To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 126
- compare with another revision
- download diff
- download tarball
- view history from revision 126
- Committer: Teddy Hogeborn
- Date: 2008-08-31 10:44:32 UTC
- Revision ID: teddy@fukt.bsnet.se-20080831104432-9hzi47foc7tlmade
* plugins.d/password-prompt.xml (OPTIONS): Move <replaceable> tags to
inside <option> tags.
Moved long options before
short.
inside <option> tags.
Moved long options before
short.
- files added:
- plugins.d/usplash
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugins.d/mandos-client.c => plugins.d/password-request.c
- plugins.d/mandos-client.xml => plugins.d/password-request.xml
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import division, with_statement, absolute_import
33
from __future__ import division
35
34
36
35
import SocketServer
37
36
import socket
37
import select
38
38
from optparse import OptionParser
39
39
import datetime
40
40
import errno
55
55
import stat
56
56
import logging
57
57
import logging.handlers
58
import pwd
59
from contextlib import closing
60
58
61
59
import dbus
62
import dbus.service
63
60
import gobject
64
61
import avahi
65
62
from dbus.mainloop.glib import DBusGMainLoop
66
63
import ctypes
67
import ctypes.util
68
64
69
version = "1.0.3"
65
version = "1.0"
70
66
71
67
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
68
syslogger = logging.handlers.SysLogHandler\
69
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
70
address = "/dev/log")
71
syslogger.setFormatter(logging.Formatter\
72
('Mandos: %(levelname)s: %(message)s'))
77
73
logger.addHandler(syslogger)
78
74
79
75
console = logging.StreamHandler()
82
78
logger.addHandler(console)
83
79
84
80
class AvahiError(Exception):
85
def __init__(self, value, *args, **kwargs):
81
def __init__(self, value):
86
82
self.value = value
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
83
def __str__(self):
84
return repr(self.value)
90
85
91
86
class AvahiServiceError(AvahiError):
92
87
pass
112
107
a sensible number of times
113
108
"""
114
109
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
110
type = None, port = None, TXT = None, domain = "",
111
host = "", max_renames = 32768):
117
112
self.interface = interface
118
113
self.name = name
119
self.type = servicetype
114
self.type = type
120
115
self.port = port
121
self.TXT = TXT if TXT is not None else []
116
if TXT is None:
117
self.TXT = []
118
else:
119
self.TXT = TXT
122
120
self.domain = domain
123
121
self.host = host
124
122
self.rename_count = 0
128
126
if self.rename_count >= self.max_renames:
129
127
logger.critical(u"No suitable Zeroconf service name found"
130
128
u" after %i retries, exiting.",
131
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
129
rename_count)
130
raise AvahiServiceError("Too many renames")
133
131
self.name = server.GetAlternativeServiceName(self.name)
134
132
logger.info(u"Changing Zeroconf service name to %r ...",
135
133
str(self.name))
136
syslogger.setFormatter(logging.Formatter
134
syslogger.setFormatter(logging.Formatter\
137
135
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
136
' %%(message)s' % self.name))
139
137
self.remove()
140
138
self.add()
141
139
self.rename_count += 1
147
145
"""Derived from the Avahi example code"""
148
146
global group
149
147
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
148
group = dbus.Interface\
149
(bus.get_object(avahi.DBUS_NAME,
152
150
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
151
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
152
group.connect_to_signal('StateChanged',
155
153
entry_group_state_changed)
156
154
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
170
168
# End of Avahi example code
171
169
172
170
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
171
class Client(object):
179
172
"""A representation of a client host served by this server.
180
173
Attributes:
181
name: string; from the config file, used in log messages
174
name: string; from the config file, used in log messages
182
175
fingerprint: string (40 or 32 hexadecimal digits); used to
183
176
uniquely identify the client
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
177
secret: bytestring; sent verbatim (over TLS) to client
178
host: string; available for use by the checker command
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
181
timeout: datetime.timedelta(); How long from last_checked_ok
182
until this client is invalid
183
interval: datetime.timedelta(); How often to start a new checker
184
stop_hook: If set, called by stop() as stop_hook(self)
185
checker: subprocess.Popen(); a running checker process used
186
to see if the client lives.
187
'None' if no process is running.
197
188
checker_initiator_tag: a gobject event source tag, or None
198
disable_initiator_tag: - '' -
189
stop_initiator_tag: - '' -
199
190
checker_callback_tag: - '' -
200
191
checker_command: string; External command which is run to check if
201
192
client lives. %() expansions are done at
202
193
runtime with vars(self) as dict, so that for
203
194
instance %(name)s can be used in the command.
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
195
Private attibutes:
196
_timeout: Real variable for 'timeout'
197
_interval: Real variable for 'interval'
198
_timeout_milliseconds: Used when calling gobject.timeout_add()
199
_interval_milliseconds: - '' -
206
200
"""
207
def timeout_milliseconds(self):
208
"Return the 'timeout' attribute in milliseconds"
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
212
213
def interval_milliseconds(self):
214
"Return the 'interval' attribute in milliseconds"
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
218
219
def __init__(self, name = None, disable_hook=None, config=None,
220
use_dbus=True):
201
def _set_timeout(self, timeout):
202
"Setter function for 'timeout' attribute"
203
self._timeout = timeout
204
self._timeout_milliseconds = ((self.timeout.days
205
* 24 * 60 * 60 * 1000)
206
+ (self.timeout.seconds * 1000)
207
+ (self.timeout.microseconds
208
// 1000))
209
timeout = property(lambda self: self._timeout,
210
_set_timeout)
211
del _set_timeout
212
def _set_interval(self, interval):
213
"Setter function for 'interval' attribute"
214
self._interval = interval
215
self._interval_milliseconds = ((self.interval.days
216
* 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds
218
* 1000)
219
+ (self.interval.microseconds
220
// 1000))
221
interval = property(lambda self: self._interval,
222
_set_interval)
223
del _set_interval
224
def __init__(self, name = None, stop_hook=None, config={}):
221
225
"""Note: the 'checker' key in 'config' sets the
222
226
'checker_command' attribute and *not* the 'checker'
223
227
attribute."""
224
228
self.name = name
225
if config is None:
226
config = {}
227
229
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
229
if self.use_dbus:
230
self.dbus_object_path = (dbus.ObjectPath
231
("/Mandos/clients/"
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
235
230
# Uppercase and remove spaces from fingerprint for later
236
231
# comparison purposes with return value from the fingerprint()
237
232
# function
238
self.fingerprint = (config["fingerprint"].upper()
239
.replace(u" ", u""))
233
self.fingerprint = config["fingerprint"].upper()\
234
.replace(u" ", u"")
240
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
241
236
if "secret" in config:
242
237
self.secret = config["secret"].decode(u"base64")
243
238
elif "secfile" in config:
244
with closing(open(os.path.expanduser
245
(os.path.expandvars
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
239
sf = open(config["secfile"])
240
self.secret = sf.read()
241
sf.close()
248
242
else:
249
243
raise TypeError(u"No secret or secfile for client %s"
250
244
% self.name)
251
245
self.host = config.get("host", "")
252
self.created = datetime.datetime.utcnow()
253
self.enabled = False
254
self.last_enabled = None
246
self.created = datetime.datetime.now()
255
247
self.last_checked_ok = None
256
248
self.timeout = string_to_delta(config["timeout"])
257
249
self.interval = string_to_delta(config["interval"])
258
self.disable_hook = disable_hook
250
self.stop_hook = stop_hook
259
251
self.checker = None
260
252
self.checker_initiator_tag = None
261
self.disable_initiator_tag = None
253
self.stop_initiator_tag = None
262
254
self.checker_callback_tag = None
263
self.checker_command = config["checker"]
264
265
def enable(self):
255
self.check_command = config["checker"]
256
def start(self):
266
257
"""Start this client's checker and timeout hooks"""
267
self.last_enabled = datetime.datetime.utcnow()
268
258
# Schedule a new checker to be started an 'interval' from now,
269
259
# and every interval from then on.
270
self.checker_initiator_tag = (gobject.timeout_add
271
(self.interval_milliseconds(),
272
self.start_checker))
260
self.checker_initiator_tag = gobject.timeout_add\
261
(self._interval_milliseconds,
262
self.start_checker)
273
263
# Also start a new checker *right now*.
274
264
self.start_checker()
275
# Schedule a disable() when 'timeout' has passed
276
self.disable_initiator_tag = (gobject.timeout_add
277
(self.timeout_milliseconds(),
278
self.disable))
279
self.enabled = True
280
if self.use_dbus:
281
# Emit D-Bus signals
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
286
variant_level=1)))
287
288
def disable(self):
289
"""Disable this client."""
290
if not getattr(self, "enabled", False):
265
# Schedule a stop() when 'timeout' has passed
266
self.stop_initiator_tag = gobject.timeout_add\
267
(self._timeout_milliseconds,
268
self.stop)
269
def stop(self):
270
"""Stop this client.
271
The possibility that a client might be restarted is left open,
272
but not currently used."""
273
# If this client doesn't have a secret, it is already stopped.
274
if hasattr(self, "secret") and self.secret:
275
logger.info(u"Stopping client %s", self.name)
276
self.secret = None
277
else:
291
278
return False
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
294
gobject.source_remove(self.disable_initiator_tag)
295
self.disable_initiator_tag = None
279
if getattr(self, "stop_initiator_tag", False):
280
gobject.source_remove(self.stop_initiator_tag)
281
self.stop_initiator_tag = None
296
282
if getattr(self, "checker_initiator_tag", False):
297
283
gobject.source_remove(self.checker_initiator_tag)
298
284
self.checker_initiator_tag = None
299
285
self.stop_checker()
300
if self.disable_hook:
301
self.disable_hook(self)
302
self.enabled = False
303
if self.use_dbus:
304
# Emit D-Bus signal
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
286
if self.stop_hook:
287
self.stop_hook(self)
307
288
# Do not run this again if called by a gobject.timeout_add
308
289
return False
309
310
290
def __del__(self):
311
self.disable_hook = None
312
self.disable()
313
314
def checker_callback(self, pid, condition, command):
291
self.stop_hook = None
292
self.stop()
293
def checker_callback(self, pid, condition):
315
294
"""The checker has completed, so take appropriate actions."""
295
now = datetime.datetime.now()
316
296
self.checker_callback_tag = None
317
297
self.checker = None
318
if self.use_dbus:
319
# Emit D-Bus signal
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
298
if os.WIFEXITED(condition) \
299
and (os.WEXITSTATUS(condition) == 0):
324
300
logger.info(u"Checker for %(name)s succeeded",
325
301
vars(self))
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
331
self.bump_timeout()
302
self.last_checked_ok = now
303
gobject.source_remove(self.stop_initiator_tag)
304
self.stop_initiator_tag = gobject.timeout_add\
305
(self._timeout_milliseconds,
306
self.stop)
332
307
elif not os.WIFEXITED(condition):
333
308
logger.warning(u"Checker for %(name)s crashed?",
334
309
vars(self))
335
if self.use_dbus:
336
# Emit D-Bus signal
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
340
310
else:
341
311
logger.info(u"Checker for %(name)s failed",
342
312
vars(self))
343
if self.use_dbus:
344
# Emit D-Bus signal
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
348
349
def bump_timeout(self):
350
"""Bump up the timeout for this client.
351
This should only be called when the client has been seen,
352
alive and well.
353
"""
354
self.last_checked_ok = datetime.datetime.utcnow()
355
gobject.source_remove(self.disable_initiator_tag)
356
self.disable_initiator_tag = (gobject.timeout_add
357
(self.timeout_milliseconds(),
358
self.disable))
359
if self.use_dbus:
360
# Emit D-Bus signal
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
364
variant_level=1)))
365
366
313
def start_checker(self):
367
314
"""Start a new checker subprocess if one is not running.
368
315
If a checker already exists, leave it running and do
377
324
# is as it should be.
378
325
if self.checker is None:
379
326
try:
380
# In case checker_command has exactly one % operator
381
command = self.checker_command % self.host
327
# In case check_command has exactly one % operator
328
command = self.check_command % self.host
382
329
except TypeError:
383
330
# Escape attributes for the shell
384
331
escaped_attrs = dict((key, re.escape(str(val)))
385
332
for key, val in
386
333
vars(self).iteritems())
387
334
try:
388
command = self.checker_command % escaped_attrs
335
command = self.check_command % escaped_attrs
389
336
except TypeError, error:
390
337
logger.error(u'Could not format string "%s":'
391
u' %s', self.checker_command, error)
338
u' %s', self.check_command, error)
392
339
return True # Try again later
393
340
try:
394
341
logger.info(u"Starting checker %r for %s",
400
347
self.checker = subprocess.Popen(command,
401
348
close_fds=True,
402
349
shell=True, cwd="/")
403
if self.use_dbus:
404
# Emit D-Bus signal
405
self.CheckerStarted(command)
406
self.PropertyChanged(
407
dbus.String("checker_running"),
408
dbus.Boolean(True, variant_level=1))
409
self.checker_callback_tag = (gobject.child_watch_add
410
(self.checker.pid,
411
self.checker_callback,
412
data=command))
350
self.checker_callback_tag = gobject.child_watch_add\
351
(self.checker.pid,
352
self.checker_callback)
413
353
except OSError, error:
414
354
logger.error(u"Failed to start subprocess: %s",
415
355
error)
416
356
# Re-run this periodically if run by gobject.timeout_add
417
357
return True
418
419
358
def stop_checker(self):
420
359
"""Force the checker process, if any, to stop."""
421
360
if self.checker_callback_tag:
433
372
if error.errno != errno.ESRCH: # No such process
434
373
raise
435
374
self.checker = None
436
if self.use_dbus:
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
439
440
375
def still_valid(self):
441
376
"""Has the timeout not yet passed for this client?"""
442
if not getattr(self, "enabled", False):
443
return False
444
now = datetime.datetime.utcnow()
377
now = datetime.datetime.now()
445
378
if self.last_checked_ok is None:
446
379
return now < (self.created + self.timeout)
447
380
else:
448
381
return now < (self.last_checked_ok + self.timeout)
449
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
452
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
456
457
# CheckerCompleted - signal
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
460
"D-Bus signal"
461
pass
462
463
# CheckerStarted - signal
464
@dbus.service.signal(_interface, signature="s")
465
def CheckerStarted(self, command):
466
"D-Bus signal"
467
pass
468
469
# GetAllProperties - method
470
@dbus.service.method(_interface, out_signature="a{sv}")
471
def GetAllProperties(self):
472
"D-Bus method"
473
return dbus.Dictionary({
474
dbus.String("name"):
475
dbus.String(self.name, variant_level=1),
476
dbus.String("fingerprint"):
477
dbus.String(self.fingerprint, variant_level=1),
478
dbus.String("host"):
479
dbus.String(self.host, variant_level=1),
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
484
variant_level=1)
485
if self.last_enabled is not None
486
else dbus.Boolean(False, variant_level=1)),
487
dbus.String("enabled"):
488
dbus.Boolean(self.enabled, variant_level=1),
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
491
variant_level=1)
492
if self.last_checked_ok is not None
493
else dbus.Boolean (False, variant_level=1)),
494
dbus.String("timeout"):
495
dbus.UInt64(self.timeout_milliseconds(),
496
variant_level=1),
497
dbus.String("interval"):
498
dbus.UInt64(self.interval_milliseconds(),
499
variant_level=1),
500
dbus.String("checker"):
501
dbus.String(self.checker_command,
502
variant_level=1),
503
dbus.String("checker_running"):
504
dbus.Boolean(self.checker is not None,
505
variant_level=1),
506
}, signature="sv")
507
508
# IsStillValid - method
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
510
(still_valid))
511
IsStillValid.__name__ = "IsStillValid"
512
513
# PropertyChanged - signal
514
@dbus.service.signal(_interface, signature="sv")
515
def PropertyChanged(self, property, value):
516
"D-Bus signal"
517
pass
518
519
# SetChecker - method
520
@dbus.service.method(_interface, in_signature="s")
521
def SetChecker(self, checker):
522
"D-Bus setter method"
523
self.checker_command = checker
524
# Emit D-Bus signal
525
self.PropertyChanged(dbus.String(u"checker"),
526
dbus.String(self.checker_command,
527
variant_level=1))
528
529
# SetHost - method
530
@dbus.service.method(_interface, in_signature="s")
531
def SetHost(self, host):
532
"D-Bus setter method"
533
self.host = host
534
# Emit D-Bus signal
535
self.PropertyChanged(dbus.String(u"host"),
536
dbus.String(self.host, variant_level=1))
537
538
# SetInterval - method
539
@dbus.service.method(_interface, in_signature="t")
540
def SetInterval(self, milliseconds):
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
542
# Emit D-Bus signal
543
self.PropertyChanged(dbus.String(u"interval"),
544
(dbus.UInt64(self.interval_milliseconds(),
545
variant_level=1)))
546
547
# SetSecret - method
548
@dbus.service.method(_interface, in_signature="ay",
549
byte_arrays=True)
550
def SetSecret(self, secret):
551
"D-Bus setter method"
552
self.secret = str(secret)
553
554
# SetTimeout - method
555
@dbus.service.method(_interface, in_signature="t")
556
def SetTimeout(self, milliseconds):
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
558
# Emit D-Bus signal
559
self.PropertyChanged(dbus.String(u"timeout"),
560
(dbus.UInt64(self.timeout_milliseconds(),
561
variant_level=1)))
562
563
# Enable - method
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
566
567
# StartChecker - method
568
@dbus.service.method(_interface)
569
def StartChecker(self):
570
"D-Bus method"
571
self.start_checker()
572
573
# Disable - method
574
@dbus.service.method(_interface)
575
def Disable(self):
576
"D-Bus method"
577
self.disable()
578
579
# StopChecker - method
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
582
583
del _interface
584
382
585
383
586
384
def peer_certificate(session):
587
385
"Return the peer's OpenPGP certificate as a bytestring"
588
386
# If not an OpenPGP certificate...
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
387
if gnutls.library.functions.gnutls_certificate_type_get\
388
(session._c_object) \
389
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
592
390
# ...do the normal thing
593
391
return session.peer_certificate
594
392
list_size = ctypes.c_uint()
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
393
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
394
(session._c_object, ctypes.byref(list_size))
598
395
if list_size.value == 0:
599
396
return None
600
397
cert = cert_list[0]
604
401
def fingerprint(openpgp):
605
402
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
606
403
# New GnuTLS "datum" with the OpenPGP public key
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
609
ctypes.POINTER
610
(ctypes.c_ubyte)),
611
ctypes.c_uint(len(openpgp))))
404
datum = gnutls.library.types.gnutls_datum_t\
405
(ctypes.cast(ctypes.c_char_p(openpgp),
406
ctypes.POINTER(ctypes.c_ubyte)),
407
ctypes.c_uint(len(openpgp)))
612
408
# New empty GnuTLS certificate
613
409
crt = gnutls.library.types.gnutls_openpgp_crt_t()
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
410
gnutls.library.functions.gnutls_openpgp_crt_init\
411
(ctypes.byref(crt))
616
412
# Import the OpenPGP public key into the certificate
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
413
gnutls.library.functions.gnutls_openpgp_crt_import\
414
(crt, ctypes.byref(datum),
415
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
621
416
# Verify the self signature in the key
622
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
417
crtverify = ctypes.c_uint();
418
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
419
(crt, 0, ctypes.byref(crtverify))
625
420
if crtverify.value != 0:
626
421
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
422
raise gnutls.errors.CertificateSecurityError("Verify failed")
628
423
# New buffer for the fingerprint
629
buf = ctypes.create_string_buffer(20)
630
buf_len = ctypes.c_size_t()
424
buffer = ctypes.create_string_buffer(20)
425
buffer_length = ctypes.c_size_t()
631
426
# Get the fingerprint from the certificate into the buffer
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
427
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
428
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
635
429
# Deinit the certificate
636
430
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
637
431
# Convert the buffer to a Python bytestring
638
fpr = ctypes.string_at(buf, buf_len.value)
432
fpr = ctypes.string_at(buffer, buffer_length.value)
639
433
# Convert the bytestring to hexadecimal notation
640
434
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
641
435
return hex_fpr
642
436
643
437
644
class TCP_handler(SocketServer.BaseRequestHandler, object):
438
class tcp_handler(SocketServer.BaseRequestHandler, object):
645
439
"""A TCP request handler class.
646
440
Instantiated by IPv6_TCPServer for each request to handle it.
647
441
Note: This will run in its own forked process."""
648
442
649
443
def handle(self):
650
444
logger.info(u"TCP connection from: %s",
651
unicode(self.client_address))
652
session = (gnutls.connection
653
.ClientSession(self.request,
654
gnutls.connection
655
.X509Credentials()))
445
unicode(self.client_address))
446
session = gnutls.connection.ClientSession\
447
(self.request, gnutls.connection.X509Credentials())
656
448
657
449
line = self.request.makefile().readline()
658
450
logger.debug(u"Protocol version: %r", line)
671
463
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
672
464
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
673
465
# "+DHE-DSS"))
674
# Use a fallback default, since this MUST be set.
675
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
678
priority, None))
466
priority = "NORMAL" # Fallback default, since this
467
# MUST be set.
468
if self.server.settings["priority"]:
469
priority = self.server.settings["priority"]
470
gnutls.library.functions.gnutls_priority_set_direct\
471
(session._c_object, priority, None);
679
472
680
473
try:
681
474
session.handshake()
691
484
session.bye()
692
485
return
693
486
logger.debug(u"Fingerprint: %s", fpr)
487
client = None
694
488
for c in self.server.clients:
695
489
if c.fingerprint == fpr:
696
490
client = c
697
491
break
698
else:
492
if not client:
699
493
logger.warning(u"Client not found for fingerprint: %s",
700
494
fpr)
701
495
session.bye()
708
502
vars(client))
709
503
session.bye()
710
504
return
711
## This won't work here, since we're in a fork.
712
# client.bump_timeout()
713
505
sent_size = 0
714
506
while sent_size < len(client.secret):
715
507
sent = session.send(client.secret[sent_size:])
720
512
session.bye()
721
513
722
514
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
724
SocketServer.TCPServer, object):
515
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
725
516
"""IPv6 TCP server. Accepts 'None' as address and/or port.
726
517
Attributes:
727
518
settings: Server settings
728
519
clients: Set() of Client objects
729
enabled: Boolean; whether this server is activated yet
730
520
"""
731
521
address_family = socket.AF_INET6
732
522
def __init__(self, *args, **kwargs):
736
526
if "clients" in kwargs:
737
527
self.clients = kwargs["clients"]
738
528
del kwargs["clients"]
739
self.enabled = False
740
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
529
return super(type(self), self).__init__(*args, **kwargs)
741
530
def server_bind(self):
742
531
"""This overrides the normal server_bind() function
743
532
to bind to an interface if one was specified, and also NOT to
772
561
# if_nametoindex
773
562
# (self.settings
774
563
# ["interface"]))
775
return super(IPv6_TCPServer, self).server_bind()
776
def server_activate(self):
777
if self.enabled:
778
return super(IPv6_TCPServer, self).server_activate()
779
def enable(self):
780
self.enabled = True
564
return super(type(self), self).server_bind()
781
565
782
566
783
567
def string_to_delta(interval):
799
583
timevalue = datetime.timedelta(0)
800
584
for s in interval.split():
801
585
try:
802
suffix = unicode(s[-1])
803
value = int(s[:-1])
586
suffix=unicode(s[-1])
587
value=int(s[:-1])
804
588
if suffix == u"d":
805
589
delta = datetime.timedelta(value)
806
590
elif suffix == u"s":
840
624
elif state == avahi.ENTRY_GROUP_FAILURE:
841
625
logger.critical(u"Avahi: Error in group state changed %s",
842
626
unicode(error))
843
raise AvahiGroupError(u"State changed: %s" % unicode(error))
627
raise AvahiGroupError("State changed: %s", str(error))
844
628
845
629
def if_nametoindex(interface):
846
630
"""Call the C function if_nametoindex(), or equivalent"""
847
631
global if_nametoindex
848
632
try:
849
if_nametoindex = (ctypes.cdll.LoadLibrary
850
(ctypes.util.find_library("c"))
851
.if_nametoindex)
633
if "ctypes.util" not in sys.modules:
634
import ctypes.util
635
if_nametoindex = ctypes.cdll.LoadLibrary\
636
(ctypes.util.find_library("c")).if_nametoindex
852
637
except (OSError, AttributeError):
853
638
if "struct" not in sys.modules:
854
639
import struct
857
642
def if_nametoindex(interface):
858
643
"Get an interface index the hard way, i.e. using fcntl()"
859
644
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
860
with closing(socket.socket()) as s:
861
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
862
struct.pack("16s16x", interface))
645
s = socket.socket()
646
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
647
struct.pack("16s16x", interface))
648
s.close()
863
649
interface_index = struct.unpack("I", ifreq[16:20])[0]
864
650
return interface_index
865
651
return if_nametoindex(interface)
889
675
890
676
891
677
def main():
678
global main_loop_started
679
main_loop_started = False
680
892
681
parser = OptionParser(version = "%%prog %s" % version)
893
682
parser.add_option("-i", "--interface", type="string",
894
683
metavar="IF", help="Bind to interface IF")
896
685
help="Address to listen for requests on")
897
686
parser.add_option("-p", "--port", type="int",
898
687
help="Port number to receive requests on")
899
parser.add_option("--check", action="store_true",
688
parser.add_option("--check", action="store_true", default=False,
900
689
help="Run self-test")
901
690
parser.add_option("--debug", action="store_true",
902
691
help="Debug mode; run in foreground and log to"
909
698
default="/etc/mandos", metavar="DIR",
910
699
help="Directory to search for configuration"
911
700
" files")
912
parser.add_option("--no-dbus", action="store_false",
913
dest="use_dbus",
914
help="Do not provide D-Bus system bus"
915
" interface")
916
options = parser.parse_args()[0]
701
(options, args) = parser.parse_args()
917
702
918
703
if options.check:
919
704
import doctest
928
713
"priority":
929
714
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
930
715
"servicename": "Mandos",
931
"use_dbus": "True",
932
716
}
933
717
934
718
# Parse config file for server-global settings
937
721
server_config.read(os.path.join(options.configdir, "mandos.conf"))
938
722
# Convert the SafeConfigParser object to a dict
939
723
server_settings = server_config.defaults()
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
724
# Use getboolean on the boolean config option
725
server_settings["debug"] = server_config.getboolean\
726
("DEFAULT", "debug")
945
727
del server_config
946
728
947
729
# Override the settings from the config file with command line
948
730
# options, if set.
949
731
for option in ("interface", "address", "port", "debug",
950
"priority", "servicename", "configdir",
951
"use_dbus"):
732
"priority", "servicename", "configdir"):
952
733
value = getattr(options, option)
953
734
if value is not None:
954
735
server_settings[option] = value
955
736
del options
956
737
# Now we have our good server settings in "server_settings"
957
738
958
# For convenience
959
739
debug = server_settings["debug"]
960
use_dbus = server_settings["use_dbus"]
961
740
962
741
if not debug:
963
742
syslogger.setLevel(logging.WARNING)
964
743
console.setLevel(logging.WARNING)
965
744
966
745
if server_settings["servicename"] != "Mandos":
967
syslogger.setFormatter(logging.Formatter
746
syslogger.setFormatter(logging.Formatter\
968
747
('Mandos (%s): %%(levelname)s:'
969
748
' %%(message)s'
970
749
% server_settings["servicename"]))
972
751
# Parse config file with clients
973
752
client_defaults = { "timeout": "1h",
974
753
"interval": "5m",
975
"checker": "fping -q -- %%(host)s",
754
"checker": "fping -q -- %(host)s",
976
755
"host": "",
977
756
}
978
757
client_config = ConfigParser.SafeConfigParser(client_defaults)
979
758
client_config.read(os.path.join(server_settings["configdir"],
980
759
"clients.conf"))
981
760
982
clients = Set()
983
tcp_server = IPv6_TCPServer((server_settings["address"],
984
server_settings["port"]),
985
TCP_handler,
986
settings=server_settings,
987
clients=clients)
988
pidfilename = "/var/run/mandos.pid"
989
try:
990
pidfile = open(pidfilename, "w")
991
except IOError, error:
992
logger.error("Could not open file %r", pidfilename)
993
994
try:
995
uid = pwd.getpwnam("_mandos").pw_uid
996
gid = pwd.getpwnam("_mandos").pw_gid
997
except KeyError:
998
try:
999
uid = pwd.getpwnam("mandos").pw_uid
1000
gid = pwd.getpwnam("mandos").pw_gid
1001
except KeyError:
1002
try:
1003
uid = pwd.getpwnam("nobody").pw_uid
1004
gid = pwd.getpwnam("nogroup").pw_gid
1005
except KeyError:
1006
uid = 65534
1007
gid = 65534
1008
try:
1009
os.setuid(uid)
1010
os.setgid(gid)
1011
except OSError, error:
1012
if error[0] != errno.EPERM:
1013
raise error
1014
1015
761
global service
1016
762
service = AvahiService(name = server_settings["servicename"],
1017
servicetype = "_mandos._tcp", )
763
type = "_mandos._tcp", );
1018
764
if server_settings["interface"]:
1019
service.interface = (if_nametoindex
1020
(server_settings["interface"]))
765
service.interface = if_nametoindex\
766
(server_settings["interface"])
1021
767
1022
768
global main_loop
1023
769
global bus
1030
776
avahi.DBUS_PATH_SERVER),
1031
777
avahi.DBUS_INTERFACE_SERVER)
1032
778
# End of Avahi example code
1033
if use_dbus:
1034
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1035
bus)
779
780
clients = Set()
781
def remove_from_clients(client):
782
clients.remove(client)
783
if not clients:
784
logger.critical(u"No clients left, exiting")
785
sys.exit()
1036
786
1037
787
clients.update(Set(Client(name = section,
788
stop_hook = remove_from_clients,
1038
789
config
1039
= dict(client_config.items(section)),
1040
use_dbus = use_dbus)
790
= dict(client_config.items(section)))
1041
791
for section in client_config.sections()))
1042
792
if not clients:
1043
logger.warning(u"No clients defined")
793
logger.critical(u"No clients defined")
794
sys.exit(1)
1044
795
1045
796
if debug:
1046
797
# Redirect stdin so all checkers get /dev/null
1054
805
# Close all input and output, do double fork, etc.
1055
806
daemon()
1056
807
808
pidfilename = "/var/run/mandos/mandos.pid"
809
pid = os.getpid()
1057
810
try:
1058
pid = os.getpid()
811
pidfile = open(pidfilename, "w")
1059
812
pidfile.write(str(pid) + "\n")
1060
813
pidfile.close()
1061
814
del pidfile
1062
except IOError:
1063
logger.error(u"Could not write to file %r with PID %d",
1064
pidfilename, pid)
1065
except NameError:
1066
# "pidfile" was never created
1067
pass
1068
del pidfilename
815
except IOError, err:
816
logger.error(u"Could not write %s file with PID %d",
817
pidfilename, os.getpid())
1069
818
1070
819
def cleanup():
1071
820
"Cleanup function; run on exit"
1078
827
1079
828
while clients:
1080
829
client = clients.pop()
1081
client.disable_hook = None
1082
client.disable()
830
client.stop_hook = None
831
client.stop()
1083
832
1084
833
atexit.register(cleanup)
1085
834
1088
837
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1089
838
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1090
839
1091
if use_dbus:
1092
class MandosServer(dbus.service.Object):
1093
"""A D-Bus proxy object"""
1094
def __init__(self):
1095
dbus.service.Object.__init__(self, bus,
1096
"/Mandos")
1097
_interface = u"org.mandos_system.Mandos"
1098
1099
@dbus.service.signal(_interface, signature="oa{sv}")
1100
def ClientAdded(self, objpath, properties):
1101
"D-Bus signal"
1102
pass
1103
1104
@dbus.service.signal(_interface, signature="o")
1105
def ClientRemoved(self, objpath):
1106
"D-Bus signal"
1107
pass
1108
1109
@dbus.service.method(_interface, out_signature="ao")
1110
def GetAllClients(self):
1111
return dbus.Array(c.dbus_object_path for c in clients)
1112
1113
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1114
def GetAllClientsWithProperties(self):
1115
return dbus.Dictionary(
1116
((c.dbus_object_path, c.GetAllProperties())
1117
for c in clients),
1118
signature="oa{sv}")
1119
1120
@dbus.service.method(_interface, in_signature="o")
1121
def RemoveClient(self, object_path):
1122
for c in clients:
1123
if c.dbus_object_path == object_path:
1124
clients.remove(c)
1125
# Don't signal anything except ClientRemoved
1126
c.use_dbus = False
1127
c.disable()
1128
# Emit D-Bus signal
1129
self.ClientRemoved(object_path)
1130
return
1131
raise KeyError
1132
@dbus.service.method(_interface)
1133
def Quit(self):
1134
main_loop.quit()
1135
1136
del _interface
1137
1138
mandos_server = MandosServer()
1139
1140
840
for client in clients:
1141
if use_dbus:
1142
# Emit D-Bus signal
1143
mandos_server.ClientAdded(client.dbus_object_path,
1144
client.GetAllProperties())
1145
client.enable()
1146
1147
tcp_server.enable()
1148
tcp_server.server_activate()
1149
841
client.start()
842
843
tcp_server = IPv6_TCPServer((server_settings["address"],
844
server_settings["port"]),
845
tcp_handler,
846
settings=server_settings,
847
clients=clients)
1150
848
# Find out what port we got
1151
849
service.port = tcp_server.socket.getsockname()[1]
1152
850
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1166
864
1167
865
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1168
866
lambda *args, **kwargs:
1169
(tcp_server.handle_request
1170
(*args[2:], **kwargs) or True))
867
tcp_server.handle_request\
868
(*args[2:], **kwargs) or True)
1171
869
1172
870
logger.debug(u"Starting main loop")
871
main_loop_started = True
1173
872
main_loop.run()
1174
873
except AvahiError, error:
1175
logger.critical(u"AvahiError: %s", error)
874
logger.critical(u"AvahiError: %s" + unicode(error))
1176
875
sys.exit(1)
1177
876
except KeyboardInterrupt:
1178
877
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0