52
22
from sets import Set
57
import logging.handlers
59
from contextlib import closing
65
28
from dbus.mainloop.glib import DBusGMainLoop
32
import logging.handlers
34
# logghandler.setFormatter(logging.Formatter('%(levelname)s %(message)s')
71
36
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
77
logger.addHandler(syslogger)
79
console = logging.StreamHandler()
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
82
logger.addHandler(console)
84
class AvahiError(Exception):
85
def __init__(self, value, *args, **kwargs):
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
91
class AvahiServiceError(AvahiError):
94
class AvahiGroupError(AvahiError):
98
class AvahiService(object):
99
"""An Avahi (Zeroconf) service.
101
interface: integer; avahi.IF_UNSPEC or an interface index.
102
Used to optionally bind to the specified interface.
103
name: string; Example: 'Mandos'
104
type: string; Example: '_mandos._tcp'.
105
See <http://www.dns-sd.org/ServiceTypes.html>
106
port: integer; what port to announce
107
TXT: list of strings; TXT record for the service
108
domain: string; Domain to publish on, default to .local if empty.
109
host: string; Host to publish records for, default is localhost
110
max_renames: integer; maximum number of renames
111
rename_count: integer; counter so we only rename after collisions
112
a sensible number of times
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
117
self.interface = interface
119
self.type = servicetype
121
self.TXT = TXT if TXT is not None else []
124
self.rename_count = 0
125
self.max_renames = max_renames
127
"""Derived from the Avahi example code"""
128
if self.rename_count >= self.max_renames:
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
132
raise AvahiServiceError(u"Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
136
syslogger.setFormatter(logging.Formatter
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
141
self.rename_count += 1
143
"""Derived from the Avahi example code"""
144
if group is not None:
147
"""Derived from the Avahi example code"""
150
group = dbus.Interface(bus.get_object
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
157
service.name, service.type)
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
168
# From the Avahi example code:
169
group = None # our entry group
37
logger.addHandler(logging.handlers.SysLogHandler(facility = logging.handlers.SysLogHandler.LOG_DAEMON))
39
# This variable is used to optionally bind to a specified interface.
40
# It is a global variable to fit in with the other variables from the
41
# Avahi server example code.
42
serviceInterface = avahi.IF_UNSPEC
43
# From the Avahi server example code:
44
serviceName = "Mandos"
45
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
46
servicePort = None # Not known at startup
47
serviceTXT = [] # TXT record for the service
48
domain = "" # Domain to publish on, default to .local
49
host = "" # Host to publish records for, default to localhost
50
group = None #our entry group
51
rename_count = 12 # Counter so we only rename after collisions a
52
# sensible number of times
170
53
# End of Avahi example code
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
178
class Client(dbus.service.Object):
179
57
"""A representation of a client host served by this server.
181
name: string; from the config file, used in log messages and
59
name: string; from the config file, used in log messages
183
60
fingerprint: string (40 or 32 hexadecimal digits); used to
184
61
uniquely identify the client
185
secret: bytestring; sent verbatim (over TLS) to client
186
host: string; available for use by the checker command
187
created: datetime.datetime(); (UTC) object creation
188
last_enabled: datetime.datetime(); (UTC)
190
last_checked_ok: datetime.datetime(); (UTC) or None
191
timeout: datetime.timedelta(); How long from last_checked_ok
192
until this client is invalid
193
interval: datetime.timedelta(); How often to start a new checker
194
disable_hook: If set, called by disable() as disable_hook(self)
195
checker: subprocess.Popen(); a running checker process used
196
to see if the client lives.
197
'None' if no process is running.
62
secret: bytestring; sent verbatim (over TLS) to client
63
fqdn: string (FQDN); available for use by the checker command
64
created: datetime.datetime()
65
last_seen: datetime.datetime() or None if not yet seen
66
timeout: datetime.timedelta(); How long from last_seen until
67
this client is invalid
68
interval: datetime.timedelta(); How often to start a new checker
69
stop_hook: If set, called by stop() as stop_hook(self)
70
checker: subprocess.Popen(); a running checker process used
71
to see if the client lives.
72
Is None if no process is running.
198
73
checker_initiator_tag: a gobject event source tag, or None
199
disable_initiator_tag: - '' -
74
stop_initiator_tag: - '' -
200
75
checker_callback_tag: - '' -
201
76
checker_command: string; External command which is run to check if
202
client lives. %() expansions are done at
77
client lives. %()s expansions are done at
203
78
runtime with vars(self) as dict, so that for
204
79
instance %(name)s can be used in the command.
205
use_dbus: bool(); Whether to provide D-Bus interface and signals
206
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
81
_timeout: Real variable for 'timeout'
82
_interval: Real variable for 'interval'
83
_timeout_milliseconds: Used by gobject.timeout_add()
84
_interval_milliseconds: - '' -
208
def timeout_milliseconds(self):
209
"Return the 'timeout' attribute in milliseconds"
210
return ((self.timeout.days * 24 * 60 * 60 * 1000)
211
+ (self.timeout.seconds * 1000)
212
+ (self.timeout.microseconds // 1000))
214
def interval_milliseconds(self):
215
"Return the 'interval' attribute in milliseconds"
216
return ((self.interval.days * 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds * 1000)
218
+ (self.interval.microseconds // 1000))
220
def __init__(self, name = None, disable_hook=None, config=None,
222
"""Note: the 'checker' key in 'config' sets the
223
'checker_command' attribute and *not* the 'checker'
86
def _set_timeout(self, timeout):
87
"Setter function for 'timeout' attribute"
88
self._timeout = timeout
89
self._timeout_milliseconds = ((self.timeout.days
90
* 24 * 60 * 60 * 1000)
91
+ (self.timeout.seconds * 1000)
92
+ (self.timeout.microseconds
94
timeout = property(lambda self: self._timeout,
97
def _set_interval(self, interval):
98
"Setter function for 'interval' attribute"
99
self._interval = interval
100
self._interval_milliseconds = ((self.interval.days
101
* 24 * 60 * 60 * 1000)
102
+ (self.interval.seconds
104
+ (self.interval.microseconds
106
interval = property(lambda self: self._interval,
109
def __init__(self, name=None, options=None, stop_hook=None,
110
fingerprint=None, secret=None, secfile=None, fqdn=None,
111
timeout=None, interval=-1, checker=None):
228
logger.debug(u"Creating client %r", self.name)
229
self.use_dbus = False # During __init__
230
# Uppercase and remove spaces from fingerprint for later
231
# comparison purposes with return value from the fingerprint()
233
self.fingerprint = (config["fingerprint"].upper()
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
236
if "secret" in config:
237
self.secret = config["secret"].decode(u"base64")
238
elif "secfile" in config:
239
with closing(open(os.path.expanduser
241
(config["secfile"])))) as secfile:
242
self.secret = secfile.read()
244
raise TypeError(u"No secret or secfile for client %s"
246
self.host = config.get("host", "")
247
self.created = datetime.datetime.utcnow()
249
self.last_enabled = None
250
self.last_checked_ok = None
251
self.timeout = string_to_delta(config["timeout"])
252
self.interval = string_to_delta(config["interval"])
253
self.disable_hook = disable_hook
113
# Uppercase and remove spaces from fingerprint
114
# for later comparison purposes with return value of
115
# the fingerprint() function
116
self.fingerprint = fingerprint.upper().replace(u" ", u"")
118
self.secret = secret.decode(u"base64")
121
self.secret = sf.read()
124
raise RuntimeError(u"No secret or secfile for client %s"
126
self.fqdn = fqdn # string
127
self.created = datetime.datetime.now()
128
self.last_seen = None
130
timeout = options.timeout
131
self.timeout = timeout
133
interval = options.interval
135
interval = string_to_delta(interval)
136
self.interval = interval
137
self.stop_hook = stop_hook
254
138
self.checker = None
255
139
self.checker_initiator_tag = None
256
self.disable_initiator_tag = None
140
self.stop_initiator_tag = None
257
141
self.checker_callback_tag = None
258
self.checker_command = config["checker"]
259
self.last_connect = None
260
# Only now, when this client is initialized, can it show up on
262
self.use_dbus = use_dbus
264
self.dbus_object_path = (dbus.ObjectPath
266
+ self.name.replace(".", "_")))
267
dbus.service.Object.__init__(self, bus,
268
self.dbus_object_path)
271
"""Start this client's checker and timeout hooks"""
272
self.last_enabled = datetime.datetime.utcnow()
142
self.check_command = checker
144
"""Start this clients checker and timeout hooks"""
273
145
# Schedule a new checker to be started an 'interval' from now,
274
146
# and every interval from then on.
275
self.checker_initiator_tag = (gobject.timeout_add
276
(self.interval_milliseconds(),
147
self.checker_initiator_tag = gobject.timeout_add\
148
(self._interval_milliseconds,
278
150
# Also start a new checker *right now*.
279
151
self.start_checker()
280
# Schedule a disable() when 'timeout' has passed
281
self.disable_initiator_tag = (gobject.timeout_add
282
(self.timeout_milliseconds(),
287
self.PropertyChanged(dbus.String(u"enabled"),
288
dbus.Boolean(True, variant_level=1))
289
self.PropertyChanged(dbus.String(u"last_enabled"),
290
(_datetime_to_dbus(self.last_enabled,
294
"""Disable this client."""
295
if not getattr(self, "enabled", False):
297
logger.info(u"Disabling client %s", self.name)
298
if getattr(self, "disable_initiator_tag", False):
299
gobject.source_remove(self.disable_initiator_tag)
300
self.disable_initiator_tag = None
301
if getattr(self, "checker_initiator_tag", False):
152
# Schedule a stop() when 'timeout' has passed
153
self.stop_initiator_tag = gobject.timeout_add\
154
(self._timeout_milliseconds,
158
The possibility that this client might be restarted is left
159
open, but not currently used."""
160
logger.debug(u"Stopping client %s", self.name)
162
if self.stop_initiator_tag:
163
gobject.source_remove(self.stop_initiator_tag)
164
self.stop_initiator_tag = None
165
if self.checker_initiator_tag:
302
166
gobject.source_remove(self.checker_initiator_tag)
303
167
self.checker_initiator_tag = None
304
168
self.stop_checker()
305
if self.disable_hook:
306
self.disable_hook(self)
310
self.PropertyChanged(dbus.String(u"enabled"),
311
dbus.Boolean(False, variant_level=1))
312
171
# Do not run this again if called by a gobject.timeout_add
315
173
def __del__(self):
316
self.disable_hook = None
319
def checker_callback(self, pid, condition, command):
174
# Some code duplication here and in stop()
175
if hasattr(self, "stop_initiator_tag") \
176
and self.stop_initiator_tag:
177
gobject.source_remove(self.stop_initiator_tag)
178
self.stop_initiator_tag = None
179
if hasattr(self, "checker_initiator_tag") \
180
and self.checker_initiator_tag:
181
gobject.source_remove(self.checker_initiator_tag)
182
self.checker_initiator_tag = None
184
def checker_callback(self, pid, condition):
320
185
"""The checker has completed, so take appropriate actions."""
321
self.checker_callback_tag = None
325
self.PropertyChanged(dbus.String(u"checker_running"),
326
dbus.Boolean(False, variant_level=1))
327
if (os.WIFEXITED(condition)
328
and (os.WEXITSTATUS(condition) == 0)):
329
logger.info(u"Checker for %(name)s succeeded",
333
self.CheckerCompleted(dbus.Boolean(True),
334
dbus.UInt16(condition),
335
dbus.String(command))
337
elif not os.WIFEXITED(condition):
186
now = datetime.datetime.now()
187
if os.WIFEXITED(condition) \
188
and (os.WEXITSTATUS(condition) == 0):
189
logger.debug(u"Checker for %(name)s succeeded",
192
gobject.source_remove(self.stop_initiator_tag)
193
self.stop_initiator_tag = gobject.timeout_add\
194
(self._timeout_milliseconds,
196
if not os.WIFEXITED(condition):
338
197
logger.warning(u"Checker for %(name)s crashed?",
342
self.CheckerCompleted(dbus.Boolean(False),
343
dbus.UInt16(condition),
344
dbus.String(command))
346
logger.info(u"Checker for %(name)s failed",
350
self.CheckerCompleted(dbus.Boolean(False),
351
dbus.UInt16(condition),
352
dbus.String(command))
354
def bump_timeout(self):
355
"""Bump up the timeout for this client.
356
This should only be called when the client has been seen,
359
self.last_checked_ok = datetime.datetime.utcnow()
360
gobject.source_remove(self.disable_initiator_tag)
361
self.disable_initiator_tag = (gobject.timeout_add
362
(self.timeout_milliseconds(),
366
self.PropertyChanged(
367
dbus.String(u"last_checked_ok"),
368
(_datetime_to_dbus(self.last_checked_ok,
200
logger.debug(u"Checker for %(name)s failed",
203
self.checker_callback_tag = None
371
204
def start_checker(self):
372
205
"""Start a new checker subprocess if one is not running.
373
206
If a checker already exists, leave it running and do
375
# The reason for not killing a running checker is that if we
376
# did that, then if a checker (for some reason) started
377
# running slowly and taking more than 'interval' time, the
378
# client would inevitably timeout, since no checker would get
379
# a chance to run to completion. If we instead leave running
380
# checkers alone, the checker would have to take more time
381
# than 'timeout' for the client to be declared invalid, which
382
# is as it should be.
383
208
if self.checker is None:
209
logger.debug(u"Starting checker for %s",
385
# In case checker_command has exactly one % operator
386
command = self.checker_command % self.host
212
command = self.check_command % self.fqdn
387
213
except TypeError:
388
# Escape attributes for the shell
389
214
escaped_attrs = dict((key, re.escape(str(val)))
391
216
vars(self).iteritems())
393
command = self.checker_command % escaped_attrs
218
command = self.check_command % escaped_attrs
394
219
except TypeError, error:
395
logger.error(u'Could not format string "%s":'
396
u' %s', self.checker_command, error)
220
logger.critical(u'Could not format string "%s": %s',
221
self.check_command, error)
397
222
return True # Try again later
399
logger.info(u"Starting checker %r for %s",
401
# We don't need to redirect stdout and stderr, since
402
# in normal mode, that is already done by daemon(),
403
# and in debug mode we don't want to. (Stdin is
404
# always replaced by /dev/null.)
405
self.checker = subprocess.Popen(command,
410
self.CheckerStarted(command)
411
self.PropertyChanged(
412
dbus.String("checker_running"),
413
dbus.Boolean(True, variant_level=1))
414
self.checker_callback_tag = (gobject.child_watch_add
416
self.checker_callback,
418
except OSError, error:
224
self.checker = subprocess.\
226
stdout=subprocess.PIPE,
227
close_fds=True, shell=True,
229
self.checker_callback_tag = gobject.\
230
child_watch_add(self.checker.pid,
233
except subprocess.OSError, error:
419
234
logger.error(u"Failed to start subprocess: %s",
421
236
# Re-run this periodically if run by gobject.timeout_add
424
238
def stop_checker(self):
425
239
"""Force the checker process, if any, to stop."""
426
if self.checker_callback_tag:
427
gobject.source_remove(self.checker_callback_tag)
428
self.checker_callback_tag = None
429
if getattr(self, "checker", None) is None:
240
if not hasattr(self, "checker") or self.checker is None:
431
logger.debug(u"Stopping checker for %(name)s", vars(self))
433
os.kill(self.checker.pid, signal.SIGTERM)
435
#if self.checker.poll() is None:
436
# os.kill(self.checker.pid, signal.SIGKILL)
437
except OSError, error:
438
if error.errno != errno.ESRCH: # No such process
242
gobject.source_remove(self.checker_callback_tag)
243
self.checker_callback_tag = None
244
os.kill(self.checker.pid, signal.SIGTERM)
245
if self.checker.poll() is None:
246
os.kill(self.checker.pid, signal.SIGKILL)
440
247
self.checker = None
442
self.PropertyChanged(dbus.String(u"checker_running"),
443
dbus.Boolean(False, variant_level=1))
445
def still_valid(self):
248
def still_valid(self, now=None):
446
249
"""Has the timeout not yet passed for this client?"""
447
if not getattr(self, "enabled", False):
449
now = datetime.datetime.utcnow()
450
if self.last_checked_ok is None:
251
now = datetime.datetime.now()
252
if self.last_seen is None:
451
253
return now < (self.created + self.timeout)
453
return now < (self.last_checked_ok + self.timeout)
455
## D-Bus methods & signals
456
_interface = u"se.bsnet.fukt.Mandos.Client"
458
# BumpTimeout - method
459
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
460
BumpTimeout.__name__ = "BumpTimeout"
462
# CheckerCompleted - signal
463
@dbus.service.signal(_interface, signature="bqs")
464
def CheckerCompleted(self, success, condition, command):
468
# CheckerStarted - signal
469
@dbus.service.signal(_interface, signature="s")
470
def CheckerStarted(self, command):
474
# GetAllProperties - method
475
@dbus.service.method(_interface, out_signature="a{sv}")
476
def GetAllProperties(self):
478
return dbus.Dictionary({
480
dbus.String(self.name, variant_level=1),
481
dbus.String("fingerprint"):
482
dbus.String(self.fingerprint, variant_level=1),
484
dbus.String(self.host, variant_level=1),
485
dbus.String("created"):
486
_datetime_to_dbus(self.created, variant_level=1),
487
dbus.String("last_enabled"):
488
(_datetime_to_dbus(self.last_enabled,
490
if self.last_enabled is not None
491
else dbus.Boolean(False, variant_level=1)),
492
dbus.String("enabled"):
493
dbus.Boolean(self.enabled, variant_level=1),
494
dbus.String("last_checked_ok"):
495
(_datetime_to_dbus(self.last_checked_ok,
497
if self.last_checked_ok is not None
498
else dbus.Boolean (False, variant_level=1)),
499
dbus.String("timeout"):
500
dbus.UInt64(self.timeout_milliseconds(),
502
dbus.String("interval"):
503
dbus.UInt64(self.interval_milliseconds(),
505
dbus.String("checker"):
506
dbus.String(self.checker_command,
508
dbus.String("checker_running"):
509
dbus.Boolean(self.checker is not None,
511
dbus.String("object_path"):
512
dbus.ObjectPath(self.dbus_object_path,
516
# IsStillValid - method
517
IsStillValid = (dbus.service.method(_interface, out_signature="b")
519
IsStillValid.__name__ = "IsStillValid"
521
# PropertyChanged - signal
522
@dbus.service.signal(_interface, signature="sv")
523
def PropertyChanged(self, property, value):
527
# SetChecker - method
528
@dbus.service.method(_interface, in_signature="s")
529
def SetChecker(self, checker):
530
"D-Bus setter method"
531
self.checker_command = checker
533
self.PropertyChanged(dbus.String(u"checker"),
534
dbus.String(self.checker_command,
538
@dbus.service.method(_interface, in_signature="s")
539
def SetHost(self, host):
540
"D-Bus setter method"
543
self.PropertyChanged(dbus.String(u"host"),
544
dbus.String(self.host, variant_level=1))
546
# SetInterval - method
547
@dbus.service.method(_interface, in_signature="t")
548
def SetInterval(self, milliseconds):
549
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
551
self.PropertyChanged(dbus.String(u"interval"),
552
(dbus.UInt64(self.interval_milliseconds(),
556
@dbus.service.method(_interface, in_signature="ay",
558
def SetSecret(self, secret):
559
"D-Bus setter method"
560
self.secret = str(secret)
562
# SetTimeout - method
563
@dbus.service.method(_interface, in_signature="t")
564
def SetTimeout(self, milliseconds):
565
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
567
self.PropertyChanged(dbus.String(u"timeout"),
568
(dbus.UInt64(self.timeout_milliseconds(),
572
Enable = dbus.service.method(_interface)(enable)
573
Enable.__name__ = "Enable"
575
# StartChecker - method
576
@dbus.service.method(_interface)
577
def StartChecker(self):
582
@dbus.service.method(_interface)
587
# StopChecker - method
588
StopChecker = dbus.service.method(_interface)(stop_checker)
589
StopChecker.__name__ = "StopChecker"
255
return now < (self.last_seen + self.timeout)
594
258
def peer_certificate(session):
595
"Return the peer's OpenPGP certificate as a bytestring"
596
259
# If not an OpenPGP certificate...
597
if (gnutls.library.functions
598
.gnutls_certificate_type_get(session._c_object)
599
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
260
if gnutls.library.functions.gnutls_certificate_type_get\
261
(session._c_object) \
262
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
600
263
# ...do the normal thing
601
264
return session.peer_certificate
602
265
list_size = ctypes.c_uint()
603
cert_list = (gnutls.library.functions
604
.gnutls_certificate_get_peers
605
(session._c_object, ctypes.byref(list_size)))
266
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
267
(session._c_object, ctypes.byref(list_size))
606
268
if list_size.value == 0:
608
270
cert = cert_list[0]
612
274
def fingerprint(openpgp):
613
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
614
# New GnuTLS "datum" with the OpenPGP public key
615
datum = (gnutls.library.types
616
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
619
ctypes.c_uint(len(openpgp))))
620
275
# New empty GnuTLS certificate
621
276
crt = gnutls.library.types.gnutls_openpgp_crt_t()
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
277
gnutls.library.functions.gnutls_openpgp_crt_init\
279
# New GnuTLS "datum" with the OpenPGP public key
280
datum = gnutls.library.types.gnutls_datum_t\
281
(ctypes.cast(ctypes.c_char_p(openpgp),
282
ctypes.POINTER(ctypes.c_ubyte)),
283
ctypes.c_uint(len(openpgp)))
624
284
# Import the OpenPGP public key into the certificate
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
627
gnutls.library.constants
628
.GNUTLS_OPENPGP_FMT_RAW))
629
# Verify the self signature in the key
630
crtverify = ctypes.c_uint()
631
(gnutls.library.functions
632
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
633
if crtverify.value != 0:
634
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
635
raise gnutls.errors.CertificateSecurityError("Verify failed")
285
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
288
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
636
289
# New buffer for the fingerprint
637
buf = ctypes.create_string_buffer(20)
638
buf_len = ctypes.c_size_t()
290
buffer = ctypes.create_string_buffer(20)
291
buffer_length = ctypes.c_size_t()
639
292
# Get the fingerprint from the certificate into the buffer
640
(gnutls.library.functions
641
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
642
ctypes.byref(buf_len)))
293
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
294
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
643
295
# Deinit the certificate
644
296
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
645
297
# Convert the buffer to a Python bytestring
646
fpr = ctypes.string_at(buf, buf_len.value)
298
fpr = ctypes.string_at(buffer, buffer_length.value)
647
299
# Convert the bytestring to hexadecimal notation
648
300
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
652
class TCP_handler(SocketServer.BaseRequestHandler, object):
304
class tcp_handler(SocketServer.BaseRequestHandler, object):
653
305
"""A TCP request handler class.
654
306
Instantiated by IPv6_TCPServer for each request to handle it.
655
307
Note: This will run in its own forked process."""
657
309
def handle(self):
658
logger.info(u"TCP connection from: %s",
659
unicode(self.client_address))
660
session = (gnutls.connection
661
.ClientSession(self.request,
665
line = self.request.makefile().readline()
666
logger.debug(u"Protocol version: %r", line)
668
if int(line.strip().split()[0]) > 1:
670
except (ValueError, IndexError, RuntimeError), error:
671
logger.error(u"Unknown protocol version: %s", error)
674
# Note: gnutls.connection.X509Credentials is really a generic
675
# GnuTLS certificate credentials object so long as no X.509
676
# keys are added to it. Therefore, we can use it here despite
677
# using OpenPGP certificates.
310
logger.debug(u"TCP connection from: %s",
311
unicode(self.client_address))
312
session = gnutls.connection.ClientSession(self.request,
679
316
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
680
317
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
682
# Use a fallback default, since this MUST be set.
683
priority = self.server.settings.get("priority", "NORMAL")
684
(gnutls.library.functions
685
.gnutls_priority_set_direct(session._c_object,
319
priority = "SECURE256"
321
gnutls.library.functions.gnutls_priority_set_direct\
322
(session._c_object, priority, None);
689
325
session.handshake()
690
326
except gnutls.errors.GNUTLSError, error:
691
logger.warning(u"Handshake failed: %s", error)
327
logger.debug(u"Handshake failed: %s", error)
692
328
# Do not run session.bye() here: the session is not
693
329
# established. Just abandon the request.
696
332
fpr = fingerprint(peer_certificate(session))
697
333
except (TypeError, gnutls.errors.GNUTLSError), error:
698
logger.warning(u"Bad certificate: %s", error)
334
logger.debug(u"Bad certificate: %s", error)
701
337
logger.debug(u"Fingerprint: %s", fpr)
702
for c in self.server.clients:
703
340
if c.fingerprint == fpr:
707
logger.warning(u"Client not found for fingerprint: %s",
711
343
# Have to check if client.still_valid(), since it is possible
712
344
# that the client timed out while establishing the GnuTLS
714
if not client.still_valid():
715
logger.warning(u"Client %(name)s is invalid",
346
if (not client) or (not client.still_valid()):
348
logger.debug(u"Client %(name)s is invalid",
351
logger.debug(u"Client not found for fingerprint: %s",
719
## This won't work here, since we're in a fork.
720
# client.bump_timeout()
722
356
while sent_size < len(client.secret):
723
357
sent = session.send(client.secret[sent_size:])
801
421
datetime.timedelta(1)
802
422
>>> string_to_delta(u'1w')
803
423
datetime.timedelta(7)
804
>>> string_to_delta('5m 30s')
805
datetime.timedelta(0, 330)
807
timevalue = datetime.timedelta(0)
808
for s in interval.split():
810
suffix = unicode(s[-1])
813
delta = datetime.timedelta(value)
815
delta = datetime.timedelta(0, value)
817
delta = datetime.timedelta(0, 0, 0, 0, value)
819
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
821
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
824
except (ValueError, IndexError):
426
suffix=unicode(interval[-1])
427
value=int(interval[:-1])
429
delta = datetime.timedelta(value)
431
delta = datetime.timedelta(0, value)
433
delta = datetime.timedelta(0, 0, 0, 0, value)
435
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
437
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
440
except (ValueError, IndexError):
446
"""From the Avahi server example code"""
447
global group, serviceName, serviceType, servicePort, serviceTXT, \
450
group = dbus.Interface(
451
bus.get_object( avahi.DBUS_NAME,
452
server.EntryGroupNew()),
453
avahi.DBUS_INTERFACE_ENTRY_GROUP)
454
group.connect_to_signal('StateChanged',
455
entry_group_state_changed)
456
logger.debug(u"Adding service '%s' of type '%s' ...",
457
serviceName, serviceType)
460
serviceInterface, # interface
461
avahi.PROTO_INET6, # protocol
462
dbus.UInt32(0), # flags
463
serviceName, serviceType,
465
dbus.UInt16(servicePort),
466
avahi.string_array_to_txt_array(serviceTXT))
470
def remove_service():
471
"""From the Avahi server example code"""
474
if not group is None:
830
478
def server_state_changed(state):
831
"""Derived from the Avahi example code"""
479
"""From the Avahi server example code"""
832
480
if state == avahi.SERVER_COLLISION:
833
logger.error(u"Zeroconf server name collision")
481
logger.warning(u"Server name collision")
835
483
elif state == avahi.SERVER_RUNNING:
839
487
def entry_group_state_changed(state, error):
840
"""Derived from the Avahi example code"""
841
logger.debug(u"Avahi state change: %i", state)
488
"""From the Avahi server example code"""
489
global serviceName, server, rename_count
491
logger.debug(u"state change: %i", state)
843
493
if state == avahi.ENTRY_GROUP_ESTABLISHED:
844
logger.debug(u"Zeroconf service established.")
494
logger.debug(u"Service established.")
845
495
elif state == avahi.ENTRY_GROUP_COLLISION:
846
logger.warning(u"Zeroconf service name collision.")
497
rename_count = rename_count - 1
499
name = server.GetAlternativeServiceName(name)
500
logger.warning(u"Service name collision, "
501
u"changing name to '%s' ...", name)
506
logger.error(u"No suitable service name found "
507
u"after %i retries, exiting.",
848
510
elif state == avahi.ENTRY_GROUP_FAILURE:
849
logger.critical(u"Avahi: Error in group state changed %s",
851
raise AvahiGroupError(u"State changed: %s" % unicode(error))
511
logger.error(u"Error in group state changed %s",
853
517
def if_nametoindex(interface):
854
"""Call the C function if_nametoindex(), or equivalent"""
855
global if_nametoindex
518
"""Call the C function if_nametoindex()"""
857
if_nametoindex = (ctypes.cdll.LoadLibrary
858
(ctypes.util.find_library("c"))
520
libc = ctypes.cdll.LoadLibrary("libc.so.6")
521
return libc.if_nametoindex(interface)
860
522
except (OSError, AttributeError):
861
523
if "struct" not in sys.modules:
863
525
if "fcntl" not in sys.modules:
865
def if_nametoindex(interface):
866
"Get an interface index the hard way, i.e. using fcntl()"
867
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
868
with closing(socket.socket()) as s:
869
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
870
struct.pack("16s16x", interface))
871
interface_index = struct.unpack("I", ifreq[16:20])[0]
872
return interface_index
873
return if_nametoindex(interface)
876
def daemon(nochdir = False, noclose = False):
877
"""See daemon(3). Standard BSD Unix function.
878
This should really exist as os.daemon, but it doesn't (yet)."""
887
# Close all standard open file descriptors
888
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
889
if not stat.S_ISCHR(os.fstat(null).st_mode):
890
raise OSError(errno.ENODEV,
891
"/dev/null not a character device")
892
os.dup2(null, sys.stdin.fileno())
893
os.dup2(null, sys.stdout.fileno())
894
os.dup2(null, sys.stderr.fileno())
900
parser = optparse.OptionParser(version = "%%prog %s" % version)
527
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
529
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
530
struct.pack("16s16x", interface))
532
interface_index = struct.unpack("I", ifreq[16:20])[0]
533
return interface_index
536
if __name__ == '__main__':
537
parser = OptionParser()
901
538
parser.add_option("-i", "--interface", type="string",
902
metavar="IF", help="Bind to interface IF")
903
parser.add_option("-a", "--address", type="string",
904
help="Address to listen for requests on")
905
parser.add_option("-p", "--port", type="int",
539
default=None, metavar="IF",
540
help="Bind to interface IF")
541
parser.add_option("--cert", type="string", default="cert.pem",
543
help="Public key certificate PEM file to use")
544
parser.add_option("--key", type="string", default="key.pem",
546
help="Private key PEM file to use")
547
parser.add_option("--ca", type="string", default="ca.pem",
549
help="Certificate Authority certificate PEM file to use")
550
parser.add_option("--crl", type="string", default="crl.pem",
552
help="Certificate Revokation List PEM file to use")
553
parser.add_option("-p", "--port", type="int", default=None,
906
554
help="Port number to receive requests on")
907
parser.add_option("--check", action="store_true",
555
parser.add_option("--timeout", type="string", # Parsed later
557
help="Amount of downtime allowed for clients")
558
parser.add_option("--interval", type="string", # Parsed later
560
help="How often to check that a client is up")
561
parser.add_option("--check", action="store_true", default=False,
908
562
help="Run self-test")
909
parser.add_option("--debug", action="store_true",
910
help="Debug mode; run in foreground and log to"
912
parser.add_option("--priority", type="string", help="GnuTLS"
913
" priority string (see GnuTLS documentation)")
914
parser.add_option("--servicename", type="string", metavar="NAME",
915
help="Zeroconf service name")
916
parser.add_option("--configdir", type="string",
917
default="/etc/mandos", metavar="DIR",
918
help="Directory to search for configuration"
920
parser.add_option("--no-dbus", action="store_false",
922
help="Do not provide D-Bus system bus"
924
options = parser.parse_args()[0]
563
parser.add_option("--debug", action="store_true", default=False,
565
(options, args) = parser.parse_args()
926
567
if options.check:
928
569
doctest.testmod()
931
# Default values for config file for server-global settings
932
server_defaults = { "interface": "",
937
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
938
"servicename": "Mandos",
942
# Parse config file for server-global settings
943
server_config = ConfigParser.SafeConfigParser(server_defaults)
945
server_config.read(os.path.join(options.configdir, "mandos.conf"))
946
# Convert the SafeConfigParser object to a dict
947
server_settings = server_config.defaults()
948
# Use getboolean on the boolean config options
949
server_settings["debug"] = (server_config.getboolean
950
("DEFAULT", "debug"))
951
server_settings["use_dbus"] = (server_config.getboolean
952
("DEFAULT", "use_dbus"))
955
# Override the settings from the config file with command line
957
for option in ("interface", "address", "port", "debug",
958
"priority", "servicename", "configdir",
960
value = getattr(options, option)
961
if value is not None:
962
server_settings[option] = value
964
# Now we have our good server settings in "server_settings"
967
debug = server_settings["debug"]
968
use_dbus = server_settings["use_dbus"]
971
syslogger.setLevel(logging.WARNING)
972
console.setLevel(logging.WARNING)
974
if server_settings["servicename"] != "Mandos":
975
syslogger.setFormatter(logging.Formatter
976
('Mandos (%s): %%(levelname)s:'
978
% server_settings["servicename"]))
980
# Parse config file with clients
981
client_defaults = { "timeout": "1h",
983
"checker": "fping -q -- %%(host)s",
986
client_config = ConfigParser.SafeConfigParser(client_defaults)
987
client_config.read(os.path.join(server_settings["configdir"],
991
tcp_server = IPv6_TCPServer((server_settings["address"],
992
server_settings["port"]),
994
settings=server_settings,
996
pidfilename = "/var/run/mandos.pid"
998
pidfile = open(pidfilename, "w")
999
except IOError, error:
1000
logger.error("Could not open file %r", pidfilename)
1003
uid = pwd.getpwnam("_mandos").pw_uid
1004
gid = pwd.getpwnam("_mandos").pw_gid
1007
uid = pwd.getpwnam("mandos").pw_uid
1008
gid = pwd.getpwnam("mandos").pw_gid
1011
uid = pwd.getpwnam("nobody").pw_uid
1012
gid = pwd.getpwnam("nogroup").pw_gid
1019
except OSError, error:
1020
if error[0] != errno.EPERM:
1024
service = AvahiService(name = server_settings["servicename"],
1025
servicetype = "_mandos._tcp", )
1026
if server_settings["interface"]:
1027
service.interface = (if_nametoindex
1028
(server_settings["interface"]))
1033
# From the Avahi example code
572
# Parse the time arguments
574
options.timeout = string_to_delta(options.timeout)
576
parser.error("option --timeout: Unparseable time")
578
options.interval = string_to_delta(options.interval)
580
parser.error("option --interval: Unparseable time")
583
defaults = { "checker": "sleep 1; fping -q -- %%(fqdn)s" }
584
client_config = ConfigParser.SafeConfigParser(defaults)
585
#client_config.readfp(open("secrets.conf"), "secrets.conf")
586
client_config.read("mandos-clients.conf")
588
# From the Avahi server example code
1034
589
DBusGMainLoop(set_as_default=True )
1035
590
main_loop = gobject.MainLoop()
1036
591
bus = dbus.SystemBus()
1037
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1038
avahi.DBUS_PATH_SERVER),
1039
avahi.DBUS_INTERFACE_SERVER)
592
server = dbus.Interface(
593
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
594
avahi.DBUS_INTERFACE_SERVER )
1040
595
# End of Avahi example code
1042
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1044
clients.update(Set(Client(name = section,
1046
= dict(client_config.items(section)),
1047
use_dbus = use_dbus)
597
debug = options.debug
600
def remove_from_clients(client):
601
clients.remove(client)
603
logger.debug(u"No clients left, exiting")
606
clients.update(Set(Client(name=section, options=options,
607
stop_hook = remove_from_clients,
608
**(dict(client_config\
1048
610
for section in client_config.sections()))
1050
logger.warning(u"No clients defined")
1053
# Redirect stdin so all checkers get /dev/null
1054
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1055
os.dup2(null, sys.stdin.fileno())
1059
# No console logging
1060
logger.removeHandler(console)
1061
# Close all input and output, do double fork, etc.
1066
pidfile.write(str(pid) + "\n")
1070
logger.error(u"Could not write to file %r with PID %d",
1073
# "pidfile" was never created
1078
"Cleanup function; run on exit"
1080
# From the Avahi example code
1081
if not group is None:
1084
# End of Avahi example code
1087
client = clients.pop()
1088
client.disable_hook = None
1091
atexit.register(cleanup)
1094
signal.signal(signal.SIGINT, signal.SIG_IGN)
1095
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1096
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1099
class MandosServer(dbus.service.Object):
1100
"""A D-Bus proxy object"""
1102
dbus.service.Object.__init__(self, bus, "/")
1103
_interface = u"se.bsnet.fukt.Mandos"
1105
@dbus.service.signal(_interface, signature="oa{sv}")
1106
def ClientAdded(self, objpath, properties):
1110
@dbus.service.signal(_interface, signature="os")
1111
def ClientRemoved(self, objpath, name):
1115
@dbus.service.method(_interface, out_signature="ao")
1116
def GetAllClients(self):
1117
return dbus.Array(c.dbus_object_path for c in clients)
1119
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1120
def GetAllClientsWithProperties(self):
1121
return dbus.Dictionary(
1122
((c.dbus_object_path, c.GetAllProperties())
1126
@dbus.service.method(_interface, in_signature="o")
1127
def RemoveClient(self, object_path):
1129
if c.dbus_object_path == object_path:
1131
# Don't signal anything except ClientRemoved
1135
self.ClientRemoved(object_path, c.name)
1141
mandos_server = MandosServer()
1143
611
for client in clients:
1146
mandos_server.ClientAdded(client.dbus_object_path,
1147
client.GetAllProperties())
1151
tcp_server.server_activate()
1153
# Find out what port we got
1154
service.port = tcp_server.socket.getsockname()[1]
1155
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1156
u" scope_id %d" % tcp_server.socket.getsockname())
1158
#service.interface = tcp_server.socket.getsockname()[3]
614
tcp_server = IPv6_TCPServer((None, options.port),
618
# Find out what random port we got
619
servicePort = tcp_server.socket.getsockname()[1]
620
logger.debug(u"Now listening on port %d", servicePort)
622
if options.interface is not None:
623
serviceInterface = if_nametoindex(options.interface)
625
# From the Avahi server example code
626
server.connect_to_signal("StateChanged", server_state_changed)
627
server_state_changed(server.GetState())
628
# End of Avahi example code
630
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
631
lambda *args, **kwargs:
632
tcp_server.handle_request(*args[2:],
1161
# From the Avahi example code
1162
server.connect_to_signal("StateChanged", server_state_changed)
1164
server_state_changed(server.GetState())
1165
except dbus.exceptions.DBusException, error:
1166
logger.critical(u"DBusException: %s", error)
1168
# End of Avahi example code
1170
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1171
lambda *args, **kwargs:
1172
(tcp_server.handle_request
1173
(*args[2:], **kwargs) or True))
1175
logger.debug(u"Starting main loop")
1177
except AvahiError, error:
1178
logger.critical(u"AvahiError: %s", error)
1180
636
except KeyboardInterrupt:
1184
if __name__ == '__main__':
641
# From the Avahi server example code
642
if not group is None:
644
# End of Avahi example code
646
for client in clients:
647
client.stop_hook = None