To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 234
- compare with another revision
- download diff
- download tarball
- view history from revision 234
- Committer: Teddy Hogeborn
- Date: 2008-10-18 11:17:22 UTC
- Revision ID: teddy@fukt.bsnet.se-20081018111722-jtbz35c031lxuuc9
* debian/mandos-client.docs (NEWS): Added.
* debian/mandos.docs (NEWS): - '' -
* debian/mandos.docs (NEWS): - '' -
- files added:
- debian/mandos-client.config
- files removed:
- debian/watch
- files modified:
- INSTALL
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import division, with_statement, absolute_import
33
from __future__ import division
35
34
36
35
import SocketServer
37
36
import socket
38
import optparse
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
59
from contextlib import closing
60
58
61
59
import dbus
62
import dbus.service
63
60
import gobject
64
61
import avahi
65
62
from dbus.mainloop.glib import DBusGMainLoop
66
63
import ctypes
67
64
import ctypes.util
68
65
69
version = "1.0.5"
66
version = "1.0.2"
70
67
71
68
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
77
74
logger.addHandler(syslogger)
78
75
79
76
console = logging.StreamHandler()
82
79
logger.addHandler(console)
83
80
84
81
class AvahiError(Exception):
85
def __init__(self, value, *args, **kwargs):
82
def __init__(self, value):
86
83
self.value = value
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
84
super(AvahiError, self).__init__()
85
def __str__(self):
86
return repr(self.value)
90
87
91
88
class AvahiServiceError(AvahiError):
92
89
pass
112
109
a sensible number of times
113
110
"""
114
111
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
112
servicetype = None, port = None, TXT = None, domain = "",
113
host = "", max_renames = 32768):
117
114
self.interface = interface
118
115
self.name = name
119
116
self.type = servicetype
120
117
self.port = port
121
self.TXT = TXT if TXT is not None else []
118
if TXT is None:
119
self.TXT = []
120
else:
121
self.TXT = TXT
122
122
self.domain = domain
123
123
self.host = host
124
124
self.rename_count = 0
129
129
logger.critical(u"No suitable Zeroconf service name found"
130
130
u" after %i retries, exiting.",
131
131
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
132
raise AvahiServiceError("Too many renames")
133
133
self.name = server.GetAlternativeServiceName(self.name)
134
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
136
syslogger.setFormatter(logging.Formatter\
137
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
138
' %%(message)s' % self.name))
139
139
self.remove()
140
140
self.add()
141
141
self.rename_count += 1
147
147
"""Derived from the Avahi example code"""
148
148
global group
149
149
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
150
group = dbus.Interface\
151
(bus.get_object(avahi.DBUS_NAME,
152
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
154
group.connect_to_signal('StateChanged',
155
155
entry_group_state_changed)
156
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
170
170
# End of Avahi example code
171
171
172
172
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
173
class Client(object):
179
174
"""A representation of a client host served by this server.
180
175
Attributes:
181
name: string; from the config file, used in log messages and
182
D-Bus identifiers
176
name: string; from the config file, used in log messages
183
177
fingerprint: string (40 or 32 hexadecimal digits); used to
184
178
uniquely identify the client
185
secret: bytestring; sent verbatim (over TLS) to client
186
host: string; available for use by the checker command
187
created: datetime.datetime(); (UTC) object creation
188
last_enabled: datetime.datetime(); (UTC)
189
enabled: bool()
190
last_checked_ok: datetime.datetime(); (UTC) or None
191
timeout: datetime.timedelta(); How long from last_checked_ok
192
until this client is invalid
193
interval: datetime.timedelta(); How often to start a new checker
194
disable_hook: If set, called by disable() as disable_hook(self)
195
checker: subprocess.Popen(); a running checker process used
196
to see if the client lives.
197
'None' if no process is running.
179
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); object creation, not client host
182
last_checked_ok: datetime.datetime() or None if not yet checked OK
183
timeout: datetime.timedelta(); How long from last_checked_ok
184
until this client is invalid
185
interval: datetime.timedelta(); How often to start a new checker
186
stop_hook: If set, called by stop() as stop_hook(self)
187
checker: subprocess.Popen(); a running checker process used
188
to see if the client lives.
189
'None' if no process is running.
198
190
checker_initiator_tag: a gobject event source tag, or None
199
disable_initiator_tag: - '' -
191
stop_initiator_tag: - '' -
200
192
checker_callback_tag: - '' -
201
193
checker_command: string; External command which is run to check if
202
194
client lives. %() expansions are done at
203
195
runtime with vars(self) as dict, so that for
204
196
instance %(name)s can be used in the command.
205
use_dbus: bool(); Whether to provide D-Bus interface and signals
206
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
197
Private attibutes:
198
_timeout: Real variable for 'timeout'
199
_interval: Real variable for 'interval'
200
_timeout_milliseconds: Used when calling gobject.timeout_add()
201
_interval_milliseconds: - '' -
207
202
"""
208
def timeout_milliseconds(self):
209
"Return the 'timeout' attribute in milliseconds"
210
return ((self.timeout.days * 24 * 60 * 60 * 1000)
211
+ (self.timeout.seconds * 1000)
212
+ (self.timeout.microseconds // 1000))
213
214
def interval_milliseconds(self):
215
"Return the 'interval' attribute in milliseconds"
216
return ((self.interval.days * 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds * 1000)
218
+ (self.interval.microseconds // 1000))
219
220
def __init__(self, name = None, disable_hook=None, config=None,
221
use_dbus=True):
203
def _set_timeout(self, timeout):
204
"Setter function for 'timeout' attribute"
205
self._timeout = timeout
206
self._timeout_milliseconds = ((self.timeout.days
207
* 24 * 60 * 60 * 1000)
208
+ (self.timeout.seconds * 1000)
209
+ (self.timeout.microseconds
210
// 1000))
211
timeout = property(lambda self: self._timeout,
212
_set_timeout)
213
del _set_timeout
214
def _set_interval(self, interval):
215
"Setter function for 'interval' attribute"
216
self._interval = interval
217
self._interval_milliseconds = ((self.interval.days
218
* 24 * 60 * 60 * 1000)
219
+ (self.interval.seconds
220
* 1000)
221
+ (self.interval.microseconds
222
// 1000))
223
interval = property(lambda self: self._interval,
224
_set_interval)
225
del _set_interval
226
def __init__(self, name = None, stop_hook=None, config=None):
222
227
"""Note: the 'checker' key in 'config' sets the
223
228
'checker_command' attribute and *not* the 'checker'
224
229
attribute."""
225
self.name = name
226
230
if config is None:
227
231
config = {}
232
self.name = name
228
233
logger.debug(u"Creating client %r", self.name)
229
self.use_dbus = False # During __init__
230
234
# Uppercase and remove spaces from fingerprint for later
231
235
# comparison purposes with return value from the fingerprint()
232
236
# function
233
self.fingerprint = (config["fingerprint"].upper()
234
.replace(u" ", u""))
237
self.fingerprint = config["fingerprint"].upper()\
238
.replace(u" ", u"")
235
239
logger.debug(u" Fingerprint: %s", self.fingerprint)
236
240
if "secret" in config:
237
241
self.secret = config["secret"].decode(u"base64")
238
242
elif "secfile" in config:
239
with closing(open(os.path.expanduser
240
(os.path.expandvars
241
(config["secfile"])))) as secfile:
242
self.secret = secfile.read()
243
secfile = open(os.path.expanduser(os.path.expandvars
244
(config["secfile"])))
245
self.secret = secfile.read()
246
secfile.close()
243
247
else:
244
248
raise TypeError(u"No secret or secfile for client %s"
245
249
% self.name)
246
250
self.host = config.get("host", "")
247
self.created = datetime.datetime.utcnow()
248
self.enabled = False
249
self.last_enabled = None
251
self.created = datetime.datetime.now()
250
252
self.last_checked_ok = None
251
253
self.timeout = string_to_delta(config["timeout"])
252
254
self.interval = string_to_delta(config["interval"])
253
self.disable_hook = disable_hook
255
self.stop_hook = stop_hook
254
256
self.checker = None
255
257
self.checker_initiator_tag = None
256
self.disable_initiator_tag = None
258
self.stop_initiator_tag = None
257
259
self.checker_callback_tag = None
258
self.checker_command = config["checker"]
259
self.last_connect = None
260
# Only now, when this client is initialized, can it show up on
261
# the D-Bus
262
self.use_dbus = use_dbus
263
if self.use_dbus:
264
self.dbus_object_path = (dbus.ObjectPath
265
("/clients/"
266
+ self.name.replace(".", "_")))
267
dbus.service.Object.__init__(self, bus,
268
self.dbus_object_path)
269
270
def enable(self):
260
self.check_command = config["checker"]
261
def start(self):
271
262
"""Start this client's checker and timeout hooks"""
272
self.last_enabled = datetime.datetime.utcnow()
273
263
# Schedule a new checker to be started an 'interval' from now,
274
264
# and every interval from then on.
275
self.checker_initiator_tag = (gobject.timeout_add
276
(self.interval_milliseconds(),
277
self.start_checker))
265
self.checker_initiator_tag = gobject.timeout_add\
266
(self._interval_milliseconds,
267
self.start_checker)
278
268
# Also start a new checker *right now*.
279
269
self.start_checker()
280
# Schedule a disable() when 'timeout' has passed
281
self.disable_initiator_tag = (gobject.timeout_add
282
(self.timeout_milliseconds(),
283
self.disable))
284
self.enabled = True
285
if self.use_dbus:
286
# Emit D-Bus signals
287
self.PropertyChanged(dbus.String(u"enabled"),
288
dbus.Boolean(True, variant_level=1))
289
self.PropertyChanged(dbus.String(u"last_enabled"),
290
(_datetime_to_dbus(self.last_enabled,
291
variant_level=1)))
292
293
def disable(self):
294
"""Disable this client."""
295
if not getattr(self, "enabled", False):
270
# Schedule a stop() when 'timeout' has passed
271
self.stop_initiator_tag = gobject.timeout_add\
272
(self._timeout_milliseconds,
273
self.stop)
274
def stop(self):
275
"""Stop this client.
276
The possibility that a client might be restarted is left open,
277
but not currently used."""
278
# If this client doesn't have a secret, it is already stopped.
279
if hasattr(self, "secret") and self.secret:
280
logger.info(u"Stopping client %s", self.name)
281
self.secret = None
282
else:
296
283
return False
297
logger.info(u"Disabling client %s", self.name)
298
if getattr(self, "disable_initiator_tag", False):
299
gobject.source_remove(self.disable_initiator_tag)
300
self.disable_initiator_tag = None
284
if getattr(self, "stop_initiator_tag", False):
285
gobject.source_remove(self.stop_initiator_tag)
286
self.stop_initiator_tag = None
301
287
if getattr(self, "checker_initiator_tag", False):
302
288
gobject.source_remove(self.checker_initiator_tag)
303
289
self.checker_initiator_tag = None
304
290
self.stop_checker()
305
if self.disable_hook:
306
self.disable_hook(self)
307
self.enabled = False
308
if self.use_dbus:
309
# Emit D-Bus signal
310
self.PropertyChanged(dbus.String(u"enabled"),
311
dbus.Boolean(False, variant_level=1))
291
if self.stop_hook:
292
self.stop_hook(self)
312
293
# Do not run this again if called by a gobject.timeout_add
313
294
return False
314
315
295
def __del__(self):
316
self.disable_hook = None
317
self.disable()
318
319
def checker_callback(self, pid, condition, command):
296
self.stop_hook = None
297
self.stop()
298
def checker_callback(self, pid, condition):
320
299
"""The checker has completed, so take appropriate actions."""
300
now = datetime.datetime.now()
321
301
self.checker_callback_tag = None
322
302
self.checker = None
323
if self.use_dbus:
324
# Emit D-Bus signal
325
self.PropertyChanged(dbus.String(u"checker_running"),
326
dbus.Boolean(False, variant_level=1))
327
if (os.WIFEXITED(condition)
328
and (os.WEXITSTATUS(condition) == 0)):
303
if os.WIFEXITED(condition) \
304
and (os.WEXITSTATUS(condition) == 0):
329
305
logger.info(u"Checker for %(name)s succeeded",
330
306
vars(self))
331
if self.use_dbus:
332
# Emit D-Bus signal
333
self.CheckerCompleted(dbus.Boolean(True),
334
dbus.UInt16(condition),
335
dbus.String(command))
336
self.bump_timeout()
307
self.last_checked_ok = now
308
gobject.source_remove(self.stop_initiator_tag)
309
self.stop_initiator_tag = gobject.timeout_add\
310
(self._timeout_milliseconds,
311
self.stop)
337
312
elif not os.WIFEXITED(condition):
338
313
logger.warning(u"Checker for %(name)s crashed?",
339
314
vars(self))
340
if self.use_dbus:
341
# Emit D-Bus signal
342
self.CheckerCompleted(dbus.Boolean(False),
343
dbus.UInt16(condition),
344
dbus.String(command))
345
315
else:
346
316
logger.info(u"Checker for %(name)s failed",
347
317
vars(self))
348
if self.use_dbus:
349
# Emit D-Bus signal
350
self.CheckerCompleted(dbus.Boolean(False),
351
dbus.UInt16(condition),
352
dbus.String(command))
353
354
def bump_timeout(self):
355
"""Bump up the timeout for this client.
356
This should only be called when the client has been seen,
357
alive and well.
358
"""
359
self.last_checked_ok = datetime.datetime.utcnow()
360
gobject.source_remove(self.disable_initiator_tag)
361
self.disable_initiator_tag = (gobject.timeout_add
362
(self.timeout_milliseconds(),
363
self.disable))
364
if self.use_dbus:
365
# Emit D-Bus signal
366
self.PropertyChanged(
367
dbus.String(u"last_checked_ok"),
368
(_datetime_to_dbus(self.last_checked_ok,
369
variant_level=1)))
370
371
318
def start_checker(self):
372
319
"""Start a new checker subprocess if one is not running.
373
320
If a checker already exists, leave it running and do
382
329
# is as it should be.
383
330
if self.checker is None:
384
331
try:
385
# In case checker_command has exactly one % operator
386
command = self.checker_command % self.host
332
# In case check_command has exactly one % operator
333
command = self.check_command % self.host
387
334
except TypeError:
388
335
# Escape attributes for the shell
389
336
escaped_attrs = dict((key, re.escape(str(val)))
390
337
for key, val in
391
338
vars(self).iteritems())
392
339
try:
393
command = self.checker_command % escaped_attrs
340
command = self.check_command % escaped_attrs
394
341
except TypeError, error:
395
342
logger.error(u'Could not format string "%s":'
396
u' %s', self.checker_command, error)
343
u' %s', self.check_command, error)
397
344
return True # Try again later
398
345
try:
399
346
logger.info(u"Starting checker %r for %s",
405
352
self.checker = subprocess.Popen(command,
406
353
close_fds=True,
407
354
shell=True, cwd="/")
408
if self.use_dbus:
409
# Emit D-Bus signal
410
self.CheckerStarted(command)
411
self.PropertyChanged(
412
dbus.String("checker_running"),
413
dbus.Boolean(True, variant_level=1))
414
self.checker_callback_tag = (gobject.child_watch_add
415
(self.checker.pid,
416
self.checker_callback,
417
data=command))
355
self.checker_callback_tag = gobject.child_watch_add\
356
(self.checker.pid,
357
self.checker_callback)
418
358
except OSError, error:
419
359
logger.error(u"Failed to start subprocess: %s",
420
360
error)
421
361
# Re-run this periodically if run by gobject.timeout_add
422
362
return True
423
424
363
def stop_checker(self):
425
364
"""Force the checker process, if any, to stop."""
426
365
if self.checker_callback_tag:
438
377
if error.errno != errno.ESRCH: # No such process
439
378
raise
440
379
self.checker = None
441
if self.use_dbus:
442
self.PropertyChanged(dbus.String(u"checker_running"),
443
dbus.Boolean(False, variant_level=1))
444
445
380
def still_valid(self):
446
381
"""Has the timeout not yet passed for this client?"""
447
if not getattr(self, "enabled", False):
448
return False
449
now = datetime.datetime.utcnow()
382
now = datetime.datetime.now()
450
383
if self.last_checked_ok is None:
451
384
return now < (self.created + self.timeout)
452
385
else:
453
386
return now < (self.last_checked_ok + self.timeout)
454
455
## D-Bus methods & signals
456
_interface = u"se.bsnet.fukt.Mandos.Client"
457
458
# BumpTimeout - method
459
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
460
BumpTimeout.__name__ = "BumpTimeout"
461
462
# CheckerCompleted - signal
463
@dbus.service.signal(_interface, signature="bqs")
464
def CheckerCompleted(self, success, condition, command):
465
"D-Bus signal"
466
pass
467
468
# CheckerStarted - signal
469
@dbus.service.signal(_interface, signature="s")
470
def CheckerStarted(self, command):
471
"D-Bus signal"
472
pass
473
474
# GetAllProperties - method
475
@dbus.service.method(_interface, out_signature="a{sv}")
476
def GetAllProperties(self):
477
"D-Bus method"
478
return dbus.Dictionary({
479
dbus.String("name"):
480
dbus.String(self.name, variant_level=1),
481
dbus.String("fingerprint"):
482
dbus.String(self.fingerprint, variant_level=1),
483
dbus.String("host"):
484
dbus.String(self.host, variant_level=1),
485
dbus.String("created"):
486
_datetime_to_dbus(self.created, variant_level=1),
487
dbus.String("last_enabled"):
488
(_datetime_to_dbus(self.last_enabled,
489
variant_level=1)
490
if self.last_enabled is not None
491
else dbus.Boolean(False, variant_level=1)),
492
dbus.String("enabled"):
493
dbus.Boolean(self.enabled, variant_level=1),
494
dbus.String("last_checked_ok"):
495
(_datetime_to_dbus(self.last_checked_ok,
496
variant_level=1)
497
if self.last_checked_ok is not None
498
else dbus.Boolean (False, variant_level=1)),
499
dbus.String("timeout"):
500
dbus.UInt64(self.timeout_milliseconds(),
501
variant_level=1),
502
dbus.String("interval"):
503
dbus.UInt64(self.interval_milliseconds(),
504
variant_level=1),
505
dbus.String("checker"):
506
dbus.String(self.checker_command,
507
variant_level=1),
508
dbus.String("checker_running"):
509
dbus.Boolean(self.checker is not None,
510
variant_level=1),
511
dbus.String("object_path"):
512
dbus.ObjectPath(self.dbus_object_path,
513
variant_level=1)
514
}, signature="sv")
515
516
# IsStillValid - method
517
IsStillValid = (dbus.service.method(_interface, out_signature="b")
518
(still_valid))
519
IsStillValid.__name__ = "IsStillValid"
520
521
# PropertyChanged - signal
522
@dbus.service.signal(_interface, signature="sv")
523
def PropertyChanged(self, property, value):
524
"D-Bus signal"
525
pass
526
527
# SetChecker - method
528
@dbus.service.method(_interface, in_signature="s")
529
def SetChecker(self, checker):
530
"D-Bus setter method"
531
self.checker_command = checker
532
# Emit D-Bus signal
533
self.PropertyChanged(dbus.String(u"checker"),
534
dbus.String(self.checker_command,
535
variant_level=1))
536
537
# SetHost - method
538
@dbus.service.method(_interface, in_signature="s")
539
def SetHost(self, host):
540
"D-Bus setter method"
541
self.host = host
542
# Emit D-Bus signal
543
self.PropertyChanged(dbus.String(u"host"),
544
dbus.String(self.host, variant_level=1))
545
546
# SetInterval - method
547
@dbus.service.method(_interface, in_signature="t")
548
def SetInterval(self, milliseconds):
549
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
550
# Emit D-Bus signal
551
self.PropertyChanged(dbus.String(u"interval"),
552
(dbus.UInt64(self.interval_milliseconds(),
553
variant_level=1)))
554
555
# SetSecret - method
556
@dbus.service.method(_interface, in_signature="ay",
557
byte_arrays=True)
558
def SetSecret(self, secret):
559
"D-Bus setter method"
560
self.secret = str(secret)
561
562
# SetTimeout - method
563
@dbus.service.method(_interface, in_signature="t")
564
def SetTimeout(self, milliseconds):
565
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
566
# Emit D-Bus signal
567
self.PropertyChanged(dbus.String(u"timeout"),
568
(dbus.UInt64(self.timeout_milliseconds(),
569
variant_level=1)))
570
571
# Enable - method
572
Enable = dbus.service.method(_interface)(enable)
573
Enable.__name__ = "Enable"
574
575
# StartChecker - method
576
@dbus.service.method(_interface)
577
def StartChecker(self):
578
"D-Bus method"
579
self.start_checker()
580
581
# Disable - method
582
@dbus.service.method(_interface)
583
def Disable(self):
584
"D-Bus method"
585
self.disable()
586
587
# StopChecker - method
588
StopChecker = dbus.service.method(_interface)(stop_checker)
589
StopChecker.__name__ = "StopChecker"
590
591
del _interface
592
387
593
388
594
389
def peer_certificate(session):
595
390
"Return the peer's OpenPGP certificate as a bytestring"
596
391
# If not an OpenPGP certificate...
597
if (gnutls.library.functions
598
.gnutls_certificate_type_get(session._c_object)
599
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
392
if gnutls.library.functions.gnutls_certificate_type_get\
393
(session._c_object) \
394
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
600
395
# ...do the normal thing
601
396
return session.peer_certificate
602
397
list_size = ctypes.c_uint()
603
cert_list = (gnutls.library.functions
604
.gnutls_certificate_get_peers
605
(session._c_object, ctypes.byref(list_size)))
398
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
399
(session._c_object, ctypes.byref(list_size))
606
400
if list_size.value == 0:
607
401
return None
608
402
cert = cert_list[0]
612
406
def fingerprint(openpgp):
613
407
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
614
408
# New GnuTLS "datum" with the OpenPGP public key
615
datum = (gnutls.library.types
616
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
617
ctypes.POINTER
618
(ctypes.c_ubyte)),
619
ctypes.c_uint(len(openpgp))))
409
datum = gnutls.library.types.gnutls_datum_t\
410
(ctypes.cast(ctypes.c_char_p(openpgp),
411
ctypes.POINTER(ctypes.c_ubyte)),
412
ctypes.c_uint(len(openpgp)))
620
413
# New empty GnuTLS certificate
621
414
crt = gnutls.library.types.gnutls_openpgp_crt_t()
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
415
gnutls.library.functions.gnutls_openpgp_crt_init\
416
(ctypes.byref(crt))
624
417
# Import the OpenPGP public key into the certificate
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
627
gnutls.library.constants
628
.GNUTLS_OPENPGP_FMT_RAW))
418
gnutls.library.functions.gnutls_openpgp_crt_import\
419
(crt, ctypes.byref(datum),
420
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
629
421
# Verify the self signature in the key
630
422
crtverify = ctypes.c_uint()
631
(gnutls.library.functions
632
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
423
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
424
(crt, 0, ctypes.byref(crtverify))
633
425
if crtverify.value != 0:
634
426
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
635
427
raise gnutls.errors.CertificateSecurityError("Verify failed")
637
429
buf = ctypes.create_string_buffer(20)
638
430
buf_len = ctypes.c_size_t()
639
431
# Get the fingerprint from the certificate into the buffer
640
(gnutls.library.functions
641
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
642
ctypes.byref(buf_len)))
432
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
433
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
643
434
# Deinit the certificate
644
435
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
645
436
# Convert the buffer to a Python bytestring
656
447
657
448
def handle(self):
658
449
logger.info(u"TCP connection from: %s",
659
unicode(self.client_address))
660
session = (gnutls.connection
661
.ClientSession(self.request,
662
gnutls.connection
663
.X509Credentials()))
450
unicode(self.client_address))
451
session = gnutls.connection.ClientSession\
452
(self.request, gnutls.connection.X509Credentials())
664
453
665
454
line = self.request.makefile().readline()
666
455
logger.debug(u"Protocol version: %r", line)
679
468
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
680
469
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
681
470
# "+DHE-DSS"))
682
# Use a fallback default, since this MUST be set.
683
priority = self.server.settings.get("priority", "NORMAL")
684
(gnutls.library.functions
685
.gnutls_priority_set_direct(session._c_object,
686
priority, None))
471
priority = "NORMAL" # Fallback default, since this
472
# MUST be set.
473
if self.server.settings["priority"]:
474
priority = self.server.settings["priority"]
475
gnutls.library.functions.gnutls_priority_set_direct\
476
(session._c_object, priority, None)
687
477
688
478
try:
689
479
session.handshake()
699
489
session.bye()
700
490
return
701
491
logger.debug(u"Fingerprint: %s", fpr)
492
client = None
702
493
for c in self.server.clients:
703
494
if c.fingerprint == fpr:
704
495
client = c
705
496
break
706
else:
497
if not client:
707
498
logger.warning(u"Client not found for fingerprint: %s",
708
499
fpr)
709
500
session.bye()
716
507
vars(client))
717
508
session.bye()
718
509
return
719
## This won't work here, since we're in a fork.
720
# client.bump_timeout()
721
510
sent_size = 0
722
511
while sent_size < len(client.secret):
723
512
sent = session.send(client.secret[sent_size:])
728
517
session.bye()
729
518
730
519
731
class IPv6_TCPServer(SocketServer.ForkingMixIn,
732
SocketServer.TCPServer, object):
520
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
733
521
"""IPv6 TCP server. Accepts 'None' as address and/or port.
734
522
Attributes:
735
523
settings: Server settings
848
636
elif state == avahi.ENTRY_GROUP_FAILURE:
849
637
logger.critical(u"Avahi: Error in group state changed %s",
850
638
unicode(error))
851
raise AvahiGroupError(u"State changed: %s" % unicode(error))
639
raise AvahiGroupError("State changed: %s", str(error))
852
640
853
641
def if_nametoindex(interface):
854
642
"""Call the C function if_nametoindex(), or equivalent"""
855
643
global if_nametoindex
856
644
try:
857
if_nametoindex = (ctypes.cdll.LoadLibrary
858
(ctypes.util.find_library("c"))
859
.if_nametoindex)
645
if_nametoindex = ctypes.cdll.LoadLibrary\
646
(ctypes.util.find_library("c")).if_nametoindex
860
647
except (OSError, AttributeError):
861
648
if "struct" not in sys.modules:
862
649
import struct
865
652
def if_nametoindex(interface):
866
653
"Get an interface index the hard way, i.e. using fcntl()"
867
654
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
868
with closing(socket.socket()) as s:
869
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
870
struct.pack("16s16x", interface))
655
s = socket.socket()
656
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
657
struct.pack("16s16x", interface))
658
s.close()
871
659
interface_index = struct.unpack("I", ifreq[16:20])[0]
872
660
return interface_index
873
661
return if_nametoindex(interface)
897
685
898
686
899
687
def main():
900
parser = optparse.OptionParser(version = "%%prog %s" % version)
688
parser = OptionParser(version = "%%prog %s" % version)
901
689
parser.add_option("-i", "--interface", type="string",
902
690
metavar="IF", help="Bind to interface IF")
903
691
parser.add_option("-a", "--address", type="string",
904
692
help="Address to listen for requests on")
905
693
parser.add_option("-p", "--port", type="int",
906
694
help="Port number to receive requests on")
907
parser.add_option("--check", action="store_true",
695
parser.add_option("--check", action="store_true", default=False,
908
696
help="Run self-test")
909
697
parser.add_option("--debug", action="store_true",
910
698
help="Debug mode; run in foreground and log to"
917
705
default="/etc/mandos", metavar="DIR",
918
706
help="Directory to search for configuration"
919
707
" files")
920
parser.add_option("--no-dbus", action="store_false",
921
dest="use_dbus",
922
help="Do not provide D-Bus system bus"
923
" interface")
924
708
options = parser.parse_args()[0]
925
709
926
710
if options.check:
936
720
"priority":
937
721
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
938
722
"servicename": "Mandos",
939
"use_dbus": "True",
940
723
}
941
724
942
725
# Parse config file for server-global settings
945
728
server_config.read(os.path.join(options.configdir, "mandos.conf"))
946
729
# Convert the SafeConfigParser object to a dict
947
730
server_settings = server_config.defaults()
948
# Use getboolean on the boolean config options
949
server_settings["debug"] = (server_config.getboolean
950
("DEFAULT", "debug"))
951
server_settings["use_dbus"] = (server_config.getboolean
952
("DEFAULT", "use_dbus"))
731
# Use getboolean on the boolean config option
732
server_settings["debug"] = server_config.getboolean\
733
("DEFAULT", "debug")
953
734
del server_config
954
735
955
736
# Override the settings from the config file with command line
956
737
# options, if set.
957
738
for option in ("interface", "address", "port", "debug",
958
"priority", "servicename", "configdir",
959
"use_dbus"):
739
"priority", "servicename", "configdir"):
960
740
value = getattr(options, option)
961
741
if value is not None:
962
742
server_settings[option] = value
963
743
del options
964
744
# Now we have our good server settings in "server_settings"
965
745
966
# For convenience
967
746
debug = server_settings["debug"]
968
use_dbus = server_settings["use_dbus"]
969
747
970
748
if not debug:
971
749
syslogger.setLevel(logging.WARNING)
972
750
console.setLevel(logging.WARNING)
973
751
974
752
if server_settings["servicename"] != "Mandos":
975
syslogger.setFormatter(logging.Formatter
753
syslogger.setFormatter(logging.Formatter\
976
754
('Mandos (%s): %%(levelname)s:'
977
755
' %%(message)s'
978
756
% server_settings["servicename"]))
980
758
# Parse config file with clients
981
759
client_defaults = { "timeout": "1h",
982
760
"interval": "5m",
983
"checker": "fping -q -- %%(host)s",
761
"checker": "fping -q -- %(host)s",
984
762
"host": "",
985
763
}
986
764
client_config = ConfigParser.SafeConfigParser(client_defaults)
999
777
except IOError, error:
1000
778
logger.error("Could not open file %r", pidfilename)
1001
779
1002
try:
1003
uid = pwd.getpwnam("_mandos").pw_uid
1004
gid = pwd.getpwnam("_mandos").pw_gid
1005
except KeyError:
1006
try:
1007
uid = pwd.getpwnam("mandos").pw_uid
1008
gid = pwd.getpwnam("mandos").pw_gid
1009
except KeyError:
1010
try:
1011
uid = pwd.getpwnam("nobody").pw_uid
1012
gid = pwd.getpwnam("nogroup").pw_gid
1013
except KeyError:
1014
uid = 65534
1015
gid = 65534
780
uid = 65534
781
gid = 65534
782
try:
783
uid = pwd.getpwnam("mandos").pw_uid
784
except KeyError:
785
try:
786
uid = pwd.getpwnam("nobody").pw_uid
787
except KeyError:
788
pass
789
try:
790
gid = pwd.getpwnam("mandos").pw_gid
791
except KeyError:
792
try:
793
gid = pwd.getpwnam("nogroup").pw_gid
794
except KeyError:
795
pass
1016
796
try:
1017
797
os.setuid(uid)
1018
798
os.setgid(gid)
1024
804
service = AvahiService(name = server_settings["servicename"],
1025
805
servicetype = "_mandos._tcp", )
1026
806
if server_settings["interface"]:
1027
service.interface = (if_nametoindex
1028
(server_settings["interface"]))
807
service.interface = if_nametoindex\
808
(server_settings["interface"])
1029
809
1030
810
global main_loop
1031
811
global bus
1038
818
avahi.DBUS_PATH_SERVER),
1039
819
avahi.DBUS_INTERFACE_SERVER)
1040
820
# End of Avahi example code
1041
if use_dbus:
1042
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
821
822
def remove_from_clients(client):
823
clients.remove(client)
824
if not clients:
825
logger.critical(u"No clients left, exiting")
826
sys.exit()
1043
827
1044
828
clients.update(Set(Client(name = section,
829
stop_hook = remove_from_clients,
1045
830
config
1046
= dict(client_config.items(section)),
1047
use_dbus = use_dbus)
831
= dict(client_config.items(section)))
1048
832
for section in client_config.sections()))
1049
833
if not clients:
1050
logger.warning(u"No clients defined")
834
logger.critical(u"No clients defined")
835
sys.exit(1)
1051
836
1052
837
if debug:
1053
838
# Redirect stdin so all checkers get /dev/null
1085
870
1086
871
while clients:
1087
872
client = clients.pop()
1088
client.disable_hook = None
1089
client.disable()
873
client.stop_hook = None
874
client.stop()
1090
875
1091
876
atexit.register(cleanup)
1092
877
1095
880
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1096
881
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1097
882
1098
if use_dbus:
1099
class MandosServer(dbus.service.Object):
1100
"""A D-Bus proxy object"""
1101
def __init__(self):
1102
dbus.service.Object.__init__(self, bus, "/")
1103
_interface = u"se.bsnet.fukt.Mandos"
1104
1105
@dbus.service.signal(_interface, signature="oa{sv}")
1106
def ClientAdded(self, objpath, properties):
1107
"D-Bus signal"
1108
pass
1109
1110
@dbus.service.signal(_interface, signature="os")
1111
def ClientRemoved(self, objpath, name):
1112
"D-Bus signal"
1113
pass
1114
1115
@dbus.service.method(_interface, out_signature="ao")
1116
def GetAllClients(self):
1117
return dbus.Array(c.dbus_object_path for c in clients)
1118
1119
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1120
def GetAllClientsWithProperties(self):
1121
return dbus.Dictionary(
1122
((c.dbus_object_path, c.GetAllProperties())
1123
for c in clients),
1124
signature="oa{sv}")
1125
1126
@dbus.service.method(_interface, in_signature="o")
1127
def RemoveClient(self, object_path):
1128
for c in clients:
1129
if c.dbus_object_path == object_path:
1130
clients.remove(c)
1131
# Don't signal anything except ClientRemoved
1132
c.use_dbus = False
1133
c.disable()
1134
# Emit D-Bus signal
1135
self.ClientRemoved(object_path, c.name)
1136
return
1137
raise KeyError
1138
1139
del _interface
1140
1141
mandos_server = MandosServer()
1142
1143
883
for client in clients:
1144
if use_dbus:
1145
# Emit D-Bus signal
1146
mandos_server.ClientAdded(client.dbus_object_path,
1147
client.GetAllProperties())
1148
client.enable()
884
client.start()
1149
885
1150
886
tcp_server.enable()
1151
887
tcp_server.server_activate()
1169
905
1170
906
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1171
907
lambda *args, **kwargs:
1172
(tcp_server.handle_request
1173
(*args[2:], **kwargs) or True))
908
tcp_server.handle_request\
909
(*args[2:], **kwargs) or True)
1174
910
1175
911
logger.debug(u"Starting main loop")
1176
912
main_loop.run()
1177
913
except AvahiError, error:
1178
logger.critical(u"AvahiError: %s", error)
914
logger.critical(u"AvahiError: %s" + unicode(error))
1179
915
sys.exit(1)
1180
916
except KeyboardInterrupt:
1181
917
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0