174
168
# End of Avahi example code
177
def _datetime_to_dbus(dt, variant_level=0):
178
"""Convert a UTC datetime.datetime() to a D-Bus type."""
179
return dbus.String(dt.isoformat(), variant_level=variant_level)
182
171
class Client(object):
183
172
"""A representation of a client host served by this server.
185
name: string; from the config file, used in log messages and
174
name: string; from the config file, used in log messages
187
175
fingerprint: string (40 or 32 hexadecimal digits); used to
188
176
uniquely identify the client
189
secret: bytestring; sent verbatim (over TLS) to client
190
host: string; available for use by the checker command
191
created: datetime.datetime(); (UTC) object creation
192
last_enabled: datetime.datetime(); (UTC)
194
last_checked_ok: datetime.datetime(); (UTC) or None
195
timeout: datetime.timedelta(); How long from last_checked_ok
196
until this client is invalid
197
interval: datetime.timedelta(); How often to start a new checker
198
disable_hook: If set, called by disable() as disable_hook(self)
199
checker: subprocess.Popen(); a running checker process used
200
to see if the client lives.
201
'None' if no process is running.
177
secret: bytestring; sent verbatim (over TLS) to client
178
host: string; available for use by the checker command
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
181
timeout: datetime.timedelta(); How long from last_checked_ok
182
until this client is invalid
183
interval: datetime.timedelta(); How often to start a new checker
184
stop_hook: If set, called by stop() as stop_hook(self)
185
checker: subprocess.Popen(); a running checker process used
186
to see if the client lives.
187
'None' if no process is running.
202
188
checker_initiator_tag: a gobject event source tag, or None
203
disable_initiator_tag: - '' -
189
stop_initiator_tag: - '' -
204
190
checker_callback_tag: - '' -
205
191
checker_command: string; External command which is run to check if
206
192
client lives. %() expansions are done at
207
193
runtime with vars(self) as dict, so that for
208
194
instance %(name)s can be used in the command.
209
current_checker_command: string; current running checker_command
196
_timeout: Real variable for 'timeout'
197
_interval: Real variable for 'interval'
198
_timeout_milliseconds: Used when calling gobject.timeout_add()
199
_interval_milliseconds: - '' -
211
def timeout_milliseconds(self):
212
"Return the 'timeout' attribute in milliseconds"
213
return ((self.timeout.days * 24 * 60 * 60 * 1000)
214
+ (self.timeout.seconds * 1000)
215
+ (self.timeout.microseconds // 1000))
217
def interval_milliseconds(self):
218
"Return the 'interval' attribute in milliseconds"
219
return ((self.interval.days * 24 * 60 * 60 * 1000)
220
+ (self.interval.seconds * 1000)
221
+ (self.interval.microseconds // 1000))
223
def __init__(self, name = None, disable_hook=None, config=None):
201
def _set_timeout(self, timeout):
202
"Setter function for 'timeout' attribute"
203
self._timeout = timeout
204
self._timeout_milliseconds = ((self.timeout.days
205
* 24 * 60 * 60 * 1000)
206
+ (self.timeout.seconds * 1000)
207
+ (self.timeout.microseconds
209
timeout = property(lambda self: self._timeout,
212
def _set_interval(self, interval):
213
"Setter function for 'interval' attribute"
214
self._interval = interval
215
self._interval_milliseconds = ((self.interval.days
216
* 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds
219
+ (self.interval.microseconds
221
interval = property(lambda self: self._interval,
224
def __init__(self, name = None, stop_hook=None, config={}):
224
225
"""Note: the 'checker' key in 'config' sets the
225
226
'checker_command' attribute and *not* the 'checker'
230
229
logger.debug(u"Creating client %r", self.name)
231
230
# Uppercase and remove spaces from fingerprint for later
232
231
# comparison purposes with return value from the fingerprint()
234
self.fingerprint = (config["fingerprint"].upper()
233
self.fingerprint = config["fingerprint"].upper()\
236
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
237
236
if "secret" in config:
238
237
self.secret = config["secret"].decode(u"base64")
239
238
elif "secfile" in config:
240
with closing(open(os.path.expanduser
242
(config["secfile"])))) as secfile:
243
self.secret = secfile.read()
239
sf = open(config["secfile"])
240
self.secret = sf.read()
245
243
raise TypeError(u"No secret or secfile for client %s"
247
245
self.host = config.get("host", "")
248
self.created = datetime.datetime.utcnow()
250
self.last_enabled = None
246
self.created = datetime.datetime.now()
251
247
self.last_checked_ok = None
252
248
self.timeout = string_to_delta(config["timeout"])
253
249
self.interval = string_to_delta(config["interval"])
254
self.disable_hook = disable_hook
250
self.stop_hook = stop_hook
255
251
self.checker = None
256
252
self.checker_initiator_tag = None
257
self.disable_initiator_tag = None
253
self.stop_initiator_tag = None
258
254
self.checker_callback_tag = None
259
self.checker_command = config["checker"]
260
self.current_checker_command = None
261
self.last_connect = None
255
self.check_command = config["checker"]
264
257
"""Start this client's checker and timeout hooks"""
265
self.last_enabled = datetime.datetime.utcnow()
266
258
# Schedule a new checker to be started an 'interval' from now,
267
259
# and every interval from then on.
268
self.checker_initiator_tag = (gobject.timeout_add
269
(self.interval_milliseconds(),
260
self.checker_initiator_tag = gobject.timeout_add\
261
(self._interval_milliseconds,
271
263
# Also start a new checker *right now*.
272
264
self.start_checker()
273
# Schedule a disable() when 'timeout' has passed
274
self.disable_initiator_tag = (gobject.timeout_add
275
(self.timeout_milliseconds(),
280
"""Disable this client."""
281
if not getattr(self, "enabled", False):
265
# Schedule a stop() when 'timeout' has passed
266
self.stop_initiator_tag = gobject.timeout_add\
267
(self._timeout_milliseconds,
271
The possibility that a client might be restarted is left open,
272
but not currently used."""
273
# If this client doesn't have a secret, it is already stopped.
274
if hasattr(self, "secret") and self.secret:
275
logger.info(u"Stopping client %s", self.name)
283
logger.info(u"Disabling client %s", self.name)
284
if getattr(self, "disable_initiator_tag", False):
285
gobject.source_remove(self.disable_initiator_tag)
286
self.disable_initiator_tag = None
279
if getattr(self, "stop_initiator_tag", False):
280
gobject.source_remove(self.stop_initiator_tag)
281
self.stop_initiator_tag = None
287
282
if getattr(self, "checker_initiator_tag", False):
288
283
gobject.source_remove(self.checker_initiator_tag)
289
284
self.checker_initiator_tag = None
290
285
self.stop_checker()
291
if self.disable_hook:
292
self.disable_hook(self)
294
288
# Do not run this again if called by a gobject.timeout_add
297
290
def __del__(self):
298
self.disable_hook = None
301
def checker_callback(self, pid, condition, command):
291
self.stop_hook = None
293
def checker_callback(self, pid, condition):
302
294
"""The checker has completed, so take appropriate actions."""
295
now = datetime.datetime.now()
303
296
self.checker_callback_tag = None
304
297
self.checker = None
305
if os.WIFEXITED(condition):
306
exitstatus = os.WEXITSTATUS(condition)
308
logger.info(u"Checker for %(name)s succeeded",
312
logger.info(u"Checker for %(name)s failed",
298
if os.WIFEXITED(condition) \
299
and (os.WEXITSTATUS(condition) == 0):
300
logger.info(u"Checker for %(name)s succeeded",
302
self.last_checked_ok = now
303
gobject.source_remove(self.stop_initiator_tag)
304
self.stop_initiator_tag = gobject.timeout_add\
305
(self._timeout_milliseconds,
307
elif not os.WIFEXITED(condition):
315
308
logger.warning(u"Checker for %(name)s crashed?",
318
def checked_ok(self):
319
"""Bump up the timeout for this client.
320
This should only be called when the client has been seen,
323
self.last_checked_ok = datetime.datetime.utcnow()
324
gobject.source_remove(self.disable_initiator_tag)
325
self.disable_initiator_tag = (gobject.timeout_add
326
(self.timeout_milliseconds(),
311
logger.info(u"Checker for %(name)s failed",
329
313
def start_checker(self):
330
314
"""Start a new checker subprocess if one is not running.
331
315
If a checker already exists, leave it running and do
407
372
if error.errno != errno.ESRCH: # No such process
409
374
self.checker = None
411
375
def still_valid(self):
412
376
"""Has the timeout not yet passed for this client?"""
413
if not getattr(self, "enabled", False):
415
now = datetime.datetime.utcnow()
377
now = datetime.datetime.now()
416
378
if self.last_checked_ok is None:
417
379
return now < (self.created + self.timeout)
419
381
return now < (self.last_checked_ok + self.timeout)
422
class ClientDBus(Client, dbus.service.Object):
423
"""A Client class using D-Bus
425
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
427
# dbus.service.Object doesn't use super(), so we can't either.
429
def __init__(self, *args, **kwargs):
430
Client.__init__(self, *args, **kwargs)
431
# Only now, when this client is initialized, can it show up on
433
self.dbus_object_path = (dbus.ObjectPath
435
+ self.name.replace(".", "_")))
436
dbus.service.Object.__init__(self, bus,
437
self.dbus_object_path)
439
oldstate = getattr(self, "enabled", False)
440
r = Client.enable(self)
441
if oldstate != self.enabled:
443
self.PropertyChanged(dbus.String(u"enabled"),
444
dbus.Boolean(True, variant_level=1))
445
self.PropertyChanged(dbus.String(u"last_enabled"),
446
(_datetime_to_dbus(self.last_enabled,
450
def disable(self, signal = True):
451
oldstate = getattr(self, "enabled", False)
452
r = Client.disable(self)
453
if signal and oldstate != self.enabled:
455
self.PropertyChanged(dbus.String(u"enabled"),
456
dbus.Boolean(False, variant_level=1))
459
def __del__(self, *args, **kwargs):
461
self.remove_from_connection()
464
if hasattr(dbus.service.Object, "__del__"):
465
dbus.service.Object.__del__(self, *args, **kwargs)
466
Client.__del__(self, *args, **kwargs)
468
def checker_callback(self, pid, condition, command,
470
self.checker_callback_tag = None
473
self.PropertyChanged(dbus.String(u"checker_running"),
474
dbus.Boolean(False, variant_level=1))
475
if os.WIFEXITED(condition):
476
exitstatus = os.WEXITSTATUS(condition)
478
self.CheckerCompleted(dbus.Int16(exitstatus),
479
dbus.Int64(condition),
480
dbus.String(command))
483
self.CheckerCompleted(dbus.Int16(-1),
484
dbus.Int64(condition),
485
dbus.String(command))
487
return Client.checker_callback(self, pid, condition, command,
490
def checked_ok(self, *args, **kwargs):
491
r = Client.checked_ok(self, *args, **kwargs)
493
self.PropertyChanged(
494
dbus.String(u"last_checked_ok"),
495
(_datetime_to_dbus(self.last_checked_ok,
499
def start_checker(self, *args, **kwargs):
500
old_checker = self.checker
501
if self.checker is not None:
502
old_checker_pid = self.checker.pid
504
old_checker_pid = None
505
r = Client.start_checker(self, *args, **kwargs)
506
# Only if new checker process was started
507
if (self.checker is not None
508
and old_checker_pid != self.checker.pid):
510
self.CheckerStarted(self.current_checker_command)
511
self.PropertyChanged(
512
dbus.String("checker_running"),
513
dbus.Boolean(True, variant_level=1))
516
def stop_checker(self, *args, **kwargs):
517
old_checker = getattr(self, "checker", None)
518
r = Client.stop_checker(self, *args, **kwargs)
519
if (old_checker is not None
520
and getattr(self, "checker", None) is None):
521
self.PropertyChanged(dbus.String(u"checker_running"),
522
dbus.Boolean(False, variant_level=1))
525
## D-Bus methods & signals
526
_interface = u"se.bsnet.fukt.Mandos.Client"
529
CheckedOK = dbus.service.method(_interface)(checked_ok)
530
CheckedOK.__name__ = "CheckedOK"
532
# CheckerCompleted - signal
533
@dbus.service.signal(_interface, signature="nxs")
534
def CheckerCompleted(self, exitcode, waitstatus, command):
538
# CheckerStarted - signal
539
@dbus.service.signal(_interface, signature="s")
540
def CheckerStarted(self, command):
544
# GetAllProperties - method
545
@dbus.service.method(_interface, out_signature="a{sv}")
546
def GetAllProperties(self):
548
return dbus.Dictionary({
550
dbus.String(self.name, variant_level=1),
551
dbus.String("fingerprint"):
552
dbus.String(self.fingerprint, variant_level=1),
554
dbus.String(self.host, variant_level=1),
555
dbus.String("created"):
556
_datetime_to_dbus(self.created, variant_level=1),
557
dbus.String("last_enabled"):
558
(_datetime_to_dbus(self.last_enabled,
560
if self.last_enabled is not None
561
else dbus.Boolean(False, variant_level=1)),
562
dbus.String("enabled"):
563
dbus.Boolean(self.enabled, variant_level=1),
564
dbus.String("last_checked_ok"):
565
(_datetime_to_dbus(self.last_checked_ok,
567
if self.last_checked_ok is not None
568
else dbus.Boolean (False, variant_level=1)),
569
dbus.String("timeout"):
570
dbus.UInt64(self.timeout_milliseconds(),
572
dbus.String("interval"):
573
dbus.UInt64(self.interval_milliseconds(),
575
dbus.String("checker"):
576
dbus.String(self.checker_command,
578
dbus.String("checker_running"):
579
dbus.Boolean(self.checker is not None,
581
dbus.String("object_path"):
582
dbus.ObjectPath(self.dbus_object_path,
586
# IsStillValid - method
587
@dbus.service.method(_interface, out_signature="b")
588
def IsStillValid(self):
589
return self.still_valid()
591
# PropertyChanged - signal
592
@dbus.service.signal(_interface, signature="sv")
593
def PropertyChanged(self, property, value):
597
# ReceivedSecret - signal
598
@dbus.service.signal(_interface)
599
def ReceivedSecret(self):
604
@dbus.service.signal(_interface)
609
# SetChecker - method
610
@dbus.service.method(_interface, in_signature="s")
611
def SetChecker(self, checker):
612
"D-Bus setter method"
613
self.checker_command = checker
615
self.PropertyChanged(dbus.String(u"checker"),
616
dbus.String(self.checker_command,
620
@dbus.service.method(_interface, in_signature="s")
621
def SetHost(self, host):
622
"D-Bus setter method"
625
self.PropertyChanged(dbus.String(u"host"),
626
dbus.String(self.host, variant_level=1))
628
# SetInterval - method
629
@dbus.service.method(_interface, in_signature="t")
630
def SetInterval(self, milliseconds):
631
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
633
self.PropertyChanged(dbus.String(u"interval"),
634
(dbus.UInt64(self.interval_milliseconds(),
638
@dbus.service.method(_interface, in_signature="ay",
640
def SetSecret(self, secret):
641
"D-Bus setter method"
642
self.secret = str(secret)
644
# SetTimeout - method
645
@dbus.service.method(_interface, in_signature="t")
646
def SetTimeout(self, milliseconds):
647
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
649
self.PropertyChanged(dbus.String(u"timeout"),
650
(dbus.UInt64(self.timeout_milliseconds(),
654
Enable = dbus.service.method(_interface)(enable)
655
Enable.__name__ = "Enable"
657
# StartChecker - method
658
@dbus.service.method(_interface)
659
def StartChecker(self):
664
@dbus.service.method(_interface)
669
# StopChecker - method
670
StopChecker = dbus.service.method(_interface)(stop_checker)
671
StopChecker.__name__ = "StopChecker"
676
class TCP_handler(SocketServer.BaseRequestHandler, object):
384
def peer_certificate(session):
385
"Return the peer's OpenPGP certificate as a bytestring"
386
# If not an OpenPGP certificate...
387
if gnutls.library.functions.gnutls_certificate_type_get\
388
(session._c_object) \
389
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
390
# ...do the normal thing
391
return session.peer_certificate
392
list_size = ctypes.c_uint()
393
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
394
(session._c_object, ctypes.byref(list_size))
395
if list_size.value == 0:
398
return ctypes.string_at(cert.data, cert.size)
401
def fingerprint(openpgp):
402
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
403
# New GnuTLS "datum" with the OpenPGP public key
404
datum = gnutls.library.types.gnutls_datum_t\
405
(ctypes.cast(ctypes.c_char_p(openpgp),
406
ctypes.POINTER(ctypes.c_ubyte)),
407
ctypes.c_uint(len(openpgp)))
408
# New empty GnuTLS certificate
409
crt = gnutls.library.types.gnutls_openpgp_crt_t()
410
gnutls.library.functions.gnutls_openpgp_crt_init\
412
# Import the OpenPGP public key into the certificate
413
gnutls.library.functions.gnutls_openpgp_crt_import\
414
(crt, ctypes.byref(datum),
415
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
416
# Verify the self signature in the key
417
crtverify = ctypes.c_uint();
418
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
419
(crt, 0, ctypes.byref(crtverify))
420
if crtverify.value != 0:
421
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
422
raise gnutls.errors.CertificateSecurityError("Verify failed")
423
# New buffer for the fingerprint
424
buffer = ctypes.create_string_buffer(20)
425
buffer_length = ctypes.c_size_t()
426
# Get the fingerprint from the certificate into the buffer
427
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
428
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
429
# Deinit the certificate
430
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
431
# Convert the buffer to a Python bytestring
432
fpr = ctypes.string_at(buffer, buffer_length.value)
433
# Convert the bytestring to hexadecimal notation
434
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
438
class tcp_handler(SocketServer.BaseRequestHandler, object):
677
439
"""A TCP request handler class.
678
440
Instantiated by IPv6_TCPServer for each request to handle it.
679
441
Note: This will run in its own forked process."""
681
443
def handle(self):
682
444
logger.info(u"TCP connection from: %s",
683
unicode(self.client_address))
684
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
685
# Open IPC pipe to parent process
686
with closing(os.fdopen(self.server.pipe[1], "w", 1)) as ipc:
687
session = (gnutls.connection
688
.ClientSession(self.request,
692
line = self.request.makefile().readline()
693
logger.debug(u"Protocol version: %r", line)
695
if int(line.strip().split()[0]) > 1:
697
except (ValueError, IndexError, RuntimeError), error:
698
logger.error(u"Unknown protocol version: %s", error)
701
# Note: gnutls.connection.X509Credentials is really a
702
# generic GnuTLS certificate credentials object so long as
703
# no X.509 keys are added to it. Therefore, we can use it
704
# here despite using OpenPGP certificates.
706
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
707
# "+AES-256-CBC", "+SHA1",
708
# "+COMP-NULL", "+CTYPE-OPENPGP",
710
# Use a fallback default, since this MUST be set.
711
priority = self.server.settings.get("priority", "NORMAL")
712
(gnutls.library.functions
713
.gnutls_priority_set_direct(session._c_object,
718
except gnutls.errors.GNUTLSError, error:
719
logger.warning(u"Handshake failed: %s", error)
720
# Do not run session.bye() here: the session is not
721
# established. Just abandon the request.
723
logger.debug(u"Handshake succeeded")
725
fpr = self.fingerprint(self.peer_certificate(session))
726
except (TypeError, gnutls.errors.GNUTLSError), error:
727
logger.warning(u"Bad certificate: %s", error)
730
logger.debug(u"Fingerprint: %s", fpr)
732
for c in self.server.clients:
733
if c.fingerprint == fpr:
737
ipc.write("NOTFOUND %s\n" % fpr)
740
# Have to check if client.still_valid(), since it is
741
# possible that the client timed out while establishing
742
# the GnuTLS session.
743
if not client.still_valid():
744
ipc.write("INVALID %s\n" % client.name)
747
ipc.write("SENDING %s\n" % client.name)
749
while sent_size < len(client.secret):
750
sent = session.send(client.secret[sent_size:])
751
logger.debug(u"Sent: %d, remaining: %d",
752
sent, len(client.secret)
753
- (sent_size + sent))
758
def peer_certificate(session):
759
"Return the peer's OpenPGP certificate as a bytestring"
760
# If not an OpenPGP certificate...
761
if (gnutls.library.functions
762
.gnutls_certificate_type_get(session._c_object)
763
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
764
# ...do the normal thing
765
return session.peer_certificate
766
list_size = ctypes.c_uint(1)
767
cert_list = (gnutls.library.functions
768
.gnutls_certificate_get_peers
769
(session._c_object, ctypes.byref(list_size)))
770
if not bool(cert_list) and list_size.value != 0:
771
raise gnutls.errors.GNUTLSError("error getting peer"
773
if list_size.value == 0:
776
return ctypes.string_at(cert.data, cert.size)
779
def fingerprint(openpgp):
780
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
781
# New GnuTLS "datum" with the OpenPGP public key
782
datum = (gnutls.library.types
783
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
786
ctypes.c_uint(len(openpgp))))
787
# New empty GnuTLS certificate
788
crt = gnutls.library.types.gnutls_openpgp_crt_t()
789
(gnutls.library.functions
790
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
791
# Import the OpenPGP public key into the certificate
792
(gnutls.library.functions
793
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
794
gnutls.library.constants
795
.GNUTLS_OPENPGP_FMT_RAW))
796
# Verify the self signature in the key
797
crtverify = ctypes.c_uint()
798
(gnutls.library.functions
799
.gnutls_openpgp_crt_verify_self(crt, 0,
800
ctypes.byref(crtverify)))
801
if crtverify.value != 0:
802
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
803
raise (gnutls.errors.CertificateSecurityError
805
# New buffer for the fingerprint
806
buf = ctypes.create_string_buffer(20)
807
buf_len = ctypes.c_size_t()
808
# Get the fingerprint from the certificate into the buffer
809
(gnutls.library.functions
810
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
811
ctypes.byref(buf_len)))
812
# Deinit the certificate
813
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
814
# Convert the buffer to a Python bytestring
815
fpr = ctypes.string_at(buf, buf_len.value)
816
# Convert the bytestring to hexadecimal notation
817
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
821
class ForkingMixInWithPipe(SocketServer.ForkingMixIn, object):
822
"""Like SocketServer.ForkingMixIn, but also pass a pipe.
823
Assumes a gobject.MainLoop event loop.
825
def process_request(self, request, client_address):
826
"""This overrides and wraps the original process_request().
827
This function creates a new pipe in self.pipe
829
self.pipe = os.pipe()
830
super(ForkingMixInWithPipe,
831
self).process_request(request, client_address)
832
os.close(self.pipe[1]) # close write end
833
# Call "handle_ipc" for both data and EOF events
834
gobject.io_add_watch(self.pipe[0],
835
gobject.IO_IN | gobject.IO_HUP,
837
def handle_ipc(source, condition):
838
"""Dummy function; override as necessary"""
843
class IPv6_TCPServer(ForkingMixInWithPipe,
844
SocketServer.TCPServer, object):
845
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
445
unicode(self.client_address))
446
session = gnutls.connection.ClientSession\
447
(self.request, gnutls.connection.X509Credentials())
449
line = self.request.makefile().readline()
450
logger.debug(u"Protocol version: %r", line)
452
if int(line.strip().split()[0]) > 1:
454
except (ValueError, IndexError, RuntimeError), error:
455
logger.error(u"Unknown protocol version: %s", error)
458
# Note: gnutls.connection.X509Credentials is really a generic
459
# GnuTLS certificate credentials object so long as no X.509
460
# keys are added to it. Therefore, we can use it here despite
461
# using OpenPGP certificates.
463
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
464
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
466
priority = "NORMAL" # Fallback default, since this
468
if self.server.settings["priority"]:
469
priority = self.server.settings["priority"]
470
gnutls.library.functions.gnutls_priority_set_direct\
471
(session._c_object, priority, None);
475
except gnutls.errors.GNUTLSError, error:
476
logger.warning(u"Handshake failed: %s", error)
477
# Do not run session.bye() here: the session is not
478
# established. Just abandon the request.
481
fpr = fingerprint(peer_certificate(session))
482
except (TypeError, gnutls.errors.GNUTLSError), error:
483
logger.warning(u"Bad certificate: %s", error)
486
logger.debug(u"Fingerprint: %s", fpr)
488
for c in self.server.clients:
489
if c.fingerprint == fpr:
493
logger.warning(u"Client not found for fingerprint: %s",
497
# Have to check if client.still_valid(), since it is possible
498
# that the client timed out while establishing the GnuTLS
500
if not client.still_valid():
501
logger.warning(u"Client %(name)s is invalid",
506
while sent_size < len(client.secret):
507
sent = session.send(client.secret[sent_size:])
508
logger.debug(u"Sent: %d, remaining: %d",
509
sent, len(client.secret)
510
- (sent_size + sent))
515
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
516
"""IPv6 TCP server. Accepts 'None' as address and/or port.
847
518
settings: Server settings
848
519
clients: Set() of Client objects
849
enabled: Boolean; whether this server is activated yet
851
521
address_family = socket.AF_INET6
852
522
def __init__(self, *args, **kwargs):
1141
721
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1142
722
# Convert the SafeConfigParser object to a dict
1143
723
server_settings = server_config.defaults()
1144
# Use the appropriate methods on the non-string config options
1145
server_settings["debug"] = server_config.getboolean("DEFAULT",
1147
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
1149
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
1151
if server_settings["port"]:
1152
server_settings["port"] = server_config.getint("DEFAULT",
724
# Use getboolean on the boolean config option
725
server_settings["debug"] = server_config.getboolean\
1154
727
del server_config
1156
729
# Override the settings from the config file with command line
1157
730
# options, if set.
1158
731
for option in ("interface", "address", "port", "debug",
1159
"priority", "servicename", "configdir",
1160
"use_dbus", "use_ipv6"):
732
"priority", "servicename", "configdir"):
1161
733
value = getattr(options, option)
1162
734
if value is not None:
1163
735
server_settings[option] = value
1165
737
# Now we have our good server settings in "server_settings"
1167
##################################################################
1170
739
debug = server_settings["debug"]
1171
use_dbus = server_settings["use_dbus"]
1172
use_ipv6 = server_settings["use_ipv6"]
1175
742
syslogger.setLevel(logging.WARNING)
1176
743
console.setLevel(logging.WARNING)
1178
745
if server_settings["servicename"] != "Mandos":
1179
syslogger.setFormatter(logging.Formatter
1180
('Mandos (%s) [%%(process)d]:'
1181
' %%(levelname)s: %%(message)s'
746
syslogger.setFormatter(logging.Formatter\
747
('Mandos (%s): %%(levelname)s:'
1182
749
% server_settings["servicename"]))
1184
751
# Parse config file with clients
1185
752
client_defaults = { "timeout": "1h",
1186
753
"interval": "5m",
1187
"checker": "fping -q -- %%(host)s",
754
"checker": "fping -q -- %(host)s",
1190
757
client_config = ConfigParser.SafeConfigParser(client_defaults)
1191
758
client_config.read(os.path.join(server_settings["configdir"],
1192
759
"clients.conf"))
1194
global mandos_dbus_service
1195
mandos_dbus_service = None
1198
tcp_server = IPv6_TCPServer((server_settings["address"],
1199
server_settings["port"]),
1201
settings=server_settings,
1202
clients=clients, use_ipv6=use_ipv6)
1203
pidfilename = "/var/run/mandos.pid"
1205
pidfile = open(pidfilename, "w")
1207
logger.error("Could not open file %r", pidfilename)
1210
uid = pwd.getpwnam("_mandos").pw_uid
1211
gid = pwd.getpwnam("_mandos").pw_gid
1214
uid = pwd.getpwnam("mandos").pw_uid
1215
gid = pwd.getpwnam("mandos").pw_gid
1218
uid = pwd.getpwnam("nobody").pw_uid
1219
gid = pwd.getpwnam("nogroup").pw_gid
1226
except OSError, error:
1227
if error[0] != errno.EPERM:
1230
# Enable all possible GnuTLS debugging
1232
# "Use a log level over 10 to enable all debugging options."
1234
gnutls.library.functions.gnutls_global_set_log_level(11)
1236
@gnutls.library.types.gnutls_log_func
1237
def debug_gnutls(level, string):
1238
logger.debug("GnuTLS: %s", string[:-1])
1240
(gnutls.library.functions
1241
.gnutls_global_set_log_function(debug_gnutls))
1244
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1245
762
service = AvahiService(name = server_settings["servicename"],
1246
servicetype = "_mandos._tcp",
1247
protocol = protocol)
763
type = "_mandos._tcp", );
1248
764
if server_settings["interface"]:
1249
service.interface = (if_nametoindex
1250
(server_settings["interface"]))
765
service.interface = if_nametoindex\
766
(server_settings["interface"])
1252
768
global main_loop