220
224
+ (self.interval.microseconds
222
interval = property(lambda self: self._interval,
227
self.IntervalChanged(self._interval_milliseconds)
228
interval = property(lambda self: self._interval, _set_interval)
224
229
del _set_interval
225
def __init__(self, name = None, stop_hook=None, config={}):
231
def __init__(self, name = None, stop_hook=None, config=None):
226
232
"""Note: the 'checker' key in 'config' sets the
227
233
'checker_command' attribute and *not* the 'checker'
235
dbus.service.Object.__init__(self, bus,
237
% name.replace(".", "_"))
230
241
logger.debug(u"Creating client %r", self.name)
231
242
# Uppercase and remove spaces from fingerprint for later
232
243
# comparison purposes with return value from the fingerprint()
234
self.fingerprint = config["fingerprint"].upper()\
245
self.fingerprint = (config["fingerprint"].upper()
236
247
logger.debug(u" Fingerprint: %s", self.fingerprint)
237
248
if "secret" in config:
238
249
self.secret = config["secret"].decode(u"base64")
239
250
elif "secfile" in config:
240
sf = open(config["secfile"])
241
self.secret = sf.read()
251
with closing(open(os.path.expanduser
253
(config["secfile"])))) as secfile:
254
self.secret = secfile.read()
244
256
raise TypeError(u"No secret or secfile for client %s"
246
258
self.host = config.get("host", "")
247
self.created = datetime.datetime.now()
259
self.created = datetime.datetime.utcnow()
248
261
self.last_checked_ok = None
249
262
self.timeout = string_to_delta(config["timeout"])
250
263
self.interval = string_to_delta(config["interval"])
254
267
self.stop_initiator_tag = None
255
268
self.checker_callback_tag = None
256
269
self.check_command = config["checker"]
258
272
"""Start this client's checker and timeout hooks"""
273
self.started = datetime.datetime.utcnow()
259
274
# Schedule a new checker to be started an 'interval' from now,
260
275
# and every interval from then on.
261
self.checker_initiator_tag = gobject.timeout_add\
262
(self._interval_milliseconds,
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self._interval_milliseconds,
264
279
# Also start a new checker *right now*.
265
280
self.start_checker()
266
281
# Schedule a stop() when 'timeout' has passed
267
self.stop_initiator_tag = gobject.timeout_add\
268
(self._timeout_milliseconds,
282
self.stop_initiator_tag = (gobject.timeout_add
283
(self._timeout_milliseconds,
286
self.StateChanged(True)
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
274
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
289
"""Stop this client."""
290
if getattr(self, "started", None) is not None:
276
291
logger.info(u"Stopping client %s", self.name)
280
294
if getattr(self, "stop_initiator_tag", False):
286
300
self.stop_checker()
287
301
if self.stop_hook:
288
302
self.stop_hook(self)
305
self.StateChanged(False)
289
306
# Do not run this again if called by a gobject.timeout_add
291
309
def __del__(self):
292
310
self.stop_hook = None
294
313
def checker_callback(self, pid, condition):
295
314
"""The checker has completed, so take appropriate actions."""
296
now = datetime.datetime.now()
297
315
self.checker_callback_tag = None
298
316
self.checker = None
299
if os.WIFEXITED(condition) \
300
and (os.WEXITSTATUS(condition) == 0):
317
if (os.WIFEXITED(condition)
318
and (os.WEXITSTATUS(condition) == 0)):
301
319
logger.info(u"Checker for %(name)s succeeded",
303
self.last_checked_ok = now
304
gobject.source_remove(self.stop_initiator_tag)
305
self.stop_initiator_tag = gobject.timeout_add\
306
(self._timeout_milliseconds,
322
self.CheckerCompleted(True)
308
324
elif not os.WIFEXITED(condition):
309
325
logger.warning(u"Checker for %(name)s crashed?",
328
self.CheckerCompleted(False)
312
330
logger.info(u"Checker for %(name)s failed",
333
self.CheckerCompleted(False)
335
def bump_timeout(self):
336
"""Bump up the timeout for this client.
337
This should only be called when the client has been seen,
340
self.last_checked_ok = datetime.datetime.utcnow()
341
gobject.source_remove(self.stop_initiator_tag)
342
self.stop_initiator_tag = (gobject.timeout_add
343
(self._timeout_milliseconds,
314
346
def start_checker(self):
315
347
"""Start a new checker subprocess if one is not running.
316
348
If a checker already exists, leave it running and do
373
408
if error.errno != errno.ESRCH: # No such process
375
410
self.checker = None
376
412
def still_valid(self):
377
413
"""Has the timeout not yet passed for this client?"""
378
now = datetime.datetime.now()
416
now = datetime.datetime.utcnow()
379
417
if self.last_checked_ok is None:
380
418
return now < (self.created + self.timeout)
382
420
return now < (self.last_checked_ok + self.timeout)
422
## D-Bus methods & signals
423
_interface = u"org.mandos_system.Mandos.Client"
425
def _datetime_to_dbus_struct(dt):
426
return dbus.Struct(dt.year, dt.month, dt.day, dt.hour,
427
dt.minute, dt.second, dt.microsecond,
430
# BumpTimeout - method
431
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
432
BumpTimeout.__name__ = "BumpTimeout"
434
# IntervalChanged - signal
435
@dbus.service.signal(_interface, signature="t")
436
def IntervalChanged(self, t):
440
# CheckerCompleted - signal
441
@dbus.service.signal(_interface, signature="b")
442
def CheckerCompleted(self, success):
446
# CheckerIsRunning - method
447
@dbus.service.method(_interface, out_signature="b")
448
def CheckerIsRunning(self):
449
"D-Bus getter method"
450
return self.checker is not None
452
# CheckerStarted - signal
453
@dbus.service.signal(_interface, signature="s")
454
def CheckerStarted(self, command):
458
# GetChecker - method
459
@dbus.service.method(_interface, out_signature="s")
460
def GetChecker(self):
461
"D-Bus getter method"
462
return self.checker_command
464
# GetCreated - method
465
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
466
def GetCreated(self):
467
"D-Bus getter method"
468
return datetime_to_dbus_struct(self.created)
470
# GetFingerprint - method
471
@dbus.service.method(_interface, out_signature="s")
472
def GetFingerprint(self):
473
"D-Bus getter method"
474
return self.fingerprint
477
@dbus.service.method(_interface, out_signature="s")
479
"D-Bus getter method"
482
# GetInterval - method
483
@dbus.service.method(_interface, out_signature="t")
484
def GetInterval(self):
485
"D-Bus getter method"
486
return self._interval_milliseconds
489
@dbus.service.method(_interface, out_signature="s")
491
"D-Bus getter method"
494
# GetStarted - method
495
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
496
def GetStarted(self):
497
"D-Bus getter method"
498
if self.started is not None:
499
return datetime_to_dbus_struct(self.started)
501
return dbus.Struct(0, 0, 0, 0, 0, 0, 0,
504
# GetTimeout - method
505
@dbus.service.method(_interface, out_signature="t")
506
def GetTimeout(self):
507
"D-Bus getter method"
508
return self._timeout_milliseconds
510
# SetChecker - method
511
@dbus.service.method(_interface, in_signature="s")
512
def SetChecker(self, checker):
513
"D-Bus setter method"
514
self.checker_command = checker
517
@dbus.service.method(_interface, in_signature="s")
518
def SetHost(self, host):
519
"D-Bus setter method"
522
# SetInterval - method
523
@dbus.service.method(_interface, in_signature="t")
524
def SetInterval(self, milliseconds):
525
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
527
# SetTimeout - method
528
@dbus.service.method(_interface, in_signature="t")
529
def SetTimeout(self, milliseconds):
530
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
533
@dbus.service.method(_interface, in_signature="ay",
535
def SetSecret(self, secret):
536
"D-Bus setter method"
537
self.secret = str(secret)
540
Start = dbus.service.method(_interface)(start)
541
Start.__name__ = "Start"
543
# StartChecker - method
544
StartChecker = dbus.service.method(_interface)(start_checker)
545
StartChecker.__name__ = "StartChecker"
547
# StateChanged - signal
548
@dbus.service.signal(_interface, signature="b")
549
def StateChanged(self, started):
553
# StillValid - method
554
StillValid = (dbus.service.method(_interface, out_signature="b")
556
StillValid.__name__ = "StillValid"
559
Stop = dbus.service.method(_interface)(stop)
560
Stop.__name__ = "Stop"
562
# StopChecker - method
563
StopChecker = dbus.service.method(_interface)(stop_checker)
564
StopChecker.__name__ = "StopChecker"
566
# TimeoutChanged - signal
567
@dbus.service.signal(_interface, signature="t")
568
def TimeoutChanged(self, t):
572
del _datetime_to_dbus_struct
385
576
def peer_certificate(session):
386
577
"Return the peer's OpenPGP certificate as a bytestring"
387
578
# If not an OpenPGP certificate...
388
if gnutls.library.functions.gnutls_certificate_type_get\
389
(session._c_object) \
390
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
579
if (gnutls.library.functions
580
.gnutls_certificate_type_get(session._c_object)
581
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
391
582
# ...do the normal thing
392
583
return session.peer_certificate
393
584
list_size = ctypes.c_uint()
394
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
(session._c_object, ctypes.byref(list_size))
585
cert_list = (gnutls.library.functions
586
.gnutls_certificate_get_peers
587
(session._c_object, ctypes.byref(list_size)))
396
588
if list_size.value == 0:
398
590
cert = cert_list[0]
402
594
def fingerprint(openpgp):
403
595
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
404
596
# New GnuTLS "datum" with the OpenPGP public key
405
datum = gnutls.library.types.gnutls_datum_t\
406
(ctypes.cast(ctypes.c_char_p(openpgp),
407
ctypes.POINTER(ctypes.c_ubyte)),
408
ctypes.c_uint(len(openpgp)))
597
datum = (gnutls.library.types
598
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
601
ctypes.c_uint(len(openpgp))))
409
602
# New empty GnuTLS certificate
410
603
crt = gnutls.library.types.gnutls_openpgp_crt_t()
411
gnutls.library.functions.gnutls_openpgp_crt_init\
604
(gnutls.library.functions
605
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
413
606
# Import the OpenPGP public key into the certificate
414
gnutls.library.functions.gnutls_openpgp_crt_import\
415
(crt, ctypes.byref(datum),
416
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
607
(gnutls.library.functions
608
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
609
gnutls.library.constants
610
.GNUTLS_OPENPGP_FMT_RAW))
417
611
# Verify the self signature in the key
418
crtverify = ctypes.c_uint();
419
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
(crt, 0, ctypes.byref(crtverify))
612
crtverify = ctypes.c_uint()
613
(gnutls.library.functions
614
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
421
615
if crtverify.value != 0:
422
616
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
423
617
raise gnutls.errors.CertificateSecurityError("Verify failed")
424
618
# New buffer for the fingerprint
425
buffer = ctypes.create_string_buffer(20)
426
buffer_length = ctypes.c_size_t()
619
buf = ctypes.create_string_buffer(20)
620
buf_len = ctypes.c_size_t()
427
621
# Get the fingerprint from the certificate into the buffer
428
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
624
ctypes.byref(buf_len)))
430
625
# Deinit the certificate
431
626
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
432
627
# Convert the buffer to a Python bytestring
433
fpr = ctypes.string_at(buffer, buffer_length.value)
628
fpr = ctypes.string_at(buf, buf_len.value)
434
629
# Convert the bytestring to hexadecimal notation
435
630
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
634
class TCP_handler(SocketServer.BaseRequestHandler, object):
440
635
"""A TCP request handler class.
441
636
Instantiated by IPv6_TCPServer for each request to handle it.
442
637
Note: This will run in its own forked process."""
444
639
def handle(self):
445
640
logger.info(u"TCP connection from: %s",
446
unicode(self.client_address))
447
session = gnutls.connection.ClientSession\
448
(self.request, gnutls.connection.X509Credentials())
641
unicode(self.client_address))
642
session = (gnutls.connection
643
.ClientSession(self.request,
450
647
line = self.request.makefile().readline()
451
648
logger.debug(u"Protocol version: %r", line)