/mandos/release : revision 237.2.9

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

16

#

16

17

# This program is free software: you can redistribute it and/or modify

17

18

# it under the terms of the GNU General Public License as published by

30

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

32

#

32

33

from __future__ import division

34

from __future__ import division, with_statement, absolute_import

34

35

36

import SocketServer

36

37

import socket

37

import select

38

from optparse import OptionParser

39

import datetime

40

import errno

56

import logging

57

import logging.handlers

58

import pwd

59

from contextlib import closing

59

60

61

import dbus

62

import dbus.service

61

63

import gobject

62

64

import avahi

63

65

from dbus.mainloop.glib import DBusGMainLoop

64

66

import ctypes

67

import ctypes.util

65

68

66

version = "1.0"

69

version = "1.0.2"

67

70

68

71

logger = logging.Logger('mandos')

69

syslogger = logging.handlers.SysLogHandler\

70

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

71

address = "/dev/log")

72

syslogger.setFormatter(logging.Formatter\

73

('Mandos: %(levelname)s: %(message)s'))

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos: %(levelname)s: %(message)s'))

74

77

logger.addHandler(syslogger)

75

78

76

79

console = logging.StreamHandler()

79

82

logger.addHandler(console)

80

83

81

84

class AvahiError(Exception):

82

def __init__(self, value):

85

def __init__(self, value, *args, **kwargs):

83

86

self.value = value

84

def __str__(self):

85

return repr(self.value)

87

super(AvahiError, self).__init__(value, *args, **kwargs)

88

def __unicode__(self):

89

return unicode(repr(self.value))

86

90

87

91

class AvahiServiceError(AvahiError):

88

92

pass

108

112

a sensible number of times

109

113

"""

110

114

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

111

type = None, port = None, TXT = None, domain = "",

112

host = "", max_renames = 32768):

115

servicetype = None, port = None, TXT = None,

116

domain = "", host = "", max_renames = 32768):

113

117

self.interface = interface

114

118

self.name = name

115

self.type = type

119

self.type = servicetype

116

120

self.port = port

117

if TXT is None:

118

self.TXT = []

119

else:

120

self.TXT = TXT

121

self.TXT = TXT if TXT is not None else []

121

122

self.domain = domain

122

123

self.host = host

123

124

self.rename_count = 0

127

128

if self.rename_count >= self.max_renames:

128

129

logger.critical(u"No suitable Zeroconf service name found"

129

130

u" after %i retries, exiting.",

130

rename_count)

131

raise AvahiServiceError("Too many renames")

131

self.rename_count)

132

raise AvahiServiceError(u"Too many renames")

132

133

self.name = server.GetAlternativeServiceName(self.name)

133

134

logger.info(u"Changing Zeroconf service name to %r ...",

134

135

str(self.name))

135

syslogger.setFormatter(logging.Formatter\

136

syslogger.setFormatter(logging.Formatter

136

137

('Mandos (%s): %%(levelname)s:'

137

' %%(message)s' % self.name))

138

' %%(message)s' % self.name))

138

139

self.remove()

139

140

self.add()

140

141

self.rename_count += 1

146

147

"""Derived from the Avahi example code"""

147

148

global group

148

149

if group is None:

149

group = dbus.Interface\

150

(bus.get_object(avahi.DBUS_NAME,

150

group = dbus.Interface(bus.get_object

151

(avahi.DBUS_NAME,

151

152

server.EntryGroupNew()),

152

avahi.DBUS_INTERFACE_ENTRY_GROUP)

153

avahi.DBUS_INTERFACE_ENTRY_GROUP)

153

154

group.connect_to_signal('StateChanged',

154

155

entry_group_state_changed)

155

156

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

169

170

# End of Avahi example code

170

171

172

class Client(object):

173

def _datetime_to_dbus(dt, variant_level=0):

174

"""Convert a UTC datetime.datetime() to a D-Bus type."""

175

return dbus.String(dt.isoformat(), variant_level=variant_level)

176

177

178

class Client(dbus.service.Object):

173

179

"""A representation of a client host served by this server.

174

180

Attributes:

175

name: string; from the config file, used in log messages

181

name: string; from the config file, used in log messages

176

182

fingerprint: string (40 or 32 hexadecimal digits); used to

177

183

uniquely identify the client

178

secret: bytestring; sent verbatim (over TLS) to client

179

host: string; available for use by the checker command

180

created: datetime.datetime(); object creation, not client host

181

last_checked_ok: datetime.datetime() or None if not yet checked OK

182

timeout: datetime.timedelta(); How long from last_checked_ok

183

until this client is invalid

184

interval: datetime.timedelta(); How often to start a new checker

185

stop_hook: If set, called by stop() as stop_hook(self)

186

checker: subprocess.Popen(); a running checker process used

187

to see if the client lives.

188

'None' if no process is running.

184

secret: bytestring; sent verbatim (over TLS) to client

185

host: string; available for use by the checker command

186

created: datetime.datetime(); (UTC) object creation

187

last_enabled: datetime.datetime(); (UTC)

188

enabled: bool()

189

last_checked_ok: datetime.datetime(); (UTC) or None

190

timeout: datetime.timedelta(); How long from last_checked_ok

191

until this client is invalid

192

interval: datetime.timedelta(); How often to start a new checker

193

disable_hook: If set, called by disable() as disable_hook(self)

194

checker: subprocess.Popen(); a running checker process used

195

to see if the client lives.

196

'None' if no process is running.

189

197

checker_initiator_tag: a gobject event source tag, or None

190

stop_initiator_tag: - '' -

198

disable_initiator_tag: - '' -

191

199

checker_callback_tag: - '' -

192

200

checker_command: string; External command which is run to check if

193

201

client lives. %() expansions are done at

194

202

runtime with vars(self) as dict, so that for

195

203

instance %(name)s can be used in the command.

196

Private attibutes:

197

_timeout: Real variable for 'timeout'

198

_interval: Real variable for 'interval'

199

_timeout_milliseconds: Used when calling gobject.timeout_add()

200

_interval_milliseconds: - '' -

204

use_dbus: bool(); Whether to provide D-Bus interface and signals

205

dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus

201

206

"""

202

def _set_timeout(self, timeout):

203

"Setter function for 'timeout' attribute"

204

self._timeout = timeout

205

self._timeout_milliseconds = ((self.timeout.days

206

* 24 * 60 * 60 * 1000)

207

+ (self.timeout.seconds * 1000)

208

+ (self.timeout.microseconds

209

// 1000))

210

timeout = property(lambda self: self._timeout,

211

_set_timeout)

212

del _set_timeout

213

def _set_interval(self, interval):

214

"Setter function for 'interval' attribute"

215

self._interval = interval

216

self._interval_milliseconds = ((self.interval.days

217

* 24 * 60 * 60 * 1000)

218

+ (self.interval.seconds

219

* 1000)

220

+ (self.interval.microseconds

221

// 1000))

222

interval = property(lambda self: self._interval,

223

_set_interval)

224

del _set_interval

225

def __init__(self, name = None, stop_hook=None, config={}):

207

def timeout_milliseconds(self):

208

"Return the 'timeout' attribute in milliseconds"

209

return ((self.timeout.days * 24 * 60 * 60 * 1000)

210

+ (self.timeout.seconds * 1000)

211

+ (self.timeout.microseconds // 1000))

212

213

def interval_milliseconds(self):

214

"Return the 'interval' attribute in milliseconds"

215

return ((self.interval.days * 24 * 60 * 60 * 1000)

216

+ (self.interval.seconds * 1000)

217

+ (self.interval.microseconds // 1000))

218

219

def __init__(self, name = None, disable_hook=None, config=None,

220

use_dbus=True):

226

221

"""Note: the 'checker' key in 'config' sets the

227

222

'checker_command' attribute and *not* the 'checker'

228

223

attribute."""

229

224

self.name = name

225

if config is None:

226

config = {}

230

227

logger.debug(u"Creating client %r", self.name)

228

self.use_dbus = use_dbus

229

if self.use_dbus:

230

self.dbus_object_path = (dbus.ObjectPath

231

("/Mandos/clients/"

232

+ self.name.replace(".", "_")))

233

dbus.service.Object.__init__(self, bus,

234

self.dbus_object_path)

231

235

# Uppercase and remove spaces from fingerprint for later

232

236

# comparison purposes with return value from the fingerprint()

233

237

# function

234

self.fingerprint = config["fingerprint"].upper()\

235

.replace(u" ", u"")

238

self.fingerprint = (config["fingerprint"].upper()

239

.replace(u" ", u""))

236

240

logger.debug(u" Fingerprint: %s", self.fingerprint)

237

241

if "secret" in config:

238

242

self.secret = config["secret"].decode(u"base64")

239

243

elif "secfile" in config:

240

sf = open(config["secfile"])

241

self.secret = sf.read()

242

sf.close()

244

with closing(open(os.path.expanduser

245

(os.path.expandvars

246

(config["secfile"])))) as secfile:

247

self.secret = secfile.read()

243

248

else:

244

249

raise TypeError(u"No secret or secfile for client %s"

245

250

% self.name)

246

251

self.host = config.get("host", "")

247

self.created = datetime.datetime.now()

252

self.created = datetime.datetime.utcnow()

253

self.enabled = False

254

self.last_enabled = None

248

255

self.last_checked_ok = None

249

256

self.timeout = string_to_delta(config["timeout"])

250

257

self.interval = string_to_delta(config["interval"])

251

self.stop_hook = stop_hook

258

self.disable_hook = disable_hook

252

259

self.checker = None

253

260

self.checker_initiator_tag = None

254

self.stop_initiator_tag = None

261

self.disable_initiator_tag = None

255

262

self.checker_callback_tag = None

256

self.check_command = config["checker"]

257

def start(self):

263

self.checker_command = config["checker"]

264

265

def enable(self):

258

266

"""Start this client's checker and timeout hooks"""

267

self.last_enabled = datetime.datetime.utcnow()

259

268

# Schedule a new checker to be started an 'interval' from now,

260

269

# and every interval from then on.

261

self.checker_initiator_tag = gobject.timeout_add\

262

(self._interval_milliseconds,

263

self.start_checker)

270

self.checker_initiator_tag = (gobject.timeout_add

271

(self.interval_milliseconds(),

272

self.start_checker))

264

273

# Also start a new checker *right now*.

265

274

self.start_checker()

266

# Schedule a stop() when 'timeout' has passed

267

self.stop_initiator_tag = gobject.timeout_add\

268

(self._timeout_milliseconds,

269

self.stop)

270

def stop(self):

271

"""Stop this client.

272

The possibility that a client might be restarted is left open,

273

but not currently used."""

274

# If this client doesn't have a secret, it is already stopped.

275

if hasattr(self, "secret") and self.secret:

276

logger.info(u"Stopping client %s", self.name)

277

self.secret = None

278

else:

275

# Schedule a disable() when 'timeout' has passed

276

self.disable_initiator_tag = (gobject.timeout_add

277

(self.timeout_milliseconds(),

278

self.disable))

279

self.enabled = True

280

if self.use_dbus:

281

# Emit D-Bus signals

282

self.PropertyChanged(dbus.String(u"enabled"),

283

dbus.Boolean(True, variant_level=1))

284

self.PropertyChanged(dbus.String(u"last_enabled"),

285

(_datetime_to_dbus(self.last_enabled,

286

variant_level=1)))

287

288

def disable(self):

289

"""Disable this client."""

290

if not getattr(self, "enabled", False):

279

291

return False

280

if getattr(self, "stop_initiator_tag", False):

281

gobject.source_remove(self.stop_initiator_tag)

282

self.stop_initiator_tag = None

292

logger.info(u"Disabling client %s", self.name)

293

if getattr(self, "disable_initiator_tag", False):

294

gobject.source_remove(self.disable_initiator_tag)

295

self.disable_initiator_tag = None

283

296

if getattr(self, "checker_initiator_tag", False):

284

297

gobject.source_remove(self.checker_initiator_tag)

285

298

self.checker_initiator_tag = None

286

299

self.stop_checker()

287

if self.stop_hook:

288

self.stop_hook(self)

300

if self.disable_hook:

301

self.disable_hook(self)

302

self.enabled = False

303

if self.use_dbus:

304

# Emit D-Bus signal

305

self.PropertyChanged(dbus.String(u"enabled"),

306

dbus.Boolean(False, variant_level=1))

289

307

# Do not run this again if called by a gobject.timeout_add

290

308

return False

309

291

310

def __del__(self):

292

self.stop_hook = None

293

self.stop()

294

def checker_callback(self, pid, condition):

311

self.disable_hook = None

312

self.disable()

313

314

def checker_callback(self, pid, condition, command):

295

315

"""The checker has completed, so take appropriate actions."""

296

now = datetime.datetime.now()

297

316

self.checker_callback_tag = None

298

317

self.checker = None

299

if os.WIFEXITED(condition) \

300

and (os.WEXITSTATUS(condition) == 0):

318

if self.use_dbus:

319

# Emit D-Bus signal

320

self.PropertyChanged(dbus.String(u"checker_running"),

321

dbus.Boolean(False, variant_level=1))

322

if (os.WIFEXITED(condition)

323

and (os.WEXITSTATUS(condition) == 0)):

301

324

logger.info(u"Checker for %(name)s succeeded",

302

325

vars(self))

303

self.last_checked_ok = now

304

gobject.source_remove(self.stop_initiator_tag)

305

self.stop_initiator_tag = gobject.timeout_add\

306

(self._timeout_milliseconds,

307

self.stop)

326

if self.use_dbus:

327

# Emit D-Bus signal

328

self.CheckerCompleted(dbus.Boolean(True),

329

dbus.UInt16(condition),

330

dbus.String(command))

331

self.bump_timeout()

308

332

elif not os.WIFEXITED(condition):

309

333

logger.warning(u"Checker for %(name)s crashed?",

310

334

vars(self))

335

if self.use_dbus:

336

# Emit D-Bus signal

337

self.CheckerCompleted(dbus.Boolean(False),

338

dbus.UInt16(condition),

339

dbus.String(command))

311

340

else:

312

341

logger.info(u"Checker for %(name)s failed",

313

342

vars(self))

343

if self.use_dbus:

344

# Emit D-Bus signal

345

self.CheckerCompleted(dbus.Boolean(False),

346

dbus.UInt16(condition),

347

dbus.String(command))

348

349

def bump_timeout(self):

350

"""Bump up the timeout for this client.

351

This should only be called when the client has been seen,

352

alive and well.

353

"""

354

self.last_checked_ok = datetime.datetime.utcnow()

355

gobject.source_remove(self.disable_initiator_tag)

356

self.disable_initiator_tag = (gobject.timeout_add

357

(self.timeout_milliseconds(),

358

self.disable))

359

if self.use_dbus:

360

# Emit D-Bus signal

361

self.PropertyChanged(

362

dbus.String(u"last_checked_ok"),

363

(_datetime_to_dbus(self.last_checked_ok,

364

variant_level=1)))

365

314

366

def start_checker(self):

315

367

"""Start a new checker subprocess if one is not running.

316

368

If a checker already exists, leave it running and do

325

377

# is as it should be.

326

378

if self.checker is None:

327

379

try:

328

# In case check_command has exactly one % operator

329

command = self.check_command % self.host

380

# In case checker_command has exactly one % operator

381

command = self.checker_command % self.host

330

382

except TypeError:

331

383

# Escape attributes for the shell

332

384

escaped_attrs = dict((key, re.escape(str(val)))

333

385

for key, val in

334

386

vars(self).iteritems())

335

387

try:

336

command = self.check_command % escaped_attrs

388

command = self.checker_command % escaped_attrs

337

389

except TypeError, error:

338

390

logger.error(u'Could not format string "%s":'

339

u' %s', self.check_command, error)

391

u' %s', self.checker_command, error)

340

392

return True # Try again later

341

393

try:

342

394

logger.info(u"Starting checker %r for %s",

348

400

self.checker = subprocess.Popen(command,

349

401

close_fds=True,

350

402

shell=True, cwd="/")

351

self.checker_callback_tag = gobject.child_watch_add\

352

(self.checker.pid,

353

self.checker_callback)

403

if self.use_dbus:

404

# Emit D-Bus signal

405

self.CheckerStarted(command)

406

self.PropertyChanged(

407

dbus.String("checker_running"),

408

dbus.Boolean(True, variant_level=1))

409

self.checker_callback_tag = (gobject.child_watch_add

410

(self.checker.pid,

411

self.checker_callback,

412

data=command))

354

413

except OSError, error:

355

414

logger.error(u"Failed to start subprocess: %s",

356

415

error)

357

416

# Re-run this periodically if run by gobject.timeout_add

358

417

return True

418

359

419

def stop_checker(self):

360

420

"""Force the checker process, if any, to stop."""

361

421

if self.checker_callback_tag:

373

433

if error.errno != errno.ESRCH: # No such process

374

434

raise

375

435

self.checker = None

436

if self.use_dbus:

437

self.PropertyChanged(dbus.String(u"checker_running"),

438

dbus.Boolean(False, variant_level=1))

439

376

440

def still_valid(self):

377

441

"""Has the timeout not yet passed for this client?"""

378

now = datetime.datetime.now()

442

if not getattr(self, "enabled", False):

443

return False

444

now = datetime.datetime.utcnow()

379

445

if self.last_checked_ok is None:

380

446

return now < (self.created + self.timeout)

381

447

else:

382

448

return now < (self.last_checked_ok + self.timeout)

449

450

## D-Bus methods & signals

451

_interface = u"org.mandos_system.Mandos.Client"

452

453

# BumpTimeout - method

454

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

455

BumpTimeout.__name__ = "BumpTimeout"

456

457

# CheckerCompleted - signal

458

@dbus.service.signal(_interface, signature="bqs")

459

def CheckerCompleted(self, success, condition, command):

460

"D-Bus signal"

461

pass

462

463

# CheckerStarted - signal

464

@dbus.service.signal(_interface, signature="s")

465

def CheckerStarted(self, command):

466

"D-Bus signal"

467

pass

468

469

# GetAllProperties - method

470

@dbus.service.method(_interface, out_signature="a{sv}")

471

def GetAllProperties(self):

472

"D-Bus method"

473

return dbus.Dictionary({

474

dbus.String("name"):

475

dbus.String(self.name, variant_level=1),

476

dbus.String("fingerprint"):

477

dbus.String(self.fingerprint, variant_level=1),

478

dbus.String("host"):

479

dbus.String(self.host, variant_level=1),

480

dbus.String("created"):

481

_datetime_to_dbus(self.created, variant_level=1),

482

dbus.String("last_enabled"):

483

(_datetime_to_dbus(self.last_enabled,

484

variant_level=1)

485

if self.last_enabled is not None

486

else dbus.Boolean(False, variant_level=1)),

487

dbus.String("enabled"):

488

dbus.Boolean(self.enabled, variant_level=1),

489

dbus.String("last_checked_ok"):

490

(_datetime_to_dbus(self.last_checked_ok,

491

variant_level=1)

492

if self.last_checked_ok is not None

493

else dbus.Boolean (False, variant_level=1)),

494

dbus.String("timeout"):

495

dbus.UInt64(self.timeout_milliseconds(),

496

variant_level=1),

497

dbus.String("interval"):

498

dbus.UInt64(self.interval_milliseconds(),

499

variant_level=1),

500

dbus.String("checker"):

501

dbus.String(self.checker_command,

502

variant_level=1),

503

dbus.String("checker_running"):

504

dbus.Boolean(self.checker is not None,

505

variant_level=1),

506

}, signature="sv")

507

508

# IsStillValid - method

509

IsStillValid = (dbus.service.method(_interface, out_signature="b")

510

(still_valid))

511

IsStillValid.__name__ = "IsStillValid"

512

513

# PropertyChanged - signal

514

@dbus.service.signal(_interface, signature="sv")

515

def PropertyChanged(self, property, value):

516

"D-Bus signal"

517

pass

518

519

# SetChecker - method

520

@dbus.service.method(_interface, in_signature="s")

521

def SetChecker(self, checker):

522

"D-Bus setter method"

523

self.checker_command = checker

524

# Emit D-Bus signal

525

self.PropertyChanged(dbus.String(u"checker"),

526

dbus.String(self.checker_command,

527

variant_level=1))

528

529

# SetHost - method

530

@dbus.service.method(_interface, in_signature="s")

531

def SetHost(self, host):

532

"D-Bus setter method"

533

self.host = host

534

# Emit D-Bus signal

535

self.PropertyChanged(dbus.String(u"host"),

536

dbus.String(self.host, variant_level=1))

537

538

# SetInterval - method

539

@dbus.service.method(_interface, in_signature="t")

540

def SetInterval(self, milliseconds):

541

self.interval = datetime.timedelta(0, 0, 0, milliseconds)

542

# Emit D-Bus signal

543

self.PropertyChanged(dbus.String(u"interval"),

544

(dbus.UInt64(self.interval_milliseconds(),

545

variant_level=1)))

546

547

# SetSecret - method

548

@dbus.service.method(_interface, in_signature="ay",

549

byte_arrays=True)

550

def SetSecret(self, secret):

551

"D-Bus setter method"

552

self.secret = str(secret)

553

554

# SetTimeout - method

555

@dbus.service.method(_interface, in_signature="t")

556

def SetTimeout(self, milliseconds):

557

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

558

# Emit D-Bus signal

559

self.PropertyChanged(dbus.String(u"timeout"),

560

(dbus.UInt64(self.timeout_milliseconds(),

561

variant_level=1)))

562

563

# Enable - method

564

Enable = dbus.service.method(_interface)(enable)

565

Enable.__name__ = "Enable"

566

567

# StartChecker - method

568

@dbus.service.method(_interface)

569

def StartChecker(self):

570

"D-Bus method"

571

self.start_checker()

572

573

# Disable - method

574

@dbus.service.method(_interface)

575

def Disable(self):

576

"D-Bus method"

577

self.disable()

578

579

# StopChecker - method

580

StopChecker = dbus.service.method(_interface)(stop_checker)

581

StopChecker.__name__ = "StopChecker"

582

583

del _interface

383

584

384

585

385

586

def peer_certificate(session):

386

587

"Return the peer's OpenPGP certificate as a bytestring"

387

588

# If not an OpenPGP certificate...

388

if gnutls.library.functions.gnutls_certificate_type_get\

389

(session._c_object) \

390

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

589

if (gnutls.library.functions

590

.gnutls_certificate_type_get(session._c_object)

591

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

391

592

# ...do the normal thing

392

593

return session.peer_certificate

393

594

list_size = ctypes.c_uint()

394

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

395

(session._c_object, ctypes.byref(list_size))

595

cert_list = (gnutls.library.functions

596

.gnutls_certificate_get_peers

597

(session._c_object, ctypes.byref(list_size)))

396

598

if list_size.value == 0:

397

599

return None

398

600

cert = cert_list[0]

402

604

def fingerprint(openpgp):

403

605

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

404

606

# New GnuTLS "datum" with the OpenPGP public key

405

datum = gnutls.library.types.gnutls_datum_t\

406

(ctypes.cast(ctypes.c_char_p(openpgp),

407

ctypes.POINTER(ctypes.c_ubyte)),

408

ctypes.c_uint(len(openpgp)))

607

datum = (gnutls.library.types

608

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

609

ctypes.POINTER

610

(ctypes.c_ubyte)),

611

ctypes.c_uint(len(openpgp))))

409

612

# New empty GnuTLS certificate

410

613

crt = gnutls.library.types.gnutls_openpgp_crt_t()

411

gnutls.library.functions.gnutls_openpgp_crt_init\

412

(ctypes.byref(crt))

614

(gnutls.library.functions

615

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

413

616

# Import the OpenPGP public key into the certificate

414

gnutls.library.functions.gnutls_openpgp_crt_import\

415

(crt, ctypes.byref(datum),

416

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

617

(gnutls.library.functions

618

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

619

gnutls.library.constants

620

.GNUTLS_OPENPGP_FMT_RAW))

417

621

# Verify the self signature in the key

418

crtverify = ctypes.c_uint();

419

gnutls.library.functions.gnutls_openpgp_crt_verify_self\

420

(crt, 0, ctypes.byref(crtverify))

622

crtverify = ctypes.c_uint()

623

(gnutls.library.functions

624

.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))

421

625

if crtverify.value != 0:

422

626

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

423

627

raise gnutls.errors.CertificateSecurityError("Verify failed")

424

628

# New buffer for the fingerprint

425

buffer = ctypes.create_string_buffer(20)

426

buffer_length = ctypes.c_size_t()

629

buf = ctypes.create_string_buffer(20)

630

buf_len = ctypes.c_size_t()

427

631

# Get the fingerprint from the certificate into the buffer

428

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

429

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

632

(gnutls.library.functions

633

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

634

ctypes.byref(buf_len)))

430

635

# Deinit the certificate

431

636

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

432

637

# Convert the buffer to a Python bytestring

433

fpr = ctypes.string_at(buffer, buffer_length.value)

638

fpr = ctypes.string_at(buf, buf_len.value)

434

639

# Convert the bytestring to hexadecimal notation

435

640

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

436

641

return hex_fpr

437

642

438

643

439

class tcp_handler(SocketServer.BaseRequestHandler, object):

644

class TCP_handler(SocketServer.BaseRequestHandler, object):

440

645

"""A TCP request handler class.

441

646

Instantiated by IPv6_TCPServer for each request to handle it.

442

647

Note: This will run in its own forked process."""

443

648

444

649

def handle(self):

445

650

logger.info(u"TCP connection from: %s",

446

unicode(self.client_address))

447

session = gnutls.connection.ClientSession\

448

(self.request, gnutls.connection.X509Credentials())

651

unicode(self.client_address))

652

session = (gnutls.connection

653

.ClientSession(self.request,

654

gnutls.connection

655

.X509Credentials()))

449

656

450

657

line = self.request.makefile().readline()

451

658

logger.debug(u"Protocol version: %r", line)

464

671

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

465

672

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

466

673

# "+DHE-DSS"))

467

priority = "NORMAL" # Fallback default, since this

468

# MUST be set.

469

if self.server.settings["priority"]:

470

priority = self.server.settings["priority"]

471

gnutls.library.functions.gnutls_priority_set_direct\

472

(session._c_object, priority, None);

674

# Use a fallback default, since this MUST be set.

675

priority = self.server.settings.get("priority", "NORMAL")

676

(gnutls.library.functions

677

.gnutls_priority_set_direct(session._c_object,

678

priority, None))

473

679

474

680

try:

475

681

session.handshake()

485

691

session.bye()

486

692

return

487

693

logger.debug(u"Fingerprint: %s", fpr)

488

client = None

489

694

for c in self.server.clients:

490

695

if c.fingerprint == fpr:

491

696

client = c

492

697

break

493

if not client:

698

else:

494

699

logger.warning(u"Client not found for fingerprint: %s",

495

700

fpr)

496

701

session.bye()

503

708

vars(client))

504

709

session.bye()

505

710

return

711

## This won't work here, since we're in a fork.

712

# client.bump_timeout()

506

713

sent_size = 0

507

714

while sent_size < len(client.secret):

508

715

sent = session.send(client.secret[sent_size:])

513

720

session.bye()

514

721

515

722

516

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

723

class IPv6_TCPServer(SocketServer.ForkingMixIn,

724

SocketServer.TCPServer, object):

517

725

"""IPv6 TCP server. Accepts 'None' as address and/or port.

518

726

Attributes:

519

727

settings: Server settings

529

737

self.clients = kwargs["clients"]

530

738

del kwargs["clients"]

531

739

self.enabled = False

532

return super(type(self), self).__init__(*args, **kwargs)

740

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

533

741

def server_bind(self):

534

742

"""This overrides the normal server_bind() function

535

743

to bind to an interface if one was specified, and also NOT to

564

772

# if_nametoindex

565

773

# (self.settings

566

774

# ["interface"]))

567

return super(type(self), self).server_bind()

775

return super(IPv6_TCPServer, self).server_bind()

568

776

def server_activate(self):

569

777

if self.enabled:

570

return super(type(self), self).server_activate()

778

return super(IPv6_TCPServer, self).server_activate()

571

779

def enable(self):

572

780

self.enabled = True

573

781

591

799

timevalue = datetime.timedelta(0)

592

800

for s in interval.split():

593

801

try:

594

suffix=unicode(s[-1])

595

value=int(s[:-1])

802

suffix = unicode(s[-1])

803

value = int(s[:-1])

596

804

if suffix == u"d":

597

805

delta = datetime.timedelta(value)

598

806

elif suffix == u"s":

632

840

elif state == avahi.ENTRY_GROUP_FAILURE:

633

841

logger.critical(u"Avahi: Error in group state changed %s",

634

842

unicode(error))

635

raise AvahiGroupError("State changed: %s", str(error))

843

raise AvahiGroupError(u"State changed: %s" % unicode(error))

636

844

637

845

def if_nametoindex(interface):

638

846

"""Call the C function if_nametoindex(), or equivalent"""

639

847

global if_nametoindex

640

848

try:

641

if "ctypes.util" not in sys.modules:

642

import ctypes.util

643

if_nametoindex = ctypes.cdll.LoadLibrary\

644

(ctypes.util.find_library("c")).if_nametoindex

849

if_nametoindex = (ctypes.cdll.LoadLibrary

850

(ctypes.util.find_library("c"))

851

.if_nametoindex)

645

852

except (OSError, AttributeError):

646

853

if "struct" not in sys.modules:

647

854

import struct

650

857

def if_nametoindex(interface):

651

858

"Get an interface index the hard way, i.e. using fcntl()"

652

859

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

653

s = socket.socket()

654

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

655

struct.pack("16s16x", interface))

656

s.close()

860

with closing(socket.socket()) as s:

861

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

862

struct.pack("16s16x", interface))

657

863

interface_index = struct.unpack("I", ifreq[16:20])[0]

658

864

return interface_index

659

865

return if_nametoindex(interface)

683

889

684

890

685

891

def main():

686

global main_loop_started

687

main_loop_started = False

688

689

892

parser = OptionParser(version = "%%prog %s" % version)

690

893

parser.add_option("-i", "--interface", type="string",

691

894

metavar="IF", help="Bind to interface IF")

693

896

help="Address to listen for requests on")

694

897

parser.add_option("-p", "--port", type="int",

695

898

help="Port number to receive requests on")

696

parser.add_option("--check", action="store_true", default=False,

899

parser.add_option("--check", action="store_true",

697

900

help="Run self-test")

698

901

parser.add_option("--debug", action="store_true",

699

902

help="Debug mode; run in foreground and log to"

706

909

default="/etc/mandos", metavar="DIR",

707

910

help="Directory to search for configuration"

708

911

" files")

709

(options, args) = parser.parse_args()

912

parser.add_option("--no-dbus", action="store_false",

913

dest="use_dbus",

914

help="Do not provide D-Bus system bus"

915

" interface")

916

options = parser.parse_args()[0]

710

917

711

918

if options.check:

712

919

import doctest

721

928

"priority":

722

929

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

723

930

"servicename": "Mandos",

931

"use_dbus": "True",

724

932

}

725

933

726

934

# Parse config file for server-global settings

729

937

server_config.read(os.path.join(options.configdir, "mandos.conf"))

730

938

# Convert the SafeConfigParser object to a dict

731

939

server_settings = server_config.defaults()

732

# Use getboolean on the boolean config option

733

server_settings["debug"] = server_config.getboolean\

734

("DEFAULT", "debug")

940

# Use getboolean on the boolean config options

941

server_settings["debug"] = (server_config.getboolean

942

("DEFAULT", "debug"))

943

server_settings["use_dbus"] = (server_config.getboolean

944

("DEFAULT", "use_dbus"))

735

945

del server_config

736

946

737

947

# Override the settings from the config file with command line

738

948

# options, if set.

739

949

for option in ("interface", "address", "port", "debug",

740

"priority", "servicename", "configdir"):

950

"priority", "servicename", "configdir",

951

"use_dbus"):

741

952

value = getattr(options, option)

742

953

if value is not None:

743

954

server_settings[option] = value

744

955

del options

745

956

# Now we have our good server settings in "server_settings"

746

957

958

# For convenience

747

959

debug = server_settings["debug"]

960

use_dbus = server_settings["use_dbus"]

748

961

749

962

if not debug:

750

963

syslogger.setLevel(logging.WARNING)

751

964

console.setLevel(logging.WARNING)

752

965

753

966

if server_settings["servicename"] != "Mandos":

754

syslogger.setFormatter(logging.Formatter\

967

syslogger.setFormatter(logging.Formatter

755

968

('Mandos (%s): %%(levelname)s:'

756

969

' %%(message)s'

757

970

% server_settings["servicename"]))

769

982

clients = Set()

770

983

tcp_server = IPv6_TCPServer((server_settings["address"],

771

984

server_settings["port"]),

772

tcp_handler,

985

TCP_handler,

773

986

settings=server_settings,

774

987

clients=clients)

775

988

pidfilename = "/var/run/mandos.pid"

778

991

except IOError, error:

779

992

logger.error("Could not open file %r", pidfilename)

780

993

781

uid = 65534

782

gid = 65534

783

try:

784

uid = pwd.getpwnam("mandos").pw_uid

785

except KeyError:

786

try:

787

uid = pwd.getpwnam("nobody").pw_uid

788

except KeyError:

789

pass

790

try:

791

gid = pwd.getpwnam("mandos").pw_gid

792

except KeyError:

793

try:

794

gid = pwd.getpwnam("nogroup").pw_gid

795

except KeyError:

796

pass

994

try:

995

uid = pwd.getpwnam("_mandos").pw_uid

996

except KeyError:

997

try:

998

uid = pwd.getpwnam("mandos").pw_uid

999

except KeyError:

1000

try:

1001

uid = pwd.getpwnam("nobody").pw_uid

1002

except KeyError:

1003

uid = 65534

1004

try:

1005

gid = pwd.getpwnam("_mandos").pw_gid

1006

except KeyError:

1007

try:

1008

gid = pwd.getpwnam("mandos").pw_gid

1009

except KeyError:

1010

try:

1011

gid = pwd.getpwnam("nogroup").pw_gid

1012

except KeyError:

1013

gid = 65534

797

1014

try:

798

1015

os.setuid(uid)

799

1016

os.setgid(gid)

803

1020

804

1021

global service

805

1022

service = AvahiService(name = server_settings["servicename"],

806

type = "_mandos._tcp", );

1023

servicetype = "_mandos._tcp", )

807

1024

if server_settings["interface"]:

808

service.interface = if_nametoindex\

809

(server_settings["interface"])

1025

service.interface = (if_nametoindex

1026

(server_settings["interface"]))

810

1027

811

1028

global main_loop

812

1029

global bus

819

1036

avahi.DBUS_PATH_SERVER),

820

1037

avahi.DBUS_INTERFACE_SERVER)

821

1038

# End of Avahi example code

822

823

def remove_from_clients(client):

824

clients.remove(client)

825

if not clients:

826

logger.critical(u"No clients left, exiting")

827

sys.exit()

1039

if use_dbus:

1040

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",

1041

bus)

828

1042

829

1043

clients.update(Set(Client(name = section,

830

stop_hook = remove_from_clients,

831

1044

config

832

= dict(client_config.items(section)))

1045

= dict(client_config.items(section)),

1046

use_dbus = use_dbus)

833

1047

for section in client_config.sections()))

834

1048

if not clients:

835

logger.critical(u"No clients defined")

836

sys.exit(1)

1049

logger.warning(u"No clients defined")

837

1050

838

1051

if debug:

839

1052

# Redirect stdin so all checkers get /dev/null

852

1065

pidfile.write(str(pid) + "\n")

853

1066

pidfile.close()

854

1067

del pidfile

855

except IOError, err:

1068

except IOError:

856

1069

logger.error(u"Could not write to file %r with PID %d",

857

1070

pidfilename, pid)

858

1071

except NameError:

871

1084

872

1085

while clients:

873

1086

client = clients.pop()

874

client.stop_hook = None

875

client.stop()

1087

client.disable_hook = None

1088

client.disable()

876

1089

877

1090

atexit.register(cleanup)

878

1091

881

1094

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

882

1095

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

883

1096

1097

if use_dbus:

1098

class MandosServer(dbus.service.Object):

1099

"""A D-Bus proxy object"""

1100

def __init__(self):

1101

dbus.service.Object.__init__(self, bus,

1102

"/Mandos")

1103

_interface = u"org.mandos_system.Mandos"

1104

1105

@dbus.service.signal(_interface, signature="oa{sv}")

1106

def ClientAdded(self, objpath, properties):

1107

"D-Bus signal"

1108

pass

1109

1110

@dbus.service.signal(_interface, signature="o")

1111

def ClientRemoved(self, objpath):

1112

"D-Bus signal"

1113

pass

1114

1115

@dbus.service.method(_interface, out_signature="ao")

1116

def GetAllClients(self):

1117

return dbus.Array(c.dbus_object_path for c in clients)

1118

1119

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1120

def GetAllClientsWithProperties(self):

1121

return dbus.Dictionary(

1122

((c.dbus_object_path, c.GetAllProperties())

1123

for c in clients),

1124

signature="oa{sv}")

1125

1126

@dbus.service.method(_interface, in_signature="o")

1127

def RemoveClient(self, object_path):

1128

for c in clients:

1129

if c.dbus_object_path == object_path:

1130

clients.remove(c)

1131

# Don't signal anything except ClientRemoved

1132

c.use_dbus = False

1133

c.disable()

1134

# Emit D-Bus signal

1135

self.ClientRemoved(object_path)

1136

return

1137

raise KeyError

1138

@dbus.service.method(_interface)

1139

def Quit(self):

1140

main_loop.quit()

1141

1142

del _interface

1143

1144

mandos_server = MandosServer()

1145

884

1146

for client in clients:

885

client.start()

1147

if use_dbus:

1148

# Emit D-Bus signal

1149

mandos_server.ClientAdded(client.dbus_object_path,

1150

client.GetAllProperties())

1151

client.enable()

886

1152

887

1153

tcp_server.enable()

888

1154

tcp_server.server_activate()

906

1172

907

1173

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

908

1174

lambda *args, **kwargs:

909

tcp_server.handle_request\

910

(*args[2:], **kwargs) or True)

1175

(tcp_server.handle_request

1176

(*args[2:], **kwargs) or True))

911

1177

912

1178

logger.debug(u"Starting main loop")

913

main_loop_started = True

914

1179

main_loop.run()

915

1180

except AvahiError, error:

916

logger.critical(u"AvahiError: %s" + unicode(error))

1181

logger.critical(u"AvahiError: %s", error)

917

1182

sys.exit(1)

918

1183

except KeyboardInterrupt:

919

1184

if debug: