To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237
- compare with another revision
- download diff
- download tarball
- view history from revision 237
- Committer: Teddy Hogeborn
- Date: 2008-11-08 17:26:35 UTC
- Revision ID: teddy@fukt.bsnet.se-20081108172635-6eexzbysvsk4bu1z
* mandos: Also import "with_statement" and "absolute_import" from
"__future__. Import "closing" from "contextlib".
(Client.__init__): Use "with closing" on "secfile".
(Client.checker_callback): Call "self.bump_timeout()" instead of
doing it directly.
(Client.bump_timeout): New method to bump up the timeout.
(TCP_handler.handle): Simplify code to provide fallback default for
GnuTLS priority string.
(IPv6_TCPServer): Do not inherit from
"SocketServer.ForkingTCPServer", since that is
undocumented - instead, follow the example code
from the documentation.
(if_nametoindex): Use "with closing" on the socket.
"__future__. Import "closing" from "contextlib".
(Client.__init__): Use "with closing" on "secfile".
(Client.checker_callback): Call "self.bump_timeout()" instead of
doing it directly.
(Client.bump_timeout): New method to bump up the timeout.
(TCP_handler.handle): Simplify code to provide fallback default for
GnuTLS priority string.
(IPv6_TCPServer): Do not inherit from
"SocketServer.ForkingTCPServer", since that is
undocumented - instead, follow the example code
from the documentation.
(if_nametoindex): Use "with closing" on the socket.
- files added:
- debian/mandos-client.config
- files removed:
- debian/watch
- files modified:
- Makefile
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
35
34
36
35
import SocketServer
37
36
import socket
38
import optparse
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
59
58
from contextlib import closing
60
59
61
60
import dbus
62
import dbus.service
63
61
import gobject
64
62
import avahi
65
63
from dbus.mainloop.glib import DBusGMainLoop
66
64
import ctypes
67
65
import ctypes.util
68
66
69
version = "1.0.5"
67
version = "1.0.2"
70
68
71
69
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
70
syslogger = logging.handlers.SysLogHandler\
71
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
72
address = "/dev/log")
73
syslogger.setFormatter(logging.Formatter\
74
('Mandos: %(levelname)s: %(message)s'))
77
75
logger.addHandler(syslogger)
78
76
79
77
console = logging.StreamHandler()
82
80
logger.addHandler(console)
83
81
84
82
class AvahiError(Exception):
85
def __init__(self, value, *args, **kwargs):
83
def __init__(self, value):
86
84
self.value = value
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
85
super(AvahiError, self).__init__()
86
def __str__(self):
87
return repr(self.value)
90
88
91
89
class AvahiServiceError(AvahiError):
92
90
pass
112
110
a sensible number of times
113
111
"""
114
112
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
113
servicetype = None, port = None, TXT = None, domain = "",
114
host = "", max_renames = 32768):
117
115
self.interface = interface
118
116
self.name = name
119
117
self.type = servicetype
120
118
self.port = port
121
self.TXT = TXT if TXT is not None else []
119
if TXT is None:
120
self.TXT = []
121
else:
122
self.TXT = TXT
122
123
self.domain = domain
123
124
self.host = host
124
125
self.rename_count = 0
129
130
logger.critical(u"No suitable Zeroconf service name found"
130
131
u" after %i retries, exiting.",
131
132
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
133
raise AvahiServiceError("Too many renames")
133
134
self.name = server.GetAlternativeServiceName(self.name)
134
135
logger.info(u"Changing Zeroconf service name to %r ...",
135
136
str(self.name))
136
syslogger.setFormatter(logging.Formatter
137
syslogger.setFormatter(logging.Formatter\
137
138
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
139
' %%(message)s' % self.name))
139
140
self.remove()
140
141
self.add()
141
142
self.rename_count += 1
147
148
"""Derived from the Avahi example code"""
148
149
global group
149
150
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
151
group = dbus.Interface\
152
(bus.get_object(avahi.DBUS_NAME,
152
153
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
155
group.connect_to_signal('StateChanged',
155
156
entry_group_state_changed)
156
157
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
170
171
# End of Avahi example code
171
172
172
173
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
174
class Client(object):
179
175
"""A representation of a client host served by this server.
180
176
Attributes:
181
name: string; from the config file, used in log messages
177
name: string; from the config file, used in log messages
182
178
fingerprint: string (40 or 32 hexadecimal digits); used to
183
179
uniquely identify the client
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
180
secret: bytestring; sent verbatim (over TLS) to client
181
host: string; available for use by the checker command
182
created: datetime.datetime(); object creation, not client host
183
last_checked_ok: datetime.datetime() or None if not yet checked OK
184
timeout: datetime.timedelta(); How long from last_checked_ok
185
until this client is invalid
186
interval: datetime.timedelta(); How often to start a new checker
187
stop_hook: If set, called by stop() as stop_hook(self)
188
checker: subprocess.Popen(); a running checker process used
189
to see if the client lives.
190
'None' if no process is running.
197
191
checker_initiator_tag: a gobject event source tag, or None
198
disable_initiator_tag: - '' -
192
stop_initiator_tag: - '' -
199
193
checker_callback_tag: - '' -
200
194
checker_command: string; External command which is run to check if
201
195
client lives. %() expansions are done at
202
196
runtime with vars(self) as dict, so that for
203
197
instance %(name)s can be used in the command.
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
198
Private attibutes:
199
_timeout: Real variable for 'timeout'
200
_interval: Real variable for 'interval'
201
_timeout_milliseconds: Used when calling gobject.timeout_add()
202
_interval_milliseconds: - '' -
206
203
"""
207
def timeout_milliseconds(self):
208
"Return the 'timeout' attribute in milliseconds"
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
212
213
def interval_milliseconds(self):
214
"Return the 'interval' attribute in milliseconds"
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
218
219
def __init__(self, name = None, disable_hook=None, config=None,
220
use_dbus=True):
204
def _set_timeout(self, timeout):
205
"Setter function for 'timeout' attribute"
206
self._timeout = timeout
207
self._timeout_milliseconds = ((self.timeout.days
208
* 24 * 60 * 60 * 1000)
209
+ (self.timeout.seconds * 1000)
210
+ (self.timeout.microseconds
211
// 1000))
212
timeout = property(lambda self: self._timeout,
213
_set_timeout)
214
del _set_timeout
215
def _set_interval(self, interval):
216
"Setter function for 'interval' attribute"
217
self._interval = interval
218
self._interval_milliseconds = ((self.interval.days
219
* 24 * 60 * 60 * 1000)
220
+ (self.interval.seconds
221
* 1000)
222
+ (self.interval.microseconds
223
// 1000))
224
interval = property(lambda self: self._interval,
225
_set_interval)
226
del _set_interval
227
def __init__(self, name = None, stop_hook=None, config=None):
221
228
"""Note: the 'checker' key in 'config' sets the
222
229
'checker_command' attribute and *not* the 'checker'
223
230
attribute."""
224
self.name = name
225
231
if config is None:
226
232
config = {}
233
self.name = name
227
234
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
229
if self.use_dbus:
230
self.dbus_object_path = (dbus.ObjectPath
231
("/Mandos/clients/"
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
235
235
# Uppercase and remove spaces from fingerprint for later
236
236
# comparison purposes with return value from the fingerprint()
237
237
# function
238
self.fingerprint = (config["fingerprint"].upper()
239
.replace(u" ", u""))
238
self.fingerprint = config["fingerprint"].upper()\
239
.replace(u" ", u"")
240
240
logger.debug(u" Fingerprint: %s", self.fingerprint)
241
241
if "secret" in config:
242
242
self.secret = config["secret"].decode(u"base64")
243
243
elif "secfile" in config:
244
244
with closing(open(os.path.expanduser
245
245
(os.path.expandvars
246
(config["secfile"])))) as secfile:
246
(config["secfile"])))) \
247
as secfile:
247
248
self.secret = secfile.read()
248
249
else:
249
250
raise TypeError(u"No secret or secfile for client %s"
250
251
% self.name)
251
252
self.host = config.get("host", "")
252
self.created = datetime.datetime.utcnow()
253
self.enabled = False
254
self.last_enabled = None
253
self.created = datetime.datetime.now()
255
254
self.last_checked_ok = None
256
255
self.timeout = string_to_delta(config["timeout"])
257
256
self.interval = string_to_delta(config["interval"])
258
self.disable_hook = disable_hook
257
self.stop_hook = stop_hook
259
258
self.checker = None
260
259
self.checker_initiator_tag = None
261
self.disable_initiator_tag = None
260
self.stop_initiator_tag = None
262
261
self.checker_callback_tag = None
263
self.checker_command = config["checker"]
264
265
def enable(self):
262
self.check_command = config["checker"]
263
def start(self):
266
264
"""Start this client's checker and timeout hooks"""
267
self.last_enabled = datetime.datetime.utcnow()
268
265
# Schedule a new checker to be started an 'interval' from now,
269
266
# and every interval from then on.
270
self.checker_initiator_tag = (gobject.timeout_add
271
(self.interval_milliseconds(),
272
self.start_checker))
267
self.checker_initiator_tag = gobject.timeout_add\
268
(self._interval_milliseconds,
269
self.start_checker)
273
270
# Also start a new checker *right now*.
274
271
self.start_checker()
275
# Schedule a disable() when 'timeout' has passed
276
self.disable_initiator_tag = (gobject.timeout_add
277
(self.timeout_milliseconds(),
278
self.disable))
279
self.enabled = True
280
if self.use_dbus:
281
# Emit D-Bus signals
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
286
variant_level=1)))
287
288
def disable(self):
289
"""Disable this client."""
290
if not getattr(self, "enabled", False):
272
# Schedule a stop() when 'timeout' has passed
273
self.stop_initiator_tag = gobject.timeout_add\
274
(self._timeout_milliseconds,
275
self.stop)
276
def stop(self):
277
"""Stop this client.
278
The possibility that a client might be restarted is left open,
279
but not currently used."""
280
# If this client doesn't have a secret, it is already stopped.
281
if hasattr(self, "secret") and self.secret:
282
logger.info(u"Stopping client %s", self.name)
283
self.secret = None
284
else:
291
285
return False
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
294
gobject.source_remove(self.disable_initiator_tag)
295
self.disable_initiator_tag = None
286
if getattr(self, "stop_initiator_tag", False):
287
gobject.source_remove(self.stop_initiator_tag)
288
self.stop_initiator_tag = None
296
289
if getattr(self, "checker_initiator_tag", False):
297
290
gobject.source_remove(self.checker_initiator_tag)
298
291
self.checker_initiator_tag = None
299
292
self.stop_checker()
300
if self.disable_hook:
301
self.disable_hook(self)
302
self.enabled = False
303
if self.use_dbus:
304
# Emit D-Bus signal
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
293
if self.stop_hook:
294
self.stop_hook(self)
307
295
# Do not run this again if called by a gobject.timeout_add
308
296
return False
309
310
297
def __del__(self):
311
self.disable_hook = None
312
self.disable()
313
314
def checker_callback(self, pid, condition, command):
298
self.stop_hook = None
299
self.stop()
300
def checker_callback(self, pid, condition):
315
301
"""The checker has completed, so take appropriate actions."""
316
302
self.checker_callback_tag = None
317
303
self.checker = None
318
if self.use_dbus:
319
# Emit D-Bus signal
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
304
if os.WIFEXITED(condition) \
305
and (os.WEXITSTATUS(condition) == 0):
324
306
logger.info(u"Checker for %(name)s succeeded",
325
307
vars(self))
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
331
308
self.bump_timeout()
332
309
elif not os.WIFEXITED(condition):
333
310
logger.warning(u"Checker for %(name)s crashed?",
334
311
vars(self))
335
if self.use_dbus:
336
# Emit D-Bus signal
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
340
312
else:
341
313
logger.info(u"Checker for %(name)s failed",
342
314
vars(self))
343
if self.use_dbus:
344
# Emit D-Bus signal
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
348
349
315
def bump_timeout(self):
350
316
"""Bump up the timeout for this client.
351
317
This should only be called when the client has been seen,
352
318
alive and well.
353
319
"""
354
self.last_checked_ok = datetime.datetime.utcnow()
355
gobject.source_remove(self.disable_initiator_tag)
356
self.disable_initiator_tag = (gobject.timeout_add
357
(self.timeout_milliseconds(),
358
self.disable))
359
if self.use_dbus:
360
# Emit D-Bus signal
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
364
variant_level=1)))
365
320
self.last_checked_ok = datetime.datetime.now()
321
gobject.source_remove(self.stop_initiator_tag)
322
self.stop_initiator_tag = gobject.timeout_add\
323
(self._timeout_milliseconds, self.stop)
366
324
def start_checker(self):
367
325
"""Start a new checker subprocess if one is not running.
368
326
If a checker already exists, leave it running and do
377
335
# is as it should be.
378
336
if self.checker is None:
379
337
try:
380
# In case checker_command has exactly one % operator
381
command = self.checker_command % self.host
338
# In case check_command has exactly one % operator
339
command = self.check_command % self.host
382
340
except TypeError:
383
341
# Escape attributes for the shell
384
342
escaped_attrs = dict((key, re.escape(str(val)))
385
343
for key, val in
386
344
vars(self).iteritems())
387
345
try:
388
command = self.checker_command % escaped_attrs
346
command = self.check_command % escaped_attrs
389
347
except TypeError, error:
390
348
logger.error(u'Could not format string "%s":'
391
u' %s', self.checker_command, error)
349
u' %s', self.check_command, error)
392
350
return True # Try again later
393
351
try:
394
352
logger.info(u"Starting checker %r for %s",
400
358
self.checker = subprocess.Popen(command,
401
359
close_fds=True,
402
360
shell=True, cwd="/")
403
if self.use_dbus:
404
# Emit D-Bus signal
405
self.CheckerStarted(command)
406
self.PropertyChanged(
407
dbus.String("checker_running"),
408
dbus.Boolean(True, variant_level=1))
409
self.checker_callback_tag = (gobject.child_watch_add
410
(self.checker.pid,
411
self.checker_callback,
412
data=command))
361
self.checker_callback_tag = gobject.child_watch_add\
362
(self.checker.pid,
363
self.checker_callback)
413
364
except OSError, error:
414
365
logger.error(u"Failed to start subprocess: %s",
415
366
error)
416
367
# Re-run this periodically if run by gobject.timeout_add
417
368
return True
418
419
369
def stop_checker(self):
420
370
"""Force the checker process, if any, to stop."""
421
371
if self.checker_callback_tag:
433
383
if error.errno != errno.ESRCH: # No such process
434
384
raise
435
385
self.checker = None
436
if self.use_dbus:
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
439
440
386
def still_valid(self):
441
387
"""Has the timeout not yet passed for this client?"""
442
if not getattr(self, "enabled", False):
443
return False
444
now = datetime.datetime.utcnow()
388
now = datetime.datetime.now()
445
389
if self.last_checked_ok is None:
446
390
return now < (self.created + self.timeout)
447
391
else:
448
392
return now < (self.last_checked_ok + self.timeout)
449
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
452
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
456
457
# CheckerCompleted - signal
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
460
"D-Bus signal"
461
pass
462
463
# CheckerStarted - signal
464
@dbus.service.signal(_interface, signature="s")
465
def CheckerStarted(self, command):
466
"D-Bus signal"
467
pass
468
469
# GetAllProperties - method
470
@dbus.service.method(_interface, out_signature="a{sv}")
471
def GetAllProperties(self):
472
"D-Bus method"
473
return dbus.Dictionary({
474
dbus.String("name"):
475
dbus.String(self.name, variant_level=1),
476
dbus.String("fingerprint"):
477
dbus.String(self.fingerprint, variant_level=1),
478
dbus.String("host"):
479
dbus.String(self.host, variant_level=1),
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
484
variant_level=1)
485
if self.last_enabled is not None
486
else dbus.Boolean(False, variant_level=1)),
487
dbus.String("enabled"):
488
dbus.Boolean(self.enabled, variant_level=1),
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
491
variant_level=1)
492
if self.last_checked_ok is not None
493
else dbus.Boolean (False, variant_level=1)),
494
dbus.String("timeout"):
495
dbus.UInt64(self.timeout_milliseconds(),
496
variant_level=1),
497
dbus.String("interval"):
498
dbus.UInt64(self.interval_milliseconds(),
499
variant_level=1),
500
dbus.String("checker"):
501
dbus.String(self.checker_command,
502
variant_level=1),
503
dbus.String("checker_running"):
504
dbus.Boolean(self.checker is not None,
505
variant_level=1),
506
}, signature="sv")
507
508
# IsStillValid - method
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
510
(still_valid))
511
IsStillValid.__name__ = "IsStillValid"
512
513
# PropertyChanged - signal
514
@dbus.service.signal(_interface, signature="sv")
515
def PropertyChanged(self, property, value):
516
"D-Bus signal"
517
pass
518
519
# SetChecker - method
520
@dbus.service.method(_interface, in_signature="s")
521
def SetChecker(self, checker):
522
"D-Bus setter method"
523
self.checker_command = checker
524
# Emit D-Bus signal
525
self.PropertyChanged(dbus.String(u"checker"),
526
dbus.String(self.checker_command,
527
variant_level=1))
528
529
# SetHost - method
530
@dbus.service.method(_interface, in_signature="s")
531
def SetHost(self, host):
532
"D-Bus setter method"
533
self.host = host
534
# Emit D-Bus signal
535
self.PropertyChanged(dbus.String(u"host"),
536
dbus.String(self.host, variant_level=1))
537
538
# SetInterval - method
539
@dbus.service.method(_interface, in_signature="t")
540
def SetInterval(self, milliseconds):
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
542
# Emit D-Bus signal
543
self.PropertyChanged(dbus.String(u"interval"),
544
(dbus.UInt64(self.interval_milliseconds(),
545
variant_level=1)))
546
547
# SetSecret - method
548
@dbus.service.method(_interface, in_signature="ay",
549
byte_arrays=True)
550
def SetSecret(self, secret):
551
"D-Bus setter method"
552
self.secret = str(secret)
553
554
# SetTimeout - method
555
@dbus.service.method(_interface, in_signature="t")
556
def SetTimeout(self, milliseconds):
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
558
# Emit D-Bus signal
559
self.PropertyChanged(dbus.String(u"timeout"),
560
(dbus.UInt64(self.timeout_milliseconds(),
561
variant_level=1)))
562
563
# Enable - method
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
566
567
# StartChecker - method
568
@dbus.service.method(_interface)
569
def StartChecker(self):
570
"D-Bus method"
571
self.start_checker()
572
573
# Disable - method
574
@dbus.service.method(_interface)
575
def Disable(self):
576
"D-Bus method"
577
self.disable()
578
579
# StopChecker - method
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
582
583
del _interface
584
393
585
394
586
395
def peer_certificate(session):
587
396
"Return the peer's OpenPGP certificate as a bytestring"
588
397
# If not an OpenPGP certificate...
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
398
if gnutls.library.functions.gnutls_certificate_type_get\
399
(session._c_object) \
400
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
592
401
# ...do the normal thing
593
402
return session.peer_certificate
594
403
list_size = ctypes.c_uint()
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
404
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
405
(session._c_object, ctypes.byref(list_size))
598
406
if list_size.value == 0:
599
407
return None
600
408
cert = cert_list[0]
604
412
def fingerprint(openpgp):
605
413
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
606
414
# New GnuTLS "datum" with the OpenPGP public key
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
609
ctypes.POINTER
610
(ctypes.c_ubyte)),
611
ctypes.c_uint(len(openpgp))))
415
datum = gnutls.library.types.gnutls_datum_t\
416
(ctypes.cast(ctypes.c_char_p(openpgp),
417
ctypes.POINTER(ctypes.c_ubyte)),
418
ctypes.c_uint(len(openpgp)))
612
419
# New empty GnuTLS certificate
613
420
crt = gnutls.library.types.gnutls_openpgp_crt_t()
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
421
gnutls.library.functions.gnutls_openpgp_crt_init\
422
(ctypes.byref(crt))
616
423
# Import the OpenPGP public key into the certificate
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
424
gnutls.library.functions.gnutls_openpgp_crt_import\
425
(crt, ctypes.byref(datum),
426
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
621
427
# Verify the self signature in the key
622
428
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
429
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
430
(crt, 0, ctypes.byref(crtverify))
625
431
if crtverify.value != 0:
626
432
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
433
raise gnutls.errors.CertificateSecurityError("Verify failed")
629
435
buf = ctypes.create_string_buffer(20)
630
436
buf_len = ctypes.c_size_t()
631
437
# Get the fingerprint from the certificate into the buffer
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
438
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
439
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
635
440
# Deinit the certificate
636
441
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
637
442
# Convert the buffer to a Python bytestring
649
454
def handle(self):
650
455
logger.info(u"TCP connection from: %s",
651
456
unicode(self.client_address))
652
session = (gnutls.connection
653
.ClientSession(self.request,
654
gnutls.connection
655
.X509Credentials()))
457
session = gnutls.connection.ClientSession\
458
(self.request, gnutls.connection.X509Credentials())
656
459
657
460
line = self.request.makefile().readline()
658
461
logger.debug(u"Protocol version: %r", line)
673
476
# "+DHE-DSS"))
674
477
# Use a fallback default, since this MUST be set.
675
478
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
678
priority, None))
479
gnutls.library.functions.gnutls_priority_set_direct\
480
(session._c_object, priority, None)
679
481
680
482
try:
681
483
session.handshake()
691
493
session.bye()
692
494
return
693
495
logger.debug(u"Fingerprint: %s", fpr)
496
client = None
694
497
for c in self.server.clients:
695
498
if c.fingerprint == fpr:
696
499
client = c
697
500
break
698
else:
501
if not client:
699
502
logger.warning(u"Client not found for fingerprint: %s",
700
503
fpr)
701
504
session.bye()
840
643
elif state == avahi.ENTRY_GROUP_FAILURE:
841
644
logger.critical(u"Avahi: Error in group state changed %s",
842
645
unicode(error))
843
raise AvahiGroupError(u"State changed: %s" % unicode(error))
646
raise AvahiGroupError("State changed: %s", str(error))
844
647
845
648
def if_nametoindex(interface):
846
649
"""Call the C function if_nametoindex(), or equivalent"""
847
650
global if_nametoindex
848
651
try:
849
if_nametoindex = (ctypes.cdll.LoadLibrary
850
(ctypes.util.find_library("c"))
851
.if_nametoindex)
652
if_nametoindex = ctypes.cdll.LoadLibrary\
653
(ctypes.util.find_library("c")).if_nametoindex
852
654
except (OSError, AttributeError):
853
655
if "struct" not in sys.modules:
854
656
import struct
889
691
890
692
891
693
def main():
892
parser = optparse.OptionParser(version = "%%prog %s" % version)
694
parser = OptionParser(version = "%%prog %s" % version)
893
695
parser.add_option("-i", "--interface", type="string",
894
696
metavar="IF", help="Bind to interface IF")
895
697
parser.add_option("-a", "--address", type="string",
896
698
help="Address to listen for requests on")
897
699
parser.add_option("-p", "--port", type="int",
898
700
help="Port number to receive requests on")
899
parser.add_option("--check", action="store_true",
701
parser.add_option("--check", action="store_true", default=False,
900
702
help="Run self-test")
901
703
parser.add_option("--debug", action="store_true",
902
704
help="Debug mode; run in foreground and log to"
909
711
default="/etc/mandos", metavar="DIR",
910
712
help="Directory to search for configuration"
911
713
" files")
912
parser.add_option("--no-dbus", action="store_false",
913
dest="use_dbus",
914
help="Do not provide D-Bus system bus"
915
" interface")
916
714
options = parser.parse_args()[0]
917
715
918
716
if options.check:
928
726
"priority":
929
727
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
930
728
"servicename": "Mandos",
931
"use_dbus": "True",
932
729
}
933
730
934
731
# Parse config file for server-global settings
937
734
server_config.read(os.path.join(options.configdir, "mandos.conf"))
938
735
# Convert the SafeConfigParser object to a dict
939
736
server_settings = server_config.defaults()
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
737
# Use getboolean on the boolean config option
738
server_settings["debug"] = server_config.getboolean\
739
("DEFAULT", "debug")
945
740
del server_config
946
741
947
742
# Override the settings from the config file with command line
948
743
# options, if set.
949
744
for option in ("interface", "address", "port", "debug",
950
"priority", "servicename", "configdir",
951
"use_dbus"):
745
"priority", "servicename", "configdir"):
952
746
value = getattr(options, option)
953
747
if value is not None:
954
748
server_settings[option] = value
955
749
del options
956
750
# Now we have our good server settings in "server_settings"
957
751
958
# For convenience
959
752
debug = server_settings["debug"]
960
use_dbus = server_settings["use_dbus"]
961
753
962
754
if not debug:
963
755
syslogger.setLevel(logging.WARNING)
964
756
console.setLevel(logging.WARNING)
965
757
966
758
if server_settings["servicename"] != "Mandos":
967
syslogger.setFormatter(logging.Formatter
759
syslogger.setFormatter(logging.Formatter\
968
760
('Mandos (%s): %%(levelname)s:'
969
761
' %%(message)s'
970
762
% server_settings["servicename"]))
972
764
# Parse config file with clients
973
765
client_defaults = { "timeout": "1h",
974
766
"interval": "5m",
975
"checker": "fping -q -- %%(host)s",
767
"checker": "fping -q -- %(host)s",
976
768
"host": "",
977
769
}
978
770
client_config = ConfigParser.SafeConfigParser(client_defaults)
991
783
except IOError, error:
992
784
logger.error("Could not open file %r", pidfilename)
993
785
994
try:
995
uid = pwd.getpwnam("_mandos").pw_uid
996
gid = pwd.getpwnam("_mandos").pw_gid
997
except KeyError:
998
try:
999
uid = pwd.getpwnam("mandos").pw_uid
1000
gid = pwd.getpwnam("mandos").pw_gid
1001
except KeyError:
1002
try:
1003
uid = pwd.getpwnam("nobody").pw_uid
1004
gid = pwd.getpwnam("nogroup").pw_gid
1005
except KeyError:
1006
uid = 65534
1007
gid = 65534
786
uid = 65534
787
gid = 65534
788
try:
789
uid = pwd.getpwnam("mandos").pw_uid
790
except KeyError:
791
try:
792
uid = pwd.getpwnam("nobody").pw_uid
793
except KeyError:
794
pass
795
try:
796
gid = pwd.getpwnam("mandos").pw_gid
797
except KeyError:
798
try:
799
gid = pwd.getpwnam("nogroup").pw_gid
800
except KeyError:
801
pass
1008
802
try:
1009
803
os.setuid(uid)
1010
804
os.setgid(gid)
1016
810
service = AvahiService(name = server_settings["servicename"],
1017
811
servicetype = "_mandos._tcp", )
1018
812
if server_settings["interface"]:
1019
service.interface = (if_nametoindex
1020
(server_settings["interface"]))
813
service.interface = if_nametoindex\
814
(server_settings["interface"])
1021
815
1022
816
global main_loop
1023
817
global bus
1030
824
avahi.DBUS_PATH_SERVER),
1031
825
avahi.DBUS_INTERFACE_SERVER)
1032
826
# End of Avahi example code
1033
if use_dbus:
1034
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1035
bus)
827
828
def remove_from_clients(client):
829
clients.remove(client)
830
if not clients:
831
logger.critical(u"No clients left, exiting")
832
sys.exit()
1036
833
1037
834
clients.update(Set(Client(name = section,
835
stop_hook = remove_from_clients,
1038
836
config
1039
= dict(client_config.items(section)),
1040
use_dbus = use_dbus)
837
= dict(client_config.items(section)))
1041
838
for section in client_config.sections()))
1042
839
if not clients:
1043
logger.warning(u"No clients defined")
840
logger.critical(u"No clients defined")
841
sys.exit(1)
1044
842
1045
843
if debug:
1046
844
# Redirect stdin so all checkers get /dev/null
1078
876
1079
877
while clients:
1080
878
client = clients.pop()
1081
client.disable_hook = None
1082
client.disable()
879
client.stop_hook = None
880
client.stop()
1083
881
1084
882
atexit.register(cleanup)
1085
883
1088
886
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1089
887
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1090
888
1091
if use_dbus:
1092
class MandosServer(dbus.service.Object):
1093
"""A D-Bus proxy object"""
1094
def __init__(self):
1095
dbus.service.Object.__init__(self, bus,
1096
"/Mandos")
1097
_interface = u"org.mandos_system.Mandos"
1098
1099
@dbus.service.signal(_interface, signature="oa{sv}")
1100
def ClientAdded(self, objpath, properties):
1101
"D-Bus signal"
1102
pass
1103
1104
@dbus.service.signal(_interface, signature="o")
1105
def ClientRemoved(self, objpath):
1106
"D-Bus signal"
1107
pass
1108
1109
@dbus.service.method(_interface, out_signature="ao")
1110
def GetAllClients(self):
1111
return dbus.Array(c.dbus_object_path for c in clients)
1112
1113
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1114
def GetAllClientsWithProperties(self):
1115
return dbus.Dictionary(
1116
((c.dbus_object_path, c.GetAllProperties())
1117
for c in clients),
1118
signature="oa{sv}")
1119
1120
@dbus.service.method(_interface, in_signature="o")
1121
def RemoveClient(self, object_path):
1122
for c in clients:
1123
if c.dbus_object_path == object_path:
1124
clients.remove(c)
1125
# Don't signal anything except ClientRemoved
1126
c.use_dbus = False
1127
c.disable()
1128
# Emit D-Bus signal
1129
self.ClientRemoved(object_path)
1130
return
1131
raise KeyError
1132
@dbus.service.method(_interface)
1133
def Quit(self):
1134
main_loop.quit()
1135
1136
del _interface
1137
1138
mandos_server = MandosServer()
1139
1140
889
for client in clients:
1141
if use_dbus:
1142
# Emit D-Bus signal
1143
mandos_server.ClientAdded(client.dbus_object_path,
1144
client.GetAllProperties())
1145
client.enable()
890
client.start()
1146
891
1147
892
tcp_server.enable()
1148
893
tcp_server.server_activate()
1166
911
1167
912
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1168
913
lambda *args, **kwargs:
1169
(tcp_server.handle_request
1170
(*args[2:], **kwargs) or True))
914
tcp_server.handle_request\
915
(*args[2:], **kwargs) or True)
1171
916
1172
917
logger.debug(u"Starting main loop")
1173
918
main_loop.run()
1174
919
except AvahiError, error:
1175
logger.critical(u"AvahiError: %s", error)
920
logger.critical(u"AvahiError: %s" + unicode(error))
1176
921
sys.exit(1)
1177
922
except KeyboardInterrupt:
1178
923
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0