#!/usr/bin/python import SocketServer import socket import select from optparse import OptionParser import datetime import errno import gnutls.crypto import gnutls.connection import gnutls.errors import ConfigParser class Client(object): def __init__(self, name=None, dn=None, password=None, passfile=None, fqdn=None, timeout=None, interval=-1): self.name = name self.dn = dn if password: self.password = password elif passfile: self.password = open(passfile).readall() else: print "No Password or Passfile in client config file" # raise RuntimeError XXX self.password = "gazonk" self.fqdn = fqdn # self.created = ... self.last_seen = None if timeout is None: timeout = self.server.options.timeout self.timeout = timeout if interval == -1: interval = self.server.options.interval self.interval = interval def server_bind(self): if self.options.interface: if not hasattr(socket, "SO_BINDTODEVICE"): # From /usr/include/asm-i486/socket.h socket.SO_BINDTODEVICE = 25 try: self.socket.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE, self.options.interface) except socket.error, error: if error[0] == errno.EPERM: print "Warning: Denied permission to bind to interface", \ self.options.interface else: raise error return super(type(self), self).server_bind() def init_with_options(self, *args, **kwargs): if "options" in kwargs: self.options = kwargs["options"] del kwargs["options"] if "clients" in kwargs: self.clients = kwargs["clients"] del kwargs["clients"] if "credentials" in kwargs: self.credentials = kwargs["credentials"] del kwargs["credentials"] return super(type(self), self).__init__(*args, **kwargs) class udp_handler(SocketServer.DatagramRequestHandler, object): def handle(self): self.wfile.write("Polo") print "UDP request answered" class IPv6_UDPServer(SocketServer.UDPServer, object): __init__ = init_with_options address_family = socket.AF_INET6 allow_reuse_address = True server_bind = server_bind def verify_request(self, request, client_address): print "UDP request came" return request[0] == "Marco" class tcp_handler(SocketServer.BaseRequestHandler, object): def handle(self): print "TCP request came" print "Request:", self.request print "Client Address:", self.client_address print "Server:", self.server session = gnutls.connection.ServerSession(self.request, self.server.credentials) session.handshake() if session.peer_certificate: print "DN:", session.peer_certificate.subject try: session.verify_peer() except gnutls.errors.CertificateError, error: print "Verify failed", error session.bye() return try: session.send(dict((client.dn, client.password) for client in self.server.clients) [session.peer_certificate.subject]) except KeyError: session.send("gazonk") # Log maybe? XXX session.bye() class IPv6_TCPServer(SocketServer.ForkingTCPServer, object): __init__ = init_with_options address_family = socket.AF_INET6 allow_reuse_address = True request_queue_size = 1024 server_bind = server_bind in6addr_any = "::" cred = None def main(): parser = OptionParser() parser.add_option("-i", "--interface", type="string", default="eth0", metavar="IF", help="Interface to bind to") parser.add_option("--cert", type="string", default="cert.pem", metavar="FILE", help="Public key certificate to use") parser.add_option("--key", type="string", default="key.pem", metavar="FILE", help="Private key to use") parser.add_option("--ca", type="string", default="ca.pem", metavar="FILE", help="Certificate Authority certificate to use") parser.add_option("--crl", type="string", default="crl.pem", metavar="FILE", help="Certificate Revokation List to use") parser.add_option("-p", "--port", type="int", default=49001, help="Port number to receive requests on") parser.add_option("--dh", type="int", metavar="BITS", help="DH group to use") parser.add_option("-t", "--timeout", type="string", # Parsed later default="15m", help="Amount of downtime allowed for clients") (options, args) = parser.parse_args() # Parse the time argument try: suffix=options.timeout[-1] value=int(options.timeout[:-1]) if suffix == "d": options.timeout = datetime.timedelta(value) elif suffix == "s": options.timeout = datetime.timedelta(0, value) elif suffix == "m": options.timeout = datetime.timedelta(0, 0, 0, 0, value) elif suffix == "h": options.timeout = datetime.timedelta(0, 0, 0, 0, 0, value) elif suffix == "w": options.timeout = datetime.timedelta(0, 0, 0, 0, 0, 0, value) else: raise ValueError except (ValueError, IndexError): parser.error("option --timeout: Unparseable time") cert = gnutls.crypto.X509Certificate(open(options.cert).read()) key = gnutls.crypto.X509PrivateKey(open(options.key).read()) ca = gnutls.crypto.X509Certificate(open(options.ca).read()) crl = gnutls.crypto.X509CRL(open(options.crl).read()) cred = gnutls.connection.X509Credentials(cert, key, [ca], [crl]) # Parse config file defaults = {} client_config_object = ConfigParser.SafeConfigParser(defaults) client_config_object.read("mandos-clients.conf") clients = [Client(name=section, **(dict(client_config_object.items(section)))) for section in client_config_object.sections()] udp_server = IPv6_UDPServer((in6addr_any, options.port), udp_handler, options=options) tcp_server = IPv6_TCPServer((in6addr_any, options.port), tcp_handler, options=options, clients=clients, credentials=cred) while True: in_, out, err = select.select((udp_server, tcp_server), (), ()) for server in in_: server.handle_request() if __name__ == "__main__": main()