/mandos/release : revision 24.1.114

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

16

#

16

17

# This program is free software: you can redistribute it and/or modify

17

18

# it under the terms of the GNU General Public License as published by

30

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

32

#

32

33

from __future__ import division

34

from __future__ import division, with_statement, absolute_import

34

35

36

import SocketServer

36

37

import socket

37

import select

38

from optparse import OptionParser

39

import datetime

40

import errno

56

import logging

57

import logging.handlers

58

import pwd

59

from contextlib import closing

59

60

61

import dbus

62

import dbus.service

61

63

import gobject

62

64

import avahi

63

65

from dbus.mainloop.glib import DBusGMainLoop

64

66

import ctypes

67

import ctypes.util

65

68

66

version = "1.0"

69

version = "1.0.2"

67

70

68

71

logger = logging.Logger('mandos')

69

syslogger = logging.handlers.SysLogHandler\

70

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

71

address = "/dev/log")

72

syslogger.setFormatter(logging.Formatter\

73

('Mandos: %(levelname)s: %(message)s'))

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos: %(levelname)s: %(message)s'))

74

77

logger.addHandler(syslogger)

75

78

76

79

console = logging.StreamHandler()

81

84

class AvahiError(Exception):

82

85

def __init__(self, value):

83

86

self.value = value

87

super(AvahiError, self).__init__()

84

88

def __str__(self):

85

89

return repr(self.value)

86

90

108

112

a sensible number of times

109

113

"""

110

114

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

111

type = None, port = None, TXT = None, domain = "",

112

host = "", max_renames = 32768):

115

servicetype = None, port = None, TXT = None,

116

domain = "", host = "", max_renames = 32768):

113

117

self.interface = interface

114

118

self.name = name

115

self.type = type

119

self.type = servicetype

116

120

self.port = port

117

if TXT is None:

118

self.TXT = []

119

else:

120

self.TXT = TXT

121

self.TXT = TXT if TXT is not None else []

121

122

self.domain = domain

122

123

self.host = host

123

124

self.rename_count = 0

127

128

if self.rename_count >= self.max_renames:

128

129

logger.critical(u"No suitable Zeroconf service name found"

129

130

u" after %i retries, exiting.",

130

rename_count)

131

self.rename_count)

131

132

raise AvahiServiceError("Too many renames")

132

133

self.name = server.GetAlternativeServiceName(self.name)

133

134

logger.info(u"Changing Zeroconf service name to %r ...",

134

135

str(self.name))

135

syslogger.setFormatter(logging.Formatter\

136

syslogger.setFormatter(logging.Formatter

136

137

('Mandos (%s): %%(levelname)s:'

137

' %%(message)s' % self.name))

138

' %%(message)s' % self.name))

138

139

self.remove()

139

140

self.add()

140

141

self.rename_count += 1

146

147

"""Derived from the Avahi example code"""

147

148

global group

148

149

if group is None:

149

group = dbus.Interface\

150

(bus.get_object(avahi.DBUS_NAME,

150

group = dbus.Interface(bus.get_object

151

(avahi.DBUS_NAME,

151

152

server.EntryGroupNew()),

152

avahi.DBUS_INTERFACE_ENTRY_GROUP)

153

avahi.DBUS_INTERFACE_ENTRY_GROUP)

153

154

group.connect_to_signal('StateChanged',

154

155

entry_group_state_changed)

155

156

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

169

170

# End of Avahi example code

170

171

172

class Client(object):

173

def _datetime_to_dbus_struct(dt, variant_level=0):

174

"""Convert a UTC datetime.datetime() to a D-Bus struct.

175

The format is special to this application, since we could not find

176

any other standard way."""

177

return dbus.Struct((dbus.Int16(dt.year),

178

dbus.Byte(dt.month),

179

dbus.Byte(dt.day),

180

dbus.Byte(dt.hour),

181

dbus.Byte(dt.minute),

182

dbus.Byte(dt.second),

183

dbus.UInt32(dt.microsecond)),

184

signature="nyyyyyu",

185

variant_level=variant_level)

186

187

188

class Client(dbus.service.Object):

173

189

"""A representation of a client host served by this server.

174

190

Attributes:

175

name: string; from the config file, used in log messages

191

name: string; from the config file, used in log messages

176

192

fingerprint: string (40 or 32 hexadecimal digits); used to

177

193

uniquely identify the client

178

secret: bytestring; sent verbatim (over TLS) to client

179

host: string; available for use by the checker command

180

created: datetime.datetime(); object creation, not client host

181

last_checked_ok: datetime.datetime() or None if not yet checked OK

182

timeout: datetime.timedelta(); How long from last_checked_ok

183

until this client is invalid

184

interval: datetime.timedelta(); How often to start a new checker

185

stop_hook: If set, called by stop() as stop_hook(self)

186

checker: subprocess.Popen(); a running checker process used

187

to see if the client lives.

188

'None' if no process is running.

194

secret: bytestring; sent verbatim (over TLS) to client

195

host: string; available for use by the checker command

196

created: datetime.datetime(); (UTC) object creation

197

last_started: datetime.datetime(); (UTC)

198

started: bool()

199

last_checked_ok: datetime.datetime(); (UTC) or None

200

timeout: datetime.timedelta(); How long from last_checked_ok

201

until this client is invalid

202

interval: datetime.timedelta(); How often to start a new checker

203

stop_hook: If set, called by stop() as stop_hook(self)

204

checker: subprocess.Popen(); a running checker process used

205

to see if the client lives.

206

'None' if no process is running.

189

207

checker_initiator_tag: a gobject event source tag, or None

190

208

stop_initiator_tag: - '' -

191

209

checker_callback_tag: - '' -

193

211

client lives. %() expansions are done at

194

212

runtime with vars(self) as dict, so that for

195

213

instance %(name)s can be used in the command.

214

dbus_object_path: dbus.ObjectPath

196

215

Private attibutes:

197

216

_timeout: Real variable for 'timeout'

198

217

_interval: Real variable for 'interval'

200

219

_interval_milliseconds: - '' -

201

220

"""

202

221

def _set_timeout(self, timeout):

203

"Setter function for 'timeout' attribute"

222

"Setter function for the 'timeout' attribute"

204

223

self._timeout = timeout

205

224

self._timeout_milliseconds = ((self.timeout.days

206

225

* 24 * 60 * 60 * 1000)

207

226

+ (self.timeout.seconds * 1000)

208

227

+ (self.timeout.microseconds

209

228

// 1000))

210

timeout = property(lambda self: self._timeout,

211

_set_timeout)

229

# Emit D-Bus signal

230

self.PropertyChanged(dbus.String(u"timeout"),

231

(dbus.UInt64(self._timeout_milliseconds,

232

variant_level=1)))

233

timeout = property(lambda self: self._timeout, _set_timeout)

212

234

del _set_timeout

235

213

236

def _set_interval(self, interval):

214

"Setter function for 'interval' attribute"

237

"Setter function for the 'interval' attribute"

215

238

self._interval = interval

216

239

self._interval_milliseconds = ((self.interval.days

217

240

* 24 * 60 * 60 * 1000)

219

242

* 1000)

220

243

+ (self.interval.microseconds

221

244

// 1000))

222

interval = property(lambda self: self._interval,

223

_set_interval)

245

# Emit D-Bus signal

246

self.PropertyChanged(dbus.String(u"interval"),

247

(dbus.UInt64(self._interval_milliseconds,

248

variant_level=1)))

249

interval = property(lambda self: self._interval, _set_interval)

224

250

del _set_interval

225

def __init__(self, name = None, stop_hook=None, config={}):

251

252

def __init__(self, name = None, stop_hook=None, config=None):

226

253

"""Note: the 'checker' key in 'config' sets the

227

254

'checker_command' attribute and *not* the 'checker'

228

255

attribute."""

256

self.dbus_object_path = (dbus.ObjectPath

257

("/Mandos/clients/"

258

+ name.replace(".", "_")))

259

dbus.service.Object.__init__(self, bus,

260

self.dbus_object_path)

261

if config is None:

262

config = {}

229

263

self.name = name

230

264

logger.debug(u"Creating client %r", self.name)

231

265

# Uppercase and remove spaces from fingerprint for later

232

266

# comparison purposes with return value from the fingerprint()

233

267

# function

234

self.fingerprint = config["fingerprint"].upper()\

235

.replace(u" ", u"")

268

self.fingerprint = (config["fingerprint"].upper()

269

.replace(u" ", u""))

236

270

logger.debug(u" Fingerprint: %s", self.fingerprint)

237

271

if "secret" in config:

238

272

self.secret = config["secret"].decode(u"base64")

239

273

elif "secfile" in config:

240

sf = open(config["secfile"])

241

self.secret = sf.read()

242

sf.close()

274

with closing(open(os.path.expanduser

275

(os.path.expandvars

276

(config["secfile"])))) as secfile:

277

self.secret = secfile.read()

243

278

else:

244

279

raise TypeError(u"No secret or secfile for client %s"

245

280

% self.name)

246

281

self.host = config.get("host", "")

247

self.created = datetime.datetime.now()

282

self.created = datetime.datetime.utcnow()

283

self.started = False

284

self.last_started = None

248

285

self.last_checked_ok = None

249

286

self.timeout = string_to_delta(config["timeout"])

250

287

self.interval = string_to_delta(config["interval"])

253

290

self.checker_initiator_tag = None

254

291

self.stop_initiator_tag = None

255

292

self.checker_callback_tag = None

256

self.check_command = config["checker"]

293

self.checker_command = config["checker"]

294

257

295

def start(self):

258

296

"""Start this client's checker and timeout hooks"""

297

self.last_started = datetime.datetime.utcnow()

259

298

# Schedule a new checker to be started an 'interval' from now,

260

299

# and every interval from then on.

261

self.checker_initiator_tag = gobject.timeout_add\

262

(self._interval_milliseconds,

263

self.start_checker)

300

self.checker_initiator_tag = (gobject.timeout_add

301

(self._interval_milliseconds,

302

self.start_checker))

264

303

# Also start a new checker *right now*.

265

304

self.start_checker()

266

305

# Schedule a stop() when 'timeout' has passed

267

self.stop_initiator_tag = gobject.timeout_add\

268

(self._timeout_milliseconds,

269

self.stop)

306

self.stop_initiator_tag = (gobject.timeout_add

307

(self._timeout_milliseconds,

308

self.stop))

309

self.started = True

310

# Emit D-Bus signal

311

self.PropertyChanged(dbus.String(u"started"),

312

dbus.Boolean(True, variant_level=1))

313

self.PropertyChanged(dbus.String(u"last_started"),

314

(_datetime_to_dbus_struct

315

(self.last_started, variant_level=1)))

316

270

317

def stop(self):

271

"""Stop this client.

272

The possibility that a client might be restarted is left open,

273

but not currently used."""

274

# If this client doesn't have a secret, it is already stopped.

275

if hasattr(self, "secret") and self.secret:

276

logger.info(u"Stopping client %s", self.name)

277

self.secret = None

278

else:

318

"""Stop this client."""

319

if not getattr(self, "started", False):

279

320

return False

321

logger.info(u"Stopping client %s", self.name)

280

322

if getattr(self, "stop_initiator_tag", False):

281

323

gobject.source_remove(self.stop_initiator_tag)

282

324

self.stop_initiator_tag = None

286

328

self.stop_checker()

287

329

if self.stop_hook:

288

330

self.stop_hook(self)

331

self.started = False

332

# Emit D-Bus signal

333

self.PropertyChanged(dbus.String(u"started"),

334

dbus.Boolean(False, variant_level=1))

289

335

# Do not run this again if called by a gobject.timeout_add

290

336

return False

337

291

338

def __del__(self):

292

339

self.stop_hook = None

293

340

self.stop()

294

def checker_callback(self, pid, condition):

341

342

def checker_callback(self, pid, condition, command):

295

343

"""The checker has completed, so take appropriate actions."""

296

now = datetime.datetime.now()

297

344

self.checker_callback_tag = None

298

345

self.checker = None

299

if os.WIFEXITED(condition) \

300

and (os.WEXITSTATUS(condition) == 0):

346

# Emit D-Bus signal

347

self.PropertyChanged(dbus.String(u"checker_running"),

348

dbus.Boolean(False, variant_level=1))

349

if (os.WIFEXITED(condition)

350

and (os.WEXITSTATUS(condition) == 0)):

301

351

logger.info(u"Checker for %(name)s succeeded",

302

352

vars(self))

303

self.last_checked_ok = now

304

gobject.source_remove(self.stop_initiator_tag)

305

self.stop_initiator_tag = gobject.timeout_add\

306

(self._timeout_milliseconds,

307

self.stop)

353

# Emit D-Bus signal

354

self.CheckerCompleted(dbus.Boolean(True),

355

dbus.UInt16(condition),

356

dbus.String(command))

357

self.bump_timeout()

308

358

elif not os.WIFEXITED(condition):

309

359

logger.warning(u"Checker for %(name)s crashed?",

310

360

vars(self))

361

# Emit D-Bus signal

362

self.CheckerCompleted(dbus.Boolean(False),

363

dbus.UInt16(condition),

364

dbus.String(command))

311

365

else:

312

366

logger.info(u"Checker for %(name)s failed",

313

367

vars(self))

368

# Emit D-Bus signal

369

self.CheckerCompleted(dbus.Boolean(False),

370

dbus.UInt16(condition),

371

dbus.String(command))

372

373

def bump_timeout(self):

374

"""Bump up the timeout for this client.

375

This should only be called when the client has been seen,

376

alive and well.

377

"""

378

self.last_checked_ok = datetime.datetime.utcnow()

379

gobject.source_remove(self.stop_initiator_tag)

380

self.stop_initiator_tag = (gobject.timeout_add

381

(self._timeout_milliseconds,

382

self.stop))

383

self.PropertyChanged(dbus.String(u"last_checked_ok"),

384

(_datetime_to_dbus_struct

385

(self.last_checked_ok,

386

variant_level=1)))

387

314

388

def start_checker(self):

315

389

"""Start a new checker subprocess if one is not running.

316

390

If a checker already exists, leave it running and do

325

399

# is as it should be.

326

400

if self.checker is None:

327

401

try:

328

# In case check_command has exactly one % operator

329

command = self.check_command % self.host

402

# In case checker_command has exactly one % operator

403

command = self.checker_command % self.host

330

404

except TypeError:

331

405

# Escape attributes for the shell

332

406

escaped_attrs = dict((key, re.escape(str(val)))

333

407

for key, val in

334

408

vars(self).iteritems())

335

409

try:

336

command = self.check_command % escaped_attrs

410

command = self.checker_command % escaped_attrs

337

411

except TypeError, error:

338

412

logger.error(u'Could not format string "%s":'

339

u' %s', self.check_command, error)

413

u' %s', self.checker_command, error)

340

414

return True # Try again later

341

415

try:

342

416

logger.info(u"Starting checker %r for %s",

348

422

self.checker = subprocess.Popen(command,

349

423

close_fds=True,

350

424

shell=True, cwd="/")

351

self.checker_callback_tag = gobject.child_watch_add\

352

(self.checker.pid,

353

self.checker_callback)

425

# Emit D-Bus signal

426

self.CheckerStarted(command)

427

self.PropertyChanged(dbus.String("checker_running"),

428

dbus.Boolean(True, variant_level=1))

429

self.checker_callback_tag = (gobject.child_watch_add

430

(self.checker.pid,

431

self.checker_callback,

432

data=command))

354

433

except OSError, error:

355

434

logger.error(u"Failed to start subprocess: %s",

356

435

error)

357

436

# Re-run this periodically if run by gobject.timeout_add

358

437

return True

438

359

439

def stop_checker(self):

360

440

"""Force the checker process, if any, to stop."""

361

441

if self.checker_callback_tag:

373

453

if error.errno != errno.ESRCH: # No such process

374

454

raise

375

455

self.checker = None

456

self.PropertyChanged(dbus.String(u"checker_running"),

457

dbus.Boolean(False, variant_level=1))

458

376

459

def still_valid(self):

377

460

"""Has the timeout not yet passed for this client?"""

378

now = datetime.datetime.now()

461

if not getattr(self, "started", False):

462

return False

463

now = datetime.datetime.utcnow()

379

464

if self.last_checked_ok is None:

380

465

return now < (self.created + self.timeout)

381

466

else:

382

467

return now < (self.last_checked_ok + self.timeout)

468

469

## D-Bus methods & signals

470

_interface = u"org.mandos_system.Mandos.Client"

471

472

# BumpTimeout - method

473

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

474

BumpTimeout.__name__ = "BumpTimeout"

475

476

# CheckerCompleted - signal

477

@dbus.service.signal(_interface, signature="bqs")

478

def CheckerCompleted(self, success, condition, command):

479

"D-Bus signal"

480

pass

481

482

# CheckerStarted - signal

483

@dbus.service.signal(_interface, signature="s")

484

def CheckerStarted(self, command):

485

"D-Bus signal"

486

pass

487

488

# GetAllProperties - method

489

@dbus.service.method(_interface, out_signature="a{sv}")

490

def GetAllProperties(self):

491

"D-Bus method"

492

return dbus.Dictionary({

493

dbus.String("name"):

494

dbus.String(self.name, variant_level=1),

495

dbus.String("fingerprint"):

496

dbus.String(self.fingerprint, variant_level=1),

497

dbus.String("host"):

498

dbus.String(self.host, variant_level=1),

499

dbus.String("created"):

500

_datetime_to_dbus_struct(self.created,

501

variant_level=1),

502

dbus.String("last_started"):

503

(_datetime_to_dbus_struct(self.last_started,

504

variant_level=1)

505

if self.last_started is not None

506

else dbus.Boolean(False, variant_level=1)),

507

dbus.String("started"):

508

dbus.Boolean(self.started, variant_level=1),

509

dbus.String("last_checked_ok"):

510

(_datetime_to_dbus_struct(self.last_checked_ok,

511

variant_level=1)

512

if self.last_checked_ok is not None

513

else dbus.Boolean (False, variant_level=1)),

514

dbus.String("timeout"):

515

dbus.UInt64(self._timeout_milliseconds,

516

variant_level=1),

517

dbus.String("interval"):

518

dbus.UInt64(self._interval_milliseconds,

519

variant_level=1),

520

dbus.String("checker"):

521

dbus.String(self.checker_command,

522

variant_level=1),

523

dbus.String("checker_running"):

524

dbus.Boolean(self.checker is not None,

525

variant_level=1),

526

}, signature="sv")

527

528

# IsStillValid - method

529

IsStillValid = (dbus.service.method(_interface, out_signature="b")

530

(still_valid))

531

IsStillValid.__name__ = "IsStillValid"

532

533

# PropertyChanged - signal

534

@dbus.service.signal(_interface, signature="sv")

535

def PropertyChanged(self, property, value):

536

"D-Bus signal"

537

pass

538

539

# SetChecker - method

540

@dbus.service.method(_interface, in_signature="s")

541

def SetChecker(self, checker):

542

"D-Bus setter method"

543

self.checker_command = checker

544

545

# SetHost - method

546

@dbus.service.method(_interface, in_signature="s")

547

def SetHost(self, host):

548

"D-Bus setter method"

549

self.host = host

550

551

# SetInterval - method

552

@dbus.service.method(_interface, in_signature="t")

553

def SetInterval(self, milliseconds):

554

self.interval = datetime.timdeelta(0, 0, 0, milliseconds)

555

556

# SetSecret - method

557

@dbus.service.method(_interface, in_signature="ay",

558

byte_arrays=True)

559

def SetSecret(self, secret):

560

"D-Bus setter method"

561

self.secret = str(secret)

562

563

# SetTimeout - method

564

@dbus.service.method(_interface, in_signature="t")

565

def SetTimeout(self, milliseconds):

566

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

567

568

# Start - method

569

Start = dbus.service.method(_interface)(start)

570

Start.__name__ = "Start"

571

572

# StartChecker - method

573

@dbus.service.method(_interface)

574

def StartChecker(self):

575

"D-Bus method"

576

self.start_checker()

577

578

# Stop - method

579

@dbus.service.method(_interface)

580

def Stop(self):

581

"D-Bus method"

582

self.stop()

583

584

# StopChecker - method

585

StopChecker = dbus.service.method(_interface)(stop_checker)

586

StopChecker.__name__ = "StopChecker"

587

588

del _interface

383

589

384

590

385

591

def peer_certificate(session):

386

592

"Return the peer's OpenPGP certificate as a bytestring"

387

593

# If not an OpenPGP certificate...

388

if gnutls.library.functions.gnutls_certificate_type_get\

389

(session._c_object) \

390

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

594

if (gnutls.library.functions

595

.gnutls_certificate_type_get(session._c_object)

596

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

391

597

# ...do the normal thing

392

598

return session.peer_certificate

393

599

list_size = ctypes.c_uint()

394

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

395

(session._c_object, ctypes.byref(list_size))

600

cert_list = (gnutls.library.functions

601

.gnutls_certificate_get_peers

602

(session._c_object, ctypes.byref(list_size)))

396

603

if list_size.value == 0:

397

604

return None

398

605

cert = cert_list[0]

402

609

def fingerprint(openpgp):

403

610

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

404

611

# New GnuTLS "datum" with the OpenPGP public key

405

datum = gnutls.library.types.gnutls_datum_t\

406

(ctypes.cast(ctypes.c_char_p(openpgp),

407

ctypes.POINTER(ctypes.c_ubyte)),

408

ctypes.c_uint(len(openpgp)))

612

datum = (gnutls.library.types

613

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

614

ctypes.POINTER

615

(ctypes.c_ubyte)),

616

ctypes.c_uint(len(openpgp))))

409

617

# New empty GnuTLS certificate

410

618

crt = gnutls.library.types.gnutls_openpgp_crt_t()

411

gnutls.library.functions.gnutls_openpgp_crt_init\

412

(ctypes.byref(crt))

619

(gnutls.library.functions

620

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

413

621

# Import the OpenPGP public key into the certificate

414

gnutls.library.functions.gnutls_openpgp_crt_import\

415

(crt, ctypes.byref(datum),

416

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

622

(gnutls.library.functions

623

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

624

gnutls.library.constants

625

.GNUTLS_OPENPGP_FMT_RAW))

417

626

# Verify the self signature in the key

418

crtverify = ctypes.c_uint();

419

gnutls.library.functions.gnutls_openpgp_crt_verify_self\

420

(crt, 0, ctypes.byref(crtverify))

627

crtverify = ctypes.c_uint()

628

(gnutls.library.functions

629

.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))

421

630

if crtverify.value != 0:

422

631

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

423

632

raise gnutls.errors.CertificateSecurityError("Verify failed")

424

633

# New buffer for the fingerprint

425

buffer = ctypes.create_string_buffer(20)

426

buffer_length = ctypes.c_size_t()

634

buf = ctypes.create_string_buffer(20)

635

buf_len = ctypes.c_size_t()

427

636

# Get the fingerprint from the certificate into the buffer

428

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

429

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

637

(gnutls.library.functions

638

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

639

ctypes.byref(buf_len)))

430

640

# Deinit the certificate

431

641

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

432

642

# Convert the buffer to a Python bytestring

433

fpr = ctypes.string_at(buffer, buffer_length.value)

643

fpr = ctypes.string_at(buf, buf_len.value)

434

644

# Convert the bytestring to hexadecimal notation

435

645

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

436

646

return hex_fpr

437

647

438

648

439

class tcp_handler(SocketServer.BaseRequestHandler, object):

649

class TCP_handler(SocketServer.BaseRequestHandler, object):

440

650

"""A TCP request handler class.

441

651

Instantiated by IPv6_TCPServer for each request to handle it.

442

652

Note: This will run in its own forked process."""

443

653

444

654

def handle(self):

445

655

logger.info(u"TCP connection from: %s",

446

unicode(self.client_address))

447

session = gnutls.connection.ClientSession\

448

(self.request, gnutls.connection.X509Credentials())

656

unicode(self.client_address))

657

session = (gnutls.connection

658

.ClientSession(self.request,

659

gnutls.connection

660

.X509Credentials()))

449

661

450

662

line = self.request.makefile().readline()

451

663

logger.debug(u"Protocol version: %r", line)

464

676

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

465

677

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

466

678

# "+DHE-DSS"))

467

priority = "NORMAL" # Fallback default, since this

468

# MUST be set.

469

if self.server.settings["priority"]:

470

priority = self.server.settings["priority"]

471

gnutls.library.functions.gnutls_priority_set_direct\

472

(session._c_object, priority, None);

679

# Use a fallback default, since this MUST be set.

680

priority = self.server.settings.get("priority", "NORMAL")

681

(gnutls.library.functions

682

.gnutls_priority_set_direct(session._c_object,

683

priority, None))

473

684

474

685

try:

475

686

session.handshake()

485

696

session.bye()

486

697

return

487

698

logger.debug(u"Fingerprint: %s", fpr)

488

client = None

489

699

for c in self.server.clients:

490

700

if c.fingerprint == fpr:

491

701

client = c

492

702

break

493

if not client:

703

else:

494

704

logger.warning(u"Client not found for fingerprint: %s",

495

705

fpr)

496

706

session.bye()

503

713

vars(client))

504

714

session.bye()

505

715

return

716

## This won't work here, since we're in a fork.

717

# client.bump_timeout()

506

718

sent_size = 0

507

719

while sent_size < len(client.secret):

508

720

sent = session.send(client.secret[sent_size:])

513

725

session.bye()

514

726

515

727

516

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

728

class IPv6_TCPServer(SocketServer.ForkingMixIn,

729

SocketServer.TCPServer, object):

517

730

"""IPv6 TCP server. Accepts 'None' as address and/or port.

518

731

Attributes:

519

732

settings: Server settings

529

742

self.clients = kwargs["clients"]

530

743

del kwargs["clients"]

531

744

self.enabled = False

532

return super(type(self), self).__init__(*args, **kwargs)

745

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

533

746

def server_bind(self):

534

747

"""This overrides the normal server_bind() function

535

748

to bind to an interface if one was specified, and also NOT to

564

777

# if_nametoindex

565

778

# (self.settings

566

779

# ["interface"]))

567

return super(type(self), self).server_bind()

780

return super(IPv6_TCPServer, self).server_bind()

568

781

def server_activate(self):

569

782

if self.enabled:

570

return super(type(self), self).server_activate()

783

return super(IPv6_TCPServer, self).server_activate()

571

784

def enable(self):

572

785

self.enabled = True

573

786

591

804

timevalue = datetime.timedelta(0)

592

805

for s in interval.split():

593

806

try:

594

suffix=unicode(s[-1])

595

value=int(s[:-1])

807

suffix = unicode(s[-1])

808

value = int(s[:-1])

596

809

if suffix == u"d":

597

810

delta = datetime.timedelta(value)

598

811

elif suffix == u"s":

638

851

"""Call the C function if_nametoindex(), or equivalent"""

639

852

global if_nametoindex

640

853

try:

641

if "ctypes.util" not in sys.modules:

642

import ctypes.util

643

if_nametoindex = ctypes.cdll.LoadLibrary\

644

(ctypes.util.find_library("c")).if_nametoindex

854

if_nametoindex = (ctypes.cdll.LoadLibrary

855

(ctypes.util.find_library("c"))

856

.if_nametoindex)

645

857

except (OSError, AttributeError):

646

858

if "struct" not in sys.modules:

647

859

import struct

650

862

def if_nametoindex(interface):

651

863

"Get an interface index the hard way, i.e. using fcntl()"

652

864

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

653

s = socket.socket()

654

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

655

struct.pack("16s16x", interface))

656

s.close()

865

with closing(socket.socket()) as s:

866

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

867

struct.pack("16s16x", interface))

657

868

interface_index = struct.unpack("I", ifreq[16:20])[0]

658

869

return interface_index

659

870

return if_nametoindex(interface)

683

894

684

895

685

896

def main():

686

global main_loop_started

687

main_loop_started = False

688

689

897

parser = OptionParser(version = "%%prog %s" % version)

690

898

parser.add_option("-i", "--interface", type="string",

691

899

metavar="IF", help="Bind to interface IF")

706

914

default="/etc/mandos", metavar="DIR",

707

915

help="Directory to search for configuration"

708

916

" files")

709

(options, args) = parser.parse_args()

917

options = parser.parse_args()[0]

710

918

711

919

if options.check:

712

920

import doctest

730

938

# Convert the SafeConfigParser object to a dict

731

939

server_settings = server_config.defaults()

732

940

# Use getboolean on the boolean config option

733

server_settings["debug"] = server_config.getboolean\

734

("DEFAULT", "debug")

941

server_settings["debug"] = (server_config.getboolean

942

("DEFAULT", "debug"))

735

943

del server_config

736

944

737

945

# Override the settings from the config file with command line

751

959

console.setLevel(logging.WARNING)

752

960

753

961

if server_settings["servicename"] != "Mandos":

754

syslogger.setFormatter(logging.Formatter\

962

syslogger.setFormatter(logging.Formatter

755

963

('Mandos (%s): %%(levelname)s:'

756

964

' %%(message)s'

757

965

% server_settings["servicename"]))

769

977

clients = Set()

770

978

tcp_server = IPv6_TCPServer((server_settings["address"],

771

979

server_settings["port"]),

772

tcp_handler,

980

TCP_handler,

773

981

settings=server_settings,

774

982

clients=clients)

775

983

pidfilename = "/var/run/mandos.pid"

778

986

except IOError, error:

779

987

logger.error("Could not open file %r", pidfilename)

780

988

781

uid = 65534

782

gid = 65534

783

try:

784

uid = pwd.getpwnam("mandos").pw_uid

785

except KeyError:

786

try:

787

uid = pwd.getpwnam("nobody").pw_uid

788

except KeyError:

789

pass

790

try:

791

gid = pwd.getpwnam("mandos").pw_gid

792

except KeyError:

793

try:

794

gid = pwd.getpwnam("nogroup").pw_gid

795

except KeyError:

796

pass

989

try:

990

uid = pwd.getpwnam("_mandos").pw_uid

991

except KeyError:

992

try:

993

uid = pwd.getpwnam("mandos").pw_uid

994

except KeyError:

995

try:

996

uid = pwd.getpwnam("nobody").pw_uid

997

except KeyError:

998

uid = 65534

999

try:

1000

gid = pwd.getpwnam("_mandos").pw_gid

1001

except KeyError:

1002

try:

1003

gid = pwd.getpwnam("mandos").pw_gid

1004

except KeyError:

1005

try:

1006

gid = pwd.getpwnam("nogroup").pw_gid

1007

except KeyError:

1008

gid = 65534

797

1009

try:

798

1010

os.setuid(uid)

799

1011

os.setgid(gid)

803

1015

804

1016

global service

805

1017

service = AvahiService(name = server_settings["servicename"],

806

type = "_mandos._tcp", );

1018

servicetype = "_mandos._tcp", )

807

1019

if server_settings["interface"]:

808

service.interface = if_nametoindex\

809

(server_settings["interface"])

1020

service.interface = (if_nametoindex

1021

(server_settings["interface"]))

810

1022

811

1023

global main_loop

812

1024

global bus

819

1031

avahi.DBUS_PATH_SERVER),

820

1032

avahi.DBUS_INTERFACE_SERVER)

821

1033

# End of Avahi example code

822

823

def remove_from_clients(client):

824

clients.remove(client)

825

if not clients:

826

logger.critical(u"No clients left, exiting")

827

sys.exit()

1034

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)

828

1035

829

1036

clients.update(Set(Client(name = section,

830

stop_hook = remove_from_clients,

831

1037

config

832

1038

= dict(client_config.items(section)))

833

1039

for section in client_config.sections()))

852

1058

pidfile.write(str(pid) + "\n")

853

1059

pidfile.close()

854

1060

del pidfile

855

except IOError, err:

1061

except IOError:

856

1062

logger.error(u"Could not write to file %r with PID %d",

857

1063

pidfilename, pid)

858

1064

except NameError:

881

1087

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

882

1088

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

883

1089

1090

class MandosServer(dbus.service.Object):

1091

"""A D-Bus proxy object"""

1092

def __init__(self):

1093

dbus.service.Object.__init__(self, bus,

1094

"/Mandos")

1095

_interface = u"org.mandos_system.Mandos"

1096

1097

@dbus.service.signal(_interface, signature="oa{sv}")

1098

def ClientAdded(self, objpath, properties):

1099

"D-Bus signal"

1100

pass

1101

1102

@dbus.service.signal(_interface, signature="o")

1103

def ClientRemoved(self, objpath):

1104

"D-Bus signal"

1105

pass

1106

1107

@dbus.service.method(_interface, out_signature="ao")

1108

def GetAllClients(self):

1109

return dbus.Array(c.dbus_object_path for c in clients)

1110

1111

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1112

def GetAllClientsWithProperties(self):

1113

return dbus.Dictionary(

1114

((c.dbus_object_path, c.GetAllProperties())

1115

for c in clients),

1116

signature="oa{sv}")

1117

1118

@dbus.service.method(_interface, in_signature="o")

1119

def RemoveClient(self, object_path):

1120

for c in clients:

1121

if c.dbus_object_path == object_path:

1122

c.stop()

1123

clients.remove(c)

1124

return

1125

raise KeyError

1126

1127

del _interface

1128

1129

mandos_server = MandosServer()

1130

884

1131

for client in clients:

1132

# Emit D-Bus signal

1133

mandos_server.ClientAdded(client.dbus_object_path,

1134

client.GetAllProperties())

885

1135

client.start()

886

1136

887

1137

tcp_server.enable()

906

1156

907

1157

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

908

1158

lambda *args, **kwargs:

909

tcp_server.handle_request\

910

(*args[2:], **kwargs) or True)

1159

(tcp_server.handle_request

1160

(*args[2:], **kwargs) or True))

911

1161

912

1162

logger.debug(u"Starting main loop")

913

main_loop_started = True

914

1163

main_loop.run()

915

1164

except AvahiError, error:

916

1165

logger.critical(u"AvahiError: %s" + unicode(error))