To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 24.1.128
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.128
- Committer: Björn Påhlsson
- Date: 2009-01-19 06:55:59 UTC
- mto: (237.7.1 mandos) (24.1.154 mandos)
- mto: This revision was merged to the branch mainline in revision 250.
- Revision ID: belorn@braxen-20090119065559-vvflkj7ffxtn4ez4
fixed a bugg in mandos-ctl + added remove client option
- files modified:
- INSTALL
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
34
34
from __future__ import division, with_statement, absolute_import
35
35
36
import SocketServer as socketserver
36
import SocketServer
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
import ConfigParser as configparser
47
import ConfigParser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
from sets import Set
52
53
import subprocess
53
54
import atexit
54
55
import stat
56
57
import logging.handlers
57
58
import pwd
58
59
from contextlib import closing
59
import struct
60
import fcntl
61
import functools
62
60
63
61
import dbus
64
62
import dbus.service
68
66
import ctypes
69
67
import ctypes.util
70
68
71
try:
72
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
73
except AttributeError:
74
try:
75
from IN import SO_BINDTODEVICE
76
except ImportError:
77
SO_BINDTODEVICE = None
78
79
80
version = "1.0.14"
81
82
logger = logging.Logger(u'mandos')
69
version = "1.0.5"
70
71
logger = logging.Logger('mandos')
83
72
syslogger = (logging.handlers.SysLogHandler
84
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
85
74
address = "/dev/log"))
86
75
syslogger.setFormatter(logging.Formatter
87
(u'Mandos [%(process)d]: %(levelname)s:'
88
u' %(message)s'))
76
('Mandos: %(levelname)s: %(message)s'))
89
77
logger.addHandler(syslogger)
90
78
91
79
console = logging.StreamHandler()
92
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
93
u' %(levelname)s:'
94
u' %(message)s'))
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
95
82
logger.addHandler(console)
96
83
97
84
class AvahiError(Exception):
110
97
111
98
class AvahiService(object):
112
99
"""An Avahi (Zeroconf) service.
113
114
100
Attributes:
115
101
interface: integer; avahi.IF_UNSPEC or an interface index.
116
102
Used to optionally bind to the specified interface.
117
name: string; Example: u'Mandos'
118
type: string; Example: u'_mandos._tcp'.
103
name: string; Example: 'Mandos'
104
type: string; Example: '_mandos._tcp'.
119
105
See <http://www.dns-sd.org/ServiceTypes.html>
120
106
port: integer; what port to announce
121
107
TXT: list of strings; TXT record for the service
124
110
max_renames: integer; maximum number of renames
125
111
rename_count: integer; counter so we only rename after collisions
126
112
a sensible number of times
127
group: D-Bus Entry Group
128
server: D-Bus Server
129
bus: dbus.SystemBus()
130
113
"""
131
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
132
115
servicetype = None, port = None, TXT = None,
133
domain = u"", host = u"", max_renames = 32768,
134
protocol = avahi.PROTO_UNSPEC, bus = None):
116
domain = "", host = "", max_renames = 32768):
135
117
self.interface = interface
136
118
self.name = name
137
119
self.type = servicetype
141
123
self.host = host
142
124
self.rename_count = 0
143
125
self.max_renames = max_renames
144
self.protocol = protocol
145
self.group = None # our entry group
146
self.server = None
147
self.bus = bus
148
126
def rename(self):
149
127
"""Derived from the Avahi example code"""
150
128
if self.rename_count >= self.max_renames:
152
130
u" after %i retries, exiting.",
153
131
self.rename_count)
154
132
raise AvahiServiceError(u"Too many renames")
155
self.name = self.server.GetAlternativeServiceName(self.name)
133
self.name = server.GetAlternativeServiceName(self.name)
156
134
logger.info(u"Changing Zeroconf service name to %r ...",
157
unicode(self.name))
135
str(self.name))
158
136
syslogger.setFormatter(logging.Formatter
159
(u'Mandos (%s) [%%(process)d]:'
160
u' %%(levelname)s: %%(message)s'
161
% self.name))
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
162
139
self.remove()
163
140
self.add()
164
141
self.rename_count += 1
165
142
def remove(self):
166
143
"""Derived from the Avahi example code"""
167
if self.group is not None:
168
self.group.Reset()
144
if group is not None:
145
group.Reset()
169
146
def add(self):
170
147
"""Derived from the Avahi example code"""
171
if self.group is None:
172
self.group = dbus.Interface(
173
self.bus.get_object(avahi.DBUS_NAME,
174
self.server.EntryGroupNew()),
175
avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
self.group.connect_to_signal('StateChanged',
177
self.entry_group_state_changed)
148
global group
149
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
178
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
179
self.name, self.type)
180
self.group.AddService(
181
self.interface,
182
self.protocol,
183
dbus.UInt32(0), # flags
184
self.name, self.type,
185
self.domain, self.host,
186
dbus.UInt16(self.port),
187
avahi.string_array_to_txt_array(self.TXT))
188
self.group.Commit()
189
def entry_group_state_changed(self, state, error):
190
"""Derived from the Avahi example code"""
191
logger.debug(u"Avahi state change: %i", state)
192
193
if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
logger.debug(u"Zeroconf service established.")
195
elif state == avahi.ENTRY_GROUP_COLLISION:
196
logger.warning(u"Zeroconf service name collision.")
197
self.rename()
198
elif state == avahi.ENTRY_GROUP_FAILURE:
199
logger.critical(u"Avahi: Error in group state changed %s",
200
unicode(error))
201
raise AvahiGroupError(u"State changed: %s"
202
% unicode(error))
203
def cleanup(self):
204
"""Derived from the Avahi example code"""
205
if self.group is not None:
206
self.group.Free()
207
self.group = None
208
def server_state_changed(self, state):
209
"""Derived from the Avahi example code"""
210
if state == avahi.SERVER_COLLISION:
211
logger.error(u"Zeroconf server name collision")
212
self.remove()
213
elif state == avahi.SERVER_RUNNING:
214
self.add()
215
def activate(self):
216
"""Derived from the Avahi example code"""
217
if self.server is None:
218
self.server = dbus.Interface(
219
self.bus.get_object(avahi.DBUS_NAME,
220
avahi.DBUS_PATH_SERVER),
221
avahi.DBUS_INTERFACE_SERVER)
222
self.server.connect_to_signal(u"StateChanged",
223
self.server_state_changed)
224
self.server_state_changed(self.server.GetState())
225
226
227
class Client(object):
157
service.name, service.type)
158
group.AddService(
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
166
group.Commit()
167
168
# From the Avahi example code:
169
group = None # our entry group
170
# End of Avahi example code
171
172
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
228
179
"""A representation of a client host served by this server.
229
230
180
Attributes:
231
181
name: string; from the config file, used in log messages and
232
182
D-Bus identifiers
252
202
client lives. %() expansions are done at
253
203
runtime with vars(self) as dict, so that for
254
204
instance %(name)s can be used in the command.
255
current_checker_command: string; current running checker_command
205
use_dbus: bool(); Whether to provide D-Bus interface and signals
206
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
256
207
"""
257
258
@staticmethod
259
def _datetime_to_milliseconds(dt):
260
"Convert a datetime.datetime() to milliseconds"
261
return ((dt.days * 24 * 60 * 60 * 1000)
262
+ (dt.seconds * 1000)
263
+ (dt.microseconds // 1000))
264
265
208
def timeout_milliseconds(self):
266
209
"Return the 'timeout' attribute in milliseconds"
267
return self._datetime_to_milliseconds(self.timeout)
210
return ((self.timeout.days * 24 * 60 * 60 * 1000)
211
+ (self.timeout.seconds * 1000)
212
+ (self.timeout.microseconds // 1000))
268
213
269
214
def interval_milliseconds(self):
270
215
"Return the 'interval' attribute in milliseconds"
271
return self._datetime_to_milliseconds(self.interval)
216
return ((self.interval.days * 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds * 1000)
218
+ (self.interval.microseconds // 1000))
272
219
273
def __init__(self, name = None, disable_hook=None, config=None):
220
def __init__(self, name = None, disable_hook=None, config=None,
221
use_dbus=True):
274
222
"""Note: the 'checker' key in 'config' sets the
275
223
'checker_command' attribute and *not* the 'checker'
276
224
attribute."""
278
226
if config is None:
279
227
config = {}
280
228
logger.debug(u"Creating client %r", self.name)
229
self.use_dbus = use_dbus
230
if self.use_dbus:
231
self.dbus_object_path = (dbus.ObjectPath
232
("/Mandos/clients/"
233
+ self.name.replace(".", "_")))
234
dbus.service.Object.__init__(self, bus,
235
self.dbus_object_path)
281
236
# Uppercase and remove spaces from fingerprint for later
282
237
# comparison purposes with return value from the fingerprint()
283
238
# function
284
self.fingerprint = (config[u"fingerprint"].upper()
239
self.fingerprint = (config["fingerprint"].upper()
285
240
.replace(u" ", u""))
286
241
logger.debug(u" Fingerprint: %s", self.fingerprint)
287
if u"secret" in config:
288
self.secret = config[u"secret"].decode(u"base64")
289
elif u"secfile" in config:
242
if "secret" in config:
243
self.secret = config["secret"].decode(u"base64")
244
elif "secfile" in config:
290
245
with closing(open(os.path.expanduser
291
246
(os.path.expandvars
292
(config[u"secfile"])))) as secfile:
247
(config["secfile"])))) as secfile:
293
248
self.secret = secfile.read()
294
249
else:
295
250
raise TypeError(u"No secret or secfile for client %s"
296
251
% self.name)
297
self.host = config.get(u"host", u"")
252
self.host = config.get("host", "")
298
253
self.created = datetime.datetime.utcnow()
299
254
self.enabled = False
300
255
self.last_enabled = None
301
256
self.last_checked_ok = None
302
self.timeout = string_to_delta(config[u"timeout"])
303
self.interval = string_to_delta(config[u"interval"])
257
self.timeout = string_to_delta(config["timeout"])
258
self.interval = string_to_delta(config["interval"])
304
259
self.disable_hook = disable_hook
305
260
self.checker = None
306
261
self.checker_initiator_tag = None
307
262
self.disable_initiator_tag = None
308
263
self.checker_callback_tag = None
309
self.checker_command = config[u"checker"]
310
self.current_checker_command = None
311
self.last_connect = None
264
self.checker_command = config["checker"]
312
265
313
266
def enable(self):
314
267
"""Start this client's checker and timeout hooks"""
315
if getattr(self, u"enabled", False):
316
# Already enabled
317
return
318
268
self.last_enabled = datetime.datetime.utcnow()
319
269
# Schedule a new checker to be started an 'interval' from now,
320
270
# and every interval from then on.
328
278
(self.timeout_milliseconds(),
329
279
self.disable))
330
280
self.enabled = True
281
if self.use_dbus:
282
# Emit D-Bus signals
283
self.PropertyChanged(dbus.String(u"enabled"),
284
dbus.Boolean(True, variant_level=1))
285
self.PropertyChanged(dbus.String(u"last_enabled"),
286
(_datetime_to_dbus(self.last_enabled,
287
variant_level=1)))
331
288
332
289
def disable(self):
333
290
"""Disable this client."""
334
291
if not getattr(self, "enabled", False):
335
292
return False
336
293
logger.info(u"Disabling client %s", self.name)
337
if getattr(self, u"disable_initiator_tag", False):
294
if getattr(self, "disable_initiator_tag", False):
338
295
gobject.source_remove(self.disable_initiator_tag)
339
296
self.disable_initiator_tag = None
340
if getattr(self, u"checker_initiator_tag", False):
297
if getattr(self, "checker_initiator_tag", False):
341
298
gobject.source_remove(self.checker_initiator_tag)
342
299
self.checker_initiator_tag = None
343
300
self.stop_checker()
344
301
if self.disable_hook:
345
302
self.disable_hook(self)
346
303
self.enabled = False
304
if self.use_dbus:
305
# Emit D-Bus signal
306
self.PropertyChanged(dbus.String(u"enabled"),
307
dbus.Boolean(False, variant_level=1))
347
308
# Do not run this again if called by a gobject.timeout_add
348
309
return False
349
310
355
316
"""The checker has completed, so take appropriate actions."""
356
317
self.checker_callback_tag = None
357
318
self.checker = None
358
if os.WIFEXITED(condition):
359
exitstatus = os.WEXITSTATUS(condition)
360
if exitstatus == 0:
361
logger.info(u"Checker for %(name)s succeeded",
362
vars(self))
363
self.checked_ok()
364
else:
365
logger.info(u"Checker for %(name)s failed",
366
vars(self))
367
else:
319
if self.use_dbus:
320
# Emit D-Bus signal
321
self.PropertyChanged(dbus.String(u"checker_running"),
322
dbus.Boolean(False, variant_level=1))
323
if (os.WIFEXITED(condition)
324
and (os.WEXITSTATUS(condition) == 0)):
325
logger.info(u"Checker for %(name)s succeeded",
326
vars(self))
327
if self.use_dbus:
328
# Emit D-Bus signal
329
self.CheckerCompleted(dbus.Boolean(True),
330
dbus.UInt16(condition),
331
dbus.String(command))
332
self.bump_timeout()
333
elif not os.WIFEXITED(condition):
368
334
logger.warning(u"Checker for %(name)s crashed?",
369
335
vars(self))
336
if self.use_dbus:
337
# Emit D-Bus signal
338
self.CheckerCompleted(dbus.Boolean(False),
339
dbus.UInt16(condition),
340
dbus.String(command))
341
else:
342
logger.info(u"Checker for %(name)s failed",
343
vars(self))
344
if self.use_dbus:
345
# Emit D-Bus signal
346
self.CheckerCompleted(dbus.Boolean(False),
347
dbus.UInt16(condition),
348
dbus.String(command))
370
349
371
def checked_ok(self):
350
def bump_timeout(self):
372
351
"""Bump up the timeout for this client.
373
374
352
This should only be called when the client has been seen,
375
353
alive and well.
376
354
"""
379
357
self.disable_initiator_tag = (gobject.timeout_add
380
358
(self.timeout_milliseconds(),
381
359
self.disable))
360
if self.use_dbus:
361
# Emit D-Bus signal
362
self.PropertyChanged(
363
dbus.String(u"last_checked_ok"),
364
(_datetime_to_dbus(self.last_checked_ok,
365
variant_level=1)))
382
366
383
367
def start_checker(self):
384
368
"""Start a new checker subprocess if one is not running.
385
386
369
If a checker already exists, leave it running and do
387
370
nothing."""
388
371
# The reason for not killing a running checker is that if we
393
376
# checkers alone, the checker would have to take more time
394
377
# than 'timeout' for the client to be declared invalid, which
395
378
# is as it should be.
396
397
# If a checker exists, make sure it is not a zombie
398
if self.checker is not None:
399
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
400
if pid:
401
logger.warning(u"Checker was a zombie")
402
gobject.source_remove(self.checker_callback_tag)
403
self.checker_callback(pid, status,
404
self.current_checker_command)
405
# Start a new checker if needed
406
379
if self.checker is None:
407
380
try:
408
381
# In case checker_command has exactly one % operator
409
382
command = self.checker_command % self.host
410
383
except TypeError:
411
384
# Escape attributes for the shell
412
escaped_attrs = dict((key,
413
re.escape(unicode(str(val),
414
errors=
415
u'replace')))
385
escaped_attrs = dict((key, re.escape(str(val)))
416
386
for key, val in
417
387
vars(self).iteritems())
418
388
try:
421
391
logger.error(u'Could not format string "%s":'
422
392
u' %s', self.checker_command, error)
423
393
return True # Try again later
424
self.current_checker_command = command
425
394
try:
426
395
logger.info(u"Starting checker %r for %s",
427
396
command, self.name)
431
400
# always replaced by /dev/null.)
432
401
self.checker = subprocess.Popen(command,
433
402
close_fds=True,
434
shell=True, cwd=u"/")
403
shell=True, cwd="/")
404
if self.use_dbus:
405
# Emit D-Bus signal
406
self.CheckerStarted(command)
407
self.PropertyChanged(
408
dbus.String("checker_running"),
409
dbus.Boolean(True, variant_level=1))
435
410
self.checker_callback_tag = (gobject.child_watch_add
436
411
(self.checker.pid,
437
412
self.checker_callback,
438
413
data=command))
439
# The checker may have completed before the gobject
440
# watch was added. Check for this.
441
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
442
if pid:
443
gobject.source_remove(self.checker_callback_tag)
444
self.checker_callback(pid, status, command)
445
414
except OSError, error:
446
415
logger.error(u"Failed to start subprocess: %s",
447
416
error)
453
422
if self.checker_callback_tag:
454
423
gobject.source_remove(self.checker_callback_tag)
455
424
self.checker_callback_tag = None
456
if getattr(self, u"checker", None) is None:
425
if getattr(self, "checker", None) is None:
457
426
return
458
427
logger.debug(u"Stopping checker for %(name)s", vars(self))
459
428
try:
465
434
if error.errno != errno.ESRCH: # No such process
466
435
raise
467
436
self.checker = None
437
if self.use_dbus:
438
self.PropertyChanged(dbus.String(u"checker_running"),
439
dbus.Boolean(False, variant_level=1))
468
440
469
441
def still_valid(self):
470
442
"""Has the timeout not yet passed for this client?"""
471
if not getattr(self, u"enabled", False):
443
if not getattr(self, "enabled", False):
472
444
return False
473
445
now = datetime.datetime.utcnow()
474
446
if self.last_checked_ok is None:
475
447
return now < (self.created + self.timeout)
476
448
else:
477
449
return now < (self.last_checked_ok + self.timeout)
478
479
480
class ClientDBus(Client, dbus.service.Object):
481
"""A Client class using D-Bus
482
483
Attributes:
484
dbus_object_path: dbus.ObjectPath
485
bus: dbus.SystemBus()
486
"""
487
# dbus.service.Object doesn't use super(), so we can't either.
488
489
def __init__(self, bus = None, *args, **kwargs):
490
self.bus = bus
491
Client.__init__(self, *args, **kwargs)
492
# Only now, when this client is initialized, can it show up on
493
# the D-Bus
494
self.dbus_object_path = (dbus.ObjectPath
495
(u"/clients/"
496
+ self.name.replace(u".", u"_")))
497
dbus.service.Object.__init__(self, self.bus,
498
self.dbus_object_path)
499
500
@staticmethod
501
def _datetime_to_dbus(dt, variant_level=0):
502
"""Convert a UTC datetime.datetime() to a D-Bus type."""
503
return dbus.String(dt.isoformat(),
504
variant_level=variant_level)
505
506
def enable(self):
507
oldstate = getattr(self, u"enabled", False)
508
r = Client.enable(self)
509
if oldstate != self.enabled:
510
# Emit D-Bus signals
511
self.PropertyChanged(dbus.String(u"enabled"),
512
dbus.Boolean(True, variant_level=1))
513
self.PropertyChanged(
514
dbus.String(u"last_enabled"),
515
self._datetime_to_dbus(self.last_enabled,
516
variant_level=1))
517
return r
518
519
def disable(self, signal = True):
520
oldstate = getattr(self, u"enabled", False)
521
r = Client.disable(self)
522
if signal and oldstate != self.enabled:
523
# Emit D-Bus signal
524
self.PropertyChanged(dbus.String(u"enabled"),
525
dbus.Boolean(False, variant_level=1))
526
return r
527
528
def __del__(self, *args, **kwargs):
529
try:
530
self.remove_from_connection()
531
except LookupError:
532
pass
533
if hasattr(dbus.service.Object, u"__del__"):
534
dbus.service.Object.__del__(self, *args, **kwargs)
535
Client.__del__(self, *args, **kwargs)
536
537
def checker_callback(self, pid, condition, command,
538
*args, **kwargs):
539
self.checker_callback_tag = None
540
self.checker = None
541
# Emit D-Bus signal
542
self.PropertyChanged(dbus.String(u"checker_running"),
543
dbus.Boolean(False, variant_level=1))
544
if os.WIFEXITED(condition):
545
exitstatus = os.WEXITSTATUS(condition)
546
# Emit D-Bus signal
547
self.CheckerCompleted(dbus.Int16(exitstatus),
548
dbus.Int64(condition),
549
dbus.String(command))
550
else:
551
# Emit D-Bus signal
552
self.CheckerCompleted(dbus.Int16(-1),
553
dbus.Int64(condition),
554
dbus.String(command))
555
556
return Client.checker_callback(self, pid, condition, command,
557
*args, **kwargs)
558
559
def checked_ok(self, *args, **kwargs):
560
r = Client.checked_ok(self, *args, **kwargs)
561
# Emit D-Bus signal
562
self.PropertyChanged(
563
dbus.String(u"last_checked_ok"),
564
(self._datetime_to_dbus(self.last_checked_ok,
565
variant_level=1)))
566
return r
567
568
def start_checker(self, *args, **kwargs):
569
old_checker = self.checker
570
if self.checker is not None:
571
old_checker_pid = self.checker.pid
572
else:
573
old_checker_pid = None
574
r = Client.start_checker(self, *args, **kwargs)
575
# Only if new checker process was started
576
if (self.checker is not None
577
and old_checker_pid != self.checker.pid):
578
# Emit D-Bus signal
579
self.CheckerStarted(self.current_checker_command)
580
self.PropertyChanged(
581
dbus.String(u"checker_running"),
582
dbus.Boolean(True, variant_level=1))
583
return r
584
585
def stop_checker(self, *args, **kwargs):
586
old_checker = getattr(self, u"checker", None)
587
r = Client.stop_checker(self, *args, **kwargs)
588
if (old_checker is not None
589
and getattr(self, u"checker", None) is None):
590
self.PropertyChanged(dbus.String(u"checker_running"),
591
dbus.Boolean(False, variant_level=1))
592
return r
593
450
594
451
## D-Bus methods & signals
595
_interface = u"se.bsnet.fukt.Mandos.Client"
452
_interface = u"org.mandos_system.Mandos.Client"
596
453
597
# CheckedOK - method
598
@dbus.service.method(_interface)
599
def CheckedOK(self):
600
return self.checked_ok()
454
# BumpTimeout - method
455
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
456
BumpTimeout.__name__ = "BumpTimeout"
601
457
602
458
# CheckerCompleted - signal
603
@dbus.service.signal(_interface, signature=u"nxs")
604
def CheckerCompleted(self, exitcode, waitstatus, command):
459
@dbus.service.signal(_interface, signature="bqs")
460
def CheckerCompleted(self, success, condition, command):
605
461
"D-Bus signal"
606
462
pass
607
463
608
464
# CheckerStarted - signal
609
@dbus.service.signal(_interface, signature=u"s")
465
@dbus.service.signal(_interface, signature="s")
610
466
def CheckerStarted(self, command):
611
467
"D-Bus signal"
612
468
pass
613
469
614
470
# GetAllProperties - method
615
@dbus.service.method(_interface, out_signature=u"a{sv}")
471
@dbus.service.method(_interface, out_signature="a{sv}")
616
472
def GetAllProperties(self):
617
473
"D-Bus method"
618
474
return dbus.Dictionary({
619
dbus.String(u"name"):
475
dbus.String("name"):
620
476
dbus.String(self.name, variant_level=1),
621
dbus.String(u"fingerprint"):
477
dbus.String("fingerprint"):
622
478
dbus.String(self.fingerprint, variant_level=1),
623
dbus.String(u"host"):
479
dbus.String("host"):
624
480
dbus.String(self.host, variant_level=1),
625
dbus.String(u"created"):
626
self._datetime_to_dbus(self.created,
627
variant_level=1),
628
dbus.String(u"last_enabled"):
629
(self._datetime_to_dbus(self.last_enabled,
630
variant_level=1)
481
dbus.String("created"):
482
_datetime_to_dbus(self.created, variant_level=1),
483
dbus.String("last_enabled"):
484
(_datetime_to_dbus(self.last_enabled,
485
variant_level=1)
631
486
if self.last_enabled is not None
632
487
else dbus.Boolean(False, variant_level=1)),
633
dbus.String(u"enabled"):
488
dbus.String("enabled"):
634
489
dbus.Boolean(self.enabled, variant_level=1),
635
dbus.String(u"last_checked_ok"):
636
(self._datetime_to_dbus(self.last_checked_ok,
637
variant_level=1)
490
dbus.String("last_checked_ok"):
491
(_datetime_to_dbus(self.last_checked_ok,
492
variant_level=1)
638
493
if self.last_checked_ok is not None
639
494
else dbus.Boolean (False, variant_level=1)),
640
dbus.String(u"timeout"):
495
dbus.String("timeout"):
641
496
dbus.UInt64(self.timeout_milliseconds(),
642
497
variant_level=1),
643
dbus.String(u"interval"):
498
dbus.String("interval"):
644
499
dbus.UInt64(self.interval_milliseconds(),
645
500
variant_level=1),
646
dbus.String(u"checker"):
501
dbus.String("checker"):
647
502
dbus.String(self.checker_command,
648
503
variant_level=1),
649
dbus.String(u"checker_running"):
504
dbus.String("checker_running"):
650
505
dbus.Boolean(self.checker is not None,
651
506
variant_level=1),
652
dbus.String(u"object_path"):
507
dbus.String("object_path"):
653
508
dbus.ObjectPath(self.dbus_object_path,
654
509
variant_level=1)
655
}, signature=u"sv")
510
}, signature="sv")
656
511
657
512
# IsStillValid - method
658
@dbus.service.method(_interface, out_signature=u"b")
659
def IsStillValid(self):
660
return self.still_valid()
513
IsStillValid = (dbus.service.method(_interface, out_signature="b")
514
(still_valid))
515
IsStillValid.__name__ = "IsStillValid"
661
516
662
517
# PropertyChanged - signal
663
@dbus.service.signal(_interface, signature=u"sv")
518
@dbus.service.signal(_interface, signature="sv")
664
519
def PropertyChanged(self, property, value):
665
520
"D-Bus signal"
666
521
pass
667
522
668
# ReceivedSecret - signal
669
@dbus.service.signal(_interface)
670
def ReceivedSecret(self):
671
"D-Bus signal"
672
pass
673
674
# Rejected - signal
675
@dbus.service.signal(_interface)
676
def Rejected(self):
677
"D-Bus signal"
678
pass
679
680
523
# SetChecker - method
681
@dbus.service.method(_interface, in_signature=u"s")
524
@dbus.service.method(_interface, in_signature="s")
682
525
def SetChecker(self, checker):
683
526
"D-Bus setter method"
684
527
self.checker_command = checker
688
531
variant_level=1))
689
532
690
533
# SetHost - method
691
@dbus.service.method(_interface, in_signature=u"s")
534
@dbus.service.method(_interface, in_signature="s")
692
535
def SetHost(self, host):
693
536
"D-Bus setter method"
694
537
self.host = host
697
540
dbus.String(self.host, variant_level=1))
698
541
699
542
# SetInterval - method
700
@dbus.service.method(_interface, in_signature=u"t")
543
@dbus.service.method(_interface, in_signature="t")
701
544
def SetInterval(self, milliseconds):
702
545
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
703
546
# Emit D-Bus signal
706
549
variant_level=1)))
707
550
708
551
# SetSecret - method
709
@dbus.service.method(_interface, in_signature=u"ay",
552
@dbus.service.method(_interface, in_signature="ay",
710
553
byte_arrays=True)
711
554
def SetSecret(self, secret):
712
555
"D-Bus setter method"
713
556
self.secret = str(secret)
714
557
715
558
# SetTimeout - method
716
@dbus.service.method(_interface, in_signature=u"t")
559
@dbus.service.method(_interface, in_signature="t")
717
560
def SetTimeout(self, milliseconds):
718
561
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
719
562
# Emit D-Bus signal
722
565
variant_level=1)))
723
566
724
567
# Enable - method
725
@dbus.service.method(_interface)
726
def Enable(self):
727
"D-Bus method"
728
self.enable()
568
Enable = dbus.service.method(_interface)(enable)
569
Enable.__name__ = "Enable"
729
570
730
571
# StartChecker - method
731
572
@dbus.service.method(_interface)
740
581
self.disable()
741
582
742
583
# StopChecker - method
743
@dbus.service.method(_interface)
744
def StopChecker(self):
745
self.stop_checker()
584
StopChecker = dbus.service.method(_interface)(stop_checker)
585
StopChecker.__name__ = "StopChecker"
746
586
747
587
del _interface
748
588
749
589
750
class ClientHandler(socketserver.BaseRequestHandler, object):
751
"""A class to handle client connections.
752
753
Instantiated once for each connection to handle it.
590
def peer_certificate(session):
591
"Return the peer's OpenPGP certificate as a bytestring"
592
# If not an OpenPGP certificate...
593
if (gnutls.library.functions
594
.gnutls_certificate_type_get(session._c_object)
595
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
596
# ...do the normal thing
597
return session.peer_certificate
598
list_size = ctypes.c_uint()
599
cert_list = (gnutls.library.functions
600
.gnutls_certificate_get_peers
601
(session._c_object, ctypes.byref(list_size)))
602
if list_size.value == 0:
603
return None
604
cert = cert_list[0]
605
return ctypes.string_at(cert.data, cert.size)
606
607
608
def fingerprint(openpgp):
609
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
610
# New GnuTLS "datum" with the OpenPGP public key
611
datum = (gnutls.library.types
612
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
613
ctypes.POINTER
614
(ctypes.c_ubyte)),
615
ctypes.c_uint(len(openpgp))))
616
# New empty GnuTLS certificate
617
crt = gnutls.library.types.gnutls_openpgp_crt_t()
618
(gnutls.library.functions
619
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
620
# Import the OpenPGP public key into the certificate
621
(gnutls.library.functions
622
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
623
gnutls.library.constants
624
.GNUTLS_OPENPGP_FMT_RAW))
625
# Verify the self signature in the key
626
crtverify = ctypes.c_uint()
627
(gnutls.library.functions
628
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
629
if crtverify.value != 0:
630
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
631
raise gnutls.errors.CertificateSecurityError("Verify failed")
632
# New buffer for the fingerprint
633
buf = ctypes.create_string_buffer(20)
634
buf_len = ctypes.c_size_t()
635
# Get the fingerprint from the certificate into the buffer
636
(gnutls.library.functions
637
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
638
ctypes.byref(buf_len)))
639
# Deinit the certificate
640
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
641
# Convert the buffer to a Python bytestring
642
fpr = ctypes.string_at(buf, buf_len.value)
643
# Convert the bytestring to hexadecimal notation
644
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
645
return hex_fpr
646
647
648
class TCP_handler(SocketServer.BaseRequestHandler, object):
649
"""A TCP request handler class.
650
Instantiated by IPv6_TCPServer for each request to handle it.
754
651
Note: This will run in its own forked process."""
755
652
756
653
def handle(self):
757
654
logger.info(u"TCP connection from: %s",
758
655
unicode(self.client_address))
759
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
# Open IPC pipe to parent process
761
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
762
session = (gnutls.connection
763
.ClientSession(self.request,
764
gnutls.connection
765
.X509Credentials()))
766
767
line = self.request.makefile().readline()
768
logger.debug(u"Protocol version: %r", line)
769
try:
770
if int(line.strip().split()[0]) > 1:
771
raise RuntimeError
772
except (ValueError, IndexError, RuntimeError), error:
773
logger.error(u"Unknown protocol version: %s", error)
774
return
775
776
# Note: gnutls.connection.X509Credentials is really a
777
# generic GnuTLS certificate credentials object so long as
778
# no X.509 keys are added to it. Therefore, we can use it
779
# here despite using OpenPGP certificates.
780
781
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
# u"+AES-256-CBC", u"+SHA1",
783
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
784
# u"+DHE-DSS"))
785
# Use a fallback default, since this MUST be set.
786
priority = self.server.gnutls_priority
787
if priority is None:
788
priority = u"NORMAL"
789
(gnutls.library.functions
790
.gnutls_priority_set_direct(session._c_object,
791
priority, None))
792
793
try:
794
session.handshake()
795
except gnutls.errors.GNUTLSError, error:
796
logger.warning(u"Handshake failed: %s", error)
797
# Do not run session.bye() here: the session is not
798
# established. Just abandon the request.
799
return
800
logger.debug(u"Handshake succeeded")
801
try:
802
fpr = self.fingerprint(self.peer_certificate(session))
803
except (TypeError, gnutls.errors.GNUTLSError), error:
804
logger.warning(u"Bad certificate: %s", error)
805
session.bye()
806
return
807
logger.debug(u"Fingerprint: %s", fpr)
808
809
for c in self.server.clients:
810
if c.fingerprint == fpr:
811
client = c
812
break
813
else:
814
ipc.write(u"NOTFOUND %s %s\n"
815
% (fpr, unicode(self.client_address)))
816
session.bye()
817
return
818
# Have to check if client.still_valid(), since it is
819
# possible that the client timed out while establishing
820
# the GnuTLS session.
821
if not client.still_valid():
822
ipc.write(u"INVALID %s\n" % client.name)
823
session.bye()
824
return
825
ipc.write(u"SENDING %s\n" % client.name)
826
sent_size = 0
827
while sent_size < len(client.secret):
828
sent = session.send(client.secret[sent_size:])
829
logger.debug(u"Sent: %d, remaining: %d",
830
sent, len(client.secret)
831
- (sent_size + sent))
832
sent_size += sent
833
session.bye()
834
835
@staticmethod
836
def peer_certificate(session):
837
"Return the peer's OpenPGP certificate as a bytestring"
838
# If not an OpenPGP certificate...
839
if (gnutls.library.functions
840
.gnutls_certificate_type_get(session._c_object)
841
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
842
# ...do the normal thing
843
return session.peer_certificate
844
list_size = ctypes.c_uint(1)
845
cert_list = (gnutls.library.functions
846
.gnutls_certificate_get_peers
847
(session._c_object, ctypes.byref(list_size)))
848
if not bool(cert_list) and list_size.value != 0:
849
raise gnutls.errors.GNUTLSError(u"error getting peer"
850
u" certificate")
851
if list_size.value == 0:
852
return None
853
cert = cert_list[0]
854
return ctypes.string_at(cert.data, cert.size)
855
856
@staticmethod
857
def fingerprint(openpgp):
858
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
859
# New GnuTLS "datum" with the OpenPGP public key
860
datum = (gnutls.library.types
861
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
862
ctypes.POINTER
863
(ctypes.c_ubyte)),
864
ctypes.c_uint(len(openpgp))))
865
# New empty GnuTLS certificate
866
crt = gnutls.library.types.gnutls_openpgp_crt_t()
867
(gnutls.library.functions
868
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
869
# Import the OpenPGP public key into the certificate
870
(gnutls.library.functions
871
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
872
gnutls.library.constants
873
.GNUTLS_OPENPGP_FMT_RAW))
874
# Verify the self signature in the key
875
crtverify = ctypes.c_uint()
876
(gnutls.library.functions
877
.gnutls_openpgp_crt_verify_self(crt, 0,
878
ctypes.byref(crtverify)))
879
if crtverify.value != 0:
880
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
881
raise (gnutls.errors.CertificateSecurityError
882
(u"Verify failed"))
883
# New buffer for the fingerprint
884
buf = ctypes.create_string_buffer(20)
885
buf_len = ctypes.c_size_t()
886
# Get the fingerprint from the certificate into the buffer
887
(gnutls.library.functions
888
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
889
ctypes.byref(buf_len)))
890
# Deinit the certificate
891
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
892
# Convert the buffer to a Python bytestring
893
fpr = ctypes.string_at(buf, buf_len.value)
894
# Convert the bytestring to hexadecimal notation
895
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
896
return hex_fpr
897
898
899
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
900
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
901
def process_request(self, request, client_address):
902
"""Overrides and wraps the original process_request().
903
904
This function creates a new pipe in self.pipe
905
"""
906
self.pipe = os.pipe()
907
super(ForkingMixInWithPipe,
908
self).process_request(request, client_address)
909
os.close(self.pipe[1]) # close write end
910
self.add_pipe(self.pipe[0])
911
def add_pipe(self, pipe):
912
"""Dummy function; override as necessary"""
913
os.close(pipe)
914
915
916
class IPv6_TCPServer(ForkingMixInWithPipe,
917
socketserver.TCPServer, object):
918
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
919
656
session = (gnutls.connection
657
.ClientSession(self.request,
658
gnutls.connection
659
.X509Credentials()))
660
661
line = self.request.makefile().readline()
662
logger.debug(u"Protocol version: %r", line)
663
try:
664
if int(line.strip().split()[0]) > 1:
665
raise RuntimeError
666
except (ValueError, IndexError, RuntimeError), error:
667
logger.error(u"Unknown protocol version: %s", error)
668
return
669
670
# Note: gnutls.connection.X509Credentials is really a generic
671
# GnuTLS certificate credentials object so long as no X.509
672
# keys are added to it. Therefore, we can use it here despite
673
# using OpenPGP certificates.
674
675
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
676
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
677
# "+DHE-DSS"))
678
# Use a fallback default, since this MUST be set.
679
priority = self.server.settings.get("priority", "NORMAL")
680
(gnutls.library.functions
681
.gnutls_priority_set_direct(session._c_object,
682
priority, None))
683
684
try:
685
session.handshake()
686
except gnutls.errors.GNUTLSError, error:
687
logger.warning(u"Handshake failed: %s", error)
688
# Do not run session.bye() here: the session is not
689
# established. Just abandon the request.
690
return
691
try:
692
fpr = fingerprint(peer_certificate(session))
693
except (TypeError, gnutls.errors.GNUTLSError), error:
694
logger.warning(u"Bad certificate: %s", error)
695
session.bye()
696
return
697
logger.debug(u"Fingerprint: %s", fpr)
698
for c in self.server.clients:
699
if c.fingerprint == fpr:
700
client = c
701
break
702
else:
703
logger.warning(u"Client not found for fingerprint: %s",
704
fpr)
705
session.bye()
706
return
707
# Have to check if client.still_valid(), since it is possible
708
# that the client timed out while establishing the GnuTLS
709
# session.
710
if not client.still_valid():
711
logger.warning(u"Client %(name)s is invalid",
712
vars(client))
713
session.bye()
714
return
715
## This won't work here, since we're in a fork.
716
# client.bump_timeout()
717
sent_size = 0
718
while sent_size < len(client.secret):
719
sent = session.send(client.secret[sent_size:])
720
logger.debug(u"Sent: %d, remaining: %d",
721
sent, len(client.secret)
722
- (sent_size + sent))
723
sent_size += sent
724
session.bye()
725
726
727
class IPv6_TCPServer(SocketServer.ForkingMixIn,
728
SocketServer.TCPServer, object):
729
"""IPv6 TCP server. Accepts 'None' as address and/or port.
920
730
Attributes:
731
settings: Server settings
732
clients: Set() of Client objects
921
733
enabled: Boolean; whether this server is activated yet
922
interface: None or a network interface name (string)
923
use_ipv6: Boolean; to use IPv6 or not
924
734
"""
925
def __init__(self, server_address, RequestHandlerClass,
926
interface=None, use_ipv6=True):
927
self.interface = interface
928
if use_ipv6:
929
self.address_family = socket.AF_INET6
930
socketserver.TCPServer.__init__(self, server_address,
931
RequestHandlerClass)
735
address_family = socket.AF_INET6
736
def __init__(self, *args, **kwargs):
737
if "settings" in kwargs:
738
self.settings = kwargs["settings"]
739
del kwargs["settings"]
740
if "clients" in kwargs:
741
self.clients = kwargs["clients"]
742
del kwargs["clients"]
743
self.enabled = False
744
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
932
745
def server_bind(self):
933
746
"""This overrides the normal server_bind() function
934
747
to bind to an interface if one was specified, and also NOT to
935
748
bind to an address or port if they were not specified."""
936
if self.interface is not None:
937
if SO_BINDTODEVICE is None:
938
logger.error(u"SO_BINDTODEVICE does not exist;"
939
u" cannot bind to interface %s",
940
self.interface)
941
else:
942
try:
943
self.socket.setsockopt(socket.SOL_SOCKET,
944
SO_BINDTODEVICE,
945
str(self.interface
946
+ u'\0'))
947
except socket.error, error:
948
if error[0] == errno.EPERM:
949
logger.error(u"No permission to"
950
u" bind to interface %s",
951
self.interface)
952
elif error[0] == errno.ENOPROTOOPT:
953
logger.error(u"SO_BINDTODEVICE not available;"
954
u" cannot bind to interface %s",
955
self.interface)
956
else:
957
raise
749
if self.settings["interface"]:
750
# 25 is from /usr/include/asm-i486/socket.h
751
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
752
try:
753
self.socket.setsockopt(socket.SOL_SOCKET,
754
SO_BINDTODEVICE,
755
self.settings["interface"])
756
except socket.error, error:
757
if error[0] == errno.EPERM:
758
logger.error(u"No permission to"
759
u" bind to interface %s",
760
self.settings["interface"])
761
else:
762
raise error
958
763
# Only bind(2) the socket if we really need to.
959
764
if self.server_address[0] or self.server_address[1]:
960
765
if not self.server_address[0]:
961
if self.address_family == socket.AF_INET6:
962
any_address = u"::" # in6addr_any
963
else:
964
any_address = socket.INADDR_ANY
965
self.server_address = (any_address,
766
in6addr_any = "::"
767
self.server_address = (in6addr_any,
966
768
self.server_address[1])
967
769
elif not self.server_address[1]:
968
770
self.server_address = (self.server_address[0],
969
771
0)
970
# if self.interface:
772
# if self.settings["interface"]:
971
773
# self.server_address = (self.server_address[0],
972
774
# 0, # port
973
775
# 0, # flowinfo
974
776
# if_nametoindex
975
# (self.interface))
976
return socketserver.TCPServer.server_bind(self)
977
978
979
class MandosServer(IPv6_TCPServer):
980
"""Mandos server.
981
982
Attributes:
983
clients: set of Client objects
984
gnutls_priority GnuTLS priority string
985
use_dbus: Boolean; to emit D-Bus signals or not
986
clients: set of Client objects
987
gnutls_priority GnuTLS priority string
988
use_dbus: Boolean; to emit D-Bus signals or not
989
990
Assumes a gobject.MainLoop event loop.
991
"""
992
def __init__(self, server_address, RequestHandlerClass,
993
interface=None, use_ipv6=True, clients=None,
994
gnutls_priority=None, use_dbus=True):
995
self.enabled = False
996
self.clients = clients
997
if self.clients is None:
998
self.clients = set()
999
self.use_dbus = use_dbus
1000
self.gnutls_priority = gnutls_priority
1001
IPv6_TCPServer.__init__(self, server_address,
1002
RequestHandlerClass,
1003
interface = interface,
1004
use_ipv6 = use_ipv6)
777
# (self.settings
778
# ["interface"]))
779
return super(IPv6_TCPServer, self).server_bind()
1005
780
def server_activate(self):
1006
781
if self.enabled:
1007
return socketserver.TCPServer.server_activate(self)
782
return super(IPv6_TCPServer, self).server_activate()
1008
783
def enable(self):
1009
784
self.enabled = True
1010
def add_pipe(self, pipe):
1011
# Call "handle_ipc" for both data and EOF events
1012
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1013
self.handle_ipc)
1014
def handle_ipc(self, source, condition, file_objects={}):
1015
condition_names = {
1016
gobject.IO_IN: u"IN", # There is data to read.
1017
gobject.IO_OUT: u"OUT", # Data can be written (without
1018
# blocking).
1019
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1020
gobject.IO_ERR: u"ERR", # Error condition.
1021
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1022
# broken, usually for pipes and
1023
# sockets).
1024
}
1025
conditions_string = ' | '.join(name
1026
for cond, name in
1027
condition_names.iteritems()
1028
if cond & condition)
1029
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1030
conditions_string)
1031
1032
# Turn the pipe file descriptor into a Python file object
1033
if source not in file_objects:
1034
file_objects[source] = os.fdopen(source, u"r", 1)
1035
1036
# Read a line from the file object
1037
cmdline = file_objects[source].readline()
1038
if not cmdline: # Empty line means end of file
1039
# close the IPC pipe
1040
file_objects[source].close()
1041
del file_objects[source]
1042
1043
# Stop calling this function
1044
return False
1045
1046
logger.debug(u"IPC command: %r", cmdline)
1047
1048
# Parse and act on command
1049
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1050
1051
if cmd == u"NOTFOUND":
1052
logger.warning(u"Client not found for fingerprint: %s",
1053
args)
1054
if self.use_dbus:
1055
# Emit D-Bus signal
1056
mandos_dbus_service.ClientNotFound(args)
1057
elif cmd == u"INVALID":
1058
for client in self.clients:
1059
if client.name == args:
1060
logger.warning(u"Client %s is invalid", args)
1061
if self.use_dbus:
1062
# Emit D-Bus signal
1063
client.Rejected()
1064
break
1065
else:
1066
logger.error(u"Unknown client %s is invalid", args)
1067
elif cmd == u"SENDING":
1068
for client in self.clients:
1069
if client.name == args:
1070
logger.info(u"Sending secret to %s", client.name)
1071
client.checked_ok()
1072
if self.use_dbus:
1073
# Emit D-Bus signal
1074
client.ReceivedSecret()
1075
break
1076
else:
1077
logger.error(u"Sending secret to unknown client %s",
1078
args)
1079
else:
1080
logger.error(u"Unknown IPC command: %r", cmdline)
1081
1082
# Keep calling this function
1083
return True
1084
785
1085
786
1086
787
def string_to_delta(interval):
1087
788
"""Parse a string and return a datetime.timedelta
1088
1089
>>> string_to_delta(u'7d')
789
790
>>> string_to_delta('7d')
1090
791
datetime.timedelta(7)
1091
>>> string_to_delta(u'60s')
792
>>> string_to_delta('60s')
1092
793
datetime.timedelta(0, 60)
1093
>>> string_to_delta(u'60m')
794
>>> string_to_delta('60m')
1094
795
datetime.timedelta(0, 3600)
1095
>>> string_to_delta(u'24h')
796
>>> string_to_delta('24h')
1096
797
datetime.timedelta(1)
1097
798
>>> string_to_delta(u'1w')
1098
799
datetime.timedelta(7)
1099
>>> string_to_delta(u'5m 30s')
800
>>> string_to_delta('5m 30s')
1100
801
datetime.timedelta(0, 330)
1101
802
"""
1102
803
timevalue = datetime.timedelta(0)
1122
823
return timevalue
1123
824
1124
825
826
def server_state_changed(state):
827
"""Derived from the Avahi example code"""
828
if state == avahi.SERVER_COLLISION:
829
logger.error(u"Zeroconf server name collision")
830
service.remove()
831
elif state == avahi.SERVER_RUNNING:
832
service.add()
833
834
835
def entry_group_state_changed(state, error):
836
"""Derived from the Avahi example code"""
837
logger.debug(u"Avahi state change: %i", state)
838
839
if state == avahi.ENTRY_GROUP_ESTABLISHED:
840
logger.debug(u"Zeroconf service established.")
841
elif state == avahi.ENTRY_GROUP_COLLISION:
842
logger.warning(u"Zeroconf service name collision.")
843
service.rename()
844
elif state == avahi.ENTRY_GROUP_FAILURE:
845
logger.critical(u"Avahi: Error in group state changed %s",
846
unicode(error))
847
raise AvahiGroupError(u"State changed: %s" % unicode(error))
848
1125
849
def if_nametoindex(interface):
1126
"""Call the C function if_nametoindex(), or equivalent
1127
1128
Note: This function cannot accept a unicode string."""
850
"""Call the C function if_nametoindex(), or equivalent"""
1129
851
global if_nametoindex
1130
852
try:
1131
853
if_nametoindex = (ctypes.cdll.LoadLibrary
1132
(ctypes.util.find_library(u"c"))
854
(ctypes.util.find_library("c"))
1133
855
.if_nametoindex)
1134
856
except (OSError, AttributeError):
1135
logger.warning(u"Doing if_nametoindex the hard way")
857
if "struct" not in sys.modules:
858
import struct
859
if "fcntl" not in sys.modules:
860
import fcntl
1136
861
def if_nametoindex(interface):
1137
862
"Get an interface index the hard way, i.e. using fcntl()"
1138
863
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1139
864
with closing(socket.socket()) as s:
1140
865
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1141
struct.pack(str(u"16s16x"),
1142
interface))
1143
interface_index = struct.unpack(str(u"I"),
1144
ifreq[16:20])[0]
866
struct.pack("16s16x", interface))
867
interface_index = struct.unpack("I", ifreq[16:20])[0]
1145
868
return interface_index
1146
869
return if_nametoindex(interface)
1147
870
1148
871
1149
872
def daemon(nochdir = False, noclose = False):
1150
873
"""See daemon(3). Standard BSD Unix function.
1151
1152
874
This should really exist as os.daemon, but it doesn't (yet)."""
1153
875
if os.fork():
1154
876
sys.exit()
1155
877
os.setsid()
1156
878
if not nochdir:
1157
os.chdir(u"/")
879
os.chdir("/")
1158
880
if os.fork():
1159
881
sys.exit()
1160
882
if not noclose:
1162
884
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1163
885
if not stat.S_ISCHR(os.fstat(null).st_mode):
1164
886
raise OSError(errno.ENODEV,
1165
u"/dev/null not a character device")
887
"/dev/null not a character device")
1166
888
os.dup2(null, sys.stdin.fileno())
1167
889
os.dup2(null, sys.stdout.fileno())
1168
890
os.dup2(null, sys.stderr.fileno())
1171
893
1172
894
1173
895
def main():
1174
1175
######################################################################
1176
# Parsing of options, both command line and config file
1177
1178
896
parser = optparse.OptionParser(version = "%%prog %s" % version)
1179
parser.add_option("-i", u"--interface", type=u"string",
1180
metavar="IF", help=u"Bind to interface IF")
1181
parser.add_option("-a", u"--address", type=u"string",
1182
help=u"Address to listen for requests on")
1183
parser.add_option("-p", u"--port", type=u"int",
1184
help=u"Port number to receive requests on")
1185
parser.add_option("--check", action=u"store_true",
1186
help=u"Run self-test")
1187
parser.add_option("--debug", action=u"store_true",
1188
help=u"Debug mode; run in foreground and log to"
1189
u" terminal")
1190
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1191
u" priority string (see GnuTLS documentation)")
1192
parser.add_option("--servicename", type=u"string",
1193
metavar=u"NAME", help=u"Zeroconf service name")
1194
parser.add_option("--configdir", type=u"string",
1195
default=u"/etc/mandos", metavar=u"DIR",
1196
help=u"Directory to search for configuration"
1197
u" files")
1198
parser.add_option("--no-dbus", action=u"store_false",
1199
dest=u"use_dbus",
1200
help=optparse.SUPPRESS_HELP) # XXX: Not done yet
1201
parser.add_option("--no-ipv6", action=u"store_false",
1202
dest=u"use_ipv6", help=u"Do not use IPv6")
897
parser.add_option("-i", "--interface", type="string",
898
metavar="IF", help="Bind to interface IF")
899
parser.add_option("-a", "--address", type="string",
900
help="Address to listen for requests on")
901
parser.add_option("-p", "--port", type="int",
902
help="Port number to receive requests on")
903
parser.add_option("--check", action="store_true",
904
help="Run self-test")
905
parser.add_option("--debug", action="store_true",
906
help="Debug mode; run in foreground and log to"
907
" terminal")
908
parser.add_option("--priority", type="string", help="GnuTLS"
909
" priority string (see GnuTLS documentation)")
910
parser.add_option("--servicename", type="string", metavar="NAME",
911
help="Zeroconf service name")
912
parser.add_option("--configdir", type="string",
913
default="/etc/mandos", metavar="DIR",
914
help="Directory to search for configuration"
915
" files")
916
parser.add_option("--no-dbus", action="store_false",
917
dest="use_dbus",
918
help="Do not provide D-Bus system bus"
919
" interface")
1203
920
options = parser.parse_args()[0]
1204
921
1205
922
if options.check:
1208
925
sys.exit()
1209
926
1210
927
# Default values for config file for server-global settings
1211
server_defaults = { u"interface": u"",
1212
u"address": u"",
1213
u"port": u"",
1214
u"debug": u"False",
1215
u"priority":
1216
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1217
u"servicename": u"Mandos",
1218
u"use_dbus": u"True",
1219
u"use_ipv6": u"True",
928
server_defaults = { "interface": "",
929
"address": "",
930
"port": "",
931
"debug": "False",
932
"priority":
933
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
934
"servicename": "Mandos",
935
"use_dbus": "True",
1220
936
}
1221
937
1222
938
# Parse config file for server-global settings
1223
server_config = configparser.SafeConfigParser(server_defaults)
939
server_config = ConfigParser.SafeConfigParser(server_defaults)
1224
940
del server_defaults
1225
server_config.read(os.path.join(options.configdir,
1226
u"mandos.conf"))
941
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1227
942
# Convert the SafeConfigParser object to a dict
1228
943
server_settings = server_config.defaults()
1229
# Use the appropriate methods on the non-string config options
1230
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1231
server_settings[option] = server_config.getboolean(u"DEFAULT",
1232
option)
1233
if server_settings["port"]:
1234
server_settings["port"] = server_config.getint(u"DEFAULT",
1235
u"port")
944
# Use getboolean on the boolean config options
945
server_settings["debug"] = (server_config.getboolean
946
("DEFAULT", "debug"))
947
server_settings["use_dbus"] = (server_config.getboolean
948
("DEFAULT", "use_dbus"))
1236
949
del server_config
1237
950
1238
951
# Override the settings from the config file with command line
1239
952
# options, if set.
1240
for option in (u"interface", u"address", u"port", u"debug",
1241
u"priority", u"servicename", u"configdir",
1242
u"use_dbus", u"use_ipv6"):
953
for option in ("interface", "address", "port", "debug",
954
"priority", "servicename", "configdir",
955
"use_dbus"):
1243
956
value = getattr(options, option)
1244
957
if value is not None:
1245
958
server_settings[option] = value
1246
959
del options
1247
# Force all strings to be unicode
1248
for option in server_settings.keys():
1249
if type(server_settings[option]) is str:
1250
server_settings[option] = unicode(server_settings[option])
1251
960
# Now we have our good server settings in "server_settings"
1252
961
1253
##################################################################
1254
1255
962
# For convenience
1256
debug = server_settings[u"debug"]
1257
use_dbus = server_settings[u"use_dbus"]
1258
use_dbus = False # XXX: Not done yet
1259
use_ipv6 = server_settings[u"use_ipv6"]
963
debug = server_settings["debug"]
964
use_dbus = server_settings["use_dbus"]
1260
965
1261
966
if not debug:
1262
967
syslogger.setLevel(logging.WARNING)
1263
968
console.setLevel(logging.WARNING)
1264
969
1265
if server_settings[u"servicename"] != u"Mandos":
970
if server_settings["servicename"] != "Mandos":
1266
971
syslogger.setFormatter(logging.Formatter
1267
(u'Mandos (%s) [%%(process)d]:'
1268
u' %%(levelname)s: %%(message)s'
1269
% server_settings[u"servicename"]))
972
('Mandos (%s): %%(levelname)s:'
973
' %%(message)s'
974
% server_settings["servicename"]))
1270
975
1271
976
# Parse config file with clients
1272
client_defaults = { u"timeout": u"1h",
1273
u"interval": u"5m",
1274
u"checker": u"fping -q -- %%(host)s",
1275
u"host": u"",
977
client_defaults = { "timeout": "1h",
978
"interval": "5m",
979
"checker": "fping -q -- %%(host)s",
980
"host": "",
1276
981
}
1277
client_config = configparser.SafeConfigParser(client_defaults)
1278
client_config.read(os.path.join(server_settings[u"configdir"],
1279
u"clients.conf"))
1280
1281
global mandos_dbus_service
1282
mandos_dbus_service = None
1283
1284
tcp_server = MandosServer((server_settings[u"address"],
1285
server_settings[u"port"]),
1286
ClientHandler,
1287
interface=server_settings[u"interface"],
1288
use_ipv6=use_ipv6,
1289
gnutls_priority=
1290
server_settings[u"priority"],
1291
use_dbus=use_dbus)
1292
pidfilename = u"/var/run/mandos.pid"
1293
try:
1294
pidfile = open(pidfilename, u"w")
1295
except IOError:
1296
logger.error(u"Could not open file %r", pidfilename)
1297
1298
try:
1299
uid = pwd.getpwnam(u"_mandos").pw_uid
1300
gid = pwd.getpwnam(u"_mandos").pw_gid
982
client_config = ConfigParser.SafeConfigParser(client_defaults)
983
client_config.read(os.path.join(server_settings["configdir"],
984
"clients.conf"))
985
986
clients = Set()
987
tcp_server = IPv6_TCPServer((server_settings["address"],
988
server_settings["port"]),
989
TCP_handler,
990
settings=server_settings,
991
clients=clients)
992
pidfilename = "/var/run/mandos.pid"
993
try:
994
pidfile = open(pidfilename, "w")
995
except IOError, error:
996
logger.error("Could not open file %r", pidfilename)
997
998
try:
999
uid = pwd.getpwnam("_mandos").pw_uid
1000
gid = pwd.getpwnam("_mandos").pw_gid
1301
1001
except KeyError:
1302
1002
try:
1303
uid = pwd.getpwnam(u"mandos").pw_uid
1304
gid = pwd.getpwnam(u"mandos").pw_gid
1003
uid = pwd.getpwnam("mandos").pw_uid
1004
gid = pwd.getpwnam("mandos").pw_gid
1305
1005
except KeyError:
1306
1006
try:
1307
uid = pwd.getpwnam(u"nobody").pw_uid
1308
gid = pwd.getpwnam(u"nobody").pw_gid
1007
uid = pwd.getpwnam("nobody").pw_uid
1008
gid = pwd.getpwnam("nogroup").pw_gid
1309
1009
except KeyError:
1310
1010
uid = 65534
1311
1011
gid = 65534
1312
1012
try:
1013
os.setuid(uid)
1313
1014
os.setgid(gid)
1314
os.setuid(uid)
1315
1015
except OSError, error:
1316
1016
if error[0] != errno.EPERM:
1317
1017
raise error
1318
1018
1319
# Enable all possible GnuTLS debugging
1320
if debug:
1321
# "Use a log level over 10 to enable all debugging options."
1322
# - GnuTLS manual
1323
gnutls.library.functions.gnutls_global_set_log_level(11)
1324
1325
@gnutls.library.types.gnutls_log_func
1326
def debug_gnutls(level, string):
1327
logger.debug(u"GnuTLS: %s", string[:-1])
1328
1329
(gnutls.library.functions
1330
.gnutls_global_set_log_function(debug_gnutls))
1019
global service
1020
service = AvahiService(name = server_settings["servicename"],
1021
servicetype = "_mandos._tcp", )
1022
if server_settings["interface"]:
1023
service.interface = (if_nametoindex
1024
(server_settings["interface"]))
1331
1025
1332
1026
global main_loop
1027
global bus
1028
global server
1333
1029
# From the Avahi example code
1334
1030
DBusGMainLoop(set_as_default=True )
1335
1031
main_loop = gobject.MainLoop()
1336
1032
bus = dbus.SystemBus()
1033
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1034
avahi.DBUS_PATH_SERVER),
1035
avahi.DBUS_INTERFACE_SERVER)
1337
1036
# End of Avahi example code
1338
1037
if use_dbus:
1339
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1340
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1341
service = AvahiService(name = server_settings[u"servicename"],
1342
servicetype = u"_mandos._tcp",
1343
protocol = protocol, bus = bus)
1344
if server_settings["interface"]:
1345
service.interface = (if_nametoindex
1346
(str(server_settings[u"interface"])))
1038
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1039
bus)
1347
1040
1348
client_class = Client
1349
if use_dbus:
1350
client_class = functools.partial(ClientDBus, bus = bus)
1351
tcp_server.clients.update(set(
1352
client_class(name = section,
1353
config= dict(client_config.items(section)))
1354
for section in client_config.sections()))
1355
if not tcp_server.clients:
1041
clients.update(Set(Client(name = section,
1042
config
1043
= dict(client_config.items(section)),
1044
use_dbus = use_dbus)
1045
for section in client_config.sections()))
1046
if not clients:
1356
1047
logger.warning(u"No clients defined")
1357
1048
1358
1049
if debug:
1368
1059
daemon()
1369
1060
1370
1061
try:
1371
with closing(pidfile):
1372
pid = os.getpid()
1373
pidfile.write(str(pid) + "\n")
1062
pid = os.getpid()
1063
pidfile.write(str(pid) + "\n")
1064
pidfile.close()
1374
1065
del pidfile
1375
1066
except IOError:
1376
1067
logger.error(u"Could not write to file %r with PID %d",
1382
1073
1383
1074
def cleanup():
1384
1075
"Cleanup function; run on exit"
1385
service.cleanup()
1076
global group
1077
# From the Avahi example code
1078
if not group is None:
1079
group.Free()
1080
group = None
1081
# End of Avahi example code
1386
1082
1387
while tcp_server.clients:
1388
client = tcp_server.clients.pop()
1083
while clients:
1084
client = clients.pop()
1389
1085
client.disable_hook = None
1390
1086
client.disable()
1391
1087
1397
1093
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1398
1094
1399
1095
if use_dbus:
1400
class MandosDBusService(dbus.service.Object):
1096
class MandosServer(dbus.service.Object):
1401
1097
"""A D-Bus proxy object"""
1402
1098
def __init__(self):
1403
dbus.service.Object.__init__(self, bus, u"/")
1404
_interface = u"se.bsnet.fukt.Mandos"
1099
dbus.service.Object.__init__(self, bus,
1100
"/Mandos")
1101
_interface = u"org.mandos_system.Mandos"
1405
1102
1406
@dbus.service.signal(_interface, signature=u"oa{sv}")
1103
@dbus.service.signal(_interface, signature="oa{sv}")
1407
1104
def ClientAdded(self, objpath, properties):
1408
1105
"D-Bus signal"
1409
1106
pass
1410
1107
1411
@dbus.service.signal(_interface, signature=u"s")
1412
def ClientNotFound(self, fingerprint):
1413
"D-Bus signal"
1414
pass
1415
1416
@dbus.service.signal(_interface, signature=u"os")
1108
@dbus.service.signal(_interface, signature="os")
1417
1109
def ClientRemoved(self, objpath, name):
1418
1110
"D-Bus signal"
1419
1111
pass
1420
1112
1421
@dbus.service.method(_interface, out_signature=u"ao")
1113
@dbus.service.method(_interface, out_signature="ao")
1422
1114
def GetAllClients(self):
1423
"D-Bus method"
1424
return dbus.Array(c.dbus_object_path
1425
for c in tcp_server.clients)
1115
return dbus.Array(c.dbus_object_path for c in clients)
1426
1116
1427
@dbus.service.method(_interface,
1428
out_signature=u"a{oa{sv}}")
1117
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1429
1118
def GetAllClientsWithProperties(self):
1430
"D-Bus method"
1431
1119
return dbus.Dictionary(
1432
1120
((c.dbus_object_path, c.GetAllProperties())
1433
for c in tcp_server.clients),
1434
signature=u"oa{sv}")
1121
for c in clients),
1122
signature="oa{sv}")
1435
1123
1436
@dbus.service.method(_interface, in_signature=u"o")
1124
@dbus.service.method(_interface, in_signature="o")
1437
1125
def RemoveClient(self, object_path):
1438
"D-Bus method"
1439
for c in tcp_server.clients:
1126
for c in clients:
1440
1127
if c.dbus_object_path == object_path:
1441
tcp_server.clients.remove(c)
1442
c.remove_from_connection()
1128
clients.remove(c)
1443
1129
# Don't signal anything except ClientRemoved
1444
c.disable(signal=False)
1130
c.use_dbus = False
1131
c.disable()
1445
1132
# Emit D-Bus signal
1446
1133
self.ClientRemoved(object_path, c.name)
1447
1134
return
1448
1135
raise KeyError
1449
1136
1137
@dbus.service.method(_interface, in_signature="s")
1138
def RemoveClientByName(self, name):
1139
for c in clients:
1140
if c.name == name:
1141
clients.remove(c)
1142
# Don't signal anything except ClientRemoved
1143
c.use_dbus = False
1144
c.disable()
1145
# Emit D-Bus signal
1146
self.ClientRemoved(c.dbus_object_path, name)
1147
return
1148
raise KeyError
1149
1150
@dbus.service.method(_interface)
1151
def Quit(self):
1152
main_loop.quit()
1153
1450
1154
del _interface
1451
1155
1452
mandos_dbus_service = MandosDBusService()
1156
mandos_server = MandosServer()
1453
1157
1454
for client in tcp_server.clients:
1158
for client in clients:
1455
1159
if use_dbus:
1456
1160
# Emit D-Bus signal
1457
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1458
client.GetAllProperties())
1161
mandos_server.ClientAdded(client.dbus_object_path,
1162
client.GetAllProperties())
1459
1163
client.enable()
1460
1164
1461
1165
tcp_server.enable()
1463
1167
1464
1168
# Find out what port we got
1465
1169
service.port = tcp_server.socket.getsockname()[1]
1466
if use_ipv6:
1467
logger.info(u"Now listening on address %r, port %d,"
1468
" flowinfo %d, scope_id %d"
1469
% tcp_server.socket.getsockname())
1470
else: # IPv4
1471
logger.info(u"Now listening on address %r, port %d"
1472
% tcp_server.socket.getsockname())
1170
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1171
u" scope_id %d" % tcp_server.socket.getsockname())
1473
1172
1474
1173
#service.interface = tcp_server.socket.getsockname()[3]
1475
1174
1476
1175
try:
1477
1176
# From the Avahi example code
1177
server.connect_to_signal("StateChanged", server_state_changed)
1478
1178
try:
1479
service.activate()
1179
server_state_changed(server.GetState())
1480
1180
except dbus.exceptions.DBusException, error:
1481
1181
logger.critical(u"DBusException: %s", error)
1482
1182
sys.exit(1)
1494
1194
sys.exit(1)
1495
1195
except KeyboardInterrupt:
1496
1196
if debug:
1497
print >> sys.stderr
1498
logger.debug(u"Server received KeyboardInterrupt")
1499
logger.debug(u"Server exiting")
1197
print
1500
1198
1501
1199
if __name__ == '__main__':
1502
1200
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0