To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 525
- compare with another revision
- download diff
- download tarball
- view history from revision 525
- Committer: Björn Påhlsson
- Date: 2011-12-21 00:33:12 UTC
- mfrom: (505.2.13 mandos-client-network-hooks)
- Revision ID: belorn@recompile.se-20111221003312-jwn6d76u2c2lejoz
working new feature: network-hooks - Enables user-scripts to take up
interfaces during bootup
interfaces during bootup
- files added:
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import binascii
67
import tempfile
66
68
67
69
import dbus
68
70
import dbus.service
73
75
import ctypes.util
74
76
import xml.dom.minidom
75
77
import inspect
78
import GnuPGInterface
76
79
77
80
try:
78
81
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
82
85
except ImportError:
83
86
SO_BINDTODEVICE = None
84
87
85
86
version = "1.4.0"
87
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
88
version = "1.4.1"
89
stored_state_file = "clients.pickle"
90
91
logger = logging.getLogger()
90
92
syslogger = (logging.handlers.SysLogHandler
91
93
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
94
address = str("/dev/log")))
93
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
96
logger.addHandler(syslogger)
97
98
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
102
logger.addHandler(console)
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
console = logging.StreamHandler()
122
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
123
' [%(process)d]:'
124
' %(levelname)s:'
125
' %(message)s'))
126
logger.addHandler(console)
127
logger.setLevel(level)
128
129
130
class PGPError(Exception):
131
"""Exception if encryption/decryption fails"""
132
pass
133
134
135
class PGPEngine(object):
136
"""A simple class for OpenPGP symmetric encryption & decryption"""
137
def __init__(self):
138
self.gnupg = GnuPGInterface.GnuPG()
139
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
140
self.gnupg = GnuPGInterface.GnuPG()
141
self.gnupg.options.meta_interactive = False
142
self.gnupg.options.homedir = self.tempdir
143
self.gnupg.options.extra_args.extend(['--force-mdc',
144
'--quiet'])
145
146
def __enter__(self):
147
return self
148
149
def __exit__ (self, exc_type, exc_value, traceback):
150
self._cleanup()
151
return False
152
153
def __del__(self):
154
self._cleanup()
155
156
def _cleanup(self):
157
if self.tempdir is not None:
158
# Delete contents of tempdir
159
for root, dirs, files in os.walk(self.tempdir,
160
topdown = False):
161
for filename in files:
162
os.remove(os.path.join(root, filename))
163
for dirname in dirs:
164
os.rmdir(os.path.join(root, dirname))
165
# Remove tempdir
166
os.rmdir(self.tempdir)
167
self.tempdir = None
168
169
def password_encode(self, password):
170
# Passphrase can not be empty and can not contain newlines or
171
# NUL bytes. So we prefix it and hex encode it.
172
return b"mandos" + binascii.hexlify(password)
173
174
def encrypt(self, data, password):
175
self.gnupg.passphrase = self.password_encode(password)
176
with open(os.devnull) as devnull:
177
try:
178
proc = self.gnupg.run(['--symmetric'],
179
create_fhs=['stdin', 'stdout'],
180
attach_fhs={'stderr': devnull})
181
with contextlib.closing(proc.handles['stdin']) as f:
182
f.write(data)
183
with contextlib.closing(proc.handles['stdout']) as f:
184
ciphertext = f.read()
185
proc.wait()
186
except IOError as e:
187
raise PGPError(e)
188
self.gnupg.passphrase = None
189
return ciphertext
190
191
def decrypt(self, data, password):
192
self.gnupg.passphrase = self.password_encode(password)
193
with open(os.devnull) as devnull:
194
try:
195
proc = self.gnupg.run(['--decrypt'],
196
create_fhs=['stdin', 'stdout'],
197
attach_fhs={'stderr': devnull})
198
with contextlib.closing(proc.handles['stdin'] ) as f:
199
f.write(data)
200
with contextlib.closing(proc.handles['stdout']) as f:
201
decrypted_plaintext = f.read()
202
proc.wait()
203
except IOError as e:
204
raise PGPError(e)
205
self.gnupg.passphrase = None
206
return decrypted_plaintext
207
208
103
209
104
210
class AvahiError(Exception):
105
211
def __init__(self, value, *args, **kwargs):
164
270
.GetAlternativeServiceName(self.name))
165
271
logger.info("Changing Zeroconf service name to %r ...",
166
272
self.name)
167
syslogger.setFormatter(logging.Formatter
168
('Mandos (%s) [%%(process)d]:'
169
' %%(levelname)s: %%(message)s'
170
% self.name))
171
273
self.remove()
172
274
try:
173
275
self.add()
193
295
avahi.DBUS_INTERFACE_ENTRY_GROUP)
194
296
self.entry_group_state_changed_match = (
195
297
self.group.connect_to_signal(
196
'StateChanged', self .entry_group_state_changed))
298
'StateChanged', self.entry_group_state_changed))
197
299
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
198
300
self.name, self.type)
199
301
self.group.AddService(
225
327
try:
226
328
self.group.Free()
227
329
except (dbus.exceptions.UnknownMethodException,
228
dbus.exceptions.DBusException) as e:
330
dbus.exceptions.DBusException):
229
331
pass
230
332
self.group = None
231
333
self.remove()
265
367
self.server_state_changed)
266
368
self.server_state_changed(self.server.GetState())
267
369
370
class AvahiServiceToSyslog(AvahiService):
371
def rename(self):
372
"""Add the new name to the syslog messages"""
373
ret = AvahiService.rename(self)
374
syslogger.setFormatter(logging.Formatter
375
('Mandos (%s) [%%(process)d]:'
376
' %%(levelname)s: %%(message)s'
377
% self.name))
378
return ret
268
379
269
def _timedelta_to_milliseconds(td):
380
def timedelta_to_milliseconds(td):
270
381
"Convert a datetime.timedelta() to milliseconds"
271
382
return ((td.days * 24 * 60 * 60 * 1000)
272
383
+ (td.seconds * 1000)
276
387
"""A representation of a client host served by this server.
277
388
278
389
Attributes:
279
_approved: bool(); 'None' if not yet approved/disapproved
390
approved: bool(); 'None' if not yet approved/disapproved
280
391
approval_delay: datetime.timedelta(); Time to wait for approval
281
392
approval_duration: datetime.timedelta(); Duration of one approval
282
393
checker: subprocess.Popen(); a running checker process used
289
400
instance %(name)s can be used in the command.
290
401
checker_initiator_tag: a gobject event source tag, or None
291
402
created: datetime.datetime(); (UTC) object creation
403
client_structure: Object describing what attributes a client has
404
and is used for storing the client at exit
292
405
current_checker_command: string; current running checker_command
293
disable_hook: If set, called by disable() as disable_hook(self)
294
406
disable_initiator_tag: a gobject event source tag, or None
295
407
enabled: bool()
296
408
fingerprint: string (40 or 32 hexadecimal digits); used to
299
411
interval: datetime.timedelta(); How often to start a new checker
300
412
last_approval_request: datetime.datetime(); (UTC) or None
301
413
last_checked_ok: datetime.datetime(); (UTC) or None
302
last_enabled: datetime.datetime(); (UTC)
414
last_checker_status: integer between 0 and 255 reflecting exit
415
status of last checker. -1 reflects crashed
416
checker, or None.
417
last_enabled: datetime.datetime(); (UTC) or None
303
418
name: string; from the config file, used in log messages and
304
419
D-Bus identifiers
305
420
secret: bytestring; sent verbatim (over TLS) to client
315
430
"created", "enabled", "fingerprint",
316
431
"host", "interval", "last_checked_ok",
317
432
"last_enabled", "name", "timeout")
433
client_defaults = { "timeout": "5m",
434
"extended_timeout": "15m",
435
"interval": "2m",
436
"checker": "fping -q -- %%(host)s",
437
"host": "",
438
"approval_delay": "0s",
439
"approval_duration": "1s",
440
"approved_by_default": "True",
441
"enabled": "True",
442
}
318
443
319
444
def timeout_milliseconds(self):
320
445
"Return the 'timeout' attribute in milliseconds"
321
return _timedelta_to_milliseconds(self.timeout)
446
return timedelta_to_milliseconds(self.timeout)
322
447
323
448
def extended_timeout_milliseconds(self):
324
449
"Return the 'extended_timeout' attribute in milliseconds"
325
return _timedelta_to_milliseconds(self.extended_timeout)
450
return timedelta_to_milliseconds(self.extended_timeout)
326
451
327
452
def interval_milliseconds(self):
328
453
"Return the 'interval' attribute in milliseconds"
329
return _timedelta_to_milliseconds(self.interval)
454
return timedelta_to_milliseconds(self.interval)
330
455
331
456
def approval_delay_milliseconds(self):
332
return _timedelta_to_milliseconds(self.approval_delay)
333
334
def __init__(self, name = None, disable_hook=None, config=None):
457
return timedelta_to_milliseconds(self.approval_delay)
458
459
@staticmethod
460
def config_parser(config):
461
""" Construct a new dict of client settings of this form:
462
{ client_name: {setting_name: value, ...}, ...}
463
with exceptions for any special settings as defined above"""
464
settings = {}
465
for client_name in config.sections():
466
section = dict(config.items(client_name))
467
client = settings[client_name] = {}
468
469
client["host"] = section["host"]
470
# Reformat values from string types to Python types
471
client["approved_by_default"] = config.getboolean(
472
client_name, "approved_by_default")
473
client["enabled"] = config.getboolean(client_name, "enabled")
474
475
client["fingerprint"] = (section["fingerprint"].upper()
476
.replace(" ", ""))
477
if "secret" in section:
478
client["secret"] = section["secret"].decode("base64")
479
elif "secfile" in section:
480
with open(os.path.expanduser(os.path.expandvars
481
(section["secfile"])),
482
"rb") as secfile:
483
client["secret"] = secfile.read()
484
else:
485
raise TypeError("No secret or secfile for section %s"
486
% section)
487
client["timeout"] = string_to_delta(section["timeout"])
488
client["extended_timeout"] = string_to_delta(
489
section["extended_timeout"])
490
client["interval"] = string_to_delta(section["interval"])
491
client["approval_delay"] = string_to_delta(
492
section["approval_delay"])
493
client["approval_duration"] = string_to_delta(
494
section["approval_duration"])
495
client["checker_command"] = section["checker"]
496
client["last_approval_request"] = None
497
client["last_checked_ok"] = None
498
client["last_checker_status"] = None
499
if client["enabled"]:
500
client["last_enabled"] = datetime.datetime.utcnow()
501
client["expires"] = (datetime.datetime.utcnow()
502
+ client["timeout"])
503
else:
504
client["last_enabled"] = None
505
client["expires"] = None
506
507
return settings
508
509
510
def __init__(self, settings, name = None):
335
511
"""Note: the 'checker' key in 'config' sets the
336
512
'checker_command' attribute and *not* the 'checker'
337
513
attribute."""
338
514
self.name = name
339
if config is None:
340
config = {}
515
# adding all client settings
516
for setting, value in settings.iteritems():
517
setattr(self, setting, value)
518
341
519
logger.debug("Creating client %r", self.name)
342
520
# Uppercase and remove spaces from fingerprint for later
343
521
# comparison purposes with return value from the fingerprint()
344
522
# function
345
self.fingerprint = (config["fingerprint"].upper()
346
.replace(" ", ""))
347
523
logger.debug(" Fingerprint: %s", self.fingerprint)
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
351
with open(os.path.expanduser(os.path.expandvars
352
(config["secfile"])),
353
"rb") as secfile:
354
self.secret = secfile.read()
355
else:
356
raise TypeError("No secret or secfile for client %s"
357
% self.name)
358
self.host = config.get("host", "")
359
self.created = datetime.datetime.utcnow()
360
self.enabled = False
361
self.last_approval_request = None
362
self.last_enabled = None
363
self.last_checked_ok = None
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
368
self.disable_hook = disable_hook
524
self.created = settings.get("created", datetime.datetime.utcnow())
525
526
# attributes specific for this server instance
369
527
self.checker = None
370
528
self.checker_initiator_tag = None
371
529
self.disable_initiator_tag = None
372
self.expires = None
373
530
self.checker_callback_tag = None
374
self.checker_command = config["checker"]
375
531
self.current_checker_command = None
376
self.last_connect = None
377
self._approved = None
378
self.approved_by_default = config.get("approved_by_default",
379
True)
532
self.approved = None
380
533
self.approvals_pending = 0
381
self.approval_delay = string_to_delta(
382
config["approval_delay"])
383
self.approval_duration = string_to_delta(
384
config["approval_duration"])
385
534
self.changedstate = (multiprocessing_manager
386
535
.Condition(multiprocessing_manager
387
536
.Lock()))
537
self.client_structure = [attr for attr in
538
self.__dict__.iterkeys()
539
if not attr.startswith("_")]
540
self.client_structure.append("client_structure")
541
542
for name, t in inspect.getmembers(type(self),
543
lambda obj:
544
isinstance(obj,
545
property)):
546
if not name.startswith("_"):
547
self.client_structure.append(name)
388
548
549
# Send notice to process children that client state has changed
389
550
def send_changedstate(self):
390
self.changedstate.acquire()
391
self.changedstate.notify_all()
392
self.changedstate.release()
551
with self.changedstate:
552
self.changedstate.notify_all()
393
553
394
554
def enable(self):
395
555
"""Start this client's checker and timeout hooks"""
397
557
# Already enabled
398
558
return
399
559
self.send_changedstate()
400
# Schedule a new checker to be started an 'interval' from now,
401
# and every interval from then on.
402
self.checker_initiator_tag = (gobject.timeout_add
403
(self.interval_milliseconds(),
404
self.start_checker))
405
# Schedule a disable() when 'timeout' has passed
406
560
self.expires = datetime.datetime.utcnow() + self.timeout
407
self.disable_initiator_tag = (gobject.timeout_add
408
(self.timeout_milliseconds(),
409
self.disable))
410
561
self.enabled = True
411
562
self.last_enabled = datetime.datetime.utcnow()
412
# Also start a new checker *right now*.
413
self.start_checker()
563
self.init_checker()
414
564
415
565
def disable(self, quiet=True):
416
566
"""Disable this client."""
428
578
gobject.source_remove(self.checker_initiator_tag)
429
579
self.checker_initiator_tag = None
430
580
self.stop_checker()
431
if self.disable_hook:
432
self.disable_hook(self)
433
581
self.enabled = False
434
582
# Do not run this again if called by a gobject.timeout_add
435
583
return False
436
584
437
585
def __del__(self):
438
self.disable_hook = None
439
586
self.disable()
440
587
588
def init_checker(self):
589
# Schedule a new checker to be started an 'interval' from now,
590
# and every interval from then on.
591
self.checker_initiator_tag = (gobject.timeout_add
592
(self.interval_milliseconds(),
593
self.start_checker))
594
# Schedule a disable() when 'timeout' has passed
595
self.disable_initiator_tag = (gobject.timeout_add
596
(self.timeout_milliseconds(),
597
self.disable))
598
# Also start a new checker *right now*.
599
self.start_checker()
600
441
601
def checker_callback(self, pid, condition, command):
442
602
"""The checker has completed, so take appropriate actions."""
443
603
self.checker_callback_tag = None
444
604
self.checker = None
445
605
if os.WIFEXITED(condition):
446
exitstatus = os.WEXITSTATUS(condition)
447
if exitstatus == 0:
606
self.last_checker_status = os.WEXITSTATUS(condition)
607
if self.last_checker_status == 0:
448
608
logger.info("Checker for %(name)s succeeded",
449
609
vars(self))
450
610
self.checked_ok()
452
612
logger.info("Checker for %(name)s failed",
453
613
vars(self))
454
614
else:
615
self.last_checker_status = -1
455
616
logger.warning("Checker for %(name)s crashed?",
456
617
vars(self))
457
618
464
625
if timeout is None:
465
626
timeout = self.timeout
466
627
self.last_checked_ok = datetime.datetime.utcnow()
467
gobject.source_remove(self.disable_initiator_tag)
468
self.disable_initiator_tag = (gobject.timeout_add
469
(_timedelta_to_milliseconds
470
(timeout), self.disable))
471
self.expires = datetime.datetime.utcnow() + timeout
628
if self.disable_initiator_tag is not None:
629
gobject.source_remove(self.disable_initiator_tag)
630
if getattr(self, "enabled", False):
631
self.disable_initiator_tag = (gobject.timeout_add
632
(timedelta_to_milliseconds
633
(timeout), self.disable))
634
self.expires = datetime.datetime.utcnow() + timeout
472
635
473
636
def need_approval(self):
474
637
self.last_approval_request = datetime.datetime.utcnow()
689
852
690
853
Note: Will not include properties with access="write".
691
854
"""
692
all = {}
855
properties = {}
693
856
for name, prop in self._get_all_dbus_properties():
694
857
if (interface_name
695
858
and interface_name != prop._dbus_interface):
700
863
continue
701
864
value = prop()
702
865
if not hasattr(value, "variant_level"):
703
all[name] = value
866
properties[name] = value
704
867
continue
705
all[name] = type(value)(value, variant_level=
706
value.variant_level+1)
707
return dbus.Dictionary(all, signature="sv")
868
properties[name] = type(value)(value, variant_level=
869
value.variant_level+1)
870
return dbus.Dictionary(properties, signature="sv")
708
871
709
872
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
710
873
out_signature="s",
761
924
return dbus.String(dt.isoformat(),
762
925
variant_level=variant_level)
763
926
927
764
928
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
765
929
.__metaclass__):
766
930
"""Applied to an empty subclass of a D-Bus object, this metaclass
858
1022
attribute.func_closure)))
859
1023
return type.__new__(mcs, name, bases, attr)
860
1024
1025
861
1026
class ClientDBus(Client, DBusObjectWithProperties):
862
1027
"""A Client class using D-Bus
863
1028
872
1037
# dbus.service.Object doesn't use super(), so we can't either.
873
1038
874
1039
def __init__(self, bus = None, *args, **kwargs):
875
self._approvals_pending = 0
876
1040
self.bus = bus
877
1041
Client.__init__(self, *args, **kwargs)
1042
self._approvals_pending = 0
1043
1044
self._approvals_pending = 0
878
1045
# Only now, when this client is initialized, can it show up on
879
1046
# the D-Bus
880
1047
client_object_name = unicode(self.name).translate(
890
1057
variant_level=1):
891
1058
""" Modify a variable so that it's a property which announces
892
1059
its changes to DBus.
893
894
transform_fun: Function that takes a value and transforms it
895
to a D-Bus type.
1060
1061
transform_fun: Function that takes a value and a variant_level
1062
and transforms it to a D-Bus type.
896
1063
dbus_name: D-Bus name of the variable
897
1064
type_func: Function that transform the value before sending it
898
1065
to the D-Bus. Default: no transform
905
1072
type_func(getattr(self, attrname, None))
906
1073
!= type_func(value)):
907
1074
dbus_value = transform_func(type_func(value),
908
variant_level)
1075
variant_level
1076
=variant_level)
909
1077
self.PropertyChanged(dbus.String(dbus_name),
910
1078
dbus_value)
911
1079
setattr(self, attrname, value)
929
1097
datetime_to_dbus, "LastApprovalRequest")
930
1098
approved_by_default = notifychangeproperty(dbus.Boolean,
931
1099
"ApprovedByDefault")
932
approval_delay = notifychangeproperty(dbus.UInt16,
1100
approval_delay = notifychangeproperty(dbus.UInt64,
933
1101
"ApprovalDelay",
934
1102
type_func =
935
_timedelta_to_milliseconds)
1103
timedelta_to_milliseconds)
936
1104
approval_duration = notifychangeproperty(
937
dbus.UInt16, "ApprovalDuration",
938
type_func = _timedelta_to_milliseconds)
1105
dbus.UInt64, "ApprovalDuration",
1106
type_func = timedelta_to_milliseconds)
939
1107
host = notifychangeproperty(dbus.String, "Host")
940
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1108
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
941
1109
type_func =
942
_timedelta_to_milliseconds)
1110
timedelta_to_milliseconds)
943
1111
extended_timeout = notifychangeproperty(
944
dbus.UInt16, "ExtendedTimeout",
945
type_func = _timedelta_to_milliseconds)
946
interval = notifychangeproperty(dbus.UInt16,
1112
dbus.UInt64, "ExtendedTimeout",
1113
type_func = timedelta_to_milliseconds)
1114
interval = notifychangeproperty(dbus.UInt64,
947
1115
"Interval",
948
1116
type_func =
949
_timedelta_to_milliseconds)
1117
timedelta_to_milliseconds)
950
1118
checker_command = notifychangeproperty(dbus.String, "Checker")
951
1119
952
1120
del notifychangeproperty
994
1162
return r
995
1163
996
1164
def _reset_approved(self):
997
self._approved = None
1165
self.approved = None
998
1166
return False
999
1167
1000
1168
def approve(self, value=True):
1001
1169
self.send_changedstate()
1002
self._approved = value
1003
gobject.timeout_add(_timedelta_to_milliseconds
1170
self.approved = value
1171
gobject.timeout_add(timedelta_to_milliseconds
1004
1172
(self.approval_duration),
1005
1173
self._reset_approved)
1006
1174
1049
1217
"D-Bus signal"
1050
1218
return self.need_approval()
1051
1219
1220
# NeRwequest - signal
1221
@dbus.service.signal(_interface, signature="s")
1222
def NewRequest(self, ip):
1223
"""D-Bus signal
1224
Is sent after a client request a password.
1225
"""
1226
pass
1227
1052
1228
## Methods
1053
1229
1054
1230
# Approve - method
1112
1288
access="readwrite")
1113
1289
def ApprovalDuration_dbus_property(self, value=None):
1114
1290
if value is None: # get
1115
return dbus.UInt64(_timedelta_to_milliseconds(
1291
return dbus.UInt64(timedelta_to_milliseconds(
1116
1292
self.approval_duration))
1117
1293
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1118
1294
1132
1308
def Host_dbus_property(self, value=None):
1133
1309
if value is None: # get
1134
1310
return dbus.String(self.host)
1135
self.host = value
1311
self.host = unicode(value)
1136
1312
1137
1313
# Created - property
1138
1314
@dbus_service_property(_interface, signature="s", access="read")
1139
1315
def Created_dbus_property(self):
1140
return dbus.String(datetime_to_dbus(self.created))
1316
return datetime_to_dbus(self.created)
1141
1317
1142
1318
# LastEnabled - property
1143
1319
@dbus_service_property(_interface, signature="s", access="read")
1187
1363
gobject.source_remove(self.disable_initiator_tag)
1188
1364
self.disable_initiator_tag = None
1189
1365
self.expires = None
1190
time_to_die = (self.
1191
_timedelta_to_milliseconds((self
1192
.last_checked_ok
1193
+ self.timeout)
1194
- datetime.datetime
1195
.utcnow()))
1366
time_to_die = timedelta_to_milliseconds((self
1367
.last_checked_ok
1368
+ self.timeout)
1369
- datetime.datetime
1370
.utcnow())
1196
1371
if time_to_die <= 0:
1197
1372
# The timeout has passed
1198
1373
self.disable()
1220
1395
self.interval = datetime.timedelta(0, 0, 0, value)
1221
1396
if getattr(self, "checker_initiator_tag", None) is None:
1222
1397
return
1223
# Reschedule checker run
1224
gobject.source_remove(self.checker_initiator_tag)
1225
self.checker_initiator_tag = (gobject.timeout_add
1226
(value, self.start_checker))
1227
self.start_checker() # Start one now, too
1398
if self.enabled:
1399
# Reschedule checker run
1400
gobject.source_remove(self.checker_initiator_tag)
1401
self.checker_initiator_tag = (gobject.timeout_add
1402
(value, self.start_checker))
1403
self.start_checker() # Start one now, too
1228
1404
1229
1405
# Checker - property
1230
1406
@dbus_service_property(_interface, signature="s",
1232
1408
def Checker_dbus_property(self, value=None):
1233
1409
if value is None: # get
1234
1410
return dbus.String(self.checker_command)
1235
self.checker_command = value
1411
self.checker_command = unicode(value)
1236
1412
1237
1413
# CheckerRunning - property
1238
1414
@dbus_service_property(_interface, signature="b",
1267
1443
raise KeyError()
1268
1444
1269
1445
def __getattribute__(self, name):
1270
if(name == '_pipe'):
1446
if name == '_pipe':
1271
1447
return super(ProxyClient, self).__getattribute__(name)
1272
1448
self._pipe.send(('getattr', name))
1273
1449
data = self._pipe.recv()
1280
1456
return func
1281
1457
1282
1458
def __setattr__(self, name, value):
1283
if(name == '_pipe'):
1459
if name == '_pipe':
1284
1460
return super(ProxyClient, self).__setattr__(name, value)
1285
1461
self._pipe.send(('setattr', name, value))
1286
1462
1463
1287
1464
class ClientDBusTransitional(ClientDBus):
1288
1465
__metaclass__ = AlternateDBusNamesMetaclass
1289
1466
1467
1290
1468
class ClientHandler(socketserver.BaseRequestHandler, object):
1291
1469
"""A class to handle client connections.
1292
1470
1360
1538
except KeyError:
1361
1539
return
1362
1540
1541
if self.server.use_dbus:
1542
# Emit D-Bus signal
1543
client.NewRequest(str(self.client_address))
1544
1363
1545
if client.approval_delay:
1364
1546
delay = client.approval_delay
1365
1547
client.approvals_pending += 1
1374
1556
client.Rejected("Disabled")
1375
1557
return
1376
1558
1377
if client._approved or not client.approval_delay:
1559
if client.approved or not client.approval_delay:
1378
1560
#We are approved or approval is disabled
1379
1561
break
1380
elif client._approved is None:
1562
elif client.approved is None:
1381
1563
logger.info("Client %s needs approval",
1382
1564
client.name)
1383
1565
if self.server.use_dbus:
1397
1579
time = datetime.datetime.now()
1398
1580
client.changedstate.acquire()
1399
1581
(client.changedstate.wait
1400
(float(client._timedelta_to_milliseconds(delay)
1582
(float(client.timedelta_to_milliseconds(delay)
1401
1583
/ 1000)))
1402
1584
client.changedstate.release()
1403
1585
time2 = datetime.datetime.now()
1502
1684
# Convert the buffer to a Python bytestring
1503
1685
fpr = ctypes.string_at(buf, buf_len.value)
1504
1686
# Convert the bytestring to hexadecimal notation
1505
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1687
hex_fpr = binascii.hexlify(fpr).upper()
1506
1688
return hex_fpr
1507
1689
1508
1690
1511
1693
def sub_process_main(self, request, address):
1512
1694
try:
1513
1695
self.finish_request(request, address)
1514
except:
1696
except Exception:
1515
1697
self.handle_error(request, address)
1516
1698
self.close_request(request)
1517
1699
1622
1804
self.enabled = False
1623
1805
self.clients = clients
1624
1806
if self.clients is None:
1625
self.clients = set()
1807
self.clients = {}
1626
1808
self.use_dbus = use_dbus
1627
1809
self.gnutls_priority = gnutls_priority
1628
1810
IPv6_TCPServer.__init__(self, server_address,
1675
1857
fpr = request[1]
1676
1858
address = request[2]
1677
1859
1678
for c in self.clients:
1860
for c in self.clients.itervalues():
1679
1861
if c.fingerprint == fpr:
1680
1862
client = c
1681
1863
break
1765
1947
return timevalue
1766
1948
1767
1949
1768
def if_nametoindex(interface):
1769
"""Call the C function if_nametoindex(), or equivalent
1770
1771
Note: This function cannot accept a unicode string."""
1772
global if_nametoindex
1773
try:
1774
if_nametoindex = (ctypes.cdll.LoadLibrary
1775
(ctypes.util.find_library("c"))
1776
.if_nametoindex)
1777
except (OSError, AttributeError):
1778
logger.warning("Doing if_nametoindex the hard way")
1779
def if_nametoindex(interface):
1780
"Get an interface index the hard way, i.e. using fcntl()"
1781
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1782
with contextlib.closing(socket.socket()) as s:
1783
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1784
struct.pack(str("16s16x"),
1785
interface))
1786
interface_index = struct.unpack(str("I"),
1787
ifreq[16:20])[0]
1788
return interface_index
1789
return if_nametoindex(interface)
1790
1791
1792
1950
def daemon(nochdir = False, noclose = False):
1793
1951
"""See daemon(3). Standard BSD Unix function.
1794
1952
1849
2007
" system bus interface")
1850
2008
parser.add_argument("--no-ipv6", action="store_false",
1851
2009
dest="use_ipv6", help="Do not use IPv6")
2010
parser.add_argument("--no-restore", action="store_false",
2011
dest="restore", help="Do not restore stored"
2012
" state")
2013
parser.add_argument("--statedir", metavar="DIR",
2014
help="Directory to save/restore state in")
2015
1852
2016
options = parser.parse_args()
1853
2017
1854
2018
if options.check:
1867
2031
"use_dbus": "True",
1868
2032
"use_ipv6": "True",
1869
2033
"debuglevel": "",
2034
"restore": "True",
2035
"statedir": "/var/lib/mandos"
1870
2036
}
1871
2037
1872
2038
# Parse config file for server-global settings
1889
2055
# options, if set.
1890
2056
for option in ("interface", "address", "port", "debug",
1891
2057
"priority", "servicename", "configdir",
1892
"use_dbus", "use_ipv6", "debuglevel"):
2058
"use_dbus", "use_ipv6", "debuglevel", "restore",
2059
"statedir"):
1893
2060
value = getattr(options, option)
1894
2061
if value is not None:
1895
2062
server_settings[option] = value
1907
2074
debuglevel = server_settings["debuglevel"]
1908
2075
use_dbus = server_settings["use_dbus"]
1909
2076
use_ipv6 = server_settings["use_ipv6"]
2077
stored_state_path = os.path.join(server_settings["statedir"],
2078
stored_state_file)
2079
2080
if debug:
2081
initlogger(logging.DEBUG)
2082
else:
2083
if not debuglevel:
2084
initlogger()
2085
else:
2086
level = getattr(logging, debuglevel.upper())
2087
initlogger(level)
1910
2088
1911
2089
if server_settings["servicename"] != "Mandos":
1912
2090
syslogger.setFormatter(logging.Formatter
1915
2093
% server_settings["servicename"]))
1916
2094
1917
2095
# Parse config file with clients
1918
client_defaults = { "timeout": "5m",
1919
"extended_timeout": "15m",
1920
"interval": "2m",
1921
"checker": "fping -q -- %%(host)s",
1922
"host": "",
1923
"approval_delay": "0s",
1924
"approval_duration": "1s",
1925
}
1926
client_config = configparser.SafeConfigParser(client_defaults)
2096
client_config = configparser.SafeConfigParser(Client.client_defaults)
1927
2097
client_config.read(os.path.join(server_settings["configdir"],
1928
2098
"clients.conf"))
1929
2099
1967
2137
if error[0] != errno.EPERM:
1968
2138
raise error
1969
2139
1970
if not debug and not debuglevel:
1971
syslogger.setLevel(logging.WARNING)
1972
console.setLevel(logging.WARNING)
1973
if debuglevel:
1974
level = getattr(logging, debuglevel.upper())
1975
syslogger.setLevel(level)
1976
console.setLevel(level)
1977
1978
2140
if debug:
1979
2141
# Enable all possible GnuTLS debugging
1980
2142
2022
2184
server_settings["use_dbus"] = False
2023
2185
tcp_server.use_dbus = False
2024
2186
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2025
service = AvahiService(name = server_settings["servicename"],
2026
servicetype = "_mandos._tcp",
2027
protocol = protocol, bus = bus)
2187
service = AvahiServiceToSyslog(name =
2188
server_settings["servicename"],
2189
servicetype = "_mandos._tcp",
2190
protocol = protocol, bus = bus)
2028
2191
if server_settings["interface"]:
2029
2192
service.interface = (if_nametoindex
2030
2193
(str(server_settings["interface"])))
2036
2199
if use_dbus:
2037
2200
client_class = functools.partial(ClientDBusTransitional,
2038
2201
bus = bus)
2039
def client_config_items(config, section):
2040
special_settings = {
2041
"approved_by_default":
2042
lambda: config.getboolean(section,
2043
"approved_by_default"),
2044
}
2045
for name, value in config.items(section):
2202
2203
client_settings = Client.config_parser(client_config)
2204
old_client_settings = {}
2205
clients_data = {}
2206
2207
# Get client data and settings from last running state.
2208
if server_settings["restore"]:
2209
try:
2210
with open(stored_state_path, "rb") as stored_state:
2211
clients_data, old_client_settings = (pickle.load
2212
(stored_state))
2213
os.remove(stored_state_path)
2214
except IOError as e:
2215
logger.warning("Could not load persistent state: {0}"
2216
.format(e))
2217
if e.errno != errno.ENOENT:
2218
raise
2219
2220
with PGPEngine() as pgp:
2221
for client_name, client in clients_data.iteritems():
2222
# Decide which value to use after restoring saved state.
2223
# We have three different values: Old config file,
2224
# new config file, and saved state.
2225
# New config value takes precedence if it differs from old
2226
# config value, otherwise use saved state.
2227
for name, value in client_settings[client_name].items():
2228
try:
2229
# For each value in new config, check if it
2230
# differs from the old config value (Except for
2231
# the "secret" attribute)
2232
if (name != "secret" and
2233
value != old_client_settings[client_name]
2234
[name]):
2235
client[name] = value
2236
except KeyError:
2237
pass
2238
2239
# Clients who has passed its expire date can still be
2240
# enabled if its last checker was successful. Clients
2241
# whose checker failed before we stored its state is
2242
# assumed to have failed all checkers during downtime.
2243
if client["enabled"]:
2244
if datetime.datetime.utcnow() >= client["expires"]:
2245
if not client["last_checked_ok"]:
2246
logger.warning(
2247
"disabling client {0} - Client never "
2248
"performed a successfull checker"
2249
.format(client["name"]))
2250
client["enabled"] = False
2251
elif client["last_checker_status"] != 0:
2252
logger.warning(
2253
"disabling client {0} - Client "
2254
"last checker failed with error code {1}"
2255
.format(client["name"],
2256
client["last_checker_status"]))
2257
client["enabled"] = False
2258
else:
2259
client["expires"] = (datetime.datetime
2260
.utcnow()
2261
+ client["timeout"])
2262
2046
2263
try:
2047
yield (name, special_settings[name]())
2048
except KeyError:
2049
yield (name, value)
2050
2051
tcp_server.clients.update(set(
2052
client_class(name = section,
2053
config= dict(client_config_items(
2054
client_config, section)))
2055
for section in client_config.sections()))
2264
client["secret"] = (
2265
pgp.decrypt(client["encrypted_secret"],
2266
client_settings[client_name]
2267
["secret"]))
2268
except PGPError:
2269
# If decryption fails, we use secret from new settings
2270
logger.debug("Failed to decrypt {0} old secret"
2271
.format(client_name))
2272
client["secret"] = (
2273
client_settings[client_name]["secret"])
2274
2275
2276
# Add/remove clients based on new changes made to config
2277
for client_name in set(old_client_settings) - set(client_settings):
2278
del clients_data[client_name]
2279
for client_name in set(client_settings) - set(old_client_settings):
2280
clients_data[client_name] = client_settings[client_name]
2281
2282
# Create clients all clients
2283
for client_name, client in clients_data.iteritems():
2284
tcp_server.clients[client_name] = client_class(
2285
name = client_name, settings = client)
2286
2056
2287
if not tcp_server.clients:
2057
2288
logger.warning("No clients defined")
2058
2289
2069
2300
# "pidfile" was never created
2070
2301
pass
2071
2302
del pidfilename
2072
2073
2303
signal.signal(signal.SIGINT, signal.SIG_IGN)
2074
2304
2075
2305
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2101
2331
def GetAllClients(self):
2102
2332
"D-Bus method"
2103
2333
return dbus.Array(c.dbus_object_path
2104
for c in tcp_server.clients)
2334
for c in
2335
tcp_server.clients.itervalues())
2105
2336
2106
2337
@dbus.service.method(_interface,
2107
2338
out_signature="a{oa{sv}}")
2109
2340
"D-Bus method"
2110
2341
return dbus.Dictionary(
2111
2342
((c.dbus_object_path, c.GetAll(""))
2112
for c in tcp_server.clients),
2343
for c in tcp_server.clients.itervalues()),
2113
2344
signature="oa{sv}")
2114
2345
2115
2346
@dbus.service.method(_interface, in_signature="o")
2116
2347
def RemoveClient(self, object_path):
2117
2348
"D-Bus method"
2118
for c in tcp_server.clients:
2349
for c in tcp_server.clients.itervalues():
2119
2350
if c.dbus_object_path == object_path:
2120
tcp_server.clients.remove(c)
2351
del tcp_server.clients[c.name]
2121
2352
c.remove_from_connection()
2122
2353
# Don't signal anything except ClientRemoved
2123
2354
c.disable(quiet=True)
2137
2368
service.cleanup()
2138
2369
2139
2370
multiprocessing.active_children()
2371
if not (tcp_server.clients or client_settings):
2372
return
2373
2374
# Store client before exiting. Secrets are encrypted with key
2375
# based on what config file has. If config file is
2376
# removed/edited, old secret will thus be unrecovable.
2377
clients = {}
2378
with PGPEngine() as pgp:
2379
for client in tcp_server.clients.itervalues():
2380
key = client_settings[client.name]["secret"]
2381
client.encrypted_secret = pgp.encrypt(client.secret,
2382
key)
2383
client_dict = {}
2384
2385
# A list of attributes that can not be pickled
2386
# + secret.
2387
exclude = set(("bus", "changedstate", "secret",
2388
"checker"))
2389
for name, typ in (inspect.getmembers
2390
(dbus.service.Object)):
2391
exclude.add(name)
2392
2393
client_dict["encrypted_secret"] = (client
2394
.encrypted_secret)
2395
for attr in client.client_structure:
2396
if attr not in exclude:
2397
client_dict[attr] = getattr(client, attr)
2398
2399
clients[client.name] = client_dict
2400
del client_settings[client.name]["secret"]
2401
2402
try:
2403
with os.fdopen(os.open(stored_state_path,
2404
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2405
0600), "wb") as stored_state:
2406
pickle.dump((clients, client_settings), stored_state)
2407
except (IOError, OSError) as e:
2408
logger.warning("Could not save persistent state: {0}"
2409
.format(e))
2410
if e.errno not in (errno.ENOENT, errno.EACCES):
2411
raise
2412
2413
# Delete all clients, and settings from config
2140
2414
while tcp_server.clients:
2141
client = tcp_server.clients.pop()
2415
name, client = tcp_server.clients.popitem()
2142
2416
if use_dbus:
2143
2417
client.remove_from_connection()
2144
client.disable_hook = None
2145
2418
# Don't signal anything except ClientRemoved
2146
2419
client.disable(quiet=True)
2147
2420
if use_dbus:
2149
2422
mandos_dbus_service.ClientRemoved(client
2150
2423
.dbus_object_path,
2151
2424
client.name)
2425
client_settings.clear()
2152
2426
2153
2427
atexit.register(cleanup)
2154
2428
2155
for client in tcp_server.clients:
2429
for client in tcp_server.clients.itervalues():
2156
2430
if use_dbus:
2157
2431
# Emit D-Bus signal
2158
2432
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2159
client.enable()
2433
# Need to initiate checking of clients
2434
if client.enabled:
2435
client.init_checker()
2160
2436
2161
2437
tcp_server.enable()
2162
2438
tcp_server.server_activate()
2202
2478
# Must run before the D-Bus bus name gets deregistered
2203
2479
cleanup()
2204
2480
2205
2206
2481
if __name__ == '__main__':
2207
2482
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0