To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 243
- compare with another revision
- download diff
- download tarball
- view history from revision 243
- Committer: Teddy Hogeborn
- Date: 2009-01-06 22:21:53 UTC
- Revision ID: teddy@fukt.bsnet.se-20090106222153-3b43cfdjyvz1032y
Tags: version-1.0.3-2
* debian/changelog (1.0.3-2): New entry.
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- network-protocol.txt
- files renamed:
- mandos-client.c => plugin-runner.c
- mandos-client.xml => plugin-runner.xml
- plugins.d/password-request.c => plugins.d/mandos-client.c
- plugins.d/password-request.xml => plugins.d/mandos-client.xml
- files modified:
- Makefile
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
24
25
# GNU General Public License for more details.
25
26
#
26
27
# You should have received a copy of the GNU General Public License
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
28
30
#
29
31
# Contact the authors at <mandos@fukt.bsnet.se>.
30
32
#
31
33
32
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
33
35
34
36
import SocketServer
35
37
import socket
36
import select
37
from optparse import OptionParser
38
import optparse
38
39
import datetime
39
40
import errno
40
41
import gnutls.crypto
54
55
import stat
55
56
import logging
56
57
import logging.handlers
58
import pwd
59
from contextlib import closing
57
60
58
61
import dbus
62
import dbus.service
59
63
import gobject
60
64
import avahi
61
65
from dbus.mainloop.glib import DBusGMainLoop
62
66
import ctypes
67
import ctypes.util
63
68
64
version = "1.0"
69
version = "1.0.3"
65
70
66
71
logger = logging.Logger('mandos')
67
syslogger = logging.handlers.SysLogHandler\
68
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
69
address = "/dev/log")
70
syslogger.setFormatter(logging.Formatter\
71
('Mandos: %(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
72
77
logger.addHandler(syslogger)
73
78
79
console = logging.StreamHandler()
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
82
logger.addHandler(console)
74
83
75
84
class AvahiError(Exception):
76
def __init__(self, value):
85
def __init__(self, value, *args, **kwargs):
77
86
self.value = value
78
def __str__(self):
79
return repr(self.value)
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
80
90
81
91
class AvahiServiceError(AvahiError):
82
92
pass
102
112
a sensible number of times
103
113
"""
104
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
105
type = None, port = None, TXT = None, domain = "",
106
host = "", max_renames = 32768):
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
107
117
self.interface = interface
108
118
self.name = name
109
self.type = type
119
self.type = servicetype
110
120
self.port = port
111
if TXT is None:
112
self.TXT = []
113
else:
114
self.TXT = TXT
121
self.TXT = TXT if TXT is not None else []
115
122
self.domain = domain
116
123
self.host = host
117
124
self.rename_count = 0
125
self.max_renames = max_renames
118
126
def rename(self):
119
127
"""Derived from the Avahi example code"""
120
128
if self.rename_count >= self.max_renames:
121
logger.critical(u"No suitable service name found after %i"
122
u" retries, exiting.", rename_count)
123
raise AvahiServiceError("Too many renames")
124
name = server.GetAlternativeServiceName(name)
125
logger.error(u"Changing name to %r ...", name)
126
syslogger.setFormatter(logging.Formatter\
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
127
137
('Mandos (%s): %%(levelname)s:'
128
' %%(message)s' % name))
138
' %%(message)s' % self.name))
129
139
self.remove()
130
140
self.add()
131
141
self.rename_count += 1
137
147
"""Derived from the Avahi example code"""
138
148
global group
139
149
if group is None:
140
group = dbus.Interface\
141
(bus.get_object(avahi.DBUS_NAME,
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
142
152
server.EntryGroupNew()),
143
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
144
154
group.connect_to_signal('StateChanged',
145
155
entry_group_state_changed)
146
logger.debug(u"Adding service '%s' of type '%s' ...",
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
147
157
service.name, service.type)
148
158
group.AddService(
149
159
self.interface, # interface
160
170
# End of Avahi example code
161
171
162
172
163
class Client(object):
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
164
179
"""A representation of a client host served by this server.
165
180
Attributes:
166
name: string; from the config file, used in log messages
181
name: string; from the config file, used in log messages
167
182
fingerprint: string (40 or 32 hexadecimal digits); used to
168
183
uniquely identify the client
169
secret: bytestring; sent verbatim (over TLS) to client
170
host: string; available for use by the checker command
171
created: datetime.datetime(); object creation, not client host
172
last_checked_ok: datetime.datetime() or None if not yet checked OK
173
timeout: datetime.timedelta(); How long from last_checked_ok
174
until this client is invalid
175
interval: datetime.timedelta(); How often to start a new checker
176
stop_hook: If set, called by stop() as stop_hook(self)
177
checker: subprocess.Popen(); a running checker process used
178
to see if the client lives.
179
'None' if no process is running.
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
180
197
checker_initiator_tag: a gobject event source tag, or None
181
stop_initiator_tag: - '' -
198
disable_initiator_tag: - '' -
182
199
checker_callback_tag: - '' -
183
200
checker_command: string; External command which is run to check if
184
201
client lives. %() expansions are done at
185
202
runtime with vars(self) as dict, so that for
186
203
instance %(name)s can be used in the command.
187
Private attibutes:
188
_timeout: Real variable for 'timeout'
189
_interval: Real variable for 'interval'
190
_timeout_milliseconds: Used when calling gobject.timeout_add()
191
_interval_milliseconds: - '' -
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
192
206
"""
193
def _set_timeout(self, timeout):
194
"Setter function for 'timeout' attribute"
195
self._timeout = timeout
196
self._timeout_milliseconds = ((self.timeout.days
197
* 24 * 60 * 60 * 1000)
198
+ (self.timeout.seconds * 1000)
199
+ (self.timeout.microseconds
200
// 1000))
201
timeout = property(lambda self: self._timeout,
202
_set_timeout)
203
del _set_timeout
204
def _set_interval(self, interval):
205
"Setter function for 'interval' attribute"
206
self._interval = interval
207
self._interval_milliseconds = ((self.interval.days
208
* 24 * 60 * 60 * 1000)
209
+ (self.interval.seconds
210
* 1000)
211
+ (self.interval.microseconds
212
// 1000))
213
interval = property(lambda self: self._interval,
214
_set_interval)
215
del _set_interval
216
def __init__(self, name = None, stop_hook=None, config={}):
207
def timeout_milliseconds(self):
208
"Return the 'timeout' attribute in milliseconds"
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
212
213
def interval_milliseconds(self):
214
"Return the 'interval' attribute in milliseconds"
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
218
219
def __init__(self, name = None, disable_hook=None, config=None,
220
use_dbus=True):
217
221
"""Note: the 'checker' key in 'config' sets the
218
222
'checker_command' attribute and *not* the 'checker'
219
223
attribute."""
220
224
self.name = name
225
if config is None:
226
config = {}
221
227
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
229
if self.use_dbus:
230
self.dbus_object_path = (dbus.ObjectPath
231
("/Mandos/clients/"
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
222
235
# Uppercase and remove spaces from fingerprint for later
223
236
# comparison purposes with return value from the fingerprint()
224
237
# function
225
self.fingerprint = config["fingerprint"].upper()\
226
.replace(u" ", u"")
238
self.fingerprint = (config["fingerprint"].upper()
239
.replace(u" ", u""))
227
240
logger.debug(u" Fingerprint: %s", self.fingerprint)
228
241
if "secret" in config:
229
242
self.secret = config["secret"].decode(u"base64")
230
243
elif "secfile" in config:
231
sf = open(config["secfile"])
232
self.secret = sf.read()
233
sf.close()
244
with closing(open(os.path.expanduser
245
(os.path.expandvars
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
234
248
else:
235
249
raise TypeError(u"No secret or secfile for client %s"
236
250
% self.name)
237
251
self.host = config.get("host", "")
238
self.created = datetime.datetime.now()
252
self.created = datetime.datetime.utcnow()
253
self.enabled = False
254
self.last_enabled = None
239
255
self.last_checked_ok = None
240
256
self.timeout = string_to_delta(config["timeout"])
241
257
self.interval = string_to_delta(config["interval"])
242
self.stop_hook = stop_hook
258
self.disable_hook = disable_hook
243
259
self.checker = None
244
260
self.checker_initiator_tag = None
245
self.stop_initiator_tag = None
261
self.disable_initiator_tag = None
246
262
self.checker_callback_tag = None
247
self.check_command = config["checker"]
248
def start(self):
263
self.checker_command = config["checker"]
264
265
def enable(self):
249
266
"""Start this client's checker and timeout hooks"""
267
self.last_enabled = datetime.datetime.utcnow()
250
268
# Schedule a new checker to be started an 'interval' from now,
251
269
# and every interval from then on.
252
self.checker_initiator_tag = gobject.timeout_add\
253
(self._interval_milliseconds,
254
self.start_checker)
270
self.checker_initiator_tag = (gobject.timeout_add
271
(self.interval_milliseconds(),
272
self.start_checker))
255
273
# Also start a new checker *right now*.
256
274
self.start_checker()
257
# Schedule a stop() when 'timeout' has passed
258
self.stop_initiator_tag = gobject.timeout_add\
259
(self._timeout_milliseconds,
260
self.stop)
261
def stop(self):
262
"""Stop this client.
263
The possibility that a client might be restarted is left open,
264
but not currently used."""
265
# If this client doesn't have a secret, it is already stopped.
266
if hasattr(self, "secret") and self.secret:
267
logger.info(u"Stopping client %s", self.name)
268
self.secret = None
269
else:
275
# Schedule a disable() when 'timeout' has passed
276
self.disable_initiator_tag = (gobject.timeout_add
277
(self.timeout_milliseconds(),
278
self.disable))
279
self.enabled = True
280
if self.use_dbus:
281
# Emit D-Bus signals
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
286
variant_level=1)))
287
288
def disable(self):
289
"""Disable this client."""
290
if not getattr(self, "enabled", False):
270
291
return False
271
if getattr(self, "stop_initiator_tag", False):
272
gobject.source_remove(self.stop_initiator_tag)
273
self.stop_initiator_tag = None
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
294
gobject.source_remove(self.disable_initiator_tag)
295
self.disable_initiator_tag = None
274
296
if getattr(self, "checker_initiator_tag", False):
275
297
gobject.source_remove(self.checker_initiator_tag)
276
298
self.checker_initiator_tag = None
277
299
self.stop_checker()
278
if self.stop_hook:
279
self.stop_hook(self)
300
if self.disable_hook:
301
self.disable_hook(self)
302
self.enabled = False
303
if self.use_dbus:
304
# Emit D-Bus signal
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
280
307
# Do not run this again if called by a gobject.timeout_add
281
308
return False
309
282
310
def __del__(self):
283
self.stop_hook = None
284
self.stop()
285
def checker_callback(self, pid, condition):
311
self.disable_hook = None
312
self.disable()
313
314
def checker_callback(self, pid, condition, command):
286
315
"""The checker has completed, so take appropriate actions."""
287
now = datetime.datetime.now()
288
316
self.checker_callback_tag = None
289
317
self.checker = None
290
if os.WIFEXITED(condition) \
291
and (os.WEXITSTATUS(condition) == 0):
318
if self.use_dbus:
319
# Emit D-Bus signal
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
292
324
logger.info(u"Checker for %(name)s succeeded",
293
325
vars(self))
294
self.last_checked_ok = now
295
gobject.source_remove(self.stop_initiator_tag)
296
self.stop_initiator_tag = gobject.timeout_add\
297
(self._timeout_milliseconds,
298
self.stop)
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
331
self.bump_timeout()
299
332
elif not os.WIFEXITED(condition):
300
333
logger.warning(u"Checker for %(name)s crashed?",
301
334
vars(self))
335
if self.use_dbus:
336
# Emit D-Bus signal
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
302
340
else:
303
341
logger.info(u"Checker for %(name)s failed",
304
342
vars(self))
343
if self.use_dbus:
344
# Emit D-Bus signal
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
348
349
def bump_timeout(self):
350
"""Bump up the timeout for this client.
351
This should only be called when the client has been seen,
352
alive and well.
353
"""
354
self.last_checked_ok = datetime.datetime.utcnow()
355
gobject.source_remove(self.disable_initiator_tag)
356
self.disable_initiator_tag = (gobject.timeout_add
357
(self.timeout_milliseconds(),
358
self.disable))
359
if self.use_dbus:
360
# Emit D-Bus signal
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
364
variant_level=1)))
365
305
366
def start_checker(self):
306
367
"""Start a new checker subprocess if one is not running.
307
368
If a checker already exists, leave it running and do
316
377
# is as it should be.
317
378
if self.checker is None:
318
379
try:
319
# In case check_command has exactly one % operator
320
command = self.check_command % self.host
380
# In case checker_command has exactly one % operator
381
command = self.checker_command % self.host
321
382
except TypeError:
322
383
# Escape attributes for the shell
323
384
escaped_attrs = dict((key, re.escape(str(val)))
324
385
for key, val in
325
386
vars(self).iteritems())
326
387
try:
327
command = self.check_command % escaped_attrs
388
command = self.checker_command % escaped_attrs
328
389
except TypeError, error:
329
390
logger.error(u'Could not format string "%s":'
330
u' %s', self.check_command, error)
391
u' %s', self.checker_command, error)
331
392
return True # Try again later
332
393
try:
333
394
logger.info(u"Starting checker %r for %s",
334
395
command, self.name)
396
# We don't need to redirect stdout and stderr, since
397
# in normal mode, that is already done by daemon(),
398
# and in debug mode we don't want to. (Stdin is
399
# always replaced by /dev/null.)
335
400
self.checker = subprocess.Popen(command,
336
401
close_fds=True,
337
402
shell=True, cwd="/")
338
self.checker_callback_tag = gobject.child_watch_add\
339
(self.checker.pid,
340
self.checker_callback)
341
except subprocess.OSError, error:
403
if self.use_dbus:
404
# Emit D-Bus signal
405
self.CheckerStarted(command)
406
self.PropertyChanged(
407
dbus.String("checker_running"),
408
dbus.Boolean(True, variant_level=1))
409
self.checker_callback_tag = (gobject.child_watch_add
410
(self.checker.pid,
411
self.checker_callback,
412
data=command))
413
except OSError, error:
342
414
logger.error(u"Failed to start subprocess: %s",
343
415
error)
344
416
# Re-run this periodically if run by gobject.timeout_add
345
417
return True
418
346
419
def stop_checker(self):
347
420
"""Force the checker process, if any, to stop."""
348
421
if self.checker_callback_tag:
360
433
if error.errno != errno.ESRCH: # No such process
361
434
raise
362
435
self.checker = None
436
if self.use_dbus:
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
439
363
440
def still_valid(self):
364
441
"""Has the timeout not yet passed for this client?"""
365
now = datetime.datetime.now()
442
if not getattr(self, "enabled", False):
443
return False
444
now = datetime.datetime.utcnow()
366
445
if self.last_checked_ok is None:
367
446
return now < (self.created + self.timeout)
368
447
else:
369
448
return now < (self.last_checked_ok + self.timeout)
449
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
452
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
456
457
# CheckerCompleted - signal
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
460
"D-Bus signal"
461
pass
462
463
# CheckerStarted - signal
464
@dbus.service.signal(_interface, signature="s")
465
def CheckerStarted(self, command):
466
"D-Bus signal"
467
pass
468
469
# GetAllProperties - method
470
@dbus.service.method(_interface, out_signature="a{sv}")
471
def GetAllProperties(self):
472
"D-Bus method"
473
return dbus.Dictionary({
474
dbus.String("name"):
475
dbus.String(self.name, variant_level=1),
476
dbus.String("fingerprint"):
477
dbus.String(self.fingerprint, variant_level=1),
478
dbus.String("host"):
479
dbus.String(self.host, variant_level=1),
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
484
variant_level=1)
485
if self.last_enabled is not None
486
else dbus.Boolean(False, variant_level=1)),
487
dbus.String("enabled"):
488
dbus.Boolean(self.enabled, variant_level=1),
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
491
variant_level=1)
492
if self.last_checked_ok is not None
493
else dbus.Boolean (False, variant_level=1)),
494
dbus.String("timeout"):
495
dbus.UInt64(self.timeout_milliseconds(),
496
variant_level=1),
497
dbus.String("interval"):
498
dbus.UInt64(self.interval_milliseconds(),
499
variant_level=1),
500
dbus.String("checker"):
501
dbus.String(self.checker_command,
502
variant_level=1),
503
dbus.String("checker_running"):
504
dbus.Boolean(self.checker is not None,
505
variant_level=1),
506
}, signature="sv")
507
508
# IsStillValid - method
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
510
(still_valid))
511
IsStillValid.__name__ = "IsStillValid"
512
513
# PropertyChanged - signal
514
@dbus.service.signal(_interface, signature="sv")
515
def PropertyChanged(self, property, value):
516
"D-Bus signal"
517
pass
518
519
# SetChecker - method
520
@dbus.service.method(_interface, in_signature="s")
521
def SetChecker(self, checker):
522
"D-Bus setter method"
523
self.checker_command = checker
524
# Emit D-Bus signal
525
self.PropertyChanged(dbus.String(u"checker"),
526
dbus.String(self.checker_command,
527
variant_level=1))
528
529
# SetHost - method
530
@dbus.service.method(_interface, in_signature="s")
531
def SetHost(self, host):
532
"D-Bus setter method"
533
self.host = host
534
# Emit D-Bus signal
535
self.PropertyChanged(dbus.String(u"host"),
536
dbus.String(self.host, variant_level=1))
537
538
# SetInterval - method
539
@dbus.service.method(_interface, in_signature="t")
540
def SetInterval(self, milliseconds):
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
542
# Emit D-Bus signal
543
self.PropertyChanged(dbus.String(u"interval"),
544
(dbus.UInt64(self.interval_milliseconds(),
545
variant_level=1)))
546
547
# SetSecret - method
548
@dbus.service.method(_interface, in_signature="ay",
549
byte_arrays=True)
550
def SetSecret(self, secret):
551
"D-Bus setter method"
552
self.secret = str(secret)
553
554
# SetTimeout - method
555
@dbus.service.method(_interface, in_signature="t")
556
def SetTimeout(self, milliseconds):
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
558
# Emit D-Bus signal
559
self.PropertyChanged(dbus.String(u"timeout"),
560
(dbus.UInt64(self.timeout_milliseconds(),
561
variant_level=1)))
562
563
# Enable - method
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
566
567
# StartChecker - method
568
@dbus.service.method(_interface)
569
def StartChecker(self):
570
"D-Bus method"
571
self.start_checker()
572
573
# Disable - method
574
@dbus.service.method(_interface)
575
def Disable(self):
576
"D-Bus method"
577
self.disable()
578
579
# StopChecker - method
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
582
583
del _interface
370
584
371
585
372
586
def peer_certificate(session):
373
587
"Return the peer's OpenPGP certificate as a bytestring"
374
588
# If not an OpenPGP certificate...
375
if gnutls.library.functions.gnutls_certificate_type_get\
376
(session._c_object) \
377
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
378
592
# ...do the normal thing
379
593
return session.peer_certificate
380
594
list_size = ctypes.c_uint()
381
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
382
(session._c_object, ctypes.byref(list_size))
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
383
598
if list_size.value == 0:
384
599
return None
385
600
cert = cert_list[0]
389
604
def fingerprint(openpgp):
390
605
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
391
606
# New GnuTLS "datum" with the OpenPGP public key
392
datum = gnutls.library.types.gnutls_datum_t\
393
(ctypes.cast(ctypes.c_char_p(openpgp),
394
ctypes.POINTER(ctypes.c_ubyte)),
395
ctypes.c_uint(len(openpgp)))
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
609
ctypes.POINTER
610
(ctypes.c_ubyte)),
611
ctypes.c_uint(len(openpgp))))
396
612
# New empty GnuTLS certificate
397
613
crt = gnutls.library.types.gnutls_openpgp_crt_t()
398
gnutls.library.functions.gnutls_openpgp_crt_init\
399
(ctypes.byref(crt))
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
400
616
# Import the OpenPGP public key into the certificate
401
gnutls.library.functions.gnutls_openpgp_crt_import\
402
(crt, ctypes.byref(datum),
403
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
621
# Verify the self signature in the key
622
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
625
if crtverify.value != 0:
626
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
raise gnutls.errors.CertificateSecurityError("Verify failed")
404
628
# New buffer for the fingerprint
405
buffer = ctypes.create_string_buffer(20)
406
buffer_length = ctypes.c_size_t()
629
buf = ctypes.create_string_buffer(20)
630
buf_len = ctypes.c_size_t()
407
631
# Get the fingerprint from the certificate into the buffer
408
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
409
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
410
635
# Deinit the certificate
411
636
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
412
637
# Convert the buffer to a Python bytestring
413
fpr = ctypes.string_at(buffer, buffer_length.value)
638
fpr = ctypes.string_at(buf, buf_len.value)
414
639
# Convert the bytestring to hexadecimal notation
415
640
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
416
641
return hex_fpr
417
642
418
643
419
class tcp_handler(SocketServer.BaseRequestHandler, object):
644
class TCP_handler(SocketServer.BaseRequestHandler, object):
420
645
"""A TCP request handler class.
421
646
Instantiated by IPv6_TCPServer for each request to handle it.
422
647
Note: This will run in its own forked process."""
423
648
424
649
def handle(self):
425
650
logger.info(u"TCP connection from: %s",
426
unicode(self.client_address))
427
session = gnutls.connection.ClientSession\
428
(self.request, gnutls.connection.X509Credentials())
651
unicode(self.client_address))
652
session = (gnutls.connection
653
.ClientSession(self.request,
654
gnutls.connection
655
.X509Credentials()))
429
656
430
657
line = self.request.makefile().readline()
431
658
logger.debug(u"Protocol version: %r", line)
444
671
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
445
672
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
446
673
# "+DHE-DSS"))
447
priority = "NORMAL" # Fallback default, since this
448
# MUST be set.
449
if self.server.settings["priority"]:
450
priority = self.server.settings["priority"]
451
gnutls.library.functions.gnutls_priority_set_direct\
452
(session._c_object, priority, None);
674
# Use a fallback default, since this MUST be set.
675
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
678
priority, None))
453
679
454
680
try:
455
681
session.handshake()
465
691
session.bye()
466
692
return
467
693
logger.debug(u"Fingerprint: %s", fpr)
468
client = None
469
694
for c in self.server.clients:
470
695
if c.fingerprint == fpr:
471
696
client = c
472
697
break
473
if not client:
698
else:
474
699
logger.warning(u"Client not found for fingerprint: %s",
475
700
fpr)
476
701
session.bye()
483
708
vars(client))
484
709
session.bye()
485
710
return
711
## This won't work here, since we're in a fork.
712
# client.bump_timeout()
486
713
sent_size = 0
487
714
while sent_size < len(client.secret):
488
715
sent = session.send(client.secret[sent_size:])
493
720
session.bye()
494
721
495
722
496
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
724
SocketServer.TCPServer, object):
497
725
"""IPv6 TCP server. Accepts 'None' as address and/or port.
498
726
Attributes:
499
727
settings: Server settings
500
728
clients: Set() of Client objects
729
enabled: Boolean; whether this server is activated yet
501
730
"""
502
731
address_family = socket.AF_INET6
503
732
def __init__(self, *args, **kwargs):
507
736
if "clients" in kwargs:
508
737
self.clients = kwargs["clients"]
509
738
del kwargs["clients"]
510
return super(type(self), self).__init__(*args, **kwargs)
739
self.enabled = False
740
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
511
741
def server_bind(self):
512
742
"""This overrides the normal server_bind() function
513
743
to bind to an interface if one was specified, and also NOT to
542
772
# if_nametoindex
543
773
# (self.settings
544
774
# ["interface"]))
545
return super(type(self), self).server_bind()
775
return super(IPv6_TCPServer, self).server_bind()
776
def server_activate(self):
777
if self.enabled:
778
return super(IPv6_TCPServer, self).server_activate()
779
def enable(self):
780
self.enabled = True
546
781
547
782
548
783
def string_to_delta(interval):
558
793
datetime.timedelta(1)
559
794
>>> string_to_delta(u'1w')
560
795
datetime.timedelta(7)
796
>>> string_to_delta('5m 30s')
797
datetime.timedelta(0, 330)
561
798
"""
562
try:
563
suffix=unicode(interval[-1])
564
value=int(interval[:-1])
565
if suffix == u"d":
566
delta = datetime.timedelta(value)
567
elif suffix == u"s":
568
delta = datetime.timedelta(0, value)
569
elif suffix == u"m":
570
delta = datetime.timedelta(0, 0, 0, 0, value)
571
elif suffix == u"h":
572
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
573
elif suffix == u"w":
574
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
575
else:
799
timevalue = datetime.timedelta(0)
800
for s in interval.split():
801
try:
802
suffix = unicode(s[-1])
803
value = int(s[:-1])
804
if suffix == u"d":
805
delta = datetime.timedelta(value)
806
elif suffix == u"s":
807
delta = datetime.timedelta(0, value)
808
elif suffix == u"m":
809
delta = datetime.timedelta(0, 0, 0, 0, value)
810
elif suffix == u"h":
811
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
812
elif suffix == u"w":
813
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
814
else:
815
raise ValueError
816
except (ValueError, IndexError):
576
817
raise ValueError
577
except (ValueError, IndexError):
578
raise ValueError
579
return delta
818
timevalue += delta
819
return timevalue
580
820
581
821
582
822
def server_state_changed(state):
583
823
"""Derived from the Avahi example code"""
584
824
if state == avahi.SERVER_COLLISION:
585
logger.error(u"Server name collision")
825
logger.error(u"Zeroconf server name collision")
586
826
service.remove()
587
827
elif state == avahi.SERVER_RUNNING:
588
828
service.add()
590
830
591
831
def entry_group_state_changed(state, error):
592
832
"""Derived from the Avahi example code"""
593
logger.debug(u"state change: %i", state)
833
logger.debug(u"Avahi state change: %i", state)
594
834
595
835
if state == avahi.ENTRY_GROUP_ESTABLISHED:
596
logger.debug(u"Service established.")
836
logger.debug(u"Zeroconf service established.")
597
837
elif state == avahi.ENTRY_GROUP_COLLISION:
598
logger.warning(u"Service name collision.")
838
logger.warning(u"Zeroconf service name collision.")
599
839
service.rename()
600
840
elif state == avahi.ENTRY_GROUP_FAILURE:
601
logger.critical(u"Error in group state changed %s",
841
logger.critical(u"Avahi: Error in group state changed %s",
602
842
unicode(error))
603
raise AvahiGroupError("State changed: %s", str(error))
843
raise AvahiGroupError(u"State changed: %s" % unicode(error))
604
844
605
845
def if_nametoindex(interface):
606
846
"""Call the C function if_nametoindex(), or equivalent"""
607
847
global if_nametoindex
608
848
try:
609
if "ctypes.util" not in sys.modules:
610
import ctypes.util
611
if_nametoindex = ctypes.cdll.LoadLibrary\
612
(ctypes.util.find_library("c")).if_nametoindex
849
if_nametoindex = (ctypes.cdll.LoadLibrary
850
(ctypes.util.find_library("c"))
851
.if_nametoindex)
613
852
except (OSError, AttributeError):
614
853
if "struct" not in sys.modules:
615
854
import struct
618
857
def if_nametoindex(interface):
619
858
"Get an interface index the hard way, i.e. using fcntl()"
620
859
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
621
s = socket.socket()
622
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
623
struct.pack("16s16x", interface))
624
s.close()
860
with closing(socket.socket()) as s:
861
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
862
struct.pack("16s16x", interface))
625
863
interface_index = struct.unpack("I", ifreq[16:20])[0]
626
864
return interface_index
627
865
return if_nametoindex(interface)
651
889
652
890
653
891
def main():
654
global main_loop_started
655
main_loop_started = False
656
657
parser = OptionParser(version = "Mandos server %s" % version)
892
parser = optparse.OptionParser(version = "%%prog %s" % version)
658
893
parser.add_option("-i", "--interface", type="string",
659
894
metavar="IF", help="Bind to interface IF")
660
895
parser.add_option("-a", "--address", type="string",
661
896
help="Address to listen for requests on")
662
897
parser.add_option("-p", "--port", type="int",
663
898
help="Port number to receive requests on")
664
parser.add_option("--check", action="store_true", default=False,
899
parser.add_option("--check", action="store_true",
665
900
help="Run self-test")
666
901
parser.add_option("--debug", action="store_true",
667
902
help="Debug mode; run in foreground and log to"
674
909
default="/etc/mandos", metavar="DIR",
675
910
help="Directory to search for configuration"
676
911
" files")
677
(options, args) = parser.parse_args()
912
parser.add_option("--no-dbus", action="store_false",
913
dest="use_dbus",
914
help=optparse.SUPPRESS_HELP)
915
options = parser.parse_args()[0]
678
916
679
917
if options.check:
680
918
import doctest
689
927
"priority":
690
928
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
691
929
"servicename": "Mandos",
930
"use_dbus": "True",
692
931
}
693
932
694
933
# Parse config file for server-global settings
695
934
server_config = ConfigParser.SafeConfigParser(server_defaults)
696
935
del server_defaults
697
936
server_config.read(os.path.join(options.configdir, "mandos.conf"))
698
server_section = "server"
699
937
# Convert the SafeConfigParser object to a dict
700
server_settings = dict(server_config.items(server_section))
701
# Use getboolean on the boolean config option
702
server_settings["debug"] = server_config.getboolean\
703
(server_section, "debug")
938
server_settings = server_config.defaults()
939
# Use getboolean on the boolean config options
940
server_settings["debug"] = (server_config.getboolean
941
("DEFAULT", "debug"))
942
server_settings["use_dbus"] = (server_config.getboolean
943
("DEFAULT", "use_dbus"))
704
944
del server_config
705
945
706
946
# Override the settings from the config file with command line
707
947
# options, if set.
708
948
for option in ("interface", "address", "port", "debug",
709
"priority", "servicename", "configdir"):
949
"priority", "servicename", "configdir",
950
"use_dbus"):
710
951
value = getattr(options, option)
711
952
if value is not None:
712
953
server_settings[option] = value
713
954
del options
714
955
# Now we have our good server settings in "server_settings"
715
956
957
# For convenience
716
958
debug = server_settings["debug"]
959
use_dbus = server_settings["use_dbus"]
960
use_dbus = False
717
961
718
962
if not debug:
719
963
syslogger.setLevel(logging.WARNING)
964
console.setLevel(logging.WARNING)
720
965
721
966
if server_settings["servicename"] != "Mandos":
722
syslogger.setFormatter(logging.Formatter\
967
syslogger.setFormatter(logging.Formatter
723
968
('Mandos (%s): %%(levelname)s:'
724
969
' %%(message)s'
725
970
% server_settings["servicename"]))
727
972
# Parse config file with clients
728
973
client_defaults = { "timeout": "1h",
729
974
"interval": "5m",
730
"checker": "fping -q -- %%(host)s",
975
"checker": "fping -q -- %(host)s",
976
"host": "",
731
977
}
732
978
client_config = ConfigParser.SafeConfigParser(client_defaults)
733
979
client_config.read(os.path.join(server_settings["configdir"],
734
980
"clients.conf"))
735
981
982
clients = Set()
983
tcp_server = IPv6_TCPServer((server_settings["address"],
984
server_settings["port"]),
985
TCP_handler,
986
settings=server_settings,
987
clients=clients)
988
pidfilename = "/var/run/mandos.pid"
989
try:
990
pidfile = open(pidfilename, "w")
991
except IOError, error:
992
logger.error("Could not open file %r", pidfilename)
993
994
try:
995
uid = pwd.getpwnam("_mandos").pw_uid
996
except KeyError:
997
try:
998
uid = pwd.getpwnam("mandos").pw_uid
999
except KeyError:
1000
try:
1001
uid = pwd.getpwnam("nobody").pw_uid
1002
except KeyError:
1003
uid = 65534
1004
try:
1005
gid = pwd.getpwnam("_mandos").pw_gid
1006
except KeyError:
1007
try:
1008
gid = pwd.getpwnam("mandos").pw_gid
1009
except KeyError:
1010
try:
1011
gid = pwd.getpwnam("nogroup").pw_gid
1012
except KeyError:
1013
gid = 65534
1014
try:
1015
os.setuid(uid)
1016
os.setgid(gid)
1017
except OSError, error:
1018
if error[0] != errno.EPERM:
1019
raise error
1020
736
1021
global service
737
1022
service = AvahiService(name = server_settings["servicename"],
738
type = "_mandos._tcp", );
1023
servicetype = "_mandos._tcp", )
739
1024
if server_settings["interface"]:
740
service.interface = if_nametoindex(server_settings["interface"])
1025
service.interface = (if_nametoindex
1026
(server_settings["interface"]))
741
1027
742
1028
global main_loop
743
1029
global bus
746
1032
DBusGMainLoop(set_as_default=True )
747
1033
main_loop = gobject.MainLoop()
748
1034
bus = dbus.SystemBus()
749
server = dbus.Interface(
750
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
751
avahi.DBUS_INTERFACE_SERVER )
1035
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1036
avahi.DBUS_PATH_SERVER),
1037
avahi.DBUS_INTERFACE_SERVER)
752
1038
# End of Avahi example code
753
754
if debug:
755
console = logging.StreamHandler()
756
# console.setLevel(logging.DEBUG)
757
console.setFormatter(logging.Formatter\
758
('%(levelname)s: %(message)s'))
759
logger.addHandler(console)
760
del console
761
762
clients = Set()
763
def remove_from_clients(client):
764
clients.remove(client)
765
if not clients:
766
logger.critical(u"No clients left, exiting")
767
sys.exit()
1039
if use_dbus:
1040
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1041
bus)
768
1042
769
1043
clients.update(Set(Client(name = section,
770
stop_hook = remove_from_clients,
771
1044
config
772
= dict(client_config.items(section)))
1045
= dict(client_config.items(section)),
1046
use_dbus = use_dbus)
773
1047
for section in client_config.sections()))
774
1048
if not clients:
775
logger.critical(u"No clients defined")
776
sys.exit(1)
1049
logger.warning(u"No clients defined")
777
1050
778
if not debug:
1051
if debug:
1052
# Redirect stdin so all checkers get /dev/null
1053
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1054
os.dup2(null, sys.stdin.fileno())
1055
if null > 2:
1056
os.close(null)
1057
else:
1058
# No console logging
1059
logger.removeHandler(console)
1060
# Close all input and output, do double fork, etc.
779
1061
daemon()
780
1062
781
pidfilename = "/var/run/mandos/mandos.pid"
782
pid = os.getpid()
783
1063
try:
784
pidfile = open(pidfilename, "w")
1064
pid = os.getpid()
785
1065
pidfile.write(str(pid) + "\n")
786
1066
pidfile.close()
787
1067
del pidfile
788
except IOError, err:
789
logger.error(u"Could not write %s file with PID %d",
790
pidfilename, os.getpid())
1068
except IOError:
1069
logger.error(u"Could not write to file %r with PID %d",
1070
pidfilename, pid)
1071
except NameError:
1072
# "pidfile" was never created
1073
pass
1074
del pidfilename
791
1075
792
1076
def cleanup():
793
1077
"Cleanup function; run on exit"
800
1084
801
1085
while clients:
802
1086
client = clients.pop()
803
client.stop_hook = None
804
client.stop()
1087
client.disable_hook = None
1088
client.disable()
805
1089
806
1090
atexit.register(cleanup)
807
1091
810
1094
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
811
1095
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
812
1096
1097
if use_dbus:
1098
class MandosServer(dbus.service.Object):
1099
"""A D-Bus proxy object"""
1100
def __init__(self):
1101
dbus.service.Object.__init__(self, bus,
1102
"/Mandos")
1103
_interface = u"org.mandos_system.Mandos"
1104
1105
@dbus.service.signal(_interface, signature="oa{sv}")
1106
def ClientAdded(self, objpath, properties):
1107
"D-Bus signal"
1108
pass
1109
1110
@dbus.service.signal(_interface, signature="o")
1111
def ClientRemoved(self, objpath):
1112
"D-Bus signal"
1113
pass
1114
1115
@dbus.service.method(_interface, out_signature="ao")
1116
def GetAllClients(self):
1117
return dbus.Array(c.dbus_object_path for c in clients)
1118
1119
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1120
def GetAllClientsWithProperties(self):
1121
return dbus.Dictionary(
1122
((c.dbus_object_path, c.GetAllProperties())
1123
for c in clients),
1124
signature="oa{sv}")
1125
1126
@dbus.service.method(_interface, in_signature="o")
1127
def RemoveClient(self, object_path):
1128
for c in clients:
1129
if c.dbus_object_path == object_path:
1130
clients.remove(c)
1131
# Don't signal anything except ClientRemoved
1132
c.use_dbus = False
1133
c.disable()
1134
# Emit D-Bus signal
1135
self.ClientRemoved(object_path)
1136
return
1137
raise KeyError
1138
@dbus.service.method(_interface)
1139
def Quit(self):
1140
main_loop.quit()
1141
1142
del _interface
1143
1144
mandos_server = MandosServer()
1145
813
1146
for client in clients:
814
client.start()
815
816
tcp_server = IPv6_TCPServer((server_settings["address"],
817
server_settings["port"]),
818
tcp_handler,
819
settings=server_settings,
820
clients=clients)
1147
if use_dbus:
1148
# Emit D-Bus signal
1149
mandos_server.ClientAdded(client.dbus_object_path,
1150
client.GetAllProperties())
1151
client.enable()
1152
1153
tcp_server.enable()
1154
tcp_server.server_activate()
1155
821
1156
# Find out what port we got
822
1157
service.port = tcp_server.socket.getsockname()[1]
823
1158
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
837
1172
838
1173
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
839
1174
lambda *args, **kwargs:
840
tcp_server.handle_request\
841
(*args[2:], **kwargs) or True)
1175
(tcp_server.handle_request
1176
(*args[2:], **kwargs) or True))
842
1177
843
1178
logger.debug(u"Starting main loop")
844
main_loop_started = True
845
1179
main_loop.run()
846
1180
except AvahiError, error:
847
logger.critical(u"AvahiError: %s" + unicode(error))
1181
logger.critical(u"AvahiError: %s", error)
848
1182
sys.exit(1)
849
1183
except KeyboardInterrupt:
850
1184
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0