/mandos/trunk : revision 24.1.113

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

35

36

import SocketServer

37

import socket

38

import optparse

38

from optparse import OptionParser

39

import datetime

40

import errno

41

import gnutls.crypto

66

import ctypes

67

import ctypes.util

68

69

version = "1.0.5"

69

version = "1.0.2"

70

71

logger = logging.Logger('mandos')

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos [%(process)d]: %(levelname)s:'

77

' %(message)s'))

76

('Mandos: %(levelname)s: %(message)s'))

78

77

logger.addHandler(syslogger)

79

78

80

79

console = logging.StreamHandler()

81

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

82

' %(levelname)s: %(message)s'))

80

console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'

81

' %(message)s'))

83

82

logger.addHandler(console)

84

83

85

84

class AvahiError(Exception):

86

def __init__(self, value, *args, **kwargs):

85

def __init__(self, value):

87

86

self.value = value

88

super(AvahiError, self).__init__(value, *args, **kwargs)

89

def __unicode__(self):

90

return unicode(repr(self.value))

87

super(AvahiError, self).__init__()

88

def __str__(self):

89

return repr(self.value)

91

90

92

91

class AvahiServiceError(AvahiError):

93

92

pass

130

129

logger.critical(u"No suitable Zeroconf service name found"

131

130

u" after %i retries, exiting.",

132

131

self.rename_count)

133

raise AvahiServiceError(u"Too many renames")

132

raise AvahiServiceError("Too many renames")

134

133

self.name = server.GetAlternativeServiceName(self.name)

135

134

logger.info(u"Changing Zeroconf service name to %r ...",

136

135

str(self.name))

171

170

# End of Avahi example code

172

171

173

172

174

def _datetime_to_dbus(dt, variant_level=0):

175

"""Convert a UTC datetime.datetime() to a D-Bus type."""

176

return dbus.String(dt.isoformat(), variant_level=variant_level)

177

178

179

173

class Client(dbus.service.Object):

180

174

"""A representation of a client host served by this server.

181

175

Attributes:

182

name: string; from the config file, used in log messages and

183

D-Bus identifiers

176

name: string; from the config file, used in log messages

184

177

fingerprint: string (40 or 32 hexadecimal digits); used to

185

178

uniquely identify the client

186

secret: bytestring; sent verbatim (over TLS) to client

187

host: string; available for use by the checker command

188

created: datetime.datetime(); (UTC) object creation

189

last_enabled: datetime.datetime(); (UTC)

190

enabled: bool()

179

secret: bytestring; sent verbatim (over TLS) to client

180

host: string; available for use by the checker command

181

created: datetime.datetime(); (UTC) object creation

182

started: datetime.datetime(); (UTC) last started

191

183

last_checked_ok: datetime.datetime(); (UTC) or None

192

timeout: datetime.timedelta(); How long from last_checked_ok

193

until this client is invalid

194

interval: datetime.timedelta(); How often to start a new checker

195

disable_hook: If set, called by disable() as disable_hook(self)

196

checker: subprocess.Popen(); a running checker process used

197

to see if the client lives.

198

'None' if no process is running.

184

timeout: datetime.timedelta(); How long from last_checked_ok

185

until this client is invalid

186

interval: datetime.timedelta(); How often to start a new checker

187

stop_hook: If set, called by stop() as stop_hook(self)

188

checker: subprocess.Popen(); a running checker process used

189

to see if the client lives.

190

'None' if no process is running.

199

191

checker_initiator_tag: a gobject event source tag, or None

200

disable_initiator_tag: - '' -

192

stop_initiator_tag: - '' -

201

193

checker_callback_tag: - '' -

202

194

checker_command: string; External command which is run to check if

203

195

client lives. %() expansions are done at

204

196

runtime with vars(self) as dict, so that for

205

197

instance %(name)s can be used in the command.

206

use_dbus: bool(); Whether to provide D-Bus interface and signals

207

dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus

198

Private attibutes:

199

_timeout: Real variable for 'timeout'

200

_interval: Real variable for 'interval'

201

_timeout_milliseconds: Used when calling gobject.timeout_add()

202

_interval_milliseconds: - '' -

208

203

"""

209

def timeout_milliseconds(self):

210

"Return the 'timeout' attribute in milliseconds"

211

return ((self.timeout.days * 24 * 60 * 60 * 1000)

212

+ (self.timeout.seconds * 1000)

213

+ (self.timeout.microseconds // 1000))

214

215

def interval_milliseconds(self):

216

"Return the 'interval' attribute in milliseconds"

217

return ((self.interval.days * 24 * 60 * 60 * 1000)

218

+ (self.interval.seconds * 1000)

219

+ (self.interval.microseconds // 1000))

220

221

def __init__(self, name = None, disable_hook=None, config=None,

222

use_dbus=True):

204

def _set_timeout(self, timeout):

205

"Setter function for the 'timeout' attribute"

206

self._timeout = timeout

207

self._timeout_milliseconds = ((self.timeout.days

208

* 24 * 60 * 60 * 1000)

209

+ (self.timeout.seconds * 1000)

210

+ (self.timeout.microseconds

211

// 1000))

212

# Emit D-Bus signal

213

self.TimeoutChanged(self._timeout_milliseconds)

214

timeout = property(lambda self: self._timeout, _set_timeout)

215

del _set_timeout

216

217

def _set_interval(self, interval):

218

"Setter function for the 'interval' attribute"

219

self._interval = interval

220

self._interval_milliseconds = ((self.interval.days

221

* 24 * 60 * 60 * 1000)

222

+ (self.interval.seconds

223

* 1000)

224

+ (self.interval.microseconds

225

// 1000))

226

# Emit D-Bus signal

227

self.IntervalChanged(self._interval_milliseconds)

228

interval = property(lambda self: self._interval, _set_interval)

229

del _set_interval

230

231

def __init__(self, name = None, stop_hook=None, config=None):

223

232

"""Note: the 'checker' key in 'config' sets the

224

233

'checker_command' attribute and *not* the 'checker'

225

234

attribute."""

226

self.name = name

235

dbus.service.Object.__init__(self, bus,

236

"/Mandos/clients/%s"

237

% name.replace(".", "_"))

227

238

if config is None:

228

239

config = {}

240

self.name = name

229

241

logger.debug(u"Creating client %r", self.name)

230

self.use_dbus = False # During __init__

231

242

# Uppercase and remove spaces from fingerprint for later

232

243

# comparison purposes with return value from the fingerprint()

233

244

# function

246

257

% self.name)

247

258

self.host = config.get("host", "")

248

259

self.created = datetime.datetime.utcnow()

249

self.enabled = False

250

self.last_enabled = None

260

self.started = None

251

261

self.last_checked_ok = None

252

262

self.timeout = string_to_delta(config["timeout"])

253

263

self.interval = string_to_delta(config["interval"])

254

self.disable_hook = disable_hook

264

self.stop_hook = stop_hook

255

265

self.checker = None

256

266

self.checker_initiator_tag = None

257

self.disable_initiator_tag = None

267

self.stop_initiator_tag = None

258

268

self.checker_callback_tag = None

259

self.checker_command = config["checker"]

260

self.last_connect = None

261

# Only now, when this client is initialized, can it show up on

262

# the D-Bus

263

self.use_dbus = use_dbus

264

if self.use_dbus:

265

self.dbus_object_path = (dbus.ObjectPath

266

("/clients/"

267

+ self.name.replace(".", "_")))

268

dbus.service.Object.__init__(self, bus,

269

self.dbus_object_path)

269

self.check_command = config["checker"]

270

271

def enable(self):

271

def start(self):

272

"""Start this client's checker and timeout hooks"""

273

self.last_enabled = datetime.datetime.utcnow()

273

self.started = datetime.datetime.utcnow()

274

# Schedule a new checker to be started an 'interval' from now,

275

# and every interval from then on.

276

self.checker_initiator_tag = (gobject.timeout_add

277

(self.interval_milliseconds(),

277

(self._interval_milliseconds,

278

self.start_checker))

279

# Also start a new checker *right now*.

280

self.start_checker()

281

# Schedule a disable() when 'timeout' has passed

282

self.disable_initiator_tag = (gobject.timeout_add

283

(self.timeout_milliseconds(),

284

self.disable))

285

self.enabled = True

286

if self.use_dbus:

287

# Emit D-Bus signals

288

self.PropertyChanged(dbus.String(u"enabled"),

289

dbus.Boolean(True, variant_level=1))

290

self.PropertyChanged(dbus.String(u"last_enabled"),

291

(_datetime_to_dbus(self.last_enabled,

292

variant_level=1)))

281

# Schedule a stop() when 'timeout' has passed

282

self.stop_initiator_tag = (gobject.timeout_add

283

(self._timeout_milliseconds,

284

self.stop))

285

# Emit D-Bus signal

286

self.StateChanged(True)

293

287

294

def disable(self):

295

"""Disable this client."""

296

if not getattr(self, "enabled", False):

288

def stop(self):

289

"""Stop this client."""

290

if getattr(self, "started", None) is not None:

291

logger.info(u"Stopping client %s", self.name)

292

else:

297

293

return False

298

logger.info(u"Disabling client %s", self.name)

299

if getattr(self, "disable_initiator_tag", False):

300

gobject.source_remove(self.disable_initiator_tag)

301

self.disable_initiator_tag = None

294

if getattr(self, "stop_initiator_tag", False):

295

gobject.source_remove(self.stop_initiator_tag)

296

self.stop_initiator_tag = None

302

297

if getattr(self, "checker_initiator_tag", False):

303

298

gobject.source_remove(self.checker_initiator_tag)

304

299

self.checker_initiator_tag = None

305

300

self.stop_checker()

306

if self.disable_hook:

307

self.disable_hook(self)

308

self.enabled = False

309

if self.use_dbus:

310

# Emit D-Bus signal

311

self.PropertyChanged(dbus.String(u"enabled"),

312

dbus.Boolean(False, variant_level=1))

301

if self.stop_hook:

302

self.stop_hook(self)

303

self.started = None

304

# Emit D-Bus signal

305

self.StateChanged(False)

313

306

# Do not run this again if called by a gobject.timeout_add

314

307

return False

315

308

316

309

def __del__(self):

317

self.disable_hook = None

318

self.disable()

310

self.stop_hook = None

311

self.stop()

319

312

320

def checker_callback(self, pid, condition, command):

313

def checker_callback(self, pid, condition):

321

314

"""The checker has completed, so take appropriate actions."""

322

315

self.checker_callback_tag = None

323

316

self.checker = None

324

if self.use_dbus:

317

if (os.WIFEXITED(condition)

318

and (os.WEXITSTATUS(condition) == 0)):

319

logger.info(u"Checker for %(name)s succeeded",

320

vars(self))

325

321

# Emit D-Bus signal

326

self.PropertyChanged(dbus.String(u"checker_running"),

327

dbus.Boolean(False, variant_level=1))

328

if os.WIFEXITED(condition):

329

exitstatus = os.WEXITSTATUS(condition)

330

if exitstatus == 0:

331

logger.info(u"Checker for %(name)s succeeded",

332

vars(self))

333

self.checked_ok()

334

else:

335

logger.info(u"Checker for %(name)s failed",

336

vars(self))

337

if self.use_dbus:

338

# Emit D-Bus signal

339

self.CheckerCompleted(dbus.Int16(exitstatus),

340

dbus.Int64(condition),

341

dbus.String(command))

342

else:

322

self.CheckerCompleted(True)

323

self.bump_timeout()

324

elif not os.WIFEXITED(condition):

343

325

logger.warning(u"Checker for %(name)s crashed?",

344

326

vars(self))

345

if self.use_dbus:

346

# Emit D-Bus signal

347

self.CheckerCompleted(dbus.Int16(-1),

348

dbus.Int64(condition),

349

dbus.String(command))

327

# Emit D-Bus signal

328

self.CheckerCompleted(False)

329

else:

330

logger.info(u"Checker for %(name)s failed",

331

vars(self))

332

# Emit D-Bus signal

333

self.CheckerCompleted(False)

350

334

351

def checked_ok(self):

335

def bump_timeout(self):

352

336

"""Bump up the timeout for this client.

353

337

This should only be called when the client has been seen,

354

338

alive and well.

355

339

"""

356

340

self.last_checked_ok = datetime.datetime.utcnow()

357

gobject.source_remove(self.disable_initiator_tag)

358

self.disable_initiator_tag = (gobject.timeout_add

359

(self.timeout_milliseconds(),

360

self.disable))

361

if self.use_dbus:

362

# Emit D-Bus signal

363

self.PropertyChanged(

364

dbus.String(u"last_checked_ok"),

365

(_datetime_to_dbus(self.last_checked_ok,

366

variant_level=1)))

341

gobject.source_remove(self.stop_initiator_tag)

342

self.stop_initiator_tag = (gobject.timeout_add

343

(self._timeout_milliseconds,

344

self.stop))

367

345

368

346

def start_checker(self):

369

347

"""Start a new checker subprocess if one is not running.

379

357

# is as it should be.

380

358

if self.checker is None:

381

359

try:

382

# In case checker_command has exactly one % operator

383

command = self.checker_command % self.host

360

# In case check_command has exactly one % operator

361

command = self.check_command % self.host

384

362

except TypeError:

385

363

# Escape attributes for the shell

386

364

escaped_attrs = dict((key, re.escape(str(val)))

387

365

for key, val in

388

366

vars(self).iteritems())

389

367

try:

390

command = self.checker_command % escaped_attrs

368

command = self.check_command % escaped_attrs

391

369

except TypeError, error:

392

370

logger.error(u'Could not format string "%s":'

393

u' %s', self.checker_command, error)

371

u' %s', self.check_command, error)

394

372

return True # Try again later

395

373

try:

396

374

logger.info(u"Starting checker %r for %s",

402

380

self.checker = subprocess.Popen(command,

403

381

close_fds=True,

404

382

shell=True, cwd="/")

405

if self.use_dbus:

406

# Emit D-Bus signal

407

self.CheckerStarted(command)

408

self.PropertyChanged(

409

dbus.String("checker_running"),

410

dbus.Boolean(True, variant_level=1))

411

383

self.checker_callback_tag = (gobject.child_watch_add

412

384

(self.checker.pid,

413

self.checker_callback,

414

data=command))

385

self.checker_callback))

386

# Emit D-Bus signal

387

self.CheckerStarted(command)

415

388

except OSError, error:

416

389

logger.error(u"Failed to start subprocess: %s",

417

390

error)

435

408

if error.errno != errno.ESRCH: # No such process

436

409

raise

437

410

self.checker = None

438

if self.use_dbus:

439

self.PropertyChanged(dbus.String(u"checker_running"),

440

dbus.Boolean(False, variant_level=1))

441

411

442

412

def still_valid(self):

443

413

"""Has the timeout not yet passed for this client?"""

444

if not getattr(self, "enabled", False):

414

if not self.started:

445

415

return False

446

416

now = datetime.datetime.utcnow()

447

417

if self.last_checked_ok is None:

450

420

return now < (self.last_checked_ok + self.timeout)

451

421

452

422

## D-Bus methods & signals

453

_interface = u"se.bsnet.fukt.Mandos.Client"

454

455

# CheckedOK - method

456

CheckedOK = dbus.service.method(_interface)(checked_ok)

457

CheckedOK.__name__ = "CheckedOK"

423

_interface = u"org.mandos_system.Mandos.Client"

424

425

def _datetime_to_dbus_struct(dt):

426

return dbus.Struct(dt.year, dt.month, dt.day, dt.hour,

427

dt.minute, dt.second, dt.microsecond,

428

signature="nyyyyyu")

429

430

# BumpTimeout - method

431

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

432

BumpTimeout.__name__ = "BumpTimeout"

433

434

# IntervalChanged - signal

435

@dbus.service.signal(_interface, signature="t")

436

def IntervalChanged(self, t):

437

"D-Bus signal"

438

pass

458

439

459

440

# CheckerCompleted - signal

460

@dbus.service.signal(_interface, signature="nxs")

461

def CheckerCompleted(self, exitcode, waitstatus, command):

441

@dbus.service.signal(_interface, signature="b")

442

def CheckerCompleted(self, success):

462

443

"D-Bus signal"

463

444

pass

464

445

446

# CheckerIsRunning - method

447

@dbus.service.method(_interface, out_signature="b")

448

def CheckerIsRunning(self):

449

"D-Bus getter method"

450

return self.checker is not None

451

465

452

# CheckerStarted - signal

466

453

@dbus.service.signal(_interface, signature="s")

467

454

def CheckerStarted(self, command):

468

455

"D-Bus signal"

469

456

pass

470

457

471

# GetAllProperties - method

472

@dbus.service.method(_interface, out_signature="a{sv}")

473

def GetAllProperties(self):

474

"D-Bus method"

475

return dbus.Dictionary({

476

dbus.String("name"):

477

dbus.String(self.name, variant_level=1),

478

dbus.String("fingerprint"):

479

dbus.String(self.fingerprint, variant_level=1),

480

dbus.String("host"):

481

dbus.String(self.host, variant_level=1),

482

dbus.String("created"):

483

_datetime_to_dbus(self.created, variant_level=1),

484

dbus.String("last_enabled"):

485

(_datetime_to_dbus(self.last_enabled,

486

variant_level=1)

487

if self.last_enabled is not None

488

else dbus.Boolean(False, variant_level=1)),

489

dbus.String("enabled"):

490

dbus.Boolean(self.enabled, variant_level=1),

491

dbus.String("last_checked_ok"):

492

(_datetime_to_dbus(self.last_checked_ok,

493

variant_level=1)

494

if self.last_checked_ok is not None

495

else dbus.Boolean (False, variant_level=1)),

496

dbus.String("timeout"):

497

dbus.UInt64(self.timeout_milliseconds(),

498

variant_level=1),

499

dbus.String("interval"):

500

dbus.UInt64(self.interval_milliseconds(),

501

variant_level=1),

502

dbus.String("checker"):

503

dbus.String(self.checker_command,

504

variant_level=1),

505

dbus.String("checker_running"):

506

dbus.Boolean(self.checker is not None,

507

variant_level=1),

508

dbus.String("object_path"):

509

dbus.ObjectPath(self.dbus_object_path,

510

variant_level=1)

511

}, signature="sv")

512

513

# IsStillValid - method

514

IsStillValid = (dbus.service.method(_interface, out_signature="b")

515

(still_valid))

516

IsStillValid.__name__ = "IsStillValid"

517

518

# PropertyChanged - signal

519

@dbus.service.signal(_interface, signature="sv")

520

def PropertyChanged(self, property, value):

521

"D-Bus signal"

522

pass

458

# GetChecker - method

459

@dbus.service.method(_interface, out_signature="s")

460

def GetChecker(self):

461

"D-Bus getter method"

462

return self.checker_command

463

464

# GetCreated - method

465

@dbus.service.method(_interface, out_signature="(nyyyyyu)")

466

def GetCreated(self):

467

"D-Bus getter method"

468

return datetime_to_dbus_struct(self.created)

469

470

# GetFingerprint - method

471

@dbus.service.method(_interface, out_signature="s")

472

def GetFingerprint(self):

473

"D-Bus getter method"

474

return self.fingerprint

475

476

# GetHost - method

477

@dbus.service.method(_interface, out_signature="s")

478

def GetHost(self):

479

"D-Bus getter method"

480

return self.host

481

482

# GetInterval - method

483

@dbus.service.method(_interface, out_signature="t")

484

def GetInterval(self):

485

"D-Bus getter method"

486

return self._interval_milliseconds

487

488

# GetName - method

489

@dbus.service.method(_interface, out_signature="s")

490

def GetName(self):

491

"D-Bus getter method"

492

return self.name

493

494

# GetStarted - method

495

@dbus.service.method(_interface, out_signature="(nyyyyyu)")

496

def GetStarted(self):

497

"D-Bus getter method"

498

if self.started is not None:

499

return datetime_to_dbus_struct(self.started)

500

else:

501

return dbus.Struct(0, 0, 0, 0, 0, 0, 0,

502

signature="nyyyyyu")

503

504

# GetTimeout - method

505

@dbus.service.method(_interface, out_signature="t")

506

def GetTimeout(self):

507

"D-Bus getter method"

508

return self._timeout_milliseconds

523

509

524

510

# SetChecker - method

525

511

@dbus.service.method(_interface, in_signature="s")

526

512

def SetChecker(self, checker):

527

513

"D-Bus setter method"

528

514

self.checker_command = checker

529

# Emit D-Bus signal

530

self.PropertyChanged(dbus.String(u"checker"),

531

dbus.String(self.checker_command,

532

variant_level=1))

533

515

534

516

# SetHost - method

535

517

@dbus.service.method(_interface, in_signature="s")

536

518

def SetHost(self, host):

537

519

"D-Bus setter method"

538

520

self.host = host

539

# Emit D-Bus signal

540

self.PropertyChanged(dbus.String(u"host"),

541

dbus.String(self.host, variant_level=1))

542

521

543

522

# SetInterval - method

544

523

@dbus.service.method(_interface, in_signature="t")

545

524

def SetInterval(self, milliseconds):

546

self.interval = datetime.timedelta(0, 0, 0, milliseconds)

547

# Emit D-Bus signal

548

self.PropertyChanged(dbus.String(u"interval"),

549

(dbus.UInt64(self.interval_milliseconds(),

550

variant_level=1)))

525

self.interval = datetime.timdeelta(0, 0, 0, milliseconds)

526

527

# SetTimeout - method

528

@dbus.service.method(_interface, in_signature="t")

529

def SetTimeout(self, milliseconds):

530

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

551

531

552

532

# SetSecret - method

553

533

@dbus.service.method(_interface, in_signature="ay",

556

536

"D-Bus setter method"

557

537

self.secret = str(secret)

558

538

559

# SetTimeout - method

560

@dbus.service.method(_interface, in_signature="t")

561

def SetTimeout(self, milliseconds):

562

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

563

# Emit D-Bus signal

564

self.PropertyChanged(dbus.String(u"timeout"),

565

(dbus.UInt64(self.timeout_milliseconds(),

566

variant_level=1)))

567

568

# Enable - method

569

Enable = dbus.service.method(_interface)(enable)

570

Enable.__name__ = "Enable"

539

# Start - method

540

Start = dbus.service.method(_interface)(start)

541

Start.__name__ = "Start"

571

542

572

543

# StartChecker - method

573

@dbus.service.method(_interface)

574

def StartChecker(self):

575

"D-Bus method"

576

self.start_checker()

577

578

# Disable - method

579

@dbus.service.method(_interface)

580

def Disable(self):

581

"D-Bus method"

582

self.disable()

544

StartChecker = dbus.service.method(_interface)(start_checker)

545

StartChecker.__name__ = "StartChecker"

546

547

# StateChanged - signal

548

@dbus.service.signal(_interface, signature="b")

549

def StateChanged(self, started):

550

"D-Bus signal"

551

pass

552

553

# StillValid - method

554

StillValid = (dbus.service.method(_interface, out_signature="b")

555

(still_valid))

556

StillValid.__name__ = "StillValid"

557

558

# Stop - method

559

Stop = dbus.service.method(_interface)(stop)

560

Stop.__name__ = "Stop"

583

561

584

562

# StopChecker - method

585

563

StopChecker = dbus.service.method(_interface)(stop_checker)

586

564

StopChecker.__name__ = "StopChecker"

587

565

566

# TimeoutChanged - signal

567

@dbus.service.signal(_interface, signature="t")

568

def TimeoutChanged(self, t):

569

"D-Bus signal"

570

pass

571

572

del _datetime_to_dbus_struct

588

573

del _interface

589

574

590

575

596

581

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

597

582

# ...do the normal thing

598

583

return session.peer_certificate

599

list_size = ctypes.c_uint(1)

584

list_size = ctypes.c_uint()

600

585

cert_list = (gnutls.library.functions

601

586

.gnutls_certificate_get_peers

602

587

(session._c_object, ctypes.byref(list_size)))

603

if not bool(cert_list) and list_size.value != 0:

604

raise gnutls.errors.GNUTLSError("error getting peer"

605

" certificate")

606

588

if list_size.value == 0:

607

589

return None

608

590

cert = cert_list[0]

677

659

# using OpenPGP certificates.

678

660

679

661

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

680

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

681

# "+DHE-DSS"))

662

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

663

# "+DHE-DSS"))

682

664

# Use a fallback default, since this MUST be set.

683

665

priority = self.server.settings.get("priority", "NORMAL")

684

666

(gnutls.library.functions

692

674

# Do not run session.bye() here: the session is not

693

675

# established. Just abandon the request.

694

676

return

695

logger.debug(u"Handshake succeeded")

696

677

try:

697

678

fpr = fingerprint(peer_certificate(session))

698

679

except (TypeError, gnutls.errors.GNUTLSError), error:

700

681

session.bye()

701

682

return

702

683

logger.debug(u"Fingerprint: %s", fpr)

703

704

684

for c in self.server.clients:

705

685

if c.fingerprint == fpr:

706

686

client = c

719

699

session.bye()

720

700

return

721

701

## This won't work here, since we're in a fork.

722

# client.checked_ok()

702

# client.bump_timeout()

723

703

sent_size = 0

724

704

while sent_size < len(client.secret):

725

705

sent = session.send(client.secret[sent_size:])

765

745

u" bind to interface %s",

766

746

self.settings["interface"])

767

747

else:

768

raise

748

raise error

769

749

# Only bind(2) the socket if we really need to.

770

750

if self.server_address[0] or self.server_address[1]:

771

751

if not self.server_address[0]:

792

772

793

773

def string_to_delta(interval):

794

774

"""Parse a string and return a datetime.timedelta

795

775

796

776

>>> string_to_delta('7d')

797

777

datetime.timedelta(7)

798

778

>>> string_to_delta('60s')

850

830

elif state == avahi.ENTRY_GROUP_FAILURE:

851

831

logger.critical(u"Avahi: Error in group state changed %s",

852

832

unicode(error))

853

raise AvahiGroupError(u"State changed: %s" % unicode(error))

833

raise AvahiGroupError("State changed: %s", str(error))

854

834

855

835

def if_nametoindex(interface):

856

836

"""Call the C function if_nametoindex(), or equivalent"""

899

879

900

880

901

881

def main():

902

parser = optparse.OptionParser(version = "%%prog %s" % version)

882

parser = OptionParser(version = "%%prog %s" % version)

903

883

parser.add_option("-i", "--interface", type="string",

904

884

metavar="IF", help="Bind to interface IF")

905

885

parser.add_option("-a", "--address", type="string",

906

886

help="Address to listen for requests on")

907

887

parser.add_option("-p", "--port", type="int",

908

888

help="Port number to receive requests on")

909

parser.add_option("--check", action="store_true",

889

parser.add_option("--check", action="store_true", default=False,

910

890

help="Run self-test")

911

891

parser.add_option("--debug", action="store_true",

912

892

help="Debug mode; run in foreground and log to"

919

899

default="/etc/mandos", metavar="DIR",

920

900

help="Directory to search for configuration"

921

901

" files")

922

parser.add_option("--no-dbus", action="store_false",

923

dest="use_dbus",

924

help="Do not provide D-Bus system bus"

925

" interface")

926

902

options = parser.parse_args()[0]

927

903

928

904

if options.check:

938

914

"priority":

939

915

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

940

916

"servicename": "Mandos",

941

"use_dbus": "True",

942

917

}

943

918

944

919

# Parse config file for server-global settings

947

922

server_config.read(os.path.join(options.configdir, "mandos.conf"))

948

923

# Convert the SafeConfigParser object to a dict

949

924

server_settings = server_config.defaults()

950

# Use the appropriate methods on the non-string config options

951

server_settings["debug"] = server_config.getboolean("DEFAULT",

952

"debug")

953

server_settings["use_dbus"] = server_config.getboolean("DEFAULT",

954

"use_dbus")

955

if server_settings["port"]:

956

server_settings["port"] = server_config.getint("DEFAULT",

957

"port")

925

# Use getboolean on the boolean config option

926

server_settings["debug"] = (server_config.getboolean

927

("DEFAULT", "debug"))

958

928

del server_config

959

929

960

930

# Override the settings from the config file with command line

961

931

# options, if set.

962

932

for option in ("interface", "address", "port", "debug",

963

"priority", "servicename", "configdir",

964

"use_dbus"):

933

"priority", "servicename", "configdir"):

965

934

value = getattr(options, option)

966

935

if value is not None:

967

936

server_settings[option] = value

968

937

del options

969

938

# Now we have our good server settings in "server_settings"

970

939

971

# For convenience

972

940

debug = server_settings["debug"]

973

use_dbus = server_settings["use_dbus"]

974

941

975

942

if not debug:

976

943

syslogger.setLevel(logging.WARNING)

985

952

# Parse config file with clients

986

953

client_defaults = { "timeout": "1h",

987

954

"interval": "5m",

988

"checker": "fping -q -- %%(host)s",

955

"checker": "fping -q -- %(host)s",

989

956

"host": "",

990

957

}

991

958

client_config = ConfigParser.SafeConfigParser(client_defaults)

1001

968

pidfilename = "/var/run/mandos.pid"

1002

969

try:

1003

970

pidfile = open(pidfilename, "w")

1004

except IOError:

971

except IOError, error:

1005

972

logger.error("Could not open file %r", pidfilename)

1006

973

1007

try:

1008

uid = pwd.getpwnam("_mandos").pw_uid

1009

gid = pwd.getpwnam("_mandos").pw_gid

1010

except KeyError:

1011

try:

1012

uid = pwd.getpwnam("mandos").pw_uid

1013

gid = pwd.getpwnam("mandos").pw_gid

1014

except KeyError:

1015

try:

1016

uid = pwd.getpwnam("nobody").pw_uid

1017

gid = pwd.getpwnam("nogroup").pw_gid

1018

except KeyError:

1019

uid = 65534

1020

gid = 65534

1021

try:

974

uid = 65534

975

gid = 65534

976

try:

977

uid = pwd.getpwnam("mandos").pw_uid

978

except KeyError:

979

try:

980

uid = pwd.getpwnam("nobody").pw_uid

981

except KeyError:

982

pass

983

try:

984

gid = pwd.getpwnam("mandos").pw_gid

985

except KeyError:

986

try:

987

gid = pwd.getpwnam("nogroup").pw_gid

988

except KeyError:

989

pass

990

try:

991

os.setuid(uid)

1022

992

os.setgid(gid)

1023

os.setuid(uid)

1024

993

except OSError, error:

1025

994

if error[0] != errno.EPERM:

1026

995

raise error

1027

996

1028

# Enable all possible GnuTLS debugging

1029

if debug:

1030

# "Use a log level over 10 to enable all debugging options."

1031

# - GnuTLS manual

1032

gnutls.library.functions.gnutls_global_set_log_level(11)

1033

1034

@gnutls.library.types.gnutls_log_func

1035

def debug_gnutls(level, string):

1036

logger.debug("GnuTLS: %s", string[:-1])

1037

1038

(gnutls.library.functions

1039

.gnutls_global_set_log_function(debug_gnutls))

1040

1041

997

global service

1042

998

service = AvahiService(name = server_settings["servicename"],

1043

999

servicetype = "_mandos._tcp", )

1056

1012

avahi.DBUS_PATH_SERVER),

1057

1013

avahi.DBUS_INTERFACE_SERVER)

1058

1014

# End of Avahi example code

1059

if use_dbus:

1060

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1015

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)

1016

1017

def remove_from_clients(client):

1018

clients.remove(client)

1019

if not clients:

1020

logger.critical(u"No clients left, exiting")

1021

sys.exit()

1061

1022

1062

1023

clients.update(Set(Client(name = section,

1024

stop_hook = remove_from_clients,

1063

1025

config

1064

= dict(client_config.items(section)),

1065

use_dbus = use_dbus)

1026

= dict(client_config.items(section)))

1066

1027

for section in client_config.sections()))

1067

1028

if not clients:

1068

logger.warning(u"No clients defined")

1029

logger.critical(u"No clients defined")

1030

sys.exit(1)

1069

1031

1070

1032

if debug:

1071

1033

# Redirect stdin so all checkers get /dev/null

1103

1065

1104

1066

while clients:

1105

1067

client = clients.pop()

1106

client.disable_hook = None

1107

client.disable()

1068

client.stop_hook = None

1069

client.stop()

1108

1070

1109

1071

atexit.register(cleanup)

1110

1072

1113

1075

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1114

1076

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1115

1077

1116

if use_dbus:

1117

class MandosServer(dbus.service.Object):

1118

"""A D-Bus proxy object"""

1119

def __init__(self):

1120

dbus.service.Object.__init__(self, bus, "/")

1121

_interface = u"se.bsnet.fukt.Mandos"

1122

1123

@dbus.service.signal(_interface, signature="oa{sv}")

1124

def ClientAdded(self, objpath, properties):

1125

"D-Bus signal"

1126

pass

1127

1128

@dbus.service.signal(_interface, signature="os")

1129

def ClientRemoved(self, objpath, name):

1130

"D-Bus signal"

1131

pass

1132

1133

@dbus.service.method(_interface, out_signature="ao")

1134

def GetAllClients(self):

1135

"D-Bus method"

1136

return dbus.Array(c.dbus_object_path for c in clients)

1137

1138

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1139

def GetAllClientsWithProperties(self):

1140

"D-Bus method"

1141

return dbus.Dictionary(

1142

((c.dbus_object_path, c.GetAllProperties())

1143

for c in clients),

1144

signature="oa{sv}")

1145

1146

@dbus.service.method(_interface, in_signature="o")

1147

def RemoveClient(self, object_path):

1148

"D-Bus method"

1149

for c in clients:

1150

if c.dbus_object_path == object_path:

1151

clients.remove(c)

1152

# Don't signal anything except ClientRemoved

1153

c.use_dbus = False

1154

c.disable()

1155

# Emit D-Bus signal

1156

self.ClientRemoved(object_path, c.name)

1157

return

1158

raise KeyError

1159

1160

del _interface

1161

1162

mandos_server = MandosServer()

1163

1164

1078

for client in clients:

1165

if use_dbus:

1166

# Emit D-Bus signal

1167

mandos_server.ClientAdded(client.dbus_object_path,

1168

client.GetAllProperties())

1169

client.enable()

1079

client.start()

1170

1080

1171

1081

tcp_server.enable()

1172

1082

tcp_server.server_activate()

1196

1106

logger.debug(u"Starting main loop")

1197

1107

main_loop.run()

1198

1108

except AvahiError, error:

1199

logger.critical(u"AvahiError: %s", error)

1109

logger.critical(u"AvahiError: %s" + unicode(error))

1200

1110

sys.exit(1)

1201

1111

except KeyboardInterrupt:

1202

1112

if debug:

1203

print >> sys.stderr

1204

logger.debug("Server received KeyboardInterrupt")

1205

logger.debug("Server exiting")

1113

print

1206

1114

1207

1115

if __name__ == '__main__':

1208

1116

main()