124
104
max_renames: integer; maximum number of renames
125
105
rename_count: integer; counter so we only rename after collisions
126
106
a sensible number of times
127
group: D-Bus Entry Group
129
bus: dbus.SystemBus()
131
108
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
132
servicetype = None, port = None, TXT = None,
133
domain = u"", host = u"", max_renames = 32768,
134
protocol = avahi.PROTO_UNSPEC, bus = None):
109
type = None, port = None, TXT = None, domain = "",
110
host = "", max_renames = 32768):
135
111
self.interface = interface
137
self.type = servicetype
139
self.TXT = TXT if TXT is not None else []
140
119
self.domain = domain
142
121
self.rename_count = 0
143
122
self.max_renames = max_renames
144
self.protocol = protocol
145
self.group = None # our entry group
148
123
def rename(self):
149
124
"""Derived from the Avahi example code"""
150
125
if self.rename_count >= self.max_renames:
151
logger.critical(u"No suitable Zeroconf service name found"
152
u" after %i retries, exiting.",
154
raise AvahiServiceError(u"Too many renames")
155
self.name = self.server.GetAlternativeServiceName(self.name)
156
logger.info(u"Changing Zeroconf service name to %r ...",
158
syslogger.setFormatter(logging.Formatter
159
(u'Mandos (%s) [%%(process)d]:'
160
u' %%(levelname)s: %%(message)s'
126
logger.critical(u"No suitable service name found after %i"
127
u" retries, exiting.", rename_count)
128
raise AvahiServiceError("Too many renames")
129
self.name = server.GetAlternativeServiceName(self.name)
130
logger.info(u"Changing name to %r ...", str(self.name))
131
syslogger.setFormatter(logging.Formatter\
132
('Mandos (%s): %%(levelname)s:'
133
' %%(message)s' % self.name))
164
136
self.rename_count += 1
165
137
def remove(self):
166
138
"""Derived from the Avahi example code"""
167
if self.group is not None:
139
if group is not None:
170
142
"""Derived from the Avahi example code"""
171
if self.group is None:
172
self.group = dbus.Interface(
173
self.bus.get_object(avahi.DBUS_NAME,
174
self.server.EntryGroupNew()),
175
avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
self.group.connect_to_signal('StateChanged',
177
self.entry_group_state_changed)
178
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
179
self.name, self.type)
180
self.group.AddService(
183
dbus.UInt32(0), # flags
184
self.name, self.type,
185
self.domain, self.host,
186
dbus.UInt16(self.port),
187
avahi.string_array_to_txt_array(self.TXT))
189
def entry_group_state_changed(self, state, error):
190
"""Derived from the Avahi example code"""
191
logger.debug(u"Avahi state change: %i", state)
193
if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
logger.debug(u"Zeroconf service established.")
195
elif state == avahi.ENTRY_GROUP_COLLISION:
196
logger.warning(u"Zeroconf service name collision.")
198
elif state == avahi.ENTRY_GROUP_FAILURE:
199
logger.critical(u"Avahi: Error in group state changed %s",
201
raise AvahiGroupError(u"State changed: %s"
204
"""Derived from the Avahi example code"""
205
if self.group is not None:
208
def server_state_changed(self, state):
209
"""Derived from the Avahi example code"""
210
if state == avahi.SERVER_COLLISION:
211
logger.error(u"Zeroconf server name collision")
213
elif state == avahi.SERVER_RUNNING:
216
"""Derived from the Avahi example code"""
217
if self.server is None:
218
self.server = dbus.Interface(
219
self.bus.get_object(avahi.DBUS_NAME,
220
avahi.DBUS_PATH_SERVER),
221
avahi.DBUS_INTERFACE_SERVER)
222
self.server.connect_to_signal(u"StateChanged",
223
self.server_state_changed)
224
self.server_state_changed(self.server.GetState())
145
group = dbus.Interface\
146
(bus.get_object(avahi.DBUS_NAME,
147
server.EntryGroupNew()),
148
avahi.DBUS_INTERFACE_ENTRY_GROUP)
149
group.connect_to_signal('StateChanged',
150
entry_group_state_changed)
151
logger.debug(u"Adding service '%s' of type '%s' ...",
152
service.name, service.type)
154
self.interface, # interface
155
avahi.PROTO_INET6, # protocol
156
dbus.UInt32(0), # flags
157
self.name, self.type,
158
self.domain, self.host,
159
dbus.UInt16(self.port),
160
avahi.string_array_to_txt_array(self.TXT))
163
# From the Avahi example code:
164
group = None # our entry group
165
# End of Avahi example code
227
168
class Client(object):
228
169
"""A representation of a client host served by this server.
231
name: string; from the config file, used in log messages and
171
name: string; from the config file, used in log messages
233
172
fingerprint: string (40 or 32 hexadecimal digits); used to
234
173
uniquely identify the client
235
secret: bytestring; sent verbatim (over TLS) to client
236
host: string; available for use by the checker command
237
created: datetime.datetime(); (UTC) object creation
238
last_enabled: datetime.datetime(); (UTC)
240
last_checked_ok: datetime.datetime(); (UTC) or None
241
timeout: datetime.timedelta(); How long from last_checked_ok
242
until this client is invalid
243
interval: datetime.timedelta(); How often to start a new checker
244
disable_hook: If set, called by disable() as disable_hook(self)
245
checker: subprocess.Popen(); a running checker process used
246
to see if the client lives.
247
'None' if no process is running.
174
secret: bytestring; sent verbatim (over TLS) to client
175
host: string; available for use by the checker command
176
created: datetime.datetime(); object creation, not client host
177
last_checked_ok: datetime.datetime() or None if not yet checked OK
178
timeout: datetime.timedelta(); How long from last_checked_ok
179
until this client is invalid
180
interval: datetime.timedelta(); How often to start a new checker
181
stop_hook: If set, called by stop() as stop_hook(self)
182
checker: subprocess.Popen(); a running checker process used
183
to see if the client lives.
184
'None' if no process is running.
248
185
checker_initiator_tag: a gobject event source tag, or None
249
disable_initiator_tag: - '' -
186
stop_initiator_tag: - '' -
250
187
checker_callback_tag: - '' -
251
188
checker_command: string; External command which is run to check if
252
189
client lives. %() expansions are done at
253
190
runtime with vars(self) as dict, so that for
254
191
instance %(name)s can be used in the command.
255
current_checker_command: string; current running checker_command
193
_timeout: Real variable for 'timeout'
194
_interval: Real variable for 'interval'
195
_timeout_milliseconds: Used when calling gobject.timeout_add()
196
_interval_milliseconds: - '' -
259
def _datetime_to_milliseconds(dt):
260
"Convert a datetime.datetime() to milliseconds"
261
return ((dt.days * 24 * 60 * 60 * 1000)
262
+ (dt.seconds * 1000)
263
+ (dt.microseconds // 1000))
265
def timeout_milliseconds(self):
266
"Return the 'timeout' attribute in milliseconds"
267
return self._datetime_to_milliseconds(self.timeout)
269
def interval_milliseconds(self):
270
"Return the 'interval' attribute in milliseconds"
271
return self._datetime_to_milliseconds(self.interval)
273
def __init__(self, name = None, disable_hook=None, config=None):
198
def _set_timeout(self, timeout):
199
"Setter function for 'timeout' attribute"
200
self._timeout = timeout
201
self._timeout_milliseconds = ((self.timeout.days
202
* 24 * 60 * 60 * 1000)
203
+ (self.timeout.seconds * 1000)
204
+ (self.timeout.microseconds
206
timeout = property(lambda self: self._timeout,
209
def _set_interval(self, interval):
210
"Setter function for 'interval' attribute"
211
self._interval = interval
212
self._interval_milliseconds = ((self.interval.days
213
* 24 * 60 * 60 * 1000)
214
+ (self.interval.seconds
216
+ (self.interval.microseconds
218
interval = property(lambda self: self._interval,
221
def __init__(self, name = None, stop_hook=None, config={}):
274
222
"""Note: the 'checker' key in 'config' sets the
275
223
'checker_command' attribute and *not* the 'checker'
280
226
logger.debug(u"Creating client %r", self.name)
281
227
# Uppercase and remove spaces from fingerprint for later
282
228
# comparison purposes with return value from the fingerprint()
284
self.fingerprint = (config[u"fingerprint"].upper()
230
self.fingerprint = config["fingerprint"].upper()\
286
232
logger.debug(u" Fingerprint: %s", self.fingerprint)
287
if u"secret" in config:
288
self.secret = config[u"secret"].decode(u"base64")
289
elif u"secfile" in config:
290
with closing(open(os.path.expanduser
292
(config[u"secfile"])))) as secfile:
293
self.secret = secfile.read()
233
if "secret" in config:
234
self.secret = config["secret"].decode(u"base64")
235
elif "secfile" in config:
236
sf = open(config["secfile"])
237
self.secret = sf.read()
295
240
raise TypeError(u"No secret or secfile for client %s"
297
self.host = config.get(u"host", u"")
298
self.created = datetime.datetime.utcnow()
300
self.last_enabled = None
242
self.host = config.get("host", "")
243
self.created = datetime.datetime.now()
301
244
self.last_checked_ok = None
302
self.timeout = string_to_delta(config[u"timeout"])
303
self.interval = string_to_delta(config[u"interval"])
304
self.disable_hook = disable_hook
245
self.timeout = string_to_delta(config["timeout"])
246
self.interval = string_to_delta(config["interval"])
247
self.stop_hook = stop_hook
305
248
self.checker = None
306
249
self.checker_initiator_tag = None
307
self.disable_initiator_tag = None
250
self.stop_initiator_tag = None
308
251
self.checker_callback_tag = None
309
self.checker_command = config[u"checker"]
310
self.current_checker_command = None
311
self.last_connect = None
252
self.check_command = config["checker"]
314
254
"""Start this client's checker and timeout hooks"""
315
if getattr(self, u"enabled", False):
318
self.last_enabled = datetime.datetime.utcnow()
319
255
# Schedule a new checker to be started an 'interval' from now,
320
256
# and every interval from then on.
321
self.checker_initiator_tag = (gobject.timeout_add
322
(self.interval_milliseconds(),
257
self.checker_initiator_tag = gobject.timeout_add\
258
(self._interval_milliseconds,
324
260
# Also start a new checker *right now*.
325
261
self.start_checker()
326
# Schedule a disable() when 'timeout' has passed
327
self.disable_initiator_tag = (gobject.timeout_add
328
(self.timeout_milliseconds(),
333
"""Disable this client."""
334
if not getattr(self, "enabled", False):
262
# Schedule a stop() when 'timeout' has passed
263
self.stop_initiator_tag = gobject.timeout_add\
264
(self._timeout_milliseconds,
268
The possibility that a client might be restarted is left open,
269
but not currently used."""
270
# If this client doesn't have a secret, it is already stopped.
271
if hasattr(self, "secret") and self.secret:
272
logger.info(u"Stopping client %s", self.name)
336
logger.info(u"Disabling client %s", self.name)
337
if getattr(self, u"disable_initiator_tag", False):
338
gobject.source_remove(self.disable_initiator_tag)
339
self.disable_initiator_tag = None
340
if getattr(self, u"checker_initiator_tag", False):
276
if getattr(self, "stop_initiator_tag", False):
277
gobject.source_remove(self.stop_initiator_tag)
278
self.stop_initiator_tag = None
279
if getattr(self, "checker_initiator_tag", False):
341
280
gobject.source_remove(self.checker_initiator_tag)
342
281
self.checker_initiator_tag = None
343
282
self.stop_checker()
344
if self.disable_hook:
345
self.disable_hook(self)
347
285
# Do not run this again if called by a gobject.timeout_add
350
287
def __del__(self):
351
self.disable_hook = None
354
def checker_callback(self, pid, condition, command):
288
self.stop_hook = None
290
def checker_callback(self, pid, condition):
355
291
"""The checker has completed, so take appropriate actions."""
292
now = datetime.datetime.now()
356
293
self.checker_callback_tag = None
357
294
self.checker = None
358
if os.WIFEXITED(condition):
359
exitstatus = os.WEXITSTATUS(condition)
361
logger.info(u"Checker for %(name)s succeeded",
365
logger.info(u"Checker for %(name)s failed",
295
if os.WIFEXITED(condition) \
296
and (os.WEXITSTATUS(condition) == 0):
297
logger.info(u"Checker for %(name)s succeeded",
299
self.last_checked_ok = now
300
gobject.source_remove(self.stop_initiator_tag)
301
self.stop_initiator_tag = gobject.timeout_add\
302
(self._timeout_milliseconds,
304
elif not os.WIFEXITED(condition):
368
305
logger.warning(u"Checker for %(name)s crashed?",
371
def checked_ok(self):
372
"""Bump up the timeout for this client.
374
This should only be called when the client has been seen,
377
self.last_checked_ok = datetime.datetime.utcnow()
378
gobject.source_remove(self.disable_initiator_tag)
379
self.disable_initiator_tag = (gobject.timeout_add
380
(self.timeout_milliseconds(),
308
logger.info(u"Checker for %(name)s failed",
383
310
def start_checker(self):
384
311
"""Start a new checker subprocess if one is not running.
386
312
If a checker already exists, leave it running and do
388
314
# The reason for not killing a running checker is that if we
465
369
if error.errno != errno.ESRCH: # No such process
467
371
self.checker = None
469
372
def still_valid(self):
470
373
"""Has the timeout not yet passed for this client?"""
471
if not getattr(self, u"enabled", False):
473
now = datetime.datetime.utcnow()
374
now = datetime.datetime.now()
474
375
if self.last_checked_ok is None:
475
376
return now < (self.created + self.timeout)
477
378
return now < (self.last_checked_ok + self.timeout)
480
class ClientDBus(Client, dbus.service.Object):
481
"""A Client class using D-Bus
484
dbus_object_path: dbus.ObjectPath
485
bus: dbus.SystemBus()
487
# dbus.service.Object doesn't use super(), so we can't either.
489
def __init__(self, bus = None, *args, **kwargs):
491
Client.__init__(self, *args, **kwargs)
492
# Only now, when this client is initialized, can it show up on
494
self.dbus_object_path = (dbus.ObjectPath
496
+ self.name.replace(u".", u"_")))
497
dbus.service.Object.__init__(self, self.bus,
498
self.dbus_object_path)
501
def _datetime_to_dbus(dt, variant_level=0):
502
"""Convert a UTC datetime.datetime() to a D-Bus type."""
503
return dbus.String(dt.isoformat(),
504
variant_level=variant_level)
507
oldstate = getattr(self, u"enabled", False)
508
r = Client.enable(self)
509
if oldstate != self.enabled:
511
self.PropertyChanged(dbus.String(u"enabled"),
512
dbus.Boolean(True, variant_level=1))
513
self.PropertyChanged(
514
dbus.String(u"last_enabled"),
515
self._datetime_to_dbus(self.last_enabled,
519
def disable(self, signal = True):
520
oldstate = getattr(self, u"enabled", False)
521
r = Client.disable(self)
522
if signal and oldstate != self.enabled:
524
self.PropertyChanged(dbus.String(u"enabled"),
525
dbus.Boolean(False, variant_level=1))
528
def __del__(self, *args, **kwargs):
530
self.remove_from_connection()
533
if hasattr(dbus.service.Object, u"__del__"):
534
dbus.service.Object.__del__(self, *args, **kwargs)
535
Client.__del__(self, *args, **kwargs)
537
def checker_callback(self, pid, condition, command,
539
self.checker_callback_tag = None
542
self.PropertyChanged(dbus.String(u"checker_running"),
543
dbus.Boolean(False, variant_level=1))
544
if os.WIFEXITED(condition):
545
exitstatus = os.WEXITSTATUS(condition)
547
self.CheckerCompleted(dbus.Int16(exitstatus),
548
dbus.Int64(condition),
549
dbus.String(command))
552
self.CheckerCompleted(dbus.Int16(-1),
553
dbus.Int64(condition),
554
dbus.String(command))
556
return Client.checker_callback(self, pid, condition, command,
559
def checked_ok(self, *args, **kwargs):
560
r = Client.checked_ok(self, *args, **kwargs)
562
self.PropertyChanged(
563
dbus.String(u"last_checked_ok"),
564
(self._datetime_to_dbus(self.last_checked_ok,
568
def start_checker(self, *args, **kwargs):
569
old_checker = self.checker
570
if self.checker is not None:
571
old_checker_pid = self.checker.pid
573
old_checker_pid = None
574
r = Client.start_checker(self, *args, **kwargs)
575
# Only if new checker process was started
576
if (self.checker is not None
577
and old_checker_pid != self.checker.pid):
579
self.CheckerStarted(self.current_checker_command)
580
self.PropertyChanged(
581
dbus.String(u"checker_running"),
582
dbus.Boolean(True, variant_level=1))
585
def stop_checker(self, *args, **kwargs):
586
old_checker = getattr(self, u"checker", None)
587
r = Client.stop_checker(self, *args, **kwargs)
588
if (old_checker is not None
589
and getattr(self, u"checker", None) is None):
590
self.PropertyChanged(dbus.String(u"checker_running"),
591
dbus.Boolean(False, variant_level=1))
594
## D-Bus methods & signals
595
_interface = u"se.bsnet.fukt.Mandos.Client"
598
@dbus.service.method(_interface)
600
return self.checked_ok()
602
# CheckerCompleted - signal
603
@dbus.service.signal(_interface, signature=u"nxs")
604
def CheckerCompleted(self, exitcode, waitstatus, command):
608
# CheckerStarted - signal
609
@dbus.service.signal(_interface, signature=u"s")
610
def CheckerStarted(self, command):
614
# GetAllProperties - method
615
@dbus.service.method(_interface, out_signature=u"a{sv}")
616
def GetAllProperties(self):
618
return dbus.Dictionary({
619
dbus.String(u"name"):
620
dbus.String(self.name, variant_level=1),
621
dbus.String(u"fingerprint"):
622
dbus.String(self.fingerprint, variant_level=1),
623
dbus.String(u"host"):
624
dbus.String(self.host, variant_level=1),
625
dbus.String(u"created"):
626
self._datetime_to_dbus(self.created,
628
dbus.String(u"last_enabled"):
629
(self._datetime_to_dbus(self.last_enabled,
631
if self.last_enabled is not None
632
else dbus.Boolean(False, variant_level=1)),
633
dbus.String(u"enabled"):
634
dbus.Boolean(self.enabled, variant_level=1),
635
dbus.String(u"last_checked_ok"):
636
(self._datetime_to_dbus(self.last_checked_ok,
638
if self.last_checked_ok is not None
639
else dbus.Boolean (False, variant_level=1)),
640
dbus.String(u"timeout"):
641
dbus.UInt64(self.timeout_milliseconds(),
643
dbus.String(u"interval"):
644
dbus.UInt64(self.interval_milliseconds(),
646
dbus.String(u"checker"):
647
dbus.String(self.checker_command,
649
dbus.String(u"checker_running"):
650
dbus.Boolean(self.checker is not None,
652
dbus.String(u"object_path"):
653
dbus.ObjectPath(self.dbus_object_path,
657
# IsStillValid - method
658
@dbus.service.method(_interface, out_signature=u"b")
659
def IsStillValid(self):
660
return self.still_valid()
662
# PropertyChanged - signal
663
@dbus.service.signal(_interface, signature=u"sv")
664
def PropertyChanged(self, property, value):
668
# ReceivedSecret - signal
669
@dbus.service.signal(_interface)
670
def ReceivedSecret(self):
675
@dbus.service.signal(_interface)
680
# SetChecker - method
681
@dbus.service.method(_interface, in_signature=u"s")
682
def SetChecker(self, checker):
683
"D-Bus setter method"
684
self.checker_command = checker
686
self.PropertyChanged(dbus.String(u"checker"),
687
dbus.String(self.checker_command,
691
@dbus.service.method(_interface, in_signature=u"s")
692
def SetHost(self, host):
693
"D-Bus setter method"
696
self.PropertyChanged(dbus.String(u"host"),
697
dbus.String(self.host, variant_level=1))
699
# SetInterval - method
700
@dbus.service.method(_interface, in_signature=u"t")
701
def SetInterval(self, milliseconds):
702
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
704
self.PropertyChanged(dbus.String(u"interval"),
705
(dbus.UInt64(self.interval_milliseconds(),
709
@dbus.service.method(_interface, in_signature=u"ay",
711
def SetSecret(self, secret):
712
"D-Bus setter method"
713
self.secret = str(secret)
715
# SetTimeout - method
716
@dbus.service.method(_interface, in_signature=u"t")
717
def SetTimeout(self, milliseconds):
718
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
720
self.PropertyChanged(dbus.String(u"timeout"),
721
(dbus.UInt64(self.timeout_milliseconds(),
725
@dbus.service.method(_interface)
730
# StartChecker - method
731
@dbus.service.method(_interface)
732
def StartChecker(self):
737
@dbus.service.method(_interface)
742
# StopChecker - method
743
@dbus.service.method(_interface)
744
def StopChecker(self):
750
class ClientHandler(socketserver.BaseRequestHandler, object):
751
"""A class to handle client connections.
753
Instantiated once for each connection to handle it.
381
def peer_certificate(session):
382
"Return the peer's OpenPGP certificate as a bytestring"
383
# If not an OpenPGP certificate...
384
if gnutls.library.functions.gnutls_certificate_type_get\
385
(session._c_object) \
386
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
387
# ...do the normal thing
388
return session.peer_certificate
389
list_size = ctypes.c_uint()
390
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
391
(session._c_object, ctypes.byref(list_size))
392
if list_size.value == 0:
395
return ctypes.string_at(cert.data, cert.size)
398
def fingerprint(openpgp):
399
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
400
# New GnuTLS "datum" with the OpenPGP public key
401
datum = gnutls.library.types.gnutls_datum_t\
402
(ctypes.cast(ctypes.c_char_p(openpgp),
403
ctypes.POINTER(ctypes.c_ubyte)),
404
ctypes.c_uint(len(openpgp)))
405
# New empty GnuTLS certificate
406
crt = gnutls.library.types.gnutls_openpgp_crt_t()
407
gnutls.library.functions.gnutls_openpgp_crt_init\
409
# Import the OpenPGP public key into the certificate
410
gnutls.library.functions.gnutls_openpgp_crt_import\
411
(crt, ctypes.byref(datum),
412
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
413
# Verify the self signature in the key
414
crtverify = ctypes.c_uint();
415
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
416
(crt, ctypes.c_uint(0), ctypes.byref(crtverify))
417
if crtverify.value != 0:
418
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
419
raise gnutls.errors.CertificateSecurityError("Verify failed")
420
# New buffer for the fingerprint
421
buffer = ctypes.create_string_buffer(20)
422
buffer_length = ctypes.c_size_t()
423
# Get the fingerprint from the certificate into the buffer
424
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
425
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
426
# Deinit the certificate
427
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
428
# Convert the buffer to a Python bytestring
429
fpr = ctypes.string_at(buffer, buffer_length.value)
430
# Convert the bytestring to hexadecimal notation
431
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
435
class tcp_handler(SocketServer.BaseRequestHandler, object):
436
"""A TCP request handler class.
437
Instantiated by IPv6_TCPServer for each request to handle it.
754
438
Note: This will run in its own forked process."""
756
440
def handle(self):
757
441
logger.info(u"TCP connection from: %s",
758
unicode(self.client_address))
759
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
# Open IPC pipe to parent process
761
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
762
session = (gnutls.connection
763
.ClientSession(self.request,
767
line = self.request.makefile().readline()
768
logger.debug(u"Protocol version: %r", line)
770
if int(line.strip().split()[0]) > 1:
772
except (ValueError, IndexError, RuntimeError), error:
773
logger.error(u"Unknown protocol version: %s", error)
776
# Note: gnutls.connection.X509Credentials is really a
777
# generic GnuTLS certificate credentials object so long as
778
# no X.509 keys are added to it. Therefore, we can use it
779
# here despite using OpenPGP certificates.
781
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
# u"+AES-256-CBC", u"+SHA1",
783
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
785
# Use a fallback default, since this MUST be set.
786
priority = self.server.gnutls_priority
789
(gnutls.library.functions
790
.gnutls_priority_set_direct(session._c_object,
795
except gnutls.errors.GNUTLSError, error:
796
logger.warning(u"Handshake failed: %s", error)
797
# Do not run session.bye() here: the session is not
798
# established. Just abandon the request.
800
logger.debug(u"Handshake succeeded")
802
fpr = self.fingerprint(self.peer_certificate(session))
803
except (TypeError, gnutls.errors.GNUTLSError), error:
804
logger.warning(u"Bad certificate: %s", error)
807
logger.debug(u"Fingerprint: %s", fpr)
809
for c in self.server.clients:
810
if c.fingerprint == fpr:
814
ipc.write(u"NOTFOUND %s %s\n"
815
% (fpr, unicode(self.client_address)))
818
# Have to check if client.still_valid(), since it is
819
# possible that the client timed out while establishing
820
# the GnuTLS session.
821
if not client.still_valid():
822
ipc.write(u"INVALID %s\n" % client.name)
825
ipc.write(u"SENDING %s\n" % client.name)
827
while sent_size < len(client.secret):
828
sent = session.send(client.secret[sent_size:])
829
logger.debug(u"Sent: %d, remaining: %d",
830
sent, len(client.secret)
831
- (sent_size + sent))
836
def peer_certificate(session):
837
"Return the peer's OpenPGP certificate as a bytestring"
838
# If not an OpenPGP certificate...
839
if (gnutls.library.functions
840
.gnutls_certificate_type_get(session._c_object)
841
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
842
# ...do the normal thing
843
return session.peer_certificate
844
list_size = ctypes.c_uint(1)
845
cert_list = (gnutls.library.functions
846
.gnutls_certificate_get_peers
847
(session._c_object, ctypes.byref(list_size)))
848
if not bool(cert_list) and list_size.value != 0:
849
raise gnutls.errors.GNUTLSError(u"error getting peer"
851
if list_size.value == 0:
854
return ctypes.string_at(cert.data, cert.size)
857
def fingerprint(openpgp):
858
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
859
# New GnuTLS "datum" with the OpenPGP public key
860
datum = (gnutls.library.types
861
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
864
ctypes.c_uint(len(openpgp))))
865
# New empty GnuTLS certificate
866
crt = gnutls.library.types.gnutls_openpgp_crt_t()
867
(gnutls.library.functions
868
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
869
# Import the OpenPGP public key into the certificate
870
(gnutls.library.functions
871
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
872
gnutls.library.constants
873
.GNUTLS_OPENPGP_FMT_RAW))
874
# Verify the self signature in the key
875
crtverify = ctypes.c_uint()
876
(gnutls.library.functions
877
.gnutls_openpgp_crt_verify_self(crt, 0,
878
ctypes.byref(crtverify)))
879
if crtverify.value != 0:
880
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
881
raise (gnutls.errors.CertificateSecurityError
883
# New buffer for the fingerprint
884
buf = ctypes.create_string_buffer(20)
885
buf_len = ctypes.c_size_t()
886
# Get the fingerprint from the certificate into the buffer
887
(gnutls.library.functions
888
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
889
ctypes.byref(buf_len)))
890
# Deinit the certificate
891
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
892
# Convert the buffer to a Python bytestring
893
fpr = ctypes.string_at(buf, buf_len.value)
894
# Convert the bytestring to hexadecimal notation
895
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
899
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
900
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
901
def process_request(self, request, client_address):
902
"""Overrides and wraps the original process_request().
904
This function creates a new pipe in self.pipe
906
self.pipe = os.pipe()
907
super(ForkingMixInWithPipe,
908
self).process_request(request, client_address)
909
os.close(self.pipe[1]) # close write end
910
self.add_pipe(self.pipe[0])
911
def add_pipe(self, pipe):
912
"""Dummy function; override as necessary"""
916
class IPv6_TCPServer(ForkingMixInWithPipe,
917
socketserver.TCPServer, object):
918
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
442
unicode(self.client_address))
443
session = gnutls.connection.ClientSession\
444
(self.request, gnutls.connection.X509Credentials())
446
line = self.request.makefile().readline()
447
logger.debug(u"Protocol version: %r", line)
449
if int(line.strip().split()[0]) > 1:
451
except (ValueError, IndexError, RuntimeError), error:
452
logger.error(u"Unknown protocol version: %s", error)
455
# Note: gnutls.connection.X509Credentials is really a generic
456
# GnuTLS certificate credentials object so long as no X.509
457
# keys are added to it. Therefore, we can use it here despite
458
# using OpenPGP certificates.
460
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
461
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
463
priority = "NORMAL" # Fallback default, since this
465
if self.server.settings["priority"]:
466
priority = self.server.settings["priority"]
467
gnutls.library.functions.gnutls_priority_set_direct\
468
(session._c_object, priority, None);
472
except gnutls.errors.GNUTLSError, error:
473
logger.warning(u"Handshake failed: %s", error)
474
# Do not run session.bye() here: the session is not
475
# established. Just abandon the request.
478
fpr = fingerprint(peer_certificate(session))
479
except (TypeError, gnutls.errors.GNUTLSError), error:
480
logger.warning(u"Bad certificate: %s", error)
483
logger.debug(u"Fingerprint: %s", fpr)
485
for c in self.server.clients:
486
if c.fingerprint == fpr:
490
logger.warning(u"Client not found for fingerprint: %s",
494
# Have to check if client.still_valid(), since it is possible
495
# that the client timed out while establishing the GnuTLS
497
if not client.still_valid():
498
logger.warning(u"Client %(name)s is invalid",
503
while sent_size < len(client.secret):
504
sent = session.send(client.secret[sent_size:])
505
logger.debug(u"Sent: %d, remaining: %d",
506
sent, len(client.secret)
507
- (sent_size + sent))
512
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
513
"""IPv6 TCP server. Accepts 'None' as address and/or port.
921
enabled: Boolean; whether this server is activated yet
922
interface: None or a network interface name (string)
923
use_ipv6: Boolean; to use IPv6 or not
515
settings: Server settings
516
clients: Set() of Client objects
925
def __init__(self, server_address, RequestHandlerClass,
926
interface=None, use_ipv6=True):
927
self.interface = interface
929
self.address_family = socket.AF_INET6
930
socketserver.TCPServer.__init__(self, server_address,
518
address_family = socket.AF_INET6
519
def __init__(self, *args, **kwargs):
520
if "settings" in kwargs:
521
self.settings = kwargs["settings"]
522
del kwargs["settings"]
523
if "clients" in kwargs:
524
self.clients = kwargs["clients"]
525
del kwargs["clients"]
526
return super(type(self), self).__init__(*args, **kwargs)
932
527
def server_bind(self):
933
528
"""This overrides the normal server_bind() function
934
529
to bind to an interface if one was specified, and also NOT to
935
530
bind to an address or port if they were not specified."""
936
if self.interface is not None:
937
if SO_BINDTODEVICE is None:
938
logger.error(u"SO_BINDTODEVICE does not exist;"
939
u" cannot bind to interface %s",
943
self.socket.setsockopt(socket.SOL_SOCKET,
947
except socket.error, error:
948
if error[0] == errno.EPERM:
949
logger.error(u"No permission to"
950
u" bind to interface %s",
952
elif error[0] == errno.ENOPROTOOPT:
953
logger.error(u"SO_BINDTODEVICE not available;"
954
u" cannot bind to interface %s",
531
if self.settings["interface"]:
532
# 25 is from /usr/include/asm-i486/socket.h
533
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
535
self.socket.setsockopt(socket.SOL_SOCKET,
537
self.settings["interface"])
538
except socket.error, error:
539
if error[0] == errno.EPERM:
540
logger.error(u"No permission to"
541
u" bind to interface %s",
542
self.settings["interface"])
958
545
# Only bind(2) the socket if we really need to.
959
546
if self.server_address[0] or self.server_address[1]:
960
547
if not self.server_address[0]:
961
if self.address_family == socket.AF_INET6:
962
any_address = u"::" # in6addr_any
964
any_address = socket.INADDR_ANY
965
self.server_address = (any_address,
549
self.server_address = (in6addr_any,
966
550
self.server_address[1])
967
551
elif not self.server_address[1]:
968
552
self.server_address = (self.server_address[0],
554
# if self.settings["interface"]:
971
555
# self.server_address = (self.server_address[0],
976
return socketserver.TCPServer.server_bind(self)
979
class MandosServer(IPv6_TCPServer):
983
clients: set of Client objects
984
gnutls_priority GnuTLS priority string
985
use_dbus: Boolean; to emit D-Bus signals or not
986
clients: set of Client objects
987
gnutls_priority GnuTLS priority string
988
use_dbus: Boolean; to emit D-Bus signals or not
990
Assumes a gobject.MainLoop event loop.
992
def __init__(self, server_address, RequestHandlerClass,
993
interface=None, use_ipv6=True, clients=None,
994
gnutls_priority=None, use_dbus=True):
996
self.clients = clients
997
if self.clients is None:
999
self.use_dbus = use_dbus
1000
self.gnutls_priority = gnutls_priority
1001
IPv6_TCPServer.__init__(self, server_address,
1002
RequestHandlerClass,
1003
interface = interface,
1004
use_ipv6 = use_ipv6)
1005
def server_activate(self):
1007
return socketserver.TCPServer.server_activate(self)
1010
def add_pipe(self, pipe):
1011
# Call "handle_ipc" for both data and EOF events
1012
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1014
def handle_ipc(self, source, condition, file_objects={}):
1016
gobject.IO_IN: u"IN", # There is data to read.
1017
gobject.IO_OUT: u"OUT", # Data can be written (without
1019
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1020
gobject.IO_ERR: u"ERR", # Error condition.
1021
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1022
# broken, usually for pipes and
1025
conditions_string = ' | '.join(name
1027
condition_names.iteritems()
1028
if cond & condition)
1029
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1032
# Turn the pipe file descriptor into a Python file object
1033
if source not in file_objects:
1034
file_objects[source] = os.fdopen(source, u"r", 1)
1036
# Read a line from the file object
1037
cmdline = file_objects[source].readline()
1038
if not cmdline: # Empty line means end of file
1039
# close the IPC pipe
1040
file_objects[source].close()
1041
del file_objects[source]
1043
# Stop calling this function
1046
logger.debug(u"IPC command: %r", cmdline)
1048
# Parse and act on command
1049
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1051
if cmd == u"NOTFOUND":
1052
logger.warning(u"Client not found for fingerprint: %s",
1056
mandos_dbus_service.ClientNotFound(args)
1057
elif cmd == u"INVALID":
1058
for client in self.clients:
1059
if client.name == args:
1060
logger.warning(u"Client %s is invalid", args)
1066
logger.error(u"Unknown client %s is invalid", args)
1067
elif cmd == u"SENDING":
1068
for client in self.clients:
1069
if client.name == args:
1070
logger.info(u"Sending secret to %s", client.name)
1074
client.ReceivedSecret()
1077
logger.error(u"Sending secret to unknown client %s",
1080
logger.error(u"Unknown IPC command: %r", cmdline)
1082
# Keep calling this function
561
return super(type(self), self).server_bind()
1086
564
def string_to_delta(interval):
1087
565
"""Parse a string and return a datetime.timedelta
1089
>>> string_to_delta(u'7d')
567
>>> string_to_delta('7d')
1090
568
datetime.timedelta(7)
1091
>>> string_to_delta(u'60s')
569
>>> string_to_delta('60s')
1092
570
datetime.timedelta(0, 60)
1093
>>> string_to_delta(u'60m')
571
>>> string_to_delta('60m')
1094
572
datetime.timedelta(0, 3600)
1095
>>> string_to_delta(u'24h')
573
>>> string_to_delta('24h')
1096
574
datetime.timedelta(1)
1097
575
>>> string_to_delta(u'1w')
1098
576
datetime.timedelta(7)
1099
>>> string_to_delta(u'5m 30s')
577
>>> string_to_delta('5m 30s')
1100
578
datetime.timedelta(0, 330)
1102
580
timevalue = datetime.timedelta(0)
1103
581
for s in interval.split():
1105
suffix = unicode(s[-1])
583
suffix=unicode(s[-1])
1107
585
if suffix == u"d":
1108
586
delta = datetime.timedelta(value)
1109
587
elif suffix == u"s":
1210
705
# Default values for config file for server-global settings
1211
server_defaults = { u"interface": u"",
1216
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1217
u"servicename": u"Mandos",
1218
u"use_dbus": u"True",
1219
u"use_ipv6": u"True",
706
server_defaults = { "interface": "",
711
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
712
"servicename": "Mandos",
1222
715
# Parse config file for server-global settings
1223
server_config = configparser.SafeConfigParser(server_defaults)
716
server_config = ConfigParser.SafeConfigParser(server_defaults)
1224
717
del server_defaults
1225
server_config.read(os.path.join(options.configdir,
718
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1227
719
# Convert the SafeConfigParser object to a dict
1228
720
server_settings = server_config.defaults()
1229
# Use the appropriate methods on the non-string config options
1230
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1231
server_settings[option] = server_config.getboolean(u"DEFAULT",
1233
if server_settings["port"]:
1234
server_settings["port"] = server_config.getint(u"DEFAULT",
721
# Use getboolean on the boolean config option
722
server_settings["debug"] = server_config.getboolean\
1236
724
del server_config
1238
726
# Override the settings from the config file with command line
1239
727
# options, if set.
1240
for option in (u"interface", u"address", u"port", u"debug",
1241
u"priority", u"servicename", u"configdir",
1242
u"use_dbus", u"use_ipv6"):
728
for option in ("interface", "address", "port", "debug",
729
"priority", "servicename", "configdir"):
1243
730
value = getattr(options, option)
1244
731
if value is not None:
1245
732
server_settings[option] = value
1247
# Force all strings to be unicode
1248
for option in server_settings.keys():
1249
if type(server_settings[option]) is str:
1250
server_settings[option] = unicode(server_settings[option])
1251
734
# Now we have our good server settings in "server_settings"
1253
##################################################################
1256
debug = server_settings[u"debug"]
1257
use_dbus = server_settings[u"use_dbus"]
1258
use_ipv6 = server_settings[u"use_ipv6"]
736
debug = server_settings["debug"]
1261
739
syslogger.setLevel(logging.WARNING)
1262
740
console.setLevel(logging.WARNING)
1264
if server_settings[u"servicename"] != u"Mandos":
1265
syslogger.setFormatter(logging.Formatter
1266
(u'Mandos (%s) [%%(process)d]:'
1267
u' %%(levelname)s: %%(message)s'
1268
% server_settings[u"servicename"]))
742
if server_settings["servicename"] != "Mandos":
743
syslogger.setFormatter(logging.Formatter\
744
('Mandos (%s): %%(levelname)s:'
746
% server_settings["servicename"]))
1270
748
# Parse config file with clients
1271
client_defaults = { u"timeout": u"1h",
1273
u"checker": u"fping -q -- %%(host)s",
749
client_defaults = { "timeout": "1h",
751
"checker": "fping -q -- %(host)s",
1276
client_config = configparser.SafeConfigParser(client_defaults)
1277
client_config.read(os.path.join(server_settings[u"configdir"],
1280
global mandos_dbus_service
1281
mandos_dbus_service = None
1283
tcp_server = MandosServer((server_settings[u"address"],
1284
server_settings[u"port"]),
1286
interface=server_settings[u"interface"],
1289
server_settings[u"priority"],
1291
pidfilename = u"/var/run/mandos.pid"
1293
pidfile = open(pidfilename, u"w")
1295
logger.error(u"Could not open file %r", pidfilename)
1298
uid = pwd.getpwnam(u"_mandos").pw_uid
1299
gid = pwd.getpwnam(u"_mandos").pw_gid
1302
uid = pwd.getpwnam(u"mandos").pw_uid
1303
gid = pwd.getpwnam(u"mandos").pw_gid
1306
uid = pwd.getpwnam(u"nobody").pw_uid
1307
gid = pwd.getpwnam(u"nobody").pw_gid
1314
except OSError, error:
1315
if error[0] != errno.EPERM:
1318
# Enable all possible GnuTLS debugging
1320
# "Use a log level over 10 to enable all debugging options."
1322
gnutls.library.functions.gnutls_global_set_log_level(11)
1324
@gnutls.library.types.gnutls_log_func
1325
def debug_gnutls(level, string):
1326
logger.debug(u"GnuTLS: %s", string[:-1])
1328
(gnutls.library.functions
1329
.gnutls_global_set_log_function(debug_gnutls))
754
client_config = ConfigParser.SafeConfigParser(client_defaults)
755
client_config.read(os.path.join(server_settings["configdir"],
759
service = AvahiService(name = server_settings["servicename"],
760
type = "_mandos._tcp", );
761
if server_settings["interface"]:
762
service.interface = if_nametoindex(server_settings["interface"])
1331
764
global main_loop
1332
767
# From the Avahi example code
1333
768
DBusGMainLoop(set_as_default=True )
1334
769
main_loop = gobject.MainLoop()
1335
770
bus = dbus.SystemBus()
771
server = dbus.Interface(
772
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
773
avahi.DBUS_INTERFACE_SERVER )
1336
774
# End of Avahi example code
1338
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1339
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1340
service = AvahiService(name = server_settings[u"servicename"],
1341
servicetype = u"_mandos._tcp",
1342
protocol = protocol, bus = bus)
1343
if server_settings["interface"]:
1344
service.interface = (if_nametoindex
1345
(str(server_settings[u"interface"])))
1347
client_class = Client
1349
client_class = functools.partial(ClientDBus, bus = bus)
1350
tcp_server.clients.update(set(
1351
client_class(name = section,
1352
config= dict(client_config.items(section)))
1353
for section in client_config.sections()))
1354
if not tcp_server.clients:
1355
logger.warning(u"No clients defined")
777
def remove_from_clients(client):
778
clients.remove(client)
780
logger.critical(u"No clients left, exiting")
783
clients.update(Set(Client(name = section,
784
stop_hook = remove_from_clients,
786
= dict(client_config.items(section)))
787
for section in client_config.sections()))
789
logger.critical(u"No clients defined")
1358
793
# Redirect stdin so all checkers get /dev/null