/mandos/trunk : revision 549

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

import hashlib

66

import binascii

67

import tempfile

67

68

69

import dbus

69

70

import dbus.service

74

75

import ctypes.util

75

76

import xml.dom.minidom

76

77

import inspect

77

import Crypto.Cipher.AES

78

import GnuPGInterface

78

79

80

try:

80

81

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

84

85

except ImportError:

85

86

SO_BINDTODEVICE = None

86

87

88

version = "1.4.1"

88

version = "1.5.0"

89

stored_state_file = "clients.pickle"

89

90

91

logger = logging.getLogger()

91

stored_state_path = "/var/lib/mandos/clients.pickle"

92

93

92

syslogger = (logging.handlers.SysLogHandler

94

93

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

94

address = str("/dev/log")))

96

syslogger.setFormatter(logging.Formatter

97

('Mandos [%(process)d]: %(levelname)s:'

98

' %(message)s'))

99

logger.addHandler(syslogger)

100

101

console = logging.StreamHandler()

102

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

103

' [%(process)d]:'

104

' %(levelname)s:'

105

' %(message)s'))

106

logger.addHandler(console)

95

96

try:

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

100

except (OSError, AttributeError):

101

def if_nametoindex(interface):

102

"Get an interface index the hard way, i.e. using fcntl()"

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

104

with contextlib.closing(socket.socket()) as s:

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

110

return interface_index

111

112

113

def initlogger(debug, level=logging.WARNING):

114

"""init logger and add loglevel"""

115

116

syslogger.setFormatter(logging.Formatter

117

('Mandos [%(process)d]: %(levelname)s:'

118

' %(message)s'))

119

logger.addHandler(syslogger)

120

121

if debug:

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

128

logger.setLevel(level)

129

130

131

class PGPError(Exception):

132

"""Exception if encryption/decryption fails"""

133

pass

134

135

136

class PGPEngine(object):

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet',

146

'--no-use-agent'])

147

148

def __enter__(self):

149

return self

150

151

def __exit__ (self, exc_type, exc_value, traceback):

152

self._cleanup()

153

return False

154

155

def __del__(self):

156

self._cleanup()

157

158

def _cleanup(self):

159

if self.tempdir is not None:

160

# Delete contents of tempdir

161

for root, dirs, files in os.walk(self.tempdir,

162

topdown = False):

163

for filename in files:

164

os.remove(os.path.join(root, filename))

165

for dirname in dirs:

166

os.rmdir(os.path.join(root, dirname))

167

# Remove tempdir

168

os.rmdir(self.tempdir)

169

self.tempdir = None

170

171

def password_encode(self, password):

172

# Passphrase can not be empty and can not contain newlines or

173

# NUL bytes. So we prefix it and hex encode it.

174

return b"mandos" + binascii.hexlify(password)

175

176

def encrypt(self, data, password):

177

self.gnupg.passphrase = self.password_encode(password)

178

with open(os.devnull) as devnull:

179

try:

180

proc = self.gnupg.run(['--symmetric'],

181

create_fhs=['stdin', 'stdout'],

182

attach_fhs={'stderr': devnull})

183

with contextlib.closing(proc.handles['stdin']) as f:

184

f.write(data)

185

with contextlib.closing(proc.handles['stdout']) as f:

186

ciphertext = f.read()

187

proc.wait()

188

except IOError as e:

189

raise PGPError(e)

190

self.gnupg.passphrase = None

191

return ciphertext

192

193

def decrypt(self, data, password):

194

self.gnupg.passphrase = self.password_encode(password)

195

with open(os.devnull) as devnull:

196

try:

197

proc = self.gnupg.run(['--decrypt'],

198

create_fhs=['stdin', 'stdout'],

199

attach_fhs={'stderr': devnull})

200

with contextlib.closing(proc.handles['stdin'] ) as f:

201

f.write(data)

202

with contextlib.closing(proc.handles['stdout']) as f:

203

decrypted_plaintext = f.read()

204

proc.wait()

205

except IOError as e:

206

raise PGPError(e)

207

self.gnupg.passphrase = None

208

return decrypted_plaintext

209

107

210

108

211

109

212

class AvahiError(Exception):

226

329

try:

227

330

self.group.Free()

228

331

except (dbus.exceptions.UnknownMethodException,

229

dbus.exceptions.DBusException) as e:

332

dbus.exceptions.DBusException):

230

333

pass

231

334

self.group = None

232

335

self.remove()

276

379

% self.name))

277

380

return ret

278

381

279

def _timedelta_to_milliseconds(td):

382

def timedelta_to_milliseconds(td):

280

383

"Convert a datetime.timedelta() to milliseconds"

281

384

return ((td.days * 24 * 60 * 60 * 1000)

282

385

+ (td.seconds * 1000)

286

389

"""A representation of a client host served by this server.

287

390

288

391

Attributes:

289

_approved: bool(); 'None' if not yet approved/disapproved

392

approved: bool(); 'None' if not yet approved/disapproved

290

393

approval_delay: datetime.timedelta(); Time to wait for approval

291

394

approval_duration: datetime.timedelta(); Duration of one approval

292

395

checker: subprocess.Popen(); a running checker process used

310

413

interval: datetime.timedelta(); How often to start a new checker

311

414

last_approval_request: datetime.datetime(); (UTC) or None

312

415

last_checked_ok: datetime.datetime(); (UTC) or None

313

last_checker_status: integer between 0 and 255 reflecting exit status

314

of last checker. -1 reflect crashed checker,

315

or None.

316

last_enabled: datetime.datetime(); (UTC)

416

last_checker_status: integer between 0 and 255 reflecting exit

417

status of last checker. -1 reflects crashed

418

checker, or None.

419

last_enabled: datetime.datetime(); (UTC) or None

317

420

name: string; from the config file, used in log messages and

318

421

D-Bus identifiers

319

422

secret: bytestring; sent verbatim (over TLS) to client

329

432

"created", "enabled", "fingerprint",

330

433

"host", "interval", "last_checked_ok",

331

434

"last_enabled", "name", "timeout")

435

client_defaults = { "timeout": "5m",

436

"extended_timeout": "15m",

437

"interval": "2m",

438

"checker": "fping -q -- %%(host)s",

439

"host": "",

440

"approval_delay": "0s",

441

"approval_duration": "1s",

442

"approved_by_default": "True",

443

"enabled": "True",

444

}

332

445

333

446

def timeout_milliseconds(self):

334

447

"Return the 'timeout' attribute in milliseconds"

335

return _timedelta_to_milliseconds(self.timeout)

448

return timedelta_to_milliseconds(self.timeout)

336

449

337

450

def extended_timeout_milliseconds(self):

338

451

"Return the 'extended_timeout' attribute in milliseconds"

339

return _timedelta_to_milliseconds(self.extended_timeout)

452

return timedelta_to_milliseconds(self.extended_timeout)

340

453

341

454

def interval_milliseconds(self):

342

455

"Return the 'interval' attribute in milliseconds"

343

return _timedelta_to_milliseconds(self.interval)

456

return timedelta_to_milliseconds(self.interval)

344

457

345

458

def approval_delay_milliseconds(self):

346

return _timedelta_to_milliseconds(self.approval_delay)

347

348

def __init__(self, name = None, config=None):

459

return timedelta_to_milliseconds(self.approval_delay)

460

461

@staticmethod

462

def config_parser(config):

463

"""Construct a new dict of client settings of this form:

464

{ client_name: {setting_name: value, ...}, ...}

465

with exceptions for any special settings as defined above.

466

NOTE: Must be a pure function. Must return the same result

467

value given the same arguments.

468

"""

469

settings = {}

470

for client_name in config.sections():

471

section = dict(config.items(client_name))

472

client = settings[client_name] = {}

473

474

client["host"] = section["host"]

475

# Reformat values from string types to Python types

476

client["approved_by_default"] = config.getboolean(

477

client_name, "approved_by_default")

478

client["enabled"] = config.getboolean(client_name,

479

"enabled")

480

481

client["fingerprint"] = (section["fingerprint"].upper()

482

.replace(" ", ""))

483

if "secret" in section:

484

client["secret"] = section["secret"].decode("base64")

485

elif "secfile" in section:

486

with open(os.path.expanduser(os.path.expandvars

487

(section["secfile"])),

488

"rb") as secfile:

489

client["secret"] = secfile.read()

490

else:

491

raise TypeError("No secret or secfile for section %s"

492

% section)

493

client["timeout"] = string_to_delta(section["timeout"])

494

client["extended_timeout"] = string_to_delta(

495

section["extended_timeout"])

496

client["interval"] = string_to_delta(section["interval"])

497

client["approval_delay"] = string_to_delta(

498

section["approval_delay"])

499

client["approval_duration"] = string_to_delta(

500

section["approval_duration"])

501

client["checker_command"] = section["checker"]

502

client["last_approval_request"] = None

503

client["last_checked_ok"] = None

504

client["last_checker_status"] = None

505

506

return settings

507

508

509

def __init__(self, settings, name = None):

349

510

"""Note: the 'checker' key in 'config' sets the

350

511

'checker_command' attribute and *not* the 'checker'

351

512

attribute."""

352

513

self.name = name

353

if config is None:

354

config = {}

514

# adding all client settings

515

for setting, value in settings.iteritems():

516

setattr(self, setting, value)

517

518

if self.enabled:

519

if not hasattr(self, "last_enabled"):

520

self.last_enabled = datetime.datetime.utcnow()

521

if not hasattr(self, "expires"):

522

self.expires = (datetime.datetime.utcnow()

523

+ self.timeout)

524

else:

525

self.last_enabled = None

526

self.expires = None

527

355

528

logger.debug("Creating client %r", self.name)

356

529

# Uppercase and remove spaces from fingerprint for later

357

530

# comparison purposes with return value from the fingerprint()

358

531

# function

359

self.fingerprint = (config["fingerprint"].upper()

360

.replace(" ", ""))

361

532

logger.debug(" Fingerprint: %s", self.fingerprint)

362

if "secret" in config:

363

self.secret = config["secret"].decode("base64")

364

elif "secfile" in config:

365

with open(os.path.expanduser(os.path.expandvars

366

(config["secfile"])),

367

"rb") as secfile:

368

self.secret = secfile.read()

369

else:

370

raise TypeError("No secret or secfile for client %s"

371

% self.name)

372

self.host = config.get("host", "")

373

self.created = datetime.datetime.utcnow()

374

self.enabled = True

375

self.last_approval_request = None

376

self.last_enabled = datetime.datetime.utcnow()

377

self.last_checked_ok = None

378

self.last_checker_status = None

379

self.timeout = string_to_delta(config["timeout"])

380

self.extended_timeout = string_to_delta(config

381

["extended_timeout"])

382

self.interval = string_to_delta(config["interval"])

533

self.created = settings.get("created",

534

datetime.datetime.utcnow())

535

536

# attributes specific for this server instance

383

537

self.checker = None

384

538

self.checker_initiator_tag = None

385

539

self.disable_initiator_tag = None

386

self.expires = datetime.datetime.utcnow() + self.timeout

387

540

self.checker_callback_tag = None

388

self.checker_command = config["checker"]

389

541

self.current_checker_command = None

390

self._approved = None

391

self.approved_by_default = config.get("approved_by_default",

392

True)

542

self.approved = None

393

543

self.approvals_pending = 0

394

self.approval_delay = string_to_delta(

395

config["approval_delay"])

396

self.approval_duration = string_to_delta(

397

config["approval_duration"])

398

544

self.changedstate = (multiprocessing_manager

399

545

.Condition(multiprocessing_manager

400

546

.Lock()))

401

self.client_structure = [attr for attr in self.__dict__.iterkeys() if not attr.startswith("_")]

547

self.client_structure = [attr for attr in

548

self.__dict__.iterkeys()

549

if not attr.startswith("_")]

402

550

self.client_structure.append("client_structure")

403

404

551

405

552

for name, t in inspect.getmembers(type(self),

406

lambda obj: isinstance(obj, property)):

553

lambda obj:

554

isinstance(obj,

555

property)):

407

556

if not name.startswith("_"):

408

557

self.client_structure.append(name)

409

558

445

594

446

595

def __del__(self):

447

596

self.disable()

448

597

449

598

def init_checker(self):

450

599

# Schedule a new checker to be started an 'interval' from now,

451

600

# and every interval from then on.

458

607

self.disable))

459

608

# Also start a new checker *right now*.

460

609

self.start_checker()

461

462

610

463

611

def checker_callback(self, pid, condition, command):

464

612

"""The checker has completed, so take appropriate actions."""

465

613

self.checker_callback_tag = None

466

614

self.checker = None

467

615

if os.WIFEXITED(condition):

468

self.last_checker_status = os.WEXITSTATUS(condition)

616

self.last_checker_status = os.WEXITSTATUS(condition)

469

617

if self.last_checker_status == 0:

470

618

logger.info("Checker for %(name)s succeeded",

471

619

vars(self))

491

639

gobject.source_remove(self.disable_initiator_tag)

492

640

if getattr(self, "enabled", False):

493

641

self.disable_initiator_tag = (gobject.timeout_add

494

(_timedelta_to_milliseconds

642

(timedelta_to_milliseconds

495

643

(timeout), self.disable))

496

644

self.expires = datetime.datetime.utcnow() + timeout

497

645

591

739

raise

592

740

self.checker = None

593

741

594

# Encrypts a client secret and stores it in a varible encrypted_secret

595

def encrypt_secret(self, key):

596

# Encryption-key need to be of a specific size, so we hash inputed key

597

hasheng = hashlib.sha256()

598

hasheng.update(key)

599

encryptionkey = hasheng.digest()

600

601

# Create validation hash so we know at decryption if it was sucessful

602

hasheng = hashlib.sha256()

603

hasheng.update(self.secret)

604

validationhash = hasheng.digest()

605

606

# Encrypt secret

607

iv = os.urandom(Crypto.Cipher.AES.block_size)

608

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

609

Crypto.Cipher.AES.MODE_CFB, iv)

610

ciphertext = ciphereng.encrypt(validationhash+self.secret)

611

self.encrypted_secret = (ciphertext, iv)

612

613

# Decrypt a encrypted client secret

614

def decrypt_secret(self, key):

615

# Decryption-key need to be of a specific size, so we hash inputed key

616

hasheng = hashlib.sha256()

617

hasheng.update(key)

618

encryptionkey = hasheng.digest()

619

620

# Decrypt encrypted secret

621

ciphertext, iv = self.encrypted_secret

622

ciphereng = Crypto.Cipher.AES.new(encryptionkey,

623

Crypto.Cipher.AES.MODE_CFB, iv)

624

plain = ciphereng.decrypt(ciphertext)

625

626

# Validate decrypted secret to know if it was succesful

627

hasheng = hashlib.sha256()

628

validationhash = plain[:hasheng.digest_size]

629

secret = plain[hasheng.digest_size:]

630

hasheng.update(secret)

631

632

# if validation fails, we use key as new secret. Otherwhise, we use

633

# the decrypted secret

634

if hasheng.digest() == validationhash:

635

self.secret = secret

636

else:

637

self.secret = key

638

del self.encrypted_secret

639

640

742

641

743

def dbus_service_property(dbus_interface, signature="v",

642

744

access="readwrite", byte_arrays=False):

748

850

# signatures other than "ay".

749

851

if prop._dbus_signature != "ay":

750

852

raise ValueError

751

value = dbus.ByteArray(''.join(unichr(byte)

752

for byte in value))

853

value = dbus.ByteArray(b''.join(chr(byte)

854

for byte in value))

753

855

prop(value)

754

856

755

857

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

760

862

761

863

Note: Will not include properties with access="write".

762

864

"""

763

all = {}

865

properties = {}

764

866

for name, prop in self._get_all_dbus_properties():

765

867

if (interface_name

766

868

and interface_name != prop._dbus_interface):

771

873

continue

772

874

value = prop()

773

875

if not hasattr(value, "variant_level"):

774

all[name] = value

876

properties[name] = value

775

877

continue

776

all[name] = type(value)(value, variant_level=

777

value.variant_level+1)

778

return dbus.Dictionary(all, signature="sv")

878

properties[name] = type(value)(value, variant_level=

879

value.variant_level+1)

880

return dbus.Dictionary(properties, signature="sv")

779

881

780

882

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

781

883

out_signature="s",

832

934

return dbus.String(dt.isoformat(),

833

935

variant_level=variant_level)

834

936

937

835

938

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

836

939

.__metaclass__):

837

940

"""Applied to an empty subclass of a D-Bus object, this metaclass

929

1032

attribute.func_closure)))

930

1033

return type.__new__(mcs, name, bases, attr)

931

1034

1035

932

1036

class ClientDBus(Client, DBusObjectWithProperties):

933

1037

"""A Client class using D-Bus

934

1038

945

1049

def __init__(self, bus = None, *args, **kwargs):

946

1050

self.bus = bus

947

1051

Client.__init__(self, *args, **kwargs)

948

1052

self._approvals_pending = 0

1053

949

1054

self._approvals_pending = 0

950

1055

# Only now, when this client is initialized, can it show up on

951

1056

# the D-Bus

962

1067

variant_level=1):

963

1068

""" Modify a variable so that it's a property which announces

964

1069

its changes to DBus.

965

1070

966

1071

transform_fun: Function that takes a value and a variant_level

967

1072

and transforms it to a D-Bus type.

968

1073

dbus_name: D-Bus name of the variable

1002

1107

datetime_to_dbus, "LastApprovalRequest")

1003

1108

approved_by_default = notifychangeproperty(dbus.Boolean,

1004

1109

"ApprovedByDefault")

1005

approval_delay = notifychangeproperty(dbus.UInt16,

1110

approval_delay = notifychangeproperty(dbus.UInt64,

1006

1111

"ApprovalDelay",

1007

1112

type_func =

1008

_timedelta_to_milliseconds)

1113

timedelta_to_milliseconds)

1009

1114

approval_duration = notifychangeproperty(

1010

dbus.UInt16, "ApprovalDuration",

1011

type_func = _timedelta_to_milliseconds)

1115

dbus.UInt64, "ApprovalDuration",

1116

type_func = timedelta_to_milliseconds)

1012

1117

host = notifychangeproperty(dbus.String, "Host")

1013

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1118

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1014

1119

type_func =

1015

_timedelta_to_milliseconds)

1120

timedelta_to_milliseconds)

1016

1121

extended_timeout = notifychangeproperty(

1017

dbus.UInt16, "ExtendedTimeout",

1018

type_func = _timedelta_to_milliseconds)

1019

interval = notifychangeproperty(dbus.UInt16,

1122

dbus.UInt64, "ExtendedTimeout",

1123

type_func = timedelta_to_milliseconds)

1124

interval = notifychangeproperty(dbus.UInt64,

1020

1125

"Interval",

1021

1126

type_func =

1022

_timedelta_to_milliseconds)

1127

timedelta_to_milliseconds)

1023

1128

checker_command = notifychangeproperty(dbus.String, "Checker")

1024

1129

1025

1130

del notifychangeproperty

1067

1172

return r

1068

1173

1069

1174

def _reset_approved(self):

1070

self._approved = None

1175

self.approved = None

1071

1176

return False

1072

1177

1073

1178

def approve(self, value=True):

1074

1179

self.send_changedstate()

1075

self._approved = value

1076

gobject.timeout_add(_timedelta_to_milliseconds

1180

self.approved = value

1181

gobject.timeout_add(timedelta_to_milliseconds

1077

1182

(self.approval_duration),

1078

1183

self._reset_approved)

1079

1184

1122

1227

"D-Bus signal"

1123

1228

return self.need_approval()

1124

1229

1230

# NeRwequest - signal

1231

@dbus.service.signal(_interface, signature="s")

1232

def NewRequest(self, ip):

1233

"""D-Bus signal

1234

Is sent after a client request a password.

1235

"""

1236

pass

1237

1125

1238

## Methods

1126

1239

1127

1240

# Approve - method

1185

1298

access="readwrite")

1186

1299

def ApprovalDuration_dbus_property(self, value=None):

1187

1300

if value is None: # get

1188

return dbus.UInt64(_timedelta_to_milliseconds(

1301

return dbus.UInt64(timedelta_to_milliseconds(

1189

1302

self.approval_duration))

1190

1303

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1191

1304

1205

1318

def Host_dbus_property(self, value=None):

1206

1319

if value is None: # get

1207

1320

return dbus.String(self.host)

1208

self.host = value

1321

self.host = unicode(value)

1209

1322

1210

1323

# Created - property

1211

1324

@dbus_service_property(_interface, signature="s", access="read")

1212

1325

def Created_dbus_property(self):

1213

return dbus.String(datetime_to_dbus(self.created))

1326

return datetime_to_dbus(self.created)

1214

1327

1215

1328

# LastEnabled - property

1216

1329

@dbus_service_property(_interface, signature="s", access="read")

1254

1367

if value is None: # get

1255

1368

return dbus.UInt64(self.timeout_milliseconds())

1256

1369

self.timeout = datetime.timedelta(0, 0, 0, value)

1257

if getattr(self, "disable_initiator_tag", None) is None:

1258

return

1259

1370

# Reschedule timeout

1260

gobject.source_remove(self.disable_initiator_tag)

1261

self.disable_initiator_tag = None

1262

self.expires = None

1263

time_to_die = _timedelta_to_milliseconds((self

1264

.last_checked_ok

1265

+ self.timeout)

1266

- datetime.datetime

1267

.utcnow())

1268

if time_to_die <= 0:

1269

# The timeout has passed

1270

self.disable()

1271

else:

1272

self.expires = (datetime.datetime.utcnow()

1273

+ datetime.timedelta(milliseconds =

1274

time_to_die))

1275

self.disable_initiator_tag = (gobject.timeout_add

1276

(time_to_die, self.disable))

1371

if self.enabled:

1372

now = datetime.datetime.utcnow()

1373

time_to_die = timedelta_to_milliseconds(

1374

(self.last_checked_ok + self.timeout) - now)

1375

if time_to_die <= 0:

1376

# The timeout has passed

1377

self.disable()

1378

else:

1379

self.expires = (now +

1380

datetime.timedelta(milliseconds =

1381

time_to_die))

1382

if (getattr(self, "disable_initiator_tag", None)

1383

is None):

1384

return

1385

gobject.source_remove(self.disable_initiator_tag)

1386

self.disable_initiator_tag = (gobject.timeout_add

1387

(time_to_die,

1388

self.disable))

1277

1389

1278

1390

# ExtendedTimeout - property

1279

1391

@dbus_service_property(_interface, signature="t",

1292

1404

self.interval = datetime.timedelta(0, 0, 0, value)

1293

1405

if getattr(self, "checker_initiator_tag", None) is None:

1294

1406

return

1295

# Reschedule checker run

1296

gobject.source_remove(self.checker_initiator_tag)

1297

self.checker_initiator_tag = (gobject.timeout_add

1298

(value, self.start_checker))

1299

self.start_checker() # Start one now, too

1407

if self.enabled:

1408

# Reschedule checker run

1409

gobject.source_remove(self.checker_initiator_tag)

1410

self.checker_initiator_tag = (gobject.timeout_add

1411

(value, self.start_checker))

1412

self.start_checker() # Start one now, too

1300

1413

1301

1414

# Checker - property

1302

1415

@dbus_service_property(_interface, signature="s",

1304

1417

def Checker_dbus_property(self, value=None):

1305

1418

if value is None: # get

1306

1419

return dbus.String(self.checker_command)

1307

self.checker_command = value

1420

self.checker_command = unicode(value)

1308

1421

1309

1422

# CheckerRunning - property

1310

1423

@dbus_service_property(_interface, signature="b",

1339

1452

raise KeyError()

1340

1453

1341

1454

def __getattribute__(self, name):

1342

if(name == '_pipe'):

1455

if name == '_pipe':

1343

1456

return super(ProxyClient, self).__getattribute__(name)

1344

1457

self._pipe.send(('getattr', name))

1345

1458

data = self._pipe.recv()

1352

1465

return func

1353

1466

1354

1467

def __setattr__(self, name, value):

1355

if(name == '_pipe'):

1468

if name == '_pipe':

1356

1469

return super(ProxyClient, self).__setattr__(name, value)

1357

1470

self._pipe.send(('setattr', name, value))

1358

1471

1472

1359

1473

class ClientDBusTransitional(ClientDBus):

1360

1474

__metaclass__ = AlternateDBusNamesMetaclass

1361

1475

1476

1362

1477

class ClientHandler(socketserver.BaseRequestHandler, object):

1363

1478

"""A class to handle client connections.

1364

1479

1432

1547

except KeyError:

1433

1548

return

1434

1549

1550

if self.server.use_dbus:

1551

# Emit D-Bus signal

1552

client.NewRequest(str(self.client_address))

1553

1435

1554

if client.approval_delay:

1436

1555

delay = client.approval_delay

1437

1556

client.approvals_pending += 1

1446

1565

client.Rejected("Disabled")

1447

1566

return

1448

1567

1449

if client._approved or not client.approval_delay:

1568

if client.approved or not client.approval_delay:

1450

1569

#We are approved or approval is disabled

1451

1570

break

1452

elif client._approved is None:

1571

elif client.approved is None:

1453

1572

logger.info("Client %s needs approval",

1454

1573

client.name)

1455

1574

if self.server.use_dbus:

1469

1588

time = datetime.datetime.now()

1470

1589

client.changedstate.acquire()

1471

1590

(client.changedstate.wait

1472

(float(client._timedelta_to_milliseconds(delay)

1591

(float(client.timedelta_to_milliseconds(delay)

1473

1592

/ 1000)))

1474

1593

client.changedstate.release()

1475

1594

time2 = datetime.datetime.now()

1574

1693

# Convert the buffer to a Python bytestring

1575

1694

fpr = ctypes.string_at(buf, buf_len.value)

1576

1695

# Convert the bytestring to hexadecimal notation

1577

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1696

hex_fpr = binascii.hexlify(fpr).upper()

1578

1697

return hex_fpr

1579

1698

1580

1699

1583

1702

def sub_process_main(self, request, address):

1584

1703

try:

1585

1704

self.finish_request(request, address)

1586

except:

1705

except Exception:

1587

1706

self.handle_error(request, address)

1588

1707

self.close_request(request)

1589

1708

1837

1956

return timevalue

1838

1957

1839

1958

1840

def if_nametoindex(interface):

1841

"""Call the C function if_nametoindex(), or equivalent

1842

1843

Note: This function cannot accept a unicode string."""

1844

global if_nametoindex

1845

try:

1846

if_nametoindex = (ctypes.cdll.LoadLibrary

1847

(ctypes.util.find_library("c"))

1848

.if_nametoindex)

1849

except (OSError, AttributeError):

1850

logger.warning("Doing if_nametoindex the hard way")

1851

def if_nametoindex(interface):

1852

"Get an interface index the hard way, i.e. using fcntl()"

1853

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1854

with contextlib.closing(socket.socket()) as s:

1855

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1856

struct.pack(str("16s16x"),

1857

interface))

1858

interface_index = struct.unpack(str("I"),

1859

ifreq[16:20])[0]

1860

return interface_index

1861

return if_nametoindex(interface)

1862

1863

1864

1959

def daemon(nochdir = False, noclose = False):

1865

1960

"""See daemon(3). Standard BSD Unix function.

1866

1961

1922

2017

parser.add_argument("--no-ipv6", action="store_false",

1923

2018

dest="use_ipv6", help="Do not use IPv6")

1924

2019

parser.add_argument("--no-restore", action="store_false",

1925

dest="restore", help="Do not restore stored state",

1926

default=True)

1927

2020

dest="restore", help="Do not restore stored"

2021

" state")

2022

parser.add_argument("--statedir", metavar="DIR",

2023

help="Directory to save/restore state in")

2024

1928

2025

options = parser.parse_args()

1929

2026

1930

2027

if options.check:

1943

2040

"use_dbus": "True",

1944

2041

"use_ipv6": "True",

1945

2042

"debuglevel": "",

2043

"restore": "True",

2044

"statedir": "/var/lib/mandos"

1946

2045

}

1947

2046

1948

2047

# Parse config file for server-global settings

1965

2064

# options, if set.

1966

2065

for option in ("interface", "address", "port", "debug",

1967

2066

"priority", "servicename", "configdir",

1968

"use_dbus", "use_ipv6", "debuglevel", "restore"):

2067

"use_dbus", "use_ipv6", "debuglevel", "restore",

2068

"statedir"):

1969

2069

value = getattr(options, option)

1970

2070

if value is not None:

1971

2071

server_settings[option] = value

1983

2083

debuglevel = server_settings["debuglevel"]

1984

2084

use_dbus = server_settings["use_dbus"]

1985

2085

use_ipv6 = server_settings["use_ipv6"]

2086

stored_state_path = os.path.join(server_settings["statedir"],

2087

stored_state_file)

2088

2089

if debug:

2090

initlogger(debug, logging.DEBUG)

2091

else:

2092

if not debuglevel:

2093

initlogger(debug)

2094

else:

2095

level = getattr(logging, debuglevel.upper())

2096

initlogger(debug, level)

1986

2097

1987

2098

if server_settings["servicename"] != "Mandos":

1988

2099

syslogger.setFormatter(logging.Formatter

1991

2102

% server_settings["servicename"]))

1992

2103

1993

2104

# Parse config file with clients

1994

client_defaults = { "timeout": "5m",

1995

"extended_timeout": "15m",

1996

"interval": "2m",

1997

"checker": "fping -q -- %%(host)s",

1998

"host": "",

1999

"approval_delay": "0s",

2000

"approval_duration": "1s",

2001

}

2002

client_config = configparser.SafeConfigParser(client_defaults)

2105

client_config = configparser.SafeConfigParser(Client

2106

.client_defaults)

2003

2107

client_config.read(os.path.join(server_settings["configdir"],

2004

2108

"clients.conf"))

2005

2109

2043

2147

if error[0] != errno.EPERM:

2044

2148

raise error

2045

2149

2046

if not debug and not debuglevel:

2047

logger.setLevel(logging.WARNING)

2048

if debuglevel:

2049

level = getattr(logging, debuglevel.upper())

2050

logger.setLevel(level)

2051

2052

2150

if debug:

2053

logger.setLevel(logging.DEBUG)

2054

2151

# Enable all possible GnuTLS debugging

2055

2152

2056

2153

# "Use a log level over 10 to enable all debugging options."

2069

2166

os.dup2(null, sys.stdin.fileno())

2070

2167

if null > 2:

2071

2168

os.close(null)

2072

else:

2073

# No console logging

2074

logger.removeHandler(console)

2075

2169

2076

2170

# Need to fork before connecting to D-Bus

2077

2171

if not debug:

2078

2172

# Close all input and output, do double fork, etc.

2079

2173

daemon()

2080

2174

2175

gobject.threads_init()

2176

2081

2177

global main_loop

2082

2178

# From the Avahi example code

2083

2179

DBusGMainLoop(set_as_default=True )

2113

2209

client_class = functools.partial(ClientDBusTransitional,

2114

2210

bus = bus)

2115

2211

2116

special_settings = {

2117

# Some settings need to be accessd by special methods;

2118

# booleans need .getboolean(), etc. Here is a list of them:

2119

"approved_by_default":

2120

lambda section:

2121

client_config.getboolean(section, "approved_by_default"),

2122

}

2123

# Construct a new dict of client settings of this form:

2124

# { client_name: {setting_name: value, ...}, ...}

2125

# with exceptions for any special settings as defined above

2126

client_settings = dict((clientname,

2127

dict((setting,

2128

(value if setting not in special_settings

2129

else special_settings[setting](clientname)))

2130

for setting, value in client_config.items(clientname)))

2131

for clientname in client_config.sections())

2132

2212

client_settings = Client.config_parser(client_config)

2133

2213

old_client_settings = {}

2134

clients_data = []

2135

2136

# Get client data and settings from last running state.

2214

clients_data = {}

2215

2216

# Get client data and settings from last running state.

2137

2217

if server_settings["restore"]:

2138

2218

try:

2139

2219

with open(stored_state_path, "rb") as stored_state:

2140

clients_data, old_client_settings = pickle.load(stored_state)

2220

clients_data, old_client_settings = (pickle.load

2221

(stored_state))

2141

2222

os.remove(stored_state_path)

2142

2223

except IOError as e:

2143

logger.warning("Could not load persistant state: {0}".format(e))

2224

logger.warning("Could not load persistent state: {0}"

2225

.format(e))

2144

2226

if e.errno != errno.ENOENT:

2145

2227

raise

2146

2147

for client in clients_data:

2148

client_name = client["name"]

2149

2150

# Decide which value to use after restoring saved state.

2151

# We have three different values: Old config file,

2152

# new config file, and saved state.

2153

# New config value takes precedence if it differs from old

2154

# config value, otherwise use saved state.

2155

for name, value in client_settings[client_name].items():

2228

except EOFError as e:

2229

logger.warning("Could not load persistent state: "

2230

"EOFError: {0}".format(e))

2231

2232

with PGPEngine() as pgp:

2233

for client_name, client in clients_data.iteritems():

2234

# Decide which value to use after restoring saved state.

2235

# We have three different values: Old config file,

2236

# new config file, and saved state.

2237

# New config value takes precedence if it differs from old

2238

# config value, otherwise use saved state.

2239

for name, value in client_settings[client_name].items():

2240

try:

2241

# For each value in new config, check if it

2242

# differs from the old config value (Except for

2243

# the "secret" attribute)

2244

if (name != "secret" and

2245

value != old_client_settings[client_name]

2246

[name]):

2247

client[name] = value

2248

except KeyError:

2249

pass

2250

2251

# Clients who has passed its expire date can still be

2252

# enabled if its last checker was successful. Clients

2253

# whose checker failed before we stored its state is

2254

# assumed to have failed all checkers during downtime.

2255

if client["enabled"]:

2256

if datetime.datetime.utcnow() >= client["expires"]:

2257

if not client["last_checked_ok"]:

2258

logger.warning(

2259

"disabling client {0} - Client never "

2260

"performed a successfull checker"

2261

.format(client["name"]))

2262

client["enabled"] = False

2263

elif client["last_checker_status"] != 0:

2264

logger.warning(

2265

"disabling client {0} - Client "

2266

"last checker failed with error code {1}"

2267

.format(client["name"],

2268

client["last_checker_status"]))

2269

client["enabled"] = False

2270

else:

2271

client["expires"] = (datetime.datetime

2272

.utcnow()

2273

+ client["timeout"])

2274

logger.debug("Last checker succeeded,"

2275

" keeping {0} enabled"

2276

.format(client["name"]))

2156

2277

try:

2157

# For each value in new config, check if it differs

2158

# from the old config value (Except for the "secret"

2159

# attribute)

2160

if name != "secret" and value != old_client_settings[client_name][name]:

2161

setattr(client, name, value)

2162

except KeyError:

2163

pass

2164

2165

# Clients who has passed its expire date, can still be enabled if its

2166

# last checker was sucessful. Clients who checkers failed before we

2167

# stored it state is asumed to had failed checker during downtime.

2168

if client["enabled"] and client["last_checked_ok"]:

2169

if ((datetime.datetime.utcnow() - client["last_checked_ok"])

2170

> client["interval"]):

2171

if client["last_checker_status"] != 0:

2172

client["enabled"] = False

2173

else:

2174

client["expires"] = datetime.datetime.utcnow() + client["timeout"]

2175

2176

client["changedstate"] = (multiprocessing_manager

2177

.Condition(multiprocessing_manager

2178

.Lock()))

2179

if use_dbus:

2180

new_client = ClientDBusTransitional.__new__(ClientDBusTransitional)

2181

tcp_server.clients[client_name] = new_client

2182

new_client.bus = bus

2183

for name, value in client.iteritems():

2184

setattr(new_client, name, value)

2185

client_object_name = unicode(client_name).translate(

2186

{ord("."): ord("_"),

2187

ord("-"): ord("_")})

2188

new_client.dbus_object_path = (dbus.ObjectPath

2189

("/clients/" + client_object_name))

2190

DBusObjectWithProperties.__init__(new_client,

2191

new_client.bus,

2192

new_client.dbus_object_path)

2193

else:

2194

tcp_server.clients[client_name] = Client.__new__(Client)

2195

for name, value in client.iteritems():

2196

setattr(tcp_server.clients[client_name], name, value)

2197

2198

tcp_server.clients[client_name].decrypt_secret(

2199

client_settings[client_name]["secret"])

2200

2201

# Create/remove clients based on new changes made to config

2202

for clientname in set(old_client_settings) - set(client_settings):

2203

del tcp_server.clients[clientname]

2204

for clientname in set(client_settings) - set(old_client_settings):

2205

tcp_server.clients[clientname] = (client_class(name = clientname,

2206

config =

2207

client_settings

2208

[clientname]))

2209

2210

2278

client["secret"] = (

2279

pgp.decrypt(client["encrypted_secret"],

2280

client_settings[client_name]

2281

["secret"]))

2282

except PGPError:

2283

# If decryption fails, we use secret from new settings

2284

logger.debug("Failed to decrypt {0} old secret"

2285

.format(client_name))

2286

client["secret"] = (

2287

client_settings[client_name]["secret"])

2288

2289

2290

# Add/remove clients based on new changes made to config

2291

for client_name in (set(old_client_settings)

2292

- set(client_settings)):

2293

del clients_data[client_name]

2294

for client_name in (set(client_settings)

2295

- set(old_client_settings)):

2296

clients_data[client_name] = client_settings[client_name]

2297

2298

# Create clients all clients

2299

for client_name, client in clients_data.iteritems():

2300

tcp_server.clients[client_name] = client_class(

2301

name = client_name, settings = client)

2302

2211

2303

if not tcp_server.clients:

2212

2304

logger.warning("No clients defined")

2213

2305

2224

2316

# "pidfile" was never created

2225

2317

pass

2226

2318

del pidfilename

2227

2228

2319

signal.signal(signal.SIGINT, signal.SIG_IGN)

2229

2320

2230

2321

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2295

2386

multiprocessing.active_children()

2296

2387

if not (tcp_server.clients or client_settings):

2297

2388

return

2298

2299

# Store client before exiting. Secrets are encrypted with key based

2300

# on what config file has. If config file is removed/edited, old

2301

# secret will thus be unrecovable.

2302

clients = []

2303

for client in tcp_server.clients.itervalues():

2304

client.encrypt_secret(client_settings[client.name]["secret"])

2305

2306

client_dict = {}

2307

2308

# A list of attributes that will not be stored when shuting down.

2309

exclude = set(("bus", "changedstate", "secret"))

2310

for name, typ in inspect.getmembers(dbus.service.Object):

2311

exclude.add(name)

2312

2313

client_dict["encrypted_secret"] = client.encrypted_secret

2314

for attr in client.client_structure:

2315

if attr not in exclude:

2316

client_dict[attr] = getattr(client, attr)

2317

2318

clients.append(client_dict)

2319

del client_settings[client.name]["secret"]

2320

2389

2390

# Store client before exiting. Secrets are encrypted with key

2391

# based on what config file has. If config file is

2392

# removed/edited, old secret will thus be unrecovable.

2393

clients = {}

2394

with PGPEngine() as pgp:

2395

for client in tcp_server.clients.itervalues():

2396

key = client_settings[client.name]["secret"]

2397

client.encrypted_secret = pgp.encrypt(client.secret,

2398

key)

2399

client_dict = {}

2400

2401

# A list of attributes that can not be pickled

2402

# + secret.

2403

exclude = set(("bus", "changedstate", "secret",

2404

"checker"))

2405

for name, typ in (inspect.getmembers

2406

(dbus.service.Object)):

2407

exclude.add(name)

2408

2409

client_dict["encrypted_secret"] = (client

2410

.encrypted_secret)

2411

for attr in client.client_structure:

2412

if attr not in exclude:

2413

client_dict[attr] = getattr(client, attr)

2414

2415

clients[client.name] = client_dict

2416

del client_settings[client.name]["secret"]

2417

2321

2418

try:

2322

with os.fdopen(os.open(stored_state_path, os.O_CREAT|os.O_WRONLY|os.O_TRUNC, 0600), "wb") as stored_state:

2419

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2420

prefix="clients-",

2421

dir=os.path.dirname

2422

(stored_state_path))

2423

with os.fdopen(tempfd, "wb") as stored_state:

2323

2424

pickle.dump((clients, client_settings), stored_state)

2324

except IOError as e:

2325

logger.warning("Could not save persistant state: {0}".format(e))

2326

if e.errno != errno.ENOENT:

2327

raise

2328

2425

os.rename(tempname, stored_state_path)

2426

except (IOError, OSError) as e:

2427

logger.warning("Could not save persistent state: {0}"

2428

.format(e))

2429

if not debug:

2430

try:

2431

os.remove(tempname)

2432

except NameError:

2433

pass

2434

if e.errno not in set((errno.ENOENT, errno.EACCES,

2435

errno.EEXIST)):

2436

raise e

2437

2329

2438

# Delete all clients, and settings from config

2330

2439

while tcp_server.clients:

2331

2440

name, client = tcp_server.clients.popitem()

2349

2458

# Need to initiate checking of clients

2350

2459

if client.enabled:

2351

2460

client.init_checker()

2352

2353

2461

2354

2462

tcp_server.enable()

2355

2463

tcp_server.server_activate()

2395

2503

# Must run before the D-Bus bus name gets deregistered

2396

2504

cleanup()

2397

2505

2398

2399

2506

if __name__ == '__main__':

2400

2507

main()