1866
 
                                    struct.pack(str("16s16x"),
1867
 
                                                interface))
1868
 
            interface_index = struct.unpack(str("I"),
1869
 
                                            ifreq[16:20])[0]
1870
 
            return interface_index
1871
 
    return if_nametoindex(interface)
1872
 
 
1873
 
 
1874
1950
def daemon(nochdir = False, noclose = False):
1875
1951
    """See daemon(3).  Standard BSD Unix function.
1876
1952
    
1932
2008
    parser.add_argument("--no-ipv6", action="store_false",
1933
2009
                        dest="use_ipv6", help="Do not use IPv6")
1934
2010
    parser.add_argument("--no-restore", action="store_false",
1935
 
                        dest="restore",
1936
 
                        help="Do not restore stored state",
1937
 
                        default=True)
1938
 
 
 
2011
                        dest="restore", help="Do not restore stored"
 
2012
                        " state")
 
2013
    parser.add_argument("--statedir", metavar="DIR",
 
2014
                        help="Directory to save/restore state in")
 
2015
    
1939
2016
    options = parser.parse_args()
1940
2017
    
1941
2018
    if options.check:
1954
2031
                        "use_dbus": "True",
1955
2032
                        "use_ipv6": "True",
1956
2033
                        "debuglevel": "",
 
2034
                        "restore": "True",
 
2035
                        "statedir": "/var/lib/mandos"
1957
2036
                        }
1958
2037
    
1959
2038
    # Parse config file for server-global settings
1976
2055
    # options, if set.
1977
2056
    for option in ("interface", "address", "port", "debug",
1978
2057
                   "priority", "servicename", "configdir",
1979
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore"):
 
2058
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2059
                   "statedir"):
1980
2060
        value = getattr(options, option)
1981
2061
        if value is not None:
1982
2062
            server_settings[option] = value
1994
2074
    debuglevel = server_settings["debuglevel"]
1995
2075
    use_dbus = server_settings["use_dbus"]
1996
2076
    use_ipv6 = server_settings["use_ipv6"]
 
2077
    stored_state_path = os.path.join(server_settings["statedir"],
 
2078
                                     stored_state_file)
 
2079
    
 
2080
    if debug:
 
2081
        initlogger(logging.DEBUG)
 
2082
    else:
 
2083
        if not debuglevel:
 
2084
            initlogger()
 
2085
        else:
 
2086
            level = getattr(logging, debuglevel.upper())
 
2087
            initlogger(level)
1997
2088
    
1998
2089
    if server_settings["servicename"] != "Mandos":
1999
2090
        syslogger.setFormatter(logging.Formatter
2002
2093
                                % server_settings["servicename"]))
2003
2094
    
2004
2095
    # Parse config file with clients
2005
 
    client_defaults = { "timeout": "5m",
2006
 
                        "extended_timeout": "15m",
2007
 
                        "interval": "2m",
2008
 
                        "checker": "fping -q -- %%(host)s",
2009
 
                        "host": "",
2010
 
                        "approval_delay": "0s",
2011
 
                        "approval_duration": "1s",
2012
 
                        }
2013
 
    client_config = configparser.SafeConfigParser(client_defaults)
 
2096
    client_config = configparser.SafeConfigParser(Client.client_defaults)
2014
2097
    client_config.read(os.path.join(server_settings["configdir"],
2015
2098
                                    "clients.conf"))
2016
2099
    
2054
2137
        if error[0] != errno.EPERM:
2055
2138
            raise error
2056
2139
    
2057
 
    if not debug and not debuglevel:
2058
 
        logger.setLevel(logging.WARNING)
2059
 
    if debuglevel:
2060
 
        level = getattr(logging, debuglevel.upper())
2061
 
        logger.setLevel(level)
2062
 
    
2063
2140
    if debug:
2064
 
        logger.setLevel(logging.DEBUG)
2065
2141
        # Enable all possible GnuTLS debugging
2066
2142
        
2067
2143
        # "Use a log level over 10 to enable all debugging options."
2124
2200
        client_class = functools.partial(ClientDBusTransitional,
2125
2201
                                         bus = bus)
2126
2202
    
2127
 
    special_settings = {
2128
 
        # Some settings need to be accessd by special methods;
2129
 
        # booleans need .getboolean(), etc.  Here is a list of them:
2130
 
        "approved_by_default":
2131
 
            lambda section:
2132
 
            client_config.getboolean(section, "approved_by_default"),
2133
 
        }
2134
 
    # Construct a new dict of client settings of this form:
2135
 
    # { client_name: {setting_name: value, ...}, ...}
2136
 
    # with exceptions for any special settings as defined above
2137
 
    client_settings = dict((clientname,
2138
 
                           dict((setting,
2139
 
                                 (value if
2140
 
                                  setting not in special_settings
2141
 
                                  else special_settings[setting]
2142
 
                                  (clientname)))
2143
 
                                for setting, value
2144
 
                                in client_config.items(clientname)))
2145
 
                          for clientname in client_config.sections())
2146
 
    
 
2203
    client_settings = Client.config_parser(client_config)
2147
2204
    old_client_settings = {}
2148
 
    clients_data = []
2149
 
 
2150
 
    # Get client data and settings from last running state. 
 
2205
    clients_data = {}
 
2206
    
 
2207
    # Get client data and settings from last running state.
2151
2208
    if server_settings["restore"]:
2152
2209
        try:
2153
2210
            with open(stored_state_path, "rb") as stored_state:
2154
 
                clients_data, old_client_settings = (
2155
 
                    pickle.load(stored_state))
 
2211
                clients_data, old_client_settings = (pickle.load
 
2212
                                                     (stored_state))
2156
2213
            os.remove(stored_state_path)
2157
2214
        except IOError as e:
2158
 
            logger.warning("Could not load persistant state: {0}"
 
2215
            logger.warning("Could not load persistent state: {0}"
2159
2216
                           .format(e))
2160
2217
            if e.errno != errno.ENOENT:
2161
2218
                raise
2162
 
 
2163
 
    for client in clients_data:
2164
 
        client_name = client["name"]
2165
 
        
2166
 
        # Decide which value to use after restoring saved state.
2167
 
        # We have three different values: Old config file,
2168
 
        # new config file, and saved state.
2169
 
        # New config value takes precedence if it differs from old
2170
 
        # config value, otherwise use saved state.
2171
 
        for name, value in client_settings[client_name].items():
 
2219
    
 
2220
    with PGPEngine() as pgp:
 
2221
        for client_name, client in clients_data.iteritems():
 
2222
            # Decide which value to use after restoring saved state.
 
2223
            # We have three different values: Old config file,
 
2224
            # new config file, and saved state.
 
2225
            # New config value takes precedence if it differs from old
 
2226
            # config value, otherwise use saved state.
 
2227
            for name, value in client_settings[client_name].items():
 
2228
                try:
 
2229
                    # For each value in new config, check if it
 
2230
                    # differs from the old config value (Except for
 
2231
                    # the "secret" attribute)
 
2232
                    if (name != "secret" and
 
2233
                        value != old_client_settings[client_name]
 
2234
                        [name]):
 
2235
                        client[name] = value
 
2236
                except KeyError:
 
2237
                    pass
 
2238
            
 
2239
            # Clients who has passed its expire date can still be
 
2240
            # enabled if its last checker was successful.  Clients
 
2241
            # whose checker failed before we stored its state is
 
2242
            # assumed to have failed all checkers during downtime.
 
2243
            if client["enabled"]:
 
2244
                if datetime.datetime.utcnow() >= client["expires"]:
 
2245
                    if not client["last_checked_ok"]:
 
2246
                        logger.warning(
 
2247
                            "disabling client {0} - Client never "
 
2248
                            "performed a successfull checker"
 
2249
                            .format(client["name"]))
 
2250
                        client["enabled"] = False
 
2251
                    elif client["last_checker_status"] != 0:
 
2252
                        logger.warning(
 
2253
                            "disabling client {0} - Client "
 
2254
                            "last checker failed with error code {1}"
 
2255
                            .format(client["name"],
 
2256
                                    client["last_checker_status"]))
 
2257
                        client["enabled"] = False
 
2258
                    else:
 
2259
                        client["expires"] = (datetime.datetime
 
2260
                                             .utcnow()
 
2261
                                             + client["timeout"])
 
2262
                    
2172
2263
            try:
2173
 
                # For each value in new config, check if it differs
2174
 
                # from the old config value (Except for the "secret"
2175
 
                # attribute)
2176
 
                if (name != "secret" and
2177
 
                    value != old_client_settings[client_name][name]):
2178
 
                    setattr(client, name, value)
2179
 
            except KeyError:
2180
 
                pass
2181
 
 
2182
 
        # Clients who has passed its expire date, can still be enabled
2183
 
        # if its last checker was sucessful. Clients who checkers
2184
 
        # failed before we stored it state is asumed to had failed
2185
 
        # checker during downtime.
2186
 
        if client["enabled"] and client["last_checked_ok"]:
2187
 
            if ((datetime.datetime.utcnow()
2188
 
                 - client["last_checked_ok"]) > client["interval"]):
2189
 
                if client["last_checker_status"] != 0:
2190
 
                    client["enabled"] = False
2191
 
                else:
2192
 
                    client["expires"] = (datetime.datetime.utcnow()
2193
 
                                         + client["timeout"])
2194
 
 
2195
 
        client["changedstate"] = (multiprocessing_manager
2196
 
                                  .Condition(multiprocessing_manager
2197
 
                                             .Lock()))
2198
 
        if use_dbus:
2199
 
            new_client = ClientDBusTransitional.__new__(
2200
 
                ClientDBusTransitional)
2201
 
            tcp_server.clients[client_name] = new_client
2202
 
            new_client.bus = bus
2203
 
            for name, value in client.iteritems():
2204
 
                setattr(new_client, name, value)
2205
 
            new_client._approvals_pending = 0
2206
 
            new_client.add_to_dbus()
2207
 
        else:
2208
 
            tcp_server.clients[client_name] = Client.__new__(Client)
2209
 
            for name, value in client.iteritems():
2210
 
                setattr(tcp_server.clients[client_name], name, value)
2211
 
                
2212
 
        tcp_server.clients[client_name].decrypt_secret(
2213
 
            client_settings[client_name]["secret"])            
2214
 
        
2215
 
    # Create/remove clients based on new changes made to config
2216
 
    for clientname in set(old_client_settings) - set(client_settings):
2217
 
        del tcp_server.clients[clientname]
2218
 
    for clientname in set(client_settings) - set(old_client_settings):
2219
 
        tcp_server.clients[clientname] = client_class(name
2220
 
                                                      = clientname,
2221
 
                                                      config =
2222
 
                                                      client_settings
2223
 
                                                      [clientname])
 
2264
                client["secret"] = (
 
2265
                    pgp.decrypt(client["encrypted_secret"],
 
2266
                                client_settings[client_name]
 
2267
                                ["secret"]))
 
2268
            except PGPError:
 
2269
                # If decryption fails, we use secret from new settings
 
2270
                logger.debug("Failed to decrypt {0} old secret"
 
2271
                             .format(client_name))
 
2272
                client["secret"] = (
 
2273
                    client_settings[client_name]["secret"])
 
2274
 
 
2275
    
 
2276
    # Add/remove clients based on new changes made to config
 
2277
    for client_name in set(old_client_settings) - set(client_settings):
 
2278
        del clients_data[client_name]
 
2279
    for client_name in set(client_settings) - set(old_client_settings):
 
2280
        clients_data[client_name] = client_settings[client_name]
 
2281
 
 
2282
    # Create clients all clients
 
2283
    for client_name, client in clients_data.iteritems():
 
2284
        tcp_server.clients[client_name] = client_class(
 
2285
            name = client_name, settings = client)
2224
2286
    
2225
2287
    if not tcp_server.clients:
2226
2288
        logger.warning("No clients defined")
2238
2300
            # "pidfile" was never created
2239
2301
            pass
2240
2302
        del pidfilename
2241
 
        
2242
2303
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2243
2304
    
2244
2305
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2309
2370
        multiprocessing.active_children()
2310
2371
        if not (tcp_server.clients or client_settings):
2311
2372
            return
2312
 
 
 
2373
        
2313
2374
        # Store client before exiting. Secrets are encrypted with key
2314
2375
        # based on what config file has. If config file is
2315
2376
        # removed/edited, old secret will thus be unrecovable.
2316
 
        clients = []
2317
 
        for client in tcp_server.clients.itervalues():
2318
 
            client.encrypt_secret(
2319
 
                client_settings[client.name]["secret"])
2320
 
 
2321
 
            client_dict = {}
2322
 
 
2323
 
            # A list of attributes that will not be stored when
2324
 
            # shutting down.
2325
 
            exclude = set(("bus", "changedstate", "secret"))
2326
 
            for name, typ in inspect.getmembers(dbus.service.Object):
2327
 
                exclude.add(name)
2328
 
                
2329
 
            client_dict["encrypted_secret"] = client.encrypted_secret
2330
 
            for attr in client.client_structure:
2331
 
                if attr not in exclude:
2332
 
                    client_dict[attr] = getattr(client, attr)
2333
 
 
2334
 
            clients.append(client_dict) 
2335
 
            del client_settings[client.name]["secret"]
2336
 
            
 
2377
        clients = {}
 
2378
        with PGPEngine() as pgp:
 
2379
            for client in tcp_server.clients.itervalues():
 
2380
                key = client_settings[client.name]["secret"]
 
2381
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2382
                                                      key)
 
2383
                client_dict = {}
 
2384
                
 
2385
                # A list of attributes that can not be pickled
 
2386
                # + secret.
 
2387
                exclude = set(("bus", "changedstate", "secret",
 
2388
                               "checker"))
 
2389
                for name, typ in (inspect.getmembers
 
2390
                                  (dbus.service.Object)):
 
2391
                    exclude.add(name)
 
2392
                
 
2393
                client_dict["encrypted_secret"] = (client
 
2394
                                                   .encrypted_secret)
 
2395
                for attr in client.client_structure:
 
2396
                    if attr not in exclude:
 
2397
                        client_dict[attr] = getattr(client, attr)
 
2398
                
 
2399
                clients[client.name] = client_dict
 
2400
                del client_settings[client.name]["secret"]
 
2401
        
2337
2402
        try:
2338
2403
            with os.fdopen(os.open(stored_state_path,
2339
2404
                                   os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2340
 
                                   stat.S_IRUSR | stat.S_IWUSR),
2341
 
                           "wb") as stored_state:
 
2405
                                   0600), "wb") as stored_state:
2342
2406
                pickle.dump((clients, client_settings), stored_state)
2343
 
        except IOError as e:
2344
 
            logger.warning("Could not save persistant state: {0}"
 
2407
        except (IOError, OSError) as e:
 
2408
            logger.warning("Could not save persistent state: {0}"
2345
2409
                           .format(e))
2346
 
            if e.errno != errno.ENOENT:
 
2410
            if e.errno not in (errno.ENOENT, errno.EACCES):
2347
2411
                raise
2348
 
 
 
2412
        
2349
2413
        # Delete all clients, and settings from config
2350
2414
        while tcp_server.clients:
2351
2415
            name, client = tcp_server.clients.popitem()
2369
2433
        # Need to initiate checking of clients
2370
2434
        if client.enabled:
2371
2435
            client.init_checker()
2372
 
 
2373
2436
    
2374
2437
    tcp_server.enable()
2375
2438
    tcp_server.server_activate()
2415
2478
    # Must run before the D-Bus bus name gets deregistered
2416
2479
    cleanup()
2417
2480
 
2418
 
 
2419
2481
if __name__ == '__main__':
2420
2482
    main()