/mandos/release : revision 24.1.116

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

16

#

16

17

# This program is free software: you can redistribute it and/or modify

17

18

# it under the terms of the GNU General Public License as published by

24

25

# GNU General Public License for more details.

25

26

#

26

27

# You should have received a copy of the GNU General Public License

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

28

30

#

29

31

# Contact the authors at <mandos@fukt.bsnet.se>.

30

32

#

31

33

32

from __future__ import division

34

from __future__ import division, with_statement, absolute_import

33

35

34

36

import SocketServer

35

37

import socket

36

import select

37

38

from optparse import OptionParser

38

39

import datetime

39

40

import errno

54

55

import stat

55

56

import logging

56

57

import logging.handlers

58

import pwd

59

from contextlib import closing

57

60

58

61

import dbus

62

import dbus.service

59

63

import gobject

60

64

import avahi

61

65

from dbus.mainloop.glib import DBusGMainLoop

62

66

import ctypes

67

import ctypes.util

63

68

64

version = "1.0"

69

version = "1.0.2"

65

70

66

71

logger = logging.Logger('mandos')

67

syslogger = logging.handlers.SysLogHandler\

68

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

69

address = "/dev/log")

70

syslogger.setFormatter(logging.Formatter\

71

('Mandos: %(levelname)s: %(message)s'))

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos: %(levelname)s: %(message)s'))

72

77

logger.addHandler(syslogger)

73

78

74

79

console = logging.StreamHandler()

79

84

class AvahiError(Exception):

80

85

def __init__(self, value):

81

86

self.value = value

87

super(AvahiError, self).__init__()

82

88

def __str__(self):

83

89

return repr(self.value)

84

90

106

112

a sensible number of times

107

113

"""

108

114

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

109

type = None, port = None, TXT = None, domain = "",

110

host = "", max_renames = 32768):

115

servicetype = None, port = None, TXT = None,

116

domain = "", host = "", max_renames = 32768):

111

117

self.interface = interface

112

118

self.name = name

113

self.type = type

119

self.type = servicetype

114

120

self.port = port

115

if TXT is None:

116

self.TXT = []

117

else:

118

self.TXT = TXT

121

self.TXT = TXT if TXT is not None else []

119

122

self.domain = domain

120

123

self.host = host

121

124

self.rename_count = 0

123

126

def rename(self):

124

127

"""Derived from the Avahi example code"""

125

128

if self.rename_count >= self.max_renames:

126

logger.critical(u"No suitable service name found after %i"

127

u" retries, exiting.", rename_count)

129

logger.critical(u"No suitable Zeroconf service name found"

130

u" after %i retries, exiting.",

131

self.rename_count)

128

132

raise AvahiServiceError("Too many renames")

129

133

self.name = server.GetAlternativeServiceName(self.name)

130

logger.info(u"Changing name to %r ...", str(self.name))

131

syslogger.setFormatter(logging.Formatter\

134

logger.info(u"Changing Zeroconf service name to %r ...",

135

str(self.name))

136

syslogger.setFormatter(logging.Formatter

132

137

('Mandos (%s): %%(levelname)s:'

133

' %%(message)s' % self.name))

138

' %%(message)s' % self.name))

134

139

self.remove()

135

140

self.add()

136

141

self.rename_count += 1

142

147

"""Derived from the Avahi example code"""

143

148

global group

144

149

if group is None:

145

group = dbus.Interface\

146

(bus.get_object(avahi.DBUS_NAME,

150

group = dbus.Interface(bus.get_object

151

(avahi.DBUS_NAME,

147

152

server.EntryGroupNew()),

148

avahi.DBUS_INTERFACE_ENTRY_GROUP)

153

avahi.DBUS_INTERFACE_ENTRY_GROUP)

149

154

group.connect_to_signal('StateChanged',

150

155

entry_group_state_changed)

151

logger.debug(u"Adding service '%s' of type '%s' ...",

156

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

152

157

service.name, service.type)

153

158

group.AddService(

154

159

self.interface, # interface

165

170

# End of Avahi example code

166

171

167

172

168

class Client(object):

173

def _datetime_to_dbus(dt, variant_level=0):

174

"""Convert a UTC datetime.datetime() to a D-Bus type."""

175

return dbus.String(dt.isoformat(), variant_level=variant_level)

176

177

178

class Client(dbus.service.Object):

169

179

"""A representation of a client host served by this server.

170

180

Attributes:

171

name: string; from the config file, used in log messages

181

name: string; from the config file, used in log messages

172

182

fingerprint: string (40 or 32 hexadecimal digits); used to

173

183

uniquely identify the client

174

secret: bytestring; sent verbatim (over TLS) to client

175

host: string; available for use by the checker command

176

created: datetime.datetime(); object creation, not client host

177

last_checked_ok: datetime.datetime() or None if not yet checked OK

178

timeout: datetime.timedelta(); How long from last_checked_ok

179

until this client is invalid

180

interval: datetime.timedelta(); How often to start a new checker

181

stop_hook: If set, called by stop() as stop_hook(self)

182

checker: subprocess.Popen(); a running checker process used

183

to see if the client lives.

184

'None' if no process is running.

184

secret: bytestring; sent verbatim (over TLS) to client

185

host: string; available for use by the checker command

186

created: datetime.datetime(); (UTC) object creation

187

last_enabled: datetime.datetime(); (UTC)

188

enabled: bool()

189

last_checked_ok: datetime.datetime(); (UTC) or None

190

timeout: datetime.timedelta(); How long from last_checked_ok

191

until this client is invalid

192

interval: datetime.timedelta(); How often to start a new checker

193

disable_hook: If set, called by disable() as disable_hook(self)

194

checker: subprocess.Popen(); a running checker process used

195

to see if the client lives.

196

'None' if no process is running.

185

197

checker_initiator_tag: a gobject event source tag, or None

186

stop_initiator_tag: - '' -

198

disable_initiator_tag: - '' -

187

199

checker_callback_tag: - '' -

188

200

checker_command: string; External command which is run to check if

189

201

client lives. %() expansions are done at

190

202

runtime with vars(self) as dict, so that for

191

203

instance %(name)s can be used in the command.

204

dbus_object_path: dbus.ObjectPath

192

205

Private attibutes:

193

206

_timeout: Real variable for 'timeout'

194

207

_interval: Real variable for 'interval'

196

209

_interval_milliseconds: - '' -

197

210

"""

198

211

def _set_timeout(self, timeout):

199

"Setter function for 'timeout' attribute"

212

"Setter function for the 'timeout' attribute"

200

213

self._timeout = timeout

201

214

self._timeout_milliseconds = ((self.timeout.days

202

215

* 24 * 60 * 60 * 1000)

203

216

+ (self.timeout.seconds * 1000)

204

217

+ (self.timeout.microseconds

205

218

// 1000))

206

timeout = property(lambda self: self._timeout,

207

_set_timeout)

219

# Emit D-Bus signal

220

self.PropertyChanged(dbus.String(u"timeout"),

221

(dbus.UInt64(self._timeout_milliseconds,

222

variant_level=1)))

223

timeout = property(lambda self: self._timeout, _set_timeout)

208

224

del _set_timeout

225

209

226

def _set_interval(self, interval):

210

"Setter function for 'interval' attribute"

227

"Setter function for the 'interval' attribute"

211

228

self._interval = interval

212

229

self._interval_milliseconds = ((self.interval.days

213

230

* 24 * 60 * 60 * 1000)

215

232

* 1000)

216

233

+ (self.interval.microseconds

217

234

// 1000))

218

interval = property(lambda self: self._interval,

219

_set_interval)

235

# Emit D-Bus signal

236

self.PropertyChanged(dbus.String(u"interval"),

237

(dbus.UInt64(self._interval_milliseconds,

238

variant_level=1)))

239

interval = property(lambda self: self._interval, _set_interval)

220

240

del _set_interval

221

def __init__(self, name = None, stop_hook=None, config={}):

241

242

def __init__(self, name = None, disable_hook=None, config=None):

222

243

"""Note: the 'checker' key in 'config' sets the

223

244

'checker_command' attribute and *not* the 'checker'

224

245

attribute."""

246

self.dbus_object_path = (dbus.ObjectPath

247

("/Mandos/clients/"

248

+ name.replace(".", "_")))

249

dbus.service.Object.__init__(self, bus,

250

self.dbus_object_path)

251

if config is None:

252

config = {}

225

253

self.name = name

226

254

logger.debug(u"Creating client %r", self.name)

227

255

# Uppercase and remove spaces from fingerprint for later

228

256

# comparison purposes with return value from the fingerprint()

229

257

# function

230

self.fingerprint = config["fingerprint"].upper()\

231

.replace(u" ", u"")

258

self.fingerprint = (config["fingerprint"].upper()

259

.replace(u" ", u""))

232

260

logger.debug(u" Fingerprint: %s", self.fingerprint)

233

261

if "secret" in config:

234

262

self.secret = config["secret"].decode(u"base64")

235

263

elif "secfile" in config:

236

sf = open(config["secfile"])

237

self.secret = sf.read()

238

sf.close()

264

with closing(open(os.path.expanduser

265

(os.path.expandvars

266

(config["secfile"])))) as secfile:

267

self.secret = secfile.read()

239

268

else:

240

269

raise TypeError(u"No secret or secfile for client %s"

241

270

% self.name)

242

271

self.host = config.get("host", "")

243

self.created = datetime.datetime.now()

272

self.created = datetime.datetime.utcnow()

273

self.enabled = False

274

self.last_enabled = None

244

275

self.last_checked_ok = None

245

276

self.timeout = string_to_delta(config["timeout"])

246

277

self.interval = string_to_delta(config["interval"])

247

self.stop_hook = stop_hook

278

self.disable_hook = disable_hook

248

279

self.checker = None

249

280

self.checker_initiator_tag = None

250

self.stop_initiator_tag = None

281

self.disable_initiator_tag = None

251

282

self.checker_callback_tag = None

252

self.check_command = config["checker"]

253

def start(self):

283

self.checker_command = config["checker"]

284

285

def enable(self):

254

286

"""Start this client's checker and timeout hooks"""

287

self.last_enabled = datetime.datetime.utcnow()

255

288

# Schedule a new checker to be started an 'interval' from now,

256

289

# and every interval from then on.

257

self.checker_initiator_tag = gobject.timeout_add\

258

(self._interval_milliseconds,

259

self.start_checker)

290

self.checker_initiator_tag = (gobject.timeout_add

291

(self._interval_milliseconds,

292

self.start_checker))

260

293

# Also start a new checker *right now*.

261

294

self.start_checker()

262

# Schedule a stop() when 'timeout' has passed

263

self.stop_initiator_tag = gobject.timeout_add\

264

(self._timeout_milliseconds,

265

self.stop)

266

def stop(self):

267

"""Stop this client.

268

The possibility that a client might be restarted is left open,

269

but not currently used."""

270

# If this client doesn't have a secret, it is already stopped.

271

if hasattr(self, "secret") and self.secret:

272

logger.info(u"Stopping client %s", self.name)

273

self.secret = None

274

else:

295

# Schedule a disable() when 'timeout' has passed

296

self.disable_initiator_tag = (gobject.timeout_add

297

(self._timeout_milliseconds,

298

self.disable))

299

self.enabled = True

300

# Emit D-Bus signal

301

self.PropertyChanged(dbus.String(u"enabled"),

302

dbus.Boolean(True, variant_level=1))

303

self.PropertyChanged(dbus.String(u"last_enabled"),

304

(_datetime_to_dbus(self.last_enabled,

305

variant_level=1)))

306

307

def disable(self):

308

"""Disable this client."""

309

if not getattr(self, "enabled", False):

275

310

return False

276

if getattr(self, "stop_initiator_tag", False):

277

gobject.source_remove(self.stop_initiator_tag)

278

self.stop_initiator_tag = None

311

logger.info(u"Disabling client %s", self.name)

312

if getattr(self, "disable_initiator_tag", False):

313

gobject.source_remove(self.disable_initiator_tag)

314

self.disable_initiator_tag = None

279

315

if getattr(self, "checker_initiator_tag", False):

280

316

gobject.source_remove(self.checker_initiator_tag)

281

317

self.checker_initiator_tag = None

282

318

self.stop_checker()

283

if self.stop_hook:

284

self.stop_hook(self)

319

if self.disable_hook:

320

self.disable_hook(self)

321

self.enabled = False

322

# Emit D-Bus signal

323

self.PropertyChanged(dbus.String(u"enabled"),

324

dbus.Boolean(False, variant_level=1))

285

325

# Do not run this again if called by a gobject.timeout_add

286

326

return False

327

287

328

def __del__(self):

288

self.stop_hook = None

289

self.stop()

290

def checker_callback(self, pid, condition):

329

self.disable_hook = None

330

self.disable()

331

332

def checker_callback(self, pid, condition, command):

291

333

"""The checker has completed, so take appropriate actions."""

292

now = datetime.datetime.now()

293

334

self.checker_callback_tag = None

294

335

self.checker = None

295

if os.WIFEXITED(condition) \

296

and (os.WEXITSTATUS(condition) == 0):

336

# Emit D-Bus signal

337

self.PropertyChanged(dbus.String(u"checker_running"),

338

dbus.Boolean(False, variant_level=1))

339

if (os.WIFEXITED(condition)

340

and (os.WEXITSTATUS(condition) == 0)):

297

341

logger.info(u"Checker for %(name)s succeeded",

298

342

vars(self))

299

self.last_checked_ok = now

300

gobject.source_remove(self.stop_initiator_tag)

301

self.stop_initiator_tag = gobject.timeout_add\

302

(self._timeout_milliseconds,

303

self.stop)

343

# Emit D-Bus signal

344

self.CheckerCompleted(dbus.Boolean(True),

345

dbus.UInt16(condition),

346

dbus.String(command))

347

self.bump_timeout()

304

348

elif not os.WIFEXITED(condition):

305

349

logger.warning(u"Checker for %(name)s crashed?",

306

350

vars(self))

351

# Emit D-Bus signal

352

self.CheckerCompleted(dbus.Boolean(False),

353

dbus.UInt16(condition),

354

dbus.String(command))

307

355

else:

308

356

logger.info(u"Checker for %(name)s failed",

309

357

vars(self))

358

# Emit D-Bus signal

359

self.CheckerCompleted(dbus.Boolean(False),

360

dbus.UInt16(condition),

361

dbus.String(command))

362

363

def bump_timeout(self):

364

"""Bump up the timeout for this client.

365

This should only be called when the client has been seen,

366

alive and well.

367

"""

368

self.last_checked_ok = datetime.datetime.utcnow()

369

gobject.source_remove(self.disable_initiator_tag)

370

self.disable_initiator_tag = (gobject.timeout_add

371

(self._timeout_milliseconds,

372

self.disable))

373

self.PropertyChanged(dbus.String(u"last_checked_ok"),

374

(_datetime_to_dbus(self.last_checked_ok,

375

variant_level=1)))

376

310

377

def start_checker(self):

311

378

"""Start a new checker subprocess if one is not running.

312

379

If a checker already exists, leave it running and do

321

388

# is as it should be.

322

389

if self.checker is None:

323

390

try:

324

# In case check_command has exactly one % operator

325

command = self.check_command % self.host

391

# In case checker_command has exactly one % operator

392

command = self.checker_command % self.host

326

393

except TypeError:

327

394

# Escape attributes for the shell

328

395

escaped_attrs = dict((key, re.escape(str(val)))

329

396

for key, val in

330

397

vars(self).iteritems())

331

398

try:

332

command = self.check_command % escaped_attrs

399

command = self.checker_command % escaped_attrs

333

400

except TypeError, error:

334

401

logger.error(u'Could not format string "%s":'

335

u' %s', self.check_command, error)

402

u' %s', self.checker_command, error)

336

403

return True # Try again later

337

404

try:

338

405

logger.info(u"Starting checker %r for %s",

344

411

self.checker = subprocess.Popen(command,

345

412

close_fds=True,

346

413

shell=True, cwd="/")

347

self.checker_callback_tag = gobject.child_watch_add\

348

(self.checker.pid,

349

self.checker_callback)

414

# Emit D-Bus signal

415

self.CheckerStarted(command)

416

self.PropertyChanged(dbus.String("checker_running"),

417

dbus.Boolean(True, variant_level=1))

418

self.checker_callback_tag = (gobject.child_watch_add

419

(self.checker.pid,

420

self.checker_callback,

421

data=command))

350

422

except OSError, error:

351

423

logger.error(u"Failed to start subprocess: %s",

352

424

error)

353

425

# Re-run this periodically if run by gobject.timeout_add

354

426

return True

427

355

428

def stop_checker(self):

356

429

"""Force the checker process, if any, to stop."""

357

430

if self.checker_callback_tag:

369

442

if error.errno != errno.ESRCH: # No such process

370

443

raise

371

444

self.checker = None

445

self.PropertyChanged(dbus.String(u"checker_running"),

446

dbus.Boolean(False, variant_level=1))

447

372

448

def still_valid(self):

373

449

"""Has the timeout not yet passed for this client?"""

374

now = datetime.datetime.now()

450

if not getattr(self, "enabled", False):

451

return False

452

now = datetime.datetime.utcnow()

375

453

if self.last_checked_ok is None:

376

454

return now < (self.created + self.timeout)

377

455

else:

378

456

return now < (self.last_checked_ok + self.timeout)

457

458

## D-Bus methods & signals

459

_interface = u"org.mandos_system.Mandos.Client"

460

461

# BumpTimeout - method

462

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

463

BumpTimeout.__name__ = "BumpTimeout"

464

465

# CheckerCompleted - signal

466

@dbus.service.signal(_interface, signature="bqs")

467

def CheckerCompleted(self, success, condition, command):

468

"D-Bus signal"

469

pass

470

471

# CheckerStarted - signal

472

@dbus.service.signal(_interface, signature="s")

473

def CheckerStarted(self, command):

474

"D-Bus signal"

475

pass

476

477

# GetAllProperties - method

478

@dbus.service.method(_interface, out_signature="a{sv}")

479

def GetAllProperties(self):

480

"D-Bus method"

481

return dbus.Dictionary({

482

dbus.String("name"):

483

dbus.String(self.name, variant_level=1),

484

dbus.String("fingerprint"):

485

dbus.String(self.fingerprint, variant_level=1),

486

dbus.String("host"):

487

dbus.String(self.host, variant_level=1),

488

dbus.String("created"):

489

_datetime_to_dbus(self.created, variant_level=1),

490

dbus.String("last_enabled"):

491

(_datetime_to_dbus(self.last_enabled,

492

variant_level=1)

493

if self.last_enabled is not None

494

else dbus.Boolean(False, variant_level=1)),

495

dbus.String("enabled"):

496

dbus.Boolean(self.enabled, variant_level=1),

497

dbus.String("last_checked_ok"):

498

(_datetime_to_dbus(self.last_checked_ok,

499

variant_level=1)

500

if self.last_checked_ok is not None

501

else dbus.Boolean (False, variant_level=1)),

502

dbus.String("timeout"):

503

dbus.UInt64(self._timeout_milliseconds,

504

variant_level=1),

505

dbus.String("interval"):

506

dbus.UInt64(self._interval_milliseconds,

507

variant_level=1),

508

dbus.String("checker"):

509

dbus.String(self.checker_command,

510

variant_level=1),

511

dbus.String("checker_running"):

512

dbus.Boolean(self.checker is not None,

513

variant_level=1),

514

}, signature="sv")

515

516

# IsStillValid - method

517

IsStillValid = (dbus.service.method(_interface, out_signature="b")

518

(still_valid))

519

IsStillValid.__name__ = "IsStillValid"

520

521

# PropertyChanged - signal

522

@dbus.service.signal(_interface, signature="sv")

523

def PropertyChanged(self, property, value):

524

"D-Bus signal"

525

pass

526

527

# SetChecker - method

528

@dbus.service.method(_interface, in_signature="s")

529

def SetChecker(self, checker):

530

"D-Bus setter method"

531

self.checker_command = checker

532

533

# SetHost - method

534

@dbus.service.method(_interface, in_signature="s")

535

def SetHost(self, host):

536

"D-Bus setter method"

537

self.host = host

538

539

# SetInterval - method

540

@dbus.service.method(_interface, in_signature="t")

541

def SetInterval(self, milliseconds):

542

self.interval = datetime.timdeelta(0, 0, 0, milliseconds)

543

544

# SetSecret - method

545

@dbus.service.method(_interface, in_signature="ay",

546

byte_arrays=True)

547

def SetSecret(self, secret):

548

"D-Bus setter method"

549

self.secret = str(secret)

550

551

# SetTimeout - method

552

@dbus.service.method(_interface, in_signature="t")

553

def SetTimeout(self, milliseconds):

554

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

555

556

# Enable - method

557

Enable = dbus.service.method(_interface)(enable)

558

Enable.__name__ = "Enable"

559

560

# StartChecker - method

561

@dbus.service.method(_interface)

562

def StartChecker(self):

563

"D-Bus method"

564

self.start_checker()

565

566

# Disable - method

567

@dbus.service.method(_interface)

568

def Disable(self):

569

"D-Bus method"

570

self.disable()

571

572

# StopChecker - method

573

StopChecker = dbus.service.method(_interface)(stop_checker)

574

StopChecker.__name__ = "StopChecker"

575

576

del _interface

379

577

380

578

381

579

def peer_certificate(session):

382

580

"Return the peer's OpenPGP certificate as a bytestring"

383

581

# If not an OpenPGP certificate...

384

if gnutls.library.functions.gnutls_certificate_type_get\

385

(session._c_object) \

386

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

582

if (gnutls.library.functions

583

.gnutls_certificate_type_get(session._c_object)

584

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

387

585

# ...do the normal thing

388

586

return session.peer_certificate

389

587

list_size = ctypes.c_uint()

390

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

391

(session._c_object, ctypes.byref(list_size))

588

cert_list = (gnutls.library.functions

589

.gnutls_certificate_get_peers

590

(session._c_object, ctypes.byref(list_size)))

392

591

if list_size.value == 0:

393

592

return None

394

593

cert = cert_list[0]

398

597

def fingerprint(openpgp):

399

598

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

400

599

# New GnuTLS "datum" with the OpenPGP public key

401

datum = gnutls.library.types.gnutls_datum_t\

402

(ctypes.cast(ctypes.c_char_p(openpgp),

403

ctypes.POINTER(ctypes.c_ubyte)),

404

ctypes.c_uint(len(openpgp)))

600

datum = (gnutls.library.types

601

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

602

ctypes.POINTER

603

(ctypes.c_ubyte)),

604

ctypes.c_uint(len(openpgp))))

405

605

# New empty GnuTLS certificate

406

606

crt = gnutls.library.types.gnutls_openpgp_crt_t()

407

gnutls.library.functions.gnutls_openpgp_crt_init\

408

(ctypes.byref(crt))

607

(gnutls.library.functions

608

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

409

609

# Import the OpenPGP public key into the certificate

410

gnutls.library.functions.gnutls_openpgp_crt_import\

411

(crt, ctypes.byref(datum),

412

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

610

(gnutls.library.functions

611

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

612

gnutls.library.constants

613

.GNUTLS_OPENPGP_FMT_RAW))

413

614

# Verify the self signature in the key

414

crtverify = ctypes.c_uint();

415

gnutls.library.functions.gnutls_openpgp_crt_verify_self\

416

(crt, ctypes.c_uint(0), ctypes.byref(crtverify))

615

crtverify = ctypes.c_uint()

616

(gnutls.library.functions

617

.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))

417

618

if crtverify.value != 0:

418

619

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

419

620

raise gnutls.errors.CertificateSecurityError("Verify failed")

420

621

# New buffer for the fingerprint

421

buffer = ctypes.create_string_buffer(20)

422

buffer_length = ctypes.c_size_t()

622

buf = ctypes.create_string_buffer(20)

623

buf_len = ctypes.c_size_t()

423

624

# Get the fingerprint from the certificate into the buffer

424

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

425

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

625

(gnutls.library.functions

626

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

627

ctypes.byref(buf_len)))

426

628

# Deinit the certificate

427

629

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

428

630

# Convert the buffer to a Python bytestring

429

fpr = ctypes.string_at(buffer, buffer_length.value)

631

fpr = ctypes.string_at(buf, buf_len.value)

430

632

# Convert the bytestring to hexadecimal notation

431

633

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

432

634

return hex_fpr

433

635

434

636

435

class tcp_handler(SocketServer.BaseRequestHandler, object):

637

class TCP_handler(SocketServer.BaseRequestHandler, object):

436

638

"""A TCP request handler class.

437

639

Instantiated by IPv6_TCPServer for each request to handle it.

438

640

Note: This will run in its own forked process."""

439

641

440

642

def handle(self):

441

643

logger.info(u"TCP connection from: %s",

442

unicode(self.client_address))

443

session = gnutls.connection.ClientSession\

444

(self.request, gnutls.connection.X509Credentials())

644

unicode(self.client_address))

645

session = (gnutls.connection

646

.ClientSession(self.request,

647

gnutls.connection

648

.X509Credentials()))

445

649

446

650

line = self.request.makefile().readline()

447

651

logger.debug(u"Protocol version: %r", line)

460

664

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

461

665

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

462

666

# "+DHE-DSS"))

463

priority = "NORMAL" # Fallback default, since this

464

# MUST be set.

465

if self.server.settings["priority"]:

466

priority = self.server.settings["priority"]

467

gnutls.library.functions.gnutls_priority_set_direct\

468

(session._c_object, priority, None);

667

# Use a fallback default, since this MUST be set.

668

priority = self.server.settings.get("priority", "NORMAL")

669

(gnutls.library.functions

670

.gnutls_priority_set_direct(session._c_object,

671

priority, None))

469

672

470

673

try:

471

674

session.handshake()

481

684

session.bye()

482

685

return

483

686

logger.debug(u"Fingerprint: %s", fpr)

484

client = None

485

687

for c in self.server.clients:

486

688

if c.fingerprint == fpr:

487

689

client = c

488

690

break

489

if not client:

691

else:

490

692

logger.warning(u"Client not found for fingerprint: %s",

491

693

fpr)

492

694

session.bye()

499

701

vars(client))

500

702

session.bye()

501

703

return

704

## This won't work here, since we're in a fork.

705

# client.bump_timeout()

502

706

sent_size = 0

503

707

while sent_size < len(client.secret):

504

708

sent = session.send(client.secret[sent_size:])

509

713

session.bye()

510

714

511

715

512

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

716

class IPv6_TCPServer(SocketServer.ForkingMixIn,

717

SocketServer.TCPServer, object):

513

718

"""IPv6 TCP server. Accepts 'None' as address and/or port.

514

719

Attributes:

515

720

settings: Server settings

516

721

clients: Set() of Client objects

722

enabled: Boolean; whether this server is activated yet

517

723

"""

518

724

address_family = socket.AF_INET6

519

725

def __init__(self, *args, **kwargs):

523

729

if "clients" in kwargs:

524

730

self.clients = kwargs["clients"]

525

731

del kwargs["clients"]

526

return super(type(self), self).__init__(*args, **kwargs)

732

self.enabled = False

733

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

527

734

def server_bind(self):

528

735

"""This overrides the normal server_bind() function

529

736

to bind to an interface if one was specified, and also NOT to

558

765

# if_nametoindex

559

766

# (self.settings

560

767

# ["interface"]))

561

return super(type(self), self).server_bind()

768

return super(IPv6_TCPServer, self).server_bind()

769

def server_activate(self):

770

if self.enabled:

771

return super(IPv6_TCPServer, self).server_activate()

772

def enable(self):

773

self.enabled = True

562

774

563

775

564

776

def string_to_delta(interval):

580

792

timevalue = datetime.timedelta(0)

581

793

for s in interval.split():

582

794

try:

583

suffix=unicode(s[-1])

584

value=int(s[:-1])

795

suffix = unicode(s[-1])

796

value = int(s[:-1])

585

797

if suffix == u"d":

586

798

delta = datetime.timedelta(value)

587

799

elif suffix == u"s":

603

815

def server_state_changed(state):

604

816

"""Derived from the Avahi example code"""

605

817

if state == avahi.SERVER_COLLISION:

606

logger.error(u"Server name collision")

818

logger.error(u"Zeroconf server name collision")

607

819

service.remove()

608

820

elif state == avahi.SERVER_RUNNING:

609

821

service.add()

611

823

612

824

def entry_group_state_changed(state, error):

613

825

"""Derived from the Avahi example code"""

614

logger.debug(u"state change: %i", state)

826

logger.debug(u"Avahi state change: %i", state)

615

827

616

828

if state == avahi.ENTRY_GROUP_ESTABLISHED:

617

logger.debug(u"Service established.")

829

logger.debug(u"Zeroconf service established.")

618

830

elif state == avahi.ENTRY_GROUP_COLLISION:

619

logger.warning(u"Service name collision.")

831

logger.warning(u"Zeroconf service name collision.")

620

832

service.rename()

621

833

elif state == avahi.ENTRY_GROUP_FAILURE:

622

logger.critical(u"Error in group state changed %s",

834

logger.critical(u"Avahi: Error in group state changed %s",

623

835

unicode(error))

624

836

raise AvahiGroupError("State changed: %s", str(error))

625

837

627

839

"""Call the C function if_nametoindex(), or equivalent"""

628

840

global if_nametoindex

629

841

try:

630

if "ctypes.util" not in sys.modules:

631

import ctypes.util

632

if_nametoindex = ctypes.cdll.LoadLibrary\

633

(ctypes.util.find_library("c")).if_nametoindex

842

if_nametoindex = (ctypes.cdll.LoadLibrary

843

(ctypes.util.find_library("c"))

844

.if_nametoindex)

634

845

except (OSError, AttributeError):

635

846

if "struct" not in sys.modules:

636

847

import struct

639

850

def if_nametoindex(interface):

640

851

"Get an interface index the hard way, i.e. using fcntl()"

641

852

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

642

s = socket.socket()

643

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

644

struct.pack("16s16x", interface))

645

s.close()

853

with closing(socket.socket()) as s:

854

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

855

struct.pack("16s16x", interface))

646

856

interface_index = struct.unpack("I", ifreq[16:20])[0]

647

857

return interface_index

648

858

return if_nametoindex(interface)

672

882

673

883

674

884

def main():

675

global main_loop_started

676

main_loop_started = False

677

678

885

parser = OptionParser(version = "%%prog %s" % version)

679

886

parser.add_option("-i", "--interface", type="string",

680

887

metavar="IF", help="Bind to interface IF")

695

902

default="/etc/mandos", metavar="DIR",

696

903

help="Directory to search for configuration"

697

904

" files")

698

(options, args) = parser.parse_args()

905

options = parser.parse_args()[0]

699

906

700

907

if options.check:

701

908

import doctest

719

926

# Convert the SafeConfigParser object to a dict

720

927

server_settings = server_config.defaults()

721

928

# Use getboolean on the boolean config option

722

server_settings["debug"] = server_config.getboolean\

723

("DEFAULT", "debug")

929

server_settings["debug"] = (server_config.getboolean

930

("DEFAULT", "debug"))

724

931

del server_config

725

932

726

933

# Override the settings from the config file with command line

740

947

console.setLevel(logging.WARNING)

741

948

742

949

if server_settings["servicename"] != "Mandos":

743

syslogger.setFormatter(logging.Formatter\

950

syslogger.setFormatter(logging.Formatter

744

951

('Mandos (%s): %%(levelname)s:'

745

952

' %%(message)s'

746

953

% server_settings["servicename"]))

755

962

client_config.read(os.path.join(server_settings["configdir"],

756

963

"clients.conf"))

757

964

965

clients = Set()

966

tcp_server = IPv6_TCPServer((server_settings["address"],

967

server_settings["port"]),

968

TCP_handler,

969

settings=server_settings,

970

clients=clients)

971

pidfilename = "/var/run/mandos.pid"

972

try:

973

pidfile = open(pidfilename, "w")

974

except IOError, error:

975

logger.error("Could not open file %r", pidfilename)

976

977

try:

978

uid = pwd.getpwnam("_mandos").pw_uid

979

except KeyError:

980

try:

981

uid = pwd.getpwnam("mandos").pw_uid

982

except KeyError:

983

try:

984

uid = pwd.getpwnam("nobody").pw_uid

985

except KeyError:

986

uid = 65534

987

try:

988

gid = pwd.getpwnam("_mandos").pw_gid

989

except KeyError:

990

try:

991

gid = pwd.getpwnam("mandos").pw_gid

992

except KeyError:

993

try:

994

gid = pwd.getpwnam("nogroup").pw_gid

995

except KeyError:

996

gid = 65534

997

try:

998

os.setuid(uid)

999

os.setgid(gid)

1000

except OSError, error:

1001

if error[0] != errno.EPERM:

1002

raise error

1003

758

1004

global service

759

1005

service = AvahiService(name = server_settings["servicename"],

760

type = "_mandos._tcp", );

1006

servicetype = "_mandos._tcp", )

761

1007

if server_settings["interface"]:

762

service.interface = if_nametoindex(server_settings["interface"])

1008

service.interface = (if_nametoindex

1009

(server_settings["interface"]))

763

1010

764

1011

global main_loop

765

1012

global bus

768

1015

DBusGMainLoop(set_as_default=True )

769

1016

main_loop = gobject.MainLoop()

770

1017

bus = dbus.SystemBus()

771

server = dbus.Interface(

772

bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),

773

avahi.DBUS_INTERFACE_SERVER )

1018

server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,

1019

avahi.DBUS_PATH_SERVER),

1020

avahi.DBUS_INTERFACE_SERVER)

774

1021

# End of Avahi example code

775

776

clients = Set()

777

def remove_from_clients(client):

778

clients.remove(client)

779

if not clients:

780

logger.critical(u"No clients left, exiting")

781

sys.exit()

1022

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)

782

1023

783

1024

clients.update(Set(Client(name = section,

784

stop_hook = remove_from_clients,

785

1025

config

786

1026

= dict(client_config.items(section)))

787

1027

for section in client_config.sections()))

801

1041

# Close all input and output, do double fork, etc.

802

1042

daemon()

803

1043

804

pidfilename = "/var/run/mandos/mandos.pid"

805

pid = os.getpid()

806

1044

try:

807

pidfile = open(pidfilename, "w")

1045

pid = os.getpid()

808

1046

pidfile.write(str(pid) + "\n")

809

1047

pidfile.close()

810

1048

del pidfile

811

except IOError, err:

812

logger.error(u"Could not write %s file with PID %d",

813

pidfilename, os.getpid())

1049

except IOError:

1050

logger.error(u"Could not write to file %r with PID %d",

1051

pidfilename, pid)

1052

except NameError:

1053

# "pidfile" was never created

1054

pass

1055

del pidfilename

814

1056

815

1057

def cleanup():

816

1058

"Cleanup function; run on exit"

823

1065

824

1066

while clients:

825

1067

client = clients.pop()

826

client.stop_hook = None

827

client.stop()

1068

client.disable_hook = None

1069

client.disable()

828

1070

829

1071

atexit.register(cleanup)

830

1072

833

1075

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

834

1076

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

835

1077

1078

class MandosServer(dbus.service.Object):

1079

"""A D-Bus proxy object"""

1080

def __init__(self):

1081

dbus.service.Object.__init__(self, bus,

1082

"/Mandos")

1083

_interface = u"org.mandos_system.Mandos"

1084

1085

@dbus.service.signal(_interface, signature="oa{sv}")

1086

def ClientAdded(self, objpath, properties):

1087

"D-Bus signal"

1088

pass

1089

1090

@dbus.service.signal(_interface, signature="o")

1091

def ClientRemoved(self, objpath):

1092

"D-Bus signal"

1093

pass

1094

1095

@dbus.service.method(_interface, out_signature="ao")

1096

def GetAllClients(self):

1097

return dbus.Array(c.dbus_object_path for c in clients)

1098

1099

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1100

def GetAllClientsWithProperties(self):

1101

return dbus.Dictionary(

1102

((c.dbus_object_path, c.GetAllProperties())

1103

for c in clients),

1104

signature="oa{sv}")

1105

1106

@dbus.service.method(_interface, in_signature="o")

1107

def RemoveClient(self, object_path):

1108

for c in clients:

1109

if c.dbus_object_path == object_path:

1110

c.disable()

1111

clients.remove(c)

1112

return

1113

raise KeyError

1114

1115

del _interface

1116

1117

mandos_server = MandosServer()

1118

836

1119

for client in clients:

837

client.start()

838

839

tcp_server = IPv6_TCPServer((server_settings["address"],

840

server_settings["port"]),

841

tcp_handler,

842

settings=server_settings,

843

clients=clients)

1120

# Emit D-Bus signal

1121

mandos_server.ClientAdded(client.dbus_object_path,

1122

client.GetAllProperties())

1123

client.enable()

1124

1125

tcp_server.enable()

1126

tcp_server.server_activate()

1127

844

1128

# Find out what port we got

845

1129

service.port = tcp_server.socket.getsockname()[1]

846

1130

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

860

1144

861

1145

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

862

1146

lambda *args, **kwargs:

863

tcp_server.handle_request\

864

(*args[2:], **kwargs) or True)

1147

(tcp_server.handle_request

1148

(*args[2:], **kwargs) or True))

865

1149

866

1150

logger.debug(u"Starting main loop")

867

main_loop_started = True

868

1151

main_loop.run()

869

1152

except AvahiError, error:

870

1153

logger.critical(u"AvahiError: %s" + unicode(error))