104
124
max_renames: integer; maximum number of renames
105
125
rename_count: integer; counter so we only rename after collisions
106
126
a sensible number of times
127
group: D-Bus Entry Group
129
bus: dbus.SystemBus()
108
131
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
109
type = None, port = None, TXT = None, domain = "",
110
host = "", max_renames = 32768):
132
servicetype = None, port = None, TXT = None,
133
domain = u"", host = u"", max_renames = 32768,
134
protocol = avahi.PROTO_UNSPEC, bus = None):
111
135
self.interface = interface
137
self.type = servicetype
139
self.TXT = TXT if TXT is not None else []
119
140
self.domain = domain
121
142
self.rename_count = 0
143
self.max_renames = max_renames
144
self.protocol = protocol
145
self.group = None # our entry group
122
148
def rename(self):
123
149
"""Derived from the Avahi example code"""
124
150
if self.rename_count >= self.max_renames:
125
logger.critical(u"No suitable service name found after %i"
126
u" retries, exiting.", rename_count)
127
raise AvahiServiceError("Too many renames")
128
name = server.GetAlternativeServiceName(name)
129
logger.error(u"Changing name to %r ...", name)
130
syslogger.setFormatter(logging.Formatter\
131
('Mandos (%s): %%(levelname)s:'
132
' %%(message)s' % name))
151
logger.critical(u"No suitable Zeroconf service name found"
152
u" after %i retries, exiting.",
154
raise AvahiServiceError(u"Too many renames")
155
self.name = self.server.GetAlternativeServiceName(self.name)
156
logger.info(u"Changing Zeroconf service name to %r ...",
158
syslogger.setFormatter(logging.Formatter
159
(u'Mandos (%s) [%%(process)d]:'
160
u' %%(levelname)s: %%(message)s'
135
164
self.rename_count += 1
136
165
def remove(self):
137
166
"""Derived from the Avahi example code"""
138
if group is not None:
167
if self.group is not None:
141
170
"""Derived from the Avahi example code"""
144
group = dbus.Interface\
145
(bus.get_object(avahi.DBUS_NAME,
146
server.EntryGroupNew()),
147
avahi.DBUS_INTERFACE_ENTRY_GROUP)
148
group.connect_to_signal('StateChanged',
149
entry_group_state_changed)
150
logger.debug(u"Adding service '%s' of type '%s' ...",
151
service.name, service.type)
153
self.interface, # interface
154
avahi.PROTO_INET6, # protocol
155
dbus.UInt32(0), # flags
156
self.name, self.type,
157
self.domain, self.host,
158
dbus.UInt16(self.port),
159
avahi.string_array_to_txt_array(self.TXT))
162
# From the Avahi example code:
163
group = None # our entry group
164
# End of Avahi example code
171
if self.group is None:
172
self.group = dbus.Interface(
173
self.bus.get_object(avahi.DBUS_NAME,
174
self.server.EntryGroupNew()),
175
avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
self.group.connect_to_signal('StateChanged',
177
self.entry_group_state_changed)
178
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
179
self.name, self.type)
180
self.group.AddService(
183
dbus.UInt32(0), # flags
184
self.name, self.type,
185
self.domain, self.host,
186
dbus.UInt16(self.port),
187
avahi.string_array_to_txt_array(self.TXT))
189
def entry_group_state_changed(self, state, error):
190
"""Derived from the Avahi example code"""
191
logger.debug(u"Avahi state change: %i", state)
193
if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
logger.debug(u"Zeroconf service established.")
195
elif state == avahi.ENTRY_GROUP_COLLISION:
196
logger.warning(u"Zeroconf service name collision.")
198
elif state == avahi.ENTRY_GROUP_FAILURE:
199
logger.critical(u"Avahi: Error in group state changed %s",
201
raise AvahiGroupError(u"State changed: %s"
204
"""Derived from the Avahi example code"""
205
if self.group is not None:
208
def server_state_changed(self, state):
209
"""Derived from the Avahi example code"""
210
if state == avahi.SERVER_COLLISION:
211
logger.error(u"Zeroconf server name collision")
213
elif state == avahi.SERVER_RUNNING:
216
"""Derived from the Avahi example code"""
217
if self.server is None:
218
self.server = dbus.Interface(
219
self.bus.get_object(avahi.DBUS_NAME,
220
avahi.DBUS_PATH_SERVER),
221
avahi.DBUS_INTERFACE_SERVER)
222
self.server.connect_to_signal(u"StateChanged",
223
self.server_state_changed)
224
self.server_state_changed(self.server.GetState())
167
227
class Client(object):
168
228
"""A representation of a client host served by this server.
170
name: string; from the config file, used in log messages
231
name: string; from the config file, used in log messages and
171
233
fingerprint: string (40 or 32 hexadecimal digits); used to
172
234
uniquely identify the client
173
secret: bytestring; sent verbatim (over TLS) to client
174
host: string; available for use by the checker command
175
created: datetime.datetime(); object creation, not client host
176
last_checked_ok: datetime.datetime() or None if not yet checked OK
177
timeout: datetime.timedelta(); How long from last_checked_ok
178
until this client is invalid
179
interval: datetime.timedelta(); How often to start a new checker
180
stop_hook: If set, called by stop() as stop_hook(self)
181
checker: subprocess.Popen(); a running checker process used
182
to see if the client lives.
183
'None' if no process is running.
235
secret: bytestring; sent verbatim (over TLS) to client
236
host: string; available for use by the checker command
237
created: datetime.datetime(); (UTC) object creation
238
last_enabled: datetime.datetime(); (UTC)
240
last_checked_ok: datetime.datetime(); (UTC) or None
241
timeout: datetime.timedelta(); How long from last_checked_ok
242
until this client is invalid
243
interval: datetime.timedelta(); How often to start a new checker
244
disable_hook: If set, called by disable() as disable_hook(self)
245
checker: subprocess.Popen(); a running checker process used
246
to see if the client lives.
247
'None' if no process is running.
184
248
checker_initiator_tag: a gobject event source tag, or None
185
stop_initiator_tag: - '' -
249
disable_initiator_tag: - '' -
186
250
checker_callback_tag: - '' -
187
251
checker_command: string; External command which is run to check if
188
252
client lives. %() expansions are done at
189
253
runtime with vars(self) as dict, so that for
190
254
instance %(name)s can be used in the command.
192
_timeout: Real variable for 'timeout'
193
_interval: Real variable for 'interval'
194
_timeout_milliseconds: Used when calling gobject.timeout_add()
195
_interval_milliseconds: - '' -
255
current_checker_command: string; current running checker_command
197
def _set_timeout(self, timeout):
198
"Setter function for 'timeout' attribute"
199
self._timeout = timeout
200
self._timeout_milliseconds = ((self.timeout.days
201
* 24 * 60 * 60 * 1000)
202
+ (self.timeout.seconds * 1000)
203
+ (self.timeout.microseconds
205
timeout = property(lambda self: self._timeout,
208
def _set_interval(self, interval):
209
"Setter function for 'interval' attribute"
210
self._interval = interval
211
self._interval_milliseconds = ((self.interval.days
212
* 24 * 60 * 60 * 1000)
213
+ (self.interval.seconds
215
+ (self.interval.microseconds
217
interval = property(lambda self: self._interval,
220
def __init__(self, name = None, stop_hook=None, config={}):
259
def _datetime_to_milliseconds(dt):
260
"Convert a datetime.datetime() to milliseconds"
261
return ((dt.days * 24 * 60 * 60 * 1000)
262
+ (dt.seconds * 1000)
263
+ (dt.microseconds // 1000))
265
def timeout_milliseconds(self):
266
"Return the 'timeout' attribute in milliseconds"
267
return self._datetime_to_milliseconds(self.timeout)
269
def interval_milliseconds(self):
270
"Return the 'interval' attribute in milliseconds"
271
return self._datetime_to_milliseconds(self.interval)
273
def __init__(self, name = None, disable_hook=None, config=None):
221
274
"""Note: the 'checker' key in 'config' sets the
222
275
'checker_command' attribute and *not* the 'checker'
225
280
logger.debug(u"Creating client %r", self.name)
226
281
# Uppercase and remove spaces from fingerprint for later
227
282
# comparison purposes with return value from the fingerprint()
229
self.fingerprint = config["fingerprint"].upper()\
284
self.fingerprint = (config[u"fingerprint"].upper()
231
286
logger.debug(u" Fingerprint: %s", self.fingerprint)
232
if "secret" in config:
233
self.secret = config["secret"].decode(u"base64")
234
elif "secfile" in config:
235
sf = open(config["secfile"])
236
self.secret = sf.read()
287
if u"secret" in config:
288
self.secret = config[u"secret"].decode(u"base64")
289
elif u"secfile" in config:
290
with closing(open(os.path.expanduser
292
(config[u"secfile"])))) as secfile:
293
self.secret = secfile.read()
239
295
raise TypeError(u"No secret or secfile for client %s"
241
self.host = config.get("host", "")
242
self.created = datetime.datetime.now()
297
self.host = config.get(u"host", u"")
298
self.created = datetime.datetime.utcnow()
300
self.last_enabled = None
243
301
self.last_checked_ok = None
244
self.timeout = string_to_delta(config["timeout"])
245
self.interval = string_to_delta(config["interval"])
246
self.stop_hook = stop_hook
302
self.timeout = string_to_delta(config[u"timeout"])
303
self.interval = string_to_delta(config[u"interval"])
304
self.disable_hook = disable_hook
247
305
self.checker = None
248
306
self.checker_initiator_tag = None
249
self.stop_initiator_tag = None
307
self.disable_initiator_tag = None
250
308
self.checker_callback_tag = None
251
self.check_command = config["checker"]
309
self.checker_command = config[u"checker"]
310
self.current_checker_command = None
311
self.last_connect = None
253
314
"""Start this client's checker and timeout hooks"""
315
if getattr(self, u"enabled", False):
318
self.last_enabled = datetime.datetime.utcnow()
254
319
# Schedule a new checker to be started an 'interval' from now,
255
320
# and every interval from then on.
256
self.checker_initiator_tag = gobject.timeout_add\
257
(self._interval_milliseconds,
321
self.checker_initiator_tag = (gobject.timeout_add
322
(self.interval_milliseconds(),
259
324
# Also start a new checker *right now*.
260
325
self.start_checker()
261
# Schedule a stop() when 'timeout' has passed
262
self.stop_initiator_tag = gobject.timeout_add\
263
(self._timeout_milliseconds,
267
The possibility that a client might be restarted is left open,
268
but not currently used."""
269
# If this client doesn't have a secret, it is already stopped.
270
if hasattr(self, "secret") and self.secret:
271
logger.info(u"Stopping client %s", self.name)
326
# Schedule a disable() when 'timeout' has passed
327
self.disable_initiator_tag = (gobject.timeout_add
328
(self.timeout_milliseconds(),
333
"""Disable this client."""
334
if not getattr(self, "enabled", False):
275
if getattr(self, "stop_initiator_tag", False):
276
gobject.source_remove(self.stop_initiator_tag)
277
self.stop_initiator_tag = None
278
if getattr(self, "checker_initiator_tag", False):
336
logger.info(u"Disabling client %s", self.name)
337
if getattr(self, u"disable_initiator_tag", False):
338
gobject.source_remove(self.disable_initiator_tag)
339
self.disable_initiator_tag = None
340
if getattr(self, u"checker_initiator_tag", False):
279
341
gobject.source_remove(self.checker_initiator_tag)
280
342
self.checker_initiator_tag = None
281
343
self.stop_checker()
344
if self.disable_hook:
345
self.disable_hook(self)
284
347
# Do not run this again if called by a gobject.timeout_add
286
350
def __del__(self):
287
self.stop_hook = None
289
def checker_callback(self, pid, condition):
351
self.disable_hook = None
354
def checker_callback(self, pid, condition, command):
290
355
"""The checker has completed, so take appropriate actions."""
291
now = datetime.datetime.now()
292
356
self.checker_callback_tag = None
293
357
self.checker = None
294
if os.WIFEXITED(condition) \
295
and (os.WEXITSTATUS(condition) == 0):
296
logger.info(u"Checker for %(name)s succeeded",
298
self.last_checked_ok = now
299
gobject.source_remove(self.stop_initiator_tag)
300
self.stop_initiator_tag = gobject.timeout_add\
301
(self._timeout_milliseconds,
303
elif not os.WIFEXITED(condition):
358
if os.WIFEXITED(condition):
359
exitstatus = os.WEXITSTATUS(condition)
361
logger.info(u"Checker for %(name)s succeeded",
365
logger.info(u"Checker for %(name)s failed",
304
368
logger.warning(u"Checker for %(name)s crashed?",
307
logger.info(u"Checker for %(name)s failed",
371
def checked_ok(self):
372
"""Bump up the timeout for this client.
374
This should only be called when the client has been seen,
377
self.last_checked_ok = datetime.datetime.utcnow()
378
gobject.source_remove(self.disable_initiator_tag)
379
self.disable_initiator_tag = (gobject.timeout_add
380
(self.timeout_milliseconds(),
309
383
def start_checker(self):
310
384
"""Start a new checker subprocess if one is not running.
311
386
If a checker already exists, leave it running and do
313
388
# The reason for not killing a running checker is that if we
364
465
if error.errno != errno.ESRCH: # No such process
366
467
self.checker = None
367
469
def still_valid(self):
368
470
"""Has the timeout not yet passed for this client?"""
369
now = datetime.datetime.now()
471
if not getattr(self, u"enabled", False):
473
now = datetime.datetime.utcnow()
370
474
if self.last_checked_ok is None:
371
475
return now < (self.created + self.timeout)
373
477
return now < (self.last_checked_ok + self.timeout)
376
def peer_certificate(session):
377
"Return the peer's OpenPGP certificate as a bytestring"
378
# If not an OpenPGP certificate...
379
if gnutls.library.functions.gnutls_certificate_type_get\
380
(session._c_object) \
381
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
382
# ...do the normal thing
383
return session.peer_certificate
384
list_size = ctypes.c_uint()
385
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
386
(session._c_object, ctypes.byref(list_size))
387
if list_size.value == 0:
390
return ctypes.string_at(cert.data, cert.size)
393
def fingerprint(openpgp):
394
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
395
# New GnuTLS "datum" with the OpenPGP public key
396
datum = gnutls.library.types.gnutls_datum_t\
397
(ctypes.cast(ctypes.c_char_p(openpgp),
398
ctypes.POINTER(ctypes.c_ubyte)),
399
ctypes.c_uint(len(openpgp)))
400
# New empty GnuTLS certificate
401
crt = gnutls.library.types.gnutls_openpgp_crt_t()
402
gnutls.library.functions.gnutls_openpgp_crt_init\
404
# Import the OpenPGP public key into the certificate
405
gnutls.library.functions.gnutls_openpgp_crt_import\
406
(crt, ctypes.byref(datum),
407
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
408
# New buffer for the fingerprint
409
buffer = ctypes.create_string_buffer(20)
410
buffer_length = ctypes.c_size_t()
411
# Get the fingerprint from the certificate into the buffer
412
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
413
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
414
# Deinit the certificate
415
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
416
# Convert the buffer to a Python bytestring
417
fpr = ctypes.string_at(buffer, buffer_length.value)
418
# Convert the bytestring to hexadecimal notation
419
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
423
class tcp_handler(SocketServer.BaseRequestHandler, object):
424
"""A TCP request handler class.
425
Instantiated by IPv6_TCPServer for each request to handle it.
480
class ClientDBus(Client, dbus.service.Object):
481
"""A Client class using D-Bus
484
dbus_object_path: dbus.ObjectPath
485
bus: dbus.SystemBus()
487
# dbus.service.Object doesn't use super(), so we can't either.
489
def __init__(self, bus = None, *args, **kwargs):
491
Client.__init__(self, *args, **kwargs)
492
# Only now, when this client is initialized, can it show up on
494
self.dbus_object_path = (dbus.ObjectPath
496
+ self.name.replace(u".", u"_")))
497
dbus.service.Object.__init__(self, self.bus,
498
self.dbus_object_path)
501
def _datetime_to_dbus(dt, variant_level=0):
502
"""Convert a UTC datetime.datetime() to a D-Bus type."""
503
return dbus.String(dt.isoformat(),
504
variant_level=variant_level)
507
oldstate = getattr(self, u"enabled", False)
508
r = Client.enable(self)
509
if oldstate != self.enabled:
511
self.PropertyChanged(dbus.String(u"enabled"),
512
dbus.Boolean(True, variant_level=1))
513
self.PropertyChanged(
514
dbus.String(u"last_enabled"),
515
self._datetime_to_dbus(self.last_enabled,
519
def disable(self, signal = True):
520
oldstate = getattr(self, u"enabled", False)
521
r = Client.disable(self)
522
if signal and oldstate != self.enabled:
524
self.PropertyChanged(dbus.String(u"enabled"),
525
dbus.Boolean(False, variant_level=1))
528
def __del__(self, *args, **kwargs):
530
self.remove_from_connection()
533
if hasattr(dbus.service.Object, u"__del__"):
534
dbus.service.Object.__del__(self, *args, **kwargs)
535
Client.__del__(self, *args, **kwargs)
537
def checker_callback(self, pid, condition, command,
539
self.checker_callback_tag = None
542
self.PropertyChanged(dbus.String(u"checker_running"),
543
dbus.Boolean(False, variant_level=1))
544
if os.WIFEXITED(condition):
545
exitstatus = os.WEXITSTATUS(condition)
547
self.CheckerCompleted(dbus.Int16(exitstatus),
548
dbus.Int64(condition),
549
dbus.String(command))
552
self.CheckerCompleted(dbus.Int16(-1),
553
dbus.Int64(condition),
554
dbus.String(command))
556
return Client.checker_callback(self, pid, condition, command,
559
def checked_ok(self, *args, **kwargs):
560
r = Client.checked_ok(self, *args, **kwargs)
562
self.PropertyChanged(
563
dbus.String(u"last_checked_ok"),
564
(self._datetime_to_dbus(self.last_checked_ok,
568
def start_checker(self, *args, **kwargs):
569
old_checker = self.checker
570
if self.checker is not None:
571
old_checker_pid = self.checker.pid
573
old_checker_pid = None
574
r = Client.start_checker(self, *args, **kwargs)
575
# Only if new checker process was started
576
if (self.checker is not None
577
and old_checker_pid != self.checker.pid):
579
self.CheckerStarted(self.current_checker_command)
580
self.PropertyChanged(
581
dbus.String(u"checker_running"),
582
dbus.Boolean(True, variant_level=1))
585
def stop_checker(self, *args, **kwargs):
586
old_checker = getattr(self, u"checker", None)
587
r = Client.stop_checker(self, *args, **kwargs)
588
if (old_checker is not None
589
and getattr(self, u"checker", None) is None):
590
self.PropertyChanged(dbus.String(u"checker_running"),
591
dbus.Boolean(False, variant_level=1))
594
## D-Bus methods & signals
595
_interface = u"se.bsnet.fukt.Mandos.Client"
598
@dbus.service.method(_interface)
600
return self.checked_ok()
602
# CheckerCompleted - signal
603
@dbus.service.signal(_interface, signature=u"nxs")
604
def CheckerCompleted(self, exitcode, waitstatus, command):
608
# CheckerStarted - signal
609
@dbus.service.signal(_interface, signature=u"s")
610
def CheckerStarted(self, command):
614
# GetAllProperties - method
615
@dbus.service.method(_interface, out_signature=u"a{sv}")
616
def GetAllProperties(self):
618
return dbus.Dictionary({
619
dbus.String(u"name"):
620
dbus.String(self.name, variant_level=1),
621
dbus.String(u"fingerprint"):
622
dbus.String(self.fingerprint, variant_level=1),
623
dbus.String(u"host"):
624
dbus.String(self.host, variant_level=1),
625
dbus.String(u"created"):
626
self._datetime_to_dbus(self.created,
628
dbus.String(u"last_enabled"):
629
(self._datetime_to_dbus(self.last_enabled,
631
if self.last_enabled is not None
632
else dbus.Boolean(False, variant_level=1)),
633
dbus.String(u"enabled"):
634
dbus.Boolean(self.enabled, variant_level=1),
635
dbus.String(u"last_checked_ok"):
636
(self._datetime_to_dbus(self.last_checked_ok,
638
if self.last_checked_ok is not None
639
else dbus.Boolean (False, variant_level=1)),
640
dbus.String(u"timeout"):
641
dbus.UInt64(self.timeout_milliseconds(),
643
dbus.String(u"interval"):
644
dbus.UInt64(self.interval_milliseconds(),
646
dbus.String(u"checker"):
647
dbus.String(self.checker_command,
649
dbus.String(u"checker_running"):
650
dbus.Boolean(self.checker is not None,
652
dbus.String(u"object_path"):
653
dbus.ObjectPath(self.dbus_object_path,
657
# IsStillValid - method
658
@dbus.service.method(_interface, out_signature=u"b")
659
def IsStillValid(self):
660
return self.still_valid()
662
# PropertyChanged - signal
663
@dbus.service.signal(_interface, signature=u"sv")
664
def PropertyChanged(self, property, value):
668
# ReceivedSecret - signal
669
@dbus.service.signal(_interface)
670
def ReceivedSecret(self):
675
@dbus.service.signal(_interface)
680
# SetChecker - method
681
@dbus.service.method(_interface, in_signature=u"s")
682
def SetChecker(self, checker):
683
"D-Bus setter method"
684
self.checker_command = checker
686
self.PropertyChanged(dbus.String(u"checker"),
687
dbus.String(self.checker_command,
691
@dbus.service.method(_interface, in_signature=u"s")
692
def SetHost(self, host):
693
"D-Bus setter method"
696
self.PropertyChanged(dbus.String(u"host"),
697
dbus.String(self.host, variant_level=1))
699
# SetInterval - method
700
@dbus.service.method(_interface, in_signature=u"t")
701
def SetInterval(self, milliseconds):
702
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
704
self.PropertyChanged(dbus.String(u"interval"),
705
(dbus.UInt64(self.interval_milliseconds(),
709
@dbus.service.method(_interface, in_signature=u"ay",
711
def SetSecret(self, secret):
712
"D-Bus setter method"
713
self.secret = str(secret)
715
# SetTimeout - method
716
@dbus.service.method(_interface, in_signature=u"t")
717
def SetTimeout(self, milliseconds):
718
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
720
self.PropertyChanged(dbus.String(u"timeout"),
721
(dbus.UInt64(self.timeout_milliseconds(),
725
@dbus.service.method(_interface)
730
# StartChecker - method
731
@dbus.service.method(_interface)
732
def StartChecker(self):
737
@dbus.service.method(_interface)
742
# StopChecker - method
743
@dbus.service.method(_interface)
744
def StopChecker(self):
750
class ClientHandler(socketserver.BaseRequestHandler, object):
751
"""A class to handle client connections.
753
Instantiated once for each connection to handle it.
426
754
Note: This will run in its own forked process."""
428
756
def handle(self):
429
757
logger.info(u"TCP connection from: %s",
430
unicode(self.client_address))
431
session = gnutls.connection.ClientSession\
432
(self.request, gnutls.connection.X509Credentials())
434
line = self.request.makefile().readline()
435
logger.debug(u"Protocol version: %r", line)
437
if int(line.strip().split()[0]) > 1:
439
except (ValueError, IndexError, RuntimeError), error:
440
logger.error(u"Unknown protocol version: %s", error)
443
# Note: gnutls.connection.X509Credentials is really a generic
444
# GnuTLS certificate credentials object so long as no X.509
445
# keys are added to it. Therefore, we can use it here despite
446
# using OpenPGP certificates.
448
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
449
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
451
priority = "NORMAL" # Fallback default, since this
453
if self.server.settings["priority"]:
454
priority = self.server.settings["priority"]
455
gnutls.library.functions.gnutls_priority_set_direct\
456
(session._c_object, priority, None);
460
except gnutls.errors.GNUTLSError, error:
461
logger.warning(u"Handshake failed: %s", error)
462
# Do not run session.bye() here: the session is not
463
# established. Just abandon the request.
466
fpr = fingerprint(peer_certificate(session))
467
except (TypeError, gnutls.errors.GNUTLSError), error:
468
logger.warning(u"Bad certificate: %s", error)
471
logger.debug(u"Fingerprint: %s", fpr)
473
for c in self.server.clients:
474
if c.fingerprint == fpr:
478
logger.warning(u"Client not found for fingerprint: %s",
482
# Have to check if client.still_valid(), since it is possible
483
# that the client timed out while establishing the GnuTLS
485
if not client.still_valid():
486
logger.warning(u"Client %(name)s is invalid",
491
while sent_size < len(client.secret):
492
sent = session.send(client.secret[sent_size:])
493
logger.debug(u"Sent: %d, remaining: %d",
494
sent, len(client.secret)
495
- (sent_size + sent))
500
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
501
"""IPv6 TCP server. Accepts 'None' as address and/or port.
758
unicode(self.client_address))
759
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
# Open IPC pipe to parent process
761
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
762
session = (gnutls.connection
763
.ClientSession(self.request,
767
line = self.request.makefile().readline()
768
logger.debug(u"Protocol version: %r", line)
770
if int(line.strip().split()[0]) > 1:
772
except (ValueError, IndexError, RuntimeError), error:
773
logger.error(u"Unknown protocol version: %s", error)
776
# Note: gnutls.connection.X509Credentials is really a
777
# generic GnuTLS certificate credentials object so long as
778
# no X.509 keys are added to it. Therefore, we can use it
779
# here despite using OpenPGP certificates.
781
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
# u"+AES-256-CBC", u"+SHA1",
783
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
785
# Use a fallback default, since this MUST be set.
786
priority = self.server.gnutls_priority
789
(gnutls.library.functions
790
.gnutls_priority_set_direct(session._c_object,
795
except gnutls.errors.GNUTLSError, error:
796
logger.warning(u"Handshake failed: %s", error)
797
# Do not run session.bye() here: the session is not
798
# established. Just abandon the request.
800
logger.debug(u"Handshake succeeded")
802
fpr = self.fingerprint(self.peer_certificate(session))
803
except (TypeError, gnutls.errors.GNUTLSError), error:
804
logger.warning(u"Bad certificate: %s", error)
807
logger.debug(u"Fingerprint: %s", fpr)
809
for c in self.server.clients:
810
if c.fingerprint == fpr:
814
ipc.write(u"NOTFOUND %s %s\n"
815
% (fpr, unicode(self.client_address)))
818
# Have to check if client.still_valid(), since it is
819
# possible that the client timed out while establishing
820
# the GnuTLS session.
821
if not client.still_valid():
822
ipc.write(u"INVALID %s\n" % client.name)
825
ipc.write(u"SENDING %s\n" % client.name)
827
while sent_size < len(client.secret):
828
sent = session.send(client.secret[sent_size:])
829
logger.debug(u"Sent: %d, remaining: %d",
830
sent, len(client.secret)
831
- (sent_size + sent))
836
def peer_certificate(session):
837
"Return the peer's OpenPGP certificate as a bytestring"
838
# If not an OpenPGP certificate...
839
if (gnutls.library.functions
840
.gnutls_certificate_type_get(session._c_object)
841
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
842
# ...do the normal thing
843
return session.peer_certificate
844
list_size = ctypes.c_uint(1)
845
cert_list = (gnutls.library.functions
846
.gnutls_certificate_get_peers
847
(session._c_object, ctypes.byref(list_size)))
848
if not bool(cert_list) and list_size.value != 0:
849
raise gnutls.errors.GNUTLSError(u"error getting peer"
851
if list_size.value == 0:
854
return ctypes.string_at(cert.data, cert.size)
857
def fingerprint(openpgp):
858
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
859
# New GnuTLS "datum" with the OpenPGP public key
860
datum = (gnutls.library.types
861
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
864
ctypes.c_uint(len(openpgp))))
865
# New empty GnuTLS certificate
866
crt = gnutls.library.types.gnutls_openpgp_crt_t()
867
(gnutls.library.functions
868
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
869
# Import the OpenPGP public key into the certificate
870
(gnutls.library.functions
871
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
872
gnutls.library.constants
873
.GNUTLS_OPENPGP_FMT_RAW))
874
# Verify the self signature in the key
875
crtverify = ctypes.c_uint()
876
(gnutls.library.functions
877
.gnutls_openpgp_crt_verify_self(crt, 0,
878
ctypes.byref(crtverify)))
879
if crtverify.value != 0:
880
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
881
raise (gnutls.errors.CertificateSecurityError
883
# New buffer for the fingerprint
884
buf = ctypes.create_string_buffer(20)
885
buf_len = ctypes.c_size_t()
886
# Get the fingerprint from the certificate into the buffer
887
(gnutls.library.functions
888
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
889
ctypes.byref(buf_len)))
890
# Deinit the certificate
891
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
892
# Convert the buffer to a Python bytestring
893
fpr = ctypes.string_at(buf, buf_len.value)
894
# Convert the bytestring to hexadecimal notation
895
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
899
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
900
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
901
def process_request(self, request, client_address):
902
"""Overrides and wraps the original process_request().
904
This function creates a new pipe in self.pipe
906
self.pipe = os.pipe()
907
super(ForkingMixInWithPipe,
908
self).process_request(request, client_address)
909
os.close(self.pipe[1]) # close write end
910
self.add_pipe(self.pipe[0])
911
def add_pipe(self, pipe):
912
"""Dummy function; override as necessary"""
916
class IPv6_TCPServer(ForkingMixInWithPipe,
917
socketserver.TCPServer, object):
918
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
503
settings: Server settings
504
clients: Set() of Client objects
921
enabled: Boolean; whether this server is activated yet
922
interface: None or a network interface name (string)
923
use_ipv6: Boolean; to use IPv6 or not
506
address_family = socket.AF_INET6
507
def __init__(self, *args, **kwargs):
508
if "settings" in kwargs:
509
self.settings = kwargs["settings"]
510
del kwargs["settings"]
511
if "clients" in kwargs:
512
self.clients = kwargs["clients"]
513
del kwargs["clients"]
514
return super(type(self), self).__init__(*args, **kwargs)
925
def __init__(self, server_address, RequestHandlerClass,
926
interface=None, use_ipv6=True):
927
self.interface = interface
929
self.address_family = socket.AF_INET6
930
socketserver.TCPServer.__init__(self, server_address,
515
932
def server_bind(self):
516
933
"""This overrides the normal server_bind() function
517
934
to bind to an interface if one was specified, and also NOT to
518
935
bind to an address or port if they were not specified."""
519
if self.settings["interface"]:
520
# 25 is from /usr/include/asm-i486/socket.h
521
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
523
self.socket.setsockopt(socket.SOL_SOCKET,
525
self.settings["interface"])
526
except socket.error, error:
527
if error[0] == errno.EPERM:
528
logger.error(u"No permission to"
529
u" bind to interface %s",
530
self.settings["interface"])
936
if self.interface is not None:
937
if SO_BINDTODEVICE is None:
938
logger.error(u"SO_BINDTODEVICE does not exist;"
939
u" cannot bind to interface %s",
943
self.socket.setsockopt(socket.SOL_SOCKET,
947
except socket.error, error:
948
if error[0] == errno.EPERM:
949
logger.error(u"No permission to"
950
u" bind to interface %s",
952
elif error[0] == errno.ENOPROTOOPT:
953
logger.error(u"SO_BINDTODEVICE not available;"
954
u" cannot bind to interface %s",
533
958
# Only bind(2) the socket if we really need to.
534
959
if self.server_address[0] or self.server_address[1]:
535
960
if not self.server_address[0]:
537
self.server_address = (in6addr_any,
961
if self.address_family == socket.AF_INET6:
962
any_address = u"::" # in6addr_any
964
any_address = socket.INADDR_ANY
965
self.server_address = (any_address,
538
966
self.server_address[1])
539
967
elif not self.server_address[1]:
540
968
self.server_address = (self.server_address[0],
542
# if self.settings["interface"]:
543
971
# self.server_address = (self.server_address[0],
549
return super(type(self), self).server_bind()
976
return socketserver.TCPServer.server_bind(self)
979
class MandosServer(IPv6_TCPServer):
983
clients: set of Client objects
984
gnutls_priority GnuTLS priority string
985
use_dbus: Boolean; to emit D-Bus signals or not
987
Assumes a gobject.MainLoop event loop.
989
def __init__(self, server_address, RequestHandlerClass,
990
interface=None, use_ipv6=True, clients=None,
991
gnutls_priority=None, use_dbus=True):
993
self.clients = clients
994
if self.clients is None:
996
self.use_dbus = use_dbus
997
self.gnutls_priority = gnutls_priority
998
IPv6_TCPServer.__init__(self, server_address,
1000
interface = interface,
1001
use_ipv6 = use_ipv6)
1002
def server_activate(self):
1004
return socketserver.TCPServer.server_activate(self)
1007
def add_pipe(self, pipe):
1008
# Call "handle_ipc" for both data and EOF events
1009
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1011
def handle_ipc(self, source, condition, file_objects={}):
1013
gobject.IO_IN: u"IN", # There is data to read.
1014
gobject.IO_OUT: u"OUT", # Data can be written (without
1016
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1017
gobject.IO_ERR: u"ERR", # Error condition.
1018
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1019
# broken, usually for pipes and
1022
conditions_string = ' | '.join(name
1024
condition_names.iteritems()
1025
if cond & condition)
1026
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1029
# Turn the pipe file descriptor into a Python file object
1030
if source not in file_objects:
1031
file_objects[source] = os.fdopen(source, u"r", 1)
1033
# Read a line from the file object
1034
cmdline = file_objects[source].readline()
1035
if not cmdline: # Empty line means end of file
1036
# close the IPC pipe
1037
file_objects[source].close()
1038
del file_objects[source]
1040
# Stop calling this function
1043
logger.debug(u"IPC command: %r", cmdline)
1045
# Parse and act on command
1046
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1048
if cmd == u"NOTFOUND":
1049
logger.warning(u"Client not found for fingerprint: %s",
1053
mandos_dbus_service.ClientNotFound(args)
1054
elif cmd == u"INVALID":
1055
for client in self.clients:
1056
if client.name == args:
1057
logger.warning(u"Client %s is invalid", args)
1063
logger.error(u"Unknown client %s is invalid", args)
1064
elif cmd == u"SENDING":
1065
for client in self.clients:
1066
if client.name == args:
1067
logger.info(u"Sending secret to %s", client.name)
1071
client.ReceivedSecret()
1074
logger.error(u"Sending secret to unknown client %s",
1077
logger.error(u"Unknown IPC command: %r", cmdline)
1079
# Keep calling this function
552
1083
def string_to_delta(interval):
553
1084
"""Parse a string and return a datetime.timedelta
555
>>> string_to_delta('7d')
1086
>>> string_to_delta(u'7d')
556
1087
datetime.timedelta(7)
557
>>> string_to_delta('60s')
1088
>>> string_to_delta(u'60s')
558
1089
datetime.timedelta(0, 60)
559
>>> string_to_delta('60m')
1090
>>> string_to_delta(u'60m')
560
1091
datetime.timedelta(0, 3600)
561
>>> string_to_delta('24h')
1092
>>> string_to_delta(u'24h')
562
1093
datetime.timedelta(1)
563
1094
>>> string_to_delta(u'1w')
564
1095
datetime.timedelta(7)
1096
>>> string_to_delta(u'5m 30s')
1097
datetime.timedelta(0, 330)
567
suffix=unicode(interval[-1])
568
value=int(interval[:-1])
570
delta = datetime.timedelta(value)
572
delta = datetime.timedelta(0, value)
574
delta = datetime.timedelta(0, 0, 0, 0, value)
576
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
578
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1099
timevalue = datetime.timedelta(0)
1100
for s in interval.split():
1102
suffix = unicode(s[-1])
1105
delta = datetime.timedelta(value)
1106
elif suffix == u"s":
1107
delta = datetime.timedelta(0, value)
1108
elif suffix == u"m":
1109
delta = datetime.timedelta(0, 0, 0, 0, value)
1110
elif suffix == u"h":
1111
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1112
elif suffix == u"w":
1113
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1116
except (ValueError, IndexError):
580
1117
raise ValueError
581
except (ValueError, IndexError):
586
def server_state_changed(state):
587
"""Derived from the Avahi example code"""
588
if state == avahi.SERVER_COLLISION:
589
logger.error(u"Server name collision")
591
elif state == avahi.SERVER_RUNNING:
595
def entry_group_state_changed(state, error):
596
"""Derived from the Avahi example code"""
597
logger.debug(u"state change: %i", state)
599
if state == avahi.ENTRY_GROUP_ESTABLISHED:
600
logger.debug(u"Service established.")
601
elif state == avahi.ENTRY_GROUP_COLLISION:
602
logger.warning(u"Service name collision.")
604
elif state == avahi.ENTRY_GROUP_FAILURE:
605
logger.critical(u"Error in group state changed %s",
607
raise AvahiGroupError("State changed: %s", str(error))
609
1122
def if_nametoindex(interface):
610
"""Call the C function if_nametoindex(), or equivalent"""
1123
"""Call the C function if_nametoindex(), or equivalent
1125
Note: This function cannot accept a unicode string."""
611
1126
global if_nametoindex
613
if "ctypes.util" not in sys.modules:
615
if_nametoindex = ctypes.cdll.LoadLibrary\
616
(ctypes.util.find_library("c")).if_nametoindex
1128
if_nametoindex = (ctypes.cdll.LoadLibrary
1129
(ctypes.util.find_library(u"c"))
617
1131
except (OSError, AttributeError):
618
if "struct" not in sys.modules:
620
if "fcntl" not in sys.modules:
1132
logger.warning(u"Doing if_nametoindex the hard way")
622
1133
def if_nametoindex(interface):
623
1134
"Get an interface index the hard way, i.e. using fcntl()"
624
1135
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
626
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
627
struct.pack("16s16x", interface))
629
interface_index = struct.unpack("I", ifreq[16:20])[0]
1136
with closing(socket.socket()) as s:
1137
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1138
struct.pack(str(u"16s16x"),
1140
interface_index = struct.unpack(str(u"I"),
630
1142
return interface_index
631
1143
return if_nametoindex(interface)
634
1146
def daemon(nochdir = False, noclose = False):
635
1147
"""See daemon(3). Standard BSD Unix function.
636
1149
This should really exist as os.daemon, but it doesn't (yet)."""
688
1207
# Default values for config file for server-global settings
689
server_defaults = { "interface": "",
694
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
695
"servicename": "Mandos",
1208
server_defaults = { u"interface": u"",
1213
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1214
u"servicename": u"Mandos",
1215
u"use_dbus": u"True",
1216
u"use_ipv6": u"True",
698
1219
# Parse config file for server-global settings
699
server_config = ConfigParser.SafeConfigParser(server_defaults)
1220
server_config = configparser.SafeConfigParser(server_defaults)
700
1221
del server_defaults
701
server_config.read(os.path.join(options.configdir, "mandos.conf"))
702
server_section = "server"
1222
server_config.read(os.path.join(options.configdir,
703
1224
# Convert the SafeConfigParser object to a dict
704
server_settings = dict(server_config.items(server_section))
705
# Use getboolean on the boolean config option
706
server_settings["debug"] = server_config.getboolean\
707
(server_section, "debug")
1225
server_settings = server_config.defaults()
1226
# Use the appropriate methods on the non-string config options
1227
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1228
server_settings[option] = server_config.getboolean(u"DEFAULT",
1230
if server_settings["port"]:
1231
server_settings["port"] = server_config.getint(u"DEFAULT",
708
1233
del server_config
710
1235
# Override the settings from the config file with command line
711
1236
# options, if set.
712
for option in ("interface", "address", "port", "debug",
713
"priority", "servicename", "configdir"):
1237
for option in (u"interface", u"address", u"port", u"debug",
1238
u"priority", u"servicename", u"configdir",
1239
u"use_dbus", u"use_ipv6"):
714
1240
value = getattr(options, option)
715
1241
if value is not None:
716
1242
server_settings[option] = value
1244
# Force all strings to be unicode
1245
for option in server_settings.keys():
1246
if type(server_settings[option]) is str:
1247
server_settings[option] = unicode(server_settings[option])
718
1248
# Now we have our good server settings in "server_settings"
720
debug = server_settings["debug"]
1250
##################################################################
1253
debug = server_settings[u"debug"]
1254
use_dbus = server_settings[u"use_dbus"]
1255
use_ipv6 = server_settings[u"use_ipv6"]
723
1258
syslogger.setLevel(logging.WARNING)
724
1259
console.setLevel(logging.WARNING)
726
if server_settings["servicename"] != "Mandos":
727
syslogger.setFormatter(logging.Formatter\
728
('Mandos (%s): %%(levelname)s:'
730
% server_settings["servicename"]))
1261
if server_settings[u"servicename"] != u"Mandos":
1262
syslogger.setFormatter(logging.Formatter
1263
(u'Mandos (%s) [%%(process)d]:'
1264
u' %%(levelname)s: %%(message)s'
1265
% server_settings[u"servicename"]))
732
1267
# Parse config file with clients
733
client_defaults = { "timeout": "1h",
735
"checker": "fping -q -- %%(host)s",
1268
client_defaults = { u"timeout": u"1h",
1270
u"checker": u"fping -q -- %%(host)s",
737
client_config = ConfigParser.SafeConfigParser(client_defaults)
738
client_config.read(os.path.join(server_settings["configdir"],
742
service = AvahiService(name = server_settings["servicename"],
743
type = "_mandos._tcp", );
744
if server_settings["interface"]:
745
service.interface = if_nametoindex(server_settings["interface"])
1273
client_config = configparser.SafeConfigParser(client_defaults)
1274
client_config.read(os.path.join(server_settings[u"configdir"],
1277
global mandos_dbus_service
1278
mandos_dbus_service = None
1280
tcp_server = MandosServer((server_settings[u"address"],
1281
server_settings[u"port"]),
1283
interface=server_settings[u"interface"],
1286
server_settings[u"priority"],
1288
pidfilename = u"/var/run/mandos.pid"
1290
pidfile = open(pidfilename, u"w")
1292
logger.error(u"Could not open file %r", pidfilename)
1295
uid = pwd.getpwnam(u"_mandos").pw_uid
1296
gid = pwd.getpwnam(u"_mandos").pw_gid
1299
uid = pwd.getpwnam(u"mandos").pw_uid
1300
gid = pwd.getpwnam(u"mandos").pw_gid
1303
uid = pwd.getpwnam(u"nobody").pw_uid
1304
gid = pwd.getpwnam(u"nobody").pw_gid
1311
except OSError, error:
1312
if error[0] != errno.EPERM:
1315
# Enable all possible GnuTLS debugging
1317
# "Use a log level over 10 to enable all debugging options."
1319
gnutls.library.functions.gnutls_global_set_log_level(11)
1321
@gnutls.library.types.gnutls_log_func
1322
def debug_gnutls(level, string):
1323
logger.debug(u"GnuTLS: %s", string[:-1])
1325
(gnutls.library.functions
1326
.gnutls_global_set_log_function(debug_gnutls))
747
1328
global main_loop
750
1329
# From the Avahi example code
751
1330
DBusGMainLoop(set_as_default=True )
752
1331
main_loop = gobject.MainLoop()
753
1332
bus = dbus.SystemBus()
754
server = dbus.Interface(
755
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
756
avahi.DBUS_INTERFACE_SERVER )
757
1333
# End of Avahi example code
760
def remove_from_clients(client):
761
clients.remove(client)
763
logger.critical(u"No clients left, exiting")
766
clients.update(Set(Client(name = section,
767
stop_hook = remove_from_clients,
769
= dict(client_config.items(section)))
770
for section in client_config.sections()))
772
logger.critical(u"No clients defined")
1335
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1336
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1337
service = AvahiService(name = server_settings[u"servicename"],
1338
servicetype = u"_mandos._tcp",
1339
protocol = protocol, bus = bus)
1340
if server_settings["interface"]:
1341
service.interface = (if_nametoindex
1342
(str(server_settings[u"interface"])))
1344
client_class = Client
1346
client_class = functools.partial(ClientDBus, bus = bus)
1347
tcp_server.clients.update(set(
1348
client_class(name = section,
1349
config= dict(client_config.items(section)))
1350
for section in client_config.sections()))
1351
if not tcp_server.clients:
1352
logger.warning(u"No clients defined")
1355
# Redirect stdin so all checkers get /dev/null
1356
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1357
os.dup2(null, sys.stdin.fileno())
1361
# No console logging
776
1362
logger.removeHandler(console)
1363
# Close all input and output, do double fork, etc.
779
pidfilename = "/var/run/mandos/mandos.pid"
782
pidfile = open(pidfilename, "w")
783
pidfile.write(str(pid) + "\n")
1367
with closing(pidfile):
1369
pidfile.write(str(pid) + "\n")
787
logger.error(u"Could not write %s file with PID %d",
788
pidfilename, os.getpid())
1372
logger.error(u"Could not write to file %r with PID %d",
1375
# "pidfile" was never created
791
1380
"Cleanup function; run on exit"
793
# From the Avahi example code
794
if not group is None:
797
# End of Avahi example code
800
client = clients.pop()
801
client.stop_hook = None
1383
while tcp_server.clients:
1384
client = tcp_server.clients.pop()
1385
client.disable_hook = None
804
1388
atexit.register(cleanup)