To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 538
- compare with another revision
- download diff
- download tarball
- view history from revision 538
- Committer: teddy at recompile
- Date: 2011-12-27 12:15:06 UTC
- Revision ID: teddy@recompile.se-20111227121506-2qqqdy8evr9ts2ub
Add TODO entries about new D-Bus features we should use.
- files added:
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import hashlib
66
import binascii
67
import tempfile
67
68
68
69
import dbus
69
70
import dbus.service
74
75
import ctypes.util
75
76
import xml.dom.minidom
76
77
import inspect
77
import Crypto.Cipher.AES
78
import GnuPGInterface
78
79
79
80
try:
80
81
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
84
85
except ImportError:
85
86
SO_BINDTODEVICE = None
86
87
87
88
88
version = "1.4.1"
89
stored_state_path = "/var/lib/mandos/clients.pickle"
89
stored_state_file = "clients.pickle"
90
90
91
91
logger = logging.getLogger()
92
92
syslogger = (logging.handlers.SysLogHandler
93
93
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
94
address = str("/dev/log")))
95
95
96
def initlogger(level=logging.WARNING):
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(debug, level=logging.WARNING):
97
114
"""init logger and add loglevel"""
98
115
99
116
syslogger.setFormatter(logging.Formatter
101
118
' %(message)s'))
102
119
logger.addHandler(syslogger)
103
120
104
console = logging.StreamHandler()
105
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
106
' [%(process)d]:'
107
' %(levelname)s:'
108
' %(message)s'))
109
logger.addHandler(console)
121
if debug:
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
110
128
logger.setLevel(level)
111
129
112
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet'])
146
147
def __enter__(self):
148
return self
149
150
def __exit__ (self, exc_type, exc_value, traceback):
151
self._cleanup()
152
return False
153
154
def __del__(self):
155
self._cleanup()
156
157
def _cleanup(self):
158
if self.tempdir is not None:
159
# Delete contents of tempdir
160
for root, dirs, files in os.walk(self.tempdir,
161
topdown = False):
162
for filename in files:
163
os.remove(os.path.join(root, filename))
164
for dirname in dirs:
165
os.rmdir(os.path.join(root, dirname))
166
# Remove tempdir
167
os.rmdir(self.tempdir)
168
self.tempdir = None
169
170
def password_encode(self, password):
171
# Passphrase can not be empty and can not contain newlines or
172
# NUL bytes. So we prefix it and hex encode it.
173
return b"mandos" + binascii.hexlify(password)
174
175
def encrypt(self, data, password):
176
self.gnupg.passphrase = self.password_encode(password)
177
with open(os.devnull) as devnull:
178
try:
179
proc = self.gnupg.run(['--symmetric'],
180
create_fhs=['stdin', 'stdout'],
181
attach_fhs={'stderr': devnull})
182
with contextlib.closing(proc.handles['stdin']) as f:
183
f.write(data)
184
with contextlib.closing(proc.handles['stdout']) as f:
185
ciphertext = f.read()
186
proc.wait()
187
except IOError as e:
188
raise PGPError(e)
189
self.gnupg.passphrase = None
190
return ciphertext
191
192
def decrypt(self, data, password):
193
self.gnupg.passphrase = self.password_encode(password)
194
with open(os.devnull) as devnull:
195
try:
196
proc = self.gnupg.run(['--decrypt'],
197
create_fhs=['stdin', 'stdout'],
198
attach_fhs={'stderr': devnull})
199
with contextlib.closing(proc.handles['stdin'] ) as f:
200
f.write(data)
201
with contextlib.closing(proc.handles['stdout']) as f:
202
decrypted_plaintext = f.read()
203
proc.wait()
204
except IOError as e:
205
raise PGPError(e)
206
self.gnupg.passphrase = None
207
return decrypted_plaintext
208
209
210
113
211
class AvahiError(Exception):
114
212
def __init__(self, value, *args, **kwargs):
115
213
self.value = value
230
328
try:
231
329
self.group.Free()
232
330
except (dbus.exceptions.UnknownMethodException,
233
dbus.exceptions.DBusException) as e:
331
dbus.exceptions.DBusException):
234
332
pass
235
333
self.group = None
236
334
self.remove()
280
378
% self.name))
281
379
return ret
282
380
283
def _timedelta_to_milliseconds(td):
381
def timedelta_to_milliseconds(td):
284
382
"Convert a datetime.timedelta() to milliseconds"
285
383
return ((td.days * 24 * 60 * 60 * 1000)
286
384
+ (td.seconds * 1000)
290
388
"""A representation of a client host served by this server.
291
389
292
390
Attributes:
293
_approved: bool(); 'None' if not yet approved/disapproved
391
approved: bool(); 'None' if not yet approved/disapproved
294
392
approval_delay: datetime.timedelta(); Time to wait for approval
295
393
approval_duration: datetime.timedelta(); Duration of one approval
296
394
checker: subprocess.Popen(); a running checker process used
314
412
interval: datetime.timedelta(); How often to start a new checker
315
413
last_approval_request: datetime.datetime(); (UTC) or None
316
414
last_checked_ok: datetime.datetime(); (UTC) or None
317
last_checker_status: integer between 0 and 255 reflecting exit status
318
of last checker. -1 reflect crashed checker,
319
or None.
320
last_enabled: datetime.datetime(); (UTC)
415
last_checker_status: integer between 0 and 255 reflecting exit
416
status of last checker. -1 reflects crashed
417
checker, or None.
418
last_enabled: datetime.datetime(); (UTC) or None
321
419
name: string; from the config file, used in log messages and
322
420
D-Bus identifiers
323
421
secret: bytestring; sent verbatim (over TLS) to client
333
431
"created", "enabled", "fingerprint",
334
432
"host", "interval", "last_checked_ok",
335
433
"last_enabled", "name", "timeout")
434
client_defaults = { "timeout": "5m",
435
"extended_timeout": "15m",
436
"interval": "2m",
437
"checker": "fping -q -- %%(host)s",
438
"host": "",
439
"approval_delay": "0s",
440
"approval_duration": "1s",
441
"approved_by_default": "True",
442
"enabled": "True",
443
}
336
444
337
445
def timeout_milliseconds(self):
338
446
"Return the 'timeout' attribute in milliseconds"
339
return _timedelta_to_milliseconds(self.timeout)
447
return timedelta_to_milliseconds(self.timeout)
340
448
341
449
def extended_timeout_milliseconds(self):
342
450
"Return the 'extended_timeout' attribute in milliseconds"
343
return _timedelta_to_milliseconds(self.extended_timeout)
451
return timedelta_to_milliseconds(self.extended_timeout)
344
452
345
453
def interval_milliseconds(self):
346
454
"Return the 'interval' attribute in milliseconds"
347
return _timedelta_to_milliseconds(self.interval)
455
return timedelta_to_milliseconds(self.interval)
348
456
349
457
def approval_delay_milliseconds(self):
350
return _timedelta_to_milliseconds(self.approval_delay)
351
352
def __init__(self, name = None, config=None):
458
return timedelta_to_milliseconds(self.approval_delay)
459
460
@staticmethod
461
def config_parser(config):
462
""" Construct a new dict of client settings of this form:
463
{ client_name: {setting_name: value, ...}, ...}
464
with exceptions for any special settings as defined above"""
465
settings = {}
466
for client_name in config.sections():
467
section = dict(config.items(client_name))
468
client = settings[client_name] = {}
469
470
client["host"] = section["host"]
471
# Reformat values from string types to Python types
472
client["approved_by_default"] = config.getboolean(
473
client_name, "approved_by_default")
474
client["enabled"] = config.getboolean(client_name, "enabled")
475
476
client["fingerprint"] = (section["fingerprint"].upper()
477
.replace(" ", ""))
478
if "secret" in section:
479
client["secret"] = section["secret"].decode("base64")
480
elif "secfile" in section:
481
with open(os.path.expanduser(os.path.expandvars
482
(section["secfile"])),
483
"rb") as secfile:
484
client["secret"] = secfile.read()
485
else:
486
raise TypeError("No secret or secfile for section %s"
487
% section)
488
client["timeout"] = string_to_delta(section["timeout"])
489
client["extended_timeout"] = string_to_delta(
490
section["extended_timeout"])
491
client["interval"] = string_to_delta(section["interval"])
492
client["approval_delay"] = string_to_delta(
493
section["approval_delay"])
494
client["approval_duration"] = string_to_delta(
495
section["approval_duration"])
496
client["checker_command"] = section["checker"]
497
client["last_approval_request"] = None
498
client["last_checked_ok"] = None
499
client["last_checker_status"] = None
500
if client["enabled"]:
501
client["last_enabled"] = datetime.datetime.utcnow()
502
client["expires"] = (datetime.datetime.utcnow()
503
+ client["timeout"])
504
else:
505
client["last_enabled"] = None
506
client["expires"] = None
507
508
return settings
509
510
511
def __init__(self, settings, name = None):
353
512
"""Note: the 'checker' key in 'config' sets the
354
513
'checker_command' attribute and *not* the 'checker'
355
514
attribute."""
356
515
self.name = name
357
if config is None:
358
config = {}
516
# adding all client settings
517
for setting, value in settings.iteritems():
518
setattr(self, setting, value)
519
359
520
logger.debug("Creating client %r", self.name)
360
521
# Uppercase and remove spaces from fingerprint for later
361
522
# comparison purposes with return value from the fingerprint()
362
523
# function
363
self.fingerprint = (config["fingerprint"].upper()
364
.replace(" ", ""))
365
524
logger.debug(" Fingerprint: %s", self.fingerprint)
366
if "secret" in config:
367
self.secret = config["secret"].decode("base64")
368
elif "secfile" in config:
369
with open(os.path.expanduser(os.path.expandvars
370
(config["secfile"])),
371
"rb") as secfile:
372
self.secret = secfile.read()
373
else:
374
raise TypeError("No secret or secfile for client %s"
375
% self.name)
376
self.host = config.get("host", "")
377
self.created = datetime.datetime.utcnow()
378
self.enabled = True
379
self.last_approval_request = None
380
self.last_enabled = datetime.datetime.utcnow()
381
self.last_checked_ok = None
382
self.last_checker_status = None
383
self.timeout = string_to_delta(config["timeout"])
384
self.extended_timeout = string_to_delta(config
385
["extended_timeout"])
386
self.interval = string_to_delta(config["interval"])
525
self.created = settings.get("created", datetime.datetime.utcnow())
526
527
# attributes specific for this server instance
387
528
self.checker = None
388
529
self.checker_initiator_tag = None
389
530
self.disable_initiator_tag = None
390
self.expires = datetime.datetime.utcnow() + self.timeout
391
531
self.checker_callback_tag = None
392
self.checker_command = config["checker"]
393
532
self.current_checker_command = None
394
self._approved = None
395
self.approved_by_default = config.get("approved_by_default",
396
True)
533
self.approved = None
397
534
self.approvals_pending = 0
398
self.approval_delay = string_to_delta(
399
config["approval_delay"])
400
self.approval_duration = string_to_delta(
401
config["approval_duration"])
402
535
self.changedstate = (multiprocessing_manager
403
536
.Condition(multiprocessing_manager
404
537
.Lock()))
405
self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]
538
self.client_structure = [attr for attr in
539
self.__dict__.iterkeys()
540
if not attr.startswith("_")]
406
541
self.client_structure.append("client_structure")
407
408
542
409
543
for name, t in inspect.getmembers(type(self),
410
lambda obj: isinstance(obj, property)):
544
lambda obj:
545
isinstance(obj,
546
property)):
411
547
if not name.startswith("_"):
412
548
self.client_structure.append(name)
413
549
449
585
450
586
def __del__(self):
451
587
self.disable()
452
588
453
589
def init_checker(self):
454
590
# Schedule a new checker to be started an 'interval' from now,
455
591
# and every interval from then on.
462
598
self.disable))
463
599
# Also start a new checker *right now*.
464
600
self.start_checker()
465
466
601
467
602
def checker_callback(self, pid, condition, command):
468
603
"""The checker has completed, so take appropriate actions."""
469
604
self.checker_callback_tag = None
470
605
self.checker = None
471
606
if os.WIFEXITED(condition):
472
self.last_checker_status = os.WEXITSTATUS(condition)
607
self.last_checker_status = os.WEXITSTATUS(condition)
473
608
if self.last_checker_status == 0:
474
609
logger.info("Checker for %(name)s succeeded",
475
610
vars(self))
495
630
gobject.source_remove(self.disable_initiator_tag)
496
631
if getattr(self, "enabled", False):
497
632
self.disable_initiator_tag = (gobject.timeout_add
498
(_timedelta_to_milliseconds
633
(timedelta_to_milliseconds
499
634
(timeout), self.disable))
500
635
self.expires = datetime.datetime.utcnow() + timeout
501
636
595
730
raise
596
731
self.checker = None
597
732
598
# Encrypts a client secret and stores it in a varible encrypted_secret
599
def encrypt_secret(self, key):
600
# Encryption-key need to be of a specific size, so we hash inputed key
601
hasheng = hashlib.sha256()
602
hasheng.update(key)
603
encryptionkey = hasheng.digest()
604
605
# Create validation hash so we know at decryption if it was sucessful
606
hasheng = hashlib.sha256()
607
hasheng.update(self.secret)
608
validationhash = hasheng.digest()
609
610
# Encrypt secret
611
iv = os.urandom(Crypto.Cipher.AES.block_size)
612
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
613
Crypto.Cipher.AES.MODE_CFB, iv)
614
ciphertext = ciphereng.encrypt(validationhash+self.secret)
615
self.encrypted_secret = (ciphertext, iv)
616
617
# Decrypt a encrypted client secret
618
def decrypt_secret(self, key):
619
# Decryption-key need to be of a specific size, so we hash inputed key
620
hasheng = hashlib.sha256()
621
hasheng.update(key)
622
encryptionkey = hasheng.digest()
623
624
# Decrypt encrypted secret
625
ciphertext, iv = self.encrypted_secret
626
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
627
Crypto.Cipher.AES.MODE_CFB, iv)
628
plain = ciphereng.decrypt(ciphertext)
629
630
# Validate decrypted secret to know if it was succesful
631
hasheng = hashlib.sha256()
632
validationhash = plain[:hasheng.digest_size]
633
secret = plain[hasheng.digest_size:]
634
hasheng.update(secret)
635
636
# if validation fails, we use key as new secret. Otherwhise, we use
637
# the decrypted secret
638
if hasheng.digest() == validationhash:
639
self.secret = secret
640
else:
641
self.secret = key
642
del self.encrypted_secret
643
644
733
645
734
def dbus_service_property(dbus_interface, signature="v",
646
735
access="readwrite", byte_arrays=False):
764
853
765
854
Note: Will not include properties with access="write".
766
855
"""
767
all = {}
856
properties = {}
768
857
for name, prop in self._get_all_dbus_properties():
769
858
if (interface_name
770
859
and interface_name != prop._dbus_interface):
775
864
continue
776
865
value = prop()
777
866
if not hasattr(value, "variant_level"):
778
all[name] = value
867
properties[name] = value
779
868
continue
780
all[name] = type(value)(value, variant_level=
781
value.variant_level+1)
782
return dbus.Dictionary(all, signature="sv")
869
properties[name] = type(value)(value, variant_level=
870
value.variant_level+1)
871
return dbus.Dictionary(properties, signature="sv")
783
872
784
873
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
785
874
out_signature="s",
836
925
return dbus.String(dt.isoformat(),
837
926
variant_level=variant_level)
838
927
928
839
929
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
840
930
.__metaclass__):
841
931
"""Applied to an empty subclass of a D-Bus object, this metaclass
933
1023
attribute.func_closure)))
934
1024
return type.__new__(mcs, name, bases, attr)
935
1025
1026
936
1027
class ClientDBus(Client, DBusObjectWithProperties):
937
1028
"""A Client class using D-Bus
938
1029
949
1040
def __init__(self, bus = None, *args, **kwargs):
950
1041
self.bus = bus
951
1042
Client.__init__(self, *args, **kwargs)
952
1043
self._approvals_pending = 0
1044
953
1045
self._approvals_pending = 0
954
1046
# Only now, when this client is initialized, can it show up on
955
1047
# the D-Bus
966
1058
variant_level=1):
967
1059
""" Modify a variable so that it's a property which announces
968
1060
its changes to DBus.
969
1061
970
1062
transform_fun: Function that takes a value and a variant_level
971
1063
and transforms it to a D-Bus type.
972
1064
dbus_name: D-Bus name of the variable
1006
1098
datetime_to_dbus, "LastApprovalRequest")
1007
1099
approved_by_default = notifychangeproperty(dbus.Boolean,
1008
1100
"ApprovedByDefault")
1009
approval_delay = notifychangeproperty(dbus.UInt16,
1101
approval_delay = notifychangeproperty(dbus.UInt64,
1010
1102
"ApprovalDelay",
1011
1103
type_func =
1012
_timedelta_to_milliseconds)
1104
timedelta_to_milliseconds)
1013
1105
approval_duration = notifychangeproperty(
1014
dbus.UInt16, "ApprovalDuration",
1015
type_func = _timedelta_to_milliseconds)
1106
dbus.UInt64, "ApprovalDuration",
1107
type_func = timedelta_to_milliseconds)
1016
1108
host = notifychangeproperty(dbus.String, "Host")
1017
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1109
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1018
1110
type_func =
1019
_timedelta_to_milliseconds)
1111
timedelta_to_milliseconds)
1020
1112
extended_timeout = notifychangeproperty(
1021
dbus.UInt16, "ExtendedTimeout",
1022
type_func = _timedelta_to_milliseconds)
1023
interval = notifychangeproperty(dbus.UInt16,
1113
dbus.UInt64, "ExtendedTimeout",
1114
type_func = timedelta_to_milliseconds)
1115
interval = notifychangeproperty(dbus.UInt64,
1024
1116
"Interval",
1025
1117
type_func =
1026
_timedelta_to_milliseconds)
1118
timedelta_to_milliseconds)
1027
1119
checker_command = notifychangeproperty(dbus.String, "Checker")
1028
1120
1029
1121
del notifychangeproperty
1071
1163
return r
1072
1164
1073
1165
def _reset_approved(self):
1074
self._approved = None
1166
self.approved = None
1075
1167
return False
1076
1168
1077
1169
def approve(self, value=True):
1078
1170
self.send_changedstate()
1079
self._approved = value
1080
gobject.timeout_add(_timedelta_to_milliseconds
1171
self.approved = value
1172
gobject.timeout_add(timedelta_to_milliseconds
1081
1173
(self.approval_duration),
1082
1174
self._reset_approved)
1083
1175
1133
1225
Is sent after a client request a password.
1134
1226
"""
1135
1227
pass
1136
1228
1137
1229
## Methods
1138
1230
1139
1231
# Approve - method
1197
1289
access="readwrite")
1198
1290
def ApprovalDuration_dbus_property(self, value=None):
1199
1291
if value is None: # get
1200
return dbus.UInt64(_timedelta_to_milliseconds(
1292
return dbus.UInt64(timedelta_to_milliseconds(
1201
1293
self.approval_duration))
1202
1294
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1203
1295
1217
1309
def Host_dbus_property(self, value=None):
1218
1310
if value is None: # get
1219
1311
return dbus.String(self.host)
1220
self.host = value
1312
self.host = unicode(value)
1221
1313
1222
1314
# Created - property
1223
1315
@dbus_service_property(_interface, signature="s", access="read")
1224
1316
def Created_dbus_property(self):
1225
return dbus.String(datetime_to_dbus(self.created))
1317
return datetime_to_dbus(self.created)
1226
1318
1227
1319
# LastEnabled - property
1228
1320
@dbus_service_property(_interface, signature="s", access="read")
1272
1364
gobject.source_remove(self.disable_initiator_tag)
1273
1365
self.disable_initiator_tag = None
1274
1366
self.expires = None
1275
time_to_die = _timedelta_to_milliseconds((self
1276
.last_checked_ok
1277
+ self.timeout)
1278
- datetime.datetime
1279
.utcnow())
1367
time_to_die = timedelta_to_milliseconds((self
1368
.last_checked_ok
1369
+ self.timeout)
1370
- datetime.datetime
1371
.utcnow())
1280
1372
if time_to_die <= 0:
1281
1373
# The timeout has passed
1282
1374
self.disable()
1304
1396
self.interval = datetime.timedelta(0, 0, 0, value)
1305
1397
if getattr(self, "checker_initiator_tag", None) is None:
1306
1398
return
1307
# Reschedule checker run
1308
gobject.source_remove(self.checker_initiator_tag)
1309
self.checker_initiator_tag = (gobject.timeout_add
1310
(value, self.start_checker))
1311
self.start_checker() # Start one now, too
1399
if self.enabled:
1400
# Reschedule checker run
1401
gobject.source_remove(self.checker_initiator_tag)
1402
self.checker_initiator_tag = (gobject.timeout_add
1403
(value, self.start_checker))
1404
self.start_checker() # Start one now, too
1312
1405
1313
1406
# Checker - property
1314
1407
@dbus_service_property(_interface, signature="s",
1316
1409
def Checker_dbus_property(self, value=None):
1317
1410
if value is None: # get
1318
1411
return dbus.String(self.checker_command)
1319
self.checker_command = value
1412
self.checker_command = unicode(value)
1320
1413
1321
1414
# CheckerRunning - property
1322
1415
@dbus_service_property(_interface, signature="b",
1351
1444
raise KeyError()
1352
1445
1353
1446
def __getattribute__(self, name):
1354
if(name == '_pipe'):
1447
if name == '_pipe':
1355
1448
return super(ProxyClient, self).__getattribute__(name)
1356
1449
self._pipe.send(('getattr', name))
1357
1450
data = self._pipe.recv()
1364
1457
return func
1365
1458
1366
1459
def __setattr__(self, name, value):
1367
if(name == '_pipe'):
1460
if name == '_pipe':
1368
1461
return super(ProxyClient, self).__setattr__(name, value)
1369
1462
self._pipe.send(('setattr', name, value))
1370
1463
1464
1371
1465
class ClientDBusTransitional(ClientDBus):
1372
1466
__metaclass__ = AlternateDBusNamesMetaclass
1373
1467
1468
1374
1469
class ClientHandler(socketserver.BaseRequestHandler, object):
1375
1470
"""A class to handle client connections.
1376
1471
1437
1532
logger.warning("Bad certificate: %s", error)
1438
1533
return
1439
1534
logger.debug("Fingerprint: %s", fpr)
1440
if self.server.use_dbus:
1441
# Emit D-Bus signal
1442
client.NewRequest(str(self.client_address))
1443
1535
1444
1536
try:
1445
1537
client = ProxyClient(child_pipe, fpr,
1447
1539
except KeyError:
1448
1540
return
1449
1541
1542
if self.server.use_dbus:
1543
# Emit D-Bus signal
1544
client.NewRequest(str(self.client_address))
1545
1450
1546
if client.approval_delay:
1451
1547
delay = client.approval_delay
1452
1548
client.approvals_pending += 1
1461
1557
client.Rejected("Disabled")
1462
1558
return
1463
1559
1464
if client._approved or not client.approval_delay:
1560
if client.approved or not client.approval_delay:
1465
1561
#We are approved or approval is disabled
1466
1562
break
1467
elif client._approved is None:
1563
elif client.approved is None:
1468
1564
logger.info("Client %s needs approval",
1469
1565
client.name)
1470
1566
if self.server.use_dbus:
1484
1580
time = datetime.datetime.now()
1485
1581
client.changedstate.acquire()
1486
1582
(client.changedstate.wait
1487
(float(client._timedelta_to_milliseconds(delay)
1583
(float(client.timedelta_to_milliseconds(delay)
1488
1584
/ 1000)))
1489
1585
client.changedstate.release()
1490
1586
time2 = datetime.datetime.now()
1589
1685
# Convert the buffer to a Python bytestring
1590
1686
fpr = ctypes.string_at(buf, buf_len.value)
1591
1687
# Convert the bytestring to hexadecimal notation
1592
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1688
hex_fpr = binascii.hexlify(fpr).upper()
1593
1689
return hex_fpr
1594
1690
1595
1691
1598
1694
def sub_process_main(self, request, address):
1599
1695
try:
1600
1696
self.finish_request(request, address)
1601
except:
1697
except Exception:
1602
1698
self.handle_error(request, address)
1603
1699
self.close_request(request)
1604
1700
1852
1948
return timevalue
1853
1949
1854
1950
1855
def if_nametoindex(interface):
1856
"""Call the C function if_nametoindex(), or equivalent
1857
1858
Note: This function cannot accept a unicode string."""
1859
global if_nametoindex
1860
try:
1861
if_nametoindex = (ctypes.cdll.LoadLibrary
1862
(ctypes.util.find_library("c"))
1863
.if_nametoindex)
1864
except (OSError, AttributeError):
1865
logger.warning("Doing if_nametoindex the hard way")
1866
def if_nametoindex(interface):
1867
"Get an interface index the hard way, i.e. using fcntl()"
1868
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1869
with contextlib.closing(socket.socket()) as s:
1870
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1871
struct.pack(str("16s16x"),
1872
interface))
1873
interface_index = struct.unpack(str("I"),
1874
ifreq[16:20])[0]
1875
return interface_index
1876
return if_nametoindex(interface)
1877
1878
1879
1951
def daemon(nochdir = False, noclose = False):
1880
1952
"""See daemon(3). Standard BSD Unix function.
1881
1953
1937
2009
parser.add_argument("--no-ipv6", action="store_false",
1938
2010
dest="use_ipv6", help="Do not use IPv6")
1939
2011
parser.add_argument("--no-restore", action="store_false",
1940
dest="restore", help="Do not restore stored state",
1941
default=True)
1942
2012
dest="restore", help="Do not restore stored"
2013
" state")
2014
parser.add_argument("--statedir", metavar="DIR",
2015
help="Directory to save/restore state in")
2016
1943
2017
options = parser.parse_args()
1944
2018
1945
2019
if options.check:
1958
2032
"use_dbus": "True",
1959
2033
"use_ipv6": "True",
1960
2034
"debuglevel": "",
2035
"restore": "True",
2036
"statedir": "/var/lib/mandos"
1961
2037
}
1962
2038
1963
2039
# Parse config file for server-global settings
1980
2056
# options, if set.
1981
2057
for option in ("interface", "address", "port", "debug",
1982
2058
"priority", "servicename", "configdir",
1983
"use_dbus", "use_ipv6", "debuglevel", "restore"):
2059
"use_dbus", "use_ipv6", "debuglevel", "restore",
2060
"statedir"):
1984
2061
value = getattr(options, option)
1985
2062
if value is not None:
1986
2063
server_settings[option] = value
1998
2075
debuglevel = server_settings["debuglevel"]
1999
2076
use_dbus = server_settings["use_dbus"]
2000
2077
use_ipv6 = server_settings["use_ipv6"]
2078
stored_state_path = os.path.join(server_settings["statedir"],
2079
stored_state_file)
2001
2080
2002
2081
if debug:
2003
initlogger(logging.DEBUG)
2082
initlogger(debug, logging.DEBUG)
2004
2083
else:
2005
2084
if not debuglevel:
2006
initlogger()
2085
initlogger(debug)
2007
2086
else:
2008
2087
level = getattr(logging, debuglevel.upper())
2009
initlogger(level)
2088
initlogger(debug, level)
2010
2089
2011
2090
if server_settings["servicename"] != "Mandos":
2012
2091
syslogger.setFormatter(logging.Formatter
2015
2094
% server_settings["servicename"]))
2016
2095
2017
2096
# Parse config file with clients
2018
client_defaults = { "timeout": "5m",
2019
"extended_timeout": "15m",
2020
"interval": "2m",
2021
"checker": "fping -q -- %%(host)s",
2022
"host": "",
2023
"approval_delay": "0s",
2024
"approval_duration": "1s",
2025
}
2026
client_config = configparser.SafeConfigParser(client_defaults)
2097
client_config = configparser.SafeConfigParser(Client.client_defaults)
2027
2098
client_config.read(os.path.join(server_settings["configdir"],
2028
2099
"clients.conf"))
2029
2100
2086
2157
os.dup2(null, sys.stdin.fileno())
2087
2158
if null > 2:
2088
2159
os.close(null)
2089
else:
2090
# No console logging
2091
logger.removeHandler(console)
2092
2160
2093
2161
# Need to fork before connecting to D-Bus
2094
2162
if not debug:
2095
2163
# Close all input and output, do double fork, etc.
2096
2164
daemon()
2097
2165
2166
gobject.threads_init()
2167
2098
2168
global main_loop
2099
2169
# From the Avahi example code
2100
2170
DBusGMainLoop(set_as_default=True )
2130
2200
client_class = functools.partial(ClientDBusTransitional,
2131
2201
bus = bus)
2132
2202
2133
special_settings = {
2134
# Some settings need to be accessd by special methods;
2135
# booleans need .getboolean(), etc. Here is a list of them:
2136
"approved_by_default":
2137
lambda section:
2138
client_config.getboolean(section, "approved_by_default"),
2139
}
2140
# Construct a new dict of client settings of this form:
2141
# { client_name: {setting_name: value, ...}, ...}
2142
# with exceptions for any special settings as defined above
2143
client_settings = dict((clientname,
2144
dict((setting,
2145
(value if setting not in special_settings
2146
else special_settings[setting](clientname)))
2147
for setting, value in client_config.items(clientname)))
2148
for clientname in client_config.sections())
2149
2203
client_settings = Client.config_parser(client_config)
2150
2204
old_client_settings = {}
2151
clients_data = []
2152
2153
# Get client data and settings from last running state.
2205
clients_data = {}
2206
2207
# Get client data and settings from last running state.
2154
2208
if server_settings["restore"]:
2155
2209
try:
2156
2210
with open(stored_state_path, "rb") as stored_state:
2157
clients_data, old_client_settings = pickle.load(stored_state)
2211
clients_data, old_client_settings = (pickle.load
2212
(stored_state))
2158
2213
os.remove(stored_state_path)
2159
2214
except IOError as e:
2160
logger.warning("Could not load persistant state: {0}".format(e))
2215
logger.warning("Could not load persistent state: {0}"
2216
.format(e))
2161
2217
if e.errno != errno.ENOENT:
2162
2218
raise
2163
2164
for client in clients_data:
2165
client_name = client["name"]
2166
2167
# Decide which value to use after restoring saved state.
2168
# We have three different values: Old config file,
2169
# new config file, and saved state.
2170
# New config value takes precedence if it differs from old
2171
# config value, otherwise use saved state.
2172
for name, value in client_settings[client_name].items():
2219
except EOFError as e:
2220
logger.warning("Could not load persistent state: "
2221
"EOFError: {0}".format(e))
2222
2223
with PGPEngine() as pgp:
2224
for client_name, client in clients_data.iteritems():
2225
# Decide which value to use after restoring saved state.
2226
# We have three different values: Old config file,
2227
# new config file, and saved state.
2228
# New config value takes precedence if it differs from old
2229
# config value, otherwise use saved state.
2230
for name, value in client_settings[client_name].items():
2231
try:
2232
# For each value in new config, check if it
2233
# differs from the old config value (Except for
2234
# the "secret" attribute)
2235
if (name != "secret" and
2236
value != old_client_settings[client_name]
2237
[name]):
2238
client[name] = value
2239
except KeyError:
2240
pass
2241
2242
# Clients who has passed its expire date can still be
2243
# enabled if its last checker was successful. Clients
2244
# whose checker failed before we stored its state is
2245
# assumed to have failed all checkers during downtime.
2246
if client["enabled"]:
2247
if datetime.datetime.utcnow() >= client["expires"]:
2248
if not client["last_checked_ok"]:
2249
logger.warning(
2250
"disabling client {0} - Client never "
2251
"performed a successfull checker"
2252
.format(client["name"]))
2253
client["enabled"] = False
2254
elif client["last_checker_status"] != 0:
2255
logger.warning(
2256
"disabling client {0} - Client "
2257
"last checker failed with error code {1}"
2258
.format(client["name"],
2259
client["last_checker_status"]))
2260
client["enabled"] = False
2261
else:
2262
client["expires"] = (datetime.datetime
2263
.utcnow()
2264
+ client["timeout"])
2265
2173
2266
try:
2174
# For each value in new config, check if it differs
2175
# from the old config value (Except for the "secret"
2176
# attribute)
2177
if name != "secret" and value != old_client_settings[client_name][name]:
2178
setattr(client, name, value)
2179
except KeyError:
2180
pass
2181
2182
# Clients who has passed its expire date, can still be enabled if its
2183
# last checker was sucessful. Clients who checkers failed before we
2184
# stored it state is asumed to had failed checker during downtime.
2185
if client["enabled"] and client["last_checked_ok"]:
2186
if ((datetime.datetime.utcnow() - client["last_checked_ok"])
2187
> client["interval"]):
2188
if client["last_checker_status"] != 0:
2189
client["enabled"] = False
2190
else:
2191
client["expires"] = datetime.datetime.utcnow() + client["timeout"]
2192
2193
client["changedstate"] = (multiprocessing_manager
2194
.Condition(multiprocessing_manager
2195
.Lock()))
2196
if use_dbus:
2197
new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)
2198
tcp_server.clients[client_name] = new_client
2199
new_client.bus = bus
2200
for name, value in client.iteritems():
2201
setattr(new_client, name, value)
2202
client_object_name = unicode(client_name).translate(
2203
{ord("."): ord("_"),
2204
ord("-"): ord("_")})
2205
new_client.dbus_object_path = (dbus.ObjectPath
2206
("/clients/" + client_object_name))
2207
DBusObjectWithProperties.__init__(new_client,
2208
new_client.bus,
2209
new_client.dbus_object_path)
2210
else:
2211
tcp_server.clients[client_name] = Client.__new__(Client)
2212
for name, value in client.iteritems():
2213
setattr(tcp_server.clients[client_name], name, value)
2214
2215
tcp_server.clients[client_name].decrypt_secret(
2216
client_settings[client_name]["secret"])
2217
2218
# Create/remove clients based on new changes made to config
2219
for clientname in set(old_client_settings) - set(client_settings):
2220
del tcp_server.clients[clientname]
2221
for clientname in set(client_settings) - set(old_client_settings):
2222
tcp_server.clients[clientname] = (client_class(name = clientname,
2223
config =
2224
client_settings
2225
[clientname]))
2226
2227
2267
client["secret"] = (
2268
pgp.decrypt(client["encrypted_secret"],
2269
client_settings[client_name]
2270
["secret"]))
2271
except PGPError:
2272
# If decryption fails, we use secret from new settings
2273
logger.debug("Failed to decrypt {0} old secret"
2274
.format(client_name))
2275
client["secret"] = (
2276
client_settings[client_name]["secret"])
2277
2278
2279
# Add/remove clients based on new changes made to config
2280
for client_name in set(old_client_settings) - set(client_settings):
2281
del clients_data[client_name]
2282
for client_name in set(client_settings) - set(old_client_settings):
2283
clients_data[client_name] = client_settings[client_name]
2284
2285
# Create clients all clients
2286
for client_name, client in clients_data.iteritems():
2287
tcp_server.clients[client_name] = client_class(
2288
name = client_name, settings = client)
2289
2228
2290
if not tcp_server.clients:
2229
2291
logger.warning("No clients defined")
2230
2292
2241
2303
# "pidfile" was never created
2242
2304
pass
2243
2305
del pidfilename
2244
2245
2306
signal.signal(signal.SIGINT, signal.SIG_IGN)
2246
2307
2247
2308
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2312
2373
multiprocessing.active_children()
2313
2374
if not (tcp_server.clients or client_settings):
2314
2375
return
2315
2316
# Store client before exiting. Secrets are encrypted with key based
2317
# on what config file has. If config file is removed/edited, old
2318
# secret will thus be unrecovable.
2319
clients = []
2320
for client in tcp_server.clients.itervalues():
2321
client.encrypt_secret(client_settings[client.name]["secret"])
2322
2323
client_dict = {}
2324
2325
# A list of attributes that will not be stored when shuting down.
2326
exclude = set(("bus", "changedstate", "secret"))
2327
for name, typ in inspect.getmembers(dbus.service.Object):
2328
exclude.add(name)
2329
2330
client_dict["encrypted_secret"] = client.encrypted_secret
2331
for attr in client.client_structure:
2332
if attr not in exclude:
2333
client_dict[attr] = getattr(client, attr)
2334
2335
clients.append(client_dict)
2336
del client_settings[client.name]["secret"]
2337
2376
2377
# Store client before exiting. Secrets are encrypted with key
2378
# based on what config file has. If config file is
2379
# removed/edited, old secret will thus be unrecovable.
2380
clients = {}
2381
with PGPEngine() as pgp:
2382
for client in tcp_server.clients.itervalues():
2383
key = client_settings[client.name]["secret"]
2384
client.encrypted_secret = pgp.encrypt(client.secret,
2385
key)
2386
client_dict = {}
2387
2388
# A list of attributes that can not be pickled
2389
# + secret.
2390
exclude = set(("bus", "changedstate", "secret",
2391
"checker"))
2392
for name, typ in (inspect.getmembers
2393
(dbus.service.Object)):
2394
exclude.add(name)
2395
2396
client_dict["encrypted_secret"] = (client
2397
.encrypted_secret)
2398
for attr in client.client_structure:
2399
if attr not in exclude:
2400
client_dict[attr] = getattr(client, attr)
2401
2402
clients[client.name] = client_dict
2403
del client_settings[client.name]["secret"]
2404
2338
2405
try:
2339
with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:
2406
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2407
prefix="clients-",
2408
dir=os.path.dirname
2409
(stored_state_path))
2410
with os.fdopen(tempfd, "wb") as stored_state:
2340
2411
pickle.dump((clients, client_settings), stored_state)
2341
except IOError as e:
2342
logger.warning("Could not save persistant state: {0}".format(e))
2343
if e.errno != errno.ENOENT:
2344
raise
2345
2412
os.rename(tempname, stored_state_path)
2413
except (IOError, OSError) as e:
2414
logger.warning("Could not save persistent state: {0}"
2415
.format(e))
2416
if not debug:
2417
try:
2418
os.remove(tempname)
2419
except NameError:
2420
pass
2421
if e.errno not in set((errno.ENOENT, errno.EACCES,
2422
errno.EEXIST)):
2423
raise e
2424
2346
2425
# Delete all clients, and settings from config
2347
2426
while tcp_server.clients:
2348
2427
name, client = tcp_server.clients.popitem()
2366
2445
# Need to initiate checking of clients
2367
2446
if client.enabled:
2368
2447
client.init_checker()
2369
2370
2448
2371
2449
tcp_server.enable()
2372
2450
tcp_server.server_activate()
2412
2490
# Must run before the D-Bus bus name gets deregistered
2413
2491
cleanup()
2414
2492
2415
2416
2493
if __name__ == '__main__':
2417
2494
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0