23
19
from sets import Set
31
25
from dbus.mainloop.glib import DBusGMainLoop
35
import logging.handlers
37
logger = logging.Logger('mandos')
38
syslogger = logging.handlers.SysLogHandler\
39
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
40
syslogger.setFormatter(logging.Formatter\
41
('%(levelname)s: %(message)s'))
42
logger.addHandler(syslogger)
45
# This variable is used to optionally bind to a specified interface.
46
# It is a global variable to fit in with the other variables from the
47
# Avahi server example code.
27
# This variable is used to optionally bind to a specified
48
29
serviceInterface = avahi.IF_UNSPEC
49
# From the Avahi server example code:
30
# It is a global variable to fit in with the rest of the
31
# variables from the Avahi server example code:
50
32
serviceName = "Mandos"
51
33
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
52
34
servicePort = None # Not known at startup
62
44
class Client(object):
63
45
"""A representation of a client host served by this server.
65
name: string; from the config file, used in log messages
66
fingerprint: string (40 or 32 hexadecimal digits); used to
67
uniquely identify the client
68
secret: bytestring; sent verbatim (over TLS) to client
69
fqdn: string (FQDN); available for use by the checker command
48
fqdn: string, FQDN (used by the checker)
70
49
created: datetime.datetime()
71
50
last_seen: datetime.datetime() or None if not yet seen
72
51
timeout: datetime.timedelta(); How long from last_seen until
73
52
this client is invalid
74
53
interval: datetime.timedelta(); How often to start a new checker
54
timeout_milliseconds: Used by gobject.timeout_add()
55
interval_milliseconds: - '' -
75
56
stop_hook: If set, called by stop() as stop_hook(self)
76
57
checker: subprocess.Popen(); a running checker process used
77
58
to see if the client lives.
79
60
checker_initiator_tag: a gobject event source tag, or None
80
61
stop_initiator_tag: - '' -
81
62
checker_callback_tag: - '' -
82
checker_command: string; External command which is run to check if
83
client lives. %()s expansions are done at
84
runtime with vars(self) as dict, so that for
85
instance %(name)s can be used in the command.
87
_timeout: Real variable for 'timeout'
88
_interval: Real variable for 'interval'
89
_timeout_milliseconds: Used by gobject.timeout_add()
90
_interval_milliseconds: - '' -
92
def _set_timeout(self, timeout):
93
"Setter function for 'timeout' attribute"
94
self._timeout = timeout
95
self._timeout_milliseconds = ((self.timeout.days
96
* 24 * 60 * 60 * 1000)
97
+ (self.timeout.seconds * 1000)
98
+ (self.timeout.microseconds
100
timeout = property(lambda self: self._timeout,
103
def _set_interval(self, interval):
104
"Setter function for 'interval' attribute"
105
self._interval = interval
106
self._interval_milliseconds = ((self.interval.days
107
* 24 * 60 * 60 * 1000)
108
+ (self.interval.seconds
110
+ (self.interval.microseconds
112
interval = property(lambda self: self._interval,
115
64
def __init__(self, name=None, options=None, stop_hook=None,
116
fingerprint=None, secret=None, secfile=None,
117
fqdn=None, timeout=None, interval=-1, checker=None):
65
dn=None, password=None, passfile=None, fqdn=None,
66
timeout=None, interval=-1):
119
# Uppercase and remove spaces from fingerprint
120
# for later comparison purposes with return value of
121
# the fingerprint() function
122
self.fingerprint = fingerprint.upper().replace(u" ", u"")
124
self.secret = secret.decode(u"base64")
127
self.secret = sf.read()
70
self.password = password
72
self.password = open(passfile).readall()
130
raise RuntimeError(u"No secret or secfile for client %s"
74
raise RuntimeError(u"No Password or Passfile for client %s"
132
76
self.fqdn = fqdn # string
133
77
self.created = datetime.datetime.now()
134
78
self.last_seen = None
135
79
if timeout is None:
136
self.timeout = options.timeout
138
self.timeout = string_to_delta(timeout)
80
timeout = options.timeout
81
self.timeout = timeout
82
self.timeout_milliseconds = ((self.timeout.days
83
* 24 * 60 * 60 * 1000)
84
+ (self.timeout.seconds * 1000)
85
+ (self.timeout.microseconds
139
87
if interval == -1:
140
self.interval = options.interval
88
interval = options.interval
142
self.interval = string_to_delta(interval)
90
interval = string_to_delta(interval)
91
self.interval = interval
92
self.interval_milliseconds = ((self.interval.days
93
* 24 * 60 * 60 * 1000)
94
+ (self.interval.seconds * 1000)
95
+ (self.interval.microseconds
143
97
self.stop_hook = stop_hook
144
98
self.checker = None
145
99
self.checker_initiator_tag = None
146
100
self.stop_initiator_tag = None
147
101
self.checker_callback_tag = None
148
self.check_command = checker
150
103
"""Start this clients checker and timeout hooks"""
151
104
# Schedule a new checker to be started an 'interval' from now,
152
105
# and every interval from then on.
153
self.checker_initiator_tag = gobject.timeout_add\
154
(self._interval_milliseconds,
106
self.checker_initiator_tag = gobject.\
107
timeout_add(self.interval_milliseconds,
156
109
# Also start a new checker *right now*.
157
110
self.start_checker()
158
111
# Schedule a stop() when 'timeout' has passed
159
self.stop_initiator_tag = gobject.timeout_add\
160
(self._timeout_milliseconds,
112
self.stop_initiator_tag = gobject.\
113
timeout_add(self.timeout_milliseconds,
163
116
"""Stop this client.
164
117
The possibility that this client might be restarted is left
165
118
open, but not currently used."""
166
logger.debug(u"Stopping client %s", self.name)
119
# print "Stopping client", self.name
168
121
if self.stop_initiator_tag:
169
122
gobject.source_remove(self.stop_initiator_tag)
170
123
self.stop_initiator_tag = None
192
145
now = datetime.datetime.now()
193
146
if os.WIFEXITED(condition) \
194
147
and (os.WEXITSTATUS(condition) == 0):
195
logger.debug(u"Checker for %(name)s succeeded",
148
#print "Checker for %(name)s succeeded" % vars(self)
197
149
self.last_seen = now
198
150
gobject.source_remove(self.stop_initiator_tag)
199
self.stop_initiator_tag = gobject.timeout_add\
200
(self._timeout_milliseconds,
202
elif not os.WIFEXITED(condition):
203
logger.warning(u"Checker for %(name)s crashed?",
206
logger.debug(u"Checker for %(name)s failed",
151
self.stop_initiator_tag = gobject.\
152
timeout_add(self.timeout_milliseconds,
155
# if not os.WIFEXITED(condition):
156
# print "Checker for %(name)s crashed?" % vars(self)
158
# print "Checker for %(name)s failed" % vars(self)
209
160
self.checker_callback_tag = None
210
161
def start_checker(self):
211
162
"""Start a new checker subprocess if one is not running.
212
163
If a checker already exists, leave it running and do
214
165
if self.checker is None:
216
command = self.check_command % self.fqdn
218
escaped_attrs = dict((key, re.escape(str(val)))
220
vars(self).iteritems())
222
command = self.check_command % escaped_attrs
223
except TypeError, error:
224
logger.critical(u'Could not format string "%s":'
225
u' %s', self.check_command, error)
226
return True # Try again later
228
logger.debug(u"Starting checker %r for %s",
166
#print "Starting checker for", self.name
230
168
self.checker = subprocess.\
169
Popen("sleep 1; fping -q -- %s"
170
% re.escape(self.fqdn),
171
stdout=subprocess.PIPE,
232
172
close_fds=True, shell=True,
234
self.checker_callback_tag = gobject.child_watch_add\
236
self.checker_callback)
174
self.checker_callback_tag = gobject.\
175
child_watch_add(self.checker.pid,
237
178
except subprocess.OSError, error:
238
logger.error(u"Failed to start subprocess: %s",
179
sys.stderr.write(u"Failed to start subprocess: %s\n"
240
181
# Re-run this periodically if run by gobject.timeout_add
242
183
def stop_checker(self):
259
200
return now < (self.last_seen + self.timeout)
262
def peer_certificate(session):
263
"Return an OpenPGP data packet string for the peer's certificate"
264
# If not an OpenPGP certificate...
265
if gnutls.library.functions.gnutls_certificate_type_get\
266
(session._c_object) \
267
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
268
# ...do the normal thing
269
return session.peer_certificate
270
list_size = ctypes.c_uint()
271
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
272
(session._c_object, ctypes.byref(list_size))
273
if list_size.value == 0:
276
return ctypes.string_at(cert.data, cert.size)
279
def fingerprint(openpgp):
280
"Convert an OpenPGP data string to a hexdigit fingerprint string"
281
# New empty GnuTLS certificate
282
crt = gnutls.library.types.gnutls_openpgp_crt_t()
283
gnutls.library.functions.gnutls_openpgp_crt_init\
285
# New GnuTLS "datum" with the OpenPGP public key
286
datum = gnutls.library.types.gnutls_datum_t\
287
(ctypes.cast(ctypes.c_char_p(openpgp),
288
ctypes.POINTER(ctypes.c_ubyte)),
289
ctypes.c_uint(len(openpgp)))
290
# Import the OpenPGP public key into the certificate
291
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
294
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
295
# New buffer for the fingerprint
296
buffer = ctypes.create_string_buffer(20)
297
buffer_length = ctypes.c_size_t()
298
# Get the fingerprint from the certificate into the buffer
299
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
300
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
301
# Deinit the certificate
302
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
303
# Convert the buffer to a Python bytestring
304
fpr = ctypes.string_at(buffer, buffer_length.value)
305
# Convert the bytestring to hexadecimal notation
306
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
310
203
class tcp_handler(SocketServer.BaseRequestHandler, object):
311
204
"""A TCP request handler class.
312
205
Instantiated by IPv6_TCPServer for each request to handle it.
313
206
Note: This will run in its own forked process."""
315
207
def handle(self):
316
logger.debug(u"TCP connection from: %s",
317
unicode(self.client_address))
318
session = gnutls.connection.ClientSession(self.request,
322
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
323
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
325
priority = "SECURE256"
327
gnutls.library.functions.gnutls_priority_set_direct\
328
(session._c_object, priority, None);
208
#print u"TCP request came"
209
#print u"Request:", self.request
210
#print u"Client Address:", self.client_address
211
#print u"Server:", self.server
212
session = gnutls.connection.ServerSession(self.request,
331
216
session.handshake()
332
217
except gnutls.errors.GNUTLSError, error:
333
logger.debug(u"Handshake failed: %s", error)
218
#sys.stderr.write(u"Handshake failed: %s\n" % error)
334
219
# Do not run session.bye() here: the session is not
335
220
# established. Just abandon the request.
222
#if session.peer_certificate:
223
# print "DN:", session.peer_certificate.subject
338
fpr = fingerprint(peer_certificate(session))
339
except (TypeError, gnutls.errors.GNUTLSError), error:
340
logger.debug(u"Bad certificate: %s", error)
225
session.verify_peer()
226
except gnutls.errors.CertificateError, error:
227
#sys.stderr.write(u"Verify failed: %s\n" % error)
343
logger.debug(u"Fingerprint: %s", fpr)
345
231
for c in clients:
346
if c.fingerprint == fpr:
232
if c.dn == session.peer_certificate.subject:
349
235
# Have to check if client.still_valid(), since it is possible
350
236
# that the client timed out while establishing the GnuTLS
352
if (not client) or (not client.still_valid()):
354
logger.debug(u"Client %(name)s is invalid",
357
logger.debug(u"Client not found for fingerprint: %s",
362
while sent_size < len(client.secret):
363
sent = session.send(client.secret[sent_size:])
364
logger.debug(u"Sent: %d, remaining: %d",
365
sent, len(client.secret)
366
- (sent_size + sent))
238
if client and client.still_valid():
239
session.send(client.password)
242
# sys.stderr.write(u"Client %(name)s is invalid\n"
245
# sys.stderr.write(u"Client not found for DN: %s\n"
246
# % session.peer_certificate.subject)
247
#session.send("gazonk")
494
379
"""From the Avahi server example code"""
495
380
global serviceName, server, rename_count
497
logger.debug(u"state change: %i", state)
382
# print "state change: %i" % state
499
384
if state == avahi.ENTRY_GROUP_ESTABLISHED:
500
logger.debug(u"Service established.")
386
# print "Service established."
501
387
elif state == avahi.ENTRY_GROUP_COLLISION:
503
389
rename_count = rename_count - 1
504
390
if rename_count > 0:
505
391
name = server.GetAlternativeServiceName(name)
506
logger.warning(u"Service name collision, "
507
u"changing name to '%s' ...", name)
392
print "WARNING: Service name collision, changing name to '%s' ..." % name
512
logger.error(u"No suitable service name found after %i"
513
u" retries, exiting.", n_rename)
397
print "ERROR: No suitable service name found after %i retries, exiting." % n_rename
515
399
elif state == avahi.ENTRY_GROUP_FAILURE:
516
logger.error(u"Error in group state changed %s",
400
print "Error in group state changed", error
521
405
def if_nametoindex(interface):
522
406
"""Call the C function if_nametoindex()"""
408
if "ctypes" not in sys.modules:
524
410
libc = ctypes.cdll.LoadLibrary("libc.so.6")
525
411
return libc.if_nametoindex(interface)
526
except (OSError, AttributeError):
412
except (ImportError, OSError, AttributeError):
527
413
if "struct" not in sys.modules:
529
415
if "fcntl" not in sys.modules:
537
423
return interface_index
540
def daemon(nochdir, noclose):
541
"""See daemon(3). Standard BSD Unix function.
542
This should really exist as os.daemon, but it doesn't (yet)."""
549
# Close all standard open file descriptors
550
null = os.open("/dev/null", os.O_NOCTTY | os.O_RDWR)
551
if not stat.S_ISCHR(os.fstat(null).st_mode):
552
raise OSError(errno.ENODEV,
553
"/dev/null not a character device")
554
os.dup2(null, sys.stdin.fileno())
555
os.dup2(null, sys.stdout.fileno())
556
os.dup2(null, sys.stderr.fileno())
561
def killme(status = 0):
562
logger.debug("Stopping server with exit status %d", status)
564
if main_loop_started:
570
426
if __name__ == '__main__':
572
main_loop_started = False
573
427
parser = OptionParser()
574
428
parser.add_option("-i", "--interface", type="string",
575
429
default=None, metavar="IF",
576
430
help="Bind to interface IF")
431
parser.add_option("--cert", type="string", default="cert.pem",
433
help="Public key certificate PEM file to use")
434
parser.add_option("--key", type="string", default="key.pem",
436
help="Private key PEM file to use")
437
parser.add_option("--ca", type="string", default="ca.pem",
439
help="Certificate Authority certificate PEM file to use")
440
parser.add_option("--crl", type="string", default="crl.pem",
442
help="Certificate Revokation List PEM file to use")
577
443
parser.add_option("-p", "--port", type="int", default=None,
578
444
help="Port number to receive requests on")
579
445
parser.add_option("--timeout", type="string", # Parsed later
618
488
avahi.DBUS_INTERFACE_SERVER )
619
489
# End of Avahi example code
621
debug = options.debug
624
console = logging.StreamHandler()
625
# console.setLevel(logging.DEBUG)
626
console.setFormatter(logging.Formatter\
627
('%(levelname)s: %(message)s'))
628
logger.addHandler(console)
632
492
def remove_from_clients(client):
633
493
clients.remove(client)
635
logger.debug(u"No clients left, exiting")
495
print "No clients left, exiting"
638
498
clients.update(Set(Client(name=section, options=options,
639
499
stop_hook = remove_from_clients,
640
500
**(dict(client_config\
641
501
.items(section))))
642
502
for section in client_config.sections()))
648
"Cleanup function; run on exit"
650
# From the Avahi server example code
651
if not group is None:
654
# End of Avahi example code
656
for client in clients:
657
client.stop_hook = None
660
atexit.register(cleanup)
663
signal.signal(signal.SIGINT, signal.SIG_IGN)
664
signal.signal(signal.SIGHUP, lambda signum, frame: killme())
665
signal.signal(signal.SIGTERM, lambda signum, frame: killme())
667
503
for client in clients:
670
506
tcp_server = IPv6_TCPServer((None, options.port),
674
511
# Find out what random port we got
675
512
servicePort = tcp_server.socket.getsockname()[1]
676
logger.debug(u"Now listening on port %d", servicePort)
513
#sys.stderr.write("Now listening on port %d\n" % servicePort)
678
515
if options.interface is not None:
679
516
serviceInterface = if_nametoindex(options.interface)
681
518
# From the Avahi server example code
682
519
server.connect_to_signal("StateChanged", server_state_changed)
684
server_state_changed(server.GetState())
685
except dbus.exceptions.DBusException, error:
686
logger.critical(u"DBusException: %s", error)
520
server_state_changed(server.GetState())
688
521
# End of Avahi example code
690
523
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,