To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 183
- compare with another revision
- download diff
- download tarball
- view history from revision 183
- Committer: Teddy Hogeborn
- Date: 2008-09-13 15:36:18 UTC
- Revision ID: teddy@fukt.bsnet.se-20080913153618-atp386q2bqj0ku99
* Makefile (install-client-nokey): Do "&&" instead of ";" to catch
errors.
* README: Kill the straight quotes. Add copyright notice.
* overview.xml: Improved wording.
errors.
* README: Kill the straight quotes. Add copyright notice.
* overview.xml: Improved wording.
- files added:
- etc-plugins.d-README
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008 Teddy Hogeborn
15
# Copyright © 2008 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import division, with_statement, absolute_import
33
from __future__ import division
35
34
36
35
import SocketServer
37
36
import socket
37
import select
38
38
from optparse import OptionParser
39
39
import datetime
40
40
import errno
56
56
import logging
57
57
import logging.handlers
58
58
import pwd
59
from contextlib import closing
60
59
61
60
import dbus
62
import dbus.service
63
61
import gobject
64
62
import avahi
65
63
from dbus.mainloop.glib import DBusGMainLoop
66
64
import ctypes
67
import ctypes.util
68
65
69
version = "1.0.2"
66
version = "1.0"
70
67
71
68
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
77
74
logger.addHandler(syslogger)
78
75
79
76
console = logging.StreamHandler()
84
81
class AvahiError(Exception):
85
82
def __init__(self, value):
86
83
self.value = value
87
super(AvahiError, self).__init__()
88
84
def __str__(self):
89
85
return repr(self.value)
90
86
112
108
a sensible number of times
113
109
"""
114
110
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
111
type = None, port = None, TXT = None, domain = "",
112
host = "", max_renames = 32768):
117
113
self.interface = interface
118
114
self.name = name
119
self.type = servicetype
115
self.type = type
120
116
self.port = port
121
self.TXT = TXT if TXT is not None else []
117
if TXT is None:
118
self.TXT = []
119
else:
120
self.TXT = TXT
122
121
self.domain = domain
123
122
self.host = host
124
123
self.rename_count = 0
128
127
if self.rename_count >= self.max_renames:
129
128
logger.critical(u"No suitable Zeroconf service name found"
130
129
u" after %i retries, exiting.",
131
self.rename_count)
130
rename_count)
132
131
raise AvahiServiceError("Too many renames")
133
132
self.name = server.GetAlternativeServiceName(self.name)
134
133
logger.info(u"Changing Zeroconf service name to %r ...",
135
134
str(self.name))
136
syslogger.setFormatter(logging.Formatter
135
syslogger.setFormatter(logging.Formatter\
137
136
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
137
' %%(message)s' % self.name))
139
138
self.remove()
140
139
self.add()
141
140
self.rename_count += 1
147
146
"""Derived from the Avahi example code"""
148
147
global group
149
148
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
149
group = dbus.Interface\
150
(bus.get_object(avahi.DBUS_NAME,
152
151
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
153
group.connect_to_signal('StateChanged',
155
154
entry_group_state_changed)
156
155
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
170
169
# End of Avahi example code
171
170
172
171
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
172
class Client(object):
179
173
"""A representation of a client host served by this server.
180
174
Attributes:
181
name: string; from the config file, used in log messages
175
name: string; from the config file, used in log messages
182
176
fingerprint: string (40 or 32 hexadecimal digits); used to
183
177
uniquely identify the client
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
178
secret: bytestring; sent verbatim (over TLS) to client
179
host: string; available for use by the checker command
180
created: datetime.datetime(); object creation, not client host
181
last_checked_ok: datetime.datetime() or None if not yet checked OK
182
timeout: datetime.timedelta(); How long from last_checked_ok
183
until this client is invalid
184
interval: datetime.timedelta(); How often to start a new checker
185
stop_hook: If set, called by stop() as stop_hook(self)
186
checker: subprocess.Popen(); a running checker process used
187
to see if the client lives.
188
'None' if no process is running.
197
189
checker_initiator_tag: a gobject event source tag, or None
198
disable_initiator_tag: - '' -
190
stop_initiator_tag: - '' -
199
191
checker_callback_tag: - '' -
200
192
checker_command: string; External command which is run to check if
201
193
client lives. %() expansions are done at
202
194
runtime with vars(self) as dict, so that for
203
195
instance %(name)s can be used in the command.
204
dbus_object_path: dbus.ObjectPath
205
196
Private attibutes:
206
197
_timeout: Real variable for 'timeout'
207
198
_interval: Real variable for 'interval'
209
200
_interval_milliseconds: - '' -
210
201
"""
211
202
def _set_timeout(self, timeout):
212
"Setter function for the 'timeout' attribute"
203
"Setter function for 'timeout' attribute"
213
204
self._timeout = timeout
214
205
self._timeout_milliseconds = ((self.timeout.days
215
206
* 24 * 60 * 60 * 1000)
216
207
+ (self.timeout.seconds * 1000)
217
208
+ (self.timeout.microseconds
218
209
// 1000))
219
# Emit D-Bus signal
220
self.PropertyChanged(dbus.String(u"timeout"),
221
(dbus.UInt64(self._timeout_milliseconds,
222
variant_level=1)))
223
timeout = property(lambda self: self._timeout, _set_timeout)
210
timeout = property(lambda self: self._timeout,
211
_set_timeout)
224
212
del _set_timeout
225
226
213
def _set_interval(self, interval):
227
"Setter function for the 'interval' attribute"
214
"Setter function for 'interval' attribute"
228
215
self._interval = interval
229
216
self._interval_milliseconds = ((self.interval.days
230
217
* 24 * 60 * 60 * 1000)
232
219
* 1000)
233
220
+ (self.interval.microseconds
234
221
// 1000))
235
# Emit D-Bus signal
236
self.PropertyChanged(dbus.String(u"interval"),
237
(dbus.UInt64(self._interval_milliseconds,
238
variant_level=1)))
239
interval = property(lambda self: self._interval, _set_interval)
222
interval = property(lambda self: self._interval,
223
_set_interval)
240
224
del _set_interval
241
242
def __init__(self, name = None, disable_hook=None, config=None):
225
def __init__(self, name = None, stop_hook=None, config={}):
243
226
"""Note: the 'checker' key in 'config' sets the
244
227
'checker_command' attribute and *not* the 'checker'
245
228
attribute."""
246
self.dbus_object_path = (dbus.ObjectPath
247
("/Mandos/clients/"
248
+ name.replace(".", "_")))
249
dbus.service.Object.__init__(self, bus,
250
self.dbus_object_path)
251
if config is None:
252
config = {}
253
229
self.name = name
254
230
logger.debug(u"Creating client %r", self.name)
255
231
# Uppercase and remove spaces from fingerprint for later
256
232
# comparison purposes with return value from the fingerprint()
257
233
# function
258
self.fingerprint = (config["fingerprint"].upper()
259
.replace(u" ", u""))
234
self.fingerprint = config["fingerprint"].upper()\
235
.replace(u" ", u"")
260
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
261
237
if "secret" in config:
262
238
self.secret = config["secret"].decode(u"base64")
263
239
elif "secfile" in config:
264
with closing(open(os.path.expanduser
265
(os.path.expandvars
266
(config["secfile"])))) as secfile:
267
self.secret = secfile.read()
240
sf = open(config["secfile"])
241
self.secret = sf.read()
242
sf.close()
268
243
else:
269
244
raise TypeError(u"No secret or secfile for client %s"
270
245
% self.name)
271
246
self.host = config.get("host", "")
272
self.created = datetime.datetime.utcnow()
273
self.enabled = False
274
self.last_enabled = None
247
self.created = datetime.datetime.now()
275
248
self.last_checked_ok = None
276
249
self.timeout = string_to_delta(config["timeout"])
277
250
self.interval = string_to_delta(config["interval"])
278
self.disable_hook = disable_hook
251
self.stop_hook = stop_hook
279
252
self.checker = None
280
253
self.checker_initiator_tag = None
281
self.disable_initiator_tag = None
254
self.stop_initiator_tag = None
282
255
self.checker_callback_tag = None
283
self.checker_command = config["checker"]
284
285
def enable(self):
256
self.check_command = config["checker"]
257
def start(self):
286
258
"""Start this client's checker and timeout hooks"""
287
self.last_enabled = datetime.datetime.utcnow()
288
259
# Schedule a new checker to be started an 'interval' from now,
289
260
# and every interval from then on.
290
self.checker_initiator_tag = (gobject.timeout_add
291
(self._interval_milliseconds,
292
self.start_checker))
261
self.checker_initiator_tag = gobject.timeout_add\
262
(self._interval_milliseconds,
263
self.start_checker)
293
264
# Also start a new checker *right now*.
294
265
self.start_checker()
295
# Schedule a disable() when 'timeout' has passed
296
self.disable_initiator_tag = (gobject.timeout_add
297
(self._timeout_milliseconds,
298
self.disable))
299
self.enabled = True
300
# Emit D-Bus signal
301
self.PropertyChanged(dbus.String(u"enabled"),
302
dbus.Boolean(True, variant_level=1))
303
self.PropertyChanged(dbus.String(u"last_enabled"),
304
(_datetime_to_dbus(self.last_enabled,
305
variant_level=1)))
306
307
def disable(self):
308
"""Disable this client."""
309
if not getattr(self, "enabled", False):
266
# Schedule a stop() when 'timeout' has passed
267
self.stop_initiator_tag = gobject.timeout_add\
268
(self._timeout_milliseconds,
269
self.stop)
270
def stop(self):
271
"""Stop this client.
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
274
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
276
logger.info(u"Stopping client %s", self.name)
277
self.secret = None
278
else:
310
279
return False
311
logger.info(u"Disabling client %s", self.name)
312
if getattr(self, "disable_initiator_tag", False):
313
gobject.source_remove(self.disable_initiator_tag)
314
self.disable_initiator_tag = None
280
if getattr(self, "stop_initiator_tag", False):
281
gobject.source_remove(self.stop_initiator_tag)
282
self.stop_initiator_tag = None
315
283
if getattr(self, "checker_initiator_tag", False):
316
284
gobject.source_remove(self.checker_initiator_tag)
317
285
self.checker_initiator_tag = None
318
286
self.stop_checker()
319
if self.disable_hook:
320
self.disable_hook(self)
321
self.enabled = False
322
# Emit D-Bus signal
323
self.PropertyChanged(dbus.String(u"enabled"),
324
dbus.Boolean(False, variant_level=1))
287
if self.stop_hook:
288
self.stop_hook(self)
325
289
# Do not run this again if called by a gobject.timeout_add
326
290
return False
327
328
291
def __del__(self):
329
self.disable_hook = None
330
self.disable()
331
332
def checker_callback(self, pid, condition, command):
292
self.stop_hook = None
293
self.stop()
294
def checker_callback(self, pid, condition):
333
295
"""The checker has completed, so take appropriate actions."""
296
now = datetime.datetime.now()
334
297
self.checker_callback_tag = None
335
298
self.checker = None
336
# Emit D-Bus signal
337
self.PropertyChanged(dbus.String(u"checker_running"),
338
dbus.Boolean(False, variant_level=1))
339
if (os.WIFEXITED(condition)
340
and (os.WEXITSTATUS(condition) == 0)):
299
if os.WIFEXITED(condition) \
300
and (os.WEXITSTATUS(condition) == 0):
341
301
logger.info(u"Checker for %(name)s succeeded",
342
302
vars(self))
343
# Emit D-Bus signal
344
self.CheckerCompleted(dbus.Boolean(True),
345
dbus.UInt16(condition),
346
dbus.String(command))
347
self.bump_timeout()
303
self.last_checked_ok = now
304
gobject.source_remove(self.stop_initiator_tag)
305
self.stop_initiator_tag = gobject.timeout_add\
306
(self._timeout_milliseconds,
307
self.stop)
348
308
elif not os.WIFEXITED(condition):
349
309
logger.warning(u"Checker for %(name)s crashed?",
350
310
vars(self))
351
# Emit D-Bus signal
352
self.CheckerCompleted(dbus.Boolean(False),
353
dbus.UInt16(condition),
354
dbus.String(command))
355
311
else:
356
312
logger.info(u"Checker for %(name)s failed",
357
313
vars(self))
358
# Emit D-Bus signal
359
self.CheckerCompleted(dbus.Boolean(False),
360
dbus.UInt16(condition),
361
dbus.String(command))
362
363
def bump_timeout(self):
364
"""Bump up the timeout for this client.
365
This should only be called when the client has been seen,
366
alive and well.
367
"""
368
self.last_checked_ok = datetime.datetime.utcnow()
369
gobject.source_remove(self.disable_initiator_tag)
370
self.disable_initiator_tag = (gobject.timeout_add
371
(self._timeout_milliseconds,
372
self.disable))
373
self.PropertyChanged(dbus.String(u"last_checked_ok"),
374
(_datetime_to_dbus(self.last_checked_ok,
375
variant_level=1)))
376
377
314
def start_checker(self):
378
315
"""Start a new checker subprocess if one is not running.
379
316
If a checker already exists, leave it running and do
388
325
# is as it should be.
389
326
if self.checker is None:
390
327
try:
391
# In case checker_command has exactly one % operator
392
command = self.checker_command % self.host
328
# In case check_command has exactly one % operator
329
command = self.check_command % self.host
393
330
except TypeError:
394
331
# Escape attributes for the shell
395
332
escaped_attrs = dict((key, re.escape(str(val)))
396
333
for key, val in
397
334
vars(self).iteritems())
398
335
try:
399
command = self.checker_command % escaped_attrs
336
command = self.check_command % escaped_attrs
400
337
except TypeError, error:
401
338
logger.error(u'Could not format string "%s":'
402
u' %s', self.checker_command, error)
339
u' %s', self.check_command, error)
403
340
return True # Try again later
404
341
try:
405
342
logger.info(u"Starting checker %r for %s",
411
348
self.checker = subprocess.Popen(command,
412
349
close_fds=True,
413
350
shell=True, cwd="/")
414
# Emit D-Bus signal
415
self.CheckerStarted(command)
416
self.PropertyChanged(dbus.String("checker_running"),
417
dbus.Boolean(True, variant_level=1))
418
self.checker_callback_tag = (gobject.child_watch_add
419
(self.checker.pid,
420
self.checker_callback,
421
data=command))
351
self.checker_callback_tag = gobject.child_watch_add\
352
(self.checker.pid,
353
self.checker_callback)
422
354
except OSError, error:
423
355
logger.error(u"Failed to start subprocess: %s",
424
356
error)
425
357
# Re-run this periodically if run by gobject.timeout_add
426
358
return True
427
428
359
def stop_checker(self):
429
360
"""Force the checker process, if any, to stop."""
430
361
if self.checker_callback_tag:
442
373
if error.errno != errno.ESRCH: # No such process
443
374
raise
444
375
self.checker = None
445
self.PropertyChanged(dbus.String(u"checker_running"),
446
dbus.Boolean(False, variant_level=1))
447
448
376
def still_valid(self):
449
377
"""Has the timeout not yet passed for this client?"""
450
if not getattr(self, "enabled", False):
451
return False
452
now = datetime.datetime.utcnow()
378
now = datetime.datetime.now()
453
379
if self.last_checked_ok is None:
454
380
return now < (self.created + self.timeout)
455
381
else:
456
382
return now < (self.last_checked_ok + self.timeout)
457
458
## D-Bus methods & signals
459
_interface = u"org.mandos_system.Mandos.Client"
460
461
# BumpTimeout - method
462
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
463
BumpTimeout.__name__ = "BumpTimeout"
464
465
# CheckerCompleted - signal
466
@dbus.service.signal(_interface, signature="bqs")
467
def CheckerCompleted(self, success, condition, command):
468
"D-Bus signal"
469
pass
470
471
# CheckerStarted - signal
472
@dbus.service.signal(_interface, signature="s")
473
def CheckerStarted(self, command):
474
"D-Bus signal"
475
pass
476
477
# GetAllProperties - method
478
@dbus.service.method(_interface, out_signature="a{sv}")
479
def GetAllProperties(self):
480
"D-Bus method"
481
return dbus.Dictionary({
482
dbus.String("name"):
483
dbus.String(self.name, variant_level=1),
484
dbus.String("fingerprint"):
485
dbus.String(self.fingerprint, variant_level=1),
486
dbus.String("host"):
487
dbus.String(self.host, variant_level=1),
488
dbus.String("created"):
489
_datetime_to_dbus(self.created, variant_level=1),
490
dbus.String("last_enabled"):
491
(_datetime_to_dbus(self.last_enabled,
492
variant_level=1)
493
if self.last_enabled is not None
494
else dbus.Boolean(False, variant_level=1)),
495
dbus.String("enabled"):
496
dbus.Boolean(self.enabled, variant_level=1),
497
dbus.String("last_checked_ok"):
498
(_datetime_to_dbus(self.last_checked_ok,
499
variant_level=1)
500
if self.last_checked_ok is not None
501
else dbus.Boolean (False, variant_level=1)),
502
dbus.String("timeout"):
503
dbus.UInt64(self._timeout_milliseconds,
504
variant_level=1),
505
dbus.String("interval"):
506
dbus.UInt64(self._interval_milliseconds,
507
variant_level=1),
508
dbus.String("checker"):
509
dbus.String(self.checker_command,
510
variant_level=1),
511
dbus.String("checker_running"):
512
dbus.Boolean(self.checker is not None,
513
variant_level=1),
514
}, signature="sv")
515
516
# IsStillValid - method
517
IsStillValid = (dbus.service.method(_interface, out_signature="b")
518
(still_valid))
519
IsStillValid.__name__ = "IsStillValid"
520
521
# PropertyChanged - signal
522
@dbus.service.signal(_interface, signature="sv")
523
def PropertyChanged(self, property, value):
524
"D-Bus signal"
525
pass
526
527
# SetChecker - method
528
@dbus.service.method(_interface, in_signature="s")
529
def SetChecker(self, checker):
530
"D-Bus setter method"
531
self.checker_command = checker
532
533
# SetHost - method
534
@dbus.service.method(_interface, in_signature="s")
535
def SetHost(self, host):
536
"D-Bus setter method"
537
self.host = host
538
539
# SetInterval - method
540
@dbus.service.method(_interface, in_signature="t")
541
def SetInterval(self, milliseconds):
542
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
543
544
# SetSecret - method
545
@dbus.service.method(_interface, in_signature="ay",
546
byte_arrays=True)
547
def SetSecret(self, secret):
548
"D-Bus setter method"
549
self.secret = str(secret)
550
551
# SetTimeout - method
552
@dbus.service.method(_interface, in_signature="t")
553
def SetTimeout(self, milliseconds):
554
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
555
556
# Enable - method
557
Enable = dbus.service.method(_interface)(enable)
558
Enable.__name__ = "Enable"
559
560
# StartChecker - method
561
@dbus.service.method(_interface)
562
def StartChecker(self):
563
"D-Bus method"
564
self.start_checker()
565
566
# Disable - method
567
@dbus.service.method(_interface)
568
def Disable(self):
569
"D-Bus method"
570
self.disable()
571
572
# StopChecker - method
573
StopChecker = dbus.service.method(_interface)(stop_checker)
574
StopChecker.__name__ = "StopChecker"
575
576
del _interface
577
383
578
384
579
385
def peer_certificate(session):
580
386
"Return the peer's OpenPGP certificate as a bytestring"
581
387
# If not an OpenPGP certificate...
582
if (gnutls.library.functions
583
.gnutls_certificate_type_get(session._c_object)
584
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
388
if gnutls.library.functions.gnutls_certificate_type_get\
389
(session._c_object) \
390
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
585
391
# ...do the normal thing
586
392
return session.peer_certificate
587
393
list_size = ctypes.c_uint()
588
cert_list = (gnutls.library.functions
589
.gnutls_certificate_get_peers
590
(session._c_object, ctypes.byref(list_size)))
394
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
(session._c_object, ctypes.byref(list_size))
591
396
if list_size.value == 0:
592
397
return None
593
398
cert = cert_list[0]
597
402
def fingerprint(openpgp):
598
403
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
599
404
# New GnuTLS "datum" with the OpenPGP public key
600
datum = (gnutls.library.types
601
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
602
ctypes.POINTER
603
(ctypes.c_ubyte)),
604
ctypes.c_uint(len(openpgp))))
405
datum = gnutls.library.types.gnutls_datum_t\
406
(ctypes.cast(ctypes.c_char_p(openpgp),
407
ctypes.POINTER(ctypes.c_ubyte)),
408
ctypes.c_uint(len(openpgp)))
605
409
# New empty GnuTLS certificate
606
410
crt = gnutls.library.types.gnutls_openpgp_crt_t()
607
(gnutls.library.functions
608
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
411
gnutls.library.functions.gnutls_openpgp_crt_init\
412
(ctypes.byref(crt))
609
413
# Import the OpenPGP public key into the certificate
610
(gnutls.library.functions
611
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
612
gnutls.library.constants
613
.GNUTLS_OPENPGP_FMT_RAW))
414
gnutls.library.functions.gnutls_openpgp_crt_import\
415
(crt, ctypes.byref(datum),
416
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
614
417
# Verify the self signature in the key
615
crtverify = ctypes.c_uint()
616
(gnutls.library.functions
617
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
418
crtverify = ctypes.c_uint();
419
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
(crt, 0, ctypes.byref(crtverify))
618
421
if crtverify.value != 0:
619
422
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
620
423
raise gnutls.errors.CertificateSecurityError("Verify failed")
621
424
# New buffer for the fingerprint
622
buf = ctypes.create_string_buffer(20)
623
buf_len = ctypes.c_size_t()
425
buffer = ctypes.create_string_buffer(20)
426
buffer_length = ctypes.c_size_t()
624
427
# Get the fingerprint from the certificate into the buffer
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
627
ctypes.byref(buf_len)))
428
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
628
430
# Deinit the certificate
629
431
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
630
432
# Convert the buffer to a Python bytestring
631
fpr = ctypes.string_at(buf, buf_len.value)
433
fpr = ctypes.string_at(buffer, buffer_length.value)
632
434
# Convert the bytestring to hexadecimal notation
633
435
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
634
436
return hex_fpr
635
437
636
438
637
class TCP_handler(SocketServer.BaseRequestHandler, object):
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
638
440
"""A TCP request handler class.
639
441
Instantiated by IPv6_TCPServer for each request to handle it.
640
442
Note: This will run in its own forked process."""
641
443
642
444
def handle(self):
643
445
logger.info(u"TCP connection from: %s",
644
unicode(self.client_address))
645
session = (gnutls.connection
646
.ClientSession(self.request,
647
gnutls.connection
648
.X509Credentials()))
446
unicode(self.client_address))
447
session = gnutls.connection.ClientSession\
448
(self.request, gnutls.connection.X509Credentials())
649
449
650
450
line = self.request.makefile().readline()
651
451
logger.debug(u"Protocol version: %r", line)
664
464
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
665
465
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
666
466
# "+DHE-DSS"))
667
# Use a fallback default, since this MUST be set.
668
priority = self.server.settings.get("priority", "NORMAL")
669
(gnutls.library.functions
670
.gnutls_priority_set_direct(session._c_object,
671
priority, None))
467
priority = "NORMAL" # Fallback default, since this
468
# MUST be set.
469
if self.server.settings["priority"]:
470
priority = self.server.settings["priority"]
471
gnutls.library.functions.gnutls_priority_set_direct\
472
(session._c_object, priority, None);
672
473
673
474
try:
674
475
session.handshake()
684
485
session.bye()
685
486
return
686
487
logger.debug(u"Fingerprint: %s", fpr)
488
client = None
687
489
for c in self.server.clients:
688
490
if c.fingerprint == fpr:
689
491
client = c
690
492
break
691
else:
493
if not client:
692
494
logger.warning(u"Client not found for fingerprint: %s",
693
495
fpr)
694
496
session.bye()
701
503
vars(client))
702
504
session.bye()
703
505
return
704
## This won't work here, since we're in a fork.
705
# client.bump_timeout()
706
506
sent_size = 0
707
507
while sent_size < len(client.secret):
708
508
sent = session.send(client.secret[sent_size:])
713
513
session.bye()
714
514
715
515
716
class IPv6_TCPServer(SocketServer.ForkingMixIn,
717
SocketServer.TCPServer, object):
516
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
718
517
"""IPv6 TCP server. Accepts 'None' as address and/or port.
719
518
Attributes:
720
519
settings: Server settings
730
529
self.clients = kwargs["clients"]
731
530
del kwargs["clients"]
732
531
self.enabled = False
733
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
532
return super(type(self), self).__init__(*args, **kwargs)
734
533
def server_bind(self):
735
534
"""This overrides the normal server_bind() function
736
535
to bind to an interface if one was specified, and also NOT to
765
564
# if_nametoindex
766
565
# (self.settings
767
566
# ["interface"]))
768
return super(IPv6_TCPServer, self).server_bind()
567
return super(type(self), self).server_bind()
769
568
def server_activate(self):
770
569
if self.enabled:
771
return super(IPv6_TCPServer, self).server_activate()
570
return super(type(self), self).server_activate()
772
571
def enable(self):
773
572
self.enabled = True
774
573
792
591
timevalue = datetime.timedelta(0)
793
592
for s in interval.split():
794
593
try:
795
suffix = unicode(s[-1])
796
value = int(s[:-1])
594
suffix=unicode(s[-1])
595
value=int(s[:-1])
797
596
if suffix == u"d":
798
597
delta = datetime.timedelta(value)
799
598
elif suffix == u"s":
839
638
"""Call the C function if_nametoindex(), or equivalent"""
840
639
global if_nametoindex
841
640
try:
842
if_nametoindex = (ctypes.cdll.LoadLibrary
843
(ctypes.util.find_library("c"))
844
.if_nametoindex)
641
if "ctypes.util" not in sys.modules:
642
import ctypes.util
643
if_nametoindex = ctypes.cdll.LoadLibrary\
644
(ctypes.util.find_library("c")).if_nametoindex
845
645
except (OSError, AttributeError):
846
646
if "struct" not in sys.modules:
847
647
import struct
850
650
def if_nametoindex(interface):
851
651
"Get an interface index the hard way, i.e. using fcntl()"
852
652
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
853
with closing(socket.socket()) as s:
854
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
855
struct.pack("16s16x", interface))
653
s = socket.socket()
654
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
655
struct.pack("16s16x", interface))
656
s.close()
856
657
interface_index = struct.unpack("I", ifreq[16:20])[0]
857
658
return interface_index
858
659
return if_nametoindex(interface)
882
683
883
684
884
685
def main():
686
global main_loop_started
687
main_loop_started = False
688
885
689
parser = OptionParser(version = "%%prog %s" % version)
886
690
parser.add_option("-i", "--interface", type="string",
887
691
metavar="IF", help="Bind to interface IF")
902
706
default="/etc/mandos", metavar="DIR",
903
707
help="Directory to search for configuration"
904
708
" files")
905
options = parser.parse_args()[0]
709
(options, args) = parser.parse_args()
906
710
907
711
if options.check:
908
712
import doctest
926
730
# Convert the SafeConfigParser object to a dict
927
731
server_settings = server_config.defaults()
928
732
# Use getboolean on the boolean config option
929
server_settings["debug"] = (server_config.getboolean
930
("DEFAULT", "debug"))
733
server_settings["debug"] = server_config.getboolean\
734
("DEFAULT", "debug")
931
735
del server_config
932
736
933
737
# Override the settings from the config file with command line
947
751
console.setLevel(logging.WARNING)
948
752
949
753
if server_settings["servicename"] != "Mandos":
950
syslogger.setFormatter(logging.Formatter
754
syslogger.setFormatter(logging.Formatter\
951
755
('Mandos (%s): %%(levelname)s:'
952
756
' %%(message)s'
953
757
% server_settings["servicename"]))
965
769
clients = Set()
966
770
tcp_server = IPv6_TCPServer((server_settings["address"],
967
771
server_settings["port"]),
968
TCP_handler,
772
tcp_handler,
969
773
settings=server_settings,
970
774
clients=clients)
971
775
pidfilename = "/var/run/mandos.pid"
974
778
except IOError, error:
975
779
logger.error("Could not open file %r", pidfilename)
976
780
977
try:
978
uid = pwd.getpwnam("_mandos").pw_uid
979
except KeyError:
980
try:
981
uid = pwd.getpwnam("mandos").pw_uid
982
except KeyError:
983
try:
984
uid = pwd.getpwnam("nobody").pw_uid
985
except KeyError:
986
uid = 65534
987
try:
988
gid = pwd.getpwnam("_mandos").pw_gid
989
except KeyError:
990
try:
991
gid = pwd.getpwnam("mandos").pw_gid
992
except KeyError:
993
try:
994
gid = pwd.getpwnam("nogroup").pw_gid
995
except KeyError:
996
gid = 65534
781
uid = 65534
782
gid = 65534
783
try:
784
uid = pwd.getpwnam("mandos").pw_uid
785
except KeyError:
786
try:
787
uid = pwd.getpwnam("nobody").pw_uid
788
except KeyError:
789
pass
790
try:
791
gid = pwd.getpwnam("mandos").pw_gid
792
except KeyError:
793
try:
794
gid = pwd.getpwnam("nogroup").pw_gid
795
except KeyError:
796
pass
997
797
try:
998
798
os.setuid(uid)
999
799
os.setgid(gid)
1003
803
1004
804
global service
1005
805
service = AvahiService(name = server_settings["servicename"],
1006
servicetype = "_mandos._tcp", )
806
type = "_mandos._tcp", );
1007
807
if server_settings["interface"]:
1008
service.interface = (if_nametoindex
1009
(server_settings["interface"]))
808
service.interface = if_nametoindex\
809
(server_settings["interface"])
1010
810
1011
811
global main_loop
1012
812
global bus
1019
819
avahi.DBUS_PATH_SERVER),
1020
820
avahi.DBUS_INTERFACE_SERVER)
1021
821
# End of Avahi example code
1022
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
822
823
def remove_from_clients(client):
824
clients.remove(client)
825
if not clients:
826
logger.critical(u"No clients left, exiting")
827
sys.exit()
1023
828
1024
829
clients.update(Set(Client(name = section,
830
stop_hook = remove_from_clients,
1025
831
config
1026
832
= dict(client_config.items(section)))
1027
833
for section in client_config.sections()))
1046
852
pidfile.write(str(pid) + "\n")
1047
853
pidfile.close()
1048
854
del pidfile
1049
except IOError:
855
except IOError, err:
1050
856
logger.error(u"Could not write to file %r with PID %d",
1051
857
pidfilename, pid)
1052
858
except NameError:
1065
871
1066
872
while clients:
1067
873
client = clients.pop()
1068
client.disable_hook = None
1069
client.disable()
874
client.stop_hook = None
875
client.stop()
1070
876
1071
877
atexit.register(cleanup)
1072
878
1075
881
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1076
882
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1077
883
1078
class MandosServer(dbus.service.Object):
1079
"""A D-Bus proxy object"""
1080
def __init__(self):
1081
dbus.service.Object.__init__(self, bus,
1082
"/Mandos")
1083
_interface = u"org.mandos_system.Mandos"
1084
1085
@dbus.service.signal(_interface, signature="oa{sv}")
1086
def ClientAdded(self, objpath, properties):
1087
"D-Bus signal"
1088
pass
1089
1090
@dbus.service.signal(_interface, signature="o")
1091
def ClientRemoved(self, objpath):
1092
"D-Bus signal"
1093
pass
1094
1095
@dbus.service.method(_interface, out_signature="ao")
1096
def GetAllClients(self):
1097
return dbus.Array(c.dbus_object_path for c in clients)
1098
1099
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1100
def GetAllClientsWithProperties(self):
1101
return dbus.Dictionary(
1102
((c.dbus_object_path, c.GetAllProperties())
1103
for c in clients),
1104
signature="oa{sv}")
1105
1106
@dbus.service.method(_interface, in_signature="o")
1107
def RemoveClient(self, object_path):
1108
for c in clients:
1109
if c.dbus_object_path == object_path:
1110
c.disable()
1111
clients.remove(c)
1112
return
1113
raise KeyError
1114
1115
del _interface
1116
1117
mandos_server = MandosServer()
1118
1119
884
for client in clients:
1120
# Emit D-Bus signal
1121
mandos_server.ClientAdded(client.dbus_object_path,
1122
client.GetAllProperties())
1123
client.enable()
885
client.start()
1124
886
1125
887
tcp_server.enable()
1126
888
tcp_server.server_activate()
1144
906
1145
907
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1146
908
lambda *args, **kwargs:
1147
(tcp_server.handle_request
1148
(*args[2:], **kwargs) or True))
909
tcp_server.handle_request\
910
(*args[2:], **kwargs) or True)
1149
911
1150
912
logger.debug(u"Starting main loop")
913
main_loop_started = True
1151
914
main_loop.run()
1152
915
except AvahiError, error:
1153
916
logger.critical(u"AvahiError: %s" + unicode(error))
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0