/mandos/release : revision 182

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

14

16

15

#

17

16

# This program is free software: you can redistribute it and/or modify

18

17

# it under the terms of the GNU General Public License as published by

31

30

# Contact the authors at <mandos@fukt.bsnet.se>.

32

31

#

33

32

34

from __future__ import division, with_statement, absolute_import

33

from __future__ import division

35

34

36

35

import SocketServer

37

36

import socket

37

import select

38

from optparse import OptionParser

39

import datetime

40

import errno

56

import logging

57

import logging.handlers

58

import pwd

59

from contextlib import closing

60

59

61

60

import dbus

62

import dbus.service

63

61

import gobject

64

62

import avahi

65

63

from dbus.mainloop.glib import DBusGMainLoop

66

64

import ctypes

67

import ctypes.util

68

65

69

version = "1.0.2"

66

version = "1.0"

70

67

71

68

logger = logging.Logger('mandos')

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos: %(levelname)s: %(message)s'))

69

syslogger = logging.handlers.SysLogHandler\

70

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

71

address = "/dev/log")

72

syslogger.setFormatter(logging.Formatter\

73

('Mandos: %(levelname)s: %(message)s'))

77

74

logger.addHandler(syslogger)

78

75

79

76

console = logging.StreamHandler()

82

79

logger.addHandler(console)

83

80

84

81

class AvahiError(Exception):

85

def __init__(self, value, *args, **kwargs):

82

def __init__(self, value):

86

83

self.value = value

87

super(AvahiError, self).__init__(value, *args, **kwargs)

88

def __unicode__(self):

89

return unicode(repr(self.value))

84

def __str__(self):

85

return repr(self.value)

90

86

91

87

class AvahiServiceError(AvahiError):

92

88

pass

112

108

a sensible number of times

113

109

"""

114

110

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

115

servicetype = None, port = None, TXT = None,

116

domain = "", host = "", max_renames = 32768):

111

type = None, port = None, TXT = None, domain = "",

112

host = "", max_renames = 32768):

117

113

self.interface = interface

118

114

self.name = name

119

self.type = servicetype

115

self.type = type

120

116

self.port = port

121

self.TXT = TXT if TXT is not None else []

117

if TXT is None:

118

self.TXT = []

119

else:

120

self.TXT = TXT

122

121

self.domain = domain

123

122

self.host = host

124

123

self.rename_count = 0

128

127

if self.rename_count >= self.max_renames:

129

128

logger.critical(u"No suitable Zeroconf service name found"

130

129

u" after %i retries, exiting.",

131

self.rename_count)

132

raise AvahiServiceError(u"Too many renames")

130

rename_count)

131

raise AvahiServiceError("Too many renames")

133

132

self.name = server.GetAlternativeServiceName(self.name)

134

133

logger.info(u"Changing Zeroconf service name to %r ...",

135

134

str(self.name))

136

syslogger.setFormatter(logging.Formatter

135

syslogger.setFormatter(logging.Formatter\

137

136

('Mandos (%s): %%(levelname)s:'

138

' %%(message)s' % self.name))

137

' %%(message)s' % self.name))

139

138

self.remove()

140

139

self.add()

141

140

self.rename_count += 1

147

146

"""Derived from the Avahi example code"""

148

147

global group

149

148

if group is None:

150

group = dbus.Interface(bus.get_object

151

(avahi.DBUS_NAME,

149

group = dbus.Interface\

150

(bus.get_object(avahi.DBUS_NAME,

152

151

server.EntryGroupNew()),

153

avahi.DBUS_INTERFACE_ENTRY_GROUP)

152

avahi.DBUS_INTERFACE_ENTRY_GROUP)

154

153

group.connect_to_signal('StateChanged',

155

154

entry_group_state_changed)

156

155

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

170

169

# End of Avahi example code

171

170

172

171

173

def _datetime_to_dbus(dt, variant_level=0):

174

"""Convert a UTC datetime.datetime() to a D-Bus type."""

175

return dbus.String(dt.isoformat(), variant_level=variant_level)

176

177

178

class Client(dbus.service.Object):

172

class Client(object):

179

173

"""A representation of a client host served by this server.

180

174

Attributes:

181

name: string; from the config file, used in log messages

175

name: string; from the config file, used in log messages

182

176

fingerprint: string (40 or 32 hexadecimal digits); used to

183

177

uniquely identify the client

184

secret: bytestring; sent verbatim (over TLS) to client

185

host: string; available for use by the checker command

186

created: datetime.datetime(); (UTC) object creation

187

last_enabled: datetime.datetime(); (UTC)

188

enabled: bool()

189

last_checked_ok: datetime.datetime(); (UTC) or None

190

timeout: datetime.timedelta(); How long from last_checked_ok

191

until this client is invalid

192

interval: datetime.timedelta(); How often to start a new checker

193

disable_hook: If set, called by disable() as disable_hook(self)

194

checker: subprocess.Popen(); a running checker process used

195

to see if the client lives.

196

'None' if no process is running.

178

secret: bytestring; sent verbatim (over TLS) to client

179

host: string; available for use by the checker command

180

created: datetime.datetime(); object creation, not client host

181

last_checked_ok: datetime.datetime() or None if not yet checked OK

182

timeout: datetime.timedelta(); How long from last_checked_ok

183

until this client is invalid

184

interval: datetime.timedelta(); How often to start a new checker

185

stop_hook: If set, called by stop() as stop_hook(self)

186

checker: subprocess.Popen(); a running checker process used

187

to see if the client lives.

188

'None' if no process is running.

197

189

checker_initiator_tag: a gobject event source tag, or None

198

disable_initiator_tag: - '' -

190

stop_initiator_tag: - '' -

199

191

checker_callback_tag: - '' -

200

192

checker_command: string; External command which is run to check if

201

193

client lives. %() expansions are done at

202

194

runtime with vars(self) as dict, so that for

203

195

instance %(name)s can be used in the command.

204

use_dbus: bool(); Whether to provide D-Bus interface and signals

205

dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus

196

Private attibutes:

197

_timeout: Real variable for 'timeout'

198

_interval: Real variable for 'interval'

199

_timeout_milliseconds: Used when calling gobject.timeout_add()

200

_interval_milliseconds: - '' -

206

201

"""

207

def timeout_milliseconds(self):

208

"Return the 'timeout' attribute in milliseconds"

209

return ((self.timeout.days * 24 * 60 * 60 * 1000)

210

+ (self.timeout.seconds * 1000)

211

+ (self.timeout.microseconds // 1000))

212

213

def interval_milliseconds(self):

214

"Return the 'interval' attribute in milliseconds"

215

return ((self.interval.days * 24 * 60 * 60 * 1000)

216

+ (self.interval.seconds * 1000)

217

+ (self.interval.microseconds // 1000))

218

219

def __init__(self, name = None, disable_hook=None, config=None,

220

use_dbus=True):

202

def _set_timeout(self, timeout):

203

"Setter function for 'timeout' attribute"

204

self._timeout = timeout

205

self._timeout_milliseconds = ((self.timeout.days

206

* 24 * 60 * 60 * 1000)

207

+ (self.timeout.seconds * 1000)

208

+ (self.timeout.microseconds

209

// 1000))

210

timeout = property(lambda self: self._timeout,

211

_set_timeout)

212

del _set_timeout

213

def _set_interval(self, interval):

214

"Setter function for 'interval' attribute"

215

self._interval = interval

216

self._interval_milliseconds = ((self.interval.days

217

* 24 * 60 * 60 * 1000)

218

+ (self.interval.seconds

219

* 1000)

220

+ (self.interval.microseconds

221

// 1000))

222

interval = property(lambda self: self._interval,

223

_set_interval)

224

del _set_interval

225

def __init__(self, name = None, stop_hook=None, config={}):

221

226

"""Note: the 'checker' key in 'config' sets the

222

227

'checker_command' attribute and *not* the 'checker'

223

228

attribute."""

224

229

self.name = name

225

if config is None:

226

config = {}

227

230

logger.debug(u"Creating client %r", self.name)

228

self.use_dbus = use_dbus

229

if self.use_dbus:

230

self.dbus_object_path = (dbus.ObjectPath

231

("/Mandos/clients/"

232

+ self.name.replace(".", "_")))

233

dbus.service.Object.__init__(self, bus,

234

self.dbus_object_path)

235

231

# Uppercase and remove spaces from fingerprint for later

236

232

# comparison purposes with return value from the fingerprint()

237

233

# function

238

self.fingerprint = (config["fingerprint"].upper()

239

.replace(u" ", u""))

234

self.fingerprint = config["fingerprint"].upper()\

235

.replace(u" ", u"")

240

236

logger.debug(u" Fingerprint: %s", self.fingerprint)

241

237

if "secret" in config:

242

238

self.secret = config["secret"].decode(u"base64")

243

239

elif "secfile" in config:

244

with closing(open(os.path.expanduser

245

(os.path.expandvars

246

(config["secfile"])))) as secfile:

247

self.secret = secfile.read()

240

sf = open(config["secfile"])

241

self.secret = sf.read()

242

sf.close()

248

243

else:

249

244

raise TypeError(u"No secret or secfile for client %s"

250

245

% self.name)

251

246

self.host = config.get("host", "")

252

self.created = datetime.datetime.utcnow()

253

self.enabled = False

254

self.last_enabled = None

247

self.created = datetime.datetime.now()

255

248

self.last_checked_ok = None

256

249

self.timeout = string_to_delta(config["timeout"])

257

250

self.interval = string_to_delta(config["interval"])

258

self.disable_hook = disable_hook

251

self.stop_hook = stop_hook

259

252

self.checker = None

260

253

self.checker_initiator_tag = None

261

self.disable_initiator_tag = None

254

self.stop_initiator_tag = None

262

255

self.checker_callback_tag = None

263

self.checker_command = config["checker"]

264

265

def enable(self):

256

self.check_command = config["checker"]

257

def start(self):

266

258

"""Start this client's checker and timeout hooks"""

267

self.last_enabled = datetime.datetime.utcnow()

268

259

# Schedule a new checker to be started an 'interval' from now,

269

260

# and every interval from then on.

270

self.checker_initiator_tag = (gobject.timeout_add

271

(self.interval_milliseconds(),

272

self.start_checker))

261

self.checker_initiator_tag = gobject.timeout_add\

262

(self._interval_milliseconds,

263

self.start_checker)

273

264

# Also start a new checker *right now*.

274

265

self.start_checker()

275

# Schedule a disable() when 'timeout' has passed

276

self.disable_initiator_tag = (gobject.timeout_add

277

(self.timeout_milliseconds(),

278

self.disable))

279

self.enabled = True

280

if self.use_dbus:

281

# Emit D-Bus signals

282

self.PropertyChanged(dbus.String(u"enabled"),

283

dbus.Boolean(True, variant_level=1))

284

self.PropertyChanged(dbus.String(u"last_enabled"),

285

(_datetime_to_dbus(self.last_enabled,

286

variant_level=1)))

287

288

def disable(self):

289

"""Disable this client."""

290

if not getattr(self, "enabled", False):

266

# Schedule a stop() when 'timeout' has passed

267

self.stop_initiator_tag = gobject.timeout_add\

268

(self._timeout_milliseconds,

269

self.stop)

270

def stop(self):

271

"""Stop this client.

272

The possibility that a client might be restarted is left open,

273

but not currently used."""

274

# If this client doesn't have a secret, it is already stopped.

275

if hasattr(self, "secret") and self.secret:

276

logger.info(u"Stopping client %s", self.name)

277

self.secret = None

278

else:

291

279

return False

292

logger.info(u"Disabling client %s", self.name)

293

if getattr(self, "disable_initiator_tag", False):

294

gobject.source_remove(self.disable_initiator_tag)

295

self.disable_initiator_tag = None

280

if getattr(self, "stop_initiator_tag", False):

281

gobject.source_remove(self.stop_initiator_tag)

282

self.stop_initiator_tag = None

296

283

if getattr(self, "checker_initiator_tag", False):

297

284

gobject.source_remove(self.checker_initiator_tag)

298

285

self.checker_initiator_tag = None

299

286

self.stop_checker()

300

if self.disable_hook:

301

self.disable_hook(self)

302

self.enabled = False

303

if self.use_dbus:

304

# Emit D-Bus signal

305

self.PropertyChanged(dbus.String(u"enabled"),

306

dbus.Boolean(False, variant_level=1))

287

if self.stop_hook:

288

self.stop_hook(self)

307

289

# Do not run this again if called by a gobject.timeout_add

308

290

return False

309

310

291

def __del__(self):

311

self.disable_hook = None

312

self.disable()

313

314

def checker_callback(self, pid, condition, command):

292

self.stop_hook = None

293

self.stop()

294

def checker_callback(self, pid, condition):

315

295

"""The checker has completed, so take appropriate actions."""

296

now = datetime.datetime.now()

316

297

self.checker_callback_tag = None

317

298

self.checker = None

318

if self.use_dbus:

319

# Emit D-Bus signal

320

self.PropertyChanged(dbus.String(u"checker_running"),

321

dbus.Boolean(False, variant_level=1))

322

if (os.WIFEXITED(condition)

323

and (os.WEXITSTATUS(condition) == 0)):

299

if os.WIFEXITED(condition) \

300

and (os.WEXITSTATUS(condition) == 0):

324

301

logger.info(u"Checker for %(name)s succeeded",

325

302

vars(self))

326

if self.use_dbus:

327

# Emit D-Bus signal

328

self.CheckerCompleted(dbus.Boolean(True),

329

dbus.UInt16(condition),

330

dbus.String(command))

331

self.bump_timeout()

303

self.last_checked_ok = now

304

gobject.source_remove(self.stop_initiator_tag)

305

self.stop_initiator_tag = gobject.timeout_add\

306

(self._timeout_milliseconds,

307

self.stop)

332

308

elif not os.WIFEXITED(condition):

333

309

logger.warning(u"Checker for %(name)s crashed?",

334

310

vars(self))

335

if self.use_dbus:

336

# Emit D-Bus signal

337

self.CheckerCompleted(dbus.Boolean(False),

338

dbus.UInt16(condition),

339

dbus.String(command))

340

311

else:

341

312

logger.info(u"Checker for %(name)s failed",

342

313

vars(self))

343

if self.use_dbus:

344

# Emit D-Bus signal

345

self.CheckerCompleted(dbus.Boolean(False),

346

dbus.UInt16(condition),

347

dbus.String(command))

348

349

def bump_timeout(self):

350

"""Bump up the timeout for this client.

351

This should only be called when the client has been seen,

352

alive and well.

353

"""

354

self.last_checked_ok = datetime.datetime.utcnow()

355

gobject.source_remove(self.disable_initiator_tag)

356

self.disable_initiator_tag = (gobject.timeout_add

357

(self.timeout_milliseconds(),

358

self.disable))

359

if self.use_dbus:

360

# Emit D-Bus signal

361

self.PropertyChanged(

362

dbus.String(u"last_checked_ok"),

363

(_datetime_to_dbus(self.last_checked_ok,

364

variant_level=1)))

365

366

314

def start_checker(self):

367

315

"""Start a new checker subprocess if one is not running.

368

316

If a checker already exists, leave it running and do

377

325

# is as it should be.

378

326

if self.checker is None:

379

327

try:

380

# In case checker_command has exactly one % operator

381

command = self.checker_command % self.host

328

# In case check_command has exactly one % operator

329

command = self.check_command % self.host

382

330

except TypeError:

383

331

# Escape attributes for the shell

384

332

escaped_attrs = dict((key, re.escape(str(val)))

385

333

for key, val in

386

334

vars(self).iteritems())

387

335

try:

388

command = self.checker_command % escaped_attrs

336

command = self.check_command % escaped_attrs

389

337

except TypeError, error:

390

338

logger.error(u'Could not format string "%s":'

391

u' %s', self.checker_command, error)

339

u' %s', self.check_command, error)

392

340

return True # Try again later

393

341

try:

394

342

logger.info(u"Starting checker %r for %s",

400

348

self.checker = subprocess.Popen(command,

401

349

close_fds=True,

402

350

shell=True, cwd="/")

403

if self.use_dbus:

404

# Emit D-Bus signal

405

self.CheckerStarted(command)

406

self.PropertyChanged(

407

dbus.String("checker_running"),

408

dbus.Boolean(True, variant_level=1))

409

self.checker_callback_tag = (gobject.child_watch_add

410

(self.checker.pid,

411

self.checker_callback,

412

data=command))

351

self.checker_callback_tag = gobject.child_watch_add\

352

(self.checker.pid,

353

self.checker_callback)

413

354

except OSError, error:

414

355

logger.error(u"Failed to start subprocess: %s",

415

356

error)

416

357

# Re-run this periodically if run by gobject.timeout_add

417

358

return True

418

419

359

def stop_checker(self):

420

360

"""Force the checker process, if any, to stop."""

421

361

if self.checker_callback_tag:

433

373

if error.errno != errno.ESRCH: # No such process

434

374

raise

435

375

self.checker = None

436

if self.use_dbus:

437

self.PropertyChanged(dbus.String(u"checker_running"),

438

dbus.Boolean(False, variant_level=1))

439

440

376

def still_valid(self):

441

377

"""Has the timeout not yet passed for this client?"""

442

if not getattr(self, "enabled", False):

443

return False

444

now = datetime.datetime.utcnow()

378

now = datetime.datetime.now()

445

379

if self.last_checked_ok is None:

446

380

return now < (self.created + self.timeout)

447

381

else:

448

382

return now < (self.last_checked_ok + self.timeout)

449

450

## D-Bus methods & signals

451

_interface = u"org.mandos_system.Mandos.Client"

452

453

# BumpTimeout - method

454

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

455

BumpTimeout.__name__ = "BumpTimeout"

456

457

# CheckerCompleted - signal

458

@dbus.service.signal(_interface, signature="bqs")

459

def CheckerCompleted(self, success, condition, command):

460

"D-Bus signal"

461

pass

462

463

# CheckerStarted - signal

464

@dbus.service.signal(_interface, signature="s")

465

def CheckerStarted(self, command):

466

"D-Bus signal"

467

pass

468

469

# GetAllProperties - method

470

@dbus.service.method(_interface, out_signature="a{sv}")

471

def GetAllProperties(self):

472

"D-Bus method"

473

return dbus.Dictionary({

474

dbus.String("name"):

475

dbus.String(self.name, variant_level=1),

476

dbus.String("fingerprint"):

477

dbus.String(self.fingerprint, variant_level=1),

478

dbus.String("host"):

479

dbus.String(self.host, variant_level=1),

480

dbus.String("created"):

481

_datetime_to_dbus(self.created, variant_level=1),

482

dbus.String("last_enabled"):

483

(_datetime_to_dbus(self.last_enabled,

484

variant_level=1)

485

if self.last_enabled is not None

486

else dbus.Boolean(False, variant_level=1)),

487

dbus.String("enabled"):

488

dbus.Boolean(self.enabled, variant_level=1),

489

dbus.String("last_checked_ok"):

490

(_datetime_to_dbus(self.last_checked_ok,

491

variant_level=1)

492

if self.last_checked_ok is not None

493

else dbus.Boolean (False, variant_level=1)),

494

dbus.String("timeout"):

495

dbus.UInt64(self.timeout_milliseconds(),

496

variant_level=1),

497

dbus.String("interval"):

498

dbus.UInt64(self.interval_milliseconds(),

499

variant_level=1),

500

dbus.String("checker"):

501

dbus.String(self.checker_command,

502

variant_level=1),

503

dbus.String("checker_running"):

504

dbus.Boolean(self.checker is not None,

505

variant_level=1),

506

}, signature="sv")

507

508

# IsStillValid - method

509

IsStillValid = (dbus.service.method(_interface, out_signature="b")

510

(still_valid))

511

IsStillValid.__name__ = "IsStillValid"

512

513

# PropertyChanged - signal

514

@dbus.service.signal(_interface, signature="sv")

515

def PropertyChanged(self, property, value):

516

"D-Bus signal"

517

pass

518

519

# SetChecker - method

520

@dbus.service.method(_interface, in_signature="s")

521

def SetChecker(self, checker):

522

"D-Bus setter method"

523

self.checker_command = checker

524

# Emit D-Bus signal

525

self.PropertyChanged(dbus.String(u"checker"),

526

dbus.String(self.checker_command,

527

variant_level=1))

528

529

# SetHost - method

530

@dbus.service.method(_interface, in_signature="s")

531

def SetHost(self, host):

532

"D-Bus setter method"

533

self.host = host

534

# Emit D-Bus signal

535

self.PropertyChanged(dbus.String(u"host"),

536

dbus.String(self.host, variant_level=1))

537

538

# SetInterval - method

539

@dbus.service.method(_interface, in_signature="t")

540

def SetInterval(self, milliseconds):

541

self.interval = datetime.timedelta(0, 0, 0, milliseconds)

542

# Emit D-Bus signal

543

self.PropertyChanged(dbus.String(u"interval"),

544

(dbus.UInt64(self.interval_milliseconds(),

545

variant_level=1)))

546

547

# SetSecret - method

548

@dbus.service.method(_interface, in_signature="ay",

549

byte_arrays=True)

550

def SetSecret(self, secret):

551

"D-Bus setter method"

552

self.secret = str(secret)

553

554

# SetTimeout - method

555

@dbus.service.method(_interface, in_signature="t")

556

def SetTimeout(self, milliseconds):

557

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

558

# Emit D-Bus signal

559

self.PropertyChanged(dbus.String(u"timeout"),

560

(dbus.UInt64(self.timeout_milliseconds(),

561

variant_level=1)))

562

563

# Enable - method

564

Enable = dbus.service.method(_interface)(enable)

565

Enable.__name__ = "Enable"

566

567

# StartChecker - method

568

@dbus.service.method(_interface)

569

def StartChecker(self):

570

"D-Bus method"

571

self.start_checker()

572

573

# Disable - method

574

@dbus.service.method(_interface)

575

def Disable(self):

576

"D-Bus method"

577

self.disable()

578

579

# StopChecker - method

580

StopChecker = dbus.service.method(_interface)(stop_checker)

581

StopChecker.__name__ = "StopChecker"

582

583

del _interface

584

383

585

384

586

385

def peer_certificate(session):

587

386

"Return the peer's OpenPGP certificate as a bytestring"

588

387

# If not an OpenPGP certificate...

589

if (gnutls.library.functions

590

.gnutls_certificate_type_get(session._c_object)

591

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

388

if gnutls.library.functions.gnutls_certificate_type_get\

389

(session._c_object) \

390

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

592

391

# ...do the normal thing

593

392

return session.peer_certificate

594

393

list_size = ctypes.c_uint()

595

cert_list = (gnutls.library.functions

596

.gnutls_certificate_get_peers

597

(session._c_object, ctypes.byref(list_size)))

394

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

395

(session._c_object, ctypes.byref(list_size))

598

396

if list_size.value == 0:

599

397

return None

600

398

cert = cert_list[0]

604

402

def fingerprint(openpgp):

605

403

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

606

404

# New GnuTLS "datum" with the OpenPGP public key

607

datum = (gnutls.library.types

608

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

609

ctypes.POINTER

610

(ctypes.c_ubyte)),

611

ctypes.c_uint(len(openpgp))))

405

datum = gnutls.library.types.gnutls_datum_t\

406

(ctypes.cast(ctypes.c_char_p(openpgp),

407

ctypes.POINTER(ctypes.c_ubyte)),

408

ctypes.c_uint(len(openpgp)))

612

409

# New empty GnuTLS certificate

613

410

crt = gnutls.library.types.gnutls_openpgp_crt_t()

614

(gnutls.library.functions

615

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

411

gnutls.library.functions.gnutls_openpgp_crt_init\

412

(ctypes.byref(crt))

616

413

# Import the OpenPGP public key into the certificate

617

(gnutls.library.functions

618

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

619

gnutls.library.constants

620

.GNUTLS_OPENPGP_FMT_RAW))

414

gnutls.library.functions.gnutls_openpgp_crt_import\

415

(crt, ctypes.byref(datum),

416

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

621

417

# Verify the self signature in the key

622

crtverify = ctypes.c_uint()

623

(gnutls.library.functions

624

.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))

418

crtverify = ctypes.c_uint();

419

gnutls.library.functions.gnutls_openpgp_crt_verify_self\

420

(crt, 0, ctypes.byref(crtverify))

625

421

if crtverify.value != 0:

626

422

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

627

423

raise gnutls.errors.CertificateSecurityError("Verify failed")

628

424

# New buffer for the fingerprint

629

buf = ctypes.create_string_buffer(20)

630

buf_len = ctypes.c_size_t()

425

buffer = ctypes.create_string_buffer(20)

426

buffer_length = ctypes.c_size_t()

631

427

# Get the fingerprint from the certificate into the buffer

632

(gnutls.library.functions

633

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

634

ctypes.byref(buf_len)))

428

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

429

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

635

430

# Deinit the certificate

636

431

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

637

432

# Convert the buffer to a Python bytestring

638

fpr = ctypes.string_at(buf, buf_len.value)

433

fpr = ctypes.string_at(buffer, buffer_length.value)

639

434

# Convert the bytestring to hexadecimal notation

640

435

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

641

436

return hex_fpr

642

437

643

438

644

class TCP_handler(SocketServer.BaseRequestHandler, object):

439

class tcp_handler(SocketServer.BaseRequestHandler, object):

645

440

"""A TCP request handler class.

646

441

Instantiated by IPv6_TCPServer for each request to handle it.

647

442

Note: This will run in its own forked process."""

648

443

649

444

def handle(self):

650

445

logger.info(u"TCP connection from: %s",

651

unicode(self.client_address))

652

session = (gnutls.connection

653

.ClientSession(self.request,

654

gnutls.connection

655

.X509Credentials()))

446

unicode(self.client_address))

447

session = gnutls.connection.ClientSession\

448

(self.request, gnutls.connection.X509Credentials())

656

449

657

450

line = self.request.makefile().readline()

658

451

logger.debug(u"Protocol version: %r", line)

671

464

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

672

465

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

673

466

# "+DHE-DSS"))

674

# Use a fallback default, since this MUST be set.

675

priority = self.server.settings.get("priority", "NORMAL")

676

(gnutls.library.functions

677

.gnutls_priority_set_direct(session._c_object,

678

priority, None))

467

priority = "NORMAL" # Fallback default, since this

468

# MUST be set.

469

if self.server.settings["priority"]:

470

priority = self.server.settings["priority"]

471

gnutls.library.functions.gnutls_priority_set_direct\

472

(session._c_object, priority, None);

679

473

680

474

try:

681

475

session.handshake()

691

485

session.bye()

692

486

return

693

487

logger.debug(u"Fingerprint: %s", fpr)

488

client = None

694

489

for c in self.server.clients:

695

490

if c.fingerprint == fpr:

696

491

client = c

697

492

break

698

else:

493

if not client:

699

494

logger.warning(u"Client not found for fingerprint: %s",

700

495

fpr)

701

496

session.bye()

708

503

vars(client))

709

504

session.bye()

710

505

return

711

## This won't work here, since we're in a fork.

712

# client.bump_timeout()

713

506

sent_size = 0

714

507

while sent_size < len(client.secret):

715

508

sent = session.send(client.secret[sent_size:])

720

513

session.bye()

721

514

722

515

723

class IPv6_TCPServer(SocketServer.ForkingMixIn,

724

SocketServer.TCPServer, object):

516

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

725

517

"""IPv6 TCP server. Accepts 'None' as address and/or port.

726

518

Attributes:

727

519

settings: Server settings

737

529

self.clients = kwargs["clients"]

738

530

del kwargs["clients"]

739

531

self.enabled = False

740

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

532

return super(type(self), self).__init__(*args, **kwargs)

741

533

def server_bind(self):

742

534

"""This overrides the normal server_bind() function

743

535

to bind to an interface if one was specified, and also NOT to

772

564

# if_nametoindex

773

565

# (self.settings

774

566

# ["interface"]))

775

return super(IPv6_TCPServer, self).server_bind()

567

return super(type(self), self).server_bind()

776

568

def server_activate(self):

777

569

if self.enabled:

778

return super(IPv6_TCPServer, self).server_activate()

570

return super(type(self), self).server_activate()

779

571

def enable(self):

780

572

self.enabled = True

781

573

799

591

timevalue = datetime.timedelta(0)

800

592

for s in interval.split():

801

593

try:

802

suffix = unicode(s[-1])

803

value = int(s[:-1])

594

suffix=unicode(s[-1])

595

value=int(s[:-1])

804

596

if suffix == u"d":

805

597

delta = datetime.timedelta(value)

806

598

elif suffix == u"s":

840

632

elif state == avahi.ENTRY_GROUP_FAILURE:

841

633

logger.critical(u"Avahi: Error in group state changed %s",

842

634

unicode(error))

843

raise AvahiGroupError(u"State changed: %s" % unicode(error))

635

raise AvahiGroupError("State changed: %s", str(error))

844

636

845

637

def if_nametoindex(interface):

846

638

"""Call the C function if_nametoindex(), or equivalent"""

847

639

global if_nametoindex

848

640

try:

849

if_nametoindex = (ctypes.cdll.LoadLibrary

850

(ctypes.util.find_library("c"))

851

.if_nametoindex)

641

if "ctypes.util" not in sys.modules:

642

import ctypes.util

643

if_nametoindex = ctypes.cdll.LoadLibrary\

644

(ctypes.util.find_library("c")).if_nametoindex

852

645

except (OSError, AttributeError):

853

646

if "struct" not in sys.modules:

854

647

import struct

857

650

def if_nametoindex(interface):

858

651

"Get an interface index the hard way, i.e. using fcntl()"

859

652

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

860

with closing(socket.socket()) as s:

861

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

862

struct.pack("16s16x", interface))

653

s = socket.socket()

654

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

655

struct.pack("16s16x", interface))

656

s.close()

863

657

interface_index = struct.unpack("I", ifreq[16:20])[0]

864

658

return interface_index

865

659

return if_nametoindex(interface)

889

683

890

684

891

685

def main():

686

global main_loop_started

687

main_loop_started = False

688

892

689

parser = OptionParser(version = "%%prog %s" % version)

893

690

parser.add_option("-i", "--interface", type="string",

894

691

metavar="IF", help="Bind to interface IF")

896

693

help="Address to listen for requests on")

897

694

parser.add_option("-p", "--port", type="int",

898

695

help="Port number to receive requests on")

899

parser.add_option("--check", action="store_true",

696

parser.add_option("--check", action="store_true", default=False,

900

697

help="Run self-test")

901

698

parser.add_option("--debug", action="store_true",

902

699

help="Debug mode; run in foreground and log to"

909

706

default="/etc/mandos", metavar="DIR",

910

707

help="Directory to search for configuration"

911

708

" files")

912

parser.add_option("--no-dbus", action="store_false",

913

dest="use_dbus",

914

help="Do not provide D-Bus system bus"

915

" interface")

916

options = parser.parse_args()[0]

709

(options, args) = parser.parse_args()

917

710

918

711

if options.check:

919

712

import doctest

928

721

"priority":

929

722

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

930

723

"servicename": "Mandos",

931

"use_dbus": "True",

932

724

}

933

725

934

726

# Parse config file for server-global settings

937

729

server_config.read(os.path.join(options.configdir, "mandos.conf"))

938

730

# Convert the SafeConfigParser object to a dict

939

731

server_settings = server_config.defaults()

940

# Use getboolean on the boolean config options

941

server_settings["debug"] = (server_config.getboolean

942

("DEFAULT", "debug"))

943

server_settings["use_dbus"] = (server_config.getboolean

944

("DEFAULT", "use_dbus"))

732

# Use getboolean on the boolean config option

733

server_settings["debug"] = server_config.getboolean\

734

("DEFAULT", "debug")

945

735

del server_config

946

736

947

737

# Override the settings from the config file with command line

948

738

# options, if set.

949

739

for option in ("interface", "address", "port", "debug",

950

"priority", "servicename", "configdir",

951

"use_dbus"):

740

"priority", "servicename", "configdir"):

952

741

value = getattr(options, option)

953

742

if value is not None:

954

743

server_settings[option] = value

955

744

del options

956

745

# Now we have our good server settings in "server_settings"

957

746

958

# For convenience

959

747

debug = server_settings["debug"]

960

use_dbus = server_settings["use_dbus"]

961

748

962

749

if not debug:

963

750

syslogger.setLevel(logging.WARNING)

964

751

console.setLevel(logging.WARNING)

965

752

966

753

if server_settings["servicename"] != "Mandos":

967

syslogger.setFormatter(logging.Formatter

754

syslogger.setFormatter(logging.Formatter\

968

755

('Mandos (%s): %%(levelname)s:'

969

756

' %%(message)s'

970

757

% server_settings["servicename"]))

982

769

clients = Set()

983

770

tcp_server = IPv6_TCPServer((server_settings["address"],

984

771

server_settings["port"]),

985

TCP_handler,

772

tcp_handler,

986

773

settings=server_settings,

987

774

clients=clients)

988

775

pidfilename = "/var/run/mandos.pid"

991

778

except IOError, error:

992

779

logger.error("Could not open file %r", pidfilename)

993

780

994

try:

995

uid = pwd.getpwnam("_mandos").pw_uid

996

except KeyError:

997

try:

998

uid = pwd.getpwnam("mandos").pw_uid

999

except KeyError:

1000

try:

1001

uid = pwd.getpwnam("nobody").pw_uid

1002

except KeyError:

1003

uid = 65534

1004

try:

1005

gid = pwd.getpwnam("_mandos").pw_gid

1006

except KeyError:

1007

try:

1008

gid = pwd.getpwnam("mandos").pw_gid

1009

except KeyError:

1010

try:

1011

gid = pwd.getpwnam("nogroup").pw_gid

1012

except KeyError:

1013

gid = 65534

781

uid = 65534

782

gid = 65534

783

try:

784

uid = pwd.getpwnam("mandos").pw_uid

785

except KeyError:

786

try:

787

uid = pwd.getpwnam("nobody").pw_uid

788

except KeyError:

789

pass

790

try:

791

gid = pwd.getpwnam("mandos").pw_gid

792

except KeyError:

793

try:

794

gid = pwd.getpwnam("nogroup").pw_gid

795

except KeyError:

796

pass

1014

797

try:

1015

798

os.setuid(uid)

1016

799

os.setgid(gid)

1020

803

1021

804

global service

1022

805

service = AvahiService(name = server_settings["servicename"],

1023

servicetype = "_mandos._tcp", )

806

type = "_mandos._tcp", );

1024

807

if server_settings["interface"]:

1025

service.interface = (if_nametoindex

1026

(server_settings["interface"]))

808

service.interface = if_nametoindex\

809

(server_settings["interface"])

1027

810

1028

811

global main_loop

1029

812

global bus

1036

819

avahi.DBUS_PATH_SERVER),

1037

820

avahi.DBUS_INTERFACE_SERVER)

1038

821

# End of Avahi example code

1039

if use_dbus:

1040

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",

1041

bus)

822

823

def remove_from_clients(client):

824

clients.remove(client)

825

if not clients:

826

logger.critical(u"No clients left, exiting")

827

sys.exit()

1042

828

1043

829

clients.update(Set(Client(name = section,

830

stop_hook = remove_from_clients,

1044

831

config

1045

= dict(client_config.items(section)),

1046

use_dbus = use_dbus)

832

= dict(client_config.items(section)))

1047

833

for section in client_config.sections()))

1048

834

if not clients:

1049

logger.warning(u"No clients defined")

835

logger.critical(u"No clients defined")

836

sys.exit(1)

1050

837

1051

838

if debug:

1052

839

# Redirect stdin so all checkers get /dev/null

1065

852

pidfile.write(str(pid) + "\n")

1066

853

pidfile.close()

1067

854

del pidfile

1068

except IOError:

855

except IOError, err:

1069

856

logger.error(u"Could not write to file %r with PID %d",

1070

857

pidfilename, pid)

1071

858

except NameError:

1084

871

1085

872

while clients:

1086

873

client = clients.pop()

1087

client.disable_hook = None

1088

client.disable()

874

client.stop_hook = None

875

client.stop()

1089

876

1090

877

atexit.register(cleanup)

1091

878

1094

881

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1095

882

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1096

883

1097

if use_dbus:

1098

class MandosServer(dbus.service.Object):

1099

"""A D-Bus proxy object"""

1100

def __init__(self):

1101

dbus.service.Object.__init__(self, bus,

1102

"/Mandos")

1103

_interface = u"org.mandos_system.Mandos"

1104

1105

@dbus.service.signal(_interface, signature="oa{sv}")

1106

def ClientAdded(self, objpath, properties):

1107

"D-Bus signal"

1108

pass

1109

1110

@dbus.service.signal(_interface, signature="o")

1111

def ClientRemoved(self, objpath):

1112

"D-Bus signal"

1113

pass

1114

1115

@dbus.service.method(_interface, out_signature="ao")

1116

def GetAllClients(self):

1117

return dbus.Array(c.dbus_object_path for c in clients)

1118

1119

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1120

def GetAllClientsWithProperties(self):

1121

return dbus.Dictionary(

1122

((c.dbus_object_path, c.GetAllProperties())

1123

for c in clients),

1124

signature="oa{sv}")

1125

1126

@dbus.service.method(_interface, in_signature="o")

1127

def RemoveClient(self, object_path):

1128

for c in clients:

1129

if c.dbus_object_path == object_path:

1130

clients.remove(c)

1131

# Don't signal anything except ClientRemoved

1132

c.use_dbus = False

1133

c.disable()

1134

# Emit D-Bus signal

1135

self.ClientRemoved(object_path)

1136

return

1137

raise KeyError

1138

@dbus.service.method(_interface)

1139

def Quit(self):

1140

main_loop.quit()

1141

1142

del _interface

1143

1144

mandos_server = MandosServer()

1145

1146

884

for client in clients:

1147

if use_dbus:

1148

# Emit D-Bus signal

1149

mandos_server.ClientAdded(client.dbus_object_path,

1150

client.GetAllProperties())

1151

client.enable()

885

client.start()

1152

886

1153

887

tcp_server.enable()

1154

888

tcp_server.server_activate()

1172

906

1173

907

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

1174

908

lambda *args, **kwargs:

1175

(tcp_server.handle_request

1176

(*args[2:], **kwargs) or True))

909

tcp_server.handle_request\

910

(*args[2:], **kwargs) or True)

1177

911

1178

912

logger.debug(u"Starting main loop")

913

main_loop_started = True

1179

914

main_loop.run()

1180

915

except AvahiError, error:

1181

logger.critical(u"AvahiError: %s", error)

916

logger.critical(u"AvahiError: %s" + unicode(error))

1182

917

sys.exit(1)

1183

918

except KeyboardInterrupt:

1184

919

if debug: