To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 530
- compare with another revision
- download diff
- download tarball
- view history from revision 530
- Committer: teddy at bsnet
- Date: 2011-12-23 20:00:52 UTC
- Revision ID: teddy@fukt.bsnet.se-20111223200052-nehnjfy0fogvm4ii
* mandos (initlogger): Take new "debug" argument; all callers changed.
Only add console logger in debug mode.
(main/cleanup): Remove temp file on failure.
Only add console logger in debug mode.
(main/cleanup): Remove temp file on failure.
- files added:
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import hashlib
66
import binascii
67
import tempfile
67
68
68
69
import dbus
69
70
import dbus.service
74
75
import ctypes.util
75
76
import xml.dom.minidom
76
77
import inspect
77
import Crypto.Cipher.AES
78
import GnuPGInterface
78
79
79
80
try:
80
81
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
84
85
except ImportError:
85
86
SO_BINDTODEVICE = None
86
87
87
88
88
version = "1.4.1"
89
stored_state_file = "clients.pickle"
89
90
90
91
logger = logging.getLogger()
91
stored_state_path = "/var/lib/mandos/clients.pickle"
92
93
92
syslogger = (logging.handlers.SysLogHandler
94
93
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
95
94
address = str("/dev/log")))
96
syslogger.setFormatter(logging.Formatter
97
('Mandos [%(process)d]: %(levelname)s:'
98
' %(message)s'))
99
logger.addHandler(syslogger)
100
101
console = logging.StreamHandler()
102
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
103
' [%(process)d]:'
104
' %(levelname)s:'
105
' %(message)s'))
106
logger.addHandler(console)
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(debug, level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
if debug:
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet'])
146
147
def __enter__(self):
148
return self
149
150
def __exit__ (self, exc_type, exc_value, traceback):
151
self._cleanup()
152
return False
153
154
def __del__(self):
155
self._cleanup()
156
157
def _cleanup(self):
158
if self.tempdir is not None:
159
# Delete contents of tempdir
160
for root, dirs, files in os.walk(self.tempdir,
161
topdown = False):
162
for filename in files:
163
os.remove(os.path.join(root, filename))
164
for dirname in dirs:
165
os.rmdir(os.path.join(root, dirname))
166
# Remove tempdir
167
os.rmdir(self.tempdir)
168
self.tempdir = None
169
170
def password_encode(self, password):
171
# Passphrase can not be empty and can not contain newlines or
172
# NUL bytes. So we prefix it and hex encode it.
173
return b"mandos" + binascii.hexlify(password)
174
175
def encrypt(self, data, password):
176
self.gnupg.passphrase = self.password_encode(password)
177
with open(os.devnull) as devnull:
178
try:
179
proc = self.gnupg.run(['--symmetric'],
180
create_fhs=['stdin', 'stdout'],
181
attach_fhs={'stderr': devnull})
182
with contextlib.closing(proc.handles['stdin']) as f:
183
f.write(data)
184
with contextlib.closing(proc.handles['stdout']) as f:
185
ciphertext = f.read()
186
proc.wait()
187
except IOError as e:
188
raise PGPError(e)
189
self.gnupg.passphrase = None
190
return ciphertext
191
192
def decrypt(self, data, password):
193
self.gnupg.passphrase = self.password_encode(password)
194
with open(os.devnull) as devnull:
195
try:
196
proc = self.gnupg.run(['--decrypt'],
197
create_fhs=['stdin', 'stdout'],
198
attach_fhs={'stderr': devnull})
199
with contextlib.closing(proc.handles['stdin'] ) as f:
200
f.write(data)
201
with contextlib.closing(proc.handles['stdout']) as f:
202
decrypted_plaintext = f.read()
203
proc.wait()
204
except IOError as e:
205
raise PGPError(e)
206
self.gnupg.passphrase = None
207
return decrypted_plaintext
208
107
209
108
210
109
211
class AvahiError(Exception):
226
328
try:
227
329
self.group.Free()
228
330
except (dbus.exceptions.UnknownMethodException,
229
dbus.exceptions.DBusException) as e:
331
dbus.exceptions.DBusException):
230
332
pass
231
333
self.group = None
232
334
self.remove()
276
378
% self.name))
277
379
return ret
278
380
279
def _timedelta_to_milliseconds(td):
381
def timedelta_to_milliseconds(td):
280
382
"Convert a datetime.timedelta() to milliseconds"
281
383
return ((td.days * 24 * 60 * 60 * 1000)
282
384
+ (td.seconds * 1000)
286
388
"""A representation of a client host served by this server.
287
389
288
390
Attributes:
289
_approved: bool(); 'None' if not yet approved/disapproved
391
approved: bool(); 'None' if not yet approved/disapproved
290
392
approval_delay: datetime.timedelta(); Time to wait for approval
291
393
approval_duration: datetime.timedelta(); Duration of one approval
292
394
checker: subprocess.Popen(); a running checker process used
311
413
last_approval_request: datetime.datetime(); (UTC) or None
312
414
last_checked_ok: datetime.datetime(); (UTC) or None
313
415
last_checker_status: integer between 0 and 255 reflecting exit
314
status of last checker. -1 reflect crashed
416
status of last checker. -1 reflects crashed
315
417
checker, or None.
316
last_enabled: datetime.datetime(); (UTC)
418
last_enabled: datetime.datetime(); (UTC) or None
317
419
name: string; from the config file, used in log messages and
318
420
D-Bus identifiers
319
421
secret: bytestring; sent verbatim (over TLS) to client
329
431
"created", "enabled", "fingerprint",
330
432
"host", "interval", "last_checked_ok",
331
433
"last_enabled", "name", "timeout")
434
client_defaults = { "timeout": "5m",
435
"extended_timeout": "15m",
436
"interval": "2m",
437
"checker": "fping -q -- %%(host)s",
438
"host": "",
439
"approval_delay": "0s",
440
"approval_duration": "1s",
441
"approved_by_default": "True",
442
"enabled": "True",
443
}
332
444
333
445
def timeout_milliseconds(self):
334
446
"Return the 'timeout' attribute in milliseconds"
335
return _timedelta_to_milliseconds(self.timeout)
447
return timedelta_to_milliseconds(self.timeout)
336
448
337
449
def extended_timeout_milliseconds(self):
338
450
"Return the 'extended_timeout' attribute in milliseconds"
339
return _timedelta_to_milliseconds(self.extended_timeout)
451
return timedelta_to_milliseconds(self.extended_timeout)
340
452
341
453
def interval_milliseconds(self):
342
454
"Return the 'interval' attribute in milliseconds"
343
return _timedelta_to_milliseconds(self.interval)
455
return timedelta_to_milliseconds(self.interval)
344
456
345
457
def approval_delay_milliseconds(self):
346
return _timedelta_to_milliseconds(self.approval_delay)
347
348
def __init__(self, name = None, config=None):
458
return timedelta_to_milliseconds(self.approval_delay)
459
460
@staticmethod
461
def config_parser(config):
462
""" Construct a new dict of client settings of this form:
463
{ client_name: {setting_name: value, ...}, ...}
464
with exceptions for any special settings as defined above"""
465
settings = {}
466
for client_name in config.sections():
467
section = dict(config.items(client_name))
468
client = settings[client_name] = {}
469
470
client["host"] = section["host"]
471
# Reformat values from string types to Python types
472
client["approved_by_default"] = config.getboolean(
473
client_name, "approved_by_default")
474
client["enabled"] = config.getboolean(client_name, "enabled")
475
476
client["fingerprint"] = (section["fingerprint"].upper()
477
.replace(" ", ""))
478
if "secret" in section:
479
client["secret"] = section["secret"].decode("base64")
480
elif "secfile" in section:
481
with open(os.path.expanduser(os.path.expandvars
482
(section["secfile"])),
483
"rb") as secfile:
484
client["secret"] = secfile.read()
485
else:
486
raise TypeError("No secret or secfile for section %s"
487
% section)
488
client["timeout"] = string_to_delta(section["timeout"])
489
client["extended_timeout"] = string_to_delta(
490
section["extended_timeout"])
491
client["interval"] = string_to_delta(section["interval"])
492
client["approval_delay"] = string_to_delta(
493
section["approval_delay"])
494
client["approval_duration"] = string_to_delta(
495
section["approval_duration"])
496
client["checker_command"] = section["checker"]
497
client["last_approval_request"] = None
498
client["last_checked_ok"] = None
499
client["last_checker_status"] = None
500
if client["enabled"]:
501
client["last_enabled"] = datetime.datetime.utcnow()
502
client["expires"] = (datetime.datetime.utcnow()
503
+ client["timeout"])
504
else:
505
client["last_enabled"] = None
506
client["expires"] = None
507
508
return settings
509
510
511
def __init__(self, settings, name = None):
349
512
"""Note: the 'checker' key in 'config' sets the
350
513
'checker_command' attribute and *not* the 'checker'
351
514
attribute."""
352
515
self.name = name
353
if config is None:
354
config = {}
516
# adding all client settings
517
for setting, value in settings.iteritems():
518
setattr(self, setting, value)
519
355
520
logger.debug("Creating client %r", self.name)
356
521
# Uppercase and remove spaces from fingerprint for later
357
522
# comparison purposes with return value from the fingerprint()
358
523
# function
359
self.fingerprint = (config["fingerprint"].upper()
360
.replace(" ", ""))
361
524
logger.debug(" Fingerprint: %s", self.fingerprint)
362
if "secret" in config:
363
self.secret = config["secret"].decode("base64")
364
elif "secfile" in config:
365
with open(os.path.expanduser(os.path.expandvars
366
(config["secfile"])),
367
"rb") as secfile:
368
self.secret = secfile.read()
369
else:
370
raise TypeError("No secret or secfile for client %s"
371
% self.name)
372
self.host = config.get("host", "")
373
self.created = datetime.datetime.utcnow()
374
self.enabled = True
375
self.last_approval_request = None
376
self.last_enabled = datetime.datetime.utcnow()
377
self.last_checked_ok = None
378
self.last_checker_status = None
379
self.timeout = string_to_delta(config["timeout"])
380
self.extended_timeout = string_to_delta(config
381
["extended_timeout"])
382
self.interval = string_to_delta(config["interval"])
525
self.created = settings.get("created", datetime.datetime.utcnow())
526
527
# attributes specific for this server instance
383
528
self.checker = None
384
529
self.checker_initiator_tag = None
385
530
self.disable_initiator_tag = None
386
self.expires = datetime.datetime.utcnow() + self.timeout
387
531
self.checker_callback_tag = None
388
self.checker_command = config["checker"]
389
532
self.current_checker_command = None
390
self._approved = None
391
self.approved_by_default = config.get("approved_by_default",
392
True)
533
self.approved = None
393
534
self.approvals_pending = 0
394
self.approval_delay = string_to_delta(
395
config["approval_delay"])
396
self.approval_duration = string_to_delta(
397
config["approval_duration"])
398
535
self.changedstate = (multiprocessing_manager
399
536
.Condition(multiprocessing_manager
400
537
.Lock()))
401
self.client_structure = [attr for attr
402
in self.__dict__.iterkeys()
538
self.client_structure = [attr for attr in
539
self.__dict__.iterkeys()
403
540
if not attr.startswith("_")]
404
541
self.client_structure.append("client_structure")
405
406
542
407
543
for name, t in inspect.getmembers(type(self),
408
544
lambda obj:
409
545
isinstance(obj,
449
585
450
586
def __del__(self):
451
587
self.disable()
452
588
453
589
def init_checker(self):
454
590
# Schedule a new checker to be started an 'interval' from now,
455
591
# and every interval from then on.
462
598
self.disable))
463
599
# Also start a new checker *right now*.
464
600
self.start_checker()
465
466
601
467
602
def checker_callback(self, pid, condition, command):
468
603
"""The checker has completed, so take appropriate actions."""
469
604
self.checker_callback_tag = None
470
605
self.checker = None
471
606
if os.WIFEXITED(condition):
472
self.last_checker_status = os.WEXITSTATUS(condition)
607
self.last_checker_status = os.WEXITSTATUS(condition)
473
608
if self.last_checker_status == 0:
474
609
logger.info("Checker for %(name)s succeeded",
475
610
vars(self))
495
630
gobject.source_remove(self.disable_initiator_tag)
496
631
if getattr(self, "enabled", False):
497
632
self.disable_initiator_tag = (gobject.timeout_add
498
(_timedelta_to_milliseconds
633
(timedelta_to_milliseconds
499
634
(timeout), self.disable))
500
635
self.expires = datetime.datetime.utcnow() + timeout
501
636
595
730
raise
596
731
self.checker = None
597
732
598
# Encrypts a client secret and stores it in a varible
599
# encrypted_secret
600
def encrypt_secret(self, key):
601
# Encryption-key need to be of a specific size, so we hash
602
# supplied key
603
hasheng = hashlib.sha256()
604
hasheng.update(key)
605
encryptionkey = hasheng.digest()
606
607
# Create validation hash so we know at decryption if it was
608
# sucessful
609
hasheng = hashlib.sha256()
610
hasheng.update(self.secret)
611
validationhash = hasheng.digest()
612
613
# Encrypt secret
614
iv = os.urandom(Crypto.Cipher.AES.block_size)
615
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
616
Crypto.Cipher.AES.MODE_CFB, iv)
617
ciphertext = ciphereng.encrypt(validationhash+self.secret)
618
self.encrypted_secret = (ciphertext, iv)
619
620
# Decrypt a encrypted client secret
621
def decrypt_secret(self, key):
622
# Decryption-key need to be of a specific size, so we hash
623
# supplied key
624
hasheng = hashlib.sha256()
625
hasheng.update(key)
626
encryptionkey = hasheng.digest()
627
628
# Decrypt encrypted secret
629
ciphertext, iv = self.encrypted_secret
630
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
631
Crypto.Cipher.AES.MODE_CFB, iv)
632
plain = ciphereng.decrypt(ciphertext)
633
634
# Validate decrypted secret to know if it was succesful
635
hasheng = hashlib.sha256()
636
validationhash = plain[:hasheng.digest_size]
637
secret = plain[hasheng.digest_size:]
638
hasheng.update(secret)
639
640
# If validation fails, we use key as new secret. Otherwise, we
641
# use the decrypted secret
642
if hasheng.digest() == validationhash:
643
self.secret = secret
644
else:
645
self.secret = key
646
del self.encrypted_secret
647
648
733
649
734
def dbus_service_property(dbus_interface, signature="v",
650
735
access="readwrite", byte_arrays=False):
768
853
769
854
Note: Will not include properties with access="write".
770
855
"""
771
all = {}
856
properties = {}
772
857
for name, prop in self._get_all_dbus_properties():
773
858
if (interface_name
774
859
and interface_name != prop._dbus_interface):
779
864
continue
780
865
value = prop()
781
866
if not hasattr(value, "variant_level"):
782
all[name] = value
867
properties[name] = value
783
868
continue
784
all[name] = type(value)(value, variant_level=
785
value.variant_level+1)
786
return dbus.Dictionary(all, signature="sv")
869
properties[name] = type(value)(value, variant_level=
870
value.variant_level+1)
871
return dbus.Dictionary(properties, signature="sv")
787
872
788
873
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
789
874
out_signature="s",
840
925
return dbus.String(dt.isoformat(),
841
926
variant_level=variant_level)
842
927
928
843
929
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
844
930
.__metaclass__):
845
931
"""Applied to an empty subclass of a D-Bus object, this metaclass
937
1023
attribute.func_closure)))
938
1024
return type.__new__(mcs, name, bases, attr)
939
1025
1026
940
1027
class ClientDBus(Client, DBusObjectWithProperties):
941
1028
"""A Client class using D-Bus
942
1029
952
1039
953
1040
def __init__(self, bus = None, *args, **kwargs):
954
1041
self.bus = bus
955
self._approvals_pending = 0
956
1042
Client.__init__(self, *args, **kwargs)
957
self.add_to_dbus()
958
959
def add_to_dbus(self):
1043
self._approvals_pending = 0
1044
1045
self._approvals_pending = 0
960
1046
# Only now, when this client is initialized, can it show up on
961
1047
# the D-Bus
962
1048
client_object_name = unicode(self.name).translate(
972
1058
variant_level=1):
973
1059
""" Modify a variable so that it's a property which announces
974
1060
its changes to DBus.
975
1061
976
1062
transform_fun: Function that takes a value and a variant_level
977
1063
and transforms it to a D-Bus type.
978
1064
dbus_name: D-Bus name of the variable
1012
1098
datetime_to_dbus, "LastApprovalRequest")
1013
1099
approved_by_default = notifychangeproperty(dbus.Boolean,
1014
1100
"ApprovedByDefault")
1015
approval_delay = notifychangeproperty(dbus.UInt16,
1101
approval_delay = notifychangeproperty(dbus.UInt64,
1016
1102
"ApprovalDelay",
1017
1103
type_func =
1018
_timedelta_to_milliseconds)
1104
timedelta_to_milliseconds)
1019
1105
approval_duration = notifychangeproperty(
1020
dbus.UInt16, "ApprovalDuration",
1021
type_func = _timedelta_to_milliseconds)
1106
dbus.UInt64, "ApprovalDuration",
1107
type_func = timedelta_to_milliseconds)
1022
1108
host = notifychangeproperty(dbus.String, "Host")
1023
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1109
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1024
1110
type_func =
1025
_timedelta_to_milliseconds)
1111
timedelta_to_milliseconds)
1026
1112
extended_timeout = notifychangeproperty(
1027
dbus.UInt16, "ExtendedTimeout",
1028
type_func = _timedelta_to_milliseconds)
1029
interval = notifychangeproperty(dbus.UInt16,
1113
dbus.UInt64, "ExtendedTimeout",
1114
type_func = timedelta_to_milliseconds)
1115
interval = notifychangeproperty(dbus.UInt64,
1030
1116
"Interval",
1031
1117
type_func =
1032
_timedelta_to_milliseconds)
1118
timedelta_to_milliseconds)
1033
1119
checker_command = notifychangeproperty(dbus.String, "Checker")
1034
1120
1035
1121
del notifychangeproperty
1077
1163
return r
1078
1164
1079
1165
def _reset_approved(self):
1080
self._approved = None
1166
self.approved = None
1081
1167
return False
1082
1168
1083
1169
def approve(self, value=True):
1084
1170
self.send_changedstate()
1085
self._approved = value
1086
gobject.timeout_add(_timedelta_to_milliseconds
1171
self.approved = value
1172
gobject.timeout_add(timedelta_to_milliseconds
1087
1173
(self.approval_duration),
1088
1174
self._reset_approved)
1089
1175
1132
1218
"D-Bus signal"
1133
1219
return self.need_approval()
1134
1220
1221
# NeRwequest - signal
1222
@dbus.service.signal(_interface, signature="s")
1223
def NewRequest(self, ip):
1224
"""D-Bus signal
1225
Is sent after a client request a password.
1226
"""
1227
pass
1228
1135
1229
## Methods
1136
1230
1137
1231
# Approve - method
1195
1289
access="readwrite")
1196
1290
def ApprovalDuration_dbus_property(self, value=None):
1197
1291
if value is None: # get
1198
return dbus.UInt64(_timedelta_to_milliseconds(
1292
return dbus.UInt64(timedelta_to_milliseconds(
1199
1293
self.approval_duration))
1200
1294
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1201
1295
1215
1309
def Host_dbus_property(self, value=None):
1216
1310
if value is None: # get
1217
1311
return dbus.String(self.host)
1218
self.host = value
1312
self.host = unicode(value)
1219
1313
1220
1314
# Created - property
1221
1315
@dbus_service_property(_interface, signature="s", access="read")
1222
1316
def Created_dbus_property(self):
1223
return dbus.String(datetime_to_dbus(self.created))
1317
return datetime_to_dbus(self.created)
1224
1318
1225
1319
# LastEnabled - property
1226
1320
@dbus_service_property(_interface, signature="s", access="read")
1270
1364
gobject.source_remove(self.disable_initiator_tag)
1271
1365
self.disable_initiator_tag = None
1272
1366
self.expires = None
1273
time_to_die = _timedelta_to_milliseconds((self
1274
.last_checked_ok
1275
+ self.timeout)
1276
- datetime.datetime
1277
.utcnow())
1367
time_to_die = timedelta_to_milliseconds((self
1368
.last_checked_ok
1369
+ self.timeout)
1370
- datetime.datetime
1371
.utcnow())
1278
1372
if time_to_die <= 0:
1279
1373
# The timeout has passed
1280
1374
self.disable()
1302
1396
self.interval = datetime.timedelta(0, 0, 0, value)
1303
1397
if getattr(self, "checker_initiator_tag", None) is None:
1304
1398
return
1305
# Reschedule checker run
1306
gobject.source_remove(self.checker_initiator_tag)
1307
self.checker_initiator_tag = (gobject.timeout_add
1308
(value, self.start_checker))
1309
self.start_checker() # Start one now, too
1399
if self.enabled:
1400
# Reschedule checker run
1401
gobject.source_remove(self.checker_initiator_tag)
1402
self.checker_initiator_tag = (gobject.timeout_add
1403
(value, self.start_checker))
1404
self.start_checker() # Start one now, too
1310
1405
1311
1406
# Checker - property
1312
1407
@dbus_service_property(_interface, signature="s",
1314
1409
def Checker_dbus_property(self, value=None):
1315
1410
if value is None: # get
1316
1411
return dbus.String(self.checker_command)
1317
self.checker_command = value
1412
self.checker_command = unicode(value)
1318
1413
1319
1414
# CheckerRunning - property
1320
1415
@dbus_service_property(_interface, signature="b",
1349
1444
raise KeyError()
1350
1445
1351
1446
def __getattribute__(self, name):
1352
if(name == '_pipe'):
1447
if name == '_pipe':
1353
1448
return super(ProxyClient, self).__getattribute__(name)
1354
1449
self._pipe.send(('getattr', name))
1355
1450
data = self._pipe.recv()
1362
1457
return func
1363
1458
1364
1459
def __setattr__(self, name, value):
1365
if(name == '_pipe'):
1460
if name == '_pipe':
1366
1461
return super(ProxyClient, self).__setattr__(name, value)
1367
1462
self._pipe.send(('setattr', name, value))
1368
1463
1464
1369
1465
class ClientDBusTransitional(ClientDBus):
1370
1466
__metaclass__ = AlternateDBusNamesMetaclass
1371
1467
1468
1372
1469
class ClientHandler(socketserver.BaseRequestHandler, object):
1373
1470
"""A class to handle client connections.
1374
1471
1442
1539
except KeyError:
1443
1540
return
1444
1541
1542
if self.server.use_dbus:
1543
# Emit D-Bus signal
1544
client.NewRequest(str(self.client_address))
1545
1445
1546
if client.approval_delay:
1446
1547
delay = client.approval_delay
1447
1548
client.approvals_pending += 1
1456
1557
client.Rejected("Disabled")
1457
1558
return
1458
1559
1459
if client._approved or not client.approval_delay:
1560
if client.approved or not client.approval_delay:
1460
1561
#We are approved or approval is disabled
1461
1562
break
1462
elif client._approved is None:
1563
elif client.approved is None:
1463
1564
logger.info("Client %s needs approval",
1464
1565
client.name)
1465
1566
if self.server.use_dbus:
1479
1580
time = datetime.datetime.now()
1480
1581
client.changedstate.acquire()
1481
1582
(client.changedstate.wait
1482
(float(client._timedelta_to_milliseconds(delay)
1583
(float(client.timedelta_to_milliseconds(delay)
1483
1584
/ 1000)))
1484
1585
client.changedstate.release()
1485
1586
time2 = datetime.datetime.now()
1584
1685
# Convert the buffer to a Python bytestring
1585
1686
fpr = ctypes.string_at(buf, buf_len.value)
1586
1687
# Convert the bytestring to hexadecimal notation
1587
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1688
hex_fpr = binascii.hexlify(fpr).upper()
1588
1689
return hex_fpr
1589
1690
1590
1691
1593
1694
def sub_process_main(self, request, address):
1594
1695
try:
1595
1696
self.finish_request(request, address)
1596
except:
1697
except Exception:
1597
1698
self.handle_error(request, address)
1598
1699
self.close_request(request)
1599
1700
1847
1948
return timevalue
1848
1949
1849
1950
1850
def if_nametoindex(interface):
1851
"""Call the C function if_nametoindex(), or equivalent
1852
1853
Note: This function cannot accept a unicode string."""
1854
global if_nametoindex
1855
try:
1856
if_nametoindex = (ctypes.cdll.LoadLibrary
1857
(ctypes.util.find_library("c"))
1858
.if_nametoindex)
1859
except (OSError, AttributeError):
1860
logger.warning("Doing if_nametoindex the hard way")
1861
def if_nametoindex(interface):
1862
"Get an interface index the hard way, i.e. using fcntl()"
1863
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1864
with contextlib.closing(socket.socket()) as s:
1865
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1866
struct.pack(str("16s16x"),
1867
interface))
1868
interface_index = struct.unpack(str("I"),
1869
ifreq[16:20])[0]
1870
return interface_index
1871
return if_nametoindex(interface)
1872
1873
1874
1951
def daemon(nochdir = False, noclose = False):
1875
1952
"""See daemon(3). Standard BSD Unix function.
1876
1953
1932
2009
parser.add_argument("--no-ipv6", action="store_false",
1933
2010
dest="use_ipv6", help="Do not use IPv6")
1934
2011
parser.add_argument("--no-restore", action="store_false",
1935
dest="restore",
1936
help="Do not restore stored state",
1937
default=True)
1938
2012
dest="restore", help="Do not restore stored"
2013
" state")
2014
parser.add_argument("--statedir", metavar="DIR",
2015
help="Directory to save/restore state in")
2016
1939
2017
options = parser.parse_args()
1940
2018
1941
2019
if options.check:
1954
2032
"use_dbus": "True",
1955
2033
"use_ipv6": "True",
1956
2034
"debuglevel": "",
2035
"restore": "True",
2036
"statedir": "/var/lib/mandos"
1957
2037
}
1958
2038
1959
2039
# Parse config file for server-global settings
1976
2056
# options, if set.
1977
2057
for option in ("interface", "address", "port", "debug",
1978
2058
"priority", "servicename", "configdir",
1979
"use_dbus", "use_ipv6", "debuglevel", "restore"):
2059
"use_dbus", "use_ipv6", "debuglevel", "restore",
2060
"statedir"):
1980
2061
value = getattr(options, option)
1981
2062
if value is not None:
1982
2063
server_settings[option] = value
1994
2075
debuglevel = server_settings["debuglevel"]
1995
2076
use_dbus = server_settings["use_dbus"]
1996
2077
use_ipv6 = server_settings["use_ipv6"]
2078
stored_state_path = os.path.join(server_settings["statedir"],
2079
stored_state_file)
2080
2081
if debug:
2082
initlogger(debug, logging.DEBUG)
2083
else:
2084
if not debuglevel:
2085
initlogger(debug)
2086
else:
2087
level = getattr(logging, debuglevel.upper())
2088
initlogger(debug, level)
1997
2089
1998
2090
if server_settings["servicename"] != "Mandos":
1999
2091
syslogger.setFormatter(logging.Formatter
2002
2094
% server_settings["servicename"]))
2003
2095
2004
2096
# Parse config file with clients
2005
client_defaults = { "timeout": "5m",
2006
"extended_timeout": "15m",
2007
"interval": "2m",
2008
"checker": "fping -q -- %%(host)s",
2009
"host": "",
2010
"approval_delay": "0s",
2011
"approval_duration": "1s",
2012
}
2013
client_config = configparser.SafeConfigParser(client_defaults)
2097
client_config = configparser.SafeConfigParser(Client.client_defaults)
2014
2098
client_config.read(os.path.join(server_settings["configdir"],
2015
2099
"clients.conf"))
2016
2100
2054
2138
if error[0] != errno.EPERM:
2055
2139
raise error
2056
2140
2057
if not debug and not debuglevel:
2058
logger.setLevel(logging.WARNING)
2059
if debuglevel:
2060
level = getattr(logging, debuglevel.upper())
2061
logger.setLevel(level)
2062
2063
2141
if debug:
2064
logger.setLevel(logging.DEBUG)
2065
2142
# Enable all possible GnuTLS debugging
2066
2143
2067
2144
# "Use a log level over 10 to enable all debugging options."
2080
2157
os.dup2(null, sys.stdin.fileno())
2081
2158
if null > 2:
2082
2159
os.close(null)
2083
else:
2084
# No console logging
2085
logger.removeHandler(console)
2086
2160
2087
2161
# Need to fork before connecting to D-Bus
2088
2162
if not debug:
2089
2163
# Close all input and output, do double fork, etc.
2090
2164
daemon()
2091
2165
2166
gobject.threads_init()
2167
2092
2168
global main_loop
2093
2169
# From the Avahi example code
2094
2170
DBusGMainLoop(set_as_default=True )
2124
2200
client_class = functools.partial(ClientDBusTransitional,
2125
2201
bus = bus)
2126
2202
2127
special_settings = {
2128
# Some settings need to be accessd by special methods;
2129
# booleans need .getboolean(), etc. Here is a list of them:
2130
"approved_by_default":
2131
lambda section:
2132
client_config.getboolean(section, "approved_by_default"),
2133
}
2134
# Construct a new dict of client settings of this form:
2135
# { client_name: {setting_name: value, ...}, ...}
2136
# with exceptions for any special settings as defined above
2137
client_settings = dict((clientname,
2138
dict((setting,
2139
(value if
2140
setting not in special_settings
2141
else special_settings[setting]
2142
(clientname)))
2143
for setting, value
2144
in client_config.items(clientname)))
2145
for clientname in client_config.sections())
2146
2203
client_settings = Client.config_parser(client_config)
2147
2204
old_client_settings = {}
2148
clients_data = []
2149
2150
# Get client data and settings from last running state.
2205
clients_data = {}
2206
2207
# Get client data and settings from last running state.
2151
2208
if server_settings["restore"]:
2152
2209
try:
2153
2210
with open(stored_state_path, "rb") as stored_state:
2154
clients_data, old_client_settings = (
2155
pickle.load(stored_state))
2211
clients_data, old_client_settings = (pickle.load
2212
(stored_state))
2156
2213
os.remove(stored_state_path)
2157
2214
except IOError as e:
2158
logger.warning("Could not load persistant state: {0}"
2215
logger.warning("Could not load persistent state: {0}"
2159
2216
.format(e))
2160
2217
if e.errno != errno.ENOENT:
2161
2218
raise
2162
2163
for client in clients_data:
2164
client_name = client["name"]
2165
2166
# Decide which value to use after restoring saved state.
2167
# We have three different values: Old config file,
2168
# new config file, and saved state.
2169
# New config value takes precedence if it differs from old
2170
# config value, otherwise use saved state.
2171
for name, value in client_settings[client_name].items():
2219
except EOFError as e:
2220
logger.warning("Could not load persistent state: "
2221
"EOFError: {0}".format(e))
2222
2223
with PGPEngine() as pgp:
2224
for client_name, client in clients_data.iteritems():
2225
# Decide which value to use after restoring saved state.
2226
# We have three different values: Old config file,
2227
# new config file, and saved state.
2228
# New config value takes precedence if it differs from old
2229
# config value, otherwise use saved state.
2230
for name, value in client_settings[client_name].items():
2231
try:
2232
# For each value in new config, check if it
2233
# differs from the old config value (Except for
2234
# the "secret" attribute)
2235
if (name != "secret" and
2236
value != old_client_settings[client_name]
2237
[name]):
2238
client[name] = value
2239
except KeyError:
2240
pass
2241
2242
# Clients who has passed its expire date can still be
2243
# enabled if its last checker was successful. Clients
2244
# whose checker failed before we stored its state is
2245
# assumed to have failed all checkers during downtime.
2246
if client["enabled"]:
2247
if datetime.datetime.utcnow() >= client["expires"]:
2248
if not client["last_checked_ok"]:
2249
logger.warning(
2250
"disabling client {0} - Client never "
2251
"performed a successfull checker"
2252
.format(client["name"]))
2253
client["enabled"] = False
2254
elif client["last_checker_status"] != 0:
2255
logger.warning(
2256
"disabling client {0} - Client "
2257
"last checker failed with error code {1}"
2258
.format(client["name"],
2259
client["last_checker_status"]))
2260
client["enabled"] = False
2261
else:
2262
client["expires"] = (datetime.datetime
2263
.utcnow()
2264
+ client["timeout"])
2265
2172
2266
try:
2173
# For each value in new config, check if it differs
2174
# from the old config value (Except for the "secret"
2175
# attribute)
2176
if (name != "secret" and
2177
value != old_client_settings[client_name][name]):
2178
setattr(client, name, value)
2179
except KeyError:
2180
pass
2181
2182
# Clients who has passed its expire date, can still be enabled
2183
# if its last checker was sucessful. Clients who checkers
2184
# failed before we stored it state is asumed to had failed
2185
# checker during downtime.
2186
if client["enabled"] and client["last_checked_ok"]:
2187
if ((datetime.datetime.utcnow()
2188
- client["last_checked_ok"]) > client["interval"]):
2189
if client["last_checker_status"] != 0:
2190
client["enabled"] = False
2191
else:
2192
client["expires"] = (datetime.datetime.utcnow()
2193
+ client["timeout"])
2194
2195
client["changedstate"] = (multiprocessing_manager
2196
.Condition(multiprocessing_manager
2197
.Lock()))
2198
if use_dbus:
2199
new_client = ClientDBusTransitional.__new__(
2200
ClientDBusTransitional)
2201
tcp_server.clients[client_name] = new_client
2202
new_client.bus = bus
2203
for name, value in client.iteritems():
2204
setattr(new_client, name, value)
2205
new_client._approvals_pending = 0
2206
new_client.add_to_dbus()
2207
else:
2208
tcp_server.clients[client_name] = Client.__new__(Client)
2209
for name, value in client.iteritems():
2210
setattr(tcp_server.clients[client_name], name, value)
2211
2212
tcp_server.clients[client_name].decrypt_secret(
2213
client_settings[client_name]["secret"])
2214
2215
# Create/remove clients based on new changes made to config
2216
for clientname in set(old_client_settings) - set(client_settings):
2217
del tcp_server.clients[clientname]
2218
for clientname in set(client_settings) - set(old_client_settings):
2219
tcp_server.clients[clientname] = client_class(name
2220
= clientname,
2221
config =
2222
client_settings
2223
[clientname])
2267
client["secret"] = (
2268
pgp.decrypt(client["encrypted_secret"],
2269
client_settings[client_name]
2270
["secret"]))
2271
except PGPError:
2272
# If decryption fails, we use secret from new settings
2273
logger.debug("Failed to decrypt {0} old secret"
2274
.format(client_name))
2275
client["secret"] = (
2276
client_settings[client_name]["secret"])
2277
2278
2279
# Add/remove clients based on new changes made to config
2280
for client_name in set(old_client_settings) - set(client_settings):
2281
del clients_data[client_name]
2282
for client_name in set(client_settings) - set(old_client_settings):
2283
clients_data[client_name] = client_settings[client_name]
2284
2285
# Create clients all clients
2286
for client_name, client in clients_data.iteritems():
2287
tcp_server.clients[client_name] = client_class(
2288
name = client_name, settings = client)
2224
2289
2225
2290
if not tcp_server.clients:
2226
2291
logger.warning("No clients defined")
2238
2303
# "pidfile" was never created
2239
2304
pass
2240
2305
del pidfilename
2241
2242
2306
signal.signal(signal.SIGINT, signal.SIG_IGN)
2243
2307
2244
2308
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2309
2373
multiprocessing.active_children()
2310
2374
if not (tcp_server.clients or client_settings):
2311
2375
return
2312
2376
2313
2377
# Store client before exiting. Secrets are encrypted with key
2314
2378
# based on what config file has. If config file is
2315
2379
# removed/edited, old secret will thus be unrecovable.
2316
clients = []
2317
for client in tcp_server.clients.itervalues():
2318
client.encrypt_secret(
2319
client_settings[client.name]["secret"])
2320
2321
client_dict = {}
2322
2323
# A list of attributes that will not be stored when
2324
# shutting down.
2325
exclude = set(("bus", "changedstate", "secret"))
2326
for name, typ in inspect.getmembers(dbus.service.Object):
2327
exclude.add(name)
2328
2329
client_dict["encrypted_secret"] = client.encrypted_secret
2330
for attr in client.client_structure:
2331
if attr not in exclude:
2332
client_dict[attr] = getattr(client, attr)
2333
2334
clients.append(client_dict)
2335
del client_settings[client.name]["secret"]
2336
2380
clients = {}
2381
with PGPEngine() as pgp:
2382
for client in tcp_server.clients.itervalues():
2383
key = client_settings[client.name]["secret"]
2384
client.encrypted_secret = pgp.encrypt(client.secret,
2385
key)
2386
client_dict = {}
2387
2388
# A list of attributes that can not be pickled
2389
# + secret.
2390
exclude = set(("bus", "changedstate", "secret",
2391
"checker"))
2392
for name, typ in (inspect.getmembers
2393
(dbus.service.Object)):
2394
exclude.add(name)
2395
2396
client_dict["encrypted_secret"] = (client
2397
.encrypted_secret)
2398
for attr in client.client_structure:
2399
if attr not in exclude:
2400
client_dict[attr] = getattr(client, attr)
2401
2402
clients[client.name] = client_dict
2403
del client_settings[client.name]["secret"]
2404
2337
2405
try:
2338
with os.fdopen(os.open(stored_state_path,
2339
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2340
stat.S_IRUSR | stat.S_IWUSR),
2341
"wb") as stored_state:
2406
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2407
prefix="clients-",
2408
dir=os.path.dirname
2409
(stored_state_path))
2410
with os.fdopen(tempfd, "wb") as stored_state:
2342
2411
pickle.dump((clients, client_settings), stored_state)
2343
except IOError as e:
2344
logger.warning("Could not save persistant state: {0}"
2412
os.rename(tempname, stored_state_path)
2413
except (IOError, OSError) as e:
2414
logger.warning("Could not save persistent state: {0}"
2345
2415
.format(e))
2346
if e.errno != errno.ENOENT:
2347
raise
2348
2416
if not debug:
2417
try:
2418
os.remove(tempname)
2419
except NameError:
2420
pass
2421
if e.errno not in set((errno.ENOENT, errno.EACCES,
2422
errno.EEXIST)):
2423
raise e
2424
2349
2425
# Delete all clients, and settings from config
2350
2426
while tcp_server.clients:
2351
2427
name, client = tcp_server.clients.popitem()
2369
2445
# Need to initiate checking of clients
2370
2446
if client.enabled:
2371
2447
client.init_checker()
2372
2373
2448
2374
2449
tcp_server.enable()
2375
2450
tcp_server.server_activate()
2415
2490
# Must run before the D-Bus bus name gets deregistered
2416
2491
cleanup()
2417
2492
2418
2419
2493
if __name__ == '__main__':
2420
2494
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0