To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 102
- compare with another revision
- download diff
- download tarball
- view history from revision 102
- Committer: Teddy Hogeborn
- Date: 2008-08-24 23:33:02 UTC
- mfrom: (24.1.65 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080824233302-kfu4g2pkozg7xrmz
* plugin-runner.c (process): Set "completed" and "status" as volatile.
(handle_sigchld): Bug fix: reset proc to process_list every time.
(handle_sigchld): Bug fix: reset proc to process_list every time.
- files added:
- plugins.d/usplash
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugins.d/mandos-client.c => plugins.d/password-request.c
- plugins.d/mandos-client.xml => plugins.d/password-request.xml
- files modified:
- Makefile
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
# GNU General Public License for more details.
26
25
#
27
26
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
30
28
#
31
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
30
#
33
31
34
from __future__ import division, with_statement, absolute_import
32
from __future__ import division
35
33
36
34
import SocketServer
37
35
import socket
38
import optparse
36
import select
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
import pwd
59
from contextlib import closing
60
57
61
58
import dbus
62
import dbus.service
63
59
import gobject
64
60
import avahi
65
61
from dbus.mainloop.glib import DBusGMainLoop
66
62
import ctypes
67
import ctypes.util
68
63
69
version = "1.0.5"
64
version = "1.0"
70
65
71
66
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
67
syslogger = logging.handlers.SysLogHandler\
68
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
69
address = "/dev/log")
70
syslogger.setFormatter(logging.Formatter\
71
('Mandos: %(levelname)s: %(message)s'))
78
72
logger.addHandler(syslogger)
79
73
80
74
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
75
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
76
' %(message)s'))
83
77
logger.addHandler(console)
84
78
85
79
class AvahiError(Exception):
86
def __init__(self, value, *args, **kwargs):
80
def __init__(self, value):
87
81
self.value = value
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
82
def __str__(self):
83
return repr(self.value)
91
84
92
85
class AvahiServiceError(AvahiError):
93
86
pass
113
106
a sensible number of times
114
107
"""
115
108
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768):
109
type = None, port = None, TXT = None, domain = "",
110
host = "", max_renames = 32768):
118
111
self.interface = interface
119
112
self.name = name
120
self.type = servicetype
113
self.type = type
121
114
self.port = port
122
self.TXT = TXT if TXT is not None else []
115
if TXT is None:
116
self.TXT = []
117
else:
118
self.TXT = TXT
123
119
self.domain = domain
124
120
self.host = host
125
121
self.rename_count = 0
127
123
def rename(self):
128
124
"""Derived from the Avahi example code"""
129
125
if self.rename_count >= self.max_renames:
130
logger.critical(u"No suitable Zeroconf service name found"
131
u" after %i retries, exiting.",
132
self.rename_count)
133
raise AvahiServiceError(u"Too many renames")
126
logger.critical(u"No suitable service name found after %i"
127
u" retries, exiting.", rename_count)
128
raise AvahiServiceError("Too many renames")
134
129
self.name = server.GetAlternativeServiceName(self.name)
135
logger.info(u"Changing Zeroconf service name to %r ...",
136
str(self.name))
137
syslogger.setFormatter(logging.Formatter
130
logger.info(u"Changing name to %r ...", str(self.name))
131
syslogger.setFormatter(logging.Formatter\
138
132
('Mandos (%s): %%(levelname)s:'
139
' %%(message)s' % self.name))
133
' %%(message)s' % self.name))
140
134
self.remove()
141
135
self.add()
142
136
self.rename_count += 1
148
142
"""Derived from the Avahi example code"""
149
143
global group
150
144
if group is None:
151
group = dbus.Interface(bus.get_object
152
(avahi.DBUS_NAME,
145
group = dbus.Interface\
146
(bus.get_object(avahi.DBUS_NAME,
153
147
server.EntryGroupNew()),
154
avahi.DBUS_INTERFACE_ENTRY_GROUP)
148
avahi.DBUS_INTERFACE_ENTRY_GROUP)
155
149
group.connect_to_signal('StateChanged',
156
150
entry_group_state_changed)
157
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
151
logger.debug(u"Adding service '%s' of type '%s' ...",
158
152
service.name, service.type)
159
153
group.AddService(
160
154
self.interface, # interface
171
165
# End of Avahi example code
172
166
173
167
174
def _datetime_to_dbus(dt, variant_level=0):
175
"""Convert a UTC datetime.datetime() to a D-Bus type."""
176
return dbus.String(dt.isoformat(), variant_level=variant_level)
177
178
179
class Client(dbus.service.Object):
168
class Client(object):
180
169
"""A representation of a client host served by this server.
181
170
Attributes:
182
name: string; from the config file, used in log messages and
183
D-Bus identifiers
171
name: string; from the config file, used in log messages
184
172
fingerprint: string (40 or 32 hexadecimal digits); used to
185
173
uniquely identify the client
186
secret: bytestring; sent verbatim (over TLS) to client
187
host: string; available for use by the checker command
188
created: datetime.datetime(); (UTC) object creation
189
last_enabled: datetime.datetime(); (UTC)
190
enabled: bool()
191
last_checked_ok: datetime.datetime(); (UTC) or None
192
timeout: datetime.timedelta(); How long from last_checked_ok
193
until this client is invalid
194
interval: datetime.timedelta(); How often to start a new checker
195
disable_hook: If set, called by disable() as disable_hook(self)
196
checker: subprocess.Popen(); a running checker process used
197
to see if the client lives.
198
'None' if no process is running.
174
secret: bytestring; sent verbatim (over TLS) to client
175
host: string; available for use by the checker command
176
created: datetime.datetime(); object creation, not client host
177
last_checked_ok: datetime.datetime() or None if not yet checked OK
178
timeout: datetime.timedelta(); How long from last_checked_ok
179
until this client is invalid
180
interval: datetime.timedelta(); How often to start a new checker
181
stop_hook: If set, called by stop() as stop_hook(self)
182
checker: subprocess.Popen(); a running checker process used
183
to see if the client lives.
184
'None' if no process is running.
199
185
checker_initiator_tag: a gobject event source tag, or None
200
disable_initiator_tag: - '' -
186
stop_initiator_tag: - '' -
201
187
checker_callback_tag: - '' -
202
188
checker_command: string; External command which is run to check if
203
189
client lives. %() expansions are done at
204
190
runtime with vars(self) as dict, so that for
205
191
instance %(name)s can be used in the command.
206
use_dbus: bool(); Whether to provide D-Bus interface and signals
207
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
192
Private attibutes:
193
_timeout: Real variable for 'timeout'
194
_interval: Real variable for 'interval'
195
_timeout_milliseconds: Used when calling gobject.timeout_add()
196
_interval_milliseconds: - '' -
208
197
"""
209
def timeout_milliseconds(self):
210
"Return the 'timeout' attribute in milliseconds"
211
return ((self.timeout.days * 24 * 60 * 60 * 1000)
212
+ (self.timeout.seconds * 1000)
213
+ (self.timeout.microseconds // 1000))
214
215
def interval_milliseconds(self):
216
"Return the 'interval' attribute in milliseconds"
217
return ((self.interval.days * 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds * 1000)
219
+ (self.interval.microseconds // 1000))
220
221
def __init__(self, name = None, disable_hook=None, config=None,
222
use_dbus=True):
198
def _set_timeout(self, timeout):
199
"Setter function for 'timeout' attribute"
200
self._timeout = timeout
201
self._timeout_milliseconds = ((self.timeout.days
202
* 24 * 60 * 60 * 1000)
203
+ (self.timeout.seconds * 1000)
204
+ (self.timeout.microseconds
205
// 1000))
206
timeout = property(lambda self: self._timeout,
207
_set_timeout)
208
del _set_timeout
209
def _set_interval(self, interval):
210
"Setter function for 'interval' attribute"
211
self._interval = interval
212
self._interval_milliseconds = ((self.interval.days
213
* 24 * 60 * 60 * 1000)
214
+ (self.interval.seconds
215
* 1000)
216
+ (self.interval.microseconds
217
// 1000))
218
interval = property(lambda self: self._interval,
219
_set_interval)
220
del _set_interval
221
def __init__(self, name = None, stop_hook=None, config={}):
223
222
"""Note: the 'checker' key in 'config' sets the
224
223
'checker_command' attribute and *not* the 'checker'
225
224
attribute."""
226
225
self.name = name
227
if config is None:
228
config = {}
229
226
logger.debug(u"Creating client %r", self.name)
230
self.use_dbus = False # During __init__
231
227
# Uppercase and remove spaces from fingerprint for later
232
228
# comparison purposes with return value from the fingerprint()
233
229
# function
234
self.fingerprint = (config["fingerprint"].upper()
235
.replace(u" ", u""))
230
self.fingerprint = config["fingerprint"].upper()\
231
.replace(u" ", u"")
236
232
logger.debug(u" Fingerprint: %s", self.fingerprint)
237
233
if "secret" in config:
238
234
self.secret = config["secret"].decode(u"base64")
239
235
elif "secfile" in config:
240
with closing(open(os.path.expanduser
241
(os.path.expandvars
242
(config["secfile"])))) as secfile:
243
self.secret = secfile.read()
236
sf = open(config["secfile"])
237
self.secret = sf.read()
238
sf.close()
244
239
else:
245
240
raise TypeError(u"No secret or secfile for client %s"
246
241
% self.name)
247
242
self.host = config.get("host", "")
248
self.created = datetime.datetime.utcnow()
249
self.enabled = False
250
self.last_enabled = None
243
self.created = datetime.datetime.now()
251
244
self.last_checked_ok = None
252
245
self.timeout = string_to_delta(config["timeout"])
253
246
self.interval = string_to_delta(config["interval"])
254
self.disable_hook = disable_hook
247
self.stop_hook = stop_hook
255
248
self.checker = None
256
249
self.checker_initiator_tag = None
257
self.disable_initiator_tag = None
250
self.stop_initiator_tag = None
258
251
self.checker_callback_tag = None
259
self.checker_command = config["checker"]
260
self.last_connect = None
261
# Only now, when this client is initialized, can it show up on
262
# the D-Bus
263
self.use_dbus = use_dbus
264
if self.use_dbus:
265
self.dbus_object_path = (dbus.ObjectPath
266
("/clients/"
267
+ self.name.replace(".", "_")))
268
dbus.service.Object.__init__(self, bus,
269
self.dbus_object_path)
270
271
def enable(self):
252
self.check_command = config["checker"]
253
def start(self):
272
254
"""Start this client's checker and timeout hooks"""
273
self.last_enabled = datetime.datetime.utcnow()
274
255
# Schedule a new checker to be started an 'interval' from now,
275
256
# and every interval from then on.
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self.interval_milliseconds(),
278
self.start_checker))
257
self.checker_initiator_tag = gobject.timeout_add\
258
(self._interval_milliseconds,
259
self.start_checker)
279
260
# Also start a new checker *right now*.
280
261
self.start_checker()
281
# Schedule a disable() when 'timeout' has passed
282
self.disable_initiator_tag = (gobject.timeout_add
283
(self.timeout_milliseconds(),
284
self.disable))
285
self.enabled = True
286
if self.use_dbus:
287
# Emit D-Bus signals
288
self.PropertyChanged(dbus.String(u"enabled"),
289
dbus.Boolean(True, variant_level=1))
290
self.PropertyChanged(dbus.String(u"last_enabled"),
291
(_datetime_to_dbus(self.last_enabled,
292
variant_level=1)))
293
294
def disable(self):
295
"""Disable this client."""
296
if not getattr(self, "enabled", False):
262
# Schedule a stop() when 'timeout' has passed
263
self.stop_initiator_tag = gobject.timeout_add\
264
(self._timeout_milliseconds,
265
self.stop)
266
def stop(self):
267
"""Stop this client.
268
The possibility that a client might be restarted is left open,
269
but not currently used."""
270
# If this client doesn't have a secret, it is already stopped.
271
if hasattr(self, "secret") and self.secret:
272
logger.info(u"Stopping client %s", self.name)
273
self.secret = None
274
else:
297
275
return False
298
logger.info(u"Disabling client %s", self.name)
299
if getattr(self, "disable_initiator_tag", False):
300
gobject.source_remove(self.disable_initiator_tag)
301
self.disable_initiator_tag = None
276
if getattr(self, "stop_initiator_tag", False):
277
gobject.source_remove(self.stop_initiator_tag)
278
self.stop_initiator_tag = None
302
279
if getattr(self, "checker_initiator_tag", False):
303
280
gobject.source_remove(self.checker_initiator_tag)
304
281
self.checker_initiator_tag = None
305
282
self.stop_checker()
306
if self.disable_hook:
307
self.disable_hook(self)
308
self.enabled = False
309
if self.use_dbus:
310
# Emit D-Bus signal
311
self.PropertyChanged(dbus.String(u"enabled"),
312
dbus.Boolean(False, variant_level=1))
283
if self.stop_hook:
284
self.stop_hook(self)
313
285
# Do not run this again if called by a gobject.timeout_add
314
286
return False
315
316
287
def __del__(self):
317
self.disable_hook = None
318
self.disable()
319
320
def checker_callback(self, pid, condition, command):
288
self.stop_hook = None
289
self.stop()
290
def checker_callback(self, pid, condition):
321
291
"""The checker has completed, so take appropriate actions."""
292
now = datetime.datetime.now()
322
293
self.checker_callback_tag = None
323
294
self.checker = None
324
if self.use_dbus:
325
# Emit D-Bus signal
326
self.PropertyChanged(dbus.String(u"checker_running"),
327
dbus.Boolean(False, variant_level=1))
328
if os.WIFEXITED(condition):
329
exitstatus = os.WEXITSTATUS(condition)
330
if exitstatus == 0:
331
logger.info(u"Checker for %(name)s succeeded",
332
vars(self))
333
self.checked_ok()
334
else:
335
logger.info(u"Checker for %(name)s failed",
336
vars(self))
337
if self.use_dbus:
338
# Emit D-Bus signal
339
self.CheckerCompleted(dbus.Int16(exitstatus),
340
dbus.Int64(condition),
341
dbus.String(command))
342
else:
295
if os.WIFEXITED(condition) \
296
and (os.WEXITSTATUS(condition) == 0):
297
logger.info(u"Checker for %(name)s succeeded",
298
vars(self))
299
self.last_checked_ok = now
300
gobject.source_remove(self.stop_initiator_tag)
301
self.stop_initiator_tag = gobject.timeout_add\
302
(self._timeout_milliseconds,
303
self.stop)
304
elif not os.WIFEXITED(condition):
343
305
logger.warning(u"Checker for %(name)s crashed?",
344
306
vars(self))
345
if self.use_dbus:
346
# Emit D-Bus signal
347
self.CheckerCompleted(dbus.Int16(-1),
348
dbus.Int64(condition),
349
dbus.String(command))
350
351
def checked_ok(self):
352
"""Bump up the timeout for this client.
353
This should only be called when the client has been seen,
354
alive and well.
355
"""
356
self.last_checked_ok = datetime.datetime.utcnow()
357
gobject.source_remove(self.disable_initiator_tag)
358
self.disable_initiator_tag = (gobject.timeout_add
359
(self.timeout_milliseconds(),
360
self.disable))
361
if self.use_dbus:
362
# Emit D-Bus signal
363
self.PropertyChanged(
364
dbus.String(u"last_checked_ok"),
365
(_datetime_to_dbus(self.last_checked_ok,
366
variant_level=1)))
367
307
else:
308
logger.info(u"Checker for %(name)s failed",
309
vars(self))
368
310
def start_checker(self):
369
311
"""Start a new checker subprocess if one is not running.
370
312
If a checker already exists, leave it running and do
379
321
# is as it should be.
380
322
if self.checker is None:
381
323
try:
382
# In case checker_command has exactly one % operator
383
command = self.checker_command % self.host
324
# In case check_command has exactly one % operator
325
command = self.check_command % self.host
384
326
except TypeError:
385
327
# Escape attributes for the shell
386
328
escaped_attrs = dict((key, re.escape(str(val)))
387
329
for key, val in
388
330
vars(self).iteritems())
389
331
try:
390
command = self.checker_command % escaped_attrs
332
command = self.check_command % escaped_attrs
391
333
except TypeError, error:
392
334
logger.error(u'Could not format string "%s":'
393
u' %s', self.checker_command, error)
335
u' %s', self.check_command, error)
394
336
return True # Try again later
395
337
try:
396
338
logger.info(u"Starting checker %r for %s",
402
344
self.checker = subprocess.Popen(command,
403
345
close_fds=True,
404
346
shell=True, cwd="/")
405
if self.use_dbus:
406
# Emit D-Bus signal
407
self.CheckerStarted(command)
408
self.PropertyChanged(
409
dbus.String("checker_running"),
410
dbus.Boolean(True, variant_level=1))
411
self.checker_callback_tag = (gobject.child_watch_add
412
(self.checker.pid,
413
self.checker_callback,
414
data=command))
347
self.checker_callback_tag = gobject.child_watch_add\
348
(self.checker.pid,
349
self.checker_callback)
415
350
except OSError, error:
416
351
logger.error(u"Failed to start subprocess: %s",
417
352
error)
418
353
# Re-run this periodically if run by gobject.timeout_add
419
354
return True
420
421
355
def stop_checker(self):
422
356
"""Force the checker process, if any, to stop."""
423
357
if self.checker_callback_tag:
435
369
if error.errno != errno.ESRCH: # No such process
436
370
raise
437
371
self.checker = None
438
if self.use_dbus:
439
self.PropertyChanged(dbus.String(u"checker_running"),
440
dbus.Boolean(False, variant_level=1))
441
442
372
def still_valid(self):
443
373
"""Has the timeout not yet passed for this client?"""
444
if not getattr(self, "enabled", False):
445
return False
446
now = datetime.datetime.utcnow()
374
now = datetime.datetime.now()
447
375
if self.last_checked_ok is None:
448
376
return now < (self.created + self.timeout)
449
377
else:
450
378
return now < (self.last_checked_ok + self.timeout)
451
452
## D-Bus methods & signals
453
_interface = u"se.bsnet.fukt.Mandos.Client"
454
455
# CheckedOK - method
456
CheckedOK = dbus.service.method(_interface)(checked_ok)
457
CheckedOK.__name__ = "CheckedOK"
458
459
# CheckerCompleted - signal
460
@dbus.service.signal(_interface, signature="nxs")
461
def CheckerCompleted(self, exitcode, waitstatus, command):
462
"D-Bus signal"
463
pass
464
465
# CheckerStarted - signal
466
@dbus.service.signal(_interface, signature="s")
467
def CheckerStarted(self, command):
468
"D-Bus signal"
469
pass
470
471
# GetAllProperties - method
472
@dbus.service.method(_interface, out_signature="a{sv}")
473
def GetAllProperties(self):
474
"D-Bus method"
475
return dbus.Dictionary({
476
dbus.String("name"):
477
dbus.String(self.name, variant_level=1),
478
dbus.String("fingerprint"):
479
dbus.String(self.fingerprint, variant_level=1),
480
dbus.String("host"):
481
dbus.String(self.host, variant_level=1),
482
dbus.String("created"):
483
_datetime_to_dbus(self.created, variant_level=1),
484
dbus.String("last_enabled"):
485
(_datetime_to_dbus(self.last_enabled,
486
variant_level=1)
487
if self.last_enabled is not None
488
else dbus.Boolean(False, variant_level=1)),
489
dbus.String("enabled"):
490
dbus.Boolean(self.enabled, variant_level=1),
491
dbus.String("last_checked_ok"):
492
(_datetime_to_dbus(self.last_checked_ok,
493
variant_level=1)
494
if self.last_checked_ok is not None
495
else dbus.Boolean (False, variant_level=1)),
496
dbus.String("timeout"):
497
dbus.UInt64(self.timeout_milliseconds(),
498
variant_level=1),
499
dbus.String("interval"):
500
dbus.UInt64(self.interval_milliseconds(),
501
variant_level=1),
502
dbus.String("checker"):
503
dbus.String(self.checker_command,
504
variant_level=1),
505
dbus.String("checker_running"):
506
dbus.Boolean(self.checker is not None,
507
variant_level=1),
508
dbus.String("object_path"):
509
dbus.ObjectPath(self.dbus_object_path,
510
variant_level=1)
511
}, signature="sv")
512
513
# IsStillValid - method
514
IsStillValid = (dbus.service.method(_interface, out_signature="b")
515
(still_valid))
516
IsStillValid.__name__ = "IsStillValid"
517
518
# PropertyChanged - signal
519
@dbus.service.signal(_interface, signature="sv")
520
def PropertyChanged(self, property, value):
521
"D-Bus signal"
522
pass
523
524
# SetChecker - method
525
@dbus.service.method(_interface, in_signature="s")
526
def SetChecker(self, checker):
527
"D-Bus setter method"
528
self.checker_command = checker
529
# Emit D-Bus signal
530
self.PropertyChanged(dbus.String(u"checker"),
531
dbus.String(self.checker_command,
532
variant_level=1))
533
534
# SetHost - method
535
@dbus.service.method(_interface, in_signature="s")
536
def SetHost(self, host):
537
"D-Bus setter method"
538
self.host = host
539
# Emit D-Bus signal
540
self.PropertyChanged(dbus.String(u"host"),
541
dbus.String(self.host, variant_level=1))
542
543
# SetInterval - method
544
@dbus.service.method(_interface, in_signature="t")
545
def SetInterval(self, milliseconds):
546
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
547
# Emit D-Bus signal
548
self.PropertyChanged(dbus.String(u"interval"),
549
(dbus.UInt64(self.interval_milliseconds(),
550
variant_level=1)))
551
552
# SetSecret - method
553
@dbus.service.method(_interface, in_signature="ay",
554
byte_arrays=True)
555
def SetSecret(self, secret):
556
"D-Bus setter method"
557
self.secret = str(secret)
558
559
# SetTimeout - method
560
@dbus.service.method(_interface, in_signature="t")
561
def SetTimeout(self, milliseconds):
562
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
563
# Emit D-Bus signal
564
self.PropertyChanged(dbus.String(u"timeout"),
565
(dbus.UInt64(self.timeout_milliseconds(),
566
variant_level=1)))
567
568
# Enable - method
569
Enable = dbus.service.method(_interface)(enable)
570
Enable.__name__ = "Enable"
571
572
# StartChecker - method
573
@dbus.service.method(_interface)
574
def StartChecker(self):
575
"D-Bus method"
576
self.start_checker()
577
578
# Disable - method
579
@dbus.service.method(_interface)
580
def Disable(self):
581
"D-Bus method"
582
self.disable()
583
584
# StopChecker - method
585
StopChecker = dbus.service.method(_interface)(stop_checker)
586
StopChecker.__name__ = "StopChecker"
587
588
del _interface
589
379
590
380
591
381
def peer_certificate(session):
592
382
"Return the peer's OpenPGP certificate as a bytestring"
593
383
# If not an OpenPGP certificate...
594
if (gnutls.library.functions
595
.gnutls_certificate_type_get(session._c_object)
596
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
384
if gnutls.library.functions.gnutls_certificate_type_get\
385
(session._c_object) \
386
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
597
387
# ...do the normal thing
598
388
return session.peer_certificate
599
list_size = ctypes.c_uint(1)
600
cert_list = (gnutls.library.functions
601
.gnutls_certificate_get_peers
602
(session._c_object, ctypes.byref(list_size)))
603
if not bool(cert_list) and list_size.value != 0:
604
raise gnutls.errors.GNUTLSError("error getting peer"
605
" certificate")
389
list_size = ctypes.c_uint()
390
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
391
(session._c_object, ctypes.byref(list_size))
606
392
if list_size.value == 0:
607
393
return None
608
394
cert = cert_list[0]
612
398
def fingerprint(openpgp):
613
399
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
614
400
# New GnuTLS "datum" with the OpenPGP public key
615
datum = (gnutls.library.types
616
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
617
ctypes.POINTER
618
(ctypes.c_ubyte)),
619
ctypes.c_uint(len(openpgp))))
401
datum = gnutls.library.types.gnutls_datum_t\
402
(ctypes.cast(ctypes.c_char_p(openpgp),
403
ctypes.POINTER(ctypes.c_ubyte)),
404
ctypes.c_uint(len(openpgp)))
620
405
# New empty GnuTLS certificate
621
406
crt = gnutls.library.types.gnutls_openpgp_crt_t()
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
407
gnutls.library.functions.gnutls_openpgp_crt_init\
408
(ctypes.byref(crt))
624
409
# Import the OpenPGP public key into the certificate
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
627
gnutls.library.constants
628
.GNUTLS_OPENPGP_FMT_RAW))
410
gnutls.library.functions.gnutls_openpgp_crt_import\
411
(crt, ctypes.byref(datum),
412
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
629
413
# Verify the self signature in the key
630
crtverify = ctypes.c_uint()
631
(gnutls.library.functions
632
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
414
crtverify = ctypes.c_uint();
415
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
416
(crt, ctypes.c_uint(0), ctypes.byref(crtverify))
633
417
if crtverify.value != 0:
634
418
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
635
419
raise gnutls.errors.CertificateSecurityError("Verify failed")
636
420
# New buffer for the fingerprint
637
buf = ctypes.create_string_buffer(20)
638
buf_len = ctypes.c_size_t()
421
buffer = ctypes.create_string_buffer(20)
422
buffer_length = ctypes.c_size_t()
639
423
# Get the fingerprint from the certificate into the buffer
640
(gnutls.library.functions
641
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
642
ctypes.byref(buf_len)))
424
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
425
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
643
426
# Deinit the certificate
644
427
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
645
428
# Convert the buffer to a Python bytestring
646
fpr = ctypes.string_at(buf, buf_len.value)
429
fpr = ctypes.string_at(buffer, buffer_length.value)
647
430
# Convert the bytestring to hexadecimal notation
648
431
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
649
432
return hex_fpr
650
433
651
434
652
class TCP_handler(SocketServer.BaseRequestHandler, object):
435
class tcp_handler(SocketServer.BaseRequestHandler, object):
653
436
"""A TCP request handler class.
654
437
Instantiated by IPv6_TCPServer for each request to handle it.
655
438
Note: This will run in its own forked process."""
656
439
657
440
def handle(self):
658
441
logger.info(u"TCP connection from: %s",
659
unicode(self.client_address))
660
session = (gnutls.connection
661
.ClientSession(self.request,
662
gnutls.connection
663
.X509Credentials()))
442
unicode(self.client_address))
443
session = gnutls.connection.ClientSession\
444
(self.request, gnutls.connection.X509Credentials())
664
445
665
446
line = self.request.makefile().readline()
666
447
logger.debug(u"Protocol version: %r", line)
677
458
# using OpenPGP certificates.
678
459
679
460
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
680
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
681
# "+DHE-DSS"))
682
# Use a fallback default, since this MUST be set.
683
priority = self.server.settings.get("priority", "NORMAL")
684
(gnutls.library.functions
685
.gnutls_priority_set_direct(session._c_object,
686
priority, None))
461
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
462
# "+DHE-DSS"))
463
priority = "NORMAL" # Fallback default, since this
464
# MUST be set.
465
if self.server.settings["priority"]:
466
priority = self.server.settings["priority"]
467
gnutls.library.functions.gnutls_priority_set_direct\
468
(session._c_object, priority, None);
687
469
688
470
try:
689
471
session.handshake()
692
474
# Do not run session.bye() here: the session is not
693
475
# established. Just abandon the request.
694
476
return
695
logger.debug(u"Handshake succeeded")
696
477
try:
697
478
fpr = fingerprint(peer_certificate(session))
698
479
except (TypeError, gnutls.errors.GNUTLSError), error:
700
481
session.bye()
701
482
return
702
483
logger.debug(u"Fingerprint: %s", fpr)
703
484
client = None
704
485
for c in self.server.clients:
705
486
if c.fingerprint == fpr:
706
487
client = c
707
488
break
708
else:
489
if not client:
709
490
logger.warning(u"Client not found for fingerprint: %s",
710
491
fpr)
711
492
session.bye()
718
499
vars(client))
719
500
session.bye()
720
501
return
721
## This won't work here, since we're in a fork.
722
# client.checked_ok()
723
502
sent_size = 0
724
503
while sent_size < len(client.secret):
725
504
sent = session.send(client.secret[sent_size:])
730
509
session.bye()
731
510
732
511
733
class IPv6_TCPServer(SocketServer.ForkingMixIn,
734
SocketServer.TCPServer, object):
512
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
735
513
"""IPv6 TCP server. Accepts 'None' as address and/or port.
736
514
Attributes:
737
515
settings: Server settings
738
516
clients: Set() of Client objects
739
enabled: Boolean; whether this server is activated yet
740
517
"""
741
518
address_family = socket.AF_INET6
742
519
def __init__(self, *args, **kwargs):
746
523
if "clients" in kwargs:
747
524
self.clients = kwargs["clients"]
748
525
del kwargs["clients"]
749
self.enabled = False
750
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
526
return super(type(self), self).__init__(*args, **kwargs)
751
527
def server_bind(self):
752
528
"""This overrides the normal server_bind() function
753
529
to bind to an interface if one was specified, and also NOT to
765
541
u" bind to interface %s",
766
542
self.settings["interface"])
767
543
else:
768
raise
544
raise error
769
545
# Only bind(2) the socket if we really need to.
770
546
if self.server_address[0] or self.server_address[1]:
771
547
if not self.server_address[0]:
782
558
# if_nametoindex
783
559
# (self.settings
784
560
# ["interface"]))
785
return super(IPv6_TCPServer, self).server_bind()
786
def server_activate(self):
787
if self.enabled:
788
return super(IPv6_TCPServer, self).server_activate()
789
def enable(self):
790
self.enabled = True
561
return super(type(self), self).server_bind()
791
562
792
563
793
564
def string_to_delta(interval):
794
565
"""Parse a string and return a datetime.timedelta
795
566
796
567
>>> string_to_delta('7d')
797
568
datetime.timedelta(7)
798
569
>>> string_to_delta('60s')
809
580
timevalue = datetime.timedelta(0)
810
581
for s in interval.split():
811
582
try:
812
suffix = unicode(s[-1])
813
value = int(s[:-1])
583
suffix=unicode(s[-1])
584
value=int(s[:-1])
814
585
if suffix == u"d":
815
586
delta = datetime.timedelta(value)
816
587
elif suffix == u"s":
832
603
def server_state_changed(state):
833
604
"""Derived from the Avahi example code"""
834
605
if state == avahi.SERVER_COLLISION:
835
logger.error(u"Zeroconf server name collision")
606
logger.error(u"Server name collision")
836
607
service.remove()
837
608
elif state == avahi.SERVER_RUNNING:
838
609
service.add()
840
611
841
612
def entry_group_state_changed(state, error):
842
613
"""Derived from the Avahi example code"""
843
logger.debug(u"Avahi state change: %i", state)
614
logger.debug(u"state change: %i", state)
844
615
845
616
if state == avahi.ENTRY_GROUP_ESTABLISHED:
846
logger.debug(u"Zeroconf service established.")
617
logger.debug(u"Service established.")
847
618
elif state == avahi.ENTRY_GROUP_COLLISION:
848
logger.warning(u"Zeroconf service name collision.")
619
logger.warning(u"Service name collision.")
849
620
service.rename()
850
621
elif state == avahi.ENTRY_GROUP_FAILURE:
851
logger.critical(u"Avahi: Error in group state changed %s",
622
logger.critical(u"Error in group state changed %s",
852
623
unicode(error))
853
raise AvahiGroupError(u"State changed: %s" % unicode(error))
624
raise AvahiGroupError("State changed: %s", str(error))
854
625
855
626
def if_nametoindex(interface):
856
627
"""Call the C function if_nametoindex(), or equivalent"""
857
628
global if_nametoindex
858
629
try:
859
if_nametoindex = (ctypes.cdll.LoadLibrary
860
(ctypes.util.find_library("c"))
861
.if_nametoindex)
630
if "ctypes.util" not in sys.modules:
631
import ctypes.util
632
if_nametoindex = ctypes.cdll.LoadLibrary\
633
(ctypes.util.find_library("c")).if_nametoindex
862
634
except (OSError, AttributeError):
863
635
if "struct" not in sys.modules:
864
636
import struct
867
639
def if_nametoindex(interface):
868
640
"Get an interface index the hard way, i.e. using fcntl()"
869
641
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
870
with closing(socket.socket()) as s:
871
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
872
struct.pack("16s16x", interface))
642
s = socket.socket()
643
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
644
struct.pack("16s16x", interface))
645
s.close()
873
646
interface_index = struct.unpack("I", ifreq[16:20])[0]
874
647
return interface_index
875
648
return if_nametoindex(interface)
899
672
900
673
901
674
def main():
902
parser = optparse.OptionParser(version = "%%prog %s" % version)
675
global main_loop_started
676
main_loop_started = False
677
678
parser = OptionParser(version = "%%prog %s" % version)
903
679
parser.add_option("-i", "--interface", type="string",
904
680
metavar="IF", help="Bind to interface IF")
905
681
parser.add_option("-a", "--address", type="string",
906
682
help="Address to listen for requests on")
907
683
parser.add_option("-p", "--port", type="int",
908
684
help="Port number to receive requests on")
909
parser.add_option("--check", action="store_true",
685
parser.add_option("--check", action="store_true", default=False,
910
686
help="Run self-test")
911
687
parser.add_option("--debug", action="store_true",
912
688
help="Debug mode; run in foreground and log to"
919
695
default="/etc/mandos", metavar="DIR",
920
696
help="Directory to search for configuration"
921
697
" files")
922
parser.add_option("--no-dbus", action="store_false",
923
dest="use_dbus",
924
help="Do not provide D-Bus system bus"
925
" interface")
926
options = parser.parse_args()[0]
698
(options, args) = parser.parse_args()
927
699
928
700
if options.check:
929
701
import doctest
938
710
"priority":
939
711
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
940
712
"servicename": "Mandos",
941
"use_dbus": "True",
942
713
}
943
714
944
715
# Parse config file for server-global settings
947
718
server_config.read(os.path.join(options.configdir, "mandos.conf"))
948
719
# Convert the SafeConfigParser object to a dict
949
720
server_settings = server_config.defaults()
950
# Use the appropriate methods on the non-string config options
951
server_settings["debug"] = server_config.getboolean("DEFAULT",
952
"debug")
953
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
954
"use_dbus")
955
if server_settings["port"]:
956
server_settings["port"] = server_config.getint("DEFAULT",
957
"port")
721
# Use getboolean on the boolean config option
722
server_settings["debug"] = server_config.getboolean\
723
("DEFAULT", "debug")
958
724
del server_config
959
725
960
726
# Override the settings from the config file with command line
961
727
# options, if set.
962
728
for option in ("interface", "address", "port", "debug",
963
"priority", "servicename", "configdir",
964
"use_dbus"):
729
"priority", "servicename", "configdir"):
965
730
value = getattr(options, option)
966
731
if value is not None:
967
732
server_settings[option] = value
968
733
del options
969
734
# Now we have our good server settings in "server_settings"
970
735
971
# For convenience
972
736
debug = server_settings["debug"]
973
use_dbus = server_settings["use_dbus"]
974
737
975
738
if not debug:
976
739
syslogger.setLevel(logging.WARNING)
977
740
console.setLevel(logging.WARNING)
978
741
979
742
if server_settings["servicename"] != "Mandos":
980
syslogger.setFormatter(logging.Formatter
743
syslogger.setFormatter(logging.Formatter\
981
744
('Mandos (%s): %%(levelname)s:'
982
745
' %%(message)s'
983
746
% server_settings["servicename"]))
985
748
# Parse config file with clients
986
749
client_defaults = { "timeout": "1h",
987
750
"interval": "5m",
988
"checker": "fping -q -- %%(host)s",
751
"checker": "fping -q -- %(host)s",
989
752
"host": "",
990
753
}
991
754
client_config = ConfigParser.SafeConfigParser(client_defaults)
992
755
client_config.read(os.path.join(server_settings["configdir"],
993
756
"clients.conf"))
994
757
995
clients = Set()
996
tcp_server = IPv6_TCPServer((server_settings["address"],
997
server_settings["port"]),
998
TCP_handler,
999
settings=server_settings,
1000
clients=clients)
1001
pidfilename = "/var/run/mandos.pid"
1002
try:
1003
pidfile = open(pidfilename, "w")
1004
except IOError:
1005
logger.error("Could not open file %r", pidfilename)
1006
1007
try:
1008
uid = pwd.getpwnam("_mandos").pw_uid
1009
gid = pwd.getpwnam("_mandos").pw_gid
1010
except KeyError:
1011
try:
1012
uid = pwd.getpwnam("mandos").pw_uid
1013
gid = pwd.getpwnam("mandos").pw_gid
1014
except KeyError:
1015
try:
1016
uid = pwd.getpwnam("nobody").pw_uid
1017
gid = pwd.getpwnam("nogroup").pw_gid
1018
except KeyError:
1019
uid = 65534
1020
gid = 65534
1021
try:
1022
os.setgid(gid)
1023
os.setuid(uid)
1024
except OSError, error:
1025
if error[0] != errno.EPERM:
1026
raise error
1027
1028
# Enable all possible GnuTLS debugging
1029
if debug:
1030
# "Use a log level over 10 to enable all debugging options."
1031
# - GnuTLS manual
1032
gnutls.library.functions.gnutls_global_set_log_level(11)
1033
1034
@gnutls.library.types.gnutls_log_func
1035
def debug_gnutls(level, string):
1036
logger.debug("GnuTLS: %s", string[:-1])
1037
1038
(gnutls.library.functions
1039
.gnutls_global_set_log_function(debug_gnutls))
1040
1041
758
global service
1042
759
service = AvahiService(name = server_settings["servicename"],
1043
servicetype = "_mandos._tcp", )
760
type = "_mandos._tcp", );
1044
761
if server_settings["interface"]:
1045
service.interface = (if_nametoindex
1046
(server_settings["interface"]))
762
service.interface = if_nametoindex(server_settings["interface"])
1047
763
1048
764
global main_loop
1049
765
global bus
1052
768
DBusGMainLoop(set_as_default=True )
1053
769
main_loop = gobject.MainLoop()
1054
770
bus = dbus.SystemBus()
1055
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1056
avahi.DBUS_PATH_SERVER),
1057
avahi.DBUS_INTERFACE_SERVER)
771
server = dbus.Interface(
772
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
773
avahi.DBUS_INTERFACE_SERVER )
1058
774
# End of Avahi example code
1059
if use_dbus:
1060
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
775
776
clients = Set()
777
def remove_from_clients(client):
778
clients.remove(client)
779
if not clients:
780
logger.critical(u"No clients left, exiting")
781
sys.exit()
1061
782
1062
783
clients.update(Set(Client(name = section,
784
stop_hook = remove_from_clients,
1063
785
config
1064
= dict(client_config.items(section)),
1065
use_dbus = use_dbus)
786
= dict(client_config.items(section)))
1066
787
for section in client_config.sections()))
1067
788
if not clients:
1068
logger.warning(u"No clients defined")
789
logger.critical(u"No clients defined")
790
sys.exit(1)
1069
791
1070
792
if debug:
1071
793
# Redirect stdin so all checkers get /dev/null
1079
801
# Close all input and output, do double fork, etc.
1080
802
daemon()
1081
803
804
pidfilename = "/var/run/mandos/mandos.pid"
805
pid = os.getpid()
1082
806
try:
1083
pid = os.getpid()
807
pidfile = open(pidfilename, "w")
1084
808
pidfile.write(str(pid) + "\n")
1085
809
pidfile.close()
1086
810
del pidfile
1087
except IOError:
1088
logger.error(u"Could not write to file %r with PID %d",
1089
pidfilename, pid)
1090
except NameError:
1091
# "pidfile" was never created
1092
pass
1093
del pidfilename
811
except IOError, err:
812
logger.error(u"Could not write %s file with PID %d",
813
pidfilename, os.getpid())
1094
814
1095
815
def cleanup():
1096
816
"Cleanup function; run on exit"
1103
823
1104
824
while clients:
1105
825
client = clients.pop()
1106
client.disable_hook = None
1107
client.disable()
826
client.stop_hook = None
827
client.stop()
1108
828
1109
829
atexit.register(cleanup)
1110
830
1113
833
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1114
834
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1115
835
1116
if use_dbus:
1117
class MandosServer(dbus.service.Object):
1118
"""A D-Bus proxy object"""
1119
def __init__(self):
1120
dbus.service.Object.__init__(self, bus, "/")
1121
_interface = u"se.bsnet.fukt.Mandos"
1122
1123
@dbus.service.signal(_interface, signature="oa{sv}")
1124
def ClientAdded(self, objpath, properties):
1125
"D-Bus signal"
1126
pass
1127
1128
@dbus.service.signal(_interface, signature="os")
1129
def ClientRemoved(self, objpath, name):
1130
"D-Bus signal"
1131
pass
1132
1133
@dbus.service.method(_interface, out_signature="ao")
1134
def GetAllClients(self):
1135
"D-Bus method"
1136
return dbus.Array(c.dbus_object_path for c in clients)
1137
1138
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1139
def GetAllClientsWithProperties(self):
1140
"D-Bus method"
1141
return dbus.Dictionary(
1142
((c.dbus_object_path, c.GetAllProperties())
1143
for c in clients),
1144
signature="oa{sv}")
1145
1146
@dbus.service.method(_interface, in_signature="o")
1147
def RemoveClient(self, object_path):
1148
"D-Bus method"
1149
for c in clients:
1150
if c.dbus_object_path == object_path:
1151
clients.remove(c)
1152
# Don't signal anything except ClientRemoved
1153
c.use_dbus = False
1154
c.disable()
1155
# Emit D-Bus signal
1156
self.ClientRemoved(object_path, c.name)
1157
return
1158
raise KeyError
1159
1160
del _interface
1161
1162
mandos_server = MandosServer()
1163
1164
836
for client in clients:
1165
if use_dbus:
1166
# Emit D-Bus signal
1167
mandos_server.ClientAdded(client.dbus_object_path,
1168
client.GetAllProperties())
1169
client.enable()
1170
1171
tcp_server.enable()
1172
tcp_server.server_activate()
1173
837
client.start()
838
839
tcp_server = IPv6_TCPServer((server_settings["address"],
840
server_settings["port"]),
841
tcp_handler,
842
settings=server_settings,
843
clients=clients)
1174
844
# Find out what port we got
1175
845
service.port = tcp_server.socket.getsockname()[1]
1176
846
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1190
860
1191
861
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1192
862
lambda *args, **kwargs:
1193
(tcp_server.handle_request
1194
(*args[2:], **kwargs) or True))
863
tcp_server.handle_request\
864
(*args[2:], **kwargs) or True)
1195
865
1196
866
logger.debug(u"Starting main loop")
867
main_loop_started = True
1197
868
main_loop.run()
1198
869
except AvahiError, error:
1199
logger.critical(u"AvahiError: %s", error)
870
logger.critical(u"AvahiError: %s" + unicode(error))
1200
871
sys.exit(1)
1201
872
except KeyboardInterrupt:
1202
873
if debug:
1203
print >> sys.stderr
1204
logger.debug("Server received KeyboardInterrupt")
1205
logger.debug("Server exiting")
874
print
1206
875
1207
876
if __name__ == '__main__':
1208
877
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0