/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

working new feature: network-hooks - Enables user-scripts to take up
                     interfaces during bootup

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
 
import hashlib
 
66
import binascii
 
67
import tempfile
67
68
 
68
69
import dbus
69
70
import dbus.service
74
75
import ctypes.util
75
76
import xml.dom.minidom
76
77
import inspect
77
 
import Crypto.Cipher.AES
 
78
import GnuPGInterface
78
79
 
79
80
try:
80
81
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
84
85
    except ImportError:
85
86
        SO_BINDTODEVICE = None
86
87
 
87
 
 
88
88
version = "1.4.1"
 
89
stored_state_file = "clients.pickle"
89
90
 
90
91
logger = logging.getLogger()
91
 
stored_state_path = "/var/lib/mandos/clients.pickle"
92
 
 
93
92
syslogger = (logging.handlers.SysLogHandler
94
93
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
95
94
              address = str("/dev/log")))
96
 
syslogger.setFormatter(logging.Formatter
97
 
                       ('Mandos [%(process)d]: %(levelname)s:'
98
 
                        ' %(message)s'))
99
 
logger.addHandler(syslogger)
100
 
 
101
 
console = logging.StreamHandler()
102
 
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
103
 
                                       ' [%(process)d]:'
104
 
                                       ' %(levelname)s:'
105
 
                                       ' %(message)s'))
106
 
logger.addHandler(console)
 
95
 
 
96
try:
 
97
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
98
                      (ctypes.util.find_library("c"))
 
99
                      .if_nametoindex)
 
100
except (OSError, AttributeError):
 
101
    def if_nametoindex(interface):
 
102
        "Get an interface index the hard way, i.e. using fcntl()"
 
103
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
104
        with contextlib.closing(socket.socket()) as s:
 
105
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
106
                                struct.pack(str("16s16x"),
 
107
                                            interface))
 
108
        interface_index = struct.unpack(str("I"),
 
109
                                        ifreq[16:20])[0]
 
110
        return interface_index
 
111
 
 
112
 
 
113
def initlogger(level=logging.WARNING):
 
114
    """init logger and add loglevel"""
 
115
    
 
116
    syslogger.setFormatter(logging.Formatter
 
117
                           ('Mandos [%(process)d]: %(levelname)s:'
 
118
                            ' %(message)s'))
 
119
    logger.addHandler(syslogger)
 
120
    
 
121
    console = logging.StreamHandler()
 
122
    console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
123
                                           ' [%(process)d]:'
 
124
                                           ' %(levelname)s:'
 
125
                                           ' %(message)s'))
 
126
    logger.addHandler(console)
 
127
    logger.setLevel(level)
 
128
 
 
129
 
 
130
class PGPError(Exception):
 
131
    """Exception if encryption/decryption fails"""
 
132
    pass
 
133
 
 
134
 
 
135
class PGPEngine(object):
 
136
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
137
    def __init__(self):
 
138
        self.gnupg = GnuPGInterface.GnuPG()
 
139
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
140
        self.gnupg = GnuPGInterface.GnuPG()
 
141
        self.gnupg.options.meta_interactive = False
 
142
        self.gnupg.options.homedir = self.tempdir
 
143
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
144
                                              '--quiet'])
 
145
    
 
146
    def __enter__(self):
 
147
        return self
 
148
    
 
149
    def __exit__ (self, exc_type, exc_value, traceback):
 
150
        self._cleanup()
 
151
        return False
 
152
    
 
153
    def __del__(self):
 
154
        self._cleanup()
 
155
    
 
156
    def _cleanup(self):
 
157
        if self.tempdir is not None:
 
158
            # Delete contents of tempdir
 
159
            for root, dirs, files in os.walk(self.tempdir,
 
160
                                             topdown = False):
 
161
                for filename in files:
 
162
                    os.remove(os.path.join(root, filename))
 
163
                for dirname in dirs:
 
164
                    os.rmdir(os.path.join(root, dirname))
 
165
            # Remove tempdir
 
166
            os.rmdir(self.tempdir)
 
167
            self.tempdir = None
 
168
    
 
169
    def password_encode(self, password):
 
170
        # Passphrase can not be empty and can not contain newlines or
 
171
        # NUL bytes.  So we prefix it and hex encode it.
 
172
        return b"mandos" + binascii.hexlify(password)
 
173
    
 
174
    def encrypt(self, data, password):
 
175
        self.gnupg.passphrase = self.password_encode(password)
 
176
        with open(os.devnull) as devnull:
 
177
            try:
 
178
                proc = self.gnupg.run(['--symmetric'],
 
179
                                      create_fhs=['stdin', 'stdout'],
 
180
                                      attach_fhs={'stderr': devnull})
 
181
                with contextlib.closing(proc.handles['stdin']) as f:
 
182
                    f.write(data)
 
183
                with contextlib.closing(proc.handles['stdout']) as f:
 
184
                    ciphertext = f.read()
 
185
                proc.wait()
 
186
            except IOError as e:
 
187
                raise PGPError(e)
 
188
        self.gnupg.passphrase = None
 
189
        return ciphertext
 
190
    
 
191
    def decrypt(self, data, password):
 
192
        self.gnupg.passphrase = self.password_encode(password)
 
193
        with open(os.devnull) as devnull:
 
194
            try:
 
195
                proc = self.gnupg.run(['--decrypt'],
 
196
                                      create_fhs=['stdin', 'stdout'],
 
197
                                      attach_fhs={'stderr': devnull})
 
198
                with contextlib.closing(proc.handles['stdin'] ) as f:
 
199
                    f.write(data)
 
200
                with contextlib.closing(proc.handles['stdout']) as f:
 
201
                    decrypted_plaintext = f.read()
 
202
                proc.wait()
 
203
            except IOError as e:
 
204
                raise PGPError(e)
 
205
        self.gnupg.passphrase = None
 
206
        return decrypted_plaintext
 
207
 
107
208
 
108
209
 
109
210
class AvahiError(Exception):
226
327
            try:
227
328
                self.group.Free()
228
329
            except (dbus.exceptions.UnknownMethodException,
229
 
                    dbus.exceptions.DBusException) as e:
 
330
                    dbus.exceptions.DBusException):
230
331
                pass
231
332
            self.group = None
232
333
        self.remove()
276
377
                                % self.name))
277
378
        return ret
278
379
 
279
 
def _timedelta_to_milliseconds(td):
 
380
def timedelta_to_milliseconds(td):
280
381
    "Convert a datetime.timedelta() to milliseconds"
281
382
    return ((td.days * 24 * 60 * 60 * 1000)
282
383
            + (td.seconds * 1000)
286
387
    """A representation of a client host served by this server.
287
388
    
288
389
    Attributes:
289
 
    _approved:   bool(); 'None' if not yet approved/disapproved
 
390
    approved:   bool(); 'None' if not yet approved/disapproved
290
391
    approval_delay: datetime.timedelta(); Time to wait for approval
291
392
    approval_duration: datetime.timedelta(); Duration of one approval
292
393
    checker:    subprocess.Popen(); a running checker process used
310
411
    interval:   datetime.timedelta(); How often to start a new checker
311
412
    last_approval_request: datetime.datetime(); (UTC) or None
312
413
    last_checked_ok: datetime.datetime(); (UTC) or None
313
 
    last_checker_status: integer between 0 and 255 reflecting exit status
314
 
                         of last checker. -1 reflect crashed checker,
315
 
                         or None.
316
 
    last_enabled: datetime.datetime(); (UTC)
 
414
    last_checker_status: integer between 0 and 255 reflecting exit
 
415
                         status of last checker. -1 reflects crashed
 
416
                         checker, or None.
 
417
    last_enabled: datetime.datetime(); (UTC) or None
317
418
    name:       string; from the config file, used in log messages and
318
419
                        D-Bus identifiers
319
420
    secret:     bytestring; sent verbatim (over TLS) to client
329
430
                          "created", "enabled", "fingerprint",
330
431
                          "host", "interval", "last_checked_ok",
331
432
                          "last_enabled", "name", "timeout")
 
433
    client_defaults = { "timeout": "5m",
 
434
                        "extended_timeout": "15m",
 
435
                        "interval": "2m",
 
436
                        "checker": "fping -q -- %%(host)s",
 
437
                        "host": "",
 
438
                        "approval_delay": "0s",
 
439
                        "approval_duration": "1s",
 
440
                        "approved_by_default": "True",
 
441
                        "enabled": "True",
 
442
                        }
332
443
    
333
444
    def timeout_milliseconds(self):
334
445
        "Return the 'timeout' attribute in milliseconds"
335
 
        return _timedelta_to_milliseconds(self.timeout)
 
446
        return timedelta_to_milliseconds(self.timeout)
336
447
    
337
448
    def extended_timeout_milliseconds(self):
338
449
        "Return the 'extended_timeout' attribute in milliseconds"
339
 
        return _timedelta_to_milliseconds(self.extended_timeout)
 
450
        return timedelta_to_milliseconds(self.extended_timeout)
340
451
    
341
452
    def interval_milliseconds(self):
342
453
        "Return the 'interval' attribute in milliseconds"
343
 
        return _timedelta_to_milliseconds(self.interval)
 
454
        return timedelta_to_milliseconds(self.interval)
344
455
    
345
456
    def approval_delay_milliseconds(self):
346
 
        return _timedelta_to_milliseconds(self.approval_delay)
347
 
    
348
 
    def __init__(self, name = None, config=None):
 
457
        return timedelta_to_milliseconds(self.approval_delay)
 
458
 
 
459
    @staticmethod
 
460
    def config_parser(config):
 
461
        """ Construct a new dict of client settings of this form:
 
462
        { client_name: {setting_name: value, ...}, ...}
 
463
        with exceptions for any special settings as defined above"""
 
464
        settings = {}
 
465
        for client_name in config.sections():
 
466
            section = dict(config.items(client_name))
 
467
            client = settings[client_name] = {}
 
468
            
 
469
            client["host"] = section["host"]
 
470
            # Reformat values from string types to Python types
 
471
            client["approved_by_default"] = config.getboolean(
 
472
                client_name, "approved_by_default")
 
473
            client["enabled"] = config.getboolean(client_name, "enabled")
 
474
            
 
475
            client["fingerprint"] = (section["fingerprint"].upper()
 
476
                                     .replace(" ", ""))
 
477
            if "secret" in section:
 
478
                client["secret"] = section["secret"].decode("base64")
 
479
            elif "secfile" in section:
 
480
                with open(os.path.expanduser(os.path.expandvars
 
481
                                             (section["secfile"])),
 
482
                          "rb") as secfile:
 
483
                    client["secret"] = secfile.read()
 
484
            else:
 
485
                raise TypeError("No secret or secfile for section %s"
 
486
                                % section)
 
487
            client["timeout"] = string_to_delta(section["timeout"])
 
488
            client["extended_timeout"] = string_to_delta(
 
489
                section["extended_timeout"])
 
490
            client["interval"] = string_to_delta(section["interval"])
 
491
            client["approval_delay"] = string_to_delta(
 
492
                section["approval_delay"])
 
493
            client["approval_duration"] = string_to_delta(
 
494
                section["approval_duration"])
 
495
            client["checker_command"] = section["checker"]
 
496
            client["last_approval_request"] = None
 
497
            client["last_checked_ok"] = None
 
498
            client["last_checker_status"] = None
 
499
            if client["enabled"]:
 
500
                client["last_enabled"] = datetime.datetime.utcnow()
 
501
                client["expires"] = (datetime.datetime.utcnow()
 
502
                                     + client["timeout"])
 
503
            else:
 
504
                client["last_enabled"] = None
 
505
                client["expires"] = None
 
506
 
 
507
        return settings
 
508
        
 
509
        
 
510
    def __init__(self, settings, name = None):
349
511
        """Note: the 'checker' key in 'config' sets the
350
512
        'checker_command' attribute and *not* the 'checker'
351
513
        attribute."""
352
514
        self.name = name
353
 
        if config is None:
354
 
            config = {}
 
515
        # adding all client settings
 
516
        for setting, value in settings.iteritems():
 
517
            setattr(self, setting, value)
 
518
        
355
519
        logger.debug("Creating client %r", self.name)
356
520
        # Uppercase and remove spaces from fingerprint for later
357
521
        # comparison purposes with return value from the fingerprint()
358
522
        # function
359
 
        self.fingerprint = (config["fingerprint"].upper()
360
 
                            .replace(" ", ""))
361
523
        logger.debug("  Fingerprint: %s", self.fingerprint)
362
 
        if "secret" in config:
363
 
            self.secret = config["secret"].decode("base64")
364
 
        elif "secfile" in config:
365
 
            with open(os.path.expanduser(os.path.expandvars
366
 
                                         (config["secfile"])),
367
 
                      "rb") as secfile:
368
 
                self.secret = secfile.read()
369
 
        else:
370
 
            raise TypeError("No secret or secfile for client %s"
371
 
                            % self.name)
372
 
        self.host = config.get("host", "")
373
 
        self.created = datetime.datetime.utcnow()
374
 
        self.enabled = True
375
 
        self.last_approval_request = None
376
 
        self.last_enabled = datetime.datetime.utcnow()
377
 
        self.last_checked_ok = None
378
 
        self.last_checker_status = None
379
 
        self.timeout = string_to_delta(config["timeout"])
380
 
        self.extended_timeout = string_to_delta(config
381
 
                                                ["extended_timeout"])
382
 
        self.interval = string_to_delta(config["interval"])
 
524
        self.created = settings.get("created", datetime.datetime.utcnow())
 
525
 
 
526
        # attributes specific for this server instance
383
527
        self.checker = None
384
528
        self.checker_initiator_tag = None
385
529
        self.disable_initiator_tag = None
386
 
        self.expires = datetime.datetime.utcnow() + self.timeout
387
530
        self.checker_callback_tag = None
388
 
        self.checker_command = config["checker"]
389
531
        self.current_checker_command = None
390
 
        self._approved = None
391
 
        self.approved_by_default = config.get("approved_by_default",
392
 
                                              True)
 
532
        self.approved = None
393
533
        self.approvals_pending = 0
394
 
        self.approval_delay = string_to_delta(
395
 
            config["approval_delay"])
396
 
        self.approval_duration = string_to_delta(
397
 
            config["approval_duration"])
398
534
        self.changedstate = (multiprocessing_manager
399
535
                             .Condition(multiprocessing_manager
400
536
                                        .Lock()))
401
 
        self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]
 
537
        self.client_structure = [attr for attr in
 
538
                                 self.__dict__.iterkeys()
 
539
                                 if not attr.startswith("_")]
402
540
        self.client_structure.append("client_structure")
403
 
 
404
 
 
 
541
        
405
542
        for name, t in inspect.getmembers(type(self),
406
 
                                          lambda obj: isinstance(obj, property)):
 
543
                                          lambda obj:
 
544
                                              isinstance(obj,
 
545
                                                         property)):
407
546
            if not name.startswith("_"):
408
547
                self.client_structure.append(name)
409
548
    
445
584
    
446
585
    def __del__(self):
447
586
        self.disable()
448
 
 
 
587
    
449
588
    def init_checker(self):
450
589
        # Schedule a new checker to be started an 'interval' from now,
451
590
        # and every interval from then on.
458
597
                                    self.disable))
459
598
        # Also start a new checker *right now*.
460
599
        self.start_checker()
461
 
 
462
 
        
 
600
    
463
601
    def checker_callback(self, pid, condition, command):
464
602
        """The checker has completed, so take appropriate actions."""
465
603
        self.checker_callback_tag = None
466
604
        self.checker = None
467
605
        if os.WIFEXITED(condition):
468
 
            self.last_checker_status =  os.WEXITSTATUS(condition)
 
606
            self.last_checker_status = os.WEXITSTATUS(condition)
469
607
            if self.last_checker_status == 0:
470
608
                logger.info("Checker for %(name)s succeeded",
471
609
                            vars(self))
491
629
            gobject.source_remove(self.disable_initiator_tag)
492
630
        if getattr(self, "enabled", False):
493
631
            self.disable_initiator_tag = (gobject.timeout_add
494
 
                                          (_timedelta_to_milliseconds
 
632
                                          (timedelta_to_milliseconds
495
633
                                           (timeout), self.disable))
496
634
            self.expires = datetime.datetime.utcnow() + timeout
497
635
    
591
729
                raise
592
730
        self.checker = None
593
731
 
594
 
    # Encrypts a client secret and stores it in a varible encrypted_secret
595
 
    def encrypt_secret(self, key):
596
 
        # Encryption-key need to be of a specific size, so we hash inputed key
597
 
        hasheng = hashlib.sha256()
598
 
        hasheng.update(key)
599
 
        encryptionkey = hasheng.digest()
600
 
 
601
 
        # Create validation hash so we know at decryption if it was sucessful
602
 
        hasheng = hashlib.sha256()
603
 
        hasheng.update(self.secret)
604
 
        validationhash = hasheng.digest()
605
 
 
606
 
        # Encrypt secret
607
 
        iv = os.urandom(Crypto.Cipher.AES.block_size)
608
 
        ciphereng = Crypto.Cipher.AES.new(encryptionkey,
609
 
                                        Crypto.Cipher.AES.MODE_CFB, iv)
610
 
        ciphertext = ciphereng.encrypt(validationhash+self.secret)
611
 
        self.encrypted_secret = (ciphertext, iv)
612
 
 
613
 
    # Decrypt a encrypted client secret
614
 
    def decrypt_secret(self, key):
615
 
        # Decryption-key need to be of a specific size, so we hash inputed key
616
 
        hasheng = hashlib.sha256()
617
 
        hasheng.update(key)
618
 
        encryptionkey = hasheng.digest()
619
 
 
620
 
        # Decrypt encrypted secret
621
 
        ciphertext, iv = self.encrypted_secret
622
 
        ciphereng = Crypto.Cipher.AES.new(encryptionkey,
623
 
                                        Crypto.Cipher.AES.MODE_CFB, iv)
624
 
        plain = ciphereng.decrypt(ciphertext)
625
 
 
626
 
        # Validate decrypted secret to know if it was succesful
627
 
        hasheng = hashlib.sha256()
628
 
        validationhash = plain[:hasheng.digest_size]
629
 
        secret = plain[hasheng.digest_size:]
630
 
        hasheng.update(secret)
631
 
 
632
 
        # if validation fails, we use key as new secret. Otherwhise, we use
633
 
        # the decrypted secret
634
 
        if hasheng.digest() == validationhash:
635
 
            self.secret = secret
636
 
        else:
637
 
            self.secret = key
638
 
        del self.encrypted_secret
639
 
 
640
732
 
641
733
def dbus_service_property(dbus_interface, signature="v",
642
734
                          access="readwrite", byte_arrays=False):
760
852
        
761
853
        Note: Will not include properties with access="write".
762
854
        """
763
 
        all = {}
 
855
        properties = {}
764
856
        for name, prop in self._get_all_dbus_properties():
765
857
            if (interface_name
766
858
                and interface_name != prop._dbus_interface):
771
863
                continue
772
864
            value = prop()
773
865
            if not hasattr(value, "variant_level"):
774
 
                all[name] = value
 
866
                properties[name] = value
775
867
                continue
776
 
            all[name] = type(value)(value, variant_level=
777
 
                                    value.variant_level+1)
778
 
        return dbus.Dictionary(all, signature="sv")
 
868
            properties[name] = type(value)(value, variant_level=
 
869
                                           value.variant_level+1)
 
870
        return dbus.Dictionary(properties, signature="sv")
779
871
    
780
872
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
781
873
                         out_signature="s",
832
924
    return dbus.String(dt.isoformat(),
833
925
                       variant_level=variant_level)
834
926
 
 
927
 
835
928
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
836
929
                                  .__metaclass__):
837
930
    """Applied to an empty subclass of a D-Bus object, this metaclass
929
1022
                                        attribute.func_closure)))
930
1023
        return type.__new__(mcs, name, bases, attr)
931
1024
 
 
1025
 
932
1026
class ClientDBus(Client, DBusObjectWithProperties):
933
1027
    """A Client class using D-Bus
934
1028
    
945
1039
    def __init__(self, bus = None, *args, **kwargs):
946
1040
        self.bus = bus
947
1041
        Client.__init__(self, *args, **kwargs)
948
 
 
 
1042
        self._approvals_pending = 0
 
1043
        
949
1044
        self._approvals_pending = 0
950
1045
        # Only now, when this client is initialized, can it show up on
951
1046
        # the D-Bus
962
1057
                             variant_level=1):
963
1058
        """ Modify a variable so that it's a property which announces
964
1059
        its changes to DBus.
965
 
 
 
1060
        
966
1061
        transform_fun: Function that takes a value and a variant_level
967
1062
                       and transforms it to a D-Bus type.
968
1063
        dbus_name: D-Bus name of the variable
1002
1097
        datetime_to_dbus, "LastApprovalRequest")
1003
1098
    approved_by_default = notifychangeproperty(dbus.Boolean,
1004
1099
                                               "ApprovedByDefault")
1005
 
    approval_delay = notifychangeproperty(dbus.UInt16,
 
1100
    approval_delay = notifychangeproperty(dbus.UInt64,
1006
1101
                                          "ApprovalDelay",
1007
1102
                                          type_func =
1008
 
                                          _timedelta_to_milliseconds)
 
1103
                                          timedelta_to_milliseconds)
1009
1104
    approval_duration = notifychangeproperty(
1010
 
        dbus.UInt16, "ApprovalDuration",
1011
 
        type_func = _timedelta_to_milliseconds)
 
1105
        dbus.UInt64, "ApprovalDuration",
 
1106
        type_func = timedelta_to_milliseconds)
1012
1107
    host = notifychangeproperty(dbus.String, "Host")
1013
 
    timeout = notifychangeproperty(dbus.UInt16, "Timeout",
 
1108
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1014
1109
                                   type_func =
1015
 
                                   _timedelta_to_milliseconds)
 
1110
                                   timedelta_to_milliseconds)
1016
1111
    extended_timeout = notifychangeproperty(
1017
 
        dbus.UInt16, "ExtendedTimeout",
1018
 
        type_func = _timedelta_to_milliseconds)
1019
 
    interval = notifychangeproperty(dbus.UInt16,
 
1112
        dbus.UInt64, "ExtendedTimeout",
 
1113
        type_func = timedelta_to_milliseconds)
 
1114
    interval = notifychangeproperty(dbus.UInt64,
1020
1115
                                    "Interval",
1021
1116
                                    type_func =
1022
 
                                    _timedelta_to_milliseconds)
 
1117
                                    timedelta_to_milliseconds)
1023
1118
    checker_command = notifychangeproperty(dbus.String, "Checker")
1024
1119
    
1025
1120
    del notifychangeproperty
1067
1162
        return r
1068
1163
    
1069
1164
    def _reset_approved(self):
1070
 
        self._approved = None
 
1165
        self.approved = None
1071
1166
        return False
1072
1167
    
1073
1168
    def approve(self, value=True):
1074
1169
        self.send_changedstate()
1075
 
        self._approved = value
1076
 
        gobject.timeout_add(_timedelta_to_milliseconds
 
1170
        self.approved = value
 
1171
        gobject.timeout_add(timedelta_to_milliseconds
1077
1172
                            (self.approval_duration),
1078
1173
                            self._reset_approved)
1079
1174
    
1122
1217
        "D-Bus signal"
1123
1218
        return self.need_approval()
1124
1219
    
 
1220
    # NeRwequest - signal
 
1221
    @dbus.service.signal(_interface, signature="s")
 
1222
    def NewRequest(self, ip):
 
1223
        """D-Bus signal
 
1224
        Is sent after a client request a password.
 
1225
        """
 
1226
        pass
 
1227
    
1125
1228
    ## Methods
1126
1229
    
1127
1230
    # Approve - method
1185
1288
                           access="readwrite")
1186
1289
    def ApprovalDuration_dbus_property(self, value=None):
1187
1290
        if value is None:       # get
1188
 
            return dbus.UInt64(_timedelta_to_milliseconds(
 
1291
            return dbus.UInt64(timedelta_to_milliseconds(
1189
1292
                    self.approval_duration))
1190
1293
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1191
1294
    
1205
1308
    def Host_dbus_property(self, value=None):
1206
1309
        if value is None:       # get
1207
1310
            return dbus.String(self.host)
1208
 
        self.host = value
 
1311
        self.host = unicode(value)
1209
1312
    
1210
1313
    # Created - property
1211
1314
    @dbus_service_property(_interface, signature="s", access="read")
1212
1315
    def Created_dbus_property(self):
1213
 
        return dbus.String(datetime_to_dbus(self.created))
 
1316
        return datetime_to_dbus(self.created)
1214
1317
    
1215
1318
    # LastEnabled - property
1216
1319
    @dbus_service_property(_interface, signature="s", access="read")
1260
1363
        gobject.source_remove(self.disable_initiator_tag)
1261
1364
        self.disable_initiator_tag = None
1262
1365
        self.expires = None
1263
 
        time_to_die = _timedelta_to_milliseconds((self
1264
 
                                                  .last_checked_ok
1265
 
                                                  + self.timeout)
1266
 
                                                 - datetime.datetime
1267
 
                                                 .utcnow())
 
1366
        time_to_die = timedelta_to_milliseconds((self
 
1367
                                                 .last_checked_ok
 
1368
                                                 + self.timeout)
 
1369
                                                - datetime.datetime
 
1370
                                                .utcnow())
1268
1371
        if time_to_die <= 0:
1269
1372
            # The timeout has passed
1270
1373
            self.disable()
1292
1395
        self.interval = datetime.timedelta(0, 0, 0, value)
1293
1396
        if getattr(self, "checker_initiator_tag", None) is None:
1294
1397
            return
1295
 
        # Reschedule checker run
1296
 
        gobject.source_remove(self.checker_initiator_tag)
1297
 
        self.checker_initiator_tag = (gobject.timeout_add
1298
 
                                      (value, self.start_checker))
1299
 
        self.start_checker()    # Start one now, too
 
1398
        if self.enabled:
 
1399
            # Reschedule checker run
 
1400
            gobject.source_remove(self.checker_initiator_tag)
 
1401
            self.checker_initiator_tag = (gobject.timeout_add
 
1402
                                          (value, self.start_checker))
 
1403
            self.start_checker()    # Start one now, too
1300
1404
    
1301
1405
    # Checker - property
1302
1406
    @dbus_service_property(_interface, signature="s",
1304
1408
    def Checker_dbus_property(self, value=None):
1305
1409
        if value is None:       # get
1306
1410
            return dbus.String(self.checker_command)
1307
 
        self.checker_command = value
 
1411
        self.checker_command = unicode(value)
1308
1412
    
1309
1413
    # CheckerRunning - property
1310
1414
    @dbus_service_property(_interface, signature="b",
1339
1443
            raise KeyError()
1340
1444
    
1341
1445
    def __getattribute__(self, name):
1342
 
        if(name == '_pipe'):
 
1446
        if name == '_pipe':
1343
1447
            return super(ProxyClient, self).__getattribute__(name)
1344
1448
        self._pipe.send(('getattr', name))
1345
1449
        data = self._pipe.recv()
1352
1456
            return func
1353
1457
    
1354
1458
    def __setattr__(self, name, value):
1355
 
        if(name == '_pipe'):
 
1459
        if name == '_pipe':
1356
1460
            return super(ProxyClient, self).__setattr__(name, value)
1357
1461
        self._pipe.send(('setattr', name, value))
1358
1462
 
 
1463
 
1359
1464
class ClientDBusTransitional(ClientDBus):
1360
1465
    __metaclass__ = AlternateDBusNamesMetaclass
1361
1466
 
 
1467
 
1362
1468
class ClientHandler(socketserver.BaseRequestHandler, object):
1363
1469
    """A class to handle client connections.
1364
1470
    
1432
1538
                except KeyError:
1433
1539
                    return
1434
1540
                
 
1541
                if self.server.use_dbus:
 
1542
                    # Emit D-Bus signal
 
1543
                    client.NewRequest(str(self.client_address))
 
1544
                
1435
1545
                if client.approval_delay:
1436
1546
                    delay = client.approval_delay
1437
1547
                    client.approvals_pending += 1
1446
1556
                            client.Rejected("Disabled")
1447
1557
                        return
1448
1558
                    
1449
 
                    if client._approved or not client.approval_delay:
 
1559
                    if client.approved or not client.approval_delay:
1450
1560
                        #We are approved or approval is disabled
1451
1561
                        break
1452
 
                    elif client._approved is None:
 
1562
                    elif client.approved is None:
1453
1563
                        logger.info("Client %s needs approval",
1454
1564
                                    client.name)
1455
1565
                        if self.server.use_dbus:
1469
1579
                    time = datetime.datetime.now()
1470
1580
                    client.changedstate.acquire()
1471
1581
                    (client.changedstate.wait
1472
 
                     (float(client._timedelta_to_milliseconds(delay)
 
1582
                     (float(client.timedelta_to_milliseconds(delay)
1473
1583
                            / 1000)))
1474
1584
                    client.changedstate.release()
1475
1585
                    time2 = datetime.datetime.now()
1574
1684
        # Convert the buffer to a Python bytestring
1575
1685
        fpr = ctypes.string_at(buf, buf_len.value)
1576
1686
        # Convert the bytestring to hexadecimal notation
1577
 
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
1687
        hex_fpr = binascii.hexlify(fpr).upper()
1578
1688
        return hex_fpr
1579
1689
 
1580
1690
 
1583
1693
    def sub_process_main(self, request, address):
1584
1694
        try:
1585
1695
            self.finish_request(request, address)
1586
 
        except:
 
1696
        except Exception:
1587
1697
            self.handle_error(request, address)
1588
1698
        self.close_request(request)
1589
1699
    
1837
1947
    return timevalue
1838
1948
 
1839
1949
 
1840
 
def if_nametoindex(interface):
1841
 
    """Call the C function if_nametoindex(), or equivalent
1842
 
    
1843
 
    Note: This function cannot accept a unicode string."""
1844
 
    global if_nametoindex
1845
 
    try:
1846
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1847
 
                          (ctypes.util.find_library("c"))
1848
 
                          .if_nametoindex)
1849
 
    except (OSError, AttributeError):
1850
 
        logger.warning("Doing if_nametoindex the hard way")
1851
 
        def if_nametoindex(interface):
1852
 
            "Get an interface index the hard way, i.e. using fcntl()"
1853
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1854
 
            with contextlib.closing(socket.socket()) as s:
1855
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1856
 
                                    struct.pack(str("16s16x"),
1857
 
                                                interface))
1858
 
            interface_index = struct.unpack(str("I"),
1859
 
                                            ifreq[16:20])[0]
1860
 
            return interface_index
1861
 
    return if_nametoindex(interface)
1862
 
 
1863
 
 
1864
1950
def daemon(nochdir = False, noclose = False):
1865
1951
    """See daemon(3).  Standard BSD Unix function.
1866
1952
    
1922
2008
    parser.add_argument("--no-ipv6", action="store_false",
1923
2009
                        dest="use_ipv6", help="Do not use IPv6")
1924
2010
    parser.add_argument("--no-restore", action="store_false",
1925
 
                        dest="restore", help="Do not restore stored state",
1926
 
                        default=True)
1927
 
 
 
2011
                        dest="restore", help="Do not restore stored"
 
2012
                        " state")
 
2013
    parser.add_argument("--statedir", metavar="DIR",
 
2014
                        help="Directory to save/restore state in")
 
2015
    
1928
2016
    options = parser.parse_args()
1929
2017
    
1930
2018
    if options.check:
1943
2031
                        "use_dbus": "True",
1944
2032
                        "use_ipv6": "True",
1945
2033
                        "debuglevel": "",
 
2034
                        "restore": "True",
 
2035
                        "statedir": "/var/lib/mandos"
1946
2036
                        }
1947
2037
    
1948
2038
    # Parse config file for server-global settings
1965
2055
    # options, if set.
1966
2056
    for option in ("interface", "address", "port", "debug",
1967
2057
                   "priority", "servicename", "configdir",
1968
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore"):
 
2058
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2059
                   "statedir"):
1969
2060
        value = getattr(options, option)
1970
2061
        if value is not None:
1971
2062
            server_settings[option] = value
1983
2074
    debuglevel = server_settings["debuglevel"]
1984
2075
    use_dbus = server_settings["use_dbus"]
1985
2076
    use_ipv6 = server_settings["use_ipv6"]
 
2077
    stored_state_path = os.path.join(server_settings["statedir"],
 
2078
                                     stored_state_file)
 
2079
    
 
2080
    if debug:
 
2081
        initlogger(logging.DEBUG)
 
2082
    else:
 
2083
        if not debuglevel:
 
2084
            initlogger()
 
2085
        else:
 
2086
            level = getattr(logging, debuglevel.upper())
 
2087
            initlogger(level)
1986
2088
    
1987
2089
    if server_settings["servicename"] != "Mandos":
1988
2090
        syslogger.setFormatter(logging.Formatter
1991
2093
                                % server_settings["servicename"]))
1992
2094
    
1993
2095
    # Parse config file with clients
1994
 
    client_defaults = { "timeout": "5m",
1995
 
                        "extended_timeout": "15m",
1996
 
                        "interval": "2m",
1997
 
                        "checker": "fping -q -- %%(host)s",
1998
 
                        "host": "",
1999
 
                        "approval_delay": "0s",
2000
 
                        "approval_duration": "1s",
2001
 
                        }
2002
 
    client_config = configparser.SafeConfigParser(client_defaults)
 
2096
    client_config = configparser.SafeConfigParser(Client.client_defaults)
2003
2097
    client_config.read(os.path.join(server_settings["configdir"],
2004
2098
                                    "clients.conf"))
2005
2099
    
2043
2137
        if error[0] != errno.EPERM:
2044
2138
            raise error
2045
2139
    
2046
 
    if not debug and not debuglevel:
2047
 
        logger.setLevel(logging.WARNING)
2048
 
    if debuglevel:
2049
 
        level = getattr(logging, debuglevel.upper())
2050
 
        logger.setLevel(level)
2051
 
    
2052
2140
    if debug:
2053
 
        logger.setLevel(logging.DEBUG)
2054
2141
        # Enable all possible GnuTLS debugging
2055
2142
        
2056
2143
        # "Use a log level over 10 to enable all debugging options."
2113
2200
        client_class = functools.partial(ClientDBusTransitional,
2114
2201
                                         bus = bus)
2115
2202
    
2116
 
    special_settings = {
2117
 
        # Some settings need to be accessd by special methods;
2118
 
        # booleans need .getboolean(), etc.  Here is a list of them:
2119
 
        "approved_by_default":
2120
 
            lambda section:
2121
 
            client_config.getboolean(section, "approved_by_default"),
2122
 
        }
2123
 
    # Construct a new dict of client settings of this form:
2124
 
    # { client_name: {setting_name: value, ...}, ...}
2125
 
    # with exceptions for any special settings as defined above
2126
 
    client_settings = dict((clientname,
2127
 
                           dict((setting,
2128
 
                                 (value if setting not in special_settings
2129
 
                                  else special_settings[setting](clientname)))
2130
 
                                for setting, value in client_config.items(clientname)))
2131
 
                          for clientname in client_config.sections())
2132
 
    
 
2203
    client_settings = Client.config_parser(client_config)
2133
2204
    old_client_settings = {}
2134
 
    clients_data = []
2135
 
 
2136
 
    # Get client data and settings from last running state. 
 
2205
    clients_data = {}
 
2206
    
 
2207
    # Get client data and settings from last running state.
2137
2208
    if server_settings["restore"]:
2138
2209
        try:
2139
2210
            with open(stored_state_path, "rb") as stored_state:
2140
 
                clients_data, old_client_settings = pickle.load(stored_state)
 
2211
                clients_data, old_client_settings = (pickle.load
 
2212
                                                     (stored_state))
2141
2213
            os.remove(stored_state_path)
2142
2214
        except IOError as e:
2143
 
            logger.warning("Could not load persistant state: {0}".format(e))
 
2215
            logger.warning("Could not load persistent state: {0}"
 
2216
                           .format(e))
2144
2217
            if e.errno != errno.ENOENT:
2145
2218
                raise
2146
 
 
2147
 
    for client in clients_data:
2148
 
        client_name = client["name"]
2149
 
        
2150
 
        # Decide which value to use after restoring saved state.
2151
 
        # We have three different values: Old config file,
2152
 
        # new config file, and saved state.
2153
 
        # New config value takes precedence if it differs from old
2154
 
        # config value, otherwise use saved state.
2155
 
        for name, value in client_settings[client_name].items():
 
2219
    
 
2220
    with PGPEngine() as pgp:
 
2221
        for client_name, client in clients_data.iteritems():
 
2222
            # Decide which value to use after restoring saved state.
 
2223
            # We have three different values: Old config file,
 
2224
            # new config file, and saved state.
 
2225
            # New config value takes precedence if it differs from old
 
2226
            # config value, otherwise use saved state.
 
2227
            for name, value in client_settings[client_name].items():
 
2228
                try:
 
2229
                    # For each value in new config, check if it
 
2230
                    # differs from the old config value (Except for
 
2231
                    # the "secret" attribute)
 
2232
                    if (name != "secret" and
 
2233
                        value != old_client_settings[client_name]
 
2234
                        [name]):
 
2235
                        client[name] = value
 
2236
                except KeyError:
 
2237
                    pass
 
2238
            
 
2239
            # Clients who has passed its expire date can still be
 
2240
            # enabled if its last checker was successful.  Clients
 
2241
            # whose checker failed before we stored its state is
 
2242
            # assumed to have failed all checkers during downtime.
 
2243
            if client["enabled"]:
 
2244
                if datetime.datetime.utcnow() >= client["expires"]:
 
2245
                    if not client["last_checked_ok"]:
 
2246
                        logger.warning(
 
2247
                            "disabling client {0} - Client never "
 
2248
                            "performed a successfull checker"
 
2249
                            .format(client["name"]))
 
2250
                        client["enabled"] = False
 
2251
                    elif client["last_checker_status"] != 0:
 
2252
                        logger.warning(
 
2253
                            "disabling client {0} - Client "
 
2254
                            "last checker failed with error code {1}"
 
2255
                            .format(client["name"],
 
2256
                                    client["last_checker_status"]))
 
2257
                        client["enabled"] = False
 
2258
                    else:
 
2259
                        client["expires"] = (datetime.datetime
 
2260
                                             .utcnow()
 
2261
                                             + client["timeout"])
 
2262
                    
2156
2263
            try:
2157
 
                # For each value in new config, check if it differs
2158
 
                # from the old config value (Except for the "secret"
2159
 
                # attribute)
2160
 
                if name != "secret" and value != old_client_settings[client_name][name]:
2161
 
                    setattr(client, name, value)
2162
 
            except KeyError:
2163
 
                pass
2164
 
 
2165
 
        # Clients who has passed its expire date, can still be enabled if its
2166
 
        # last checker was sucessful. Clients who checkers failed before we
2167
 
        # stored it state is asumed to had failed checker during downtime.
2168
 
        if client["enabled"] and client["last_checked_ok"]:
2169
 
            if ((datetime.datetime.utcnow() - client["last_checked_ok"])
2170
 
                > client["interval"]):
2171
 
                if client["last_checker_status"] != 0:
2172
 
                    client["enabled"] = False
2173
 
                else:
2174
 
                    client["expires"] = datetime.datetime.utcnow() + client["timeout"]
2175
 
 
2176
 
        client["changedstate"] = (multiprocessing_manager
2177
 
                                  .Condition(multiprocessing_manager
2178
 
                                             .Lock()))
2179
 
        if use_dbus:
2180
 
            new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)
2181
 
            tcp_server.clients[client_name] = new_client
2182
 
            new_client.bus = bus
2183
 
            for name, value in client.iteritems():
2184
 
                setattr(new_client, name, value)
2185
 
            client_object_name = unicode(client_name).translate(
2186
 
                {ord("."): ord("_"),
2187
 
                 ord("-"): ord("_")})
2188
 
            new_client.dbus_object_path = (dbus.ObjectPath
2189
 
                                     ("/clients/" + client_object_name))
2190
 
            DBusObjectWithProperties.__init__(new_client,
2191
 
                                              new_client.bus,
2192
 
                                              new_client.dbus_object_path)
2193
 
        else:
2194
 
            tcp_server.clients[client_name] = Client.__new__(Client)
2195
 
            for name, value in client.iteritems():
2196
 
                setattr(tcp_server.clients[client_name], name, value)
2197
 
                
2198
 
        tcp_server.clients[client_name].decrypt_secret(
2199
 
            client_settings[client_name]["secret"])            
2200
 
        
2201
 
    # Create/remove clients based on new changes made to config
2202
 
    for clientname in set(old_client_settings) - set(client_settings):
2203
 
        del tcp_server.clients[clientname]
2204
 
    for clientname in set(client_settings) - set(old_client_settings):
2205
 
        tcp_server.clients[clientname] = (client_class(name = clientname,
2206
 
                                                       config =
2207
 
                                                       client_settings
2208
 
                                                       [clientname]))
2209
 
    
2210
 
 
 
2264
                client["secret"] = (
 
2265
                    pgp.decrypt(client["encrypted_secret"],
 
2266
                                client_settings[client_name]
 
2267
                                ["secret"]))
 
2268
            except PGPError:
 
2269
                # If decryption fails, we use secret from new settings
 
2270
                logger.debug("Failed to decrypt {0} old secret"
 
2271
                             .format(client_name))
 
2272
                client["secret"] = (
 
2273
                    client_settings[client_name]["secret"])
 
2274
 
 
2275
    
 
2276
    # Add/remove clients based on new changes made to config
 
2277
    for client_name in set(old_client_settings) - set(client_settings):
 
2278
        del clients_data[client_name]
 
2279
    for client_name in set(client_settings) - set(old_client_settings):
 
2280
        clients_data[client_name] = client_settings[client_name]
 
2281
 
 
2282
    # Create clients all clients
 
2283
    for client_name, client in clients_data.iteritems():
 
2284
        tcp_server.clients[client_name] = client_class(
 
2285
            name = client_name, settings = client)
 
2286
    
2211
2287
    if not tcp_server.clients:
2212
2288
        logger.warning("No clients defined")
2213
2289
        
2224
2300
            # "pidfile" was never created
2225
2301
            pass
2226
2302
        del pidfilename
2227
 
        
2228
2303
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2229
2304
    
2230
2305
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2295
2370
        multiprocessing.active_children()
2296
2371
        if not (tcp_server.clients or client_settings):
2297
2372
            return
2298
 
 
2299
 
        # Store client before exiting. Secrets are encrypted with key based
2300
 
        # on what config file has. If config file is removed/edited, old
2301
 
        # secret will thus be unrecovable.
2302
 
        clients = []
2303
 
        for client in tcp_server.clients.itervalues():
2304
 
            client.encrypt_secret(client_settings[client.name]["secret"])
2305
 
 
2306
 
            client_dict = {}
2307
 
 
2308
 
            # A list of attributes that will not be stored when shuting down.
2309
 
            exclude = set(("bus", "changedstate", "secret"))            
2310
 
            for name, typ in inspect.getmembers(dbus.service.Object):
2311
 
                exclude.add(name)
2312
 
                
2313
 
            client_dict["encrypted_secret"] = client.encrypted_secret
2314
 
            for attr in client.client_structure:
2315
 
                if attr not in exclude:
2316
 
                    client_dict[attr] = getattr(client, attr)
2317
 
 
2318
 
            clients.append(client_dict) 
2319
 
            del client_settings[client.name]["secret"]
2320
 
            
 
2373
        
 
2374
        # Store client before exiting. Secrets are encrypted with key
 
2375
        # based on what config file has. If config file is
 
2376
        # removed/edited, old secret will thus be unrecovable.
 
2377
        clients = {}
 
2378
        with PGPEngine() as pgp:
 
2379
            for client in tcp_server.clients.itervalues():
 
2380
                key = client_settings[client.name]["secret"]
 
2381
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2382
                                                      key)
 
2383
                client_dict = {}
 
2384
                
 
2385
                # A list of attributes that can not be pickled
 
2386
                # + secret.
 
2387
                exclude = set(("bus", "changedstate", "secret",
 
2388
                               "checker"))
 
2389
                for name, typ in (inspect.getmembers
 
2390
                                  (dbus.service.Object)):
 
2391
                    exclude.add(name)
 
2392
                
 
2393
                client_dict["encrypted_secret"] = (client
 
2394
                                                   .encrypted_secret)
 
2395
                for attr in client.client_structure:
 
2396
                    if attr not in exclude:
 
2397
                        client_dict[attr] = getattr(client, attr)
 
2398
                
 
2399
                clients[client.name] = client_dict
 
2400
                del client_settings[client.name]["secret"]
 
2401
        
2321
2402
        try:
2322
 
            with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:
 
2403
            with os.fdopen(os.open(stored_state_path,
 
2404
                                   os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
 
2405
                                   0600), "wb") as stored_state:
2323
2406
                pickle.dump((clients, client_settings), stored_state)
2324
 
        except IOError as e:
2325
 
            logger.warning("Could not save persistant state: {0}".format(e))
2326
 
            if e.errno != errno.ENOENT:
 
2407
        except (IOError, OSError) as e:
 
2408
            logger.warning("Could not save persistent state: {0}"
 
2409
                           .format(e))
 
2410
            if e.errno not in (errno.ENOENT, errno.EACCES):
2327
2411
                raise
2328
 
 
 
2412
        
2329
2413
        # Delete all clients, and settings from config
2330
2414
        while tcp_server.clients:
2331
2415
            name, client = tcp_server.clients.popitem()
2349
2433
        # Need to initiate checking of clients
2350
2434
        if client.enabled:
2351
2435
            client.init_checker()
2352
 
 
2353
2436
    
2354
2437
    tcp_server.enable()
2355
2438
    tcp_server.server_activate()
2395
2478
    # Must run before the D-Bus bus name gets deregistered
2396
2479
    cleanup()
2397
2480
 
2398
 
 
2399
2481
if __name__ == '__main__':
2400
2482
    main()