To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 525
- compare with another revision
- download diff
- download tarball
- view history from revision 525
- Committer: Björn Påhlsson
- Date: 2011-12-21 00:33:12 UTC
- mfrom: (505.2.13 mandos-client-network-hooks)
- Revision ID: belorn@recompile.se-20111221003312-jwn6d76u2c2lejoz
working new feature: network-hooks - Enables user-scripts to take up
interfaces during bootup
interfaces during bootup
- files added:
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import binascii
67
import tempfile
66
68
67
69
import dbus
68
70
import dbus.service
73
75
import ctypes.util
74
76
import xml.dom.minidom
75
77
import inspect
78
import GnuPGInterface
76
79
77
80
try:
78
81
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
82
85
except ImportError:
83
86
SO_BINDTODEVICE = None
84
87
85
86
version = "1.3.1"
87
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
88
version = "1.4.1"
89
stored_state_file = "clients.pickle"
90
91
logger = logging.getLogger()
90
92
syslogger = (logging.handlers.SysLogHandler
91
93
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
94
address = str("/dev/log")))
93
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
96
logger.addHandler(syslogger)
97
98
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
102
logger.addHandler(console)
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
console = logging.StreamHandler()
122
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
123
' [%(process)d]:'
124
' %(levelname)s:'
125
' %(message)s'))
126
logger.addHandler(console)
127
logger.setLevel(level)
128
129
130
class PGPError(Exception):
131
"""Exception if encryption/decryption fails"""
132
pass
133
134
135
class PGPEngine(object):
136
"""A simple class for OpenPGP symmetric encryption & decryption"""
137
def __init__(self):
138
self.gnupg = GnuPGInterface.GnuPG()
139
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
140
self.gnupg = GnuPGInterface.GnuPG()
141
self.gnupg.options.meta_interactive = False
142
self.gnupg.options.homedir = self.tempdir
143
self.gnupg.options.extra_args.extend(['--force-mdc',
144
'--quiet'])
145
146
def __enter__(self):
147
return self
148
149
def __exit__ (self, exc_type, exc_value, traceback):
150
self._cleanup()
151
return False
152
153
def __del__(self):
154
self._cleanup()
155
156
def _cleanup(self):
157
if self.tempdir is not None:
158
# Delete contents of tempdir
159
for root, dirs, files in os.walk(self.tempdir,
160
topdown = False):
161
for filename in files:
162
os.remove(os.path.join(root, filename))
163
for dirname in dirs:
164
os.rmdir(os.path.join(root, dirname))
165
# Remove tempdir
166
os.rmdir(self.tempdir)
167
self.tempdir = None
168
169
def password_encode(self, password):
170
# Passphrase can not be empty and can not contain newlines or
171
# NUL bytes. So we prefix it and hex encode it.
172
return b"mandos" + binascii.hexlify(password)
173
174
def encrypt(self, data, password):
175
self.gnupg.passphrase = self.password_encode(password)
176
with open(os.devnull) as devnull:
177
try:
178
proc = self.gnupg.run(['--symmetric'],
179
create_fhs=['stdin', 'stdout'],
180
attach_fhs={'stderr': devnull})
181
with contextlib.closing(proc.handles['stdin']) as f:
182
f.write(data)
183
with contextlib.closing(proc.handles['stdout']) as f:
184
ciphertext = f.read()
185
proc.wait()
186
except IOError as e:
187
raise PGPError(e)
188
self.gnupg.passphrase = None
189
return ciphertext
190
191
def decrypt(self, data, password):
192
self.gnupg.passphrase = self.password_encode(password)
193
with open(os.devnull) as devnull:
194
try:
195
proc = self.gnupg.run(['--decrypt'],
196
create_fhs=['stdin', 'stdout'],
197
attach_fhs={'stderr': devnull})
198
with contextlib.closing(proc.handles['stdin'] ) as f:
199
f.write(data)
200
with contextlib.closing(proc.handles['stdout']) as f:
201
decrypted_plaintext = f.read()
202
proc.wait()
203
except IOError as e:
204
raise PGPError(e)
205
self.gnupg.passphrase = None
206
return decrypted_plaintext
207
208
103
209
104
210
class AvahiError(Exception):
105
211
def __init__(self, value, *args, **kwargs):
164
270
.GetAlternativeServiceName(self.name))
165
271
logger.info("Changing Zeroconf service name to %r ...",
166
272
self.name)
167
syslogger.setFormatter(logging.Formatter
168
('Mandos (%s) [%%(process)d]:'
169
' %%(levelname)s: %%(message)s'
170
% self.name))
171
273
self.remove()
172
274
try:
173
275
self.add()
193
295
avahi.DBUS_INTERFACE_ENTRY_GROUP)
194
296
self.entry_group_state_changed_match = (
195
297
self.group.connect_to_signal(
196
'StateChanged', self .entry_group_state_changed))
298
'StateChanged', self.entry_group_state_changed))
197
299
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
198
300
self.name, self.type)
199
301
self.group.AddService(
225
327
try:
226
328
self.group.Free()
227
329
except (dbus.exceptions.UnknownMethodException,
228
dbus.exceptions.DBusException) as e:
330
dbus.exceptions.DBusException):
229
331
pass
230
332
self.group = None
231
333
self.remove()
265
367
self.server_state_changed)
266
368
self.server_state_changed(self.server.GetState())
267
369
370
class AvahiServiceToSyslog(AvahiService):
371
def rename(self):
372
"""Add the new name to the syslog messages"""
373
ret = AvahiService.rename(self)
374
syslogger.setFormatter(logging.Formatter
375
('Mandos (%s) [%%(process)d]:'
376
' %%(levelname)s: %%(message)s'
377
% self.name))
378
return ret
268
379
269
def _timedelta_to_milliseconds(td):
380
def timedelta_to_milliseconds(td):
270
381
"Convert a datetime.timedelta() to milliseconds"
271
382
return ((td.days * 24 * 60 * 60 * 1000)
272
383
+ (td.seconds * 1000)
276
387
"""A representation of a client host served by this server.
277
388
278
389
Attributes:
279
_approved: bool(); 'None' if not yet approved/disapproved
390
approved: bool(); 'None' if not yet approved/disapproved
280
391
approval_delay: datetime.timedelta(); Time to wait for approval
281
392
approval_duration: datetime.timedelta(); Duration of one approval
282
393
checker: subprocess.Popen(); a running checker process used
289
400
instance %(name)s can be used in the command.
290
401
checker_initiator_tag: a gobject event source tag, or None
291
402
created: datetime.datetime(); (UTC) object creation
403
client_structure: Object describing what attributes a client has
404
and is used for storing the client at exit
292
405
current_checker_command: string; current running checker_command
293
disable_hook: If set, called by disable() as disable_hook(self)
294
406
disable_initiator_tag: a gobject event source tag, or None
295
407
enabled: bool()
296
408
fingerprint: string (40 or 32 hexadecimal digits); used to
299
411
interval: datetime.timedelta(); How often to start a new checker
300
412
last_approval_request: datetime.datetime(); (UTC) or None
301
413
last_checked_ok: datetime.datetime(); (UTC) or None
302
last_enabled: datetime.datetime(); (UTC)
414
last_checker_status: integer between 0 and 255 reflecting exit
415
status of last checker. -1 reflects crashed
416
checker, or None.
417
last_enabled: datetime.datetime(); (UTC) or None
303
418
name: string; from the config file, used in log messages and
304
419
D-Bus identifiers
305
420
secret: bytestring; sent verbatim (over TLS) to client
315
430
"created", "enabled", "fingerprint",
316
431
"host", "interval", "last_checked_ok",
317
432
"last_enabled", "name", "timeout")
433
client_defaults = { "timeout": "5m",
434
"extended_timeout": "15m",
435
"interval": "2m",
436
"checker": "fping -q -- %%(host)s",
437
"host": "",
438
"approval_delay": "0s",
439
"approval_duration": "1s",
440
"approved_by_default": "True",
441
"enabled": "True",
442
}
318
443
319
444
def timeout_milliseconds(self):
320
445
"Return the 'timeout' attribute in milliseconds"
321
return _timedelta_to_milliseconds(self.timeout)
446
return timedelta_to_milliseconds(self.timeout)
322
447
323
448
def extended_timeout_milliseconds(self):
324
449
"Return the 'extended_timeout' attribute in milliseconds"
325
return _timedelta_to_milliseconds(self.extended_timeout)
450
return timedelta_to_milliseconds(self.extended_timeout)
326
451
327
452
def interval_milliseconds(self):
328
453
"Return the 'interval' attribute in milliseconds"
329
return _timedelta_to_milliseconds(self.interval)
454
return timedelta_to_milliseconds(self.interval)
330
455
331
456
def approval_delay_milliseconds(self):
332
return _timedelta_to_milliseconds(self.approval_delay)
333
334
def __init__(self, name = None, disable_hook=None, config=None):
457
return timedelta_to_milliseconds(self.approval_delay)
458
459
@staticmethod
460
def config_parser(config):
461
""" Construct a new dict of client settings of this form:
462
{ client_name: {setting_name: value, ...}, ...}
463
with exceptions for any special settings as defined above"""
464
settings = {}
465
for client_name in config.sections():
466
section = dict(config.items(client_name))
467
client = settings[client_name] = {}
468
469
client["host"] = section["host"]
470
# Reformat values from string types to Python types
471
client["approved_by_default"] = config.getboolean(
472
client_name, "approved_by_default")
473
client["enabled"] = config.getboolean(client_name, "enabled")
474
475
client["fingerprint"] = (section["fingerprint"].upper()
476
.replace(" ", ""))
477
if "secret" in section:
478
client["secret"] = section["secret"].decode("base64")
479
elif "secfile" in section:
480
with open(os.path.expanduser(os.path.expandvars
481
(section["secfile"])),
482
"rb") as secfile:
483
client["secret"] = secfile.read()
484
else:
485
raise TypeError("No secret or secfile for section %s"
486
% section)
487
client["timeout"] = string_to_delta(section["timeout"])
488
client["extended_timeout"] = string_to_delta(
489
section["extended_timeout"])
490
client["interval"] = string_to_delta(section["interval"])
491
client["approval_delay"] = string_to_delta(
492
section["approval_delay"])
493
client["approval_duration"] = string_to_delta(
494
section["approval_duration"])
495
client["checker_command"] = section["checker"]
496
client["last_approval_request"] = None
497
client["last_checked_ok"] = None
498
client["last_checker_status"] = None
499
if client["enabled"]:
500
client["last_enabled"] = datetime.datetime.utcnow()
501
client["expires"] = (datetime.datetime.utcnow()
502
+ client["timeout"])
503
else:
504
client["last_enabled"] = None
505
client["expires"] = None
506
507
return settings
508
509
510
def __init__(self, settings, name = None):
335
511
"""Note: the 'checker' key in 'config' sets the
336
512
'checker_command' attribute and *not* the 'checker'
337
513
attribute."""
338
514
self.name = name
339
if config is None:
340
config = {}
515
# adding all client settings
516
for setting, value in settings.iteritems():
517
setattr(self, setting, value)
518
341
519
logger.debug("Creating client %r", self.name)
342
520
# Uppercase and remove spaces from fingerprint for later
343
521
# comparison purposes with return value from the fingerprint()
344
522
# function
345
self.fingerprint = (config["fingerprint"].upper()
346
.replace(" ", ""))
347
523
logger.debug(" Fingerprint: %s", self.fingerprint)
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
351
with open(os.path.expanduser(os.path.expandvars
352
(config["secfile"])),
353
"rb") as secfile:
354
self.secret = secfile.read()
355
else:
356
raise TypeError("No secret or secfile for client %s"
357
% self.name)
358
self.host = config.get("host", "")
359
self.created = datetime.datetime.utcnow()
360
self.enabled = False
361
self.last_approval_request = None
362
self.last_enabled = None
363
self.last_checked_ok = None
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
368
self.disable_hook = disable_hook
524
self.created = settings.get("created", datetime.datetime.utcnow())
525
526
# attributes specific for this server instance
369
527
self.checker = None
370
528
self.checker_initiator_tag = None
371
529
self.disable_initiator_tag = None
372
self.expires = None
373
530
self.checker_callback_tag = None
374
self.checker_command = config["checker"]
375
531
self.current_checker_command = None
376
self.last_connect = None
377
self._approved = None
378
self.approved_by_default = config.get("approved_by_default",
379
True)
532
self.approved = None
380
533
self.approvals_pending = 0
381
self.approval_delay = string_to_delta(
382
config["approval_delay"])
383
self.approval_duration = string_to_delta(
384
config["approval_duration"])
385
534
self.changedstate = (multiprocessing_manager
386
535
.Condition(multiprocessing_manager
387
536
.Lock()))
537
self.client_structure = [attr for attr in
538
self.__dict__.iterkeys()
539
if not attr.startswith("_")]
540
self.client_structure.append("client_structure")
541
542
for name, t in inspect.getmembers(type(self),
543
lambda obj:
544
isinstance(obj,
545
property)):
546
if not name.startswith("_"):
547
self.client_structure.append(name)
388
548
549
# Send notice to process children that client state has changed
389
550
def send_changedstate(self):
390
self.changedstate.acquire()
391
self.changedstate.notify_all()
392
self.changedstate.release()
551
with self.changedstate:
552
self.changedstate.notify_all()
393
553
394
554
def enable(self):
395
555
"""Start this client's checker and timeout hooks"""
397
557
# Already enabled
398
558
return
399
559
self.send_changedstate()
400
# Schedule a new checker to be started an 'interval' from now,
401
# and every interval from then on.
402
self.checker_initiator_tag = (gobject.timeout_add
403
(self.interval_milliseconds(),
404
self.start_checker))
405
# Schedule a disable() when 'timeout' has passed
406
560
self.expires = datetime.datetime.utcnow() + self.timeout
407
self.disable_initiator_tag = (gobject.timeout_add
408
(self.timeout_milliseconds(),
409
self.disable))
410
561
self.enabled = True
411
562
self.last_enabled = datetime.datetime.utcnow()
412
# Also start a new checker *right now*.
413
self.start_checker()
563
self.init_checker()
414
564
415
565
def disable(self, quiet=True):
416
566
"""Disable this client."""
428
578
gobject.source_remove(self.checker_initiator_tag)
429
579
self.checker_initiator_tag = None
430
580
self.stop_checker()
431
if self.disable_hook:
432
self.disable_hook(self)
433
581
self.enabled = False
434
582
# Do not run this again if called by a gobject.timeout_add
435
583
return False
436
584
437
585
def __del__(self):
438
self.disable_hook = None
439
586
self.disable()
440
587
588
def init_checker(self):
589
# Schedule a new checker to be started an 'interval' from now,
590
# and every interval from then on.
591
self.checker_initiator_tag = (gobject.timeout_add
592
(self.interval_milliseconds(),
593
self.start_checker))
594
# Schedule a disable() when 'timeout' has passed
595
self.disable_initiator_tag = (gobject.timeout_add
596
(self.timeout_milliseconds(),
597
self.disable))
598
# Also start a new checker *right now*.
599
self.start_checker()
600
441
601
def checker_callback(self, pid, condition, command):
442
602
"""The checker has completed, so take appropriate actions."""
443
603
self.checker_callback_tag = None
444
604
self.checker = None
445
605
if os.WIFEXITED(condition):
446
exitstatus = os.WEXITSTATUS(condition)
447
if exitstatus == 0:
606
self.last_checker_status = os.WEXITSTATUS(condition)
607
if self.last_checker_status == 0:
448
608
logger.info("Checker for %(name)s succeeded",
449
609
vars(self))
450
610
self.checked_ok()
452
612
logger.info("Checker for %(name)s failed",
453
613
vars(self))
454
614
else:
615
self.last_checker_status = -1
455
616
logger.warning("Checker for %(name)s crashed?",
456
617
vars(self))
457
618
464
625
if timeout is None:
465
626
timeout = self.timeout
466
627
self.last_checked_ok = datetime.datetime.utcnow()
467
gobject.source_remove(self.disable_initiator_tag)
468
self.expires = datetime.datetime.utcnow() + timeout
469
self.disable_initiator_tag = (gobject.timeout_add
470
(_timedelta_to_milliseconds
471
(timeout), self.disable))
628
if self.disable_initiator_tag is not None:
629
gobject.source_remove(self.disable_initiator_tag)
630
if getattr(self, "enabled", False):
631
self.disable_initiator_tag = (gobject.timeout_add
632
(timedelta_to_milliseconds
633
(timeout), self.disable))
634
self.expires = datetime.datetime.utcnow() + timeout
472
635
473
636
def need_approval(self):
474
637
self.last_approval_request = datetime.datetime.utcnow()
689
852
690
853
Note: Will not include properties with access="write".
691
854
"""
692
all = {}
855
properties = {}
693
856
for name, prop in self._get_all_dbus_properties():
694
857
if (interface_name
695
858
and interface_name != prop._dbus_interface):
700
863
continue
701
864
value = prop()
702
865
if not hasattr(value, "variant_level"):
703
all[name] = value
866
properties[name] = value
704
867
continue
705
all[name] = type(value)(value, variant_level=
706
value.variant_level+1)
707
return dbus.Dictionary(all, signature="sv")
868
properties[name] = type(value)(value, variant_level=
869
value.variant_level+1)
870
return dbus.Dictionary(properties, signature="sv")
708
871
709
872
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
710
873
out_signature="s",
761
924
return dbus.String(dt.isoformat(),
762
925
variant_level=variant_level)
763
926
927
764
928
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
765
929
.__metaclass__):
766
930
"""Applied to an empty subclass of a D-Bus object, this metaclass
858
1022
attribute.func_closure)))
859
1023
return type.__new__(mcs, name, bases, attr)
860
1024
1025
861
1026
class ClientDBus(Client, DBusObjectWithProperties):
862
1027
"""A Client class using D-Bus
863
1028
872
1037
# dbus.service.Object doesn't use super(), so we can't either.
873
1038
874
1039
def __init__(self, bus = None, *args, **kwargs):
875
self._approvals_pending = 0
876
1040
self.bus = bus
877
1041
Client.__init__(self, *args, **kwargs)
1042
self._approvals_pending = 0
1043
1044
self._approvals_pending = 0
878
1045
# Only now, when this client is initialized, can it show up on
879
1046
# the D-Bus
880
1047
client_object_name = unicode(self.name).translate(
890
1057
variant_level=1):
891
1058
""" Modify a variable so that it's a property which announces
892
1059
its changes to DBus.
893
894
transform_fun: Function that takes a value and transforms it
895
to a D-Bus type.
1060
1061
transform_fun: Function that takes a value and a variant_level
1062
and transforms it to a D-Bus type.
896
1063
dbus_name: D-Bus name of the variable
897
1064
type_func: Function that transform the value before sending it
898
1065
to the D-Bus. Default: no transform
905
1072
type_func(getattr(self, attrname, None))
906
1073
!= type_func(value)):
907
1074
dbus_value = transform_func(type_func(value),
908
variant_level)
1075
variant_level
1076
=variant_level)
909
1077
self.PropertyChanged(dbus.String(dbus_name),
910
1078
dbus_value)
911
1079
setattr(self, attrname, value)
929
1097
datetime_to_dbus, "LastApprovalRequest")
930
1098
approved_by_default = notifychangeproperty(dbus.Boolean,
931
1099
"ApprovedByDefault")
932
approval_delay = notifychangeproperty(dbus.UInt16,
1100
approval_delay = notifychangeproperty(dbus.UInt64,
933
1101
"ApprovalDelay",
934
1102
type_func =
935
_timedelta_to_milliseconds)
1103
timedelta_to_milliseconds)
936
1104
approval_duration = notifychangeproperty(
937
dbus.UInt16, "ApprovalDuration",
938
type_func = _timedelta_to_milliseconds)
1105
dbus.UInt64, "ApprovalDuration",
1106
type_func = timedelta_to_milliseconds)
939
1107
host = notifychangeproperty(dbus.String, "Host")
940
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1108
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
941
1109
type_func =
942
_timedelta_to_milliseconds)
1110
timedelta_to_milliseconds)
943
1111
extended_timeout = notifychangeproperty(
944
dbus.UInt16, "ExtendedTimeout",
945
type_func = _timedelta_to_milliseconds)
946
interval = notifychangeproperty(dbus.UInt16,
1112
dbus.UInt64, "ExtendedTimeout",
1113
type_func = timedelta_to_milliseconds)
1114
interval = notifychangeproperty(dbus.UInt64,
947
1115
"Interval",
948
1116
type_func =
949
_timedelta_to_milliseconds)
1117
timedelta_to_milliseconds)
950
1118
checker_command = notifychangeproperty(dbus.String, "Checker")
951
1119
952
1120
del notifychangeproperty
994
1162
return r
995
1163
996
1164
def _reset_approved(self):
997
self._approved = None
1165
self.approved = None
998
1166
return False
999
1167
1000
1168
def approve(self, value=True):
1001
1169
self.send_changedstate()
1002
self._approved = value
1003
gobject.timeout_add(_timedelta_to_milliseconds
1170
self.approved = value
1171
gobject.timeout_add(timedelta_to_milliseconds
1004
1172
(self.approval_duration),
1005
1173
self._reset_approved)
1006
1174
1049
1217
"D-Bus signal"
1050
1218
return self.need_approval()
1051
1219
1220
# NeRwequest - signal
1221
@dbus.service.signal(_interface, signature="s")
1222
def NewRequest(self, ip):
1223
"""D-Bus signal
1224
Is sent after a client request a password.
1225
"""
1226
pass
1227
1052
1228
## Methods
1053
1229
1054
1230
# Approve - method
1112
1288
access="readwrite")
1113
1289
def ApprovalDuration_dbus_property(self, value=None):
1114
1290
if value is None: # get
1115
return dbus.UInt64(_timedelta_to_milliseconds(
1291
return dbus.UInt64(timedelta_to_milliseconds(
1116
1292
self.approval_duration))
1117
1293
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1118
1294
1132
1308
def Host_dbus_property(self, value=None):
1133
1309
if value is None: # get
1134
1310
return dbus.String(self.host)
1135
self.host = value
1311
self.host = unicode(value)
1136
1312
1137
1313
# Created - property
1138
1314
@dbus_service_property(_interface, signature="s", access="read")
1139
1315
def Created_dbus_property(self):
1140
return dbus.String(datetime_to_dbus(self.created))
1316
return datetime_to_dbus(self.created)
1141
1317
1142
1318
# LastEnabled - property
1143
1319
@dbus_service_property(_interface, signature="s", access="read")
1187
1363
gobject.source_remove(self.disable_initiator_tag)
1188
1364
self.disable_initiator_tag = None
1189
1365
self.expires = None
1190
time_to_die = (self.
1191
_timedelta_to_milliseconds((self
1192
.last_checked_ok
1193
+ self.timeout)
1194
- datetime.datetime
1195
.utcnow()))
1366
time_to_die = timedelta_to_milliseconds((self
1367
.last_checked_ok
1368
+ self.timeout)
1369
- datetime.datetime
1370
.utcnow())
1196
1371
if time_to_die <= 0:
1197
1372
# The timeout has passed
1198
1373
self.disable()
1220
1395
self.interval = datetime.timedelta(0, 0, 0, value)
1221
1396
if getattr(self, "checker_initiator_tag", None) is None:
1222
1397
return
1223
# Reschedule checker run
1224
gobject.source_remove(self.checker_initiator_tag)
1225
self.checker_initiator_tag = (gobject.timeout_add
1226
(value, self.start_checker))
1227
self.start_checker() # Start one now, too
1398
if self.enabled:
1399
# Reschedule checker run
1400
gobject.source_remove(self.checker_initiator_tag)
1401
self.checker_initiator_tag = (gobject.timeout_add
1402
(value, self.start_checker))
1403
self.start_checker() # Start one now, too
1228
1404
1229
1405
# Checker - property
1230
1406
@dbus_service_property(_interface, signature="s",
1232
1408
def Checker_dbus_property(self, value=None):
1233
1409
if value is None: # get
1234
1410
return dbus.String(self.checker_command)
1235
self.checker_command = value
1411
self.checker_command = unicode(value)
1236
1412
1237
1413
# CheckerRunning - property
1238
1414
@dbus_service_property(_interface, signature="b",
1267
1443
raise KeyError()
1268
1444
1269
1445
def __getattribute__(self, name):
1270
if(name == '_pipe'):
1446
if name == '_pipe':
1271
1447
return super(ProxyClient, self).__getattribute__(name)
1272
1448
self._pipe.send(('getattr', name))
1273
1449
data = self._pipe.recv()
1280
1456
return func
1281
1457
1282
1458
def __setattr__(self, name, value):
1283
if(name == '_pipe'):
1459
if name == '_pipe':
1284
1460
return super(ProxyClient, self).__setattr__(name, value)
1285
1461
self._pipe.send(('setattr', name, value))
1286
1462
1463
1287
1464
class ClientDBusTransitional(ClientDBus):
1288
1465
__metaclass__ = AlternateDBusNamesMetaclass
1289
1466
1467
1290
1468
class ClientHandler(socketserver.BaseRequestHandler, object):
1291
1469
"""A class to handle client connections.
1292
1470
1360
1538
except KeyError:
1361
1539
return
1362
1540
1541
if self.server.use_dbus:
1542
# Emit D-Bus signal
1543
client.NewRequest(str(self.client_address))
1544
1363
1545
if client.approval_delay:
1364
1546
delay = client.approval_delay
1365
1547
client.approvals_pending += 1
1374
1556
client.Rejected("Disabled")
1375
1557
return
1376
1558
1377
if client._approved or not client.approval_delay:
1559
if client.approved or not client.approval_delay:
1378
1560
#We are approved or approval is disabled
1379
1561
break
1380
elif client._approved is None:
1562
elif client.approved is None:
1381
1563
logger.info("Client %s needs approval",
1382
1564
client.name)
1383
1565
if self.server.use_dbus:
1394
1576
return
1395
1577
1396
1578
#wait until timeout or approved
1397
#x = float(client
1398
# ._timedelta_to_milliseconds(delay))
1399
1579
time = datetime.datetime.now()
1400
1580
client.changedstate.acquire()
1401
1581
(client.changedstate.wait
1402
(float(client._timedelta_to_milliseconds(delay)
1582
(float(client.timedelta_to_milliseconds(delay)
1403
1583
/ 1000)))
1404
1584
client.changedstate.release()
1405
1585
time2 = datetime.datetime.now()
1430
1610
sent_size += sent
1431
1611
1432
1612
logger.info("Sending secret to %s", client.name)
1433
# bump the timeout as if seen
1613
# bump the timeout using extended_timeout
1434
1614
client.checked_ok(client.extended_timeout)
1435
1615
if self.server.use_dbus:
1436
1616
# Emit D-Bus signal
1504
1684
# Convert the buffer to a Python bytestring
1505
1685
fpr = ctypes.string_at(buf, buf_len.value)
1506
1686
# Convert the bytestring to hexadecimal notation
1507
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1687
hex_fpr = binascii.hexlify(fpr).upper()
1508
1688
return hex_fpr
1509
1689
1510
1690
1513
1693
def sub_process_main(self, request, address):
1514
1694
try:
1515
1695
self.finish_request(request, address)
1516
except:
1696
except Exception:
1517
1697
self.handle_error(request, address)
1518
1698
self.close_request(request)
1519
1699
1520
1700
def process_request(self, request, address):
1521
1701
"""Start a new process to process the request."""
1522
multiprocessing.Process(target = self.sub_process_main,
1523
args = (request, address)).start()
1702
proc = multiprocessing.Process(target = self.sub_process_main,
1703
args = (request,
1704
address))
1705
proc.start()
1706
return proc
1524
1707
1525
1708
1526
1709
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1532
1715
"""
1533
1716
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1534
1717
1535
super(MultiprocessingMixInWithPipe,
1536
self).process_request(request, client_address)
1718
proc = MultiprocessingMixIn.process_request(self, request,
1719
client_address)
1537
1720
self.child_pipe.close()
1538
self.add_pipe(parent_pipe)
1721
self.add_pipe(parent_pipe, proc)
1539
1722
1540
def add_pipe(self, parent_pipe):
1723
def add_pipe(self, parent_pipe, proc):
1541
1724
"""Dummy function; override as necessary"""
1542
1725
raise NotImplementedError
1543
1726
1621
1804
self.enabled = False
1622
1805
self.clients = clients
1623
1806
if self.clients is None:
1624
self.clients = set()
1807
self.clients = {}
1625
1808
self.use_dbus = use_dbus
1626
1809
self.gnutls_priority = gnutls_priority
1627
1810
IPv6_TCPServer.__init__(self, server_address,
1631
1814
def server_activate(self):
1632
1815
if self.enabled:
1633
1816
return socketserver.TCPServer.server_activate(self)
1817
1634
1818
def enable(self):
1635
1819
self.enabled = True
1636
def add_pipe(self, parent_pipe):
1820
1821
def add_pipe(self, parent_pipe, proc):
1637
1822
# Call "handle_ipc" for both data and EOF events
1638
1823
gobject.io_add_watch(parent_pipe.fileno(),
1639
1824
gobject.IO_IN | gobject.IO_HUP,
1640
1825
functools.partial(self.handle_ipc,
1641
1826
parent_pipe =
1642
parent_pipe))
1643
1827
parent_pipe,
1828
proc = proc))
1829
1644
1830
def handle_ipc(self, source, condition, parent_pipe=None,
1645
client_object=None):
1831
proc = None, client_object=None):
1646
1832
condition_names = {
1647
1833
gobject.IO_IN: "IN", # There is data to read.
1648
1834
gobject.IO_OUT: "OUT", # Data can be written (without
1657
1843
for cond, name in
1658
1844
condition_names.iteritems()
1659
1845
if cond & condition)
1660
# error or the other end of multiprocessing.Pipe has closed
1846
# error, or the other end of multiprocessing.Pipe has closed
1661
1847
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1848
# Wait for other process to exit
1849
proc.join()
1662
1850
return False
1663
1851
1664
1852
# Read a request from the child
1669
1857
fpr = request[1]
1670
1858
address = request[2]
1671
1859
1672
for c in self.clients:
1860
for c in self.clients.itervalues():
1673
1861
if c.fingerprint == fpr:
1674
1862
client = c
1675
1863
break
1688
1876
functools.partial(self.handle_ipc,
1689
1877
parent_pipe =
1690
1878
parent_pipe,
1879
proc = proc,
1691
1880
client_object =
1692
1881
client))
1693
1882
parent_pipe.send(True)
1758
1947
return timevalue
1759
1948
1760
1949
1761
def if_nametoindex(interface):
1762
"""Call the C function if_nametoindex(), or equivalent
1763
1764
Note: This function cannot accept a unicode string."""
1765
global if_nametoindex
1766
try:
1767
if_nametoindex = (ctypes.cdll.LoadLibrary
1768
(ctypes.util.find_library("c"))
1769
.if_nametoindex)
1770
except (OSError, AttributeError):
1771
logger.warning("Doing if_nametoindex the hard way")
1772
def if_nametoindex(interface):
1773
"Get an interface index the hard way, i.e. using fcntl()"
1774
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1775
with contextlib.closing(socket.socket()) as s:
1776
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1777
struct.pack(str("16s16x"),
1778
interface))
1779
interface_index = struct.unpack(str("I"),
1780
ifreq[16:20])[0]
1781
return interface_index
1782
return if_nametoindex(interface)
1783
1784
1785
1950
def daemon(nochdir = False, noclose = False):
1786
1951
"""See daemon(3). Standard BSD Unix function.
1787
1952
1842
2007
" system bus interface")
1843
2008
parser.add_argument("--no-ipv6", action="store_false",
1844
2009
dest="use_ipv6", help="Do not use IPv6")
2010
parser.add_argument("--no-restore", action="store_false",
2011
dest="restore", help="Do not restore stored"
2012
" state")
2013
parser.add_argument("--statedir", metavar="DIR",
2014
help="Directory to save/restore state in")
2015
1845
2016
options = parser.parse_args()
1846
2017
1847
2018
if options.check:
1860
2031
"use_dbus": "True",
1861
2032
"use_ipv6": "True",
1862
2033
"debuglevel": "",
2034
"restore": "True",
2035
"statedir": "/var/lib/mandos"
1863
2036
}
1864
2037
1865
2038
# Parse config file for server-global settings
1882
2055
# options, if set.
1883
2056
for option in ("interface", "address", "port", "debug",
1884
2057
"priority", "servicename", "configdir",
1885
"use_dbus", "use_ipv6", "debuglevel"):
2058
"use_dbus", "use_ipv6", "debuglevel", "restore",
2059
"statedir"):
1886
2060
value = getattr(options, option)
1887
2061
if value is not None:
1888
2062
server_settings[option] = value
1900
2074
debuglevel = server_settings["debuglevel"]
1901
2075
use_dbus = server_settings["use_dbus"]
1902
2076
use_ipv6 = server_settings["use_ipv6"]
2077
stored_state_path = os.path.join(server_settings["statedir"],
2078
stored_state_file)
2079
2080
if debug:
2081
initlogger(logging.DEBUG)
2082
else:
2083
if not debuglevel:
2084
initlogger()
2085
else:
2086
level = getattr(logging, debuglevel.upper())
2087
initlogger(level)
1903
2088
1904
2089
if server_settings["servicename"] != "Mandos":
1905
2090
syslogger.setFormatter(logging.Formatter
1908
2093
% server_settings["servicename"]))
1909
2094
1910
2095
# Parse config file with clients
1911
client_defaults = { "timeout": "5m",
1912
"extended_timeout": "15m",
1913
"interval": "2m",
1914
"checker": "fping -q -- %%(host)s",
1915
"host": "",
1916
"approval_delay": "0s",
1917
"approval_duration": "1s",
1918
}
1919
client_config = configparser.SafeConfigParser(client_defaults)
2096
client_config = configparser.SafeConfigParser(Client.client_defaults)
1920
2097
client_config.read(os.path.join(server_settings["configdir"],
1921
2098
"clients.conf"))
1922
2099
1960
2137
if error[0] != errno.EPERM:
1961
2138
raise error
1962
2139
1963
if not debug and not debuglevel:
1964
syslogger.setLevel(logging.WARNING)
1965
console.setLevel(logging.WARNING)
1966
if debuglevel:
1967
level = getattr(logging, debuglevel.upper())
1968
syslogger.setLevel(level)
1969
console.setLevel(level)
1970
1971
2140
if debug:
1972
2141
# Enable all possible GnuTLS debugging
1973
2142
2015
2184
server_settings["use_dbus"] = False
2016
2185
tcp_server.use_dbus = False
2017
2186
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2018
service = AvahiService(name = server_settings["servicename"],
2019
servicetype = "_mandos._tcp",
2020
protocol = protocol, bus = bus)
2187
service = AvahiServiceToSyslog(name =
2188
server_settings["servicename"],
2189
servicetype = "_mandos._tcp",
2190
protocol = protocol, bus = bus)
2021
2191
if server_settings["interface"]:
2022
2192
service.interface = (if_nametoindex
2023
2193
(str(server_settings["interface"])))
2029
2199
if use_dbus:
2030
2200
client_class = functools.partial(ClientDBusTransitional,
2031
2201
bus = bus)
2032
def client_config_items(config, section):
2033
special_settings = {
2034
"approved_by_default":
2035
lambda: config.getboolean(section,
2036
"approved_by_default"),
2037
}
2038
for name, value in config.items(section):
2202
2203
client_settings = Client.config_parser(client_config)
2204
old_client_settings = {}
2205
clients_data = {}
2206
2207
# Get client data and settings from last running state.
2208
if server_settings["restore"]:
2209
try:
2210
with open(stored_state_path, "rb") as stored_state:
2211
clients_data, old_client_settings = (pickle.load
2212
(stored_state))
2213
os.remove(stored_state_path)
2214
except IOError as e:
2215
logger.warning("Could not load persistent state: {0}"
2216
.format(e))
2217
if e.errno != errno.ENOENT:
2218
raise
2219
2220
with PGPEngine() as pgp:
2221
for client_name, client in clients_data.iteritems():
2222
# Decide which value to use after restoring saved state.
2223
# We have three different values: Old config file,
2224
# new config file, and saved state.
2225
# New config value takes precedence if it differs from old
2226
# config value, otherwise use saved state.
2227
for name, value in client_settings[client_name].items():
2228
try:
2229
# For each value in new config, check if it
2230
# differs from the old config value (Except for
2231
# the "secret" attribute)
2232
if (name != "secret" and
2233
value != old_client_settings[client_name]
2234
[name]):
2235
client[name] = value
2236
except KeyError:
2237
pass
2238
2239
# Clients who has passed its expire date can still be
2240
# enabled if its last checker was successful. Clients
2241
# whose checker failed before we stored its state is
2242
# assumed to have failed all checkers during downtime.
2243
if client["enabled"]:
2244
if datetime.datetime.utcnow() >= client["expires"]:
2245
if not client["last_checked_ok"]:
2246
logger.warning(
2247
"disabling client {0} - Client never "
2248
"performed a successfull checker"
2249
.format(client["name"]))
2250
client["enabled"] = False
2251
elif client["last_checker_status"] != 0:
2252
logger.warning(
2253
"disabling client {0} - Client "
2254
"last checker failed with error code {1}"
2255
.format(client["name"],
2256
client["last_checker_status"]))
2257
client["enabled"] = False
2258
else:
2259
client["expires"] = (datetime.datetime
2260
.utcnow()
2261
+ client["timeout"])
2262
2039
2263
try:
2040
yield (name, special_settings[name]())
2041
except KeyError:
2042
yield (name, value)
2043
2044
tcp_server.clients.update(set(
2045
client_class(name = section,
2046
config= dict(client_config_items(
2047
client_config, section)))
2048
for section in client_config.sections()))
2264
client["secret"] = (
2265
pgp.decrypt(client["encrypted_secret"],
2266
client_settings[client_name]
2267
["secret"]))
2268
except PGPError:
2269
# If decryption fails, we use secret from new settings
2270
logger.debug("Failed to decrypt {0} old secret"
2271
.format(client_name))
2272
client["secret"] = (
2273
client_settings[client_name]["secret"])
2274
2275
2276
# Add/remove clients based on new changes made to config
2277
for client_name in set(old_client_settings) - set(client_settings):
2278
del clients_data[client_name]
2279
for client_name in set(client_settings) - set(old_client_settings):
2280
clients_data[client_name] = client_settings[client_name]
2281
2282
# Create clients all clients
2283
for client_name, client in clients_data.iteritems():
2284
tcp_server.clients[client_name] = client_class(
2285
name = client_name, settings = client)
2286
2049
2287
if not tcp_server.clients:
2050
2288
logger.warning("No clients defined")
2051
2289
2062
2300
# "pidfile" was never created
2063
2301
pass
2064
2302
del pidfilename
2065
2066
2303
signal.signal(signal.SIGINT, signal.SIG_IGN)
2067
2304
2068
2305
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2094
2331
def GetAllClients(self):
2095
2332
"D-Bus method"
2096
2333
return dbus.Array(c.dbus_object_path
2097
for c in tcp_server.clients)
2334
for c in
2335
tcp_server.clients.itervalues())
2098
2336
2099
2337
@dbus.service.method(_interface,
2100
2338
out_signature="a{oa{sv}}")
2102
2340
"D-Bus method"
2103
2341
return dbus.Dictionary(
2104
2342
((c.dbus_object_path, c.GetAll(""))
2105
for c in tcp_server.clients),
2343
for c in tcp_server.clients.itervalues()),
2106
2344
signature="oa{sv}")
2107
2345
2108
2346
@dbus.service.method(_interface, in_signature="o")
2109
2347
def RemoveClient(self, object_path):
2110
2348
"D-Bus method"
2111
for c in tcp_server.clients:
2349
for c in tcp_server.clients.itervalues():
2112
2350
if c.dbus_object_path == object_path:
2113
tcp_server.clients.remove(c)
2351
del tcp_server.clients[c.name]
2114
2352
c.remove_from_connection()
2115
2353
# Don't signal anything except ClientRemoved
2116
2354
c.disable(quiet=True)
2129
2367
"Cleanup function; run on exit"
2130
2368
service.cleanup()
2131
2369
2370
multiprocessing.active_children()
2371
if not (tcp_server.clients or client_settings):
2372
return
2373
2374
# Store client before exiting. Secrets are encrypted with key
2375
# based on what config file has. If config file is
2376
# removed/edited, old secret will thus be unrecovable.
2377
clients = {}
2378
with PGPEngine() as pgp:
2379
for client in tcp_server.clients.itervalues():
2380
key = client_settings[client.name]["secret"]
2381
client.encrypted_secret = pgp.encrypt(client.secret,
2382
key)
2383
client_dict = {}
2384
2385
# A list of attributes that can not be pickled
2386
# + secret.
2387
exclude = set(("bus", "changedstate", "secret",
2388
"checker"))
2389
for name, typ in (inspect.getmembers
2390
(dbus.service.Object)):
2391
exclude.add(name)
2392
2393
client_dict["encrypted_secret"] = (client
2394
.encrypted_secret)
2395
for attr in client.client_structure:
2396
if attr not in exclude:
2397
client_dict[attr] = getattr(client, attr)
2398
2399
clients[client.name] = client_dict
2400
del client_settings[client.name]["secret"]
2401
2402
try:
2403
with os.fdopen(os.open(stored_state_path,
2404
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2405
0600), "wb") as stored_state:
2406
pickle.dump((clients, client_settings), stored_state)
2407
except (IOError, OSError) as e:
2408
logger.warning("Could not save persistent state: {0}"
2409
.format(e))
2410
if e.errno not in (errno.ENOENT, errno.EACCES):
2411
raise
2412
2413
# Delete all clients, and settings from config
2132
2414
while tcp_server.clients:
2133
client = tcp_server.clients.pop()
2415
name, client = tcp_server.clients.popitem()
2134
2416
if use_dbus:
2135
2417
client.remove_from_connection()
2136
client.disable_hook = None
2137
2418
# Don't signal anything except ClientRemoved
2138
2419
client.disable(quiet=True)
2139
2420
if use_dbus:
2141
2422
mandos_dbus_service.ClientRemoved(client
2142
2423
.dbus_object_path,
2143
2424
client.name)
2425
client_settings.clear()
2144
2426
2145
2427
atexit.register(cleanup)
2146
2428
2147
for client in tcp_server.clients:
2429
for client in tcp_server.clients.itervalues():
2148
2430
if use_dbus:
2149
2431
# Emit D-Bus signal
2150
2432
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2151
client.enable()
2433
# Need to initiate checking of clients
2434
if client.enabled:
2435
client.init_checker()
2152
2436
2153
2437
tcp_server.enable()
2154
2438
tcp_server.server_activate()
2194
2478
# Must run before the D-Bus bus name gets deregistered
2195
2479
cleanup()
2196
2480
2197
2198
2481
if __name__ == '__main__':
2199
2482
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0