To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.2.38
- compare with another revision
- download diff
- download tarball
- view history from revision 237.2.38
- Committer: Teddy Hogeborn
- Date: 2009-01-18 00:16:57 UTC
- mto: (24.1.127 mandos) (237.4.2 mandos-pipe-ipc) (299.1.1 release) (300.1.1 release) (301.1.1 release)
- mto: This revision was merged to the branch mainline in revision 249.
- Revision ID: teddy@fukt.bsnet.se-20090118001657-6mo3ae73ldy5tegf
* debian/mandos-client.postinst: Converted to Bourne shell. Also
minor message change.
* debian/mandos-client.postrm: Minor message change.
* debian/mandos.postinst: Converted to Bourne shell. Also minor
message change.
* debian/mandos.prerm: Minor message change.
minor message change.
* debian/mandos-client.postrm: Minor message change.
* debian/mandos.postinst: Converted to Bourne shell. Also minor
message change.
* debian/mandos.prerm: Minor message change.
- files modified:
- INSTALL
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
34
34
from __future__ import division, with_statement, absolute_import
35
35
36
import SocketServer as socketserver
36
import SocketServer
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
import ConfigParser as configparser
47
import ConfigParser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
from sets import Set
52
53
import subprocess
53
54
import atexit
54
55
import stat
56
57
import logging.handlers
57
58
import pwd
58
59
from contextlib import closing
59
import struct
60
import fcntl
61
import functools
62
60
63
61
import dbus
64
62
import dbus.service
68
66
import ctypes
69
67
import ctypes.util
70
68
71
try:
72
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
73
except AttributeError:
74
try:
75
from IN import SO_BINDTODEVICE
76
except ImportError:
77
SO_BINDTODEVICE = None
78
79
80
version = "1.0.8"
81
82
logger = logging.Logger(u'mandos')
69
version = "1.0.5"
70
71
logger = logging.Logger('mandos')
83
72
syslogger = (logging.handlers.SysLogHandler
84
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
85
74
address = "/dev/log"))
86
75
syslogger.setFormatter(logging.Formatter
87
(u'Mandos [%(process)d]: %(levelname)s:'
88
u' %(message)s'))
76
('Mandos: %(levelname)s: %(message)s'))
89
77
logger.addHandler(syslogger)
90
78
91
79
console = logging.StreamHandler()
92
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
93
u' %(levelname)s:'
94
u' %(message)s'))
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
95
82
logger.addHandler(console)
96
83
97
84
class AvahiError(Exception):
110
97
111
98
class AvahiService(object):
112
99
"""An Avahi (Zeroconf) service.
113
114
100
Attributes:
115
101
interface: integer; avahi.IF_UNSPEC or an interface index.
116
102
Used to optionally bind to the specified interface.
117
name: string; Example: u'Mandos'
118
type: string; Example: u'_mandos._tcp'.
103
name: string; Example: 'Mandos'
104
type: string; Example: '_mandos._tcp'.
119
105
See <http://www.dns-sd.org/ServiceTypes.html>
120
106
port: integer; what port to announce
121
107
TXT: list of strings; TXT record for the service
124
110
max_renames: integer; maximum number of renames
125
111
rename_count: integer; counter so we only rename after collisions
126
112
a sensible number of times
127
group: D-Bus Entry Group
128
server: D-Bus Server
129
bus: dbus.SystemBus()
130
113
"""
131
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
132
115
servicetype = None, port = None, TXT = None,
133
domain = u"", host = u"", max_renames = 32768,
134
protocol = avahi.PROTO_UNSPEC, bus = None):
116
domain = "", host = "", max_renames = 32768):
135
117
self.interface = interface
136
118
self.name = name
137
119
self.type = servicetype
141
123
self.host = host
142
124
self.rename_count = 0
143
125
self.max_renames = max_renames
144
self.protocol = protocol
145
self.group = None # our entry group
146
self.server = None
147
self.bus = bus
148
126
def rename(self):
149
127
"""Derived from the Avahi example code"""
150
128
if self.rename_count >= self.max_renames:
152
130
u" after %i retries, exiting.",
153
131
self.rename_count)
154
132
raise AvahiServiceError(u"Too many renames")
155
self.name = self.server.GetAlternativeServiceName(self.name)
133
self.name = server.GetAlternativeServiceName(self.name)
156
134
logger.info(u"Changing Zeroconf service name to %r ...",
157
unicode(self.name))
135
str(self.name))
158
136
syslogger.setFormatter(logging.Formatter
159
(u'Mandos (%s) [%%(process)d]:'
160
u' %%(levelname)s: %%(message)s'
161
% self.name))
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
162
139
self.remove()
163
140
self.add()
164
141
self.rename_count += 1
165
142
def remove(self):
166
143
"""Derived from the Avahi example code"""
167
if self.group is not None:
168
self.group.Reset()
144
if group is not None:
145
group.Reset()
169
146
def add(self):
170
147
"""Derived from the Avahi example code"""
171
if self.group is None:
172
self.group = dbus.Interface(
173
self.bus.get_object(avahi.DBUS_NAME,
174
self.server.EntryGroupNew()),
175
avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
self.group.connect_to_signal('StateChanged',
177
self.entry_group_state_changed)
148
global group
149
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
178
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
179
self.name, self.type)
180
self.group.AddService(
181
self.interface,
182
self.protocol,
183
dbus.UInt32(0), # flags
184
self.name, self.type,
185
self.domain, self.host,
186
dbus.UInt16(self.port),
187
avahi.string_array_to_txt_array(self.TXT))
188
self.group.Commit()
189
def entry_group_state_changed(self, state, error):
190
"""Derived from the Avahi example code"""
191
logger.debug(u"Avahi state change: %i", state)
192
193
if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
logger.debug(u"Zeroconf service established.")
195
elif state == avahi.ENTRY_GROUP_COLLISION:
196
logger.warning(u"Zeroconf service name collision.")
197
self.rename()
198
elif state == avahi.ENTRY_GROUP_FAILURE:
199
logger.critical(u"Avahi: Error in group state changed %s",
200
unicode(error))
201
raise AvahiGroupError(u"State changed: %s"
202
% unicode(error))
203
def cleanup(self):
204
"""Derived from the Avahi example code"""
205
if self.group is not None:
206
self.group.Free()
207
self.group = None
208
def server_state_changed(self, state):
209
"""Derived from the Avahi example code"""
210
if state == avahi.SERVER_COLLISION:
211
logger.error(u"Zeroconf server name collision")
212
self.remove()
213
elif state == avahi.SERVER_RUNNING:
214
self.add()
215
def activate(self):
216
"""Derived from the Avahi example code"""
217
if self.server is None:
218
self.server = dbus.Interface(
219
self.bus.get_object(avahi.DBUS_NAME,
220
avahi.DBUS_PATH_SERVER),
221
avahi.DBUS_INTERFACE_SERVER)
222
self.server.connect_to_signal(u"StateChanged",
223
self.server_state_changed)
224
self.server_state_changed(self.server.GetState())
225
226
227
class Client(object):
157
service.name, service.type)
158
group.AddService(
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
166
group.Commit()
167
168
# From the Avahi example code:
169
group = None # our entry group
170
# End of Avahi example code
171
172
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
228
179
"""A representation of a client host served by this server.
229
230
180
Attributes:
231
name: string; from the config file, used in log messages and
232
D-Bus identifiers
181
name: string; from the config file, used in log messages
233
182
fingerprint: string (40 or 32 hexadecimal digits); used to
234
183
uniquely identify the client
235
184
secret: bytestring; sent verbatim (over TLS) to client
252
201
client lives. %() expansions are done at
253
202
runtime with vars(self) as dict, so that for
254
203
instance %(name)s can be used in the command.
255
current_checker_command: string; current running checker_command
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
256
206
"""
257
258
@staticmethod
259
def _datetime_to_milliseconds(dt):
260
"Convert a datetime.datetime() to milliseconds"
261
return ((dt.days * 24 * 60 * 60 * 1000)
262
+ (dt.seconds * 1000)
263
+ (dt.microseconds // 1000))
264
265
207
def timeout_milliseconds(self):
266
208
"Return the 'timeout' attribute in milliseconds"
267
return self._datetime_to_milliseconds(self.timeout)
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
268
212
269
213
def interval_milliseconds(self):
270
214
"Return the 'interval' attribute in milliseconds"
271
return self._datetime_to_milliseconds(self.interval)
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
272
218
273
def __init__(self, name = None, disable_hook=None, config=None):
219
def __init__(self, name = None, disable_hook=None, config=None,
220
use_dbus=True):
274
221
"""Note: the 'checker' key in 'config' sets the
275
222
'checker_command' attribute and *not* the 'checker'
276
223
attribute."""
278
225
if config is None:
279
226
config = {}
280
227
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
229
if self.use_dbus:
230
self.dbus_object_path = (dbus.ObjectPath
231
("/Mandos/clients/"
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
281
235
# Uppercase and remove spaces from fingerprint for later
282
236
# comparison purposes with return value from the fingerprint()
283
237
# function
284
self.fingerprint = (config[u"fingerprint"].upper()
238
self.fingerprint = (config["fingerprint"].upper()
285
239
.replace(u" ", u""))
286
240
logger.debug(u" Fingerprint: %s", self.fingerprint)
287
if u"secret" in config:
288
self.secret = config[u"secret"].decode(u"base64")
289
elif u"secfile" in config:
241
if "secret" in config:
242
self.secret = config["secret"].decode(u"base64")
243
elif "secfile" in config:
290
244
with closing(open(os.path.expanduser
291
245
(os.path.expandvars
292
(config[u"secfile"])))) as secfile:
246
(config["secfile"])))) as secfile:
293
247
self.secret = secfile.read()
294
248
else:
295
249
raise TypeError(u"No secret or secfile for client %s"
296
250
% self.name)
297
self.host = config.get(u"host", u"")
251
self.host = config.get("host", "")
298
252
self.created = datetime.datetime.utcnow()
299
253
self.enabled = False
300
254
self.last_enabled = None
301
255
self.last_checked_ok = None
302
self.timeout = string_to_delta(config[u"timeout"])
303
self.interval = string_to_delta(config[u"interval"])
256
self.timeout = string_to_delta(config["timeout"])
257
self.interval = string_to_delta(config["interval"])
304
258
self.disable_hook = disable_hook
305
259
self.checker = None
306
260
self.checker_initiator_tag = None
307
261
self.disable_initiator_tag = None
308
262
self.checker_callback_tag = None
309
self.checker_command = config[u"checker"]
310
self.current_checker_command = None
311
self.last_connect = None
263
self.checker_command = config["checker"]
312
264
313
265
def enable(self):
314
266
"""Start this client's checker and timeout hooks"""
325
277
(self.timeout_milliseconds(),
326
278
self.disable))
327
279
self.enabled = True
280
if self.use_dbus:
281
# Emit D-Bus signals
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
286
variant_level=1)))
328
287
329
288
def disable(self):
330
289
"""Disable this client."""
331
290
if not getattr(self, "enabled", False):
332
291
return False
333
292
logger.info(u"Disabling client %s", self.name)
334
if getattr(self, u"disable_initiator_tag", False):
293
if getattr(self, "disable_initiator_tag", False):
335
294
gobject.source_remove(self.disable_initiator_tag)
336
295
self.disable_initiator_tag = None
337
if getattr(self, u"checker_initiator_tag", False):
296
if getattr(self, "checker_initiator_tag", False):
338
297
gobject.source_remove(self.checker_initiator_tag)
339
298
self.checker_initiator_tag = None
340
299
self.stop_checker()
341
300
if self.disable_hook:
342
301
self.disable_hook(self)
343
302
self.enabled = False
303
if self.use_dbus:
304
# Emit D-Bus signal
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
344
307
# Do not run this again if called by a gobject.timeout_add
345
308
return False
346
309
352
315
"""The checker has completed, so take appropriate actions."""
353
316
self.checker_callback_tag = None
354
317
self.checker = None
355
if os.WIFEXITED(condition):
356
exitstatus = os.WEXITSTATUS(condition)
357
if exitstatus == 0:
358
logger.info(u"Checker for %(name)s succeeded",
359
vars(self))
360
self.checked_ok()
361
else:
362
logger.info(u"Checker for %(name)s failed",
363
vars(self))
364
else:
318
if self.use_dbus:
319
# Emit D-Bus signal
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
324
logger.info(u"Checker for %(name)s succeeded",
325
vars(self))
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
331
self.bump_timeout()
332
elif not os.WIFEXITED(condition):
365
333
logger.warning(u"Checker for %(name)s crashed?",
366
334
vars(self))
335
if self.use_dbus:
336
# Emit D-Bus signal
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
340
else:
341
logger.info(u"Checker for %(name)s failed",
342
vars(self))
343
if self.use_dbus:
344
# Emit D-Bus signal
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
367
348
368
def checked_ok(self):
349
def bump_timeout(self):
369
350
"""Bump up the timeout for this client.
370
371
351
This should only be called when the client has been seen,
372
352
alive and well.
373
353
"""
376
356
self.disable_initiator_tag = (gobject.timeout_add
377
357
(self.timeout_milliseconds(),
378
358
self.disable))
359
if self.use_dbus:
360
# Emit D-Bus signal
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
364
variant_level=1)))
379
365
380
366
def start_checker(self):
381
367
"""Start a new checker subprocess if one is not running.
382
383
368
If a checker already exists, leave it running and do
384
369
nothing."""
385
370
# The reason for not killing a running checker is that if we
390
375
# checkers alone, the checker would have to take more time
391
376
# than 'timeout' for the client to be declared invalid, which
392
377
# is as it should be.
393
394
# If a checker exists, make sure it is not a zombie
395
if self.checker is not None:
396
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
397
if pid:
398
logger.warning(u"Checker was a zombie")
399
gobject.source_remove(self.checker_callback_tag)
400
self.checker_callback(pid, status,
401
self.current_checker_command)
402
# Start a new checker if needed
403
378
if self.checker is None:
404
379
try:
405
380
# In case checker_command has exactly one % operator
406
381
command = self.checker_command % self.host
407
382
except TypeError:
408
383
# Escape attributes for the shell
409
escaped_attrs = dict((key,
410
re.escape(unicode(str(val),
411
errors=
412
u'replace')))
384
escaped_attrs = dict((key, re.escape(str(val)))
413
385
for key, val in
414
386
vars(self).iteritems())
415
387
try:
418
390
logger.error(u'Could not format string "%s":'
419
391
u' %s', self.checker_command, error)
420
392
return True # Try again later
421
self.current_checker_command = command
422
393
try:
423
394
logger.info(u"Starting checker %r for %s",
424
395
command, self.name)
428
399
# always replaced by /dev/null.)
429
400
self.checker = subprocess.Popen(command,
430
401
close_fds=True,
431
shell=True, cwd=u"/")
402
shell=True, cwd="/")
403
if self.use_dbus:
404
# Emit D-Bus signal
405
self.CheckerStarted(command)
406
self.PropertyChanged(
407
dbus.String("checker_running"),
408
dbus.Boolean(True, variant_level=1))
432
409
self.checker_callback_tag = (gobject.child_watch_add
433
410
(self.checker.pid,
434
411
self.checker_callback,
435
412
data=command))
436
# The checker may have completed before the gobject
437
# watch was added. Check for this.
438
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
439
if pid:
440
gobject.source_remove(self.checker_callback_tag)
441
self.checker_callback(pid, status, command)
442
413
except OSError, error:
443
414
logger.error(u"Failed to start subprocess: %s",
444
415
error)
450
421
if self.checker_callback_tag:
451
422
gobject.source_remove(self.checker_callback_tag)
452
423
self.checker_callback_tag = None
453
if getattr(self, u"checker", None) is None:
424
if getattr(self, "checker", None) is None:
454
425
return
455
426
logger.debug(u"Stopping checker for %(name)s", vars(self))
456
427
try:
462
433
if error.errno != errno.ESRCH: # No such process
463
434
raise
464
435
self.checker = None
436
if self.use_dbus:
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
465
439
466
440
def still_valid(self):
467
441
"""Has the timeout not yet passed for this client?"""
468
if not getattr(self, u"enabled", False):
442
if not getattr(self, "enabled", False):
469
443
return False
470
444
now = datetime.datetime.utcnow()
471
445
if self.last_checked_ok is None:
472
446
return now < (self.created + self.timeout)
473
447
else:
474
448
return now < (self.last_checked_ok + self.timeout)
475
476
477
class ClientDBus(Client, dbus.service.Object):
478
"""A Client class using D-Bus
479
480
Attributes:
481
dbus_object_path: dbus.ObjectPath
482
bus: dbus.SystemBus()
483
"""
484
# dbus.service.Object doesn't use super(), so we can't either.
485
486
def __init__(self, bus = None, *args, **kwargs):
487
self.bus = bus
488
Client.__init__(self, *args, **kwargs)
489
# Only now, when this client is initialized, can it show up on
490
# the D-Bus
491
self.dbus_object_path = (dbus.ObjectPath
492
(u"/clients/"
493
+ self.name.replace(u".", u"_")))
494
dbus.service.Object.__init__(self, self.bus,
495
self.dbus_object_path)
496
497
@staticmethod
498
def _datetime_to_dbus(dt, variant_level=0):
499
"""Convert a UTC datetime.datetime() to a D-Bus type."""
500
return dbus.String(dt.isoformat(),
501
variant_level=variant_level)
502
503
def enable(self):
504
oldstate = getattr(self, u"enabled", False)
505
r = Client.enable(self)
506
if oldstate != self.enabled:
507
# Emit D-Bus signals
508
self.PropertyChanged(dbus.String(u"enabled"),
509
dbus.Boolean(True, variant_level=1))
510
self.PropertyChanged(
511
dbus.String(u"last_enabled"),
512
self._datetime_to_dbus(self.last_enabled,
513
variant_level=1))
514
return r
515
516
def disable(self, signal = True):
517
oldstate = getattr(self, u"enabled", False)
518
r = Client.disable(self)
519
if signal and oldstate != self.enabled:
520
# Emit D-Bus signal
521
self.PropertyChanged(dbus.String(u"enabled"),
522
dbus.Boolean(False, variant_level=1))
523
return r
524
525
def __del__(self, *args, **kwargs):
526
try:
527
self.remove_from_connection()
528
except LookupError:
529
pass
530
if hasattr(dbus.service.Object, u"__del__"):
531
dbus.service.Object.__del__(self, *args, **kwargs)
532
Client.__del__(self, *args, **kwargs)
533
534
def checker_callback(self, pid, condition, command,
535
*args, **kwargs):
536
self.checker_callback_tag = None
537
self.checker = None
538
# Emit D-Bus signal
539
self.PropertyChanged(dbus.String(u"checker_running"),
540
dbus.Boolean(False, variant_level=1))
541
if os.WIFEXITED(condition):
542
exitstatus = os.WEXITSTATUS(condition)
543
# Emit D-Bus signal
544
self.CheckerCompleted(dbus.Int16(exitstatus),
545
dbus.Int64(condition),
546
dbus.String(command))
547
else:
548
# Emit D-Bus signal
549
self.CheckerCompleted(dbus.Int16(-1),
550
dbus.Int64(condition),
551
dbus.String(command))
552
553
return Client.checker_callback(self, pid, condition, command,
554
*args, **kwargs)
555
556
def checked_ok(self, *args, **kwargs):
557
r = Client.checked_ok(self, *args, **kwargs)
558
# Emit D-Bus signal
559
self.PropertyChanged(
560
dbus.String(u"last_checked_ok"),
561
(self._datetime_to_dbus(self.last_checked_ok,
562
variant_level=1)))
563
return r
564
565
def start_checker(self, *args, **kwargs):
566
old_checker = self.checker
567
if self.checker is not None:
568
old_checker_pid = self.checker.pid
569
else:
570
old_checker_pid = None
571
r = Client.start_checker(self, *args, **kwargs)
572
# Only if new checker process was started
573
if (self.checker is not None
574
and old_checker_pid != self.checker.pid):
575
# Emit D-Bus signal
576
self.CheckerStarted(self.current_checker_command)
577
self.PropertyChanged(
578
dbus.String(u"checker_running"),
579
dbus.Boolean(True, variant_level=1))
580
return r
581
582
def stop_checker(self, *args, **kwargs):
583
old_checker = getattr(self, u"checker", None)
584
r = Client.stop_checker(self, *args, **kwargs)
585
if (old_checker is not None
586
and getattr(self, u"checker", None) is None):
587
self.PropertyChanged(dbus.String(u"checker_running"),
588
dbus.Boolean(False, variant_level=1))
589
return r
590
449
591
450
## D-Bus methods & signals
592
_interface = u"se.bsnet.fukt.Mandos.Client"
451
_interface = u"org.mandos_system.Mandos.Client"
593
452
594
# CheckedOK - method
595
@dbus.service.method(_interface)
596
def CheckedOK(self):
597
return self.checked_ok()
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
598
456
599
457
# CheckerCompleted - signal
600
@dbus.service.signal(_interface, signature=u"nxs")
601
def CheckerCompleted(self, exitcode, waitstatus, command):
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
602
460
"D-Bus signal"
603
461
pass
604
462
605
463
# CheckerStarted - signal
606
@dbus.service.signal(_interface, signature=u"s")
464
@dbus.service.signal(_interface, signature="s")
607
465
def CheckerStarted(self, command):
608
466
"D-Bus signal"
609
467
pass
610
468
611
469
# GetAllProperties - method
612
@dbus.service.method(_interface, out_signature=u"a{sv}")
470
@dbus.service.method(_interface, out_signature="a{sv}")
613
471
def GetAllProperties(self):
614
472
"D-Bus method"
615
473
return dbus.Dictionary({
616
dbus.String(u"name"):
474
dbus.String("name"):
617
475
dbus.String(self.name, variant_level=1),
618
dbus.String(u"fingerprint"):
476
dbus.String("fingerprint"):
619
477
dbus.String(self.fingerprint, variant_level=1),
620
dbus.String(u"host"):
478
dbus.String("host"):
621
479
dbus.String(self.host, variant_level=1),
622
dbus.String(u"created"):
623
self._datetime_to_dbus(self.created,
624
variant_level=1),
625
dbus.String(u"last_enabled"):
626
(self._datetime_to_dbus(self.last_enabled,
627
variant_level=1)
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
484
variant_level=1)
628
485
if self.last_enabled is not None
629
486
else dbus.Boolean(False, variant_level=1)),
630
dbus.String(u"enabled"):
487
dbus.String("enabled"):
631
488
dbus.Boolean(self.enabled, variant_level=1),
632
dbus.String(u"last_checked_ok"):
633
(self._datetime_to_dbus(self.last_checked_ok,
634
variant_level=1)
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
491
variant_level=1)
635
492
if self.last_checked_ok is not None
636
493
else dbus.Boolean (False, variant_level=1)),
637
dbus.String(u"timeout"):
494
dbus.String("timeout"):
638
495
dbus.UInt64(self.timeout_milliseconds(),
639
496
variant_level=1),
640
dbus.String(u"interval"):
497
dbus.String("interval"):
641
498
dbus.UInt64(self.interval_milliseconds(),
642
499
variant_level=1),
643
dbus.String(u"checker"):
500
dbus.String("checker"):
644
501
dbus.String(self.checker_command,
645
502
variant_level=1),
646
dbus.String(u"checker_running"):
503
dbus.String("checker_running"):
647
504
dbus.Boolean(self.checker is not None,
648
505
variant_level=1),
649
dbus.String(u"object_path"):
650
dbus.ObjectPath(self.dbus_object_path,
651
variant_level=1)
652
}, signature=u"sv")
506
}, signature="sv")
653
507
654
508
# IsStillValid - method
655
@dbus.service.method(_interface, out_signature=u"b")
656
def IsStillValid(self):
657
return self.still_valid()
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
510
(still_valid))
511
IsStillValid.__name__ = "IsStillValid"
658
512
659
513
# PropertyChanged - signal
660
@dbus.service.signal(_interface, signature=u"sv")
514
@dbus.service.signal(_interface, signature="sv")
661
515
def PropertyChanged(self, property, value):
662
516
"D-Bus signal"
663
517
pass
664
518
665
# ReceivedSecret - signal
666
@dbus.service.signal(_interface)
667
def ReceivedSecret(self):
668
"D-Bus signal"
669
pass
670
671
# Rejected - signal
672
@dbus.service.signal(_interface)
673
def Rejected(self):
674
"D-Bus signal"
675
pass
676
677
519
# SetChecker - method
678
@dbus.service.method(_interface, in_signature=u"s")
520
@dbus.service.method(_interface, in_signature="s")
679
521
def SetChecker(self, checker):
680
522
"D-Bus setter method"
681
523
self.checker_command = checker
685
527
variant_level=1))
686
528
687
529
# SetHost - method
688
@dbus.service.method(_interface, in_signature=u"s")
530
@dbus.service.method(_interface, in_signature="s")
689
531
def SetHost(self, host):
690
532
"D-Bus setter method"
691
533
self.host = host
694
536
dbus.String(self.host, variant_level=1))
695
537
696
538
# SetInterval - method
697
@dbus.service.method(_interface, in_signature=u"t")
539
@dbus.service.method(_interface, in_signature="t")
698
540
def SetInterval(self, milliseconds):
699
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
700
542
# Emit D-Bus signal
703
545
variant_level=1)))
704
546
705
547
# SetSecret - method
706
@dbus.service.method(_interface, in_signature=u"ay",
548
@dbus.service.method(_interface, in_signature="ay",
707
549
byte_arrays=True)
708
550
def SetSecret(self, secret):
709
551
"D-Bus setter method"
710
552
self.secret = str(secret)
711
553
712
554
# SetTimeout - method
713
@dbus.service.method(_interface, in_signature=u"t")
555
@dbus.service.method(_interface, in_signature="t")
714
556
def SetTimeout(self, milliseconds):
715
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
716
558
# Emit D-Bus signal
719
561
variant_level=1)))
720
562
721
563
# Enable - method
722
@dbus.service.method(_interface)
723
def Enable(self):
724
"D-Bus method"
725
self.enable()
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
726
566
727
567
# StartChecker - method
728
568
@dbus.service.method(_interface)
737
577
self.disable()
738
578
739
579
# StopChecker - method
740
@dbus.service.method(_interface)
741
def StopChecker(self):
742
self.stop_checker()
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
743
582
744
583
del _interface
745
584
746
585
747
class ClientHandler(socketserver.BaseRequestHandler, object):
748
"""A class to handle client connections.
749
750
Instantiated once for each connection to handle it.
586
def peer_certificate(session):
587
"Return the peer's OpenPGP certificate as a bytestring"
588
# If not an OpenPGP certificate...
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
592
# ...do the normal thing
593
return session.peer_certificate
594
list_size = ctypes.c_uint()
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
598
if list_size.value == 0:
599
return None
600
cert = cert_list[0]
601
return ctypes.string_at(cert.data, cert.size)
602
603
604
def fingerprint(openpgp):
605
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
606
# New GnuTLS "datum" with the OpenPGP public key
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
609
ctypes.POINTER
610
(ctypes.c_ubyte)),
611
ctypes.c_uint(len(openpgp))))
612
# New empty GnuTLS certificate
613
crt = gnutls.library.types.gnutls_openpgp_crt_t()
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
616
# Import the OpenPGP public key into the certificate
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
621
# Verify the self signature in the key
622
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
625
if crtverify.value != 0:
626
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
raise gnutls.errors.CertificateSecurityError("Verify failed")
628
# New buffer for the fingerprint
629
buf = ctypes.create_string_buffer(20)
630
buf_len = ctypes.c_size_t()
631
# Get the fingerprint from the certificate into the buffer
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
635
# Deinit the certificate
636
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
637
# Convert the buffer to a Python bytestring
638
fpr = ctypes.string_at(buf, buf_len.value)
639
# Convert the bytestring to hexadecimal notation
640
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
641
return hex_fpr
642
643
644
class TCP_handler(SocketServer.BaseRequestHandler, object):
645
"""A TCP request handler class.
646
Instantiated by IPv6_TCPServer for each request to handle it.
751
647
Note: This will run in its own forked process."""
752
648
753
649
def handle(self):
754
650
logger.info(u"TCP connection from: %s",
755
651
unicode(self.client_address))
756
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
757
# Open IPC pipe to parent process
758
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
759
session = (gnutls.connection
760
.ClientSession(self.request,
761
gnutls.connection
762
.X509Credentials()))
763
764
line = self.request.makefile().readline()
765
logger.debug(u"Protocol version: %r", line)
766
try:
767
if int(line.strip().split()[0]) > 1:
768
raise RuntimeError
769
except (ValueError, IndexError, RuntimeError), error:
770
logger.error(u"Unknown protocol version: %s", error)
771
return
772
773
# Note: gnutls.connection.X509Credentials is really a
774
# generic GnuTLS certificate credentials object so long as
775
# no X.509 keys are added to it. Therefore, we can use it
776
# here despite using OpenPGP certificates.
777
778
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
779
# u"+AES-256-CBC", u"+SHA1",
780
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
781
# u"+DHE-DSS"))
782
# Use a fallback default, since this MUST be set.
783
priority = self.server.gnutls_priority
784
if priority is None:
785
priority = u"NORMAL"
786
(gnutls.library.functions
787
.gnutls_priority_set_direct(session._c_object,
788
priority, None))
789
790
try:
791
session.handshake()
792
except gnutls.errors.GNUTLSError, error:
793
logger.warning(u"Handshake failed: %s", error)
794
# Do not run session.bye() here: the session is not
795
# established. Just abandon the request.
796
return
797
logger.debug(u"Handshake succeeded")
798
try:
799
fpr = self.fingerprint(self.peer_certificate(session))
800
except (TypeError, gnutls.errors.GNUTLSError), error:
801
logger.warning(u"Bad certificate: %s", error)
802
session.bye()
803
return
804
logger.debug(u"Fingerprint: %s", fpr)
805
806
for c in self.server.clients:
807
if c.fingerprint == fpr:
808
client = c
809
break
810
else:
811
ipc.write(u"NOTFOUND %s\n" % fpr)
812
session.bye()
813
return
814
# Have to check if client.still_valid(), since it is
815
# possible that the client timed out while establishing
816
# the GnuTLS session.
817
if not client.still_valid():
818
ipc.write(u"INVALID %s\n" % client.name)
819
session.bye()
820
return
821
ipc.write(u"SENDING %s\n" % client.name)
822
sent_size = 0
823
while sent_size < len(client.secret):
824
sent = session.send(client.secret[sent_size:])
825
logger.debug(u"Sent: %d, remaining: %d",
826
sent, len(client.secret)
827
- (sent_size + sent))
828
sent_size += sent
829
session.bye()
830
831
@staticmethod
832
def peer_certificate(session):
833
"Return the peer's OpenPGP certificate as a bytestring"
834
# If not an OpenPGP certificate...
835
if (gnutls.library.functions
836
.gnutls_certificate_type_get(session._c_object)
837
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
838
# ...do the normal thing
839
return session.peer_certificate
840
list_size = ctypes.c_uint(1)
841
cert_list = (gnutls.library.functions
842
.gnutls_certificate_get_peers
843
(session._c_object, ctypes.byref(list_size)))
844
if not bool(cert_list) and list_size.value != 0:
845
raise gnutls.errors.GNUTLSError(u"error getting peer"
846
u" certificate")
847
if list_size.value == 0:
848
return None
849
cert = cert_list[0]
850
return ctypes.string_at(cert.data, cert.size)
851
852
@staticmethod
853
def fingerprint(openpgp):
854
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
855
# New GnuTLS "datum" with the OpenPGP public key
856
datum = (gnutls.library.types
857
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
858
ctypes.POINTER
859
(ctypes.c_ubyte)),
860
ctypes.c_uint(len(openpgp))))
861
# New empty GnuTLS certificate
862
crt = gnutls.library.types.gnutls_openpgp_crt_t()
863
(gnutls.library.functions
864
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
865
# Import the OpenPGP public key into the certificate
866
(gnutls.library.functions
867
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
868
gnutls.library.constants
869
.GNUTLS_OPENPGP_FMT_RAW))
870
# Verify the self signature in the key
871
crtverify = ctypes.c_uint()
872
(gnutls.library.functions
873
.gnutls_openpgp_crt_verify_self(crt, 0,
874
ctypes.byref(crtverify)))
875
if crtverify.value != 0:
876
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
877
raise (gnutls.errors.CertificateSecurityError
878
(u"Verify failed"))
879
# New buffer for the fingerprint
880
buf = ctypes.create_string_buffer(20)
881
buf_len = ctypes.c_size_t()
882
# Get the fingerprint from the certificate into the buffer
883
(gnutls.library.functions
884
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
885
ctypes.byref(buf_len)))
886
# Deinit the certificate
887
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
888
# Convert the buffer to a Python bytestring
889
fpr = ctypes.string_at(buf, buf_len.value)
890
# Convert the bytestring to hexadecimal notation
891
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
892
return hex_fpr
893
894
895
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
896
"""Like socketserver.ForkingMixIn, but also pass a pipe.
897
898
Assumes a gobject.MainLoop event loop.
899
"""
900
def process_request(self, request, client_address):
901
"""Overrides and wraps the original process_request().
902
903
This function creates a new pipe in self.pipe
904
"""
905
self.pipe = os.pipe()
906
super(ForkingMixInWithPipe,
907
self).process_request(request, client_address)
908
os.close(self.pipe[1]) # close write end
909
# Call "handle_ipc" for both data and EOF events
910
gobject.io_add_watch(self.pipe[0],
911
gobject.IO_IN | gobject.IO_HUP,
912
self.handle_ipc)
913
def handle_ipc(source, condition):
914
"""Dummy function; override as necessary"""
915
os.close(source)
916
return False
917
918
919
class IPv6_TCPServer(ForkingMixInWithPipe,
920
socketserver.TCPServer, object):
921
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
922
652
session = (gnutls.connection
653
.ClientSession(self.request,
654
gnutls.connection
655
.X509Credentials()))
656
657
line = self.request.makefile().readline()
658
logger.debug(u"Protocol version: %r", line)
659
try:
660
if int(line.strip().split()[0]) > 1:
661
raise RuntimeError
662
except (ValueError, IndexError, RuntimeError), error:
663
logger.error(u"Unknown protocol version: %s", error)
664
return
665
666
# Note: gnutls.connection.X509Credentials is really a generic
667
# GnuTLS certificate credentials object so long as no X.509
668
# keys are added to it. Therefore, we can use it here despite
669
# using OpenPGP certificates.
670
671
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
672
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
673
# "+DHE-DSS"))
674
# Use a fallback default, since this MUST be set.
675
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
678
priority, None))
679
680
try:
681
session.handshake()
682
except gnutls.errors.GNUTLSError, error:
683
logger.warning(u"Handshake failed: %s", error)
684
# Do not run session.bye() here: the session is not
685
# established. Just abandon the request.
686
return
687
try:
688
fpr = fingerprint(peer_certificate(session))
689
except (TypeError, gnutls.errors.GNUTLSError), error:
690
logger.warning(u"Bad certificate: %s", error)
691
session.bye()
692
return
693
logger.debug(u"Fingerprint: %s", fpr)
694
for c in self.server.clients:
695
if c.fingerprint == fpr:
696
client = c
697
break
698
else:
699
logger.warning(u"Client not found for fingerprint: %s",
700
fpr)
701
session.bye()
702
return
703
# Have to check if client.still_valid(), since it is possible
704
# that the client timed out while establishing the GnuTLS
705
# session.
706
if not client.still_valid():
707
logger.warning(u"Client %(name)s is invalid",
708
vars(client))
709
session.bye()
710
return
711
## This won't work here, since we're in a fork.
712
# client.bump_timeout()
713
sent_size = 0
714
while sent_size < len(client.secret):
715
sent = session.send(client.secret[sent_size:])
716
logger.debug(u"Sent: %d, remaining: %d",
717
sent, len(client.secret)
718
- (sent_size + sent))
719
sent_size += sent
720
session.bye()
721
722
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
724
SocketServer.TCPServer, object):
725
"""IPv6 TCP server. Accepts 'None' as address and/or port.
923
726
Attributes:
727
settings: Server settings
728
clients: Set() of Client objects
924
729
enabled: Boolean; whether this server is activated yet
925
interface: None or a network interface name (string)
926
use_ipv6: Boolean; to use IPv6 or not
927
----
928
clients: set of Client objects
929
gnutls_priority GnuTLS priority string
930
use_dbus: Boolean; to emit D-Bus signals or not
931
730
"""
932
def __init__(self, server_address, RequestHandlerClass,
933
interface=None, use_ipv6=True, clients=None,
934
gnutls_priority=None, use_dbus=True):
731
address_family = socket.AF_INET6
732
def __init__(self, *args, **kwargs):
733
if "settings" in kwargs:
734
self.settings = kwargs["settings"]
735
del kwargs["settings"]
736
if "clients" in kwargs:
737
self.clients = kwargs["clients"]
738
del kwargs["clients"]
935
739
self.enabled = False
936
self.interface = interface
937
if use_ipv6:
938
self.address_family = socket.AF_INET6
939
self.clients = clients
940
self.use_dbus = use_dbus
941
self.gnutls_priority = gnutls_priority
942
socketserver.TCPServer.__init__(self, server_address,
943
RequestHandlerClass)
740
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
944
741
def server_bind(self):
945
742
"""This overrides the normal server_bind() function
946
743
to bind to an interface if one was specified, and also NOT to
947
744
bind to an address or port if they were not specified."""
948
if self.interface is not None:
949
if SO_BINDTODEVICE is None:
950
logger.error(u"SO_BINDTODEVICE does not exist;"
951
u" cannot bind to interface %s",
952
self.interface)
953
else:
954
try:
955
self.socket.setsockopt(socket.SOL_SOCKET,
956
SO_BINDTODEVICE,
957
str(self.interface
958
+ u'\0'))
959
except socket.error, error:
960
if error[0] == errno.EPERM:
961
logger.error(u"No permission to"
962
u" bind to interface %s",
963
self.interface)
964
elif error[0] == errno.ENOPROTOOPT:
965
logger.error(u"SO_BINDTODEVICE not available;"
966
u" cannot bind to interface %s",
967
self.interface)
968
else:
969
raise
745
if self.settings["interface"]:
746
# 25 is from /usr/include/asm-i486/socket.h
747
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
748
try:
749
self.socket.setsockopt(socket.SOL_SOCKET,
750
SO_BINDTODEVICE,
751
self.settings["interface"])
752
except socket.error, error:
753
if error[0] == errno.EPERM:
754
logger.error(u"No permission to"
755
u" bind to interface %s",
756
self.settings["interface"])
757
else:
758
raise error
970
759
# Only bind(2) the socket if we really need to.
971
760
if self.server_address[0] or self.server_address[1]:
972
761
if not self.server_address[0]:
973
if self.address_family == socket.AF_INET6:
974
any_address = u"::" # in6addr_any
975
else:
976
any_address = socket.INADDR_ANY
977
self.server_address = (any_address,
762
in6addr_any = "::"
763
self.server_address = (in6addr_any,
978
764
self.server_address[1])
979
765
elif not self.server_address[1]:
980
766
self.server_address = (self.server_address[0],
981
767
0)
982
# if self.interface:
768
# if self.settings["interface"]:
983
769
# self.server_address = (self.server_address[0],
984
770
# 0, # port
985
771
# 0, # flowinfo
986
772
# if_nametoindex
987
# (self.interface))
988
return socketserver.TCPServer.server_bind(self)
773
# (self.settings
774
# ["interface"]))
775
return super(IPv6_TCPServer, self).server_bind()
989
776
def server_activate(self):
990
777
if self.enabled:
991
return socketserver.TCPServer.server_activate(self)
778
return super(IPv6_TCPServer, self).server_activate()
992
779
def enable(self):
993
780
self.enabled = True
994
def handle_ipc(self, source, condition, file_objects={}):
995
condition_names = {
996
gobject.IO_IN: u"IN", # There is data to read.
997
gobject.IO_OUT: u"OUT", # Data can be written (without
998
# blocking).
999
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1000
gobject.IO_ERR: u"ERR", # Error condition.
1001
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1002
# broken, usually for pipes and
1003
# sockets).
1004
}
1005
conditions_string = ' | '.join(name
1006
for cond, name in
1007
condition_names.iteritems()
1008
if cond & condition)
1009
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1010
conditions_string)
1011
1012
# Turn the pipe file descriptor into a Python file object
1013
if source not in file_objects:
1014
file_objects[source] = os.fdopen(source, u"r", 1)
1015
1016
# Read a line from the file object
1017
cmdline = file_objects[source].readline()
1018
if not cmdline: # Empty line means end of file
1019
# close the IPC pipe
1020
file_objects[source].close()
1021
del file_objects[source]
1022
1023
# Stop calling this function
1024
return False
1025
1026
logger.debug(u"IPC command: %r", cmdline)
1027
1028
# Parse and act on command
1029
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1030
1031
if cmd == u"NOTFOUND":
1032
logger.warning(u"Client not found for fingerprint: %s",
1033
args)
1034
if self.use_dbus:
1035
# Emit D-Bus signal
1036
mandos_dbus_service.ClientNotFound(args)
1037
elif cmd == u"INVALID":
1038
for client in self.clients:
1039
if client.name == args:
1040
logger.warning(u"Client %s is invalid", args)
1041
if self.use_dbus:
1042
# Emit D-Bus signal
1043
client.Rejected()
1044
break
1045
else:
1046
logger.error(u"Unknown client %s is invalid", args)
1047
elif cmd == u"SENDING":
1048
for client in self.clients:
1049
if client.name == args:
1050
logger.info(u"Sending secret to %s", client.name)
1051
client.checked_ok()
1052
if self.use_dbus:
1053
# Emit D-Bus signal
1054
client.ReceivedSecret()
1055
break
1056
else:
1057
logger.error(u"Sending secret to unknown client %s",
1058
args)
1059
else:
1060
logger.error(u"Unknown IPC command: %r", cmdline)
1061
1062
# Keep calling this function
1063
return True
1064
781
1065
782
1066
783
def string_to_delta(interval):
1067
784
"""Parse a string and return a datetime.timedelta
1068
1069
>>> string_to_delta(u'7d')
785
786
>>> string_to_delta('7d')
1070
787
datetime.timedelta(7)
1071
>>> string_to_delta(u'60s')
788
>>> string_to_delta('60s')
1072
789
datetime.timedelta(0, 60)
1073
>>> string_to_delta(u'60m')
790
>>> string_to_delta('60m')
1074
791
datetime.timedelta(0, 3600)
1075
>>> string_to_delta(u'24h')
792
>>> string_to_delta('24h')
1076
793
datetime.timedelta(1)
1077
794
>>> string_to_delta(u'1w')
1078
795
datetime.timedelta(7)
1079
>>> string_to_delta(u'5m 30s')
796
>>> string_to_delta('5m 30s')
1080
797
datetime.timedelta(0, 330)
1081
798
"""
1082
799
timevalue = datetime.timedelta(0)
1102
819
return timevalue
1103
820
1104
821
822
def server_state_changed(state):
823
"""Derived from the Avahi example code"""
824
if state == avahi.SERVER_COLLISION:
825
logger.error(u"Zeroconf server name collision")
826
service.remove()
827
elif state == avahi.SERVER_RUNNING:
828
service.add()
829
830
831
def entry_group_state_changed(state, error):
832
"""Derived from the Avahi example code"""
833
logger.debug(u"Avahi state change: %i", state)
834
835
if state == avahi.ENTRY_GROUP_ESTABLISHED:
836
logger.debug(u"Zeroconf service established.")
837
elif state == avahi.ENTRY_GROUP_COLLISION:
838
logger.warning(u"Zeroconf service name collision.")
839
service.rename()
840
elif state == avahi.ENTRY_GROUP_FAILURE:
841
logger.critical(u"Avahi: Error in group state changed %s",
842
unicode(error))
843
raise AvahiGroupError(u"State changed: %s" % unicode(error))
844
1105
845
def if_nametoindex(interface):
1106
"""Call the C function if_nametoindex(), or equivalent
1107
1108
Note: This function cannot accept a unicode string."""
846
"""Call the C function if_nametoindex(), or equivalent"""
1109
847
global if_nametoindex
1110
848
try:
1111
849
if_nametoindex = (ctypes.cdll.LoadLibrary
1112
(ctypes.util.find_library(u"c"))
850
(ctypes.util.find_library("c"))
1113
851
.if_nametoindex)
1114
852
except (OSError, AttributeError):
1115
logger.warning(u"Doing if_nametoindex the hard way")
853
if "struct" not in sys.modules:
854
import struct
855
if "fcntl" not in sys.modules:
856
import fcntl
1116
857
def if_nametoindex(interface):
1117
858
"Get an interface index the hard way, i.e. using fcntl()"
1118
859
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1119
860
with closing(socket.socket()) as s:
1120
861
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1121
struct.pack(str(u"16s16x"),
1122
interface))
1123
interface_index = struct.unpack(str(u"I"),
1124
ifreq[16:20])[0]
862
struct.pack("16s16x", interface))
863
interface_index = struct.unpack("I", ifreq[16:20])[0]
1125
864
return interface_index
1126
865
return if_nametoindex(interface)
1127
866
1128
867
1129
868
def daemon(nochdir = False, noclose = False):
1130
869
"""See daemon(3). Standard BSD Unix function.
1131
1132
870
This should really exist as os.daemon, but it doesn't (yet)."""
1133
871
if os.fork():
1134
872
sys.exit()
1135
873
os.setsid()
1136
874
if not nochdir:
1137
os.chdir(u"/")
875
os.chdir("/")
1138
876
if os.fork():
1139
877
sys.exit()
1140
878
if not noclose:
1142
880
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1143
881
if not stat.S_ISCHR(os.fstat(null).st_mode):
1144
882
raise OSError(errno.ENODEV,
1145
u"/dev/null not a character device")
883
"/dev/null not a character device")
1146
884
os.dup2(null, sys.stdin.fileno())
1147
885
os.dup2(null, sys.stdout.fileno())
1148
886
os.dup2(null, sys.stderr.fileno())
1151
889
1152
890
1153
891
def main():
1154
1155
######################################################################
1156
# Parsing of options, both command line and config file
1157
1158
892
parser = optparse.OptionParser(version = "%%prog %s" % version)
1159
parser.add_option("-i", u"--interface", type=u"string",
1160
metavar="IF", help=u"Bind to interface IF")
1161
parser.add_option("-a", u"--address", type=u"string",
1162
help=u"Address to listen for requests on")
1163
parser.add_option("-p", u"--port", type=u"int",
1164
help=u"Port number to receive requests on")
1165
parser.add_option("--check", action=u"store_true",
1166
help=u"Run self-test")
1167
parser.add_option("--debug", action=u"store_true",
1168
help=u"Debug mode; run in foreground and log to"
1169
u" terminal")
1170
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1171
u" priority string (see GnuTLS documentation)")
1172
parser.add_option("--servicename", type=u"string",
1173
metavar=u"NAME", help=u"Zeroconf service name")
1174
parser.add_option("--configdir", type=u"string",
1175
default=u"/etc/mandos", metavar=u"DIR",
1176
help=u"Directory to search for configuration"
1177
u" files")
1178
parser.add_option("--no-dbus", action=u"store_false",
1179
dest=u"use_dbus", help=u"Do not provide D-Bus"
1180
u" system bus interface")
1181
parser.add_option("--no-ipv6", action=u"store_false",
1182
dest=u"use_ipv6", help=u"Do not use IPv6")
893
parser.add_option("-i", "--interface", type="string",
894
metavar="IF", help="Bind to interface IF")
895
parser.add_option("-a", "--address", type="string",
896
help="Address to listen for requests on")
897
parser.add_option("-p", "--port", type="int",
898
help="Port number to receive requests on")
899
parser.add_option("--check", action="store_true",
900
help="Run self-test")
901
parser.add_option("--debug", action="store_true",
902
help="Debug mode; run in foreground and log to"
903
" terminal")
904
parser.add_option("--priority", type="string", help="GnuTLS"
905
" priority string (see GnuTLS documentation)")
906
parser.add_option("--servicename", type="string", metavar="NAME",
907
help="Zeroconf service name")
908
parser.add_option("--configdir", type="string",
909
default="/etc/mandos", metavar="DIR",
910
help="Directory to search for configuration"
911
" files")
912
parser.add_option("--no-dbus", action="store_false",
913
dest="use_dbus",
914
help="Do not provide D-Bus system bus"
915
" interface")
1183
916
options = parser.parse_args()[0]
1184
917
1185
918
if options.check:
1188
921
sys.exit()
1189
922
1190
923
# Default values for config file for server-global settings
1191
server_defaults = { u"interface": u"",
1192
u"address": u"",
1193
u"port": u"",
1194
u"debug": u"False",
1195
u"priority":
1196
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1197
u"servicename": u"Mandos",
1198
u"use_dbus": u"True",
1199
u"use_ipv6": u"True",
924
server_defaults = { "interface": "",
925
"address": "",
926
"port": "",
927
"debug": "False",
928
"priority":
929
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
930
"servicename": "Mandos",
931
"use_dbus": "True",
1200
932
}
1201
933
1202
934
# Parse config file for server-global settings
1203
server_config = configparser.SafeConfigParser(server_defaults)
935
server_config = ConfigParser.SafeConfigParser(server_defaults)
1204
936
del server_defaults
1205
server_config.read(os.path.join(options.configdir,
1206
u"mandos.conf"))
937
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1207
938
# Convert the SafeConfigParser object to a dict
1208
939
server_settings = server_config.defaults()
1209
# Use the appropriate methods on the non-string config options
1210
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1211
server_settings[option] = server_config.getboolean(u"DEFAULT",
1212
option)
1213
if server_settings["port"]:
1214
server_settings["port"] = server_config.getint(u"DEFAULT",
1215
u"port")
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
1216
945
del server_config
1217
946
1218
947
# Override the settings from the config file with command line
1219
948
# options, if set.
1220
for option in (u"interface", u"address", u"port", u"debug",
1221
u"priority", u"servicename", u"configdir",
1222
u"use_dbus", u"use_ipv6"):
949
for option in ("interface", "address", "port", "debug",
950
"priority", "servicename", "configdir",
951
"use_dbus"):
1223
952
value = getattr(options, option)
1224
953
if value is not None:
1225
954
server_settings[option] = value
1226
955
del options
1227
# Force all strings to be unicode
1228
for option in server_settings.keys():
1229
if type(server_settings[option]) is str:
1230
server_settings[option] = unicode(server_settings[option])
1231
956
# Now we have our good server settings in "server_settings"
1232
957
1233
##################################################################
1234
1235
958
# For convenience
1236
debug = server_settings[u"debug"]
1237
use_dbus = server_settings[u"use_dbus"]
1238
use_ipv6 = server_settings[u"use_ipv6"]
959
debug = server_settings["debug"]
960
use_dbus = server_settings["use_dbus"]
1239
961
1240
962
if not debug:
1241
963
syslogger.setLevel(logging.WARNING)
1242
964
console.setLevel(logging.WARNING)
1243
965
1244
if server_settings[u"servicename"] != u"Mandos":
966
if server_settings["servicename"] != "Mandos":
1245
967
syslogger.setFormatter(logging.Formatter
1246
(u'Mandos (%s) [%%(process)d]:'
1247
u' %%(levelname)s: %%(message)s'
1248
% server_settings[u"servicename"]))
968
('Mandos (%s): %%(levelname)s:'
969
' %%(message)s'
970
% server_settings["servicename"]))
1249
971
1250
972
# Parse config file with clients
1251
client_defaults = { u"timeout": u"1h",
1252
u"interval": u"5m",
1253
u"checker": u"fping -q -- %%(host)s",
1254
u"host": u"",
973
client_defaults = { "timeout": "1h",
974
"interval": "5m",
975
"checker": "fping -q -- %%(host)s",
976
"host": "",
1255
977
}
1256
client_config = configparser.SafeConfigParser(client_defaults)
1257
client_config.read(os.path.join(server_settings[u"configdir"],
1258
u"clients.conf"))
1259
1260
global mandos_dbus_service
1261
mandos_dbus_service = None
1262
1263
clients = set()
1264
tcp_server = IPv6_TCPServer((server_settings[u"address"],
1265
server_settings[u"port"]),
1266
ClientHandler,
1267
interface=
1268
server_settings[u"interface"],
1269
use_ipv6=use_ipv6,
1270
clients=clients,
1271
gnutls_priority=
1272
server_settings[u"priority"],
1273
use_dbus=use_dbus)
1274
pidfilename = u"/var/run/mandos.pid"
1275
try:
1276
pidfile = open(pidfilename, u"w")
1277
except IOError:
1278
logger.error(u"Could not open file %r", pidfilename)
1279
1280
try:
1281
uid = pwd.getpwnam(u"_mandos").pw_uid
1282
gid = pwd.getpwnam(u"_mandos").pw_gid
978
client_config = ConfigParser.SafeConfigParser(client_defaults)
979
client_config.read(os.path.join(server_settings["configdir"],
980
"clients.conf"))
981
982
clients = Set()
983
tcp_server = IPv6_TCPServer((server_settings["address"],
984
server_settings["port"]),
985
TCP_handler,
986
settings=server_settings,
987
clients=clients)
988
pidfilename = "/var/run/mandos.pid"
989
try:
990
pidfile = open(pidfilename, "w")
991
except IOError, error:
992
logger.error("Could not open file %r", pidfilename)
993
994
try:
995
uid = pwd.getpwnam("_mandos").pw_uid
996
gid = pwd.getpwnam("_mandos").pw_gid
1283
997
except KeyError:
1284
998
try:
1285
uid = pwd.getpwnam(u"mandos").pw_uid
1286
gid = pwd.getpwnam(u"mandos").pw_gid
999
uid = pwd.getpwnam("mandos").pw_uid
1000
gid = pwd.getpwnam("mandos").pw_gid
1287
1001
except KeyError:
1288
1002
try:
1289
uid = pwd.getpwnam(u"nobody").pw_uid
1290
gid = pwd.getpwnam(u"nobody").pw_gid
1003
uid = pwd.getpwnam("nobody").pw_uid
1004
gid = pwd.getpwnam("nogroup").pw_gid
1291
1005
except KeyError:
1292
1006
uid = 65534
1293
1007
gid = 65534
1294
1008
try:
1009
os.setuid(uid)
1295
1010
os.setgid(gid)
1296
os.setuid(uid)
1297
1011
except OSError, error:
1298
1012
if error[0] != errno.EPERM:
1299
1013
raise error
1300
1014
1301
# Enable all possible GnuTLS debugging
1302
if debug:
1303
# "Use a log level over 10 to enable all debugging options."
1304
# - GnuTLS manual
1305
gnutls.library.functions.gnutls_global_set_log_level(11)
1306
1307
@gnutls.library.types.gnutls_log_func
1308
def debug_gnutls(level, string):
1309
logger.debug(u"GnuTLS: %s", string[:-1])
1310
1311
(gnutls.library.functions
1312
.gnutls_global_set_log_function(debug_gnutls))
1015
global service
1016
service = AvahiService(name = server_settings["servicename"],
1017
servicetype = "_mandos._tcp", )
1018
if server_settings["interface"]:
1019
service.interface = (if_nametoindex
1020
(server_settings["interface"]))
1313
1021
1314
1022
global main_loop
1023
global bus
1024
global server
1315
1025
# From the Avahi example code
1316
1026
DBusGMainLoop(set_as_default=True )
1317
1027
main_loop = gobject.MainLoop()
1318
1028
bus = dbus.SystemBus()
1029
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1030
avahi.DBUS_PATH_SERVER),
1031
avahi.DBUS_INTERFACE_SERVER)
1319
1032
# End of Avahi example code
1320
1033
if use_dbus:
1321
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1322
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1323
service = AvahiService(name = server_settings[u"servicename"],
1324
servicetype = u"_mandos._tcp",
1325
protocol = protocol, bus = bus)
1326
if server_settings["interface"]:
1327
service.interface = (if_nametoindex
1328
(str(server_settings[u"interface"])))
1034
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1035
bus)
1329
1036
1330
client_class = Client
1331
if use_dbus:
1332
client_class = functools.partial(ClientDBus, bus = bus)
1333
clients.update(set(
1334
client_class(name = section,
1335
config= dict(client_config.items(section)))
1336
for section in client_config.sections()))
1037
clients.update(Set(Client(name = section,
1038
config
1039
= dict(client_config.items(section)),
1040
use_dbus = use_dbus)
1041
for section in client_config.sections()))
1337
1042
if not clients:
1338
1043
logger.warning(u"No clients defined")
1339
1044
1350
1055
daemon()
1351
1056
1352
1057
try:
1353
with closing(pidfile):
1354
pid = os.getpid()
1355
pidfile.write(str(pid) + "\n")
1058
pid = os.getpid()
1059
pidfile.write(str(pid) + "\n")
1060
pidfile.close()
1356
1061
del pidfile
1357
1062
except IOError:
1358
1063
logger.error(u"Could not write to file %r with PID %d",
1364
1069
1365
1070
def cleanup():
1366
1071
"Cleanup function; run on exit"
1367
service.cleanup()
1072
global group
1073
# From the Avahi example code
1074
if not group is None:
1075
group.Free()
1076
group = None
1077
# End of Avahi example code
1368
1078
1369
1079
while clients:
1370
1080
client = clients.pop()
1379
1089
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1380
1090
1381
1091
if use_dbus:
1382
class MandosDBusService(dbus.service.Object):
1092
class MandosServer(dbus.service.Object):
1383
1093
"""A D-Bus proxy object"""
1384
1094
def __init__(self):
1385
dbus.service.Object.__init__(self, bus, u"/")
1386
_interface = u"se.bsnet.fukt.Mandos"
1387
1388
@dbus.service.signal(_interface, signature=u"oa{sv}")
1095
dbus.service.Object.__init__(self, bus,
1096
"/Mandos")
1097
_interface = u"org.mandos_system.Mandos"
1098
1099
@dbus.service.signal(_interface, signature="oa{sv}")
1389
1100
def ClientAdded(self, objpath, properties):
1390
1101
"D-Bus signal"
1391
1102
pass
1392
1393
@dbus.service.signal(_interface, signature=u"s")
1394
def ClientNotFound(self, fingerprint):
1395
"D-Bus signal"
1396
pass
1397
1398
@dbus.service.signal(_interface, signature=u"os")
1399
def ClientRemoved(self, objpath, name):
1400
"D-Bus signal"
1401
pass
1402
1403
@dbus.service.method(_interface, out_signature=u"ao")
1103
1104
@dbus.service.signal(_interface, signature="o")
1105
def ClientRemoved(self, objpath):
1106
"D-Bus signal"
1107
pass
1108
1109
@dbus.service.method(_interface, out_signature="ao")
1404
1110
def GetAllClients(self):
1405
"D-Bus method"
1406
1111
return dbus.Array(c.dbus_object_path for c in clients)
1407
1408
@dbus.service.method(_interface,
1409
out_signature=u"a{oa{sv}}")
1112
1113
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1410
1114
def GetAllClientsWithProperties(self):
1411
"D-Bus method"
1412
1115
return dbus.Dictionary(
1413
1116
((c.dbus_object_path, c.GetAllProperties())
1414
1117
for c in clients),
1415
signature=u"oa{sv}")
1416
1417
@dbus.service.method(_interface, in_signature=u"o")
1118
signature="oa{sv}")
1119
1120
@dbus.service.method(_interface, in_signature="o")
1418
1121
def RemoveClient(self, object_path):
1419
"D-Bus method"
1420
1122
for c in clients:
1421
1123
if c.dbus_object_path == object_path:
1422
1124
clients.remove(c)
1423
c.remove_from_connection()
1424
1125
# Don't signal anything except ClientRemoved
1425
c.disable(signal=False)
1126
c.use_dbus = False
1127
c.disable()
1426
1128
# Emit D-Bus signal
1427
self.ClientRemoved(object_path, c.name)
1129
self.ClientRemoved(object_path)
1428
1130
return
1429
1131
raise KeyError
1430
1132
@dbus.service.method(_interface)
1133
def Quit(self):
1134
main_loop.quit()
1135
1431
1136
del _interface
1432
1433
mandos_dbus_service = MandosDBusService()
1137
1138
mandos_server = MandosServer()
1434
1139
1435
1140
for client in clients:
1436
1141
if use_dbus:
1437
1142
# Emit D-Bus signal
1438
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1439
client.GetAllProperties())
1143
mandos_server.ClientAdded(client.dbus_object_path,
1144
client.GetAllProperties())
1440
1145
client.enable()
1441
1146
1442
1147
tcp_server.enable()
1444
1149
1445
1150
# Find out what port we got
1446
1151
service.port = tcp_server.socket.getsockname()[1]
1447
if use_ipv6:
1448
logger.info(u"Now listening on address %r, port %d,"
1449
" flowinfo %d, scope_id %d"
1450
% tcp_server.socket.getsockname())
1451
else: # IPv4
1452
logger.info(u"Now listening on address %r, port %d"
1453
% tcp_server.socket.getsockname())
1152
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1153
u" scope_id %d" % tcp_server.socket.getsockname())
1454
1154
1455
1155
#service.interface = tcp_server.socket.getsockname()[3]
1456
1156
1457
1157
try:
1458
1158
# From the Avahi example code
1159
server.connect_to_signal("StateChanged", server_state_changed)
1459
1160
try:
1460
service.activate()
1161
server_state_changed(server.GetState())
1461
1162
except dbus.exceptions.DBusException, error:
1462
1163
logger.critical(u"DBusException: %s", error)
1463
1164
sys.exit(1)
1475
1176
sys.exit(1)
1476
1177
except KeyboardInterrupt:
1477
1178
if debug:
1478
print >> sys.stderr
1479
logger.debug(u"Server received KeyboardInterrupt")
1480
logger.debug(u"Server exiting")
1179
print
1481
1180
1482
1181
if __name__ == '__main__':
1483
1182
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0