To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 24.1.128
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.128
- Committer: Björn Påhlsson
- Date: 2009-01-19 06:55:59 UTC
- mto: (237.7.1 mandos) (24.1.154 mandos)
- mto: This revision was merged to the branch mainline in revision 250.
- Revision ID: belorn@braxen-20090119065559-vvflkj7ffxtn4ez4
fixed a bugg in mandos-ctl + added remove client option
- files added:
- NEWS
- debian/po
- files removed:
- etc-plugins.d-README
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
30
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
32
#
32
33
33
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
34
35
35
36
import SocketServer
36
37
import socket
37
import select
38
from optparse import OptionParser
38
import optparse
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
56
56
import logging
57
57
import logging.handlers
58
58
import pwd
59
from contextlib import closing
59
60
60
61
import dbus
62
import dbus.service
61
63
import gobject
62
64
import avahi
63
65
from dbus.mainloop.glib import DBusGMainLoop
64
66
import ctypes
67
import ctypes.util
65
68
66
version = "1.0"
69
version = "1.0.5"
67
70
68
71
logger = logging.Logger('mandos')
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
74
77
logger.addHandler(syslogger)
75
78
76
79
console = logging.StreamHandler()
79
82
logger.addHandler(console)
80
83
81
84
class AvahiError(Exception):
82
def __init__(self, value):
85
def __init__(self, value, *args, **kwargs):
83
86
self.value = value
84
def __str__(self):
85
return repr(self.value)
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
86
90
87
91
class AvahiServiceError(AvahiError):
88
92
pass
108
112
a sensible number of times
109
113
"""
110
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
111
type = None, port = None, TXT = None, domain = "",
112
host = "", max_renames = 32768):
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
113
117
self.interface = interface
114
118
self.name = name
115
self.type = type
119
self.type = servicetype
116
120
self.port = port
117
if TXT is None:
118
self.TXT = []
119
else:
120
self.TXT = TXT
121
self.TXT = TXT if TXT is not None else []
121
122
self.domain = domain
122
123
self.host = host
123
124
self.rename_count = 0
127
128
if self.rename_count >= self.max_renames:
128
129
logger.critical(u"No suitable Zeroconf service name found"
129
130
u" after %i retries, exiting.",
130
rename_count)
131
raise AvahiServiceError("Too many renames")
131
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
132
133
self.name = server.GetAlternativeServiceName(self.name)
133
134
logger.info(u"Changing Zeroconf service name to %r ...",
134
135
str(self.name))
135
syslogger.setFormatter(logging.Formatter\
136
syslogger.setFormatter(logging.Formatter
136
137
('Mandos (%s): %%(levelname)s:'
137
' %%(message)s' % self.name))
138
' %%(message)s' % self.name))
138
139
self.remove()
139
140
self.add()
140
141
self.rename_count += 1
146
147
"""Derived from the Avahi example code"""
147
148
global group
148
149
if group is None:
149
group = dbus.Interface\
150
(bus.get_object(avahi.DBUS_NAME,
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
151
152
server.EntryGroupNew()),
152
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
154
group.connect_to_signal('StateChanged',
154
155
entry_group_state_changed)
155
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
169
170
# End of Avahi example code
170
171
171
172
172
class Client(object):
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
173
179
"""A representation of a client host served by this server.
174
180
Attributes:
175
name: string; from the config file, used in log messages
181
name: string; from the config file, used in log messages and
182
D-Bus identifiers
176
183
fingerprint: string (40 or 32 hexadecimal digits); used to
177
184
uniquely identify the client
178
secret: bytestring; sent verbatim (over TLS) to client
179
host: string; available for use by the checker command
180
created: datetime.datetime(); object creation, not client host
181
last_checked_ok: datetime.datetime() or None if not yet checked OK
182
timeout: datetime.timedelta(); How long from last_checked_ok
183
until this client is invalid
184
interval: datetime.timedelta(); How often to start a new checker
185
stop_hook: If set, called by stop() as stop_hook(self)
186
checker: subprocess.Popen(); a running checker process used
187
to see if the client lives.
188
'None' if no process is running.
185
secret: bytestring; sent verbatim (over TLS) to client
186
host: string; available for use by the checker command
187
created: datetime.datetime(); (UTC) object creation
188
last_enabled: datetime.datetime(); (UTC)
189
enabled: bool()
190
last_checked_ok: datetime.datetime(); (UTC) or None
191
timeout: datetime.timedelta(); How long from last_checked_ok
192
until this client is invalid
193
interval: datetime.timedelta(); How often to start a new checker
194
disable_hook: If set, called by disable() as disable_hook(self)
195
checker: subprocess.Popen(); a running checker process used
196
to see if the client lives.
197
'None' if no process is running.
189
198
checker_initiator_tag: a gobject event source tag, or None
190
stop_initiator_tag: - '' -
199
disable_initiator_tag: - '' -
191
200
checker_callback_tag: - '' -
192
201
checker_command: string; External command which is run to check if
193
202
client lives. %() expansions are done at
194
203
runtime with vars(self) as dict, so that for
195
204
instance %(name)s can be used in the command.
196
Private attibutes:
197
_timeout: Real variable for 'timeout'
198
_interval: Real variable for 'interval'
199
_timeout_milliseconds: Used when calling gobject.timeout_add()
200
_interval_milliseconds: - '' -
205
use_dbus: bool(); Whether to provide D-Bus interface and signals
206
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
201
207
"""
202
def _set_timeout(self, timeout):
203
"Setter function for 'timeout' attribute"
204
self._timeout = timeout
205
self._timeout_milliseconds = ((self.timeout.days
206
* 24 * 60 * 60 * 1000)
207
+ (self.timeout.seconds * 1000)
208
+ (self.timeout.microseconds
209
// 1000))
210
timeout = property(lambda self: self._timeout,
211
_set_timeout)
212
del _set_timeout
213
def _set_interval(self, interval):
214
"Setter function for 'interval' attribute"
215
self._interval = interval
216
self._interval_milliseconds = ((self.interval.days
217
* 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds
219
* 1000)
220
+ (self.interval.microseconds
221
// 1000))
222
interval = property(lambda self: self._interval,
223
_set_interval)
224
del _set_interval
225
def __init__(self, name = None, stop_hook=None, config={}):
208
def timeout_milliseconds(self):
209
"Return the 'timeout' attribute in milliseconds"
210
return ((self.timeout.days * 24 * 60 * 60 * 1000)
211
+ (self.timeout.seconds * 1000)
212
+ (self.timeout.microseconds // 1000))
213
214
def interval_milliseconds(self):
215
"Return the 'interval' attribute in milliseconds"
216
return ((self.interval.days * 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds * 1000)
218
+ (self.interval.microseconds // 1000))
219
220
def __init__(self, name = None, disable_hook=None, config=None,
221
use_dbus=True):
226
222
"""Note: the 'checker' key in 'config' sets the
227
223
'checker_command' attribute and *not* the 'checker'
228
224
attribute."""
229
225
self.name = name
226
if config is None:
227
config = {}
230
228
logger.debug(u"Creating client %r", self.name)
229
self.use_dbus = use_dbus
230
if self.use_dbus:
231
self.dbus_object_path = (dbus.ObjectPath
232
("/Mandos/clients/"
233
+ self.name.replace(".", "_")))
234
dbus.service.Object.__init__(self, bus,
235
self.dbus_object_path)
231
236
# Uppercase and remove spaces from fingerprint for later
232
237
# comparison purposes with return value from the fingerprint()
233
238
# function
234
self.fingerprint = config["fingerprint"].upper()\
235
.replace(u" ", u"")
239
self.fingerprint = (config["fingerprint"].upper()
240
.replace(u" ", u""))
236
241
logger.debug(u" Fingerprint: %s", self.fingerprint)
237
242
if "secret" in config:
238
243
self.secret = config["secret"].decode(u"base64")
239
244
elif "secfile" in config:
240
sf = open(config["secfile"])
241
self.secret = sf.read()
242
sf.close()
245
with closing(open(os.path.expanduser
246
(os.path.expandvars
247
(config["secfile"])))) as secfile:
248
self.secret = secfile.read()
243
249
else:
244
250
raise TypeError(u"No secret or secfile for client %s"
245
251
% self.name)
246
252
self.host = config.get("host", "")
247
self.created = datetime.datetime.now()
253
self.created = datetime.datetime.utcnow()
254
self.enabled = False
255
self.last_enabled = None
248
256
self.last_checked_ok = None
249
257
self.timeout = string_to_delta(config["timeout"])
250
258
self.interval = string_to_delta(config["interval"])
251
self.stop_hook = stop_hook
259
self.disable_hook = disable_hook
252
260
self.checker = None
253
261
self.checker_initiator_tag = None
254
self.stop_initiator_tag = None
262
self.disable_initiator_tag = None
255
263
self.checker_callback_tag = None
256
self.check_command = config["checker"]
257
def start(self):
264
self.checker_command = config["checker"]
265
266
def enable(self):
258
267
"""Start this client's checker and timeout hooks"""
268
self.last_enabled = datetime.datetime.utcnow()
259
269
# Schedule a new checker to be started an 'interval' from now,
260
270
# and every interval from then on.
261
self.checker_initiator_tag = gobject.timeout_add\
262
(self._interval_milliseconds,
263
self.start_checker)
271
self.checker_initiator_tag = (gobject.timeout_add
272
(self.interval_milliseconds(),
273
self.start_checker))
264
274
# Also start a new checker *right now*.
265
275
self.start_checker()
266
# Schedule a stop() when 'timeout' has passed
267
self.stop_initiator_tag = gobject.timeout_add\
268
(self._timeout_milliseconds,
269
self.stop)
270
def stop(self):
271
"""Stop this client.
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
274
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
276
logger.info(u"Stopping client %s", self.name)
277
self.secret = None
278
else:
276
# Schedule a disable() when 'timeout' has passed
277
self.disable_initiator_tag = (gobject.timeout_add
278
(self.timeout_milliseconds(),
279
self.disable))
280
self.enabled = True
281
if self.use_dbus:
282
# Emit D-Bus signals
283
self.PropertyChanged(dbus.String(u"enabled"),
284
dbus.Boolean(True, variant_level=1))
285
self.PropertyChanged(dbus.String(u"last_enabled"),
286
(_datetime_to_dbus(self.last_enabled,
287
variant_level=1)))
288
289
def disable(self):
290
"""Disable this client."""
291
if not getattr(self, "enabled", False):
279
292
return False
280
if getattr(self, "stop_initiator_tag", False):
281
gobject.source_remove(self.stop_initiator_tag)
282
self.stop_initiator_tag = None
293
logger.info(u"Disabling client %s", self.name)
294
if getattr(self, "disable_initiator_tag", False):
295
gobject.source_remove(self.disable_initiator_tag)
296
self.disable_initiator_tag = None
283
297
if getattr(self, "checker_initiator_tag", False):
284
298
gobject.source_remove(self.checker_initiator_tag)
285
299
self.checker_initiator_tag = None
286
300
self.stop_checker()
287
if self.stop_hook:
288
self.stop_hook(self)
301
if self.disable_hook:
302
self.disable_hook(self)
303
self.enabled = False
304
if self.use_dbus:
305
# Emit D-Bus signal
306
self.PropertyChanged(dbus.String(u"enabled"),
307
dbus.Boolean(False, variant_level=1))
289
308
# Do not run this again if called by a gobject.timeout_add
290
309
return False
310
291
311
def __del__(self):
292
self.stop_hook = None
293
self.stop()
294
def checker_callback(self, pid, condition):
312
self.disable_hook = None
313
self.disable()
314
315
def checker_callback(self, pid, condition, command):
295
316
"""The checker has completed, so take appropriate actions."""
296
now = datetime.datetime.now()
297
317
self.checker_callback_tag = None
298
318
self.checker = None
299
if os.WIFEXITED(condition) \
300
and (os.WEXITSTATUS(condition) == 0):
319
if self.use_dbus:
320
# Emit D-Bus signal
321
self.PropertyChanged(dbus.String(u"checker_running"),
322
dbus.Boolean(False, variant_level=1))
323
if (os.WIFEXITED(condition)
324
and (os.WEXITSTATUS(condition) == 0)):
301
325
logger.info(u"Checker for %(name)s succeeded",
302
326
vars(self))
303
self.last_checked_ok = now
304
gobject.source_remove(self.stop_initiator_tag)
305
self.stop_initiator_tag = gobject.timeout_add\
306
(self._timeout_milliseconds,
307
self.stop)
327
if self.use_dbus:
328
# Emit D-Bus signal
329
self.CheckerCompleted(dbus.Boolean(True),
330
dbus.UInt16(condition),
331
dbus.String(command))
332
self.bump_timeout()
308
333
elif not os.WIFEXITED(condition):
309
334
logger.warning(u"Checker for %(name)s crashed?",
310
335
vars(self))
336
if self.use_dbus:
337
# Emit D-Bus signal
338
self.CheckerCompleted(dbus.Boolean(False),
339
dbus.UInt16(condition),
340
dbus.String(command))
311
341
else:
312
342
logger.info(u"Checker for %(name)s failed",
313
343
vars(self))
344
if self.use_dbus:
345
# Emit D-Bus signal
346
self.CheckerCompleted(dbus.Boolean(False),
347
dbus.UInt16(condition),
348
dbus.String(command))
349
350
def bump_timeout(self):
351
"""Bump up the timeout for this client.
352
This should only be called when the client has been seen,
353
alive and well.
354
"""
355
self.last_checked_ok = datetime.datetime.utcnow()
356
gobject.source_remove(self.disable_initiator_tag)
357
self.disable_initiator_tag = (gobject.timeout_add
358
(self.timeout_milliseconds(),
359
self.disable))
360
if self.use_dbus:
361
# Emit D-Bus signal
362
self.PropertyChanged(
363
dbus.String(u"last_checked_ok"),
364
(_datetime_to_dbus(self.last_checked_ok,
365
variant_level=1)))
366
314
367
def start_checker(self):
315
368
"""Start a new checker subprocess if one is not running.
316
369
If a checker already exists, leave it running and do
325
378
# is as it should be.
326
379
if self.checker is None:
327
380
try:
328
# In case check_command has exactly one % operator
329
command = self.check_command % self.host
381
# In case checker_command has exactly one % operator
382
command = self.checker_command % self.host
330
383
except TypeError:
331
384
# Escape attributes for the shell
332
385
escaped_attrs = dict((key, re.escape(str(val)))
333
386
for key, val in
334
387
vars(self).iteritems())
335
388
try:
336
command = self.check_command % escaped_attrs
389
command = self.checker_command % escaped_attrs
337
390
except TypeError, error:
338
391
logger.error(u'Could not format string "%s":'
339
u' %s', self.check_command, error)
392
u' %s', self.checker_command, error)
340
393
return True # Try again later
341
394
try:
342
395
logger.info(u"Starting checker %r for %s",
348
401
self.checker = subprocess.Popen(command,
349
402
close_fds=True,
350
403
shell=True, cwd="/")
351
self.checker_callback_tag = gobject.child_watch_add\
352
(self.checker.pid,
353
self.checker_callback)
404
if self.use_dbus:
405
# Emit D-Bus signal
406
self.CheckerStarted(command)
407
self.PropertyChanged(
408
dbus.String("checker_running"),
409
dbus.Boolean(True, variant_level=1))
410
self.checker_callback_tag = (gobject.child_watch_add
411
(self.checker.pid,
412
self.checker_callback,
413
data=command))
354
414
except OSError, error:
355
415
logger.error(u"Failed to start subprocess: %s",
356
416
error)
357
417
# Re-run this periodically if run by gobject.timeout_add
358
418
return True
419
359
420
def stop_checker(self):
360
421
"""Force the checker process, if any, to stop."""
361
422
if self.checker_callback_tag:
373
434
if error.errno != errno.ESRCH: # No such process
374
435
raise
375
436
self.checker = None
437
if self.use_dbus:
438
self.PropertyChanged(dbus.String(u"checker_running"),
439
dbus.Boolean(False, variant_level=1))
440
376
441
def still_valid(self):
377
442
"""Has the timeout not yet passed for this client?"""
378
now = datetime.datetime.now()
443
if not getattr(self, "enabled", False):
444
return False
445
now = datetime.datetime.utcnow()
379
446
if self.last_checked_ok is None:
380
447
return now < (self.created + self.timeout)
381
448
else:
382
449
return now < (self.last_checked_ok + self.timeout)
450
451
## D-Bus methods & signals
452
_interface = u"org.mandos_system.Mandos.Client"
453
454
# BumpTimeout - method
455
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
456
BumpTimeout.__name__ = "BumpTimeout"
457
458
# CheckerCompleted - signal
459
@dbus.service.signal(_interface, signature="bqs")
460
def CheckerCompleted(self, success, condition, command):
461
"D-Bus signal"
462
pass
463
464
# CheckerStarted - signal
465
@dbus.service.signal(_interface, signature="s")
466
def CheckerStarted(self, command):
467
"D-Bus signal"
468
pass
469
470
# GetAllProperties - method
471
@dbus.service.method(_interface, out_signature="a{sv}")
472
def GetAllProperties(self):
473
"D-Bus method"
474
return dbus.Dictionary({
475
dbus.String("name"):
476
dbus.String(self.name, variant_level=1),
477
dbus.String("fingerprint"):
478
dbus.String(self.fingerprint, variant_level=1),
479
dbus.String("host"):
480
dbus.String(self.host, variant_level=1),
481
dbus.String("created"):
482
_datetime_to_dbus(self.created, variant_level=1),
483
dbus.String("last_enabled"):
484
(_datetime_to_dbus(self.last_enabled,
485
variant_level=1)
486
if self.last_enabled is not None
487
else dbus.Boolean(False, variant_level=1)),
488
dbus.String("enabled"):
489
dbus.Boolean(self.enabled, variant_level=1),
490
dbus.String("last_checked_ok"):
491
(_datetime_to_dbus(self.last_checked_ok,
492
variant_level=1)
493
if self.last_checked_ok is not None
494
else dbus.Boolean (False, variant_level=1)),
495
dbus.String("timeout"):
496
dbus.UInt64(self.timeout_milliseconds(),
497
variant_level=1),
498
dbus.String("interval"):
499
dbus.UInt64(self.interval_milliseconds(),
500
variant_level=1),
501
dbus.String("checker"):
502
dbus.String(self.checker_command,
503
variant_level=1),
504
dbus.String("checker_running"):
505
dbus.Boolean(self.checker is not None,
506
variant_level=1),
507
dbus.String("object_path"):
508
dbus.ObjectPath(self.dbus_object_path,
509
variant_level=1)
510
}, signature="sv")
511
512
# IsStillValid - method
513
IsStillValid = (dbus.service.method(_interface, out_signature="b")
514
(still_valid))
515
IsStillValid.__name__ = "IsStillValid"
516
517
# PropertyChanged - signal
518
@dbus.service.signal(_interface, signature="sv")
519
def PropertyChanged(self, property, value):
520
"D-Bus signal"
521
pass
522
523
# SetChecker - method
524
@dbus.service.method(_interface, in_signature="s")
525
def SetChecker(self, checker):
526
"D-Bus setter method"
527
self.checker_command = checker
528
# Emit D-Bus signal
529
self.PropertyChanged(dbus.String(u"checker"),
530
dbus.String(self.checker_command,
531
variant_level=1))
532
533
# SetHost - method
534
@dbus.service.method(_interface, in_signature="s")
535
def SetHost(self, host):
536
"D-Bus setter method"
537
self.host = host
538
# Emit D-Bus signal
539
self.PropertyChanged(dbus.String(u"host"),
540
dbus.String(self.host, variant_level=1))
541
542
# SetInterval - method
543
@dbus.service.method(_interface, in_signature="t")
544
def SetInterval(self, milliseconds):
545
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
546
# Emit D-Bus signal
547
self.PropertyChanged(dbus.String(u"interval"),
548
(dbus.UInt64(self.interval_milliseconds(),
549
variant_level=1)))
550
551
# SetSecret - method
552
@dbus.service.method(_interface, in_signature="ay",
553
byte_arrays=True)
554
def SetSecret(self, secret):
555
"D-Bus setter method"
556
self.secret = str(secret)
557
558
# SetTimeout - method
559
@dbus.service.method(_interface, in_signature="t")
560
def SetTimeout(self, milliseconds):
561
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
562
# Emit D-Bus signal
563
self.PropertyChanged(dbus.String(u"timeout"),
564
(dbus.UInt64(self.timeout_milliseconds(),
565
variant_level=1)))
566
567
# Enable - method
568
Enable = dbus.service.method(_interface)(enable)
569
Enable.__name__ = "Enable"
570
571
# StartChecker - method
572
@dbus.service.method(_interface)
573
def StartChecker(self):
574
"D-Bus method"
575
self.start_checker()
576
577
# Disable - method
578
@dbus.service.method(_interface)
579
def Disable(self):
580
"D-Bus method"
581
self.disable()
582
583
# StopChecker - method
584
StopChecker = dbus.service.method(_interface)(stop_checker)
585
StopChecker.__name__ = "StopChecker"
586
587
del _interface
383
588
384
589
385
590
def peer_certificate(session):
386
591
"Return the peer's OpenPGP certificate as a bytestring"
387
592
# If not an OpenPGP certificate...
388
if gnutls.library.functions.gnutls_certificate_type_get\
389
(session._c_object) \
390
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
593
if (gnutls.library.functions
594
.gnutls_certificate_type_get(session._c_object)
595
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
391
596
# ...do the normal thing
392
597
return session.peer_certificate
393
598
list_size = ctypes.c_uint()
394
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
(session._c_object, ctypes.byref(list_size))
599
cert_list = (gnutls.library.functions
600
.gnutls_certificate_get_peers
601
(session._c_object, ctypes.byref(list_size)))
396
602
if list_size.value == 0:
397
603
return None
398
604
cert = cert_list[0]
402
608
def fingerprint(openpgp):
403
609
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
404
610
# New GnuTLS "datum" with the OpenPGP public key
405
datum = gnutls.library.types.gnutls_datum_t\
406
(ctypes.cast(ctypes.c_char_p(openpgp),
407
ctypes.POINTER(ctypes.c_ubyte)),
408
ctypes.c_uint(len(openpgp)))
611
datum = (gnutls.library.types
612
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
613
ctypes.POINTER
614
(ctypes.c_ubyte)),
615
ctypes.c_uint(len(openpgp))))
409
616
# New empty GnuTLS certificate
410
617
crt = gnutls.library.types.gnutls_openpgp_crt_t()
411
gnutls.library.functions.gnutls_openpgp_crt_init\
412
(ctypes.byref(crt))
618
(gnutls.library.functions
619
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
413
620
# Import the OpenPGP public key into the certificate
414
gnutls.library.functions.gnutls_openpgp_crt_import\
415
(crt, ctypes.byref(datum),
416
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
621
(gnutls.library.functions
622
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
623
gnutls.library.constants
624
.GNUTLS_OPENPGP_FMT_RAW))
417
625
# Verify the self signature in the key
418
crtverify = ctypes.c_uint();
419
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
(crt, 0, ctypes.byref(crtverify))
626
crtverify = ctypes.c_uint()
627
(gnutls.library.functions
628
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
421
629
if crtverify.value != 0:
422
630
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
423
631
raise gnutls.errors.CertificateSecurityError("Verify failed")
424
632
# New buffer for the fingerprint
425
buffer = ctypes.create_string_buffer(20)
426
buffer_length = ctypes.c_size_t()
633
buf = ctypes.create_string_buffer(20)
634
buf_len = ctypes.c_size_t()
427
635
# Get the fingerprint from the certificate into the buffer
428
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
636
(gnutls.library.functions
637
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
638
ctypes.byref(buf_len)))
430
639
# Deinit the certificate
431
640
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
432
641
# Convert the buffer to a Python bytestring
433
fpr = ctypes.string_at(buffer, buffer_length.value)
642
fpr = ctypes.string_at(buf, buf_len.value)
434
643
# Convert the bytestring to hexadecimal notation
435
644
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
436
645
return hex_fpr
437
646
438
647
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
648
class TCP_handler(SocketServer.BaseRequestHandler, object):
440
649
"""A TCP request handler class.
441
650
Instantiated by IPv6_TCPServer for each request to handle it.
442
651
Note: This will run in its own forked process."""
443
652
444
653
def handle(self):
445
654
logger.info(u"TCP connection from: %s",
446
unicode(self.client_address))
447
session = gnutls.connection.ClientSession\
448
(self.request, gnutls.connection.X509Credentials())
655
unicode(self.client_address))
656
session = (gnutls.connection
657
.ClientSession(self.request,
658
gnutls.connection
659
.X509Credentials()))
449
660
450
661
line = self.request.makefile().readline()
451
662
logger.debug(u"Protocol version: %r", line)
464
675
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
465
676
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
466
677
# "+DHE-DSS"))
467
priority = "NORMAL" # Fallback default, since this
468
# MUST be set.
469
if self.server.settings["priority"]:
470
priority = self.server.settings["priority"]
471
gnutls.library.functions.gnutls_priority_set_direct\
472
(session._c_object, priority, None);
678
# Use a fallback default, since this MUST be set.
679
priority = self.server.settings.get("priority", "NORMAL")
680
(gnutls.library.functions
681
.gnutls_priority_set_direct(session._c_object,
682
priority, None))
473
683
474
684
try:
475
685
session.handshake()
485
695
session.bye()
486
696
return
487
697
logger.debug(u"Fingerprint: %s", fpr)
488
client = None
489
698
for c in self.server.clients:
490
699
if c.fingerprint == fpr:
491
700
client = c
492
701
break
493
if not client:
702
else:
494
703
logger.warning(u"Client not found for fingerprint: %s",
495
704
fpr)
496
705
session.bye()
503
712
vars(client))
504
713
session.bye()
505
714
return
715
## This won't work here, since we're in a fork.
716
# client.bump_timeout()
506
717
sent_size = 0
507
718
while sent_size < len(client.secret):
508
719
sent = session.send(client.secret[sent_size:])
513
724
session.bye()
514
725
515
726
516
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
727
class IPv6_TCPServer(SocketServer.ForkingMixIn,
728
SocketServer.TCPServer, object):
517
729
"""IPv6 TCP server. Accepts 'None' as address and/or port.
518
730
Attributes:
519
731
settings: Server settings
529
741
self.clients = kwargs["clients"]
530
742
del kwargs["clients"]
531
743
self.enabled = False
532
return super(type(self), self).__init__(*args, **kwargs)
744
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
533
745
def server_bind(self):
534
746
"""This overrides the normal server_bind() function
535
747
to bind to an interface if one was specified, and also NOT to
564
776
# if_nametoindex
565
777
# (self.settings
566
778
# ["interface"]))
567
return super(type(self), self).server_bind()
779
return super(IPv6_TCPServer, self).server_bind()
568
780
def server_activate(self):
569
781
if self.enabled:
570
return super(type(self), self).server_activate()
782
return super(IPv6_TCPServer, self).server_activate()
571
783
def enable(self):
572
784
self.enabled = True
573
785
591
803
timevalue = datetime.timedelta(0)
592
804
for s in interval.split():
593
805
try:
594
suffix=unicode(s[-1])
595
value=int(s[:-1])
806
suffix = unicode(s[-1])
807
value = int(s[:-1])
596
808
if suffix == u"d":
597
809
delta = datetime.timedelta(value)
598
810
elif suffix == u"s":
632
844
elif state == avahi.ENTRY_GROUP_FAILURE:
633
845
logger.critical(u"Avahi: Error in group state changed %s",
634
846
unicode(error))
635
raise AvahiGroupError("State changed: %s", str(error))
847
raise AvahiGroupError(u"State changed: %s" % unicode(error))
636
848
637
849
def if_nametoindex(interface):
638
850
"""Call the C function if_nametoindex(), or equivalent"""
639
851
global if_nametoindex
640
852
try:
641
if "ctypes.util" not in sys.modules:
642
import ctypes.util
643
if_nametoindex = ctypes.cdll.LoadLibrary\
644
(ctypes.util.find_library("c")).if_nametoindex
853
if_nametoindex = (ctypes.cdll.LoadLibrary
854
(ctypes.util.find_library("c"))
855
.if_nametoindex)
645
856
except (OSError, AttributeError):
646
857
if "struct" not in sys.modules:
647
858
import struct
650
861
def if_nametoindex(interface):
651
862
"Get an interface index the hard way, i.e. using fcntl()"
652
863
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
653
s = socket.socket()
654
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
655
struct.pack("16s16x", interface))
656
s.close()
864
with closing(socket.socket()) as s:
865
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
866
struct.pack("16s16x", interface))
657
867
interface_index = struct.unpack("I", ifreq[16:20])[0]
658
868
return interface_index
659
869
return if_nametoindex(interface)
683
893
684
894
685
895
def main():
686
global main_loop_started
687
main_loop_started = False
688
689
parser = OptionParser(version = "%%prog %s" % version)
896
parser = optparse.OptionParser(version = "%%prog %s" % version)
690
897
parser.add_option("-i", "--interface", type="string",
691
898
metavar="IF", help="Bind to interface IF")
692
899
parser.add_option("-a", "--address", type="string",
693
900
help="Address to listen for requests on")
694
901
parser.add_option("-p", "--port", type="int",
695
902
help="Port number to receive requests on")
696
parser.add_option("--check", action="store_true", default=False,
903
parser.add_option("--check", action="store_true",
697
904
help="Run self-test")
698
905
parser.add_option("--debug", action="store_true",
699
906
help="Debug mode; run in foreground and log to"
706
913
default="/etc/mandos", metavar="DIR",
707
914
help="Directory to search for configuration"
708
915
" files")
709
(options, args) = parser.parse_args()
916
parser.add_option("--no-dbus", action="store_false",
917
dest="use_dbus",
918
help="Do not provide D-Bus system bus"
919
" interface")
920
options = parser.parse_args()[0]
710
921
711
922
if options.check:
712
923
import doctest
721
932
"priority":
722
933
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
723
934
"servicename": "Mandos",
935
"use_dbus": "True",
724
936
}
725
937
726
938
# Parse config file for server-global settings
729
941
server_config.read(os.path.join(options.configdir, "mandos.conf"))
730
942
# Convert the SafeConfigParser object to a dict
731
943
server_settings = server_config.defaults()
732
# Use getboolean on the boolean config option
733
server_settings["debug"] = server_config.getboolean\
734
("DEFAULT", "debug")
944
# Use getboolean on the boolean config options
945
server_settings["debug"] = (server_config.getboolean
946
("DEFAULT", "debug"))
947
server_settings["use_dbus"] = (server_config.getboolean
948
("DEFAULT", "use_dbus"))
735
949
del server_config
736
950
737
951
# Override the settings from the config file with command line
738
952
# options, if set.
739
953
for option in ("interface", "address", "port", "debug",
740
"priority", "servicename", "configdir"):
954
"priority", "servicename", "configdir",
955
"use_dbus"):
741
956
value = getattr(options, option)
742
957
if value is not None:
743
958
server_settings[option] = value
744
959
del options
745
960
# Now we have our good server settings in "server_settings"
746
961
962
# For convenience
747
963
debug = server_settings["debug"]
964
use_dbus = server_settings["use_dbus"]
748
965
749
966
if not debug:
750
967
syslogger.setLevel(logging.WARNING)
751
968
console.setLevel(logging.WARNING)
752
969
753
970
if server_settings["servicename"] != "Mandos":
754
syslogger.setFormatter(logging.Formatter\
971
syslogger.setFormatter(logging.Formatter
755
972
('Mandos (%s): %%(levelname)s:'
756
973
' %%(message)s'
757
974
% server_settings["servicename"]))
759
976
# Parse config file with clients
760
977
client_defaults = { "timeout": "1h",
761
978
"interval": "5m",
762
"checker": "fping -q -- %(host)s",
979
"checker": "fping -q -- %%(host)s",
763
980
"host": "",
764
981
}
765
982
client_config = ConfigParser.SafeConfigParser(client_defaults)
769
986
clients = Set()
770
987
tcp_server = IPv6_TCPServer((server_settings["address"],
771
988
server_settings["port"]),
772
tcp_handler,
989
TCP_handler,
773
990
settings=server_settings,
774
991
clients=clients)
775
992
pidfilename = "/var/run/mandos.pid"
778
995
except IOError, error:
779
996
logger.error("Could not open file %r", pidfilename)
780
997
781
uid = 65534
782
gid = 65534
783
try:
784
uid = pwd.getpwnam("mandos").pw_uid
785
except KeyError:
786
try:
787
uid = pwd.getpwnam("nobody").pw_uid
788
except KeyError:
789
pass
790
try:
791
gid = pwd.getpwnam("mandos").pw_gid
792
except KeyError:
793
try:
794
gid = pwd.getpwnam("nogroup").pw_gid
795
except KeyError:
796
pass
998
try:
999
uid = pwd.getpwnam("_mandos").pw_uid
1000
gid = pwd.getpwnam("_mandos").pw_gid
1001
except KeyError:
1002
try:
1003
uid = pwd.getpwnam("mandos").pw_uid
1004
gid = pwd.getpwnam("mandos").pw_gid
1005
except KeyError:
1006
try:
1007
uid = pwd.getpwnam("nobody").pw_uid
1008
gid = pwd.getpwnam("nogroup").pw_gid
1009
except KeyError:
1010
uid = 65534
1011
gid = 65534
797
1012
try:
798
1013
os.setuid(uid)
799
1014
os.setgid(gid)
803
1018
804
1019
global service
805
1020
service = AvahiService(name = server_settings["servicename"],
806
type = "_mandos._tcp", );
1021
servicetype = "_mandos._tcp", )
807
1022
if server_settings["interface"]:
808
service.interface = if_nametoindex\
809
(server_settings["interface"])
1023
service.interface = (if_nametoindex
1024
(server_settings["interface"]))
810
1025
811
1026
global main_loop
812
1027
global bus
819
1034
avahi.DBUS_PATH_SERVER),
820
1035
avahi.DBUS_INTERFACE_SERVER)
821
1036
# End of Avahi example code
822
823
def remove_from_clients(client):
824
clients.remove(client)
825
if not clients:
826
logger.critical(u"No clients left, exiting")
827
sys.exit()
1037
if use_dbus:
1038
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1039
bus)
828
1040
829
1041
clients.update(Set(Client(name = section,
830
stop_hook = remove_from_clients,
831
1042
config
832
= dict(client_config.items(section)))
1043
= dict(client_config.items(section)),
1044
use_dbus = use_dbus)
833
1045
for section in client_config.sections()))
834
1046
if not clients:
835
logger.critical(u"No clients defined")
836
sys.exit(1)
1047
logger.warning(u"No clients defined")
837
1048
838
1049
if debug:
839
1050
# Redirect stdin so all checkers get /dev/null
852
1063
pidfile.write(str(pid) + "\n")
853
1064
pidfile.close()
854
1065
del pidfile
855
except IOError, err:
1066
except IOError:
856
1067
logger.error(u"Could not write to file %r with PID %d",
857
1068
pidfilename, pid)
858
1069
except NameError:
871
1082
872
1083
while clients:
873
1084
client = clients.pop()
874
client.stop_hook = None
875
client.stop()
1085
client.disable_hook = None
1086
client.disable()
876
1087
877
1088
atexit.register(cleanup)
878
1089
881
1092
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
882
1093
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
883
1094
1095
if use_dbus:
1096
class MandosServer(dbus.service.Object):
1097
"""A D-Bus proxy object"""
1098
def __init__(self):
1099
dbus.service.Object.__init__(self, bus,
1100
"/Mandos")
1101
_interface = u"org.mandos_system.Mandos"
1102
1103
@dbus.service.signal(_interface, signature="oa{sv}")
1104
def ClientAdded(self, objpath, properties):
1105
"D-Bus signal"
1106
pass
1107
1108
@dbus.service.signal(_interface, signature="os")
1109
def ClientRemoved(self, objpath, name):
1110
"D-Bus signal"
1111
pass
1112
1113
@dbus.service.method(_interface, out_signature="ao")
1114
def GetAllClients(self):
1115
return dbus.Array(c.dbus_object_path for c in clients)
1116
1117
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1118
def GetAllClientsWithProperties(self):
1119
return dbus.Dictionary(
1120
((c.dbus_object_path, c.GetAllProperties())
1121
for c in clients),
1122
signature="oa{sv}")
1123
1124
@dbus.service.method(_interface, in_signature="o")
1125
def RemoveClient(self, object_path):
1126
for c in clients:
1127
if c.dbus_object_path == object_path:
1128
clients.remove(c)
1129
# Don't signal anything except ClientRemoved
1130
c.use_dbus = False
1131
c.disable()
1132
# Emit D-Bus signal
1133
self.ClientRemoved(object_path, c.name)
1134
return
1135
raise KeyError
1136
1137
@dbus.service.method(_interface, in_signature="s")
1138
def RemoveClientByName(self, name):
1139
for c in clients:
1140
if c.name == name:
1141
clients.remove(c)
1142
# Don't signal anything except ClientRemoved
1143
c.use_dbus = False
1144
c.disable()
1145
# Emit D-Bus signal
1146
self.ClientRemoved(c.dbus_object_path, name)
1147
return
1148
raise KeyError
1149
1150
@dbus.service.method(_interface)
1151
def Quit(self):
1152
main_loop.quit()
1153
1154
del _interface
1155
1156
mandos_server = MandosServer()
1157
884
1158
for client in clients:
885
client.start()
1159
if use_dbus:
1160
# Emit D-Bus signal
1161
mandos_server.ClientAdded(client.dbus_object_path,
1162
client.GetAllProperties())
1163
client.enable()
886
1164
887
1165
tcp_server.enable()
888
1166
tcp_server.server_activate()
906
1184
907
1185
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
908
1186
lambda *args, **kwargs:
909
tcp_server.handle_request\
910
(*args[2:], **kwargs) or True)
1187
(tcp_server.handle_request
1188
(*args[2:], **kwargs) or True))
911
1189
912
1190
logger.debug(u"Starting main loop")
913
main_loop_started = True
914
1191
main_loop.run()
915
1192
except AvahiError, error:
916
logger.critical(u"AvahiError: %s" + unicode(error))
1193
logger.critical(u"AvahiError: %s", error)
917
1194
sys.exit(1)
918
1195
except KeyboardInterrupt:
919
1196
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0