11
11
# and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
16
16
# This program is free software: you can redistribute it and/or modify
17
17
# it under the terms of the GNU General Public License as published by
30
30
# Contact the authors at <mandos@fukt.bsnet.se>.
33
from __future__ import division
33
from __future__ import division, with_statement, absolute_import
35
35
import SocketServer
38
37
from optparse import OptionParser
108
111
a sensible number of times
110
113
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
111
type = None, port = None, TXT = None, domain = "",
114
servicetype = None, port = None, TXT = None, domain = "",
112
115
host = "", max_renames = 32768):
113
116
self.interface = interface
118
self.type = servicetype
127
130
if self.rename_count >= self.max_renames:
128
131
logger.critical(u"No suitable Zeroconf service name found"
129
132
u" after %i retries, exiting.",
131
134
raise AvahiServiceError("Too many renames")
132
135
self.name = server.GetAlternativeServiceName(self.name)
133
136
logger.info(u"Changing Zeroconf service name to %r ...",
178
181
secret: bytestring; sent verbatim (over TLS) to client
179
182
host: string; available for use by the checker command
180
183
created: datetime.datetime(); object creation, not client host
181
185
last_checked_ok: datetime.datetime() or None if not yet checked OK
182
186
timeout: datetime.timedelta(); How long from last_checked_ok
183
187
until this client is invalid
199
203
_timeout_milliseconds: Used when calling gobject.timeout_add()
200
204
_interval_milliseconds: - '' -
206
interface = u"org.mandos_system.Mandos.Clients"
208
@dbus.service.method(interface, out_signature="s")
210
"D-Bus getter method"
213
@dbus.service.method(interface, out_signature="s")
214
def getFingerprint(self):
215
"D-Bus getter method"
216
return self.fingerprint
218
@dbus.service.method(interface, in_signature="ay",
220
def setSecret(self, secret):
221
"D-Bus setter method"
202
224
def _set_timeout(self, timeout):
203
"Setter function for 'timeout' attribute"
225
"Setter function for the 'timeout' attribute"
204
226
self._timeout = timeout
205
227
self._timeout_milliseconds = ((self.timeout.days
206
228
* 24 * 60 * 60 * 1000)
207
229
+ (self.timeout.seconds * 1000)
208
230
+ (self.timeout.microseconds
210
timeout = property(lambda self: self._timeout,
233
self.TimeoutChanged(self._timeout_milliseconds)
234
timeout = property(lambda self: self._timeout, _set_timeout)
237
@dbus.service.method(interface, out_signature="t")
238
def getTimeout(self):
239
"D-Bus getter method"
240
return self._timeout_milliseconds
242
@dbus.service.signal(interface, signature="t")
243
def TimeoutChanged(self, t):
213
247
def _set_interval(self, interval):
214
"Setter function for 'interval' attribute"
248
"Setter function for the 'interval' attribute"
215
249
self._interval = interval
216
250
self._interval_milliseconds = ((self.interval.days
217
251
* 24 * 60 * 60 * 1000)
220
254
+ (self.interval.microseconds
222
interval = property(lambda self: self._interval,
257
self.IntervalChanged(self._interval_milliseconds)
258
interval = property(lambda self: self._interval, _set_interval)
224
259
del _set_interval
225
def __init__(self, name = None, stop_hook=None, config={}):
261
@dbus.service.method(interface, out_signature="t")
262
def getInterval(self):
263
"D-Bus getter method"
264
return self._interval_milliseconds
266
@dbus.service.signal(interface, signature="t")
267
def IntervalChanged(self, t):
271
def __init__(self, name = None, stop_hook=None, config=None):
226
272
"""Note: the 'checker' key in 'config' sets the
227
273
'checker_command' attribute and *not* the 'checker'
275
dbus.service.Object.__init__(self, bus,
277
% name.replace(".", "_"))
230
281
logger.debug(u"Creating client %r", self.name)
231
282
# Uppercase and remove spaces from fingerprint for later
237
288
if "secret" in config:
238
289
self.secret = config["secret"].decode(u"base64")
239
290
elif "secfile" in config:
240
sf = open(config["secfile"])
241
self.secret = sf.read()
291
with closing(open(os.path.expanduser
293
(config["secfile"])))) \
295
self.secret = secfile.read()
244
297
raise TypeError(u"No secret or secfile for client %s"
246
299
self.host = config.get("host", "")
247
300
self.created = datetime.datetime.now()
248
302
self.last_checked_ok = None
249
303
self.timeout = string_to_delta(config["timeout"])
250
304
self.interval = string_to_delta(config["interval"])
254
308
self.stop_initiator_tag = None
255
309
self.checker_callback_tag = None
256
310
self.check_command = config["checker"]
258
313
"""Start this client's checker and timeout hooks"""
259
315
# Schedule a new checker to be started an 'interval' from now,
260
316
# and every interval from then on.
261
317
self.checker_initiator_tag = gobject.timeout_add\
267
323
self.stop_initiator_tag = gobject.timeout_add\
268
324
(self._timeout_milliseconds,
327
self.StateChanged(True)
329
@dbus.service.signal(interface, signature="b")
330
def StateChanged(self, started):
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
274
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
335
"""Stop this client."""
336
if getattr(self, "started", False):
276
337
logger.info(u"Stopping client %s", self.name)
280
340
if getattr(self, "stop_initiator_tag", False):
286
346
self.stop_checker()
287
347
if self.stop_hook:
288
348
self.stop_hook(self)
350
self.StateChanged(False)
289
351
# Do not run this again if called by a gobject.timeout_add
354
Stop = dbus.service.method(interface)(stop)
291
356
def __del__(self):
292
357
self.stop_hook = None
294
360
def checker_callback(self, pid, condition):
295
361
"""The checker has completed, so take appropriate actions."""
296
now = datetime.datetime.now()
297
362
self.checker_callback_tag = None
298
363
self.checker = None
299
364
if os.WIFEXITED(condition) \
300
365
and (os.WEXITSTATUS(condition) == 0):
301
366
logger.info(u"Checker for %(name)s succeeded",
303
self.last_checked_ok = now
304
gobject.source_remove(self.stop_initiator_tag)
305
self.stop_initiator_tag = gobject.timeout_add\
306
(self._timeout_milliseconds,
369
self.CheckerCompleted(True)
308
371
elif not os.WIFEXITED(condition):
309
372
logger.warning(u"Checker for %(name)s crashed?",
375
self.CheckerCompleted(False)
312
377
logger.info(u"Checker for %(name)s failed",
380
self.CheckerCompleted(False)
382
@dbus.service.signal(interface, signature="b")
383
def CheckerCompleted(self, success):
387
def bump_timeout(self):
388
"""Bump up the timeout for this client.
389
This should only be called when the client has been seen,
392
self.last_checked_ok = datetime.datetime.now()
393
gobject.source_remove(self.stop_initiator_tag)
394
self.stop_initiator_tag = gobject.timeout_add\
395
(self._timeout_milliseconds, self.stop)
397
bumpTimeout = dbus.service.method(interface)(bump_timeout)
314
399
def start_checker(self):
315
400
"""Start a new checker subprocess if one is not running.
316
401
If a checker already exists, leave it running and do
351
436
self.checker_callback_tag = gobject.child_watch_add\
352
437
(self.checker.pid,
353
438
self.checker_callback)
440
self.CheckerStarted(command)
354
441
except OSError, error:
355
442
logger.error(u"Failed to start subprocess: %s",
357
444
# Re-run this periodically if run by gobject.timeout_add
447
@dbus.service.signal(interface, signature="s")
448
def CheckerStarted(self, command):
451
@dbus.service.method(interface, out_signature="b")
452
def checkerIsRunning(self):
453
"D-Bus getter method"
454
return self.checker is not None
359
456
def stop_checker(self):
360
457
"""Force the checker process, if any, to stop."""
361
458
if self.checker_callback_tag:
373
470
if error.errno != errno.ESRCH: # No such process
375
472
self.checker = None
474
StopChecker = dbus.service.method(interface)(stop_checker)
376
476
def still_valid(self):
377
477
"""Has the timeout not yet passed for this client?"""
378
480
now = datetime.datetime.now()
379
481
if self.last_checked_ok is None:
380
482
return now < (self.created + self.timeout)
382
484
return now < (self.last_checked_ok + self.timeout)
486
stillValid = dbus.service.method(interface, out_signature="b")\
385
492
def peer_certificate(session):
415
522
(crt, ctypes.byref(datum),
416
523
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
417
524
# Verify the self signature in the key
418
crtverify = ctypes.c_uint();
525
crtverify = ctypes.c_uint()
419
526
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
527
(crt, 0, ctypes.byref(crtverify))
421
528
if crtverify.value != 0:
422
529
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
423
530
raise gnutls.errors.CertificateSecurityError("Verify failed")
424
531
# New buffer for the fingerprint
425
buffer = ctypes.create_string_buffer(20)
426
buffer_length = ctypes.c_size_t()
532
buf = ctypes.create_string_buffer(20)
533
buf_len = ctypes.c_size_t()
427
534
# Get the fingerprint from the certificate into the buffer
428
535
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
536
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
430
537
# Deinit the certificate
431
538
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
432
539
# Convert the buffer to a Python bytestring
433
fpr = ctypes.string_at(buffer, buffer_length.value)
540
fpr = ctypes.string_at(buf, buf_len.value)
434
541
# Convert the bytestring to hexadecimal notation
435
542
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
546
class TCP_handler(SocketServer.BaseRequestHandler, object):
440
547
"""A TCP request handler class.
441
548
Instantiated by IPv6_TCPServer for each request to handle it.
442
549
Note: This will run in its own forked process."""
444
551
def handle(self):
445
552
logger.info(u"TCP connection from: %s",
446
unicode(self.client_address))
553
unicode(self.client_address))
447
554
session = gnutls.connection.ClientSession\
448
555
(self.request, gnutls.connection.X509Credentials())
464
571
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
465
572
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
467
priority = "NORMAL" # Fallback default, since this
469
if self.server.settings["priority"]:
470
priority = self.server.settings["priority"]
574
# Use a fallback default, since this MUST be set.
575
priority = self.server.settings.get("priority", "NORMAL")
471
576
gnutls.library.functions.gnutls_priority_set_direct\
472
(session._c_object, priority, None);
577
(session._c_object, priority, None)
475
580
session.handshake()
516
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
623
class IPv6_TCPServer(SocketServer.ForkingMixIn,
624
SocketServer.TCPServer, object):
517
625
"""IPv6 TCP server. Accepts 'None' as address and/or port.
519
627
settings: Server settings
529
637
self.clients = kwargs["clients"]
530
638
del kwargs["clients"]
531
639
self.enabled = False
532
return super(type(self), self).__init__(*args, **kwargs)
640
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
533
641
def server_bind(self):
534
642
"""This overrides the normal server_bind() function
535
643
to bind to an interface if one was specified, and also NOT to
566
674
# ["interface"]))
567
return super(type(self), self).server_bind()
675
return super(IPv6_TCPServer, self).server_bind()
568
676
def server_activate(self):
570
return super(type(self), self).server_activate()
678
return super(IPv6_TCPServer, self).server_activate()
571
679
def enable(self):
572
680
self.enabled = True
638
746
"""Call the C function if_nametoindex(), or equivalent"""
639
747
global if_nametoindex
641
if "ctypes.util" not in sys.modules:
643
749
if_nametoindex = ctypes.cdll.LoadLibrary\
644
750
(ctypes.util.find_library("c")).if_nametoindex
645
751
except (OSError, AttributeError):
650
756
def if_nametoindex(interface):
651
757
"Get an interface index the hard way, i.e. using fcntl()"
652
758
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
654
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
655
struct.pack("16s16x", interface))
759
with closing(socket.socket()) as s:
760
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
761
struct.pack("16s16x", interface))
657
762
interface_index = struct.unpack("I", ifreq[16:20])[0]
658
763
return interface_index
659
764
return if_nametoindex(interface)
686
global main_loop_started
687
main_loop_started = False
689
791
parser = OptionParser(version = "%%prog %s" % version)
690
792
parser.add_option("-i", "--interface", type="string",
691
793
metavar="IF", help="Bind to interface IF")
706
808
default="/etc/mandos", metavar="DIR",
707
809
help="Directory to search for configuration"
709
(options, args) = parser.parse_args()
811
options = parser.parse_args()[0]
711
813
if options.check:
770
872
tcp_server = IPv6_TCPServer((server_settings["address"],
771
873
server_settings["port"]),
773
875
settings=server_settings,
775
877
pidfilename = "/var/run/mandos.pid"
805
907
service = AvahiService(name = server_settings["servicename"],
806
type = "_mandos._tcp", );
908
servicetype = "_mandos._tcp", )
807
909
if server_settings["interface"]:
808
910
service.interface = if_nametoindex\
809
911
(server_settings["interface"])