/mandos/release : revision 237.2.145

1

#!/usr/bin/python

2

3

import SocketServer

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

19

# the Free Software Foundation, either version 3 of the License, or

20

# (at your option) any later version.

21

#

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

25

# GNU General Public License for more details.

26

#

27

# You should have received a copy of the GNU General Public License

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

35

36

import SocketServer as socketserver

4

37

import socket

5

import select

6

from optparse import OptionParser

38

import optparse

7

39

import datetime

8

40

import errno

9

41

import gnutls.crypto

10

42

import gnutls.connection

11

43

import gnutls.errors

12

import ConfigParser

44

import gnutls.library.functions

45

import gnutls.library.constants

46

import gnutls.library.types

47

import ConfigParser as configparser

13

48

import sys

49

import re

50

import os

51

import signal

52

import subprocess

53

import atexit

54

import stat

55

import logging

56

import logging.handlers

57

import pwd

58

from contextlib import closing

59

import struct

60

import fcntl

61

import functools

62

63

import dbus

64

import dbus.service

65

import gobject

66

import avahi

67

from dbus.mainloop.glib import DBusGMainLoop

68

import ctypes

69

import ctypes.util

70

import xml.dom.minidom

71

import inspect

72

73

try:

74

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

75

except AttributeError:

76

try:

77

from IN import SO_BINDTODEVICE

78

except ImportError:

79

SO_BINDTODEVICE = None

80

81

82

version = "1.0.12"

83

84

logger = logging.Logger(u'mandos')

85

syslogger = (logging.handlers.SysLogHandler

86

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

87

address = "/dev/log"))

88

syslogger.setFormatter(logging.Formatter

89

(u'Mandos [%(process)d]: %(levelname)s:'

90

u' %(message)s'))

91

logger.addHandler(syslogger)

92

93

console = logging.StreamHandler()

94

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

95

u' %(levelname)s:'

96

u' %(message)s'))

97

logger.addHandler(console)

98

99

class AvahiError(Exception):

100

def __init__(self, value, *args, **kwargs):

101

self.value = value

102

super(AvahiError, self).__init__(value, *args, **kwargs)

103

def __unicode__(self):

104

return unicode(repr(self.value))

105

106

class AvahiServiceError(AvahiError):

107

pass

108

109

class AvahiGroupError(AvahiError):

110

pass

111

112

113

class AvahiService(object):

114

"""An Avahi (Zeroconf) service.

115

116

Attributes:

117

interface: integer; avahi.IF_UNSPEC or an interface index.

118

Used to optionally bind to the specified interface.

119

name: string; Example: u'Mandos'

120

type: string; Example: u'_mandos._tcp'.

121

See <http://www.dns-sd.org/ServiceTypes.html>

122

port: integer; what port to announce

123

TXT: list of strings; TXT record for the service

124

domain: string; Domain to publish on, default to .local if empty.

125

host: string; Host to publish records for, default is localhost

126

max_renames: integer; maximum number of renames

127

rename_count: integer; counter so we only rename after collisions

128

a sensible number of times

129

group: D-Bus Entry Group

130

server: D-Bus Server

131

bus: dbus.SystemBus()

132

"""

133

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

134

servicetype = None, port = None, TXT = None,

135

domain = u"", host = u"", max_renames = 32768,

136

protocol = avahi.PROTO_UNSPEC, bus = None):

137

self.interface = interface

138

self.name = name

139

self.type = servicetype

140

self.port = port

141

self.TXT = TXT if TXT is not None else []

142

self.domain = domain

143

self.host = host

144

self.rename_count = 0

145

self.max_renames = max_renames

146

self.protocol = protocol

147

self.group = None # our entry group

148

self.server = None

149

self.bus = bus

150

def rename(self):

151

"""Derived from the Avahi example code"""

152

if self.rename_count >= self.max_renames:

153

logger.critical(u"No suitable Zeroconf service name found"

154

u" after %i retries, exiting.",

155

self.rename_count)

156

raise AvahiServiceError(u"Too many renames")

157

self.name = self.server.GetAlternativeServiceName(self.name)

158

logger.info(u"Changing Zeroconf service name to %r ...",

159

unicode(self.name))

160

syslogger.setFormatter(logging.Formatter

161

(u'Mandos (%s) [%%(process)d]:'

162

u' %%(levelname)s: %%(message)s'

163

% self.name))

164

self.remove()

165

self.add()

166

self.rename_count += 1

167

def remove(self):

168

"""Derived from the Avahi example code"""

169

if self.group is not None:

170

self.group.Reset()

171

def add(self):

172

"""Derived from the Avahi example code"""

173

if self.group is None:

174

self.group = dbus.Interface(

175

self.bus.get_object(avahi.DBUS_NAME,

176

self.server.EntryGroupNew()),

177

avahi.DBUS_INTERFACE_ENTRY_GROUP)

178

self.group.connect_to_signal('StateChanged',

179

self

180

.entry_group_state_changed)

181

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

182

self.name, self.type)

183

self.group.AddService(

184

self.interface,

185

self.protocol,

186

dbus.UInt32(0), # flags

187

self.name, self.type,

188

self.domain, self.host,

189

dbus.UInt16(self.port),

190

avahi.string_array_to_txt_array(self.TXT))

191

self.group.Commit()

192

def entry_group_state_changed(self, state, error):

193

"""Derived from the Avahi example code"""

194

logger.debug(u"Avahi state change: %i", state)

195

196

if state == avahi.ENTRY_GROUP_ESTABLISHED:

197

logger.debug(u"Zeroconf service established.")

198

elif state == avahi.ENTRY_GROUP_COLLISION:

199

logger.warning(u"Zeroconf service name collision.")

200

self.rename()

201

elif state == avahi.ENTRY_GROUP_FAILURE:

202

logger.critical(u"Avahi: Error in group state changed %s",

203

unicode(error))

204

raise AvahiGroupError(u"State changed: %s"

205

% unicode(error))

206

def cleanup(self):

207

"""Derived from the Avahi example code"""

208

if self.group is not None:

209

self.group.Free()

210

self.group = None

211

def server_state_changed(self, state):

212

"""Derived from the Avahi example code"""

213

if state == avahi.SERVER_COLLISION:

214

logger.error(u"Zeroconf server name collision")

215

self.remove()

216

elif state == avahi.SERVER_RUNNING:

217

self.add()

218

def activate(self):

219

"""Derived from the Avahi example code"""

220

if self.server is None:

221

self.server = dbus.Interface(

222

self.bus.get_object(avahi.DBUS_NAME,

223

avahi.DBUS_PATH_SERVER),

224

avahi.DBUS_INTERFACE_SERVER)

225

self.server.connect_to_signal(u"StateChanged",

226

self.server_state_changed)

227

self.server_state_changed(self.server.GetState())

14

228

15

229

16

230

class Client(object):

17

def __init__(self, name=None, options=None, dn=None,

18

password=None, passfile=None, fqdn=None,

19

timeout=None, interval=-1):

231

"""A representation of a client host served by this server.

232

233

Attributes:

234

name: string; from the config file, used in log messages and

235

D-Bus identifiers

236

fingerprint: string (40 or 32 hexadecimal digits); used to

237

uniquely identify the client

238

secret: bytestring; sent verbatim (over TLS) to client

239

host: string; available for use by the checker command

240

created: datetime.datetime(); (UTC) object creation

241

last_enabled: datetime.datetime(); (UTC)

242

enabled: bool()

243

last_checked_ok: datetime.datetime(); (UTC) or None

244

timeout: datetime.timedelta(); How long from last_checked_ok

245

until this client is invalid

246

interval: datetime.timedelta(); How often to start a new checker

247

disable_hook: If set, called by disable() as disable_hook(self)

248

checker: subprocess.Popen(); a running checker process used

249

to see if the client lives.

250

'None' if no process is running.

251

checker_initiator_tag: a gobject event source tag, or None

252

disable_initiator_tag: - '' -

253

checker_callback_tag: - '' -

254

checker_command: string; External command which is run to check if

255

client lives. %() expansions are done at

256

runtime with vars(self) as dict, so that for

257

instance %(name)s can be used in the command.

258

current_checker_command: string; current running checker_command

259

"""

260

261

@staticmethod

262

def _timedelta_to_milliseconds(td):

263

"Convert a datetime.timedelta() to milliseconds"

264

return ((td.days * 24 * 60 * 60 * 1000)

265

+ (td.seconds * 1000)

266

+ (td.microseconds // 1000))

267

268

def timeout_milliseconds(self):

269

"Return the 'timeout' attribute in milliseconds"

270

return self._timedelta_to_milliseconds(self.timeout)

271

272

def interval_milliseconds(self):

273

"Return the 'interval' attribute in milliseconds"

274

return self._timedelta_to_milliseconds(self.interval)

275

276

def __init__(self, name = None, disable_hook=None, config=None):

277

"""Note: the 'checker' key in 'config' sets the

278

'checker_command' attribute and *not* the 'checker'

279

attribute."""

20

280

self.name = name

21

self.dn = dn

22

if password:

23

self.password = password

24

elif passfile:

25

self.password = open(passfile).readall()

26

else:

27

print "No Password or Passfile in client config file"

28

# raise RuntimeError XXX

29

self.password = "gazonk"

30

self.fqdn = fqdn

31

self.created = datetime.datetime.now()

32

self.last_seen = None

33

if timeout is None:

34

timeout = options.timeout

35

self.timeout = timeout

36

if interval == -1:

37

interval = options.interval

38

self.interval = interval

39

self.next_check = datetime.datetime.now()

40

41

42

class server_metaclass(type):

43

"Common behavior for the UDP and TCP server classes"

44

def __new__(cls, name, bases, attrs):

45

attrs["address_family"] = socket.AF_INET6

46

attrs["allow_reuse_address"] = True

47

def server_bind(self):

48

if self.options.interface:

49

if not hasattr(socket, "SO_BINDTODEVICE"):

50

# From /usr/include/asm-i486/socket.h

51

socket.SO_BINDTODEVICE = 25

281

if config is None:

282

config = {}

283

logger.debug(u"Creating client %r", self.name)

284

# Uppercase and remove spaces from fingerprint for later

285

# comparison purposes with return value from the fingerprint()

286

# function

287

self.fingerprint = (config[u"fingerprint"].upper()

288

.replace(u" ", u""))

289

logger.debug(u" Fingerprint: %s", self.fingerprint)

290

if u"secret" in config:

291

self.secret = config[u"secret"].decode(u"base64")

292

elif u"secfile" in config:

293

with closing(open(os.path.expanduser

294

(os.path.expandvars

295

(config[u"secfile"])))) as secfile:

296

self.secret = secfile.read()

297

else:

298

raise TypeError(u"No secret or secfile for client %s"

299

% self.name)

300

self.host = config.get(u"host", u"")

301

self.created = datetime.datetime.utcnow()

302

self.enabled = False

303

self.last_enabled = None

304

self.last_checked_ok = None

305

self.timeout = string_to_delta(config[u"timeout"])

306

self.interval = string_to_delta(config[u"interval"])

307

self.disable_hook = disable_hook

308

self.checker = None

309

self.checker_initiator_tag = None

310

self.disable_initiator_tag = None

311

self.checker_callback_tag = None

312

self.checker_command = config[u"checker"]

313

self.current_checker_command = None

314

self.last_connect = None

315

316

def enable(self):

317

"""Start this client's checker and timeout hooks"""

318

if getattr(self, u"enabled", False):

319

# Already enabled

320

return

321

self.last_enabled = datetime.datetime.utcnow()

322

# Schedule a new checker to be started an 'interval' from now,

323

# and every interval from then on.

324

self.checker_initiator_tag = (gobject.timeout_add

325

(self.interval_milliseconds(),

326

self.start_checker))

327

# Also start a new checker *right now*.

328

self.start_checker()

329

# Schedule a disable() when 'timeout' has passed

330

self.disable_initiator_tag = (gobject.timeout_add

331

(self.timeout_milliseconds(),

332

self.disable))

333

self.enabled = True

334

335

def disable(self):

336

"""Disable this client."""

337

if not getattr(self, "enabled", False):

338

return False

339

logger.info(u"Disabling client %s", self.name)

340

if getattr(self, u"disable_initiator_tag", False):

341

gobject.source_remove(self.disable_initiator_tag)

342

self.disable_initiator_tag = None

343

if getattr(self, u"checker_initiator_tag", False):

344

gobject.source_remove(self.checker_initiator_tag)

345

self.checker_initiator_tag = None

346

self.stop_checker()

347

if self.disable_hook:

348

self.disable_hook(self)

349

self.enabled = False

350

# Do not run this again if called by a gobject.timeout_add

351

return False

352

353

def __del__(self):

354

self.disable_hook = None

355

self.disable()

356

357

def checker_callback(self, pid, condition, command):

358

"""The checker has completed, so take appropriate actions."""

359

self.checker_callback_tag = None

360

self.checker = None

361

if os.WIFEXITED(condition):

362

exitstatus = os.WEXITSTATUS(condition)

363

if exitstatus == 0:

364

logger.info(u"Checker for %(name)s succeeded",

365

vars(self))

366

self.checked_ok()

367

else:

368

logger.info(u"Checker for %(name)s failed",

369

vars(self))

370

else:

371

logger.warning(u"Checker for %(name)s crashed?",

372

vars(self))

373

374

def checked_ok(self):

375

"""Bump up the timeout for this client.

376

377

This should only be called when the client has been seen,

378

alive and well.

379

"""

380

self.last_checked_ok = datetime.datetime.utcnow()

381

gobject.source_remove(self.disable_initiator_tag)

382

self.disable_initiator_tag = (gobject.timeout_add

383

(self.timeout_milliseconds(),

384

self.disable))

385

386

def start_checker(self):

387

"""Start a new checker subprocess if one is not running.

388

389

If a checker already exists, leave it running and do

390

nothing."""

391

# The reason for not killing a running checker is that if we

392

# did that, then if a checker (for some reason) started

393

# running slowly and taking more than 'interval' time, the

394

# client would inevitably timeout, since no checker would get

395

# a chance to run to completion. If we instead leave running

396

# checkers alone, the checker would have to take more time

397

# than 'timeout' for the client to be declared invalid, which

398

# is as it should be.

399

400

# If a checker exists, make sure it is not a zombie

401

if self.checker is not None:

402

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

403

if pid:

404

logger.warning(u"Checker was a zombie")

405

gobject.source_remove(self.checker_callback_tag)

406

self.checker_callback(pid, status,

407

self.current_checker_command)

408

# Start a new checker if needed

409

if self.checker is None:

410

try:

411

# In case checker_command has exactly one % operator

412

command = self.checker_command % self.host

413

except TypeError:

414

# Escape attributes for the shell

415

escaped_attrs = dict((key,

416

re.escape(unicode(str(val),

417

errors=

418

u'replace')))

419

for key, val in

420

vars(self).iteritems())

421

try:

422

command = self.checker_command % escaped_attrs

423

except TypeError, error:

424

logger.error(u'Could not format string "%s":'

425

u' %s', self.checker_command, error)

426

return True # Try again later

427

self.current_checker_command = command

428

try:

429

logger.info(u"Starting checker %r for %s",

430

command, self.name)

431

# We don't need to redirect stdout and stderr, since

432

# in normal mode, that is already done by daemon(),

433

# and in debug mode we don't want to. (Stdin is

434

# always replaced by /dev/null.)

435

self.checker = subprocess.Popen(command,

436

close_fds=True,

437

shell=True, cwd=u"/")

438

self.checker_callback_tag = (gobject.child_watch_add

439

(self.checker.pid,

440

self.checker_callback,

441

data=command))

442

# The checker may have completed before the gobject

443

# watch was added. Check for this.

444

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

445

if pid:

446

gobject.source_remove(self.checker_callback_tag)

447

self.checker_callback(pid, status, command)

448

except OSError, error:

449

logger.error(u"Failed to start subprocess: %s",

450

error)

451

# Re-run this periodically if run by gobject.timeout_add

452

return True

453

454

def stop_checker(self):

455

"""Force the checker process, if any, to stop."""

456

if self.checker_callback_tag:

457

gobject.source_remove(self.checker_callback_tag)

458

self.checker_callback_tag = None

459

if getattr(self, u"checker", None) is None:

460

return

461

logger.debug(u"Stopping checker for %(name)s", vars(self))

462

try:

463

os.kill(self.checker.pid, signal.SIGTERM)

464

#os.sleep(0.5)

465

#if self.checker.poll() is None:

466

# os.kill(self.checker.pid, signal.SIGKILL)

467

except OSError, error:

468

if error.errno != errno.ESRCH: # No such process

469

raise

470

self.checker = None

471

472

def still_valid(self):

473

"""Has the timeout not yet passed for this client?"""

474

if not getattr(self, u"enabled", False):

475

return False

476

now = datetime.datetime.utcnow()

477

if self.last_checked_ok is None:

478

return now < (self.created + self.timeout)

479

else:

480

return now < (self.last_checked_ok + self.timeout)

481

482

483

def dbus_service_property(dbus_interface, signature=u"v",

484

access=u"readwrite", byte_arrays=False):

485

"""Decorators for marking methods of a DBusObjectWithProperties to

486

become properties on the D-Bus.

487

488

The decorated method will be called with no arguments by "Get"

489

and with one argument by "Set".

490

491

The parameters, where they are supported, are the same as

492

dbus.service.method, except there is only "signature", since the

493

type from Get() and the type sent to Set() is the same.

494

"""

495

def decorator(func):

496

func._dbus_is_property = True

497

func._dbus_interface = dbus_interface

498

func._dbus_signature = signature

499

func._dbus_access = access

500

func._dbus_name = func.__name__

501

if func._dbus_name.endswith(u"_dbus_property"):

502

func._dbus_name = func._dbus_name[:-14]

503

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

504

return func

505

return decorator

506

507

508

class DBusPropertyException(dbus.exceptions.DBusException):

509

"""A base class for D-Bus property-related exceptions

510

"""

511

def __unicode__(self):

512

return unicode(str(self))

513

514

515

class DBusPropertyAccessException(DBusPropertyException):

516

"""A property's access permissions disallows an operation.

517

"""

518

pass

519

520

521

class DBusPropertyNotFound(DBusPropertyException):

522

"""An attempt was made to access a non-existing property.

523

"""

524

pass

525

526

527

class DBusObjectWithProperties(dbus.service.Object):

528

"""A D-Bus object with properties.

529

530

Classes inheriting from this can use the dbus_service_property

531

decorator to expose methods as D-Bus properties. It exposes the

532

standard Get(), Set(), and GetAll() methods on the D-Bus.

533

"""

534

535

@staticmethod

536

def _is_dbus_property(obj):

537

return getattr(obj, u"_dbus_is_property", False)

538

539

def _get_all_dbus_properties(self):

540

"""Returns a generator of (name, attribute) pairs

541

"""

542

return ((prop._dbus_name, prop)

543

for name, prop in

544

inspect.getmembers(self, self._is_dbus_property))

545

546

def _get_dbus_property(self, interface_name, property_name):

547

"""Returns a bound method if one exists which is a D-Bus

548

property with the specified name and interface.

549

"""

550

for name in (property_name,

551

property_name + u"_dbus_property"):

552

prop = getattr(self, name, None)

553

if (prop is None

554

or not self._is_dbus_property(prop)

555

or prop._dbus_name != property_name

556

or (interface_name and prop._dbus_interface

557

and interface_name != prop._dbus_interface)):

558

continue

559

return prop

560

# No such property

561

raise DBusPropertyNotFound(self.dbus_object_path + u":"

562

+ interface_name + u"."

563

+ property_name)

564

565

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

566

out_signature=u"v")

567

def Get(self, interface_name, property_name):

568

"""Standard D-Bus property Get() method, see D-Bus standard.

569

"""

570

prop = self._get_dbus_property(interface_name, property_name)

571

if prop._dbus_access == u"write":

572

raise DBusPropertyAccessException(property_name)

573

value = prop()

574

if not hasattr(value, u"variant_level"):

575

return value

576

return type(value)(value, variant_level=value.variant_level+1)

577

578

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

579

def Set(self, interface_name, property_name, value):

580

"""Standard D-Bus property Set() method, see D-Bus standard.

581

"""

582

prop = self._get_dbus_property(interface_name, property_name)

583

if prop._dbus_access == u"read":

584

raise DBusPropertyAccessException(property_name)

585

if prop._dbus_get_args_options[u"byte_arrays"]:

586

value = dbus.ByteArray(''.join(unichr(byte)

587

for byte in value))

588

prop(value)

589

590

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

591

out_signature=u"a{sv}")

592

def GetAll(self, interface_name):

593

"""Standard D-Bus property GetAll() method, see D-Bus

594

standard.

595

596

Note: Will not include properties with access="write".

597

"""

598

all = {}

599

for name, prop in self._get_all_dbus_properties():

600

if (interface_name

601

and interface_name != prop._dbus_interface):

602

# Interface non-empty but did not match

603

continue

604

# Ignore write-only properties

605

if prop._dbus_access == u"write":

606

continue

607

value = prop()

608

if not hasattr(value, u"variant_level"):

609

all[name] = value

610

continue

611

all[name] = type(value)(value, variant_level=

612

value.variant_level+1)

613

return dbus.Dictionary(all, signature=u"sv")

614

615

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

616

out_signature=u"s",

617

path_keyword='object_path',

618

connection_keyword='connection')

619

def Introspect(self, object_path, connection):

620

"""Standard D-Bus method, overloaded to insert property tags.

621

"""

622

xmlstring = dbus.service.Object.Introspect(self, object_path,

623

connection)

624

document = xml.dom.minidom.parseString(xmlstring)

625

del xmlstring

626

def make_tag(document, name, prop):

627

e = document.createElement(u"property")

628

e.setAttribute(u"name", name)

629

e.setAttribute(u"type", prop._dbus_signature)

630

e.setAttribute(u"access", prop._dbus_access)

631

return e

632

for if_tag in document.getElementsByTagName(u"interface"):

633

for tag in (make_tag(document, name, prop)

634

for name, prop

635

in self._get_all_dbus_properties()

636

if prop._dbus_interface

637

== if_tag.getAttribute(u"name")):

638

if_tag.appendChild(tag)

639

xmlstring = document.toxml(u"utf-8")

640

document.unlink()

641

return xmlstring

642

643

644

class ClientDBus(Client, DBusObjectWithProperties):

645

"""A Client class using D-Bus

646

647

Attributes:

648

dbus_object_path: dbus.ObjectPath

649

bus: dbus.SystemBus()

650

"""

651

# dbus.service.Object doesn't use super(), so we can't either.

652

653

def __init__(self, bus = None, *args, **kwargs):

654

self.bus = bus

655

Client.__init__(self, *args, **kwargs)

656

# Only now, when this client is initialized, can it show up on

657

# the D-Bus

658

self.dbus_object_path = (dbus.ObjectPath

659

(u"/clients/"

660

+ self.name.replace(u".", u"_")))

661

DBusObjectWithProperties.__init__(self, self.bus,

662

self.dbus_object_path)

663

664

@staticmethod

665

def _datetime_to_dbus(dt, variant_level=0):

666

"""Convert a UTC datetime.datetime() to a D-Bus type."""

667

return dbus.String(dt.isoformat(),

668

variant_level=variant_level)

669

670

def enable(self):

671

oldstate = getattr(self, u"enabled", False)

672

r = Client.enable(self)

673

if oldstate != self.enabled:

674

# Emit D-Bus signals

675

self.PropertyChanged(dbus.String(u"enabled"),

676

dbus.Boolean(True, variant_level=1))

677

self.PropertyChanged(

678

dbus.String(u"last_enabled"),

679

self._datetime_to_dbus(self.last_enabled,

680

variant_level=1))

681

return r

682

683

def disable(self, signal = True):

684

oldstate = getattr(self, u"enabled", False)

685

r = Client.disable(self)

686

if signal and oldstate != self.enabled:

687

# Emit D-Bus signal

688

self.PropertyChanged(dbus.String(u"enabled"),

689

dbus.Boolean(False, variant_level=1))

690

return r

691

692

def __del__(self, *args, **kwargs):

693

try:

694

self.remove_from_connection()

695

except LookupError:

696

pass

697

if hasattr(DBusObjectWithProperties, u"__del__"):

698

DBusObjectWithProperties.__del__(self, *args, **kwargs)

699

Client.__del__(self, *args, **kwargs)

700

701

def checker_callback(self, pid, condition, command,

702

*args, **kwargs):

703

self.checker_callback_tag = None

704

self.checker = None

705

# Emit D-Bus signal

706

self.PropertyChanged(dbus.String(u"checker_running"),

707

dbus.Boolean(False, variant_level=1))

708

if os.WIFEXITED(condition):

709

exitstatus = os.WEXITSTATUS(condition)

710

# Emit D-Bus signal

711

self.CheckerCompleted(dbus.Int16(exitstatus),

712

dbus.Int64(condition),

713

dbus.String(command))

714

else:

715

# Emit D-Bus signal

716

self.CheckerCompleted(dbus.Int16(-1),

717

dbus.Int64(condition),

718

dbus.String(command))

719

720

return Client.checker_callback(self, pid, condition, command,

721

*args, **kwargs)

722

723

def checked_ok(self, *args, **kwargs):

724

r = Client.checked_ok(self, *args, **kwargs)

725

# Emit D-Bus signal

726

self.PropertyChanged(

727

dbus.String(u"last_checked_ok"),

728

(self._datetime_to_dbus(self.last_checked_ok,

729

variant_level=1)))

730

return r

731

732

def start_checker(self, *args, **kwargs):

733

old_checker = self.checker

734

if self.checker is not None:

735

old_checker_pid = self.checker.pid

736

else:

737

old_checker_pid = None

738

r = Client.start_checker(self, *args, **kwargs)

739

# Only if new checker process was started

740

if (self.checker is not None

741

and old_checker_pid != self.checker.pid):

742

# Emit D-Bus signal

743

self.CheckerStarted(self.current_checker_command)

744

self.PropertyChanged(

745

dbus.String(u"checker_running"),

746

dbus.Boolean(True, variant_level=1))

747

return r

748

749

def stop_checker(self, *args, **kwargs):

750

old_checker = getattr(self, u"checker", None)

751

r = Client.stop_checker(self, *args, **kwargs)

752

if (old_checker is not None

753

and getattr(self, u"checker", None) is None):

754

self.PropertyChanged(dbus.String(u"checker_running"),

755

dbus.Boolean(False, variant_level=1))

756

return r

757

758

## D-Bus methods & signals

759

_interface = u"se.bsnet.fukt.Mandos.Client"

760

761

# CheckedOK - method

762

@dbus.service.method(_interface)

763

def CheckedOK(self):

764

return self.checked_ok()

765

766

# CheckerCompleted - signal

767

@dbus.service.signal(_interface, signature=u"nxs")

768

def CheckerCompleted(self, exitcode, waitstatus, command):

769

"D-Bus signal"

770

pass

771

772

# CheckerStarted - signal

773

@dbus.service.signal(_interface, signature=u"s")

774

def CheckerStarted(self, command):

775

"D-Bus signal"

776

pass

777

778

# PropertyChanged - signal

779

@dbus.service.signal(_interface, signature=u"sv")

780

def PropertyChanged(self, property, value):

781

"D-Bus signal"

782

pass

783

784

# ReceivedSecret - signal

785

@dbus.service.signal(_interface)

786

def ReceivedSecret(self):

787

"D-Bus signal"

788

pass

789

790

# Rejected - signal

791

@dbus.service.signal(_interface)

792

def Rejected(self):

793

"D-Bus signal"

794

pass

795

796

# Enable - method

797

@dbus.service.method(_interface)

798

def Enable(self):

799

"D-Bus method"

800

self.enable()

801

802

# StartChecker - method

803

@dbus.service.method(_interface)

804

def StartChecker(self):

805

"D-Bus method"

806

self.start_checker()

807

808

# Disable - method

809

@dbus.service.method(_interface)

810

def Disable(self):

811

"D-Bus method"

812

self.disable()

813

814

# StopChecker - method

815

@dbus.service.method(_interface)

816

def StopChecker(self):

817

self.stop_checker()

818

819

# name - property

820

@dbus_service_property(_interface, signature=u"s", access=u"read")

821

def name_dbus_property(self):

822

return dbus.String(self.name)

823

824

# fingerprint - property

825

@dbus_service_property(_interface, signature=u"s", access=u"read")

826

def fingerprint_dbus_property(self):

827

return dbus.String(self.fingerprint)

828

829

# host - property

830

@dbus_service_property(_interface, signature=u"s",

831

access=u"readwrite")

832

def host_dbus_property(self, value=None):

833

if value is None: # get

834

return dbus.String(self.host)

835

self.host = value

836

# Emit D-Bus signal

837

self.PropertyChanged(dbus.String(u"host"),

838

dbus.String(value, variant_level=1))

839

840

# created - property

841

@dbus_service_property(_interface, signature=u"s", access=u"read")

842

def created_dbus_property(self):

843

return dbus.String(self._datetime_to_dbus(self.created))

844

845

# last_enabled - property

846

@dbus_service_property(_interface, signature=u"s", access=u"read")

847

def last_enabled_dbus_property(self):

848

if self.last_enabled is None:

849

return dbus.String(u"")

850

return dbus.String(self._datetime_to_dbus(self.last_enabled))

851

852

# enabled - property

853

@dbus_service_property(_interface, signature=u"b",

854

access=u"readwrite")

855

def enabled_dbus_property(self, value=None):

856

if value is None: # get

857

return dbus.Boolean(self.enabled)

858

if value:

859

self.enable()

860

else:

861

self.disable()

862

863

# last_checked_ok - property

864

@dbus_service_property(_interface, signature=u"s",

865

access=u"readwrite")

866

def last_checked_ok_dbus_property(self, value=None):

867

if value is not None:

868

self.checked_ok()

869

return

870

if self.last_checked_ok is None:

871

return dbus.String(u"")

872

return dbus.String(self._datetime_to_dbus(self

873

.last_checked_ok))

874

875

# timeout - property

876

@dbus_service_property(_interface, signature=u"t",

877

access=u"readwrite")

878

def timeout_dbus_property(self, value=None):

879

if value is None: # get

880

return dbus.UInt64(self.timeout_milliseconds())

881

self.timeout = datetime.timedelta(0, 0, 0, value)

882

# Emit D-Bus signal

883

self.PropertyChanged(dbus.String(u"timeout"),

884

dbus.UInt64(value, variant_level=1))

885

if getattr(self, u"disable_initiator_tag", None) is None:

886

return

887

# Reschedule timeout

888

gobject.source_remove(self.disable_initiator_tag)

889

self.disable_initiator_tag = None

890

time_to_die = (self.

891

_timedelta_to_milliseconds((self

892

.last_checked_ok

893

+ self.timeout)

894

- datetime.datetime

895

.utcnow()))

896

if time_to_die <= 0:

897

# The timeout has passed

898

self.disable()

899

else:

900

self.disable_initiator_tag = (gobject.timeout_add

901

(time_to_die, self.disable))

902

903

# interval - property

904

@dbus_service_property(_interface, signature=u"t",

905

access=u"readwrite")

906

def interval_dbus_property(self, value=None):

907

if value is None: # get

908

return dbus.UInt64(self.interval_milliseconds())

909

self.interval = datetime.timedelta(0, 0, 0, value)

910

# Emit D-Bus signal

911

self.PropertyChanged(dbus.String(u"interval"),

912

dbus.UInt64(value, variant_level=1))

913

if getattr(self, u"checker_initiator_tag", None) is None:

914

return

915

# Reschedule checker run

916

gobject.source_remove(self.checker_initiator_tag)

917

self.checker_initiator_tag = (gobject.timeout_add

918

(value, self.start_checker))

919

self.start_checker() # Start one now, too

920

921

# checker - property

922

@dbus_service_property(_interface, signature=u"s",

923

access=u"readwrite")

924

def checker_dbus_property(self, value=None):

925

if value is None: # get

926

return dbus.String(self.checker_command)

927

self.checker_command = value

928

# Emit D-Bus signal

929

self.PropertyChanged(dbus.String(u"checker"),

930

dbus.String(self.checker_command,

931

variant_level=1))

932

933

# checker_running - property

934

@dbus_service_property(_interface, signature=u"b",

935

access=u"readwrite")

936

def checker_running_dbus_property(self, value=None):

937

if value is None: # get

938

return dbus.Boolean(self.checker is not None)

939

if value:

940

self.start_checker()

941

else:

942

self.stop_checker()

943

944

# object_path - property

945

@dbus_service_property(_interface, signature=u"o", access=u"read")

946

def object_path_dbus_property(self):

947

return self.dbus_object_path # is already a dbus.ObjectPath

948

949

# secret = property

950

@dbus_service_property(_interface, signature=u"ay",

951

access=u"write", byte_arrays=True)

952

def secret_dbus_property(self, value):

953

self.secret = str(value)

954

955

del _interface

956

957

958

class ClientHandler(socketserver.BaseRequestHandler, object):

959

"""A class to handle client connections.

960

961

Instantiated once for each connection to handle it.

962

Note: This will run in its own forked process."""

963

964

def handle(self):

965

logger.info(u"TCP connection from: %s",

966

unicode(self.client_address))

967

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

968

# Open IPC pipe to parent process

969

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

970

session = (gnutls.connection

971

.ClientSession(self.request,

972

gnutls.connection

973

.X509Credentials()))

974

975

line = self.request.makefile().readline()

976

logger.debug(u"Protocol version: %r", line)

977

try:

978

if int(line.strip().split()[0]) > 1:

979

raise RuntimeError

980

except (ValueError, IndexError, RuntimeError), error:

981

logger.error(u"Unknown protocol version: %s", error)

982

return

983

984

# Note: gnutls.connection.X509Credentials is really a

985

# generic GnuTLS certificate credentials object so long as

986

# no X.509 keys are added to it. Therefore, we can use it

987

# here despite using OpenPGP certificates.

988

989

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

990

# u"+AES-256-CBC", u"+SHA1",

991

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

992

# u"+DHE-DSS"))

993

# Use a fallback default, since this MUST be set.

994

priority = self.server.gnutls_priority

995

if priority is None:

996

priority = u"NORMAL"

997

(gnutls.library.functions

998

.gnutls_priority_set_direct(session._c_object,

999

priority, None))

1000

1001

try:

1002

session.handshake()

1003

except gnutls.errors.GNUTLSError, error:

1004

logger.warning(u"Handshake failed: %s", error)

1005

# Do not run session.bye() here: the session is not

1006

# established. Just abandon the request.

1007

return

1008

logger.debug(u"Handshake succeeded")

1009

try:

1010

fpr = self.fingerprint(self.peer_certificate(session))

1011

except (TypeError, gnutls.errors.GNUTLSError), error:

1012

logger.warning(u"Bad certificate: %s", error)

1013

session.bye()

1014

return

1015

logger.debug(u"Fingerprint: %s", fpr)

1016

1017

for c in self.server.clients:

1018

if c.fingerprint == fpr:

1019

client = c

1020

break

1021

else:

1022

ipc.write(u"NOTFOUND %s %s\n"

1023

% (fpr, unicode(self.client_address)))

1024

session.bye()

1025

return

1026

# Have to check if client.still_valid(), since it is

1027

# possible that the client timed out while establishing

1028

# the GnuTLS session.

1029

if not client.still_valid():

1030

ipc.write(u"INVALID %s\n" % client.name)

1031

session.bye()

1032

return

1033

ipc.write(u"SENDING %s\n" % client.name)

1034

sent_size = 0

1035

while sent_size < len(client.secret):

1036

sent = session.send(client.secret[sent_size:])

1037

logger.debug(u"Sent: %d, remaining: %d",

1038

sent, len(client.secret)

1039

- (sent_size + sent))

1040

sent_size += sent

1041

session.bye()

1042

1043

@staticmethod

1044

def peer_certificate(session):

1045

"Return the peer's OpenPGP certificate as a bytestring"

1046

# If not an OpenPGP certificate...

1047

if (gnutls.library.functions

1048

.gnutls_certificate_type_get(session._c_object)

1049

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1050

# ...do the normal thing

1051

return session.peer_certificate

1052

list_size = ctypes.c_uint(1)

1053

cert_list = (gnutls.library.functions

1054

.gnutls_certificate_get_peers

1055

(session._c_object, ctypes.byref(list_size)))

1056

if not bool(cert_list) and list_size.value != 0:

1057

raise gnutls.errors.GNUTLSError(u"error getting peer"

1058

u" certificate")

1059

if list_size.value == 0:

1060

return None

1061

cert = cert_list[0]

1062

return ctypes.string_at(cert.data, cert.size)

1063

1064

@staticmethod

1065

def fingerprint(openpgp):

1066

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1067

# New GnuTLS "datum" with the OpenPGP public key

1068

datum = (gnutls.library.types

1069

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1070

ctypes.POINTER

1071

(ctypes.c_ubyte)),

1072

ctypes.c_uint(len(openpgp))))

1073

# New empty GnuTLS certificate

1074

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1075

(gnutls.library.functions

1076

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1077

# Import the OpenPGP public key into the certificate

1078

(gnutls.library.functions

1079

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1080

gnutls.library.constants

1081

.GNUTLS_OPENPGP_FMT_RAW))

1082

# Verify the self signature in the key

1083

crtverify = ctypes.c_uint()

1084

(gnutls.library.functions

1085

.gnutls_openpgp_crt_verify_self(crt, 0,

1086

ctypes.byref(crtverify)))

1087

if crtverify.value != 0:

1088

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1089

raise (gnutls.errors.CertificateSecurityError

1090

(u"Verify failed"))

1091

# New buffer for the fingerprint

1092

buf = ctypes.create_string_buffer(20)

1093

buf_len = ctypes.c_size_t()

1094

# Get the fingerprint from the certificate into the buffer

1095

(gnutls.library.functions

1096

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1097

ctypes.byref(buf_len)))

1098

# Deinit the certificate

1099

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1100

# Convert the buffer to a Python bytestring

1101

fpr = ctypes.string_at(buf, buf_len.value)

1102

# Convert the bytestring to hexadecimal notation

1103

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1104

return hex_fpr

1105

1106

1107

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

1108

"""Like socketserver.ForkingMixIn, but also pass a pipe."""

1109

def process_request(self, request, client_address):

1110

"""Overrides and wraps the original process_request().

1111

1112

This function creates a new pipe in self.pipe

1113

"""

1114

self.pipe = os.pipe()

1115

super(ForkingMixInWithPipe,

1116

self).process_request(request, client_address)

1117

os.close(self.pipe[1]) # close write end

1118

self.add_pipe(self.pipe[0])

1119

def add_pipe(self, pipe):

1120

"""Dummy function; override as necessary"""

1121

os.close(pipe)

1122

1123

1124

class IPv6_TCPServer(ForkingMixInWithPipe,

1125

socketserver.TCPServer, object):

1126

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1127

1128

Attributes:

1129

enabled: Boolean; whether this server is activated yet

1130

interface: None or a network interface name (string)

1131

use_ipv6: Boolean; to use IPv6 or not

1132

"""

1133

def __init__(self, server_address, RequestHandlerClass,

1134

interface=None, use_ipv6=True):

1135

self.interface = interface

1136

if use_ipv6:

1137

self.address_family = socket.AF_INET6

1138

socketserver.TCPServer.__init__(self, server_address,

1139

RequestHandlerClass)

1140

def server_bind(self):

1141

"""This overrides the normal server_bind() function

1142

to bind to an interface if one was specified, and also NOT to

1143

bind to an address or port if they were not specified."""

1144

if self.interface is not None:

1145

if SO_BINDTODEVICE is None:

1146

logger.error(u"SO_BINDTODEVICE does not exist;"

1147

u" cannot bind to interface %s",

1148

self.interface)

1149

else:

52

1150

try:

53

1151

self.socket.setsockopt(socket.SOL_SOCKET,

54

socket.SO_BINDTODEVICE,

55

self.options.interface)

1152

SO_BINDTODEVICE,

1153

str(self.interface

1154

+ u'\0'))

56

1155

except socket.error, error:

57

1156

if error[0] == errno.EPERM:

58

print "Warning: No permission to bind to interface", \

59

self.options.interface

1157

logger.error(u"No permission to"

1158

u" bind to interface %s",

1159

self.interface)

1160

elif error[0] == errno.ENOPROTOOPT:

1161

logger.error(u"SO_BINDTODEVICE not available;"

1162

u" cannot bind to interface %s",

1163

self.interface)

60

1164

else:

61

raise error

62

return super(type(self), self).server_bind()

63

attrs["server_bind"] = server_bind

64

def init(self, *args, **kwargs):

65

if "options" in kwargs:

66

self.options = kwargs["options"]

67

del kwargs["options"]

68

if "clients" in kwargs:

69

self.clients = kwargs["clients"]

70

del kwargs["clients"]

71

if "credentials" in kwargs:

72

self.credentials = kwargs["credentials"]

73

del kwargs["credentials"]

74

return super(type(self), self).__init__(*args, **kwargs)

75

attrs["__init__"] = init

76

return type.__new__(cls, name, bases, attrs)

77

78

79

class udp_handler(SocketServer.DatagramRequestHandler, object):

80

def handle(self):

81

self.wfile.write("Polo")

82

print "UDP request answered"

83

84

85

class IPv6_UDPServer(SocketServer.UDPServer, object):

86

__metaclass__ = server_metaclass

87

def verify_request(self, request, client_address):

88

print "UDP request came"

89

return request[0] == "Marco"

90

91

92

class tcp_handler(SocketServer.BaseRequestHandler, object):

93

def handle(self):

94

print "TCP request came"

95

print "Request:", self.request

96

print "Client Address:", self.client_address

97

print "Server:", self.server

98

session = gnutls.connection.ServerSession(self.request,

99

self.server.credentials)

100

session.handshake()

101

if session.peer_certificate:

102

print "DN:", session.peer_certificate.subject

103

try:

104

session.verify_peer()

105

except gnutls.errors.CertificateError, error:

106

print "Verify failed", error

107

session.bye()

108

return

109

try:

110

session.send(dict((client.dn, client.password)

111

for client in self.server.clients)

112

[session.peer_certificate.subject])

113

except KeyError:

114

session.send("gazonk")

115

# Log maybe? XXX

116

session.bye()

117

118

119

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

120

__metaclass__ = server_metaclass

121

request_queue_size = 1024

122

123

124

in6addr_any = "::"

1165

raise

1166

# Only bind(2) the socket if we really need to.

1167

if self.server_address[0] or self.server_address[1]:

1168

if not self.server_address[0]:

1169

if self.address_family == socket.AF_INET6:

1170

any_address = u"::" # in6addr_any

1171

else:

1172

any_address = socket.INADDR_ANY

1173

self.server_address = (any_address,

1174

self.server_address[1])

1175

elif not self.server_address[1]:

1176

self.server_address = (self.server_address[0],

1177

0)

1178

# if self.interface:

1179

# self.server_address = (self.server_address[0],

1180

# 0, # port

1181

# 0, # flowinfo

1182

# if_nametoindex

1183

# (self.interface))

1184

return socketserver.TCPServer.server_bind(self)

1185

1186

1187

class MandosServer(IPv6_TCPServer):

1188

"""Mandos server.

1189

1190

Attributes:

1191

clients: set of Client objects

1192

gnutls_priority GnuTLS priority string

1193

use_dbus: Boolean; to emit D-Bus signals or not

1194

1195

Assumes a gobject.MainLoop event loop.

1196

"""

1197

def __init__(self, server_address, RequestHandlerClass,

1198

interface=None, use_ipv6=True, clients=None,

1199

gnutls_priority=None, use_dbus=True):

1200

self.enabled = False

1201

self.clients = clients

1202

if self.clients is None:

1203

self.clients = set()

1204

self.use_dbus = use_dbus

1205

self.gnutls_priority = gnutls_priority

1206

IPv6_TCPServer.__init__(self, server_address,

1207

RequestHandlerClass,

1208

interface = interface,

1209

use_ipv6 = use_ipv6)

1210

def server_activate(self):

1211

if self.enabled:

1212

return socketserver.TCPServer.server_activate(self)

1213

def enable(self):

1214

self.enabled = True

1215

def add_pipe(self, pipe):

1216

# Call "handle_ipc" for both data and EOF events

1217

gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,

1218

self.handle_ipc)

1219

def handle_ipc(self, source, condition, file_objects={}):

1220

condition_names = {

1221

gobject.IO_IN: u"IN", # There is data to read.

1222

gobject.IO_OUT: u"OUT", # Data can be written (without

1223

# blocking).

1224

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1225

gobject.IO_ERR: u"ERR", # Error condition.

1226

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1227

# broken, usually for pipes and

1228

# sockets).

1229

}

1230

conditions_string = ' | '.join(name

1231

for cond, name in

1232

condition_names.iteritems()

1233

if cond & condition)

1234

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1235

conditions_string)

1236

1237

# Turn the pipe file descriptor into a Python file object

1238

if source not in file_objects:

1239

file_objects[source] = os.fdopen(source, u"r", 1)

1240

1241

# Read a line from the file object

1242

cmdline = file_objects[source].readline()

1243

if not cmdline: # Empty line means end of file

1244

# close the IPC pipe

1245

file_objects[source].close()

1246

del file_objects[source]

1247

1248

# Stop calling this function

1249

return False

1250

1251

logger.debug(u"IPC command: %r", cmdline)

1252

1253

# Parse and act on command

1254

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1255

1256

if cmd == u"NOTFOUND":

1257

logger.warning(u"Client not found for fingerprint: %s",

1258

args)

1259

if self.use_dbus:

1260

# Emit D-Bus signal

1261

mandos_dbus_service.ClientNotFound(args)

1262

elif cmd == u"INVALID":

1263

for client in self.clients:

1264

if client.name == args:

1265

logger.warning(u"Client %s is invalid", args)

1266

if self.use_dbus:

1267

# Emit D-Bus signal

1268

client.Rejected()

1269

break

1270

else:

1271

logger.error(u"Unknown client %s is invalid", args)

1272

elif cmd == u"SENDING":

1273

for client in self.clients:

1274

if client.name == args:

1275

logger.info(u"Sending secret to %s", client.name)

1276

client.checked_ok()

1277

if self.use_dbus:

1278

# Emit D-Bus signal

1279

client.ReceivedSecret()

1280

break

1281

else:

1282

logger.error(u"Sending secret to unknown client %s",

1283

args)

1284

else:

1285

logger.error(u"Unknown IPC command: %r", cmdline)

1286

1287

# Keep calling this function

1288

return True

1289

125

1290

126

1291

def string_to_delta(interval):

127

1292

"""Parse a string and return a datetime.timedelta

128

129

>>> string_to_delta('7d')

1293

1294

>>> string_to_delta(u'7d')

130

1295

datetime.timedelta(7)

131

>>> string_to_delta('60s')

1296

>>> string_to_delta(u'60s')

132

1297

datetime.timedelta(0, 60)

133

>>> string_to_delta('60m')

1298

>>> string_to_delta(u'60m')

134

1299

datetime.timedelta(0, 3600)

135

>>> string_to_delta('24h')

1300

>>> string_to_delta(u'24h')

136

1301

datetime.timedelta(1)

137

1302

>>> string_to_delta(u'1w')

138

1303

datetime.timedelta(7)

1304

>>> string_to_delta(u'5m 30s')

1305

datetime.timedelta(0, 330)

139

1306

"""

140

try:

141

suffix=unicode(interval[-1])

142

value=int(interval[:-1])

143

if suffix == u"d":

144

delta = datetime.timedelta(value)

145

elif suffix == u"s":

146

delta = datetime.timedelta(0, value)

147

elif suffix == u"m":

148

delta = datetime.timedelta(0, 0, 0, 0, value)

149

elif suffix == u"h":

150

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

151

elif suffix == u"w":

152

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

153

else:

1307

timevalue = datetime.timedelta(0)

1308

for s in interval.split():

1309

try:

1310

suffix = unicode(s[-1])

1311

value = int(s[:-1])

1312

if suffix == u"d":

1313

delta = datetime.timedelta(value)

1314

elif suffix == u"s":

1315

delta = datetime.timedelta(0, value)

1316

elif suffix == u"m":

1317

delta = datetime.timedelta(0, 0, 0, 0, value)

1318

elif suffix == u"h":

1319

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1320

elif suffix == u"w":

1321

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1322

else:

1323

raise ValueError

1324

except (ValueError, IndexError):

154

1325

raise ValueError

155

except (ValueError, IndexError):

156

raise ValueError

157

return delta

1326

timevalue += delta

1327

return timevalue

1328

1329

1330

def if_nametoindex(interface):

1331

"""Call the C function if_nametoindex(), or equivalent

1332

1333

Note: This function cannot accept a unicode string."""

1334

global if_nametoindex

1335

try:

1336

if_nametoindex = (ctypes.cdll.LoadLibrary

1337

(ctypes.util.find_library(u"c"))

1338

.if_nametoindex)

1339

except (OSError, AttributeError):

1340

logger.warning(u"Doing if_nametoindex the hard way")

1341

def if_nametoindex(interface):

1342

"Get an interface index the hard way, i.e. using fcntl()"

1343

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1344

with closing(socket.socket()) as s:

1345

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1346

struct.pack(str(u"16s16x"),

1347

interface))

1348

interface_index = struct.unpack(str(u"I"),

1349

ifreq[16:20])[0]

1350

return interface_index

1351

return if_nametoindex(interface)

1352

1353

1354

def daemon(nochdir = False, noclose = False):

1355

"""See daemon(3). Standard BSD Unix function.

1356

1357

This should really exist as os.daemon, but it doesn't (yet)."""

1358

if os.fork():

1359

sys.exit()

1360

os.setsid()

1361

if not nochdir:

1362

os.chdir(u"/")

1363

if os.fork():

1364

sys.exit()

1365

if not noclose:

1366

# Close all standard open file descriptors

1367

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1368

if not stat.S_ISCHR(os.fstat(null).st_mode):

1369

raise OSError(errno.ENODEV,

1370

u"/dev/null not a character device")

1371

os.dup2(null, sys.stdin.fileno())

1372

os.dup2(null, sys.stdout.fileno())

1373

os.dup2(null, sys.stderr.fileno())

1374

if null > 2:

1375

os.close(null)

158

1376

159

1377

160

1378

def main():

161

parser = OptionParser()

162

parser.add_option("-i", "--interface", type="string",

163

default="eth0", metavar="IF",

164

help="Interface to bind to")

165

parser.add_option("--cert", type="string", default="cert.pem",

166

metavar="FILE",

167

help="Public key certificate to use")

168

parser.add_option("--key", type="string", default="key.pem",

169

metavar="FILE",

170

help="Private key to use")

171

parser.add_option("--ca", type="string", default="ca.pem",

172

metavar="FILE",

173

help="Certificate Authority certificate to use")

174

parser.add_option("--crl", type="string", default="crl.pem",

175

metavar="FILE",

176

help="Certificate Revokation List to use")

177

parser.add_option("-p", "--port", type="int", default=49001,

178

help="Port number to receive requests on")

179

parser.add_option("--dh", type="int", metavar="BITS",

180

help="DH group to use")

181

parser.add_option("-t", "--timeout", type="string", # Parsed later

182

default="15m",

183

help="Amount of downtime allowed for clients")

184

parser.add_option("--interval", type="string", # Parsed later

185

default="5m",

186

help="How often to check that a client is up")

187

parser.add_option("--check", action="store_true", default=False,

188

help="Run self-test")

189

(options, args) = parser.parse_args()

190

1379

1380

##################################################################

1381

# Parsing of options, both command line and config file

1382

1383

parser = optparse.OptionParser(version = "%%prog %s" % version)

1384

parser.add_option("-i", u"--interface", type=u"string",

1385

metavar="IF", help=u"Bind to interface IF")

1386

parser.add_option("-a", u"--address", type=u"string",

1387

help=u"Address to listen for requests on")

1388

parser.add_option("-p", u"--port", type=u"int",

1389

help=u"Port number to receive requests on")

1390

parser.add_option("--check", action=u"store_true",

1391

help=u"Run self-test")

1392

parser.add_option("--debug", action=u"store_true",

1393

help=u"Debug mode; run in foreground and log to"

1394

u" terminal")

1395

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1396

u" priority string (see GnuTLS documentation)")

1397

parser.add_option("--servicename", type=u"string",

1398

metavar=u"NAME", help=u"Zeroconf service name")

1399

parser.add_option("--configdir", type=u"string",

1400

default=u"/etc/mandos", metavar=u"DIR",

1401

help=u"Directory to search for configuration"

1402

u" files")

1403

parser.add_option("--no-dbus", action=u"store_false",

1404

dest=u"use_dbus", help=u"Do not provide D-Bus"

1405

u" system bus interface")

1406

parser.add_option("--no-ipv6", action=u"store_false",

1407

dest=u"use_ipv6", help=u"Do not use IPv6")

1408

options = parser.parse_args()[0]

1409

191

1410

if options.check:

192

1411

import doctest

193

1412

doctest.testmod()

194

1413

sys.exit()

195

1414

196

# Parse the time arguments

197

try:

198

options.timeout = string_to_delta(options.timeout)

199

except ValueError:

200

parser.error("option --timeout: Unparseable time")

201

202

try:

203

options.interval = string_to_delta(options.interval)

204

except ValueError:

205

parser.error("option --interval: Unparseable time")

206

207

cert = gnutls.crypto.X509Certificate(open(options.cert).read())

208

key = gnutls.crypto.X509PrivateKey(open(options.key).read())

209

ca = gnutls.crypto.X509Certificate(open(options.ca).read())

210

crl = gnutls.crypto.X509CRL(open(options.crl).read())

211

cred = gnutls.connection.X509Credentials(cert, key, [ca], [crl])

212

213

# Parse config file

214

defaults = {}

215

client_config_object = ConfigParser.SafeConfigParser(defaults)

216

client_config_object.read("mandos-clients.conf")

217

clients = [Client(name=section, options=options,

218

**(dict(client_config_object.items(section))))

219

for section in client_config_object.sections()]

220

221

udp_server = IPv6_UDPServer((in6addr_any, options.port),

222

udp_handler,

223

options=options)

224

225

tcp_server = IPv6_TCPServer((in6addr_any, options.port),

226

tcp_handler,

227

options=options,

228

clients=clients,

229

credentials=cred)

230

231

while True:

232

in_, out, err = select.select((udp_server,

233

tcp_server), (), ())

234

for server in in_:

235

server.handle_request()

236

237

238

if __name__ == "__main__":

1415

# Default values for config file for server-global settings

1416

server_defaults = { u"interface": u"",

1417

u"address": u"",

1418

u"port": u"",

1419

u"debug": u"False",

1420

u"priority":

1421

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1422

u"servicename": u"Mandos",

1423

u"use_dbus": u"True",

1424

u"use_ipv6": u"True",

1425

}

1426

1427

# Parse config file for server-global settings

1428

server_config = configparser.SafeConfigParser(server_defaults)

1429

del server_defaults

1430

server_config.read(os.path.join(options.configdir,

1431

u"mandos.conf"))

1432

# Convert the SafeConfigParser object to a dict

1433

server_settings = server_config.defaults()

1434

# Use the appropriate methods on the non-string config options

1435

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1436

server_settings[option] = server_config.getboolean(u"DEFAULT",

1437

option)

1438

if server_settings["port"]:

1439

server_settings["port"] = server_config.getint(u"DEFAULT",

1440

u"port")

1441

del server_config

1442

1443

# Override the settings from the config file with command line

1444

# options, if set.

1445

for option in (u"interface", u"address", u"port", u"debug",

1446

u"priority", u"servicename", u"configdir",

1447

u"use_dbus", u"use_ipv6"):

1448

value = getattr(options, option)

1449

if value is not None:

1450

server_settings[option] = value

1451

del options

1452

# Force all strings to be unicode

1453

for option in server_settings.keys():

1454

if type(server_settings[option]) is str:

1455

server_settings[option] = unicode(server_settings[option])

1456

# Now we have our good server settings in "server_settings"

1457

1458

##################################################################

1459

1460

# For convenience

1461

debug = server_settings[u"debug"]

1462

use_dbus = server_settings[u"use_dbus"]

1463

use_ipv6 = server_settings[u"use_ipv6"]

1464

1465

if not debug:

1466

syslogger.setLevel(logging.WARNING)

1467

console.setLevel(logging.WARNING)

1468

1469

if server_settings[u"servicename"] != u"Mandos":

1470

syslogger.setFormatter(logging.Formatter

1471

(u'Mandos (%s) [%%(process)d]:'

1472

u' %%(levelname)s: %%(message)s'

1473

% server_settings[u"servicename"]))

1474

1475

# Parse config file with clients

1476

client_defaults = { u"timeout": u"1h",

1477

u"interval": u"5m",

1478

u"checker": u"fping -q -- %%(host)s",

1479

u"host": u"",

1480

}

1481

client_config = configparser.SafeConfigParser(client_defaults)

1482

client_config.read(os.path.join(server_settings[u"configdir"],

1483

u"clients.conf"))

1484

1485

global mandos_dbus_service

1486

mandos_dbus_service = None

1487

1488

tcp_server = MandosServer((server_settings[u"address"],

1489

server_settings[u"port"]),

1490

ClientHandler,

1491

interface=server_settings[u"interface"],

1492

use_ipv6=use_ipv6,

1493

gnutls_priority=

1494

server_settings[u"priority"],

1495

use_dbus=use_dbus)

1496

pidfilename = u"/var/run/mandos.pid"

1497

try:

1498

pidfile = open(pidfilename, u"w")

1499

except IOError:

1500

logger.error(u"Could not open file %r", pidfilename)

1501

1502

try:

1503

uid = pwd.getpwnam(u"_mandos").pw_uid

1504

gid = pwd.getpwnam(u"_mandos").pw_gid

1505

except KeyError:

1506

try:

1507

uid = pwd.getpwnam(u"mandos").pw_uid

1508

gid = pwd.getpwnam(u"mandos").pw_gid

1509

except KeyError:

1510

try:

1511

uid = pwd.getpwnam(u"nobody").pw_uid

1512

gid = pwd.getpwnam(u"nobody").pw_gid

1513

except KeyError:

1514

uid = 65534

1515

gid = 65534

1516

try:

1517

os.setgid(gid)

1518

os.setuid(uid)

1519

except OSError, error:

1520

if error[0] != errno.EPERM:

1521

raise error

1522

1523

# Enable all possible GnuTLS debugging

1524

if debug:

1525

# "Use a log level over 10 to enable all debugging options."

1526

# - GnuTLS manual

1527

gnutls.library.functions.gnutls_global_set_log_level(11)

1528

1529

@gnutls.library.types.gnutls_log_func

1530

def debug_gnutls(level, string):

1531

logger.debug(u"GnuTLS: %s", string[:-1])

1532

1533

(gnutls.library.functions

1534

.gnutls_global_set_log_function(debug_gnutls))

1535

1536

global main_loop

1537

# From the Avahi example code

1538

DBusGMainLoop(set_as_default=True )

1539

main_loop = gobject.MainLoop()

1540

bus = dbus.SystemBus()

1541

# End of Avahi example code

1542

if use_dbus:

1543

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1544

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1545

service = AvahiService(name = server_settings[u"servicename"],

1546

servicetype = u"_mandos._tcp",

1547

protocol = protocol, bus = bus)

1548

if server_settings["interface"]:

1549

service.interface = (if_nametoindex

1550

(str(server_settings[u"interface"])))

1551

1552

client_class = Client

1553

if use_dbus:

1554

client_class = functools.partial(ClientDBus, bus = bus)

1555

tcp_server.clients.update(set(

1556

client_class(name = section,

1557

config= dict(client_config.items(section)))

1558

for section in client_config.sections()))

1559

if not tcp_server.clients:

1560

logger.warning(u"No clients defined")

1561

1562

if debug:

1563

# Redirect stdin so all checkers get /dev/null

1564

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1565

os.dup2(null, sys.stdin.fileno())

1566

if null > 2:

1567

os.close(null)

1568

else:

1569

# No console logging

1570

logger.removeHandler(console)

1571

# Close all input and output, do double fork, etc.

1572

daemon()

1573

1574

try:

1575

with closing(pidfile):

1576

pid = os.getpid()

1577

pidfile.write(str(pid) + "\n")

1578

del pidfile

1579

except IOError:

1580

logger.error(u"Could not write to file %r with PID %d",

1581

pidfilename, pid)

1582

except NameError:

1583

# "pidfile" was never created

1584

pass

1585

del pidfilename

1586

1587

def cleanup():

1588

"Cleanup function; run on exit"

1589

service.cleanup()

1590

1591

while tcp_server.clients:

1592

client = tcp_server.clients.pop()

1593

client.disable_hook = None

1594

client.disable()

1595

1596

atexit.register(cleanup)

1597

1598

if not debug:

1599

signal.signal(signal.SIGINT, signal.SIG_IGN)

1600

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1601

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1602

1603

if use_dbus:

1604

class MandosDBusService(dbus.service.Object):

1605

"""A D-Bus proxy object"""

1606

def __init__(self):

1607

dbus.service.Object.__init__(self, bus, u"/")

1608

_interface = u"se.bsnet.fukt.Mandos"

1609

1610

@dbus.service.signal(_interface, signature=u"oa{sv}")

1611

def ClientAdded(self, objpath, properties):

1612

"D-Bus signal"

1613

pass

1614

1615

@dbus.service.signal(_interface, signature=u"s")

1616

def ClientNotFound(self, fingerprint):

1617

"D-Bus signal"

1618

pass

1619

1620

@dbus.service.signal(_interface, signature=u"os")

1621

def ClientRemoved(self, objpath, name):

1622

"D-Bus signal"

1623

pass

1624

1625

@dbus.service.method(_interface, out_signature=u"ao")

1626

def GetAllClients(self):

1627

"D-Bus method"

1628

return dbus.Array(c.dbus_object_path

1629

for c in tcp_server.clients)

1630

1631

@dbus.service.method(_interface,

1632

out_signature=u"a{oa{sv}}")

1633

def GetAllClientsWithProperties(self):

1634

"D-Bus method"

1635

return dbus.Dictionary(

1636

((c.dbus_object_path, c.GetAll(u""))

1637

for c in tcp_server.clients),

1638

signature=u"oa{sv}")

1639

1640

@dbus.service.method(_interface, in_signature=u"o")

1641

def RemoveClient(self, object_path):

1642

"D-Bus method"

1643

for c in tcp_server.clients:

1644

if c.dbus_object_path == object_path:

1645

tcp_server.clients.remove(c)

1646

c.remove_from_connection()

1647

# Don't signal anything except ClientRemoved

1648

c.disable(signal=False)

1649

# Emit D-Bus signal

1650

self.ClientRemoved(object_path, c.name)

1651

return

1652

raise KeyError

1653

1654

del _interface

1655

1656

mandos_dbus_service = MandosDBusService()

1657

1658

for client in tcp_server.clients:

1659

if use_dbus:

1660

# Emit D-Bus signal

1661

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1662

client.GetAll(u""))

1663

client.enable()

1664

1665

tcp_server.enable()

1666

tcp_server.server_activate()

1667

1668

# Find out what port we got

1669

service.port = tcp_server.socket.getsockname()[1]

1670

if use_ipv6:

1671

logger.info(u"Now listening on address %r, port %d,"

1672

" flowinfo %d, scope_id %d"

1673

% tcp_server.socket.getsockname())

1674

else: # IPv4

1675

logger.info(u"Now listening on address %r, port %d"

1676

% tcp_server.socket.getsockname())

1677

1678

#service.interface = tcp_server.socket.getsockname()[3]

1679

1680

try:

1681

# From the Avahi example code

1682

try:

1683

service.activate()

1684

except dbus.exceptions.DBusException, error:

1685

logger.critical(u"DBusException: %s", error)

1686

sys.exit(1)

1687

# End of Avahi example code

1688

1689

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

1690

lambda *args, **kwargs:

1691

(tcp_server.handle_request

1692

(*args[2:], **kwargs) or True))

1693

1694

logger.debug(u"Starting main loop")

1695

main_loop.run()

1696

except AvahiError, error:

1697

logger.critical(u"AvahiError: %s", error)

1698

sys.exit(1)

1699

except KeyboardInterrupt:

1700

if debug:

1701

print >> sys.stderr

1702

logger.debug(u"Server received KeyboardInterrupt")

1703

logger.debug(u"Server exiting")

1704

1705

if __name__ == '__main__':

239

1706

main()

240