170
168
# End of Avahi example code
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
178
class Client(dbus.service.Object):
171
class Client(object):
179
172
"""A representation of a client host served by this server.
181
name: string; from the config file, used in log messages and
174
name: string; from the config file, used in log messages
183
175
fingerprint: string (40 or 32 hexadecimal digits); used to
184
176
uniquely identify the client
185
secret: bytestring; sent verbatim (over TLS) to client
186
host: string; available for use by the checker command
187
created: datetime.datetime(); (UTC) object creation
188
last_enabled: datetime.datetime(); (UTC)
190
last_checked_ok: datetime.datetime(); (UTC) or None
191
timeout: datetime.timedelta(); How long from last_checked_ok
192
until this client is invalid
193
interval: datetime.timedelta(); How often to start a new checker
194
disable_hook: If set, called by disable() as disable_hook(self)
195
checker: subprocess.Popen(); a running checker process used
196
to see if the client lives.
197
'None' if no process is running.
177
secret: bytestring; sent verbatim (over TLS) to client
178
host: string; available for use by the checker command
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
181
timeout: datetime.timedelta(); How long from last_checked_ok
182
until this client is invalid
183
interval: datetime.timedelta(); How often to start a new checker
184
stop_hook: If set, called by stop() as stop_hook(self)
185
checker: subprocess.Popen(); a running checker process used
186
to see if the client lives.
187
'None' if no process is running.
198
188
checker_initiator_tag: a gobject event source tag, or None
199
disable_initiator_tag: - '' -
189
stop_initiator_tag: - '' -
200
190
checker_callback_tag: - '' -
201
191
checker_command: string; External command which is run to check if
202
192
client lives. %() expansions are done at
203
193
runtime with vars(self) as dict, so that for
204
194
instance %(name)s can be used in the command.
205
use_dbus: bool(); Whether to provide D-Bus interface and signals
206
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
196
_timeout: Real variable for 'timeout'
197
_interval: Real variable for 'interval'
198
_timeout_milliseconds: Used when calling gobject.timeout_add()
199
_interval_milliseconds: - '' -
208
def timeout_milliseconds(self):
209
"Return the 'timeout' attribute in milliseconds"
210
return ((self.timeout.days * 24 * 60 * 60 * 1000)
211
+ (self.timeout.seconds * 1000)
212
+ (self.timeout.microseconds // 1000))
214
def interval_milliseconds(self):
215
"Return the 'interval' attribute in milliseconds"
216
return ((self.interval.days * 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds * 1000)
218
+ (self.interval.microseconds // 1000))
220
def __init__(self, name = None, disable_hook=None, config=None,
201
def _set_timeout(self, timeout):
202
"Setter function for 'timeout' attribute"
203
self._timeout = timeout
204
self._timeout_milliseconds = ((self.timeout.days
205
* 24 * 60 * 60 * 1000)
206
+ (self.timeout.seconds * 1000)
207
+ (self.timeout.microseconds
209
timeout = property(lambda self: self._timeout,
212
def _set_interval(self, interval):
213
"Setter function for 'interval' attribute"
214
self._interval = interval
215
self._interval_milliseconds = ((self.interval.days
216
* 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds
219
+ (self.interval.microseconds
221
interval = property(lambda self: self._interval,
224
def __init__(self, name = None, stop_hook=None, config={}):
222
225
"""Note: the 'checker' key in 'config' sets the
223
226
'checker_command' attribute and *not* the 'checker'
228
229
logger.debug(u"Creating client %r", self.name)
229
self.use_dbus = use_dbus
231
self.dbus_object_path = (dbus.ObjectPath
233
+ self.name.replace(".", "_")))
234
dbus.service.Object.__init__(self, bus,
235
self.dbus_object_path)
236
230
# Uppercase and remove spaces from fingerprint for later
237
231
# comparison purposes with return value from the fingerprint()
239
self.fingerprint = (config["fingerprint"].upper()
233
self.fingerprint = config["fingerprint"].upper()\
241
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
242
236
if "secret" in config:
243
237
self.secret = config["secret"].decode(u"base64")
244
238
elif "secfile" in config:
245
with closing(open(os.path.expanduser
247
(config["secfile"])))) as secfile:
248
self.secret = secfile.read()
239
sf = open(config["secfile"])
240
self.secret = sf.read()
250
243
raise TypeError(u"No secret or secfile for client %s"
252
245
self.host = config.get("host", "")
253
self.created = datetime.datetime.utcnow()
255
self.last_enabled = None
246
self.created = datetime.datetime.now()
256
247
self.last_checked_ok = None
257
248
self.timeout = string_to_delta(config["timeout"])
258
249
self.interval = string_to_delta(config["interval"])
259
self.disable_hook = disable_hook
250
self.stop_hook = stop_hook
260
251
self.checker = None
261
252
self.checker_initiator_tag = None
262
self.disable_initiator_tag = None
253
self.stop_initiator_tag = None
263
254
self.checker_callback_tag = None
264
self.checker_command = config["checker"]
255
self.check_command = config["checker"]
267
257
"""Start this client's checker and timeout hooks"""
268
self.last_enabled = datetime.datetime.utcnow()
269
258
# Schedule a new checker to be started an 'interval' from now,
270
259
# and every interval from then on.
271
self.checker_initiator_tag = (gobject.timeout_add
272
(self.interval_milliseconds(),
260
self.checker_initiator_tag = gobject.timeout_add\
261
(self._interval_milliseconds,
274
263
# Also start a new checker *right now*.
275
264
self.start_checker()
276
# Schedule a disable() when 'timeout' has passed
277
self.disable_initiator_tag = (gobject.timeout_add
278
(self.timeout_milliseconds(),
283
self.PropertyChanged(dbus.String(u"enabled"),
284
dbus.Boolean(True, variant_level=1))
285
self.PropertyChanged(dbus.String(u"last_enabled"),
286
(_datetime_to_dbus(self.last_enabled,
290
"""Disable this client."""
291
if not getattr(self, "enabled", False):
265
# Schedule a stop() when 'timeout' has passed
266
self.stop_initiator_tag = gobject.timeout_add\
267
(self._timeout_milliseconds,
271
The possibility that a client might be restarted is left open,
272
but not currently used."""
273
# If this client doesn't have a secret, it is already stopped.
274
if hasattr(self, "secret") and self.secret:
275
logger.info(u"Stopping client %s", self.name)
293
logger.info(u"Disabling client %s", self.name)
294
if getattr(self, "disable_initiator_tag", False):
295
gobject.source_remove(self.disable_initiator_tag)
296
self.disable_initiator_tag = None
279
if getattr(self, "stop_initiator_tag", False):
280
gobject.source_remove(self.stop_initiator_tag)
281
self.stop_initiator_tag = None
297
282
if getattr(self, "checker_initiator_tag", False):
298
283
gobject.source_remove(self.checker_initiator_tag)
299
284
self.checker_initiator_tag = None
300
285
self.stop_checker()
301
if self.disable_hook:
302
self.disable_hook(self)
306
self.PropertyChanged(dbus.String(u"enabled"),
307
dbus.Boolean(False, variant_level=1))
308
288
# Do not run this again if called by a gobject.timeout_add
311
290
def __del__(self):
312
self.disable_hook = None
315
def checker_callback(self, pid, condition, command):
291
self.stop_hook = None
293
def checker_callback(self, pid, condition):
316
294
"""The checker has completed, so take appropriate actions."""
295
now = datetime.datetime.now()
317
296
self.checker_callback_tag = None
318
297
self.checker = None
321
self.PropertyChanged(dbus.String(u"checker_running"),
322
dbus.Boolean(False, variant_level=1))
323
if (os.WIFEXITED(condition)
324
and (os.WEXITSTATUS(condition) == 0)):
298
if os.WIFEXITED(condition) \
299
and (os.WEXITSTATUS(condition) == 0):
325
300
logger.info(u"Checker for %(name)s succeeded",
329
self.CheckerCompleted(dbus.Boolean(True),
330
dbus.UInt16(condition),
331
dbus.String(command))
302
self.last_checked_ok = now
303
gobject.source_remove(self.stop_initiator_tag)
304
self.stop_initiator_tag = gobject.timeout_add\
305
(self._timeout_milliseconds,
333
307
elif not os.WIFEXITED(condition):
334
308
logger.warning(u"Checker for %(name)s crashed?",
338
self.CheckerCompleted(dbus.Boolean(False),
339
dbus.UInt16(condition),
340
dbus.String(command))
342
311
logger.info(u"Checker for %(name)s failed",
346
self.CheckerCompleted(dbus.Boolean(False),
347
dbus.UInt16(condition),
348
dbus.String(command))
350
def bump_timeout(self):
351
"""Bump up the timeout for this client.
352
This should only be called when the client has been seen,
355
self.last_checked_ok = datetime.datetime.utcnow()
356
gobject.source_remove(self.disable_initiator_tag)
357
self.disable_initiator_tag = (gobject.timeout_add
358
(self.timeout_milliseconds(),
362
self.PropertyChanged(
363
dbus.String(u"last_checked_ok"),
364
(_datetime_to_dbus(self.last_checked_ok,
367
313
def start_checker(self):
368
314
"""Start a new checker subprocess if one is not running.
369
315
If a checker already exists, leave it running and do
434
372
if error.errno != errno.ESRCH: # No such process
436
374
self.checker = None
438
self.PropertyChanged(dbus.String(u"checker_running"),
439
dbus.Boolean(False, variant_level=1))
441
375
def still_valid(self):
442
376
"""Has the timeout not yet passed for this client?"""
443
if not getattr(self, "enabled", False):
445
now = datetime.datetime.utcnow()
377
now = datetime.datetime.now()
446
378
if self.last_checked_ok is None:
447
379
return now < (self.created + self.timeout)
449
381
return now < (self.last_checked_ok + self.timeout)
451
## D-Bus methods & signals
452
_interface = u"org.mandos_system.Mandos.Client"
454
# BumpTimeout - method
455
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
456
BumpTimeout.__name__ = "BumpTimeout"
458
# CheckerCompleted - signal
459
@dbus.service.signal(_interface, signature="bqs")
460
def CheckerCompleted(self, success, condition, command):
464
# CheckerStarted - signal
465
@dbus.service.signal(_interface, signature="s")
466
def CheckerStarted(self, command):
470
# GetAllProperties - method
471
@dbus.service.method(_interface, out_signature="a{sv}")
472
def GetAllProperties(self):
474
return dbus.Dictionary({
476
dbus.String(self.name, variant_level=1),
477
dbus.String("fingerprint"):
478
dbus.String(self.fingerprint, variant_level=1),
480
dbus.String(self.host, variant_level=1),
481
dbus.String("created"):
482
_datetime_to_dbus(self.created, variant_level=1),
483
dbus.String("last_enabled"):
484
(_datetime_to_dbus(self.last_enabled,
486
if self.last_enabled is not None
487
else dbus.Boolean(False, variant_level=1)),
488
dbus.String("enabled"):
489
dbus.Boolean(self.enabled, variant_level=1),
490
dbus.String("last_checked_ok"):
491
(_datetime_to_dbus(self.last_checked_ok,
493
if self.last_checked_ok is not None
494
else dbus.Boolean (False, variant_level=1)),
495
dbus.String("timeout"):
496
dbus.UInt64(self.timeout_milliseconds(),
498
dbus.String("interval"):
499
dbus.UInt64(self.interval_milliseconds(),
501
dbus.String("checker"):
502
dbus.String(self.checker_command,
504
dbus.String("checker_running"):
505
dbus.Boolean(self.checker is not None,
507
dbus.String("object_path"):
508
dbus.ObjectPath(self.dbus_object_path,
512
# IsStillValid - method
513
IsStillValid = (dbus.service.method(_interface, out_signature="b")
515
IsStillValid.__name__ = "IsStillValid"
517
# PropertyChanged - signal
518
@dbus.service.signal(_interface, signature="sv")
519
def PropertyChanged(self, property, value):
523
# SetChecker - method
524
@dbus.service.method(_interface, in_signature="s")
525
def SetChecker(self, checker):
526
"D-Bus setter method"
527
self.checker_command = checker
529
self.PropertyChanged(dbus.String(u"checker"),
530
dbus.String(self.checker_command,
534
@dbus.service.method(_interface, in_signature="s")
535
def SetHost(self, host):
536
"D-Bus setter method"
539
self.PropertyChanged(dbus.String(u"host"),
540
dbus.String(self.host, variant_level=1))
542
# SetInterval - method
543
@dbus.service.method(_interface, in_signature="t")
544
def SetInterval(self, milliseconds):
545
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
547
self.PropertyChanged(dbus.String(u"interval"),
548
(dbus.UInt64(self.interval_milliseconds(),
552
@dbus.service.method(_interface, in_signature="ay",
554
def SetSecret(self, secret):
555
"D-Bus setter method"
556
self.secret = str(secret)
558
# SetTimeout - method
559
@dbus.service.method(_interface, in_signature="t")
560
def SetTimeout(self, milliseconds):
561
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
563
self.PropertyChanged(dbus.String(u"timeout"),
564
(dbus.UInt64(self.timeout_milliseconds(),
568
Enable = dbus.service.method(_interface)(enable)
569
Enable.__name__ = "Enable"
571
# StartChecker - method
572
@dbus.service.method(_interface)
573
def StartChecker(self):
578
@dbus.service.method(_interface)
583
# StopChecker - method
584
StopChecker = dbus.service.method(_interface)(stop_checker)
585
StopChecker.__name__ = "StopChecker"
590
384
def peer_certificate(session):
591
385
"Return the peer's OpenPGP certificate as a bytestring"
592
386
# If not an OpenPGP certificate...
593
if (gnutls.library.functions
594
.gnutls_certificate_type_get(session._c_object)
595
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
387
if gnutls.library.functions.gnutls_certificate_type_get\
388
(session._c_object) \
389
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
596
390
# ...do the normal thing
597
391
return session.peer_certificate
598
392
list_size = ctypes.c_uint()
599
cert_list = (gnutls.library.functions
600
.gnutls_certificate_get_peers
601
(session._c_object, ctypes.byref(list_size)))
393
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
394
(session._c_object, ctypes.byref(list_size))
602
395
if list_size.value == 0:
604
397
cert = cert_list[0]
608
401
def fingerprint(openpgp):
609
402
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
610
403
# New GnuTLS "datum" with the OpenPGP public key
611
datum = (gnutls.library.types
612
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
615
ctypes.c_uint(len(openpgp))))
404
datum = gnutls.library.types.gnutls_datum_t\
405
(ctypes.cast(ctypes.c_char_p(openpgp),
406
ctypes.POINTER(ctypes.c_ubyte)),
407
ctypes.c_uint(len(openpgp)))
616
408
# New empty GnuTLS certificate
617
409
crt = gnutls.library.types.gnutls_openpgp_crt_t()
618
(gnutls.library.functions
619
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
410
gnutls.library.functions.gnutls_openpgp_crt_init\
620
412
# Import the OpenPGP public key into the certificate
621
(gnutls.library.functions
622
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
623
gnutls.library.constants
624
.GNUTLS_OPENPGP_FMT_RAW))
413
gnutls.library.functions.gnutls_openpgp_crt_import\
414
(crt, ctypes.byref(datum),
415
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
625
416
# Verify the self signature in the key
626
crtverify = ctypes.c_uint()
627
(gnutls.library.functions
628
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
417
crtverify = ctypes.c_uint();
418
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
419
(crt, 0, ctypes.byref(crtverify))
629
420
if crtverify.value != 0:
630
421
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
631
422
raise gnutls.errors.CertificateSecurityError("Verify failed")
632
423
# New buffer for the fingerprint
633
buf = ctypes.create_string_buffer(20)
634
buf_len = ctypes.c_size_t()
424
buffer = ctypes.create_string_buffer(20)
425
buffer_length = ctypes.c_size_t()
635
426
# Get the fingerprint from the certificate into the buffer
636
(gnutls.library.functions
637
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
638
ctypes.byref(buf_len)))
427
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
428
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
639
429
# Deinit the certificate
640
430
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
641
431
# Convert the buffer to a Python bytestring
642
fpr = ctypes.string_at(buf, buf_len.value)
432
fpr = ctypes.string_at(buffer, buffer_length.value)
643
433
# Convert the bytestring to hexadecimal notation
644
434
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
648
class TCP_handler(SocketServer.BaseRequestHandler, object):
438
class tcp_handler(SocketServer.BaseRequestHandler, object):
649
439
"""A TCP request handler class.
650
440
Instantiated by IPv6_TCPServer for each request to handle it.
651
441
Note: This will run in its own forked process."""
653
443
def handle(self):
654
444
logger.info(u"TCP connection from: %s",
655
unicode(self.client_address))
656
session = (gnutls.connection
657
.ClientSession(self.request,
445
unicode(self.client_address))
446
session = gnutls.connection.ClientSession\
447
(self.request, gnutls.connection.X509Credentials())
661
449
line = self.request.makefile().readline()
662
450
logger.debug(u"Protocol version: %r", line)
1092
837
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1093
838
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1096
class MandosServer(dbus.service.Object):
1097
"""A D-Bus proxy object"""
1099
dbus.service.Object.__init__(self, bus,
1101
_interface = u"org.mandos_system.Mandos"
1103
@dbus.service.signal(_interface, signature="oa{sv}")
1104
def ClientAdded(self, objpath, properties):
1108
@dbus.service.signal(_interface, signature="os")
1109
def ClientRemoved(self, objpath, name):
1113
@dbus.service.method(_interface, out_signature="ao")
1114
def GetAllClients(self):
1115
return dbus.Array(c.dbus_object_path for c in clients)
1117
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1118
def GetAllClientsWithProperties(self):
1119
return dbus.Dictionary(
1120
((c.dbus_object_path, c.GetAllProperties())
1124
@dbus.service.method(_interface, in_signature="o")
1125
def RemoveClient(self, object_path):
1127
if c.dbus_object_path == object_path:
1129
# Don't signal anything except ClientRemoved
1133
self.ClientRemoved(object_path, c.name)
1137
@dbus.service.method(_interface, in_signature="s")
1138
def RemoveClientByName(self, name):
1142
# Don't signal anything except ClientRemoved
1146
self.ClientRemoved(c.dbus_object_path, name)
1150
@dbus.service.method(_interface)
1156
mandos_server = MandosServer()
1158
840
for client in clients:
1161
mandos_server.ClientAdded(client.dbus_object_path,
1162
client.GetAllProperties())
1166
tcp_server.server_activate()
843
tcp_server = IPv6_TCPServer((server_settings["address"],
844
server_settings["port"]),
846
settings=server_settings,
1168
848
# Find out what port we got
1169
849
service.port = tcp_server.socket.getsockname()[1]
1170
850
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"