/mandos/trunk : revision 202

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

14

16

15

#

17

16

# This program is free software: you can redistribute it and/or modify

18

17

# it under the terms of the GNU General Public License as published by

31

30

# Contact the authors at <mandos@fukt.bsnet.se>.

32

31

#

33

32

34

from __future__ import division, with_statement, absolute_import

33

from __future__ import division

35

34

36

35

import SocketServer

37

36

import socket

37

import select

38

from optparse import OptionParser

39

import datetime

40

import errno

56

import logging

57

import logging.handlers

58

import pwd

59

from contextlib import closing

60

59

61

60

import dbus

62

import dbus.service

63

61

import gobject

64

62

import avahi

65

63

from dbus.mainloop.glib import DBusGMainLoop

66

64

import ctypes

67

import ctypes.util

68

65

69

version = "1.0.2"

66

version = "1.0"

70

67

71

68

logger = logging.Logger('mandos')

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos: %(levelname)s: %(message)s'))

69

syslogger = logging.handlers.SysLogHandler\

70

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

71

address = "/dev/log")

72

syslogger.setFormatter(logging.Formatter\

73

('Mandos: %(levelname)s: %(message)s'))

77

74

logger.addHandler(syslogger)

78

75

79

76

console = logging.StreamHandler()

84

81

class AvahiError(Exception):

85

82

def __init__(self, value):

86

83

self.value = value

87

super(AvahiError, self).__init__()

88

84

def __str__(self):

89

85

return repr(self.value)

90

86

112

108

a sensible number of times

113

109

"""

114

110

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

115

servicetype = None, port = None, TXT = None,

116

domain = "", host = "", max_renames = 32768):

111

type = None, port = None, TXT = None, domain = "",

112

host = "", max_renames = 32768):

117

113

self.interface = interface

118

114

self.name = name

119

self.type = servicetype

115

self.type = type

120

116

self.port = port

121

self.TXT = TXT if TXT is not None else []

117

if TXT is None:

118

self.TXT = []

119

else:

120

self.TXT = TXT

122

121

self.domain = domain

123

122

self.host = host

124

123

self.rename_count = 0

128

127

if self.rename_count >= self.max_renames:

129

128

logger.critical(u"No suitable Zeroconf service name found"

130

129

u" after %i retries, exiting.",

131

self.rename_count)

130

rename_count)

132

131

raise AvahiServiceError("Too many renames")

133

132

self.name = server.GetAlternativeServiceName(self.name)

134

133

logger.info(u"Changing Zeroconf service name to %r ...",

135

134

str(self.name))

136

syslogger.setFormatter(logging.Formatter

135

syslogger.setFormatter(logging.Formatter\

137

136

('Mandos (%s): %%(levelname)s:'

138

' %%(message)s' % self.name))

137

' %%(message)s' % self.name))

139

138

self.remove()

140

139

self.add()

141

140

self.rename_count += 1

147

146

"""Derived from the Avahi example code"""

148

147

global group

149

148

if group is None:

150

group = dbus.Interface(bus.get_object

151

(avahi.DBUS_NAME,

149

group = dbus.Interface\

150

(bus.get_object(avahi.DBUS_NAME,

152

151

server.EntryGroupNew()),

153

avahi.DBUS_INTERFACE_ENTRY_GROUP)

152

avahi.DBUS_INTERFACE_ENTRY_GROUP)

154

153

group.connect_to_signal('StateChanged',

155

154

entry_group_state_changed)

156

155

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

170

169

# End of Avahi example code

171

170

172

171

173

def _datetime_to_dbus(dt, variant_level=0):

174

"""Convert a UTC datetime.datetime() to a D-Bus type."""

175

return dbus.String(dt.isoformat(), variant_level=variant_level)

176

177

178

class Client(dbus.service.Object):

172

class Client(object):

179

173

"""A representation of a client host served by this server.

180

174

Attributes:

181

name: string; from the config file, used in log messages

175

name: string; from the config file, used in log messages

182

176

fingerprint: string (40 or 32 hexadecimal digits); used to

183

177

uniquely identify the client

184

secret: bytestring; sent verbatim (over TLS) to client

185

host: string; available for use by the checker command

186

created: datetime.datetime(); (UTC) object creation

187

last_enabled: datetime.datetime(); (UTC)

188

enabled: bool()

189

last_checked_ok: datetime.datetime(); (UTC) or None

190

timeout: datetime.timedelta(); How long from last_checked_ok

191

until this client is invalid

192

interval: datetime.timedelta(); How often to start a new checker

193

disable_hook: If set, called by disable() as disable_hook(self)

194

checker: subprocess.Popen(); a running checker process used

195

to see if the client lives.

196

'None' if no process is running.

178

secret: bytestring; sent verbatim (over TLS) to client

179

host: string; available for use by the checker command

180

created: datetime.datetime(); object creation, not client host

181

last_checked_ok: datetime.datetime() or None if not yet checked OK

182

timeout: datetime.timedelta(); How long from last_checked_ok

183

until this client is invalid

184

interval: datetime.timedelta(); How often to start a new checker

185

stop_hook: If set, called by stop() as stop_hook(self)

186

checker: subprocess.Popen(); a running checker process used

187

to see if the client lives.

188

'None' if no process is running.

197

189

checker_initiator_tag: a gobject event source tag, or None

198

disable_initiator_tag: - '' -

190

stop_initiator_tag: - '' -

199

191

checker_callback_tag: - '' -

200

192

checker_command: string; External command which is run to check if

201

193

client lives. %() expansions are done at

202

194

runtime with vars(self) as dict, so that for

203

195

instance %(name)s can be used in the command.

204

dbus_object_path: dbus.ObjectPath

205

196

Private attibutes:

206

197

_timeout: Real variable for 'timeout'

207

198

_interval: Real variable for 'interval'

209

200

_interval_milliseconds: - '' -

210

201

"""

211

202

def _set_timeout(self, timeout):

212

"Setter function for the 'timeout' attribute"

203

"Setter function for 'timeout' attribute"

213

204

self._timeout = timeout

214

205

self._timeout_milliseconds = ((self.timeout.days

215

206

* 24 * 60 * 60 * 1000)

216

207

+ (self.timeout.seconds * 1000)

217

208

+ (self.timeout.microseconds

218

209

// 1000))

219

# Emit D-Bus signal

220

self.PropertyChanged(dbus.String(u"timeout"),

221

(dbus.UInt64(self._timeout_milliseconds,

222

variant_level=1)))

223

timeout = property(lambda self: self._timeout, _set_timeout)

210

timeout = property(lambda self: self._timeout,

211

_set_timeout)

224

212

del _set_timeout

225

226

213

def _set_interval(self, interval):

227

"Setter function for the 'interval' attribute"

214

"Setter function for 'interval' attribute"

228

215

self._interval = interval

229

216

self._interval_milliseconds = ((self.interval.days

230

217

* 24 * 60 * 60 * 1000)

232

219

* 1000)

233

220

+ (self.interval.microseconds

234

221

// 1000))

235

# Emit D-Bus signal

236

self.PropertyChanged(dbus.String(u"interval"),

237

(dbus.UInt64(self._interval_milliseconds,

238

variant_level=1)))

239

interval = property(lambda self: self._interval, _set_interval)

222

interval = property(lambda self: self._interval,

223

_set_interval)

240

224

del _set_interval

241

242

def __init__(self, name = None, disable_hook=None, config=None):

225

def __init__(self, name = None, stop_hook=None, config={}):

243

226

"""Note: the 'checker' key in 'config' sets the

244

227

'checker_command' attribute and *not* the 'checker'

245

228

attribute."""

246

self.dbus_object_path = (dbus.ObjectPath

247

("/Mandos/clients/"

248

+ name.replace(".", "_")))

249

dbus.service.Object.__init__(self, bus,

250

self.dbus_object_path)

251

if config is None:

252

config = {}

253

229

self.name = name

254

230

logger.debug(u"Creating client %r", self.name)

255

231

# Uppercase and remove spaces from fingerprint for later

256

232

# comparison purposes with return value from the fingerprint()

257

233

# function

258

self.fingerprint = (config["fingerprint"].upper()

259

.replace(u" ", u""))

234

self.fingerprint = config["fingerprint"].upper()\

235

.replace(u" ", u"")

260

236

logger.debug(u" Fingerprint: %s", self.fingerprint)

261

237

if "secret" in config:

262

238

self.secret = config["secret"].decode(u"base64")

263

239

elif "secfile" in config:

264

with closing(open(os.path.expanduser

265

(os.path.expandvars

266

(config["secfile"])))) as secfile:

267

self.secret = secfile.read()

240

sf = open(config["secfile"])

241

self.secret = sf.read()

242

sf.close()

268

243

else:

269

244

raise TypeError(u"No secret or secfile for client %s"

270

245

% self.name)

271

246

self.host = config.get("host", "")

272

self.created = datetime.datetime.utcnow()

273

self.enabled = False

274

self.last_enabled = None

247

self.created = datetime.datetime.now()

275

248

self.last_checked_ok = None

276

249

self.timeout = string_to_delta(config["timeout"])

277

250

self.interval = string_to_delta(config["interval"])

278

self.disable_hook = disable_hook

251

self.stop_hook = stop_hook

279

252

self.checker = None

280

253

self.checker_initiator_tag = None

281

self.disable_initiator_tag = None

254

self.stop_initiator_tag = None

282

255

self.checker_callback_tag = None

283

self.checker_command = config["checker"]

284

285

def enable(self):

256

self.check_command = config["checker"]

257

def start(self):

286

258

"""Start this client's checker and timeout hooks"""

287

self.last_enabled = datetime.datetime.utcnow()

288

259

# Schedule a new checker to be started an 'interval' from now,

289

260

# and every interval from then on.

290

self.checker_initiator_tag = (gobject.timeout_add

291

(self._interval_milliseconds,

292

self.start_checker))

261

self.checker_initiator_tag = gobject.timeout_add\

262

(self._interval_milliseconds,

263

self.start_checker)

293

264

# Also start a new checker *right now*.

294

265

self.start_checker()

295

# Schedule a disable() when 'timeout' has passed

296

self.disable_initiator_tag = (gobject.timeout_add

297

(self._timeout_milliseconds,

298

self.disable))

299

self.enabled = True

300

# Emit D-Bus signal

301

self.PropertyChanged(dbus.String(u"enabled"),

302

dbus.Boolean(True, variant_level=1))

303

self.PropertyChanged(dbus.String(u"last_enabled"),

304

(_datetime_to_dbus(self.last_enabled,

305

variant_level=1)))

306

307

def disable(self):

308

"""Disable this client."""

309

if not getattr(self, "enabled", False):

266

# Schedule a stop() when 'timeout' has passed

267

self.stop_initiator_tag = gobject.timeout_add\

268

(self._timeout_milliseconds,

269

self.stop)

270

def stop(self):

271

"""Stop this client.

272

The possibility that a client might be restarted is left open,

273

but not currently used."""

274

# If this client doesn't have a secret, it is already stopped.

275

if hasattr(self, "secret") and self.secret:

276

logger.info(u"Stopping client %s", self.name)

277

self.secret = None

278

else:

310

279

return False

311

logger.info(u"Disabling client %s", self.name)

312

if getattr(self, "disable_initiator_tag", False):

313

gobject.source_remove(self.disable_initiator_tag)

314

self.disable_initiator_tag = None

280

if getattr(self, "stop_initiator_tag", False):

281

gobject.source_remove(self.stop_initiator_tag)

282

self.stop_initiator_tag = None

315

283

if getattr(self, "checker_initiator_tag", False):

316

284

gobject.source_remove(self.checker_initiator_tag)

317

285

self.checker_initiator_tag = None

318

286

self.stop_checker()

319

if self.disable_hook:

320

self.disable_hook(self)

321

self.enabled = False

322

# Emit D-Bus signal

323

self.PropertyChanged(dbus.String(u"enabled"),

324

dbus.Boolean(False, variant_level=1))

287

if self.stop_hook:

288

self.stop_hook(self)

325

289

# Do not run this again if called by a gobject.timeout_add

326

290

return False

327

328

291

def __del__(self):

329

self.disable_hook = None

330

self.disable()

331

332

def checker_callback(self, pid, condition, command):

292

self.stop_hook = None

293

self.stop()

294

def checker_callback(self, pid, condition):

333

295

"""The checker has completed, so take appropriate actions."""

296

now = datetime.datetime.now()

334

297

self.checker_callback_tag = None

335

298

self.checker = None

336

# Emit D-Bus signal

337

self.PropertyChanged(dbus.String(u"checker_running"),

338

dbus.Boolean(False, variant_level=1))

339

if (os.WIFEXITED(condition)

340

and (os.WEXITSTATUS(condition) == 0)):

299

if os.WIFEXITED(condition) \

300

and (os.WEXITSTATUS(condition) == 0):

341

301

logger.info(u"Checker for %(name)s succeeded",

342

302

vars(self))

343

# Emit D-Bus signal

344

self.CheckerCompleted(dbus.Boolean(True),

345

dbus.UInt16(condition),

346

dbus.String(command))

347

self.bump_timeout()

303

self.last_checked_ok = now

304

gobject.source_remove(self.stop_initiator_tag)

305

self.stop_initiator_tag = gobject.timeout_add\

306

(self._timeout_milliseconds,

307

self.stop)

348

308

elif not os.WIFEXITED(condition):

349

309

logger.warning(u"Checker for %(name)s crashed?",

350

310

vars(self))

351

# Emit D-Bus signal

352

self.CheckerCompleted(dbus.Boolean(False),

353

dbus.UInt16(condition),

354

dbus.String(command))

355

311

else:

356

312

logger.info(u"Checker for %(name)s failed",

357

313

vars(self))

358

# Emit D-Bus signal

359

self.CheckerCompleted(dbus.Boolean(False),

360

dbus.UInt16(condition),

361

dbus.String(command))

362

363

def bump_timeout(self):

364

"""Bump up the timeout for this client.

365

This should only be called when the client has been seen,

366

alive and well.

367

"""

368

self.last_checked_ok = datetime.datetime.utcnow()

369

gobject.source_remove(self.disable_initiator_tag)

370

self.disable_initiator_tag = (gobject.timeout_add

371

(self._timeout_milliseconds,

372

self.disable))

373

self.PropertyChanged(dbus.String(u"last_checked_ok"),

374

(_datetime_to_dbus(self.last_checked_ok,

375

variant_level=1)))

376

377

314

def start_checker(self):

378

315

"""Start a new checker subprocess if one is not running.

379

316

If a checker already exists, leave it running and do

388

325

# is as it should be.

389

326

if self.checker is None:

390

327

try:

391

# In case checker_command has exactly one % operator

392

command = self.checker_command % self.host

328

# In case check_command has exactly one % operator

329

command = self.check_command % self.host

393

330

except TypeError:

394

331

# Escape attributes for the shell

395

332

escaped_attrs = dict((key, re.escape(str(val)))

396

333

for key, val in

397

334

vars(self).iteritems())

398

335

try:

399

command = self.checker_command % escaped_attrs

336

command = self.check_command % escaped_attrs

400

337

except TypeError, error:

401

338

logger.error(u'Could not format string "%s":'

402

u' %s', self.checker_command, error)

339

u' %s', self.check_command, error)

403

340

return True # Try again later

404

341

try:

405

342

logger.info(u"Starting checker %r for %s",

411

348

self.checker = subprocess.Popen(command,

412

349

close_fds=True,

413

350

shell=True, cwd="/")

414

# Emit D-Bus signal

415

self.CheckerStarted(command)

416

self.PropertyChanged(dbus.String("checker_running"),

417

dbus.Boolean(True, variant_level=1))

418

self.checker_callback_tag = (gobject.child_watch_add

419

(self.checker.pid,

420

self.checker_callback,

421

data=command))

351

self.checker_callback_tag = gobject.child_watch_add\

352

(self.checker.pid,

353

self.checker_callback)

422

354

except OSError, error:

423

355

logger.error(u"Failed to start subprocess: %s",

424

356

error)

425

357

# Re-run this periodically if run by gobject.timeout_add

426

358

return True

427

428

359

def stop_checker(self):

429

360

"""Force the checker process, if any, to stop."""

430

361

if self.checker_callback_tag:

442

373

if error.errno != errno.ESRCH: # No such process

443

374

raise

444

375

self.checker = None

445

self.PropertyChanged(dbus.String(u"checker_running"),

446

dbus.Boolean(False, variant_level=1))

447

448

376

def still_valid(self):

449

377

"""Has the timeout not yet passed for this client?"""

450

if not getattr(self, "enabled", False):

451

return False

452

now = datetime.datetime.utcnow()

378

now = datetime.datetime.now()

453

379

if self.last_checked_ok is None:

454

380

return now < (self.created + self.timeout)

455

381

else:

456

382

return now < (self.last_checked_ok + self.timeout)

457

458

## D-Bus methods & signals

459

_interface = u"org.mandos_system.Mandos.Client"

460

461

# BumpTimeout - method

462

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

463

BumpTimeout.__name__ = "BumpTimeout"

464

465

# CheckerCompleted - signal

466

@dbus.service.signal(_interface, signature="bqs")

467

def CheckerCompleted(self, success, condition, command):

468

"D-Bus signal"

469

pass

470

471

# CheckerStarted - signal

472

@dbus.service.signal(_interface, signature="s")

473

def CheckerStarted(self, command):

474

"D-Bus signal"

475

pass

476

477

# GetAllProperties - method

478

@dbus.service.method(_interface, out_signature="a{sv}")

479

def GetAllProperties(self):

480

"D-Bus method"

481

return dbus.Dictionary({

482

dbus.String("name"):

483

dbus.String(self.name, variant_level=1),

484

dbus.String("fingerprint"):

485

dbus.String(self.fingerprint, variant_level=1),

486

dbus.String("host"):

487

dbus.String(self.host, variant_level=1),

488

dbus.String("created"):

489

_datetime_to_dbus(self.created, variant_level=1),

490

dbus.String("last_enabled"):

491

(_datetime_to_dbus(self.last_enabled,

492

variant_level=1)

493

if self.last_enabled is not None

494

else dbus.Boolean(False, variant_level=1)),

495

dbus.String("enabled"):

496

dbus.Boolean(self.enabled, variant_level=1),

497

dbus.String("last_checked_ok"):

498

(_datetime_to_dbus(self.last_checked_ok,

499

variant_level=1)

500

if self.last_checked_ok is not None

501

else dbus.Boolean (False, variant_level=1)),

502

dbus.String("timeout"):

503

dbus.UInt64(self._timeout_milliseconds,

504

variant_level=1),

505

dbus.String("interval"):

506

dbus.UInt64(self._interval_milliseconds,

507

variant_level=1),

508

dbus.String("checker"):

509

dbus.String(self.checker_command,

510

variant_level=1),

511

dbus.String("checker_running"):

512

dbus.Boolean(self.checker is not None,

513

variant_level=1),

514

}, signature="sv")

515

516

# IsStillValid - method

517

IsStillValid = (dbus.service.method(_interface, out_signature="b")

518

(still_valid))

519

IsStillValid.__name__ = "IsStillValid"

520

521

# PropertyChanged - signal

522

@dbus.service.signal(_interface, signature="sv")

523

def PropertyChanged(self, property, value):

524

"D-Bus signal"

525

pass

526

527

# SetChecker - method

528

@dbus.service.method(_interface, in_signature="s")

529

def SetChecker(self, checker):

530

"D-Bus setter method"

531

self.checker_command = checker

532

533

# SetHost - method

534

@dbus.service.method(_interface, in_signature="s")

535

def SetHost(self, host):

536

"D-Bus setter method"

537

self.host = host

538

539

# SetInterval - method

540

@dbus.service.method(_interface, in_signature="t")

541

def SetInterval(self, milliseconds):

542

self.interval = datetime.timdeelta(0, 0, 0, milliseconds)

543

544

# SetSecret - method

545

@dbus.service.method(_interface, in_signature="ay",

546

byte_arrays=True)

547

def SetSecret(self, secret):

548

"D-Bus setter method"

549

self.secret = str(secret)

550

551

# SetTimeout - method

552

@dbus.service.method(_interface, in_signature="t")

553

def SetTimeout(self, milliseconds):

554

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

555

556

# Enable - method

557

Enable = dbus.service.method(_interface)(enable)

558

Enable.__name__ = "Enable"

559

560

# StartChecker - method

561

@dbus.service.method(_interface)

562

def StartChecker(self):

563

"D-Bus method"

564

self.start_checker()

565

566

# Disable - method

567

@dbus.service.method(_interface)

568

def Disable(self):

569

"D-Bus method"

570

self.disable()

571

572

# StopChecker - method

573

StopChecker = dbus.service.method(_interface)(stop_checker)

574

StopChecker.__name__ = "StopChecker"

575

576

del _interface

577

383

578

384

579

385

def peer_certificate(session):

580

386

"Return the peer's OpenPGP certificate as a bytestring"

581

387

# If not an OpenPGP certificate...

582

if (gnutls.library.functions

583

.gnutls_certificate_type_get(session._c_object)

584

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

388

if gnutls.library.functions.gnutls_certificate_type_get\

389

(session._c_object) \

390

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

585

391

# ...do the normal thing

586

392

return session.peer_certificate

587

393

list_size = ctypes.c_uint()

588

cert_list = (gnutls.library.functions

589

.gnutls_certificate_get_peers

590

(session._c_object, ctypes.byref(list_size)))

394

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

395

(session._c_object, ctypes.byref(list_size))

591

396

if list_size.value == 0:

592

397

return None

593

398

cert = cert_list[0]

597

402

def fingerprint(openpgp):

598

403

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

599

404

# New GnuTLS "datum" with the OpenPGP public key

600

datum = (gnutls.library.types

601

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

602

ctypes.POINTER

603

(ctypes.c_ubyte)),

604

ctypes.c_uint(len(openpgp))))

405

datum = gnutls.library.types.gnutls_datum_t\

406

(ctypes.cast(ctypes.c_char_p(openpgp),

407

ctypes.POINTER(ctypes.c_ubyte)),

408

ctypes.c_uint(len(openpgp)))

605

409

# New empty GnuTLS certificate

606

410

crt = gnutls.library.types.gnutls_openpgp_crt_t()

607

(gnutls.library.functions

608

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

411

gnutls.library.functions.gnutls_openpgp_crt_init\

412

(ctypes.byref(crt))

609

413

# Import the OpenPGP public key into the certificate

610

(gnutls.library.functions

611

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

612

gnutls.library.constants

613

.GNUTLS_OPENPGP_FMT_RAW))

414

gnutls.library.functions.gnutls_openpgp_crt_import\

415

(crt, ctypes.byref(datum),

416

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

614

417

# Verify the self signature in the key

615

crtverify = ctypes.c_uint()

616

(gnutls.library.functions

617

.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))

418

crtverify = ctypes.c_uint();

419

gnutls.library.functions.gnutls_openpgp_crt_verify_self\

420

(crt, 0, ctypes.byref(crtverify))

618

421

if crtverify.value != 0:

619

422

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

620

423

raise gnutls.errors.CertificateSecurityError("Verify failed")

621

424

# New buffer for the fingerprint

622

buf = ctypes.create_string_buffer(20)

623

buf_len = ctypes.c_size_t()

425

buffer = ctypes.create_string_buffer(20)

426

buffer_length = ctypes.c_size_t()

624

427

# Get the fingerprint from the certificate into the buffer

625

(gnutls.library.functions

626

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

627

ctypes.byref(buf_len)))

428

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

429

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

628

430

# Deinit the certificate

629

431

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

630

432

# Convert the buffer to a Python bytestring

631

fpr = ctypes.string_at(buf, buf_len.value)

433

fpr = ctypes.string_at(buffer, buffer_length.value)

632

434

# Convert the bytestring to hexadecimal notation

633

435

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

634

436

return hex_fpr

635

437

636

438

637

class TCP_handler(SocketServer.BaseRequestHandler, object):

439

class tcp_handler(SocketServer.BaseRequestHandler, object):

638

440

"""A TCP request handler class.

639

441

Instantiated by IPv6_TCPServer for each request to handle it.

640

442

Note: This will run in its own forked process."""

641

443

642

444

def handle(self):

643

445

logger.info(u"TCP connection from: %s",

644

unicode(self.client_address))

645

session = (gnutls.connection

646

.ClientSession(self.request,

647

gnutls.connection

648

.X509Credentials()))

446

unicode(self.client_address))

447

session = gnutls.connection.ClientSession\

448

(self.request, gnutls.connection.X509Credentials())

649

449

650

450

line = self.request.makefile().readline()

651

451

logger.debug(u"Protocol version: %r", line)

664

464

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

665

465

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

666

466

# "+DHE-DSS"))

667

# Use a fallback default, since this MUST be set.

668

priority = self.server.settings.get("priority", "NORMAL")

669

(gnutls.library.functions

670

.gnutls_priority_set_direct(session._c_object,

671

priority, None))

467

priority = "NORMAL" # Fallback default, since this

468

# MUST be set.

469

if self.server.settings["priority"]:

470

priority = self.server.settings["priority"]

471

gnutls.library.functions.gnutls_priority_set_direct\

472

(session._c_object, priority, None);

672

473

673

474

try:

674

475

session.handshake()

684

485

session.bye()

685

486

return

686

487

logger.debug(u"Fingerprint: %s", fpr)

488

client = None

687

489

for c in self.server.clients:

688

490

if c.fingerprint == fpr:

689

491

client = c

690

492

break

691

else:

493

if not client:

692

494

logger.warning(u"Client not found for fingerprint: %s",

693

495

fpr)

694

496

session.bye()

701

503

vars(client))

702

504

session.bye()

703

505

return

704

## This won't work here, since we're in a fork.

705

# client.bump_timeout()

706

506

sent_size = 0

707

507

while sent_size < len(client.secret):

708

508

sent = session.send(client.secret[sent_size:])

713

513

session.bye()

714

514

715

515

716

class IPv6_TCPServer(SocketServer.ForkingMixIn,

717

SocketServer.TCPServer, object):

516

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

718

517

"""IPv6 TCP server. Accepts 'None' as address and/or port.

719

518

Attributes:

720

519

settings: Server settings

730

529

self.clients = kwargs["clients"]

731

530

del kwargs["clients"]

732

531

self.enabled = False

733

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

532

return super(type(self), self).__init__(*args, **kwargs)

734

533

def server_bind(self):

735

534

"""This overrides the normal server_bind() function

736

535

to bind to an interface if one was specified, and also NOT to

765

564

# if_nametoindex

766

565

# (self.settings

767

566

# ["interface"]))

768

return super(IPv6_TCPServer, self).server_bind()

567

return super(type(self), self).server_bind()

769

568

def server_activate(self):

770

569

if self.enabled:

771

return super(IPv6_TCPServer, self).server_activate()

570

return super(type(self), self).server_activate()

772

571

def enable(self):

773

572

self.enabled = True

774

573

792

591

timevalue = datetime.timedelta(0)

793

592

for s in interval.split():

794

593

try:

795

suffix = unicode(s[-1])

796

value = int(s[:-1])

594

suffix=unicode(s[-1])

595

value=int(s[:-1])

797

596

if suffix == u"d":

798

597

delta = datetime.timedelta(value)

799

598

elif suffix == u"s":

839

638

"""Call the C function if_nametoindex(), or equivalent"""

840

639

global if_nametoindex

841

640

try:

842

if_nametoindex = (ctypes.cdll.LoadLibrary

843

(ctypes.util.find_library("c"))

844

.if_nametoindex)

641

if "ctypes.util" not in sys.modules:

642

import ctypes.util

643

if_nametoindex = ctypes.cdll.LoadLibrary\

644

(ctypes.util.find_library("c")).if_nametoindex

845

645

except (OSError, AttributeError):

846

646

if "struct" not in sys.modules:

847

647

import struct

850

650

def if_nametoindex(interface):

851

651

"Get an interface index the hard way, i.e. using fcntl()"

852

652

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

853

with closing(socket.socket()) as s:

854

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

855

struct.pack("16s16x", interface))

653

s = socket.socket()

654

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

655

struct.pack("16s16x", interface))

656

s.close()

856

657

interface_index = struct.unpack("I", ifreq[16:20])[0]

857

658

return interface_index

858

659

return if_nametoindex(interface)

882

683

883

684

884

685

def main():

686

global main_loop_started

687

main_loop_started = False

688

885

689

parser = OptionParser(version = "%%prog %s" % version)

886

690

parser.add_option("-i", "--interface", type="string",

887

691

metavar="IF", help="Bind to interface IF")

902

706

default="/etc/mandos", metavar="DIR",

903

707

help="Directory to search for configuration"

904

708

" files")

905

options = parser.parse_args()[0]

709

(options, args) = parser.parse_args()

906

710

907

711

if options.check:

908

712

import doctest

926

730

# Convert the SafeConfigParser object to a dict

927

731

server_settings = server_config.defaults()

928

732

# Use getboolean on the boolean config option

929

server_settings["debug"] = (server_config.getboolean

930

("DEFAULT", "debug"))

733

server_settings["debug"] = server_config.getboolean\

734

("DEFAULT", "debug")

931

735

del server_config

932

736

933

737

# Override the settings from the config file with command line

947

751

console.setLevel(logging.WARNING)

948

752

949

753

if server_settings["servicename"] != "Mandos":

950

syslogger.setFormatter(logging.Formatter

754

syslogger.setFormatter(logging.Formatter\

951

755

('Mandos (%s): %%(levelname)s:'

952

756

' %%(message)s'

953

757

% server_settings["servicename"]))

965

769

clients = Set()

966

770

tcp_server = IPv6_TCPServer((server_settings["address"],

967

771

server_settings["port"]),

968

TCP_handler,

772

tcp_handler,

969

773

settings=server_settings,

970

774

clients=clients)

971

775

pidfilename = "/var/run/mandos.pid"

974

778

except IOError, error:

975

779

logger.error("Could not open file %r", pidfilename)

976

780

977

try:

978

uid = pwd.getpwnam("_mandos").pw_uid

979

except KeyError:

980

try:

981

uid = pwd.getpwnam("mandos").pw_uid

982

except KeyError:

983

try:

984

uid = pwd.getpwnam("nobody").pw_uid

985

except KeyError:

986

uid = 65534

987

try:

988

gid = pwd.getpwnam("_mandos").pw_gid

989

except KeyError:

990

try:

991

gid = pwd.getpwnam("mandos").pw_gid

992

except KeyError:

993

try:

994

gid = pwd.getpwnam("nogroup").pw_gid

995

except KeyError:

996

gid = 65534

781

uid = 65534

782

gid = 65534

783

try:

784

uid = pwd.getpwnam("mandos").pw_uid

785

except KeyError:

786

try:

787

uid = pwd.getpwnam("nobody").pw_uid

788

except KeyError:

789

pass

790

try:

791

gid = pwd.getpwnam("mandos").pw_gid

792

except KeyError:

793

try:

794

gid = pwd.getpwnam("nogroup").pw_gid

795

except KeyError:

796

pass

997

797

try:

998

798

os.setuid(uid)

999

799

os.setgid(gid)

1003

803

1004

804

global service

1005

805

service = AvahiService(name = server_settings["servicename"],

1006

servicetype = "_mandos._tcp", )

806

type = "_mandos._tcp", );

1007

807

if server_settings["interface"]:

1008

service.interface = (if_nametoindex

1009

(server_settings["interface"]))

808

service.interface = if_nametoindex\

809

(server_settings["interface"])

1010

810

1011

811

global main_loop

1012

812

global bus

1019

819

avahi.DBUS_PATH_SERVER),

1020

820

avahi.DBUS_INTERFACE_SERVER)

1021

821

# End of Avahi example code

1022

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)

822

823

def remove_from_clients(client):

824

clients.remove(client)

825

if not clients:

826

logger.critical(u"No clients left, exiting")

827

sys.exit()

1023

828

1024

829

clients.update(Set(Client(name = section,

830

stop_hook = remove_from_clients,

1025

831

config

1026

832

= dict(client_config.items(section)))

1027

833

for section in client_config.sections()))

1046

852

pidfile.write(str(pid) + "\n")

1047

853

pidfile.close()

1048

854

del pidfile

1049

except IOError:

855

except IOError, err:

1050

856

logger.error(u"Could not write to file %r with PID %d",

1051

857

pidfilename, pid)

1052

858

except NameError:

1065

871

1066

872

while clients:

1067

873

client = clients.pop()

1068

client.disable_hook = None

1069

client.disable()

874

client.stop_hook = None

875

client.stop()

1070

876

1071

877

atexit.register(cleanup)

1072

878

1075

881

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1076

882

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1077

883

1078

class MandosServer(dbus.service.Object):

1079

"""A D-Bus proxy object"""

1080

def __init__(self):

1081

dbus.service.Object.__init__(self, bus,

1082

"/Mandos")

1083

_interface = u"org.mandos_system.Mandos"

1084

1085

@dbus.service.signal(_interface, signature="oa{sv}")

1086

def ClientAdded(self, objpath, properties):

1087

"D-Bus signal"

1088

pass

1089

1090

@dbus.service.signal(_interface, signature="o")

1091

def ClientRemoved(self, objpath):

1092

"D-Bus signal"

1093

pass

1094

1095

@dbus.service.method(_interface, out_signature="ao")

1096

def GetAllClients(self):

1097

return dbus.Array(c.dbus_object_path for c in clients)

1098

1099

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1100

def GetAllClientsWithProperties(self):

1101

return dbus.Dictionary(

1102

((c.dbus_object_path, c.GetAllProperties())

1103

for c in clients),

1104

signature="oa{sv}")

1105

1106

@dbus.service.method(_interface, in_signature="o")

1107

def RemoveClient(self, object_path):

1108

for c in clients:

1109

if c.dbus_object_path == object_path:

1110

c.disable()

1111

clients.remove(c)

1112

return

1113

raise KeyError

1114

1115

del _interface

1116

1117

mandos_server = MandosServer()

1118

1119

884

for client in clients:

1120

# Emit D-Bus signal

1121

mandos_server.ClientAdded(client.dbus_object_path,

1122

client.GetAllProperties())

1123

client.enable()

885

client.start()

1124

886

1125

887

tcp_server.enable()

1126

888

tcp_server.server_activate()

1144

906

1145

907

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

1146

908

lambda *args, **kwargs:

1147

(tcp_server.handle_request

1148

(*args[2:], **kwargs) or True))

909

tcp_server.handle_request\

910

(*args[2:], **kwargs) or True)

1149

911

1150

912

logger.debug(u"Starting main loop")

913

main_loop_started = True

1151

914

main_loop.run()

1152

915

except AvahiError, error:

1153

916

logger.critical(u"AvahiError: %s" + unicode(error))