/mandos/trunk : revision 1

1

#!/usr/bin/python

2

3

from __future__ import division

4

5

import SocketServer

6

import socket

7

import select

8

from optparse import OptionParser

9

import datetime

10

import errno

11

import gnutls.crypto

12

import gnutls.connection

13

import gnutls.errors

14

import gnutls.library.functions

15

import gnutls.library.constants

16

import gnutls.library.types

17

import ConfigParser

18

import sys

19

import re

20

import os

21

import signal

22

from sets import Set

23

import subprocess

24

25

import dbus

26

import gobject

27

import avahi

28

from dbus.mainloop.glib import DBusGMainLoop

29

import ctypes

30

31

# This variable is used to optionally bind to a specified interface.

32

# It is a global variable to fit in with the other variables from the

33

# Avahi server example code.

34

serviceInterface = avahi.IF_UNSPEC

35

# From the Avahi server example code:

36

serviceName = "Mandos"

37

serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html

38

servicePort = None # Not known at startup

39

serviceTXT = [] # TXT record for the service

40

domain = "" # Domain to publish on, default to .local

41

host = "" # Host to publish records for, default to localhost

42

group = None #our entry group

43

rename_count = 12 # Counter so we only rename after collisions a

44

# sensible number of times

45

# End of Avahi example code

46

47

48

class Client(object):

49

"""A representation of a client host served by this server.

50

Attributes:

51

name: string; from the config file, used in log messages

52

fingerprint: string (40 or 32 hexadecimal digits); used to

53

uniquely identify the client

54

secret: bytestring; sent verbatim (over TLS) to client

55

fqdn: string (FQDN); available for use by the checker command

56

created: datetime.datetime()

57

last_seen: datetime.datetime() or None if not yet seen

58

timeout: datetime.timedelta(); How long from last_seen until

59

this client is invalid

60

interval: datetime.timedelta(); How often to start a new checker

61

stop_hook: If set, called by stop() as stop_hook(self)

62

checker: subprocess.Popen(); a running checker process used

63

to see if the client lives.

64

Is None if no process is running.

65

checker_initiator_tag: a gobject event source tag, or None

66

stop_initiator_tag: - '' -

67

checker_callback_tag: - '' -

68

checker_command: string; External command which is run to check if

69

client lives. %()s expansions are done at

70

runtime with vars(self) as dict, so that for

71

instance %(name)s can be used in the command.

72

Private attibutes:

73

_timeout: Real variable for 'timeout'

74

_interval: Real variable for 'interval'

75

_timeout_milliseconds: Used by gobject.timeout_add()

76

_interval_milliseconds: - '' -

77

"""

78

def _set_timeout(self, timeout):

79

"Setter function for 'timeout' attribute"

80

self._timeout = timeout

81

self._timeout_milliseconds = ((self.timeout.days

82

* 24 * 60 * 60 * 1000)

83

+ (self.timeout.seconds * 1000)

84

+ (self.timeout.microseconds

85

// 1000))

86

timeout = property(lambda self: self._timeout,

87

_set_timeout)

88

del _set_timeout

89

def _set_interval(self, interval):

90

"Setter function for 'interval' attribute"

91

self._interval = interval

92

self._interval_milliseconds = ((self.interval.days

93

* 24 * 60 * 60 * 1000)

94

+ (self.interval.seconds

95

* 1000)

96

+ (self.interval.microseconds

97

// 1000))

98

interval = property(lambda self: self._interval,

99

_set_interval)

100

del _set_interval

101

def __init__(self, name=None, options=None, stop_hook=None,

102

fingerprint=None, secret=None, secfile=None, fqdn=None,

103

timeout=None, interval=-1, checker=None):

104

self.name = name

105

# Uppercase and remove spaces from fingerprint

106

# for later comparison purposes with return value of

107

# the fingerprint() function

108

self.fingerprint = fingerprint.upper().replace(u" ", u"")

109

if secret:

110

self.secret = secret.decode(u"base64")

111

elif secfile:

112

sf = open(secfile)

113

self.secret = sf.read()

114

sf.close()

115

else:

116

raise RuntimeError(u"No secret or secfile for client %s"

117

% self.name)

118

self.fqdn = fqdn # string

119

self.created = datetime.datetime.now()

120

self.last_seen = None

121

if timeout is None:

122

timeout = options.timeout

123

self.timeout = timeout

124

if interval == -1:

125

interval = options.interval

126

else:

127

interval = string_to_delta(interval)

128

self.interval = interval

129

self.stop_hook = stop_hook

130

self.checker = None

131

self.checker_initiator_tag = None

132

self.stop_initiator_tag = None

133

self.checker_callback_tag = None

134

self.check_command = checker

135

def start(self):

136

"""Start this clients checker and timeout hooks"""

137

# Schedule a new checker to be started an 'interval' from now,

138

# and every interval from then on.

139

self.checker_initiator_tag = gobject.timeout_add\

140

(self._interval_milliseconds,

141

self.start_checker)

142

# Also start a new checker *right now*.

143

self.start_checker()

144

# Schedule a stop() when 'timeout' has passed

145

self.stop_initiator_tag = gobject.timeout_add\

146

(self._timeout_milliseconds,

147

self.stop)

148

def stop(self):

149

"""Stop this client.

150

The possibility that this client might be restarted is left

151

open, but not currently used."""

152

if debug:

153

sys.stderr.write(u"Stopping client %s\n" % self.name)

154

self.secret = None

155

if self.stop_initiator_tag:

156

gobject.source_remove(self.stop_initiator_tag)

157

self.stop_initiator_tag = None

158

if self.checker_initiator_tag:

159

gobject.source_remove(self.checker_initiator_tag)

160

self.checker_initiator_tag = None

161

self.stop_checker()

162

if self.stop_hook:

163

self.stop_hook(self)

164

# Do not run this again if called by a gobject.timeout_add

165

return False

166

def __del__(self):

167

# Some code duplication here and in stop()

168

if hasattr(self, "stop_initiator_tag") \

169

and self.stop_initiator_tag:

170

gobject.source_remove(self.stop_initiator_tag)

171

self.stop_initiator_tag = None

172

if hasattr(self, "checker_initiator_tag") \

173

and self.checker_initiator_tag:

174

gobject.source_remove(self.checker_initiator_tag)

175

self.checker_initiator_tag = None

176

self.stop_checker()

177

def checker_callback(self, pid, condition):

178

"""The checker has completed, so take appropriate actions."""

179

now = datetime.datetime.now()

180

if os.WIFEXITED(condition) \

181

and (os.WEXITSTATUS(condition) == 0):

182

if debug:

183

sys.stderr.write(u"Checker for %(name)s succeeded\n"

184

% vars(self))

185

self.last_seen = now

186

gobject.source_remove(self.stop_initiator_tag)

187

self.stop_initiator_tag = gobject.timeout_add\

188

(self._timeout_milliseconds,

189

self.stop)

190

elif debug:

191

if not os.WIFEXITED(condition):

192

sys.stderr.write(u"Checker for %(name)s crashed?\n"

193

% vars(self))

194

else:

195

sys.stderr.write(u"Checker for %(name)s failed\n"

196

% vars(self))

197

self.checker = None

198

self.checker_callback_tag = None

199

def start_checker(self):

200

"""Start a new checker subprocess if one is not running.

201

If a checker already exists, leave it running and do

202

nothing."""

203

if self.checker is None:

204

if debug:

205

sys.stderr.write(u"Starting checker for %s\n"

206

% self.name)

207

try:

208

command = self.check_command % self.fqdn

209

except TypeError:

210

escaped_attrs = dict((key, re.escape(str(val)))

211

for key, val in

212

vars(self).iteritems())

213

command = self.check_command % escaped_attrs

214

try:

215

self.checker = subprocess.\

216

Popen(command,

217

stdout=subprocess.PIPE,

218

close_fds=True, shell=True,

219

cwd="/")

220

self.checker_callback_tag = gobject.\

221

child_watch_add(self.checker.pid,

222

self.\

223

checker_callback)

224

except subprocess.OSError, error:

225

sys.stderr.write(u"Failed to start subprocess: %s\n"

226

% error)

227

# Re-run this periodically if run by gobject.timeout_add

228

return True

229

def stop_checker(self):

230

"""Force the checker process, if any, to stop."""

231

if not hasattr(self, "checker") or self.checker is None:

232

return

233

gobject.source_remove(self.checker_callback_tag)

234

self.checker_callback_tag = None

235

os.kill(self.checker.pid, signal.SIGTERM)

236

if self.checker.poll() is None:

237

os.kill(self.checker.pid, signal.SIGKILL)

238

self.checker = None

239

def still_valid(self, now=None):

240

"""Has the timeout not yet passed for this client?"""

241

if now is None:

242

now = datetime.datetime.now()

243

if self.last_seen is None:

244

return now < (self.created + self.timeout)

245

else:

246

return now < (self.last_seen + self.timeout)

247

248

249

def peer_certificate(session):

250

# If not an OpenPGP certificate...

251

if gnutls.library.functions.gnutls_certificate_type_get\

252

(session._c_object) \

253

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

254

# ...do the normal thing

255

return session.peer_certificate

256

list_size = ctypes.c_uint()

257

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

258

(session._c_object, ctypes.byref(list_size))

259

if list_size.value == 0:

260

return None

261

cert = cert_list[0]

262

return ctypes.string_at(cert.data, cert.size)

263

264

265

def fingerprint(openpgp):

266

# New empty GnuTLS certificate

267

crt = gnutls.library.types.gnutls_openpgp_crt_t()

268

gnutls.library.functions.gnutls_openpgp_crt_init\

269

(ctypes.byref(crt))

270

# New GnuTLS "datum" with the OpenPGP public key

271

datum = gnutls.library.types.gnutls_datum_t\

272

(ctypes.cast(ctypes.c_char_p(openpgp),

273

ctypes.POINTER(ctypes.c_ubyte)),

274

ctypes.c_uint(len(openpgp)))

275

# Import the OpenPGP public key into the certificate

276

ret = gnutls.library.functions.gnutls_openpgp_crt_import\

277

(crt,

278

ctypes.byref(datum),

279

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

280

# New buffer for the fingerprint

281

buffer = ctypes.create_string_buffer(20)

282

buffer_length = ctypes.c_size_t()

283

# Get the fingerprint from the certificate into the buffer

284

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

285

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

286

# Deinit the certificate

287

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

288

# Convert the buffer to a Python bytestring

289

fpr = ctypes.string_at(buffer, buffer_length.value)

290

# Convert the bytestring to hexadecimal notation

291

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

292

return hex_fpr

293

294

295

class tcp_handler(SocketServer.BaseRequestHandler, object):

296

"""A TCP request handler class.

297

Instantiated by IPv6_TCPServer for each request to handle it.

298

Note: This will run in its own forked process."""

299

300

def handle(self):

301

if debug:

302

sys.stderr.write(u"TCP request came\n")

303

sys.stderr.write(u"Request: %s\n" % self.request)

304

sys.stderr.write(u"Client Address: %s\n"

305

% unicode(self.client_address))

306

sys.stderr.write(u"Server: %s\n" % self.server)

307

session = gnutls.connection.ClientSession(self.request,

308

gnutls.connection.\

309

X509Credentials())

310

311

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

312

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

313

# "+DHE-DSS"))

314

priority = "SECURE256"

315

316

gnutls.library.functions.gnutls_priority_set_direct\

317

(session._c_object, priority, None);

318

319

try:

320

session.handshake()

321

except gnutls.errors.GNUTLSError, error:

322

if debug:

323

sys.stderr.write(u"Handshake failed: %s\n" % error)

324

# Do not run session.bye() here: the session is not

325

# established. Just abandon the request.

326

return

327

try:

328

fpr = fingerprint(peer_certificate(session))

329

except (TypeError, gnutls.errors.GNUTLSError), error:

330

if debug:

331

sys.stderr.write(u"Bad certificate: %s\n" % error)

332

session.bye()

333

return

334

if debug:

335

sys.stderr.write(u"Fingerprint: %s\n" % fpr)

336

client = None

337

for c in clients:

338

if c.fingerprint == fpr:

339

client = c

340

break

341

# Have to check if client.still_valid(), since it is possible

342

# that the client timed out while establishing the GnuTLS

343

# session.

344

if (not client) or (not client.still_valid()):

345

if debug:

346

if client:

347

sys.stderr.write(u"Client %(name)s is invalid\n"

348

% vars(client))

349

else:

350

sys.stderr.write(u"Client not found for "

351

u"fingerprint: %s\n" % fpr)

352

session.bye()

353

return

354

sent_size = 0

355

while sent_size < len(client.secret):

356

sent = session.send(client.secret[sent_size:])

357

if debug:

358

sys.stderr.write(u"Sent: %d, remaining: %d\n"

359

% (sent, len(client.secret)

360

- (sent_size + sent)))

361

sent_size += sent

362

session.bye()

363

364

365

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

366

"""IPv6 TCP server. Accepts 'None' as address and/or port.

367

Attributes:

368

options: Command line options

369

clients: Set() of Client objects

370

"""

371

address_family = socket.AF_INET6

372

def __init__(self, *args, **kwargs):

373

if "options" in kwargs:

374

self.options = kwargs["options"]

375

del kwargs["options"]

376

if "clients" in kwargs:

377

self.clients = kwargs["clients"]

378

del kwargs["clients"]

379

return super(type(self), self).__init__(*args, **kwargs)

380

def server_bind(self):

381

"""This overrides the normal server_bind() function

382

to bind to an interface if one was specified, and also NOT to

383

bind to an address or port if they were not specified."""

384

if self.options.interface:

385

if not hasattr(socket, "SO_BINDTODEVICE"):

386

# From /usr/include/asm-i486/socket.h

387

socket.SO_BINDTODEVICE = 25

388

try:

389

self.socket.setsockopt(socket.SOL_SOCKET,

390

socket.SO_BINDTODEVICE,

391

self.options.interface)

392

except socket.error, error:

393

if error[0] == errno.EPERM:

394

sys.stderr.write(u"Warning: No permission to" \

395

u" bind to interface %s\n"

396

% self.options.interface)

397

else:

398

raise error

399

# Only bind(2) the socket if we really need to.

400

if self.server_address[0] or self.server_address[1]:

401

if not self.server_address[0]:

402

in6addr_any = "::"

403

self.server_address = (in6addr_any,

404

self.server_address[1])

405

elif self.server_address[1] is None:

406

self.server_address = (self.server_address[0],

407

0)

408

return super(type(self), self).server_bind()

409

410

411

def string_to_delta(interval):

412

"""Parse a string and return a datetime.timedelta

413

414

>>> string_to_delta('7d')

415

datetime.timedelta(7)

416

>>> string_to_delta('60s')

417

datetime.timedelta(0, 60)

418

>>> string_to_delta('60m')

419

datetime.timedelta(0, 3600)

420

>>> string_to_delta('24h')

421

datetime.timedelta(1)

422

>>> string_to_delta(u'1w')

423

datetime.timedelta(7)

424

"""

425

try:

426

suffix=unicode(interval[-1])

427

value=int(interval[:-1])

428

if suffix == u"d":

429

delta = datetime.timedelta(value)

430

elif suffix == u"s":

431

delta = datetime.timedelta(0, value)

432

elif suffix == u"m":

433

delta = datetime.timedelta(0, 0, 0, 0, value)

434

elif suffix == u"h":

435

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

436

elif suffix == u"w":

437

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

438

else:

439

raise ValueError

440

except (ValueError, IndexError):

441

raise ValueError

442

return delta

443

444

445

def add_service():

446

"""From the Avahi server example code"""

447

global group, serviceName, serviceType, servicePort, serviceTXT, \

448

domain, host

449

if group is None:

450

group = dbus.Interface(

451

bus.get_object( avahi.DBUS_NAME,

452

server.EntryGroupNew()),

453

avahi.DBUS_INTERFACE_ENTRY_GROUP)

454

group.connect_to_signal('StateChanged',

455

entry_group_state_changed)

456

if debug:

457

sys.stderr.write(u"Adding service '%s' of type '%s' ...\n"

458

% (serviceName, serviceType))

459

460

group.AddService(

461

serviceInterface, # interface

462

avahi.PROTO_INET6, # protocol

463

dbus.UInt32(0), # flags

464

serviceName, serviceType,

465

domain, host,

466

dbus.UInt16(servicePort),

467

avahi.string_array_to_txt_array(serviceTXT))

468

group.Commit()

469

470

471

def remove_service():

472

"""From the Avahi server example code"""

473

global group

474

475

if not group is None:

476

group.Reset()

477

478

479

def server_state_changed(state):

480

"""From the Avahi server example code"""

481

if state == avahi.SERVER_COLLISION:

482

sys.stderr.write(u"WARNING: Server name collision\n")

483

remove_service()

484

elif state == avahi.SERVER_RUNNING:

485

add_service()

486

487

488

def entry_group_state_changed(state, error):

489

"""From the Avahi server example code"""

490

global serviceName, server, rename_count

491

492

if debug:

493

sys.stderr.write(u"state change: %i\n" % state)

494

495

if state == avahi.ENTRY_GROUP_ESTABLISHED:

496

if debug:

497

sys.stderr.write(u"Service established.\n")

498

elif state == avahi.ENTRY_GROUP_COLLISION:

499

500

rename_count = rename_count - 1

501

if rename_count > 0:

502

name = server.GetAlternativeServiceName(name)

503

sys.stderr.write(u"WARNING: Service name collision, "

504

u"changing name to '%s' ...\n" % name)

505

remove_service()

506

add_service()

507

508

else:

509

sys.stderr.write(u"ERROR: No suitable service name found "

510

u"after %i retries, exiting.\n"

511

% n_rename)

512

main_loop.quit()

513

elif state == avahi.ENTRY_GROUP_FAILURE:

514

sys.stderr.write(u"Error in group state changed %s\n"

515

% unicode(error))

516

main_loop.quit()

517

return

518

519

520

def if_nametoindex(interface):

521

"""Call the C function if_nametoindex()"""

522

try:

523

libc = ctypes.cdll.LoadLibrary("libc.so.6")

524

return libc.if_nametoindex(interface)

525

except (OSError, AttributeError):

526

if "struct" not in sys.modules:

527

import struct

528

if "fcntl" not in sys.modules:

529

import fcntl

530

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

531

s = socket.socket()

532

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

533

struct.pack("16s16x", interface))

534

s.close()

535

interface_index = struct.unpack("I", ifreq[16:20])[0]

536

return interface_index

537

538

539

if __name__ == '__main__':

540

parser = OptionParser()

541

parser.add_option("-i", "--interface", type="string",

542

default=None, metavar="IF",

543

help="Bind to interface IF")

544

parser.add_option("--cert", type="string", default="cert.pem",

545

metavar="FILE",

546

help="Public key certificate PEM file to use")

547

parser.add_option("--key", type="string", default="key.pem",

548

metavar="FILE",

549

help="Private key PEM file to use")

550

parser.add_option("--ca", type="string", default="ca.pem",

551

metavar="FILE",

552

help="Certificate Authority certificate PEM file to use")

553

parser.add_option("--crl", type="string", default="crl.pem",

554

metavar="FILE",

555

help="Certificate Revokation List PEM file to use")

556

parser.add_option("-p", "--port", type="int", default=None,

557

help="Port number to receive requests on")

558

parser.add_option("--timeout", type="string", # Parsed later

559

default="1h",

560

help="Amount of downtime allowed for clients")

561

parser.add_option("--interval", type="string", # Parsed later

562

default="5m",

563

help="How often to check that a client is up")

564

parser.add_option("--check", action="store_true", default=False,

565

help="Run self-test")

566

parser.add_option("--debug", action="store_true", default=False,

567

help="Debug mode")

568

(options, args) = parser.parse_args()

569

570

if options.check:

571

import doctest

572

doctest.testmod()

573

sys.exit()

574

575

# Parse the time arguments

576

try:

577

options.timeout = string_to_delta(options.timeout)

578

except ValueError:

579

parser.error("option --timeout: Unparseable time")

580

try:

581

options.interval = string_to_delta(options.interval)

582

except ValueError:

583

parser.error("option --interval: Unparseable time")

584

585

# Parse config file

586

defaults = { "checker": "sleep 1; fping -q -- %%(fqdn)s" }

587

client_config = ConfigParser.SafeConfigParser(defaults)

588

#client_config.readfp(open("secrets.conf"), "secrets.conf")

589

client_config.read("mandos-clients.conf")

590

591

# From the Avahi server example code

592

DBusGMainLoop(set_as_default=True )

593

main_loop = gobject.MainLoop()

594

bus = dbus.SystemBus()

595

server = dbus.Interface(

596

bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),

597

avahi.DBUS_INTERFACE_SERVER )

598

# End of Avahi example code

599

600

debug = options.debug

601

602

clients = Set()

603

def remove_from_clients(client):

604

clients.remove(client)

605

if not clients:

606

if debug:

607

sys.stderr.write(u"No clients left, exiting\n")

608

main_loop.quit()

609

610

clients.update(Set(Client(name=section, options=options,

611

stop_hook = remove_from_clients,

612

**(dict(client_config\

613

.items(section))))

614

for section in client_config.sections()))

615

for client in clients:

616

client.start()

617

618

tcp_server = IPv6_TCPServer((None, options.port),

619

tcp_handler,

620

options=options,

621

clients=clients)

622

# Find out what random port we got

623

servicePort = tcp_server.socket.getsockname()[1]

624

if debug:

625

sys.stderr.write(u"Now listening on port %d\n" % servicePort)

626

627

if options.interface is not None:

628

serviceInterface = if_nametoindex(options.interface)

629

630

# From the Avahi server example code

631

server.connect_to_signal("StateChanged", server_state_changed)

632

server_state_changed(server.GetState())

633

# End of Avahi example code

634

635

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

636

lambda *args, **kwargs:

637

tcp_server.handle_request(*args[2:],

638

**kwargs) or True)

639

try:

640

main_loop.run()

641

except KeyboardInterrupt:

642

print

643

644

# Cleanup here

645

646

# From the Avahi server example code

647

if not group is None:

648

group.Free()

649

# End of Avahi example code

650

651

for client in clients:

652

client.stop_hook = None

653

client.stop()