To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 226
- compare with another revision
- download diff
- download tarball
- view history from revision 226
- Committer: Teddy Hogeborn
- Date: 2008-10-04 20:09:53 UTC
- Revision ID: teddy@fukt.bsnet.se-20081004200953-7j0fjlq6fqsxs9t2
* Makefile (DOCS): Added "plugins.d/askpass-fifo.8mandos".
(install-client-nokey): Also install
"plugins.d/askpass-fifo.8mandos".
(uninstall-client): Also uninstall "plugins.d/askpass-fifo.8mandos".
* plugins.d/askpass-fifo.xml: New.
(install-client-nokey): Also install
"plugins.d/askpass-fifo.8mandos".
(uninstall-client): Also uninstall "plugins.d/askpass-fifo.8mandos".
* plugins.d/askpass-fifo.xml: New.
- files added:
- debian/mandos-client.config
- files removed:
- NEWS
- files modified:
- INSTALL
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import division, with_statement, absolute_import
33
from __future__ import division
35
34
36
35
import SocketServer
37
36
import socket
38
import optparse
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
59
from contextlib import closing
60
58
61
59
import dbus
62
import dbus.service
63
60
import gobject
64
61
import avahi
65
62
from dbus.mainloop.glib import DBusGMainLoop
66
63
import ctypes
67
64
import ctypes.util
68
65
69
version = "1.0.5"
66
version = "1.0"
70
67
71
68
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
77
74
logger.addHandler(syslogger)
78
75
79
76
console = logging.StreamHandler()
82
79
logger.addHandler(console)
83
80
84
81
class AvahiError(Exception):
85
def __init__(self, value, *args, **kwargs):
82
def __init__(self, value):
86
83
self.value = value
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
84
super(AvahiError, self).__init__()
85
def __str__(self):
86
return repr(self.value)
90
87
91
88
class AvahiServiceError(AvahiError):
92
89
pass
112
109
a sensible number of times
113
110
"""
114
111
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
112
servicetype = None, port = None, TXT = None, domain = "",
113
host = "", max_renames = 32768):
117
114
self.interface = interface
118
115
self.name = name
119
116
self.type = servicetype
120
117
self.port = port
121
self.TXT = TXT if TXT is not None else []
118
if TXT is None:
119
self.TXT = []
120
else:
121
self.TXT = TXT
122
122
self.domain = domain
123
123
self.host = host
124
124
self.rename_count = 0
129
129
logger.critical(u"No suitable Zeroconf service name found"
130
130
u" after %i retries, exiting.",
131
131
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
132
raise AvahiServiceError("Too many renames")
133
133
self.name = server.GetAlternativeServiceName(self.name)
134
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
136
syslogger.setFormatter(logging.Formatter\
137
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
138
' %%(message)s' % self.name))
139
139
self.remove()
140
140
self.add()
141
141
self.rename_count += 1
147
147
"""Derived from the Avahi example code"""
148
148
global group
149
149
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
150
group = dbus.Interface\
151
(bus.get_object(avahi.DBUS_NAME,
152
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
154
group.connect_to_signal('StateChanged',
155
155
entry_group_state_changed)
156
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
170
170
# End of Avahi example code
171
171
172
172
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
173
class Client(object):
179
174
"""A representation of a client host served by this server.
180
175
Attributes:
181
name: string; from the config file, used in log messages
176
name: string; from the config file, used in log messages
182
177
fingerprint: string (40 or 32 hexadecimal digits); used to
183
178
uniquely identify the client
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
179
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); object creation, not client host
182
last_checked_ok: datetime.datetime() or None if not yet checked OK
183
timeout: datetime.timedelta(); How long from last_checked_ok
184
until this client is invalid
185
interval: datetime.timedelta(); How often to start a new checker
186
stop_hook: If set, called by stop() as stop_hook(self)
187
checker: subprocess.Popen(); a running checker process used
188
to see if the client lives.
189
'None' if no process is running.
197
190
checker_initiator_tag: a gobject event source tag, or None
198
disable_initiator_tag: - '' -
191
stop_initiator_tag: - '' -
199
192
checker_callback_tag: - '' -
200
193
checker_command: string; External command which is run to check if
201
194
client lives. %() expansions are done at
202
195
runtime with vars(self) as dict, so that for
203
196
instance %(name)s can be used in the command.
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
197
Private attibutes:
198
_timeout: Real variable for 'timeout'
199
_interval: Real variable for 'interval'
200
_timeout_milliseconds: Used when calling gobject.timeout_add()
201
_interval_milliseconds: - '' -
206
202
"""
207
def timeout_milliseconds(self):
208
"Return the 'timeout' attribute in milliseconds"
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
212
213
def interval_milliseconds(self):
214
"Return the 'interval' attribute in milliseconds"
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
218
219
def __init__(self, name = None, disable_hook=None, config=None,
220
use_dbus=True):
203
def _set_timeout(self, timeout):
204
"Setter function for 'timeout' attribute"
205
self._timeout = timeout
206
self._timeout_milliseconds = ((self.timeout.days
207
* 24 * 60 * 60 * 1000)
208
+ (self.timeout.seconds * 1000)
209
+ (self.timeout.microseconds
210
// 1000))
211
timeout = property(lambda self: self._timeout,
212
_set_timeout)
213
del _set_timeout
214
def _set_interval(self, interval):
215
"Setter function for 'interval' attribute"
216
self._interval = interval
217
self._interval_milliseconds = ((self.interval.days
218
* 24 * 60 * 60 * 1000)
219
+ (self.interval.seconds
220
* 1000)
221
+ (self.interval.microseconds
222
// 1000))
223
interval = property(lambda self: self._interval,
224
_set_interval)
225
del _set_interval
226
def __init__(self, name = None, stop_hook=None, config=None):
221
227
"""Note: the 'checker' key in 'config' sets the
222
228
'checker_command' attribute and *not* the 'checker'
223
229
attribute."""
224
self.name = name
225
230
if config is None:
226
231
config = {}
232
self.name = name
227
233
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
229
if self.use_dbus:
230
self.dbus_object_path = (dbus.ObjectPath
231
("/Mandos/clients/"
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
235
234
# Uppercase and remove spaces from fingerprint for later
236
235
# comparison purposes with return value from the fingerprint()
237
236
# function
238
self.fingerprint = (config["fingerprint"].upper()
239
.replace(u" ", u""))
237
self.fingerprint = config["fingerprint"].upper()\
238
.replace(u" ", u"")
240
239
logger.debug(u" Fingerprint: %s", self.fingerprint)
241
240
if "secret" in config:
242
241
self.secret = config["secret"].decode(u"base64")
243
242
elif "secfile" in config:
244
with closing(open(os.path.expanduser
245
(os.path.expandvars
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
243
secfile = open(os.path.expanduser(os.path.expandvars
244
(config["secfile"])))
245
self.secret = secfile.read()
246
secfile.close()
248
247
else:
249
248
raise TypeError(u"No secret or secfile for client %s"
250
249
% self.name)
251
250
self.host = config.get("host", "")
252
self.created = datetime.datetime.utcnow()
253
self.enabled = False
254
self.last_enabled = None
251
self.created = datetime.datetime.now()
255
252
self.last_checked_ok = None
256
253
self.timeout = string_to_delta(config["timeout"])
257
254
self.interval = string_to_delta(config["interval"])
258
self.disable_hook = disable_hook
255
self.stop_hook = stop_hook
259
256
self.checker = None
260
257
self.checker_initiator_tag = None
261
self.disable_initiator_tag = None
258
self.stop_initiator_tag = None
262
259
self.checker_callback_tag = None
263
self.checker_command = config["checker"]
264
265
def enable(self):
260
self.check_command = config["checker"]
261
def start(self):
266
262
"""Start this client's checker and timeout hooks"""
267
self.last_enabled = datetime.datetime.utcnow()
268
263
# Schedule a new checker to be started an 'interval' from now,
269
264
# and every interval from then on.
270
self.checker_initiator_tag = (gobject.timeout_add
271
(self.interval_milliseconds(),
272
self.start_checker))
265
self.checker_initiator_tag = gobject.timeout_add\
266
(self._interval_milliseconds,
267
self.start_checker)
273
268
# Also start a new checker *right now*.
274
269
self.start_checker()
275
# Schedule a disable() when 'timeout' has passed
276
self.disable_initiator_tag = (gobject.timeout_add
277
(self.timeout_milliseconds(),
278
self.disable))
279
self.enabled = True
280
if self.use_dbus:
281
# Emit D-Bus signals
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
286
variant_level=1)))
287
288
def disable(self):
289
"""Disable this client."""
290
if not getattr(self, "enabled", False):
270
# Schedule a stop() when 'timeout' has passed
271
self.stop_initiator_tag = gobject.timeout_add\
272
(self._timeout_milliseconds,
273
self.stop)
274
def stop(self):
275
"""Stop this client.
276
The possibility that a client might be restarted is left open,
277
but not currently used."""
278
# If this client doesn't have a secret, it is already stopped.
279
if hasattr(self, "secret") and self.secret:
280
logger.info(u"Stopping client %s", self.name)
281
self.secret = None
282
else:
291
283
return False
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
294
gobject.source_remove(self.disable_initiator_tag)
295
self.disable_initiator_tag = None
284
if getattr(self, "stop_initiator_tag", False):
285
gobject.source_remove(self.stop_initiator_tag)
286
self.stop_initiator_tag = None
296
287
if getattr(self, "checker_initiator_tag", False):
297
288
gobject.source_remove(self.checker_initiator_tag)
298
289
self.checker_initiator_tag = None
299
290
self.stop_checker()
300
if self.disable_hook:
301
self.disable_hook(self)
302
self.enabled = False
303
if self.use_dbus:
304
# Emit D-Bus signal
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
291
if self.stop_hook:
292
self.stop_hook(self)
307
293
# Do not run this again if called by a gobject.timeout_add
308
294
return False
309
310
295
def __del__(self):
311
self.disable_hook = None
312
self.disable()
313
314
def checker_callback(self, pid, condition, command):
296
self.stop_hook = None
297
self.stop()
298
def checker_callback(self, pid, condition):
315
299
"""The checker has completed, so take appropriate actions."""
300
now = datetime.datetime.now()
316
301
self.checker_callback_tag = None
317
302
self.checker = None
318
if self.use_dbus:
319
# Emit D-Bus signal
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
303
if os.WIFEXITED(condition) \
304
and (os.WEXITSTATUS(condition) == 0):
324
305
logger.info(u"Checker for %(name)s succeeded",
325
306
vars(self))
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
331
self.bump_timeout()
307
self.last_checked_ok = now
308
gobject.source_remove(self.stop_initiator_tag)
309
self.stop_initiator_tag = gobject.timeout_add\
310
(self._timeout_milliseconds,
311
self.stop)
332
312
elif not os.WIFEXITED(condition):
333
313
logger.warning(u"Checker for %(name)s crashed?",
334
314
vars(self))
335
if self.use_dbus:
336
# Emit D-Bus signal
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
340
315
else:
341
316
logger.info(u"Checker for %(name)s failed",
342
317
vars(self))
343
if self.use_dbus:
344
# Emit D-Bus signal
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
348
349
def bump_timeout(self):
350
"""Bump up the timeout for this client.
351
This should only be called when the client has been seen,
352
alive and well.
353
"""
354
self.last_checked_ok = datetime.datetime.utcnow()
355
gobject.source_remove(self.disable_initiator_tag)
356
self.disable_initiator_tag = (gobject.timeout_add
357
(self.timeout_milliseconds(),
358
self.disable))
359
if self.use_dbus:
360
# Emit D-Bus signal
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
364
variant_level=1)))
365
366
318
def start_checker(self):
367
319
"""Start a new checker subprocess if one is not running.
368
320
If a checker already exists, leave it running and do
377
329
# is as it should be.
378
330
if self.checker is None:
379
331
try:
380
# In case checker_command has exactly one % operator
381
command = self.checker_command % self.host
332
# In case check_command has exactly one % operator
333
command = self.check_command % self.host
382
334
except TypeError:
383
335
# Escape attributes for the shell
384
336
escaped_attrs = dict((key, re.escape(str(val)))
385
337
for key, val in
386
338
vars(self).iteritems())
387
339
try:
388
command = self.checker_command % escaped_attrs
340
command = self.check_command % escaped_attrs
389
341
except TypeError, error:
390
342
logger.error(u'Could not format string "%s":'
391
u' %s', self.checker_command, error)
343
u' %s', self.check_command, error)
392
344
return True # Try again later
393
345
try:
394
346
logger.info(u"Starting checker %r for %s",
400
352
self.checker = subprocess.Popen(command,
401
353
close_fds=True,
402
354
shell=True, cwd="/")
403
if self.use_dbus:
404
# Emit D-Bus signal
405
self.CheckerStarted(command)
406
self.PropertyChanged(
407
dbus.String("checker_running"),
408
dbus.Boolean(True, variant_level=1))
409
self.checker_callback_tag = (gobject.child_watch_add
410
(self.checker.pid,
411
self.checker_callback,
412
data=command))
355
self.checker_callback_tag = gobject.child_watch_add\
356
(self.checker.pid,
357
self.checker_callback)
413
358
except OSError, error:
414
359
logger.error(u"Failed to start subprocess: %s",
415
360
error)
416
361
# Re-run this periodically if run by gobject.timeout_add
417
362
return True
418
419
363
def stop_checker(self):
420
364
"""Force the checker process, if any, to stop."""
421
365
if self.checker_callback_tag:
433
377
if error.errno != errno.ESRCH: # No such process
434
378
raise
435
379
self.checker = None
436
if self.use_dbus:
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
439
440
380
def still_valid(self):
441
381
"""Has the timeout not yet passed for this client?"""
442
if not getattr(self, "enabled", False):
443
return False
444
now = datetime.datetime.utcnow()
382
now = datetime.datetime.now()
445
383
if self.last_checked_ok is None:
446
384
return now < (self.created + self.timeout)
447
385
else:
448
386
return now < (self.last_checked_ok + self.timeout)
449
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
452
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
456
457
# CheckerCompleted - signal
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
460
"D-Bus signal"
461
pass
462
463
# CheckerStarted - signal
464
@dbus.service.signal(_interface, signature="s")
465
def CheckerStarted(self, command):
466
"D-Bus signal"
467
pass
468
469
# GetAllProperties - method
470
@dbus.service.method(_interface, out_signature="a{sv}")
471
def GetAllProperties(self):
472
"D-Bus method"
473
return dbus.Dictionary({
474
dbus.String("name"):
475
dbus.String(self.name, variant_level=1),
476
dbus.String("fingerprint"):
477
dbus.String(self.fingerprint, variant_level=1),
478
dbus.String("host"):
479
dbus.String(self.host, variant_level=1),
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
484
variant_level=1)
485
if self.last_enabled is not None
486
else dbus.Boolean(False, variant_level=1)),
487
dbus.String("enabled"):
488
dbus.Boolean(self.enabled, variant_level=1),
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
491
variant_level=1)
492
if self.last_checked_ok is not None
493
else dbus.Boolean (False, variant_level=1)),
494
dbus.String("timeout"):
495
dbus.UInt64(self.timeout_milliseconds(),
496
variant_level=1),
497
dbus.String("interval"):
498
dbus.UInt64(self.interval_milliseconds(),
499
variant_level=1),
500
dbus.String("checker"):
501
dbus.String(self.checker_command,
502
variant_level=1),
503
dbus.String("checker_running"):
504
dbus.Boolean(self.checker is not None,
505
variant_level=1),
506
}, signature="sv")
507
508
# IsStillValid - method
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
510
(still_valid))
511
IsStillValid.__name__ = "IsStillValid"
512
513
# PropertyChanged - signal
514
@dbus.service.signal(_interface, signature="sv")
515
def PropertyChanged(self, property, value):
516
"D-Bus signal"
517
pass
518
519
# SetChecker - method
520
@dbus.service.method(_interface, in_signature="s")
521
def SetChecker(self, checker):
522
"D-Bus setter method"
523
self.checker_command = checker
524
# Emit D-Bus signal
525
self.PropertyChanged(dbus.String(u"checker"),
526
dbus.String(self.checker_command,
527
variant_level=1))
528
529
# SetHost - method
530
@dbus.service.method(_interface, in_signature="s")
531
def SetHost(self, host):
532
"D-Bus setter method"
533
self.host = host
534
# Emit D-Bus signal
535
self.PropertyChanged(dbus.String(u"host"),
536
dbus.String(self.host, variant_level=1))
537
538
# SetInterval - method
539
@dbus.service.method(_interface, in_signature="t")
540
def SetInterval(self, milliseconds):
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
542
# Emit D-Bus signal
543
self.PropertyChanged(dbus.String(u"interval"),
544
(dbus.UInt64(self.interval_milliseconds(),
545
variant_level=1)))
546
547
# SetSecret - method
548
@dbus.service.method(_interface, in_signature="ay",
549
byte_arrays=True)
550
def SetSecret(self, secret):
551
"D-Bus setter method"
552
self.secret = str(secret)
553
554
# SetTimeout - method
555
@dbus.service.method(_interface, in_signature="t")
556
def SetTimeout(self, milliseconds):
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
558
# Emit D-Bus signal
559
self.PropertyChanged(dbus.String(u"timeout"),
560
(dbus.UInt64(self.timeout_milliseconds(),
561
variant_level=1)))
562
563
# Enable - method
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
566
567
# StartChecker - method
568
@dbus.service.method(_interface)
569
def StartChecker(self):
570
"D-Bus method"
571
self.start_checker()
572
573
# Disable - method
574
@dbus.service.method(_interface)
575
def Disable(self):
576
"D-Bus method"
577
self.disable()
578
579
# StopChecker - method
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
582
583
del _interface
584
387
585
388
586
389
def peer_certificate(session):
587
390
"Return the peer's OpenPGP certificate as a bytestring"
588
391
# If not an OpenPGP certificate...
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
392
if gnutls.library.functions.gnutls_certificate_type_get\
393
(session._c_object) \
394
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
592
395
# ...do the normal thing
593
396
return session.peer_certificate
594
397
list_size = ctypes.c_uint()
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
398
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
399
(session._c_object, ctypes.byref(list_size))
598
400
if list_size.value == 0:
599
401
return None
600
402
cert = cert_list[0]
604
406
def fingerprint(openpgp):
605
407
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
606
408
# New GnuTLS "datum" with the OpenPGP public key
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
609
ctypes.POINTER
610
(ctypes.c_ubyte)),
611
ctypes.c_uint(len(openpgp))))
409
datum = gnutls.library.types.gnutls_datum_t\
410
(ctypes.cast(ctypes.c_char_p(openpgp),
411
ctypes.POINTER(ctypes.c_ubyte)),
412
ctypes.c_uint(len(openpgp)))
612
413
# New empty GnuTLS certificate
613
414
crt = gnutls.library.types.gnutls_openpgp_crt_t()
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
415
gnutls.library.functions.gnutls_openpgp_crt_init\
416
(ctypes.byref(crt))
616
417
# Import the OpenPGP public key into the certificate
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
418
gnutls.library.functions.gnutls_openpgp_crt_import\
419
(crt, ctypes.byref(datum),
420
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
621
421
# Verify the self signature in the key
622
422
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
423
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
424
(crt, 0, ctypes.byref(crtverify))
625
425
if crtverify.value != 0:
626
426
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
427
raise gnutls.errors.CertificateSecurityError("Verify failed")
629
429
buf = ctypes.create_string_buffer(20)
630
430
buf_len = ctypes.c_size_t()
631
431
# Get the fingerprint from the certificate into the buffer
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
432
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
433
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
635
434
# Deinit the certificate
636
435
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
637
436
# Convert the buffer to a Python bytestring
648
447
649
448
def handle(self):
650
449
logger.info(u"TCP connection from: %s",
651
unicode(self.client_address))
652
session = (gnutls.connection
653
.ClientSession(self.request,
654
gnutls.connection
655
.X509Credentials()))
450
unicode(self.client_address))
451
session = gnutls.connection.ClientSession\
452
(self.request, gnutls.connection.X509Credentials())
656
453
657
454
line = self.request.makefile().readline()
658
455
logger.debug(u"Protocol version: %r", line)
671
468
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
672
469
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
673
470
# "+DHE-DSS"))
674
# Use a fallback default, since this MUST be set.
675
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
678
priority, None))
471
priority = "NORMAL" # Fallback default, since this
472
# MUST be set.
473
if self.server.settings["priority"]:
474
priority = self.server.settings["priority"]
475
gnutls.library.functions.gnutls_priority_set_direct\
476
(session._c_object, priority, None)
679
477
680
478
try:
681
479
session.handshake()
691
489
session.bye()
692
490
return
693
491
logger.debug(u"Fingerprint: %s", fpr)
492
client = None
694
493
for c in self.server.clients:
695
494
if c.fingerprint == fpr:
696
495
client = c
697
496
break
698
else:
497
if not client:
699
498
logger.warning(u"Client not found for fingerprint: %s",
700
499
fpr)
701
500
session.bye()
708
507
vars(client))
709
508
session.bye()
710
509
return
711
## This won't work here, since we're in a fork.
712
# client.bump_timeout()
713
510
sent_size = 0
714
511
while sent_size < len(client.secret):
715
512
sent = session.send(client.secret[sent_size:])
720
517
session.bye()
721
518
722
519
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
724
SocketServer.TCPServer, object):
520
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
725
521
"""IPv6 TCP server. Accepts 'None' as address and/or port.
726
522
Attributes:
727
523
settings: Server settings
840
636
elif state == avahi.ENTRY_GROUP_FAILURE:
841
637
logger.critical(u"Avahi: Error in group state changed %s",
842
638
unicode(error))
843
raise AvahiGroupError(u"State changed: %s" % unicode(error))
639
raise AvahiGroupError("State changed: %s", str(error))
844
640
845
641
def if_nametoindex(interface):
846
642
"""Call the C function if_nametoindex(), or equivalent"""
847
643
global if_nametoindex
848
644
try:
849
if_nametoindex = (ctypes.cdll.LoadLibrary
850
(ctypes.util.find_library("c"))
851
.if_nametoindex)
645
if_nametoindex = ctypes.cdll.LoadLibrary\
646
(ctypes.util.find_library("c")).if_nametoindex
852
647
except (OSError, AttributeError):
853
648
if "struct" not in sys.modules:
854
649
import struct
857
652
def if_nametoindex(interface):
858
653
"Get an interface index the hard way, i.e. using fcntl()"
859
654
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
860
with closing(socket.socket()) as s:
861
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
862
struct.pack("16s16x", interface))
655
s = socket.socket()
656
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
657
struct.pack("16s16x", interface))
658
s.close()
863
659
interface_index = struct.unpack("I", ifreq[16:20])[0]
864
660
return interface_index
865
661
return if_nametoindex(interface)
889
685
890
686
891
687
def main():
892
parser = optparse.OptionParser(version = "%%prog %s" % version)
688
parser = OptionParser(version = "%%prog %s" % version)
893
689
parser.add_option("-i", "--interface", type="string",
894
690
metavar="IF", help="Bind to interface IF")
895
691
parser.add_option("-a", "--address", type="string",
896
692
help="Address to listen for requests on")
897
693
parser.add_option("-p", "--port", type="int",
898
694
help="Port number to receive requests on")
899
parser.add_option("--check", action="store_true",
695
parser.add_option("--check", action="store_true", default=False,
900
696
help="Run self-test")
901
697
parser.add_option("--debug", action="store_true",
902
698
help="Debug mode; run in foreground and log to"
909
705
default="/etc/mandos", metavar="DIR",
910
706
help="Directory to search for configuration"
911
707
" files")
912
parser.add_option("--no-dbus", action="store_false",
913
dest="use_dbus",
914
help="Do not provide D-Bus system bus"
915
" interface")
916
708
options = parser.parse_args()[0]
917
709
918
710
if options.check:
928
720
"priority":
929
721
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
930
722
"servicename": "Mandos",
931
"use_dbus": "True",
932
723
}
933
724
934
725
# Parse config file for server-global settings
937
728
server_config.read(os.path.join(options.configdir, "mandos.conf"))
938
729
# Convert the SafeConfigParser object to a dict
939
730
server_settings = server_config.defaults()
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
731
# Use getboolean on the boolean config option
732
server_settings["debug"] = server_config.getboolean\
733
("DEFAULT", "debug")
945
734
del server_config
946
735
947
736
# Override the settings from the config file with command line
948
737
# options, if set.
949
738
for option in ("interface", "address", "port", "debug",
950
"priority", "servicename", "configdir",
951
"use_dbus"):
739
"priority", "servicename", "configdir"):
952
740
value = getattr(options, option)
953
741
if value is not None:
954
742
server_settings[option] = value
955
743
del options
956
744
# Now we have our good server settings in "server_settings"
957
745
958
# For convenience
959
746
debug = server_settings["debug"]
960
use_dbus = server_settings["use_dbus"]
961
747
962
748
if not debug:
963
749
syslogger.setLevel(logging.WARNING)
964
750
console.setLevel(logging.WARNING)
965
751
966
752
if server_settings["servicename"] != "Mandos":
967
syslogger.setFormatter(logging.Formatter
753
syslogger.setFormatter(logging.Formatter\
968
754
('Mandos (%s): %%(levelname)s:'
969
755
' %%(message)s'
970
756
% server_settings["servicename"]))
972
758
# Parse config file with clients
973
759
client_defaults = { "timeout": "1h",
974
760
"interval": "5m",
975
"checker": "fping -q -- %%(host)s",
761
"checker": "fping -q -- %(host)s",
976
762
"host": "",
977
763
}
978
764
client_config = ConfigParser.SafeConfigParser(client_defaults)
991
777
except IOError, error:
992
778
logger.error("Could not open file %r", pidfilename)
993
779
994
try:
995
uid = pwd.getpwnam("_mandos").pw_uid
996
gid = pwd.getpwnam("_mandos").pw_gid
997
except KeyError:
998
try:
999
uid = pwd.getpwnam("mandos").pw_uid
1000
gid = pwd.getpwnam("mandos").pw_gid
1001
except KeyError:
1002
try:
1003
uid = pwd.getpwnam("nobody").pw_uid
1004
gid = pwd.getpwnam("nogroup").pw_gid
1005
except KeyError:
1006
uid = 65534
1007
gid = 65534
780
uid = 65534
781
gid = 65534
782
try:
783
uid = pwd.getpwnam("mandos").pw_uid
784
except KeyError:
785
try:
786
uid = pwd.getpwnam("nobody").pw_uid
787
except KeyError:
788
pass
789
try:
790
gid = pwd.getpwnam("mandos").pw_gid
791
except KeyError:
792
try:
793
gid = pwd.getpwnam("nogroup").pw_gid
794
except KeyError:
795
pass
1008
796
try:
1009
797
os.setuid(uid)
1010
798
os.setgid(gid)
1016
804
service = AvahiService(name = server_settings["servicename"],
1017
805
servicetype = "_mandos._tcp", )
1018
806
if server_settings["interface"]:
1019
service.interface = (if_nametoindex
1020
(server_settings["interface"]))
807
service.interface = if_nametoindex\
808
(server_settings["interface"])
1021
809
1022
810
global main_loop
1023
811
global bus
1030
818
avahi.DBUS_PATH_SERVER),
1031
819
avahi.DBUS_INTERFACE_SERVER)
1032
820
# End of Avahi example code
1033
if use_dbus:
1034
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1035
bus)
821
822
def remove_from_clients(client):
823
clients.remove(client)
824
if not clients:
825
logger.critical(u"No clients left, exiting")
826
sys.exit()
1036
827
1037
828
clients.update(Set(Client(name = section,
829
stop_hook = remove_from_clients,
1038
830
config
1039
= dict(client_config.items(section)),
1040
use_dbus = use_dbus)
831
= dict(client_config.items(section)))
1041
832
for section in client_config.sections()))
1042
833
if not clients:
1043
logger.warning(u"No clients defined")
834
logger.critical(u"No clients defined")
835
sys.exit(1)
1044
836
1045
837
if debug:
1046
838
# Redirect stdin so all checkers get /dev/null
1078
870
1079
871
while clients:
1080
872
client = clients.pop()
1081
client.disable_hook = None
1082
client.disable()
873
client.stop_hook = None
874
client.stop()
1083
875
1084
876
atexit.register(cleanup)
1085
877
1088
880
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1089
881
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1090
882
1091
if use_dbus:
1092
class MandosServer(dbus.service.Object):
1093
"""A D-Bus proxy object"""
1094
def __init__(self):
1095
dbus.service.Object.__init__(self, bus,
1096
"/Mandos")
1097
_interface = u"org.mandos_system.Mandos"
1098
1099
@dbus.service.signal(_interface, signature="oa{sv}")
1100
def ClientAdded(self, objpath, properties):
1101
"D-Bus signal"
1102
pass
1103
1104
@dbus.service.signal(_interface, signature="o")
1105
def ClientRemoved(self, objpath):
1106
"D-Bus signal"
1107
pass
1108
1109
@dbus.service.method(_interface, out_signature="ao")
1110
def GetAllClients(self):
1111
return dbus.Array(c.dbus_object_path for c in clients)
1112
1113
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1114
def GetAllClientsWithProperties(self):
1115
return dbus.Dictionary(
1116
((c.dbus_object_path, c.GetAllProperties())
1117
for c in clients),
1118
signature="oa{sv}")
1119
1120
@dbus.service.method(_interface, in_signature="o")
1121
def RemoveClient(self, object_path):
1122
for c in clients:
1123
if c.dbus_object_path == object_path:
1124
clients.remove(c)
1125
# Don't signal anything except ClientRemoved
1126
c.use_dbus = False
1127
c.disable()
1128
# Emit D-Bus signal
1129
self.ClientRemoved(object_path)
1130
return
1131
raise KeyError
1132
@dbus.service.method(_interface)
1133
def Quit(self):
1134
main_loop.quit()
1135
1136
del _interface
1137
1138
mandos_server = MandosServer()
1139
1140
883
for client in clients:
1141
if use_dbus:
1142
# Emit D-Bus signal
1143
mandos_server.ClientAdded(client.dbus_object_path,
1144
client.GetAllProperties())
1145
client.enable()
884
client.start()
1146
885
1147
886
tcp_server.enable()
1148
887
tcp_server.server_activate()
1166
905
1167
906
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1168
907
lambda *args, **kwargs:
1169
(tcp_server.handle_request
1170
(*args[2:], **kwargs) or True))
908
tcp_server.handle_request\
909
(*args[2:], **kwargs) or True)
1171
910
1172
911
logger.debug(u"Starting main loop")
1173
912
main_loop.run()
1174
913
except AvahiError, error:
1175
logger.critical(u"AvahiError: %s", error)
914
logger.critical(u"AvahiError: %s" + unicode(error))
1176
915
sys.exit(1)
1177
916
except KeyboardInterrupt:
1178
917
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0