To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 238
- compare with another revision
- download diff
- download tarball
- view history from revision 238
- Committer: Teddy Hogeborn
- Date: 2008-12-10 01:26:02 UTC
- mfrom: (237.1.2 mandos)
- Revision ID: teddy@fukt.bsnet.se-20081210012602-vhz3h75xkj24t340
First version of a somewhat complete D-Bus server interface. Also
change user/group name to "_mandos".
* debian/mandos.postinst: Rename old "mandos" user and group to
"_mandos"; create "_mandos" user and group
if none exist.
* debian/mandos-client.postinst: - '' -
* initramfs-tools-hook: Try "_mandos" before "mandos" as user and
group name.
* mandos (_datetime_to_dbus_struct): New; was previously local.
(Client.started): Renamed to "last_started". All users changed.
(Client.started): New; boolean.
(Client.dbus_object_path): New.
(Client.check_command): Renamed to "checker_command". All users
changed.
(Client.__init__): Set and use "self.dbus_object_path". Set
"self.started".
(Client.start): Update "self.started". Emit "self.PropertyChanged"
signals for both "started" and "last_started".
(Client.stop): Update "self.started". Emit "self.PropertyChanged"
signal for "started".
(Client.checker_callback): Take additional "command" argument. All
callers changed. Emit
"self.PropertyChanged" signal.
(Client.bump_timeout): Emit "self.PropertyChanged" signal for
"last_checked_ok".
(Client.start_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.stop_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.still_valid): Bug fix: use "getattr(self, started, False)"
instead of "self.started" in case this client
object is so new that the "started" attribute
has not been created yet.
(Client.IntervalChanged, Client.CheckerIsRunning, Client.GetChecker,
Client.GetCreated, Client.GetFingerprint, Client.GetHost,
Client.GetInterval, Client.GetName, Client.GetStarted,
Client.GetTimeout, Client.StateChanged, Client.TimeoutChanged):
Removed; all callers changed.
(Client.CheckerCompleted): Add "condition" and "command" arguments.
All callers changed.
(Client.GetAllProperties, Client.PropertyChanged): New.
(Client.StillValid): Renamed to "IsStillValid".
(Client.StartChecker): Changed to its own function to avoid the
return value from "Client.start_checker()".
(Client.Stop): Changed to its own function to avoid the return value
from "Client.stop()".
(main): Try "_mandos" before "mandos" as user and group name.
Removed inner function "remove_from_clients". New inner
class "MandosServer".
change user/group name to "_mandos".
* debian/mandos.postinst: Rename old "mandos" user and group to
"_mandos"; create "_mandos" user and group
if none exist.
* debian/mandos-client.postinst: - '' -
* initramfs-tools-hook: Try "_mandos" before "mandos" as user and
group name.
* mandos (_datetime_to_dbus_struct): New; was previously local.
(Client.started): Renamed to "last_started". All users changed.
(Client.started): New; boolean.
(Client.dbus_object_path): New.
(Client.check_command): Renamed to "checker_command". All users
changed.
(Client.__init__): Set and use "self.dbus_object_path". Set
"self.started".
(Client.start): Update "self.started". Emit "self.PropertyChanged"
signals for both "started" and "last_started".
(Client.stop): Update "self.started". Emit "self.PropertyChanged"
signal for "started".
(Client.checker_callback): Take additional "command" argument. All
callers changed. Emit
"self.PropertyChanged" signal.
(Client.bump_timeout): Emit "self.PropertyChanged" signal for
"last_checked_ok".
(Client.start_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.stop_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.still_valid): Bug fix: use "getattr(self, started, False)"
instead of "self.started" in case this client
object is so new that the "started" attribute
has not been created yet.
(Client.IntervalChanged, Client.CheckerIsRunning, Client.GetChecker,
Client.GetCreated, Client.GetFingerprint, Client.GetHost,
Client.GetInterval, Client.GetName, Client.GetStarted,
Client.GetTimeout, Client.StateChanged, Client.TimeoutChanged):
Removed; all callers changed.
(Client.CheckerCompleted): Add "condition" and "command" arguments.
All callers changed.
(Client.GetAllProperties, Client.PropertyChanged): New.
(Client.StillValid): Renamed to "IsStillValid".
(Client.StartChecker): Changed to its own function to avoid the
return value from "Client.start_checker()".
(Client.Stop): Changed to its own function to avoid the return value
from "Client.stop()".
(main): Try "_mandos" before "mandos" as user and group name.
Removed inner function "remove_from_clients". New inner
class "MandosServer".
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- plugins.d/usplash
- files renamed:
- plugins.d/password-request.c => plugins.d/mandos-client.c
- plugins.d/password-request.xml => plugins.d/mandos-client.xml
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn
15
# Copyright © 2008 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
30
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
32
#
32
33
33
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
34
35
35
36
import SocketServer
36
37
import socket
37
import select
38
38
from optparse import OptionParser
39
39
import datetime
40
40
import errno
55
55
import stat
56
56
import logging
57
57
import logging.handlers
58
import pwd
59
from contextlib import closing
58
60
59
61
import dbus
62
import dbus.service
60
63
import gobject
61
64
import avahi
62
65
from dbus.mainloop.glib import DBusGMainLoop
63
66
import ctypes
67
import ctypes.util
64
68
65
version = "1.0"
69
version = "1.0.2"
66
70
67
71
logger = logging.Logger('mandos')
68
syslogger = logging.handlers.SysLogHandler\
69
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
70
address = "/dev/log")
71
syslogger.setFormatter(logging.Formatter\
72
('Mandos: %(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
73
77
logger.addHandler(syslogger)
74
78
75
79
console = logging.StreamHandler()
80
84
class AvahiError(Exception):
81
85
def __init__(self, value):
82
86
self.value = value
87
super(AvahiError, self).__init__()
83
88
def __str__(self):
84
89
return repr(self.value)
85
90
107
112
a sensible number of times
108
113
"""
109
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
110
type = None, port = None, TXT = None, domain = "",
111
host = "", max_renames = 32768):
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
112
117
self.interface = interface
113
118
self.name = name
114
self.type = type
119
self.type = servicetype
115
120
self.port = port
116
if TXT is None:
117
self.TXT = []
118
else:
119
self.TXT = TXT
121
self.TXT = TXT if TXT is not None else []
120
122
self.domain = domain
121
123
self.host = host
122
124
self.rename_count = 0
126
128
if self.rename_count >= self.max_renames:
127
129
logger.critical(u"No suitable Zeroconf service name found"
128
130
u" after %i retries, exiting.",
129
rename_count)
131
self.rename_count)
130
132
raise AvahiServiceError("Too many renames")
131
133
self.name = server.GetAlternativeServiceName(self.name)
132
134
logger.info(u"Changing Zeroconf service name to %r ...",
133
135
str(self.name))
134
syslogger.setFormatter(logging.Formatter\
136
syslogger.setFormatter(logging.Formatter
135
137
('Mandos (%s): %%(levelname)s:'
136
' %%(message)s' % self.name))
138
' %%(message)s' % self.name))
137
139
self.remove()
138
140
self.add()
139
141
self.rename_count += 1
145
147
"""Derived from the Avahi example code"""
146
148
global group
147
149
if group is None:
148
group = dbus.Interface\
149
(bus.get_object(avahi.DBUS_NAME,
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
150
152
server.EntryGroupNew()),
151
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
154
group.connect_to_signal('StateChanged',
153
155
entry_group_state_changed)
154
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
168
170
# End of Avahi example code
169
171
170
172
171
class Client(object):
173
def _datetime_to_dbus_struct(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus struct.
175
The format is special to this application, since we could not find
176
any other standard way."""
177
return dbus.Struct((dbus.Int16(dt.year),
178
dbus.Byte(dt.month),
179
dbus.Byte(dt.day),
180
dbus.Byte(dt.hour),
181
dbus.Byte(dt.minute),
182
dbus.Byte(dt.second),
183
dbus.UInt32(dt.microsecond)),
184
signature="nyyyyyu",
185
variant_level=variant_level)
186
187
188
class Client(dbus.service.Object):
172
189
"""A representation of a client host served by this server.
173
190
Attributes:
174
name: string; from the config file, used in log messages
191
name: string; from the config file, used in log messages
175
192
fingerprint: string (40 or 32 hexadecimal digits); used to
176
193
uniquely identify the client
177
secret: bytestring; sent verbatim (over TLS) to client
178
host: string; available for use by the checker command
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
181
timeout: datetime.timedelta(); How long from last_checked_ok
182
until this client is invalid
183
interval: datetime.timedelta(); How often to start a new checker
184
stop_hook: If set, called by stop() as stop_hook(self)
185
checker: subprocess.Popen(); a running checker process used
186
to see if the client lives.
187
'None' if no process is running.
194
secret: bytestring; sent verbatim (over TLS) to client
195
host: string; available for use by the checker command
196
created: datetime.datetime(); (UTC) object creation
197
last_started: datetime.datetime(); (UTC)
198
started: bool()
199
last_checked_ok: datetime.datetime(); (UTC) or None
200
timeout: datetime.timedelta(); How long from last_checked_ok
201
until this client is invalid
202
interval: datetime.timedelta(); How often to start a new checker
203
stop_hook: If set, called by stop() as stop_hook(self)
204
checker: subprocess.Popen(); a running checker process used
205
to see if the client lives.
206
'None' if no process is running.
188
207
checker_initiator_tag: a gobject event source tag, or None
189
208
stop_initiator_tag: - '' -
190
209
checker_callback_tag: - '' -
192
211
client lives. %() expansions are done at
193
212
runtime with vars(self) as dict, so that for
194
213
instance %(name)s can be used in the command.
214
dbus_object_path: dbus.ObjectPath
195
215
Private attibutes:
196
216
_timeout: Real variable for 'timeout'
197
217
_interval: Real variable for 'interval'
199
219
_interval_milliseconds: - '' -
200
220
"""
201
221
def _set_timeout(self, timeout):
202
"Setter function for 'timeout' attribute"
222
"Setter function for the 'timeout' attribute"
203
223
self._timeout = timeout
204
224
self._timeout_milliseconds = ((self.timeout.days
205
225
* 24 * 60 * 60 * 1000)
206
226
+ (self.timeout.seconds * 1000)
207
227
+ (self.timeout.microseconds
208
228
// 1000))
209
timeout = property(lambda self: self._timeout,
210
_set_timeout)
229
# Emit D-Bus signal
230
self.PropertyChanged(dbus.String(u"timeout"),
231
(dbus.UInt64(self._timeout_milliseconds,
232
variant_level=1)))
233
timeout = property(lambda self: self._timeout, _set_timeout)
211
234
del _set_timeout
235
212
236
def _set_interval(self, interval):
213
"Setter function for 'interval' attribute"
237
"Setter function for the 'interval' attribute"
214
238
self._interval = interval
215
239
self._interval_milliseconds = ((self.interval.days
216
240
* 24 * 60 * 60 * 1000)
218
242
* 1000)
219
243
+ (self.interval.microseconds
220
244
// 1000))
221
interval = property(lambda self: self._interval,
222
_set_interval)
245
# Emit D-Bus signal
246
self.PropertyChanged(dbus.String(u"interval"),
247
(dbus.UInt64(self._interval_milliseconds,
248
variant_level=1)))
249
interval = property(lambda self: self._interval, _set_interval)
223
250
del _set_interval
224
def __init__(self, name = None, stop_hook=None, config={}):
251
252
def __init__(self, name = None, stop_hook=None, config=None):
225
253
"""Note: the 'checker' key in 'config' sets the
226
254
'checker_command' attribute and *not* the 'checker'
227
255
attribute."""
256
self.dbus_object_path = (dbus.ObjectPath
257
("/Mandos/clients/"
258
+ name.replace(".", "_")))
259
dbus.service.Object.__init__(self, bus,
260
self.dbus_object_path)
261
if config is None:
262
config = {}
228
263
self.name = name
229
264
logger.debug(u"Creating client %r", self.name)
230
265
# Uppercase and remove spaces from fingerprint for later
231
266
# comparison purposes with return value from the fingerprint()
232
267
# function
233
self.fingerprint = config["fingerprint"].upper()\
234
.replace(u" ", u"")
268
self.fingerprint = (config["fingerprint"].upper()
269
.replace(u" ", u""))
235
270
logger.debug(u" Fingerprint: %s", self.fingerprint)
236
271
if "secret" in config:
237
272
self.secret = config["secret"].decode(u"base64")
238
273
elif "secfile" in config:
239
sf = open(config["secfile"])
240
self.secret = sf.read()
241
sf.close()
274
with closing(open(os.path.expanduser
275
(os.path.expandvars
276
(config["secfile"])))) as secfile:
277
self.secret = secfile.read()
242
278
else:
243
279
raise TypeError(u"No secret or secfile for client %s"
244
280
% self.name)
245
281
self.host = config.get("host", "")
246
self.created = datetime.datetime.now()
282
self.created = datetime.datetime.utcnow()
283
self.started = False
284
self.last_started = None
247
285
self.last_checked_ok = None
248
286
self.timeout = string_to_delta(config["timeout"])
249
287
self.interval = string_to_delta(config["interval"])
252
290
self.checker_initiator_tag = None
253
291
self.stop_initiator_tag = None
254
292
self.checker_callback_tag = None
255
self.check_command = config["checker"]
293
self.checker_command = config["checker"]
294
256
295
def start(self):
257
296
"""Start this client's checker and timeout hooks"""
297
self.last_started = datetime.datetime.utcnow()
258
298
# Schedule a new checker to be started an 'interval' from now,
259
299
# and every interval from then on.
260
self.checker_initiator_tag = gobject.timeout_add\
261
(self._interval_milliseconds,
262
self.start_checker)
300
self.checker_initiator_tag = (gobject.timeout_add
301
(self._interval_milliseconds,
302
self.start_checker))
263
303
# Also start a new checker *right now*.
264
304
self.start_checker()
265
305
# Schedule a stop() when 'timeout' has passed
266
self.stop_initiator_tag = gobject.timeout_add\
267
(self._timeout_milliseconds,
268
self.stop)
306
self.stop_initiator_tag = (gobject.timeout_add
307
(self._timeout_milliseconds,
308
self.stop))
309
self.started = True
310
# Emit D-Bus signal
311
self.PropertyChanged(dbus.String(u"started"),
312
dbus.Boolean(True, variant_level=1))
313
self.PropertyChanged(dbus.String(u"last_started"),
314
(_datetime_to_dbus_struct
315
(self.last_started, variant_level=1)))
316
269
317
def stop(self):
270
"""Stop this client.
271
The possibility that a client might be restarted is left open,
272
but not currently used."""
273
# If this client doesn't have a secret, it is already stopped.
274
if hasattr(self, "secret") and self.secret:
275
logger.info(u"Stopping client %s", self.name)
276
self.secret = None
277
else:
318
"""Stop this client."""
319
if not getattr(self, "started", False):
278
320
return False
321
logger.info(u"Stopping client %s", self.name)
279
322
if getattr(self, "stop_initiator_tag", False):
280
323
gobject.source_remove(self.stop_initiator_tag)
281
324
self.stop_initiator_tag = None
285
328
self.stop_checker()
286
329
if self.stop_hook:
287
330
self.stop_hook(self)
331
self.started = False
332
# Emit D-Bus signal
333
self.PropertyChanged(dbus.String(u"started"),
334
dbus.Boolean(False, variant_level=1))
288
335
# Do not run this again if called by a gobject.timeout_add
289
336
return False
337
290
338
def __del__(self):
291
339
self.stop_hook = None
292
340
self.stop()
293
def checker_callback(self, pid, condition):
341
342
def checker_callback(self, pid, condition, command):
294
343
"""The checker has completed, so take appropriate actions."""
295
now = datetime.datetime.now()
296
344
self.checker_callback_tag = None
297
345
self.checker = None
298
if os.WIFEXITED(condition) \
299
and (os.WEXITSTATUS(condition) == 0):
346
# Emit D-Bus signal
347
self.PropertyChanged(dbus.String(u"checker_running"),
348
dbus.Boolean(False, variant_level=1))
349
if (os.WIFEXITED(condition)
350
and (os.WEXITSTATUS(condition) == 0)):
300
351
logger.info(u"Checker for %(name)s succeeded",
301
352
vars(self))
302
self.last_checked_ok = now
303
gobject.source_remove(self.stop_initiator_tag)
304
self.stop_initiator_tag = gobject.timeout_add\
305
(self._timeout_milliseconds,
306
self.stop)
353
# Emit D-Bus signal
354
self.CheckerCompleted(dbus.Boolean(True),
355
dbus.UInt16(condition),
356
dbus.String(command))
357
self.bump_timeout()
307
358
elif not os.WIFEXITED(condition):
308
359
logger.warning(u"Checker for %(name)s crashed?",
309
360
vars(self))
361
# Emit D-Bus signal
362
self.CheckerCompleted(dbus.Boolean(False),
363
dbus.UInt16(condition),
364
dbus.String(command))
310
365
else:
311
366
logger.info(u"Checker for %(name)s failed",
312
367
vars(self))
368
# Emit D-Bus signal
369
self.CheckerCompleted(dbus.Boolean(False),
370
dbus.UInt16(condition),
371
dbus.String(command))
372
373
def bump_timeout(self):
374
"""Bump up the timeout for this client.
375
This should only be called when the client has been seen,
376
alive and well.
377
"""
378
self.last_checked_ok = datetime.datetime.utcnow()
379
gobject.source_remove(self.stop_initiator_tag)
380
self.stop_initiator_tag = (gobject.timeout_add
381
(self._timeout_milliseconds,
382
self.stop))
383
self.PropertyChanged(dbus.String(u"last_checked_ok"),
384
(_datetime_to_dbus_struct
385
(self.last_checked_ok,
386
variant_level=1)))
387
313
388
def start_checker(self):
314
389
"""Start a new checker subprocess if one is not running.
315
390
If a checker already exists, leave it running and do
324
399
# is as it should be.
325
400
if self.checker is None:
326
401
try:
327
# In case check_command has exactly one % operator
328
command = self.check_command % self.host
402
# In case checker_command has exactly one % operator
403
command = self.checker_command % self.host
329
404
except TypeError:
330
405
# Escape attributes for the shell
331
406
escaped_attrs = dict((key, re.escape(str(val)))
332
407
for key, val in
333
408
vars(self).iteritems())
334
409
try:
335
command = self.check_command % escaped_attrs
410
command = self.checker_command % escaped_attrs
336
411
except TypeError, error:
337
412
logger.error(u'Could not format string "%s":'
338
u' %s', self.check_command, error)
413
u' %s', self.checker_command, error)
339
414
return True # Try again later
340
415
try:
341
416
logger.info(u"Starting checker %r for %s",
347
422
self.checker = subprocess.Popen(command,
348
423
close_fds=True,
349
424
shell=True, cwd="/")
350
self.checker_callback_tag = gobject.child_watch_add\
351
(self.checker.pid,
352
self.checker_callback)
425
# Emit D-Bus signal
426
self.CheckerStarted(command)
427
self.PropertyChanged(dbus.String("checker_running"),
428
dbus.Boolean(True, variant_level=1))
429
self.checker_callback_tag = (gobject.child_watch_add
430
(self.checker.pid,
431
self.checker_callback,
432
data=command))
353
433
except OSError, error:
354
434
logger.error(u"Failed to start subprocess: %s",
355
435
error)
356
436
# Re-run this periodically if run by gobject.timeout_add
357
437
return True
438
358
439
def stop_checker(self):
359
440
"""Force the checker process, if any, to stop."""
360
441
if self.checker_callback_tag:
372
453
if error.errno != errno.ESRCH: # No such process
373
454
raise
374
455
self.checker = None
456
self.PropertyChanged(dbus.String(u"checker_running"),
457
dbus.Boolean(False, variant_level=1))
458
375
459
def still_valid(self):
376
460
"""Has the timeout not yet passed for this client?"""
377
now = datetime.datetime.now()
461
if not getattr(self, "started", False):
462
return False
463
now = datetime.datetime.utcnow()
378
464
if self.last_checked_ok is None:
379
465
return now < (self.created + self.timeout)
380
466
else:
381
467
return now < (self.last_checked_ok + self.timeout)
468
469
## D-Bus methods & signals
470
_interface = u"org.mandos_system.Mandos.Client"
471
472
# BumpTimeout - method
473
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
474
BumpTimeout.__name__ = "BumpTimeout"
475
476
# CheckerCompleted - signal
477
@dbus.service.signal(_interface, signature="bqs")
478
def CheckerCompleted(self, success, condition, command):
479
"D-Bus signal"
480
pass
481
482
# CheckerStarted - signal
483
@dbus.service.signal(_interface, signature="s")
484
def CheckerStarted(self, command):
485
"D-Bus signal"
486
pass
487
488
# GetAllProperties - method
489
@dbus.service.method(_interface, out_signature="a{sv}")
490
def GetAllProperties(self):
491
"D-Bus method"
492
return dbus.Dictionary({
493
dbus.String("name"):
494
dbus.String(self.name, variant_level=1),
495
dbus.String("fingerprint"):
496
dbus.String(self.fingerprint, variant_level=1),
497
dbus.String("host"):
498
dbus.String(self.host, variant_level=1),
499
dbus.String("created"):
500
_datetime_to_dbus_struct(self.created,
501
variant_level=1),
502
dbus.String("last_started"):
503
(_datetime_to_dbus_struct(self.last_started,
504
variant_level=1)
505
if self.last_started is not None
506
else dbus.Boolean(False, variant_level=1)),
507
dbus.String("started"):
508
dbus.Boolean(self.started, variant_level=1),
509
dbus.String("last_checked_ok"):
510
(_datetime_to_dbus_struct(self.last_checked_ok,
511
variant_level=1)
512
if self.last_checked_ok is not None
513
else dbus.Boolean (False, variant_level=1)),
514
dbus.String("timeout"):
515
dbus.UInt64(self._timeout_milliseconds,
516
variant_level=1),
517
dbus.String("interval"):
518
dbus.UInt64(self._interval_milliseconds,
519
variant_level=1),
520
dbus.String("checker"):
521
dbus.String(self.checker_command,
522
variant_level=1),
523
dbus.String("checker_running"):
524
dbus.Boolean(self.checker is not None,
525
variant_level=1),
526
}, signature="sv")
527
528
# IsStillValid - method
529
IsStillValid = (dbus.service.method(_interface, out_signature="b")
530
(still_valid))
531
IsStillValid.__name__ = "IsStillValid"
532
533
# PropertyChanged - signal
534
@dbus.service.signal(_interface, signature="sv")
535
def PropertyChanged(self, property, value):
536
"D-Bus signal"
537
pass
538
539
# SetChecker - method
540
@dbus.service.method(_interface, in_signature="s")
541
def SetChecker(self, checker):
542
"D-Bus setter method"
543
self.checker_command = checker
544
545
# SetHost - method
546
@dbus.service.method(_interface, in_signature="s")
547
def SetHost(self, host):
548
"D-Bus setter method"
549
self.host = host
550
551
# SetInterval - method
552
@dbus.service.method(_interface, in_signature="t")
553
def SetInterval(self, milliseconds):
554
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
555
556
# SetSecret - method
557
@dbus.service.method(_interface, in_signature="ay",
558
byte_arrays=True)
559
def SetSecret(self, secret):
560
"D-Bus setter method"
561
self.secret = str(secret)
562
563
# SetTimeout - method
564
@dbus.service.method(_interface, in_signature="t")
565
def SetTimeout(self, milliseconds):
566
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
567
568
# Start - method
569
Start = dbus.service.method(_interface)(start)
570
Start.__name__ = "Start"
571
572
# StartChecker - method
573
@dbus.service.method(_interface)
574
def StartChecker(self):
575
"D-Bus method"
576
self.start_checker()
577
578
# Stop - method
579
@dbus.service.method(_interface)
580
def Stop(self):
581
"D-Bus method"
582
self.stop()
583
584
# StopChecker - method
585
StopChecker = dbus.service.method(_interface)(stop_checker)
586
StopChecker.__name__ = "StopChecker"
587
588
del _interface
382
589
383
590
384
591
def peer_certificate(session):
385
592
"Return the peer's OpenPGP certificate as a bytestring"
386
593
# If not an OpenPGP certificate...
387
if gnutls.library.functions.gnutls_certificate_type_get\
388
(session._c_object) \
389
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
594
if (gnutls.library.functions
595
.gnutls_certificate_type_get(session._c_object)
596
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
390
597
# ...do the normal thing
391
598
return session.peer_certificate
392
599
list_size = ctypes.c_uint()
393
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
394
(session._c_object, ctypes.byref(list_size))
600
cert_list = (gnutls.library.functions
601
.gnutls_certificate_get_peers
602
(session._c_object, ctypes.byref(list_size)))
395
603
if list_size.value == 0:
396
604
return None
397
605
cert = cert_list[0]
401
609
def fingerprint(openpgp):
402
610
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
403
611
# New GnuTLS "datum" with the OpenPGP public key
404
datum = gnutls.library.types.gnutls_datum_t\
405
(ctypes.cast(ctypes.c_char_p(openpgp),
406
ctypes.POINTER(ctypes.c_ubyte)),
407
ctypes.c_uint(len(openpgp)))
612
datum = (gnutls.library.types
613
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
614
ctypes.POINTER
615
(ctypes.c_ubyte)),
616
ctypes.c_uint(len(openpgp))))
408
617
# New empty GnuTLS certificate
409
618
crt = gnutls.library.types.gnutls_openpgp_crt_t()
410
gnutls.library.functions.gnutls_openpgp_crt_init\
411
(ctypes.byref(crt))
619
(gnutls.library.functions
620
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
412
621
# Import the OpenPGP public key into the certificate
413
gnutls.library.functions.gnutls_openpgp_crt_import\
414
(crt, ctypes.byref(datum),
415
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
624
gnutls.library.constants
625
.GNUTLS_OPENPGP_FMT_RAW))
416
626
# Verify the self signature in the key
417
crtverify = ctypes.c_uint();
418
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
419
(crt, 0, ctypes.byref(crtverify))
627
crtverify = ctypes.c_uint()
628
(gnutls.library.functions
629
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
420
630
if crtverify.value != 0:
421
631
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
422
632
raise gnutls.errors.CertificateSecurityError("Verify failed")
423
633
# New buffer for the fingerprint
424
buffer = ctypes.create_string_buffer(20)
425
buffer_length = ctypes.c_size_t()
634
buf = ctypes.create_string_buffer(20)
635
buf_len = ctypes.c_size_t()
426
636
# Get the fingerprint from the certificate into the buffer
427
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
428
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
637
(gnutls.library.functions
638
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
639
ctypes.byref(buf_len)))
429
640
# Deinit the certificate
430
641
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
431
642
# Convert the buffer to a Python bytestring
432
fpr = ctypes.string_at(buffer, buffer_length.value)
643
fpr = ctypes.string_at(buf, buf_len.value)
433
644
# Convert the bytestring to hexadecimal notation
434
645
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
435
646
return hex_fpr
436
647
437
648
438
class tcp_handler(SocketServer.BaseRequestHandler, object):
649
class TCP_handler(SocketServer.BaseRequestHandler, object):
439
650
"""A TCP request handler class.
440
651
Instantiated by IPv6_TCPServer for each request to handle it.
441
652
Note: This will run in its own forked process."""
442
653
443
654
def handle(self):
444
655
logger.info(u"TCP connection from: %s",
445
unicode(self.client_address))
446
session = gnutls.connection.ClientSession\
447
(self.request, gnutls.connection.X509Credentials())
656
unicode(self.client_address))
657
session = (gnutls.connection
658
.ClientSession(self.request,
659
gnutls.connection
660
.X509Credentials()))
448
661
449
662
line = self.request.makefile().readline()
450
663
logger.debug(u"Protocol version: %r", line)
463
676
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
464
677
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
465
678
# "+DHE-DSS"))
466
priority = "NORMAL" # Fallback default, since this
467
# MUST be set.
468
if self.server.settings["priority"]:
469
priority = self.server.settings["priority"]
470
gnutls.library.functions.gnutls_priority_set_direct\
471
(session._c_object, priority, None);
679
# Use a fallback default, since this MUST be set.
680
priority = self.server.settings.get("priority", "NORMAL")
681
(gnutls.library.functions
682
.gnutls_priority_set_direct(session._c_object,
683
priority, None))
472
684
473
685
try:
474
686
session.handshake()
484
696
session.bye()
485
697
return
486
698
logger.debug(u"Fingerprint: %s", fpr)
487
client = None
488
699
for c in self.server.clients:
489
700
if c.fingerprint == fpr:
490
701
client = c
491
702
break
492
if not client:
703
else:
493
704
logger.warning(u"Client not found for fingerprint: %s",
494
705
fpr)
495
706
session.bye()
502
713
vars(client))
503
714
session.bye()
504
715
return
716
## This won't work here, since we're in a fork.
717
# client.bump_timeout()
505
718
sent_size = 0
506
719
while sent_size < len(client.secret):
507
720
sent = session.send(client.secret[sent_size:])
512
725
session.bye()
513
726
514
727
515
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
728
class IPv6_TCPServer(SocketServer.ForkingMixIn,
729
SocketServer.TCPServer, object):
516
730
"""IPv6 TCP server. Accepts 'None' as address and/or port.
517
731
Attributes:
518
732
settings: Server settings
519
733
clients: Set() of Client objects
734
enabled: Boolean; whether this server is activated yet
520
735
"""
521
736
address_family = socket.AF_INET6
522
737
def __init__(self, *args, **kwargs):
526
741
if "clients" in kwargs:
527
742
self.clients = kwargs["clients"]
528
743
del kwargs["clients"]
529
return super(type(self), self).__init__(*args, **kwargs)
744
self.enabled = False
745
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
530
746
def server_bind(self):
531
747
"""This overrides the normal server_bind() function
532
748
to bind to an interface if one was specified, and also NOT to
561
777
# if_nametoindex
562
778
# (self.settings
563
779
# ["interface"]))
564
return super(type(self), self).server_bind()
780
return super(IPv6_TCPServer, self).server_bind()
781
def server_activate(self):
782
if self.enabled:
783
return super(IPv6_TCPServer, self).server_activate()
784
def enable(self):
785
self.enabled = True
565
786
566
787
567
788
def string_to_delta(interval):
583
804
timevalue = datetime.timedelta(0)
584
805
for s in interval.split():
585
806
try:
586
suffix=unicode(s[-1])
587
value=int(s[:-1])
807
suffix = unicode(s[-1])
808
value = int(s[:-1])
588
809
if suffix == u"d":
589
810
delta = datetime.timedelta(value)
590
811
elif suffix == u"s":
630
851
"""Call the C function if_nametoindex(), or equivalent"""
631
852
global if_nametoindex
632
853
try:
633
if "ctypes.util" not in sys.modules:
634
import ctypes.util
635
if_nametoindex = ctypes.cdll.LoadLibrary\
636
(ctypes.util.find_library("c")).if_nametoindex
854
if_nametoindex = (ctypes.cdll.LoadLibrary
855
(ctypes.util.find_library("c"))
856
.if_nametoindex)
637
857
except (OSError, AttributeError):
638
858
if "struct" not in sys.modules:
639
859
import struct
642
862
def if_nametoindex(interface):
643
863
"Get an interface index the hard way, i.e. using fcntl()"
644
864
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
645
s = socket.socket()
646
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
647
struct.pack("16s16x", interface))
648
s.close()
865
with closing(socket.socket()) as s:
866
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
867
struct.pack("16s16x", interface))
649
868
interface_index = struct.unpack("I", ifreq[16:20])[0]
650
869
return interface_index
651
870
return if_nametoindex(interface)
675
894
676
895
677
896
def main():
678
global main_loop_started
679
main_loop_started = False
680
681
897
parser = OptionParser(version = "%%prog %s" % version)
682
898
parser.add_option("-i", "--interface", type="string",
683
899
metavar="IF", help="Bind to interface IF")
698
914
default="/etc/mandos", metavar="DIR",
699
915
help="Directory to search for configuration"
700
916
" files")
701
(options, args) = parser.parse_args()
917
options = parser.parse_args()[0]
702
918
703
919
if options.check:
704
920
import doctest
722
938
# Convert the SafeConfigParser object to a dict
723
939
server_settings = server_config.defaults()
724
940
# Use getboolean on the boolean config option
725
server_settings["debug"] = server_config.getboolean\
726
("DEFAULT", "debug")
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
727
943
del server_config
728
944
729
945
# Override the settings from the config file with command line
743
959
console.setLevel(logging.WARNING)
744
960
745
961
if server_settings["servicename"] != "Mandos":
746
syslogger.setFormatter(logging.Formatter\
962
syslogger.setFormatter(logging.Formatter
747
963
('Mandos (%s): %%(levelname)s:'
748
964
' %%(message)s'
749
965
% server_settings["servicename"]))
758
974
client_config.read(os.path.join(server_settings["configdir"],
759
975
"clients.conf"))
760
976
977
clients = Set()
978
tcp_server = IPv6_TCPServer((server_settings["address"],
979
server_settings["port"]),
980
TCP_handler,
981
settings=server_settings,
982
clients=clients)
983
pidfilename = "/var/run/mandos.pid"
984
try:
985
pidfile = open(pidfilename, "w")
986
except IOError, error:
987
logger.error("Could not open file %r", pidfilename)
988
989
try:
990
uid = pwd.getpwnam("_mandos").pw_uid
991
except KeyError:
992
try:
993
uid = pwd.getpwnam("mandos").pw_uid
994
except KeyError:
995
try:
996
uid = pwd.getpwnam("nobody").pw_uid
997
except KeyError:
998
uid = 65534
999
try:
1000
gid = pwd.getpwnam("_mandos").pw_gid
1001
except KeyError:
1002
try:
1003
gid = pwd.getpwnam("mandos").pw_gid
1004
except KeyError:
1005
try:
1006
gid = pwd.getpwnam("nogroup").pw_gid
1007
except KeyError:
1008
gid = 65534
1009
try:
1010
os.setuid(uid)
1011
os.setgid(gid)
1012
except OSError, error:
1013
if error[0] != errno.EPERM:
1014
raise error
1015
761
1016
global service
762
1017
service = AvahiService(name = server_settings["servicename"],
763
type = "_mandos._tcp", );
1018
servicetype = "_mandos._tcp", )
764
1019
if server_settings["interface"]:
765
service.interface = if_nametoindex\
766
(server_settings["interface"])
1020
service.interface = (if_nametoindex
1021
(server_settings["interface"]))
767
1022
768
1023
global main_loop
769
1024
global bus
776
1031
avahi.DBUS_PATH_SERVER),
777
1032
avahi.DBUS_INTERFACE_SERVER)
778
1033
# End of Avahi example code
779
780
clients = Set()
781
def remove_from_clients(client):
782
clients.remove(client)
783
if not clients:
784
logger.critical(u"No clients left, exiting")
785
sys.exit()
1034
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
786
1035
787
1036
clients.update(Set(Client(name = section,
788
stop_hook = remove_from_clients,
789
1037
config
790
1038
= dict(client_config.items(section)))
791
1039
for section in client_config.sections()))
805
1053
# Close all input and output, do double fork, etc.
806
1054
daemon()
807
1055
808
pidfilename = "/var/run/mandos/mandos.pid"
809
pid = os.getpid()
810
1056
try:
811
pidfile = open(pidfilename, "w")
1057
pid = os.getpid()
812
1058
pidfile.write(str(pid) + "\n")
813
1059
pidfile.close()
814
1060
del pidfile
815
except IOError, err:
816
logger.error(u"Could not write %s file with PID %d",
817
pidfilename, os.getpid())
1061
except IOError:
1062
logger.error(u"Could not write to file %r with PID %d",
1063
pidfilename, pid)
1064
except NameError:
1065
# "pidfile" was never created
1066
pass
1067
del pidfilename
818
1068
819
1069
def cleanup():
820
1070
"Cleanup function; run on exit"
837
1087
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
838
1088
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
839
1089
1090
class MandosServer(dbus.service.Object):
1091
"""A D-Bus proxy object"""
1092
def __init__(self):
1093
dbus.service.Object.__init__(self, bus,
1094
"/Mandos")
1095
_interface = u"org.mandos_system.Mandos"
1096
1097
@dbus.service.signal(_interface, signature="oa{sv}")
1098
def ClientAdded(self, objpath, properties):
1099
"D-Bus signal"
1100
pass
1101
1102
@dbus.service.signal(_interface, signature="o")
1103
def ClientRemoved(self, objpath):
1104
"D-Bus signal"
1105
pass
1106
1107
@dbus.service.method(_interface, out_signature="ao")
1108
def GetAllClients(self):
1109
return dbus.Array(c.dbus_object_path for c in clients)
1110
1111
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1112
def GetAllClientsWithProperties(self):
1113
return dbus.Dictionary(
1114
((c.dbus_object_path, c.GetAllProperties())
1115
for c in clients),
1116
signature="oa{sv}")
1117
1118
@dbus.service.method(_interface, in_signature="o")
1119
def RemoveClient(self, object_path):
1120
for c in clients:
1121
if c.dbus_object_path == object_path:
1122
c.stop()
1123
clients.remove(c)
1124
return
1125
raise KeyError
1126
1127
del _interface
1128
1129
mandos_server = MandosServer()
1130
840
1131
for client in clients:
1132
# Emit D-Bus signal
1133
mandos_server.ClientAdded(client.dbus_object_path,
1134
client.GetAllProperties())
841
1135
client.start()
842
1136
843
tcp_server = IPv6_TCPServer((server_settings["address"],
844
server_settings["port"]),
845
tcp_handler,
846
settings=server_settings,
847
clients=clients)
1137
tcp_server.enable()
1138
tcp_server.server_activate()
1139
848
1140
# Find out what port we got
849
1141
service.port = tcp_server.socket.getsockname()[1]
850
1142
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
864
1156
865
1157
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
866
1158
lambda *args, **kwargs:
867
tcp_server.handle_request\
868
(*args[2:], **kwargs) or True)
1159
(tcp_server.handle_request
1160
(*args[2:], **kwargs) or True))
869
1161
870
1162
logger.debug(u"Starting main loop")
871
main_loop_started = True
872
1163
main_loop.run()
873
1164
except AvahiError, error:
874
1165
logger.critical(u"AvahiError: %s" + unicode(error))
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0