To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 539
- compare with another revision
- download diff
- download tarball
- view history from revision 539
- Committer: teddy at recompile
- Date: 2011-12-27 14:15:40 UTC
- Revision ID: teddy@recompile.se-20111227141540-ajrabf33q59jfa7t
Reorder TODO entries
- files added:
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import hashlib
66
import binascii
67
import tempfile
67
68
68
69
import dbus
69
70
import dbus.service
74
75
import ctypes.util
75
76
import xml.dom.minidom
76
77
import inspect
77
import Crypto.Cipher.AES
78
import GnuPGInterface
78
79
79
80
try:
80
81
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
84
85
except ImportError:
85
86
SO_BINDTODEVICE = None
86
87
87
88
88
version = "1.4.1"
89
stored_state_file = "clients.pickle"
89
90
90
91
logger = logging.getLogger()
91
stored_state_path = "/var/lib/mandos/clients.pickle"
92
93
92
syslogger = (logging.handlers.SysLogHandler
94
93
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
95
94
address = str("/dev/log")))
96
syslogger.setFormatter(logging.Formatter
97
('Mandos [%(process)d]: %(levelname)s:'
98
' %(message)s'))
99
logger.addHandler(syslogger)
100
101
console = logging.StreamHandler()
102
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
103
' [%(process)d]:'
104
' %(levelname)s:'
105
' %(message)s'))
106
logger.addHandler(console)
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(debug, level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
if debug:
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
128
logger.setLevel(level)
129
130
131
class PGPError(Exception):
132
"""Exception if encryption/decryption fails"""
133
pass
134
135
136
class PGPEngine(object):
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet'])
146
147
def __enter__(self):
148
return self
149
150
def __exit__ (self, exc_type, exc_value, traceback):
151
self._cleanup()
152
return False
153
154
def __del__(self):
155
self._cleanup()
156
157
def _cleanup(self):
158
if self.tempdir is not None:
159
# Delete contents of tempdir
160
for root, dirs, files in os.walk(self.tempdir,
161
topdown = False):
162
for filename in files:
163
os.remove(os.path.join(root, filename))
164
for dirname in dirs:
165
os.rmdir(os.path.join(root, dirname))
166
# Remove tempdir
167
os.rmdir(self.tempdir)
168
self.tempdir = None
169
170
def password_encode(self, password):
171
# Passphrase can not be empty and can not contain newlines or
172
# NUL bytes. So we prefix it and hex encode it.
173
return b"mandos" + binascii.hexlify(password)
174
175
def encrypt(self, data, password):
176
self.gnupg.passphrase = self.password_encode(password)
177
with open(os.devnull) as devnull:
178
try:
179
proc = self.gnupg.run(['--symmetric'],
180
create_fhs=['stdin', 'stdout'],
181
attach_fhs={'stderr': devnull})
182
with contextlib.closing(proc.handles['stdin']) as f:
183
f.write(data)
184
with contextlib.closing(proc.handles['stdout']) as f:
185
ciphertext = f.read()
186
proc.wait()
187
except IOError as e:
188
raise PGPError(e)
189
self.gnupg.passphrase = None
190
return ciphertext
191
192
def decrypt(self, data, password):
193
self.gnupg.passphrase = self.password_encode(password)
194
with open(os.devnull) as devnull:
195
try:
196
proc = self.gnupg.run(['--decrypt'],
197
create_fhs=['stdin', 'stdout'],
198
attach_fhs={'stderr': devnull})
199
with contextlib.closing(proc.handles['stdin'] ) as f:
200
f.write(data)
201
with contextlib.closing(proc.handles['stdout']) as f:
202
decrypted_plaintext = f.read()
203
proc.wait()
204
except IOError as e:
205
raise PGPError(e)
206
self.gnupg.passphrase = None
207
return decrypted_plaintext
208
107
209
108
210
109
211
class AvahiError(Exception):
226
328
try:
227
329
self.group.Free()
228
330
except (dbus.exceptions.UnknownMethodException,
229
dbus.exceptions.DBusException) as e:
331
dbus.exceptions.DBusException):
230
332
pass
231
333
self.group = None
232
334
self.remove()
276
378
% self.name))
277
379
return ret
278
380
279
def _timedelta_to_milliseconds(td):
381
def timedelta_to_milliseconds(td):
280
382
"Convert a datetime.timedelta() to milliseconds"
281
383
return ((td.days * 24 * 60 * 60 * 1000)
282
384
+ (td.seconds * 1000)
286
388
"""A representation of a client host served by this server.
287
389
288
390
Attributes:
289
_approved: bool(); 'None' if not yet approved/disapproved
391
approved: bool(); 'None' if not yet approved/disapproved
290
392
approval_delay: datetime.timedelta(); Time to wait for approval
291
393
approval_duration: datetime.timedelta(); Duration of one approval
292
394
checker: subprocess.Popen(); a running checker process used
310
412
interval: datetime.timedelta(); How often to start a new checker
311
413
last_approval_request: datetime.datetime(); (UTC) or None
312
414
last_checked_ok: datetime.datetime(); (UTC) or None
313
last_checker_status: integer between 0 and 255 reflecting exit status
314
of last checker. -1 reflect crashed checker,
315
or None.
316
last_enabled: datetime.datetime(); (UTC)
415
last_checker_status: integer between 0 and 255 reflecting exit
416
status of last checker. -1 reflects crashed
417
checker, or None.
418
last_enabled: datetime.datetime(); (UTC) or None
317
419
name: string; from the config file, used in log messages and
318
420
D-Bus identifiers
319
421
secret: bytestring; sent verbatim (over TLS) to client
329
431
"created", "enabled", "fingerprint",
330
432
"host", "interval", "last_checked_ok",
331
433
"last_enabled", "name", "timeout")
434
client_defaults = { "timeout": "5m",
435
"extended_timeout": "15m",
436
"interval": "2m",
437
"checker": "fping -q -- %%(host)s",
438
"host": "",
439
"approval_delay": "0s",
440
"approval_duration": "1s",
441
"approved_by_default": "True",
442
"enabled": "True",
443
}
332
444
333
445
def timeout_milliseconds(self):
334
446
"Return the 'timeout' attribute in milliseconds"
335
return _timedelta_to_milliseconds(self.timeout)
447
return timedelta_to_milliseconds(self.timeout)
336
448
337
449
def extended_timeout_milliseconds(self):
338
450
"Return the 'extended_timeout' attribute in milliseconds"
339
return _timedelta_to_milliseconds(self.extended_timeout)
451
return timedelta_to_milliseconds(self.extended_timeout)
340
452
341
453
def interval_milliseconds(self):
342
454
"Return the 'interval' attribute in milliseconds"
343
return _timedelta_to_milliseconds(self.interval)
455
return timedelta_to_milliseconds(self.interval)
344
456
345
457
def approval_delay_milliseconds(self):
346
return _timedelta_to_milliseconds(self.approval_delay)
347
348
def __init__(self, name = None, config=None):
458
return timedelta_to_milliseconds(self.approval_delay)
459
460
@staticmethod
461
def config_parser(config):
462
""" Construct a new dict of client settings of this form:
463
{ client_name: {setting_name: value, ...}, ...}
464
with exceptions for any special settings as defined above"""
465
settings = {}
466
for client_name in config.sections():
467
section = dict(config.items(client_name))
468
client = settings[client_name] = {}
469
470
client["host"] = section["host"]
471
# Reformat values from string types to Python types
472
client["approved_by_default"] = config.getboolean(
473
client_name, "approved_by_default")
474
client["enabled"] = config.getboolean(client_name, "enabled")
475
476
client["fingerprint"] = (section["fingerprint"].upper()
477
.replace(" ", ""))
478
if "secret" in section:
479
client["secret"] = section["secret"].decode("base64")
480
elif "secfile" in section:
481
with open(os.path.expanduser(os.path.expandvars
482
(section["secfile"])),
483
"rb") as secfile:
484
client["secret"] = secfile.read()
485
else:
486
raise TypeError("No secret or secfile for section %s"
487
% section)
488
client["timeout"] = string_to_delta(section["timeout"])
489
client["extended_timeout"] = string_to_delta(
490
section["extended_timeout"])
491
client["interval"] = string_to_delta(section["interval"])
492
client["approval_delay"] = string_to_delta(
493
section["approval_delay"])
494
client["approval_duration"] = string_to_delta(
495
section["approval_duration"])
496
client["checker_command"] = section["checker"]
497
client["last_approval_request"] = None
498
client["last_checked_ok"] = None
499
client["last_checker_status"] = None
500
if client["enabled"]:
501
client["last_enabled"] = datetime.datetime.utcnow()
502
client["expires"] = (datetime.datetime.utcnow()
503
+ client["timeout"])
504
else:
505
client["last_enabled"] = None
506
client["expires"] = None
507
508
return settings
509
510
511
def __init__(self, settings, name = None):
349
512
"""Note: the 'checker' key in 'config' sets the
350
513
'checker_command' attribute and *not* the 'checker'
351
514
attribute."""
352
515
self.name = name
353
if config is None:
354
config = {}
516
# adding all client settings
517
for setting, value in settings.iteritems():
518
setattr(self, setting, value)
519
355
520
logger.debug("Creating client %r", self.name)
356
521
# Uppercase and remove spaces from fingerprint for later
357
522
# comparison purposes with return value from the fingerprint()
358
523
# function
359
self.fingerprint = (config["fingerprint"].upper()
360
.replace(" ", ""))
361
524
logger.debug(" Fingerprint: %s", self.fingerprint)
362
if "secret" in config:
363
self.secret = config["secret"].decode("base64")
364
elif "secfile" in config:
365
with open(os.path.expanduser(os.path.expandvars
366
(config["secfile"])),
367
"rb") as secfile:
368
self.secret = secfile.read()
369
else:
370
raise TypeError("No secret or secfile for client %s"
371
% self.name)
372
self.host = config.get("host", "")
373
self.created = datetime.datetime.utcnow()
374
self.enabled = True
375
self.last_approval_request = None
376
self.last_enabled = datetime.datetime.utcnow()
377
self.last_checked_ok = None
378
self.last_checker_status = None
379
self.timeout = string_to_delta(config["timeout"])
380
self.extended_timeout = string_to_delta(config
381
["extended_timeout"])
382
self.interval = string_to_delta(config["interval"])
525
self.created = settings.get("created", datetime.datetime.utcnow())
526
527
# attributes specific for this server instance
383
528
self.checker = None
384
529
self.checker_initiator_tag = None
385
530
self.disable_initiator_tag = None
386
self.expires = datetime.datetime.utcnow() + self.timeout
387
531
self.checker_callback_tag = None
388
self.checker_command = config["checker"]
389
532
self.current_checker_command = None
390
self._approved = None
391
self.approved_by_default = config.get("approved_by_default",
392
True)
533
self.approved = None
393
534
self.approvals_pending = 0
394
self.approval_delay = string_to_delta(
395
config["approval_delay"])
396
self.approval_duration = string_to_delta(
397
config["approval_duration"])
398
535
self.changedstate = (multiprocessing_manager
399
536
.Condition(multiprocessing_manager
400
537
.Lock()))
401
self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]
538
self.client_structure = [attr for attr in
539
self.__dict__.iterkeys()
540
if not attr.startswith("_")]
402
541
self.client_structure.append("client_structure")
403
404
542
405
543
for name, t in inspect.getmembers(type(self),
406
lambda obj: isinstance(obj, property)):
544
lambda obj:
545
isinstance(obj,
546
property)):
407
547
if not name.startswith("_"):
408
548
self.client_structure.append(name)
409
549
445
585
446
586
def __del__(self):
447
587
self.disable()
448
588
449
589
def init_checker(self):
450
590
# Schedule a new checker to be started an 'interval' from now,
451
591
# and every interval from then on.
458
598
self.disable))
459
599
# Also start a new checker *right now*.
460
600
self.start_checker()
461
462
601
463
602
def checker_callback(self, pid, condition, command):
464
603
"""The checker has completed, so take appropriate actions."""
465
604
self.checker_callback_tag = None
466
605
self.checker = None
467
606
if os.WIFEXITED(condition):
468
self.last_checker_status = os.WEXITSTATUS(condition)
607
self.last_checker_status = os.WEXITSTATUS(condition)
469
608
if self.last_checker_status == 0:
470
609
logger.info("Checker for %(name)s succeeded",
471
610
vars(self))
491
630
gobject.source_remove(self.disable_initiator_tag)
492
631
if getattr(self, "enabled", False):
493
632
self.disable_initiator_tag = (gobject.timeout_add
494
(_timedelta_to_milliseconds
633
(timedelta_to_milliseconds
495
634
(timeout), self.disable))
496
635
self.expires = datetime.datetime.utcnow() + timeout
497
636
591
730
raise
592
731
self.checker = None
593
732
594
# Encrypts a client secret and stores it in a varible encrypted_secret
595
def encrypt_secret(self, key):
596
# Encryption-key need to be of a specific size, so we hash inputed key
597
hasheng = hashlib.sha256()
598
hasheng.update(key)
599
encryptionkey = hasheng.digest()
600
601
# Create validation hash so we know at decryption if it was sucessful
602
hasheng = hashlib.sha256()
603
hasheng.update(self.secret)
604
validationhash = hasheng.digest()
605
606
# Encrypt secret
607
iv = os.urandom(Crypto.Cipher.AES.block_size)
608
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
609
Crypto.Cipher.AES.MODE_CFB, iv)
610
ciphertext = ciphereng.encrypt(validationhash+self.secret)
611
self.encrypted_secret = (ciphertext, iv)
612
613
# Decrypt a encrypted client secret
614
def decrypt_secret(self, key):
615
# Decryption-key need to be of a specific size, so we hash inputed key
616
hasheng = hashlib.sha256()
617
hasheng.update(key)
618
encryptionkey = hasheng.digest()
619
620
# Decrypt encrypted secret
621
ciphertext, iv = self.encrypted_secret
622
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
623
Crypto.Cipher.AES.MODE_CFB, iv)
624
plain = ciphereng.decrypt(ciphertext)
625
626
# Validate decrypted secret to know if it was succesful
627
hasheng = hashlib.sha256()
628
validationhash = plain[:hasheng.digest_size]
629
secret = plain[hasheng.digest_size:]
630
hasheng.update(secret)
631
632
# if validation fails, we use key as new secret. Otherwhise, we use
633
# the decrypted secret
634
if hasheng.digest() == validationhash:
635
self.secret = secret
636
else:
637
self.secret = key
638
del self.encrypted_secret
639
640
733
641
734
def dbus_service_property(dbus_interface, signature="v",
642
735
access="readwrite", byte_arrays=False):
760
853
761
854
Note: Will not include properties with access="write".
762
855
"""
763
all = {}
856
properties = {}
764
857
for name, prop in self._get_all_dbus_properties():
765
858
if (interface_name
766
859
and interface_name != prop._dbus_interface):
771
864
continue
772
865
value = prop()
773
866
if not hasattr(value, "variant_level"):
774
all[name] = value
867
properties[name] = value
775
868
continue
776
all[name] = type(value)(value, variant_level=
777
value.variant_level+1)
778
return dbus.Dictionary(all, signature="sv")
869
properties[name] = type(value)(value, variant_level=
870
value.variant_level+1)
871
return dbus.Dictionary(properties, signature="sv")
779
872
780
873
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
781
874
out_signature="s",
832
925
return dbus.String(dt.isoformat(),
833
926
variant_level=variant_level)
834
927
928
835
929
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
836
930
.__metaclass__):
837
931
"""Applied to an empty subclass of a D-Bus object, this metaclass
929
1023
attribute.func_closure)))
930
1024
return type.__new__(mcs, name, bases, attr)
931
1025
1026
932
1027
class ClientDBus(Client, DBusObjectWithProperties):
933
1028
"""A Client class using D-Bus
934
1029
945
1040
def __init__(self, bus = None, *args, **kwargs):
946
1041
self.bus = bus
947
1042
Client.__init__(self, *args, **kwargs)
948
1043
self._approvals_pending = 0
1044
949
1045
self._approvals_pending = 0
950
1046
# Only now, when this client is initialized, can it show up on
951
1047
# the D-Bus
962
1058
variant_level=1):
963
1059
""" Modify a variable so that it's a property which announces
964
1060
its changes to DBus.
965
1061
966
1062
transform_fun: Function that takes a value and a variant_level
967
1063
and transforms it to a D-Bus type.
968
1064
dbus_name: D-Bus name of the variable
1002
1098
datetime_to_dbus, "LastApprovalRequest")
1003
1099
approved_by_default = notifychangeproperty(dbus.Boolean,
1004
1100
"ApprovedByDefault")
1005
approval_delay = notifychangeproperty(dbus.UInt16,
1101
approval_delay = notifychangeproperty(dbus.UInt64,
1006
1102
"ApprovalDelay",
1007
1103
type_func =
1008
_timedelta_to_milliseconds)
1104
timedelta_to_milliseconds)
1009
1105
approval_duration = notifychangeproperty(
1010
dbus.UInt16, "ApprovalDuration",
1011
type_func = _timedelta_to_milliseconds)
1106
dbus.UInt64, "ApprovalDuration",
1107
type_func = timedelta_to_milliseconds)
1012
1108
host = notifychangeproperty(dbus.String, "Host")
1013
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1109
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1014
1110
type_func =
1015
_timedelta_to_milliseconds)
1111
timedelta_to_milliseconds)
1016
1112
extended_timeout = notifychangeproperty(
1017
dbus.UInt16, "ExtendedTimeout",
1018
type_func = _timedelta_to_milliseconds)
1019
interval = notifychangeproperty(dbus.UInt16,
1113
dbus.UInt64, "ExtendedTimeout",
1114
type_func = timedelta_to_milliseconds)
1115
interval = notifychangeproperty(dbus.UInt64,
1020
1116
"Interval",
1021
1117
type_func =
1022
_timedelta_to_milliseconds)
1118
timedelta_to_milliseconds)
1023
1119
checker_command = notifychangeproperty(dbus.String, "Checker")
1024
1120
1025
1121
del notifychangeproperty
1067
1163
return r
1068
1164
1069
1165
def _reset_approved(self):
1070
self._approved = None
1166
self.approved = None
1071
1167
return False
1072
1168
1073
1169
def approve(self, value=True):
1074
1170
self.send_changedstate()
1075
self._approved = value
1076
gobject.timeout_add(_timedelta_to_milliseconds
1171
self.approved = value
1172
gobject.timeout_add(timedelta_to_milliseconds
1077
1173
(self.approval_duration),
1078
1174
self._reset_approved)
1079
1175
1122
1218
"D-Bus signal"
1123
1219
return self.need_approval()
1124
1220
1221
# NeRwequest - signal
1222
@dbus.service.signal(_interface, signature="s")
1223
def NewRequest(self, ip):
1224
"""D-Bus signal
1225
Is sent after a client request a password.
1226
"""
1227
pass
1228
1125
1229
## Methods
1126
1230
1127
1231
# Approve - method
1185
1289
access="readwrite")
1186
1290
def ApprovalDuration_dbus_property(self, value=None):
1187
1291
if value is None: # get
1188
return dbus.UInt64(_timedelta_to_milliseconds(
1292
return dbus.UInt64(timedelta_to_milliseconds(
1189
1293
self.approval_duration))
1190
1294
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1191
1295
1205
1309
def Host_dbus_property(self, value=None):
1206
1310
if value is None: # get
1207
1311
return dbus.String(self.host)
1208
self.host = value
1312
self.host = unicode(value)
1209
1313
1210
1314
# Created - property
1211
1315
@dbus_service_property(_interface, signature="s", access="read")
1212
1316
def Created_dbus_property(self):
1213
return dbus.String(datetime_to_dbus(self.created))
1317
return datetime_to_dbus(self.created)
1214
1318
1215
1319
# LastEnabled - property
1216
1320
@dbus_service_property(_interface, signature="s", access="read")
1260
1364
gobject.source_remove(self.disable_initiator_tag)
1261
1365
self.disable_initiator_tag = None
1262
1366
self.expires = None
1263
time_to_die = _timedelta_to_milliseconds((self
1264
.last_checked_ok
1265
+ self.timeout)
1266
- datetime.datetime
1267
.utcnow())
1367
time_to_die = timedelta_to_milliseconds((self
1368
.last_checked_ok
1369
+ self.timeout)
1370
- datetime.datetime
1371
.utcnow())
1268
1372
if time_to_die <= 0:
1269
1373
# The timeout has passed
1270
1374
self.disable()
1292
1396
self.interval = datetime.timedelta(0, 0, 0, value)
1293
1397
if getattr(self, "checker_initiator_tag", None) is None:
1294
1398
return
1295
# Reschedule checker run
1296
gobject.source_remove(self.checker_initiator_tag)
1297
self.checker_initiator_tag = (gobject.timeout_add
1298
(value, self.start_checker))
1299
self.start_checker() # Start one now, too
1399
if self.enabled:
1400
# Reschedule checker run
1401
gobject.source_remove(self.checker_initiator_tag)
1402
self.checker_initiator_tag = (gobject.timeout_add
1403
(value, self.start_checker))
1404
self.start_checker() # Start one now, too
1300
1405
1301
1406
# Checker - property
1302
1407
@dbus_service_property(_interface, signature="s",
1304
1409
def Checker_dbus_property(self, value=None):
1305
1410
if value is None: # get
1306
1411
return dbus.String(self.checker_command)
1307
self.checker_command = value
1412
self.checker_command = unicode(value)
1308
1413
1309
1414
# CheckerRunning - property
1310
1415
@dbus_service_property(_interface, signature="b",
1339
1444
raise KeyError()
1340
1445
1341
1446
def __getattribute__(self, name):
1342
if(name == '_pipe'):
1447
if name == '_pipe':
1343
1448
return super(ProxyClient, self).__getattribute__(name)
1344
1449
self._pipe.send(('getattr', name))
1345
1450
data = self._pipe.recv()
1352
1457
return func
1353
1458
1354
1459
def __setattr__(self, name, value):
1355
if(name == '_pipe'):
1460
if name == '_pipe':
1356
1461
return super(ProxyClient, self).__setattr__(name, value)
1357
1462
self._pipe.send(('setattr', name, value))
1358
1463
1464
1359
1465
class ClientDBusTransitional(ClientDBus):
1360
1466
__metaclass__ = AlternateDBusNamesMetaclass
1361
1467
1468
1362
1469
class ClientHandler(socketserver.BaseRequestHandler, object):
1363
1470
"""A class to handle client connections.
1364
1471
1432
1539
except KeyError:
1433
1540
return
1434
1541
1542
if self.server.use_dbus:
1543
# Emit D-Bus signal
1544
client.NewRequest(str(self.client_address))
1545
1435
1546
if client.approval_delay:
1436
1547
delay = client.approval_delay
1437
1548
client.approvals_pending += 1
1446
1557
client.Rejected("Disabled")
1447
1558
return
1448
1559
1449
if client._approved or not client.approval_delay:
1560
if client.approved or not client.approval_delay:
1450
1561
#We are approved or approval is disabled
1451
1562
break
1452
elif client._approved is None:
1563
elif client.approved is None:
1453
1564
logger.info("Client %s needs approval",
1454
1565
client.name)
1455
1566
if self.server.use_dbus:
1469
1580
time = datetime.datetime.now()
1470
1581
client.changedstate.acquire()
1471
1582
(client.changedstate.wait
1472
(float(client._timedelta_to_milliseconds(delay)
1583
(float(client.timedelta_to_milliseconds(delay)
1473
1584
/ 1000)))
1474
1585
client.changedstate.release()
1475
1586
time2 = datetime.datetime.now()
1574
1685
# Convert the buffer to a Python bytestring
1575
1686
fpr = ctypes.string_at(buf, buf_len.value)
1576
1687
# Convert the bytestring to hexadecimal notation
1577
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1688
hex_fpr = binascii.hexlify(fpr).upper()
1578
1689
return hex_fpr
1579
1690
1580
1691
1583
1694
def sub_process_main(self, request, address):
1584
1695
try:
1585
1696
self.finish_request(request, address)
1586
except:
1697
except Exception:
1587
1698
self.handle_error(request, address)
1588
1699
self.close_request(request)
1589
1700
1837
1948
return timevalue
1838
1949
1839
1950
1840
def if_nametoindex(interface):
1841
"""Call the C function if_nametoindex(), or equivalent
1842
1843
Note: This function cannot accept a unicode string."""
1844
global if_nametoindex
1845
try:
1846
if_nametoindex = (ctypes.cdll.LoadLibrary
1847
(ctypes.util.find_library("c"))
1848
.if_nametoindex)
1849
except (OSError, AttributeError):
1850
logger.warning("Doing if_nametoindex the hard way")
1851
def if_nametoindex(interface):
1852
"Get an interface index the hard way, i.e. using fcntl()"
1853
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1854
with contextlib.closing(socket.socket()) as s:
1855
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1856
struct.pack(str("16s16x"),
1857
interface))
1858
interface_index = struct.unpack(str("I"),
1859
ifreq[16:20])[0]
1860
return interface_index
1861
return if_nametoindex(interface)
1862
1863
1864
1951
def daemon(nochdir = False, noclose = False):
1865
1952
"""See daemon(3). Standard BSD Unix function.
1866
1953
1922
2009
parser.add_argument("--no-ipv6", action="store_false",
1923
2010
dest="use_ipv6", help="Do not use IPv6")
1924
2011
parser.add_argument("--no-restore", action="store_false",
1925
dest="restore", help="Do not restore stored state",
1926
default=True)
1927
2012
dest="restore", help="Do not restore stored"
2013
" state")
2014
parser.add_argument("--statedir", metavar="DIR",
2015
help="Directory to save/restore state in")
2016
1928
2017
options = parser.parse_args()
1929
2018
1930
2019
if options.check:
1943
2032
"use_dbus": "True",
1944
2033
"use_ipv6": "True",
1945
2034
"debuglevel": "",
2035
"restore": "True",
2036
"statedir": "/var/lib/mandos"
1946
2037
}
1947
2038
1948
2039
# Parse config file for server-global settings
1965
2056
# options, if set.
1966
2057
for option in ("interface", "address", "port", "debug",
1967
2058
"priority", "servicename", "configdir",
1968
"use_dbus", "use_ipv6", "debuglevel", "restore"):
2059
"use_dbus", "use_ipv6", "debuglevel", "restore",
2060
"statedir"):
1969
2061
value = getattr(options, option)
1970
2062
if value is not None:
1971
2063
server_settings[option] = value
1983
2075
debuglevel = server_settings["debuglevel"]
1984
2076
use_dbus = server_settings["use_dbus"]
1985
2077
use_ipv6 = server_settings["use_ipv6"]
2078
stored_state_path = os.path.join(server_settings["statedir"],
2079
stored_state_file)
2080
2081
if debug:
2082
initlogger(debug, logging.DEBUG)
2083
else:
2084
if not debuglevel:
2085
initlogger(debug)
2086
else:
2087
level = getattr(logging, debuglevel.upper())
2088
initlogger(debug, level)
1986
2089
1987
2090
if server_settings["servicename"] != "Mandos":
1988
2091
syslogger.setFormatter(logging.Formatter
1991
2094
% server_settings["servicename"]))
1992
2095
1993
2096
# Parse config file with clients
1994
client_defaults = { "timeout": "5m",
1995
"extended_timeout": "15m",
1996
"interval": "2m",
1997
"checker": "fping -q -- %%(host)s",
1998
"host": "",
1999
"approval_delay": "0s",
2000
"approval_duration": "1s",
2001
}
2002
client_config = configparser.SafeConfigParser(client_defaults)
2097
client_config = configparser.SafeConfigParser(Client.client_defaults)
2003
2098
client_config.read(os.path.join(server_settings["configdir"],
2004
2099
"clients.conf"))
2005
2100
2043
2138
if error[0] != errno.EPERM:
2044
2139
raise error
2045
2140
2046
if not debug and not debuglevel:
2047
logger.setLevel(logging.WARNING)
2048
if debuglevel:
2049
level = getattr(logging, debuglevel.upper())
2050
logger.setLevel(level)
2051
2052
2141
if debug:
2053
logger.setLevel(logging.DEBUG)
2054
2142
# Enable all possible GnuTLS debugging
2055
2143
2056
2144
# "Use a log level over 10 to enable all debugging options."
2069
2157
os.dup2(null, sys.stdin.fileno())
2070
2158
if null > 2:
2071
2159
os.close(null)
2072
else:
2073
# No console logging
2074
logger.removeHandler(console)
2075
2160
2076
2161
# Need to fork before connecting to D-Bus
2077
2162
if not debug:
2078
2163
# Close all input and output, do double fork, etc.
2079
2164
daemon()
2080
2165
2166
gobject.threads_init()
2167
2081
2168
global main_loop
2082
2169
# From the Avahi example code
2083
2170
DBusGMainLoop(set_as_default=True )
2113
2200
client_class = functools.partial(ClientDBusTransitional,
2114
2201
bus = bus)
2115
2202
2116
special_settings = {
2117
# Some settings need to be accessd by special methods;
2118
# booleans need .getboolean(), etc. Here is a list of them:
2119
"approved_by_default":
2120
lambda section:
2121
client_config.getboolean(section, "approved_by_default"),
2122
}
2123
# Construct a new dict of client settings of this form:
2124
# { client_name: {setting_name: value, ...}, ...}
2125
# with exceptions for any special settings as defined above
2126
client_settings = dict((clientname,
2127
dict((setting,
2128
(value if setting not in special_settings
2129
else special_settings[setting](clientname)))
2130
for setting, value in client_config.items(clientname)))
2131
for clientname in client_config.sections())
2132
2203
client_settings = Client.config_parser(client_config)
2133
2204
old_client_settings = {}
2134
clients_data = []
2135
2136
# Get client data and settings from last running state.
2205
clients_data = {}
2206
2207
# Get client data and settings from last running state.
2137
2208
if server_settings["restore"]:
2138
2209
try:
2139
2210
with open(stored_state_path, "rb") as stored_state:
2140
clients_data, old_client_settings = pickle.load(stored_state)
2211
clients_data, old_client_settings = (pickle.load
2212
(stored_state))
2141
2213
os.remove(stored_state_path)
2142
2214
except IOError as e:
2143
logger.warning("Could not load persistant state: {0}".format(e))
2215
logger.warning("Could not load persistent state: {0}"
2216
.format(e))
2144
2217
if e.errno != errno.ENOENT:
2145
2218
raise
2146
2147
for client in clients_data:
2148
client_name = client["name"]
2149
2150
# Decide which value to use after restoring saved state.
2151
# We have three different values: Old config file,
2152
# new config file, and saved state.
2153
# New config value takes precedence if it differs from old
2154
# config value, otherwise use saved state.
2155
for name, value in client_settings[client_name].items():
2219
except EOFError as e:
2220
logger.warning("Could not load persistent state: "
2221
"EOFError: {0}".format(e))
2222
2223
with PGPEngine() as pgp:
2224
for client_name, client in clients_data.iteritems():
2225
# Decide which value to use after restoring saved state.
2226
# We have three different values: Old config file,
2227
# new config file, and saved state.
2228
# New config value takes precedence if it differs from old
2229
# config value, otherwise use saved state.
2230
for name, value in client_settings[client_name].items():
2231
try:
2232
# For each value in new config, check if it
2233
# differs from the old config value (Except for
2234
# the "secret" attribute)
2235
if (name != "secret" and
2236
value != old_client_settings[client_name]
2237
[name]):
2238
client[name] = value
2239
except KeyError:
2240
pass
2241
2242
# Clients who has passed its expire date can still be
2243
# enabled if its last checker was successful. Clients
2244
# whose checker failed before we stored its state is
2245
# assumed to have failed all checkers during downtime.
2246
if client["enabled"]:
2247
if datetime.datetime.utcnow() >= client["expires"]:
2248
if not client["last_checked_ok"]:
2249
logger.warning(
2250
"disabling client {0} - Client never "
2251
"performed a successfull checker"
2252
.format(client["name"]))
2253
client["enabled"] = False
2254
elif client["last_checker_status"] != 0:
2255
logger.warning(
2256
"disabling client {0} - Client "
2257
"last checker failed with error code {1}"
2258
.format(client["name"],
2259
client["last_checker_status"]))
2260
client["enabled"] = False
2261
else:
2262
client["expires"] = (datetime.datetime
2263
.utcnow()
2264
+ client["timeout"])
2265
2156
2266
try:
2157
# For each value in new config, check if it differs
2158
# from the old config value (Except for the "secret"
2159
# attribute)
2160
if name != "secret" and value != old_client_settings[client_name][name]:
2161
setattr(client, name, value)
2162
except KeyError:
2163
pass
2164
2165
# Clients who has passed its expire date, can still be enabled if its
2166
# last checker was sucessful. Clients who checkers failed before we
2167
# stored it state is asumed to had failed checker during downtime.
2168
if client["enabled"] and client["last_checked_ok"]:
2169
if ((datetime.datetime.utcnow() - client["last_checked_ok"])
2170
> client["interval"]):
2171
if client["last_checker_status"] != 0:
2172
client["enabled"] = False
2173
else:
2174
client["expires"] = datetime.datetime.utcnow() + client["timeout"]
2175
2176
client["changedstate"] = (multiprocessing_manager
2177
.Condition(multiprocessing_manager
2178
.Lock()))
2179
if use_dbus:
2180
new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)
2181
tcp_server.clients[client_name] = new_client
2182
new_client.bus = bus
2183
for name, value in client.iteritems():
2184
setattr(new_client, name, value)
2185
client_object_name = unicode(client_name).translate(
2186
{ord("."): ord("_"),
2187
ord("-"): ord("_")})
2188
new_client.dbus_object_path = (dbus.ObjectPath
2189
("/clients/" + client_object_name))
2190
DBusObjectWithProperties.__init__(new_client,
2191
new_client.bus,
2192
new_client.dbus_object_path)
2193
else:
2194
tcp_server.clients[client_name] = Client.__new__(Client)
2195
for name, value in client.iteritems():
2196
setattr(tcp_server.clients[client_name], name, value)
2197
2198
tcp_server.clients[client_name].decrypt_secret(
2199
client_settings[client_name]["secret"])
2200
2201
# Create/remove clients based on new changes made to config
2202
for clientname in set(old_client_settings) - set(client_settings):
2203
del tcp_server.clients[clientname]
2204
for clientname in set(client_settings) - set(old_client_settings):
2205
tcp_server.clients[clientname] = (client_class(name = clientname,
2206
config =
2207
client_settings
2208
[clientname]))
2209
2210
2267
client["secret"] = (
2268
pgp.decrypt(client["encrypted_secret"],
2269
client_settings[client_name]
2270
["secret"]))
2271
except PGPError:
2272
# If decryption fails, we use secret from new settings
2273
logger.debug("Failed to decrypt {0} old secret"
2274
.format(client_name))
2275
client["secret"] = (
2276
client_settings[client_name]["secret"])
2277
2278
2279
# Add/remove clients based on new changes made to config
2280
for client_name in set(old_client_settings) - set(client_settings):
2281
del clients_data[client_name]
2282
for client_name in set(client_settings) - set(old_client_settings):
2283
clients_data[client_name] = client_settings[client_name]
2284
2285
# Create clients all clients
2286
for client_name, client in clients_data.iteritems():
2287
tcp_server.clients[client_name] = client_class(
2288
name = client_name, settings = client)
2289
2211
2290
if not tcp_server.clients:
2212
2291
logger.warning("No clients defined")
2213
2292
2224
2303
# "pidfile" was never created
2225
2304
pass
2226
2305
del pidfilename
2227
2228
2306
signal.signal(signal.SIGINT, signal.SIG_IGN)
2229
2307
2230
2308
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2295
2373
multiprocessing.active_children()
2296
2374
if not (tcp_server.clients or client_settings):
2297
2375
return
2298
2299
# Store client before exiting. Secrets are encrypted with key based
2300
# on what config file has. If config file is removed/edited, old
2301
# secret will thus be unrecovable.
2302
clients = []
2303
for client in tcp_server.clients.itervalues():
2304
client.encrypt_secret(client_settings[client.name]["secret"])
2305
2306
client_dict = {}
2307
2308
# A list of attributes that will not be stored when shuting down.
2309
exclude = set(("bus", "changedstate", "secret"))
2310
for name, typ in inspect.getmembers(dbus.service.Object):
2311
exclude.add(name)
2312
2313
client_dict["encrypted_secret"] = client.encrypted_secret
2314
for attr in client.client_structure:
2315
if attr not in exclude:
2316
client_dict[attr] = getattr(client, attr)
2317
2318
clients.append(client_dict)
2319
del client_settings[client.name]["secret"]
2320
2376
2377
# Store client before exiting. Secrets are encrypted with key
2378
# based on what config file has. If config file is
2379
# removed/edited, old secret will thus be unrecovable.
2380
clients = {}
2381
with PGPEngine() as pgp:
2382
for client in tcp_server.clients.itervalues():
2383
key = client_settings[client.name]["secret"]
2384
client.encrypted_secret = pgp.encrypt(client.secret,
2385
key)
2386
client_dict = {}
2387
2388
# A list of attributes that can not be pickled
2389
# + secret.
2390
exclude = set(("bus", "changedstate", "secret",
2391
"checker"))
2392
for name, typ in (inspect.getmembers
2393
(dbus.service.Object)):
2394
exclude.add(name)
2395
2396
client_dict["encrypted_secret"] = (client
2397
.encrypted_secret)
2398
for attr in client.client_structure:
2399
if attr not in exclude:
2400
client_dict[attr] = getattr(client, attr)
2401
2402
clients[client.name] = client_dict
2403
del client_settings[client.name]["secret"]
2404
2321
2405
try:
2322
with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:
2406
tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2407
prefix="clients-",
2408
dir=os.path.dirname
2409
(stored_state_path))
2410
with os.fdopen(tempfd, "wb") as stored_state:
2323
2411
pickle.dump((clients, client_settings), stored_state)
2324
except IOError as e:
2325
logger.warning("Could not save persistant state: {0}".format(e))
2326
if e.errno != errno.ENOENT:
2327
raise
2328
2412
os.rename(tempname, stored_state_path)
2413
except (IOError, OSError) as e:
2414
logger.warning("Could not save persistent state: {0}"
2415
.format(e))
2416
if not debug:
2417
try:
2418
os.remove(tempname)
2419
except NameError:
2420
pass
2421
if e.errno not in set((errno.ENOENT, errno.EACCES,
2422
errno.EEXIST)):
2423
raise e
2424
2329
2425
# Delete all clients, and settings from config
2330
2426
while tcp_server.clients:
2331
2427
name, client = tcp_server.clients.popitem()
2349
2445
# Need to initiate checking of clients
2350
2446
if client.enabled:
2351
2447
client.init_checker()
2352
2353
2448
2354
2449
tcp_server.enable()
2355
2450
tcp_server.server_activate()
2395
2490
# Must run before the D-Bus bus name gets deregistered
2396
2491
cleanup()
2397
2492
2398
2399
2493
if __name__ == '__main__':
2400
2494
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0