To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.2.31
- compare with another revision
- download diff
- download tarball
- view history from revision 237.2.31
- Committer: Teddy Hogeborn
- Date: 2009-10-25 19:06:56 UTC
- mto: (24.1.170 mandos) (237.4.29 release)
- mto: This revision was merged to the branch mainline in revision 419.
- Revision ID: teddy@fukt.bsnet.se-20091025190656-jdj54g1ra7wbglxh
* Makefile: Don't use PIE if BROKEN_PIE is set.
* debian/rules: Set BROKEN_PIE on mips and mipsel architectures.
* debian/rules: Set BROKEN_PIE on mips and mipsel architectures.
- files modified:
- INSTALL
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
34
34
from __future__ import division, with_statement, absolute_import
35
35
36
import SocketServer
36
import SocketServer as socketserver
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
import ConfigParser
47
import ConfigParser as configparser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
from sets import Set
53
52
import subprocess
54
53
import atexit
55
54
import stat
57
56
import logging.handlers
58
57
import pwd
59
58
from contextlib import closing
59
import struct
60
import fcntl
61
import functools
60
62
61
63
import dbus
62
64
import dbus.service
66
68
import ctypes
67
69
import ctypes.util
68
70
69
version = "1.0.5"
70
71
logger = logging.Logger('mandos')
71
try:
72
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
73
except AttributeError:
74
try:
75
from IN import SO_BINDTODEVICE
76
except ImportError:
77
SO_BINDTODEVICE = None
78
79
80
version = "1.0.13"
81
82
logger = logging.Logger(u'mandos')
72
83
syslogger = (logging.handlers.SysLogHandler
73
84
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
85
address = "/dev/log"))
75
86
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
87
(u'Mandos [%(process)d]: %(levelname)s:'
88
u' %(message)s'))
77
89
logger.addHandler(syslogger)
78
90
79
91
console = logging.StreamHandler()
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
92
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
93
u' %(levelname)s:'
94
u' %(message)s'))
82
95
logger.addHandler(console)
83
96
84
97
class AvahiError(Exception):
97
110
98
111
class AvahiService(object):
99
112
"""An Avahi (Zeroconf) service.
113
100
114
Attributes:
101
115
interface: integer; avahi.IF_UNSPEC or an interface index.
102
116
Used to optionally bind to the specified interface.
103
name: string; Example: 'Mandos'
104
type: string; Example: '_mandos._tcp'.
117
name: string; Example: u'Mandos'
118
type: string; Example: u'_mandos._tcp'.
105
119
See <http://www.dns-sd.org/ServiceTypes.html>
106
120
port: integer; what port to announce
107
121
TXT: list of strings; TXT record for the service
110
124
max_renames: integer; maximum number of renames
111
125
rename_count: integer; counter so we only rename after collisions
112
126
a sensible number of times
127
group: D-Bus Entry Group
128
server: D-Bus Server
129
bus: dbus.SystemBus()
113
130
"""
114
131
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
132
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
133
domain = u"", host = u"", max_renames = 32768,
134
protocol = avahi.PROTO_UNSPEC, bus = None):
117
135
self.interface = interface
118
136
self.name = name
119
137
self.type = servicetype
123
141
self.host = host
124
142
self.rename_count = 0
125
143
self.max_renames = max_renames
144
self.protocol = protocol
145
self.group = None # our entry group
146
self.server = None
147
self.bus = bus
126
148
def rename(self):
127
149
"""Derived from the Avahi example code"""
128
150
if self.rename_count >= self.max_renames:
130
152
u" after %i retries, exiting.",
131
153
self.rename_count)
132
154
raise AvahiServiceError(u"Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
155
self.name = self.server.GetAlternativeServiceName(self.name)
134
156
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
157
unicode(self.name))
136
158
syslogger.setFormatter(logging.Formatter
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
159
(u'Mandos (%s) [%%(process)d]:'
160
u' %%(levelname)s: %%(message)s'
161
% self.name))
139
162
self.remove()
140
163
self.add()
141
164
self.rename_count += 1
142
165
def remove(self):
143
166
"""Derived from the Avahi example code"""
144
if group is not None:
145
group.Reset()
167
if self.group is not None:
168
self.group.Reset()
146
169
def add(self):
147
170
"""Derived from the Avahi example code"""
148
global group
149
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
171
if self.group is None:
172
self.group = dbus.Interface(
173
self.bus.get_object(avahi.DBUS_NAME,
174
self.server.EntryGroupNew()),
175
avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
self.group.connect_to_signal('StateChanged',
177
self.entry_group_state_changed)
156
178
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
157
service.name, service.type)
158
group.AddService(
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
166
group.Commit()
167
168
# From the Avahi example code:
169
group = None # our entry group
170
# End of Avahi example code
171
172
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
179
self.name, self.type)
180
self.group.AddService(
181
self.interface,
182
self.protocol,
183
dbus.UInt32(0), # flags
184
self.name, self.type,
185
self.domain, self.host,
186
dbus.UInt16(self.port),
187
avahi.string_array_to_txt_array(self.TXT))
188
self.group.Commit()
189
def entry_group_state_changed(self, state, error):
190
"""Derived from the Avahi example code"""
191
logger.debug(u"Avahi state change: %i", state)
192
193
if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
logger.debug(u"Zeroconf service established.")
195
elif state == avahi.ENTRY_GROUP_COLLISION:
196
logger.warning(u"Zeroconf service name collision.")
197
self.rename()
198
elif state == avahi.ENTRY_GROUP_FAILURE:
199
logger.critical(u"Avahi: Error in group state changed %s",
200
unicode(error))
201
raise AvahiGroupError(u"State changed: %s"
202
% unicode(error))
203
def cleanup(self):
204
"""Derived from the Avahi example code"""
205
if self.group is not None:
206
self.group.Free()
207
self.group = None
208
def server_state_changed(self, state):
209
"""Derived from the Avahi example code"""
210
if state == avahi.SERVER_COLLISION:
211
logger.error(u"Zeroconf server name collision")
212
self.remove()
213
elif state == avahi.SERVER_RUNNING:
214
self.add()
215
def activate(self):
216
"""Derived from the Avahi example code"""
217
if self.server is None:
218
self.server = dbus.Interface(
219
self.bus.get_object(avahi.DBUS_NAME,
220
avahi.DBUS_PATH_SERVER),
221
avahi.DBUS_INTERFACE_SERVER)
222
self.server.connect_to_signal(u"StateChanged",
223
self.server_state_changed)
224
self.server_state_changed(self.server.GetState())
225
226
227
class Client(object):
179
228
"""A representation of a client host served by this server.
229
180
230
Attributes:
181
231
name: string; from the config file, used in log messages and
182
232
D-Bus identifiers
202
252
client lives. %() expansions are done at
203
253
runtime with vars(self) as dict, so that for
204
254
instance %(name)s can be used in the command.
205
use_dbus: bool(); Whether to provide D-Bus interface and signals
206
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
255
current_checker_command: string; current running checker_command
207
256
"""
257
258
@staticmethod
259
def _datetime_to_milliseconds(dt):
260
"Convert a datetime.datetime() to milliseconds"
261
return ((dt.days * 24 * 60 * 60 * 1000)
262
+ (dt.seconds * 1000)
263
+ (dt.microseconds // 1000))
264
208
265
def timeout_milliseconds(self):
209
266
"Return the 'timeout' attribute in milliseconds"
210
return ((self.timeout.days * 24 * 60 * 60 * 1000)
211
+ (self.timeout.seconds * 1000)
212
+ (self.timeout.microseconds // 1000))
267
return self._datetime_to_milliseconds(self.timeout)
213
268
214
269
def interval_milliseconds(self):
215
270
"Return the 'interval' attribute in milliseconds"
216
return ((self.interval.days * 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds * 1000)
218
+ (self.interval.microseconds // 1000))
271
return self._datetime_to_milliseconds(self.interval)
219
272
220
def __init__(self, name = None, disable_hook=None, config=None,
221
use_dbus=True):
273
def __init__(self, name = None, disable_hook=None, config=None):
222
274
"""Note: the 'checker' key in 'config' sets the
223
275
'checker_command' attribute and *not* the 'checker'
224
276
attribute."""
226
278
if config is None:
227
279
config = {}
228
280
logger.debug(u"Creating client %r", self.name)
229
self.use_dbus = False # During __init__
230
281
# Uppercase and remove spaces from fingerprint for later
231
282
# comparison purposes with return value from the fingerprint()
232
283
# function
233
self.fingerprint = (config["fingerprint"].upper()
284
self.fingerprint = (config[u"fingerprint"].upper()
234
285
.replace(u" ", u""))
235
286
logger.debug(u" Fingerprint: %s", self.fingerprint)
236
if "secret" in config:
237
self.secret = config["secret"].decode(u"base64")
238
elif "secfile" in config:
287
if u"secret" in config:
288
self.secret = config[u"secret"].decode(u"base64")
289
elif u"secfile" in config:
239
290
with closing(open(os.path.expanduser
240
291
(os.path.expandvars
241
(config["secfile"])))) as secfile:
292
(config[u"secfile"])))) as secfile:
242
293
self.secret = secfile.read()
243
294
else:
244
295
raise TypeError(u"No secret or secfile for client %s"
245
296
% self.name)
246
self.host = config.get("host", "")
297
self.host = config.get(u"host", u"")
247
298
self.created = datetime.datetime.utcnow()
248
299
self.enabled = False
249
300
self.last_enabled = None
250
301
self.last_checked_ok = None
251
self.timeout = string_to_delta(config["timeout"])
252
self.interval = string_to_delta(config["interval"])
302
self.timeout = string_to_delta(config[u"timeout"])
303
self.interval = string_to_delta(config[u"interval"])
253
304
self.disable_hook = disable_hook
254
305
self.checker = None
255
306
self.checker_initiator_tag = None
256
307
self.disable_initiator_tag = None
257
308
self.checker_callback_tag = None
258
self.checker_command = config["checker"]
309
self.checker_command = config[u"checker"]
310
self.current_checker_command = None
259
311
self.last_connect = None
260
# Only now, when this client is initialized, can it show up on
261
# the D-Bus
262
self.use_dbus = use_dbus
263
if self.use_dbus:
264
self.dbus_object_path = (dbus.ObjectPath
265
("/clients/"
266
+ self.name.replace(".", "_")))
267
dbus.service.Object.__init__(self, bus,
268
self.dbus_object_path)
269
312
270
313
def enable(self):
271
314
"""Start this client's checker and timeout hooks"""
315
if getattr(self, u"enabled", False):
316
# Already enabled
317
return
272
318
self.last_enabled = datetime.datetime.utcnow()
273
319
# Schedule a new checker to be started an 'interval' from now,
274
320
# and every interval from then on.
282
328
(self.timeout_milliseconds(),
283
329
self.disable))
284
330
self.enabled = True
285
if self.use_dbus:
286
# Emit D-Bus signals
287
self.PropertyChanged(dbus.String(u"enabled"),
288
dbus.Boolean(True, variant_level=1))
289
self.PropertyChanged(dbus.String(u"last_enabled"),
290
(_datetime_to_dbus(self.last_enabled,
291
variant_level=1)))
292
331
293
332
def disable(self):
294
333
"""Disable this client."""
295
334
if not getattr(self, "enabled", False):
296
335
return False
297
336
logger.info(u"Disabling client %s", self.name)
298
if getattr(self, "disable_initiator_tag", False):
337
if getattr(self, u"disable_initiator_tag", False):
299
338
gobject.source_remove(self.disable_initiator_tag)
300
339
self.disable_initiator_tag = None
301
if getattr(self, "checker_initiator_tag", False):
340
if getattr(self, u"checker_initiator_tag", False):
302
341
gobject.source_remove(self.checker_initiator_tag)
303
342
self.checker_initiator_tag = None
304
343
self.stop_checker()
305
344
if self.disable_hook:
306
345
self.disable_hook(self)
307
346
self.enabled = False
308
if self.use_dbus:
309
# Emit D-Bus signal
310
self.PropertyChanged(dbus.String(u"enabled"),
311
dbus.Boolean(False, variant_level=1))
312
347
# Do not run this again if called by a gobject.timeout_add
313
348
return False
314
349
320
355
"""The checker has completed, so take appropriate actions."""
321
356
self.checker_callback_tag = None
322
357
self.checker = None
323
if self.use_dbus:
324
# Emit D-Bus signal
325
self.PropertyChanged(dbus.String(u"checker_running"),
326
dbus.Boolean(False, variant_level=1))
327
358
if os.WIFEXITED(condition):
328
359
exitstatus = os.WEXITSTATUS(condition)
329
360
if exitstatus == 0:
333
364
else:
334
365
logger.info(u"Checker for %(name)s failed",
335
366
vars(self))
336
if self.use_dbus:
337
# Emit D-Bus signal
338
self.CheckerCompleted(dbus.Int16(exitstatus),
339
dbus.Int64(condition),
340
dbus.String(command))
341
367
else:
342
368
logger.warning(u"Checker for %(name)s crashed?",
343
369
vars(self))
344
if self.use_dbus:
345
# Emit D-Bus signal
346
self.CheckerCompleted(dbus.Int16(-1),
347
dbus.Int64(condition),
348
dbus.String(command))
349
370
350
371
def checked_ok(self):
351
372
"""Bump up the timeout for this client.
373
352
374
This should only be called when the client has been seen,
353
375
alive and well.
354
376
"""
357
379
self.disable_initiator_tag = (gobject.timeout_add
358
380
(self.timeout_milliseconds(),
359
381
self.disable))
360
if self.use_dbus:
361
# Emit D-Bus signal
362
self.PropertyChanged(
363
dbus.String(u"last_checked_ok"),
364
(_datetime_to_dbus(self.last_checked_ok,
365
variant_level=1)))
366
382
367
383
def start_checker(self):
368
384
"""Start a new checker subprocess if one is not running.
385
369
386
If a checker already exists, leave it running and do
370
387
nothing."""
371
388
# The reason for not killing a running checker is that if we
376
393
# checkers alone, the checker would have to take more time
377
394
# than 'timeout' for the client to be declared invalid, which
378
395
# is as it should be.
396
397
# If a checker exists, make sure it is not a zombie
398
if self.checker is not None:
399
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
400
if pid:
401
logger.warning(u"Checker was a zombie")
402
gobject.source_remove(self.checker_callback_tag)
403
self.checker_callback(pid, status,
404
self.current_checker_command)
405
# Start a new checker if needed
379
406
if self.checker is None:
380
407
try:
381
408
# In case checker_command has exactly one % operator
382
409
command = self.checker_command % self.host
383
410
except TypeError:
384
411
# Escape attributes for the shell
385
escaped_attrs = dict((key, re.escape(str(val)))
412
escaped_attrs = dict((key,
413
re.escape(unicode(str(val),
414
errors=
415
u'replace')))
386
416
for key, val in
387
417
vars(self).iteritems())
388
418
try:
391
421
logger.error(u'Could not format string "%s":'
392
422
u' %s', self.checker_command, error)
393
423
return True # Try again later
424
self.current_checker_command = command
394
425
try:
395
426
logger.info(u"Starting checker %r for %s",
396
427
command, self.name)
400
431
# always replaced by /dev/null.)
401
432
self.checker = subprocess.Popen(command,
402
433
close_fds=True,
403
shell=True, cwd="/")
404
if self.use_dbus:
405
# Emit D-Bus signal
406
self.CheckerStarted(command)
407
self.PropertyChanged(
408
dbus.String("checker_running"),
409
dbus.Boolean(True, variant_level=1))
434
shell=True, cwd=u"/")
410
435
self.checker_callback_tag = (gobject.child_watch_add
411
436
(self.checker.pid,
412
437
self.checker_callback,
413
438
data=command))
439
# The checker may have completed before the gobject
440
# watch was added. Check for this.
441
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
442
if pid:
443
gobject.source_remove(self.checker_callback_tag)
444
self.checker_callback(pid, status, command)
414
445
except OSError, error:
415
446
logger.error(u"Failed to start subprocess: %s",
416
447
error)
422
453
if self.checker_callback_tag:
423
454
gobject.source_remove(self.checker_callback_tag)
424
455
self.checker_callback_tag = None
425
if getattr(self, "checker", None) is None:
456
if getattr(self, u"checker", None) is None:
426
457
return
427
458
logger.debug(u"Stopping checker for %(name)s", vars(self))
428
459
try:
434
465
if error.errno != errno.ESRCH: # No such process
435
466
raise
436
467
self.checker = None
437
if self.use_dbus:
438
self.PropertyChanged(dbus.String(u"checker_running"),
439
dbus.Boolean(False, variant_level=1))
440
468
441
469
def still_valid(self):
442
470
"""Has the timeout not yet passed for this client?"""
443
if not getattr(self, "enabled", False):
471
if not getattr(self, u"enabled", False):
444
472
return False
445
473
now = datetime.datetime.utcnow()
446
474
if self.last_checked_ok is None:
447
475
return now < (self.created + self.timeout)
448
476
else:
449
477
return now < (self.last_checked_ok + self.timeout)
478
479
480
class ClientDBus(Client, dbus.service.Object):
481
"""A Client class using D-Bus
482
483
Attributes:
484
dbus_object_path: dbus.ObjectPath
485
bus: dbus.SystemBus()
486
"""
487
# dbus.service.Object doesn't use super(), so we can't either.
488
489
def __init__(self, bus = None, *args, **kwargs):
490
self.bus = bus
491
Client.__init__(self, *args, **kwargs)
492
# Only now, when this client is initialized, can it show up on
493
# the D-Bus
494
self.dbus_object_path = (dbus.ObjectPath
495
(u"/clients/"
496
+ self.name.replace(u".", u"_")))
497
dbus.service.Object.__init__(self, self.bus,
498
self.dbus_object_path)
499
500
@staticmethod
501
def _datetime_to_dbus(dt, variant_level=0):
502
"""Convert a UTC datetime.datetime() to a D-Bus type."""
503
return dbus.String(dt.isoformat(),
504
variant_level=variant_level)
505
506
def enable(self):
507
oldstate = getattr(self, u"enabled", False)
508
r = Client.enable(self)
509
if oldstate != self.enabled:
510
# Emit D-Bus signals
511
self.PropertyChanged(dbus.String(u"enabled"),
512
dbus.Boolean(True, variant_level=1))
513
self.PropertyChanged(
514
dbus.String(u"last_enabled"),
515
self._datetime_to_dbus(self.last_enabled,
516
variant_level=1))
517
return r
518
519
def disable(self, signal = True):
520
oldstate = getattr(self, u"enabled", False)
521
r = Client.disable(self)
522
if signal and oldstate != self.enabled:
523
# Emit D-Bus signal
524
self.PropertyChanged(dbus.String(u"enabled"),
525
dbus.Boolean(False, variant_level=1))
526
return r
527
528
def __del__(self, *args, **kwargs):
529
try:
530
self.remove_from_connection()
531
except LookupError:
532
pass
533
if hasattr(dbus.service.Object, u"__del__"):
534
dbus.service.Object.__del__(self, *args, **kwargs)
535
Client.__del__(self, *args, **kwargs)
536
537
def checker_callback(self, pid, condition, command,
538
*args, **kwargs):
539
self.checker_callback_tag = None
540
self.checker = None
541
# Emit D-Bus signal
542
self.PropertyChanged(dbus.String(u"checker_running"),
543
dbus.Boolean(False, variant_level=1))
544
if os.WIFEXITED(condition):
545
exitstatus = os.WEXITSTATUS(condition)
546
# Emit D-Bus signal
547
self.CheckerCompleted(dbus.Int16(exitstatus),
548
dbus.Int64(condition),
549
dbus.String(command))
550
else:
551
# Emit D-Bus signal
552
self.CheckerCompleted(dbus.Int16(-1),
553
dbus.Int64(condition),
554
dbus.String(command))
555
556
return Client.checker_callback(self, pid, condition, command,
557
*args, **kwargs)
558
559
def checked_ok(self, *args, **kwargs):
560
r = Client.checked_ok(self, *args, **kwargs)
561
# Emit D-Bus signal
562
self.PropertyChanged(
563
dbus.String(u"last_checked_ok"),
564
(self._datetime_to_dbus(self.last_checked_ok,
565
variant_level=1)))
566
return r
567
568
def start_checker(self, *args, **kwargs):
569
old_checker = self.checker
570
if self.checker is not None:
571
old_checker_pid = self.checker.pid
572
else:
573
old_checker_pid = None
574
r = Client.start_checker(self, *args, **kwargs)
575
# Only if new checker process was started
576
if (self.checker is not None
577
and old_checker_pid != self.checker.pid):
578
# Emit D-Bus signal
579
self.CheckerStarted(self.current_checker_command)
580
self.PropertyChanged(
581
dbus.String(u"checker_running"),
582
dbus.Boolean(True, variant_level=1))
583
return r
584
585
def stop_checker(self, *args, **kwargs):
586
old_checker = getattr(self, u"checker", None)
587
r = Client.stop_checker(self, *args, **kwargs)
588
if (old_checker is not None
589
and getattr(self, u"checker", None) is None):
590
self.PropertyChanged(dbus.String(u"checker_running"),
591
dbus.Boolean(False, variant_level=1))
592
return r
450
593
451
594
## D-Bus methods & signals
452
595
_interface = u"se.bsnet.fukt.Mandos.Client"
453
596
454
597
# CheckedOK - method
455
CheckedOK = dbus.service.method(_interface)(checked_ok)
456
CheckedOK.__name__ = "CheckedOK"
598
@dbus.service.method(_interface)
599
def CheckedOK(self):
600
return self.checked_ok()
457
601
458
602
# CheckerCompleted - signal
459
@dbus.service.signal(_interface, signature="nxs")
603
@dbus.service.signal(_interface, signature=u"nxs")
460
604
def CheckerCompleted(self, exitcode, waitstatus, command):
461
605
"D-Bus signal"
462
606
pass
463
607
464
608
# CheckerStarted - signal
465
@dbus.service.signal(_interface, signature="s")
609
@dbus.service.signal(_interface, signature=u"s")
466
610
def CheckerStarted(self, command):
467
611
"D-Bus signal"
468
612
pass
469
613
470
614
# GetAllProperties - method
471
@dbus.service.method(_interface, out_signature="a{sv}")
615
@dbus.service.method(_interface, out_signature=u"a{sv}")
472
616
def GetAllProperties(self):
473
617
"D-Bus method"
474
618
return dbus.Dictionary({
475
dbus.String("name"):
619
dbus.String(u"name"):
476
620
dbus.String(self.name, variant_level=1),
477
dbus.String("fingerprint"):
621
dbus.String(u"fingerprint"):
478
622
dbus.String(self.fingerprint, variant_level=1),
479
dbus.String("host"):
623
dbus.String(u"host"):
480
624
dbus.String(self.host, variant_level=1),
481
dbus.String("created"):
482
_datetime_to_dbus(self.created, variant_level=1),
483
dbus.String("last_enabled"):
484
(_datetime_to_dbus(self.last_enabled,
485
variant_level=1)
625
dbus.String(u"created"):
626
self._datetime_to_dbus(self.created,
627
variant_level=1),
628
dbus.String(u"last_enabled"):
629
(self._datetime_to_dbus(self.last_enabled,
630
variant_level=1)
486
631
if self.last_enabled is not None
487
632
else dbus.Boolean(False, variant_level=1)),
488
dbus.String("enabled"):
633
dbus.String(u"enabled"):
489
634
dbus.Boolean(self.enabled, variant_level=1),
490
dbus.String("last_checked_ok"):
491
(_datetime_to_dbus(self.last_checked_ok,
492
variant_level=1)
635
dbus.String(u"last_checked_ok"):
636
(self._datetime_to_dbus(self.last_checked_ok,
637
variant_level=1)
493
638
if self.last_checked_ok is not None
494
639
else dbus.Boolean (False, variant_level=1)),
495
dbus.String("timeout"):
640
dbus.String(u"timeout"):
496
641
dbus.UInt64(self.timeout_milliseconds(),
497
642
variant_level=1),
498
dbus.String("interval"):
643
dbus.String(u"interval"):
499
644
dbus.UInt64(self.interval_milliseconds(),
500
645
variant_level=1),
501
dbus.String("checker"):
646
dbus.String(u"checker"):
502
647
dbus.String(self.checker_command,
503
648
variant_level=1),
504
dbus.String("checker_running"):
649
dbus.String(u"checker_running"):
505
650
dbus.Boolean(self.checker is not None,
506
651
variant_level=1),
507
dbus.String("object_path"):
652
dbus.String(u"object_path"):
508
653
dbus.ObjectPath(self.dbus_object_path,
509
654
variant_level=1)
510
}, signature="sv")
655
}, signature=u"sv")
511
656
512
657
# IsStillValid - method
513
IsStillValid = (dbus.service.method(_interface, out_signature="b")
514
(still_valid))
515
IsStillValid.__name__ = "IsStillValid"
658
@dbus.service.method(_interface, out_signature=u"b")
659
def IsStillValid(self):
660
return self.still_valid()
516
661
517
662
# PropertyChanged - signal
518
@dbus.service.signal(_interface, signature="sv")
663
@dbus.service.signal(_interface, signature=u"sv")
519
664
def PropertyChanged(self, property, value):
520
665
"D-Bus signal"
521
666
pass
522
667
668
# ReceivedSecret - signal
669
@dbus.service.signal(_interface)
670
def ReceivedSecret(self):
671
"D-Bus signal"
672
pass
673
674
# Rejected - signal
675
@dbus.service.signal(_interface)
676
def Rejected(self):
677
"D-Bus signal"
678
pass
679
523
680
# SetChecker - method
524
@dbus.service.method(_interface, in_signature="s")
681
@dbus.service.method(_interface, in_signature=u"s")
525
682
def SetChecker(self, checker):
526
683
"D-Bus setter method"
527
684
self.checker_command = checker
531
688
variant_level=1))
532
689
533
690
# SetHost - method
534
@dbus.service.method(_interface, in_signature="s")
691
@dbus.service.method(_interface, in_signature=u"s")
535
692
def SetHost(self, host):
536
693
"D-Bus setter method"
537
694
self.host = host
540
697
dbus.String(self.host, variant_level=1))
541
698
542
699
# SetInterval - method
543
@dbus.service.method(_interface, in_signature="t")
700
@dbus.service.method(_interface, in_signature=u"t")
544
701
def SetInterval(self, milliseconds):
545
702
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
546
703
# Emit D-Bus signal
549
706
variant_level=1)))
550
707
551
708
# SetSecret - method
552
@dbus.service.method(_interface, in_signature="ay",
709
@dbus.service.method(_interface, in_signature=u"ay",
553
710
byte_arrays=True)
554
711
def SetSecret(self, secret):
555
712
"D-Bus setter method"
556
713
self.secret = str(secret)
557
714
558
715
# SetTimeout - method
559
@dbus.service.method(_interface, in_signature="t")
716
@dbus.service.method(_interface, in_signature=u"t")
560
717
def SetTimeout(self, milliseconds):
561
718
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
562
719
# Emit D-Bus signal
565
722
variant_level=1)))
566
723
567
724
# Enable - method
568
Enable = dbus.service.method(_interface)(enable)
569
Enable.__name__ = "Enable"
725
@dbus.service.method(_interface)
726
def Enable(self):
727
"D-Bus method"
728
self.enable()
570
729
571
730
# StartChecker - method
572
731
@dbus.service.method(_interface)
581
740
self.disable()
582
741
583
742
# StopChecker - method
584
StopChecker = dbus.service.method(_interface)(stop_checker)
585
StopChecker.__name__ = "StopChecker"
743
@dbus.service.method(_interface)
744
def StopChecker(self):
745
self.stop_checker()
586
746
587
747
del _interface
588
748
589
749
590
def peer_certificate(session):
591
"Return the peer's OpenPGP certificate as a bytestring"
592
# If not an OpenPGP certificate...
593
if (gnutls.library.functions
594
.gnutls_certificate_type_get(session._c_object)
595
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
596
# ...do the normal thing
597
return session.peer_certificate
598
list_size = ctypes.c_uint(1)
599
cert_list = (gnutls.library.functions
600
.gnutls_certificate_get_peers
601
(session._c_object, ctypes.byref(list_size)))
602
if not bool(cert_list) and list_size.value != 0:
603
raise gnutls.errors.GNUTLSError("error getting peer"
604
" certificate")
605
if list_size.value == 0:
606
return None
607
cert = cert_list[0]
608
return ctypes.string_at(cert.data, cert.size)
609
610
611
def fingerprint(openpgp):
612
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
613
# New GnuTLS "datum" with the OpenPGP public key
614
datum = (gnutls.library.types
615
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
616
ctypes.POINTER
617
(ctypes.c_ubyte)),
618
ctypes.c_uint(len(openpgp))))
619
# New empty GnuTLS certificate
620
crt = gnutls.library.types.gnutls_openpgp_crt_t()
621
(gnutls.library.functions
622
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
623
# Import the OpenPGP public key into the certificate
624
(gnutls.library.functions
625
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
626
gnutls.library.constants
627
.GNUTLS_OPENPGP_FMT_RAW))
628
# Verify the self signature in the key
629
crtverify = ctypes.c_uint()
630
(gnutls.library.functions
631
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
632
if crtverify.value != 0:
633
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
634
raise gnutls.errors.CertificateSecurityError("Verify failed")
635
# New buffer for the fingerprint
636
buf = ctypes.create_string_buffer(20)
637
buf_len = ctypes.c_size_t()
638
# Get the fingerprint from the certificate into the buffer
639
(gnutls.library.functions
640
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
641
ctypes.byref(buf_len)))
642
# Deinit the certificate
643
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
644
# Convert the buffer to a Python bytestring
645
fpr = ctypes.string_at(buf, buf_len.value)
646
# Convert the bytestring to hexadecimal notation
647
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
648
return hex_fpr
649
650
651
class TCP_handler(SocketServer.BaseRequestHandler, object):
652
"""A TCP request handler class.
653
Instantiated by IPv6_TCPServer for each request to handle it.
750
class ClientHandler(socketserver.BaseRequestHandler, object):
751
"""A class to handle client connections.
752
753
Instantiated once for each connection to handle it.
654
754
Note: This will run in its own forked process."""
655
755
656
756
def handle(self):
657
757
logger.info(u"TCP connection from: %s",
658
758
unicode(self.client_address))
659
session = (gnutls.connection
660
.ClientSession(self.request,
661
gnutls.connection
662
.X509Credentials()))
663
664
line = self.request.makefile().readline()
665
logger.debug(u"Protocol version: %r", line)
666
try:
667
if int(line.strip().split()[0]) > 1:
668
raise RuntimeError
669
except (ValueError, IndexError, RuntimeError), error:
670
logger.error(u"Unknown protocol version: %s", error)
671
return
672
673
# Note: gnutls.connection.X509Credentials is really a generic
674
# GnuTLS certificate credentials object so long as no X.509
675
# keys are added to it. Therefore, we can use it here despite
676
# using OpenPGP certificates.
677
678
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
679
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
680
# "+DHE-DSS"))
681
# Use a fallback default, since this MUST be set.
682
priority = self.server.settings.get("priority", "NORMAL")
683
(gnutls.library.functions
684
.gnutls_priority_set_direct(session._c_object,
685
priority, None))
686
687
try:
688
session.handshake()
689
except gnutls.errors.GNUTLSError, error:
690
logger.warning(u"Handshake failed: %s", error)
691
# Do not run session.bye() here: the session is not
692
# established. Just abandon the request.
693
return
694
logger.debug(u"Handshake succeeded")
695
try:
696
fpr = fingerprint(peer_certificate(session))
697
except (TypeError, gnutls.errors.GNUTLSError), error:
698
logger.warning(u"Bad certificate: %s", error)
699
session.bye()
700
return
701
logger.debug(u"Fingerprint: %s", fpr)
702
for c in self.server.clients:
703
if c.fingerprint == fpr:
704
client = c
705
break
706
else:
707
logger.warning(u"Client not found for fingerprint: %s",
708
fpr)
709
session.bye()
710
return
711
# Have to check if client.still_valid(), since it is possible
712
# that the client timed out while establishing the GnuTLS
713
# session.
714
if not client.still_valid():
715
logger.warning(u"Client %(name)s is invalid",
716
vars(client))
717
session.bye()
718
return
719
## This won't work here, since we're in a fork.
720
# client.checked_ok()
721
sent_size = 0
722
while sent_size < len(client.secret):
723
sent = session.send(client.secret[sent_size:])
724
logger.debug(u"Sent: %d, remaining: %d",
725
sent, len(client.secret)
726
- (sent_size + sent))
727
sent_size += sent
728
session.bye()
729
730
731
class IPv6_TCPServer(SocketServer.ForkingMixIn,
732
SocketServer.TCPServer, object):
733
"""IPv6 TCP server. Accepts 'None' as address and/or port.
759
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
# Open IPC pipe to parent process
761
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
762
session = (gnutls.connection
763
.ClientSession(self.request,
764
gnutls.connection
765
.X509Credentials()))
766
767
line = self.request.makefile().readline()
768
logger.debug(u"Protocol version: %r", line)
769
try:
770
if int(line.strip().split()[0]) > 1:
771
raise RuntimeError
772
except (ValueError, IndexError, RuntimeError), error:
773
logger.error(u"Unknown protocol version: %s", error)
774
return
775
776
# Note: gnutls.connection.X509Credentials is really a
777
# generic GnuTLS certificate credentials object so long as
778
# no X.509 keys are added to it. Therefore, we can use it
779
# here despite using OpenPGP certificates.
780
781
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
# u"+AES-256-CBC", u"+SHA1",
783
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
784
# u"+DHE-DSS"))
785
# Use a fallback default, since this MUST be set.
786
priority = self.server.gnutls_priority
787
if priority is None:
788
priority = u"NORMAL"
789
(gnutls.library.functions
790
.gnutls_priority_set_direct(session._c_object,
791
priority, None))
792
793
try:
794
session.handshake()
795
except gnutls.errors.GNUTLSError, error:
796
logger.warning(u"Handshake failed: %s", error)
797
# Do not run session.bye() here: the session is not
798
# established. Just abandon the request.
799
return
800
logger.debug(u"Handshake succeeded")
801
try:
802
fpr = self.fingerprint(self.peer_certificate(session))
803
except (TypeError, gnutls.errors.GNUTLSError), error:
804
logger.warning(u"Bad certificate: %s", error)
805
session.bye()
806
return
807
logger.debug(u"Fingerprint: %s", fpr)
808
809
for c in self.server.clients:
810
if c.fingerprint == fpr:
811
client = c
812
break
813
else:
814
ipc.write(u"NOTFOUND %s %s\n"
815
% (fpr, unicode(self.client_address)))
816
session.bye()
817
return
818
# Have to check if client.still_valid(), since it is
819
# possible that the client timed out while establishing
820
# the GnuTLS session.
821
if not client.still_valid():
822
ipc.write(u"INVALID %s\n" % client.name)
823
session.bye()
824
return
825
ipc.write(u"SENDING %s\n" % client.name)
826
sent_size = 0
827
while sent_size < len(client.secret):
828
sent = session.send(client.secret[sent_size:])
829
logger.debug(u"Sent: %d, remaining: %d",
830
sent, len(client.secret)
831
- (sent_size + sent))
832
sent_size += sent
833
session.bye()
834
835
@staticmethod
836
def peer_certificate(session):
837
"Return the peer's OpenPGP certificate as a bytestring"
838
# If not an OpenPGP certificate...
839
if (gnutls.library.functions
840
.gnutls_certificate_type_get(session._c_object)
841
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
842
# ...do the normal thing
843
return session.peer_certificate
844
list_size = ctypes.c_uint(1)
845
cert_list = (gnutls.library.functions
846
.gnutls_certificate_get_peers
847
(session._c_object, ctypes.byref(list_size)))
848
if not bool(cert_list) and list_size.value != 0:
849
raise gnutls.errors.GNUTLSError(u"error getting peer"
850
u" certificate")
851
if list_size.value == 0:
852
return None
853
cert = cert_list[0]
854
return ctypes.string_at(cert.data, cert.size)
855
856
@staticmethod
857
def fingerprint(openpgp):
858
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
859
# New GnuTLS "datum" with the OpenPGP public key
860
datum = (gnutls.library.types
861
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
862
ctypes.POINTER
863
(ctypes.c_ubyte)),
864
ctypes.c_uint(len(openpgp))))
865
# New empty GnuTLS certificate
866
crt = gnutls.library.types.gnutls_openpgp_crt_t()
867
(gnutls.library.functions
868
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
869
# Import the OpenPGP public key into the certificate
870
(gnutls.library.functions
871
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
872
gnutls.library.constants
873
.GNUTLS_OPENPGP_FMT_RAW))
874
# Verify the self signature in the key
875
crtverify = ctypes.c_uint()
876
(gnutls.library.functions
877
.gnutls_openpgp_crt_verify_self(crt, 0,
878
ctypes.byref(crtverify)))
879
if crtverify.value != 0:
880
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
881
raise (gnutls.errors.CertificateSecurityError
882
(u"Verify failed"))
883
# New buffer for the fingerprint
884
buf = ctypes.create_string_buffer(20)
885
buf_len = ctypes.c_size_t()
886
# Get the fingerprint from the certificate into the buffer
887
(gnutls.library.functions
888
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
889
ctypes.byref(buf_len)))
890
# Deinit the certificate
891
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
892
# Convert the buffer to a Python bytestring
893
fpr = ctypes.string_at(buf, buf_len.value)
894
# Convert the bytestring to hexadecimal notation
895
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
896
return hex_fpr
897
898
899
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
900
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
901
def process_request(self, request, client_address):
902
"""Overrides and wraps the original process_request().
903
904
This function creates a new pipe in self.pipe
905
"""
906
self.pipe = os.pipe()
907
super(ForkingMixInWithPipe,
908
self).process_request(request, client_address)
909
os.close(self.pipe[1]) # close write end
910
self.add_pipe(self.pipe[0])
911
def add_pipe(self, pipe):
912
"""Dummy function; override as necessary"""
913
os.close(pipe)
914
915
916
class IPv6_TCPServer(ForkingMixInWithPipe,
917
socketserver.TCPServer, object):
918
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
919
734
920
Attributes:
735
settings: Server settings
736
clients: Set() of Client objects
737
921
enabled: Boolean; whether this server is activated yet
922
interface: None or a network interface name (string)
923
use_ipv6: Boolean; to use IPv6 or not
738
924
"""
739
address_family = socket.AF_INET6
740
def __init__(self, *args, **kwargs):
741
if "settings" in kwargs:
742
self.settings = kwargs["settings"]
743
del kwargs["settings"]
744
if "clients" in kwargs:
745
self.clients = kwargs["clients"]
746
del kwargs["clients"]
747
self.enabled = False
748
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
925
def __init__(self, server_address, RequestHandlerClass,
926
interface=None, use_ipv6=True):
927
self.interface = interface
928
if use_ipv6:
929
self.address_family = socket.AF_INET6
930
socketserver.TCPServer.__init__(self, server_address,
931
RequestHandlerClass)
749
932
def server_bind(self):
750
933
"""This overrides the normal server_bind() function
751
934
to bind to an interface if one was specified, and also NOT to
752
935
bind to an address or port if they were not specified."""
753
if self.settings["interface"]:
754
# 25 is from /usr/include/asm-i486/socket.h
755
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
756
try:
757
self.socket.setsockopt(socket.SOL_SOCKET,
758
SO_BINDTODEVICE,
759
self.settings["interface"])
760
except socket.error, error:
761
if error[0] == errno.EPERM:
762
logger.error(u"No permission to"
763
u" bind to interface %s",
764
self.settings["interface"])
765
else:
766
raise error
936
if self.interface is not None:
937
if SO_BINDTODEVICE is None:
938
logger.error(u"SO_BINDTODEVICE does not exist;"
939
u" cannot bind to interface %s",
940
self.interface)
941
else:
942
try:
943
self.socket.setsockopt(socket.SOL_SOCKET,
944
SO_BINDTODEVICE,
945
str(self.interface
946
+ u'\0'))
947
except socket.error, error:
948
if error[0] == errno.EPERM:
949
logger.error(u"No permission to"
950
u" bind to interface %s",
951
self.interface)
952
elif error[0] == errno.ENOPROTOOPT:
953
logger.error(u"SO_BINDTODEVICE not available;"
954
u" cannot bind to interface %s",
955
self.interface)
956
else:
957
raise
767
958
# Only bind(2) the socket if we really need to.
768
959
if self.server_address[0] or self.server_address[1]:
769
960
if not self.server_address[0]:
770
in6addr_any = "::"
771
self.server_address = (in6addr_any,
961
if self.address_family == socket.AF_INET6:
962
any_address = u"::" # in6addr_any
963
else:
964
any_address = socket.INADDR_ANY
965
self.server_address = (any_address,
772
966
self.server_address[1])
773
967
elif not self.server_address[1]:
774
968
self.server_address = (self.server_address[0],
775
969
0)
776
# if self.settings["interface"]:
970
# if self.interface:
777
971
# self.server_address = (self.server_address[0],
778
972
# 0, # port
779
973
# 0, # flowinfo
780
974
# if_nametoindex
781
# (self.settings
782
# ["interface"]))
783
return super(IPv6_TCPServer, self).server_bind()
975
# (self.interface))
976
return socketserver.TCPServer.server_bind(self)
977
978
979
class MandosServer(IPv6_TCPServer):
980
"""Mandos server.
981
982
Attributes:
983
clients: set of Client objects
984
gnutls_priority GnuTLS priority string
985
use_dbus: Boolean; to emit D-Bus signals or not
986
clients: set of Client objects
987
gnutls_priority GnuTLS priority string
988
use_dbus: Boolean; to emit D-Bus signals or not
989
990
Assumes a gobject.MainLoop event loop.
991
"""
992
def __init__(self, server_address, RequestHandlerClass,
993
interface=None, use_ipv6=True, clients=None,
994
gnutls_priority=None, use_dbus=True):
995
self.enabled = False
996
self.clients = clients
997
if self.clients is None:
998
self.clients = set()
999
self.use_dbus = use_dbus
1000
self.gnutls_priority = gnutls_priority
1001
IPv6_TCPServer.__init__(self, server_address,
1002
RequestHandlerClass,
1003
interface = interface,
1004
use_ipv6 = use_ipv6)
784
1005
def server_activate(self):
785
1006
if self.enabled:
786
return super(IPv6_TCPServer, self).server_activate()
1007
return socketserver.TCPServer.server_activate(self)
787
1008
def enable(self):
788
1009
self.enabled = True
1010
def add_pipe(self, pipe):
1011
# Call "handle_ipc" for both data and EOF events
1012
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1013
self.handle_ipc)
1014
def handle_ipc(self, source, condition, file_objects={}):
1015
condition_names = {
1016
gobject.IO_IN: u"IN", # There is data to read.
1017
gobject.IO_OUT: u"OUT", # Data can be written (without
1018
# blocking).
1019
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1020
gobject.IO_ERR: u"ERR", # Error condition.
1021
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1022
# broken, usually for pipes and
1023
# sockets).
1024
}
1025
conditions_string = ' | '.join(name
1026
for cond, name in
1027
condition_names.iteritems()
1028
if cond & condition)
1029
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1030
conditions_string)
1031
1032
# Turn the pipe file descriptor into a Python file object
1033
if source not in file_objects:
1034
file_objects[source] = os.fdopen(source, u"r", 1)
1035
1036
# Read a line from the file object
1037
cmdline = file_objects[source].readline()
1038
if not cmdline: # Empty line means end of file
1039
# close the IPC pipe
1040
file_objects[source].close()
1041
del file_objects[source]
1042
1043
# Stop calling this function
1044
return False
1045
1046
logger.debug(u"IPC command: %r", cmdline)
1047
1048
# Parse and act on command
1049
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1050
1051
if cmd == u"NOTFOUND":
1052
logger.warning(u"Client not found for fingerprint: %s",
1053
args)
1054
if self.use_dbus:
1055
# Emit D-Bus signal
1056
mandos_dbus_service.ClientNotFound(args)
1057
elif cmd == u"INVALID":
1058
for client in self.clients:
1059
if client.name == args:
1060
logger.warning(u"Client %s is invalid", args)
1061
if self.use_dbus:
1062
# Emit D-Bus signal
1063
client.Rejected()
1064
break
1065
else:
1066
logger.error(u"Unknown client %s is invalid", args)
1067
elif cmd == u"SENDING":
1068
for client in self.clients:
1069
if client.name == args:
1070
logger.info(u"Sending secret to %s", client.name)
1071
client.checked_ok()
1072
if self.use_dbus:
1073
# Emit D-Bus signal
1074
client.ReceivedSecret()
1075
break
1076
else:
1077
logger.error(u"Sending secret to unknown client %s",
1078
args)
1079
else:
1080
logger.error(u"Unknown IPC command: %r", cmdline)
1081
1082
# Keep calling this function
1083
return True
789
1084
790
1085
791
1086
def string_to_delta(interval):
792
1087
"""Parse a string and return a datetime.timedelta
793
794
>>> string_to_delta('7d')
1088
1089
>>> string_to_delta(u'7d')
795
1090
datetime.timedelta(7)
796
>>> string_to_delta('60s')
1091
>>> string_to_delta(u'60s')
797
1092
datetime.timedelta(0, 60)
798
>>> string_to_delta('60m')
1093
>>> string_to_delta(u'60m')
799
1094
datetime.timedelta(0, 3600)
800
>>> string_to_delta('24h')
1095
>>> string_to_delta(u'24h')
801
1096
datetime.timedelta(1)
802
1097
>>> string_to_delta(u'1w')
803
1098
datetime.timedelta(7)
804
>>> string_to_delta('5m 30s')
1099
>>> string_to_delta(u'5m 30s')
805
1100
datetime.timedelta(0, 330)
806
1101
"""
807
1102
timevalue = datetime.timedelta(0)
827
1122
return timevalue
828
1123
829
1124
830
def server_state_changed(state):
831
"""Derived from the Avahi example code"""
832
if state == avahi.SERVER_COLLISION:
833
logger.error(u"Zeroconf server name collision")
834
service.remove()
835
elif state == avahi.SERVER_RUNNING:
836
service.add()
837
838
839
def entry_group_state_changed(state, error):
840
"""Derived from the Avahi example code"""
841
logger.debug(u"Avahi state change: %i", state)
842
843
if state == avahi.ENTRY_GROUP_ESTABLISHED:
844
logger.debug(u"Zeroconf service established.")
845
elif state == avahi.ENTRY_GROUP_COLLISION:
846
logger.warning(u"Zeroconf service name collision.")
847
service.rename()
848
elif state == avahi.ENTRY_GROUP_FAILURE:
849
logger.critical(u"Avahi: Error in group state changed %s",
850
unicode(error))
851
raise AvahiGroupError(u"State changed: %s" % unicode(error))
852
853
1125
def if_nametoindex(interface):
854
"""Call the C function if_nametoindex(), or equivalent"""
1126
"""Call the C function if_nametoindex(), or equivalent
1127
1128
Note: This function cannot accept a unicode string."""
855
1129
global if_nametoindex
856
1130
try:
857
1131
if_nametoindex = (ctypes.cdll.LoadLibrary
858
(ctypes.util.find_library("c"))
1132
(ctypes.util.find_library(u"c"))
859
1133
.if_nametoindex)
860
1134
except (OSError, AttributeError):
861
if "struct" not in sys.modules:
862
import struct
863
if "fcntl" not in sys.modules:
864
import fcntl
1135
logger.warning(u"Doing if_nametoindex the hard way")
865
1136
def if_nametoindex(interface):
866
1137
"Get an interface index the hard way, i.e. using fcntl()"
867
1138
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
868
1139
with closing(socket.socket()) as s:
869
1140
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
870
struct.pack("16s16x", interface))
871
interface_index = struct.unpack("I", ifreq[16:20])[0]
1141
struct.pack(str(u"16s16x"),
1142
interface))
1143
interface_index = struct.unpack(str(u"I"),
1144
ifreq[16:20])[0]
872
1145
return interface_index
873
1146
return if_nametoindex(interface)
874
1147
875
1148
876
1149
def daemon(nochdir = False, noclose = False):
877
1150
"""See daemon(3). Standard BSD Unix function.
1151
878
1152
This should really exist as os.daemon, but it doesn't (yet)."""
879
1153
if os.fork():
880
1154
sys.exit()
881
1155
os.setsid()
882
1156
if not nochdir:
883
os.chdir("/")
1157
os.chdir(u"/")
884
1158
if os.fork():
885
1159
sys.exit()
886
1160
if not noclose:
888
1162
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
889
1163
if not stat.S_ISCHR(os.fstat(null).st_mode):
890
1164
raise OSError(errno.ENODEV,
891
"/dev/null not a character device")
1165
u"/dev/null not a character device")
892
1166
os.dup2(null, sys.stdin.fileno())
893
1167
os.dup2(null, sys.stdout.fileno())
894
1168
os.dup2(null, sys.stderr.fileno())
897
1171
898
1172
899
1173
def main():
1174
1175
######################################################################
1176
# Parsing of options, both command line and config file
1177
900
1178
parser = optparse.OptionParser(version = "%%prog %s" % version)
901
parser.add_option("-i", "--interface", type="string",
902
metavar="IF", help="Bind to interface IF")
903
parser.add_option("-a", "--address", type="string",
904
help="Address to listen for requests on")
905
parser.add_option("-p", "--port", type="int",
906
help="Port number to receive requests on")
907
parser.add_option("--check", action="store_true",
908
help="Run self-test")
909
parser.add_option("--debug", action="store_true",
910
help="Debug mode; run in foreground and log to"
911
" terminal")
912
parser.add_option("--priority", type="string", help="GnuTLS"
913
" priority string (see GnuTLS documentation)")
914
parser.add_option("--servicename", type="string", metavar="NAME",
915
help="Zeroconf service name")
916
parser.add_option("--configdir", type="string",
917
default="/etc/mandos", metavar="DIR",
918
help="Directory to search for configuration"
919
" files")
920
parser.add_option("--no-dbus", action="store_false",
921
dest="use_dbus",
922
help="Do not provide D-Bus system bus"
923
" interface")
1179
parser.add_option("-i", u"--interface", type=u"string",
1180
metavar="IF", help=u"Bind to interface IF")
1181
parser.add_option("-a", u"--address", type=u"string",
1182
help=u"Address to listen for requests on")
1183
parser.add_option("-p", u"--port", type=u"int",
1184
help=u"Port number to receive requests on")
1185
parser.add_option("--check", action=u"store_true",
1186
help=u"Run self-test")
1187
parser.add_option("--debug", action=u"store_true",
1188
help=u"Debug mode; run in foreground and log to"
1189
u" terminal")
1190
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1191
u" priority string (see GnuTLS documentation)")
1192
parser.add_option("--servicename", type=u"string",
1193
metavar=u"NAME", help=u"Zeroconf service name")
1194
parser.add_option("--configdir", type=u"string",
1195
default=u"/etc/mandos", metavar=u"DIR",
1196
help=u"Directory to search for configuration"
1197
u" files")
1198
parser.add_option("--no-dbus", action=u"store_false",
1199
dest=u"use_dbus",
1200
help=optparse.SUPPRESS_HELP) # XXX: Not done yet
1201
parser.add_option("--no-ipv6", action=u"store_false",
1202
dest=u"use_ipv6", help=u"Do not use IPv6")
924
1203
options = parser.parse_args()[0]
925
1204
926
1205
if options.check:
929
1208
sys.exit()
930
1209
931
1210
# Default values for config file for server-global settings
932
server_defaults = { "interface": "",
933
"address": "",
934
"port": "",
935
"debug": "False",
936
"priority":
937
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
938
"servicename": "Mandos",
939
"use_dbus": "True",
1211
server_defaults = { u"interface": u"",
1212
u"address": u"",
1213
u"port": u"",
1214
u"debug": u"False",
1215
u"priority":
1216
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1217
u"servicename": u"Mandos",
1218
u"use_dbus": u"True",
1219
u"use_ipv6": u"True",
940
1220
}
941
1221
942
1222
# Parse config file for server-global settings
943
server_config = ConfigParser.SafeConfigParser(server_defaults)
1223
server_config = configparser.SafeConfigParser(server_defaults)
944
1224
del server_defaults
945
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1225
server_config.read(os.path.join(options.configdir,
1226
u"mandos.conf"))
946
1227
# Convert the SafeConfigParser object to a dict
947
1228
server_settings = server_config.defaults()
948
1229
# Use the appropriate methods on the non-string config options
949
server_settings["debug"] = server_config.getboolean("DEFAULT",
950
"debug")
951
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
952
"use_dbus")
1230
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1231
server_settings[option] = server_config.getboolean(u"DEFAULT",
1232
option)
953
1233
if server_settings["port"]:
954
server_settings["port"] = server_config.getint("DEFAULT",
955
"port")
1234
server_settings["port"] = server_config.getint(u"DEFAULT",
1235
u"port")
956
1236
del server_config
957
1237
958
1238
# Override the settings from the config file with command line
959
1239
# options, if set.
960
for option in ("interface", "address", "port", "debug",
961
"priority", "servicename", "configdir",
962
"use_dbus"):
1240
for option in (u"interface", u"address", u"port", u"debug",
1241
u"priority", u"servicename", u"configdir",
1242
u"use_dbus", u"use_ipv6"):
963
1243
value = getattr(options, option)
964
1244
if value is not None:
965
1245
server_settings[option] = value
966
1246
del options
1247
# Force all strings to be unicode
1248
for option in server_settings.keys():
1249
if type(server_settings[option]) is str:
1250
server_settings[option] = unicode(server_settings[option])
967
1251
# Now we have our good server settings in "server_settings"
968
1252
1253
##################################################################
1254
969
1255
# For convenience
970
debug = server_settings["debug"]
971
use_dbus = server_settings["use_dbus"]
1256
debug = server_settings[u"debug"]
1257
use_dbus = server_settings[u"use_dbus"]
1258
use_dbus = False # XXX: Not done yet
1259
use_ipv6 = server_settings[u"use_ipv6"]
972
1260
973
1261
if not debug:
974
1262
syslogger.setLevel(logging.WARNING)
975
1263
console.setLevel(logging.WARNING)
976
1264
977
if server_settings["servicename"] != "Mandos":
1265
if server_settings[u"servicename"] != u"Mandos":
978
1266
syslogger.setFormatter(logging.Formatter
979
('Mandos (%s): %%(levelname)s:'
980
' %%(message)s'
981
% server_settings["servicename"]))
1267
(u'Mandos (%s) [%%(process)d]:'
1268
u' %%(levelname)s: %%(message)s'
1269
% server_settings[u"servicename"]))
982
1270
983
1271
# Parse config file with clients
984
client_defaults = { "timeout": "1h",
985
"interval": "5m",
986
"checker": "fping -q -- %%(host)s",
987
"host": "",
1272
client_defaults = { u"timeout": u"1h",
1273
u"interval": u"5m",
1274
u"checker": u"fping -q -- %%(host)s",
1275
u"host": u"",
988
1276
}
989
client_config = ConfigParser.SafeConfigParser(client_defaults)
990
client_config.read(os.path.join(server_settings["configdir"],
991
"clients.conf"))
992
993
clients = Set()
994
tcp_server = IPv6_TCPServer((server_settings["address"],
995
server_settings["port"]),
996
TCP_handler,
997
settings=server_settings,
998
clients=clients)
999
pidfilename = "/var/run/mandos.pid"
1000
try:
1001
pidfile = open(pidfilename, "w")
1002
except IOError, error:
1003
logger.error("Could not open file %r", pidfilename)
1004
1005
try:
1006
uid = pwd.getpwnam("_mandos").pw_uid
1007
gid = pwd.getpwnam("_mandos").pw_gid
1277
client_config = configparser.SafeConfigParser(client_defaults)
1278
client_config.read(os.path.join(server_settings[u"configdir"],
1279
u"clients.conf"))
1280
1281
global mandos_dbus_service
1282
mandos_dbus_service = None
1283
1284
tcp_server = MandosServer((server_settings[u"address"],
1285
server_settings[u"port"]),
1286
ClientHandler,
1287
interface=server_settings[u"interface"],
1288
use_ipv6=use_ipv6,
1289
gnutls_priority=
1290
server_settings[u"priority"],
1291
use_dbus=use_dbus)
1292
pidfilename = u"/var/run/mandos.pid"
1293
try:
1294
pidfile = open(pidfilename, u"w")
1295
except IOError:
1296
logger.error(u"Could not open file %r", pidfilename)
1297
1298
try:
1299
uid = pwd.getpwnam(u"_mandos").pw_uid
1300
gid = pwd.getpwnam(u"_mandos").pw_gid
1008
1301
except KeyError:
1009
1302
try:
1010
uid = pwd.getpwnam("mandos").pw_uid
1011
gid = pwd.getpwnam("mandos").pw_gid
1303
uid = pwd.getpwnam(u"mandos").pw_uid
1304
gid = pwd.getpwnam(u"mandos").pw_gid
1012
1305
except KeyError:
1013
1306
try:
1014
uid = pwd.getpwnam("nobody").pw_uid
1015
gid = pwd.getpwnam("nogroup").pw_gid
1307
uid = pwd.getpwnam(u"nobody").pw_uid
1308
gid = pwd.getpwnam(u"nobody").pw_gid
1016
1309
except KeyError:
1017
1310
uid = 65534
1018
1311
gid = 65534
1019
1312
try:
1313
os.setgid(gid)
1020
1314
os.setuid(uid)
1021
os.setgid(gid)
1022
1315
except OSError, error:
1023
1316
if error[0] != errno.EPERM:
1024
1317
raise error
1025
1318
1026
global service
1027
service = AvahiService(name = server_settings["servicename"],
1028
servicetype = "_mandos._tcp", )
1029
if server_settings["interface"]:
1030
service.interface = (if_nametoindex
1031
(server_settings["interface"]))
1319
# Enable all possible GnuTLS debugging
1320
if debug:
1321
# "Use a log level over 10 to enable all debugging options."
1322
# - GnuTLS manual
1323
gnutls.library.functions.gnutls_global_set_log_level(11)
1324
1325
@gnutls.library.types.gnutls_log_func
1326
def debug_gnutls(level, string):
1327
logger.debug(u"GnuTLS: %s", string[:-1])
1328
1329
(gnutls.library.functions
1330
.gnutls_global_set_log_function(debug_gnutls))
1032
1331
1033
1332
global main_loop
1034
global bus
1035
global server
1036
1333
# From the Avahi example code
1037
1334
DBusGMainLoop(set_as_default=True )
1038
1335
main_loop = gobject.MainLoop()
1039
1336
bus = dbus.SystemBus()
1040
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1041
avahi.DBUS_PATH_SERVER),
1042
avahi.DBUS_INTERFACE_SERVER)
1043
1337
# End of Avahi example code
1044
1338
if use_dbus:
1045
1339
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1340
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1341
service = AvahiService(name = server_settings[u"servicename"],
1342
servicetype = u"_mandos._tcp",
1343
protocol = protocol, bus = bus)
1344
if server_settings["interface"]:
1345
service.interface = (if_nametoindex
1346
(str(server_settings[u"interface"])))
1046
1347
1047
clients.update(Set(Client(name = section,
1048
config
1049
= dict(client_config.items(section)),
1050
use_dbus = use_dbus)
1051
for section in client_config.sections()))
1052
if not clients:
1348
client_class = Client
1349
if use_dbus:
1350
client_class = functools.partial(ClientDBus, bus = bus)
1351
tcp_server.clients.update(set(
1352
client_class(name = section,
1353
config= dict(client_config.items(section)))
1354
for section in client_config.sections()))
1355
if not tcp_server.clients:
1053
1356
logger.warning(u"No clients defined")
1054
1357
1055
1358
if debug:
1065
1368
daemon()
1066
1369
1067
1370
try:
1068
pid = os.getpid()
1069
pidfile.write(str(pid) + "\n")
1070
pidfile.close()
1371
with closing(pidfile):
1372
pid = os.getpid()
1373
pidfile.write(str(pid) + "\n")
1071
1374
del pidfile
1072
1375
except IOError:
1073
1376
logger.error(u"Could not write to file %r with PID %d",
1079
1382
1080
1383
def cleanup():
1081
1384
"Cleanup function; run on exit"
1082
global group
1083
# From the Avahi example code
1084
if not group is None:
1085
group.Free()
1086
group = None
1087
# End of Avahi example code
1385
service.cleanup()
1088
1386
1089
while clients:
1090
client = clients.pop()
1387
while tcp_server.clients:
1388
client = tcp_server.clients.pop()
1091
1389
client.disable_hook = None
1092
1390
client.disable()
1093
1391
1099
1397
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1100
1398
1101
1399
if use_dbus:
1102
class MandosServer(dbus.service.Object):
1400
class MandosDBusService(dbus.service.Object):
1103
1401
"""A D-Bus proxy object"""
1104
1402
def __init__(self):
1105
dbus.service.Object.__init__(self, bus, "/")
1403
dbus.service.Object.__init__(self, bus, u"/")
1106
1404
_interface = u"se.bsnet.fukt.Mandos"
1107
1405
1108
@dbus.service.signal(_interface, signature="oa{sv}")
1406
@dbus.service.signal(_interface, signature=u"oa{sv}")
1109
1407
def ClientAdded(self, objpath, properties):
1110
1408
"D-Bus signal"
1111
1409
pass
1112
1410
1113
@dbus.service.signal(_interface, signature="os")
1411
@dbus.service.signal(_interface, signature=u"s")
1412
def ClientNotFound(self, fingerprint):
1413
"D-Bus signal"
1414
pass
1415
1416
@dbus.service.signal(_interface, signature=u"os")
1114
1417
def ClientRemoved(self, objpath, name):
1115
1418
"D-Bus signal"
1116
1419
pass
1117
1420
1118
@dbus.service.method(_interface, out_signature="ao")
1421
@dbus.service.method(_interface, out_signature=u"ao")
1119
1422
def GetAllClients(self):
1120
1423
"D-Bus method"
1121
return dbus.Array(c.dbus_object_path for c in clients)
1424
return dbus.Array(c.dbus_object_path
1425
for c in tcp_server.clients)
1122
1426
1123
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1427
@dbus.service.method(_interface,
1428
out_signature=u"a{oa{sv}}")
1124
1429
def GetAllClientsWithProperties(self):
1125
1430
"D-Bus method"
1126
1431
return dbus.Dictionary(
1127
1432
((c.dbus_object_path, c.GetAllProperties())
1128
for c in clients),
1129
signature="oa{sv}")
1433
for c in tcp_server.clients),
1434
signature=u"oa{sv}")
1130
1435
1131
@dbus.service.method(_interface, in_signature="o")
1436
@dbus.service.method(_interface, in_signature=u"o")
1132
1437
def RemoveClient(self, object_path):
1133
1438
"D-Bus method"
1134
for c in clients:
1439
for c in tcp_server.clients:
1135
1440
if c.dbus_object_path == object_path:
1136
clients.remove(c)
1441
tcp_server.clients.remove(c)
1442
c.remove_from_connection()
1137
1443
# Don't signal anything except ClientRemoved
1138
c.use_dbus = False
1139
c.disable()
1444
c.disable(signal=False)
1140
1445
# Emit D-Bus signal
1141
1446
self.ClientRemoved(object_path, c.name)
1142
1447
return
1144
1449
1145
1450
del _interface
1146
1451
1147
mandos_server = MandosServer()
1452
mandos_dbus_service = MandosDBusService()
1148
1453
1149
for client in clients:
1454
for client in tcp_server.clients:
1150
1455
if use_dbus:
1151
1456
# Emit D-Bus signal
1152
mandos_server.ClientAdded(client.dbus_object_path,
1153
client.GetAllProperties())
1457
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1458
client.GetAllProperties())
1154
1459
client.enable()
1155
1460
1156
1461
tcp_server.enable()
1158
1463
1159
1464
# Find out what port we got
1160
1465
service.port = tcp_server.socket.getsockname()[1]
1161
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1162
u" scope_id %d" % tcp_server.socket.getsockname())
1466
if use_ipv6:
1467
logger.info(u"Now listening on address %r, port %d,"
1468
" flowinfo %d, scope_id %d"
1469
% tcp_server.socket.getsockname())
1470
else: # IPv4
1471
logger.info(u"Now listening on address %r, port %d"
1472
% tcp_server.socket.getsockname())
1163
1473
1164
1474
#service.interface = tcp_server.socket.getsockname()[3]
1165
1475
1166
1476
try:
1167
1477
# From the Avahi example code
1168
server.connect_to_signal("StateChanged", server_state_changed)
1169
1478
try:
1170
server_state_changed(server.GetState())
1479
service.activate()
1171
1480
except dbus.exceptions.DBusException, error:
1172
1481
logger.critical(u"DBusException: %s", error)
1173
1482
sys.exit(1)
1185
1494
sys.exit(1)
1186
1495
except KeyboardInterrupt:
1187
1496
if debug:
1188
print
1497
print >> sys.stderr
1498
logger.debug(u"Server received KeyboardInterrupt")
1499
logger.debug(u"Server exiting")
1189
1500
1190
1501
if __name__ == '__main__':
1191
1502
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0