To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 223
- compare with another revision
- download diff
- download tarball
- view history from revision 223
- Committer: Teddy Hogeborn
- Date: 2008-10-03 09:32:30 UTC
- Revision ID: teddy@fukt.bsnet.se-20081003093230-rshn19e0c19zz12i
* .bzrignore (plugins.d/askpass-fifo): Added.
* Makefile (FORTIFY): Added "-fstack-protector-all".
(mandos, mandos-keygen): Use more strict regexps when updating the
version number.
* mandos (Client.__init__): Use os.path.expandvars() and
os.path.expanduser() on the "secfile"
config value.
* plugins.d/splashy.c: Update comments and order of #include's.
(main): Check user and group when looking for running splashy
process. Do not ignore ENOENT from execl(). Use _exit()
instead of "return" when an error happens in child
processes. Bug fix: Only wait for splashy_update
completion if it was started. Bug fix: detect failing
waitpid(). Only kill splashy_update if it is running. Do
the killing of the old splashy process before the fork().
Do setsid() and setuid(geteuid()) before starting the new
splashy. Report failing execl().
* plugins.d/usplash.c: Update comments and order of #include's.
(main): Check user and group when looking for running usplash
process. Do not report execv() error if interrupted by a
signal.
* Makefile (FORTIFY): Added "-fstack-protector-all".
(mandos, mandos-keygen): Use more strict regexps when updating the
version number.
* mandos (Client.__init__): Use os.path.expandvars() and
os.path.expanduser() on the "secfile"
config value.
* plugins.d/splashy.c: Update comments and order of #include's.
(main): Check user and group when looking for running splashy
process. Do not ignore ENOENT from execl(). Use _exit()
instead of "return" when an error happens in child
processes. Bug fix: Only wait for splashy_update
completion if it was started. Bug fix: detect failing
waitpid(). Only kill splashy_update if it is running. Do
the killing of the old splashy process before the fork().
Do setsid() and setuid(geteuid()) before starting the new
splashy. Report failing execl().
* plugins.d/usplash.c: Update comments and order of #include's.
(main): Check user and group when looking for running usplash
process. Do not report execv() error if interrupted by a
signal.
- files added:
- debian/mandos-client.config
- files removed:
- NEWS
- files modified:
- INSTALL
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import division, with_statement, absolute_import
33
from __future__ import division
35
34
36
35
import SocketServer
37
36
import socket
38
import optparse
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
59
from contextlib import closing
60
58
61
59
import dbus
62
import dbus.service
63
60
import gobject
64
61
import avahi
65
62
from dbus.mainloop.glib import DBusGMainLoop
66
63
import ctypes
67
64
import ctypes.util
68
65
69
version = "1.0.5"
66
version = "1.0"
70
67
71
68
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
78
74
logger.addHandler(syslogger)
79
75
80
76
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
' %(message)s'))
83
79
logger.addHandler(console)
84
80
85
81
class AvahiError(Exception):
86
def __init__(self, value, *args, **kwargs):
82
def __init__(self, value):
87
83
self.value = value
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
84
super(AvahiError, self).__init__()
85
def __str__(self):
86
return repr(self.value)
91
87
92
88
class AvahiServiceError(AvahiError):
93
89
pass
113
109
a sensible number of times
114
110
"""
115
111
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768):
112
servicetype = None, port = None, TXT = None, domain = "",
113
host = "", max_renames = 32768):
118
114
self.interface = interface
119
115
self.name = name
120
116
self.type = servicetype
121
117
self.port = port
122
self.TXT = TXT if TXT is not None else []
118
if TXT is None:
119
self.TXT = []
120
else:
121
self.TXT = TXT
123
122
self.domain = domain
124
123
self.host = host
125
124
self.rename_count = 0
130
129
logger.critical(u"No suitable Zeroconf service name found"
131
130
u" after %i retries, exiting.",
132
131
self.rename_count)
133
raise AvahiServiceError(u"Too many renames")
132
raise AvahiServiceError("Too many renames")
134
133
self.name = server.GetAlternativeServiceName(self.name)
135
134
logger.info(u"Changing Zeroconf service name to %r ...",
136
135
str(self.name))
137
syslogger.setFormatter(logging.Formatter
136
syslogger.setFormatter(logging.Formatter\
138
137
('Mandos (%s): %%(levelname)s:'
139
' %%(message)s' % self.name))
138
' %%(message)s' % self.name))
140
139
self.remove()
141
140
self.add()
142
141
self.rename_count += 1
148
147
"""Derived from the Avahi example code"""
149
148
global group
150
149
if group is None:
151
group = dbus.Interface(bus.get_object
152
(avahi.DBUS_NAME,
150
group = dbus.Interface\
151
(bus.get_object(avahi.DBUS_NAME,
153
152
server.EntryGroupNew()),
154
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
155
154
group.connect_to_signal('StateChanged',
156
155
entry_group_state_changed)
157
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
171
170
# End of Avahi example code
172
171
173
172
174
def _datetime_to_dbus(dt, variant_level=0):
175
"""Convert a UTC datetime.datetime() to a D-Bus type."""
176
return dbus.String(dt.isoformat(), variant_level=variant_level)
177
178
179
class Client(dbus.service.Object):
173
class Client(object):
180
174
"""A representation of a client host served by this server.
181
175
Attributes:
182
name: string; from the config file, used in log messages and
183
D-Bus identifiers
176
name: string; from the config file, used in log messages
184
177
fingerprint: string (40 or 32 hexadecimal digits); used to
185
178
uniquely identify the client
186
secret: bytestring; sent verbatim (over TLS) to client
187
host: string; available for use by the checker command
188
created: datetime.datetime(); (UTC) object creation
189
last_enabled: datetime.datetime(); (UTC)
190
enabled: bool()
191
last_checked_ok: datetime.datetime(); (UTC) or None
192
timeout: datetime.timedelta(); How long from last_checked_ok
193
until this client is invalid
194
interval: datetime.timedelta(); How often to start a new checker
195
disable_hook: If set, called by disable() as disable_hook(self)
196
checker: subprocess.Popen(); a running checker process used
197
to see if the client lives.
198
'None' if no process is running.
179
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); object creation, not client host
182
last_checked_ok: datetime.datetime() or None if not yet checked OK
183
timeout: datetime.timedelta(); How long from last_checked_ok
184
until this client is invalid
185
interval: datetime.timedelta(); How often to start a new checker
186
stop_hook: If set, called by stop() as stop_hook(self)
187
checker: subprocess.Popen(); a running checker process used
188
to see if the client lives.
189
'None' if no process is running.
199
190
checker_initiator_tag: a gobject event source tag, or None
200
disable_initiator_tag: - '' -
191
stop_initiator_tag: - '' -
201
192
checker_callback_tag: - '' -
202
193
checker_command: string; External command which is run to check if
203
194
client lives. %() expansions are done at
204
195
runtime with vars(self) as dict, so that for
205
196
instance %(name)s can be used in the command.
206
use_dbus: bool(); Whether to provide D-Bus interface and signals
207
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
197
Private attibutes:
198
_timeout: Real variable for 'timeout'
199
_interval: Real variable for 'interval'
200
_timeout_milliseconds: Used when calling gobject.timeout_add()
201
_interval_milliseconds: - '' -
208
202
"""
209
def timeout_milliseconds(self):
210
"Return the 'timeout' attribute in milliseconds"
211
return ((self.timeout.days * 24 * 60 * 60 * 1000)
212
+ (self.timeout.seconds * 1000)
213
+ (self.timeout.microseconds // 1000))
214
215
def interval_milliseconds(self):
216
"Return the 'interval' attribute in milliseconds"
217
return ((self.interval.days * 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds * 1000)
219
+ (self.interval.microseconds // 1000))
220
221
def __init__(self, name = None, disable_hook=None, config=None,
222
use_dbus=True):
203
def _set_timeout(self, timeout):
204
"Setter function for 'timeout' attribute"
205
self._timeout = timeout
206
self._timeout_milliseconds = ((self.timeout.days
207
* 24 * 60 * 60 * 1000)
208
+ (self.timeout.seconds * 1000)
209
+ (self.timeout.microseconds
210
// 1000))
211
timeout = property(lambda self: self._timeout,
212
_set_timeout)
213
del _set_timeout
214
def _set_interval(self, interval):
215
"Setter function for 'interval' attribute"
216
self._interval = interval
217
self._interval_milliseconds = ((self.interval.days
218
* 24 * 60 * 60 * 1000)
219
+ (self.interval.seconds
220
* 1000)
221
+ (self.interval.microseconds
222
// 1000))
223
interval = property(lambda self: self._interval,
224
_set_interval)
225
del _set_interval
226
def __init__(self, name = None, stop_hook=None, config=None):
223
227
"""Note: the 'checker' key in 'config' sets the
224
228
'checker_command' attribute and *not* the 'checker'
225
229
attribute."""
226
self.name = name
227
230
if config is None:
228
231
config = {}
232
self.name = name
229
233
logger.debug(u"Creating client %r", self.name)
230
self.use_dbus = False # During __init__
231
234
# Uppercase and remove spaces from fingerprint for later
232
235
# comparison purposes with return value from the fingerprint()
233
236
# function
234
self.fingerprint = (config["fingerprint"].upper()
235
.replace(u" ", u""))
237
self.fingerprint = config["fingerprint"].upper()\
238
.replace(u" ", u"")
236
239
logger.debug(u" Fingerprint: %s", self.fingerprint)
237
240
if "secret" in config:
238
241
self.secret = config["secret"].decode(u"base64")
239
242
elif "secfile" in config:
240
with closing(open(os.path.expanduser
241
(os.path.expandvars
242
(config["secfile"])))) as secfile:
243
self.secret = secfile.read()
243
secfile = open(os.path.expanduser(os.path.expandvars
244
(config["secfile"])))
245
self.secret = secfile.read()
246
secfile.close()
244
247
else:
245
248
raise TypeError(u"No secret or secfile for client %s"
246
249
% self.name)
247
250
self.host = config.get("host", "")
248
self.created = datetime.datetime.utcnow()
249
self.enabled = False
250
self.last_enabled = None
251
self.created = datetime.datetime.now()
251
252
self.last_checked_ok = None
252
253
self.timeout = string_to_delta(config["timeout"])
253
254
self.interval = string_to_delta(config["interval"])
254
self.disable_hook = disable_hook
255
self.stop_hook = stop_hook
255
256
self.checker = None
256
257
self.checker_initiator_tag = None
257
self.disable_initiator_tag = None
258
self.stop_initiator_tag = None
258
259
self.checker_callback_tag = None
259
self.checker_command = config["checker"]
260
self.last_connect = None
261
# Only now, when this client is initialized, can it show up on
262
# the D-Bus
263
self.use_dbus = use_dbus
264
if self.use_dbus:
265
self.dbus_object_path = (dbus.ObjectPath
266
("/clients/"
267
+ self.name.replace(".", "_")))
268
dbus.service.Object.__init__(self, bus,
269
self.dbus_object_path)
270
271
def enable(self):
260
self.check_command = config["checker"]
261
def start(self):
272
262
"""Start this client's checker and timeout hooks"""
273
self.last_enabled = datetime.datetime.utcnow()
274
263
# Schedule a new checker to be started an 'interval' from now,
275
264
# and every interval from then on.
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self.interval_milliseconds(),
278
self.start_checker))
265
self.checker_initiator_tag = gobject.timeout_add\
266
(self._interval_milliseconds,
267
self.start_checker)
279
268
# Also start a new checker *right now*.
280
269
self.start_checker()
281
# Schedule a disable() when 'timeout' has passed
282
self.disable_initiator_tag = (gobject.timeout_add
283
(self.timeout_milliseconds(),
284
self.disable))
285
self.enabled = True
286
if self.use_dbus:
287
# Emit D-Bus signals
288
self.PropertyChanged(dbus.String(u"enabled"),
289
dbus.Boolean(True, variant_level=1))
290
self.PropertyChanged(dbus.String(u"last_enabled"),
291
(_datetime_to_dbus(self.last_enabled,
292
variant_level=1)))
293
294
def disable(self):
295
"""Disable this client."""
296
if not getattr(self, "enabled", False):
270
# Schedule a stop() when 'timeout' has passed
271
self.stop_initiator_tag = gobject.timeout_add\
272
(self._timeout_milliseconds,
273
self.stop)
274
def stop(self):
275
"""Stop this client.
276
The possibility that a client might be restarted is left open,
277
but not currently used."""
278
# If this client doesn't have a secret, it is already stopped.
279
if hasattr(self, "secret") and self.secret:
280
logger.info(u"Stopping client %s", self.name)
281
self.secret = None
282
else:
297
283
return False
298
logger.info(u"Disabling client %s", self.name)
299
if getattr(self, "disable_initiator_tag", False):
300
gobject.source_remove(self.disable_initiator_tag)
301
self.disable_initiator_tag = None
284
if getattr(self, "stop_initiator_tag", False):
285
gobject.source_remove(self.stop_initiator_tag)
286
self.stop_initiator_tag = None
302
287
if getattr(self, "checker_initiator_tag", False):
303
288
gobject.source_remove(self.checker_initiator_tag)
304
289
self.checker_initiator_tag = None
305
290
self.stop_checker()
306
if self.disable_hook:
307
self.disable_hook(self)
308
self.enabled = False
309
if self.use_dbus:
310
# Emit D-Bus signal
311
self.PropertyChanged(dbus.String(u"enabled"),
312
dbus.Boolean(False, variant_level=1))
291
if self.stop_hook:
292
self.stop_hook(self)
313
293
# Do not run this again if called by a gobject.timeout_add
314
294
return False
315
316
295
def __del__(self):
317
self.disable_hook = None
318
self.disable()
319
320
def checker_callback(self, pid, condition, command):
296
self.stop_hook = None
297
self.stop()
298
def checker_callback(self, pid, condition):
321
299
"""The checker has completed, so take appropriate actions."""
300
now = datetime.datetime.now()
322
301
self.checker_callback_tag = None
323
302
self.checker = None
324
if self.use_dbus:
325
# Emit D-Bus signal
326
self.PropertyChanged(dbus.String(u"checker_running"),
327
dbus.Boolean(False, variant_level=1))
328
if os.WIFEXITED(condition):
329
exitstatus = os.WEXITSTATUS(condition)
330
if exitstatus == 0:
331
logger.info(u"Checker for %(name)s succeeded",
332
vars(self))
333
self.checked_ok()
334
else:
335
logger.info(u"Checker for %(name)s failed",
336
vars(self))
337
if self.use_dbus:
338
# Emit D-Bus signal
339
self.CheckerCompleted(dbus.Int16(exitstatus),
340
dbus.Int64(condition),
341
dbus.String(command))
342
else:
303
if os.WIFEXITED(condition) \
304
and (os.WEXITSTATUS(condition) == 0):
305
logger.info(u"Checker for %(name)s succeeded",
306
vars(self))
307
self.last_checked_ok = now
308
gobject.source_remove(self.stop_initiator_tag)
309
self.stop_initiator_tag = gobject.timeout_add\
310
(self._timeout_milliseconds,
311
self.stop)
312
elif not os.WIFEXITED(condition):
343
313
logger.warning(u"Checker for %(name)s crashed?",
344
314
vars(self))
345
if self.use_dbus:
346
# Emit D-Bus signal
347
self.CheckerCompleted(dbus.Int16(-1),
348
dbus.Int64(condition),
349
dbus.String(command))
350
351
def checked_ok(self):
352
"""Bump up the timeout for this client.
353
This should only be called when the client has been seen,
354
alive and well.
355
"""
356
self.last_checked_ok = datetime.datetime.utcnow()
357
gobject.source_remove(self.disable_initiator_tag)
358
self.disable_initiator_tag = (gobject.timeout_add
359
(self.timeout_milliseconds(),
360
self.disable))
361
if self.use_dbus:
362
# Emit D-Bus signal
363
self.PropertyChanged(
364
dbus.String(u"last_checked_ok"),
365
(_datetime_to_dbus(self.last_checked_ok,
366
variant_level=1)))
367
315
else:
316
logger.info(u"Checker for %(name)s failed",
317
vars(self))
368
318
def start_checker(self):
369
319
"""Start a new checker subprocess if one is not running.
370
320
If a checker already exists, leave it running and do
379
329
# is as it should be.
380
330
if self.checker is None:
381
331
try:
382
# In case checker_command has exactly one % operator
383
command = self.checker_command % self.host
332
# In case check_command has exactly one % operator
333
command = self.check_command % self.host
384
334
except TypeError:
385
335
# Escape attributes for the shell
386
336
escaped_attrs = dict((key, re.escape(str(val)))
387
337
for key, val in
388
338
vars(self).iteritems())
389
339
try:
390
command = self.checker_command % escaped_attrs
340
command = self.check_command % escaped_attrs
391
341
except TypeError, error:
392
342
logger.error(u'Could not format string "%s":'
393
u' %s', self.checker_command, error)
343
u' %s', self.check_command, error)
394
344
return True # Try again later
395
345
try:
396
346
logger.info(u"Starting checker %r for %s",
402
352
self.checker = subprocess.Popen(command,
403
353
close_fds=True,
404
354
shell=True, cwd="/")
405
if self.use_dbus:
406
# Emit D-Bus signal
407
self.CheckerStarted(command)
408
self.PropertyChanged(
409
dbus.String("checker_running"),
410
dbus.Boolean(True, variant_level=1))
411
self.checker_callback_tag = (gobject.child_watch_add
412
(self.checker.pid,
413
self.checker_callback,
414
data=command))
355
self.checker_callback_tag = gobject.child_watch_add\
356
(self.checker.pid,
357
self.checker_callback)
415
358
except OSError, error:
416
359
logger.error(u"Failed to start subprocess: %s",
417
360
error)
418
361
# Re-run this periodically if run by gobject.timeout_add
419
362
return True
420
421
363
def stop_checker(self):
422
364
"""Force the checker process, if any, to stop."""
423
365
if self.checker_callback_tag:
435
377
if error.errno != errno.ESRCH: # No such process
436
378
raise
437
379
self.checker = None
438
if self.use_dbus:
439
self.PropertyChanged(dbus.String(u"checker_running"),
440
dbus.Boolean(False, variant_level=1))
441
442
380
def still_valid(self):
443
381
"""Has the timeout not yet passed for this client?"""
444
if not getattr(self, "enabled", False):
445
return False
446
now = datetime.datetime.utcnow()
382
now = datetime.datetime.now()
447
383
if self.last_checked_ok is None:
448
384
return now < (self.created + self.timeout)
449
385
else:
450
386
return now < (self.last_checked_ok + self.timeout)
451
452
## D-Bus methods & signals
453
_interface = u"se.bsnet.fukt.Mandos.Client"
454
455
# CheckedOK - method
456
CheckedOK = dbus.service.method(_interface)(checked_ok)
457
CheckedOK.__name__ = "CheckedOK"
458
459
# CheckerCompleted - signal
460
@dbus.service.signal(_interface, signature="nxs")
461
def CheckerCompleted(self, exitcode, waitstatus, command):
462
"D-Bus signal"
463
pass
464
465
# CheckerStarted - signal
466
@dbus.service.signal(_interface, signature="s")
467
def CheckerStarted(self, command):
468
"D-Bus signal"
469
pass
470
471
# GetAllProperties - method
472
@dbus.service.method(_interface, out_signature="a{sv}")
473
def GetAllProperties(self):
474
"D-Bus method"
475
return dbus.Dictionary({
476
dbus.String("name"):
477
dbus.String(self.name, variant_level=1),
478
dbus.String("fingerprint"):
479
dbus.String(self.fingerprint, variant_level=1),
480
dbus.String("host"):
481
dbus.String(self.host, variant_level=1),
482
dbus.String("created"):
483
_datetime_to_dbus(self.created, variant_level=1),
484
dbus.String("last_enabled"):
485
(_datetime_to_dbus(self.last_enabled,
486
variant_level=1)
487
if self.last_enabled is not None
488
else dbus.Boolean(False, variant_level=1)),
489
dbus.String("enabled"):
490
dbus.Boolean(self.enabled, variant_level=1),
491
dbus.String("last_checked_ok"):
492
(_datetime_to_dbus(self.last_checked_ok,
493
variant_level=1)
494
if self.last_checked_ok is not None
495
else dbus.Boolean (False, variant_level=1)),
496
dbus.String("timeout"):
497
dbus.UInt64(self.timeout_milliseconds(),
498
variant_level=1),
499
dbus.String("interval"):
500
dbus.UInt64(self.interval_milliseconds(),
501
variant_level=1),
502
dbus.String("checker"):
503
dbus.String(self.checker_command,
504
variant_level=1),
505
dbus.String("checker_running"):
506
dbus.Boolean(self.checker is not None,
507
variant_level=1),
508
dbus.String("object_path"):
509
dbus.ObjectPath(self.dbus_object_path,
510
variant_level=1)
511
}, signature="sv")
512
513
# IsStillValid - method
514
IsStillValid = (dbus.service.method(_interface, out_signature="b")
515
(still_valid))
516
IsStillValid.__name__ = "IsStillValid"
517
518
# PropertyChanged - signal
519
@dbus.service.signal(_interface, signature="sv")
520
def PropertyChanged(self, property, value):
521
"D-Bus signal"
522
pass
523
524
# SetChecker - method
525
@dbus.service.method(_interface, in_signature="s")
526
def SetChecker(self, checker):
527
"D-Bus setter method"
528
self.checker_command = checker
529
# Emit D-Bus signal
530
self.PropertyChanged(dbus.String(u"checker"),
531
dbus.String(self.checker_command,
532
variant_level=1))
533
534
# SetHost - method
535
@dbus.service.method(_interface, in_signature="s")
536
def SetHost(self, host):
537
"D-Bus setter method"
538
self.host = host
539
# Emit D-Bus signal
540
self.PropertyChanged(dbus.String(u"host"),
541
dbus.String(self.host, variant_level=1))
542
543
# SetInterval - method
544
@dbus.service.method(_interface, in_signature="t")
545
def SetInterval(self, milliseconds):
546
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
547
# Emit D-Bus signal
548
self.PropertyChanged(dbus.String(u"interval"),
549
(dbus.UInt64(self.interval_milliseconds(),
550
variant_level=1)))
551
552
# SetSecret - method
553
@dbus.service.method(_interface, in_signature="ay",
554
byte_arrays=True)
555
def SetSecret(self, secret):
556
"D-Bus setter method"
557
self.secret = str(secret)
558
559
# SetTimeout - method
560
@dbus.service.method(_interface, in_signature="t")
561
def SetTimeout(self, milliseconds):
562
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
563
# Emit D-Bus signal
564
self.PropertyChanged(dbus.String(u"timeout"),
565
(dbus.UInt64(self.timeout_milliseconds(),
566
variant_level=1)))
567
568
# Enable - method
569
Enable = dbus.service.method(_interface)(enable)
570
Enable.__name__ = "Enable"
571
572
# StartChecker - method
573
@dbus.service.method(_interface)
574
def StartChecker(self):
575
"D-Bus method"
576
self.start_checker()
577
578
# Disable - method
579
@dbus.service.method(_interface)
580
def Disable(self):
581
"D-Bus method"
582
self.disable()
583
584
# StopChecker - method
585
StopChecker = dbus.service.method(_interface)(stop_checker)
586
StopChecker.__name__ = "StopChecker"
587
588
del _interface
589
387
590
388
591
389
def peer_certificate(session):
592
390
"Return the peer's OpenPGP certificate as a bytestring"
593
391
# If not an OpenPGP certificate...
594
if (gnutls.library.functions
595
.gnutls_certificate_type_get(session._c_object)
596
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
392
if gnutls.library.functions.gnutls_certificate_type_get\
393
(session._c_object) \
394
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
597
395
# ...do the normal thing
598
396
return session.peer_certificate
599
list_size = ctypes.c_uint(1)
600
cert_list = (gnutls.library.functions
601
.gnutls_certificate_get_peers
602
(session._c_object, ctypes.byref(list_size)))
603
if not bool(cert_list) and list_size.value != 0:
604
raise gnutls.errors.GNUTLSError("error getting peer"
605
" certificate")
397
list_size = ctypes.c_uint()
398
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
399
(session._c_object, ctypes.byref(list_size))
606
400
if list_size.value == 0:
607
401
return None
608
402
cert = cert_list[0]
612
406
def fingerprint(openpgp):
613
407
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
614
408
# New GnuTLS "datum" with the OpenPGP public key
615
datum = (gnutls.library.types
616
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
617
ctypes.POINTER
618
(ctypes.c_ubyte)),
619
ctypes.c_uint(len(openpgp))))
409
datum = gnutls.library.types.gnutls_datum_t\
410
(ctypes.cast(ctypes.c_char_p(openpgp),
411
ctypes.POINTER(ctypes.c_ubyte)),
412
ctypes.c_uint(len(openpgp)))
620
413
# New empty GnuTLS certificate
621
414
crt = gnutls.library.types.gnutls_openpgp_crt_t()
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
415
gnutls.library.functions.gnutls_openpgp_crt_init\
416
(ctypes.byref(crt))
624
417
# Import the OpenPGP public key into the certificate
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
627
gnutls.library.constants
628
.GNUTLS_OPENPGP_FMT_RAW))
418
gnutls.library.functions.gnutls_openpgp_crt_import\
419
(crt, ctypes.byref(datum),
420
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
629
421
# Verify the self signature in the key
630
422
crtverify = ctypes.c_uint()
631
(gnutls.library.functions
632
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
423
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
424
(crt, 0, ctypes.byref(crtverify))
633
425
if crtverify.value != 0:
634
426
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
635
427
raise gnutls.errors.CertificateSecurityError("Verify failed")
637
429
buf = ctypes.create_string_buffer(20)
638
430
buf_len = ctypes.c_size_t()
639
431
# Get the fingerprint from the certificate into the buffer
640
(gnutls.library.functions
641
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
642
ctypes.byref(buf_len)))
432
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
433
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
643
434
# Deinit the certificate
644
435
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
645
436
# Convert the buffer to a Python bytestring
656
447
657
448
def handle(self):
658
449
logger.info(u"TCP connection from: %s",
659
unicode(self.client_address))
660
session = (gnutls.connection
661
.ClientSession(self.request,
662
gnutls.connection
663
.X509Credentials()))
450
unicode(self.client_address))
451
session = gnutls.connection.ClientSession\
452
(self.request, gnutls.connection.X509Credentials())
664
453
665
454
line = self.request.makefile().readline()
666
455
logger.debug(u"Protocol version: %r", line)
677
466
# using OpenPGP certificates.
678
467
679
468
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
680
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
681
# "+DHE-DSS"))
682
# Use a fallback default, since this MUST be set.
683
priority = self.server.settings.get("priority", "NORMAL")
684
(gnutls.library.functions
685
.gnutls_priority_set_direct(session._c_object,
686
priority, None))
469
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
470
# "+DHE-DSS"))
471
priority = "NORMAL" # Fallback default, since this
472
# MUST be set.
473
if self.server.settings["priority"]:
474
priority = self.server.settings["priority"]
475
gnutls.library.functions.gnutls_priority_set_direct\
476
(session._c_object, priority, None)
687
477
688
478
try:
689
479
session.handshake()
692
482
# Do not run session.bye() here: the session is not
693
483
# established. Just abandon the request.
694
484
return
695
logger.debug(u"Handshake succeeded")
696
485
try:
697
486
fpr = fingerprint(peer_certificate(session))
698
487
except (TypeError, gnutls.errors.GNUTLSError), error:
700
489
session.bye()
701
490
return
702
491
logger.debug(u"Fingerprint: %s", fpr)
703
492
client = None
704
493
for c in self.server.clients:
705
494
if c.fingerprint == fpr:
706
495
client = c
707
496
break
708
else:
497
if not client:
709
498
logger.warning(u"Client not found for fingerprint: %s",
710
499
fpr)
711
500
session.bye()
718
507
vars(client))
719
508
session.bye()
720
509
return
721
## This won't work here, since we're in a fork.
722
# client.checked_ok()
723
510
sent_size = 0
724
511
while sent_size < len(client.secret):
725
512
sent = session.send(client.secret[sent_size:])
730
517
session.bye()
731
518
732
519
733
class IPv6_TCPServer(SocketServer.ForkingMixIn,
734
SocketServer.TCPServer, object):
520
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
735
521
"""IPv6 TCP server. Accepts 'None' as address and/or port.
736
522
Attributes:
737
523
settings: Server settings
765
551
u" bind to interface %s",
766
552
self.settings["interface"])
767
553
else:
768
raise
554
raise error
769
555
# Only bind(2) the socket if we really need to.
770
556
if self.server_address[0] or self.server_address[1]:
771
557
if not self.server_address[0]:
792
578
793
579
def string_to_delta(interval):
794
580
"""Parse a string and return a datetime.timedelta
795
581
796
582
>>> string_to_delta('7d')
797
583
datetime.timedelta(7)
798
584
>>> string_to_delta('60s')
850
636
elif state == avahi.ENTRY_GROUP_FAILURE:
851
637
logger.critical(u"Avahi: Error in group state changed %s",
852
638
unicode(error))
853
raise AvahiGroupError(u"State changed: %s" % unicode(error))
639
raise AvahiGroupError("State changed: %s", str(error))
854
640
855
641
def if_nametoindex(interface):
856
642
"""Call the C function if_nametoindex(), or equivalent"""
857
643
global if_nametoindex
858
644
try:
859
if_nametoindex = (ctypes.cdll.LoadLibrary
860
(ctypes.util.find_library("c"))
861
.if_nametoindex)
645
if_nametoindex = ctypes.cdll.LoadLibrary\
646
(ctypes.util.find_library("c")).if_nametoindex
862
647
except (OSError, AttributeError):
863
648
if "struct" not in sys.modules:
864
649
import struct
867
652
def if_nametoindex(interface):
868
653
"Get an interface index the hard way, i.e. using fcntl()"
869
654
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
870
with closing(socket.socket()) as s:
871
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
872
struct.pack("16s16x", interface))
655
s = socket.socket()
656
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
657
struct.pack("16s16x", interface))
658
s.close()
873
659
interface_index = struct.unpack("I", ifreq[16:20])[0]
874
660
return interface_index
875
661
return if_nametoindex(interface)
899
685
900
686
901
687
def main():
902
parser = optparse.OptionParser(version = "%%prog %s" % version)
688
parser = OptionParser(version = "%%prog %s" % version)
903
689
parser.add_option("-i", "--interface", type="string",
904
690
metavar="IF", help="Bind to interface IF")
905
691
parser.add_option("-a", "--address", type="string",
906
692
help="Address to listen for requests on")
907
693
parser.add_option("-p", "--port", type="int",
908
694
help="Port number to receive requests on")
909
parser.add_option("--check", action="store_true",
695
parser.add_option("--check", action="store_true", default=False,
910
696
help="Run self-test")
911
697
parser.add_option("--debug", action="store_true",
912
698
help="Debug mode; run in foreground and log to"
919
705
default="/etc/mandos", metavar="DIR",
920
706
help="Directory to search for configuration"
921
707
" files")
922
parser.add_option("--no-dbus", action="store_false",
923
dest="use_dbus",
924
help="Do not provide D-Bus system bus"
925
" interface")
926
708
options = parser.parse_args()[0]
927
709
928
710
if options.check:
938
720
"priority":
939
721
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
940
722
"servicename": "Mandos",
941
"use_dbus": "True",
942
723
}
943
724
944
725
# Parse config file for server-global settings
947
728
server_config.read(os.path.join(options.configdir, "mandos.conf"))
948
729
# Convert the SafeConfigParser object to a dict
949
730
server_settings = server_config.defaults()
950
# Use the appropriate methods on the non-string config options
951
server_settings["debug"] = server_config.getboolean("DEFAULT",
952
"debug")
953
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
954
"use_dbus")
955
if server_settings["port"]:
956
server_settings["port"] = server_config.getint("DEFAULT",
957
"port")
731
# Use getboolean on the boolean config option
732
server_settings["debug"] = server_config.getboolean\
733
("DEFAULT", "debug")
958
734
del server_config
959
735
960
736
# Override the settings from the config file with command line
961
737
# options, if set.
962
738
for option in ("interface", "address", "port", "debug",
963
"priority", "servicename", "configdir",
964
"use_dbus"):
739
"priority", "servicename", "configdir"):
965
740
value = getattr(options, option)
966
741
if value is not None:
967
742
server_settings[option] = value
968
743
del options
969
744
# Now we have our good server settings in "server_settings"
970
745
971
# For convenience
972
746
debug = server_settings["debug"]
973
use_dbus = server_settings["use_dbus"]
974
747
975
748
if not debug:
976
749
syslogger.setLevel(logging.WARNING)
977
750
console.setLevel(logging.WARNING)
978
751
979
752
if server_settings["servicename"] != "Mandos":
980
syslogger.setFormatter(logging.Formatter
753
syslogger.setFormatter(logging.Formatter\
981
754
('Mandos (%s): %%(levelname)s:'
982
755
' %%(message)s'
983
756
% server_settings["servicename"]))
985
758
# Parse config file with clients
986
759
client_defaults = { "timeout": "1h",
987
760
"interval": "5m",
988
"checker": "fping -q -- %%(host)s",
761
"checker": "fping -q -- %(host)s",
989
762
"host": "",
990
763
}
991
764
client_config = ConfigParser.SafeConfigParser(client_defaults)
1001
774
pidfilename = "/var/run/mandos.pid"
1002
775
try:
1003
776
pidfile = open(pidfilename, "w")
1004
except IOError:
777
except IOError, error:
1005
778
logger.error("Could not open file %r", pidfilename)
1006
779
1007
try:
1008
uid = pwd.getpwnam("_mandos").pw_uid
1009
gid = pwd.getpwnam("_mandos").pw_gid
1010
except KeyError:
1011
try:
1012
uid = pwd.getpwnam("mandos").pw_uid
1013
gid = pwd.getpwnam("mandos").pw_gid
1014
except KeyError:
1015
try:
1016
uid = pwd.getpwnam("nobody").pw_uid
1017
gid = pwd.getpwnam("nogroup").pw_gid
1018
except KeyError:
1019
uid = 65534
1020
gid = 65534
1021
try:
780
uid = 65534
781
gid = 65534
782
try:
783
uid = pwd.getpwnam("mandos").pw_uid
784
except KeyError:
785
try:
786
uid = pwd.getpwnam("nobody").pw_uid
787
except KeyError:
788
pass
789
try:
790
gid = pwd.getpwnam("mandos").pw_gid
791
except KeyError:
792
try:
793
gid = pwd.getpwnam("nogroup").pw_gid
794
except KeyError:
795
pass
796
try:
797
os.setuid(uid)
1022
798
os.setgid(gid)
1023
os.setuid(uid)
1024
799
except OSError, error:
1025
800
if error[0] != errno.EPERM:
1026
801
raise error
1027
802
1028
# Enable all possible GnuTLS debugging
1029
if debug:
1030
# "Use a log level over 10 to enable all debugging options."
1031
# - GnuTLS manual
1032
gnutls.library.functions.gnutls_global_set_log_level(11)
1033
1034
@gnutls.library.types.gnutls_log_func
1035
def debug_gnutls(level, string):
1036
logger.debug("GnuTLS: %s", string[:-1])
1037
1038
(gnutls.library.functions
1039
.gnutls_global_set_log_function(debug_gnutls))
1040
1041
803
global service
1042
804
service = AvahiService(name = server_settings["servicename"],
1043
805
servicetype = "_mandos._tcp", )
1044
806
if server_settings["interface"]:
1045
service.interface = (if_nametoindex
1046
(server_settings["interface"]))
807
service.interface = if_nametoindex\
808
(server_settings["interface"])
1047
809
1048
810
global main_loop
1049
811
global bus
1056
818
avahi.DBUS_PATH_SERVER),
1057
819
avahi.DBUS_INTERFACE_SERVER)
1058
820
# End of Avahi example code
1059
if use_dbus:
1060
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
821
822
def remove_from_clients(client):
823
clients.remove(client)
824
if not clients:
825
logger.critical(u"No clients left, exiting")
826
sys.exit()
1061
827
1062
828
clients.update(Set(Client(name = section,
829
stop_hook = remove_from_clients,
1063
830
config
1064
= dict(client_config.items(section)),
1065
use_dbus = use_dbus)
831
= dict(client_config.items(section)))
1066
832
for section in client_config.sections()))
1067
833
if not clients:
1068
logger.warning(u"No clients defined")
834
logger.critical(u"No clients defined")
835
sys.exit(1)
1069
836
1070
837
if debug:
1071
838
# Redirect stdin so all checkers get /dev/null
1103
870
1104
871
while clients:
1105
872
client = clients.pop()
1106
client.disable_hook = None
1107
client.disable()
873
client.stop_hook = None
874
client.stop()
1108
875
1109
876
atexit.register(cleanup)
1110
877
1113
880
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1114
881
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1115
882
1116
if use_dbus:
1117
class MandosServer(dbus.service.Object):
1118
"""A D-Bus proxy object"""
1119
def __init__(self):
1120
dbus.service.Object.__init__(self, bus, "/")
1121
_interface = u"se.bsnet.fukt.Mandos"
1122
1123
@dbus.service.signal(_interface, signature="oa{sv}")
1124
def ClientAdded(self, objpath, properties):
1125
"D-Bus signal"
1126
pass
1127
1128
@dbus.service.signal(_interface, signature="os")
1129
def ClientRemoved(self, objpath, name):
1130
"D-Bus signal"
1131
pass
1132
1133
@dbus.service.method(_interface, out_signature="ao")
1134
def GetAllClients(self):
1135
"D-Bus method"
1136
return dbus.Array(c.dbus_object_path for c in clients)
1137
1138
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1139
def GetAllClientsWithProperties(self):
1140
"D-Bus method"
1141
return dbus.Dictionary(
1142
((c.dbus_object_path, c.GetAllProperties())
1143
for c in clients),
1144
signature="oa{sv}")
1145
1146
@dbus.service.method(_interface, in_signature="o")
1147
def RemoveClient(self, object_path):
1148
"D-Bus method"
1149
for c in clients:
1150
if c.dbus_object_path == object_path:
1151
clients.remove(c)
1152
# Don't signal anything except ClientRemoved
1153
c.use_dbus = False
1154
c.disable()
1155
# Emit D-Bus signal
1156
self.ClientRemoved(object_path, c.name)
1157
return
1158
raise KeyError
1159
1160
del _interface
1161
1162
mandos_server = MandosServer()
1163
1164
883
for client in clients:
1165
if use_dbus:
1166
# Emit D-Bus signal
1167
mandos_server.ClientAdded(client.dbus_object_path,
1168
client.GetAllProperties())
1169
client.enable()
884
client.start()
1170
885
1171
886
tcp_server.enable()
1172
887
tcp_server.server_activate()
1190
905
1191
906
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1192
907
lambda *args, **kwargs:
1193
(tcp_server.handle_request
1194
(*args[2:], **kwargs) or True))
908
tcp_server.handle_request\
909
(*args[2:], **kwargs) or True)
1195
910
1196
911
logger.debug(u"Starting main loop")
1197
912
main_loop.run()
1198
913
except AvahiError, error:
1199
logger.critical(u"AvahiError: %s", error)
914
logger.critical(u"AvahiError: %s" + unicode(error))
1200
915
sys.exit(1)
1201
916
except KeyboardInterrupt:
1202
917
if debug:
1203
print >> sys.stderr
1204
logger.debug("Server received KeyboardInterrupt")
1205
logger.debug("Server exiting")
918
print
1206
919
1207
920
if __name__ == '__main__':
1208
921
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0