/mandos/release : revision 24.1.114

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

16

#

16

17

# This program is free software: you can redistribute it and/or modify

17

18

# it under the terms of the GNU General Public License as published by

24

25

# GNU General Public License for more details.

25

26

#

26

27

# You should have received a copy of the GNU General Public License

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

28

30

#

29

31

# Contact the authors at <mandos@fukt.bsnet.se>.

30

32

#

31

33

32

from __future__ import division

34

from __future__ import division, with_statement, absolute_import

33

35

34

36

import SocketServer

35

37

import socket

36

import select

37

38

from optparse import OptionParser

38

39

import datetime

39

40

import errno

54

55

import stat

55

56

import logging

56

57

import logging.handlers

58

import pwd

59

from contextlib import closing

57

60

58

61

import dbus

62

import dbus.service

59

63

import gobject

60

64

import avahi

61

65

from dbus.mainloop.glib import DBusGMainLoop

62

66

import ctypes

67

import ctypes.util

63

68

64

version = "1.0"

69

version = "1.0.2"

65

70

66

71

logger = logging.Logger('mandos')

67

syslogger = logging.handlers.SysLogHandler\

68

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

69

address = "/dev/log")

70

syslogger.setFormatter(logging.Formatter\

71

('Mandos: %(levelname)s: %(message)s'))

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos: %(levelname)s: %(message)s'))

72

77

logger.addHandler(syslogger)

73

78

74

79

console = logging.StreamHandler()

79

84

class AvahiError(Exception):

80

85

def __init__(self, value):

81

86

self.value = value

87

super(AvahiError, self).__init__()

82

88

def __str__(self):

83

89

return repr(self.value)

84

90

106

112

a sensible number of times

107

113

"""

108

114

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

109

type = None, port = None, TXT = None, domain = "",

110

host = "", max_renames = 32768):

115

servicetype = None, port = None, TXT = None,

116

domain = "", host = "", max_renames = 32768):

111

117

self.interface = interface

112

118

self.name = name

113

self.type = type

119

self.type = servicetype

114

120

self.port = port

115

if TXT is None:

116

self.TXT = []

117

else:

118

self.TXT = TXT

121

self.TXT = TXT if TXT is not None else []

119

122

self.domain = domain

120

123

self.host = host

121

124

self.rename_count = 0

123

126

def rename(self):

124

127

"""Derived from the Avahi example code"""

125

128

if self.rename_count >= self.max_renames:

126

logger.critical(u"No suitable service name found after %i"

127

u" retries, exiting.", rename_count)

129

logger.critical(u"No suitable Zeroconf service name found"

130

u" after %i retries, exiting.",

131

self.rename_count)

128

132

raise AvahiServiceError("Too many renames")

129

133

self.name = server.GetAlternativeServiceName(self.name)

130

logger.info(u"Changing name to %r ...", str(self.name))

131

syslogger.setFormatter(logging.Formatter\

134

logger.info(u"Changing Zeroconf service name to %r ...",

135

str(self.name))

136

syslogger.setFormatter(logging.Formatter

132

137

('Mandos (%s): %%(levelname)s:'

133

' %%(message)s' % self.name))

138

' %%(message)s' % self.name))

134

139

self.remove()

135

140

self.add()

136

141

self.rename_count += 1

142

147

"""Derived from the Avahi example code"""

143

148

global group

144

149

if group is None:

145

group = dbus.Interface\

146

(bus.get_object(avahi.DBUS_NAME,

150

group = dbus.Interface(bus.get_object

151

(avahi.DBUS_NAME,

147

152

server.EntryGroupNew()),

148

avahi.DBUS_INTERFACE_ENTRY_GROUP)

153

avahi.DBUS_INTERFACE_ENTRY_GROUP)

149

154

group.connect_to_signal('StateChanged',

150

155

entry_group_state_changed)

151

logger.debug(u"Adding service '%s' of type '%s' ...",

156

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

152

157

service.name, service.type)

153

158

group.AddService(

154

159

self.interface, # interface

165

170

# End of Avahi example code

166

171

167

172

168

class Client(object):

173

def _datetime_to_dbus_struct(dt, variant_level=0):

174

"""Convert a UTC datetime.datetime() to a D-Bus struct.

175

The format is special to this application, since we could not find

176

any other standard way."""

177

return dbus.Struct((dbus.Int16(dt.year),

178

dbus.Byte(dt.month),

179

dbus.Byte(dt.day),

180

dbus.Byte(dt.hour),

181

dbus.Byte(dt.minute),

182

dbus.Byte(dt.second),

183

dbus.UInt32(dt.microsecond)),

184

signature="nyyyyyu",

185

variant_level=variant_level)

186

187

188

class Client(dbus.service.Object):

169

189

"""A representation of a client host served by this server.

170

190

Attributes:

171

name: string; from the config file, used in log messages

191

name: string; from the config file, used in log messages

172

192

fingerprint: string (40 or 32 hexadecimal digits); used to

173

193

uniquely identify the client

174

secret: bytestring; sent verbatim (over TLS) to client

175

host: string; available for use by the checker command

176

created: datetime.datetime(); object creation, not client host

177

last_checked_ok: datetime.datetime() or None if not yet checked OK

178

timeout: datetime.timedelta(); How long from last_checked_ok

179

until this client is invalid

180

interval: datetime.timedelta(); How often to start a new checker

181

stop_hook: If set, called by stop() as stop_hook(self)

182

checker: subprocess.Popen(); a running checker process used

183

to see if the client lives.

184

'None' if no process is running.

194

secret: bytestring; sent verbatim (over TLS) to client

195

host: string; available for use by the checker command

196

created: datetime.datetime(); (UTC) object creation

197

last_started: datetime.datetime(); (UTC)

198

started: bool()

199

last_checked_ok: datetime.datetime(); (UTC) or None

200

timeout: datetime.timedelta(); How long from last_checked_ok

201

until this client is invalid

202

interval: datetime.timedelta(); How often to start a new checker

203

stop_hook: If set, called by stop() as stop_hook(self)

204

checker: subprocess.Popen(); a running checker process used

205

to see if the client lives.

206

'None' if no process is running.

185

207

checker_initiator_tag: a gobject event source tag, or None

186

208

stop_initiator_tag: - '' -

187

209

checker_callback_tag: - '' -

189

211

client lives. %() expansions are done at

190

212

runtime with vars(self) as dict, so that for

191

213

instance %(name)s can be used in the command.

214

dbus_object_path: dbus.ObjectPath

192

215

Private attibutes:

193

216

_timeout: Real variable for 'timeout'

194

217

_interval: Real variable for 'interval'

196

219

_interval_milliseconds: - '' -

197

220

"""

198

221

def _set_timeout(self, timeout):

199

"Setter function for 'timeout' attribute"

222

"Setter function for the 'timeout' attribute"

200

223

self._timeout = timeout

201

224

self._timeout_milliseconds = ((self.timeout.days

202

225

* 24 * 60 * 60 * 1000)

203

226

+ (self.timeout.seconds * 1000)

204

227

+ (self.timeout.microseconds

205

228

// 1000))

206

timeout = property(lambda self: self._timeout,

207

_set_timeout)

229

# Emit D-Bus signal

230

self.PropertyChanged(dbus.String(u"timeout"),

231

(dbus.UInt64(self._timeout_milliseconds,

232

variant_level=1)))

233

timeout = property(lambda self: self._timeout, _set_timeout)

208

234

del _set_timeout

235

209

236

def _set_interval(self, interval):

210

"Setter function for 'interval' attribute"

237

"Setter function for the 'interval' attribute"

211

238

self._interval = interval

212

239

self._interval_milliseconds = ((self.interval.days

213

240

* 24 * 60 * 60 * 1000)

215

242

* 1000)

216

243

+ (self.interval.microseconds

217

244

// 1000))

218

interval = property(lambda self: self._interval,

219

_set_interval)

245

# Emit D-Bus signal

246

self.PropertyChanged(dbus.String(u"interval"),

247

(dbus.UInt64(self._interval_milliseconds,

248

variant_level=1)))

249

interval = property(lambda self: self._interval, _set_interval)

220

250

del _set_interval

221

def __init__(self, name = None, stop_hook=None, config={}):

251

252

def __init__(self, name = None, stop_hook=None, config=None):

222

253

"""Note: the 'checker' key in 'config' sets the

223

254

'checker_command' attribute and *not* the 'checker'

224

255

attribute."""

256

self.dbus_object_path = (dbus.ObjectPath

257

("/Mandos/clients/"

258

+ name.replace(".", "_")))

259

dbus.service.Object.__init__(self, bus,

260

self.dbus_object_path)

261

if config is None:

262

config = {}

225

263

self.name = name

226

264

logger.debug(u"Creating client %r", self.name)

227

265

# Uppercase and remove spaces from fingerprint for later

228

266

# comparison purposes with return value from the fingerprint()

229

267

# function

230

self.fingerprint = config["fingerprint"].upper()\

231

.replace(u" ", u"")

268

self.fingerprint = (config["fingerprint"].upper()

269

.replace(u" ", u""))

232

270

logger.debug(u" Fingerprint: %s", self.fingerprint)

233

271

if "secret" in config:

234

272

self.secret = config["secret"].decode(u"base64")

235

273

elif "secfile" in config:

236

sf = open(config["secfile"])

237

self.secret = sf.read()

238

sf.close()

274

with closing(open(os.path.expanduser

275

(os.path.expandvars

276

(config["secfile"])))) as secfile:

277

self.secret = secfile.read()

239

278

else:

240

279

raise TypeError(u"No secret or secfile for client %s"

241

280

% self.name)

242

281

self.host = config.get("host", "")

243

self.created = datetime.datetime.now()

282

self.created = datetime.datetime.utcnow()

283

self.started = False

284

self.last_started = None

244

285

self.last_checked_ok = None

245

286

self.timeout = string_to_delta(config["timeout"])

246

287

self.interval = string_to_delta(config["interval"])

249

290

self.checker_initiator_tag = None

250

291

self.stop_initiator_tag = None

251

292

self.checker_callback_tag = None

252

self.check_command = config["checker"]

293

self.checker_command = config["checker"]

294

253

295

def start(self):

254

296

"""Start this client's checker and timeout hooks"""

297

self.last_started = datetime.datetime.utcnow()

255

298

# Schedule a new checker to be started an 'interval' from now,

256

299

# and every interval from then on.

257

self.checker_initiator_tag = gobject.timeout_add\

258

(self._interval_milliseconds,

259

self.start_checker)

300

self.checker_initiator_tag = (gobject.timeout_add

301

(self._interval_milliseconds,

302

self.start_checker))

260

303

# Also start a new checker *right now*.

261

304

self.start_checker()

262

305

# Schedule a stop() when 'timeout' has passed

263

self.stop_initiator_tag = gobject.timeout_add\

264

(self._timeout_milliseconds,

265

self.stop)

306

self.stop_initiator_tag = (gobject.timeout_add

307

(self._timeout_milliseconds,

308

self.stop))

309

self.started = True

310

# Emit D-Bus signal

311

self.PropertyChanged(dbus.String(u"started"),

312

dbus.Boolean(True, variant_level=1))

313

self.PropertyChanged(dbus.String(u"last_started"),

314

(_datetime_to_dbus_struct

315

(self.last_started, variant_level=1)))

316

266

317

def stop(self):

267

"""Stop this client.

268

The possibility that a client might be restarted is left open,

269

but not currently used."""

270

# If this client doesn't have a secret, it is already stopped.

271

if hasattr(self, "secret") and self.secret:

272

logger.info(u"Stopping client %s", self.name)

273

self.secret = None

274

else:

318

"""Stop this client."""

319

if not getattr(self, "started", False):

275

320

return False

321

logger.info(u"Stopping client %s", self.name)

276

322

if getattr(self, "stop_initiator_tag", False):

277

323

gobject.source_remove(self.stop_initiator_tag)

278

324

self.stop_initiator_tag = None

282

328

self.stop_checker()

283

329

if self.stop_hook:

284

330

self.stop_hook(self)

331

self.started = False

332

# Emit D-Bus signal

333

self.PropertyChanged(dbus.String(u"started"),

334

dbus.Boolean(False, variant_level=1))

285

335

# Do not run this again if called by a gobject.timeout_add

286

336

return False

337

287

338

def __del__(self):

288

339

self.stop_hook = None

289

340

self.stop()

290

def checker_callback(self, pid, condition):

341

342

def checker_callback(self, pid, condition, command):

291

343

"""The checker has completed, so take appropriate actions."""

292

now = datetime.datetime.now()

293

344

self.checker_callback_tag = None

294

345

self.checker = None

295

if os.WIFEXITED(condition) \

296

and (os.WEXITSTATUS(condition) == 0):

346

# Emit D-Bus signal

347

self.PropertyChanged(dbus.String(u"checker_running"),

348

dbus.Boolean(False, variant_level=1))

349

if (os.WIFEXITED(condition)

350

and (os.WEXITSTATUS(condition) == 0)):

297

351

logger.info(u"Checker for %(name)s succeeded",

298

352

vars(self))

299

self.last_checked_ok = now

300

gobject.source_remove(self.stop_initiator_tag)

301

self.stop_initiator_tag = gobject.timeout_add\

302

(self._timeout_milliseconds,

303

self.stop)

353

# Emit D-Bus signal

354

self.CheckerCompleted(dbus.Boolean(True),

355

dbus.UInt16(condition),

356

dbus.String(command))

357

self.bump_timeout()

304

358

elif not os.WIFEXITED(condition):

305

359

logger.warning(u"Checker for %(name)s crashed?",

306

360

vars(self))

361

# Emit D-Bus signal

362

self.CheckerCompleted(dbus.Boolean(False),

363

dbus.UInt16(condition),

364

dbus.String(command))

307

365

else:

308

366

logger.info(u"Checker for %(name)s failed",

309

367

vars(self))

368

# Emit D-Bus signal

369

self.CheckerCompleted(dbus.Boolean(False),

370

dbus.UInt16(condition),

371

dbus.String(command))

372

373

def bump_timeout(self):

374

"""Bump up the timeout for this client.

375

This should only be called when the client has been seen,

376

alive and well.

377

"""

378

self.last_checked_ok = datetime.datetime.utcnow()

379

gobject.source_remove(self.stop_initiator_tag)

380

self.stop_initiator_tag = (gobject.timeout_add

381

(self._timeout_milliseconds,

382

self.stop))

383

self.PropertyChanged(dbus.String(u"last_checked_ok"),

384

(_datetime_to_dbus_struct

385

(self.last_checked_ok,

386

variant_level=1)))

387

310

388

def start_checker(self):

311

389

"""Start a new checker subprocess if one is not running.

312

390

If a checker already exists, leave it running and do

321

399

# is as it should be.

322

400

if self.checker is None:

323

401

try:

324

# In case check_command has exactly one % operator

325

command = self.check_command % self.host

402

# In case checker_command has exactly one % operator

403

command = self.checker_command % self.host

326

404

except TypeError:

327

405

# Escape attributes for the shell

328

406

escaped_attrs = dict((key, re.escape(str(val)))

329

407

for key, val in

330

408

vars(self).iteritems())

331

409

try:

332

command = self.check_command % escaped_attrs

410

command = self.checker_command % escaped_attrs

333

411

except TypeError, error:

334

412

logger.error(u'Could not format string "%s":'

335

u' %s', self.check_command, error)

413

u' %s', self.checker_command, error)

336

414

return True # Try again later

337

415

try:

338

416

logger.info(u"Starting checker %r for %s",

344

422

self.checker = subprocess.Popen(command,

345

423

close_fds=True,

346

424

shell=True, cwd="/")

347

self.checker_callback_tag = gobject.child_watch_add\

348

(self.checker.pid,

349

self.checker_callback)

425

# Emit D-Bus signal

426

self.CheckerStarted(command)

427

self.PropertyChanged(dbus.String("checker_running"),

428

dbus.Boolean(True, variant_level=1))

429

self.checker_callback_tag = (gobject.child_watch_add

430

(self.checker.pid,

431

self.checker_callback,

432

data=command))

350

433

except OSError, error:

351

434

logger.error(u"Failed to start subprocess: %s",

352

435

error)

353

436

# Re-run this periodically if run by gobject.timeout_add

354

437

return True

438

355

439

def stop_checker(self):

356

440

"""Force the checker process, if any, to stop."""

357

441

if self.checker_callback_tag:

369

453

if error.errno != errno.ESRCH: # No such process

370

454

raise

371

455

self.checker = None

456

self.PropertyChanged(dbus.String(u"checker_running"),

457

dbus.Boolean(False, variant_level=1))

458

372

459

def still_valid(self):

373

460

"""Has the timeout not yet passed for this client?"""

374

now = datetime.datetime.now()

461

if not getattr(self, "started", False):

462

return False

463

now = datetime.datetime.utcnow()

375

464

if self.last_checked_ok is None:

376

465

return now < (self.created + self.timeout)

377

466

else:

378

467

return now < (self.last_checked_ok + self.timeout)

468

469

## D-Bus methods & signals

470

_interface = u"org.mandos_system.Mandos.Client"

471

472

# BumpTimeout - method

473

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

474

BumpTimeout.__name__ = "BumpTimeout"

475

476

# CheckerCompleted - signal

477

@dbus.service.signal(_interface, signature="bqs")

478

def CheckerCompleted(self, success, condition, command):

479

"D-Bus signal"

480

pass

481

482

# CheckerStarted - signal

483

@dbus.service.signal(_interface, signature="s")

484

def CheckerStarted(self, command):

485

"D-Bus signal"

486

pass

487

488

# GetAllProperties - method

489

@dbus.service.method(_interface, out_signature="a{sv}")

490

def GetAllProperties(self):

491

"D-Bus method"

492

return dbus.Dictionary({

493

dbus.String("name"):

494

dbus.String(self.name, variant_level=1),

495

dbus.String("fingerprint"):

496

dbus.String(self.fingerprint, variant_level=1),

497

dbus.String("host"):

498

dbus.String(self.host, variant_level=1),

499

dbus.String("created"):

500

_datetime_to_dbus_struct(self.created,

501

variant_level=1),

502

dbus.String("last_started"):

503

(_datetime_to_dbus_struct(self.last_started,

504

variant_level=1)

505

if self.last_started is not None

506

else dbus.Boolean(False, variant_level=1)),

507

dbus.String("started"):

508

dbus.Boolean(self.started, variant_level=1),

509

dbus.String("last_checked_ok"):

510

(_datetime_to_dbus_struct(self.last_checked_ok,

511

variant_level=1)

512

if self.last_checked_ok is not None

513

else dbus.Boolean (False, variant_level=1)),

514

dbus.String("timeout"):

515

dbus.UInt64(self._timeout_milliseconds,

516

variant_level=1),

517

dbus.String("interval"):

518

dbus.UInt64(self._interval_milliseconds,

519

variant_level=1),

520

dbus.String("checker"):

521

dbus.String(self.checker_command,

522

variant_level=1),

523

dbus.String("checker_running"):

524

dbus.Boolean(self.checker is not None,

525

variant_level=1),

526

}, signature="sv")

527

528

# IsStillValid - method

529

IsStillValid = (dbus.service.method(_interface, out_signature="b")

530

(still_valid))

531

IsStillValid.__name__ = "IsStillValid"

532

533

# PropertyChanged - signal

534

@dbus.service.signal(_interface, signature="sv")

535

def PropertyChanged(self, property, value):

536

"D-Bus signal"

537

pass

538

539

# SetChecker - method

540

@dbus.service.method(_interface, in_signature="s")

541

def SetChecker(self, checker):

542

"D-Bus setter method"

543

self.checker_command = checker

544

545

# SetHost - method

546

@dbus.service.method(_interface, in_signature="s")

547

def SetHost(self, host):

548

"D-Bus setter method"

549

self.host = host

550

551

# SetInterval - method

552

@dbus.service.method(_interface, in_signature="t")

553

def SetInterval(self, milliseconds):

554

self.interval = datetime.timdeelta(0, 0, 0, milliseconds)

555

556

# SetSecret - method

557

@dbus.service.method(_interface, in_signature="ay",

558

byte_arrays=True)

559

def SetSecret(self, secret):

560

"D-Bus setter method"

561

self.secret = str(secret)

562

563

# SetTimeout - method

564

@dbus.service.method(_interface, in_signature="t")

565

def SetTimeout(self, milliseconds):

566

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

567

568

# Start - method

569

Start = dbus.service.method(_interface)(start)

570

Start.__name__ = "Start"

571

572

# StartChecker - method

573

@dbus.service.method(_interface)

574

def StartChecker(self):

575

"D-Bus method"

576

self.start_checker()

577

578

# Stop - method

579

@dbus.service.method(_interface)

580

def Stop(self):

581

"D-Bus method"

582

self.stop()

583

584

# StopChecker - method

585

StopChecker = dbus.service.method(_interface)(stop_checker)

586

StopChecker.__name__ = "StopChecker"

587

588

del _interface

379

589

380

590

381

591

def peer_certificate(session):

382

592

"Return the peer's OpenPGP certificate as a bytestring"

383

593

# If not an OpenPGP certificate...

384

if gnutls.library.functions.gnutls_certificate_type_get\

385

(session._c_object) \

386

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

594

if (gnutls.library.functions

595

.gnutls_certificate_type_get(session._c_object)

596

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

387

597

# ...do the normal thing

388

598

return session.peer_certificate

389

599

list_size = ctypes.c_uint()

390

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

391

(session._c_object, ctypes.byref(list_size))

600

cert_list = (gnutls.library.functions

601

.gnutls_certificate_get_peers

602

(session._c_object, ctypes.byref(list_size)))

392

603

if list_size.value == 0:

393

604

return None

394

605

cert = cert_list[0]

398

609

def fingerprint(openpgp):

399

610

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

400

611

# New GnuTLS "datum" with the OpenPGP public key

401

datum = gnutls.library.types.gnutls_datum_t\

402

(ctypes.cast(ctypes.c_char_p(openpgp),

403

ctypes.POINTER(ctypes.c_ubyte)),

404

ctypes.c_uint(len(openpgp)))

612

datum = (gnutls.library.types

613

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

614

ctypes.POINTER

615

(ctypes.c_ubyte)),

616

ctypes.c_uint(len(openpgp))))

405

617

# New empty GnuTLS certificate

406

618

crt = gnutls.library.types.gnutls_openpgp_crt_t()

407

gnutls.library.functions.gnutls_openpgp_crt_init\

408

(ctypes.byref(crt))

619

(gnutls.library.functions

620

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

409

621

# Import the OpenPGP public key into the certificate

410

gnutls.library.functions.gnutls_openpgp_crt_import\

411

(crt, ctypes.byref(datum),

412

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

622

(gnutls.library.functions

623

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

624

gnutls.library.constants

625

.GNUTLS_OPENPGP_FMT_RAW))

413

626

# Verify the self signature in the key

414

crtverify = ctypes.c_uint();

415

gnutls.library.functions.gnutls_openpgp_crt_verify_self\

416

(crt, ctypes.c_uint(0), ctypes.byref(crtverify))

627

crtverify = ctypes.c_uint()

628

(gnutls.library.functions

629

.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))

417

630

if crtverify.value != 0:

418

631

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

419

632

raise gnutls.errors.CertificateSecurityError("Verify failed")

420

633

# New buffer for the fingerprint

421

buffer = ctypes.create_string_buffer(20)

422

buffer_length = ctypes.c_size_t()

634

buf = ctypes.create_string_buffer(20)

635

buf_len = ctypes.c_size_t()

423

636

# Get the fingerprint from the certificate into the buffer

424

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

425

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

637

(gnutls.library.functions

638

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

639

ctypes.byref(buf_len)))

426

640

# Deinit the certificate

427

641

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

428

642

# Convert the buffer to a Python bytestring

429

fpr = ctypes.string_at(buffer, buffer_length.value)

643

fpr = ctypes.string_at(buf, buf_len.value)

430

644

# Convert the bytestring to hexadecimal notation

431

645

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

432

646

return hex_fpr

433

647

434

648

435

class tcp_handler(SocketServer.BaseRequestHandler, object):

649

class TCP_handler(SocketServer.BaseRequestHandler, object):

436

650

"""A TCP request handler class.

437

651

Instantiated by IPv6_TCPServer for each request to handle it.

438

652

Note: This will run in its own forked process."""

439

653

440

654

def handle(self):

441

655

logger.info(u"TCP connection from: %s",

442

unicode(self.client_address))

443

session = gnutls.connection.ClientSession\

444

(self.request, gnutls.connection.X509Credentials())

656

unicode(self.client_address))

657

session = (gnutls.connection

658

.ClientSession(self.request,

659

gnutls.connection

660

.X509Credentials()))

445

661

446

662

line = self.request.makefile().readline()

447

663

logger.debug(u"Protocol version: %r", line)

460

676

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

461

677

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

462

678

# "+DHE-DSS"))

463

priority = "NORMAL" # Fallback default, since this

464

# MUST be set.

465

if self.server.settings["priority"]:

466

priority = self.server.settings["priority"]

467

gnutls.library.functions.gnutls_priority_set_direct\

468

(session._c_object, priority, None);

679

# Use a fallback default, since this MUST be set.

680

priority = self.server.settings.get("priority", "NORMAL")

681

(gnutls.library.functions

682

.gnutls_priority_set_direct(session._c_object,

683

priority, None))

469

684

470

685

try:

471

686

session.handshake()

481

696

session.bye()

482

697

return

483

698

logger.debug(u"Fingerprint: %s", fpr)

484

client = None

485

699

for c in self.server.clients:

486

700

if c.fingerprint == fpr:

487

701

client = c

488

702

break

489

if not client:

703

else:

490

704

logger.warning(u"Client not found for fingerprint: %s",

491

705

fpr)

492

706

session.bye()

499

713

vars(client))

500

714

session.bye()

501

715

return

716

## This won't work here, since we're in a fork.

717

# client.bump_timeout()

502

718

sent_size = 0

503

719

while sent_size < len(client.secret):

504

720

sent = session.send(client.secret[sent_size:])

509

725

session.bye()

510

726

511

727

512

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

728

class IPv6_TCPServer(SocketServer.ForkingMixIn,

729

SocketServer.TCPServer, object):

513

730

"""IPv6 TCP server. Accepts 'None' as address and/or port.

514

731

Attributes:

515

732

settings: Server settings

516

733

clients: Set() of Client objects

734

enabled: Boolean; whether this server is activated yet

517

735

"""

518

736

address_family = socket.AF_INET6

519

737

def __init__(self, *args, **kwargs):

523

741

if "clients" in kwargs:

524

742

self.clients = kwargs["clients"]

525

743

del kwargs["clients"]

526

return super(type(self), self).__init__(*args, **kwargs)

744

self.enabled = False

745

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

527

746

def server_bind(self):

528

747

"""This overrides the normal server_bind() function

529

748

to bind to an interface if one was specified, and also NOT to

558

777

# if_nametoindex

559

778

# (self.settings

560

779

# ["interface"]))

561

return super(type(self), self).server_bind()

780

return super(IPv6_TCPServer, self).server_bind()

781

def server_activate(self):

782

if self.enabled:

783

return super(IPv6_TCPServer, self).server_activate()

784

def enable(self):

785

self.enabled = True

562

786

563

787

564

788

def string_to_delta(interval):

580

804

timevalue = datetime.timedelta(0)

581

805

for s in interval.split():

582

806

try:

583

suffix=unicode(s[-1])

584

value=int(s[:-1])

807

suffix = unicode(s[-1])

808

value = int(s[:-1])

585

809

if suffix == u"d":

586

810

delta = datetime.timedelta(value)

587

811

elif suffix == u"s":

603

827

def server_state_changed(state):

604

828

"""Derived from the Avahi example code"""

605

829

if state == avahi.SERVER_COLLISION:

606

logger.error(u"Server name collision")

830

logger.error(u"Zeroconf server name collision")

607

831

service.remove()

608

832

elif state == avahi.SERVER_RUNNING:

609

833

service.add()

611

835

612

836

def entry_group_state_changed(state, error):

613

837

"""Derived from the Avahi example code"""

614

logger.debug(u"state change: %i", state)

838

logger.debug(u"Avahi state change: %i", state)

615

839

616

840

if state == avahi.ENTRY_GROUP_ESTABLISHED:

617

logger.debug(u"Service established.")

841

logger.debug(u"Zeroconf service established.")

618

842

elif state == avahi.ENTRY_GROUP_COLLISION:

619

logger.warning(u"Service name collision.")

843

logger.warning(u"Zeroconf service name collision.")

620

844

service.rename()

621

845

elif state == avahi.ENTRY_GROUP_FAILURE:

622

logger.critical(u"Error in group state changed %s",

846

logger.critical(u"Avahi: Error in group state changed %s",

623

847

unicode(error))

624

848

raise AvahiGroupError("State changed: %s", str(error))

625

849

627

851

"""Call the C function if_nametoindex(), or equivalent"""

628

852

global if_nametoindex

629

853

try:

630

if "ctypes.util" not in sys.modules:

631

import ctypes.util

632

if_nametoindex = ctypes.cdll.LoadLibrary\

633

(ctypes.util.find_library("c")).if_nametoindex

854

if_nametoindex = (ctypes.cdll.LoadLibrary

855

(ctypes.util.find_library("c"))

856

.if_nametoindex)

634

857

except (OSError, AttributeError):

635

858

if "struct" not in sys.modules:

636

859

import struct

639

862

def if_nametoindex(interface):

640

863

"Get an interface index the hard way, i.e. using fcntl()"

641

864

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

642

s = socket.socket()

643

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

644

struct.pack("16s16x", interface))

645

s.close()

865

with closing(socket.socket()) as s:

866

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

867

struct.pack("16s16x", interface))

646

868

interface_index = struct.unpack("I", ifreq[16:20])[0]

647

869

return interface_index

648

870

return if_nametoindex(interface)

672

894

673

895

674

896

def main():

675

global main_loop_started

676

main_loop_started = False

677

678

897

parser = OptionParser(version = "%%prog %s" % version)

679

898

parser.add_option("-i", "--interface", type="string",

680

899

metavar="IF", help="Bind to interface IF")

695

914

default="/etc/mandos", metavar="DIR",

696

915

help="Directory to search for configuration"

697

916

" files")

698

(options, args) = parser.parse_args()

917

options = parser.parse_args()[0]

699

918

700

919

if options.check:

701

920

import doctest

719

938

# Convert the SafeConfigParser object to a dict

720

939

server_settings = server_config.defaults()

721

940

# Use getboolean on the boolean config option

722

server_settings["debug"] = server_config.getboolean\

723

("DEFAULT", "debug")

941

server_settings["debug"] = (server_config.getboolean

942

("DEFAULT", "debug"))

724

943

del server_config

725

944

726

945

# Override the settings from the config file with command line

740

959

console.setLevel(logging.WARNING)

741

960

742

961

if server_settings["servicename"] != "Mandos":

743

syslogger.setFormatter(logging.Formatter\

962

syslogger.setFormatter(logging.Formatter

744

963

('Mandos (%s): %%(levelname)s:'

745

964

' %%(message)s'

746

965

% server_settings["servicename"]))

755

974

client_config.read(os.path.join(server_settings["configdir"],

756

975

"clients.conf"))

757

976

977

clients = Set()

978

tcp_server = IPv6_TCPServer((server_settings["address"],

979

server_settings["port"]),

980

TCP_handler,

981

settings=server_settings,

982

clients=clients)

983

pidfilename = "/var/run/mandos.pid"

984

try:

985

pidfile = open(pidfilename, "w")

986

except IOError, error:

987

logger.error("Could not open file %r", pidfilename)

988

989

try:

990

uid = pwd.getpwnam("_mandos").pw_uid

991

except KeyError:

992

try:

993

uid = pwd.getpwnam("mandos").pw_uid

994

except KeyError:

995

try:

996

uid = pwd.getpwnam("nobody").pw_uid

997

except KeyError:

998

uid = 65534

999

try:

1000

gid = pwd.getpwnam("_mandos").pw_gid

1001

except KeyError:

1002

try:

1003

gid = pwd.getpwnam("mandos").pw_gid

1004

except KeyError:

1005

try:

1006

gid = pwd.getpwnam("nogroup").pw_gid

1007

except KeyError:

1008

gid = 65534

1009

try:

1010

os.setuid(uid)

1011

os.setgid(gid)

1012

except OSError, error:

1013

if error[0] != errno.EPERM:

1014

raise error

1015

758

1016

global service

759

1017

service = AvahiService(name = server_settings["servicename"],

760

type = "_mandos._tcp", );

1018

servicetype = "_mandos._tcp", )

761

1019

if server_settings["interface"]:

762

service.interface = if_nametoindex(server_settings["interface"])

1020

service.interface = (if_nametoindex

1021

(server_settings["interface"]))

763

1022

764

1023

global main_loop

765

1024

global bus

768

1027

DBusGMainLoop(set_as_default=True )

769

1028

main_loop = gobject.MainLoop()

770

1029

bus = dbus.SystemBus()

771

server = dbus.Interface(

772

bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),

773

avahi.DBUS_INTERFACE_SERVER )

1030

server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,

1031

avahi.DBUS_PATH_SERVER),

1032

avahi.DBUS_INTERFACE_SERVER)

774

1033

# End of Avahi example code

775

776

clients = Set()

777

def remove_from_clients(client):

778

clients.remove(client)

779

if not clients:

780

logger.critical(u"No clients left, exiting")

781

sys.exit()

1034

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)

782

1035

783

1036

clients.update(Set(Client(name = section,

784

stop_hook = remove_from_clients,

785

1037

config

786

1038

= dict(client_config.items(section)))

787

1039

for section in client_config.sections()))

801

1053

# Close all input and output, do double fork, etc.

802

1054

daemon()

803

1055

804

pidfilename = "/var/run/mandos/mandos.pid"

805

pid = os.getpid()

806

1056

try:

807

pidfile = open(pidfilename, "w")

1057

pid = os.getpid()

808

1058

pidfile.write(str(pid) + "\n")

809

1059

pidfile.close()

810

1060

del pidfile

811

except IOError, err:

812

logger.error(u"Could not write %s file with PID %d",

813

pidfilename, os.getpid())

1061

except IOError:

1062

logger.error(u"Could not write to file %r with PID %d",

1063

pidfilename, pid)

1064

except NameError:

1065

# "pidfile" was never created

1066

pass

1067

del pidfilename

814

1068

815

1069

def cleanup():

816

1070

"Cleanup function; run on exit"

833

1087

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

834

1088

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

835

1089

1090

class MandosServer(dbus.service.Object):

1091

"""A D-Bus proxy object"""

1092

def __init__(self):

1093

dbus.service.Object.__init__(self, bus,

1094

"/Mandos")

1095

_interface = u"org.mandos_system.Mandos"

1096

1097

@dbus.service.signal(_interface, signature="oa{sv}")

1098

def ClientAdded(self, objpath, properties):

1099

"D-Bus signal"

1100

pass

1101

1102

@dbus.service.signal(_interface, signature="o")

1103

def ClientRemoved(self, objpath):

1104

"D-Bus signal"

1105

pass

1106

1107

@dbus.service.method(_interface, out_signature="ao")

1108

def GetAllClients(self):

1109

return dbus.Array(c.dbus_object_path for c in clients)

1110

1111

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1112

def GetAllClientsWithProperties(self):

1113

return dbus.Dictionary(

1114

((c.dbus_object_path, c.GetAllProperties())

1115

for c in clients),

1116

signature="oa{sv}")

1117

1118

@dbus.service.method(_interface, in_signature="o")

1119

def RemoveClient(self, object_path):

1120

for c in clients:

1121

if c.dbus_object_path == object_path:

1122

c.stop()

1123

clients.remove(c)

1124

return

1125

raise KeyError

1126

1127

del _interface

1128

1129

mandos_server = MandosServer()

1130

836

1131

for client in clients:

1132

# Emit D-Bus signal

1133

mandos_server.ClientAdded(client.dbus_object_path,

1134

client.GetAllProperties())

837

1135

client.start()

838

1136

839

tcp_server = IPv6_TCPServer((server_settings["address"],

840

server_settings["port"]),

841

tcp_handler,

842

settings=server_settings,

843

clients=clients)

1137

tcp_server.enable()

1138

tcp_server.server_activate()

1139

844

1140

# Find out what port we got

845

1141

service.port = tcp_server.socket.getsockname()[1]

846

1142

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

860

1156

861

1157

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

862

1158

lambda *args, **kwargs:

863

tcp_server.handle_request\

864

(*args[2:], **kwargs) or True)

1159

(tcp_server.handle_request

1160

(*args[2:], **kwargs) or True))

865

1161

866

1162

logger.debug(u"Starting main loop")

867

main_loop_started = True

868

1163

main_loop.run()

869

1164

except AvahiError, error:

870

1165

logger.critical(u"AvahiError: %s" + unicode(error))