/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

merge

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
 
14
# Copyright © 2008 Teddy Hogeborn
 
15
# Copyright © 2008 Björn Påhlsson
15
16
# 
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
30
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
32
# 
32
33
 
33
 
from __future__ import division
 
34
from __future__ import division, with_statement, absolute_import
34
35
 
35
36
import SocketServer
36
37
import socket
55
56
import logging
56
57
import logging.handlers
57
58
import pwd
 
59
from contextlib import closing
58
60
 
59
61
import dbus
 
62
import dbus.service
60
63
import gobject
61
64
import avahi
62
65
from dbus.mainloop.glib import DBusGMainLoop
63
66
import ctypes
64
67
import ctypes.util
65
68
 
66
 
version = "1.0"
 
69
version = "1.0.2"
67
70
 
68
71
logger = logging.Logger('mandos')
69
 
syslogger = logging.handlers.SysLogHandler\
70
 
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
 
             address = "/dev/log")
72
 
syslogger.setFormatter(logging.Formatter\
73
 
                        ('Mandos: %(levelname)s: %(message)s'))
 
72
syslogger = (logging.handlers.SysLogHandler
 
73
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
74
              address = "/dev/log"))
 
75
syslogger.setFormatter(logging.Formatter
 
76
                       ('Mandos: %(levelname)s: %(message)s'))
74
77
logger.addHandler(syslogger)
75
78
 
76
79
console = logging.StreamHandler()
109
112
                  a sensible number of times
110
113
    """
111
114
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
112
 
                 servicetype = None, port = None, TXT = None, domain = "",
113
 
                 host = "", max_renames = 32768):
 
115
                 servicetype = None, port = None, TXT = None,
 
116
                 domain = "", host = "", max_renames = 32768):
114
117
        self.interface = interface
115
118
        self.name = name
116
119
        self.type = servicetype
117
120
        self.port = port
118
 
        if TXT is None:
119
 
            self.TXT = []
120
 
        else:
121
 
            self.TXT = TXT
 
121
        self.TXT = TXT if TXT is not None else []
122
122
        self.domain = domain
123
123
        self.host = host
124
124
        self.rename_count = 0
133
133
        self.name = server.GetAlternativeServiceName(self.name)
134
134
        logger.info(u"Changing Zeroconf service name to %r ...",
135
135
                    str(self.name))
136
 
        syslogger.setFormatter(logging.Formatter\
 
136
        syslogger.setFormatter(logging.Formatter
137
137
                               ('Mandos (%s): %%(levelname)s:'
138
 
                               ' %%(message)s' % self.name))
 
138
                                ' %%(message)s' % self.name))
139
139
        self.remove()
140
140
        self.add()
141
141
        self.rename_count += 1
147
147
        """Derived from the Avahi example code"""
148
148
        global group
149
149
        if group is None:
150
 
            group = dbus.Interface\
151
 
                    (bus.get_object(avahi.DBUS_NAME,
 
150
            group = dbus.Interface(bus.get_object
 
151
                                   (avahi.DBUS_NAME,
152
152
                                    server.EntryGroupNew()),
153
 
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
153
                                   avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
154
            group.connect_to_signal('StateChanged',
155
155
                                    entry_group_state_changed)
156
156
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
170
170
# End of Avahi example code
171
171
 
172
172
 
173
 
class Client(object):
 
173
def _datetime_to_dbus_struct(dt, variant_level=0):
 
174
    """Convert a UTC datetime.datetime() to a D-Bus struct.
 
175
    The format is special to this application, since we could not find
 
176
    any other standard way."""
 
177
    return dbus.Struct((dbus.Int16(dt.year),
 
178
                        dbus.Byte(dt.month),
 
179
                        dbus.Byte(dt.day),
 
180
                        dbus.Byte(dt.hour),
 
181
                        dbus.Byte(dt.minute),
 
182
                        dbus.Byte(dt.second),
 
183
                        dbus.UInt32(dt.microsecond)),
 
184
                       signature="nyyyyyu",
 
185
                       variant_level=variant_level)
 
186
 
 
187
 
 
188
class Client(dbus.service.Object):
174
189
    """A representation of a client host served by this server.
175
190
    Attributes:
176
 
    name:      string; from the config file, used in log messages
 
191
    name:       string; from the config file, used in log messages
177
192
    fingerprint: string (40 or 32 hexadecimal digits); used to
178
193
                 uniquely identify the client
179
 
    secret:    bytestring; sent verbatim (over TLS) to client
180
 
    host:      string; available for use by the checker command
181
 
    created:   datetime.datetime(); object creation, not client host
182
 
    last_checked_ok: datetime.datetime() or None if not yet checked OK
183
 
    timeout:   datetime.timedelta(); How long from last_checked_ok
184
 
                                     until this client is invalid
185
 
    interval:  datetime.timedelta(); How often to start a new checker
186
 
    stop_hook: If set, called by stop() as stop_hook(self)
187
 
    checker:   subprocess.Popen(); a running checker process used
188
 
                                   to see if the client lives.
189
 
                                   'None' if no process is running.
 
194
    secret:     bytestring; sent verbatim (over TLS) to client
 
195
    host:       string; available for use by the checker command
 
196
    created:    datetime.datetime(); (UTC) object creation
 
197
    last_started: datetime.datetime(); (UTC)
 
198
    started:    bool()
 
199
    last_checked_ok: datetime.datetime(); (UTC) or None
 
200
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
201
                                      until this client is invalid
 
202
    interval:   datetime.timedelta(); How often to start a new checker
 
203
    stop_hook:  If set, called by stop() as stop_hook(self)
 
204
    checker:    subprocess.Popen(); a running checker process used
 
205
                                    to see if the client lives.
 
206
                                    'None' if no process is running.
190
207
    checker_initiator_tag: a gobject event source tag, or None
191
208
    stop_initiator_tag:    - '' -
192
209
    checker_callback_tag:  - '' -
194
211
                     client lives.  %() expansions are done at
195
212
                     runtime with vars(self) as dict, so that for
196
213
                     instance %(name)s can be used in the command.
 
214
    dbus_object_path: dbus.ObjectPath
197
215
    Private attibutes:
198
216
    _timeout: Real variable for 'timeout'
199
217
    _interval: Real variable for 'interval'
201
219
    _interval_milliseconds: - '' -
202
220
    """
203
221
    def _set_timeout(self, timeout):
204
 
        "Setter function for 'timeout' attribute"
 
222
        "Setter function for the 'timeout' attribute"
205
223
        self._timeout = timeout
206
224
        self._timeout_milliseconds = ((self.timeout.days
207
225
                                       * 24 * 60 * 60 * 1000)
208
226
                                      + (self.timeout.seconds * 1000)
209
227
                                      + (self.timeout.microseconds
210
228
                                         // 1000))
211
 
    timeout = property(lambda self: self._timeout,
212
 
                       _set_timeout)
 
229
        # Emit D-Bus signal
 
230
        self.PropertyChanged(dbus.String(u"timeout"),
 
231
                             (dbus.UInt64(self._timeout_milliseconds,
 
232
                                          variant_level=1)))
 
233
    timeout = property(lambda self: self._timeout, _set_timeout)
213
234
    del _set_timeout
 
235
    
214
236
    def _set_interval(self, interval):
215
 
        "Setter function for 'interval' attribute"
 
237
        "Setter function for the 'interval' attribute"
216
238
        self._interval = interval
217
239
        self._interval_milliseconds = ((self.interval.days
218
240
                                        * 24 * 60 * 60 * 1000)
220
242
                                          * 1000)
221
243
                                       + (self.interval.microseconds
222
244
                                          // 1000))
223
 
    interval = property(lambda self: self._interval,
224
 
                        _set_interval)
 
245
        # Emit D-Bus signal
 
246
        self.PropertyChanged(dbus.String(u"interval"),
 
247
                             (dbus.UInt64(self._interval_milliseconds,
 
248
                                          variant_level=1)))
 
249
    interval = property(lambda self: self._interval, _set_interval)
225
250
    del _set_interval
 
251
    
226
252
    def __init__(self, name = None, stop_hook=None, config=None):
227
253
        """Note: the 'checker' key in 'config' sets the
228
254
        'checker_command' attribute and *not* the 'checker'
229
255
        attribute."""
 
256
        self.dbus_object_path = (dbus.ObjectPath
 
257
                                 ("/Mandos/clients/"
 
258
                                  + name.replace(".", "_")))
 
259
        dbus.service.Object.__init__(self, bus,
 
260
                                     self.dbus_object_path)
230
261
        if config is None:
231
262
            config = {}
232
263
        self.name = name
234
265
        # Uppercase and remove spaces from fingerprint for later
235
266
        # comparison purposes with return value from the fingerprint()
236
267
        # function
237
 
        self.fingerprint = config["fingerprint"].upper()\
238
 
                           .replace(u" ", u"")
 
268
        self.fingerprint = (config["fingerprint"].upper()
 
269
                            .replace(u" ", u""))
239
270
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
240
271
        if "secret" in config:
241
272
            self.secret = config["secret"].decode(u"base64")
242
273
        elif "secfile" in config:
243
 
            secfile = open(os.path.expanduser(os.path.expandvars
244
 
                                              (config["secfile"])))
245
 
            self.secret = secfile.read()
246
 
            secfile.close()
 
274
            with closing(open(os.path.expanduser
 
275
                              (os.path.expandvars
 
276
                               (config["secfile"])))) as secfile:
 
277
                self.secret = secfile.read()
247
278
        else:
248
279
            raise TypeError(u"No secret or secfile for client %s"
249
280
                            % self.name)
250
281
        self.host = config.get("host", "")
251
 
        self.created = datetime.datetime.now()
 
282
        self.created = datetime.datetime.utcnow()
 
283
        self.started = False
 
284
        self.last_started = None
252
285
        self.last_checked_ok = None
253
286
        self.timeout = string_to_delta(config["timeout"])
254
287
        self.interval = string_to_delta(config["interval"])
257
290
        self.checker_initiator_tag = None
258
291
        self.stop_initiator_tag = None
259
292
        self.checker_callback_tag = None
260
 
        self.check_command = config["checker"]
 
293
        self.checker_command = config["checker"]
 
294
    
261
295
    def start(self):
262
296
        """Start this client's checker and timeout hooks"""
 
297
        self.last_started = datetime.datetime.utcnow()
263
298
        # Schedule a new checker to be started an 'interval' from now,
264
299
        # and every interval from then on.
265
 
        self.checker_initiator_tag = gobject.timeout_add\
266
 
                                     (self._interval_milliseconds,
267
 
                                      self.start_checker)
 
300
        self.checker_initiator_tag = (gobject.timeout_add
 
301
                                      (self._interval_milliseconds,
 
302
                                       self.start_checker))
268
303
        # Also start a new checker *right now*.
269
304
        self.start_checker()
270
305
        # Schedule a stop() when 'timeout' has passed
271
 
        self.stop_initiator_tag = gobject.timeout_add\
272
 
                                  (self._timeout_milliseconds,
273
 
                                   self.stop)
 
306
        self.stop_initiator_tag = (gobject.timeout_add
 
307
                                   (self._timeout_milliseconds,
 
308
                                    self.stop))
 
309
        self.started = True
 
310
        # Emit D-Bus signal
 
311
        self.PropertyChanged(dbus.String(u"started"),
 
312
                             dbus.Boolean(True, variant_level=1))
 
313
        self.PropertyChanged(dbus.String(u"last_started"),
 
314
                             (_datetime_to_dbus_struct
 
315
                              (self.last_started, variant_level=1)))
 
316
    
274
317
    def stop(self):
275
 
        """Stop this client.
276
 
        The possibility that a client might be restarted is left open,
277
 
        but not currently used."""
278
 
        # If this client doesn't have a secret, it is already stopped.
279
 
        if hasattr(self, "secret") and self.secret:
280
 
            logger.info(u"Stopping client %s", self.name)
281
 
            self.secret = None
282
 
        else:
 
318
        """Stop this client."""
 
319
        if not getattr(self, "started", False):
283
320
            return False
 
321
        logger.info(u"Stopping client %s", self.name)
284
322
        if getattr(self, "stop_initiator_tag", False):
285
323
            gobject.source_remove(self.stop_initiator_tag)
286
324
            self.stop_initiator_tag = None
290
328
        self.stop_checker()
291
329
        if self.stop_hook:
292
330
            self.stop_hook(self)
 
331
        self.started = False
 
332
        # Emit D-Bus signal
 
333
        self.PropertyChanged(dbus.String(u"started"),
 
334
                             dbus.Boolean(False, variant_level=1))
293
335
        # Do not run this again if called by a gobject.timeout_add
294
336
        return False
 
337
    
295
338
    def __del__(self):
296
339
        self.stop_hook = None
297
340
        self.stop()
298
 
    def checker_callback(self, pid, condition):
 
341
    
 
342
    def checker_callback(self, pid, condition, command):
299
343
        """The checker has completed, so take appropriate actions."""
300
 
        now = datetime.datetime.now()
301
344
        self.checker_callback_tag = None
302
345
        self.checker = None
303
 
        if os.WIFEXITED(condition) \
304
 
               and (os.WEXITSTATUS(condition) == 0):
 
346
        # Emit D-Bus signal
 
347
        self.PropertyChanged(dbus.String(u"checker_running"),
 
348
                             dbus.Boolean(False, variant_level=1))
 
349
        if (os.WIFEXITED(condition)
 
350
            and (os.WEXITSTATUS(condition) == 0)):
305
351
            logger.info(u"Checker for %(name)s succeeded",
306
352
                        vars(self))
307
 
            self.last_checked_ok = now
308
 
            gobject.source_remove(self.stop_initiator_tag)
309
 
            self.stop_initiator_tag = gobject.timeout_add\
310
 
                                      (self._timeout_milliseconds,
311
 
                                       self.stop)
 
353
            # Emit D-Bus signal
 
354
            self.CheckerCompleted(dbus.Boolean(True),
 
355
                                  dbus.UInt16(condition),
 
356
                                  dbus.String(command))
 
357
            self.bump_timeout()
312
358
        elif not os.WIFEXITED(condition):
313
359
            logger.warning(u"Checker for %(name)s crashed?",
314
360
                           vars(self))
 
361
            # Emit D-Bus signal
 
362
            self.CheckerCompleted(dbus.Boolean(False),
 
363
                                  dbus.UInt16(condition),
 
364
                                  dbus.String(command))
315
365
        else:
316
366
            logger.info(u"Checker for %(name)s failed",
317
367
                        vars(self))
 
368
            # Emit D-Bus signal
 
369
            self.CheckerCompleted(dbus.Boolean(False),
 
370
                                  dbus.UInt16(condition),
 
371
                                  dbus.String(command))
 
372
    
 
373
    def bump_timeout(self):
 
374
        """Bump up the timeout for this client.
 
375
        This should only be called when the client has been seen,
 
376
        alive and well.
 
377
        """
 
378
        self.last_checked_ok = datetime.datetime.utcnow()
 
379
        gobject.source_remove(self.stop_initiator_tag)
 
380
        self.stop_initiator_tag = (gobject.timeout_add
 
381
                                   (self._timeout_milliseconds,
 
382
                                    self.stop))
 
383
        self.PropertyChanged(dbus.String(u"last_checked_ok"),
 
384
                             (_datetime_to_dbus_struct
 
385
                              (self.last_checked_ok,
 
386
                               variant_level=1)))
 
387
    
318
388
    def start_checker(self):
319
389
        """Start a new checker subprocess if one is not running.
320
390
        If a checker already exists, leave it running and do
329
399
        # is as it should be.
330
400
        if self.checker is None:
331
401
            try:
332
 
                # In case check_command has exactly one % operator
333
 
                command = self.check_command % self.host
 
402
                # In case checker_command has exactly one % operator
 
403
                command = self.checker_command % self.host
334
404
            except TypeError:
335
405
                # Escape attributes for the shell
336
406
                escaped_attrs = dict((key, re.escape(str(val)))
337
407
                                     for key, val in
338
408
                                     vars(self).iteritems())
339
409
                try:
340
 
                    command = self.check_command % escaped_attrs
 
410
                    command = self.checker_command % escaped_attrs
341
411
                except TypeError, error:
342
412
                    logger.error(u'Could not format string "%s":'
343
 
                                 u' %s', self.check_command, error)
 
413
                                 u' %s', self.checker_command, error)
344
414
                    return True # Try again later
345
415
            try:
346
416
                logger.info(u"Starting checker %r for %s",
352
422
                self.checker = subprocess.Popen(command,
353
423
                                                close_fds=True,
354
424
                                                shell=True, cwd="/")
355
 
                self.checker_callback_tag = gobject.child_watch_add\
356
 
                                            (self.checker.pid,
357
 
                                             self.checker_callback)
 
425
                # Emit D-Bus signal
 
426
                self.CheckerStarted(command)
 
427
                self.PropertyChanged(dbus.String("checker_running"),
 
428
                                     dbus.Boolean(True, variant_level=1))
 
429
                self.checker_callback_tag = (gobject.child_watch_add
 
430
                                             (self.checker.pid,
 
431
                                              self.checker_callback,
 
432
                                              data=command))
358
433
            except OSError, error:
359
434
                logger.error(u"Failed to start subprocess: %s",
360
435
                             error)
361
436
        # Re-run this periodically if run by gobject.timeout_add
362
437
        return True
 
438
    
363
439
    def stop_checker(self):
364
440
        """Force the checker process, if any, to stop."""
365
441
        if self.checker_callback_tag:
377
453
            if error.errno != errno.ESRCH: # No such process
378
454
                raise
379
455
        self.checker = None
 
456
        self.PropertyChanged(dbus.String(u"checker_running"),
 
457
                             dbus.Boolean(False, variant_level=1))
 
458
    
380
459
    def still_valid(self):
381
460
        """Has the timeout not yet passed for this client?"""
382
 
        now = datetime.datetime.now()
 
461
        if not getattr(self, "started", False):
 
462
            return False
 
463
        now = datetime.datetime.utcnow()
383
464
        if self.last_checked_ok is None:
384
465
            return now < (self.created + self.timeout)
385
466
        else:
386
467
            return now < (self.last_checked_ok + self.timeout)
 
468
    
 
469
    ## D-Bus methods & signals
 
470
    _interface = u"org.mandos_system.Mandos.Client"
 
471
    
 
472
    # BumpTimeout - method
 
473
    BumpTimeout = dbus.service.method(_interface)(bump_timeout)
 
474
    BumpTimeout.__name__ = "BumpTimeout"
 
475
    
 
476
    # CheckerCompleted - signal
 
477
    @dbus.service.signal(_interface, signature="bqs")
 
478
    def CheckerCompleted(self, success, condition, command):
 
479
        "D-Bus signal"
 
480
        pass
 
481
    
 
482
    # CheckerStarted - signal
 
483
    @dbus.service.signal(_interface, signature="s")
 
484
    def CheckerStarted(self, command):
 
485
        "D-Bus signal"
 
486
        pass
 
487
    
 
488
    # GetAllProperties - method
 
489
    @dbus.service.method(_interface, out_signature="a{sv}")
 
490
    def GetAllProperties(self):
 
491
        "D-Bus method"
 
492
        return dbus.Dictionary({
 
493
                dbus.String("name"):
 
494
                    dbus.String(self.name, variant_level=1),
 
495
                dbus.String("fingerprint"):
 
496
                    dbus.String(self.fingerprint, variant_level=1),
 
497
                dbus.String("host"):
 
498
                    dbus.String(self.host, variant_level=1),
 
499
                dbus.String("created"):
 
500
                    _datetime_to_dbus_struct(self.created,
 
501
                                             variant_level=1),
 
502
                dbus.String("last_started"):
 
503
                    (_datetime_to_dbus_struct(self.last_started,
 
504
                                              variant_level=1)
 
505
                     if self.last_started is not None
 
506
                     else dbus.Boolean(False, variant_level=1)),
 
507
                dbus.String("started"):
 
508
                    dbus.Boolean(self.started, variant_level=1),
 
509
                dbus.String("last_checked_ok"):
 
510
                    (_datetime_to_dbus_struct(self.last_checked_ok,
 
511
                                              variant_level=1)
 
512
                     if self.last_checked_ok is not None
 
513
                     else dbus.Boolean (False, variant_level=1)),
 
514
                dbus.String("timeout"):
 
515
                    dbus.UInt64(self._timeout_milliseconds,
 
516
                                variant_level=1),
 
517
                dbus.String("interval"):
 
518
                    dbus.UInt64(self._interval_milliseconds,
 
519
                                variant_level=1),
 
520
                dbus.String("checker"):
 
521
                    dbus.String(self.checker_command,
 
522
                                variant_level=1),
 
523
                dbus.String("checker_running"):
 
524
                    dbus.Boolean(self.checker is not None,
 
525
                                 variant_level=1),
 
526
                }, signature="sv")
 
527
    
 
528
    # IsStillValid - method
 
529
    IsStillValid = (dbus.service.method(_interface, out_signature="b")
 
530
                    (still_valid))
 
531
    IsStillValid.__name__ = "IsStillValid"
 
532
    
 
533
    # PropertyChanged - signal
 
534
    @dbus.service.signal(_interface, signature="sv")
 
535
    def PropertyChanged(self, property, value):
 
536
        "D-Bus signal"
 
537
        pass
 
538
    
 
539
    # SetChecker - method
 
540
    @dbus.service.method(_interface, in_signature="s")
 
541
    def SetChecker(self, checker):
 
542
        "D-Bus setter method"
 
543
        self.checker_command = checker
 
544
    
 
545
    # SetHost - method
 
546
    @dbus.service.method(_interface, in_signature="s")
 
547
    def SetHost(self, host):
 
548
        "D-Bus setter method"
 
549
        self.host = host
 
550
    
 
551
    # SetInterval - method
 
552
    @dbus.service.method(_interface, in_signature="t")
 
553
    def SetInterval(self, milliseconds):
 
554
        self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
 
555
    
 
556
    # SetSecret - method
 
557
    @dbus.service.method(_interface, in_signature="ay",
 
558
                         byte_arrays=True)
 
559
    def SetSecret(self, secret):
 
560
        "D-Bus setter method"
 
561
        self.secret = str(secret)
 
562
    
 
563
    # SetTimeout - method
 
564
    @dbus.service.method(_interface, in_signature="t")
 
565
    def SetTimeout(self, milliseconds):
 
566
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
 
567
    
 
568
    # Start - method
 
569
    Start = dbus.service.method(_interface)(start)
 
570
    Start.__name__ = "Start"
 
571
    
 
572
    # StartChecker - method
 
573
    @dbus.service.method(_interface)
 
574
    def StartChecker(self):
 
575
        "D-Bus method"
 
576
        self.start_checker()
 
577
    
 
578
    # Stop - method
 
579
    @dbus.service.method(_interface)
 
580
    def Stop(self):
 
581
        "D-Bus method"
 
582
        self.stop()
 
583
    
 
584
    # StopChecker - method
 
585
    StopChecker = dbus.service.method(_interface)(stop_checker)
 
586
    StopChecker.__name__ = "StopChecker"
 
587
    
 
588
    del _interface
387
589
 
388
590
 
389
591
def peer_certificate(session):
390
592
    "Return the peer's OpenPGP certificate as a bytestring"
391
593
    # If not an OpenPGP certificate...
392
 
    if gnutls.library.functions.gnutls_certificate_type_get\
393
 
            (session._c_object) \
394
 
           != gnutls.library.constants.GNUTLS_CRT_OPENPGP:
 
594
    if (gnutls.library.functions
 
595
        .gnutls_certificate_type_get(session._c_object)
 
596
        != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
395
597
        # ...do the normal thing
396
598
        return session.peer_certificate
397
599
    list_size = ctypes.c_uint()
398
 
    cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
399
 
        (session._c_object, ctypes.byref(list_size))
 
600
    cert_list = (gnutls.library.functions
 
601
                 .gnutls_certificate_get_peers
 
602
                 (session._c_object, ctypes.byref(list_size)))
400
603
    if list_size.value == 0:
401
604
        return None
402
605
    cert = cert_list[0]
406
609
def fingerprint(openpgp):
407
610
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
408
611
    # New GnuTLS "datum" with the OpenPGP public key
409
 
    datum = gnutls.library.types.gnutls_datum_t\
410
 
        (ctypes.cast(ctypes.c_char_p(openpgp),
411
 
                     ctypes.POINTER(ctypes.c_ubyte)),
412
 
         ctypes.c_uint(len(openpgp)))
 
612
    datum = (gnutls.library.types
 
613
             .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
614
                                         ctypes.POINTER
 
615
                                         (ctypes.c_ubyte)),
 
616
                             ctypes.c_uint(len(openpgp))))
413
617
    # New empty GnuTLS certificate
414
618
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
415
 
    gnutls.library.functions.gnutls_openpgp_crt_init\
416
 
        (ctypes.byref(crt))
 
619
    (gnutls.library.functions
 
620
     .gnutls_openpgp_crt_init(ctypes.byref(crt)))
417
621
    # Import the OpenPGP public key into the certificate
418
 
    gnutls.library.functions.gnutls_openpgp_crt_import\
419
 
                    (crt, ctypes.byref(datum),
420
 
                     gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
622
    (gnutls.library.functions
 
623
     .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
624
                                gnutls.library.constants
 
625
                                .GNUTLS_OPENPGP_FMT_RAW))
421
626
    # Verify the self signature in the key
422
627
    crtverify = ctypes.c_uint()
423
 
    gnutls.library.functions.gnutls_openpgp_crt_verify_self\
424
 
        (crt, 0, ctypes.byref(crtverify))
 
628
    (gnutls.library.functions
 
629
     .gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
425
630
    if crtverify.value != 0:
426
631
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
427
632
        raise gnutls.errors.CertificateSecurityError("Verify failed")
429
634
    buf = ctypes.create_string_buffer(20)
430
635
    buf_len = ctypes.c_size_t()
431
636
    # Get the fingerprint from the certificate into the buffer
432
 
    gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
433
 
        (crt, ctypes.byref(buf), ctypes.byref(buf_len))
 
637
    (gnutls.library.functions
 
638
     .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
639
                                         ctypes.byref(buf_len)))
434
640
    # Deinit the certificate
435
641
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
436
642
    # Convert the buffer to a Python bytestring
447
653
    
448
654
    def handle(self):
449
655
        logger.info(u"TCP connection from: %s",
450
 
                     unicode(self.client_address))
451
 
        session = gnutls.connection.ClientSession\
452
 
                  (self.request, gnutls.connection.X509Credentials())
 
656
                    unicode(self.client_address))
 
657
        session = (gnutls.connection
 
658
                   .ClientSession(self.request,
 
659
                                  gnutls.connection
 
660
                                  .X509Credentials()))
453
661
        
454
662
        line = self.request.makefile().readline()
455
663
        logger.debug(u"Protocol version: %r", line)
468
676
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
469
677
        #                "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
470
678
        #                "+DHE-DSS"))
471
 
        priority = "NORMAL"             # Fallback default, since this
472
 
                                        # MUST be set.
473
 
        if self.server.settings["priority"]:
474
 
            priority = self.server.settings["priority"]
475
 
        gnutls.library.functions.gnutls_priority_set_direct\
476
 
            (session._c_object, priority, None)
 
679
        # Use a fallback default, since this MUST be set.
 
680
        priority = self.server.settings.get("priority", "NORMAL")
 
681
        (gnutls.library.functions
 
682
         .gnutls_priority_set_direct(session._c_object,
 
683
                                     priority, None))
477
684
        
478
685
        try:
479
686
            session.handshake()
489
696
            session.bye()
490
697
            return
491
698
        logger.debug(u"Fingerprint: %s", fpr)
492
 
        client = None
493
699
        for c in self.server.clients:
494
700
            if c.fingerprint == fpr:
495
701
                client = c
496
702
                break
497
 
        if not client:
 
703
        else:
498
704
            logger.warning(u"Client not found for fingerprint: %s",
499
705
                           fpr)
500
706
            session.bye()
507
713
                           vars(client))
508
714
            session.bye()
509
715
            return
 
716
        ## This won't work here, since we're in a fork.
 
717
        # client.bump_timeout()
510
718
        sent_size = 0
511
719
        while sent_size < len(client.secret):
512
720
            sent = session.send(client.secret[sent_size:])
517
725
        session.bye()
518
726
 
519
727
 
520
 
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
 
728
class IPv6_TCPServer(SocketServer.ForkingMixIn,
 
729
                     SocketServer.TCPServer, object):
521
730
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
522
731
    Attributes:
523
732
        settings:       Server settings
642
851
    """Call the C function if_nametoindex(), or equivalent"""
643
852
    global if_nametoindex
644
853
    try:
645
 
        if_nametoindex = ctypes.cdll.LoadLibrary\
646
 
            (ctypes.util.find_library("c")).if_nametoindex
 
854
        if_nametoindex = (ctypes.cdll.LoadLibrary
 
855
                          (ctypes.util.find_library("c"))
 
856
                          .if_nametoindex)
647
857
    except (OSError, AttributeError):
648
858
        if "struct" not in sys.modules:
649
859
            import struct
652
862
        def if_nametoindex(interface):
653
863
            "Get an interface index the hard way, i.e. using fcntl()"
654
864
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
655
 
            s = socket.socket()
656
 
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
657
 
                                struct.pack("16s16x", interface))
658
 
            s.close()
 
865
            with closing(socket.socket()) as s:
 
866
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
867
                                    struct.pack("16s16x", interface))
659
868
            interface_index = struct.unpack("I", ifreq[16:20])[0]
660
869
            return interface_index
661
870
    return if_nametoindex(interface)
729
938
    # Convert the SafeConfigParser object to a dict
730
939
    server_settings = server_config.defaults()
731
940
    # Use getboolean on the boolean config option
732
 
    server_settings["debug"] = server_config.getboolean\
733
 
                               ("DEFAULT", "debug")
 
941
    server_settings["debug"] = (server_config.getboolean
 
942
                                ("DEFAULT", "debug"))
734
943
    del server_config
735
944
    
736
945
    # Override the settings from the config file with command line
750
959
        console.setLevel(logging.WARNING)
751
960
    
752
961
    if server_settings["servicename"] != "Mandos":
753
 
        syslogger.setFormatter(logging.Formatter\
 
962
        syslogger.setFormatter(logging.Formatter
754
963
                               ('Mandos (%s): %%(levelname)s:'
755
964
                                ' %%(message)s'
756
965
                                % server_settings["servicename"]))
777
986
    except IOError, error:
778
987
        logger.error("Could not open file %r", pidfilename)
779
988
    
780
 
    uid = 65534
781
 
    gid = 65534
782
 
    try:
783
 
        uid = pwd.getpwnam("mandos").pw_uid
784
 
    except KeyError:
785
 
        try:
786
 
            uid = pwd.getpwnam("nobody").pw_uid
787
 
        except KeyError:
788
 
            pass
789
 
    try:
790
 
        gid = pwd.getpwnam("mandos").pw_gid
791
 
    except KeyError:
792
 
        try:
793
 
            gid = pwd.getpwnam("nogroup").pw_gid
794
 
        except KeyError:
795
 
            pass
 
989
    try:
 
990
        uid = pwd.getpwnam("_mandos").pw_uid
 
991
    except KeyError:
 
992
        try:
 
993
            uid = pwd.getpwnam("mandos").pw_uid
 
994
        except KeyError:
 
995
            try:
 
996
                uid = pwd.getpwnam("nobody").pw_uid
 
997
            except KeyError:
 
998
                uid = 65534
 
999
    try:
 
1000
        gid = pwd.getpwnam("_mandos").pw_gid
 
1001
    except KeyError:
 
1002
        try:
 
1003
            gid = pwd.getpwnam("mandos").pw_gid
 
1004
        except KeyError:
 
1005
            try:
 
1006
                gid = pwd.getpwnam("nogroup").pw_gid
 
1007
            except KeyError:
 
1008
                gid = 65534
796
1009
    try:
797
1010
        os.setuid(uid)
798
1011
        os.setgid(gid)
804
1017
    service = AvahiService(name = server_settings["servicename"],
805
1018
                           servicetype = "_mandos._tcp", )
806
1019
    if server_settings["interface"]:
807
 
        service.interface = if_nametoindex\
808
 
                            (server_settings["interface"])
 
1020
        service.interface = (if_nametoindex
 
1021
                             (server_settings["interface"]))
809
1022
    
810
1023
    global main_loop
811
1024
    global bus
818
1031
                                           avahi.DBUS_PATH_SERVER),
819
1032
                            avahi.DBUS_INTERFACE_SERVER)
820
1033
    # End of Avahi example code
821
 
    
822
 
    def remove_from_clients(client):
823
 
        clients.remove(client)
824
 
        if not clients:
825
 
            logger.critical(u"No clients left, exiting")
826
 
            sys.exit()
 
1034
    bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
827
1035
    
828
1036
    clients.update(Set(Client(name = section,
829
 
                              stop_hook = remove_from_clients,
830
1037
                              config
831
1038
                              = dict(client_config.items(section)))
832
1039
                       for section in client_config.sections()))
880
1087
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
881
1088
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
882
1089
    
 
1090
    class MandosServer(dbus.service.Object):
 
1091
        """A D-Bus proxy object"""
 
1092
        def __init__(self):
 
1093
            dbus.service.Object.__init__(self, bus,
 
1094
                                         "/Mandos")
 
1095
        _interface = u"org.mandos_system.Mandos"
 
1096
        
 
1097
        @dbus.service.signal(_interface, signature="oa{sv}")
 
1098
        def ClientAdded(self, objpath, properties):
 
1099
            "D-Bus signal"
 
1100
            pass
 
1101
        
 
1102
        @dbus.service.signal(_interface, signature="o")
 
1103
        def ClientRemoved(self, objpath):
 
1104
            "D-Bus signal"
 
1105
            pass
 
1106
        
 
1107
        @dbus.service.method(_interface, out_signature="ao")
 
1108
        def GetAllClients(self):
 
1109
            return dbus.Array(c.dbus_object_path for c in clients)
 
1110
        
 
1111
        @dbus.service.method(_interface, out_signature="a{oa{sv}}")
 
1112
        def GetAllClientsWithProperties(self):
 
1113
            return dbus.Dictionary(
 
1114
                ((c.dbus_object_path, c.GetAllProperties())
 
1115
                 for c in clients),
 
1116
                signature="oa{sv}")
 
1117
        
 
1118
        @dbus.service.method(_interface, in_signature="o")
 
1119
        def RemoveClient(self, object_path):
 
1120
            for c in clients:
 
1121
                if c.dbus_object_path == object_path:
 
1122
                    c.stop()
 
1123
                    clients.remove(c)
 
1124
                    return
 
1125
            raise KeyError
 
1126
        
 
1127
        del _interface
 
1128
    
 
1129
    mandos_server = MandosServer()
 
1130
    
883
1131
    for client in clients:
 
1132
        # Emit D-Bus signal
 
1133
        mandos_server.ClientAdded(client.dbus_object_path,
 
1134
                                  client.GetAllProperties())
884
1135
        client.start()
885
1136
    
886
1137
    tcp_server.enable()
905
1156
        
906
1157
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
907
1158
                             lambda *args, **kwargs:
908
 
                             tcp_server.handle_request\
909
 
                             (*args[2:], **kwargs) or True)
 
1159
                             (tcp_server.handle_request
 
1160
                              (*args[2:], **kwargs) or True))
910
1161
        
911
1162
        logger.debug(u"Starting main loop")
912
1163
        main_loop.run()