To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 46
- compare with another revision
- download diff
- download tarball
- view history from revision 46
- Committer: Teddy Hogeborn
- Date: 2008-08-04 23:38:26 UTC
- mfrom: (24.1.20 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080804233826-idy7v8x36llseue0
* network-protocol.txt: New.
* server.py (daemon): Do the double fork thing.
* server.py (daemon): Do the double fork thing.
- files added:
- network-protocol.txt
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos.conf => server.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
server.py
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008 Teddy Hogeborn
15
# Copyright © 2008 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
# GNU General Public License for more details.
26
25
#
27
26
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
30
28
#
31
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
30
#
33
31
34
from __future__ import division, with_statement, absolute_import
32
from __future__ import division
35
33
36
34
import SocketServer
37
35
import socket
36
import select
38
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
import pwd
59
from contextlib import closing
60
57
61
58
import dbus
62
import dbus.service
63
59
import gobject
64
60
import avahi
65
61
from dbus.mainloop.glib import DBusGMainLoop
66
62
import ctypes
67
import ctypes.util
68
63
69
version = "1.0.2"
70
64
71
65
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
66
syslogger = logging.handlers.SysLogHandler\
67
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
68
syslogger.setFormatter(logging.Formatter\
69
('%(levelname)s: %(message)s'))
77
70
logger.addHandler(syslogger)
71
del syslogger
78
72
79
console = logging.StreamHandler()
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
82
logger.addHandler(console)
83
73
84
74
class AvahiError(Exception):
85
def __init__(self, value, *args, **kwargs):
75
def __init__(self, value):
86
76
self.value = value
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
77
def __str__(self):
78
return repr(self.value)
90
79
91
80
class AvahiServiceError(AvahiError):
92
81
pass
112
101
a sensible number of times
113
102
"""
114
103
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
104
type = None, port = None, TXT = None, domain = "",
105
host = "", max_renames = 12):
117
106
self.interface = interface
118
107
self.name = name
119
self.type = servicetype
108
self.type = type
120
109
self.port = port
121
self.TXT = TXT if TXT is not None else []
110
if TXT is None:
111
self.TXT = []
112
else:
113
self.TXT = TXT
122
114
self.domain = domain
123
115
self.host = host
124
116
self.rename_count = 0
125
self.max_renames = max_renames
126
117
def rename(self):
127
118
"""Derived from the Avahi example code"""
128
119
if self.rename_count >= self.max_renames:
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
120
logger.critical(u"No suitable service name found after %i"
121
u" retries, exiting.", rename_count)
122
raise AvahiServiceError("Too many renames")
123
name = server.GetAlternativeServiceName(name)
124
logger.error(u"Changing name to %r ...", name)
139
125
self.remove()
140
126
self.add()
141
127
self.rename_count += 1
147
133
"""Derived from the Avahi example code"""
148
134
global group
149
135
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
136
group = dbus.Interface\
137
(bus.get_object(avahi.DBUS_NAME,
152
138
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
139
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
140
group.connect_to_signal('StateChanged',
155
141
entry_group_state_changed)
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
142
logger.debug(u"Adding service '%s' of type '%s' ...",
157
143
service.name, service.type)
158
144
group.AddService(
159
145
self.interface, # interface
170
156
# End of Avahi example code
171
157
172
158
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
159
class Client(object):
179
160
"""A representation of a client host served by this server.
180
161
Attributes:
181
name: string; from the config file, used in log messages
162
name: string; from the config file, used in log messages
182
163
fingerprint: string (40 or 32 hexadecimal digits); used to
183
164
uniquely identify the client
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
165
secret: bytestring; sent verbatim (over TLS) to client
166
fqdn: string (FQDN); available for use by the checker command
167
created: datetime.datetime(); object creation, not client host
168
last_checked_ok: datetime.datetime() or None if not yet checked OK
169
timeout: datetime.timedelta(); How long from last_checked_ok
170
until this client is invalid
171
interval: datetime.timedelta(); How often to start a new checker
172
stop_hook: If set, called by stop() as stop_hook(self)
173
checker: subprocess.Popen(); a running checker process used
174
to see if the client lives.
175
'None' if no process is running.
197
176
checker_initiator_tag: a gobject event source tag, or None
198
disable_initiator_tag: - '' -
177
stop_initiator_tag: - '' -
199
178
checker_callback_tag: - '' -
200
179
checker_command: string; External command which is run to check if
201
180
client lives. %() expansions are done at
202
181
runtime with vars(self) as dict, so that for
203
182
instance %(name)s can be used in the command.
204
dbus_object_path: dbus.ObjectPath
205
183
Private attibutes:
206
184
_timeout: Real variable for 'timeout'
207
185
_interval: Real variable for 'interval'
209
187
_interval_milliseconds: - '' -
210
188
"""
211
189
def _set_timeout(self, timeout):
212
"Setter function for the 'timeout' attribute"
190
"Setter function for 'timeout' attribute"
213
191
self._timeout = timeout
214
192
self._timeout_milliseconds = ((self.timeout.days
215
193
* 24 * 60 * 60 * 1000)
216
194
+ (self.timeout.seconds * 1000)
217
195
+ (self.timeout.microseconds
218
196
// 1000))
219
# Emit D-Bus signal
220
self.PropertyChanged(dbus.String(u"timeout"),
221
(dbus.UInt64(self._timeout_milliseconds,
222
variant_level=1)))
223
timeout = property(lambda self: self._timeout, _set_timeout)
197
timeout = property(lambda self: self._timeout,
198
_set_timeout)
224
199
del _set_timeout
225
226
200
def _set_interval(self, interval):
227
"Setter function for the 'interval' attribute"
201
"Setter function for 'interval' attribute"
228
202
self._interval = interval
229
203
self._interval_milliseconds = ((self.interval.days
230
204
* 24 * 60 * 60 * 1000)
232
206
* 1000)
233
207
+ (self.interval.microseconds
234
208
// 1000))
235
# Emit D-Bus signal
236
self.PropertyChanged(dbus.String(u"interval"),
237
(dbus.UInt64(self._interval_milliseconds,
238
variant_level=1)))
239
interval = property(lambda self: self._interval, _set_interval)
209
interval = property(lambda self: self._interval,
210
_set_interval)
240
211
del _set_interval
241
242
def __init__(self, name = None, disable_hook=None, config=None):
212
def __init__(self, name = None, stop_hook=None, config={}):
243
213
"""Note: the 'checker' key in 'config' sets the
244
214
'checker_command' attribute and *not* the 'checker'
245
215
attribute."""
246
self.dbus_object_path = (dbus.ObjectPath
247
("/Mandos/clients/"
248
+ name.replace(".", "_")))
249
dbus.service.Object.__init__(self, bus,
250
self.dbus_object_path)
251
if config is None:
252
config = {}
253
216
self.name = name
254
217
logger.debug(u"Creating client %r", self.name)
255
218
# Uppercase and remove spaces from fingerprint for later
256
219
# comparison purposes with return value from the fingerprint()
257
220
# function
258
self.fingerprint = (config["fingerprint"].upper()
259
.replace(u" ", u""))
221
self.fingerprint = config["fingerprint"].upper()\
222
.replace(u" ", u"")
260
223
logger.debug(u" Fingerprint: %s", self.fingerprint)
261
224
if "secret" in config:
262
225
self.secret = config["secret"].decode(u"base64")
263
226
elif "secfile" in config:
264
with closing(open(os.path.expanduser
265
(os.path.expandvars
266
(config["secfile"])))) as secfile:
267
self.secret = secfile.read()
227
sf = open(config["secfile"])
228
self.secret = sf.read()
229
sf.close()
268
230
else:
269
231
raise TypeError(u"No secret or secfile for client %s"
270
232
% self.name)
271
self.host = config.get("host", "")
272
self.created = datetime.datetime.utcnow()
273
self.enabled = False
274
self.last_enabled = None
233
self.fqdn = config.get("fqdn", "")
234
self.created = datetime.datetime.now()
275
235
self.last_checked_ok = None
276
236
self.timeout = string_to_delta(config["timeout"])
277
237
self.interval = string_to_delta(config["interval"])
278
self.disable_hook = disable_hook
238
self.stop_hook = stop_hook
279
239
self.checker = None
280
240
self.checker_initiator_tag = None
281
self.disable_initiator_tag = None
241
self.stop_initiator_tag = None
282
242
self.checker_callback_tag = None
283
self.checker_command = config["checker"]
284
285
def enable(self):
243
self.check_command = config["checker"]
244
def start(self):
286
245
"""Start this client's checker and timeout hooks"""
287
self.last_enabled = datetime.datetime.utcnow()
288
246
# Schedule a new checker to be started an 'interval' from now,
289
247
# and every interval from then on.
290
self.checker_initiator_tag = (gobject.timeout_add
291
(self._interval_milliseconds,
292
self.start_checker))
248
self.checker_initiator_tag = gobject.timeout_add\
249
(self._interval_milliseconds,
250
self.start_checker)
293
251
# Also start a new checker *right now*.
294
252
self.start_checker()
295
# Schedule a disable() when 'timeout' has passed
296
self.disable_initiator_tag = (gobject.timeout_add
297
(self._timeout_milliseconds,
298
self.disable))
299
self.enabled = True
300
# Emit D-Bus signal
301
self.PropertyChanged(dbus.String(u"enabled"),
302
dbus.Boolean(True, variant_level=1))
303
self.PropertyChanged(dbus.String(u"last_enabled"),
304
(_datetime_to_dbus(self.last_enabled,
305
variant_level=1)))
306
307
def disable(self):
308
"""Disable this client."""
309
if not getattr(self, "enabled", False):
253
# Schedule a stop() when 'timeout' has passed
254
self.stop_initiator_tag = gobject.timeout_add\
255
(self._timeout_milliseconds,
256
self.stop)
257
def stop(self):
258
"""Stop this client.
259
The possibility that a client might be restarted is left open,
260
but not currently used."""
261
# If this client doesn't have a secret, it is already stopped.
262
if self.secret:
263
logger.info(u"Stopping client %s", self.name)
264
self.secret = None
265
else:
310
266
return False
311
logger.info(u"Disabling client %s", self.name)
312
if getattr(self, "disable_initiator_tag", False):
313
gobject.source_remove(self.disable_initiator_tag)
314
self.disable_initiator_tag = None
267
if getattr(self, "stop_initiator_tag", False):
268
gobject.source_remove(self.stop_initiator_tag)
269
self.stop_initiator_tag = None
315
270
if getattr(self, "checker_initiator_tag", False):
316
271
gobject.source_remove(self.checker_initiator_tag)
317
272
self.checker_initiator_tag = None
318
273
self.stop_checker()
319
if self.disable_hook:
320
self.disable_hook(self)
321
self.enabled = False
322
# Emit D-Bus signal
323
self.PropertyChanged(dbus.String(u"enabled"),
324
dbus.Boolean(False, variant_level=1))
274
if self.stop_hook:
275
self.stop_hook(self)
325
276
# Do not run this again if called by a gobject.timeout_add
326
277
return False
327
328
278
def __del__(self):
329
self.disable_hook = None
330
self.disable()
331
332
def checker_callback(self, pid, condition, command):
279
self.stop_hook = None
280
self.stop()
281
def checker_callback(self, pid, condition):
333
282
"""The checker has completed, so take appropriate actions."""
283
now = datetime.datetime.now()
334
284
self.checker_callback_tag = None
335
285
self.checker = None
336
# Emit D-Bus signal
337
self.PropertyChanged(dbus.String(u"checker_running"),
338
dbus.Boolean(False, variant_level=1))
339
if (os.WIFEXITED(condition)
340
and (os.WEXITSTATUS(condition) == 0)):
286
if os.WIFEXITED(condition) \
287
and (os.WEXITSTATUS(condition) == 0):
341
288
logger.info(u"Checker for %(name)s succeeded",
342
289
vars(self))
343
# Emit D-Bus signal
344
self.CheckerCompleted(dbus.Boolean(True),
345
dbus.UInt16(condition),
346
dbus.String(command))
347
self.bump_timeout()
290
self.last_checked_ok = now
291
gobject.source_remove(self.stop_initiator_tag)
292
self.stop_initiator_tag = gobject.timeout_add\
293
(self._timeout_milliseconds,
294
self.stop)
348
295
elif not os.WIFEXITED(condition):
349
296
logger.warning(u"Checker for %(name)s crashed?",
350
297
vars(self))
351
# Emit D-Bus signal
352
self.CheckerCompleted(dbus.Boolean(False),
353
dbus.UInt16(condition),
354
dbus.String(command))
355
298
else:
356
299
logger.info(u"Checker for %(name)s failed",
357
300
vars(self))
358
# Emit D-Bus signal
359
self.CheckerCompleted(dbus.Boolean(False),
360
dbus.UInt16(condition),
361
dbus.String(command))
362
363
def bump_timeout(self):
364
"""Bump up the timeout for this client.
365
This should only be called when the client has been seen,
366
alive and well.
367
"""
368
self.last_checked_ok = datetime.datetime.utcnow()
369
gobject.source_remove(self.disable_initiator_tag)
370
self.disable_initiator_tag = (gobject.timeout_add
371
(self._timeout_milliseconds,
372
self.disable))
373
self.PropertyChanged(dbus.String(u"last_checked_ok"),
374
(_datetime_to_dbus(self.last_checked_ok,
375
variant_level=1)))
376
377
301
def start_checker(self):
378
302
"""Start a new checker subprocess if one is not running.
379
303
If a checker already exists, leave it running and do
388
312
# is as it should be.
389
313
if self.checker is None:
390
314
try:
391
# In case checker_command has exactly one % operator
392
command = self.checker_command % self.host
315
# In case check_command has exactly one % operator
316
command = self.check_command % self.fqdn
393
317
except TypeError:
394
318
# Escape attributes for the shell
395
319
escaped_attrs = dict((key, re.escape(str(val)))
396
320
for key, val in
397
321
vars(self).iteritems())
398
322
try:
399
command = self.checker_command % escaped_attrs
323
command = self.check_command % escaped_attrs
400
324
except TypeError, error:
401
325
logger.error(u'Could not format string "%s":'
402
u' %s', self.checker_command, error)
326
u' %s', self.check_command, error)
403
327
return True # Try again later
404
328
try:
405
329
logger.info(u"Starting checker %r for %s",
406
330
command, self.name)
407
# We don't need to redirect stdout and stderr, since
408
# in normal mode, that is already done by daemon(),
409
# and in debug mode we don't want to. (Stdin is
410
# always replaced by /dev/null.)
411
331
self.checker = subprocess.Popen(command,
412
332
close_fds=True,
413
333
shell=True, cwd="/")
414
# Emit D-Bus signal
415
self.CheckerStarted(command)
416
self.PropertyChanged(dbus.String("checker_running"),
417
dbus.Boolean(True, variant_level=1))
418
self.checker_callback_tag = (gobject.child_watch_add
419
(self.checker.pid,
420
self.checker_callback,
421
data=command))
422
except OSError, error:
334
self.checker_callback_tag = gobject.child_watch_add\
335
(self.checker.pid,
336
self.checker_callback)
337
except subprocess.OSError, error:
423
338
logger.error(u"Failed to start subprocess: %s",
424
339
error)
425
340
# Re-run this periodically if run by gobject.timeout_add
426
341
return True
427
428
342
def stop_checker(self):
429
343
"""Force the checker process, if any, to stop."""
430
344
if self.checker_callback_tag:
432
346
self.checker_callback_tag = None
433
347
if getattr(self, "checker", None) is None:
434
348
return
435
logger.debug(u"Stopping checker for %(name)s", vars(self))
349
logger.debug("Stopping checker for %(name)s", vars(self))
436
350
try:
437
351
os.kill(self.checker.pid, signal.SIGTERM)
438
352
#os.sleep(0.5)
442
356
if error.errno != errno.ESRCH: # No such process
443
357
raise
444
358
self.checker = None
445
self.PropertyChanged(dbus.String(u"checker_running"),
446
dbus.Boolean(False, variant_level=1))
447
448
359
def still_valid(self):
449
360
"""Has the timeout not yet passed for this client?"""
450
if not getattr(self, "enabled", False):
451
return False
452
now = datetime.datetime.utcnow()
361
now = datetime.datetime.now()
453
362
if self.last_checked_ok is None:
454
363
return now < (self.created + self.timeout)
455
364
else:
456
365
return now < (self.last_checked_ok + self.timeout)
457
458
## D-Bus methods & signals
459
_interface = u"org.mandos_system.Mandos.Client"
460
461
# BumpTimeout - method
462
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
463
BumpTimeout.__name__ = "BumpTimeout"
464
465
# CheckerCompleted - signal
466
@dbus.service.signal(_interface, signature="bqs")
467
def CheckerCompleted(self, success, condition, command):
468
"D-Bus signal"
469
pass
470
471
# CheckerStarted - signal
472
@dbus.service.signal(_interface, signature="s")
473
def CheckerStarted(self, command):
474
"D-Bus signal"
475
pass
476
477
# GetAllProperties - method
478
@dbus.service.method(_interface, out_signature="a{sv}")
479
def GetAllProperties(self):
480
"D-Bus method"
481
return dbus.Dictionary({
482
dbus.String("name"):
483
dbus.String(self.name, variant_level=1),
484
dbus.String("fingerprint"):
485
dbus.String(self.fingerprint, variant_level=1),
486
dbus.String("host"):
487
dbus.String(self.host, variant_level=1),
488
dbus.String("created"):
489
_datetime_to_dbus(self.created, variant_level=1),
490
dbus.String("last_enabled"):
491
(_datetime_to_dbus(self.last_enabled,
492
variant_level=1)
493
if self.last_enabled is not None
494
else dbus.Boolean(False, variant_level=1)),
495
dbus.String("enabled"):
496
dbus.Boolean(self.enabled, variant_level=1),
497
dbus.String("last_checked_ok"):
498
(_datetime_to_dbus(self.last_checked_ok,
499
variant_level=1)
500
if self.last_checked_ok is not None
501
else dbus.Boolean (False, variant_level=1)),
502
dbus.String("timeout"):
503
dbus.UInt64(self._timeout_milliseconds,
504
variant_level=1),
505
dbus.String("interval"):
506
dbus.UInt64(self._interval_milliseconds,
507
variant_level=1),
508
dbus.String("checker"):
509
dbus.String(self.checker_command,
510
variant_level=1),
511
dbus.String("checker_running"):
512
dbus.Boolean(self.checker is not None,
513
variant_level=1),
514
}, signature="sv")
515
516
# IsStillValid - method
517
IsStillValid = (dbus.service.method(_interface, out_signature="b")
518
(still_valid))
519
IsStillValid.__name__ = "IsStillValid"
520
521
# PropertyChanged - signal
522
@dbus.service.signal(_interface, signature="sv")
523
def PropertyChanged(self, property, value):
524
"D-Bus signal"
525
pass
526
527
# SetChecker - method
528
@dbus.service.method(_interface, in_signature="s")
529
def SetChecker(self, checker):
530
"D-Bus setter method"
531
self.checker_command = checker
532
533
# SetHost - method
534
@dbus.service.method(_interface, in_signature="s")
535
def SetHost(self, host):
536
"D-Bus setter method"
537
self.host = host
538
539
# SetInterval - method
540
@dbus.service.method(_interface, in_signature="t")
541
def SetInterval(self, milliseconds):
542
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
543
544
# SetSecret - method
545
@dbus.service.method(_interface, in_signature="ay",
546
byte_arrays=True)
547
def SetSecret(self, secret):
548
"D-Bus setter method"
549
self.secret = str(secret)
550
551
# SetTimeout - method
552
@dbus.service.method(_interface, in_signature="t")
553
def SetTimeout(self, milliseconds):
554
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
555
556
# Enable - method
557
Enable = dbus.service.method(_interface)(enable)
558
Enable.__name__ = "Enable"
559
560
# StartChecker - method
561
@dbus.service.method(_interface)
562
def StartChecker(self):
563
"D-Bus method"
564
self.start_checker()
565
566
# Disable - method
567
@dbus.service.method(_interface)
568
def Disable(self):
569
"D-Bus method"
570
self.disable()
571
572
# StopChecker - method
573
StopChecker = dbus.service.method(_interface)(stop_checker)
574
StopChecker.__name__ = "StopChecker"
575
576
del _interface
577
366
578
367
579
368
def peer_certificate(session):
580
369
"Return the peer's OpenPGP certificate as a bytestring"
581
370
# If not an OpenPGP certificate...
582
if (gnutls.library.functions
583
.gnutls_certificate_type_get(session._c_object)
584
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
371
if gnutls.library.functions.gnutls_certificate_type_get\
372
(session._c_object) \
373
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
585
374
# ...do the normal thing
586
375
return session.peer_certificate
587
376
list_size = ctypes.c_uint()
588
cert_list = (gnutls.library.functions
589
.gnutls_certificate_get_peers
590
(session._c_object, ctypes.byref(list_size)))
377
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
378
(session._c_object, ctypes.byref(list_size))
591
379
if list_size.value == 0:
592
380
return None
593
381
cert = cert_list[0]
597
385
def fingerprint(openpgp):
598
386
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
599
387
# New GnuTLS "datum" with the OpenPGP public key
600
datum = (gnutls.library.types
601
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
602
ctypes.POINTER
603
(ctypes.c_ubyte)),
604
ctypes.c_uint(len(openpgp))))
388
datum = gnutls.library.types.gnutls_datum_t\
389
(ctypes.cast(ctypes.c_char_p(openpgp),
390
ctypes.POINTER(ctypes.c_ubyte)),
391
ctypes.c_uint(len(openpgp)))
605
392
# New empty GnuTLS certificate
606
393
crt = gnutls.library.types.gnutls_openpgp_crt_t()
607
(gnutls.library.functions
608
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
394
gnutls.library.functions.gnutls_openpgp_crt_init\
395
(ctypes.byref(crt))
609
396
# Import the OpenPGP public key into the certificate
610
(gnutls.library.functions
611
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
612
gnutls.library.constants
613
.GNUTLS_OPENPGP_FMT_RAW))
614
# Verify the self signature in the key
615
crtverify = ctypes.c_uint()
616
(gnutls.library.functions
617
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
618
if crtverify.value != 0:
619
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
620
raise gnutls.errors.CertificateSecurityError("Verify failed")
397
gnutls.library.functions.gnutls_openpgp_crt_import\
398
(crt, ctypes.byref(datum),
399
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
621
400
# New buffer for the fingerprint
622
buf = ctypes.create_string_buffer(20)
623
buf_len = ctypes.c_size_t()
401
buffer = ctypes.create_string_buffer(20)
402
buffer_length = ctypes.c_size_t()
624
403
# Get the fingerprint from the certificate into the buffer
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
627
ctypes.byref(buf_len)))
404
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
405
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
628
406
# Deinit the certificate
629
407
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
630
408
# Convert the buffer to a Python bytestring
631
fpr = ctypes.string_at(buf, buf_len.value)
409
fpr = ctypes.string_at(buffer, buffer_length.value)
632
410
# Convert the bytestring to hexadecimal notation
633
411
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
634
412
return hex_fpr
635
413
636
414
637
class TCP_handler(SocketServer.BaseRequestHandler, object):
415
class tcp_handler(SocketServer.BaseRequestHandler, object):
638
416
"""A TCP request handler class.
639
417
Instantiated by IPv6_TCPServer for each request to handle it.
640
418
Note: This will run in its own forked process."""
641
419
642
420
def handle(self):
643
421
logger.info(u"TCP connection from: %s",
644
unicode(self.client_address))
645
session = (gnutls.connection
646
.ClientSession(self.request,
647
gnutls.connection
648
.X509Credentials()))
422
unicode(self.client_address))
423
session = gnutls.connection.ClientSession\
424
(self.request, gnutls.connection.X509Credentials())
649
425
650
426
line = self.request.makefile().readline()
651
427
logger.debug(u"Protocol version: %r", line)
664
440
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
665
441
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
666
442
# "+DHE-DSS"))
667
# Use a fallback default, since this MUST be set.
668
priority = self.server.settings.get("priority", "NORMAL")
669
(gnutls.library.functions
670
.gnutls_priority_set_direct(session._c_object,
671
priority, None))
443
priority = "NORMAL" # Fallback default, since this
444
# MUST be set.
445
if self.server.settings["priority"]:
446
priority = self.server.settings["priority"]
447
gnutls.library.functions.gnutls_priority_set_direct\
448
(session._c_object, priority, None);
672
449
673
450
try:
674
451
session.handshake()
684
461
session.bye()
685
462
return
686
463
logger.debug(u"Fingerprint: %s", fpr)
464
client = None
687
465
for c in self.server.clients:
688
466
if c.fingerprint == fpr:
689
467
client = c
690
468
break
691
else:
469
if not client:
692
470
logger.warning(u"Client not found for fingerprint: %s",
693
471
fpr)
694
472
session.bye()
701
479
vars(client))
702
480
session.bye()
703
481
return
704
## This won't work here, since we're in a fork.
705
# client.bump_timeout()
706
482
sent_size = 0
707
483
while sent_size < len(client.secret):
708
484
sent = session.send(client.secret[sent_size:])
713
489
session.bye()
714
490
715
491
716
class IPv6_TCPServer(SocketServer.ForkingMixIn,
717
SocketServer.TCPServer, object):
492
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
718
493
"""IPv6 TCP server. Accepts 'None' as address and/or port.
719
494
Attributes:
720
495
settings: Server settings
721
496
clients: Set() of Client objects
722
enabled: Boolean; whether this server is activated yet
723
497
"""
724
498
address_family = socket.AF_INET6
725
499
def __init__(self, *args, **kwargs):
729
503
if "clients" in kwargs:
730
504
self.clients = kwargs["clients"]
731
505
del kwargs["clients"]
732
self.enabled = False
733
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
506
return super(type(self), self).__init__(*args, **kwargs)
734
507
def server_bind(self):
735
508
"""This overrides the normal server_bind() function
736
509
to bind to an interface if one was specified, and also NOT to
755
528
in6addr_any = "::"
756
529
self.server_address = (in6addr_any,
757
530
self.server_address[1])
758
elif not self.server_address[1]:
531
elif self.server_address[1] is None:
759
532
self.server_address = (self.server_address[0],
760
533
0)
761
# if self.settings["interface"]:
762
# self.server_address = (self.server_address[0],
763
# 0, # port
764
# 0, # flowinfo
765
# if_nametoindex
766
# (self.settings
767
# ["interface"]))
768
return super(IPv6_TCPServer, self).server_bind()
769
def server_activate(self):
770
if self.enabled:
771
return super(IPv6_TCPServer, self).server_activate()
772
def enable(self):
773
self.enabled = True
534
return super(type(self), self).server_bind()
774
535
775
536
776
537
def string_to_delta(interval):
786
547
datetime.timedelta(1)
787
548
>>> string_to_delta(u'1w')
788
549
datetime.timedelta(7)
789
>>> string_to_delta('5m 30s')
790
datetime.timedelta(0, 330)
791
550
"""
792
timevalue = datetime.timedelta(0)
793
for s in interval.split():
794
try:
795
suffix = unicode(s[-1])
796
value = int(s[:-1])
797
if suffix == u"d":
798
delta = datetime.timedelta(value)
799
elif suffix == u"s":
800
delta = datetime.timedelta(0, value)
801
elif suffix == u"m":
802
delta = datetime.timedelta(0, 0, 0, 0, value)
803
elif suffix == u"h":
804
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
805
elif suffix == u"w":
806
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
807
else:
808
raise ValueError
809
except (ValueError, IndexError):
551
try:
552
suffix=unicode(interval[-1])
553
value=int(interval[:-1])
554
if suffix == u"d":
555
delta = datetime.timedelta(value)
556
elif suffix == u"s":
557
delta = datetime.timedelta(0, value)
558
elif suffix == u"m":
559
delta = datetime.timedelta(0, 0, 0, 0, value)
560
elif suffix == u"h":
561
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
562
elif suffix == u"w":
563
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
564
else:
810
565
raise ValueError
811
timevalue += delta
812
return timevalue
566
except (ValueError, IndexError):
567
raise ValueError
568
return delta
813
569
814
570
815
571
def server_state_changed(state):
816
572
"""Derived from the Avahi example code"""
817
573
if state == avahi.SERVER_COLLISION:
818
logger.error(u"Zeroconf server name collision")
574
logger.error(u"Server name collision")
819
575
service.remove()
820
576
elif state == avahi.SERVER_RUNNING:
821
577
service.add()
823
579
824
580
def entry_group_state_changed(state, error):
825
581
"""Derived from the Avahi example code"""
826
logger.debug(u"Avahi state change: %i", state)
582
logger.debug(u"state change: %i", state)
827
583
828
584
if state == avahi.ENTRY_GROUP_ESTABLISHED:
829
logger.debug(u"Zeroconf service established.")
585
logger.debug(u"Service established.")
830
586
elif state == avahi.ENTRY_GROUP_COLLISION:
831
logger.warning(u"Zeroconf service name collision.")
587
logger.warning(u"Service name collision.")
832
588
service.rename()
833
589
elif state == avahi.ENTRY_GROUP_FAILURE:
834
logger.critical(u"Avahi: Error in group state changed %s",
590
logger.critical(u"Error in group state changed %s",
835
591
unicode(error))
836
raise AvahiGroupError(u"State changed: %s" % unicode(error))
592
raise AvahiGroupError("State changed: %s", str(error))
837
593
838
594
def if_nametoindex(interface):
839
595
"""Call the C function if_nametoindex(), or equivalent"""
840
596
global if_nametoindex
841
597
try:
842
if_nametoindex = (ctypes.cdll.LoadLibrary
843
(ctypes.util.find_library("c"))
844
.if_nametoindex)
598
if "ctypes.util" not in sys.modules:
599
import ctypes.util
600
if_nametoindex = ctypes.cdll.LoadLibrary\
601
(ctypes.util.find_library("c")).if_nametoindex
845
602
except (OSError, AttributeError):
846
603
if "struct" not in sys.modules:
847
604
import struct
850
607
def if_nametoindex(interface):
851
608
"Get an interface index the hard way, i.e. using fcntl()"
852
609
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
853
with closing(socket.socket()) as s:
854
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
855
struct.pack("16s16x", interface))
610
s = socket.socket()
611
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
612
struct.pack("16s16x", interface))
613
s.close()
856
614
interface_index = struct.unpack("I", ifreq[16:20])[0]
857
615
return interface_index
858
616
return if_nametoindex(interface)
859
617
860
618
861
def daemon(nochdir = False, noclose = False):
619
def daemon(nochdir, noclose):
862
620
"""See daemon(3). Standard BSD Unix function.
863
621
This should really exist as os.daemon, but it doesn't (yet)."""
864
622
if os.fork():
882
640
883
641
884
642
def main():
885
parser = OptionParser(version = "%%prog %s" % version)
643
global main_loop_started
644
main_loop_started = False
645
646
parser = OptionParser()
886
647
parser.add_option("-i", "--interface", type="string",
887
648
metavar="IF", help="Bind to interface IF")
888
649
parser.add_option("-a", "--address", type="string",
891
652
help="Port number to receive requests on")
892
653
parser.add_option("--check", action="store_true", default=False,
893
654
help="Run self-test")
894
parser.add_option("--debug", action="store_true",
655
parser.add_option("--debug", action="store_true", default=False,
895
656
help="Debug mode; run in foreground and log to"
896
657
" terminal")
897
658
parser.add_option("--priority", type="string", help="GnuTLS"
902
663
default="/etc/mandos", metavar="DIR",
903
664
help="Directory to search for configuration"
904
665
" files")
905
options = parser.parse_args()[0]
666
(options, args) = parser.parse_args()
906
667
907
668
if options.check:
908
669
import doctest
922
683
# Parse config file for server-global settings
923
684
server_config = ConfigParser.SafeConfigParser(server_defaults)
924
685
del server_defaults
925
server_config.read(os.path.join(options.configdir, "mandos.conf"))
686
server_config.read(os.path.join(options.configdir, "server.conf"))
687
server_section = "server"
926
688
# Convert the SafeConfigParser object to a dict
927
server_settings = server_config.defaults()
689
server_settings = dict(server_config.items(server_section))
928
690
# Use getboolean on the boolean config option
929
server_settings["debug"] = (server_config.getboolean
930
("DEFAULT", "debug"))
691
server_settings["debug"] = server_config.getboolean\
692
(server_section, "debug")
931
693
del server_config
932
694
933
695
# Override the settings from the config file with command line
940
702
del options
941
703
# Now we have our good server settings in "server_settings"
942
704
943
debug = server_settings["debug"]
944
945
if not debug:
946
syslogger.setLevel(logging.WARNING)
947
console.setLevel(logging.WARNING)
948
949
if server_settings["servicename"] != "Mandos":
950
syslogger.setFormatter(logging.Formatter
951
('Mandos (%s): %%(levelname)s:'
952
' %%(message)s'
953
% server_settings["servicename"]))
954
955
705
# Parse config file with clients
956
706
client_defaults = { "timeout": "1h",
957
707
"interval": "5m",
958
"checker": "fping -q -- %(host)s",
959
"host": "",
708
"checker": "fping -q -- %%(fqdn)s",
960
709
}
961
710
client_config = ConfigParser.SafeConfigParser(client_defaults)
962
711
client_config.read(os.path.join(server_settings["configdir"],
963
712
"clients.conf"))
964
713
965
clients = Set()
966
tcp_server = IPv6_TCPServer((server_settings["address"],
967
server_settings["port"]),
968
TCP_handler,
969
settings=server_settings,
970
clients=clients)
971
pidfilename = "/var/run/mandos.pid"
972
try:
973
pidfile = open(pidfilename, "w")
974
except IOError, error:
975
logger.error("Could not open file %r", pidfilename)
976
977
try:
978
uid = pwd.getpwnam("_mandos").pw_uid
979
except KeyError:
980
try:
981
uid = pwd.getpwnam("mandos").pw_uid
982
except KeyError:
983
try:
984
uid = pwd.getpwnam("nobody").pw_uid
985
except KeyError:
986
uid = 65534
987
try:
988
gid = pwd.getpwnam("_mandos").pw_gid
989
except KeyError:
990
try:
991
gid = pwd.getpwnam("mandos").pw_gid
992
except KeyError:
993
try:
994
gid = pwd.getpwnam("nogroup").pw_gid
995
except KeyError:
996
gid = 65534
997
try:
998
os.setuid(uid)
999
os.setgid(gid)
1000
except OSError, error:
1001
if error[0] != errno.EPERM:
1002
raise error
1003
1004
714
global service
1005
715
service = AvahiService(name = server_settings["servicename"],
1006
servicetype = "_mandos._tcp", )
716
type = "_mandos._tcp", );
1007
717
if server_settings["interface"]:
1008
service.interface = (if_nametoindex
1009
(server_settings["interface"]))
718
service.interface = if_nametoindex(server_settings["interface"])
1010
719
1011
720
global main_loop
1012
721
global bus
1015
724
DBusGMainLoop(set_as_default=True )
1016
725
main_loop = gobject.MainLoop()
1017
726
bus = dbus.SystemBus()
1018
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1019
avahi.DBUS_PATH_SERVER),
1020
avahi.DBUS_INTERFACE_SERVER)
727
server = dbus.Interface(
728
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
729
avahi.DBUS_INTERFACE_SERVER )
1021
730
# End of Avahi example code
1022
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
731
732
debug = server_settings["debug"]
733
734
if debug:
735
console = logging.StreamHandler()
736
# console.setLevel(logging.DEBUG)
737
console.setFormatter(logging.Formatter\
738
('%(levelname)s: %(message)s'))
739
logger.addHandler(console)
740
del console
741
742
clients = Set()
743
def remove_from_clients(client):
744
clients.remove(client)
745
if not clients:
746
logger.critical(u"No clients left, exiting")
747
sys.exit()
1023
748
1024
749
clients.update(Set(Client(name = section,
750
stop_hook = remove_from_clients,
1025
751
config
1026
752
= dict(client_config.items(section)))
1027
753
for section in client_config.sections()))
1028
if not clients:
1029
logger.critical(u"No clients defined")
1030
sys.exit(1)
1031
1032
if debug:
1033
# Redirect stdin so all checkers get /dev/null
1034
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1035
os.dup2(null, sys.stdin.fileno())
1036
if null > 2:
1037
os.close(null)
1038
else:
1039
# No console logging
1040
logger.removeHandler(console)
1041
# Close all input and output, do double fork, etc.
1042
daemon()
1043
1044
try:
1045
pid = os.getpid()
1046
pidfile.write(str(pid) + "\n")
1047
pidfile.close()
1048
del pidfile
1049
except IOError:
1050
logger.error(u"Could not write to file %r with PID %d",
1051
pidfilename, pid)
1052
except NameError:
1053
# "pidfile" was never created
1054
pass
1055
del pidfilename
754
755
if not debug:
756
daemon(False, False)
1056
757
1057
758
def cleanup():
1058
759
"Cleanup function; run on exit"
1065
766
1066
767
while clients:
1067
768
client = clients.pop()
1068
client.disable_hook = None
1069
client.disable()
769
client.stop_hook = None
770
client.stop()
1070
771
1071
772
atexit.register(cleanup)
1072
773
1075
776
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1076
777
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1077
778
1078
class MandosServer(dbus.service.Object):
1079
"""A D-Bus proxy object"""
1080
def __init__(self):
1081
dbus.service.Object.__init__(self, bus,
1082
"/Mandos")
1083
_interface = u"org.mandos_system.Mandos"
1084
1085
@dbus.service.signal(_interface, signature="oa{sv}")
1086
def ClientAdded(self, objpath, properties):
1087
"D-Bus signal"
1088
pass
1089
1090
@dbus.service.signal(_interface, signature="o")
1091
def ClientRemoved(self, objpath):
1092
"D-Bus signal"
1093
pass
1094
1095
@dbus.service.method(_interface, out_signature="ao")
1096
def GetAllClients(self):
1097
return dbus.Array(c.dbus_object_path for c in clients)
1098
1099
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1100
def GetAllClientsWithProperties(self):
1101
return dbus.Dictionary(
1102
((c.dbus_object_path, c.GetAllProperties())
1103
for c in clients),
1104
signature="oa{sv}")
1105
1106
@dbus.service.method(_interface, in_signature="o")
1107
def RemoveClient(self, object_path):
1108
for c in clients:
1109
if c.dbus_object_path == object_path:
1110
c.disable()
1111
clients.remove(c)
1112
return
1113
raise KeyError
1114
1115
del _interface
1116
1117
mandos_server = MandosServer()
1118
1119
779
for client in clients:
1120
# Emit D-Bus signal
1121
mandos_server.ClientAdded(client.dbus_object_path,
1122
client.GetAllProperties())
1123
client.enable()
1124
1125
tcp_server.enable()
1126
tcp_server.server_activate()
1127
780
client.start()
781
782
tcp_server = IPv6_TCPServer((server_settings["address"],
783
server_settings["port"]),
784
tcp_handler,
785
settings=server_settings,
786
clients=clients)
1128
787
# Find out what port we got
1129
788
service.port = tcp_server.socket.getsockname()[1]
1130
789
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1144
803
1145
804
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1146
805
lambda *args, **kwargs:
1147
(tcp_server.handle_request
1148
(*args[2:], **kwargs) or True))
806
tcp_server.handle_request\
807
(*args[2:], **kwargs) or True)
1149
808
1150
logger.debug(u"Starting main loop")
809
logger.debug("Starting main loop")
810
main_loop_started = True
1151
811
main_loop.run()
1152
812
except AvahiError, error:
1153
logger.critical(u"AvahiError: %s", error)
813
logger.critical(u"AvahiError: %s" + unicode(error))
1154
814
sys.exit(1)
1155
815
except KeyboardInterrupt:
1156
816
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0