To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 222
- compare with another revision
- download diff
- download tarball
- view history from revision 222
- Committer: Teddy Hogeborn
- Date: 2008-10-01 18:41:06 UTC
- Revision ID: teddy@fukt.bsnet.se-20081001184106-r728au6iv0lq8orm
Tags: version-1.0-2
* debian/changelog: Add Debian revision number to old revision too.
- files removed:
- NEWS
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008 Teddy Hogeborn
15
# Copyright © 2008 Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import division, with_statement, absolute_import
33
from __future__ import division
35
34
36
35
import SocketServer
37
36
import socket
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
59
from contextlib import closing
60
58
61
59
import dbus
62
import dbus.service
63
60
import gobject
64
61
import avahi
65
62
from dbus.mainloop.glib import DBusGMainLoop
66
63
import ctypes
67
64
import ctypes.util
68
65
69
version = "1.0.2"
66
version = "1.0"
70
67
71
68
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
77
74
logger.addHandler(syslogger)
78
75
79
76
console = logging.StreamHandler()
112
109
a sensible number of times
113
110
"""
114
111
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
112
servicetype = None, port = None, TXT = None, domain = "",
113
host = "", max_renames = 32768):
117
114
self.interface = interface
118
115
self.name = name
119
116
self.type = servicetype
120
117
self.port = port
121
self.TXT = TXT if TXT is not None else []
118
if TXT is None:
119
self.TXT = []
120
else:
121
self.TXT = TXT
122
122
self.domain = domain
123
123
self.host = host
124
124
self.rename_count = 0
133
133
self.name = server.GetAlternativeServiceName(self.name)
134
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
136
syslogger.setFormatter(logging.Formatter\
137
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
138
' %%(message)s' % self.name))
139
139
self.remove()
140
140
self.add()
141
141
self.rename_count += 1
147
147
"""Derived from the Avahi example code"""
148
148
global group
149
149
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
150
group = dbus.Interface\
151
(bus.get_object(avahi.DBUS_NAME,
152
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
154
group.connect_to_signal('StateChanged',
155
155
entry_group_state_changed)
156
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
170
170
# End of Avahi example code
171
171
172
172
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
173
class Client(object):
179
174
"""A representation of a client host served by this server.
180
175
Attributes:
181
name: string; from the config file, used in log messages
176
name: string; from the config file, used in log messages
182
177
fingerprint: string (40 or 32 hexadecimal digits); used to
183
178
uniquely identify the client
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
179
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); object creation, not client host
182
last_checked_ok: datetime.datetime() or None if not yet checked OK
183
timeout: datetime.timedelta(); How long from last_checked_ok
184
until this client is invalid
185
interval: datetime.timedelta(); How often to start a new checker
186
stop_hook: If set, called by stop() as stop_hook(self)
187
checker: subprocess.Popen(); a running checker process used
188
to see if the client lives.
189
'None' if no process is running.
197
190
checker_initiator_tag: a gobject event source tag, or None
198
disable_initiator_tag: - '' -
191
stop_initiator_tag: - '' -
199
192
checker_callback_tag: - '' -
200
193
checker_command: string; External command which is run to check if
201
194
client lives. %() expansions are done at
202
195
runtime with vars(self) as dict, so that for
203
196
instance %(name)s can be used in the command.
204
dbus_object_path: dbus.ObjectPath
205
197
Private attibutes:
206
198
_timeout: Real variable for 'timeout'
207
199
_interval: Real variable for 'interval'
209
201
_interval_milliseconds: - '' -
210
202
"""
211
203
def _set_timeout(self, timeout):
212
"Setter function for the 'timeout' attribute"
204
"Setter function for 'timeout' attribute"
213
205
self._timeout = timeout
214
206
self._timeout_milliseconds = ((self.timeout.days
215
207
* 24 * 60 * 60 * 1000)
216
208
+ (self.timeout.seconds * 1000)
217
209
+ (self.timeout.microseconds
218
210
// 1000))
219
# Emit D-Bus signal
220
self.PropertyChanged(dbus.String(u"timeout"),
221
(dbus.UInt64(self._timeout_milliseconds,
222
variant_level=1)))
223
timeout = property(lambda self: self._timeout, _set_timeout)
211
timeout = property(lambda self: self._timeout,
212
_set_timeout)
224
213
del _set_timeout
225
226
214
def _set_interval(self, interval):
227
"Setter function for the 'interval' attribute"
215
"Setter function for 'interval' attribute"
228
216
self._interval = interval
229
217
self._interval_milliseconds = ((self.interval.days
230
218
* 24 * 60 * 60 * 1000)
232
220
* 1000)
233
221
+ (self.interval.microseconds
234
222
// 1000))
235
# Emit D-Bus signal
236
self.PropertyChanged(dbus.String(u"interval"),
237
(dbus.UInt64(self._interval_milliseconds,
238
variant_level=1)))
239
interval = property(lambda self: self._interval, _set_interval)
223
interval = property(lambda self: self._interval,
224
_set_interval)
240
225
del _set_interval
241
242
def __init__(self, name = None, disable_hook=None, config=None):
226
def __init__(self, name = None, stop_hook=None, config=None):
243
227
"""Note: the 'checker' key in 'config' sets the
244
228
'checker_command' attribute and *not* the 'checker'
245
229
attribute."""
246
self.dbus_object_path = (dbus.ObjectPath
247
("/Mandos/clients/"
248
+ name.replace(".", "_")))
249
dbus.service.Object.__init__(self, bus,
250
self.dbus_object_path)
251
230
if config is None:
252
231
config = {}
253
232
self.name = name
255
234
# Uppercase and remove spaces from fingerprint for later
256
235
# comparison purposes with return value from the fingerprint()
257
236
# function
258
self.fingerprint = (config["fingerprint"].upper()
259
.replace(u" ", u""))
237
self.fingerprint = config["fingerprint"].upper()\
238
.replace(u" ", u"")
260
239
logger.debug(u" Fingerprint: %s", self.fingerprint)
261
240
if "secret" in config:
262
241
self.secret = config["secret"].decode(u"base64")
263
242
elif "secfile" in config:
264
with closing(open(os.path.expanduser
265
(os.path.expandvars
266
(config["secfile"])))) as secfile:
267
self.secret = secfile.read()
243
secfile = open(config["secfile"])
244
self.secret = secfile.read()
245
secfile.close()
268
246
else:
269
247
raise TypeError(u"No secret or secfile for client %s"
270
248
% self.name)
271
249
self.host = config.get("host", "")
272
self.created = datetime.datetime.utcnow()
273
self.enabled = False
274
self.last_enabled = None
250
self.created = datetime.datetime.now()
275
251
self.last_checked_ok = None
276
252
self.timeout = string_to_delta(config["timeout"])
277
253
self.interval = string_to_delta(config["interval"])
278
self.disable_hook = disable_hook
254
self.stop_hook = stop_hook
279
255
self.checker = None
280
256
self.checker_initiator_tag = None
281
self.disable_initiator_tag = None
257
self.stop_initiator_tag = None
282
258
self.checker_callback_tag = None
283
self.checker_command = config["checker"]
284
285
def enable(self):
259
self.check_command = config["checker"]
260
def start(self):
286
261
"""Start this client's checker and timeout hooks"""
287
self.last_enabled = datetime.datetime.utcnow()
288
262
# Schedule a new checker to be started an 'interval' from now,
289
263
# and every interval from then on.
290
self.checker_initiator_tag = (gobject.timeout_add
291
(self._interval_milliseconds,
292
self.start_checker))
264
self.checker_initiator_tag = gobject.timeout_add\
265
(self._interval_milliseconds,
266
self.start_checker)
293
267
# Also start a new checker *right now*.
294
268
self.start_checker()
295
# Schedule a disable() when 'timeout' has passed
296
self.disable_initiator_tag = (gobject.timeout_add
297
(self._timeout_milliseconds,
298
self.disable))
299
self.enabled = True
300
# Emit D-Bus signal
301
self.PropertyChanged(dbus.String(u"enabled"),
302
dbus.Boolean(True, variant_level=1))
303
self.PropertyChanged(dbus.String(u"last_enabled"),
304
(_datetime_to_dbus(self.last_enabled,
305
variant_level=1)))
306
307
def disable(self):
308
"""Disable this client."""
309
if not getattr(self, "enabled", False):
269
# Schedule a stop() when 'timeout' has passed
270
self.stop_initiator_tag = gobject.timeout_add\
271
(self._timeout_milliseconds,
272
self.stop)
273
def stop(self):
274
"""Stop this client.
275
The possibility that a client might be restarted is left open,
276
but not currently used."""
277
# If this client doesn't have a secret, it is already stopped.
278
if hasattr(self, "secret") and self.secret:
279
logger.info(u"Stopping client %s", self.name)
280
self.secret = None
281
else:
310
282
return False
311
logger.info(u"Disabling client %s", self.name)
312
if getattr(self, "disable_initiator_tag", False):
313
gobject.source_remove(self.disable_initiator_tag)
314
self.disable_initiator_tag = None
283
if getattr(self, "stop_initiator_tag", False):
284
gobject.source_remove(self.stop_initiator_tag)
285
self.stop_initiator_tag = None
315
286
if getattr(self, "checker_initiator_tag", False):
316
287
gobject.source_remove(self.checker_initiator_tag)
317
288
self.checker_initiator_tag = None
318
289
self.stop_checker()
319
if self.disable_hook:
320
self.disable_hook(self)
321
self.enabled = False
322
# Emit D-Bus signal
323
self.PropertyChanged(dbus.String(u"enabled"),
324
dbus.Boolean(False, variant_level=1))
290
if self.stop_hook:
291
self.stop_hook(self)
325
292
# Do not run this again if called by a gobject.timeout_add
326
293
return False
327
328
294
def __del__(self):
329
self.disable_hook = None
330
self.disable()
331
332
def checker_callback(self, pid, condition, command):
295
self.stop_hook = None
296
self.stop()
297
def checker_callback(self, pid, condition):
333
298
"""The checker has completed, so take appropriate actions."""
299
now = datetime.datetime.now()
334
300
self.checker_callback_tag = None
335
301
self.checker = None
336
# Emit D-Bus signal
337
self.PropertyChanged(dbus.String(u"checker_running"),
338
dbus.Boolean(False, variant_level=1))
339
if (os.WIFEXITED(condition)
340
and (os.WEXITSTATUS(condition) == 0)):
302
if os.WIFEXITED(condition) \
303
and (os.WEXITSTATUS(condition) == 0):
341
304
logger.info(u"Checker for %(name)s succeeded",
342
305
vars(self))
343
# Emit D-Bus signal
344
self.CheckerCompleted(dbus.Boolean(True),
345
dbus.UInt16(condition),
346
dbus.String(command))
347
self.bump_timeout()
306
self.last_checked_ok = now
307
gobject.source_remove(self.stop_initiator_tag)
308
self.stop_initiator_tag = gobject.timeout_add\
309
(self._timeout_milliseconds,
310
self.stop)
348
311
elif not os.WIFEXITED(condition):
349
312
logger.warning(u"Checker for %(name)s crashed?",
350
313
vars(self))
351
# Emit D-Bus signal
352
self.CheckerCompleted(dbus.Boolean(False),
353
dbus.UInt16(condition),
354
dbus.String(command))
355
314
else:
356
315
logger.info(u"Checker for %(name)s failed",
357
316
vars(self))
358
# Emit D-Bus signal
359
self.CheckerCompleted(dbus.Boolean(False),
360
dbus.UInt16(condition),
361
dbus.String(command))
362
363
def bump_timeout(self):
364
"""Bump up the timeout for this client.
365
This should only be called when the client has been seen,
366
alive and well.
367
"""
368
self.last_checked_ok = datetime.datetime.utcnow()
369
gobject.source_remove(self.disable_initiator_tag)
370
self.disable_initiator_tag = (gobject.timeout_add
371
(self._timeout_milliseconds,
372
self.disable))
373
self.PropertyChanged(dbus.String(u"last_checked_ok"),
374
(_datetime_to_dbus(self.last_checked_ok,
375
variant_level=1)))
376
377
317
def start_checker(self):
378
318
"""Start a new checker subprocess if one is not running.
379
319
If a checker already exists, leave it running and do
388
328
# is as it should be.
389
329
if self.checker is None:
390
330
try:
391
# In case checker_command has exactly one % operator
392
command = self.checker_command % self.host
331
# In case check_command has exactly one % operator
332
command = self.check_command % self.host
393
333
except TypeError:
394
334
# Escape attributes for the shell
395
335
escaped_attrs = dict((key, re.escape(str(val)))
396
336
for key, val in
397
337
vars(self).iteritems())
398
338
try:
399
command = self.checker_command % escaped_attrs
339
command = self.check_command % escaped_attrs
400
340
except TypeError, error:
401
341
logger.error(u'Could not format string "%s":'
402
u' %s', self.checker_command, error)
342
u' %s', self.check_command, error)
403
343
return True # Try again later
404
344
try:
405
345
logger.info(u"Starting checker %r for %s",
411
351
self.checker = subprocess.Popen(command,
412
352
close_fds=True,
413
353
shell=True, cwd="/")
414
# Emit D-Bus signal
415
self.CheckerStarted(command)
416
self.PropertyChanged(dbus.String("checker_running"),
417
dbus.Boolean(True, variant_level=1))
418
self.checker_callback_tag = (gobject.child_watch_add
419
(self.checker.pid,
420
self.checker_callback,
421
data=command))
354
self.checker_callback_tag = gobject.child_watch_add\
355
(self.checker.pid,
356
self.checker_callback)
422
357
except OSError, error:
423
358
logger.error(u"Failed to start subprocess: %s",
424
359
error)
425
360
# Re-run this periodically if run by gobject.timeout_add
426
361
return True
427
428
362
def stop_checker(self):
429
363
"""Force the checker process, if any, to stop."""
430
364
if self.checker_callback_tag:
442
376
if error.errno != errno.ESRCH: # No such process
443
377
raise
444
378
self.checker = None
445
self.PropertyChanged(dbus.String(u"checker_running"),
446
dbus.Boolean(False, variant_level=1))
447
448
379
def still_valid(self):
449
380
"""Has the timeout not yet passed for this client?"""
450
if not getattr(self, "enabled", False):
451
return False
452
now = datetime.datetime.utcnow()
381
now = datetime.datetime.now()
453
382
if self.last_checked_ok is None:
454
383
return now < (self.created + self.timeout)
455
384
else:
456
385
return now < (self.last_checked_ok + self.timeout)
457
458
## D-Bus methods & signals
459
_interface = u"org.mandos_system.Mandos.Client"
460
461
# BumpTimeout - method
462
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
463
BumpTimeout.__name__ = "BumpTimeout"
464
465
# CheckerCompleted - signal
466
@dbus.service.signal(_interface, signature="bqs")
467
def CheckerCompleted(self, success, condition, command):
468
"D-Bus signal"
469
pass
470
471
# CheckerStarted - signal
472
@dbus.service.signal(_interface, signature="s")
473
def CheckerStarted(self, command):
474
"D-Bus signal"
475
pass
476
477
# GetAllProperties - method
478
@dbus.service.method(_interface, out_signature="a{sv}")
479
def GetAllProperties(self):
480
"D-Bus method"
481
return dbus.Dictionary({
482
dbus.String("name"):
483
dbus.String(self.name, variant_level=1),
484
dbus.String("fingerprint"):
485
dbus.String(self.fingerprint, variant_level=1),
486
dbus.String("host"):
487
dbus.String(self.host, variant_level=1),
488
dbus.String("created"):
489
_datetime_to_dbus(self.created, variant_level=1),
490
dbus.String("last_enabled"):
491
(_datetime_to_dbus(self.last_enabled,
492
variant_level=1)
493
if self.last_enabled is not None
494
else dbus.Boolean(False, variant_level=1)),
495
dbus.String("enabled"):
496
dbus.Boolean(self.enabled, variant_level=1),
497
dbus.String("last_checked_ok"):
498
(_datetime_to_dbus(self.last_checked_ok,
499
variant_level=1)
500
if self.last_checked_ok is not None
501
else dbus.Boolean (False, variant_level=1)),
502
dbus.String("timeout"):
503
dbus.UInt64(self._timeout_milliseconds,
504
variant_level=1),
505
dbus.String("interval"):
506
dbus.UInt64(self._interval_milliseconds,
507
variant_level=1),
508
dbus.String("checker"):
509
dbus.String(self.checker_command,
510
variant_level=1),
511
dbus.String("checker_running"):
512
dbus.Boolean(self.checker is not None,
513
variant_level=1),
514
}, signature="sv")
515
516
# IsStillValid - method
517
IsStillValid = (dbus.service.method(_interface, out_signature="b")
518
(still_valid))
519
IsStillValid.__name__ = "IsStillValid"
520
521
# PropertyChanged - signal
522
@dbus.service.signal(_interface, signature="sv")
523
def PropertyChanged(self, property, value):
524
"D-Bus signal"
525
pass
526
527
# SetChecker - method
528
@dbus.service.method(_interface, in_signature="s")
529
def SetChecker(self, checker):
530
"D-Bus setter method"
531
self.checker_command = checker
532
533
# SetHost - method
534
@dbus.service.method(_interface, in_signature="s")
535
def SetHost(self, host):
536
"D-Bus setter method"
537
self.host = host
538
539
# SetInterval - method
540
@dbus.service.method(_interface, in_signature="t")
541
def SetInterval(self, milliseconds):
542
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
543
544
# SetSecret - method
545
@dbus.service.method(_interface, in_signature="ay",
546
byte_arrays=True)
547
def SetSecret(self, secret):
548
"D-Bus setter method"
549
self.secret = str(secret)
550
551
# SetTimeout - method
552
@dbus.service.method(_interface, in_signature="t")
553
def SetTimeout(self, milliseconds):
554
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
555
556
# Enable - method
557
Enable = dbus.service.method(_interface)(enable)
558
Enable.__name__ = "Enable"
559
560
# StartChecker - method
561
@dbus.service.method(_interface)
562
def StartChecker(self):
563
"D-Bus method"
564
self.start_checker()
565
566
# Disable - method
567
@dbus.service.method(_interface)
568
def Disable(self):
569
"D-Bus method"
570
self.disable()
571
572
# StopChecker - method
573
StopChecker = dbus.service.method(_interface)(stop_checker)
574
StopChecker.__name__ = "StopChecker"
575
576
del _interface
577
386
578
387
579
388
def peer_certificate(session):
580
389
"Return the peer's OpenPGP certificate as a bytestring"
581
390
# If not an OpenPGP certificate...
582
if (gnutls.library.functions
583
.gnutls_certificate_type_get(session._c_object)
584
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
391
if gnutls.library.functions.gnutls_certificate_type_get\
392
(session._c_object) \
393
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
585
394
# ...do the normal thing
586
395
return session.peer_certificate
587
396
list_size = ctypes.c_uint()
588
cert_list = (gnutls.library.functions
589
.gnutls_certificate_get_peers
590
(session._c_object, ctypes.byref(list_size)))
397
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
398
(session._c_object, ctypes.byref(list_size))
591
399
if list_size.value == 0:
592
400
return None
593
401
cert = cert_list[0]
597
405
def fingerprint(openpgp):
598
406
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
599
407
# New GnuTLS "datum" with the OpenPGP public key
600
datum = (gnutls.library.types
601
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
602
ctypes.POINTER
603
(ctypes.c_ubyte)),
604
ctypes.c_uint(len(openpgp))))
408
datum = gnutls.library.types.gnutls_datum_t\
409
(ctypes.cast(ctypes.c_char_p(openpgp),
410
ctypes.POINTER(ctypes.c_ubyte)),
411
ctypes.c_uint(len(openpgp)))
605
412
# New empty GnuTLS certificate
606
413
crt = gnutls.library.types.gnutls_openpgp_crt_t()
607
(gnutls.library.functions
608
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
414
gnutls.library.functions.gnutls_openpgp_crt_init\
415
(ctypes.byref(crt))
609
416
# Import the OpenPGP public key into the certificate
610
(gnutls.library.functions
611
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
612
gnutls.library.constants
613
.GNUTLS_OPENPGP_FMT_RAW))
417
gnutls.library.functions.gnutls_openpgp_crt_import\
418
(crt, ctypes.byref(datum),
419
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
614
420
# Verify the self signature in the key
615
421
crtverify = ctypes.c_uint()
616
(gnutls.library.functions
617
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
422
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
423
(crt, 0, ctypes.byref(crtverify))
618
424
if crtverify.value != 0:
619
425
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
620
426
raise gnutls.errors.CertificateSecurityError("Verify failed")
622
428
buf = ctypes.create_string_buffer(20)
623
429
buf_len = ctypes.c_size_t()
624
430
# Get the fingerprint from the certificate into the buffer
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
627
ctypes.byref(buf_len)))
431
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
432
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
628
433
# Deinit the certificate
629
434
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
630
435
# Convert the buffer to a Python bytestring
641
446
642
447
def handle(self):
643
448
logger.info(u"TCP connection from: %s",
644
unicode(self.client_address))
645
session = (gnutls.connection
646
.ClientSession(self.request,
647
gnutls.connection
648
.X509Credentials()))
449
unicode(self.client_address))
450
session = gnutls.connection.ClientSession\
451
(self.request, gnutls.connection.X509Credentials())
649
452
650
453
line = self.request.makefile().readline()
651
454
logger.debug(u"Protocol version: %r", line)
664
467
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
665
468
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
666
469
# "+DHE-DSS"))
667
# Use a fallback default, since this MUST be set.
668
priority = self.server.settings.get("priority", "NORMAL")
669
(gnutls.library.functions
670
.gnutls_priority_set_direct(session._c_object,
671
priority, None))
470
priority = "NORMAL" # Fallback default, since this
471
# MUST be set.
472
if self.server.settings["priority"]:
473
priority = self.server.settings["priority"]
474
gnutls.library.functions.gnutls_priority_set_direct\
475
(session._c_object, priority, None)
672
476
673
477
try:
674
478
session.handshake()
684
488
session.bye()
685
489
return
686
490
logger.debug(u"Fingerprint: %s", fpr)
491
client = None
687
492
for c in self.server.clients:
688
493
if c.fingerprint == fpr:
689
494
client = c
690
495
break
691
else:
496
if not client:
692
497
logger.warning(u"Client not found for fingerprint: %s",
693
498
fpr)
694
499
session.bye()
701
506
vars(client))
702
507
session.bye()
703
508
return
704
## This won't work here, since we're in a fork.
705
# client.bump_timeout()
706
509
sent_size = 0
707
510
while sent_size < len(client.secret):
708
511
sent = session.send(client.secret[sent_size:])
713
516
session.bye()
714
517
715
518
716
class IPv6_TCPServer(SocketServer.ForkingMixIn,
717
SocketServer.TCPServer, object):
519
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
718
520
"""IPv6 TCP server. Accepts 'None' as address and/or port.
719
521
Attributes:
720
522
settings: Server settings
839
641
"""Call the C function if_nametoindex(), or equivalent"""
840
642
global if_nametoindex
841
643
try:
842
if_nametoindex = (ctypes.cdll.LoadLibrary
843
(ctypes.util.find_library("c"))
844
.if_nametoindex)
644
if_nametoindex = ctypes.cdll.LoadLibrary\
645
(ctypes.util.find_library("c")).if_nametoindex
845
646
except (OSError, AttributeError):
846
647
if "struct" not in sys.modules:
847
648
import struct
850
651
def if_nametoindex(interface):
851
652
"Get an interface index the hard way, i.e. using fcntl()"
852
653
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
853
with closing(socket.socket()) as s:
854
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
855
struct.pack("16s16x", interface))
654
s = socket.socket()
655
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
656
struct.pack("16s16x", interface))
657
s.close()
856
658
interface_index = struct.unpack("I", ifreq[16:20])[0]
857
659
return interface_index
858
660
return if_nametoindex(interface)
926
728
# Convert the SafeConfigParser object to a dict
927
729
server_settings = server_config.defaults()
928
730
# Use getboolean on the boolean config option
929
server_settings["debug"] = (server_config.getboolean
930
("DEFAULT", "debug"))
731
server_settings["debug"] = server_config.getboolean\
732
("DEFAULT", "debug")
931
733
del server_config
932
734
933
735
# Override the settings from the config file with command line
947
749
console.setLevel(logging.WARNING)
948
750
949
751
if server_settings["servicename"] != "Mandos":
950
syslogger.setFormatter(logging.Formatter
752
syslogger.setFormatter(logging.Formatter\
951
753
('Mandos (%s): %%(levelname)s:'
952
754
' %%(message)s'
953
755
% server_settings["servicename"]))
974
776
except IOError, error:
975
777
logger.error("Could not open file %r", pidfilename)
976
778
977
try:
978
uid = pwd.getpwnam("_mandos").pw_uid
979
except KeyError:
980
try:
981
uid = pwd.getpwnam("mandos").pw_uid
982
except KeyError:
983
try:
984
uid = pwd.getpwnam("nobody").pw_uid
985
except KeyError:
986
uid = 65534
987
try:
988
gid = pwd.getpwnam("_mandos").pw_gid
989
except KeyError:
990
try:
991
gid = pwd.getpwnam("mandos").pw_gid
992
except KeyError:
993
try:
994
gid = pwd.getpwnam("nogroup").pw_gid
995
except KeyError:
996
gid = 65534
779
uid = 65534
780
gid = 65534
781
try:
782
uid = pwd.getpwnam("mandos").pw_uid
783
except KeyError:
784
try:
785
uid = pwd.getpwnam("nobody").pw_uid
786
except KeyError:
787
pass
788
try:
789
gid = pwd.getpwnam("mandos").pw_gid
790
except KeyError:
791
try:
792
gid = pwd.getpwnam("nogroup").pw_gid
793
except KeyError:
794
pass
997
795
try:
998
796
os.setuid(uid)
999
797
os.setgid(gid)
1005
803
service = AvahiService(name = server_settings["servicename"],
1006
804
servicetype = "_mandos._tcp", )
1007
805
if server_settings["interface"]:
1008
service.interface = (if_nametoindex
1009
(server_settings["interface"]))
806
service.interface = if_nametoindex\
807
(server_settings["interface"])
1010
808
1011
809
global main_loop
1012
810
global bus
1019
817
avahi.DBUS_PATH_SERVER),
1020
818
avahi.DBUS_INTERFACE_SERVER)
1021
819
# End of Avahi example code
1022
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
820
821
def remove_from_clients(client):
822
clients.remove(client)
823
if not clients:
824
logger.critical(u"No clients left, exiting")
825
sys.exit()
1023
826
1024
827
clients.update(Set(Client(name = section,
828
stop_hook = remove_from_clients,
1025
829
config
1026
830
= dict(client_config.items(section)))
1027
831
for section in client_config.sections()))
1065
869
1066
870
while clients:
1067
871
client = clients.pop()
1068
client.disable_hook = None
1069
client.disable()
872
client.stop_hook = None
873
client.stop()
1070
874
1071
875
atexit.register(cleanup)
1072
876
1075
879
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1076
880
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1077
881
1078
class MandosServer(dbus.service.Object):
1079
"""A D-Bus proxy object"""
1080
def __init__(self):
1081
dbus.service.Object.__init__(self, bus,
1082
"/Mandos")
1083
_interface = u"org.mandos_system.Mandos"
1084
1085
@dbus.service.signal(_interface, signature="oa{sv}")
1086
def ClientAdded(self, objpath, properties):
1087
"D-Bus signal"
1088
pass
1089
1090
@dbus.service.signal(_interface, signature="o")
1091
def ClientRemoved(self, objpath):
1092
"D-Bus signal"
1093
pass
1094
1095
@dbus.service.method(_interface, out_signature="ao")
1096
def GetAllClients(self):
1097
return dbus.Array(c.dbus_object_path for c in clients)
1098
1099
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1100
def GetAllClientsWithProperties(self):
1101
return dbus.Dictionary(
1102
((c.dbus_object_path, c.GetAllProperties())
1103
for c in clients),
1104
signature="oa{sv}")
1105
1106
@dbus.service.method(_interface, in_signature="o")
1107
def RemoveClient(self, object_path):
1108
for c in clients:
1109
if c.dbus_object_path == object_path:
1110
c.disable()
1111
clients.remove(c)
1112
return
1113
raise KeyError
1114
1115
del _interface
1116
1117
mandos_server = MandosServer()
1118
1119
882
for client in clients:
1120
# Emit D-Bus signal
1121
mandos_server.ClientAdded(client.dbus_object_path,
1122
client.GetAllProperties())
1123
client.enable()
883
client.start()
1124
884
1125
885
tcp_server.enable()
1126
886
tcp_server.server_activate()
1144
904
1145
905
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1146
906
lambda *args, **kwargs:
1147
(tcp_server.handle_request
1148
(*args[2:], **kwargs) or True))
907
tcp_server.handle_request\
908
(*args[2:], **kwargs) or True)
1149
909
1150
910
logger.debug(u"Starting main loop")
1151
911
main_loop.run()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0