To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 238
- compare with another revision
- download diff
- download tarball
- view history from revision 238
- Committer: Teddy Hogeborn
- Date: 2008-12-10 01:26:02 UTC
- mfrom: (237.1.2 mandos)
- Revision ID: teddy@fukt.bsnet.se-20081210012602-vhz3h75xkj24t340
First version of a somewhat complete D-Bus server interface. Also
change user/group name to "_mandos".
* debian/mandos.postinst: Rename old "mandos" user and group to
"_mandos"; create "_mandos" user and group
if none exist.
* debian/mandos-client.postinst: - '' -
* initramfs-tools-hook: Try "_mandos" before "mandos" as user and
group name.
* mandos (_datetime_to_dbus_struct): New; was previously local.
(Client.started): Renamed to "last_started". All users changed.
(Client.started): New; boolean.
(Client.dbus_object_path): New.
(Client.check_command): Renamed to "checker_command". All users
changed.
(Client.__init__): Set and use "self.dbus_object_path". Set
"self.started".
(Client.start): Update "self.started". Emit "self.PropertyChanged"
signals for both "started" and "last_started".
(Client.stop): Update "self.started". Emit "self.PropertyChanged"
signal for "started".
(Client.checker_callback): Take additional "command" argument. All
callers changed. Emit
"self.PropertyChanged" signal.
(Client.bump_timeout): Emit "self.PropertyChanged" signal for
"last_checked_ok".
(Client.start_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.stop_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.still_valid): Bug fix: use "getattr(self, started, False)"
instead of "self.started" in case this client
object is so new that the "started" attribute
has not been created yet.
(Client.IntervalChanged, Client.CheckerIsRunning, Client.GetChecker,
Client.GetCreated, Client.GetFingerprint, Client.GetHost,
Client.GetInterval, Client.GetName, Client.GetStarted,
Client.GetTimeout, Client.StateChanged, Client.TimeoutChanged):
Removed; all callers changed.
(Client.CheckerCompleted): Add "condition" and "command" arguments.
All callers changed.
(Client.GetAllProperties, Client.PropertyChanged): New.
(Client.StillValid): Renamed to "IsStillValid".
(Client.StartChecker): Changed to its own function to avoid the
return value from "Client.start_checker()".
(Client.Stop): Changed to its own function to avoid the return value
from "Client.stop()".
(main): Try "_mandos" before "mandos" as user and group name.
Removed inner function "remove_from_clients". New inner
class "MandosServer".
change user/group name to "_mandos".
* debian/mandos.postinst: Rename old "mandos" user and group to
"_mandos"; create "_mandos" user and group
if none exist.
* debian/mandos-client.postinst: - '' -
* initramfs-tools-hook: Try "_mandos" before "mandos" as user and
group name.
* mandos (_datetime_to_dbus_struct): New; was previously local.
(Client.started): Renamed to "last_started". All users changed.
(Client.started): New; boolean.
(Client.dbus_object_path): New.
(Client.check_command): Renamed to "checker_command". All users
changed.
(Client.__init__): Set and use "self.dbus_object_path". Set
"self.started".
(Client.start): Update "self.started". Emit "self.PropertyChanged"
signals for both "started" and "last_started".
(Client.stop): Update "self.started". Emit "self.PropertyChanged"
signal for "started".
(Client.checker_callback): Take additional "command" argument. All
callers changed. Emit
"self.PropertyChanged" signal.
(Client.bump_timeout): Emit "self.PropertyChanged" signal for
"last_checked_ok".
(Client.start_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.stop_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.still_valid): Bug fix: use "getattr(self, started, False)"
instead of "self.started" in case this client
object is so new that the "started" attribute
has not been created yet.
(Client.IntervalChanged, Client.CheckerIsRunning, Client.GetChecker,
Client.GetCreated, Client.GetFingerprint, Client.GetHost,
Client.GetInterval, Client.GetName, Client.GetStarted,
Client.GetTimeout, Client.StateChanged, Client.TimeoutChanged):
Removed; all callers changed.
(Client.CheckerCompleted): Add "condition" and "command" arguments.
All callers changed.
(Client.GetAllProperties, Client.PropertyChanged): New.
(Client.StillValid): Renamed to "IsStillValid".
(Client.StartChecker): Changed to its own function to avoid the
return value from "Client.start_checker()".
(Client.Stop): Changed to its own function to avoid the return value
from "Client.stop()".
(main): Try "_mandos" before "mandos" as user and group name.
Removed inner function "remove_from_clients". New inner
class "MandosServer".
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- etc-plugins.d-README
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn
15
# Copyright © 2008 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
30
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
32
#
32
33
33
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
34
35
35
36
import SocketServer
36
37
import socket
37
import select
38
38
from optparse import OptionParser
39
39
import datetime
40
40
import errno
56
56
import logging
57
57
import logging.handlers
58
58
import pwd
59
from contextlib import closing
59
60
60
61
import dbus
62
import dbus.service
61
63
import gobject
62
64
import avahi
63
65
from dbus.mainloop.glib import DBusGMainLoop
64
66
import ctypes
67
import ctypes.util
65
68
66
version = "1.0"
69
version = "1.0.2"
67
70
68
71
logger = logging.Logger('mandos')
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
74
77
logger.addHandler(syslogger)
75
78
76
79
console = logging.StreamHandler()
81
84
class AvahiError(Exception):
82
85
def __init__(self, value):
83
86
self.value = value
87
super(AvahiError, self).__init__()
84
88
def __str__(self):
85
89
return repr(self.value)
86
90
108
112
a sensible number of times
109
113
"""
110
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
111
type = None, port = None, TXT = None, domain = "",
112
host = "", max_renames = 32768):
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
113
117
self.interface = interface
114
118
self.name = name
115
self.type = type
119
self.type = servicetype
116
120
self.port = port
117
if TXT is None:
118
self.TXT = []
119
else:
120
self.TXT = TXT
121
self.TXT = TXT if TXT is not None else []
121
122
self.domain = domain
122
123
self.host = host
123
124
self.rename_count = 0
127
128
if self.rename_count >= self.max_renames:
128
129
logger.critical(u"No suitable Zeroconf service name found"
129
130
u" after %i retries, exiting.",
130
rename_count)
131
self.rename_count)
131
132
raise AvahiServiceError("Too many renames")
132
133
self.name = server.GetAlternativeServiceName(self.name)
133
134
logger.info(u"Changing Zeroconf service name to %r ...",
134
135
str(self.name))
135
syslogger.setFormatter(logging.Formatter\
136
syslogger.setFormatter(logging.Formatter
136
137
('Mandos (%s): %%(levelname)s:'
137
' %%(message)s' % self.name))
138
' %%(message)s' % self.name))
138
139
self.remove()
139
140
self.add()
140
141
self.rename_count += 1
146
147
"""Derived from the Avahi example code"""
147
148
global group
148
149
if group is None:
149
group = dbus.Interface\
150
(bus.get_object(avahi.DBUS_NAME,
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
151
152
server.EntryGroupNew()),
152
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
154
group.connect_to_signal('StateChanged',
154
155
entry_group_state_changed)
155
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
169
170
# End of Avahi example code
170
171
171
172
172
class Client(object):
173
def _datetime_to_dbus_struct(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus struct.
175
The format is special to this application, since we could not find
176
any other standard way."""
177
return dbus.Struct((dbus.Int16(dt.year),
178
dbus.Byte(dt.month),
179
dbus.Byte(dt.day),
180
dbus.Byte(dt.hour),
181
dbus.Byte(dt.minute),
182
dbus.Byte(dt.second),
183
dbus.UInt32(dt.microsecond)),
184
signature="nyyyyyu",
185
variant_level=variant_level)
186
187
188
class Client(dbus.service.Object):
173
189
"""A representation of a client host served by this server.
174
190
Attributes:
175
name: string; from the config file, used in log messages
191
name: string; from the config file, used in log messages
176
192
fingerprint: string (40 or 32 hexadecimal digits); used to
177
193
uniquely identify the client
178
secret: bytestring; sent verbatim (over TLS) to client
179
host: string; available for use by the checker command
180
created: datetime.datetime(); object creation, not client host
181
last_checked_ok: datetime.datetime() or None if not yet checked OK
182
timeout: datetime.timedelta(); How long from last_checked_ok
183
until this client is invalid
184
interval: datetime.timedelta(); How often to start a new checker
185
stop_hook: If set, called by stop() as stop_hook(self)
186
checker: subprocess.Popen(); a running checker process used
187
to see if the client lives.
188
'None' if no process is running.
194
secret: bytestring; sent verbatim (over TLS) to client
195
host: string; available for use by the checker command
196
created: datetime.datetime(); (UTC) object creation
197
last_started: datetime.datetime(); (UTC)
198
started: bool()
199
last_checked_ok: datetime.datetime(); (UTC) or None
200
timeout: datetime.timedelta(); How long from last_checked_ok
201
until this client is invalid
202
interval: datetime.timedelta(); How often to start a new checker
203
stop_hook: If set, called by stop() as stop_hook(self)
204
checker: subprocess.Popen(); a running checker process used
205
to see if the client lives.
206
'None' if no process is running.
189
207
checker_initiator_tag: a gobject event source tag, or None
190
208
stop_initiator_tag: - '' -
191
209
checker_callback_tag: - '' -
193
211
client lives. %() expansions are done at
194
212
runtime with vars(self) as dict, so that for
195
213
instance %(name)s can be used in the command.
214
dbus_object_path: dbus.ObjectPath
196
215
Private attibutes:
197
216
_timeout: Real variable for 'timeout'
198
217
_interval: Real variable for 'interval'
200
219
_interval_milliseconds: - '' -
201
220
"""
202
221
def _set_timeout(self, timeout):
203
"Setter function for 'timeout' attribute"
222
"Setter function for the 'timeout' attribute"
204
223
self._timeout = timeout
205
224
self._timeout_milliseconds = ((self.timeout.days
206
225
* 24 * 60 * 60 * 1000)
207
226
+ (self.timeout.seconds * 1000)
208
227
+ (self.timeout.microseconds
209
228
// 1000))
210
timeout = property(lambda self: self._timeout,
211
_set_timeout)
229
# Emit D-Bus signal
230
self.PropertyChanged(dbus.String(u"timeout"),
231
(dbus.UInt64(self._timeout_milliseconds,
232
variant_level=1)))
233
timeout = property(lambda self: self._timeout, _set_timeout)
212
234
del _set_timeout
235
213
236
def _set_interval(self, interval):
214
"Setter function for 'interval' attribute"
237
"Setter function for the 'interval' attribute"
215
238
self._interval = interval
216
239
self._interval_milliseconds = ((self.interval.days
217
240
* 24 * 60 * 60 * 1000)
219
242
* 1000)
220
243
+ (self.interval.microseconds
221
244
// 1000))
222
interval = property(lambda self: self._interval,
223
_set_interval)
245
# Emit D-Bus signal
246
self.PropertyChanged(dbus.String(u"interval"),
247
(dbus.UInt64(self._interval_milliseconds,
248
variant_level=1)))
249
interval = property(lambda self: self._interval, _set_interval)
224
250
del _set_interval
225
def __init__(self, name = None, stop_hook=None, config={}):
251
252
def __init__(self, name = None, stop_hook=None, config=None):
226
253
"""Note: the 'checker' key in 'config' sets the
227
254
'checker_command' attribute and *not* the 'checker'
228
255
attribute."""
256
self.dbus_object_path = (dbus.ObjectPath
257
("/Mandos/clients/"
258
+ name.replace(".", "_")))
259
dbus.service.Object.__init__(self, bus,
260
self.dbus_object_path)
261
if config is None:
262
config = {}
229
263
self.name = name
230
264
logger.debug(u"Creating client %r", self.name)
231
265
# Uppercase and remove spaces from fingerprint for later
232
266
# comparison purposes with return value from the fingerprint()
233
267
# function
234
self.fingerprint = config["fingerprint"].upper()\
235
.replace(u" ", u"")
268
self.fingerprint = (config["fingerprint"].upper()
269
.replace(u" ", u""))
236
270
logger.debug(u" Fingerprint: %s", self.fingerprint)
237
271
if "secret" in config:
238
272
self.secret = config["secret"].decode(u"base64")
239
273
elif "secfile" in config:
240
sf = open(config["secfile"])
241
self.secret = sf.read()
242
sf.close()
274
with closing(open(os.path.expanduser
275
(os.path.expandvars
276
(config["secfile"])))) as secfile:
277
self.secret = secfile.read()
243
278
else:
244
279
raise TypeError(u"No secret or secfile for client %s"
245
280
% self.name)
246
281
self.host = config.get("host", "")
247
self.created = datetime.datetime.now()
282
self.created = datetime.datetime.utcnow()
283
self.started = False
284
self.last_started = None
248
285
self.last_checked_ok = None
249
286
self.timeout = string_to_delta(config["timeout"])
250
287
self.interval = string_to_delta(config["interval"])
253
290
self.checker_initiator_tag = None
254
291
self.stop_initiator_tag = None
255
292
self.checker_callback_tag = None
256
self.check_command = config["checker"]
293
self.checker_command = config["checker"]
294
257
295
def start(self):
258
296
"""Start this client's checker and timeout hooks"""
297
self.last_started = datetime.datetime.utcnow()
259
298
# Schedule a new checker to be started an 'interval' from now,
260
299
# and every interval from then on.
261
self.checker_initiator_tag = gobject.timeout_add\
262
(self._interval_milliseconds,
263
self.start_checker)
300
self.checker_initiator_tag = (gobject.timeout_add
301
(self._interval_milliseconds,
302
self.start_checker))
264
303
# Also start a new checker *right now*.
265
304
self.start_checker()
266
305
# Schedule a stop() when 'timeout' has passed
267
self.stop_initiator_tag = gobject.timeout_add\
268
(self._timeout_milliseconds,
269
self.stop)
306
self.stop_initiator_tag = (gobject.timeout_add
307
(self._timeout_milliseconds,
308
self.stop))
309
self.started = True
310
# Emit D-Bus signal
311
self.PropertyChanged(dbus.String(u"started"),
312
dbus.Boolean(True, variant_level=1))
313
self.PropertyChanged(dbus.String(u"last_started"),
314
(_datetime_to_dbus_struct
315
(self.last_started, variant_level=1)))
316
270
317
def stop(self):
271
"""Stop this client.
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
274
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
276
logger.info(u"Stopping client %s", self.name)
277
self.secret = None
278
else:
318
"""Stop this client."""
319
if not getattr(self, "started", False):
279
320
return False
321
logger.info(u"Stopping client %s", self.name)
280
322
if getattr(self, "stop_initiator_tag", False):
281
323
gobject.source_remove(self.stop_initiator_tag)
282
324
self.stop_initiator_tag = None
286
328
self.stop_checker()
287
329
if self.stop_hook:
288
330
self.stop_hook(self)
331
self.started = False
332
# Emit D-Bus signal
333
self.PropertyChanged(dbus.String(u"started"),
334
dbus.Boolean(False, variant_level=1))
289
335
# Do not run this again if called by a gobject.timeout_add
290
336
return False
337
291
338
def __del__(self):
292
339
self.stop_hook = None
293
340
self.stop()
294
def checker_callback(self, pid, condition):
341
342
def checker_callback(self, pid, condition, command):
295
343
"""The checker has completed, so take appropriate actions."""
296
now = datetime.datetime.now()
297
344
self.checker_callback_tag = None
298
345
self.checker = None
299
if os.WIFEXITED(condition) \
300
and (os.WEXITSTATUS(condition) == 0):
346
# Emit D-Bus signal
347
self.PropertyChanged(dbus.String(u"checker_running"),
348
dbus.Boolean(False, variant_level=1))
349
if (os.WIFEXITED(condition)
350
and (os.WEXITSTATUS(condition) == 0)):
301
351
logger.info(u"Checker for %(name)s succeeded",
302
352
vars(self))
303
self.last_checked_ok = now
304
gobject.source_remove(self.stop_initiator_tag)
305
self.stop_initiator_tag = gobject.timeout_add\
306
(self._timeout_milliseconds,
307
self.stop)
353
# Emit D-Bus signal
354
self.CheckerCompleted(dbus.Boolean(True),
355
dbus.UInt16(condition),
356
dbus.String(command))
357
self.bump_timeout()
308
358
elif not os.WIFEXITED(condition):
309
359
logger.warning(u"Checker for %(name)s crashed?",
310
360
vars(self))
361
# Emit D-Bus signal
362
self.CheckerCompleted(dbus.Boolean(False),
363
dbus.UInt16(condition),
364
dbus.String(command))
311
365
else:
312
366
logger.info(u"Checker for %(name)s failed",
313
367
vars(self))
368
# Emit D-Bus signal
369
self.CheckerCompleted(dbus.Boolean(False),
370
dbus.UInt16(condition),
371
dbus.String(command))
372
373
def bump_timeout(self):
374
"""Bump up the timeout for this client.
375
This should only be called when the client has been seen,
376
alive and well.
377
"""
378
self.last_checked_ok = datetime.datetime.utcnow()
379
gobject.source_remove(self.stop_initiator_tag)
380
self.stop_initiator_tag = (gobject.timeout_add
381
(self._timeout_milliseconds,
382
self.stop))
383
self.PropertyChanged(dbus.String(u"last_checked_ok"),
384
(_datetime_to_dbus_struct
385
(self.last_checked_ok,
386
variant_level=1)))
387
314
388
def start_checker(self):
315
389
"""Start a new checker subprocess if one is not running.
316
390
If a checker already exists, leave it running and do
325
399
# is as it should be.
326
400
if self.checker is None:
327
401
try:
328
# In case check_command has exactly one % operator
329
command = self.check_command % self.host
402
# In case checker_command has exactly one % operator
403
command = self.checker_command % self.host
330
404
except TypeError:
331
405
# Escape attributes for the shell
332
406
escaped_attrs = dict((key, re.escape(str(val)))
333
407
for key, val in
334
408
vars(self).iteritems())
335
409
try:
336
command = self.check_command % escaped_attrs
410
command = self.checker_command % escaped_attrs
337
411
except TypeError, error:
338
412
logger.error(u'Could not format string "%s":'
339
u' %s', self.check_command, error)
413
u' %s', self.checker_command, error)
340
414
return True # Try again later
341
415
try:
342
416
logger.info(u"Starting checker %r for %s",
348
422
self.checker = subprocess.Popen(command,
349
423
close_fds=True,
350
424
shell=True, cwd="/")
351
self.checker_callback_tag = gobject.child_watch_add\
352
(self.checker.pid,
353
self.checker_callback)
425
# Emit D-Bus signal
426
self.CheckerStarted(command)
427
self.PropertyChanged(dbus.String("checker_running"),
428
dbus.Boolean(True, variant_level=1))
429
self.checker_callback_tag = (gobject.child_watch_add
430
(self.checker.pid,
431
self.checker_callback,
432
data=command))
354
433
except OSError, error:
355
434
logger.error(u"Failed to start subprocess: %s",
356
435
error)
357
436
# Re-run this periodically if run by gobject.timeout_add
358
437
return True
438
359
439
def stop_checker(self):
360
440
"""Force the checker process, if any, to stop."""
361
441
if self.checker_callback_tag:
373
453
if error.errno != errno.ESRCH: # No such process
374
454
raise
375
455
self.checker = None
456
self.PropertyChanged(dbus.String(u"checker_running"),
457
dbus.Boolean(False, variant_level=1))
458
376
459
def still_valid(self):
377
460
"""Has the timeout not yet passed for this client?"""
378
now = datetime.datetime.now()
461
if not getattr(self, "started", False):
462
return False
463
now = datetime.datetime.utcnow()
379
464
if self.last_checked_ok is None:
380
465
return now < (self.created + self.timeout)
381
466
else:
382
467
return now < (self.last_checked_ok + self.timeout)
468
469
## D-Bus methods & signals
470
_interface = u"org.mandos_system.Mandos.Client"
471
472
# BumpTimeout - method
473
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
474
BumpTimeout.__name__ = "BumpTimeout"
475
476
# CheckerCompleted - signal
477
@dbus.service.signal(_interface, signature="bqs")
478
def CheckerCompleted(self, success, condition, command):
479
"D-Bus signal"
480
pass
481
482
# CheckerStarted - signal
483
@dbus.service.signal(_interface, signature="s")
484
def CheckerStarted(self, command):
485
"D-Bus signal"
486
pass
487
488
# GetAllProperties - method
489
@dbus.service.method(_interface, out_signature="a{sv}")
490
def GetAllProperties(self):
491
"D-Bus method"
492
return dbus.Dictionary({
493
dbus.String("name"):
494
dbus.String(self.name, variant_level=1),
495
dbus.String("fingerprint"):
496
dbus.String(self.fingerprint, variant_level=1),
497
dbus.String("host"):
498
dbus.String(self.host, variant_level=1),
499
dbus.String("created"):
500
_datetime_to_dbus_struct(self.created,
501
variant_level=1),
502
dbus.String("last_started"):
503
(_datetime_to_dbus_struct(self.last_started,
504
variant_level=1)
505
if self.last_started is not None
506
else dbus.Boolean(False, variant_level=1)),
507
dbus.String("started"):
508
dbus.Boolean(self.started, variant_level=1),
509
dbus.String("last_checked_ok"):
510
(_datetime_to_dbus_struct(self.last_checked_ok,
511
variant_level=1)
512
if self.last_checked_ok is not None
513
else dbus.Boolean (False, variant_level=1)),
514
dbus.String("timeout"):
515
dbus.UInt64(self._timeout_milliseconds,
516
variant_level=1),
517
dbus.String("interval"):
518
dbus.UInt64(self._interval_milliseconds,
519
variant_level=1),
520
dbus.String("checker"):
521
dbus.String(self.checker_command,
522
variant_level=1),
523
dbus.String("checker_running"):
524
dbus.Boolean(self.checker is not None,
525
variant_level=1),
526
}, signature="sv")
527
528
# IsStillValid - method
529
IsStillValid = (dbus.service.method(_interface, out_signature="b")
530
(still_valid))
531
IsStillValid.__name__ = "IsStillValid"
532
533
# PropertyChanged - signal
534
@dbus.service.signal(_interface, signature="sv")
535
def PropertyChanged(self, property, value):
536
"D-Bus signal"
537
pass
538
539
# SetChecker - method
540
@dbus.service.method(_interface, in_signature="s")
541
def SetChecker(self, checker):
542
"D-Bus setter method"
543
self.checker_command = checker
544
545
# SetHost - method
546
@dbus.service.method(_interface, in_signature="s")
547
def SetHost(self, host):
548
"D-Bus setter method"
549
self.host = host
550
551
# SetInterval - method
552
@dbus.service.method(_interface, in_signature="t")
553
def SetInterval(self, milliseconds):
554
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
555
556
# SetSecret - method
557
@dbus.service.method(_interface, in_signature="ay",
558
byte_arrays=True)
559
def SetSecret(self, secret):
560
"D-Bus setter method"
561
self.secret = str(secret)
562
563
# SetTimeout - method
564
@dbus.service.method(_interface, in_signature="t")
565
def SetTimeout(self, milliseconds):
566
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
567
568
# Start - method
569
Start = dbus.service.method(_interface)(start)
570
Start.__name__ = "Start"
571
572
# StartChecker - method
573
@dbus.service.method(_interface)
574
def StartChecker(self):
575
"D-Bus method"
576
self.start_checker()
577
578
# Stop - method
579
@dbus.service.method(_interface)
580
def Stop(self):
581
"D-Bus method"
582
self.stop()
583
584
# StopChecker - method
585
StopChecker = dbus.service.method(_interface)(stop_checker)
586
StopChecker.__name__ = "StopChecker"
587
588
del _interface
383
589
384
590
385
591
def peer_certificate(session):
386
592
"Return the peer's OpenPGP certificate as a bytestring"
387
593
# If not an OpenPGP certificate...
388
if gnutls.library.functions.gnutls_certificate_type_get\
389
(session._c_object) \
390
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
594
if (gnutls.library.functions
595
.gnutls_certificate_type_get(session._c_object)
596
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
391
597
# ...do the normal thing
392
598
return session.peer_certificate
393
599
list_size = ctypes.c_uint()
394
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
(session._c_object, ctypes.byref(list_size))
600
cert_list = (gnutls.library.functions
601
.gnutls_certificate_get_peers
602
(session._c_object, ctypes.byref(list_size)))
396
603
if list_size.value == 0:
397
604
return None
398
605
cert = cert_list[0]
402
609
def fingerprint(openpgp):
403
610
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
404
611
# New GnuTLS "datum" with the OpenPGP public key
405
datum = gnutls.library.types.gnutls_datum_t\
406
(ctypes.cast(ctypes.c_char_p(openpgp),
407
ctypes.POINTER(ctypes.c_ubyte)),
408
ctypes.c_uint(len(openpgp)))
612
datum = (gnutls.library.types
613
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
614
ctypes.POINTER
615
(ctypes.c_ubyte)),
616
ctypes.c_uint(len(openpgp))))
409
617
# New empty GnuTLS certificate
410
618
crt = gnutls.library.types.gnutls_openpgp_crt_t()
411
gnutls.library.functions.gnutls_openpgp_crt_init\
412
(ctypes.byref(crt))
619
(gnutls.library.functions
620
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
413
621
# Import the OpenPGP public key into the certificate
414
gnutls.library.functions.gnutls_openpgp_crt_import\
415
(crt, ctypes.byref(datum),
416
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
624
gnutls.library.constants
625
.GNUTLS_OPENPGP_FMT_RAW))
417
626
# Verify the self signature in the key
418
crtverify = ctypes.c_uint();
419
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
(crt, 0, ctypes.byref(crtverify))
627
crtverify = ctypes.c_uint()
628
(gnutls.library.functions
629
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
421
630
if crtverify.value != 0:
422
631
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
423
632
raise gnutls.errors.CertificateSecurityError("Verify failed")
424
633
# New buffer for the fingerprint
425
buffer = ctypes.create_string_buffer(20)
426
buffer_length = ctypes.c_size_t()
634
buf = ctypes.create_string_buffer(20)
635
buf_len = ctypes.c_size_t()
427
636
# Get the fingerprint from the certificate into the buffer
428
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
637
(gnutls.library.functions
638
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
639
ctypes.byref(buf_len)))
430
640
# Deinit the certificate
431
641
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
432
642
# Convert the buffer to a Python bytestring
433
fpr = ctypes.string_at(buffer, buffer_length.value)
643
fpr = ctypes.string_at(buf, buf_len.value)
434
644
# Convert the bytestring to hexadecimal notation
435
645
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
436
646
return hex_fpr
437
647
438
648
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
649
class TCP_handler(SocketServer.BaseRequestHandler, object):
440
650
"""A TCP request handler class.
441
651
Instantiated by IPv6_TCPServer for each request to handle it.
442
652
Note: This will run in its own forked process."""
443
653
444
654
def handle(self):
445
655
logger.info(u"TCP connection from: %s",
446
unicode(self.client_address))
447
session = gnutls.connection.ClientSession\
448
(self.request, gnutls.connection.X509Credentials())
656
unicode(self.client_address))
657
session = (gnutls.connection
658
.ClientSession(self.request,
659
gnutls.connection
660
.X509Credentials()))
449
661
450
662
line = self.request.makefile().readline()
451
663
logger.debug(u"Protocol version: %r", line)
464
676
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
465
677
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
466
678
# "+DHE-DSS"))
467
priority = "NORMAL" # Fallback default, since this
468
# MUST be set.
469
if self.server.settings["priority"]:
470
priority = self.server.settings["priority"]
471
gnutls.library.functions.gnutls_priority_set_direct\
472
(session._c_object, priority, None);
679
# Use a fallback default, since this MUST be set.
680
priority = self.server.settings.get("priority", "NORMAL")
681
(gnutls.library.functions
682
.gnutls_priority_set_direct(session._c_object,
683
priority, None))
473
684
474
685
try:
475
686
session.handshake()
485
696
session.bye()
486
697
return
487
698
logger.debug(u"Fingerprint: %s", fpr)
488
client = None
489
699
for c in self.server.clients:
490
700
if c.fingerprint == fpr:
491
701
client = c
492
702
break
493
if not client:
703
else:
494
704
logger.warning(u"Client not found for fingerprint: %s",
495
705
fpr)
496
706
session.bye()
503
713
vars(client))
504
714
session.bye()
505
715
return
716
## This won't work here, since we're in a fork.
717
# client.bump_timeout()
506
718
sent_size = 0
507
719
while sent_size < len(client.secret):
508
720
sent = session.send(client.secret[sent_size:])
513
725
session.bye()
514
726
515
727
516
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
728
class IPv6_TCPServer(SocketServer.ForkingMixIn,
729
SocketServer.TCPServer, object):
517
730
"""IPv6 TCP server. Accepts 'None' as address and/or port.
518
731
Attributes:
519
732
settings: Server settings
529
742
self.clients = kwargs["clients"]
530
743
del kwargs["clients"]
531
744
self.enabled = False
532
return super(type(self), self).__init__(*args, **kwargs)
745
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
533
746
def server_bind(self):
534
747
"""This overrides the normal server_bind() function
535
748
to bind to an interface if one was specified, and also NOT to
564
777
# if_nametoindex
565
778
# (self.settings
566
779
# ["interface"]))
567
return super(type(self), self).server_bind()
780
return super(IPv6_TCPServer, self).server_bind()
568
781
def server_activate(self):
569
782
if self.enabled:
570
return super(type(self), self).server_activate()
783
return super(IPv6_TCPServer, self).server_activate()
571
784
def enable(self):
572
785
self.enabled = True
573
786
591
804
timevalue = datetime.timedelta(0)
592
805
for s in interval.split():
593
806
try:
594
suffix=unicode(s[-1])
595
value=int(s[:-1])
807
suffix = unicode(s[-1])
808
value = int(s[:-1])
596
809
if suffix == u"d":
597
810
delta = datetime.timedelta(value)
598
811
elif suffix == u"s":
638
851
"""Call the C function if_nametoindex(), or equivalent"""
639
852
global if_nametoindex
640
853
try:
641
if "ctypes.util" not in sys.modules:
642
import ctypes.util
643
if_nametoindex = ctypes.cdll.LoadLibrary\
644
(ctypes.util.find_library("c")).if_nametoindex
854
if_nametoindex = (ctypes.cdll.LoadLibrary
855
(ctypes.util.find_library("c"))
856
.if_nametoindex)
645
857
except (OSError, AttributeError):
646
858
if "struct" not in sys.modules:
647
859
import struct
650
862
def if_nametoindex(interface):
651
863
"Get an interface index the hard way, i.e. using fcntl()"
652
864
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
653
s = socket.socket()
654
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
655
struct.pack("16s16x", interface))
656
s.close()
865
with closing(socket.socket()) as s:
866
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
867
struct.pack("16s16x", interface))
657
868
interface_index = struct.unpack("I", ifreq[16:20])[0]
658
869
return interface_index
659
870
return if_nametoindex(interface)
683
894
684
895
685
896
def main():
686
global main_loop_started
687
main_loop_started = False
688
689
897
parser = OptionParser(version = "%%prog %s" % version)
690
898
parser.add_option("-i", "--interface", type="string",
691
899
metavar="IF", help="Bind to interface IF")
706
914
default="/etc/mandos", metavar="DIR",
707
915
help="Directory to search for configuration"
708
916
" files")
709
(options, args) = parser.parse_args()
917
options = parser.parse_args()[0]
710
918
711
919
if options.check:
712
920
import doctest
730
938
# Convert the SafeConfigParser object to a dict
731
939
server_settings = server_config.defaults()
732
940
# Use getboolean on the boolean config option
733
server_settings["debug"] = server_config.getboolean\
734
("DEFAULT", "debug")
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
735
943
del server_config
736
944
737
945
# Override the settings from the config file with command line
751
959
console.setLevel(logging.WARNING)
752
960
753
961
if server_settings["servicename"] != "Mandos":
754
syslogger.setFormatter(logging.Formatter\
962
syslogger.setFormatter(logging.Formatter
755
963
('Mandos (%s): %%(levelname)s:'
756
964
' %%(message)s'
757
965
% server_settings["servicename"]))
769
977
clients = Set()
770
978
tcp_server = IPv6_TCPServer((server_settings["address"],
771
979
server_settings["port"]),
772
tcp_handler,
980
TCP_handler,
773
981
settings=server_settings,
774
982
clients=clients)
775
983
pidfilename = "/var/run/mandos.pid"
778
986
except IOError, error:
779
987
logger.error("Could not open file %r", pidfilename)
780
988
781
uid = 65534
782
gid = 65534
783
try:
784
uid = pwd.getpwnam("mandos").pw_uid
785
except KeyError:
786
try:
787
uid = pwd.getpwnam("nobody").pw_uid
788
except KeyError:
789
pass
790
try:
791
gid = pwd.getpwnam("mandos").pw_gid
792
except KeyError:
793
try:
794
gid = pwd.getpwnam("nogroup").pw_gid
795
except KeyError:
796
pass
989
try:
990
uid = pwd.getpwnam("_mandos").pw_uid
991
except KeyError:
992
try:
993
uid = pwd.getpwnam("mandos").pw_uid
994
except KeyError:
995
try:
996
uid = pwd.getpwnam("nobody").pw_uid
997
except KeyError:
998
uid = 65534
999
try:
1000
gid = pwd.getpwnam("_mandos").pw_gid
1001
except KeyError:
1002
try:
1003
gid = pwd.getpwnam("mandos").pw_gid
1004
except KeyError:
1005
try:
1006
gid = pwd.getpwnam("nogroup").pw_gid
1007
except KeyError:
1008
gid = 65534
797
1009
try:
798
1010
os.setuid(uid)
799
1011
os.setgid(gid)
803
1015
804
1016
global service
805
1017
service = AvahiService(name = server_settings["servicename"],
806
type = "_mandos._tcp", );
1018
servicetype = "_mandos._tcp", )
807
1019
if server_settings["interface"]:
808
service.interface = if_nametoindex\
809
(server_settings["interface"])
1020
service.interface = (if_nametoindex
1021
(server_settings["interface"]))
810
1022
811
1023
global main_loop
812
1024
global bus
819
1031
avahi.DBUS_PATH_SERVER),
820
1032
avahi.DBUS_INTERFACE_SERVER)
821
1033
# End of Avahi example code
822
823
def remove_from_clients(client):
824
clients.remove(client)
825
if not clients:
826
logger.critical(u"No clients left, exiting")
827
sys.exit()
1034
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
828
1035
829
1036
clients.update(Set(Client(name = section,
830
stop_hook = remove_from_clients,
831
1037
config
832
1038
= dict(client_config.items(section)))
833
1039
for section in client_config.sections()))
852
1058
pidfile.write(str(pid) + "\n")
853
1059
pidfile.close()
854
1060
del pidfile
855
except IOError, err:
1061
except IOError:
856
1062
logger.error(u"Could not write to file %r with PID %d",
857
1063
pidfilename, pid)
858
1064
except NameError:
881
1087
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
882
1088
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
883
1089
1090
class MandosServer(dbus.service.Object):
1091
"""A D-Bus proxy object"""
1092
def __init__(self):
1093
dbus.service.Object.__init__(self, bus,
1094
"/Mandos")
1095
_interface = u"org.mandos_system.Mandos"
1096
1097
@dbus.service.signal(_interface, signature="oa{sv}")
1098
def ClientAdded(self, objpath, properties):
1099
"D-Bus signal"
1100
pass
1101
1102
@dbus.service.signal(_interface, signature="o")
1103
def ClientRemoved(self, objpath):
1104
"D-Bus signal"
1105
pass
1106
1107
@dbus.service.method(_interface, out_signature="ao")
1108
def GetAllClients(self):
1109
return dbus.Array(c.dbus_object_path for c in clients)
1110
1111
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1112
def GetAllClientsWithProperties(self):
1113
return dbus.Dictionary(
1114
((c.dbus_object_path, c.GetAllProperties())
1115
for c in clients),
1116
signature="oa{sv}")
1117
1118
@dbus.service.method(_interface, in_signature="o")
1119
def RemoveClient(self, object_path):
1120
for c in clients:
1121
if c.dbus_object_path == object_path:
1122
c.stop()
1123
clients.remove(c)
1124
return
1125
raise KeyError
1126
1127
del _interface
1128
1129
mandos_server = MandosServer()
1130
884
1131
for client in clients:
1132
# Emit D-Bus signal
1133
mandos_server.ClientAdded(client.dbus_object_path,
1134
client.GetAllProperties())
885
1135
client.start()
886
1136
887
1137
tcp_server.enable()
906
1156
907
1157
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
908
1158
lambda *args, **kwargs:
909
tcp_server.handle_request\
910
(*args[2:], **kwargs) or True)
1159
(tcp_server.handle_request
1160
(*args[2:], **kwargs) or True))
911
1161
912
1162
logger.debug(u"Starting main loop")
913
main_loop_started = True
914
1163
main_loop.run()
915
1164
except AvahiError, error:
916
1165
logger.critical(u"AvahiError: %s" + unicode(error))
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0