/mandos/trunk : revision 24.1.113

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

35

36

import SocketServer

37

import socket

38

import optparse

38

from optparse import OptionParser

39

import datetime

40

import errno

41

import gnutls.crypto

66

import ctypes

67

import ctypes.util

68

69

version = "1.0.5"

69

version = "1.0.2"

70

71

logger = logging.Logger('mandos')

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos [%(process)d]: %(levelname)s:'

77

' %(message)s'))

76

('Mandos: %(levelname)s: %(message)s'))

78

77

logger.addHandler(syslogger)

79

78

80

79

console = logging.StreamHandler()

81

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

82

' %(levelname)s: %(message)s'))

80

console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'

81

' %(message)s'))

83

82

logger.addHandler(console)

84

83

85

84

class AvahiError(Exception):

86

def __init__(self, value, *args, **kwargs):

85

def __init__(self, value):

87

86

self.value = value

88

super(AvahiError, self).__init__(value, *args, **kwargs)

89

def __unicode__(self):

90

return unicode(repr(self.value))

87

super(AvahiError, self).__init__()

88

def __str__(self):

89

return repr(self.value)

91

90

92

91

class AvahiServiceError(AvahiError):

93

92

pass

130

129

logger.critical(u"No suitable Zeroconf service name found"

131

130

u" after %i retries, exiting.",

132

131

self.rename_count)

133

raise AvahiServiceError(u"Too many renames")

132

raise AvahiServiceError("Too many renames")

134

133

self.name = server.GetAlternativeServiceName(self.name)

135

134

logger.info(u"Changing Zeroconf service name to %r ...",

136

135

str(self.name))

171

170

# End of Avahi example code

172

171

173

172

174

def _datetime_to_dbus(dt, variant_level=0):

175

"""Convert a UTC datetime.datetime() to a D-Bus type."""

176

return dbus.String(dt.isoformat(), variant_level=variant_level)

177

178

179

173

class Client(dbus.service.Object):

180

174

"""A representation of a client host served by this server.

181

175

Attributes:

182

name: string; from the config file, used in log messages and

183

D-Bus identifiers

176

name: string; from the config file, used in log messages

184

177

fingerprint: string (40 or 32 hexadecimal digits); used to

185

178

uniquely identify the client

186

secret: bytestring; sent verbatim (over TLS) to client

187

host: string; available for use by the checker command

188

created: datetime.datetime(); (UTC) object creation

189

last_enabled: datetime.datetime(); (UTC)

190

enabled: bool()

179

secret: bytestring; sent verbatim (over TLS) to client

180

host: string; available for use by the checker command

181

created: datetime.datetime(); (UTC) object creation

182

started: datetime.datetime(); (UTC) last started

191

183

last_checked_ok: datetime.datetime(); (UTC) or None

192

timeout: datetime.timedelta(); How long from last_checked_ok

193

until this client is invalid

194

interval: datetime.timedelta(); How often to start a new checker

195

disable_hook: If set, called by disable() as disable_hook(self)

196

checker: subprocess.Popen(); a running checker process used

197

to see if the client lives.

198

'None' if no process is running.

184

timeout: datetime.timedelta(); How long from last_checked_ok

185

until this client is invalid

186

interval: datetime.timedelta(); How often to start a new checker

187

stop_hook: If set, called by stop() as stop_hook(self)

188

checker: subprocess.Popen(); a running checker process used

189

to see if the client lives.

190

'None' if no process is running.

199

191

checker_initiator_tag: a gobject event source tag, or None

200

disable_initiator_tag: - '' -

192

stop_initiator_tag: - '' -

201

193

checker_callback_tag: - '' -

202

194

checker_command: string; External command which is run to check if

203

195

client lives. %() expansions are done at

204

196

runtime with vars(self) as dict, so that for

205

197

instance %(name)s can be used in the command.

206

use_dbus: bool(); Whether to provide D-Bus interface and signals

207

dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus

198

Private attibutes:

199

_timeout: Real variable for 'timeout'

200

_interval: Real variable for 'interval'

201

_timeout_milliseconds: Used when calling gobject.timeout_add()

202

_interval_milliseconds: - '' -

208

203

"""

209

def timeout_milliseconds(self):

210

"Return the 'timeout' attribute in milliseconds"

211

return ((self.timeout.days * 24 * 60 * 60 * 1000)

212

+ (self.timeout.seconds * 1000)

213

+ (self.timeout.microseconds // 1000))

214

215

def interval_milliseconds(self):

216

"Return the 'interval' attribute in milliseconds"

217

return ((self.interval.days * 24 * 60 * 60 * 1000)

218

+ (self.interval.seconds * 1000)

219

+ (self.interval.microseconds // 1000))

220

221

def __init__(self, name = None, disable_hook=None, config=None,

222

use_dbus=True):

204

def _set_timeout(self, timeout):

205

"Setter function for the 'timeout' attribute"

206

self._timeout = timeout

207

self._timeout_milliseconds = ((self.timeout.days

208

* 24 * 60 * 60 * 1000)

209

+ (self.timeout.seconds * 1000)

210

+ (self.timeout.microseconds

211

// 1000))

212

# Emit D-Bus signal

213

self.TimeoutChanged(self._timeout_milliseconds)

214

timeout = property(lambda self: self._timeout, _set_timeout)

215

del _set_timeout

216

217

def _set_interval(self, interval):

218

"Setter function for the 'interval' attribute"

219

self._interval = interval

220

self._interval_milliseconds = ((self.interval.days

221

* 24 * 60 * 60 * 1000)

222

+ (self.interval.seconds

223

* 1000)

224

+ (self.interval.microseconds

225

// 1000))

226

# Emit D-Bus signal

227

self.IntervalChanged(self._interval_milliseconds)

228

interval = property(lambda self: self._interval, _set_interval)

229

del _set_interval

230

231

def __init__(self, name = None, stop_hook=None, config=None):

223

232

"""Note: the 'checker' key in 'config' sets the

224

233

'checker_command' attribute and *not* the 'checker'

225

234

attribute."""

226

self.name = name

235

dbus.service.Object.__init__(self, bus,

236

"/Mandos/clients/%s"

237

% name.replace(".", "_"))

227

238

if config is None:

228

239

config = {}

240

self.name = name

229

241

logger.debug(u"Creating client %r", self.name)

230

self.use_dbus = False # During __init__

231

242

# Uppercase and remove spaces from fingerprint for later

232

243

# comparison purposes with return value from the fingerprint()

233

244

# function

246

257

% self.name)

247

258

self.host = config.get("host", "")

248

259

self.created = datetime.datetime.utcnow()

249

self.enabled = False

250

self.last_enabled = None

260

self.started = None

251

261

self.last_checked_ok = None

252

262

self.timeout = string_to_delta(config["timeout"])

253

263

self.interval = string_to_delta(config["interval"])

254

self.disable_hook = disable_hook

264

self.stop_hook = stop_hook

255

265

self.checker = None

256

266

self.checker_initiator_tag = None

257

self.disable_initiator_tag = None

267

self.stop_initiator_tag = None

258

268

self.checker_callback_tag = None

259

self.checker_command = config["checker"]

260

self.last_connect = None

261

# Only now, when this client is initialized, can it show up on

262

# the D-Bus

263

self.use_dbus = use_dbus

264

if self.use_dbus:

265

self.dbus_object_path = (dbus.ObjectPath

266

("/clients/"

267

+ self.name.replace(".", "_")))

268

dbus.service.Object.__init__(self, bus,

269

self.dbus_object_path)

269

self.check_command = config["checker"]

270

271

def enable(self):

271

def start(self):

272

"""Start this client's checker and timeout hooks"""

273

self.last_enabled = datetime.datetime.utcnow()

273

self.started = datetime.datetime.utcnow()

274

# Schedule a new checker to be started an 'interval' from now,

275

# and every interval from then on.

276

self.checker_initiator_tag = (gobject.timeout_add

277

(self.interval_milliseconds(),

277

(self._interval_milliseconds,

278

self.start_checker))

279

# Also start a new checker *right now*.

280

self.start_checker()

281

# Schedule a disable() when 'timeout' has passed

282

self.disable_initiator_tag = (gobject.timeout_add

283

(self.timeout_milliseconds(),

284

self.disable))

285

self.enabled = True

286

if self.use_dbus:

287

# Emit D-Bus signals

288

self.PropertyChanged(dbus.String(u"enabled"),

289

dbus.Boolean(True, variant_level=1))

290

self.PropertyChanged(dbus.String(u"last_enabled"),

291

(_datetime_to_dbus(self.last_enabled,

292

variant_level=1)))

281

# Schedule a stop() when 'timeout' has passed

282

self.stop_initiator_tag = (gobject.timeout_add

283

(self._timeout_milliseconds,

284

self.stop))

285

# Emit D-Bus signal

286

self.StateChanged(True)

293

287

294

def disable(self):

295

"""Disable this client."""

296

if not getattr(self, "enabled", False):

288

def stop(self):

289

"""Stop this client."""

290

if getattr(self, "started", None) is not None:

291

logger.info(u"Stopping client %s", self.name)

292

else:

297

293

return False

298

logger.info(u"Disabling client %s", self.name)

299

if getattr(self, "disable_initiator_tag", False):

300

gobject.source_remove(self.disable_initiator_tag)

301

self.disable_initiator_tag = None

294

if getattr(self, "stop_initiator_tag", False):

295

gobject.source_remove(self.stop_initiator_tag)

296

self.stop_initiator_tag = None

302

297

if getattr(self, "checker_initiator_tag", False):

303

298

gobject.source_remove(self.checker_initiator_tag)

304

299

self.checker_initiator_tag = None

305

300

self.stop_checker()

306

if self.disable_hook:

307

self.disable_hook(self)

308

self.enabled = False

309

if self.use_dbus:

310

# Emit D-Bus signal

311

self.PropertyChanged(dbus.String(u"enabled"),

312

dbus.Boolean(False, variant_level=1))

301

if self.stop_hook:

302

self.stop_hook(self)

303

self.started = None

304

# Emit D-Bus signal

305

self.StateChanged(False)

313

306

# Do not run this again if called by a gobject.timeout_add

314

307

return False

315

308

316

309

def __del__(self):

317

self.disable_hook = None

318

self.disable()

310

self.stop_hook = None

311

self.stop()

319

312

320

def checker_callback(self, pid, condition, command):

313

def checker_callback(self, pid, condition):

321

314

"""The checker has completed, so take appropriate actions."""

322

315

self.checker_callback_tag = None

323

316

self.checker = None

324

if self.use_dbus:

317

if (os.WIFEXITED(condition)

318

and (os.WEXITSTATUS(condition) == 0)):

319

logger.info(u"Checker for %(name)s succeeded",

320

vars(self))

325

321

# Emit D-Bus signal

326

self.PropertyChanged(dbus.String(u"checker_running"),

327

dbus.Boolean(False, variant_level=1))

328

if os.WIFEXITED(condition):

329

exitstatus = os.WEXITSTATUS(condition)

330

if exitstatus == 0:

331

logger.info(u"Checker for %(name)s succeeded",

332

vars(self))

333

self.checked_ok()

334

else:

335

logger.info(u"Checker for %(name)s failed",

336

vars(self))

337

if self.use_dbus:

338

# Emit D-Bus signal

339

self.CheckerCompleted(dbus.Int16(exitstatus),

340

dbus.Int64(condition),

341

dbus.String(command))

342

else:

322

self.CheckerCompleted(True)

323

self.bump_timeout()

324

elif not os.WIFEXITED(condition):

343

325

logger.warning(u"Checker for %(name)s crashed?",

344

326

vars(self))

345

if self.use_dbus:

346

# Emit D-Bus signal

347

self.CheckerCompleted(dbus.Int16(-1),

348

dbus.Int64(condition),

349

dbus.String(command))

327

# Emit D-Bus signal

328

self.CheckerCompleted(False)

329

else:

330

logger.info(u"Checker for %(name)s failed",

331

vars(self))

332

# Emit D-Bus signal

333

self.CheckerCompleted(False)

350

334

351

def checked_ok(self):

335

def bump_timeout(self):

352

336

"""Bump up the timeout for this client.

353

337

This should only be called when the client has been seen,

354

338

alive and well.

355

339

"""

356

340

self.last_checked_ok = datetime.datetime.utcnow()

357

gobject.source_remove(self.disable_initiator_tag)

358

self.disable_initiator_tag = (gobject.timeout_add

359

(self.timeout_milliseconds(),

360

self.disable))

361

if self.use_dbus:

362

# Emit D-Bus signal

363

self.PropertyChanged(

364

dbus.String(u"last_checked_ok"),

365

(_datetime_to_dbus(self.last_checked_ok,

366

variant_level=1)))

341

gobject.source_remove(self.stop_initiator_tag)

342

self.stop_initiator_tag = (gobject.timeout_add

343

(self._timeout_milliseconds,

344

self.stop))

367

345

368

346

def start_checker(self):

369

347

"""Start a new checker subprocess if one is not running.

379

357

# is as it should be.

380

358

if self.checker is None:

381

359

try:

382

# In case checker_command has exactly one % operator

383

command = self.checker_command % self.host

360

# In case check_command has exactly one % operator

361

command = self.check_command % self.host

384

362

except TypeError:

385

363

# Escape attributes for the shell

386

364

escaped_attrs = dict((key, re.escape(str(val)))

387

365

for key, val in

388

366

vars(self).iteritems())

389

367

try:

390

command = self.checker_command % escaped_attrs

368

command = self.check_command % escaped_attrs

391

369

except TypeError, error:

392

370

logger.error(u'Could not format string "%s":'

393

u' %s', self.checker_command, error)

371

u' %s', self.check_command, error)

394

372

return True # Try again later

395

373

try:

396

374

logger.info(u"Starting checker %r for %s",

402

380

self.checker = subprocess.Popen(command,

403

381

close_fds=True,

404

382

shell=True, cwd="/")

405

if self.use_dbus:

406

# Emit D-Bus signal

407

self.CheckerStarted(command)

408

self.PropertyChanged(

409

dbus.String("checker_running"),

410

dbus.Boolean(True, variant_level=1))

411

383

self.checker_callback_tag = (gobject.child_watch_add

412

384

(self.checker.pid,

413

self.checker_callback,

414

data=command))

415

# The checker may have completed before the gobject

416

# watch was added. Check for this.

417

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

418

if pid:

419

gobject.source_remove(self.checker_callback_tag)

420

self.checker_callback(pid, status, command)

385

self.checker_callback))

386

# Emit D-Bus signal

387

self.CheckerStarted(command)

421

388

except OSError, error:

422

389

logger.error(u"Failed to start subprocess: %s",

423

390

error)

441

408

if error.errno != errno.ESRCH: # No such process

442

409

raise

443

410

self.checker = None

444

if self.use_dbus:

445

self.PropertyChanged(dbus.String(u"checker_running"),

446

dbus.Boolean(False, variant_level=1))

447

411

448

412

def still_valid(self):

449

413

"""Has the timeout not yet passed for this client?"""

450

if not getattr(self, "enabled", False):

414

if not self.started:

451

415

return False

452

416

now = datetime.datetime.utcnow()

453

417

if self.last_checked_ok is None:

456

420

return now < (self.last_checked_ok + self.timeout)

457

421

458

422

## D-Bus methods & signals

459

_interface = u"se.bsnet.fukt.Mandos.Client"

460

461

# CheckedOK - method

462

CheckedOK = dbus.service.method(_interface)(checked_ok)

463

CheckedOK.__name__ = "CheckedOK"

423

_interface = u"org.mandos_system.Mandos.Client"

424

425

def _datetime_to_dbus_struct(dt):

426

return dbus.Struct(dt.year, dt.month, dt.day, dt.hour,

427

dt.minute, dt.second, dt.microsecond,

428

signature="nyyyyyu")

429

430

# BumpTimeout - method

431

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

432

BumpTimeout.__name__ = "BumpTimeout"

433

434

# IntervalChanged - signal

435

@dbus.service.signal(_interface, signature="t")

436

def IntervalChanged(self, t):

437

"D-Bus signal"

438

pass

464

439

465

440

# CheckerCompleted - signal

466

@dbus.service.signal(_interface, signature="nxs")

467

def CheckerCompleted(self, exitcode, waitstatus, command):

441

@dbus.service.signal(_interface, signature="b")

442

def CheckerCompleted(self, success):

468

443

"D-Bus signal"

469

444

pass

470

445

446

# CheckerIsRunning - method

447

@dbus.service.method(_interface, out_signature="b")

448

def CheckerIsRunning(self):

449

"D-Bus getter method"

450

return self.checker is not None

451

471

452

# CheckerStarted - signal

472

453

@dbus.service.signal(_interface, signature="s")

473

454

def CheckerStarted(self, command):

474

455

"D-Bus signal"

475

456

pass

476

457

477

# GetAllProperties - method

478

@dbus.service.method(_interface, out_signature="a{sv}")

479

def GetAllProperties(self):

480

"D-Bus method"

481

return dbus.Dictionary({

482

dbus.String("name"):

483

dbus.String(self.name, variant_level=1),

484

dbus.String("fingerprint"):

485

dbus.String(self.fingerprint, variant_level=1),

486

dbus.String("host"):

487

dbus.String(self.host, variant_level=1),

488

dbus.String("created"):

489

_datetime_to_dbus(self.created, variant_level=1),

490

dbus.String("last_enabled"):

491

(_datetime_to_dbus(self.last_enabled,

492

variant_level=1)

493

if self.last_enabled is not None

494

else dbus.Boolean(False, variant_level=1)),

495

dbus.String("enabled"):

496

dbus.Boolean(self.enabled, variant_level=1),

497

dbus.String("last_checked_ok"):

498

(_datetime_to_dbus(self.last_checked_ok,

499

variant_level=1)

500

if self.last_checked_ok is not None

501

else dbus.Boolean (False, variant_level=1)),

502

dbus.String("timeout"):

503

dbus.UInt64(self.timeout_milliseconds(),

504

variant_level=1),

505

dbus.String("interval"):

506

dbus.UInt64(self.interval_milliseconds(),

507

variant_level=1),

508

dbus.String("checker"):

509

dbus.String(self.checker_command,

510

variant_level=1),

511

dbus.String("checker_running"):

512

dbus.Boolean(self.checker is not None,

513

variant_level=1),

514

dbus.String("object_path"):

515

dbus.ObjectPath(self.dbus_object_path,

516

variant_level=1)

517

}, signature="sv")

518

519

# IsStillValid - method

520

IsStillValid = (dbus.service.method(_interface, out_signature="b")

521

(still_valid))

522

IsStillValid.__name__ = "IsStillValid"

523

524

# PropertyChanged - signal

525

@dbus.service.signal(_interface, signature="sv")

526

def PropertyChanged(self, property, value):

527

"D-Bus signal"

528

pass

458

# GetChecker - method

459

@dbus.service.method(_interface, out_signature="s")

460

def GetChecker(self):

461

"D-Bus getter method"

462

return self.checker_command

463

464

# GetCreated - method

465

@dbus.service.method(_interface, out_signature="(nyyyyyu)")

466

def GetCreated(self):

467

"D-Bus getter method"

468

return datetime_to_dbus_struct(self.created)

469

470

# GetFingerprint - method

471

@dbus.service.method(_interface, out_signature="s")

472

def GetFingerprint(self):

473

"D-Bus getter method"

474

return self.fingerprint

475

476

# GetHost - method

477

@dbus.service.method(_interface, out_signature="s")

478

def GetHost(self):

479

"D-Bus getter method"

480

return self.host

481

482

# GetInterval - method

483

@dbus.service.method(_interface, out_signature="t")

484

def GetInterval(self):

485

"D-Bus getter method"

486

return self._interval_milliseconds

487

488

# GetName - method

489

@dbus.service.method(_interface, out_signature="s")

490

def GetName(self):

491

"D-Bus getter method"

492

return self.name

493

494

# GetStarted - method

495

@dbus.service.method(_interface, out_signature="(nyyyyyu)")

496

def GetStarted(self):

497

"D-Bus getter method"

498

if self.started is not None:

499

return datetime_to_dbus_struct(self.started)

500

else:

501

return dbus.Struct(0, 0, 0, 0, 0, 0, 0,

502

signature="nyyyyyu")

503

504

# GetTimeout - method

505

@dbus.service.method(_interface, out_signature="t")

506

def GetTimeout(self):

507

"D-Bus getter method"

508

return self._timeout_milliseconds

529

509

530

510

# SetChecker - method

531

511

@dbus.service.method(_interface, in_signature="s")

532

512

def SetChecker(self, checker):

533

513

"D-Bus setter method"

534

514

self.checker_command = checker

535

# Emit D-Bus signal

536

self.PropertyChanged(dbus.String(u"checker"),

537

dbus.String(self.checker_command,

538

variant_level=1))

539

515

540

516

# SetHost - method

541

517

@dbus.service.method(_interface, in_signature="s")

542

518

def SetHost(self, host):

543

519

"D-Bus setter method"

544

520

self.host = host

545

# Emit D-Bus signal

546

self.PropertyChanged(dbus.String(u"host"),

547

dbus.String(self.host, variant_level=1))

548

521

549

522

# SetInterval - method

550

523

@dbus.service.method(_interface, in_signature="t")

551

524

def SetInterval(self, milliseconds):

552

self.interval = datetime.timedelta(0, 0, 0, milliseconds)

553

# Emit D-Bus signal

554

self.PropertyChanged(dbus.String(u"interval"),

555

(dbus.UInt64(self.interval_milliseconds(),

556

variant_level=1)))

525

self.interval = datetime.timdeelta(0, 0, 0, milliseconds)

526

527

# SetTimeout - method

528

@dbus.service.method(_interface, in_signature="t")

529

def SetTimeout(self, milliseconds):

530

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

557

531

558

532

# SetSecret - method

559

533

@dbus.service.method(_interface, in_signature="ay",

562

536

"D-Bus setter method"

563

537

self.secret = str(secret)

564

538

565

# SetTimeout - method

566

@dbus.service.method(_interface, in_signature="t")

567

def SetTimeout(self, milliseconds):

568

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

569

# Emit D-Bus signal

570

self.PropertyChanged(dbus.String(u"timeout"),

571

(dbus.UInt64(self.timeout_milliseconds(),

572

variant_level=1)))

573

574

# Enable - method

575

Enable = dbus.service.method(_interface)(enable)

576

Enable.__name__ = "Enable"

539

# Start - method

540

Start = dbus.service.method(_interface)(start)

541

Start.__name__ = "Start"

577

542

578

543

# StartChecker - method

579

@dbus.service.method(_interface)

580

def StartChecker(self):

581

"D-Bus method"

582

self.start_checker()

583

584

# Disable - method

585

@dbus.service.method(_interface)

586

def Disable(self):

587

"D-Bus method"

588

self.disable()

544

StartChecker = dbus.service.method(_interface)(start_checker)

545

StartChecker.__name__ = "StartChecker"

546

547

# StateChanged - signal

548

@dbus.service.signal(_interface, signature="b")

549

def StateChanged(self, started):

550

"D-Bus signal"

551

pass

552

553

# StillValid - method

554

StillValid = (dbus.service.method(_interface, out_signature="b")

555

(still_valid))

556

StillValid.__name__ = "StillValid"

557

558

# Stop - method

559

Stop = dbus.service.method(_interface)(stop)

560

Stop.__name__ = "Stop"

589

561

590

562

# StopChecker - method

591

563

StopChecker = dbus.service.method(_interface)(stop_checker)

592

564

StopChecker.__name__ = "StopChecker"

593

565

566

# TimeoutChanged - signal

567

@dbus.service.signal(_interface, signature="t")

568

def TimeoutChanged(self, t):

569

"D-Bus signal"

570

pass

571

572

del _datetime_to_dbus_struct

594

573

del _interface

595

574

596

575

602

581

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

603

582

# ...do the normal thing

604

583

return session.peer_certificate

605

list_size = ctypes.c_uint(1)

584

list_size = ctypes.c_uint()

606

585

cert_list = (gnutls.library.functions

607

586

.gnutls_certificate_get_peers

608

587

(session._c_object, ctypes.byref(list_size)))

609

if not bool(cert_list) and list_size.value != 0:

610

raise gnutls.errors.GNUTLSError("error getting peer"

611

" certificate")

612

588

if list_size.value == 0:

613

589

return None

614

590

cert = cert_list[0]

683

659

# using OpenPGP certificates.

684

660

685

661

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

686

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

687

# "+DHE-DSS"))

662

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

663

# "+DHE-DSS"))

688

664

# Use a fallback default, since this MUST be set.

689

665

priority = self.server.settings.get("priority", "NORMAL")

690

666

(gnutls.library.functions

698

674

# Do not run session.bye() here: the session is not

699

675

# established. Just abandon the request.

700

676

return

701

logger.debug(u"Handshake succeeded")

702

677

try:

703

678

fpr = fingerprint(peer_certificate(session))

704

679

except (TypeError, gnutls.errors.GNUTLSError), error:

706

681

session.bye()

707

682

return

708

683

logger.debug(u"Fingerprint: %s", fpr)

709

710

684

for c in self.server.clients:

711

685

if c.fingerprint == fpr:

712

686

client = c

725

699

session.bye()

726

700

return

727

701

## This won't work here, since we're in a fork.

728

# client.checked_ok()

702

# client.bump_timeout()

729

703

sent_size = 0

730

704

while sent_size < len(client.secret):

731

705

sent = session.send(client.secret[sent_size:])

771

745

u" bind to interface %s",

772

746

self.settings["interface"])

773

747

else:

774

raise

748

raise error

775

749

# Only bind(2) the socket if we really need to.

776

750

if self.server_address[0] or self.server_address[1]:

777

751

if not self.server_address[0]:

798

772

799

773

def string_to_delta(interval):

800

774

"""Parse a string and return a datetime.timedelta

801

775

802

776

>>> string_to_delta('7d')

803

777

datetime.timedelta(7)

804

778

>>> string_to_delta('60s')

856

830

elif state == avahi.ENTRY_GROUP_FAILURE:

857

831

logger.critical(u"Avahi: Error in group state changed %s",

858

832

unicode(error))

859

raise AvahiGroupError(u"State changed: %s" % unicode(error))

833

raise AvahiGroupError("State changed: %s", str(error))

860

834

861

835

def if_nametoindex(interface):

862

836

"""Call the C function if_nametoindex(), or equivalent"""

905

879

906

880

907

881

def main():

908

parser = optparse.OptionParser(version = "%%prog %s" % version)

882

parser = OptionParser(version = "%%prog %s" % version)

909

883

parser.add_option("-i", "--interface", type="string",

910

884

metavar="IF", help="Bind to interface IF")

911

885

parser.add_option("-a", "--address", type="string",

912

886

help="Address to listen for requests on")

913

887

parser.add_option("-p", "--port", type="int",

914

888

help="Port number to receive requests on")

915

parser.add_option("--check", action="store_true",

889

parser.add_option("--check", action="store_true", default=False,

916

890

help="Run self-test")

917

891

parser.add_option("--debug", action="store_true",

918

892

help="Debug mode; run in foreground and log to"

925

899

default="/etc/mandos", metavar="DIR",

926

900

help="Directory to search for configuration"

927

901

" files")

928

parser.add_option("--no-dbus", action="store_false",

929

dest="use_dbus",

930

help="Do not provide D-Bus system bus"

931

" interface")

932

902

options = parser.parse_args()[0]

933

903

934

904

if options.check:

944

914

"priority":

945

915

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

946

916

"servicename": "Mandos",

947

"use_dbus": "True",

948

917

}

949

918

950

919

# Parse config file for server-global settings

953

922

server_config.read(os.path.join(options.configdir, "mandos.conf"))

954

923

# Convert the SafeConfigParser object to a dict

955

924

server_settings = server_config.defaults()

956

# Use the appropriate methods on the non-string config options

957

server_settings["debug"] = server_config.getboolean("DEFAULT",

958

"debug")

959

server_settings["use_dbus"] = server_config.getboolean("DEFAULT",

960

"use_dbus")

961

if server_settings["port"]:

962

server_settings["port"] = server_config.getint("DEFAULT",

963

"port")

925

# Use getboolean on the boolean config option

926

server_settings["debug"] = (server_config.getboolean

927

("DEFAULT", "debug"))

964

928

del server_config

965

929

966

930

# Override the settings from the config file with command line

967

931

# options, if set.

968

932

for option in ("interface", "address", "port", "debug",

969

"priority", "servicename", "configdir",

970

"use_dbus"):

933

"priority", "servicename", "configdir"):

971

934

value = getattr(options, option)

972

935

if value is not None:

973

936

server_settings[option] = value

974

937

del options

975

938

# Now we have our good server settings in "server_settings"

976

939

977

# For convenience

978

940

debug = server_settings["debug"]

979

use_dbus = server_settings["use_dbus"]

980

941

981

942

if not debug:

982

943

syslogger.setLevel(logging.WARNING)

991

952

# Parse config file with clients

992

953

client_defaults = { "timeout": "1h",

993

954

"interval": "5m",

994

"checker": "fping -q -- %%(host)s",

955

"checker": "fping -q -- %(host)s",

995

956

"host": "",

996

957

}

997

958

client_config = ConfigParser.SafeConfigParser(client_defaults)

1007

968

pidfilename = "/var/run/mandos.pid"

1008

969

try:

1009

970

pidfile = open(pidfilename, "w")

1010

except IOError:

971

except IOError, error:

1011

972

logger.error("Could not open file %r", pidfilename)

1012

973

1013

try:

1014

uid = pwd.getpwnam("_mandos").pw_uid

1015

gid = pwd.getpwnam("_mandos").pw_gid

1016

except KeyError:

1017

try:

1018

uid = pwd.getpwnam("mandos").pw_uid

1019

gid = pwd.getpwnam("mandos").pw_gid

1020

except KeyError:

1021

try:

1022

uid = pwd.getpwnam("nobody").pw_uid

1023

gid = pwd.getpwnam("nogroup").pw_gid

1024

except KeyError:

1025

uid = 65534

1026

gid = 65534

1027

try:

974

uid = 65534

975

gid = 65534

976

try:

977

uid = pwd.getpwnam("mandos").pw_uid

978

except KeyError:

979

try:

980

uid = pwd.getpwnam("nobody").pw_uid

981

except KeyError:

982

pass

983

try:

984

gid = pwd.getpwnam("mandos").pw_gid

985

except KeyError:

986

try:

987

gid = pwd.getpwnam("nogroup").pw_gid

988

except KeyError:

989

pass

990

try:

991

os.setuid(uid)

1028

992

os.setgid(gid)

1029

os.setuid(uid)

1030

993

except OSError, error:

1031

994

if error[0] != errno.EPERM:

1032

995

raise error

1033

996

1034

# Enable all possible GnuTLS debugging

1035

if debug:

1036

# "Use a log level over 10 to enable all debugging options."

1037

# - GnuTLS manual

1038

gnutls.library.functions.gnutls_global_set_log_level(11)

1039

1040

@gnutls.library.types.gnutls_log_func

1041

def debug_gnutls(level, string):

1042

logger.debug("GnuTLS: %s", string[:-1])

1043

1044

(gnutls.library.functions

1045

.gnutls_global_set_log_function(debug_gnutls))

1046

1047

997

global service

1048

998

service = AvahiService(name = server_settings["servicename"],

1049

999

servicetype = "_mandos._tcp", )

1062

1012

avahi.DBUS_PATH_SERVER),

1063

1013

avahi.DBUS_INTERFACE_SERVER)

1064

1014

# End of Avahi example code

1065

if use_dbus:

1066

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1015

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)

1016

1017

def remove_from_clients(client):

1018

clients.remove(client)

1019

if not clients:

1020

logger.critical(u"No clients left, exiting")

1021

sys.exit()

1067

1022

1068

1023

clients.update(Set(Client(name = section,

1024

stop_hook = remove_from_clients,

1069

1025

config

1070

= dict(client_config.items(section)),

1071

use_dbus = use_dbus)

1026

= dict(client_config.items(section)))

1072

1027

for section in client_config.sections()))

1073

1028

if not clients:

1074

logger.warning(u"No clients defined")

1029

logger.critical(u"No clients defined")

1030

sys.exit(1)

1075

1031

1076

1032

if debug:

1077

1033

# Redirect stdin so all checkers get /dev/null

1109

1065

1110

1066

while clients:

1111

1067

client = clients.pop()

1112

client.disable_hook = None

1113

client.disable()

1068

client.stop_hook = None

1069

client.stop()

1114

1070

1115

1071

atexit.register(cleanup)

1116

1072

1119

1075

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1120

1076

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1121

1077

1122

if use_dbus:

1123

class MandosServer(dbus.service.Object):

1124

"""A D-Bus proxy object"""

1125

def __init__(self):

1126

dbus.service.Object.__init__(self, bus, "/")

1127

_interface = u"se.bsnet.fukt.Mandos"

1128

1129

@dbus.service.signal(_interface, signature="oa{sv}")

1130

def ClientAdded(self, objpath, properties):

1131

"D-Bus signal"

1132

pass

1133

1134

@dbus.service.signal(_interface, signature="os")

1135

def ClientRemoved(self, objpath, name):

1136

"D-Bus signal"

1137

pass

1138

1139

@dbus.service.method(_interface, out_signature="ao")

1140

def GetAllClients(self):

1141

"D-Bus method"

1142

return dbus.Array(c.dbus_object_path for c in clients)

1143

1144

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1145

def GetAllClientsWithProperties(self):

1146

"D-Bus method"

1147

return dbus.Dictionary(

1148

((c.dbus_object_path, c.GetAllProperties())

1149

for c in clients),

1150

signature="oa{sv}")

1151

1152

@dbus.service.method(_interface, in_signature="o")

1153

def RemoveClient(self, object_path):

1154

"D-Bus method"

1155

for c in clients:

1156

if c.dbus_object_path == object_path:

1157

clients.remove(c)

1158

# Don't signal anything except ClientRemoved

1159

c.use_dbus = False

1160

c.disable()

1161

# Emit D-Bus signal

1162

self.ClientRemoved(object_path, c.name)

1163

return

1164

raise KeyError

1165

1166

del _interface

1167

1168

mandos_server = MandosServer()

1169

1170

1078

for client in clients:

1171

if use_dbus:

1172

# Emit D-Bus signal

1173

mandos_server.ClientAdded(client.dbus_object_path,

1174

client.GetAllProperties())

1175

client.enable()

1079

client.start()

1176

1080

1177

1081

tcp_server.enable()

1178

1082

tcp_server.server_activate()

1202

1106

logger.debug(u"Starting main loop")

1203

1107

main_loop.run()

1204

1108

except AvahiError, error:

1205

logger.critical(u"AvahiError: %s", error)

1109

logger.critical(u"AvahiError: %s" + unicode(error))

1206

1110

sys.exit(1)

1207

1111

except KeyboardInterrupt:

1208

1112

if debug:

1209

print >> sys.stderr

1210

logger.debug("Server received KeyboardInterrupt")

1211

logger.debug("Server exiting")

1113

print

1212

1114

1213

1115

if __name__ == '__main__':

1214

1116

main()