To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 202
- compare with another revision
- download diff
- download tarball
- view history from revision 202
- Committer: Teddy Hogeborn
- Date: 2008-09-21 13:42:34 UTC
- Revision ID: teddy@fukt.bsnet.se-20080921134234-jo8p4rwtm50yb4xj
* clients.conf ([bar]/secfile): Do not imply armored format.
* debian/control: Build-Depend on pkg-config.
* debian/mandos.prerm (remove): Bug fix; check for
"/etc/init.d/mandos", not
"/etc/init.d/ssh".
* debian/control: Build-Depend on pkg-config.
* debian/mandos.prerm (remove): Bug fix; check for
"/etc/init.d/mandos", not
"/etc/init.d/ssh".
- files added:
- debian/mandos-client.config
- files removed:
- NEWS
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import division, with_statement, absolute_import
33
from __future__ import division
35
34
36
35
import SocketServer
37
36
import socket
38
import optparse
37
import select
38
from optparse import OptionParser
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
56
56
import logging
57
57
import logging.handlers
58
58
import pwd
59
from contextlib import closing
60
59
61
60
import dbus
62
import dbus.service
63
61
import gobject
64
62
import avahi
65
63
from dbus.mainloop.glib import DBusGMainLoop
66
64
import ctypes
67
import ctypes.util
68
65
69
version = "1.0.7"
66
version = "1.0"
70
67
71
68
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
78
74
logger.addHandler(syslogger)
79
75
80
76
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
' %(message)s'))
83
79
logger.addHandler(console)
84
80
85
81
class AvahiError(Exception):
86
def __init__(self, value, *args, **kwargs):
82
def __init__(self, value):
87
83
self.value = value
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
84
def __str__(self):
85
return repr(self.value)
91
86
92
87
class AvahiServiceError(AvahiError):
93
88
pass
113
108
a sensible number of times
114
109
"""
115
110
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768,
118
protocol = avahi.PROTO_UNSPEC):
111
type = None, port = None, TXT = None, domain = "",
112
host = "", max_renames = 32768):
119
113
self.interface = interface
120
114
self.name = name
121
self.type = servicetype
115
self.type = type
122
116
self.port = port
123
self.TXT = TXT if TXT is not None else []
117
if TXT is None:
118
self.TXT = []
119
else:
120
self.TXT = TXT
124
121
self.domain = domain
125
122
self.host = host
126
123
self.rename_count = 0
127
124
self.max_renames = max_renames
128
self.protocol = protocol
129
125
def rename(self):
130
126
"""Derived from the Avahi example code"""
131
127
if self.rename_count >= self.max_renames:
132
128
logger.critical(u"No suitable Zeroconf service name found"
133
129
u" after %i retries, exiting.",
134
self.rename_count)
135
raise AvahiServiceError(u"Too many renames")
130
rename_count)
131
raise AvahiServiceError("Too many renames")
136
132
self.name = server.GetAlternativeServiceName(self.name)
137
133
logger.info(u"Changing Zeroconf service name to %r ...",
138
134
str(self.name))
139
syslogger.setFormatter(logging.Formatter
135
syslogger.setFormatter(logging.Formatter\
140
136
('Mandos (%s): %%(levelname)s:'
141
' %%(message)s' % self.name))
137
' %%(message)s' % self.name))
142
138
self.remove()
143
139
self.add()
144
140
self.rename_count += 1
150
146
"""Derived from the Avahi example code"""
151
147
global group
152
148
if group is None:
153
group = dbus.Interface(bus.get_object
154
(avahi.DBUS_NAME,
149
group = dbus.Interface\
150
(bus.get_object(avahi.DBUS_NAME,
155
151
server.EntryGroupNew()),
156
avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
avahi.DBUS_INTERFACE_ENTRY_GROUP)
157
153
group.connect_to_signal('StateChanged',
158
154
entry_group_state_changed)
159
155
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
160
156
service.name, service.type)
161
157
group.AddService(
162
158
self.interface, # interface
163
self.protocol, # protocol
159
avahi.PROTO_INET6, # protocol
164
160
dbus.UInt32(0), # flags
165
161
self.name, self.type,
166
162
self.domain, self.host,
173
169
# End of Avahi example code
174
170
175
171
176
def _datetime_to_dbus(dt, variant_level=0):
177
"""Convert a UTC datetime.datetime() to a D-Bus type."""
178
return dbus.String(dt.isoformat(), variant_level=variant_level)
179
180
181
class Client(dbus.service.Object):
172
class Client(object):
182
173
"""A representation of a client host served by this server.
183
174
Attributes:
184
name: string; from the config file, used in log messages and
185
D-Bus identifiers
175
name: string; from the config file, used in log messages
186
176
fingerprint: string (40 or 32 hexadecimal digits); used to
187
177
uniquely identify the client
188
secret: bytestring; sent verbatim (over TLS) to client
189
host: string; available for use by the checker command
190
created: datetime.datetime(); (UTC) object creation
191
last_enabled: datetime.datetime(); (UTC)
192
enabled: bool()
193
last_checked_ok: datetime.datetime(); (UTC) or None
194
timeout: datetime.timedelta(); How long from last_checked_ok
195
until this client is invalid
196
interval: datetime.timedelta(); How often to start a new checker
197
disable_hook: If set, called by disable() as disable_hook(self)
198
checker: subprocess.Popen(); a running checker process used
199
to see if the client lives.
200
'None' if no process is running.
178
secret: bytestring; sent verbatim (over TLS) to client
179
host: string; available for use by the checker command
180
created: datetime.datetime(); object creation, not client host
181
last_checked_ok: datetime.datetime() or None if not yet checked OK
182
timeout: datetime.timedelta(); How long from last_checked_ok
183
until this client is invalid
184
interval: datetime.timedelta(); How often to start a new checker
185
stop_hook: If set, called by stop() as stop_hook(self)
186
checker: subprocess.Popen(); a running checker process used
187
to see if the client lives.
188
'None' if no process is running.
201
189
checker_initiator_tag: a gobject event source tag, or None
202
disable_initiator_tag: - '' -
190
stop_initiator_tag: - '' -
203
191
checker_callback_tag: - '' -
204
192
checker_command: string; External command which is run to check if
205
193
client lives. %() expansions are done at
206
194
runtime with vars(self) as dict, so that for
207
195
instance %(name)s can be used in the command.
208
current_checker_command: string; current running checker_command
209
use_dbus: bool(); Whether to provide D-Bus interface and signals
210
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
196
Private attibutes:
197
_timeout: Real variable for 'timeout'
198
_interval: Real variable for 'interval'
199
_timeout_milliseconds: Used when calling gobject.timeout_add()
200
_interval_milliseconds: - '' -
211
201
"""
212
def timeout_milliseconds(self):
213
"Return the 'timeout' attribute in milliseconds"
214
return ((self.timeout.days * 24 * 60 * 60 * 1000)
215
+ (self.timeout.seconds * 1000)
216
+ (self.timeout.microseconds // 1000))
217
218
def interval_milliseconds(self):
219
"Return the 'interval' attribute in milliseconds"
220
return ((self.interval.days * 24 * 60 * 60 * 1000)
221
+ (self.interval.seconds * 1000)
222
+ (self.interval.microseconds // 1000))
223
224
def __init__(self, name = None, disable_hook=None, config=None,
225
use_dbus=True):
202
def _set_timeout(self, timeout):
203
"Setter function for 'timeout' attribute"
204
self._timeout = timeout
205
self._timeout_milliseconds = ((self.timeout.days
206
* 24 * 60 * 60 * 1000)
207
+ (self.timeout.seconds * 1000)
208
+ (self.timeout.microseconds
209
// 1000))
210
timeout = property(lambda self: self._timeout,
211
_set_timeout)
212
del _set_timeout
213
def _set_interval(self, interval):
214
"Setter function for 'interval' attribute"
215
self._interval = interval
216
self._interval_milliseconds = ((self.interval.days
217
* 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds
219
* 1000)
220
+ (self.interval.microseconds
221
// 1000))
222
interval = property(lambda self: self._interval,
223
_set_interval)
224
del _set_interval
225
def __init__(self, name = None, stop_hook=None, config={}):
226
226
"""Note: the 'checker' key in 'config' sets the
227
227
'checker_command' attribute and *not* the 'checker'
228
228
attribute."""
229
229
self.name = name
230
if config is None:
231
config = {}
232
230
logger.debug(u"Creating client %r", self.name)
233
self.use_dbus = False # During __init__
234
231
# Uppercase and remove spaces from fingerprint for later
235
232
# comparison purposes with return value from the fingerprint()
236
233
# function
237
self.fingerprint = (config["fingerprint"].upper()
238
.replace(u" ", u""))
234
self.fingerprint = config["fingerprint"].upper()\
235
.replace(u" ", u"")
239
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
240
237
if "secret" in config:
241
238
self.secret = config["secret"].decode(u"base64")
242
239
elif "secfile" in config:
243
with closing(open(os.path.expanduser
244
(os.path.expandvars
245
(config["secfile"])))) as secfile:
246
self.secret = secfile.read()
240
sf = open(config["secfile"])
241
self.secret = sf.read()
242
sf.close()
247
243
else:
248
244
raise TypeError(u"No secret or secfile for client %s"
249
245
% self.name)
250
246
self.host = config.get("host", "")
251
self.created = datetime.datetime.utcnow()
252
self.enabled = False
253
self.last_enabled = None
247
self.created = datetime.datetime.now()
254
248
self.last_checked_ok = None
255
249
self.timeout = string_to_delta(config["timeout"])
256
250
self.interval = string_to_delta(config["interval"])
257
self.disable_hook = disable_hook
251
self.stop_hook = stop_hook
258
252
self.checker = None
259
253
self.checker_initiator_tag = None
260
self.disable_initiator_tag = None
254
self.stop_initiator_tag = None
261
255
self.checker_callback_tag = None
262
self.checker_command = config["checker"]
263
self.current_checker_command = None
264
self.last_connect = None
265
# Only now, when this client is initialized, can it show up on
266
# the D-Bus
267
self.use_dbus = use_dbus
268
if self.use_dbus:
269
self.dbus_object_path = (dbus.ObjectPath
270
("/clients/"
271
+ self.name.replace(".", "_")))
272
dbus.service.Object.__init__(self, bus,
273
self.dbus_object_path)
274
275
def enable(self):
256
self.check_command = config["checker"]
257
def start(self):
276
258
"""Start this client's checker and timeout hooks"""
277
self.last_enabled = datetime.datetime.utcnow()
278
259
# Schedule a new checker to be started an 'interval' from now,
279
260
# and every interval from then on.
280
self.checker_initiator_tag = (gobject.timeout_add
281
(self.interval_milliseconds(),
282
self.start_checker))
261
self.checker_initiator_tag = gobject.timeout_add\
262
(self._interval_milliseconds,
263
self.start_checker)
283
264
# Also start a new checker *right now*.
284
265
self.start_checker()
285
# Schedule a disable() when 'timeout' has passed
286
self.disable_initiator_tag = (gobject.timeout_add
287
(self.timeout_milliseconds(),
288
self.disable))
289
self.enabled = True
290
if self.use_dbus:
291
# Emit D-Bus signals
292
self.PropertyChanged(dbus.String(u"enabled"),
293
dbus.Boolean(True, variant_level=1))
294
self.PropertyChanged(dbus.String(u"last_enabled"),
295
(_datetime_to_dbus(self.last_enabled,
296
variant_level=1)))
297
298
def disable(self):
299
"""Disable this client."""
300
if not getattr(self, "enabled", False):
266
# Schedule a stop() when 'timeout' has passed
267
self.stop_initiator_tag = gobject.timeout_add\
268
(self._timeout_milliseconds,
269
self.stop)
270
def stop(self):
271
"""Stop this client.
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
274
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
276
logger.info(u"Stopping client %s", self.name)
277
self.secret = None
278
else:
301
279
return False
302
logger.info(u"Disabling client %s", self.name)
303
if getattr(self, "disable_initiator_tag", False):
304
gobject.source_remove(self.disable_initiator_tag)
305
self.disable_initiator_tag = None
280
if getattr(self, "stop_initiator_tag", False):
281
gobject.source_remove(self.stop_initiator_tag)
282
self.stop_initiator_tag = None
306
283
if getattr(self, "checker_initiator_tag", False):
307
284
gobject.source_remove(self.checker_initiator_tag)
308
285
self.checker_initiator_tag = None
309
286
self.stop_checker()
310
if self.disable_hook:
311
self.disable_hook(self)
312
self.enabled = False
313
if self.use_dbus:
314
# Emit D-Bus signal
315
self.PropertyChanged(dbus.String(u"enabled"),
316
dbus.Boolean(False, variant_level=1))
287
if self.stop_hook:
288
self.stop_hook(self)
317
289
# Do not run this again if called by a gobject.timeout_add
318
290
return False
319
320
291
def __del__(self):
321
self.disable_hook = None
322
self.disable()
323
324
def checker_callback(self, pid, condition, command):
292
self.stop_hook = None
293
self.stop()
294
def checker_callback(self, pid, condition):
325
295
"""The checker has completed, so take appropriate actions."""
296
now = datetime.datetime.now()
326
297
self.checker_callback_tag = None
327
298
self.checker = None
328
if self.use_dbus:
329
# Emit D-Bus signal
330
self.PropertyChanged(dbus.String(u"checker_running"),
331
dbus.Boolean(False, variant_level=1))
332
if os.WIFEXITED(condition):
333
exitstatus = os.WEXITSTATUS(condition)
334
if exitstatus == 0:
335
logger.info(u"Checker for %(name)s succeeded",
336
vars(self))
337
self.checked_ok()
338
else:
339
logger.info(u"Checker for %(name)s failed",
340
vars(self))
341
if self.use_dbus:
342
# Emit D-Bus signal
343
self.CheckerCompleted(dbus.Int16(exitstatus),
344
dbus.Int64(condition),
345
dbus.String(command))
346
else:
299
if os.WIFEXITED(condition) \
300
and (os.WEXITSTATUS(condition) == 0):
301
logger.info(u"Checker for %(name)s succeeded",
302
vars(self))
303
self.last_checked_ok = now
304
gobject.source_remove(self.stop_initiator_tag)
305
self.stop_initiator_tag = gobject.timeout_add\
306
(self._timeout_milliseconds,
307
self.stop)
308
elif not os.WIFEXITED(condition):
347
309
logger.warning(u"Checker for %(name)s crashed?",
348
310
vars(self))
349
if self.use_dbus:
350
# Emit D-Bus signal
351
self.CheckerCompleted(dbus.Int16(-1),
352
dbus.Int64(condition),
353
dbus.String(command))
354
355
def checked_ok(self):
356
"""Bump up the timeout for this client.
357
This should only be called when the client has been seen,
358
alive and well.
359
"""
360
self.last_checked_ok = datetime.datetime.utcnow()
361
gobject.source_remove(self.disable_initiator_tag)
362
self.disable_initiator_tag = (gobject.timeout_add
363
(self.timeout_milliseconds(),
364
self.disable))
365
if self.use_dbus:
366
# Emit D-Bus signal
367
self.PropertyChanged(
368
dbus.String(u"last_checked_ok"),
369
(_datetime_to_dbus(self.last_checked_ok,
370
variant_level=1)))
371
311
else:
312
logger.info(u"Checker for %(name)s failed",
313
vars(self))
372
314
def start_checker(self):
373
315
"""Start a new checker subprocess if one is not running.
374
316
If a checker already exists, leave it running and do
381
323
# checkers alone, the checker would have to take more time
382
324
# than 'timeout' for the client to be declared invalid, which
383
325
# is as it should be.
384
385
# If a checker exists, make sure it is not a zombie
386
if self.checker is not None:
387
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
388
if pid:
389
logger.warning("Checker was a zombie")
390
gobject.source_remove(self.checker_callback_tag)
391
self.checker_callback(pid, status,
392
self.current_checker_command)
393
# Start a new checker if needed
394
326
if self.checker is None:
395
327
try:
396
# In case checker_command has exactly one % operator
397
command = self.checker_command % self.host
328
# In case check_command has exactly one % operator
329
command = self.check_command % self.host
398
330
except TypeError:
399
331
# Escape attributes for the shell
400
332
escaped_attrs = dict((key, re.escape(str(val)))
401
333
for key, val in
402
334
vars(self).iteritems())
403
335
try:
404
command = self.checker_command % escaped_attrs
336
command = self.check_command % escaped_attrs
405
337
except TypeError, error:
406
338
logger.error(u'Could not format string "%s":'
407
u' %s', self.checker_command, error)
339
u' %s', self.check_command, error)
408
340
return True # Try again later
409
self.current_checker_command = command
410
341
try:
411
342
logger.info(u"Starting checker %r for %s",
412
343
command, self.name)
417
348
self.checker = subprocess.Popen(command,
418
349
close_fds=True,
419
350
shell=True, cwd="/")
420
if self.use_dbus:
421
# Emit D-Bus signal
422
self.CheckerStarted(command)
423
self.PropertyChanged(
424
dbus.String("checker_running"),
425
dbus.Boolean(True, variant_level=1))
426
self.checker_callback_tag = (gobject.child_watch_add
427
(self.checker.pid,
428
self.checker_callback,
429
data=command))
430
# The checker may have completed before the gobject
431
# watch was added. Check for this.
432
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
433
if pid:
434
gobject.source_remove(self.checker_callback_tag)
435
self.checker_callback(pid, status, command)
351
self.checker_callback_tag = gobject.child_watch_add\
352
(self.checker.pid,
353
self.checker_callback)
436
354
except OSError, error:
437
355
logger.error(u"Failed to start subprocess: %s",
438
356
error)
439
357
# Re-run this periodically if run by gobject.timeout_add
440
358
return True
441
442
359
def stop_checker(self):
443
360
"""Force the checker process, if any, to stop."""
444
361
if self.checker_callback_tag:
456
373
if error.errno != errno.ESRCH: # No such process
457
374
raise
458
375
self.checker = None
459
if self.use_dbus:
460
self.PropertyChanged(dbus.String(u"checker_running"),
461
dbus.Boolean(False, variant_level=1))
462
463
376
def still_valid(self):
464
377
"""Has the timeout not yet passed for this client?"""
465
if not getattr(self, "enabled", False):
466
return False
467
now = datetime.datetime.utcnow()
378
now = datetime.datetime.now()
468
379
if self.last_checked_ok is None:
469
380
return now < (self.created + self.timeout)
470
381
else:
471
382
return now < (self.last_checked_ok + self.timeout)
472
473
## D-Bus methods & signals
474
_interface = u"se.bsnet.fukt.Mandos.Client"
475
476
# CheckedOK - method
477
CheckedOK = dbus.service.method(_interface)(checked_ok)
478
CheckedOK.__name__ = "CheckedOK"
479
480
# CheckerCompleted - signal
481
@dbus.service.signal(_interface, signature="nxs")
482
def CheckerCompleted(self, exitcode, waitstatus, command):
483
"D-Bus signal"
484
pass
485
486
# CheckerStarted - signal
487
@dbus.service.signal(_interface, signature="s")
488
def CheckerStarted(self, command):
489
"D-Bus signal"
490
pass
491
492
# GetAllProperties - method
493
@dbus.service.method(_interface, out_signature="a{sv}")
494
def GetAllProperties(self):
495
"D-Bus method"
496
return dbus.Dictionary({
497
dbus.String("name"):
498
dbus.String(self.name, variant_level=1),
499
dbus.String("fingerprint"):
500
dbus.String(self.fingerprint, variant_level=1),
501
dbus.String("host"):
502
dbus.String(self.host, variant_level=1),
503
dbus.String("created"):
504
_datetime_to_dbus(self.created, variant_level=1),
505
dbus.String("last_enabled"):
506
(_datetime_to_dbus(self.last_enabled,
507
variant_level=1)
508
if self.last_enabled is not None
509
else dbus.Boolean(False, variant_level=1)),
510
dbus.String("enabled"):
511
dbus.Boolean(self.enabled, variant_level=1),
512
dbus.String("last_checked_ok"):
513
(_datetime_to_dbus(self.last_checked_ok,
514
variant_level=1)
515
if self.last_checked_ok is not None
516
else dbus.Boolean (False, variant_level=1)),
517
dbus.String("timeout"):
518
dbus.UInt64(self.timeout_milliseconds(),
519
variant_level=1),
520
dbus.String("interval"):
521
dbus.UInt64(self.interval_milliseconds(),
522
variant_level=1),
523
dbus.String("checker"):
524
dbus.String(self.checker_command,
525
variant_level=1),
526
dbus.String("checker_running"):
527
dbus.Boolean(self.checker is not None,
528
variant_level=1),
529
dbus.String("object_path"):
530
dbus.ObjectPath(self.dbus_object_path,
531
variant_level=1)
532
}, signature="sv")
533
534
# IsStillValid - method
535
IsStillValid = (dbus.service.method(_interface, out_signature="b")
536
(still_valid))
537
IsStillValid.__name__ = "IsStillValid"
538
539
# PropertyChanged - signal
540
@dbus.service.signal(_interface, signature="sv")
541
def PropertyChanged(self, property, value):
542
"D-Bus signal"
543
pass
544
545
# SetChecker - method
546
@dbus.service.method(_interface, in_signature="s")
547
def SetChecker(self, checker):
548
"D-Bus setter method"
549
self.checker_command = checker
550
# Emit D-Bus signal
551
self.PropertyChanged(dbus.String(u"checker"),
552
dbus.String(self.checker_command,
553
variant_level=1))
554
555
# SetHost - method
556
@dbus.service.method(_interface, in_signature="s")
557
def SetHost(self, host):
558
"D-Bus setter method"
559
self.host = host
560
# Emit D-Bus signal
561
self.PropertyChanged(dbus.String(u"host"),
562
dbus.String(self.host, variant_level=1))
563
564
# SetInterval - method
565
@dbus.service.method(_interface, in_signature="t")
566
def SetInterval(self, milliseconds):
567
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
568
# Emit D-Bus signal
569
self.PropertyChanged(dbus.String(u"interval"),
570
(dbus.UInt64(self.interval_milliseconds(),
571
variant_level=1)))
572
573
# SetSecret - method
574
@dbus.service.method(_interface, in_signature="ay",
575
byte_arrays=True)
576
def SetSecret(self, secret):
577
"D-Bus setter method"
578
self.secret = str(secret)
579
580
# SetTimeout - method
581
@dbus.service.method(_interface, in_signature="t")
582
def SetTimeout(self, milliseconds):
583
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
584
# Emit D-Bus signal
585
self.PropertyChanged(dbus.String(u"timeout"),
586
(dbus.UInt64(self.timeout_milliseconds(),
587
variant_level=1)))
588
589
# Enable - method
590
Enable = dbus.service.method(_interface)(enable)
591
Enable.__name__ = "Enable"
592
593
# StartChecker - method
594
@dbus.service.method(_interface)
595
def StartChecker(self):
596
"D-Bus method"
597
self.start_checker()
598
599
# Disable - method
600
@dbus.service.method(_interface)
601
def Disable(self):
602
"D-Bus method"
603
self.disable()
604
605
# StopChecker - method
606
StopChecker = dbus.service.method(_interface)(stop_checker)
607
StopChecker.__name__ = "StopChecker"
608
609
del _interface
610
383
611
384
612
385
def peer_certificate(session):
613
386
"Return the peer's OpenPGP certificate as a bytestring"
614
387
# If not an OpenPGP certificate...
615
if (gnutls.library.functions
616
.gnutls_certificate_type_get(session._c_object)
617
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
388
if gnutls.library.functions.gnutls_certificate_type_get\
389
(session._c_object) \
390
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
618
391
# ...do the normal thing
619
392
return session.peer_certificate
620
list_size = ctypes.c_uint(1)
621
cert_list = (gnutls.library.functions
622
.gnutls_certificate_get_peers
623
(session._c_object, ctypes.byref(list_size)))
624
if not bool(cert_list) and list_size.value != 0:
625
raise gnutls.errors.GNUTLSError("error getting peer"
626
" certificate")
393
list_size = ctypes.c_uint()
394
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
(session._c_object, ctypes.byref(list_size))
627
396
if list_size.value == 0:
628
397
return None
629
398
cert = cert_list[0]
633
402
def fingerprint(openpgp):
634
403
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
635
404
# New GnuTLS "datum" with the OpenPGP public key
636
datum = (gnutls.library.types
637
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
638
ctypes.POINTER
639
(ctypes.c_ubyte)),
640
ctypes.c_uint(len(openpgp))))
405
datum = gnutls.library.types.gnutls_datum_t\
406
(ctypes.cast(ctypes.c_char_p(openpgp),
407
ctypes.POINTER(ctypes.c_ubyte)),
408
ctypes.c_uint(len(openpgp)))
641
409
# New empty GnuTLS certificate
642
410
crt = gnutls.library.types.gnutls_openpgp_crt_t()
643
(gnutls.library.functions
644
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
411
gnutls.library.functions.gnutls_openpgp_crt_init\
412
(ctypes.byref(crt))
645
413
# Import the OpenPGP public key into the certificate
646
(gnutls.library.functions
647
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
648
gnutls.library.constants
649
.GNUTLS_OPENPGP_FMT_RAW))
414
gnutls.library.functions.gnutls_openpgp_crt_import\
415
(crt, ctypes.byref(datum),
416
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
650
417
# Verify the self signature in the key
651
crtverify = ctypes.c_uint()
652
(gnutls.library.functions
653
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
418
crtverify = ctypes.c_uint();
419
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
(crt, 0, ctypes.byref(crtverify))
654
421
if crtverify.value != 0:
655
422
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
656
423
raise gnutls.errors.CertificateSecurityError("Verify failed")
657
424
# New buffer for the fingerprint
658
buf = ctypes.create_string_buffer(20)
659
buf_len = ctypes.c_size_t()
425
buffer = ctypes.create_string_buffer(20)
426
buffer_length = ctypes.c_size_t()
660
427
# Get the fingerprint from the certificate into the buffer
661
(gnutls.library.functions
662
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
663
ctypes.byref(buf_len)))
428
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
664
430
# Deinit the certificate
665
431
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
666
432
# Convert the buffer to a Python bytestring
667
fpr = ctypes.string_at(buf, buf_len.value)
433
fpr = ctypes.string_at(buffer, buffer_length.value)
668
434
# Convert the bytestring to hexadecimal notation
669
435
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
670
436
return hex_fpr
671
437
672
438
673
class TCP_handler(SocketServer.BaseRequestHandler, object):
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
674
440
"""A TCP request handler class.
675
441
Instantiated by IPv6_TCPServer for each request to handle it.
676
442
Note: This will run in its own forked process."""
677
443
678
444
def handle(self):
679
445
logger.info(u"TCP connection from: %s",
680
unicode(self.client_address))
681
session = (gnutls.connection
682
.ClientSession(self.request,
683
gnutls.connection
684
.X509Credentials()))
446
unicode(self.client_address))
447
session = gnutls.connection.ClientSession\
448
(self.request, gnutls.connection.X509Credentials())
685
449
686
450
line = self.request.makefile().readline()
687
451
logger.debug(u"Protocol version: %r", line)
698
462
# using OpenPGP certificates.
699
463
700
464
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
701
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
702
# "+DHE-DSS"))
703
# Use a fallback default, since this MUST be set.
704
priority = self.server.settings.get("priority", "NORMAL")
705
(gnutls.library.functions
706
.gnutls_priority_set_direct(session._c_object,
707
priority, None))
465
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
466
# "+DHE-DSS"))
467
priority = "NORMAL" # Fallback default, since this
468
# MUST be set.
469
if self.server.settings["priority"]:
470
priority = self.server.settings["priority"]
471
gnutls.library.functions.gnutls_priority_set_direct\
472
(session._c_object, priority, None);
708
473
709
474
try:
710
475
session.handshake()
713
478
# Do not run session.bye() here: the session is not
714
479
# established. Just abandon the request.
715
480
return
716
logger.debug(u"Handshake succeeded")
717
481
try:
718
482
fpr = fingerprint(peer_certificate(session))
719
483
except (TypeError, gnutls.errors.GNUTLSError), error:
721
485
session.bye()
722
486
return
723
487
logger.debug(u"Fingerprint: %s", fpr)
724
488
client = None
725
489
for c in self.server.clients:
726
490
if c.fingerprint == fpr:
727
491
client = c
728
492
break
729
else:
493
if not client:
730
494
logger.warning(u"Client not found for fingerprint: %s",
731
495
fpr)
732
496
session.bye()
739
503
vars(client))
740
504
session.bye()
741
505
return
742
## This won't work here, since we're in a fork.
743
# client.checked_ok()
744
506
sent_size = 0
745
507
while sent_size < len(client.secret):
746
508
sent = session.send(client.secret[sent_size:])
751
513
session.bye()
752
514
753
515
754
class IPv6_TCPServer(SocketServer.ForkingMixIn,
755
SocketServer.TCPServer, object):
756
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
516
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
517
"""IPv6 TCP server. Accepts 'None' as address and/or port.
757
518
Attributes:
758
519
settings: Server settings
759
520
clients: Set() of Client objects
767
528
if "clients" in kwargs:
768
529
self.clients = kwargs["clients"]
769
530
del kwargs["clients"]
770
if "use_ipv6" in kwargs:
771
if not kwargs["use_ipv6"]:
772
self.address_family = socket.AF_INET
773
del kwargs["use_ipv6"]
774
531
self.enabled = False
775
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
532
return super(type(self), self).__init__(*args, **kwargs)
776
533
def server_bind(self):
777
534
"""This overrides the normal server_bind() function
778
535
to bind to an interface if one was specified, and also NOT to
790
547
u" bind to interface %s",
791
548
self.settings["interface"])
792
549
else:
793
raise
550
raise error
794
551
# Only bind(2) the socket if we really need to.
795
552
if self.server_address[0] or self.server_address[1]:
796
553
if not self.server_address[0]:
797
if self.address_family == socket.AF_INET6:
798
any_address = "::" # in6addr_any
799
else:
800
any_address = socket.INADDR_ANY
801
self.server_address = (any_address,
554
in6addr_any = "::"
555
self.server_address = (in6addr_any,
802
556
self.server_address[1])
803
557
elif not self.server_address[1]:
804
558
self.server_address = (self.server_address[0],
810
564
# if_nametoindex
811
565
# (self.settings
812
566
# ["interface"]))
813
return super(IPv6_TCPServer, self).server_bind()
567
return super(type(self), self).server_bind()
814
568
def server_activate(self):
815
569
if self.enabled:
816
return super(IPv6_TCPServer, self).server_activate()
570
return super(type(self), self).server_activate()
817
571
def enable(self):
818
572
self.enabled = True
819
573
820
574
821
575
def string_to_delta(interval):
822
576
"""Parse a string and return a datetime.timedelta
823
577
824
578
>>> string_to_delta('7d')
825
579
datetime.timedelta(7)
826
580
>>> string_to_delta('60s')
837
591
timevalue = datetime.timedelta(0)
838
592
for s in interval.split():
839
593
try:
840
suffix = unicode(s[-1])
841
value = int(s[:-1])
594
suffix=unicode(s[-1])
595
value=int(s[:-1])
842
596
if suffix == u"d":
843
597
delta = datetime.timedelta(value)
844
598
elif suffix == u"s":
878
632
elif state == avahi.ENTRY_GROUP_FAILURE:
879
633
logger.critical(u"Avahi: Error in group state changed %s",
880
634
unicode(error))
881
raise AvahiGroupError(u"State changed: %s" % unicode(error))
635
raise AvahiGroupError("State changed: %s", str(error))
882
636
883
637
def if_nametoindex(interface):
884
638
"""Call the C function if_nametoindex(), or equivalent"""
885
639
global if_nametoindex
886
640
try:
887
if_nametoindex = (ctypes.cdll.LoadLibrary
888
(ctypes.util.find_library("c"))
889
.if_nametoindex)
641
if "ctypes.util" not in sys.modules:
642
import ctypes.util
643
if_nametoindex = ctypes.cdll.LoadLibrary\
644
(ctypes.util.find_library("c")).if_nametoindex
890
645
except (OSError, AttributeError):
891
646
if "struct" not in sys.modules:
892
647
import struct
895
650
def if_nametoindex(interface):
896
651
"Get an interface index the hard way, i.e. using fcntl()"
897
652
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
898
with closing(socket.socket()) as s:
899
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
900
struct.pack("16s16x", interface))
653
s = socket.socket()
654
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
655
struct.pack("16s16x", interface))
656
s.close()
901
657
interface_index = struct.unpack("I", ifreq[16:20])[0]
902
658
return interface_index
903
659
return if_nametoindex(interface)
927
683
928
684
929
685
def main():
930
parser = optparse.OptionParser(version = "%%prog %s" % version)
686
global main_loop_started
687
main_loop_started = False
688
689
parser = OptionParser(version = "%%prog %s" % version)
931
690
parser.add_option("-i", "--interface", type="string",
932
691
metavar="IF", help="Bind to interface IF")
933
692
parser.add_option("-a", "--address", type="string",
934
693
help="Address to listen for requests on")
935
694
parser.add_option("-p", "--port", type="int",
936
695
help="Port number to receive requests on")
937
parser.add_option("--check", action="store_true",
696
parser.add_option("--check", action="store_true", default=False,
938
697
help="Run self-test")
939
698
parser.add_option("--debug", action="store_true",
940
699
help="Debug mode; run in foreground and log to"
947
706
default="/etc/mandos", metavar="DIR",
948
707
help="Directory to search for configuration"
949
708
" files")
950
parser.add_option("--no-dbus", action="store_false",
951
dest="use_dbus",
952
help="Do not provide D-Bus system bus"
953
" interface")
954
parser.add_option("--no-ipv6", action="store_false",
955
dest="use_ipv6", help="Do not use IPv6")
956
options = parser.parse_args()[0]
709
(options, args) = parser.parse_args()
957
710
958
711
if options.check:
959
712
import doctest
968
721
"priority":
969
722
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
970
723
"servicename": "Mandos",
971
"use_dbus": "True",
972
"use_ipv6": "True",
973
724
}
974
725
975
726
# Parse config file for server-global settings
978
729
server_config.read(os.path.join(options.configdir, "mandos.conf"))
979
730
# Convert the SafeConfigParser object to a dict
980
731
server_settings = server_config.defaults()
981
# Use the appropriate methods on the non-string config options
982
server_settings["debug"] = server_config.getboolean("DEFAULT",
983
"debug")
984
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
985
"use_dbus")
986
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
987
"use_ipv6")
988
if server_settings["port"]:
989
server_settings["port"] = server_config.getint("DEFAULT",
990
"port")
732
# Use getboolean on the boolean config option
733
server_settings["debug"] = server_config.getboolean\
734
("DEFAULT", "debug")
991
735
del server_config
992
736
993
737
# Override the settings from the config file with command line
994
738
# options, if set.
995
739
for option in ("interface", "address", "port", "debug",
996
"priority", "servicename", "configdir",
997
"use_dbus", "use_ipv6"):
740
"priority", "servicename", "configdir"):
998
741
value = getattr(options, option)
999
742
if value is not None:
1000
743
server_settings[option] = value
1001
744
del options
1002
745
# Now we have our good server settings in "server_settings"
1003
746
1004
# For convenience
1005
747
debug = server_settings["debug"]
1006
use_dbus = server_settings["use_dbus"]
1007
use_ipv6 = server_settings["use_ipv6"]
1008
748
1009
749
if not debug:
1010
750
syslogger.setLevel(logging.WARNING)
1011
751
console.setLevel(logging.WARNING)
1012
752
1013
753
if server_settings["servicename"] != "Mandos":
1014
syslogger.setFormatter(logging.Formatter
754
syslogger.setFormatter(logging.Formatter\
1015
755
('Mandos (%s): %%(levelname)s:'
1016
756
' %%(message)s'
1017
757
% server_settings["servicename"]))
1019
759
# Parse config file with clients
1020
760
client_defaults = { "timeout": "1h",
1021
761
"interval": "5m",
1022
"checker": "fping -q -- %%(host)s",
762
"checker": "fping -q -- %(host)s",
1023
763
"host": "",
1024
764
}
1025
765
client_config = ConfigParser.SafeConfigParser(client_defaults)
1029
769
clients = Set()
1030
770
tcp_server = IPv6_TCPServer((server_settings["address"],
1031
771
server_settings["port"]),
1032
TCP_handler,
772
tcp_handler,
1033
773
settings=server_settings,
1034
clients=clients, use_ipv6=use_ipv6)
774
clients=clients)
1035
775
pidfilename = "/var/run/mandos.pid"
1036
776
try:
1037
777
pidfile = open(pidfilename, "w")
1038
except IOError:
778
except IOError, error:
1039
779
logger.error("Could not open file %r", pidfilename)
1040
780
1041
try:
1042
uid = pwd.getpwnam("_mandos").pw_uid
1043
gid = pwd.getpwnam("_mandos").pw_gid
1044
except KeyError:
1045
try:
1046
uid = pwd.getpwnam("mandos").pw_uid
1047
gid = pwd.getpwnam("mandos").pw_gid
1048
except KeyError:
1049
try:
1050
uid = pwd.getpwnam("nobody").pw_uid
1051
gid = pwd.getpwnam("nogroup").pw_gid
1052
except KeyError:
1053
uid = 65534
1054
gid = 65534
1055
try:
781
uid = 65534
782
gid = 65534
783
try:
784
uid = pwd.getpwnam("mandos").pw_uid
785
except KeyError:
786
try:
787
uid = pwd.getpwnam("nobody").pw_uid
788
except KeyError:
789
pass
790
try:
791
gid = pwd.getpwnam("mandos").pw_gid
792
except KeyError:
793
try:
794
gid = pwd.getpwnam("nogroup").pw_gid
795
except KeyError:
796
pass
797
try:
798
os.setuid(uid)
1056
799
os.setgid(gid)
1057
os.setuid(uid)
1058
800
except OSError, error:
1059
801
if error[0] != errno.EPERM:
1060
802
raise error
1061
803
1062
# Enable all possible GnuTLS debugging
1063
if debug:
1064
# "Use a log level over 10 to enable all debugging options."
1065
# - GnuTLS manual
1066
gnutls.library.functions.gnutls_global_set_log_level(11)
1067
1068
@gnutls.library.types.gnutls_log_func
1069
def debug_gnutls(level, string):
1070
logger.debug("GnuTLS: %s", string[:-1])
1071
1072
(gnutls.library.functions
1073
.gnutls_global_set_log_function(debug_gnutls))
1074
1075
804
global service
1076
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1077
805
service = AvahiService(name = server_settings["servicename"],
1078
servicetype = "_mandos._tcp",
1079
protocol = protocol)
806
type = "_mandos._tcp", );
1080
807
if server_settings["interface"]:
1081
service.interface = (if_nametoindex
1082
(server_settings["interface"]))
808
service.interface = if_nametoindex\
809
(server_settings["interface"])
1083
810
1084
811
global main_loop
1085
812
global bus
1092
819
avahi.DBUS_PATH_SERVER),
1093
820
avahi.DBUS_INTERFACE_SERVER)
1094
821
# End of Avahi example code
1095
if use_dbus:
1096
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
822
823
def remove_from_clients(client):
824
clients.remove(client)
825
if not clients:
826
logger.critical(u"No clients left, exiting")
827
sys.exit()
1097
828
1098
829
clients.update(Set(Client(name = section,
830
stop_hook = remove_from_clients,
1099
831
config
1100
= dict(client_config.items(section)),
1101
use_dbus = use_dbus)
832
= dict(client_config.items(section)))
1102
833
for section in client_config.sections()))
1103
834
if not clients:
1104
logger.warning(u"No clients defined")
835
logger.critical(u"No clients defined")
836
sys.exit(1)
1105
837
1106
838
if debug:
1107
839
# Redirect stdin so all checkers get /dev/null
1120
852
pidfile.write(str(pid) + "\n")
1121
853
pidfile.close()
1122
854
del pidfile
1123
except IOError:
855
except IOError, err:
1124
856
logger.error(u"Could not write to file %r with PID %d",
1125
857
pidfilename, pid)
1126
858
except NameError:
1139
871
1140
872
while clients:
1141
873
client = clients.pop()
1142
client.disable_hook = None
1143
client.disable()
874
client.stop_hook = None
875
client.stop()
1144
876
1145
877
atexit.register(cleanup)
1146
878
1149
881
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1150
882
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1151
883
1152
if use_dbus:
1153
class MandosServer(dbus.service.Object):
1154
"""A D-Bus proxy object"""
1155
def __init__(self):
1156
dbus.service.Object.__init__(self, bus, "/")
1157
_interface = u"se.bsnet.fukt.Mandos"
1158
1159
@dbus.service.signal(_interface, signature="oa{sv}")
1160
def ClientAdded(self, objpath, properties):
1161
"D-Bus signal"
1162
pass
1163
1164
@dbus.service.signal(_interface, signature="os")
1165
def ClientRemoved(self, objpath, name):
1166
"D-Bus signal"
1167
pass
1168
1169
@dbus.service.method(_interface, out_signature="ao")
1170
def GetAllClients(self):
1171
"D-Bus method"
1172
return dbus.Array(c.dbus_object_path for c in clients)
1173
1174
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1175
def GetAllClientsWithProperties(self):
1176
"D-Bus method"
1177
return dbus.Dictionary(
1178
((c.dbus_object_path, c.GetAllProperties())
1179
for c in clients),
1180
signature="oa{sv}")
1181
1182
@dbus.service.method(_interface, in_signature="o")
1183
def RemoveClient(self, object_path):
1184
"D-Bus method"
1185
for c in clients:
1186
if c.dbus_object_path == object_path:
1187
clients.remove(c)
1188
# Don't signal anything except ClientRemoved
1189
c.use_dbus = False
1190
c.disable()
1191
# Emit D-Bus signal
1192
self.ClientRemoved(object_path, c.name)
1193
return
1194
raise KeyError
1195
1196
del _interface
1197
1198
mandos_server = MandosServer()
1199
1200
884
for client in clients:
1201
if use_dbus:
1202
# Emit D-Bus signal
1203
mandos_server.ClientAdded(client.dbus_object_path,
1204
client.GetAllProperties())
1205
client.enable()
885
client.start()
1206
886
1207
887
tcp_server.enable()
1208
888
tcp_server.server_activate()
1209
889
1210
890
# Find out what port we got
1211
891
service.port = tcp_server.socket.getsockname()[1]
1212
if use_ipv6:
1213
logger.info(u"Now listening on address %r, port %d,"
1214
" flowinfo %d, scope_id %d"
1215
% tcp_server.socket.getsockname())
1216
else: # IPv4
1217
logger.info(u"Now listening on address %r, port %d"
1218
% tcp_server.socket.getsockname())
892
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
893
u" scope_id %d" % tcp_server.socket.getsockname())
1219
894
1220
895
#service.interface = tcp_server.socket.getsockname()[3]
1221
896
1231
906
1232
907
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1233
908
lambda *args, **kwargs:
1234
(tcp_server.handle_request
1235
(*args[2:], **kwargs) or True))
909
tcp_server.handle_request\
910
(*args[2:], **kwargs) or True)
1236
911
1237
912
logger.debug(u"Starting main loop")
913
main_loop_started = True
1238
914
main_loop.run()
1239
915
except AvahiError, error:
1240
logger.critical(u"AvahiError: %s", error)
916
logger.critical(u"AvahiError: %s" + unicode(error))
1241
917
sys.exit(1)
1242
918
except KeyboardInterrupt:
1243
919
if debug:
1244
print >> sys.stderr
1245
logger.debug("Server received KeyboardInterrupt")
1246
logger.debug("Server exiting")
920
print
1247
921
1248
922
if __name__ == '__main__':
1249
923
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0