To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 24.1.15
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.15
- Committer: Björn Påhlsson
- Date: 2008-08-04 15:50:45 UTC
- mfrom: (41 mandos)
- mto: (237.7.1 mandos) (24.1.154 mandos)
- mto: This revision was merged to the branch mainline in revision 42.
- Revision ID: belorn@braxen-20080804155045-gnodwjn34v0a2vhr
merge
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos.conf => server.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
server.py
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
9
# following functions: "AvahiService.add", "AvahiService.remove",
10
# "server_state_changed", "entry_group_state_changed", and some lines
11
# in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008 Teddy Hogeborn
15
# Copyright © 2008 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
# GNU General Public License for more details.
26
25
#
27
26
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
30
28
#
31
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
30
#
33
31
34
from __future__ import division, with_statement, absolute_import
32
from __future__ import division
35
33
36
34
import SocketServer
37
35
import socket
36
import select
38
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
import pwd
59
from contextlib import closing
60
57
61
58
import dbus
62
import dbus.service
63
59
import gobject
64
60
import avahi
65
61
from dbus.mainloop.glib import DBusGMainLoop
66
62
import ctypes
67
import ctypes.util
68
69
version = "1.0.2"
63
64
# Brief description of the operation of this program:
65
#
66
# This server announces itself as a Zeroconf service. Connecting
67
# clients use the TLS protocol, with the unusual quirk that this
68
# server program acts as a TLS "client" while a connecting client acts
69
# as a TLS "server". The client (acting as a TLS "server") must
70
# supply an OpenPGP certificate, and the fingerprint of this
71
# certificate is used by this server to look up (in a list read from a
72
# file at start time) which binary blob to give the client. No other
73
# authentication or authorization is done by this server.
74
70
75
71
76
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
77
syslogger = logging.handlers.SysLogHandler\
78
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
79
syslogger.setFormatter(logging.Formatter\
80
('%(levelname)s: %(message)s'))
77
81
logger.addHandler(syslogger)
82
del syslogger
78
83
79
console = logging.StreamHandler()
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
82
logger.addHandler(console)
83
84
84
85
class AvahiError(Exception):
85
86
def __init__(self, value):
86
87
self.value = value
87
super(AvahiError, self).__init__()
88
88
def __str__(self):
89
89
return repr(self.value)
90
90
96
96
97
97
98
98
class AvahiService(object):
99
"""An Avahi (Zeroconf) service.
100
Attributes:
99
"""
101
100
interface: integer; avahi.IF_UNSPEC or an interface index.
102
101
Used to optionally bind to the specified interface.
103
name: string; Example: 'Mandos'
104
type: string; Example: '_mandos._tcp'.
105
See <http://www.dns-sd.org/ServiceTypes.html>
106
port: integer; what port to announce
107
TXT: list of strings; TXT record for the service
108
domain: string; Domain to publish on, default to .local if empty.
109
host: string; Host to publish records for, default is localhost
110
max_renames: integer; maximum number of renames
111
rename_count: integer; counter so we only rename after collisions
112
a sensible number of times
102
name = string; Example: "Mandos"
103
type = string; Example: "_mandos._tcp".
104
See <http://www.dns-sd.org/ServiceTypes.html>
105
port = integer; what port to announce
106
TXT = list of strings; TXT record for the service
107
domain = string; Domain to publish on, default to .local if empty.
108
host = string; Host to publish records for, default to localhost
109
if empty.
110
max_renames = integer; maximum number of renames
111
rename_count = integer; counter so we only rename after collisions
112
a sensible number of times
113
113
"""
114
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
115
type = None, port = None, TXT = None, domain = "",
116
host = "", max_renames = 12):
117
"""An Avahi (Zeroconf) service. """
117
118
self.interface = interface
118
119
self.name = name
119
self.type = servicetype
120
self.type = type
120
121
self.port = port
121
self.TXT = TXT if TXT is not None else []
122
if TXT is None:
123
self.TXT = []
124
else:
125
self.TXT = TXT
122
126
self.domain = domain
123
127
self.host = host
124
128
self.rename_count = 0
125
self.max_renames = max_renames
126
129
def rename(self):
127
130
"""Derived from the Avahi example code"""
128
131
if self.rename_count >= self.max_renames:
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
132
logger.critical(u"No suitable service name found after %i"
133
u" retries, exiting.", rename_count)
132
134
raise AvahiServiceError("Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
135
name = server.GetAlternativeServiceName(name)
136
logger.notice(u"Changing name to %r ...", name)
139
137
self.remove()
140
138
self.add()
141
139
self.rename_count += 1
147
145
"""Derived from the Avahi example code"""
148
146
global group
149
147
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
148
group = dbus.Interface\
149
(bus.get_object(avahi.DBUS_NAME,
152
150
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
151
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
152
group.connect_to_signal('StateChanged',
155
153
entry_group_state_changed)
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
154
logger.debug(u"Adding service '%s' of type '%s' ...",
157
155
service.name, service.type)
158
156
group.AddService(
159
157
self.interface, # interface
170
168
# End of Avahi example code
171
169
172
170
173
class Client(dbus.service.Object):
171
class Client(object):
174
172
"""A representation of a client host served by this server.
175
173
Attributes:
176
174
name: string; from the config file, used in log messages
177
175
fingerprint: string (40 or 32 hexadecimal digits); used to
178
176
uniquely identify the client
179
177
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); (UTC) object creation
182
started: datetime.datetime(); (UTC) last started
183
last_checked_ok: datetime.datetime(); (UTC) or None
178
fqdn: string (FQDN); available for use by the checker command
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
184
181
timeout: datetime.timedelta(); How long from last_checked_ok
185
182
until this client is invalid
186
183
interval: datetime.timedelta(); How often to start a new checker
202
199
_interval_milliseconds: - '' -
203
200
"""
204
201
def _set_timeout(self, timeout):
205
"Setter function for the 'timeout' attribute"
202
"Setter function for 'timeout' attribute"
206
203
self._timeout = timeout
207
204
self._timeout_milliseconds = ((self.timeout.days
208
205
* 24 * 60 * 60 * 1000)
209
206
+ (self.timeout.seconds * 1000)
210
207
+ (self.timeout.microseconds
211
208
// 1000))
212
# Emit D-Bus signal
213
self.TimeoutChanged(self._timeout_milliseconds)
214
timeout = property(lambda self: self._timeout, _set_timeout)
209
timeout = property(lambda self: self._timeout,
210
_set_timeout)
215
211
del _set_timeout
216
217
212
def _set_interval(self, interval):
218
"Setter function for the 'interval' attribute"
213
"Setter function for 'interval' attribute"
219
214
self._interval = interval
220
215
self._interval_milliseconds = ((self.interval.days
221
216
* 24 * 60 * 60 * 1000)
223
218
* 1000)
224
219
+ (self.interval.microseconds
225
220
// 1000))
226
# Emit D-Bus signal
227
self.IntervalChanged(self._interval_milliseconds)
228
interval = property(lambda self: self._interval, _set_interval)
221
interval = property(lambda self: self._interval,
222
_set_interval)
229
223
del _set_interval
230
231
def __init__(self, name = None, stop_hook=None, config=None):
232
"""Note: the 'checker' key in 'config' sets the
233
'checker_command' attribute and *not* the 'checker'
234
attribute."""
235
dbus.service.Object.__init__(self, bus,
236
"/Mandos/clients/%s"
237
% name.replace(".", "_"))
238
if config is None:
239
config = {}
224
def __init__(self, name=None, stop_hook=None, fingerprint=None,
225
secret=None, secfile=None, fqdn=None, timeout=None,
226
interval=-1, checker=None):
227
"""Note: the 'checker' argument sets the 'checker_command'
228
attribute and not the 'checker' attribute.."""
240
229
self.name = name
241
230
logger.debug(u"Creating client %r", self.name)
242
# Uppercase and remove spaces from fingerprint for later
243
# comparison purposes with return value from the fingerprint()
244
# function
245
self.fingerprint = (config["fingerprint"].upper()
246
.replace(u" ", u""))
231
# Uppercase and remove spaces from fingerprint
232
# for later comparison purposes with return value of
233
# the fingerprint() function
234
self.fingerprint = fingerprint.upper().replace(u" ", u"")
247
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
248
if "secret" in config:
249
self.secret = config["secret"].decode(u"base64")
250
elif "secfile" in config:
251
with closing(open(os.path.expanduser
252
(os.path.expandvars
253
(config["secfile"])))) as secfile:
254
self.secret = secfile.read()
236
if secret:
237
self.secret = secret.decode(u"base64")
238
elif secfile:
239
sf = open(secfile)
240
self.secret = sf.read()
241
sf.close()
255
242
else:
256
243
raise TypeError(u"No secret or secfile for client %s"
257
244
% self.name)
258
self.host = config.get("host", "")
259
self.created = datetime.datetime.utcnow()
260
self.started = None
245
self.fqdn = fqdn
246
self.created = datetime.datetime.now()
261
247
self.last_checked_ok = None
262
self.timeout = string_to_delta(config["timeout"])
263
self.interval = string_to_delta(config["interval"])
248
self.timeout = string_to_delta(timeout)
249
self.interval = string_to_delta(interval)
264
250
self.stop_hook = stop_hook
265
251
self.checker = None
266
252
self.checker_initiator_tag = None
267
253
self.stop_initiator_tag = None
268
254
self.checker_callback_tag = None
269
self.check_command = config["checker"]
270
255
self.check_command = checker
271
256
def start(self):
272
257
"""Start this client's checker and timeout hooks"""
273
self.started = datetime.datetime.utcnow()
274
258
# Schedule a new checker to be started an 'interval' from now,
275
259
# and every interval from then on.
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self._interval_milliseconds,
278
self.start_checker))
260
self.checker_initiator_tag = gobject.timeout_add\
261
(self._interval_milliseconds,
262
self.start_checker)
279
263
# Also start a new checker *right now*.
280
264
self.start_checker()
281
265
# Schedule a stop() when 'timeout' has passed
282
self.stop_initiator_tag = (gobject.timeout_add
283
(self._timeout_milliseconds,
284
self.stop))
285
# Emit D-Bus signal
286
self.StateChanged(True)
287
266
self.stop_initiator_tag = gobject.timeout_add\
267
(self._timeout_milliseconds,
268
self.stop)
288
269
def stop(self):
289
"""Stop this client."""
290
if getattr(self, "started", None) is not None:
291
logger.info(u"Stopping client %s", self.name)
270
"""Stop this client.
271
The possibility that a client might be restarted is left open,
272
but not currently used."""
273
# If this client doesn't have a secret, it is already stopped.
274
if self.secret:
275
logger.debug(u"Stopping client %s", self.name)
276
self.secret = None
292
277
else:
293
278
return False
294
279
if getattr(self, "stop_initiator_tag", False):
300
285
self.stop_checker()
301
286
if self.stop_hook:
302
287
self.stop_hook(self)
303
self.started = None
304
# Emit D-Bus signal
305
self.StateChanged(False)
306
288
# Do not run this again if called by a gobject.timeout_add
307
289
return False
308
309
290
def __del__(self):
310
291
self.stop_hook = None
311
292
self.stop()
312
313
293
def checker_callback(self, pid, condition):
314
294
"""The checker has completed, so take appropriate actions."""
295
now = datetime.datetime.now()
315
296
self.checker_callback_tag = None
316
297
self.checker = None
317
if (os.WIFEXITED(condition)
318
and (os.WEXITSTATUS(condition) == 0)):
319
logger.info(u"Checker for %(name)s succeeded",
320
vars(self))
321
# Emit D-Bus signal
322
self.CheckerCompleted(True)
323
self.bump_timeout()
298
if os.WIFEXITED(condition) \
299
and (os.WEXITSTATUS(condition) == 0):
300
logger.debug(u"Checker for %(name)s succeeded",
301
vars(self))
302
self.last_checked_ok = now
303
gobject.source_remove(self.stop_initiator_tag)
304
self.stop_initiator_tag = gobject.timeout_add\
305
(self._timeout_milliseconds,
306
self.stop)
324
307
elif not os.WIFEXITED(condition):
325
308
logger.warning(u"Checker for %(name)s crashed?",
326
309
vars(self))
327
# Emit D-Bus signal
328
self.CheckerCompleted(False)
329
310
else:
330
logger.info(u"Checker for %(name)s failed",
331
vars(self))
332
# Emit D-Bus signal
333
self.CheckerCompleted(False)
334
335
def bump_timeout(self):
336
"""Bump up the timeout for this client.
337
This should only be called when the client has been seen,
338
alive and well.
339
"""
340
self.last_checked_ok = datetime.datetime.utcnow()
341
gobject.source_remove(self.stop_initiator_tag)
342
self.stop_initiator_tag = (gobject.timeout_add
343
(self._timeout_milliseconds,
344
self.stop))
345
311
logger.debug(u"Checker for %(name)s failed",
312
vars(self))
346
313
def start_checker(self):
347
314
"""Start a new checker subprocess if one is not running.
348
315
If a checker already exists, leave it running and do
358
325
if self.checker is None:
359
326
try:
360
327
# In case check_command has exactly one % operator
361
command = self.check_command % self.host
328
command = self.check_command % self.fqdn
362
329
except TypeError:
363
330
# Escape attributes for the shell
364
331
escaped_attrs = dict((key, re.escape(str(val)))
371
338
u' %s', self.check_command, error)
372
339
return True # Try again later
373
340
try:
374
logger.info(u"Starting checker %r for %s",
375
command, self.name)
376
# We don't need to redirect stdout and stderr, since
377
# in normal mode, that is already done by daemon(),
378
# and in debug mode we don't want to. (Stdin is
379
# always replaced by /dev/null.)
341
logger.debug(u"Starting checker %r for %s",
342
command, self.name)
380
343
self.checker = subprocess.Popen(command,
381
344
close_fds=True,
382
345
shell=True, cwd="/")
383
self.checker_callback_tag = (gobject.child_watch_add
384
(self.checker.pid,
385
self.checker_callback))
386
# Emit D-Bus signal
387
self.CheckerStarted(command)
388
except OSError, error:
346
self.checker_callback_tag = gobject.child_watch_add\
347
(self.checker.pid,
348
self.checker_callback)
349
except subprocess.OSError, error:
389
350
logger.error(u"Failed to start subprocess: %s",
390
351
error)
391
352
# Re-run this periodically if run by gobject.timeout_add
392
353
return True
393
394
354
def stop_checker(self):
395
355
"""Force the checker process, if any, to stop."""
396
356
if self.checker_callback_tag:
398
358
self.checker_callback_tag = None
399
359
if getattr(self, "checker", None) is None:
400
360
return
401
logger.debug(u"Stopping checker for %(name)s", vars(self))
361
logger.debug("Stopping checker for %(name)s", vars(self))
402
362
try:
403
363
os.kill(self.checker.pid, signal.SIGTERM)
404
364
#os.sleep(0.5)
408
368
if error.errno != errno.ESRCH: # No such process
409
369
raise
410
370
self.checker = None
411
412
371
def still_valid(self):
413
372
"""Has the timeout not yet passed for this client?"""
414
if not self.started:
415
return False
416
now = datetime.datetime.utcnow()
373
now = datetime.datetime.now()
417
374
if self.last_checked_ok is None:
418
375
return now < (self.created + self.timeout)
419
376
else:
420
377
return now < (self.last_checked_ok + self.timeout)
421
422
## D-Bus methods & signals
423
_interface = u"org.mandos_system.Mandos.Client"
424
425
def _datetime_to_dbus_struct(dt):
426
return dbus.Struct(dt.year, dt.month, dt.day, dt.hour,
427
dt.minute, dt.second, dt.microsecond,
428
signature="nyyyyyu")
429
430
# BumpTimeout - method
431
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
432
BumpTimeout.__name__ = "BumpTimeout"
433
434
# IntervalChanged - signal
435
@dbus.service.signal(_interface, signature="t")
436
def IntervalChanged(self, t):
437
"D-Bus signal"
438
pass
439
440
# CheckerCompleted - signal
441
@dbus.service.signal(_interface, signature="b")
442
def CheckerCompleted(self, success):
443
"D-Bus signal"
444
pass
445
446
# CheckerIsRunning - method
447
@dbus.service.method(_interface, out_signature="b")
448
def CheckerIsRunning(self):
449
"D-Bus getter method"
450
return self.checker is not None
451
452
# CheckerStarted - signal
453
@dbus.service.signal(_interface, signature="s")
454
def CheckerStarted(self, command):
455
"D-Bus signal"
456
pass
457
458
# GetChecker - method
459
@dbus.service.method(_interface, out_signature="s")
460
def GetChecker(self):
461
"D-Bus getter method"
462
return self.checker_command
463
464
# GetCreated - method
465
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
466
def GetCreated(self):
467
"D-Bus getter method"
468
return datetime_to_dbus_struct(self.created)
469
470
# GetFingerprint - method
471
@dbus.service.method(_interface, out_signature="s")
472
def GetFingerprint(self):
473
"D-Bus getter method"
474
return self.fingerprint
475
476
# GetHost - method
477
@dbus.service.method(_interface, out_signature="s")
478
def GetHost(self):
479
"D-Bus getter method"
480
return self.host
481
482
# GetInterval - method
483
@dbus.service.method(_interface, out_signature="t")
484
def GetInterval(self):
485
"D-Bus getter method"
486
return self._interval_milliseconds
487
488
# GetName - method
489
@dbus.service.method(_interface, out_signature="s")
490
def GetName(self):
491
"D-Bus getter method"
492
return self.name
493
494
# GetStarted - method
495
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
496
def GetStarted(self):
497
"D-Bus getter method"
498
if self.started is not None:
499
return datetime_to_dbus_struct(self.started)
500
else:
501
return dbus.Struct(0, 0, 0, 0, 0, 0, 0,
502
signature="nyyyyyu")
503
504
# GetTimeout - method
505
@dbus.service.method(_interface, out_signature="t")
506
def GetTimeout(self):
507
"D-Bus getter method"
508
return self._timeout_milliseconds
509
510
# SetChecker - method
511
@dbus.service.method(_interface, in_signature="s")
512
def SetChecker(self, checker):
513
"D-Bus setter method"
514
self.checker_command = checker
515
516
# SetHost - method
517
@dbus.service.method(_interface, in_signature="s")
518
def SetHost(self, host):
519
"D-Bus setter method"
520
self.host = host
521
522
# SetInterval - method
523
@dbus.service.method(_interface, in_signature="t")
524
def SetInterval(self, milliseconds):
525
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
526
527
# SetTimeout - method
528
@dbus.service.method(_interface, in_signature="t")
529
def SetTimeout(self, milliseconds):
530
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
531
532
# SetSecret - method
533
@dbus.service.method(_interface, in_signature="ay",
534
byte_arrays=True)
535
def SetSecret(self, secret):
536
"D-Bus setter method"
537
self.secret = str(secret)
538
539
# Start - method
540
Start = dbus.service.method(_interface)(start)
541
Start.__name__ = "Start"
542
543
# StartChecker - method
544
StartChecker = dbus.service.method(_interface)(start_checker)
545
StartChecker.__name__ = "StartChecker"
546
547
# StateChanged - signal
548
@dbus.service.signal(_interface, signature="b")
549
def StateChanged(self, started):
550
"D-Bus signal"
551
pass
552
553
# StillValid - method
554
StillValid = (dbus.service.method(_interface, out_signature="b")
555
(still_valid))
556
StillValid.__name__ = "StillValid"
557
558
# Stop - method
559
Stop = dbus.service.method(_interface)(stop)
560
Stop.__name__ = "Stop"
561
562
# StopChecker - method
563
StopChecker = dbus.service.method(_interface)(stop_checker)
564
StopChecker.__name__ = "StopChecker"
565
566
# TimeoutChanged - signal
567
@dbus.service.signal(_interface, signature="t")
568
def TimeoutChanged(self, t):
569
"D-Bus signal"
570
pass
571
572
del _datetime_to_dbus_struct
573
del _interface
574
378
575
379
576
380
def peer_certificate(session):
577
381
"Return the peer's OpenPGP certificate as a bytestring"
578
382
# If not an OpenPGP certificate...
579
if (gnutls.library.functions
580
.gnutls_certificate_type_get(session._c_object)
581
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
383
if gnutls.library.functions.gnutls_certificate_type_get\
384
(session._c_object) \
385
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
582
386
# ...do the normal thing
583
387
return session.peer_certificate
584
388
list_size = ctypes.c_uint()
585
cert_list = (gnutls.library.functions
586
.gnutls_certificate_get_peers
587
(session._c_object, ctypes.byref(list_size)))
389
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
390
(session._c_object, ctypes.byref(list_size))
588
391
if list_size.value == 0:
589
392
return None
590
393
cert = cert_list[0]
593
396
594
397
def fingerprint(openpgp):
595
398
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
596
# New GnuTLS "datum" with the OpenPGP public key
597
datum = (gnutls.library.types
598
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
599
ctypes.POINTER
600
(ctypes.c_ubyte)),
601
ctypes.c_uint(len(openpgp))))
602
399
# New empty GnuTLS certificate
603
400
crt = gnutls.library.types.gnutls_openpgp_crt_t()
604
(gnutls.library.functions
605
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
401
gnutls.library.functions.gnutls_openpgp_crt_init\
402
(ctypes.byref(crt))
403
# New GnuTLS "datum" with the OpenPGP public key
404
datum = gnutls.library.types.gnutls_datum_t\
405
(ctypes.cast(ctypes.c_char_p(openpgp),
406
ctypes.POINTER(ctypes.c_ubyte)),
407
ctypes.c_uint(len(openpgp)))
606
408
# Import the OpenPGP public key into the certificate
607
(gnutls.library.functions
608
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
609
gnutls.library.constants
610
.GNUTLS_OPENPGP_FMT_RAW))
611
# Verify the self signature in the key
612
crtverify = ctypes.c_uint()
613
(gnutls.library.functions
614
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
615
if crtverify.value != 0:
616
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
617
raise gnutls.errors.CertificateSecurityError("Verify failed")
409
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
410
(crt,
411
ctypes.byref(datum),
412
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
618
413
# New buffer for the fingerprint
619
buf = ctypes.create_string_buffer(20)
620
buf_len = ctypes.c_size_t()
414
buffer = ctypes.create_string_buffer(20)
415
buffer_length = ctypes.c_size_t()
621
416
# Get the fingerprint from the certificate into the buffer
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
624
ctypes.byref(buf_len)))
417
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
418
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
625
419
# Deinit the certificate
626
420
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
421
# Convert the buffer to a Python bytestring
628
fpr = ctypes.string_at(buf, buf_len.value)
422
fpr = ctypes.string_at(buffer, buffer_length.value)
629
423
# Convert the bytestring to hexadecimal notation
630
424
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
631
425
return hex_fpr
632
426
633
427
634
class TCP_handler(SocketServer.BaseRequestHandler, object):
428
class tcp_handler(SocketServer.BaseRequestHandler, object):
635
429
"""A TCP request handler class.
636
430
Instantiated by IPv6_TCPServer for each request to handle it.
637
431
Note: This will run in its own forked process."""
638
432
639
433
def handle(self):
640
logger.info(u"TCP connection from: %s",
641
unicode(self.client_address))
642
session = (gnutls.connection
643
.ClientSession(self.request,
644
gnutls.connection
645
.X509Credentials()))
434
logger.debug(u"TCP connection from: %s",
435
unicode(self.client_address))
436
session = gnutls.connection.ClientSession\
437
(self.request, gnutls.connection.X509Credentials())
646
438
647
439
line = self.request.makefile().readline()
648
440
logger.debug(u"Protocol version: %r", line)
661
453
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
662
454
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
663
455
# "+DHE-DSS"))
664
# Use a fallback default, since this MUST be set.
665
priority = self.server.settings.get("priority", "NORMAL")
666
(gnutls.library.functions
667
.gnutls_priority_set_direct(session._c_object,
668
priority, None))
456
priority = "NORMAL" # Fallback default, since this
457
# MUST be set.
458
if self.server.settings["priority"]:
459
priority = self.server.settings["priority"]
460
gnutls.library.functions.gnutls_priority_set_direct\
461
(session._c_object, priority, None);
669
462
670
463
try:
671
464
session.handshake()
672
465
except gnutls.errors.GNUTLSError, error:
673
logger.warning(u"Handshake failed: %s", error)
466
logger.debug(u"Handshake failed: %s", error)
674
467
# Do not run session.bye() here: the session is not
675
468
# established. Just abandon the request.
676
469
return
677
470
try:
678
471
fpr = fingerprint(peer_certificate(session))
679
472
except (TypeError, gnutls.errors.GNUTLSError), error:
680
logger.warning(u"Bad certificate: %s", error)
473
logger.debug(u"Bad certificate: %s", error)
681
474
session.bye()
682
475
return
683
476
logger.debug(u"Fingerprint: %s", fpr)
477
client = None
684
478
for c in self.server.clients:
685
479
if c.fingerprint == fpr:
686
480
client = c
687
481
break
688
else:
689
logger.warning(u"Client not found for fingerprint: %s",
690
fpr)
482
if not client:
483
logger.debug(u"Client not found for fingerprint: %s", fpr)
691
484
session.bye()
692
485
return
693
486
# Have to check if client.still_valid(), since it is possible
694
487
# that the client timed out while establishing the GnuTLS
695
488
# session.
696
489
if not client.still_valid():
697
logger.warning(u"Client %(name)s is invalid",
698
vars(client))
490
logger.debug(u"Client %(name)s is invalid", vars(client))
699
491
session.bye()
700
492
return
701
## This won't work here, since we're in a fork.
702
# client.bump_timeout()
703
493
sent_size = 0
704
494
while sent_size < len(client.secret):
705
495
sent = session.send(client.secret[sent_size:])
710
500
session.bye()
711
501
712
502
713
class IPv6_TCPServer(SocketServer.ForkingMixIn,
714
SocketServer.TCPServer, object):
503
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
715
504
"""IPv6 TCP server. Accepts 'None' as address and/or port.
716
505
Attributes:
717
506
settings: Server settings
718
507
clients: Set() of Client objects
719
enabled: Boolean; whether this server is activated yet
720
508
"""
721
509
address_family = socket.AF_INET6
722
510
def __init__(self, *args, **kwargs):
726
514
if "clients" in kwargs:
727
515
self.clients = kwargs["clients"]
728
516
del kwargs["clients"]
729
self.enabled = False
730
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
517
return super(type(self), self).__init__(*args, **kwargs)
731
518
def server_bind(self):
732
519
"""This overrides the normal server_bind() function
733
520
to bind to an interface if one was specified, and also NOT to
741
528
self.settings["interface"])
742
529
except socket.error, error:
743
530
if error[0] == errno.EPERM:
744
logger.error(u"No permission to"
745
u" bind to interface %s",
746
self.settings["interface"])
531
logger.warning(u"No permission to"
532
u" bind to interface %s",
533
self.settings["interface"])
747
534
else:
748
535
raise error
749
536
# Only bind(2) the socket if we really need to.
752
539
in6addr_any = "::"
753
540
self.server_address = (in6addr_any,
754
541
self.server_address[1])
755
elif not self.server_address[1]:
542
elif self.server_address[1] is None:
756
543
self.server_address = (self.server_address[0],
757
544
0)
758
# if self.settings["interface"]:
759
# self.server_address = (self.server_address[0],
760
# 0, # port
761
# 0, # flowinfo
762
# if_nametoindex
763
# (self.settings
764
# ["interface"]))
765
return super(IPv6_TCPServer, self).server_bind()
766
def server_activate(self):
767
if self.enabled:
768
return super(IPv6_TCPServer, self).server_activate()
769
def enable(self):
770
self.enabled = True
545
return super(type(self), self).server_bind()
771
546
772
547
773
548
def string_to_delta(interval):
783
558
datetime.timedelta(1)
784
559
>>> string_to_delta(u'1w')
785
560
datetime.timedelta(7)
786
>>> string_to_delta('5m 30s')
787
datetime.timedelta(0, 330)
788
561
"""
789
timevalue = datetime.timedelta(0)
790
for s in interval.split():
791
try:
792
suffix = unicode(s[-1])
793
value = int(s[:-1])
794
if suffix == u"d":
795
delta = datetime.timedelta(value)
796
elif suffix == u"s":
797
delta = datetime.timedelta(0, value)
798
elif suffix == u"m":
799
delta = datetime.timedelta(0, 0, 0, 0, value)
800
elif suffix == u"h":
801
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
802
elif suffix == u"w":
803
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
804
else:
805
raise ValueError
806
except (ValueError, IndexError):
562
try:
563
suffix=unicode(interval[-1])
564
value=int(interval[:-1])
565
if suffix == u"d":
566
delta = datetime.timedelta(value)
567
elif suffix == u"s":
568
delta = datetime.timedelta(0, value)
569
elif suffix == u"m":
570
delta = datetime.timedelta(0, 0, 0, 0, value)
571
elif suffix == u"h":
572
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
573
elif suffix == u"w":
574
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
575
else:
807
576
raise ValueError
808
timevalue += delta
809
return timevalue
577
except (ValueError, IndexError):
578
raise ValueError
579
return delta
810
580
811
581
812
582
def server_state_changed(state):
813
583
"""Derived from the Avahi example code"""
814
584
if state == avahi.SERVER_COLLISION:
815
logger.error(u"Zeroconf server name collision")
585
logger.warning(u"Server name collision")
816
586
service.remove()
817
587
elif state == avahi.SERVER_RUNNING:
818
588
service.add()
820
590
821
591
def entry_group_state_changed(state, error):
822
592
"""Derived from the Avahi example code"""
823
logger.debug(u"Avahi state change: %i", state)
593
logger.debug(u"state change: %i", state)
824
594
825
595
if state == avahi.ENTRY_GROUP_ESTABLISHED:
826
logger.debug(u"Zeroconf service established.")
596
logger.debug(u"Service established.")
827
597
elif state == avahi.ENTRY_GROUP_COLLISION:
828
logger.warning(u"Zeroconf service name collision.")
598
logger.warning(u"Service name collision.")
829
599
service.rename()
830
600
elif state == avahi.ENTRY_GROUP_FAILURE:
831
logger.critical(u"Avahi: Error in group state changed %s",
601
logger.critical(u"Error in group state changed %s",
832
602
unicode(error))
833
603
raise AvahiGroupError("State changed: %s", str(error))
834
604
836
606
"""Call the C function if_nametoindex(), or equivalent"""
837
607
global if_nametoindex
838
608
try:
839
if_nametoindex = (ctypes.cdll.LoadLibrary
840
(ctypes.util.find_library("c"))
841
.if_nametoindex)
609
if "ctypes.util" not in sys.modules:
610
import ctypes.util
611
if_nametoindex = ctypes.cdll.LoadLibrary\
612
(ctypes.util.find_library("c")).if_nametoindex
842
613
except (OSError, AttributeError):
843
614
if "struct" not in sys.modules:
844
615
import struct
847
618
def if_nametoindex(interface):
848
619
"Get an interface index the hard way, i.e. using fcntl()"
849
620
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
850
with closing(socket.socket()) as s:
851
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
852
struct.pack("16s16x", interface))
621
s = socket.socket()
622
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
623
struct.pack("16s16x", interface))
624
s.close()
853
625
interface_index = struct.unpack("I", ifreq[16:20])[0]
854
626
return interface_index
855
627
return if_nametoindex(interface)
856
628
857
629
858
def daemon(nochdir = False, noclose = False):
630
def daemon(nochdir, noclose):
859
631
"""See daemon(3). Standard BSD Unix function.
860
632
This should really exist as os.daemon, but it doesn't (yet)."""
861
633
if os.fork():
863
635
os.setsid()
864
636
if not nochdir:
865
637
os.chdir("/")
866
if os.fork():
867
sys.exit()
868
638
if not noclose:
869
639
# Close all standard open file descriptors
870
640
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
879
649
880
650
881
651
def main():
882
parser = OptionParser(version = "%%prog %s" % version)
652
global main_loop_started
653
main_loop_started = False
654
655
parser = OptionParser()
883
656
parser.add_option("-i", "--interface", type="string",
884
657
metavar="IF", help="Bind to interface IF")
885
658
parser.add_option("-a", "--address", type="string",
888
661
help="Port number to receive requests on")
889
662
parser.add_option("--check", action="store_true", default=False,
890
663
help="Run self-test")
891
parser.add_option("--debug", action="store_true",
664
parser.add_option("--debug", action="store_true", default=False,
892
665
help="Debug mode; run in foreground and log to"
893
666
" terminal")
894
667
parser.add_option("--priority", type="string", help="GnuTLS"
899
672
default="/etc/mandos", metavar="DIR",
900
673
help="Directory to search for configuration"
901
674
" files")
902
options = parser.parse_args()[0]
675
(options, args) = parser.parse_args()
903
676
904
677
if options.check:
905
678
import doctest
919
692
# Parse config file for server-global settings
920
693
server_config = ConfigParser.SafeConfigParser(server_defaults)
921
694
del server_defaults
922
server_config.read(os.path.join(options.configdir, "mandos.conf"))
695
server_config.read(os.path.join(options.configdir, "server.conf"))
696
server_section = "server"
923
697
# Convert the SafeConfigParser object to a dict
924
server_settings = server_config.defaults()
698
server_settings = dict(server_config.items(server_section))
925
699
# Use getboolean on the boolean config option
926
server_settings["debug"] = (server_config.getboolean
927
("DEFAULT", "debug"))
700
server_settings["debug"] = server_config.getboolean\
701
(server_section, "debug")
928
702
del server_config
929
703
930
704
# Override the settings from the config file with command line
937
711
del options
938
712
# Now we have our good server settings in "server_settings"
939
713
940
debug = server_settings["debug"]
941
942
if not debug:
943
syslogger.setLevel(logging.WARNING)
944
console.setLevel(logging.WARNING)
945
946
if server_settings["servicename"] != "Mandos":
947
syslogger.setFormatter(logging.Formatter
948
('Mandos (%s): %%(levelname)s:'
949
' %%(message)s'
950
% server_settings["servicename"]))
951
952
714
# Parse config file with clients
953
715
client_defaults = { "timeout": "1h",
954
716
"interval": "5m",
955
"checker": "fping -q -- %(host)s",
956
"host": "",
717
"checker": "fping -q -- %%(fqdn)s",
957
718
}
958
719
client_config = ConfigParser.SafeConfigParser(client_defaults)
959
720
client_config.read(os.path.join(server_settings["configdir"],
960
721
"clients.conf"))
961
722
962
clients = Set()
963
tcp_server = IPv6_TCPServer((server_settings["address"],
964
server_settings["port"]),
965
TCP_handler,
966
settings=server_settings,
967
clients=clients)
968
pidfilename = "/var/run/mandos.pid"
969
try:
970
pidfile = open(pidfilename, "w")
971
except IOError, error:
972
logger.error("Could not open file %r", pidfilename)
973
974
uid = 65534
975
gid = 65534
976
try:
977
uid = pwd.getpwnam("mandos").pw_uid
978
except KeyError:
979
try:
980
uid = pwd.getpwnam("nobody").pw_uid
981
except KeyError:
982
pass
983
try:
984
gid = pwd.getpwnam("mandos").pw_gid
985
except KeyError:
986
try:
987
gid = pwd.getpwnam("nogroup").pw_gid
988
except KeyError:
989
pass
990
try:
991
os.setuid(uid)
992
os.setgid(gid)
993
except OSError, error:
994
if error[0] != errno.EPERM:
995
raise error
996
997
723
global service
998
724
service = AvahiService(name = server_settings["servicename"],
999
servicetype = "_mandos._tcp", )
725
type = "_mandos._tcp", );
1000
726
if server_settings["interface"]:
1001
service.interface = (if_nametoindex
1002
(server_settings["interface"]))
727
service.interface = if_nametoindex(server_settings["interface"])
1003
728
1004
729
global main_loop
1005
730
global bus
1008
733
DBusGMainLoop(set_as_default=True )
1009
734
main_loop = gobject.MainLoop()
1010
735
bus = dbus.SystemBus()
1011
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1012
avahi.DBUS_PATH_SERVER),
1013
avahi.DBUS_INTERFACE_SERVER)
736
server = dbus.Interface(
737
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
738
avahi.DBUS_INTERFACE_SERVER )
1014
739
# End of Avahi example code
1015
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
1016
740
741
debug = server_settings["debug"]
742
743
if debug:
744
console = logging.StreamHandler()
745
# console.setLevel(logging.DEBUG)
746
console.setFormatter(logging.Formatter\
747
('%(levelname)s: %(message)s'))
748
logger.addHandler(console)
749
del console
750
751
clients = Set()
1017
752
def remove_from_clients(client):
1018
753
clients.remove(client)
1019
754
if not clients:
1020
logger.critical(u"No clients left, exiting")
755
logger.debug(u"No clients left, exiting")
1021
756
sys.exit()
1022
757
1023
clients.update(Set(Client(name = section,
758
clients.update(Set(Client(name=section,
1024
759
stop_hook = remove_from_clients,
1025
config
1026
= dict(client_config.items(section)))
760
**(dict(client_config\
761
.items(section))))
1027
762
for section in client_config.sections()))
1028
if not clients:
1029
logger.critical(u"No clients defined")
1030
sys.exit(1)
1031
1032
if debug:
1033
# Redirect stdin so all checkers get /dev/null
1034
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1035
os.dup2(null, sys.stdin.fileno())
1036
if null > 2:
1037
os.close(null)
1038
else:
1039
# No console logging
1040
logger.removeHandler(console)
1041
# Close all input and output, do double fork, etc.
1042
daemon()
1043
1044
try:
1045
pid = os.getpid()
1046
pidfile.write(str(pid) + "\n")
1047
pidfile.close()
1048
del pidfile
1049
except IOError:
1050
logger.error(u"Could not write to file %r with PID %d",
1051
pidfilename, pid)
1052
except NameError:
1053
# "pidfile" was never created
1054
pass
1055
del pidfilename
763
764
if not debug:
765
daemon(False, False)
1056
766
1057
767
def cleanup():
1058
768
"Cleanup function; run on exit"
1078
788
for client in clients:
1079
789
client.start()
1080
790
1081
tcp_server.enable()
1082
tcp_server.server_activate()
1083
791
tcp_server = IPv6_TCPServer((server_settings["address"],
792
server_settings["port"]),
793
tcp_handler,
794
settings=server_settings,
795
clients=clients)
1084
796
# Find out what port we got
1085
797
service.port = tcp_server.socket.getsockname()[1]
1086
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1087
u" scope_id %d" % tcp_server.socket.getsockname())
798
logger.debug(u"Now listening on address %r, port %d, flowinfo %d,"
799
u" scope_id %d" % tcp_server.socket.getsockname())
1088
800
1089
801
#service.interface = tcp_server.socket.getsockname()[3]
1090
802
1100
812
1101
813
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1102
814
lambda *args, **kwargs:
1103
(tcp_server.handle_request
1104
(*args[2:], **kwargs) or True))
815
tcp_server.handle_request\
816
(*args[2:], **kwargs) or True)
1105
817
1106
logger.debug(u"Starting main loop")
818
logger.debug("Starting main loop")
819
main_loop_started = True
1107
820
main_loop.run()
1108
821
except AvahiError, error:
1109
822
logger.critical(u"AvahiError: %s" + unicode(error))
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0