To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 525
- compare with another revision
- download diff
- download tarball
- view history from revision 525
- Committer: Björn Påhlsson
- Date: 2011-12-21 00:33:12 UTC
- mfrom: (505.2.13 mandos-client-network-hooks)
- Revision ID: belorn@recompile.se-20111221003312-jwn6d76u2c2lejoz
working new feature: network-hooks - Enables user-scripts to take up
interfaces during bootup
interfaces during bootup
- files added:
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
63
63
import cPickle as pickle
64
64
import multiprocessing
65
65
import types
66
import binascii
67
import tempfile
66
68
67
69
import dbus
68
70
import dbus.service
73
75
import ctypes.util
74
76
import xml.dom.minidom
75
77
import inspect
78
import GnuPGInterface
76
79
77
80
try:
78
81
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
82
85
except ImportError:
83
86
SO_BINDTODEVICE = None
84
87
85
86
88
version = "1.4.1"
89
stored_state_file = "clients.pickle"
87
90
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
91
logger = logging.getLogger()
90
92
syslogger = (logging.handlers.SysLogHandler
91
93
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
94
address = str("/dev/log")))
93
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
96
logger.addHandler(syslogger)
97
98
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
102
logger.addHandler(console)
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
console = logging.StreamHandler()
122
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
123
' [%(process)d]:'
124
' %(levelname)s:'
125
' %(message)s'))
126
logger.addHandler(console)
127
logger.setLevel(level)
128
129
130
class PGPError(Exception):
131
"""Exception if encryption/decryption fails"""
132
pass
133
134
135
class PGPEngine(object):
136
"""A simple class for OpenPGP symmetric encryption & decryption"""
137
def __init__(self):
138
self.gnupg = GnuPGInterface.GnuPG()
139
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
140
self.gnupg = GnuPGInterface.GnuPG()
141
self.gnupg.options.meta_interactive = False
142
self.gnupg.options.homedir = self.tempdir
143
self.gnupg.options.extra_args.extend(['--force-mdc',
144
'--quiet'])
145
146
def __enter__(self):
147
return self
148
149
def __exit__ (self, exc_type, exc_value, traceback):
150
self._cleanup()
151
return False
152
153
def __del__(self):
154
self._cleanup()
155
156
def _cleanup(self):
157
if self.tempdir is not None:
158
# Delete contents of tempdir
159
for root, dirs, files in os.walk(self.tempdir,
160
topdown = False):
161
for filename in files:
162
os.remove(os.path.join(root, filename))
163
for dirname in dirs:
164
os.rmdir(os.path.join(root, dirname))
165
# Remove tempdir
166
os.rmdir(self.tempdir)
167
self.tempdir = None
168
169
def password_encode(self, password):
170
# Passphrase can not be empty and can not contain newlines or
171
# NUL bytes. So we prefix it and hex encode it.
172
return b"mandos" + binascii.hexlify(password)
173
174
def encrypt(self, data, password):
175
self.gnupg.passphrase = self.password_encode(password)
176
with open(os.devnull) as devnull:
177
try:
178
proc = self.gnupg.run(['--symmetric'],
179
create_fhs=['stdin', 'stdout'],
180
attach_fhs={'stderr': devnull})
181
with contextlib.closing(proc.handles['stdin']) as f:
182
f.write(data)
183
with contextlib.closing(proc.handles['stdout']) as f:
184
ciphertext = f.read()
185
proc.wait()
186
except IOError as e:
187
raise PGPError(e)
188
self.gnupg.passphrase = None
189
return ciphertext
190
191
def decrypt(self, data, password):
192
self.gnupg.passphrase = self.password_encode(password)
193
with open(os.devnull) as devnull:
194
try:
195
proc = self.gnupg.run(['--decrypt'],
196
create_fhs=['stdin', 'stdout'],
197
attach_fhs={'stderr': devnull})
198
with contextlib.closing(proc.handles['stdin'] ) as f:
199
f.write(data)
200
with contextlib.closing(proc.handles['stdout']) as f:
201
decrypted_plaintext = f.read()
202
proc.wait()
203
except IOError as e:
204
raise PGPError(e)
205
self.gnupg.passphrase = None
206
return decrypted_plaintext
207
208
103
209
104
210
class AvahiError(Exception):
105
211
def __init__(self, value, *args, **kwargs):
164
270
.GetAlternativeServiceName(self.name))
165
271
logger.info("Changing Zeroconf service name to %r ...",
166
272
self.name)
167
syslogger.setFormatter(logging.Formatter
168
('Mandos (%s) [%%(process)d]:'
169
' %%(levelname)s: %%(message)s'
170
% self.name))
171
273
self.remove()
172
274
try:
173
275
self.add()
193
295
avahi.DBUS_INTERFACE_ENTRY_GROUP)
194
296
self.entry_group_state_changed_match = (
195
297
self.group.connect_to_signal(
196
'StateChanged', self .entry_group_state_changed))
298
'StateChanged', self.entry_group_state_changed))
197
299
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
198
300
self.name, self.type)
199
301
self.group.AddService(
225
327
try:
226
328
self.group.Free()
227
329
except (dbus.exceptions.UnknownMethodException,
228
dbus.exceptions.DBusException) as e:
330
dbus.exceptions.DBusException):
229
331
pass
230
332
self.group = None
231
333
self.remove()
265
367
self.server_state_changed)
266
368
self.server_state_changed(self.server.GetState())
267
369
370
class AvahiServiceToSyslog(AvahiService):
371
def rename(self):
372
"""Add the new name to the syslog messages"""
373
ret = AvahiService.rename(self)
374
syslogger.setFormatter(logging.Formatter
375
('Mandos (%s) [%%(process)d]:'
376
' %%(levelname)s: %%(message)s'
377
% self.name))
378
return ret
268
379
269
def _timedelta_to_milliseconds(td):
380
def timedelta_to_milliseconds(td):
270
381
"Convert a datetime.timedelta() to milliseconds"
271
382
return ((td.days * 24 * 60 * 60 * 1000)
272
383
+ (td.seconds * 1000)
276
387
"""A representation of a client host served by this server.
277
388
278
389
Attributes:
279
_approved: bool(); 'None' if not yet approved/disapproved
390
approved: bool(); 'None' if not yet approved/disapproved
280
391
approval_delay: datetime.timedelta(); Time to wait for approval
281
392
approval_duration: datetime.timedelta(); Duration of one approval
282
393
checker: subprocess.Popen(); a running checker process used
289
400
instance %(name)s can be used in the command.
290
401
checker_initiator_tag: a gobject event source tag, or None
291
402
created: datetime.datetime(); (UTC) object creation
403
client_structure: Object describing what attributes a client has
404
and is used for storing the client at exit
292
405
current_checker_command: string; current running checker_command
293
disable_hook: If set, called by disable() as disable_hook(self)
294
406
disable_initiator_tag: a gobject event source tag, or None
295
407
enabled: bool()
296
408
fingerprint: string (40 or 32 hexadecimal digits); used to
299
411
interval: datetime.timedelta(); How often to start a new checker
300
412
last_approval_request: datetime.datetime(); (UTC) or None
301
413
last_checked_ok: datetime.datetime(); (UTC) or None
302
last_enabled: datetime.datetime(); (UTC)
414
last_checker_status: integer between 0 and 255 reflecting exit
415
status of last checker. -1 reflects crashed
416
checker, or None.
417
last_enabled: datetime.datetime(); (UTC) or None
303
418
name: string; from the config file, used in log messages and
304
419
D-Bus identifiers
305
420
secret: bytestring; sent verbatim (over TLS) to client
315
430
"created", "enabled", "fingerprint",
316
431
"host", "interval", "last_checked_ok",
317
432
"last_enabled", "name", "timeout")
433
client_defaults = { "timeout": "5m",
434
"extended_timeout": "15m",
435
"interval": "2m",
436
"checker": "fping -q -- %%(host)s",
437
"host": "",
438
"approval_delay": "0s",
439
"approval_duration": "1s",
440
"approved_by_default": "True",
441
"enabled": "True",
442
}
318
443
319
444
def timeout_milliseconds(self):
320
445
"Return the 'timeout' attribute in milliseconds"
321
return _timedelta_to_milliseconds(self.timeout)
446
return timedelta_to_milliseconds(self.timeout)
322
447
323
448
def extended_timeout_milliseconds(self):
324
449
"Return the 'extended_timeout' attribute in milliseconds"
325
return _timedelta_to_milliseconds(self.extended_timeout)
450
return timedelta_to_milliseconds(self.extended_timeout)
326
451
327
452
def interval_milliseconds(self):
328
453
"Return the 'interval' attribute in milliseconds"
329
return _timedelta_to_milliseconds(self.interval)
454
return timedelta_to_milliseconds(self.interval)
330
455
331
456
def approval_delay_milliseconds(self):
332
return _timedelta_to_milliseconds(self.approval_delay)
333
334
def __init__(self, name = None, disable_hook=None, config=None):
457
return timedelta_to_milliseconds(self.approval_delay)
458
459
@staticmethod
460
def config_parser(config):
461
""" Construct a new dict of client settings of this form:
462
{ client_name: {setting_name: value, ...}, ...}
463
with exceptions for any special settings as defined above"""
464
settings = {}
465
for client_name in config.sections():
466
section = dict(config.items(client_name))
467
client = settings[client_name] = {}
468
469
client["host"] = section["host"]
470
# Reformat values from string types to Python types
471
client["approved_by_default"] = config.getboolean(
472
client_name, "approved_by_default")
473
client["enabled"] = config.getboolean(client_name, "enabled")
474
475
client["fingerprint"] = (section["fingerprint"].upper()
476
.replace(" ", ""))
477
if "secret" in section:
478
client["secret"] = section["secret"].decode("base64")
479
elif "secfile" in section:
480
with open(os.path.expanduser(os.path.expandvars
481
(section["secfile"])),
482
"rb") as secfile:
483
client["secret"] = secfile.read()
484
else:
485
raise TypeError("No secret or secfile for section %s"
486
% section)
487
client["timeout"] = string_to_delta(section["timeout"])
488
client["extended_timeout"] = string_to_delta(
489
section["extended_timeout"])
490
client["interval"] = string_to_delta(section["interval"])
491
client["approval_delay"] = string_to_delta(
492
section["approval_delay"])
493
client["approval_duration"] = string_to_delta(
494
section["approval_duration"])
495
client["checker_command"] = section["checker"]
496
client["last_approval_request"] = None
497
client["last_checked_ok"] = None
498
client["last_checker_status"] = None
499
if client["enabled"]:
500
client["last_enabled"] = datetime.datetime.utcnow()
501
client["expires"] = (datetime.datetime.utcnow()
502
+ client["timeout"])
503
else:
504
client["last_enabled"] = None
505
client["expires"] = None
506
507
return settings
508
509
510
def __init__(self, settings, name = None):
335
511
"""Note: the 'checker' key in 'config' sets the
336
512
'checker_command' attribute and *not* the 'checker'
337
513
attribute."""
338
514
self.name = name
339
if config is None:
340
config = {}
515
# adding all client settings
516
for setting, value in settings.iteritems():
517
setattr(self, setting, value)
518
341
519
logger.debug("Creating client %r", self.name)
342
520
# Uppercase and remove spaces from fingerprint for later
343
521
# comparison purposes with return value from the fingerprint()
344
522
# function
345
self.fingerprint = (config["fingerprint"].upper()
346
.replace(" ", ""))
347
523
logger.debug(" Fingerprint: %s", self.fingerprint)
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
351
with open(os.path.expanduser(os.path.expandvars
352
(config["secfile"])),
353
"rb") as secfile:
354
self.secret = secfile.read()
355
else:
356
raise TypeError("No secret or secfile for client %s"
357
% self.name)
358
self.host = config.get("host", "")
359
self.created = datetime.datetime.utcnow()
360
self.enabled = False
361
self.last_approval_request = None
362
self.last_enabled = None
363
self.last_checked_ok = None
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
368
self.disable_hook = disable_hook
524
self.created = settings.get("created", datetime.datetime.utcnow())
525
526
# attributes specific for this server instance
369
527
self.checker = None
370
528
self.checker_initiator_tag = None
371
529
self.disable_initiator_tag = None
372
self.expires = None
373
530
self.checker_callback_tag = None
374
self.checker_command = config["checker"]
375
531
self.current_checker_command = None
376
self.last_connect = None
377
self._approved = None
378
self.approved_by_default = config.get("approved_by_default",
379
True)
532
self.approved = None
380
533
self.approvals_pending = 0
381
self.approval_delay = string_to_delta(
382
config["approval_delay"])
383
self.approval_duration = string_to_delta(
384
config["approval_duration"])
385
534
self.changedstate = (multiprocessing_manager
386
535
.Condition(multiprocessing_manager
387
536
.Lock()))
537
self.client_structure = [attr for attr in
538
self.__dict__.iterkeys()
539
if not attr.startswith("_")]
540
self.client_structure.append("client_structure")
541
542
for name, t in inspect.getmembers(type(self),
543
lambda obj:
544
isinstance(obj,
545
property)):
546
if not name.startswith("_"):
547
self.client_structure.append(name)
388
548
549
# Send notice to process children that client state has changed
389
550
def send_changedstate(self):
390
self.changedstate.acquire()
391
self.changedstate.notify_all()
392
self.changedstate.release()
551
with self.changedstate:
552
self.changedstate.notify_all()
393
553
394
554
def enable(self):
395
555
"""Start this client's checker and timeout hooks"""
397
557
# Already enabled
398
558
return
399
559
self.send_changedstate()
400
# Schedule a new checker to be started an 'interval' from now,
401
# and every interval from then on.
402
self.checker_initiator_tag = (gobject.timeout_add
403
(self.interval_milliseconds(),
404
self.start_checker))
405
# Schedule a disable() when 'timeout' has passed
406
560
self.expires = datetime.datetime.utcnow() + self.timeout
407
self.disable_initiator_tag = (gobject.timeout_add
408
(self.timeout_milliseconds(),
409
self.disable))
410
561
self.enabled = True
411
562
self.last_enabled = datetime.datetime.utcnow()
412
# Also start a new checker *right now*.
413
self.start_checker()
563
self.init_checker()
414
564
415
565
def disable(self, quiet=True):
416
566
"""Disable this client."""
428
578
gobject.source_remove(self.checker_initiator_tag)
429
579
self.checker_initiator_tag = None
430
580
self.stop_checker()
431
if self.disable_hook:
432
self.disable_hook(self)
433
581
self.enabled = False
434
582
# Do not run this again if called by a gobject.timeout_add
435
583
return False
436
584
437
585
def __del__(self):
438
self.disable_hook = None
439
586
self.disable()
440
587
588
def init_checker(self):
589
# Schedule a new checker to be started an 'interval' from now,
590
# and every interval from then on.
591
self.checker_initiator_tag = (gobject.timeout_add
592
(self.interval_milliseconds(),
593
self.start_checker))
594
# Schedule a disable() when 'timeout' has passed
595
self.disable_initiator_tag = (gobject.timeout_add
596
(self.timeout_milliseconds(),
597
self.disable))
598
# Also start a new checker *right now*.
599
self.start_checker()
600
441
601
def checker_callback(self, pid, condition, command):
442
602
"""The checker has completed, so take appropriate actions."""
443
603
self.checker_callback_tag = None
444
604
self.checker = None
445
605
if os.WIFEXITED(condition):
446
exitstatus = os.WEXITSTATUS(condition)
447
if exitstatus == 0:
606
self.last_checker_status = os.WEXITSTATUS(condition)
607
if self.last_checker_status == 0:
448
608
logger.info("Checker for %(name)s succeeded",
449
609
vars(self))
450
610
self.checked_ok()
452
612
logger.info("Checker for %(name)s failed",
453
613
vars(self))
454
614
else:
615
self.last_checker_status = -1
455
616
logger.warning("Checker for %(name)s crashed?",
456
617
vars(self))
457
618
468
629
gobject.source_remove(self.disable_initiator_tag)
469
630
if getattr(self, "enabled", False):
470
631
self.disable_initiator_tag = (gobject.timeout_add
471
(_timedelta_to_milliseconds
632
(timedelta_to_milliseconds
472
633
(timeout), self.disable))
473
634
self.expires = datetime.datetime.utcnow() + timeout
474
635
691
852
692
853
Note: Will not include properties with access="write".
693
854
"""
694
all = {}
855
properties = {}
695
856
for name, prop in self._get_all_dbus_properties():
696
857
if (interface_name
697
858
and interface_name != prop._dbus_interface):
702
863
continue
703
864
value = prop()
704
865
if not hasattr(value, "variant_level"):
705
all[name] = value
866
properties[name] = value
706
867
continue
707
all[name] = type(value)(value, variant_level=
708
value.variant_level+1)
709
return dbus.Dictionary(all, signature="sv")
868
properties[name] = type(value)(value, variant_level=
869
value.variant_level+1)
870
return dbus.Dictionary(properties, signature="sv")
710
871
711
872
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
712
873
out_signature="s",
763
924
return dbus.String(dt.isoformat(),
764
925
variant_level=variant_level)
765
926
927
766
928
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
767
929
.__metaclass__):
768
930
"""Applied to an empty subclass of a D-Bus object, this metaclass
860
1022
attribute.func_closure)))
861
1023
return type.__new__(mcs, name, bases, attr)
862
1024
1025
863
1026
class ClientDBus(Client, DBusObjectWithProperties):
864
1027
"""A Client class using D-Bus
865
1028
874
1037
# dbus.service.Object doesn't use super(), so we can't either.
875
1038
876
1039
def __init__(self, bus = None, *args, **kwargs):
877
self._approvals_pending = 0
878
1040
self.bus = bus
879
1041
Client.__init__(self, *args, **kwargs)
1042
self._approvals_pending = 0
1043
1044
self._approvals_pending = 0
880
1045
# Only now, when this client is initialized, can it show up on
881
1046
# the D-Bus
882
1047
client_object_name = unicode(self.name).translate(
892
1057
variant_level=1):
893
1058
""" Modify a variable so that it's a property which announces
894
1059
its changes to DBus.
895
1060
896
1061
transform_fun: Function that takes a value and a variant_level
897
1062
and transforms it to a D-Bus type.
898
1063
dbus_name: D-Bus name of the variable
932
1097
datetime_to_dbus, "LastApprovalRequest")
933
1098
approved_by_default = notifychangeproperty(dbus.Boolean,
934
1099
"ApprovedByDefault")
935
approval_delay = notifychangeproperty(dbus.UInt16,
1100
approval_delay = notifychangeproperty(dbus.UInt64,
936
1101
"ApprovalDelay",
937
1102
type_func =
938
_timedelta_to_milliseconds)
1103
timedelta_to_milliseconds)
939
1104
approval_duration = notifychangeproperty(
940
dbus.UInt16, "ApprovalDuration",
941
type_func = _timedelta_to_milliseconds)
1105
dbus.UInt64, "ApprovalDuration",
1106
type_func = timedelta_to_milliseconds)
942
1107
host = notifychangeproperty(dbus.String, "Host")
943
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1108
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
944
1109
type_func =
945
_timedelta_to_milliseconds)
1110
timedelta_to_milliseconds)
946
1111
extended_timeout = notifychangeproperty(
947
dbus.UInt16, "ExtendedTimeout",
948
type_func = _timedelta_to_milliseconds)
949
interval = notifychangeproperty(dbus.UInt16,
1112
dbus.UInt64, "ExtendedTimeout",
1113
type_func = timedelta_to_milliseconds)
1114
interval = notifychangeproperty(dbus.UInt64,
950
1115
"Interval",
951
1116
type_func =
952
_timedelta_to_milliseconds)
1117
timedelta_to_milliseconds)
953
1118
checker_command = notifychangeproperty(dbus.String, "Checker")
954
1119
955
1120
del notifychangeproperty
997
1162
return r
998
1163
999
1164
def _reset_approved(self):
1000
self._approved = None
1165
self.approved = None
1001
1166
return False
1002
1167
1003
1168
def approve(self, value=True):
1004
1169
self.send_changedstate()
1005
self._approved = value
1006
gobject.timeout_add(_timedelta_to_milliseconds
1170
self.approved = value
1171
gobject.timeout_add(timedelta_to_milliseconds
1007
1172
(self.approval_duration),
1008
1173
self._reset_approved)
1009
1174
1052
1217
"D-Bus signal"
1053
1218
return self.need_approval()
1054
1219
1220
# NeRwequest - signal
1221
@dbus.service.signal(_interface, signature="s")
1222
def NewRequest(self, ip):
1223
"""D-Bus signal
1224
Is sent after a client request a password.
1225
"""
1226
pass
1227
1055
1228
## Methods
1056
1229
1057
1230
# Approve - method
1115
1288
access="readwrite")
1116
1289
def ApprovalDuration_dbus_property(self, value=None):
1117
1290
if value is None: # get
1118
return dbus.UInt64(_timedelta_to_milliseconds(
1291
return dbus.UInt64(timedelta_to_milliseconds(
1119
1292
self.approval_duration))
1120
1293
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1121
1294
1135
1308
def Host_dbus_property(self, value=None):
1136
1309
if value is None: # get
1137
1310
return dbus.String(self.host)
1138
self.host = value
1311
self.host = unicode(value)
1139
1312
1140
1313
# Created - property
1141
1314
@dbus_service_property(_interface, signature="s", access="read")
1142
1315
def Created_dbus_property(self):
1143
return dbus.String(datetime_to_dbus(self.created))
1316
return datetime_to_dbus(self.created)
1144
1317
1145
1318
# LastEnabled - property
1146
1319
@dbus_service_property(_interface, signature="s", access="read")
1190
1363
gobject.source_remove(self.disable_initiator_tag)
1191
1364
self.disable_initiator_tag = None
1192
1365
self.expires = None
1193
time_to_die = _timedelta_to_milliseconds((self
1194
.last_checked_ok
1195
+ self.timeout)
1196
- datetime.datetime
1197
.utcnow())
1366
time_to_die = timedelta_to_milliseconds((self
1367
.last_checked_ok
1368
+ self.timeout)
1369
- datetime.datetime
1370
.utcnow())
1198
1371
if time_to_die <= 0:
1199
1372
# The timeout has passed
1200
1373
self.disable()
1222
1395
self.interval = datetime.timedelta(0, 0, 0, value)
1223
1396
if getattr(self, "checker_initiator_tag", None) is None:
1224
1397
return
1225
# Reschedule checker run
1226
gobject.source_remove(self.checker_initiator_tag)
1227
self.checker_initiator_tag = (gobject.timeout_add
1228
(value, self.start_checker))
1229
self.start_checker() # Start one now, too
1398
if self.enabled:
1399
# Reschedule checker run
1400
gobject.source_remove(self.checker_initiator_tag)
1401
self.checker_initiator_tag = (gobject.timeout_add
1402
(value, self.start_checker))
1403
self.start_checker() # Start one now, too
1230
1404
1231
1405
# Checker - property
1232
1406
@dbus_service_property(_interface, signature="s",
1234
1408
def Checker_dbus_property(self, value=None):
1235
1409
if value is None: # get
1236
1410
return dbus.String(self.checker_command)
1237
self.checker_command = value
1411
self.checker_command = unicode(value)
1238
1412
1239
1413
# CheckerRunning - property
1240
1414
@dbus_service_property(_interface, signature="b",
1269
1443
raise KeyError()
1270
1444
1271
1445
def __getattribute__(self, name):
1272
if(name == '_pipe'):
1446
if name == '_pipe':
1273
1447
return super(ProxyClient, self).__getattribute__(name)
1274
1448
self._pipe.send(('getattr', name))
1275
1449
data = self._pipe.recv()
1282
1456
return func
1283
1457
1284
1458
def __setattr__(self, name, value):
1285
if(name == '_pipe'):
1459
if name == '_pipe':
1286
1460
return super(ProxyClient, self).__setattr__(name, value)
1287
1461
self._pipe.send(('setattr', name, value))
1288
1462
1463
1289
1464
class ClientDBusTransitional(ClientDBus):
1290
1465
__metaclass__ = AlternateDBusNamesMetaclass
1291
1466
1467
1292
1468
class ClientHandler(socketserver.BaseRequestHandler, object):
1293
1469
"""A class to handle client connections.
1294
1470
1362
1538
except KeyError:
1363
1539
return
1364
1540
1541
if self.server.use_dbus:
1542
# Emit D-Bus signal
1543
client.NewRequest(str(self.client_address))
1544
1365
1545
if client.approval_delay:
1366
1546
delay = client.approval_delay
1367
1547
client.approvals_pending += 1
1376
1556
client.Rejected("Disabled")
1377
1557
return
1378
1558
1379
if client._approved or not client.approval_delay:
1559
if client.approved or not client.approval_delay:
1380
1560
#We are approved or approval is disabled
1381
1561
break
1382
elif client._approved is None:
1562
elif client.approved is None:
1383
1563
logger.info("Client %s needs approval",
1384
1564
client.name)
1385
1565
if self.server.use_dbus:
1399
1579
time = datetime.datetime.now()
1400
1580
client.changedstate.acquire()
1401
1581
(client.changedstate.wait
1402
(float(client._timedelta_to_milliseconds(delay)
1582
(float(client.timedelta_to_milliseconds(delay)
1403
1583
/ 1000)))
1404
1584
client.changedstate.release()
1405
1585
time2 = datetime.datetime.now()
1504
1684
# Convert the buffer to a Python bytestring
1505
1685
fpr = ctypes.string_at(buf, buf_len.value)
1506
1686
# Convert the bytestring to hexadecimal notation
1507
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1687
hex_fpr = binascii.hexlify(fpr).upper()
1508
1688
return hex_fpr
1509
1689
1510
1690
1513
1693
def sub_process_main(self, request, address):
1514
1694
try:
1515
1695
self.finish_request(request, address)
1516
except:
1696
except Exception:
1517
1697
self.handle_error(request, address)
1518
1698
self.close_request(request)
1519
1699
1624
1804
self.enabled = False
1625
1805
self.clients = clients
1626
1806
if self.clients is None:
1627
self.clients = set()
1807
self.clients = {}
1628
1808
self.use_dbus = use_dbus
1629
1809
self.gnutls_priority = gnutls_priority
1630
1810
IPv6_TCPServer.__init__(self, server_address,
1677
1857
fpr = request[1]
1678
1858
address = request[2]
1679
1859
1680
for c in self.clients:
1860
for c in self.clients.itervalues():
1681
1861
if c.fingerprint == fpr:
1682
1862
client = c
1683
1863
break
1767
1947
return timevalue
1768
1948
1769
1949
1770
def if_nametoindex(interface):
1771
"""Call the C function if_nametoindex(), or equivalent
1772
1773
Note: This function cannot accept a unicode string."""
1774
global if_nametoindex
1775
try:
1776
if_nametoindex = (ctypes.cdll.LoadLibrary
1777
(ctypes.util.find_library("c"))
1778
.if_nametoindex)
1779
except (OSError, AttributeError):
1780
logger.warning("Doing if_nametoindex the hard way")
1781
def if_nametoindex(interface):
1782
"Get an interface index the hard way, i.e. using fcntl()"
1783
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1784
with contextlib.closing(socket.socket()) as s:
1785
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1786
struct.pack(str("16s16x"),
1787
interface))
1788
interface_index = struct.unpack(str("I"),
1789
ifreq[16:20])[0]
1790
return interface_index
1791
return if_nametoindex(interface)
1792
1793
1794
1950
def daemon(nochdir = False, noclose = False):
1795
1951
"""See daemon(3). Standard BSD Unix function.
1796
1952
1851
2007
" system bus interface")
1852
2008
parser.add_argument("--no-ipv6", action="store_false",
1853
2009
dest="use_ipv6", help="Do not use IPv6")
2010
parser.add_argument("--no-restore", action="store_false",
2011
dest="restore", help="Do not restore stored"
2012
" state")
2013
parser.add_argument("--statedir", metavar="DIR",
2014
help="Directory to save/restore state in")
2015
1854
2016
options = parser.parse_args()
1855
2017
1856
2018
if options.check:
1869
2031
"use_dbus": "True",
1870
2032
"use_ipv6": "True",
1871
2033
"debuglevel": "",
2034
"restore": "True",
2035
"statedir": "/var/lib/mandos"
1872
2036
}
1873
2037
1874
2038
# Parse config file for server-global settings
1891
2055
# options, if set.
1892
2056
for option in ("interface", "address", "port", "debug",
1893
2057
"priority", "servicename", "configdir",
1894
"use_dbus", "use_ipv6", "debuglevel"):
2058
"use_dbus", "use_ipv6", "debuglevel", "restore",
2059
"statedir"):
1895
2060
value = getattr(options, option)
1896
2061
if value is not None:
1897
2062
server_settings[option] = value
1909
2074
debuglevel = server_settings["debuglevel"]
1910
2075
use_dbus = server_settings["use_dbus"]
1911
2076
use_ipv6 = server_settings["use_ipv6"]
2077
stored_state_path = os.path.join(server_settings["statedir"],
2078
stored_state_file)
2079
2080
if debug:
2081
initlogger(logging.DEBUG)
2082
else:
2083
if not debuglevel:
2084
initlogger()
2085
else:
2086
level = getattr(logging, debuglevel.upper())
2087
initlogger(level)
1912
2088
1913
2089
if server_settings["servicename"] != "Mandos":
1914
2090
syslogger.setFormatter(logging.Formatter
1917
2093
% server_settings["servicename"]))
1918
2094
1919
2095
# Parse config file with clients
1920
client_defaults = { "timeout": "5m",
1921
"extended_timeout": "15m",
1922
"interval": "2m",
1923
"checker": "fping -q -- %%(host)s",
1924
"host": "",
1925
"approval_delay": "0s",
1926
"approval_duration": "1s",
1927
}
1928
client_config = configparser.SafeConfigParser(client_defaults)
2096
client_config = configparser.SafeConfigParser(Client.client_defaults)
1929
2097
client_config.read(os.path.join(server_settings["configdir"],
1930
2098
"clients.conf"))
1931
2099
1969
2137
if error[0] != errno.EPERM:
1970
2138
raise error
1971
2139
1972
if not debug and not debuglevel:
1973
syslogger.setLevel(logging.WARNING)
1974
console.setLevel(logging.WARNING)
1975
if debuglevel:
1976
level = getattr(logging, debuglevel.upper())
1977
syslogger.setLevel(level)
1978
console.setLevel(level)
1979
1980
2140
if debug:
1981
2141
# Enable all possible GnuTLS debugging
1982
2142
2024
2184
server_settings["use_dbus"] = False
2025
2185
tcp_server.use_dbus = False
2026
2186
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2027
service = AvahiService(name = server_settings["servicename"],
2028
servicetype = "_mandos._tcp",
2029
protocol = protocol, bus = bus)
2187
service = AvahiServiceToSyslog(name =
2188
server_settings["servicename"],
2189
servicetype = "_mandos._tcp",
2190
protocol = protocol, bus = bus)
2030
2191
if server_settings["interface"]:
2031
2192
service.interface = (if_nametoindex
2032
2193
(str(server_settings["interface"])))
2038
2199
if use_dbus:
2039
2200
client_class = functools.partial(ClientDBusTransitional,
2040
2201
bus = bus)
2041
def client_config_items(config, section):
2042
special_settings = {
2043
"approved_by_default":
2044
lambda: config.getboolean(section,
2045
"approved_by_default"),
2046
}
2047
for name, value in config.items(section):
2202
2203
client_settings = Client.config_parser(client_config)
2204
old_client_settings = {}
2205
clients_data = {}
2206
2207
# Get client data and settings from last running state.
2208
if server_settings["restore"]:
2209
try:
2210
with open(stored_state_path, "rb") as stored_state:
2211
clients_data, old_client_settings = (pickle.load
2212
(stored_state))
2213
os.remove(stored_state_path)
2214
except IOError as e:
2215
logger.warning("Could not load persistent state: {0}"
2216
.format(e))
2217
if e.errno != errno.ENOENT:
2218
raise
2219
2220
with PGPEngine() as pgp:
2221
for client_name, client in clients_data.iteritems():
2222
# Decide which value to use after restoring saved state.
2223
# We have three different values: Old config file,
2224
# new config file, and saved state.
2225
# New config value takes precedence if it differs from old
2226
# config value, otherwise use saved state.
2227
for name, value in client_settings[client_name].items():
2228
try:
2229
# For each value in new config, check if it
2230
# differs from the old config value (Except for
2231
# the "secret" attribute)
2232
if (name != "secret" and
2233
value != old_client_settings[client_name]
2234
[name]):
2235
client[name] = value
2236
except KeyError:
2237
pass
2238
2239
# Clients who has passed its expire date can still be
2240
# enabled if its last checker was successful. Clients
2241
# whose checker failed before we stored its state is
2242
# assumed to have failed all checkers during downtime.
2243
if client["enabled"]:
2244
if datetime.datetime.utcnow() >= client["expires"]:
2245
if not client["last_checked_ok"]:
2246
logger.warning(
2247
"disabling client {0} - Client never "
2248
"performed a successfull checker"
2249
.format(client["name"]))
2250
client["enabled"] = False
2251
elif client["last_checker_status"] != 0:
2252
logger.warning(
2253
"disabling client {0} - Client "
2254
"last checker failed with error code {1}"
2255
.format(client["name"],
2256
client["last_checker_status"]))
2257
client["enabled"] = False
2258
else:
2259
client["expires"] = (datetime.datetime
2260
.utcnow()
2261
+ client["timeout"])
2262
2048
2263
try:
2049
yield (name, special_settings[name]())
2050
except KeyError:
2051
yield (name, value)
2052
2053
tcp_server.clients.update(set(
2054
client_class(name = section,
2055
config= dict(client_config_items(
2056
client_config, section)))
2057
for section in client_config.sections()))
2264
client["secret"] = (
2265
pgp.decrypt(client["encrypted_secret"],
2266
client_settings[client_name]
2267
["secret"]))
2268
except PGPError:
2269
# If decryption fails, we use secret from new settings
2270
logger.debug("Failed to decrypt {0} old secret"
2271
.format(client_name))
2272
client["secret"] = (
2273
client_settings[client_name]["secret"])
2274
2275
2276
# Add/remove clients based on new changes made to config
2277
for client_name in set(old_client_settings) - set(client_settings):
2278
del clients_data[client_name]
2279
for client_name in set(client_settings) - set(old_client_settings):
2280
clients_data[client_name] = client_settings[client_name]
2281
2282
# Create clients all clients
2283
for client_name, client in clients_data.iteritems():
2284
tcp_server.clients[client_name] = client_class(
2285
name = client_name, settings = client)
2286
2058
2287
if not tcp_server.clients:
2059
2288
logger.warning("No clients defined")
2060
2289
2071
2300
# "pidfile" was never created
2072
2301
pass
2073
2302
del pidfilename
2074
2075
2303
signal.signal(signal.SIGINT, signal.SIG_IGN)
2076
2304
2077
2305
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2103
2331
def GetAllClients(self):
2104
2332
"D-Bus method"
2105
2333
return dbus.Array(c.dbus_object_path
2106
for c in tcp_server.clients)
2334
for c in
2335
tcp_server.clients.itervalues())
2107
2336
2108
2337
@dbus.service.method(_interface,
2109
2338
out_signature="a{oa{sv}}")
2111
2340
"D-Bus method"
2112
2341
return dbus.Dictionary(
2113
2342
((c.dbus_object_path, c.GetAll(""))
2114
for c in tcp_server.clients),
2343
for c in tcp_server.clients.itervalues()),
2115
2344
signature="oa{sv}")
2116
2345
2117
2346
@dbus.service.method(_interface, in_signature="o")
2118
2347
def RemoveClient(self, object_path):
2119
2348
"D-Bus method"
2120
for c in tcp_server.clients:
2349
for c in tcp_server.clients.itervalues():
2121
2350
if c.dbus_object_path == object_path:
2122
tcp_server.clients.remove(c)
2351
del tcp_server.clients[c.name]
2123
2352
c.remove_from_connection()
2124
2353
# Don't signal anything except ClientRemoved
2125
2354
c.disable(quiet=True)
2139
2368
service.cleanup()
2140
2369
2141
2370
multiprocessing.active_children()
2371
if not (tcp_server.clients or client_settings):
2372
return
2373
2374
# Store client before exiting. Secrets are encrypted with key
2375
# based on what config file has. If config file is
2376
# removed/edited, old secret will thus be unrecovable.
2377
clients = {}
2378
with PGPEngine() as pgp:
2379
for client in tcp_server.clients.itervalues():
2380
key = client_settings[client.name]["secret"]
2381
client.encrypted_secret = pgp.encrypt(client.secret,
2382
key)
2383
client_dict = {}
2384
2385
# A list of attributes that can not be pickled
2386
# + secret.
2387
exclude = set(("bus", "changedstate", "secret",
2388
"checker"))
2389
for name, typ in (inspect.getmembers
2390
(dbus.service.Object)):
2391
exclude.add(name)
2392
2393
client_dict["encrypted_secret"] = (client
2394
.encrypted_secret)
2395
for attr in client.client_structure:
2396
if attr not in exclude:
2397
client_dict[attr] = getattr(client, attr)
2398
2399
clients[client.name] = client_dict
2400
del client_settings[client.name]["secret"]
2401
2402
try:
2403
with os.fdopen(os.open(stored_state_path,
2404
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2405
0600), "wb") as stored_state:
2406
pickle.dump((clients, client_settings), stored_state)
2407
except (IOError, OSError) as e:
2408
logger.warning("Could not save persistent state: {0}"
2409
.format(e))
2410
if e.errno not in (errno.ENOENT, errno.EACCES):
2411
raise
2412
2413
# Delete all clients, and settings from config
2142
2414
while tcp_server.clients:
2143
client = tcp_server.clients.pop()
2415
name, client = tcp_server.clients.popitem()
2144
2416
if use_dbus:
2145
2417
client.remove_from_connection()
2146
client.disable_hook = None
2147
2418
# Don't signal anything except ClientRemoved
2148
2419
client.disable(quiet=True)
2149
2420
if use_dbus:
2151
2422
mandos_dbus_service.ClientRemoved(client
2152
2423
.dbus_object_path,
2153
2424
client.name)
2425
client_settings.clear()
2154
2426
2155
2427
atexit.register(cleanup)
2156
2428
2157
for client in tcp_server.clients:
2429
for client in tcp_server.clients.itervalues():
2158
2430
if use_dbus:
2159
2431
# Emit D-Bus signal
2160
2432
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2161
client.enable()
2433
# Need to initiate checking of clients
2434
if client.enabled:
2435
client.init_checker()
2162
2436
2163
2437
tcp_server.enable()
2164
2438
tcp_server.server_activate()
2204
2478
# Must run before the D-Bus bus name gets deregistered
2205
2479
cleanup()
2206
2480
2207
2208
2481
if __name__ == '__main__':
2209
2482
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0