To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 176
- compare with another revision
- download diff
- download tarball
- view history from revision 176
- Committer: Teddy Hogeborn
- Date: 2008-09-07 01:44:44 UTC
- mfrom: (24.1.93 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080907014444-cf4ilzndc0tbn8va
Merge & resolve.
- files added:
- etc-plugins.d-README
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import division, with_statement, absolute_import
33
from __future__ import division
35
34
36
35
import SocketServer
37
36
import socket
37
import select
38
38
from optparse import OptionParser
39
39
import datetime
40
40
import errno
56
56
import logging
57
57
import logging.handlers
58
58
import pwd
59
from contextlib import closing
60
59
61
60
import dbus
62
import dbus.service
63
61
import gobject
64
62
import avahi
65
63
from dbus.mainloop.glib import DBusGMainLoop
66
64
import ctypes
67
import ctypes.util
68
65
69
version = "1.0.3"
66
version = "1.0"
70
67
71
68
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
77
74
logger.addHandler(syslogger)
78
75
79
76
console = logging.StreamHandler()
82
79
logger.addHandler(console)
83
80
84
81
class AvahiError(Exception):
85
def __init__(self, value, *args, **kwargs):
82
def __init__(self, value):
86
83
self.value = value
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
84
def __str__(self):
85
return repr(self.value)
90
86
91
87
class AvahiServiceError(AvahiError):
92
88
pass
112
108
a sensible number of times
113
109
"""
114
110
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
111
type = None, port = None, TXT = None, domain = "",
112
host = "", max_renames = 32768):
117
113
self.interface = interface
118
114
self.name = name
119
self.type = servicetype
115
self.type = type
120
116
self.port = port
121
self.TXT = TXT if TXT is not None else []
117
if TXT is None:
118
self.TXT = []
119
else:
120
self.TXT = TXT
122
121
self.domain = domain
123
122
self.host = host
124
123
self.rename_count = 0
128
127
if self.rename_count >= self.max_renames:
129
128
logger.critical(u"No suitable Zeroconf service name found"
130
129
u" after %i retries, exiting.",
131
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
130
rename_count)
131
raise AvahiServiceError("Too many renames")
133
132
self.name = server.GetAlternativeServiceName(self.name)
134
133
logger.info(u"Changing Zeroconf service name to %r ...",
135
134
str(self.name))
136
syslogger.setFormatter(logging.Formatter
135
syslogger.setFormatter(logging.Formatter\
137
136
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
137
' %%(message)s' % self.name))
139
138
self.remove()
140
139
self.add()
141
140
self.rename_count += 1
147
146
"""Derived from the Avahi example code"""
148
147
global group
149
148
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
149
group = dbus.Interface\
150
(bus.get_object(avahi.DBUS_NAME,
152
151
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
153
group.connect_to_signal('StateChanged',
155
154
entry_group_state_changed)
156
155
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
170
169
# End of Avahi example code
171
170
172
171
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
172
class Client(object):
179
173
"""A representation of a client host served by this server.
180
174
Attributes:
181
name: string; from the config file, used in log messages
175
name: string; from the config file, used in log messages
182
176
fingerprint: string (40 or 32 hexadecimal digits); used to
183
177
uniquely identify the client
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
178
secret: bytestring; sent verbatim (over TLS) to client
179
host: string; available for use by the checker command
180
created: datetime.datetime(); object creation, not client host
181
last_checked_ok: datetime.datetime() or None if not yet checked OK
182
timeout: datetime.timedelta(); How long from last_checked_ok
183
until this client is invalid
184
interval: datetime.timedelta(); How often to start a new checker
185
stop_hook: If set, called by stop() as stop_hook(self)
186
checker: subprocess.Popen(); a running checker process used
187
to see if the client lives.
188
'None' if no process is running.
197
189
checker_initiator_tag: a gobject event source tag, or None
198
disable_initiator_tag: - '' -
190
stop_initiator_tag: - '' -
199
191
checker_callback_tag: - '' -
200
192
checker_command: string; External command which is run to check if
201
193
client lives. %() expansions are done at
202
194
runtime with vars(self) as dict, so that for
203
195
instance %(name)s can be used in the command.
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
196
Private attibutes:
197
_timeout: Real variable for 'timeout'
198
_interval: Real variable for 'interval'
199
_timeout_milliseconds: Used when calling gobject.timeout_add()
200
_interval_milliseconds: - '' -
206
201
"""
207
def timeout_milliseconds(self):
208
"Return the 'timeout' attribute in milliseconds"
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
212
213
def interval_milliseconds(self):
214
"Return the 'interval' attribute in milliseconds"
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
218
219
def __init__(self, name = None, disable_hook=None, config=None,
220
use_dbus=True):
202
def _set_timeout(self, timeout):
203
"Setter function for 'timeout' attribute"
204
self._timeout = timeout
205
self._timeout_milliseconds = ((self.timeout.days
206
* 24 * 60 * 60 * 1000)
207
+ (self.timeout.seconds * 1000)
208
+ (self.timeout.microseconds
209
// 1000))
210
timeout = property(lambda self: self._timeout,
211
_set_timeout)
212
del _set_timeout
213
def _set_interval(self, interval):
214
"Setter function for 'interval' attribute"
215
self._interval = interval
216
self._interval_milliseconds = ((self.interval.days
217
* 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds
219
* 1000)
220
+ (self.interval.microseconds
221
// 1000))
222
interval = property(lambda self: self._interval,
223
_set_interval)
224
del _set_interval
225
def __init__(self, name = None, stop_hook=None, config={}):
221
226
"""Note: the 'checker' key in 'config' sets the
222
227
'checker_command' attribute and *not* the 'checker'
223
228
attribute."""
224
229
self.name = name
225
if config is None:
226
config = {}
227
230
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
229
if self.use_dbus:
230
self.dbus_object_path = (dbus.ObjectPath
231
("/Mandos/clients/"
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
235
231
# Uppercase and remove spaces from fingerprint for later
236
232
# comparison purposes with return value from the fingerprint()
237
233
# function
238
self.fingerprint = (config["fingerprint"].upper()
239
.replace(u" ", u""))
234
self.fingerprint = config["fingerprint"].upper()\
235
.replace(u" ", u"")
240
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
241
237
if "secret" in config:
242
238
self.secret = config["secret"].decode(u"base64")
243
239
elif "secfile" in config:
244
with closing(open(os.path.expanduser
245
(os.path.expandvars
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
240
sf = open(config["secfile"])
241
self.secret = sf.read()
242
sf.close()
248
243
else:
249
244
raise TypeError(u"No secret or secfile for client %s"
250
245
% self.name)
251
246
self.host = config.get("host", "")
252
self.created = datetime.datetime.utcnow()
253
self.enabled = False
254
self.last_enabled = None
247
self.created = datetime.datetime.now()
255
248
self.last_checked_ok = None
256
249
self.timeout = string_to_delta(config["timeout"])
257
250
self.interval = string_to_delta(config["interval"])
258
self.disable_hook = disable_hook
251
self.stop_hook = stop_hook
259
252
self.checker = None
260
253
self.checker_initiator_tag = None
261
self.disable_initiator_tag = None
254
self.stop_initiator_tag = None
262
255
self.checker_callback_tag = None
263
self.checker_command = config["checker"]
264
265
def enable(self):
256
self.check_command = config["checker"]
257
def start(self):
266
258
"""Start this client's checker and timeout hooks"""
267
self.last_enabled = datetime.datetime.utcnow()
268
259
# Schedule a new checker to be started an 'interval' from now,
269
260
# and every interval from then on.
270
self.checker_initiator_tag = (gobject.timeout_add
271
(self.interval_milliseconds(),
272
self.start_checker))
261
self.checker_initiator_tag = gobject.timeout_add\
262
(self._interval_milliseconds,
263
self.start_checker)
273
264
# Also start a new checker *right now*.
274
265
self.start_checker()
275
# Schedule a disable() when 'timeout' has passed
276
self.disable_initiator_tag = (gobject.timeout_add
277
(self.timeout_milliseconds(),
278
self.disable))
279
self.enabled = True
280
if self.use_dbus:
281
# Emit D-Bus signals
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
286
variant_level=1)))
287
288
def disable(self):
289
"""Disable this client."""
290
if not getattr(self, "enabled", False):
266
# Schedule a stop() when 'timeout' has passed
267
self.stop_initiator_tag = gobject.timeout_add\
268
(self._timeout_milliseconds,
269
self.stop)
270
def stop(self):
271
"""Stop this client.
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
274
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
276
logger.info(u"Stopping client %s", self.name)
277
self.secret = None
278
else:
291
279
return False
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
294
gobject.source_remove(self.disable_initiator_tag)
295
self.disable_initiator_tag = None
280
if getattr(self, "stop_initiator_tag", False):
281
gobject.source_remove(self.stop_initiator_tag)
282
self.stop_initiator_tag = None
296
283
if getattr(self, "checker_initiator_tag", False):
297
284
gobject.source_remove(self.checker_initiator_tag)
298
285
self.checker_initiator_tag = None
299
286
self.stop_checker()
300
if self.disable_hook:
301
self.disable_hook(self)
302
self.enabled = False
303
if self.use_dbus:
304
# Emit D-Bus signal
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
287
if self.stop_hook:
288
self.stop_hook(self)
307
289
# Do not run this again if called by a gobject.timeout_add
308
290
return False
309
310
291
def __del__(self):
311
self.disable_hook = None
312
self.disable()
313
314
def checker_callback(self, pid, condition, command):
292
self.stop_hook = None
293
self.stop()
294
def checker_callback(self, pid, condition):
315
295
"""The checker has completed, so take appropriate actions."""
296
now = datetime.datetime.now()
316
297
self.checker_callback_tag = None
317
298
self.checker = None
318
if self.use_dbus:
319
# Emit D-Bus signal
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
299
if os.WIFEXITED(condition) \
300
and (os.WEXITSTATUS(condition) == 0):
324
301
logger.info(u"Checker for %(name)s succeeded",
325
302
vars(self))
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
331
self.bump_timeout()
303
self.last_checked_ok = now
304
gobject.source_remove(self.stop_initiator_tag)
305
self.stop_initiator_tag = gobject.timeout_add\
306
(self._timeout_milliseconds,
307
self.stop)
332
308
elif not os.WIFEXITED(condition):
333
309
logger.warning(u"Checker for %(name)s crashed?",
334
310
vars(self))
335
if self.use_dbus:
336
# Emit D-Bus signal
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
340
311
else:
341
312
logger.info(u"Checker for %(name)s failed",
342
313
vars(self))
343
if self.use_dbus:
344
# Emit D-Bus signal
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
348
349
def bump_timeout(self):
350
"""Bump up the timeout for this client.
351
This should only be called when the client has been seen,
352
alive and well.
353
"""
354
self.last_checked_ok = datetime.datetime.utcnow()
355
gobject.source_remove(self.disable_initiator_tag)
356
self.disable_initiator_tag = (gobject.timeout_add
357
(self.timeout_milliseconds(),
358
self.disable))
359
if self.use_dbus:
360
# Emit D-Bus signal
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
364
variant_level=1)))
365
366
314
def start_checker(self):
367
315
"""Start a new checker subprocess if one is not running.
368
316
If a checker already exists, leave it running and do
377
325
# is as it should be.
378
326
if self.checker is None:
379
327
try:
380
# In case checker_command has exactly one % operator
381
command = self.checker_command % self.host
328
# In case check_command has exactly one % operator
329
command = self.check_command % self.host
382
330
except TypeError:
383
331
# Escape attributes for the shell
384
332
escaped_attrs = dict((key, re.escape(str(val)))
385
333
for key, val in
386
334
vars(self).iteritems())
387
335
try:
388
command = self.checker_command % escaped_attrs
336
command = self.check_command % escaped_attrs
389
337
except TypeError, error:
390
338
logger.error(u'Could not format string "%s":'
391
u' %s', self.checker_command, error)
339
u' %s', self.check_command, error)
392
340
return True # Try again later
393
341
try:
394
342
logger.info(u"Starting checker %r for %s",
400
348
self.checker = subprocess.Popen(command,
401
349
close_fds=True,
402
350
shell=True, cwd="/")
403
if self.use_dbus:
404
# Emit D-Bus signal
405
self.CheckerStarted(command)
406
self.PropertyChanged(
407
dbus.String("checker_running"),
408
dbus.Boolean(True, variant_level=1))
409
self.checker_callback_tag = (gobject.child_watch_add
410
(self.checker.pid,
411
self.checker_callback,
412
data=command))
351
self.checker_callback_tag = gobject.child_watch_add\
352
(self.checker.pid,
353
self.checker_callback)
413
354
except OSError, error:
414
355
logger.error(u"Failed to start subprocess: %s",
415
356
error)
416
357
# Re-run this periodically if run by gobject.timeout_add
417
358
return True
418
419
359
def stop_checker(self):
420
360
"""Force the checker process, if any, to stop."""
421
361
if self.checker_callback_tag:
433
373
if error.errno != errno.ESRCH: # No such process
434
374
raise
435
375
self.checker = None
436
if self.use_dbus:
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
439
440
376
def still_valid(self):
441
377
"""Has the timeout not yet passed for this client?"""
442
if not getattr(self, "enabled", False):
443
return False
444
now = datetime.datetime.utcnow()
378
now = datetime.datetime.now()
445
379
if self.last_checked_ok is None:
446
380
return now < (self.created + self.timeout)
447
381
else:
448
382
return now < (self.last_checked_ok + self.timeout)
449
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
452
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
456
457
# CheckerCompleted - signal
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
460
"D-Bus signal"
461
pass
462
463
# CheckerStarted - signal
464
@dbus.service.signal(_interface, signature="s")
465
def CheckerStarted(self, command):
466
"D-Bus signal"
467
pass
468
469
# GetAllProperties - method
470
@dbus.service.method(_interface, out_signature="a{sv}")
471
def GetAllProperties(self):
472
"D-Bus method"
473
return dbus.Dictionary({
474
dbus.String("name"):
475
dbus.String(self.name, variant_level=1),
476
dbus.String("fingerprint"):
477
dbus.String(self.fingerprint, variant_level=1),
478
dbus.String("host"):
479
dbus.String(self.host, variant_level=1),
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
484
variant_level=1)
485
if self.last_enabled is not None
486
else dbus.Boolean(False, variant_level=1)),
487
dbus.String("enabled"):
488
dbus.Boolean(self.enabled, variant_level=1),
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
491
variant_level=1)
492
if self.last_checked_ok is not None
493
else dbus.Boolean (False, variant_level=1)),
494
dbus.String("timeout"):
495
dbus.UInt64(self.timeout_milliseconds(),
496
variant_level=1),
497
dbus.String("interval"):
498
dbus.UInt64(self.interval_milliseconds(),
499
variant_level=1),
500
dbus.String("checker"):
501
dbus.String(self.checker_command,
502
variant_level=1),
503
dbus.String("checker_running"):
504
dbus.Boolean(self.checker is not None,
505
variant_level=1),
506
}, signature="sv")
507
508
# IsStillValid - method
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
510
(still_valid))
511
IsStillValid.__name__ = "IsStillValid"
512
513
# PropertyChanged - signal
514
@dbus.service.signal(_interface, signature="sv")
515
def PropertyChanged(self, property, value):
516
"D-Bus signal"
517
pass
518
519
# SetChecker - method
520
@dbus.service.method(_interface, in_signature="s")
521
def SetChecker(self, checker):
522
"D-Bus setter method"
523
self.checker_command = checker
524
# Emit D-Bus signal
525
self.PropertyChanged(dbus.String(u"checker"),
526
dbus.String(self.checker_command,
527
variant_level=1))
528
529
# SetHost - method
530
@dbus.service.method(_interface, in_signature="s")
531
def SetHost(self, host):
532
"D-Bus setter method"
533
self.host = host
534
# Emit D-Bus signal
535
self.PropertyChanged(dbus.String(u"host"),
536
dbus.String(self.host, variant_level=1))
537
538
# SetInterval - method
539
@dbus.service.method(_interface, in_signature="t")
540
def SetInterval(self, milliseconds):
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
542
# Emit D-Bus signal
543
self.PropertyChanged(dbus.String(u"interval"),
544
(dbus.UInt64(self.interval_milliseconds(),
545
variant_level=1)))
546
547
# SetSecret - method
548
@dbus.service.method(_interface, in_signature="ay",
549
byte_arrays=True)
550
def SetSecret(self, secret):
551
"D-Bus setter method"
552
self.secret = str(secret)
553
554
# SetTimeout - method
555
@dbus.service.method(_interface, in_signature="t")
556
def SetTimeout(self, milliseconds):
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
558
# Emit D-Bus signal
559
self.PropertyChanged(dbus.String(u"timeout"),
560
(dbus.UInt64(self.timeout_milliseconds(),
561
variant_level=1)))
562
563
# Enable - method
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
566
567
# StartChecker - method
568
@dbus.service.method(_interface)
569
def StartChecker(self):
570
"D-Bus method"
571
self.start_checker()
572
573
# Disable - method
574
@dbus.service.method(_interface)
575
def Disable(self):
576
"D-Bus method"
577
self.disable()
578
579
# StopChecker - method
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
582
583
del _interface
584
383
585
384
586
385
def peer_certificate(session):
587
386
"Return the peer's OpenPGP certificate as a bytestring"
588
387
# If not an OpenPGP certificate...
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
388
if gnutls.library.functions.gnutls_certificate_type_get\
389
(session._c_object) \
390
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
592
391
# ...do the normal thing
593
392
return session.peer_certificate
594
393
list_size = ctypes.c_uint()
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
394
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
(session._c_object, ctypes.byref(list_size))
598
396
if list_size.value == 0:
599
397
return None
600
398
cert = cert_list[0]
604
402
def fingerprint(openpgp):
605
403
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
606
404
# New GnuTLS "datum" with the OpenPGP public key
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
609
ctypes.POINTER
610
(ctypes.c_ubyte)),
611
ctypes.c_uint(len(openpgp))))
405
datum = gnutls.library.types.gnutls_datum_t\
406
(ctypes.cast(ctypes.c_char_p(openpgp),
407
ctypes.POINTER(ctypes.c_ubyte)),
408
ctypes.c_uint(len(openpgp)))
612
409
# New empty GnuTLS certificate
613
410
crt = gnutls.library.types.gnutls_openpgp_crt_t()
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
411
gnutls.library.functions.gnutls_openpgp_crt_init\
412
(ctypes.byref(crt))
616
413
# Import the OpenPGP public key into the certificate
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
414
gnutls.library.functions.gnutls_openpgp_crt_import\
415
(crt, ctypes.byref(datum),
416
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
621
417
# Verify the self signature in the key
622
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
418
crtverify = ctypes.c_uint();
419
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
(crt, 0, ctypes.byref(crtverify))
625
421
if crtverify.value != 0:
626
422
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
423
raise gnutls.errors.CertificateSecurityError("Verify failed")
628
424
# New buffer for the fingerprint
629
buf = ctypes.create_string_buffer(20)
630
buf_len = ctypes.c_size_t()
425
buffer = ctypes.create_string_buffer(20)
426
buffer_length = ctypes.c_size_t()
631
427
# Get the fingerprint from the certificate into the buffer
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
428
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
635
430
# Deinit the certificate
636
431
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
637
432
# Convert the buffer to a Python bytestring
638
fpr = ctypes.string_at(buf, buf_len.value)
433
fpr = ctypes.string_at(buffer, buffer_length.value)
639
434
# Convert the bytestring to hexadecimal notation
640
435
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
641
436
return hex_fpr
642
437
643
438
644
class TCP_handler(SocketServer.BaseRequestHandler, object):
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
645
440
"""A TCP request handler class.
646
441
Instantiated by IPv6_TCPServer for each request to handle it.
647
442
Note: This will run in its own forked process."""
648
443
649
444
def handle(self):
650
445
logger.info(u"TCP connection from: %s",
651
unicode(self.client_address))
652
session = (gnutls.connection
653
.ClientSession(self.request,
654
gnutls.connection
655
.X509Credentials()))
446
unicode(self.client_address))
447
session = gnutls.connection.ClientSession\
448
(self.request, gnutls.connection.X509Credentials())
656
449
657
450
line = self.request.makefile().readline()
658
451
logger.debug(u"Protocol version: %r", line)
671
464
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
672
465
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
673
466
# "+DHE-DSS"))
674
# Use a fallback default, since this MUST be set.
675
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
678
priority, None))
467
priority = "NORMAL" # Fallback default, since this
468
# MUST be set.
469
if self.server.settings["priority"]:
470
priority = self.server.settings["priority"]
471
gnutls.library.functions.gnutls_priority_set_direct\
472
(session._c_object, priority, None);
679
473
680
474
try:
681
475
session.handshake()
691
485
session.bye()
692
486
return
693
487
logger.debug(u"Fingerprint: %s", fpr)
488
client = None
694
489
for c in self.server.clients:
695
490
if c.fingerprint == fpr:
696
491
client = c
697
492
break
698
else:
493
if not client:
699
494
logger.warning(u"Client not found for fingerprint: %s",
700
495
fpr)
701
496
session.bye()
708
503
vars(client))
709
504
session.bye()
710
505
return
711
## This won't work here, since we're in a fork.
712
# client.bump_timeout()
713
506
sent_size = 0
714
507
while sent_size < len(client.secret):
715
508
sent = session.send(client.secret[sent_size:])
720
513
session.bye()
721
514
722
515
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
724
SocketServer.TCPServer, object):
516
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
725
517
"""IPv6 TCP server. Accepts 'None' as address and/or port.
726
518
Attributes:
727
519
settings: Server settings
737
529
self.clients = kwargs["clients"]
738
530
del kwargs["clients"]
739
531
self.enabled = False
740
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
532
return super(type(self), self).__init__(*args, **kwargs)
741
533
def server_bind(self):
742
534
"""This overrides the normal server_bind() function
743
535
to bind to an interface if one was specified, and also NOT to
772
564
# if_nametoindex
773
565
# (self.settings
774
566
# ["interface"]))
775
return super(IPv6_TCPServer, self).server_bind()
567
return super(type(self), self).server_bind()
776
568
def server_activate(self):
777
569
if self.enabled:
778
return super(IPv6_TCPServer, self).server_activate()
570
return super(type(self), self).server_activate()
779
571
def enable(self):
780
572
self.enabled = True
781
573
799
591
timevalue = datetime.timedelta(0)
800
592
for s in interval.split():
801
593
try:
802
suffix = unicode(s[-1])
803
value = int(s[:-1])
594
suffix=unicode(s[-1])
595
value=int(s[:-1])
804
596
if suffix == u"d":
805
597
delta = datetime.timedelta(value)
806
598
elif suffix == u"s":
840
632
elif state == avahi.ENTRY_GROUP_FAILURE:
841
633
logger.critical(u"Avahi: Error in group state changed %s",
842
634
unicode(error))
843
raise AvahiGroupError(u"State changed: %s" % unicode(error))
635
raise AvahiGroupError("State changed: %s", str(error))
844
636
845
637
def if_nametoindex(interface):
846
638
"""Call the C function if_nametoindex(), or equivalent"""
847
639
global if_nametoindex
848
640
try:
849
if_nametoindex = (ctypes.cdll.LoadLibrary
850
(ctypes.util.find_library("c"))
851
.if_nametoindex)
641
if "ctypes.util" not in sys.modules:
642
import ctypes.util
643
if_nametoindex = ctypes.cdll.LoadLibrary\
644
(ctypes.util.find_library("c")).if_nametoindex
852
645
except (OSError, AttributeError):
853
646
if "struct" not in sys.modules:
854
647
import struct
857
650
def if_nametoindex(interface):
858
651
"Get an interface index the hard way, i.e. using fcntl()"
859
652
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
860
with closing(socket.socket()) as s:
861
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
862
struct.pack("16s16x", interface))
653
s = socket.socket()
654
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
655
struct.pack("16s16x", interface))
656
s.close()
863
657
interface_index = struct.unpack("I", ifreq[16:20])[0]
864
658
return interface_index
865
659
return if_nametoindex(interface)
889
683
890
684
891
685
def main():
686
global main_loop_started
687
main_loop_started = False
688
892
689
parser = OptionParser(version = "%%prog %s" % version)
893
690
parser.add_option("-i", "--interface", type="string",
894
691
metavar="IF", help="Bind to interface IF")
896
693
help="Address to listen for requests on")
897
694
parser.add_option("-p", "--port", type="int",
898
695
help="Port number to receive requests on")
899
parser.add_option("--check", action="store_true",
696
parser.add_option("--check", action="store_true", default=False,
900
697
help="Run self-test")
901
698
parser.add_option("--debug", action="store_true",
902
699
help="Debug mode; run in foreground and log to"
909
706
default="/etc/mandos", metavar="DIR",
910
707
help="Directory to search for configuration"
911
708
" files")
912
parser.add_option("--no-dbus", action="store_false",
913
dest="use_dbus",
914
help="Do not provide D-Bus system bus"
915
" interface")
916
options = parser.parse_args()[0]
709
(options, args) = parser.parse_args()
917
710
918
711
if options.check:
919
712
import doctest
928
721
"priority":
929
722
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
930
723
"servicename": "Mandos",
931
"use_dbus": "True",
932
724
}
933
725
934
726
# Parse config file for server-global settings
937
729
server_config.read(os.path.join(options.configdir, "mandos.conf"))
938
730
# Convert the SafeConfigParser object to a dict
939
731
server_settings = server_config.defaults()
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
732
# Use getboolean on the boolean config option
733
server_settings["debug"] = server_config.getboolean\
734
("DEFAULT", "debug")
945
735
del server_config
946
736
947
737
# Override the settings from the config file with command line
948
738
# options, if set.
949
739
for option in ("interface", "address", "port", "debug",
950
"priority", "servicename", "configdir",
951
"use_dbus"):
740
"priority", "servicename", "configdir"):
952
741
value = getattr(options, option)
953
742
if value is not None:
954
743
server_settings[option] = value
955
744
del options
956
745
# Now we have our good server settings in "server_settings"
957
746
958
# For convenience
959
747
debug = server_settings["debug"]
960
use_dbus = server_settings["use_dbus"]
961
748
962
749
if not debug:
963
750
syslogger.setLevel(logging.WARNING)
964
751
console.setLevel(logging.WARNING)
965
752
966
753
if server_settings["servicename"] != "Mandos":
967
syslogger.setFormatter(logging.Formatter
754
syslogger.setFormatter(logging.Formatter\
968
755
('Mandos (%s): %%(levelname)s:'
969
756
' %%(message)s'
970
757
% server_settings["servicename"]))
972
759
# Parse config file with clients
973
760
client_defaults = { "timeout": "1h",
974
761
"interval": "5m",
975
"checker": "fping -q -- %%(host)s",
762
"checker": "fping -q -- %(host)s",
976
763
"host": "",
977
764
}
978
765
client_config = ConfigParser.SafeConfigParser(client_defaults)
982
769
clients = Set()
983
770
tcp_server = IPv6_TCPServer((server_settings["address"],
984
771
server_settings["port"]),
985
TCP_handler,
772
tcp_handler,
986
773
settings=server_settings,
987
774
clients=clients)
988
775
pidfilename = "/var/run/mandos.pid"
991
778
except IOError, error:
992
779
logger.error("Could not open file %r", pidfilename)
993
780
994
try:
995
uid = pwd.getpwnam("_mandos").pw_uid
996
gid = pwd.getpwnam("_mandos").pw_gid
997
except KeyError:
998
try:
999
uid = pwd.getpwnam("mandos").pw_uid
1000
gid = pwd.getpwnam("mandos").pw_gid
1001
except KeyError:
1002
try:
1003
uid = pwd.getpwnam("nobody").pw_uid
1004
gid = pwd.getpwnam("nogroup").pw_gid
1005
except KeyError:
1006
uid = 65534
1007
gid = 65534
781
uid = 65534
782
gid = 65534
783
try:
784
uid = pwd.getpwnam("mandos").pw_uid
785
except KeyError:
786
try:
787
uid = pwd.getpwnam("nobody").pw_uid
788
except KeyError:
789
pass
790
try:
791
gid = pwd.getpwnam("mandos").pw_gid
792
except KeyError:
793
try:
794
gid = pwd.getpwnam("nogroup").pw_gid
795
except KeyError:
796
pass
1008
797
try:
1009
798
os.setuid(uid)
1010
799
os.setgid(gid)
1014
803
1015
804
global service
1016
805
service = AvahiService(name = server_settings["servicename"],
1017
servicetype = "_mandos._tcp", )
806
type = "_mandos._tcp", );
1018
807
if server_settings["interface"]:
1019
service.interface = (if_nametoindex
1020
(server_settings["interface"]))
808
service.interface = if_nametoindex\
809
(server_settings["interface"])
1021
810
1022
811
global main_loop
1023
812
global bus
1030
819
avahi.DBUS_PATH_SERVER),
1031
820
avahi.DBUS_INTERFACE_SERVER)
1032
821
# End of Avahi example code
1033
if use_dbus:
1034
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1035
bus)
822
823
def remove_from_clients(client):
824
clients.remove(client)
825
if not clients:
826
logger.critical(u"No clients left, exiting")
827
sys.exit()
1036
828
1037
829
clients.update(Set(Client(name = section,
830
stop_hook = remove_from_clients,
1038
831
config
1039
= dict(client_config.items(section)),
1040
use_dbus = use_dbus)
832
= dict(client_config.items(section)))
1041
833
for section in client_config.sections()))
1042
834
if not clients:
1043
logger.warning(u"No clients defined")
835
logger.critical(u"No clients defined")
836
sys.exit(1)
1044
837
1045
838
if debug:
1046
839
# Redirect stdin so all checkers get /dev/null
1059
852
pidfile.write(str(pid) + "\n")
1060
853
pidfile.close()
1061
854
del pidfile
1062
except IOError:
855
except IOError, err:
1063
856
logger.error(u"Could not write to file %r with PID %d",
1064
857
pidfilename, pid)
1065
858
except NameError:
1078
871
1079
872
while clients:
1080
873
client = clients.pop()
1081
client.disable_hook = None
1082
client.disable()
874
client.stop_hook = None
875
client.stop()
1083
876
1084
877
atexit.register(cleanup)
1085
878
1088
881
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1089
882
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1090
883
1091
if use_dbus:
1092
class MandosServer(dbus.service.Object):
1093
"""A D-Bus proxy object"""
1094
def __init__(self):
1095
dbus.service.Object.__init__(self, bus,
1096
"/Mandos")
1097
_interface = u"org.mandos_system.Mandos"
1098
1099
@dbus.service.signal(_interface, signature="oa{sv}")
1100
def ClientAdded(self, objpath, properties):
1101
"D-Bus signal"
1102
pass
1103
1104
@dbus.service.signal(_interface, signature="o")
1105
def ClientRemoved(self, objpath):
1106
"D-Bus signal"
1107
pass
1108
1109
@dbus.service.method(_interface, out_signature="ao")
1110
def GetAllClients(self):
1111
return dbus.Array(c.dbus_object_path for c in clients)
1112
1113
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1114
def GetAllClientsWithProperties(self):
1115
return dbus.Dictionary(
1116
((c.dbus_object_path, c.GetAllProperties())
1117
for c in clients),
1118
signature="oa{sv}")
1119
1120
@dbus.service.method(_interface, in_signature="o")
1121
def RemoveClient(self, object_path):
1122
for c in clients:
1123
if c.dbus_object_path == object_path:
1124
clients.remove(c)
1125
# Don't signal anything except ClientRemoved
1126
c.use_dbus = False
1127
c.disable()
1128
# Emit D-Bus signal
1129
self.ClientRemoved(object_path)
1130
return
1131
raise KeyError
1132
@dbus.service.method(_interface)
1133
def Quit(self):
1134
main_loop.quit()
1135
1136
del _interface
1137
1138
mandos_server = MandosServer()
1139
1140
884
for client in clients:
1141
if use_dbus:
1142
# Emit D-Bus signal
1143
mandos_server.ClientAdded(client.dbus_object_path,
1144
client.GetAllProperties())
1145
client.enable()
885
client.start()
1146
886
1147
887
tcp_server.enable()
1148
888
tcp_server.server_activate()
1166
906
1167
907
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1168
908
lambda *args, **kwargs:
1169
(tcp_server.handle_request
1170
(*args[2:], **kwargs) or True))
909
tcp_server.handle_request\
910
(*args[2:], **kwargs) or True)
1171
911
1172
912
logger.debug(u"Starting main loop")
913
main_loop_started = True
1173
914
main_loop.run()
1174
915
except AvahiError, error:
1175
logger.critical(u"AvahiError: %s", error)
916
logger.critical(u"AvahiError: %s" + unicode(error))
1176
917
sys.exit(1)
1177
918
except KeyboardInterrupt:
1178
919
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0