/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

Merge "mandos-list" from belorn.

* Makefile (PROGS): Added "mandos-list".
  (mandos-list): New.

* mandos-list: New; from merge.  Added unicode support.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
 
14
# Copyright © 2008 Teddy Hogeborn
 
15
# Copyright © 2008 Björn Påhlsson
15
16
# 
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
30
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
32
# 
32
33
 
33
 
from __future__ import division
 
34
from __future__ import division, with_statement, absolute_import
34
35
 
35
36
import SocketServer
36
37
import socket
37
 
import select
38
38
from optparse import OptionParser
39
39
import datetime
40
40
import errno
55
55
import stat
56
56
import logging
57
57
import logging.handlers
 
58
import pwd
 
59
from contextlib import closing
58
60
 
59
61
import dbus
 
62
import dbus.service
60
63
import gobject
61
64
import avahi
62
65
from dbus.mainloop.glib import DBusGMainLoop
63
66
import ctypes
 
67
import ctypes.util
64
68
 
65
 
version = "1.0"
 
69
version = "1.0.2"
66
70
 
67
71
logger = logging.Logger('mandos')
68
 
syslogger = logging.handlers.SysLogHandler\
69
 
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
70
 
             address = "/dev/log")
71
 
syslogger.setFormatter(logging.Formatter\
72
 
                        ('Mandos: %(levelname)s: %(message)s'))
 
72
syslogger = (logging.handlers.SysLogHandler
 
73
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
74
              address = "/dev/log"))
 
75
syslogger.setFormatter(logging.Formatter
 
76
                       ('Mandos: %(levelname)s: %(message)s'))
73
77
logger.addHandler(syslogger)
74
78
 
75
79
console = logging.StreamHandler()
80
84
class AvahiError(Exception):
81
85
    def __init__(self, value):
82
86
        self.value = value
 
87
        super(AvahiError, self).__init__()
83
88
    def __str__(self):
84
89
        return repr(self.value)
85
90
 
107
112
                  a sensible number of times
108
113
    """
109
114
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
110
 
                 type = None, port = None, TXT = None, domain = "",
111
 
                 host = "", max_renames = 32768):
 
115
                 servicetype = None, port = None, TXT = None,
 
116
                 domain = "", host = "", max_renames = 32768):
112
117
        self.interface = interface
113
118
        self.name = name
114
 
        self.type = type
 
119
        self.type = servicetype
115
120
        self.port = port
116
 
        if TXT is None:
117
 
            self.TXT = []
118
 
        else:
119
 
            self.TXT = TXT
 
121
        self.TXT = TXT if TXT is not None else []
120
122
        self.domain = domain
121
123
        self.host = host
122
124
        self.rename_count = 0
126
128
        if self.rename_count >= self.max_renames:
127
129
            logger.critical(u"No suitable Zeroconf service name found"
128
130
                            u" after %i retries, exiting.",
129
 
                            rename_count)
 
131
                            self.rename_count)
130
132
            raise AvahiServiceError("Too many renames")
131
133
        self.name = server.GetAlternativeServiceName(self.name)
132
134
        logger.info(u"Changing Zeroconf service name to %r ...",
133
135
                    str(self.name))
134
 
        syslogger.setFormatter(logging.Formatter\
 
136
        syslogger.setFormatter(logging.Formatter
135
137
                               ('Mandos (%s): %%(levelname)s:'
136
 
                               ' %%(message)s' % self.name))
 
138
                                ' %%(message)s' % self.name))
137
139
        self.remove()
138
140
        self.add()
139
141
        self.rename_count += 1
145
147
        """Derived from the Avahi example code"""
146
148
        global group
147
149
        if group is None:
148
 
            group = dbus.Interface\
149
 
                    (bus.get_object(avahi.DBUS_NAME,
 
150
            group = dbus.Interface(bus.get_object
 
151
                                   (avahi.DBUS_NAME,
150
152
                                    server.EntryGroupNew()),
151
 
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
153
                                   avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
154
            group.connect_to_signal('StateChanged',
153
155
                                    entry_group_state_changed)
154
156
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
168
170
# End of Avahi example code
169
171
 
170
172
 
171
 
class Client(object):
 
173
def _datetime_to_dbus(dt, variant_level=0):
 
174
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
175
    return dbus.String(dt.isoformat(), variant_level=variant_level)
 
176
 
 
177
 
 
178
class Client(dbus.service.Object):
172
179
    """A representation of a client host served by this server.
173
180
    Attributes:
174
 
    name:      string; from the config file, used in log messages
 
181
    name:       string; from the config file, used in log messages
175
182
    fingerprint: string (40 or 32 hexadecimal digits); used to
176
183
                 uniquely identify the client
177
 
    secret:    bytestring; sent verbatim (over TLS) to client
178
 
    host:      string; available for use by the checker command
179
 
    created:   datetime.datetime(); object creation, not client host
180
 
    last_checked_ok: datetime.datetime() or None if not yet checked OK
181
 
    timeout:   datetime.timedelta(); How long from last_checked_ok
182
 
                                     until this client is invalid
183
 
    interval:  datetime.timedelta(); How often to start a new checker
184
 
    stop_hook: If set, called by stop() as stop_hook(self)
185
 
    checker:   subprocess.Popen(); a running checker process used
186
 
                                   to see if the client lives.
187
 
                                   'None' if no process is running.
 
184
    secret:     bytestring; sent verbatim (over TLS) to client
 
185
    host:       string; available for use by the checker command
 
186
    created:    datetime.datetime(); (UTC) object creation
 
187
    last_enabled: datetime.datetime(); (UTC)
 
188
    enabled:    bool()
 
189
    last_checked_ok: datetime.datetime(); (UTC) or None
 
190
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
191
                                      until this client is invalid
 
192
    interval:   datetime.timedelta(); How often to start a new checker
 
193
    disable_hook:  If set, called by disable() as disable_hook(self)
 
194
    checker:    subprocess.Popen(); a running checker process used
 
195
                                    to see if the client lives.
 
196
                                    'None' if no process is running.
188
197
    checker_initiator_tag: a gobject event source tag, or None
189
 
    stop_initiator_tag:    - '' -
 
198
    disable_initiator_tag:    - '' -
190
199
    checker_callback_tag:  - '' -
191
200
    checker_command: string; External command which is run to check if
192
201
                     client lives.  %() expansions are done at
193
202
                     runtime with vars(self) as dict, so that for
194
203
                     instance %(name)s can be used in the command.
 
204
    dbus_object_path: dbus.ObjectPath
195
205
    Private attibutes:
196
206
    _timeout: Real variable for 'timeout'
197
207
    _interval: Real variable for 'interval'
199
209
    _interval_milliseconds: - '' -
200
210
    """
201
211
    def _set_timeout(self, timeout):
202
 
        "Setter function for 'timeout' attribute"
 
212
        "Setter function for the 'timeout' attribute"
203
213
        self._timeout = timeout
204
214
        self._timeout_milliseconds = ((self.timeout.days
205
215
                                       * 24 * 60 * 60 * 1000)
206
216
                                      + (self.timeout.seconds * 1000)
207
217
                                      + (self.timeout.microseconds
208
218
                                         // 1000))
209
 
    timeout = property(lambda self: self._timeout,
210
 
                       _set_timeout)
 
219
        # Emit D-Bus signal
 
220
        self.PropertyChanged(dbus.String(u"timeout"),
 
221
                             (dbus.UInt64(self._timeout_milliseconds,
 
222
                                          variant_level=1)))
 
223
    timeout = property(lambda self: self._timeout, _set_timeout)
211
224
    del _set_timeout
 
225
    
212
226
    def _set_interval(self, interval):
213
 
        "Setter function for 'interval' attribute"
 
227
        "Setter function for the 'interval' attribute"
214
228
        self._interval = interval
215
229
        self._interval_milliseconds = ((self.interval.days
216
230
                                        * 24 * 60 * 60 * 1000)
218
232
                                          * 1000)
219
233
                                       + (self.interval.microseconds
220
234
                                          // 1000))
221
 
    interval = property(lambda self: self._interval,
222
 
                        _set_interval)
 
235
        # Emit D-Bus signal
 
236
        self.PropertyChanged(dbus.String(u"interval"),
 
237
                             (dbus.UInt64(self._interval_milliseconds,
 
238
                                          variant_level=1)))
 
239
    interval = property(lambda self: self._interval, _set_interval)
223
240
    del _set_interval
224
 
    def __init__(self, name = None, stop_hook=None, config={}):
 
241
    
 
242
    def __init__(self, name = None, disable_hook=None, config=None):
225
243
        """Note: the 'checker' key in 'config' sets the
226
244
        'checker_command' attribute and *not* the 'checker'
227
245
        attribute."""
 
246
        self.dbus_object_path = (dbus.ObjectPath
 
247
                                 ("/Mandos/clients/"
 
248
                                  + name.replace(".", "_")))
 
249
        dbus.service.Object.__init__(self, bus,
 
250
                                     self.dbus_object_path)
 
251
        if config is None:
 
252
            config = {}
228
253
        self.name = name
229
254
        logger.debug(u"Creating client %r", self.name)
230
255
        # Uppercase and remove spaces from fingerprint for later
231
256
        # comparison purposes with return value from the fingerprint()
232
257
        # function
233
 
        self.fingerprint = config["fingerprint"].upper()\
234
 
                           .replace(u" ", u"")
 
258
        self.fingerprint = (config["fingerprint"].upper()
 
259
                            .replace(u" ", u""))
235
260
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
236
261
        if "secret" in config:
237
262
            self.secret = config["secret"].decode(u"base64")
238
263
        elif "secfile" in config:
239
 
            sf = open(config["secfile"])
240
 
            self.secret = sf.read()
241
 
            sf.close()
 
264
            with closing(open(os.path.expanduser
 
265
                              (os.path.expandvars
 
266
                               (config["secfile"])))) as secfile:
 
267
                self.secret = secfile.read()
242
268
        else:
243
269
            raise TypeError(u"No secret or secfile for client %s"
244
270
                            % self.name)
245
271
        self.host = config.get("host", "")
246
 
        self.created = datetime.datetime.now()
 
272
        self.created = datetime.datetime.utcnow()
 
273
        self.enabled = False
 
274
        self.last_enabled = None
247
275
        self.last_checked_ok = None
248
276
        self.timeout = string_to_delta(config["timeout"])
249
277
        self.interval = string_to_delta(config["interval"])
250
 
        self.stop_hook = stop_hook
 
278
        self.disable_hook = disable_hook
251
279
        self.checker = None
252
280
        self.checker_initiator_tag = None
253
 
        self.stop_initiator_tag = None
 
281
        self.disable_initiator_tag = None
254
282
        self.checker_callback_tag = None
255
 
        self.check_command = config["checker"]
256
 
    def start(self):
 
283
        self.checker_command = config["checker"]
 
284
    
 
285
    def enable(self):
257
286
        """Start this client's checker and timeout hooks"""
 
287
        self.last_enabled = datetime.datetime.utcnow()
258
288
        # Schedule a new checker to be started an 'interval' from now,
259
289
        # and every interval from then on.
260
 
        self.checker_initiator_tag = gobject.timeout_add\
261
 
                                     (self._interval_milliseconds,
262
 
                                      self.start_checker)
 
290
        self.checker_initiator_tag = (gobject.timeout_add
 
291
                                      (self._interval_milliseconds,
 
292
                                       self.start_checker))
263
293
        # Also start a new checker *right now*.
264
294
        self.start_checker()
265
 
        # Schedule a stop() when 'timeout' has passed
266
 
        self.stop_initiator_tag = gobject.timeout_add\
267
 
                                  (self._timeout_milliseconds,
268
 
                                   self.stop)
269
 
    def stop(self):
270
 
        """Stop this client.
271
 
        The possibility that a client might be restarted is left open,
272
 
        but not currently used."""
273
 
        # If this client doesn't have a secret, it is already stopped.
274
 
        if hasattr(self, "secret") and self.secret:
275
 
            logger.info(u"Stopping client %s", self.name)
276
 
            self.secret = None
277
 
        else:
 
295
        # Schedule a disable() when 'timeout' has passed
 
296
        self.disable_initiator_tag = (gobject.timeout_add
 
297
                                   (self._timeout_milliseconds,
 
298
                                    self.disable))
 
299
        self.enabled = True
 
300
        # Emit D-Bus signal
 
301
        self.PropertyChanged(dbus.String(u"enabled"),
 
302
                             dbus.Boolean(True, variant_level=1))
 
303
        self.PropertyChanged(dbus.String(u"last_enabled"),
 
304
                             (_datetime_to_dbus(self.last_enabled,
 
305
                                                variant_level=1)))
 
306
    
 
307
    def disable(self):
 
308
        """Disable this client."""
 
309
        if not getattr(self, "enabled", False):
278
310
            return False
279
 
        if getattr(self, "stop_initiator_tag", False):
280
 
            gobject.source_remove(self.stop_initiator_tag)
281
 
            self.stop_initiator_tag = None
 
311
        logger.info(u"Disabling client %s", self.name)
 
312
        if getattr(self, "disable_initiator_tag", False):
 
313
            gobject.source_remove(self.disable_initiator_tag)
 
314
            self.disable_initiator_tag = None
282
315
        if getattr(self, "checker_initiator_tag", False):
283
316
            gobject.source_remove(self.checker_initiator_tag)
284
317
            self.checker_initiator_tag = None
285
318
        self.stop_checker()
286
 
        if self.stop_hook:
287
 
            self.stop_hook(self)
 
319
        if self.disable_hook:
 
320
            self.disable_hook(self)
 
321
        self.enabled = False
 
322
        # Emit D-Bus signal
 
323
        self.PropertyChanged(dbus.String(u"enabled"),
 
324
                             dbus.Boolean(False, variant_level=1))
288
325
        # Do not run this again if called by a gobject.timeout_add
289
326
        return False
 
327
    
290
328
    def __del__(self):
291
 
        self.stop_hook = None
292
 
        self.stop()
293
 
    def checker_callback(self, pid, condition):
 
329
        self.disable_hook = None
 
330
        self.disable()
 
331
    
 
332
    def checker_callback(self, pid, condition, command):
294
333
        """The checker has completed, so take appropriate actions."""
295
 
        now = datetime.datetime.now()
296
334
        self.checker_callback_tag = None
297
335
        self.checker = None
298
 
        if os.WIFEXITED(condition) \
299
 
               and (os.WEXITSTATUS(condition) == 0):
 
336
        # Emit D-Bus signal
 
337
        self.PropertyChanged(dbus.String(u"checker_running"),
 
338
                             dbus.Boolean(False, variant_level=1))
 
339
        if (os.WIFEXITED(condition)
 
340
            and (os.WEXITSTATUS(condition) == 0)):
300
341
            logger.info(u"Checker for %(name)s succeeded",
301
342
                        vars(self))
302
 
            self.last_checked_ok = now
303
 
            gobject.source_remove(self.stop_initiator_tag)
304
 
            self.stop_initiator_tag = gobject.timeout_add\
305
 
                                      (self._timeout_milliseconds,
306
 
                                       self.stop)
 
343
            # Emit D-Bus signal
 
344
            self.CheckerCompleted(dbus.Boolean(True),
 
345
                                  dbus.UInt16(condition),
 
346
                                  dbus.String(command))
 
347
            self.bump_timeout()
307
348
        elif not os.WIFEXITED(condition):
308
349
            logger.warning(u"Checker for %(name)s crashed?",
309
350
                           vars(self))
 
351
            # Emit D-Bus signal
 
352
            self.CheckerCompleted(dbus.Boolean(False),
 
353
                                  dbus.UInt16(condition),
 
354
                                  dbus.String(command))
310
355
        else:
311
356
            logger.info(u"Checker for %(name)s failed",
312
357
                        vars(self))
 
358
            # Emit D-Bus signal
 
359
            self.CheckerCompleted(dbus.Boolean(False),
 
360
                                  dbus.UInt16(condition),
 
361
                                  dbus.String(command))
 
362
    
 
363
    def bump_timeout(self):
 
364
        """Bump up the timeout for this client.
 
365
        This should only be called when the client has been seen,
 
366
        alive and well.
 
367
        """
 
368
        self.last_checked_ok = datetime.datetime.utcnow()
 
369
        gobject.source_remove(self.disable_initiator_tag)
 
370
        self.disable_initiator_tag = (gobject.timeout_add
 
371
                                      (self._timeout_milliseconds,
 
372
                                       self.disable))
 
373
        self.PropertyChanged(dbus.String(u"last_checked_ok"),
 
374
                             (_datetime_to_dbus(self.last_checked_ok,
 
375
                                                variant_level=1)))
 
376
    
313
377
    def start_checker(self):
314
378
        """Start a new checker subprocess if one is not running.
315
379
        If a checker already exists, leave it running and do
324
388
        # is as it should be.
325
389
        if self.checker is None:
326
390
            try:
327
 
                # In case check_command has exactly one % operator
328
 
                command = self.check_command % self.host
 
391
                # In case checker_command has exactly one % operator
 
392
                command = self.checker_command % self.host
329
393
            except TypeError:
330
394
                # Escape attributes for the shell
331
395
                escaped_attrs = dict((key, re.escape(str(val)))
332
396
                                     for key, val in
333
397
                                     vars(self).iteritems())
334
398
                try:
335
 
                    command = self.check_command % escaped_attrs
 
399
                    command = self.checker_command % escaped_attrs
336
400
                except TypeError, error:
337
401
                    logger.error(u'Could not format string "%s":'
338
 
                                 u' %s', self.check_command, error)
 
402
                                 u' %s', self.checker_command, error)
339
403
                    return True # Try again later
340
404
            try:
341
405
                logger.info(u"Starting checker %r for %s",
347
411
                self.checker = subprocess.Popen(command,
348
412
                                                close_fds=True,
349
413
                                                shell=True, cwd="/")
350
 
                self.checker_callback_tag = gobject.child_watch_add\
351
 
                                            (self.checker.pid,
352
 
                                             self.checker_callback)
 
414
                # Emit D-Bus signal
 
415
                self.CheckerStarted(command)
 
416
                self.PropertyChanged(dbus.String("checker_running"),
 
417
                                     dbus.Boolean(True, variant_level=1))
 
418
                self.checker_callback_tag = (gobject.child_watch_add
 
419
                                             (self.checker.pid,
 
420
                                              self.checker_callback,
 
421
                                              data=command))
353
422
            except OSError, error:
354
423
                logger.error(u"Failed to start subprocess: %s",
355
424
                             error)
356
425
        # Re-run this periodically if run by gobject.timeout_add
357
426
        return True
 
427
    
358
428
    def stop_checker(self):
359
429
        """Force the checker process, if any, to stop."""
360
430
        if self.checker_callback_tag:
372
442
            if error.errno != errno.ESRCH: # No such process
373
443
                raise
374
444
        self.checker = None
 
445
        self.PropertyChanged(dbus.String(u"checker_running"),
 
446
                             dbus.Boolean(False, variant_level=1))
 
447
    
375
448
    def still_valid(self):
376
449
        """Has the timeout not yet passed for this client?"""
377
 
        now = datetime.datetime.now()
 
450
        if not getattr(self, "enabled", False):
 
451
            return False
 
452
        now = datetime.datetime.utcnow()
378
453
        if self.last_checked_ok is None:
379
454
            return now < (self.created + self.timeout)
380
455
        else:
381
456
            return now < (self.last_checked_ok + self.timeout)
 
457
    
 
458
    ## D-Bus methods & signals
 
459
    _interface = u"org.mandos_system.Mandos.Client"
 
460
    
 
461
    # BumpTimeout - method
 
462
    BumpTimeout = dbus.service.method(_interface)(bump_timeout)
 
463
    BumpTimeout.__name__ = "BumpTimeout"
 
464
    
 
465
    # CheckerCompleted - signal
 
466
    @dbus.service.signal(_interface, signature="bqs")
 
467
    def CheckerCompleted(self, success, condition, command):
 
468
        "D-Bus signal"
 
469
        pass
 
470
    
 
471
    # CheckerStarted - signal
 
472
    @dbus.service.signal(_interface, signature="s")
 
473
    def CheckerStarted(self, command):
 
474
        "D-Bus signal"
 
475
        pass
 
476
    
 
477
    # GetAllProperties - method
 
478
    @dbus.service.method(_interface, out_signature="a{sv}")
 
479
    def GetAllProperties(self):
 
480
        "D-Bus method"
 
481
        return dbus.Dictionary({
 
482
                dbus.String("name"):
 
483
                    dbus.String(self.name, variant_level=1),
 
484
                dbus.String("fingerprint"):
 
485
                    dbus.String(self.fingerprint, variant_level=1),
 
486
                dbus.String("host"):
 
487
                    dbus.String(self.host, variant_level=1),
 
488
                dbus.String("created"):
 
489
                    _datetime_to_dbus(self.created, variant_level=1),
 
490
                dbus.String("last_enabled"):
 
491
                    (_datetime_to_dbus(self.last_enabled,
 
492
                                       variant_level=1)
 
493
                     if self.last_enabled is not None
 
494
                     else dbus.Boolean(False, variant_level=1)),
 
495
                dbus.String("enabled"):
 
496
                    dbus.Boolean(self.enabled, variant_level=1),
 
497
                dbus.String("last_checked_ok"):
 
498
                    (_datetime_to_dbus(self.last_checked_ok,
 
499
                                       variant_level=1)
 
500
                     if self.last_checked_ok is not None
 
501
                     else dbus.Boolean (False, variant_level=1)),
 
502
                dbus.String("timeout"):
 
503
                    dbus.UInt64(self._timeout_milliseconds,
 
504
                                variant_level=1),
 
505
                dbus.String("interval"):
 
506
                    dbus.UInt64(self._interval_milliseconds,
 
507
                                variant_level=1),
 
508
                dbus.String("checker"):
 
509
                    dbus.String(self.checker_command,
 
510
                                variant_level=1),
 
511
                dbus.String("checker_running"):
 
512
                    dbus.Boolean(self.checker is not None,
 
513
                                 variant_level=1),
 
514
                }, signature="sv")
 
515
    
 
516
    # IsStillValid - method
 
517
    IsStillValid = (dbus.service.method(_interface, out_signature="b")
 
518
                    (still_valid))
 
519
    IsStillValid.__name__ = "IsStillValid"
 
520
    
 
521
    # PropertyChanged - signal
 
522
    @dbus.service.signal(_interface, signature="sv")
 
523
    def PropertyChanged(self, property, value):
 
524
        "D-Bus signal"
 
525
        pass
 
526
    
 
527
    # SetChecker - method
 
528
    @dbus.service.method(_interface, in_signature="s")
 
529
    def SetChecker(self, checker):
 
530
        "D-Bus setter method"
 
531
        self.checker_command = checker
 
532
    
 
533
    # SetHost - method
 
534
    @dbus.service.method(_interface, in_signature="s")
 
535
    def SetHost(self, host):
 
536
        "D-Bus setter method"
 
537
        self.host = host
 
538
    
 
539
    # SetInterval - method
 
540
    @dbus.service.method(_interface, in_signature="t")
 
541
    def SetInterval(self, milliseconds):
 
542
        self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
 
543
    
 
544
    # SetSecret - method
 
545
    @dbus.service.method(_interface, in_signature="ay",
 
546
                         byte_arrays=True)
 
547
    def SetSecret(self, secret):
 
548
        "D-Bus setter method"
 
549
        self.secret = str(secret)
 
550
    
 
551
    # SetTimeout - method
 
552
    @dbus.service.method(_interface, in_signature="t")
 
553
    def SetTimeout(self, milliseconds):
 
554
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
 
555
    
 
556
    # Enable - method
 
557
    Enable = dbus.service.method(_interface)(enable)
 
558
    Enable.__name__ = "Enable"
 
559
    
 
560
    # StartChecker - method
 
561
    @dbus.service.method(_interface)
 
562
    def StartChecker(self):
 
563
        "D-Bus method"
 
564
        self.start_checker()
 
565
    
 
566
    # Disable - method
 
567
    @dbus.service.method(_interface)
 
568
    def Disable(self):
 
569
        "D-Bus method"
 
570
        self.disable()
 
571
    
 
572
    # StopChecker - method
 
573
    StopChecker = dbus.service.method(_interface)(stop_checker)
 
574
    StopChecker.__name__ = "StopChecker"
 
575
    
 
576
    del _interface
382
577
 
383
578
 
384
579
def peer_certificate(session):
385
580
    "Return the peer's OpenPGP certificate as a bytestring"
386
581
    # If not an OpenPGP certificate...
387
 
    if gnutls.library.functions.gnutls_certificate_type_get\
388
 
            (session._c_object) \
389
 
           != gnutls.library.constants.GNUTLS_CRT_OPENPGP:
 
582
    if (gnutls.library.functions
 
583
        .gnutls_certificate_type_get(session._c_object)
 
584
        != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
390
585
        # ...do the normal thing
391
586
        return session.peer_certificate
392
587
    list_size = ctypes.c_uint()
393
 
    cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
394
 
        (session._c_object, ctypes.byref(list_size))
 
588
    cert_list = (gnutls.library.functions
 
589
                 .gnutls_certificate_get_peers
 
590
                 (session._c_object, ctypes.byref(list_size)))
395
591
    if list_size.value == 0:
396
592
        return None
397
593
    cert = cert_list[0]
401
597
def fingerprint(openpgp):
402
598
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
403
599
    # New GnuTLS "datum" with the OpenPGP public key
404
 
    datum = gnutls.library.types.gnutls_datum_t\
405
 
        (ctypes.cast(ctypes.c_char_p(openpgp),
406
 
                     ctypes.POINTER(ctypes.c_ubyte)),
407
 
         ctypes.c_uint(len(openpgp)))
 
600
    datum = (gnutls.library.types
 
601
             .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
602
                                         ctypes.POINTER
 
603
                                         (ctypes.c_ubyte)),
 
604
                             ctypes.c_uint(len(openpgp))))
408
605
    # New empty GnuTLS certificate
409
606
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
410
 
    gnutls.library.functions.gnutls_openpgp_crt_init\
411
 
        (ctypes.byref(crt))
 
607
    (gnutls.library.functions
 
608
     .gnutls_openpgp_crt_init(ctypes.byref(crt)))
412
609
    # Import the OpenPGP public key into the certificate
413
 
    gnutls.library.functions.gnutls_openpgp_crt_import\
414
 
                    (crt, ctypes.byref(datum),
415
 
                     gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
610
    (gnutls.library.functions
 
611
     .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
612
                                gnutls.library.constants
 
613
                                .GNUTLS_OPENPGP_FMT_RAW))
416
614
    # Verify the self signature in the key
417
 
    crtverify = ctypes.c_uint();
418
 
    gnutls.library.functions.gnutls_openpgp_crt_verify_self\
419
 
        (crt, 0, ctypes.byref(crtverify))
 
615
    crtverify = ctypes.c_uint()
 
616
    (gnutls.library.functions
 
617
     .gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
420
618
    if crtverify.value != 0:
421
619
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
422
620
        raise gnutls.errors.CertificateSecurityError("Verify failed")
423
621
    # New buffer for the fingerprint
424
 
    buffer = ctypes.create_string_buffer(20)
425
 
    buffer_length = ctypes.c_size_t()
 
622
    buf = ctypes.create_string_buffer(20)
 
623
    buf_len = ctypes.c_size_t()
426
624
    # Get the fingerprint from the certificate into the buffer
427
 
    gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
428
 
        (crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
 
625
    (gnutls.library.functions
 
626
     .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
627
                                         ctypes.byref(buf_len)))
429
628
    # Deinit the certificate
430
629
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
431
630
    # Convert the buffer to a Python bytestring
432
 
    fpr = ctypes.string_at(buffer, buffer_length.value)
 
631
    fpr = ctypes.string_at(buf, buf_len.value)
433
632
    # Convert the bytestring to hexadecimal notation
434
633
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
435
634
    return hex_fpr
436
635
 
437
636
 
438
 
class tcp_handler(SocketServer.BaseRequestHandler, object):
 
637
class TCP_handler(SocketServer.BaseRequestHandler, object):
439
638
    """A TCP request handler class.
440
639
    Instantiated by IPv6_TCPServer for each request to handle it.
441
640
    Note: This will run in its own forked process."""
442
641
    
443
642
    def handle(self):
444
643
        logger.info(u"TCP connection from: %s",
445
 
                     unicode(self.client_address))
446
 
        session = gnutls.connection.ClientSession\
447
 
                  (self.request, gnutls.connection.X509Credentials())
 
644
                    unicode(self.client_address))
 
645
        session = (gnutls.connection
 
646
                   .ClientSession(self.request,
 
647
                                  gnutls.connection
 
648
                                  .X509Credentials()))
448
649
        
449
650
        line = self.request.makefile().readline()
450
651
        logger.debug(u"Protocol version: %r", line)
463
664
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
464
665
        #                "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
465
666
        #                "+DHE-DSS"))
466
 
        priority = "NORMAL"             # Fallback default, since this
467
 
                                        # MUST be set.
468
 
        if self.server.settings["priority"]:
469
 
            priority = self.server.settings["priority"]
470
 
        gnutls.library.functions.gnutls_priority_set_direct\
471
 
            (session._c_object, priority, None);
 
667
        # Use a fallback default, since this MUST be set.
 
668
        priority = self.server.settings.get("priority", "NORMAL")
 
669
        (gnutls.library.functions
 
670
         .gnutls_priority_set_direct(session._c_object,
 
671
                                     priority, None))
472
672
        
473
673
        try:
474
674
            session.handshake()
484
684
            session.bye()
485
685
            return
486
686
        logger.debug(u"Fingerprint: %s", fpr)
487
 
        client = None
488
687
        for c in self.server.clients:
489
688
            if c.fingerprint == fpr:
490
689
                client = c
491
690
                break
492
 
        if not client:
 
691
        else:
493
692
            logger.warning(u"Client not found for fingerprint: %s",
494
693
                           fpr)
495
694
            session.bye()
502
701
                           vars(client))
503
702
            session.bye()
504
703
            return
 
704
        ## This won't work here, since we're in a fork.
 
705
        # client.bump_timeout()
505
706
        sent_size = 0
506
707
        while sent_size < len(client.secret):
507
708
            sent = session.send(client.secret[sent_size:])
512
713
        session.bye()
513
714
 
514
715
 
515
 
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
 
716
class IPv6_TCPServer(SocketServer.ForkingMixIn,
 
717
                     SocketServer.TCPServer, object):
516
718
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
517
719
    Attributes:
518
720
        settings:       Server settings
519
721
        clients:        Set() of Client objects
 
722
        enabled:        Boolean; whether this server is activated yet
520
723
    """
521
724
    address_family = socket.AF_INET6
522
725
    def __init__(self, *args, **kwargs):
526
729
        if "clients" in kwargs:
527
730
            self.clients = kwargs["clients"]
528
731
            del kwargs["clients"]
529
 
        return super(type(self), self).__init__(*args, **kwargs)
 
732
        self.enabled = False
 
733
        super(IPv6_TCPServer, self).__init__(*args, **kwargs)
530
734
    def server_bind(self):
531
735
        """This overrides the normal server_bind() function
532
736
        to bind to an interface if one was specified, and also NOT to
561
765
#                                            if_nametoindex
562
766
#                                            (self.settings
563
767
#                                             ["interface"]))
564
 
            return super(type(self), self).server_bind()
 
768
            return super(IPv6_TCPServer, self).server_bind()
 
769
    def server_activate(self):
 
770
        if self.enabled:
 
771
            return super(IPv6_TCPServer, self).server_activate()
 
772
    def enable(self):
 
773
        self.enabled = True
565
774
 
566
775
 
567
776
def string_to_delta(interval):
583
792
    timevalue = datetime.timedelta(0)
584
793
    for s in interval.split():
585
794
        try:
586
 
            suffix=unicode(s[-1])
587
 
            value=int(s[:-1])
 
795
            suffix = unicode(s[-1])
 
796
            value = int(s[:-1])
588
797
            if suffix == u"d":
589
798
                delta = datetime.timedelta(value)
590
799
            elif suffix == u"s":
630
839
    """Call the C function if_nametoindex(), or equivalent"""
631
840
    global if_nametoindex
632
841
    try:
633
 
        if "ctypes.util" not in sys.modules:
634
 
            import ctypes.util
635
 
        if_nametoindex = ctypes.cdll.LoadLibrary\
636
 
            (ctypes.util.find_library("c")).if_nametoindex
 
842
        if_nametoindex = (ctypes.cdll.LoadLibrary
 
843
                          (ctypes.util.find_library("c"))
 
844
                          .if_nametoindex)
637
845
    except (OSError, AttributeError):
638
846
        if "struct" not in sys.modules:
639
847
            import struct
642
850
        def if_nametoindex(interface):
643
851
            "Get an interface index the hard way, i.e. using fcntl()"
644
852
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
645
 
            s = socket.socket()
646
 
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
647
 
                                struct.pack("16s16x", interface))
648
 
            s.close()
 
853
            with closing(socket.socket()) as s:
 
854
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
855
                                    struct.pack("16s16x", interface))
649
856
            interface_index = struct.unpack("I", ifreq[16:20])[0]
650
857
            return interface_index
651
858
    return if_nametoindex(interface)
675
882
 
676
883
 
677
884
def main():
678
 
    global main_loop_started
679
 
    main_loop_started = False
680
 
    
681
885
    parser = OptionParser(version = "%%prog %s" % version)
682
886
    parser.add_option("-i", "--interface", type="string",
683
887
                      metavar="IF", help="Bind to interface IF")
698
902
                      default="/etc/mandos", metavar="DIR",
699
903
                      help="Directory to search for configuration"
700
904
                      " files")
701
 
    (options, args) = parser.parse_args()
 
905
    options = parser.parse_args()[0]
702
906
    
703
907
    if options.check:
704
908
        import doctest
722
926
    # Convert the SafeConfigParser object to a dict
723
927
    server_settings = server_config.defaults()
724
928
    # Use getboolean on the boolean config option
725
 
    server_settings["debug"] = server_config.getboolean\
726
 
                               ("DEFAULT", "debug")
 
929
    server_settings["debug"] = (server_config.getboolean
 
930
                                ("DEFAULT", "debug"))
727
931
    del server_config
728
932
    
729
933
    # Override the settings from the config file with command line
743
947
        console.setLevel(logging.WARNING)
744
948
    
745
949
    if server_settings["servicename"] != "Mandos":
746
 
        syslogger.setFormatter(logging.Formatter\
 
950
        syslogger.setFormatter(logging.Formatter
747
951
                               ('Mandos (%s): %%(levelname)s:'
748
952
                                ' %%(message)s'
749
953
                                % server_settings["servicename"]))
758
962
    client_config.read(os.path.join(server_settings["configdir"],
759
963
                                    "clients.conf"))
760
964
    
 
965
    clients = Set()
 
966
    tcp_server = IPv6_TCPServer((server_settings["address"],
 
967
                                 server_settings["port"]),
 
968
                                TCP_handler,
 
969
                                settings=server_settings,
 
970
                                clients=clients)
 
971
    pidfilename = "/var/run/mandos.pid"
 
972
    try:
 
973
        pidfile = open(pidfilename, "w")
 
974
    except IOError, error:
 
975
        logger.error("Could not open file %r", pidfilename)
 
976
    
 
977
    try:
 
978
        uid = pwd.getpwnam("_mandos").pw_uid
 
979
    except KeyError:
 
980
        try:
 
981
            uid = pwd.getpwnam("mandos").pw_uid
 
982
        except KeyError:
 
983
            try:
 
984
                uid = pwd.getpwnam("nobody").pw_uid
 
985
            except KeyError:
 
986
                uid = 65534
 
987
    try:
 
988
        gid = pwd.getpwnam("_mandos").pw_gid
 
989
    except KeyError:
 
990
        try:
 
991
            gid = pwd.getpwnam("mandos").pw_gid
 
992
        except KeyError:
 
993
            try:
 
994
                gid = pwd.getpwnam("nogroup").pw_gid
 
995
            except KeyError:
 
996
                gid = 65534
 
997
    try:
 
998
        os.setuid(uid)
 
999
        os.setgid(gid)
 
1000
    except OSError, error:
 
1001
        if error[0] != errno.EPERM:
 
1002
            raise error
 
1003
    
761
1004
    global service
762
1005
    service = AvahiService(name = server_settings["servicename"],
763
 
                           type = "_mandos._tcp", );
 
1006
                           servicetype = "_mandos._tcp", )
764
1007
    if server_settings["interface"]:
765
 
        service.interface = if_nametoindex\
766
 
                            (server_settings["interface"])
 
1008
        service.interface = (if_nametoindex
 
1009
                             (server_settings["interface"]))
767
1010
    
768
1011
    global main_loop
769
1012
    global bus
776
1019
                                           avahi.DBUS_PATH_SERVER),
777
1020
                            avahi.DBUS_INTERFACE_SERVER)
778
1021
    # End of Avahi example code
779
 
    
780
 
    clients = Set()
781
 
    def remove_from_clients(client):
782
 
        clients.remove(client)
783
 
        if not clients:
784
 
            logger.critical(u"No clients left, exiting")
785
 
            sys.exit()
 
1022
    bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
786
1023
    
787
1024
    clients.update(Set(Client(name = section,
788
 
                              stop_hook = remove_from_clients,
789
1025
                              config
790
1026
                              = dict(client_config.items(section)))
791
1027
                       for section in client_config.sections()))
805
1041
        # Close all input and output, do double fork, etc.
806
1042
        daemon()
807
1043
    
808
 
    pidfilename = "/var/run/mandos/mandos.pid"
809
 
    pid = os.getpid()
810
1044
    try:
811
 
        pidfile = open(pidfilename, "w")
 
1045
        pid = os.getpid()
812
1046
        pidfile.write(str(pid) + "\n")
813
1047
        pidfile.close()
814
1048
        del pidfile
815
 
    except IOError, err:
816
 
        logger.error(u"Could not write %s file with PID %d",
817
 
                     pidfilename, os.getpid())
 
1049
    except IOError:
 
1050
        logger.error(u"Could not write to file %r with PID %d",
 
1051
                     pidfilename, pid)
 
1052
    except NameError:
 
1053
        # "pidfile" was never created
 
1054
        pass
 
1055
    del pidfilename
818
1056
    
819
1057
    def cleanup():
820
1058
        "Cleanup function; run on exit"
827
1065
        
828
1066
        while clients:
829
1067
            client = clients.pop()
830
 
            client.stop_hook = None
831
 
            client.stop()
 
1068
            client.disable_hook = None
 
1069
            client.disable()
832
1070
    
833
1071
    atexit.register(cleanup)
834
1072
    
837
1075
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
838
1076
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
839
1077
    
 
1078
    class MandosServer(dbus.service.Object):
 
1079
        """A D-Bus proxy object"""
 
1080
        def __init__(self):
 
1081
            dbus.service.Object.__init__(self, bus,
 
1082
                                         "/Mandos")
 
1083
        _interface = u"org.mandos_system.Mandos"
 
1084
        
 
1085
        @dbus.service.signal(_interface, signature="oa{sv}")
 
1086
        def ClientAdded(self, objpath, properties):
 
1087
            "D-Bus signal"
 
1088
            pass
 
1089
        
 
1090
        @dbus.service.signal(_interface, signature="o")
 
1091
        def ClientRemoved(self, objpath):
 
1092
            "D-Bus signal"
 
1093
            pass
 
1094
        
 
1095
        @dbus.service.method(_interface, out_signature="ao")
 
1096
        def GetAllClients(self):
 
1097
            return dbus.Array(c.dbus_object_path for c in clients)
 
1098
        
 
1099
        @dbus.service.method(_interface, out_signature="a{oa{sv}}")
 
1100
        def GetAllClientsWithProperties(self):
 
1101
            return dbus.Dictionary(
 
1102
                ((c.dbus_object_path, c.GetAllProperties())
 
1103
                 for c in clients),
 
1104
                signature="oa{sv}")
 
1105
        
 
1106
        @dbus.service.method(_interface, in_signature="o")
 
1107
        def RemoveClient(self, object_path):
 
1108
            for c in clients:
 
1109
                if c.dbus_object_path == object_path:
 
1110
                    c.disable()
 
1111
                    clients.remove(c)
 
1112
                    return
 
1113
            raise KeyError
 
1114
        
 
1115
        del _interface
 
1116
    
 
1117
    mandos_server = MandosServer()
 
1118
    
840
1119
    for client in clients:
841
 
        client.start()
842
 
    
843
 
    tcp_server = IPv6_TCPServer((server_settings["address"],
844
 
                                 server_settings["port"]),
845
 
                                tcp_handler,
846
 
                                settings=server_settings,
847
 
                                clients=clients)
 
1120
        # Emit D-Bus signal
 
1121
        mandos_server.ClientAdded(client.dbus_object_path,
 
1122
                                  client.GetAllProperties())
 
1123
        client.enable()
 
1124
    
 
1125
    tcp_server.enable()
 
1126
    tcp_server.server_activate()
 
1127
    
848
1128
    # Find out what port we got
849
1129
    service.port = tcp_server.socket.getsockname()[1]
850
1130
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
864
1144
        
865
1145
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
866
1146
                             lambda *args, **kwargs:
867
 
                             tcp_server.handle_request\
868
 
                             (*args[2:], **kwargs) or True)
 
1147
                             (tcp_server.handle_request
 
1148
                              (*args[2:], **kwargs) or True))
869
1149
        
870
1150
        logger.debug(u"Starting main loop")
871
 
        main_loop_started = True
872
1151
        main_loop.run()
873
1152
    except AvahiError, error:
874
1153
        logger.critical(u"AvahiError: %s" + unicode(error))