/mandos/release : revision 24.1.114

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

16

#

16

17

# This program is free software: you can redistribute it and/or modify

17

18

# it under the terms of the GNU General Public License as published by

30

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

32

#

32

33

from __future__ import division

34

from __future__ import division, with_statement, absolute_import

34

35

36

import SocketServer

36

37

import socket

37

import select

38

from optparse import OptionParser

39

import datetime

40

import errno

55

import stat

56

import logging

57

import logging.handlers

58

import pwd

59

from contextlib import closing

58

60

59

61

import dbus

62

import dbus.service

60

63

import gobject

61

64

import avahi

62

65

from dbus.mainloop.glib import DBusGMainLoop

63

66

import ctypes

67

import ctypes.util

64

68

65

version = "1.0"

69

version = "1.0.2"

66

70

67

71

logger = logging.Logger('mandos')

68

syslogger = logging.handlers.SysLogHandler\

69

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

70

address = "/dev/log")

71

syslogger.setFormatter(logging.Formatter\

72

('Mandos: %(levelname)s: %(message)s'))

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos: %(levelname)s: %(message)s'))

73

77

logger.addHandler(syslogger)

74

78

75

79

console = logging.StreamHandler()

80

84

class AvahiError(Exception):

81

85

def __init__(self, value):

82

86

self.value = value

87

super(AvahiError, self).__init__()

83

88

def __str__(self):

84

89

return repr(self.value)

85

90

107

112

a sensible number of times

108

113

"""

109

114

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

110

type = None, port = None, TXT = None, domain = "",

111

host = "", max_renames = 32768):

115

servicetype = None, port = None, TXT = None,

116

domain = "", host = "", max_renames = 32768):

112

117

self.interface = interface

113

118

self.name = name

114

self.type = type

119

self.type = servicetype

115

120

self.port = port

116

if TXT is None:

117

self.TXT = []

118

else:

119

self.TXT = TXT

121

self.TXT = TXT if TXT is not None else []

120

122

self.domain = domain

121

123

self.host = host

122

124

self.rename_count = 0

126

128

if self.rename_count >= self.max_renames:

127

129

logger.critical(u"No suitable Zeroconf service name found"

128

130

u" after %i retries, exiting.",

129

rename_count)

131

self.rename_count)

130

132

raise AvahiServiceError("Too many renames")

131

133

self.name = server.GetAlternativeServiceName(self.name)

132

134

logger.info(u"Changing Zeroconf service name to %r ...",

133

135

str(self.name))

134

syslogger.setFormatter(logging.Formatter\

136

syslogger.setFormatter(logging.Formatter

135

137

('Mandos (%s): %%(levelname)s:'

136

' %%(message)s' % self.name))

138

' %%(message)s' % self.name))

137

139

self.remove()

138

140

self.add()

139

141

self.rename_count += 1

145

147

"""Derived from the Avahi example code"""

146

148

global group

147

149

if group is None:

148

group = dbus.Interface\

149

(bus.get_object(avahi.DBUS_NAME,

150

group = dbus.Interface(bus.get_object

151

(avahi.DBUS_NAME,

150

152

server.EntryGroupNew()),

151

avahi.DBUS_INTERFACE_ENTRY_GROUP)

153

avahi.DBUS_INTERFACE_ENTRY_GROUP)

152

154

group.connect_to_signal('StateChanged',

153

155

entry_group_state_changed)

154

156

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

168

170

# End of Avahi example code

169

171

170

172

171

class Client(object):

173

def _datetime_to_dbus_struct(dt, variant_level=0):

174

"""Convert a UTC datetime.datetime() to a D-Bus struct.

175

The format is special to this application, since we could not find

176

any other standard way."""

177

return dbus.Struct((dbus.Int16(dt.year),

178

dbus.Byte(dt.month),

179

dbus.Byte(dt.day),

180

dbus.Byte(dt.hour),

181

dbus.Byte(dt.minute),

182

dbus.Byte(dt.second),

183

dbus.UInt32(dt.microsecond)),

184

signature="nyyyyyu",

185

variant_level=variant_level)

186

187

188

class Client(dbus.service.Object):

172

189

"""A representation of a client host served by this server.

173

190

Attributes:

174

name: string; from the config file, used in log messages

191

name: string; from the config file, used in log messages

175

192

fingerprint: string (40 or 32 hexadecimal digits); used to

176

193

uniquely identify the client

177

secret: bytestring; sent verbatim (over TLS) to client

178

host: string; available for use by the checker command

179

created: datetime.datetime(); object creation, not client host

180

last_checked_ok: datetime.datetime() or None if not yet checked OK

181

timeout: datetime.timedelta(); How long from last_checked_ok

182

until this client is invalid

183

interval: datetime.timedelta(); How often to start a new checker

184

stop_hook: If set, called by stop() as stop_hook(self)

185

checker: subprocess.Popen(); a running checker process used

186

to see if the client lives.

187

'None' if no process is running.

194

secret: bytestring; sent verbatim (over TLS) to client

195

host: string; available for use by the checker command

196

created: datetime.datetime(); (UTC) object creation

197

last_started: datetime.datetime(); (UTC)

198

started: bool()

199

last_checked_ok: datetime.datetime(); (UTC) or None

200

timeout: datetime.timedelta(); How long from last_checked_ok

201

until this client is invalid

202

interval: datetime.timedelta(); How often to start a new checker

203

stop_hook: If set, called by stop() as stop_hook(self)

204

checker: subprocess.Popen(); a running checker process used

205

to see if the client lives.

206

'None' if no process is running.

188

207

checker_initiator_tag: a gobject event source tag, or None

189

208

stop_initiator_tag: - '' -

190

209

checker_callback_tag: - '' -

192

211

client lives. %() expansions are done at

193

212

runtime with vars(self) as dict, so that for

194

213

instance %(name)s can be used in the command.

214

dbus_object_path: dbus.ObjectPath

195

215

Private attibutes:

196

216

_timeout: Real variable for 'timeout'

197

217

_interval: Real variable for 'interval'

199

219

_interval_milliseconds: - '' -

200

220

"""

201

221

def _set_timeout(self, timeout):

202

"Setter function for 'timeout' attribute"

222

"Setter function for the 'timeout' attribute"

203

223

self._timeout = timeout

204

224

self._timeout_milliseconds = ((self.timeout.days

205

225

* 24 * 60 * 60 * 1000)

206

226

+ (self.timeout.seconds * 1000)

207

227

+ (self.timeout.microseconds

208

228

// 1000))

209

timeout = property(lambda self: self._timeout,

210

_set_timeout)

229

# Emit D-Bus signal

230

self.PropertyChanged(dbus.String(u"timeout"),

231

(dbus.UInt64(self._timeout_milliseconds,

232

variant_level=1)))

233

timeout = property(lambda self: self._timeout, _set_timeout)

211

234

del _set_timeout

235

212

236

def _set_interval(self, interval):

213

"Setter function for 'interval' attribute"

237

"Setter function for the 'interval' attribute"

214

238

self._interval = interval

215

239

self._interval_milliseconds = ((self.interval.days

216

240

* 24 * 60 * 60 * 1000)

218

242

* 1000)

219

243

+ (self.interval.microseconds

220

244

// 1000))

221

interval = property(lambda self: self._interval,

222

_set_interval)

245

# Emit D-Bus signal

246

self.PropertyChanged(dbus.String(u"interval"),

247

(dbus.UInt64(self._interval_milliseconds,

248

variant_level=1)))

249

interval = property(lambda self: self._interval, _set_interval)

223

250

del _set_interval

224

def __init__(self, name = None, stop_hook=None, config={}):

251

252

def __init__(self, name = None, stop_hook=None, config=None):

225

253

"""Note: the 'checker' key in 'config' sets the

226

254

'checker_command' attribute and *not* the 'checker'

227

255

attribute."""

256

self.dbus_object_path = (dbus.ObjectPath

257

("/Mandos/clients/"

258

+ name.replace(".", "_")))

259

dbus.service.Object.__init__(self, bus,

260

self.dbus_object_path)

261

if config is None:

262

config = {}

228

263

self.name = name

229

264

logger.debug(u"Creating client %r", self.name)

230

265

# Uppercase and remove spaces from fingerprint for later

231

266

# comparison purposes with return value from the fingerprint()

232

267

# function

233

self.fingerprint = config["fingerprint"].upper()\

234

.replace(u" ", u"")

268

self.fingerprint = (config["fingerprint"].upper()

269

.replace(u" ", u""))

235

270

logger.debug(u" Fingerprint: %s", self.fingerprint)

236

271

if "secret" in config:

237

272

self.secret = config["secret"].decode(u"base64")

238

273

elif "secfile" in config:

239

sf = open(config["secfile"])

240

self.secret = sf.read()

241

sf.close()

274

with closing(open(os.path.expanduser

275

(os.path.expandvars

276

(config["secfile"])))) as secfile:

277

self.secret = secfile.read()

242

278

else:

243

279

raise TypeError(u"No secret or secfile for client %s"

244

280

% self.name)

245

281

self.host = config.get("host", "")

246

self.created = datetime.datetime.now()

282

self.created = datetime.datetime.utcnow()

283

self.started = False

284

self.last_started = None

247

285

self.last_checked_ok = None

248

286

self.timeout = string_to_delta(config["timeout"])

249

287

self.interval = string_to_delta(config["interval"])

252

290

self.checker_initiator_tag = None

253

291

self.stop_initiator_tag = None

254

292

self.checker_callback_tag = None

255

self.check_command = config["checker"]

293

self.checker_command = config["checker"]

294

256

295

def start(self):

257

296

"""Start this client's checker and timeout hooks"""

297

self.last_started = datetime.datetime.utcnow()

258

298

# Schedule a new checker to be started an 'interval' from now,

259

299

# and every interval from then on.

260

self.checker_initiator_tag = gobject.timeout_add\

261

(self._interval_milliseconds,

262

self.start_checker)

300

self.checker_initiator_tag = (gobject.timeout_add

301

(self._interval_milliseconds,

302

self.start_checker))

263

303

# Also start a new checker *right now*.

264

304

self.start_checker()

265

305

# Schedule a stop() when 'timeout' has passed

266

self.stop_initiator_tag = gobject.timeout_add\

267

(self._timeout_milliseconds,

268

self.stop)

306

self.stop_initiator_tag = (gobject.timeout_add

307

(self._timeout_milliseconds,

308

self.stop))

309

self.started = True

310

# Emit D-Bus signal

311

self.PropertyChanged(dbus.String(u"started"),

312

dbus.Boolean(True, variant_level=1))

313

self.PropertyChanged(dbus.String(u"last_started"),

314

(_datetime_to_dbus_struct

315

(self.last_started, variant_level=1)))

316

269

317

def stop(self):

270

"""Stop this client.

271

The possibility that a client might be restarted is left open,

272

but not currently used."""

273

# If this client doesn't have a secret, it is already stopped.

274

if hasattr(self, "secret") and self.secret:

275

logger.info(u"Stopping client %s", self.name)

276

self.secret = None

277

else:

318

"""Stop this client."""

319

if not getattr(self, "started", False):

278

320

return False

321

logger.info(u"Stopping client %s", self.name)

279

322

if getattr(self, "stop_initiator_tag", False):

280

323

gobject.source_remove(self.stop_initiator_tag)

281

324

self.stop_initiator_tag = None

285

328

self.stop_checker()

286

329

if self.stop_hook:

287

330

self.stop_hook(self)

331

self.started = False

332

# Emit D-Bus signal

333

self.PropertyChanged(dbus.String(u"started"),

334

dbus.Boolean(False, variant_level=1))

288

335

# Do not run this again if called by a gobject.timeout_add

289

336

return False

337

290

338

def __del__(self):

291

339

self.stop_hook = None

292

340

self.stop()

293

def checker_callback(self, pid, condition):

341

342

def checker_callback(self, pid, condition, command):

294

343

"""The checker has completed, so take appropriate actions."""

295

now = datetime.datetime.now()

296

344

self.checker_callback_tag = None

297

345

self.checker = None

298

if os.WIFEXITED(condition) \

299

and (os.WEXITSTATUS(condition) == 0):

346

# Emit D-Bus signal

347

self.PropertyChanged(dbus.String(u"checker_running"),

348

dbus.Boolean(False, variant_level=1))

349

if (os.WIFEXITED(condition)

350

and (os.WEXITSTATUS(condition) == 0)):

300

351

logger.info(u"Checker for %(name)s succeeded",

301

352

vars(self))

302

self.last_checked_ok = now

303

gobject.source_remove(self.stop_initiator_tag)

304

self.stop_initiator_tag = gobject.timeout_add\

305

(self._timeout_milliseconds,

306

self.stop)

353

# Emit D-Bus signal

354

self.CheckerCompleted(dbus.Boolean(True),

355

dbus.UInt16(condition),

356

dbus.String(command))

357

self.bump_timeout()

307

358

elif not os.WIFEXITED(condition):

308

359

logger.warning(u"Checker for %(name)s crashed?",

309

360

vars(self))

361

# Emit D-Bus signal

362

self.CheckerCompleted(dbus.Boolean(False),

363

dbus.UInt16(condition),

364

dbus.String(command))

310

365

else:

311

366

logger.info(u"Checker for %(name)s failed",

312

367

vars(self))

368

# Emit D-Bus signal

369

self.CheckerCompleted(dbus.Boolean(False),

370

dbus.UInt16(condition),

371

dbus.String(command))

372

373

def bump_timeout(self):

374

"""Bump up the timeout for this client.

375

This should only be called when the client has been seen,

376

alive and well.

377

"""

378

self.last_checked_ok = datetime.datetime.utcnow()

379

gobject.source_remove(self.stop_initiator_tag)

380

self.stop_initiator_tag = (gobject.timeout_add

381

(self._timeout_milliseconds,

382

self.stop))

383

self.PropertyChanged(dbus.String(u"last_checked_ok"),

384

(_datetime_to_dbus_struct

385

(self.last_checked_ok,

386

variant_level=1)))

387

313

388

def start_checker(self):

314

389

"""Start a new checker subprocess if one is not running.

315

390

If a checker already exists, leave it running and do

324

399

# is as it should be.

325

400

if self.checker is None:

326

401

try:

327

# In case check_command has exactly one % operator

328

command = self.check_command % self.host

402

# In case checker_command has exactly one % operator

403

command = self.checker_command % self.host

329

404

except TypeError:

330

405

# Escape attributes for the shell

331

406

escaped_attrs = dict((key, re.escape(str(val)))

332

407

for key, val in

333

408

vars(self).iteritems())

334

409

try:

335

command = self.check_command % escaped_attrs

410

command = self.checker_command % escaped_attrs

336

411

except TypeError, error:

337

412

logger.error(u'Could not format string "%s":'

338

u' %s', self.check_command, error)

413

u' %s', self.checker_command, error)

339

414

return True # Try again later

340

415

try:

341

416

logger.info(u"Starting checker %r for %s",

347

422

self.checker = subprocess.Popen(command,

348

423

close_fds=True,

349

424

shell=True, cwd="/")

350

self.checker_callback_tag = gobject.child_watch_add\

351

(self.checker.pid,

352

self.checker_callback)

425

# Emit D-Bus signal

426

self.CheckerStarted(command)

427

self.PropertyChanged(dbus.String("checker_running"),

428

dbus.Boolean(True, variant_level=1))

429

self.checker_callback_tag = (gobject.child_watch_add

430

(self.checker.pid,

431

self.checker_callback,

432

data=command))

353

433

except OSError, error:

354

434

logger.error(u"Failed to start subprocess: %s",

355

435

error)

356

436

# Re-run this periodically if run by gobject.timeout_add

357

437

return True

438

358

439

def stop_checker(self):

359

440

"""Force the checker process, if any, to stop."""

360

441

if self.checker_callback_tag:

372

453

if error.errno != errno.ESRCH: # No such process

373

454

raise

374

455

self.checker = None

456

self.PropertyChanged(dbus.String(u"checker_running"),

457

dbus.Boolean(False, variant_level=1))

458

375

459

def still_valid(self):

376

460

"""Has the timeout not yet passed for this client?"""

377

now = datetime.datetime.now()

461

if not getattr(self, "started", False):

462

return False

463

now = datetime.datetime.utcnow()

378

464

if self.last_checked_ok is None:

379

465

return now < (self.created + self.timeout)

380

466

else:

381

467

return now < (self.last_checked_ok + self.timeout)

468

469

## D-Bus methods & signals

470

_interface = u"org.mandos_system.Mandos.Client"

471

472

# BumpTimeout - method

473

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

474

BumpTimeout.__name__ = "BumpTimeout"

475

476

# CheckerCompleted - signal

477

@dbus.service.signal(_interface, signature="bqs")

478

def CheckerCompleted(self, success, condition, command):

479

"D-Bus signal"

480

pass

481

482

# CheckerStarted - signal

483

@dbus.service.signal(_interface, signature="s")

484

def CheckerStarted(self, command):

485

"D-Bus signal"

486

pass

487

488

# GetAllProperties - method

489

@dbus.service.method(_interface, out_signature="a{sv}")

490

def GetAllProperties(self):

491

"D-Bus method"

492

return dbus.Dictionary({

493

dbus.String("name"):

494

dbus.String(self.name, variant_level=1),

495

dbus.String("fingerprint"):

496

dbus.String(self.fingerprint, variant_level=1),

497

dbus.String("host"):

498

dbus.String(self.host, variant_level=1),

499

dbus.String("created"):

500

_datetime_to_dbus_struct(self.created,

501

variant_level=1),

502

dbus.String("last_started"):

503

(_datetime_to_dbus_struct(self.last_started,

504

variant_level=1)

505

if self.last_started is not None

506

else dbus.Boolean(False, variant_level=1)),

507

dbus.String("started"):

508

dbus.Boolean(self.started, variant_level=1),

509

dbus.String("last_checked_ok"):

510

(_datetime_to_dbus_struct(self.last_checked_ok,

511

variant_level=1)

512

if self.last_checked_ok is not None

513

else dbus.Boolean (False, variant_level=1)),

514

dbus.String("timeout"):

515

dbus.UInt64(self._timeout_milliseconds,

516

variant_level=1),

517

dbus.String("interval"):

518

dbus.UInt64(self._interval_milliseconds,

519

variant_level=1),

520

dbus.String("checker"):

521

dbus.String(self.checker_command,

522

variant_level=1),

523

dbus.String("checker_running"):

524

dbus.Boolean(self.checker is not None,

525

variant_level=1),

526

}, signature="sv")

527

528

# IsStillValid - method

529

IsStillValid = (dbus.service.method(_interface, out_signature="b")

530

(still_valid))

531

IsStillValid.__name__ = "IsStillValid"

532

533

# PropertyChanged - signal

534

@dbus.service.signal(_interface, signature="sv")

535

def PropertyChanged(self, property, value):

536

"D-Bus signal"

537

pass

538

539

# SetChecker - method

540

@dbus.service.method(_interface, in_signature="s")

541

def SetChecker(self, checker):

542

"D-Bus setter method"

543

self.checker_command = checker

544

545

# SetHost - method

546

@dbus.service.method(_interface, in_signature="s")

547

def SetHost(self, host):

548

"D-Bus setter method"

549

self.host = host

550

551

# SetInterval - method

552

@dbus.service.method(_interface, in_signature="t")

553

def SetInterval(self, milliseconds):

554

self.interval = datetime.timdeelta(0, 0, 0, milliseconds)

555

556

# SetSecret - method

557

@dbus.service.method(_interface, in_signature="ay",

558

byte_arrays=True)

559

def SetSecret(self, secret):

560

"D-Bus setter method"

561

self.secret = str(secret)

562

563

# SetTimeout - method

564

@dbus.service.method(_interface, in_signature="t")

565

def SetTimeout(self, milliseconds):

566

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

567

568

# Start - method

569

Start = dbus.service.method(_interface)(start)

570

Start.__name__ = "Start"

571

572

# StartChecker - method

573

@dbus.service.method(_interface)

574

def StartChecker(self):

575

"D-Bus method"

576

self.start_checker()

577

578

# Stop - method

579

@dbus.service.method(_interface)

580

def Stop(self):

581

"D-Bus method"

582

self.stop()

583

584

# StopChecker - method

585

StopChecker = dbus.service.method(_interface)(stop_checker)

586

StopChecker.__name__ = "StopChecker"

587

588

del _interface

382

589

383

590

384

591

def peer_certificate(session):

385

592

"Return the peer's OpenPGP certificate as a bytestring"

386

593

# If not an OpenPGP certificate...

387

if gnutls.library.functions.gnutls_certificate_type_get\

388

(session._c_object) \

389

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

594

if (gnutls.library.functions

595

.gnutls_certificate_type_get(session._c_object)

596

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

390

597

# ...do the normal thing

391

598

return session.peer_certificate

392

599

list_size = ctypes.c_uint()

393

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

394

(session._c_object, ctypes.byref(list_size))

600

cert_list = (gnutls.library.functions

601

.gnutls_certificate_get_peers

602

(session._c_object, ctypes.byref(list_size)))

395

603

if list_size.value == 0:

396

604

return None

397

605

cert = cert_list[0]

401

609

def fingerprint(openpgp):

402

610

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

403

611

# New GnuTLS "datum" with the OpenPGP public key

404

datum = gnutls.library.types.gnutls_datum_t\

405

(ctypes.cast(ctypes.c_char_p(openpgp),

406

ctypes.POINTER(ctypes.c_ubyte)),

407

ctypes.c_uint(len(openpgp)))

612

datum = (gnutls.library.types

613

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

614

ctypes.POINTER

615

(ctypes.c_ubyte)),

616

ctypes.c_uint(len(openpgp))))

408

617

# New empty GnuTLS certificate

409

618

crt = gnutls.library.types.gnutls_openpgp_crt_t()

410

gnutls.library.functions.gnutls_openpgp_crt_init\

411

(ctypes.byref(crt))

619

(gnutls.library.functions

620

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

412

621

# Import the OpenPGP public key into the certificate

413

gnutls.library.functions.gnutls_openpgp_crt_import\

414

(crt, ctypes.byref(datum),

415

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

622

(gnutls.library.functions

623

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

624

gnutls.library.constants

625

.GNUTLS_OPENPGP_FMT_RAW))

416

626

# Verify the self signature in the key

417

crtverify = ctypes.c_uint();

418

gnutls.library.functions.gnutls_openpgp_crt_verify_self\

419

(crt, 0, ctypes.byref(crtverify))

627

crtverify = ctypes.c_uint()

628

(gnutls.library.functions

629

.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))

420

630

if crtverify.value != 0:

421

631

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

422

632

raise gnutls.errors.CertificateSecurityError("Verify failed")

423

633

# New buffer for the fingerprint

424

buffer = ctypes.create_string_buffer(20)

425

buffer_length = ctypes.c_size_t()

634

buf = ctypes.create_string_buffer(20)

635

buf_len = ctypes.c_size_t()

426

636

# Get the fingerprint from the certificate into the buffer

427

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

428

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

637

(gnutls.library.functions

638

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

639

ctypes.byref(buf_len)))

429

640

# Deinit the certificate

430

641

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

431

642

# Convert the buffer to a Python bytestring

432

fpr = ctypes.string_at(buffer, buffer_length.value)

643

fpr = ctypes.string_at(buf, buf_len.value)

433

644

# Convert the bytestring to hexadecimal notation

434

645

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

435

646

return hex_fpr

436

647

437

648

438

class tcp_handler(SocketServer.BaseRequestHandler, object):

649

class TCP_handler(SocketServer.BaseRequestHandler, object):

439

650

"""A TCP request handler class.

440

651

Instantiated by IPv6_TCPServer for each request to handle it.

441

652

Note: This will run in its own forked process."""

442

653

443

654

def handle(self):

444

655

logger.info(u"TCP connection from: %s",

445

unicode(self.client_address))

446

session = gnutls.connection.ClientSession\

447

(self.request, gnutls.connection.X509Credentials())

656

unicode(self.client_address))

657

session = (gnutls.connection

658

.ClientSession(self.request,

659

gnutls.connection

660

.X509Credentials()))

448

661

449

662

line = self.request.makefile().readline()

450

663

logger.debug(u"Protocol version: %r", line)

463

676

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

464

677

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

465

678

# "+DHE-DSS"))

466

priority = "NORMAL" # Fallback default, since this

467

# MUST be set.

468

if self.server.settings["priority"]:

469

priority = self.server.settings["priority"]

470

gnutls.library.functions.gnutls_priority_set_direct\

471

(session._c_object, priority, None);

679

# Use a fallback default, since this MUST be set.

680

priority = self.server.settings.get("priority", "NORMAL")

681

(gnutls.library.functions

682

.gnutls_priority_set_direct(session._c_object,

683

priority, None))

472

684

473

685

try:

474

686

session.handshake()

484

696

session.bye()

485

697

return

486

698

logger.debug(u"Fingerprint: %s", fpr)

487

client = None

488

699

for c in self.server.clients:

489

700

if c.fingerprint == fpr:

490

701

client = c

491

702

break

492

if not client:

703

else:

493

704

logger.warning(u"Client not found for fingerprint: %s",

494

705

fpr)

495

706

session.bye()

502

713

vars(client))

503

714

session.bye()

504

715

return

716

## This won't work here, since we're in a fork.

717

# client.bump_timeout()

505

718

sent_size = 0

506

719

while sent_size < len(client.secret):

507

720

sent = session.send(client.secret[sent_size:])

512

725

session.bye()

513

726

514

727

515

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

728

class IPv6_TCPServer(SocketServer.ForkingMixIn,

729

SocketServer.TCPServer, object):

516

730

"""IPv6 TCP server. Accepts 'None' as address and/or port.

517

731

Attributes:

518

732

settings: Server settings

519

733

clients: Set() of Client objects

734

enabled: Boolean; whether this server is activated yet

520

735

"""

521

736

address_family = socket.AF_INET6

522

737

def __init__(self, *args, **kwargs):

526

741

if "clients" in kwargs:

527

742

self.clients = kwargs["clients"]

528

743

del kwargs["clients"]

529

return super(type(self), self).__init__(*args, **kwargs)

744

self.enabled = False

745

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

530

746

def server_bind(self):

531

747

"""This overrides the normal server_bind() function

532

748

to bind to an interface if one was specified, and also NOT to

561

777

# if_nametoindex

562

778

# (self.settings

563

779

# ["interface"]))

564

return super(type(self), self).server_bind()

780

return super(IPv6_TCPServer, self).server_bind()

781

def server_activate(self):

782

if self.enabled:

783

return super(IPv6_TCPServer, self).server_activate()

784

def enable(self):

785

self.enabled = True

565

786

566

787

567

788

def string_to_delta(interval):

583

804

timevalue = datetime.timedelta(0)

584

805

for s in interval.split():

585

806

try:

586

suffix=unicode(s[-1])

587

value=int(s[:-1])

807

suffix = unicode(s[-1])

808

value = int(s[:-1])

588

809

if suffix == u"d":

589

810

delta = datetime.timedelta(value)

590

811

elif suffix == u"s":

630

851

"""Call the C function if_nametoindex(), or equivalent"""

631

852

global if_nametoindex

632

853

try:

633

if "ctypes.util" not in sys.modules:

634

import ctypes.util

635

if_nametoindex = ctypes.cdll.LoadLibrary\

636

(ctypes.util.find_library("c")).if_nametoindex

854

if_nametoindex = (ctypes.cdll.LoadLibrary

855

(ctypes.util.find_library("c"))

856

.if_nametoindex)

637

857

except (OSError, AttributeError):

638

858

if "struct" not in sys.modules:

639

859

import struct

642

862

def if_nametoindex(interface):

643

863

"Get an interface index the hard way, i.e. using fcntl()"

644

864

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

645

s = socket.socket()

646

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

647

struct.pack("16s16x", interface))

648

s.close()

865

with closing(socket.socket()) as s:

866

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

867

struct.pack("16s16x", interface))

649

868

interface_index = struct.unpack("I", ifreq[16:20])[0]

650

869

return interface_index

651

870

return if_nametoindex(interface)

675

894

676

895

677

896

def main():

678

global main_loop_started

679

main_loop_started = False

680

681

897

parser = OptionParser(version = "%%prog %s" % version)

682

898

parser.add_option("-i", "--interface", type="string",

683

899

metavar="IF", help="Bind to interface IF")

698

914

default="/etc/mandos", metavar="DIR",

699

915

help="Directory to search for configuration"

700

916

" files")

701

(options, args) = parser.parse_args()

917

options = parser.parse_args()[0]

702

918

703

919

if options.check:

704

920

import doctest

722

938

# Convert the SafeConfigParser object to a dict

723

939

server_settings = server_config.defaults()

724

940

# Use getboolean on the boolean config option

725

server_settings["debug"] = server_config.getboolean\

726

("DEFAULT", "debug")

941

server_settings["debug"] = (server_config.getboolean

942

("DEFAULT", "debug"))

727

943

del server_config

728

944

729

945

# Override the settings from the config file with command line

743

959

console.setLevel(logging.WARNING)

744

960

745

961

if server_settings["servicename"] != "Mandos":

746

syslogger.setFormatter(logging.Formatter\

962

syslogger.setFormatter(logging.Formatter

747

963

('Mandos (%s): %%(levelname)s:'

748

964

' %%(message)s'

749

965

% server_settings["servicename"]))

758

974

client_config.read(os.path.join(server_settings["configdir"],

759

975

"clients.conf"))

760

976

977

clients = Set()

978

tcp_server = IPv6_TCPServer((server_settings["address"],

979

server_settings["port"]),

980

TCP_handler,

981

settings=server_settings,

982

clients=clients)

983

pidfilename = "/var/run/mandos.pid"

984

try:

985

pidfile = open(pidfilename, "w")

986

except IOError, error:

987

logger.error("Could not open file %r", pidfilename)

988

989

try:

990

uid = pwd.getpwnam("_mandos").pw_uid

991

except KeyError:

992

try:

993

uid = pwd.getpwnam("mandos").pw_uid

994

except KeyError:

995

try:

996

uid = pwd.getpwnam("nobody").pw_uid

997

except KeyError:

998

uid = 65534

999

try:

1000

gid = pwd.getpwnam("_mandos").pw_gid

1001

except KeyError:

1002

try:

1003

gid = pwd.getpwnam("mandos").pw_gid

1004

except KeyError:

1005

try:

1006

gid = pwd.getpwnam("nogroup").pw_gid

1007

except KeyError:

1008

gid = 65534

1009

try:

1010

os.setuid(uid)

1011

os.setgid(gid)

1012

except OSError, error:

1013

if error[0] != errno.EPERM:

1014

raise error

1015

761

1016

global service

762

1017

service = AvahiService(name = server_settings["servicename"],

763

type = "_mandos._tcp", );

1018

servicetype = "_mandos._tcp", )

764

1019

if server_settings["interface"]:

765

service.interface = if_nametoindex\

766

(server_settings["interface"])

1020

service.interface = (if_nametoindex

1021

(server_settings["interface"]))

767

1022

768

1023

global main_loop

769

1024

global bus

776

1031

avahi.DBUS_PATH_SERVER),

777

1032

avahi.DBUS_INTERFACE_SERVER)

778

1033

# End of Avahi example code

779

780

clients = Set()

781

def remove_from_clients(client):

782

clients.remove(client)

783

if not clients:

784

logger.critical(u"No clients left, exiting")

785

sys.exit()

1034

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)

786

1035

787

1036

clients.update(Set(Client(name = section,

788

stop_hook = remove_from_clients,

789

1037

config

790

1038

= dict(client_config.items(section)))

791

1039

for section in client_config.sections()))

805

1053

# Close all input and output, do double fork, etc.

806

1054

daemon()

807

1055

808

pidfilename = "/var/run/mandos/mandos.pid"

809

pid = os.getpid()

810

1056

try:

811

pidfile = open(pidfilename, "w")

1057

pid = os.getpid()

812

1058

pidfile.write(str(pid) + "\n")

813

1059

pidfile.close()

814

1060

del pidfile

815

except IOError, err:

816

logger.error(u"Could not write %s file with PID %d",

817

pidfilename, os.getpid())

1061

except IOError:

1062

logger.error(u"Could not write to file %r with PID %d",

1063

pidfilename, pid)

1064

except NameError:

1065

# "pidfile" was never created

1066

pass

1067

del pidfilename

818

1068

819

1069

def cleanup():

820

1070

"Cleanup function; run on exit"

837

1087

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

838

1088

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

839

1089

1090

class MandosServer(dbus.service.Object):

1091

"""A D-Bus proxy object"""

1092

def __init__(self):

1093

dbus.service.Object.__init__(self, bus,

1094

"/Mandos")

1095

_interface = u"org.mandos_system.Mandos"

1096

1097

@dbus.service.signal(_interface, signature="oa{sv}")

1098

def ClientAdded(self, objpath, properties):

1099

"D-Bus signal"

1100

pass

1101

1102

@dbus.service.signal(_interface, signature="o")

1103

def ClientRemoved(self, objpath):

1104

"D-Bus signal"

1105

pass

1106

1107

@dbus.service.method(_interface, out_signature="ao")

1108

def GetAllClients(self):

1109

return dbus.Array(c.dbus_object_path for c in clients)

1110

1111

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1112

def GetAllClientsWithProperties(self):

1113

return dbus.Dictionary(

1114

((c.dbus_object_path, c.GetAllProperties())

1115

for c in clients),

1116

signature="oa{sv}")

1117

1118

@dbus.service.method(_interface, in_signature="o")

1119

def RemoveClient(self, object_path):

1120

for c in clients:

1121

if c.dbus_object_path == object_path:

1122

c.stop()

1123

clients.remove(c)

1124

return

1125

raise KeyError

1126

1127

del _interface

1128

1129

mandos_server = MandosServer()

1130

840

1131

for client in clients:

1132

# Emit D-Bus signal

1133

mandos_server.ClientAdded(client.dbus_object_path,

1134

client.GetAllProperties())

841

1135

client.start()

842

1136

843

tcp_server = IPv6_TCPServer((server_settings["address"],

844

server_settings["port"]),

845

tcp_handler,

846

settings=server_settings,

847

clients=clients)

1137

tcp_server.enable()

1138

tcp_server.server_activate()

1139

848

1140

# Find out what port we got

849

1141

service.port = tcp_server.socket.getsockname()[1]

850

1142

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

864

1156

865

1157

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

866

1158

lambda *args, **kwargs:

867

tcp_server.handle_request\

868

(*args[2:], **kwargs) or True)

1159

(tcp_server.handle_request

1160

(*args[2:], **kwargs) or True))

869

1161

870

1162

logger.debug(u"Starting main loop")

871

main_loop_started = True

872

1163

main_loop.run()

873

1164

except AvahiError, error:

874

1165

logger.critical(u"AvahiError: %s" + unicode(error))