To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 539
- compare with another revision
- download diff
- download tarball
- view history from revision 539
- Committer: teddy at recompile
- Date: 2011-12-27 14:15:40 UTC
- Revision ID: teddy@recompile.se-20111227141540-ajrabf33q59jfa7t
Reorder TODO entries
- files added:
- network-hooks.d/openvpn
- files modified:
- DBUS-API
added
removed
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import binascii
67
import tempfile
66
68
67
69
import dbus
68
70
import dbus.service
73
75
import ctypes.util
74
76
import xml.dom.minidom
75
77
import inspect
78
import GnuPGInterface
76
79
77
80
try:
78
81
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
82
85
except ImportError:
83
86
SO_BINDTODEVICE = None
84
87
85
86
88
version = "1.4.1"
89
stored_state_file = "clients.pickle"
87
90
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
91
logger = logging.getLogger()
90
92
syslogger = (logging.handlers.SysLogHandler
91
93
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
94
address = str("/dev/log")))
93
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
96
logger.addHandler(syslogger)
97
98
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
102
logger.addHandler(console)
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(debug, level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
if debug:
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet'])
146
147
def __enter__(self):
148
return self
149
150
def __exit__ (self, exc_type, exc_value, traceback):
151
self._cleanup()
152
return False
153
154
def __del__(self):
155
self._cleanup()
156
157
def _cleanup(self):
158
if self.tempdir is not None:
159
# Delete contents of tempdir
160
for root, dirs, files in os.walk(self.tempdir,
161
topdown = False):
162
for filename in files:
163
os.remove(os.path.join(root, filename))
164
for dirname in dirs:
165
os.rmdir(os.path.join(root, dirname))
166
# Remove tempdir
167
os.rmdir(self.tempdir)
168
self.tempdir = None
169
170
def password_encode(self, password):
171
# Passphrase can not be empty and can not contain newlines or
172
# NUL bytes. So we prefix it and hex encode it.
173
return b"mandos" + binascii.hexlify(password)
174
175
def encrypt(self, data, password):
176
self.gnupg.passphrase = self.password_encode(password)
177
with open(os.devnull) as devnull:
178
try:
179
proc = self.gnupg.run(['--symmetric'],
180
create_fhs=['stdin', 'stdout'],
181
attach_fhs={'stderr': devnull})
182
with contextlib.closing(proc.handles['stdin']) as f:
183
f.write(data)
184
with contextlib.closing(proc.handles['stdout']) as f:
185
ciphertext = f.read()
186
proc.wait()
187
except IOError as e:
188
raise PGPError(e)
189
self.gnupg.passphrase = None
190
return ciphertext
191
192
def decrypt(self, data, password):
193
self.gnupg.passphrase = self.password_encode(password)
194
with open(os.devnull) as devnull:
195
try:
196
proc = self.gnupg.run(['--decrypt'],
197
create_fhs=['stdin', 'stdout'],
198
attach_fhs={'stderr': devnull})
199
with contextlib.closing(proc.handles['stdin'] ) as f:
200
f.write(data)
201
with contextlib.closing(proc.handles['stdout']) as f:
202
decrypted_plaintext = f.read()
203
proc.wait()
204
except IOError as e:
205
raise PGPError(e)
206
self.gnupg.passphrase = None
207
return decrypted_plaintext
208
209
103
210
104
211
class AvahiError(Exception):
105
212
def __init__(self, value, *args, **kwargs):
164
271
.GetAlternativeServiceName(self.name))
165
272
logger.info("Changing Zeroconf service name to %r ...",
166
273
self.name)
167
syslogger.setFormatter(logging.Formatter
168
('Mandos (%s) [%%(process)d]:'
169
' %%(levelname)s: %%(message)s'
170
% self.name))
171
274
self.remove()
172
275
try:
173
276
self.add()
193
296
avahi.DBUS_INTERFACE_ENTRY_GROUP)
194
297
self.entry_group_state_changed_match = (
195
298
self.group.connect_to_signal(
196
'StateChanged', self .entry_group_state_changed))
299
'StateChanged', self.entry_group_state_changed))
197
300
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
198
301
self.name, self.type)
199
302
self.group.AddService(
225
328
try:
226
329
self.group.Free()
227
330
except (dbus.exceptions.UnknownMethodException,
228
dbus.exceptions.DBusException) as e:
331
dbus.exceptions.DBusException):
229
332
pass
230
333
self.group = None
231
334
self.remove()
265
368
self.server_state_changed)
266
369
self.server_state_changed(self.server.GetState())
267
370
371
class AvahiServiceToSyslog(AvahiService):
372
def rename(self):
373
"""Add the new name to the syslog messages"""
374
ret = AvahiService.rename(self)
375
syslogger.setFormatter(logging.Formatter
376
('Mandos (%s) [%%(process)d]:'
377
' %%(levelname)s: %%(message)s'
378
% self.name))
379
return ret
268
380
269
def _timedelta_to_milliseconds(td):
381
def timedelta_to_milliseconds(td):
270
382
"Convert a datetime.timedelta() to milliseconds"
271
383
return ((td.days * 24 * 60 * 60 * 1000)
272
384
+ (td.seconds * 1000)
276
388
"""A representation of a client host served by this server.
277
389
278
390
Attributes:
279
_approved: bool(); 'None' if not yet approved/disapproved
391
approved: bool(); 'None' if not yet approved/disapproved
280
392
approval_delay: datetime.timedelta(); Time to wait for approval
281
393
approval_duration: datetime.timedelta(); Duration of one approval
282
394
checker: subprocess.Popen(); a running checker process used
289
401
instance %(name)s can be used in the command.
290
402
checker_initiator_tag: a gobject event source tag, or None
291
403
created: datetime.datetime(); (UTC) object creation
404
client_structure: Object describing what attributes a client has
405
and is used for storing the client at exit
292
406
current_checker_command: string; current running checker_command
293
disable_hook: If set, called by disable() as disable_hook(self)
294
407
disable_initiator_tag: a gobject event source tag, or None
295
408
enabled: bool()
296
409
fingerprint: string (40 or 32 hexadecimal digits); used to
299
412
interval: datetime.timedelta(); How often to start a new checker
300
413
last_approval_request: datetime.datetime(); (UTC) or None
301
414
last_checked_ok: datetime.datetime(); (UTC) or None
302
last_enabled: datetime.datetime(); (UTC)
415
last_checker_status: integer between 0 and 255 reflecting exit
416
status of last checker. -1 reflects crashed
417
checker, or None.
418
last_enabled: datetime.datetime(); (UTC) or None
303
419
name: string; from the config file, used in log messages and
304
420
D-Bus identifiers
305
421
secret: bytestring; sent verbatim (over TLS) to client
315
431
"created", "enabled", "fingerprint",
316
432
"host", "interval", "last_checked_ok",
317
433
"last_enabled", "name", "timeout")
434
client_defaults = { "timeout": "5m",
435
"extended_timeout": "15m",
436
"interval": "2m",
437
"checker": "fping -q -- %%(host)s",
438
"host": "",
439
"approval_delay": "0s",
440
"approval_duration": "1s",
441
"approved_by_default": "True",
442
"enabled": "True",
443
}
318
444
319
445
def timeout_milliseconds(self):
320
446
"Return the 'timeout' attribute in milliseconds"
321
return _timedelta_to_milliseconds(self.timeout)
447
return timedelta_to_milliseconds(self.timeout)
322
448
323
449
def extended_timeout_milliseconds(self):
324
450
"Return the 'extended_timeout' attribute in milliseconds"
325
return _timedelta_to_milliseconds(self.extended_timeout)
451
return timedelta_to_milliseconds(self.extended_timeout)
326
452
327
453
def interval_milliseconds(self):
328
454
"Return the 'interval' attribute in milliseconds"
329
return _timedelta_to_milliseconds(self.interval)
455
return timedelta_to_milliseconds(self.interval)
330
456
331
457
def approval_delay_milliseconds(self):
332
return _timedelta_to_milliseconds(self.approval_delay)
333
334
def __init__(self, name = None, disable_hook=None, config=None):
458
return timedelta_to_milliseconds(self.approval_delay)
459
460
@staticmethod
461
def config_parser(config):
462
""" Construct a new dict of client settings of this form:
463
{ client_name: {setting_name: value, ...}, ...}
464
with exceptions for any special settings as defined above"""
465
settings = {}
466
for client_name in config.sections():
467
section = dict(config.items(client_name))
468
client = settings[client_name] = {}
469
470
client["host"] = section["host"]
471
# Reformat values from string types to Python types
472
client["approved_by_default"] = config.getboolean(
473
client_name, "approved_by_default")
474
client["enabled"] = config.getboolean(client_name, "enabled")
475
476
client["fingerprint"] = (section["fingerprint"].upper()
477
.replace(" ", ""))
478
if "secret" in section:
479
client["secret"] = section["secret"].decode("base64")
480
elif "secfile" in section:
481
with open(os.path.expanduser(os.path.expandvars
482
(section["secfile"])),
483
"rb") as secfile:
484
client["secret"] = secfile.read()
485
else:
486
raise TypeError("No secret or secfile for section %s"
487
% section)
488
client["timeout"] = string_to_delta(section["timeout"])
489
client["extended_timeout"] = string_to_delta(
490
section["extended_timeout"])
491
client["interval"] = string_to_delta(section["interval"])
492
client["approval_delay"] = string_to_delta(
493
section["approval_delay"])
494
client["approval_duration"] = string_to_delta(
495
section["approval_duration"])
496
client["checker_command"] = section["checker"]
497
client["last_approval_request"] = None
498
client["last_checked_ok"] = None
499
client["last_checker_status"] = None
500
if client["enabled"]:
501
client["last_enabled"] = datetime.datetime.utcnow()
502
client["expires"] = (datetime.datetime.utcnow()
503
+ client["timeout"])
504
else:
505
client["last_enabled"] = None
506
client["expires"] = None
507
508
return settings
509
510
511
def __init__(self, settings, name = None):
335
512
"""Note: the 'checker' key in 'config' sets the
336
513
'checker_command' attribute and *not* the 'checker'
337
514
attribute."""
338
515
self.name = name
339
if config is None:
340
config = {}
516
# adding all client settings
517
for setting, value in settings.iteritems():
518
setattr(self, setting, value)
519
341
520
logger.debug("Creating client %r", self.name)
342
521
# Uppercase and remove spaces from fingerprint for later
343
522
# comparison purposes with return value from the fingerprint()
344
523
# function
345
self.fingerprint = (config["fingerprint"].upper()
346
.replace(" ", ""))
347
524
logger.debug(" Fingerprint: %s", self.fingerprint)
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
351
with open(os.path.expanduser(os.path.expandvars
352
(config["secfile"])),
353
"rb") as secfile:
354
self.secret = secfile.read()
355
else:
356
raise TypeError("No secret or secfile for client %s"
357
% self.name)
358
self.host = config.get("host", "")
359
self.created = datetime.datetime.utcnow()
360
self.enabled = False
361
self.last_approval_request = None
362
self.last_enabled = None
363
self.last_checked_ok = None
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
368
self.disable_hook = disable_hook
525
self.created = settings.get("created", datetime.datetime.utcnow())
526
527
# attributes specific for this server instance
369
528
self.checker = None
370
529
self.checker_initiator_tag = None
371
530
self.disable_initiator_tag = None
372
self.expires = None
373
531
self.checker_callback_tag = None
374
self.checker_command = config["checker"]
375
532
self.current_checker_command = None
376
self.last_connect = None
377
self._approved = None
378
self.approved_by_default = config.get("approved_by_default",
379
True)
533
self.approved = None
380
534
self.approvals_pending = 0
381
self.approval_delay = string_to_delta(
382
config["approval_delay"])
383
self.approval_duration = string_to_delta(
384
config["approval_duration"])
385
535
self.changedstate = (multiprocessing_manager
386
536
.Condition(multiprocessing_manager
387
537
.Lock()))
538
self.client_structure = [attr for attr in
539
self.__dict__.iterkeys()
540
if not attr.startswith("_")]
541
self.client_structure.append("client_structure")
542
543
for name, t in inspect.getmembers(type(self),
544
lambda obj:
545
isinstance(obj,
546
property)):
547
if not name.startswith("_"):
548
self.client_structure.append(name)
388
549
550
# Send notice to process children that client state has changed
389
551
def send_changedstate(self):
390
self.changedstate.acquire()
391
self.changedstate.notify_all()
392
self.changedstate.release()
552
with self.changedstate:
553
self.changedstate.notify_all()
393
554
394
555
def enable(self):
395
556
"""Start this client's checker and timeout hooks"""
397
558
# Already enabled
398
559
return
399
560
self.send_changedstate()
400
# Schedule a new checker to be started an 'interval' from now,
401
# and every interval from then on.
402
self.checker_initiator_tag = (gobject.timeout_add
403
(self.interval_milliseconds(),
404
self.start_checker))
405
# Schedule a disable() when 'timeout' has passed
406
561
self.expires = datetime.datetime.utcnow() + self.timeout
407
self.disable_initiator_tag = (gobject.timeout_add
408
(self.timeout_milliseconds(),
409
self.disable))
410
562
self.enabled = True
411
563
self.last_enabled = datetime.datetime.utcnow()
412
# Also start a new checker *right now*.
413
self.start_checker()
564
self.init_checker()
414
565
415
566
def disable(self, quiet=True):
416
567
"""Disable this client."""
428
579
gobject.source_remove(self.checker_initiator_tag)
429
580
self.checker_initiator_tag = None
430
581
self.stop_checker()
431
if self.disable_hook:
432
self.disable_hook(self)
433
582
self.enabled = False
434
583
# Do not run this again if called by a gobject.timeout_add
435
584
return False
436
585
437
586
def __del__(self):
438
self.disable_hook = None
439
587
self.disable()
440
588
589
def init_checker(self):
590
# Schedule a new checker to be started an 'interval' from now,
591
# and every interval from then on.
592
self.checker_initiator_tag = (gobject.timeout_add
593
(self.interval_milliseconds(),
594
self.start_checker))
595
# Schedule a disable() when 'timeout' has passed
596
self.disable_initiator_tag = (gobject.timeout_add
597
(self.timeout_milliseconds(),
598
self.disable))
599
# Also start a new checker *right now*.
600
self.start_checker()
601
441
602
def checker_callback(self, pid, condition, command):
442
603
"""The checker has completed, so take appropriate actions."""
443
604
self.checker_callback_tag = None
444
605
self.checker = None
445
606
if os.WIFEXITED(condition):
446
exitstatus = os.WEXITSTATUS(condition)
447
if exitstatus == 0:
607
self.last_checker_status = os.WEXITSTATUS(condition)
608
if self.last_checker_status == 0:
448
609
logger.info("Checker for %(name)s succeeded",
449
610
vars(self))
450
611
self.checked_ok()
452
613
logger.info("Checker for %(name)s failed",
453
614
vars(self))
454
615
else:
616
self.last_checker_status = -1
455
617
logger.warning("Checker for %(name)s crashed?",
456
618
vars(self))
457
619
468
630
gobject.source_remove(self.disable_initiator_tag)
469
631
if getattr(self, "enabled", False):
470
632
self.disable_initiator_tag = (gobject.timeout_add
471
(_timedelta_to_milliseconds
633
(timedelta_to_milliseconds
472
634
(timeout), self.disable))
473
635
self.expires = datetime.datetime.utcnow() + timeout
474
636
691
853
692
854
Note: Will not include properties with access="write".
693
855
"""
694
all = {}
856
properties = {}
695
857
for name, prop in self._get_all_dbus_properties():
696
858
if (interface_name
697
859
and interface_name != prop._dbus_interface):
702
864
continue
703
865
value = prop()
704
866
if not hasattr(value, "variant_level"):
705
all[name] = value
867
properties[name] = value
706
868
continue
707
all[name] = type(value)(value, variant_level=
708
value.variant_level+1)
709
return dbus.Dictionary(all, signature="sv")
869
properties[name] = type(value)(value, variant_level=
870
value.variant_level+1)
871
return dbus.Dictionary(properties, signature="sv")
710
872
711
873
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
712
874
out_signature="s",
763
925
return dbus.String(dt.isoformat(),
764
926
variant_level=variant_level)
765
927
928
766
929
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
767
930
.__metaclass__):
768
931
"""Applied to an empty subclass of a D-Bus object, this metaclass
860
1023
attribute.func_closure)))
861
1024
return type.__new__(mcs, name, bases, attr)
862
1025
1026
863
1027
class ClientDBus(Client, DBusObjectWithProperties):
864
1028
"""A Client class using D-Bus
865
1029
874
1038
# dbus.service.Object doesn't use super(), so we can't either.
875
1039
876
1040
def __init__(self, bus = None, *args, **kwargs):
877
self._approvals_pending = 0
878
1041
self.bus = bus
879
1042
Client.__init__(self, *args, **kwargs)
1043
self._approvals_pending = 0
1044
1045
self._approvals_pending = 0
880
1046
# Only now, when this client is initialized, can it show up on
881
1047
# the D-Bus
882
1048
client_object_name = unicode(self.name).translate(
892
1058
variant_level=1):
893
1059
""" Modify a variable so that it's a property which announces
894
1060
its changes to DBus.
895
1061
896
1062
transform_fun: Function that takes a value and a variant_level
897
1063
and transforms it to a D-Bus type.
898
1064
dbus_name: D-Bus name of the variable
932
1098
datetime_to_dbus, "LastApprovalRequest")
933
1099
approved_by_default = notifychangeproperty(dbus.Boolean,
934
1100
"ApprovedByDefault")
935
approval_delay = notifychangeproperty(dbus.UInt16,
1101
approval_delay = notifychangeproperty(dbus.UInt64,
936
1102
"ApprovalDelay",
937
1103
type_func =
938
_timedelta_to_milliseconds)
1104
timedelta_to_milliseconds)
939
1105
approval_duration = notifychangeproperty(
940
dbus.UInt16, "ApprovalDuration",
941
type_func = _timedelta_to_milliseconds)
1106
dbus.UInt64, "ApprovalDuration",
1107
type_func = timedelta_to_milliseconds)
942
1108
host = notifychangeproperty(dbus.String, "Host")
943
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1109
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
944
1110
type_func =
945
_timedelta_to_milliseconds)
1111
timedelta_to_milliseconds)
946
1112
extended_timeout = notifychangeproperty(
947
dbus.UInt16, "ExtendedTimeout",
948
type_func = _timedelta_to_milliseconds)
949
interval = notifychangeproperty(dbus.UInt16,
1113
dbus.UInt64, "ExtendedTimeout",
1114
type_func = timedelta_to_milliseconds)
1115
interval = notifychangeproperty(dbus.UInt64,
950
1116
"Interval",
951
1117
type_func =
952
_timedelta_to_milliseconds)
1118
timedelta_to_milliseconds)
953
1119
checker_command = notifychangeproperty(dbus.String, "Checker")
954
1120
955
1121
del notifychangeproperty
997
1163
return r
998
1164
999
1165
def _reset_approved(self):
1000
self._approved = None
1166
self.approved = None
1001
1167
return False
1002
1168
1003
1169
def approve(self, value=True):
1004
1170
self.send_changedstate()
1005
self._approved = value
1006
gobject.timeout_add(_timedelta_to_milliseconds
1171
self.approved = value
1172
gobject.timeout_add(timedelta_to_milliseconds
1007
1173
(self.approval_duration),
1008
1174
self._reset_approved)
1009
1175
1052
1218
"D-Bus signal"
1053
1219
return self.need_approval()
1054
1220
1221
# NeRwequest - signal
1222
@dbus.service.signal(_interface, signature="s")
1223
def NewRequest(self, ip):
1224
"""D-Bus signal
1225
Is sent after a client request a password.
1226
"""
1227
pass
1228
1055
1229
## Methods
1056
1230
1057
1231
# Approve - method
1115
1289
access="readwrite")
1116
1290
def ApprovalDuration_dbus_property(self, value=None):
1117
1291
if value is None: # get
1118
return dbus.UInt64(_timedelta_to_milliseconds(
1292
return dbus.UInt64(timedelta_to_milliseconds(
1119
1293
self.approval_duration))
1120
1294
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1121
1295
1135
1309
def Host_dbus_property(self, value=None):
1136
1310
if value is None: # get
1137
1311
return dbus.String(self.host)
1138
self.host = value
1312
self.host = unicode(value)
1139
1313
1140
1314
# Created - property
1141
1315
@dbus_service_property(_interface, signature="s", access="read")
1142
1316
def Created_dbus_property(self):
1143
return dbus.String(datetime_to_dbus(self.created))
1317
return datetime_to_dbus(self.created)
1144
1318
1145
1319
# LastEnabled - property
1146
1320
@dbus_service_property(_interface, signature="s", access="read")
1190
1364
gobject.source_remove(self.disable_initiator_tag)
1191
1365
self.disable_initiator_tag = None
1192
1366
self.expires = None
1193
time_to_die = _timedelta_to_milliseconds((self
1194
.last_checked_ok
1195
+ self.timeout)
1196
- datetime.datetime
1197
.utcnow())
1367
time_to_die = timedelta_to_milliseconds((self
1368
.last_checked_ok
1369
+ self.timeout)
1370
- datetime.datetime
1371
.utcnow())
1198
1372
if time_to_die <= 0:
1199
1373
# The timeout has passed
1200
1374
self.disable()
1222
1396
self.interval = datetime.timedelta(0, 0, 0, value)
1223
1397
if getattr(self, "checker_initiator_tag", None) is None:
1224
1398
return
1225
# Reschedule checker run
1226
gobject.source_remove(self.checker_initiator_tag)
1227
self.checker_initiator_tag = (gobject.timeout_add
1228
(value, self.start_checker))
1229
self.start_checker() # Start one now, too
1399
if self.enabled:
1400
# Reschedule checker run
1401
gobject.source_remove(self.checker_initiator_tag)
1402
self.checker_initiator_tag = (gobject.timeout_add
1403
(value, self.start_checker))
1404
self.start_checker() # Start one now, too
1230
1405
1231
1406
# Checker - property
1232
1407
@dbus_service_property(_interface, signature="s",
1234
1409
def Checker_dbus_property(self, value=None):
1235
1410
if value is None: # get
1236
1411
return dbus.String(self.checker_command)
1237
self.checker_command = value
1412
self.checker_command = unicode(value)
1238
1413
1239
1414
# CheckerRunning - property
1240
1415
@dbus_service_property(_interface, signature="b",
1269
1444
raise KeyError()
1270
1445
1271
1446
def __getattribute__(self, name):
1272
if(name == '_pipe'):
1447
if name == '_pipe':
1273
1448
return super(ProxyClient, self).__getattribute__(name)
1274
1449
self._pipe.send(('getattr', name))
1275
1450
data = self._pipe.recv()
1282
1457
return func
1283
1458
1284
1459
def __setattr__(self, name, value):
1285
if(name == '_pipe'):
1460
if name == '_pipe':
1286
1461
return super(ProxyClient, self).__setattr__(name, value)
1287
1462
self._pipe.send(('setattr', name, value))
1288
1463
1464
1289
1465
class ClientDBusTransitional(ClientDBus):
1290
1466
__metaclass__ = AlternateDBusNamesMetaclass
1291
1467
1468
1292
1469
class ClientHandler(socketserver.BaseRequestHandler, object):
1293
1470
"""A class to handle client connections.
1294
1471
1362
1539
except KeyError:
1363
1540
return
1364
1541
1542
if self.server.use_dbus:
1543
# Emit D-Bus signal
1544
client.NewRequest(str(self.client_address))
1545
1365
1546
if client.approval_delay:
1366
1547
delay = client.approval_delay
1367
1548
client.approvals_pending += 1
1376
1557
client.Rejected("Disabled")
1377
1558
return
1378
1559
1379
if client._approved or not client.approval_delay:
1560
if client.approved or not client.approval_delay:
1380
1561
#We are approved or approval is disabled
1381
1562
break
1382
elif client._approved is None:
1563
elif client.approved is None:
1383
1564
logger.info("Client %s needs approval",
1384
1565
client.name)
1385
1566
if self.server.use_dbus:
1399
1580
time = datetime.datetime.now()
1400
1581
client.changedstate.acquire()
1401
1582
(client.changedstate.wait
1402
(float(client._timedelta_to_milliseconds(delay)
1583
(float(client.timedelta_to_milliseconds(delay)
1403
1584
/ 1000)))
1404
1585
client.changedstate.release()
1405
1586
time2 = datetime.datetime.now()
1504
1685
# Convert the buffer to a Python bytestring
1505
1686
fpr = ctypes.string_at(buf, buf_len.value)
1506
1687
# Convert the bytestring to hexadecimal notation
1507
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1688
hex_fpr = binascii.hexlify(fpr).upper()
1508
1689
return hex_fpr
1509
1690
1510
1691
1513
1694
def sub_process_main(self, request, address):
1514
1695
try:
1515
1696
self.finish_request(request, address)
1516
except:
1697
except Exception:
1517
1698
self.handle_error(request, address)
1518
1699
self.close_request(request)
1519
1700
1624
1805
self.enabled = False
1625
1806
self.clients = clients
1626
1807
if self.clients is None:
1627
self.clients = set()
1808
self.clients = {}
1628
1809
self.use_dbus = use_dbus
1629
1810
self.gnutls_priority = gnutls_priority
1630
1811
IPv6_TCPServer.__init__(self, server_address,
1677
1858
fpr = request[1]
1678
1859
address = request[2]
1679
1860
1680
for c in self.clients:
1861
for c in self.clients.itervalues():
1681
1862
if c.fingerprint == fpr:
1682
1863
client = c
1683
1864
break
1767
1948
return timevalue
1768
1949
1769
1950
1770
def if_nametoindex(interface):
1771
"""Call the C function if_nametoindex(), or equivalent
1772
1773
Note: This function cannot accept a unicode string."""
1774
global if_nametoindex
1775
try:
1776
if_nametoindex = (ctypes.cdll.LoadLibrary
1777
(ctypes.util.find_library("c"))
1778
.if_nametoindex)
1779
except (OSError, AttributeError):
1780
logger.warning("Doing if_nametoindex the hard way")
1781
def if_nametoindex(interface):
1782
"Get an interface index the hard way, i.e. using fcntl()"
1783
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1784
with contextlib.closing(socket.socket()) as s:
1785
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1786
struct.pack(str("16s16x"),
1787
interface))
1788
interface_index = struct.unpack(str("I"),
1789
ifreq[16:20])[0]
1790
return interface_index
1791
return if_nametoindex(interface)
1792
1793
1794
1951
def daemon(nochdir = False, noclose = False):
1795
1952
"""See daemon(3). Standard BSD Unix function.
1796
1953
1851
2008
" system bus interface")
1852
2009
parser.add_argument("--no-ipv6", action="store_false",
1853
2010
dest="use_ipv6", help="Do not use IPv6")
2011
parser.add_argument("--no-restore", action="store_false",
2012
dest="restore", help="Do not restore stored"
2013
" state")
2014
parser.add_argument("--statedir", metavar="DIR",
2015
help="Directory to save/restore state in")
2016
1854
2017
options = parser.parse_args()
1855
2018
1856
2019
if options.check:
1869
2032
"use_dbus": "True",
1870
2033
"use_ipv6": "True",
1871
2034
"debuglevel": "",
2035
"restore": "True",
2036
"statedir": "/var/lib/mandos"
1872
2037
}
1873
2038
1874
2039
# Parse config file for server-global settings
1891
2056
# options, if set.
1892
2057
for option in ("interface", "address", "port", "debug",
1893
2058
"priority", "servicename", "configdir",
1894
"use_dbus", "use_ipv6", "debuglevel"):
2059
"use_dbus", "use_ipv6", "debuglevel", "restore",
2060
"statedir"):
1895
2061
value = getattr(options, option)
1896
2062
if value is not None:
1897
2063
server_settings[option] = value
1909
2075
debuglevel = server_settings["debuglevel"]
1910
2076
use_dbus = server_settings["use_dbus"]
1911
2077
use_ipv6 = server_settings["use_ipv6"]
2078
stored_state_path = os.path.join(server_settings["statedir"],
2079
stored_state_file)
2080
2081
if debug:
2082
initlogger(debug, logging.DEBUG)
2083
else:
2084
if not debuglevel:
2085
initlogger(debug)
2086
else:
2087
level = getattr(logging, debuglevel.upper())
2088
initlogger(debug, level)
1912
2089
1913
2090
if server_settings["servicename"] != "Mandos":
1914
2091
syslogger.setFormatter(logging.Formatter
1917
2094
% server_settings["servicename"]))
1918
2095
1919
2096
# Parse config file with clients
1920
client_defaults = { "timeout": "5m",
1921
"extended_timeout": "15m",
1922
"interval": "2m",
1923
"checker": "fping -q -- %%(host)s",
1924
"host": "",
1925
"approval_delay": "0s",
1926
"approval_duration": "1s",
1927
}
1928
client_config = configparser.SafeConfigParser(client_defaults)
2097
client_config = configparser.SafeConfigParser(Client.client_defaults)
1929
2098
client_config.read(os.path.join(server_settings["configdir"],
1930
2099
"clients.conf"))
1931
2100
1969
2138
if error[0] != errno.EPERM:
1970
2139
raise error
1971
2140
1972
if not debug and not debuglevel:
1973
syslogger.setLevel(logging.WARNING)
1974
console.setLevel(logging.WARNING)
1975
if debuglevel:
1976
level = getattr(logging, debuglevel.upper())
1977
syslogger.setLevel(level)
1978
console.setLevel(level)
1979
1980
2141
if debug:
1981
2142
# Enable all possible GnuTLS debugging
1982
2143
1996
2157
os.dup2(null, sys.stdin.fileno())
1997
2158
if null > 2:
1998
2159
os.close(null)
1999
else:
2000
# No console logging
2001
logger.removeHandler(console)
2002
2160
2003
2161
# Need to fork before connecting to D-Bus
2004
2162
if not debug:
2005
2163
# Close all input and output, do double fork, etc.
2006
2164
daemon()
2007
2165
2166
gobject.threads_init()
2167
2008
2168
global main_loop
2009
2169
# From the Avahi example code
2010
2170
DBusGMainLoop(set_as_default=True )
2024
2184
server_settings["use_dbus"] = False
2025
2185
tcp_server.use_dbus = False
2026
2186
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2027
service = AvahiService(name = server_settings["servicename"],
2028
servicetype = "_mandos._tcp",
2029
protocol = protocol, bus = bus)
2187
service = AvahiServiceToSyslog(name =
2188
server_settings["servicename"],
2189
servicetype = "_mandos._tcp",
2190
protocol = protocol, bus = bus)
2030
2191
if server_settings["interface"]:
2031
2192
service.interface = (if_nametoindex
2032
2193
(str(server_settings["interface"])))
2038
2199
if use_dbus:
2039
2200
client_class = functools.partial(ClientDBusTransitional,
2040
2201
bus = bus)
2041
def client_config_items(config, section):
2042
special_settings = {
2043
"approved_by_default":
2044
lambda: config.getboolean(section,
2045
"approved_by_default"),
2046
}
2047
for name, value in config.items(section):
2202
2203
client_settings = Client.config_parser(client_config)
2204
old_client_settings = {}
2205
clients_data = {}
2206
2207
# Get client data and settings from last running state.
2208
if server_settings["restore"]:
2209
try:
2210
with open(stored_state_path, "rb") as stored_state:
2211
clients_data, old_client_settings = (pickle.load
2212
(stored_state))
2213
os.remove(stored_state_path)
2214
except IOError as e:
2215
logger.warning("Could not load persistent state: {0}"
2216
.format(e))
2217
if e.errno != errno.ENOENT:
2218
raise
2219
except EOFError as e:
2220
logger.warning("Could not load persistent state: "
2221
"EOFError: {0}".format(e))
2222
2223
with PGPEngine() as pgp:
2224
for client_name, client in clients_data.iteritems():
2225
# Decide which value to use after restoring saved state.
2226
# We have three different values: Old config file,
2227
# new config file, and saved state.
2228
# New config value takes precedence if it differs from old
2229
# config value, otherwise use saved state.
2230
for name, value in client_settings[client_name].items():
2231
try:
2232
# For each value in new config, check if it
2233
# differs from the old config value (Except for
2234
# the "secret" attribute)
2235
if (name != "secret" and
2236
value != old_client_settings[client_name]
2237
[name]):
2238
client[name] = value
2239
except KeyError:
2240
pass
2241
2242
# Clients who has passed its expire date can still be
2243
# enabled if its last checker was successful. Clients
2244
# whose checker failed before we stored its state is
2245
# assumed to have failed all checkers during downtime.
2246
if client["enabled"]:
2247
if datetime.datetime.utcnow() >= client["expires"]:
2248
if not client["last_checked_ok"]:
2249
logger.warning(
2250
"disabling client {0} - Client never "
2251
"performed a successfull checker"
2252
.format(client["name"]))
2253
client["enabled"] = False
2254
elif client["last_checker_status"] != 0:
2255
logger.warning(
2256
"disabling client {0} - Client "
2257
"last checker failed with error code {1}"
2258
.format(client["name"],
2259
client["last_checker_status"]))
2260
client["enabled"] = False
2261
else:
2262
client["expires"] = (datetime.datetime
2263
.utcnow()
2264
+ client["timeout"])
2265
2048
2266
try:
2049
yield (name, special_settings[name]())
2050
except KeyError:
2051
yield (name, value)
2052
2053
tcp_server.clients.update(set(
2054
client_class(name = section,
2055
config= dict(client_config_items(
2056
client_config, section)))
2057
for section in client_config.sections()))
2267
client["secret"] = (
2268
pgp.decrypt(client["encrypted_secret"],
2269
client_settings[client_name]
2270
["secret"]))
2271
except PGPError:
2272
# If decryption fails, we use secret from new settings
2273
logger.debug("Failed to decrypt {0} old secret"
2274
.format(client_name))
2275
client["secret"] = (
2276
client_settings[client_name]["secret"])
2277
2278
2279
# Add/remove clients based on new changes made to config
2280
for client_name in set(old_client_settings) - set(client_settings):
2281
del clients_data[client_name]
2282
for client_name in set(client_settings) - set(old_client_settings):
2283
clients_data[client_name] = client_settings[client_name]
2284
2285
# Create clients all clients
2286
for client_name, client in clients_data.iteritems():
2287
tcp_server.clients[client_name] = client_class(
2288
name = client_name, settings = client)
2289
2058
2290
if not tcp_server.clients:
2059
2291
logger.warning("No clients defined")
2060
2292
2071
2303
# "pidfile" was never created
2072
2304
pass
2073
2305
del pidfilename
2074
2075
2306
signal.signal(signal.SIGINT, signal.SIG_IGN)
2076
2307
2077
2308
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2103
2334
def GetAllClients(self):
2104
2335
"D-Bus method"
2105
2336
return dbus.Array(c.dbus_object_path
2106
for c in tcp_server.clients)
2337
for c in
2338
tcp_server.clients.itervalues())
2107
2339
2108
2340
@dbus.service.method(_interface,
2109
2341
out_signature="a{oa{sv}}")
2111
2343
"D-Bus method"
2112
2344
return dbus.Dictionary(
2113
2345
((c.dbus_object_path, c.GetAll(""))
2114
for c in tcp_server.clients),
2346
for c in tcp_server.clients.itervalues()),
2115
2347
signature="oa{sv}")
2116
2348
2117
2349
@dbus.service.method(_interface, in_signature="o")
2118
2350
def RemoveClient(self, object_path):
2119
2351
"D-Bus method"
2120
for c in tcp_server.clients:
2352
for c in tcp_server.clients.itervalues():
2121
2353
if c.dbus_object_path == object_path:
2122
tcp_server.clients.remove(c)
2354
del tcp_server.clients[c.name]
2123
2355
c.remove_from_connection()
2124
2356
# Don't signal anything except ClientRemoved
2125
2357
c.disable(quiet=True)
2139
2371
service.cleanup()
2140
2372
2141
2373
multiprocessing.active_children()
2374
if not (tcp_server.clients or client_settings):
2375
return
2376
2377
# Store client before exiting. Secrets are encrypted with key
2378
# based on what config file has. If config file is
2379
# removed/edited, old secret will thus be unrecovable.
2380
clients = {}
2381
with PGPEngine() as pgp:
2382
for client in tcp_server.clients.itervalues():
2383
key = client_settings[client.name]["secret"]
2384
client.encrypted_secret = pgp.encrypt(client.secret,
2385
key)
2386
client_dict = {}
2387
2388
# A list of attributes that can not be pickled
2389
# + secret.
2390
exclude = set(("bus", "changedstate", "secret",
2391
"checker"))
2392
for name, typ in (inspect.getmembers
2393
(dbus.service.Object)):
2394
exclude.add(name)
2395
2396
client_dict["encrypted_secret"] = (client
2397
.encrypted_secret)
2398
for attr in client.client_structure:
2399
if attr not in exclude:
2400
client_dict[attr] = getattr(client, attr)
2401
2402
clients[client.name] = client_dict
2403
del client_settings[client.name]["secret"]
2404
2405
try:
2406
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2407
prefix="clients-",
2408
dir=os.path.dirname
2409
(stored_state_path))
2410
with os.fdopen(tempfd, "wb") as stored_state:
2411
pickle.dump((clients, client_settings), stored_state)
2412
os.rename(tempname, stored_state_path)
2413
except (IOError, OSError) as e:
2414
logger.warning("Could not save persistent state: {0}"
2415
.format(e))
2416
if not debug:
2417
try:
2418
os.remove(tempname)
2419
except NameError:
2420
pass
2421
if e.errno not in set((errno.ENOENT, errno.EACCES,
2422
errno.EEXIST)):
2423
raise e
2424
2425
# Delete all clients, and settings from config
2142
2426
while tcp_server.clients:
2143
client = tcp_server.clients.pop()
2427
name, client = tcp_server.clients.popitem()
2144
2428
if use_dbus:
2145
2429
client.remove_from_connection()
2146
client.disable_hook = None
2147
2430
# Don't signal anything except ClientRemoved
2148
2431
client.disable(quiet=True)
2149
2432
if use_dbus:
2151
2434
mandos_dbus_service.ClientRemoved(client
2152
2435
.dbus_object_path,
2153
2436
client.name)
2437
client_settings.clear()
2154
2438
2155
2439
atexit.register(cleanup)
2156
2440
2157
for client in tcp_server.clients:
2441
for client in tcp_server.clients.itervalues():
2158
2442
if use_dbus:
2159
2443
# Emit D-Bus signal
2160
2444
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2161
client.enable()
2445
# Need to initiate checking of clients
2446
if client.enabled:
2447
client.init_checker()
2162
2448
2163
2449
tcp_server.enable()
2164
2450
tcp_server.server_activate()
2204
2490
# Must run before the D-Bus bus name gets deregistered
2205
2491
cleanup()
2206
2492
2207
2208
2493
if __name__ == '__main__':
2209
2494
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0