To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 181
- compare with another revision
- download diff
- download tarball
- view history from revision 181
- Committer: Teddy Hogeborn
- Date: 2008-09-08 18:54:47 UTC
- Revision ID: teddy@fukt.bsnet.se-20080908185447-dm2ertwxa20qbckf
* INSTALL: Even better text.
- files added:
- etc-plugins.d-README
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import division, with_statement, absolute_import
33
from __future__ import division
35
34
36
35
import SocketServer
37
36
import socket
38
import optparse
37
import select
38
from optparse import OptionParser
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
56
56
import logging
57
57
import logging.handlers
58
58
import pwd
59
from contextlib import closing
60
59
61
60
import dbus
62
import dbus.service
63
61
import gobject
64
62
import avahi
65
63
from dbus.mainloop.glib import DBusGMainLoop
66
64
import ctypes
67
import ctypes.util
68
65
69
version = "1.0.5"
66
version = "1.0"
70
67
71
68
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
78
74
logger.addHandler(syslogger)
79
75
80
76
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
' %(message)s'))
83
79
logger.addHandler(console)
84
80
85
81
class AvahiError(Exception):
86
def __init__(self, value, *args, **kwargs):
82
def __init__(self, value):
87
83
self.value = value
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
84
def __str__(self):
85
return repr(self.value)
91
86
92
87
class AvahiServiceError(AvahiError):
93
88
pass
113
108
a sensible number of times
114
109
"""
115
110
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768,
118
protocol = avahi.PROTO_UNSPEC):
111
type = None, port = None, TXT = None, domain = "",
112
host = "", max_renames = 32768):
119
113
self.interface = interface
120
114
self.name = name
121
self.type = servicetype
115
self.type = type
122
116
self.port = port
123
self.TXT = TXT if TXT is not None else []
117
if TXT is None:
118
self.TXT = []
119
else:
120
self.TXT = TXT
124
121
self.domain = domain
125
122
self.host = host
126
123
self.rename_count = 0
127
124
self.max_renames = max_renames
128
self.protocol = protocol
129
125
def rename(self):
130
126
"""Derived from the Avahi example code"""
131
127
if self.rename_count >= self.max_renames:
132
128
logger.critical(u"No suitable Zeroconf service name found"
133
129
u" after %i retries, exiting.",
134
self.rename_count)
135
raise AvahiServiceError(u"Too many renames")
130
rename_count)
131
raise AvahiServiceError("Too many renames")
136
132
self.name = server.GetAlternativeServiceName(self.name)
137
133
logger.info(u"Changing Zeroconf service name to %r ...",
138
134
str(self.name))
139
syslogger.setFormatter(logging.Formatter
135
syslogger.setFormatter(logging.Formatter\
140
136
('Mandos (%s): %%(levelname)s:'
141
' %%(message)s' % self.name))
137
' %%(message)s' % self.name))
142
138
self.remove()
143
139
self.add()
144
140
self.rename_count += 1
150
146
"""Derived from the Avahi example code"""
151
147
global group
152
148
if group is None:
153
group = dbus.Interface(bus.get_object
154
(avahi.DBUS_NAME,
149
group = dbus.Interface\
150
(bus.get_object(avahi.DBUS_NAME,
155
151
server.EntryGroupNew()),
156
avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
avahi.DBUS_INTERFACE_ENTRY_GROUP)
157
153
group.connect_to_signal('StateChanged',
158
154
entry_group_state_changed)
159
155
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
160
156
service.name, service.type)
161
157
group.AddService(
162
158
self.interface, # interface
163
self.protocol, # protocol
159
avahi.PROTO_INET6, # protocol
164
160
dbus.UInt32(0), # flags
165
161
self.name, self.type,
166
162
self.domain, self.host,
173
169
# End of Avahi example code
174
170
175
171
176
def _datetime_to_dbus(dt, variant_level=0):
177
"""Convert a UTC datetime.datetime() to a D-Bus type."""
178
return dbus.String(dt.isoformat(), variant_level=variant_level)
179
180
181
class Client(dbus.service.Object):
172
class Client(object):
182
173
"""A representation of a client host served by this server.
183
174
Attributes:
184
name: string; from the config file, used in log messages and
185
D-Bus identifiers
175
name: string; from the config file, used in log messages
186
176
fingerprint: string (40 or 32 hexadecimal digits); used to
187
177
uniquely identify the client
188
secret: bytestring; sent verbatim (over TLS) to client
189
host: string; available for use by the checker command
190
created: datetime.datetime(); (UTC) object creation
191
last_enabled: datetime.datetime(); (UTC)
192
enabled: bool()
193
last_checked_ok: datetime.datetime(); (UTC) or None
194
timeout: datetime.timedelta(); How long from last_checked_ok
195
until this client is invalid
196
interval: datetime.timedelta(); How often to start a new checker
197
disable_hook: If set, called by disable() as disable_hook(self)
198
checker: subprocess.Popen(); a running checker process used
199
to see if the client lives.
200
'None' if no process is running.
178
secret: bytestring; sent verbatim (over TLS) to client
179
host: string; available for use by the checker command
180
created: datetime.datetime(); object creation, not client host
181
last_checked_ok: datetime.datetime() or None if not yet checked OK
182
timeout: datetime.timedelta(); How long from last_checked_ok
183
until this client is invalid
184
interval: datetime.timedelta(); How often to start a new checker
185
stop_hook: If set, called by stop() as stop_hook(self)
186
checker: subprocess.Popen(); a running checker process used
187
to see if the client lives.
188
'None' if no process is running.
201
189
checker_initiator_tag: a gobject event source tag, or None
202
disable_initiator_tag: - '' -
190
stop_initiator_tag: - '' -
203
191
checker_callback_tag: - '' -
204
192
checker_command: string; External command which is run to check if
205
193
client lives. %() expansions are done at
206
194
runtime with vars(self) as dict, so that for
207
195
instance %(name)s can be used in the command.
208
use_dbus: bool(); Whether to provide D-Bus interface and signals
209
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
196
Private attibutes:
197
_timeout: Real variable for 'timeout'
198
_interval: Real variable for 'interval'
199
_timeout_milliseconds: Used when calling gobject.timeout_add()
200
_interval_milliseconds: - '' -
210
201
"""
211
def timeout_milliseconds(self):
212
"Return the 'timeout' attribute in milliseconds"
213
return ((self.timeout.days * 24 * 60 * 60 * 1000)
214
+ (self.timeout.seconds * 1000)
215
+ (self.timeout.microseconds // 1000))
216
217
def interval_milliseconds(self):
218
"Return the 'interval' attribute in milliseconds"
219
return ((self.interval.days * 24 * 60 * 60 * 1000)
220
+ (self.interval.seconds * 1000)
221
+ (self.interval.microseconds // 1000))
222
223
def __init__(self, name = None, disable_hook=None, config=None,
224
use_dbus=True):
202
def _set_timeout(self, timeout):
203
"Setter function for 'timeout' attribute"
204
self._timeout = timeout
205
self._timeout_milliseconds = ((self.timeout.days
206
* 24 * 60 * 60 * 1000)
207
+ (self.timeout.seconds * 1000)
208
+ (self.timeout.microseconds
209
// 1000))
210
timeout = property(lambda self: self._timeout,
211
_set_timeout)
212
del _set_timeout
213
def _set_interval(self, interval):
214
"Setter function for 'interval' attribute"
215
self._interval = interval
216
self._interval_milliseconds = ((self.interval.days
217
* 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds
219
* 1000)
220
+ (self.interval.microseconds
221
// 1000))
222
interval = property(lambda self: self._interval,
223
_set_interval)
224
del _set_interval
225
def __init__(self, name = None, stop_hook=None, config={}):
225
226
"""Note: the 'checker' key in 'config' sets the
226
227
'checker_command' attribute and *not* the 'checker'
227
228
attribute."""
228
229
self.name = name
229
if config is None:
230
config = {}
231
230
logger.debug(u"Creating client %r", self.name)
232
self.use_dbus = False # During __init__
233
231
# Uppercase and remove spaces from fingerprint for later
234
232
# comparison purposes with return value from the fingerprint()
235
233
# function
236
self.fingerprint = (config["fingerprint"].upper()
237
.replace(u" ", u""))
234
self.fingerprint = config["fingerprint"].upper()\
235
.replace(u" ", u"")
238
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
239
237
if "secret" in config:
240
238
self.secret = config["secret"].decode(u"base64")
241
239
elif "secfile" in config:
242
with closing(open(os.path.expanduser
243
(os.path.expandvars
244
(config["secfile"])))) as secfile:
245
self.secret = secfile.read()
240
sf = open(config["secfile"])
241
self.secret = sf.read()
242
sf.close()
246
243
else:
247
244
raise TypeError(u"No secret or secfile for client %s"
248
245
% self.name)
249
246
self.host = config.get("host", "")
250
self.created = datetime.datetime.utcnow()
251
self.enabled = False
252
self.last_enabled = None
247
self.created = datetime.datetime.now()
253
248
self.last_checked_ok = None
254
249
self.timeout = string_to_delta(config["timeout"])
255
250
self.interval = string_to_delta(config["interval"])
256
self.disable_hook = disable_hook
251
self.stop_hook = stop_hook
257
252
self.checker = None
258
253
self.checker_initiator_tag = None
259
self.disable_initiator_tag = None
254
self.stop_initiator_tag = None
260
255
self.checker_callback_tag = None
261
self.checker_command = config["checker"]
262
self.last_connect = None
263
# Only now, when this client is initialized, can it show up on
264
# the D-Bus
265
self.use_dbus = use_dbus
266
if self.use_dbus:
267
self.dbus_object_path = (dbus.ObjectPath
268
("/clients/"
269
+ self.name.replace(".", "_")))
270
dbus.service.Object.__init__(self, bus,
271
self.dbus_object_path)
272
273
def enable(self):
256
self.check_command = config["checker"]
257
def start(self):
274
258
"""Start this client's checker and timeout hooks"""
275
self.last_enabled = datetime.datetime.utcnow()
276
259
# Schedule a new checker to be started an 'interval' from now,
277
260
# and every interval from then on.
278
self.checker_initiator_tag = (gobject.timeout_add
279
(self.interval_milliseconds(),
280
self.start_checker))
261
self.checker_initiator_tag = gobject.timeout_add\
262
(self._interval_milliseconds,
263
self.start_checker)
281
264
# Also start a new checker *right now*.
282
265
self.start_checker()
283
# Schedule a disable() when 'timeout' has passed
284
self.disable_initiator_tag = (gobject.timeout_add
285
(self.timeout_milliseconds(),
286
self.disable))
287
self.enabled = True
288
if self.use_dbus:
289
# Emit D-Bus signals
290
self.PropertyChanged(dbus.String(u"enabled"),
291
dbus.Boolean(True, variant_level=1))
292
self.PropertyChanged(dbus.String(u"last_enabled"),
293
(_datetime_to_dbus(self.last_enabled,
294
variant_level=1)))
295
296
def disable(self):
297
"""Disable this client."""
298
if not getattr(self, "enabled", False):
266
# Schedule a stop() when 'timeout' has passed
267
self.stop_initiator_tag = gobject.timeout_add\
268
(self._timeout_milliseconds,
269
self.stop)
270
def stop(self):
271
"""Stop this client.
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
274
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
276
logger.info(u"Stopping client %s", self.name)
277
self.secret = None
278
else:
299
279
return False
300
logger.info(u"Disabling client %s", self.name)
301
if getattr(self, "disable_initiator_tag", False):
302
gobject.source_remove(self.disable_initiator_tag)
303
self.disable_initiator_tag = None
280
if getattr(self, "stop_initiator_tag", False):
281
gobject.source_remove(self.stop_initiator_tag)
282
self.stop_initiator_tag = None
304
283
if getattr(self, "checker_initiator_tag", False):
305
284
gobject.source_remove(self.checker_initiator_tag)
306
285
self.checker_initiator_tag = None
307
286
self.stop_checker()
308
if self.disable_hook:
309
self.disable_hook(self)
310
self.enabled = False
311
if self.use_dbus:
312
# Emit D-Bus signal
313
self.PropertyChanged(dbus.String(u"enabled"),
314
dbus.Boolean(False, variant_level=1))
287
if self.stop_hook:
288
self.stop_hook(self)
315
289
# Do not run this again if called by a gobject.timeout_add
316
290
return False
317
318
291
def __del__(self):
319
self.disable_hook = None
320
self.disable()
321
322
def checker_callback(self, pid, condition, command):
292
self.stop_hook = None
293
self.stop()
294
def checker_callback(self, pid, condition):
323
295
"""The checker has completed, so take appropriate actions."""
296
now = datetime.datetime.now()
324
297
self.checker_callback_tag = None
325
298
self.checker = None
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.PropertyChanged(dbus.String(u"checker_running"),
329
dbus.Boolean(False, variant_level=1))
330
if os.WIFEXITED(condition):
331
exitstatus = os.WEXITSTATUS(condition)
332
if exitstatus == 0:
333
logger.info(u"Checker for %(name)s succeeded",
334
vars(self))
335
self.checked_ok()
336
else:
337
logger.info(u"Checker for %(name)s failed",
338
vars(self))
339
if self.use_dbus:
340
# Emit D-Bus signal
341
self.CheckerCompleted(dbus.Int16(exitstatus),
342
dbus.Int64(condition),
343
dbus.String(command))
344
else:
299
if os.WIFEXITED(condition) \
300
and (os.WEXITSTATUS(condition) == 0):
301
logger.info(u"Checker for %(name)s succeeded",
302
vars(self))
303
self.last_checked_ok = now
304
gobject.source_remove(self.stop_initiator_tag)
305
self.stop_initiator_tag = gobject.timeout_add\
306
(self._timeout_milliseconds,
307
self.stop)
308
elif not os.WIFEXITED(condition):
345
309
logger.warning(u"Checker for %(name)s crashed?",
346
310
vars(self))
347
if self.use_dbus:
348
# Emit D-Bus signal
349
self.CheckerCompleted(dbus.Int16(-1),
350
dbus.Int64(condition),
351
dbus.String(command))
352
353
def checked_ok(self):
354
"""Bump up the timeout for this client.
355
This should only be called when the client has been seen,
356
alive and well.
357
"""
358
self.last_checked_ok = datetime.datetime.utcnow()
359
gobject.source_remove(self.disable_initiator_tag)
360
self.disable_initiator_tag = (gobject.timeout_add
361
(self.timeout_milliseconds(),
362
self.disable))
363
if self.use_dbus:
364
# Emit D-Bus signal
365
self.PropertyChanged(
366
dbus.String(u"last_checked_ok"),
367
(_datetime_to_dbus(self.last_checked_ok,
368
variant_level=1)))
369
311
else:
312
logger.info(u"Checker for %(name)s failed",
313
vars(self))
370
314
def start_checker(self):
371
315
"""Start a new checker subprocess if one is not running.
372
316
If a checker already exists, leave it running and do
381
325
# is as it should be.
382
326
if self.checker is None:
383
327
try:
384
# In case checker_command has exactly one % operator
385
command = self.checker_command % self.host
328
# In case check_command has exactly one % operator
329
command = self.check_command % self.host
386
330
except TypeError:
387
331
# Escape attributes for the shell
388
332
escaped_attrs = dict((key, re.escape(str(val)))
389
333
for key, val in
390
334
vars(self).iteritems())
391
335
try:
392
command = self.checker_command % escaped_attrs
336
command = self.check_command % escaped_attrs
393
337
except TypeError, error:
394
338
logger.error(u'Could not format string "%s":'
395
u' %s', self.checker_command, error)
339
u' %s', self.check_command, error)
396
340
return True # Try again later
397
341
try:
398
342
logger.info(u"Starting checker %r for %s",
404
348
self.checker = subprocess.Popen(command,
405
349
close_fds=True,
406
350
shell=True, cwd="/")
407
if self.use_dbus:
408
# Emit D-Bus signal
409
self.CheckerStarted(command)
410
self.PropertyChanged(
411
dbus.String("checker_running"),
412
dbus.Boolean(True, variant_level=1))
413
self.checker_callback_tag = (gobject.child_watch_add
414
(self.checker.pid,
415
self.checker_callback,
416
data=command))
417
# The checker may have completed before the gobject
418
# watch was added. Check for this.
419
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
420
if pid:
421
gobject.source_remove(self.checker_callback_tag)
422
self.checker_callback(pid, status, command)
351
self.checker_callback_tag = gobject.child_watch_add\
352
(self.checker.pid,
353
self.checker_callback)
423
354
except OSError, error:
424
355
logger.error(u"Failed to start subprocess: %s",
425
356
error)
426
357
# Re-run this periodically if run by gobject.timeout_add
427
358
return True
428
429
359
def stop_checker(self):
430
360
"""Force the checker process, if any, to stop."""
431
361
if self.checker_callback_tag:
443
373
if error.errno != errno.ESRCH: # No such process
444
374
raise
445
375
self.checker = None
446
if self.use_dbus:
447
self.PropertyChanged(dbus.String(u"checker_running"),
448
dbus.Boolean(False, variant_level=1))
449
450
376
def still_valid(self):
451
377
"""Has the timeout not yet passed for this client?"""
452
if not getattr(self, "enabled", False):
453
return False
454
now = datetime.datetime.utcnow()
378
now = datetime.datetime.now()
455
379
if self.last_checked_ok is None:
456
380
return now < (self.created + self.timeout)
457
381
else:
458
382
return now < (self.last_checked_ok + self.timeout)
459
460
## D-Bus methods & signals
461
_interface = u"se.bsnet.fukt.Mandos.Client"
462
463
# CheckedOK - method
464
CheckedOK = dbus.service.method(_interface)(checked_ok)
465
CheckedOK.__name__ = "CheckedOK"
466
467
# CheckerCompleted - signal
468
@dbus.service.signal(_interface, signature="nxs")
469
def CheckerCompleted(self, exitcode, waitstatus, command):
470
"D-Bus signal"
471
pass
472
473
# CheckerStarted - signal
474
@dbus.service.signal(_interface, signature="s")
475
def CheckerStarted(self, command):
476
"D-Bus signal"
477
pass
478
479
# GetAllProperties - method
480
@dbus.service.method(_interface, out_signature="a{sv}")
481
def GetAllProperties(self):
482
"D-Bus method"
483
return dbus.Dictionary({
484
dbus.String("name"):
485
dbus.String(self.name, variant_level=1),
486
dbus.String("fingerprint"):
487
dbus.String(self.fingerprint, variant_level=1),
488
dbus.String("host"):
489
dbus.String(self.host, variant_level=1),
490
dbus.String("created"):
491
_datetime_to_dbus(self.created, variant_level=1),
492
dbus.String("last_enabled"):
493
(_datetime_to_dbus(self.last_enabled,
494
variant_level=1)
495
if self.last_enabled is not None
496
else dbus.Boolean(False, variant_level=1)),
497
dbus.String("enabled"):
498
dbus.Boolean(self.enabled, variant_level=1),
499
dbus.String("last_checked_ok"):
500
(_datetime_to_dbus(self.last_checked_ok,
501
variant_level=1)
502
if self.last_checked_ok is not None
503
else dbus.Boolean (False, variant_level=1)),
504
dbus.String("timeout"):
505
dbus.UInt64(self.timeout_milliseconds(),
506
variant_level=1),
507
dbus.String("interval"):
508
dbus.UInt64(self.interval_milliseconds(),
509
variant_level=1),
510
dbus.String("checker"):
511
dbus.String(self.checker_command,
512
variant_level=1),
513
dbus.String("checker_running"):
514
dbus.Boolean(self.checker is not None,
515
variant_level=1),
516
dbus.String("object_path"):
517
dbus.ObjectPath(self.dbus_object_path,
518
variant_level=1)
519
}, signature="sv")
520
521
# IsStillValid - method
522
IsStillValid = (dbus.service.method(_interface, out_signature="b")
523
(still_valid))
524
IsStillValid.__name__ = "IsStillValid"
525
526
# PropertyChanged - signal
527
@dbus.service.signal(_interface, signature="sv")
528
def PropertyChanged(self, property, value):
529
"D-Bus signal"
530
pass
531
532
# SetChecker - method
533
@dbus.service.method(_interface, in_signature="s")
534
def SetChecker(self, checker):
535
"D-Bus setter method"
536
self.checker_command = checker
537
# Emit D-Bus signal
538
self.PropertyChanged(dbus.String(u"checker"),
539
dbus.String(self.checker_command,
540
variant_level=1))
541
542
# SetHost - method
543
@dbus.service.method(_interface, in_signature="s")
544
def SetHost(self, host):
545
"D-Bus setter method"
546
self.host = host
547
# Emit D-Bus signal
548
self.PropertyChanged(dbus.String(u"host"),
549
dbus.String(self.host, variant_level=1))
550
551
# SetInterval - method
552
@dbus.service.method(_interface, in_signature="t")
553
def SetInterval(self, milliseconds):
554
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
555
# Emit D-Bus signal
556
self.PropertyChanged(dbus.String(u"interval"),
557
(dbus.UInt64(self.interval_milliseconds(),
558
variant_level=1)))
559
560
# SetSecret - method
561
@dbus.service.method(_interface, in_signature="ay",
562
byte_arrays=True)
563
def SetSecret(self, secret):
564
"D-Bus setter method"
565
self.secret = str(secret)
566
567
# SetTimeout - method
568
@dbus.service.method(_interface, in_signature="t")
569
def SetTimeout(self, milliseconds):
570
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
571
# Emit D-Bus signal
572
self.PropertyChanged(dbus.String(u"timeout"),
573
(dbus.UInt64(self.timeout_milliseconds(),
574
variant_level=1)))
575
576
# Enable - method
577
Enable = dbus.service.method(_interface)(enable)
578
Enable.__name__ = "Enable"
579
580
# StartChecker - method
581
@dbus.service.method(_interface)
582
def StartChecker(self):
583
"D-Bus method"
584
self.start_checker()
585
586
# Disable - method
587
@dbus.service.method(_interface)
588
def Disable(self):
589
"D-Bus method"
590
self.disable()
591
592
# StopChecker - method
593
StopChecker = dbus.service.method(_interface)(stop_checker)
594
StopChecker.__name__ = "StopChecker"
595
596
del _interface
597
383
598
384
599
385
def peer_certificate(session):
600
386
"Return the peer's OpenPGP certificate as a bytestring"
601
387
# If not an OpenPGP certificate...
602
if (gnutls.library.functions
603
.gnutls_certificate_type_get(session._c_object)
604
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
388
if gnutls.library.functions.gnutls_certificate_type_get\
389
(session._c_object) \
390
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
605
391
# ...do the normal thing
606
392
return session.peer_certificate
607
list_size = ctypes.c_uint(1)
608
cert_list = (gnutls.library.functions
609
.gnutls_certificate_get_peers
610
(session._c_object, ctypes.byref(list_size)))
611
if not bool(cert_list) and list_size.value != 0:
612
raise gnutls.errors.GNUTLSError("error getting peer"
613
" certificate")
393
list_size = ctypes.c_uint()
394
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
(session._c_object, ctypes.byref(list_size))
614
396
if list_size.value == 0:
615
397
return None
616
398
cert = cert_list[0]
620
402
def fingerprint(openpgp):
621
403
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
622
404
# New GnuTLS "datum" with the OpenPGP public key
623
datum = (gnutls.library.types
624
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
625
ctypes.POINTER
626
(ctypes.c_ubyte)),
627
ctypes.c_uint(len(openpgp))))
405
datum = gnutls.library.types.gnutls_datum_t\
406
(ctypes.cast(ctypes.c_char_p(openpgp),
407
ctypes.POINTER(ctypes.c_ubyte)),
408
ctypes.c_uint(len(openpgp)))
628
409
# New empty GnuTLS certificate
629
410
crt = gnutls.library.types.gnutls_openpgp_crt_t()
630
(gnutls.library.functions
631
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
411
gnutls.library.functions.gnutls_openpgp_crt_init\
412
(ctypes.byref(crt))
632
413
# Import the OpenPGP public key into the certificate
633
(gnutls.library.functions
634
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
635
gnutls.library.constants
636
.GNUTLS_OPENPGP_FMT_RAW))
414
gnutls.library.functions.gnutls_openpgp_crt_import\
415
(crt, ctypes.byref(datum),
416
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
637
417
# Verify the self signature in the key
638
crtverify = ctypes.c_uint()
639
(gnutls.library.functions
640
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
418
crtverify = ctypes.c_uint();
419
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
(crt, 0, ctypes.byref(crtverify))
641
421
if crtverify.value != 0:
642
422
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
643
423
raise gnutls.errors.CertificateSecurityError("Verify failed")
644
424
# New buffer for the fingerprint
645
buf = ctypes.create_string_buffer(20)
646
buf_len = ctypes.c_size_t()
425
buffer = ctypes.create_string_buffer(20)
426
buffer_length = ctypes.c_size_t()
647
427
# Get the fingerprint from the certificate into the buffer
648
(gnutls.library.functions
649
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
650
ctypes.byref(buf_len)))
428
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
651
430
# Deinit the certificate
652
431
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
653
432
# Convert the buffer to a Python bytestring
654
fpr = ctypes.string_at(buf, buf_len.value)
433
fpr = ctypes.string_at(buffer, buffer_length.value)
655
434
# Convert the bytestring to hexadecimal notation
656
435
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
657
436
return hex_fpr
658
437
659
438
660
class TCP_handler(SocketServer.BaseRequestHandler, object):
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
661
440
"""A TCP request handler class.
662
441
Instantiated by IPv6_TCPServer for each request to handle it.
663
442
Note: This will run in its own forked process."""
664
443
665
444
def handle(self):
666
445
logger.info(u"TCP connection from: %s",
667
unicode(self.client_address))
668
session = (gnutls.connection
669
.ClientSession(self.request,
670
gnutls.connection
671
.X509Credentials()))
446
unicode(self.client_address))
447
session = gnutls.connection.ClientSession\
448
(self.request, gnutls.connection.X509Credentials())
672
449
673
450
line = self.request.makefile().readline()
674
451
logger.debug(u"Protocol version: %r", line)
685
462
# using OpenPGP certificates.
686
463
687
464
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
688
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
689
# "+DHE-DSS"))
690
# Use a fallback default, since this MUST be set.
691
priority = self.server.settings.get("priority", "NORMAL")
692
(gnutls.library.functions
693
.gnutls_priority_set_direct(session._c_object,
694
priority, None))
465
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
466
# "+DHE-DSS"))
467
priority = "NORMAL" # Fallback default, since this
468
# MUST be set.
469
if self.server.settings["priority"]:
470
priority = self.server.settings["priority"]
471
gnutls.library.functions.gnutls_priority_set_direct\
472
(session._c_object, priority, None);
695
473
696
474
try:
697
475
session.handshake()
700
478
# Do not run session.bye() here: the session is not
701
479
# established. Just abandon the request.
702
480
return
703
logger.debug(u"Handshake succeeded")
704
481
try:
705
482
fpr = fingerprint(peer_certificate(session))
706
483
except (TypeError, gnutls.errors.GNUTLSError), error:
708
485
session.bye()
709
486
return
710
487
logger.debug(u"Fingerprint: %s", fpr)
711
488
client = None
712
489
for c in self.server.clients:
713
490
if c.fingerprint == fpr:
714
491
client = c
715
492
break
716
else:
493
if not client:
717
494
logger.warning(u"Client not found for fingerprint: %s",
718
495
fpr)
719
496
session.bye()
726
503
vars(client))
727
504
session.bye()
728
505
return
729
## This won't work here, since we're in a fork.
730
# client.checked_ok()
731
506
sent_size = 0
732
507
while sent_size < len(client.secret):
733
508
sent = session.send(client.secret[sent_size:])
738
513
session.bye()
739
514
740
515
741
class IPv6_TCPServer(SocketServer.ForkingMixIn,
742
SocketServer.TCPServer, object):
743
"""IPv6-capable TCP server. Accepts 'None' as address and/or port.
516
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
517
"""IPv6 TCP server. Accepts 'None' as address and/or port.
744
518
Attributes:
745
519
settings: Server settings
746
520
clients: Set() of Client objects
754
528
if "clients" in kwargs:
755
529
self.clients = kwargs["clients"]
756
530
del kwargs["clients"]
757
if "use_ipv6" in kwargs:
758
if not kwargs["use_ipv6"]:
759
self.address_family = socket.AF_INET
760
del kwargs["use_ipv6"]
761
531
self.enabled = False
762
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
532
return super(type(self), self).__init__(*args, **kwargs)
763
533
def server_bind(self):
764
534
"""This overrides the normal server_bind() function
765
535
to bind to an interface if one was specified, and also NOT to
777
547
u" bind to interface %s",
778
548
self.settings["interface"])
779
549
else:
780
raise
550
raise error
781
551
# Only bind(2) the socket if we really need to.
782
552
if self.server_address[0] or self.server_address[1]:
783
553
if not self.server_address[0]:
784
if self.address_family == socket.AF_INET6:
785
any_address = "::" # in6addr_any
786
else:
787
any_address = socket.INADDR_ANY
788
self.server_address = (any_address,
554
in6addr_any = "::"
555
self.server_address = (in6addr_any,
789
556
self.server_address[1])
790
557
elif not self.server_address[1]:
791
558
self.server_address = (self.server_address[0],
797
564
# if_nametoindex
798
565
# (self.settings
799
566
# ["interface"]))
800
return super(IPv6_TCPServer, self).server_bind()
567
return super(type(self), self).server_bind()
801
568
def server_activate(self):
802
569
if self.enabled:
803
return super(IPv6_TCPServer, self).server_activate()
570
return super(type(self), self).server_activate()
804
571
def enable(self):
805
572
self.enabled = True
806
573
807
574
808
575
def string_to_delta(interval):
809
576
"""Parse a string and return a datetime.timedelta
810
577
811
578
>>> string_to_delta('7d')
812
579
datetime.timedelta(7)
813
580
>>> string_to_delta('60s')
824
591
timevalue = datetime.timedelta(0)
825
592
for s in interval.split():
826
593
try:
827
suffix = unicode(s[-1])
828
value = int(s[:-1])
594
suffix=unicode(s[-1])
595
value=int(s[:-1])
829
596
if suffix == u"d":
830
597
delta = datetime.timedelta(value)
831
598
elif suffix == u"s":
865
632
elif state == avahi.ENTRY_GROUP_FAILURE:
866
633
logger.critical(u"Avahi: Error in group state changed %s",
867
634
unicode(error))
868
raise AvahiGroupError(u"State changed: %s" % unicode(error))
635
raise AvahiGroupError("State changed: %s", str(error))
869
636
870
637
def if_nametoindex(interface):
871
638
"""Call the C function if_nametoindex(), or equivalent"""
872
639
global if_nametoindex
873
640
try:
874
if_nametoindex = (ctypes.cdll.LoadLibrary
875
(ctypes.util.find_library("c"))
876
.if_nametoindex)
641
if "ctypes.util" not in sys.modules:
642
import ctypes.util
643
if_nametoindex = ctypes.cdll.LoadLibrary\
644
(ctypes.util.find_library("c")).if_nametoindex
877
645
except (OSError, AttributeError):
878
646
if "struct" not in sys.modules:
879
647
import struct
882
650
def if_nametoindex(interface):
883
651
"Get an interface index the hard way, i.e. using fcntl()"
884
652
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
885
with closing(socket.socket()) as s:
886
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
887
struct.pack("16s16x", interface))
653
s = socket.socket()
654
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
655
struct.pack("16s16x", interface))
656
s.close()
888
657
interface_index = struct.unpack("I", ifreq[16:20])[0]
889
658
return interface_index
890
659
return if_nametoindex(interface)
914
683
915
684
916
685
def main():
917
parser = optparse.OptionParser(version = "%%prog %s" % version)
686
global main_loop_started
687
main_loop_started = False
688
689
parser = OptionParser(version = "%%prog %s" % version)
918
690
parser.add_option("-i", "--interface", type="string",
919
691
metavar="IF", help="Bind to interface IF")
920
692
parser.add_option("-a", "--address", type="string",
921
693
help="Address to listen for requests on")
922
694
parser.add_option("-p", "--port", type="int",
923
695
help="Port number to receive requests on")
924
parser.add_option("--check", action="store_true",
696
parser.add_option("--check", action="store_true", default=False,
925
697
help="Run self-test")
926
698
parser.add_option("--debug", action="store_true",
927
699
help="Debug mode; run in foreground and log to"
934
706
default="/etc/mandos", metavar="DIR",
935
707
help="Directory to search for configuration"
936
708
" files")
937
parser.add_option("--no-dbus", action="store_false",
938
dest="use_dbus",
939
help="Do not provide D-Bus system bus"
940
" interface")
941
parser.add_option("--no-ipv6", action="store_false",
942
dest="use_ipv6", help="Do not use IPv6")
943
options = parser.parse_args()[0]
709
(options, args) = parser.parse_args()
944
710
945
711
if options.check:
946
712
import doctest
955
721
"priority":
956
722
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
957
723
"servicename": "Mandos",
958
"use_dbus": "True",
959
"use_ipv6": "True",
960
724
}
961
725
962
726
# Parse config file for server-global settings
965
729
server_config.read(os.path.join(options.configdir, "mandos.conf"))
966
730
# Convert the SafeConfigParser object to a dict
967
731
server_settings = server_config.defaults()
968
# Use the appropriate methods on the non-string config options
969
server_settings["debug"] = server_config.getboolean("DEFAULT",
970
"debug")
971
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
972
"use_dbus")
973
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
974
"use_ipv6")
975
if server_settings["port"]:
976
server_settings["port"] = server_config.getint("DEFAULT",
977
"port")
732
# Use getboolean on the boolean config option
733
server_settings["debug"] = server_config.getboolean\
734
("DEFAULT", "debug")
978
735
del server_config
979
736
980
737
# Override the settings from the config file with command line
981
738
# options, if set.
982
739
for option in ("interface", "address", "port", "debug",
983
"priority", "servicename", "configdir",
984
"use_dbus", "use_ipv6"):
740
"priority", "servicename", "configdir"):
985
741
value = getattr(options, option)
986
742
if value is not None:
987
743
server_settings[option] = value
988
744
del options
989
745
# Now we have our good server settings in "server_settings"
990
746
991
# For convenience
992
747
debug = server_settings["debug"]
993
use_dbus = server_settings["use_dbus"]
994
use_ipv6 = server_settings["use_ipv6"]
995
748
996
749
if not debug:
997
750
syslogger.setLevel(logging.WARNING)
998
751
console.setLevel(logging.WARNING)
999
752
1000
753
if server_settings["servicename"] != "Mandos":
1001
syslogger.setFormatter(logging.Formatter
754
syslogger.setFormatter(logging.Formatter\
1002
755
('Mandos (%s): %%(levelname)s:'
1003
756
' %%(message)s'
1004
757
% server_settings["servicename"]))
1006
759
# Parse config file with clients
1007
760
client_defaults = { "timeout": "1h",
1008
761
"interval": "5m",
1009
"checker": "fping -q -- %%(host)s",
762
"checker": "fping -q -- %(host)s",
1010
763
"host": "",
1011
764
}
1012
765
client_config = ConfigParser.SafeConfigParser(client_defaults)
1016
769
clients = Set()
1017
770
tcp_server = IPv6_TCPServer((server_settings["address"],
1018
771
server_settings["port"]),
1019
TCP_handler,
772
tcp_handler,
1020
773
settings=server_settings,
1021
clients=clients, use_ipv6=use_ipv6)
774
clients=clients)
1022
775
pidfilename = "/var/run/mandos.pid"
1023
776
try:
1024
777
pidfile = open(pidfilename, "w")
1025
except IOError:
778
except IOError, error:
1026
779
logger.error("Could not open file %r", pidfilename)
1027
780
1028
try:
1029
uid = pwd.getpwnam("_mandos").pw_uid
1030
gid = pwd.getpwnam("_mandos").pw_gid
1031
except KeyError:
1032
try:
1033
uid = pwd.getpwnam("mandos").pw_uid
1034
gid = pwd.getpwnam("mandos").pw_gid
1035
except KeyError:
1036
try:
1037
uid = pwd.getpwnam("nobody").pw_uid
1038
gid = pwd.getpwnam("nogroup").pw_gid
1039
except KeyError:
1040
uid = 65534
1041
gid = 65534
1042
try:
781
uid = 65534
782
gid = 65534
783
try:
784
uid = pwd.getpwnam("mandos").pw_uid
785
except KeyError:
786
try:
787
uid = pwd.getpwnam("nobody").pw_uid
788
except KeyError:
789
pass
790
try:
791
gid = pwd.getpwnam("mandos").pw_gid
792
except KeyError:
793
try:
794
gid = pwd.getpwnam("nogroup").pw_gid
795
except KeyError:
796
pass
797
try:
798
os.setuid(uid)
1043
799
os.setgid(gid)
1044
os.setuid(uid)
1045
800
except OSError, error:
1046
801
if error[0] != errno.EPERM:
1047
802
raise error
1048
803
1049
# Enable all possible GnuTLS debugging
1050
if debug:
1051
# "Use a log level over 10 to enable all debugging options."
1052
# - GnuTLS manual
1053
gnutls.library.functions.gnutls_global_set_log_level(11)
1054
1055
@gnutls.library.types.gnutls_log_func
1056
def debug_gnutls(level, string):
1057
logger.debug("GnuTLS: %s", string[:-1])
1058
1059
(gnutls.library.functions
1060
.gnutls_global_set_log_function(debug_gnutls))
1061
1062
804
global service
1063
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1064
805
service = AvahiService(name = server_settings["servicename"],
1065
servicetype = "_mandos._tcp",
1066
protocol = protocol)
806
type = "_mandos._tcp", );
1067
807
if server_settings["interface"]:
1068
service.interface = (if_nametoindex
1069
(server_settings["interface"]))
808
service.interface = if_nametoindex\
809
(server_settings["interface"])
1070
810
1071
811
global main_loop
1072
812
global bus
1079
819
avahi.DBUS_PATH_SERVER),
1080
820
avahi.DBUS_INTERFACE_SERVER)
1081
821
# End of Avahi example code
1082
if use_dbus:
1083
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
822
823
def remove_from_clients(client):
824
clients.remove(client)
825
if not clients:
826
logger.critical(u"No clients left, exiting")
827
sys.exit()
1084
828
1085
829
clients.update(Set(Client(name = section,
830
stop_hook = remove_from_clients,
1086
831
config
1087
= dict(client_config.items(section)),
1088
use_dbus = use_dbus)
832
= dict(client_config.items(section)))
1089
833
for section in client_config.sections()))
1090
834
if not clients:
1091
logger.warning(u"No clients defined")
835
logger.critical(u"No clients defined")
836
sys.exit(1)
1092
837
1093
838
if debug:
1094
839
# Redirect stdin so all checkers get /dev/null
1107
852
pidfile.write(str(pid) + "\n")
1108
853
pidfile.close()
1109
854
del pidfile
1110
except IOError:
855
except IOError, err:
1111
856
logger.error(u"Could not write to file %r with PID %d",
1112
857
pidfilename, pid)
1113
858
except NameError:
1126
871
1127
872
while clients:
1128
873
client = clients.pop()
1129
client.disable_hook = None
1130
client.disable()
874
client.stop_hook = None
875
client.stop()
1131
876
1132
877
atexit.register(cleanup)
1133
878
1136
881
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1137
882
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1138
883
1139
if use_dbus:
1140
class MandosServer(dbus.service.Object):
1141
"""A D-Bus proxy object"""
1142
def __init__(self):
1143
dbus.service.Object.__init__(self, bus, "/")
1144
_interface = u"se.bsnet.fukt.Mandos"
1145
1146
@dbus.service.signal(_interface, signature="oa{sv}")
1147
def ClientAdded(self, objpath, properties):
1148
"D-Bus signal"
1149
pass
1150
1151
@dbus.service.signal(_interface, signature="os")
1152
def ClientRemoved(self, objpath, name):
1153
"D-Bus signal"
1154
pass
1155
1156
@dbus.service.method(_interface, out_signature="ao")
1157
def GetAllClients(self):
1158
"D-Bus method"
1159
return dbus.Array(c.dbus_object_path for c in clients)
1160
1161
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1162
def GetAllClientsWithProperties(self):
1163
"D-Bus method"
1164
return dbus.Dictionary(
1165
((c.dbus_object_path, c.GetAllProperties())
1166
for c in clients),
1167
signature="oa{sv}")
1168
1169
@dbus.service.method(_interface, in_signature="o")
1170
def RemoveClient(self, object_path):
1171
"D-Bus method"
1172
for c in clients:
1173
if c.dbus_object_path == object_path:
1174
clients.remove(c)
1175
# Don't signal anything except ClientRemoved
1176
c.use_dbus = False
1177
c.disable()
1178
# Emit D-Bus signal
1179
self.ClientRemoved(object_path, c.name)
1180
return
1181
raise KeyError
1182
1183
del _interface
1184
1185
mandos_server = MandosServer()
1186
1187
884
for client in clients:
1188
if use_dbus:
1189
# Emit D-Bus signal
1190
mandos_server.ClientAdded(client.dbus_object_path,
1191
client.GetAllProperties())
1192
client.enable()
885
client.start()
1193
886
1194
887
tcp_server.enable()
1195
888
tcp_server.server_activate()
1196
889
1197
890
# Find out what port we got
1198
891
service.port = tcp_server.socket.getsockname()[1]
1199
if use_ipv6:
1200
logger.info(u"Now listening on address %r, port %d,"
1201
" flowinfo %d, scope_id %d"
1202
% tcp_server.socket.getsockname())
1203
else: # IPv4
1204
logger.info(u"Now listening on address %r, port %d"
1205
% tcp_server.socket.getsockname())
892
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
893
u" scope_id %d" % tcp_server.socket.getsockname())
1206
894
1207
895
#service.interface = tcp_server.socket.getsockname()[3]
1208
896
1218
906
1219
907
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1220
908
lambda *args, **kwargs:
1221
(tcp_server.handle_request
1222
(*args[2:], **kwargs) or True))
909
tcp_server.handle_request\
910
(*args[2:], **kwargs) or True)
1223
911
1224
912
logger.debug(u"Starting main loop")
913
main_loop_started = True
1225
914
main_loop.run()
1226
915
except AvahiError, error:
1227
logger.critical(u"AvahiError: %s", error)
916
logger.critical(u"AvahiError: %s" + unicode(error))
1228
917
sys.exit(1)
1229
918
except KeyboardInterrupt:
1230
919
if debug:
1231
print >> sys.stderr
1232
logger.debug("Server received KeyboardInterrupt")
1233
logger.debug("Server exiting")
920
print
1234
921
1235
922
if __name__ == '__main__':
1236
923
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0