To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 24.1.113
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.113
- Committer: Björn Påhlsson
- Date: 2008-11-12 05:46:49 UTC
- mfrom: (237.1.2 mandos)
- mto: (24.1.154 mandos) (237.4.3 mandos-release)
- mto: This revision was merged to the branch mainline in revision 240.
- Revision ID: belorn@braxen-20081112054649-g3m4i22ncnaf5hbi
merge
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- ca.pem
- files renamed:
- server.py => mandos
- server.conf => mandos.conf
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# following functions: "AvahiService.add", "AvahiService.remove",
10
# "server_state_changed", "entry_group_state_changed", and some lines
11
# in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn
15
# Copyright © 2008 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
24
25
# GNU General Public License for more details.
25
26
#
26
27
# You should have received a copy of the GNU General Public License
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
28
30
#
29
31
# Contact the authors at <mandos@fukt.bsnet.se>.
30
32
#
31
33
32
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
33
35
34
36
import SocketServer
35
37
import socket
36
import select
37
38
from optparse import OptionParser
38
39
import datetime
39
40
import errno
54
55
import stat
55
56
import logging
56
57
import logging.handlers
58
import pwd
59
from contextlib import closing
57
60
58
61
import dbus
62
import dbus.service
59
63
import gobject
60
64
import avahi
61
65
from dbus.mainloop.glib import DBusGMainLoop
62
66
import ctypes
63
64
# Brief description of the operation of this program:
65
#
66
# This server announces itself as a Zeroconf service. Connecting
67
# clients use the TLS protocol, with the unusual quirk that this
68
# server program acts as a TLS "client" while a connecting client acts
69
# as a TLS "server". The client (acting as a TLS "server") must
70
# supply an OpenPGP certificate, and the fingerprint of this
71
# certificate is used by this server to look up (in a list read from a
72
# file at start time) which binary blob to give the client. No other
73
# authentication or authorization is done by this server.
74
67
import ctypes.util
68
69
version = "1.0.2"
75
70
76
71
logger = logging.Logger('mandos')
77
syslogger = logging.handlers.SysLogHandler\
78
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
79
syslogger.setFormatter(logging.Formatter\
80
('%(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
81
77
logger.addHandler(syslogger)
82
del syslogger
83
78
79
console = logging.StreamHandler()
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
82
logger.addHandler(console)
84
83
85
84
class AvahiError(Exception):
86
85
def __init__(self, value):
87
86
self.value = value
87
super(AvahiError, self).__init__()
88
88
def __str__(self):
89
89
return repr(self.value)
90
90
96
96
97
97
98
98
class AvahiService(object):
99
"""
99
"""An Avahi (Zeroconf) service.
100
Attributes:
100
101
interface: integer; avahi.IF_UNSPEC or an interface index.
101
102
Used to optionally bind to the specified interface.
102
name = string; Example: "Mandos"
103
type = string; Example: "_mandos._tcp".
104
See <http://www.dns-sd.org/ServiceTypes.html>
105
port = integer; what port to announce
106
TXT = list of strings; TXT record for the service
107
domain = string; Domain to publish on, default to .local if empty.
108
host = string; Host to publish records for, default to localhost
109
if empty.
110
max_renames = integer; maximum number of renames
111
rename_count = integer; counter so we only rename after collisions
112
a sensible number of times
103
name: string; Example: 'Mandos'
104
type: string; Example: '_mandos._tcp'.
105
See <http://www.dns-sd.org/ServiceTypes.html>
106
port: integer; what port to announce
107
TXT: list of strings; TXT record for the service
108
domain: string; Domain to publish on, default to .local if empty.
109
host: string; Host to publish records for, default is localhost
110
max_renames: integer; maximum number of renames
111
rename_count: integer; counter so we only rename after collisions
112
a sensible number of times
113
113
"""
114
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
type = None, port = None, TXT = None, domain = "",
116
host = "", max_renames = 12):
117
"""An Avahi (Zeroconf) service. """
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
118
117
self.interface = interface
119
118
self.name = name
120
self.type = type
119
self.type = servicetype
121
120
self.port = port
122
if TXT is None:
123
self.TXT = []
124
else:
125
self.TXT = TXT
121
self.TXT = TXT if TXT is not None else []
126
122
self.domain = domain
127
123
self.host = host
128
124
self.rename_count = 0
125
self.max_renames = max_renames
129
126
def rename(self):
130
127
"""Derived from the Avahi example code"""
131
128
if self.rename_count >= self.max_renames:
132
logger.critical(u"No suitable service name found after %i"
133
u" retries, exiting.", rename_count)
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
134
132
raise AvahiServiceError("Too many renames")
135
name = server.GetAlternativeServiceName(name)
136
logger.notice(u"Changing name to %r ...", name)
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
137
139
self.remove()
138
140
self.add()
139
141
self.rename_count += 1
145
147
"""Derived from the Avahi example code"""
146
148
global group
147
149
if group is None:
148
group = dbus.Interface\
149
(bus.get_object(avahi.DBUS_NAME,
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
150
152
server.EntryGroupNew()),
151
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
154
group.connect_to_signal('StateChanged',
153
155
entry_group_state_changed)
154
logger.debug(u"Adding service '%s' of type '%s' ...",
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
155
157
service.name, service.type)
156
158
group.AddService(
157
159
self.interface, # interface
168
170
# End of Avahi example code
169
171
170
172
171
class Client(object):
173
class Client(dbus.service.Object):
172
174
"""A representation of a client host served by this server.
173
175
Attributes:
174
176
name: string; from the config file, used in log messages
175
177
fingerprint: string (40 or 32 hexadecimal digits); used to
176
178
uniquely identify the client
177
179
secret: bytestring; sent verbatim (over TLS) to client
178
fqdn: string (FQDN); available for use by the checker command
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
180
host: string; available for use by the checker command
181
created: datetime.datetime(); (UTC) object creation
182
started: datetime.datetime(); (UTC) last started
183
last_checked_ok: datetime.datetime(); (UTC) or None
181
184
timeout: datetime.timedelta(); How long from last_checked_ok
182
185
until this client is invalid
183
186
interval: datetime.timedelta(); How often to start a new checker
199
202
_interval_milliseconds: - '' -
200
203
"""
201
204
def _set_timeout(self, timeout):
202
"Setter function for 'timeout' attribute"
205
"Setter function for the 'timeout' attribute"
203
206
self._timeout = timeout
204
207
self._timeout_milliseconds = ((self.timeout.days
205
208
* 24 * 60 * 60 * 1000)
206
209
+ (self.timeout.seconds * 1000)
207
210
+ (self.timeout.microseconds
208
211
// 1000))
209
timeout = property(lambda self: self._timeout,
210
_set_timeout)
212
# Emit D-Bus signal
213
self.TimeoutChanged(self._timeout_milliseconds)
214
timeout = property(lambda self: self._timeout, _set_timeout)
211
215
del _set_timeout
216
212
217
def _set_interval(self, interval):
213
"Setter function for 'interval' attribute"
218
"Setter function for the 'interval' attribute"
214
219
self._interval = interval
215
220
self._interval_milliseconds = ((self.interval.days
216
221
* 24 * 60 * 60 * 1000)
218
223
* 1000)
219
224
+ (self.interval.microseconds
220
225
// 1000))
221
interval = property(lambda self: self._interval,
222
_set_interval)
226
# Emit D-Bus signal
227
self.IntervalChanged(self._interval_milliseconds)
228
interval = property(lambda self: self._interval, _set_interval)
223
229
del _set_interval
224
def __init__(self, name=None, stop_hook=None, fingerprint=None,
225
secret=None, secfile=None, fqdn=None, timeout=None,
226
interval=-1, checker=None):
227
"""Note: the 'checker' argument sets the 'checker_command'
228
attribute and not the 'checker' attribute.."""
230
231
def __init__(self, name = None, stop_hook=None, config=None):
232
"""Note: the 'checker' key in 'config' sets the
233
'checker_command' attribute and *not* the 'checker'
234
attribute."""
235
dbus.service.Object.__init__(self, bus,
236
"/Mandos/clients/%s"
237
% name.replace(".", "_"))
238
if config is None:
239
config = {}
229
240
self.name = name
230
241
logger.debug(u"Creating client %r", self.name)
231
# Uppercase and remove spaces from fingerprint
232
# for later comparison purposes with return value of
233
# the fingerprint() function
234
self.fingerprint = fingerprint.upper().replace(u" ", u"")
242
# Uppercase and remove spaces from fingerprint for later
243
# comparison purposes with return value from the fingerprint()
244
# function
245
self.fingerprint = (config["fingerprint"].upper()
246
.replace(u" ", u""))
235
247
logger.debug(u" Fingerprint: %s", self.fingerprint)
236
if secret:
237
self.secret = secret.decode(u"base64")
238
elif secfile:
239
sf = open(secfile)
240
self.secret = sf.read()
241
sf.close()
248
if "secret" in config:
249
self.secret = config["secret"].decode(u"base64")
250
elif "secfile" in config:
251
with closing(open(os.path.expanduser
252
(os.path.expandvars
253
(config["secfile"])))) as secfile:
254
self.secret = secfile.read()
242
255
else:
243
256
raise TypeError(u"No secret or secfile for client %s"
244
257
% self.name)
245
self.fqdn = fqdn
246
self.created = datetime.datetime.now()
258
self.host = config.get("host", "")
259
self.created = datetime.datetime.utcnow()
260
self.started = None
247
261
self.last_checked_ok = None
248
self.timeout = string_to_delta(timeout)
249
self.interval = string_to_delta(interval)
262
self.timeout = string_to_delta(config["timeout"])
263
self.interval = string_to_delta(config["interval"])
250
264
self.stop_hook = stop_hook
251
265
self.checker = None
252
266
self.checker_initiator_tag = None
253
267
self.stop_initiator_tag = None
254
268
self.checker_callback_tag = None
255
self.check_command = checker
269
self.check_command = config["checker"]
270
256
271
def start(self):
257
272
"""Start this client's checker and timeout hooks"""
273
self.started = datetime.datetime.utcnow()
258
274
# Schedule a new checker to be started an 'interval' from now,
259
275
# and every interval from then on.
260
self.checker_initiator_tag = gobject.timeout_add\
261
(self._interval_milliseconds,
262
self.start_checker)
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self._interval_milliseconds,
278
self.start_checker))
263
279
# Also start a new checker *right now*.
264
280
self.start_checker()
265
281
# Schedule a stop() when 'timeout' has passed
266
self.stop_initiator_tag = gobject.timeout_add\
267
(self._timeout_milliseconds,
268
self.stop)
282
self.stop_initiator_tag = (gobject.timeout_add
283
(self._timeout_milliseconds,
284
self.stop))
285
# Emit D-Bus signal
286
self.StateChanged(True)
287
269
288
def stop(self):
270
"""Stop this client.
271
The possibility that a client might be restarted is left open,
272
but not currently used."""
273
# If this client doesn't have a secret, it is already stopped.
274
if self.secret:
275
logger.debug(u"Stopping client %s", self.name)
276
self.secret = None
289
"""Stop this client."""
290
if getattr(self, "started", None) is not None:
291
logger.info(u"Stopping client %s", self.name)
277
292
else:
278
293
return False
279
294
if getattr(self, "stop_initiator_tag", False):
285
300
self.stop_checker()
286
301
if self.stop_hook:
287
302
self.stop_hook(self)
303
self.started = None
304
# Emit D-Bus signal
305
self.StateChanged(False)
288
306
# Do not run this again if called by a gobject.timeout_add
289
307
return False
308
290
309
def __del__(self):
291
310
self.stop_hook = None
292
311
self.stop()
312
293
313
def checker_callback(self, pid, condition):
294
314
"""The checker has completed, so take appropriate actions."""
295
now = datetime.datetime.now()
296
315
self.checker_callback_tag = None
297
316
self.checker = None
298
if os.WIFEXITED(condition) \
299
and (os.WEXITSTATUS(condition) == 0):
300
logger.debug(u"Checker for %(name)s succeeded",
301
vars(self))
302
self.last_checked_ok = now
303
gobject.source_remove(self.stop_initiator_tag)
304
self.stop_initiator_tag = gobject.timeout_add\
305
(self._timeout_milliseconds,
306
self.stop)
317
if (os.WIFEXITED(condition)
318
and (os.WEXITSTATUS(condition) == 0)):
319
logger.info(u"Checker for %(name)s succeeded",
320
vars(self))
321
# Emit D-Bus signal
322
self.CheckerCompleted(True)
323
self.bump_timeout()
307
324
elif not os.WIFEXITED(condition):
308
325
logger.warning(u"Checker for %(name)s crashed?",
309
326
vars(self))
327
# Emit D-Bus signal
328
self.CheckerCompleted(False)
310
329
else:
311
logger.debug(u"Checker for %(name)s failed",
312
vars(self))
330
logger.info(u"Checker for %(name)s failed",
331
vars(self))
332
# Emit D-Bus signal
333
self.CheckerCompleted(False)
334
335
def bump_timeout(self):
336
"""Bump up the timeout for this client.
337
This should only be called when the client has been seen,
338
alive and well.
339
"""
340
self.last_checked_ok = datetime.datetime.utcnow()
341
gobject.source_remove(self.stop_initiator_tag)
342
self.stop_initiator_tag = (gobject.timeout_add
343
(self._timeout_milliseconds,
344
self.stop))
345
313
346
def start_checker(self):
314
347
"""Start a new checker subprocess if one is not running.
315
348
If a checker already exists, leave it running and do
325
358
if self.checker is None:
326
359
try:
327
360
# In case check_command has exactly one % operator
328
command = self.check_command % self.fqdn
361
command = self.check_command % self.host
329
362
except TypeError:
330
363
# Escape attributes for the shell
331
364
escaped_attrs = dict((key, re.escape(str(val)))
338
371
u' %s', self.check_command, error)
339
372
return True # Try again later
340
373
try:
341
logger.debug(u"Starting checker %r for %s",
342
command, self.name)
374
logger.info(u"Starting checker %r for %s",
375
command, self.name)
376
# We don't need to redirect stdout and stderr, since
377
# in normal mode, that is already done by daemon(),
378
# and in debug mode we don't want to. (Stdin is
379
# always replaced by /dev/null.)
343
380
self.checker = subprocess.Popen(command,
344
381
close_fds=True,
345
382
shell=True, cwd="/")
346
self.checker_callback_tag = gobject.child_watch_add\
347
(self.checker.pid,
348
self.checker_callback)
349
except subprocess.OSError, error:
383
self.checker_callback_tag = (gobject.child_watch_add
384
(self.checker.pid,
385
self.checker_callback))
386
# Emit D-Bus signal
387
self.CheckerStarted(command)
388
except OSError, error:
350
389
logger.error(u"Failed to start subprocess: %s",
351
390
error)
352
391
# Re-run this periodically if run by gobject.timeout_add
353
392
return True
393
354
394
def stop_checker(self):
355
395
"""Force the checker process, if any, to stop."""
356
396
if self.checker_callback_tag:
358
398
self.checker_callback_tag = None
359
399
if getattr(self, "checker", None) is None:
360
400
return
361
logger.debug("Stopping checker for %(name)s", vars(self))
401
logger.debug(u"Stopping checker for %(name)s", vars(self))
362
402
try:
363
403
os.kill(self.checker.pid, signal.SIGTERM)
364
404
#os.sleep(0.5)
368
408
if error.errno != errno.ESRCH: # No such process
369
409
raise
370
410
self.checker = None
411
371
412
def still_valid(self):
372
413
"""Has the timeout not yet passed for this client?"""
373
now = datetime.datetime.now()
414
if not self.started:
415
return False
416
now = datetime.datetime.utcnow()
374
417
if self.last_checked_ok is None:
375
418
return now < (self.created + self.timeout)
376
419
else:
377
420
return now < (self.last_checked_ok + self.timeout)
421
422
## D-Bus methods & signals
423
_interface = u"org.mandos_system.Mandos.Client"
424
425
def _datetime_to_dbus_struct(dt):
426
return dbus.Struct(dt.year, dt.month, dt.day, dt.hour,
427
dt.minute, dt.second, dt.microsecond,
428
signature="nyyyyyu")
429
430
# BumpTimeout - method
431
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
432
BumpTimeout.__name__ = "BumpTimeout"
433
434
# IntervalChanged - signal
435
@dbus.service.signal(_interface, signature="t")
436
def IntervalChanged(self, t):
437
"D-Bus signal"
438
pass
439
440
# CheckerCompleted - signal
441
@dbus.service.signal(_interface, signature="b")
442
def CheckerCompleted(self, success):
443
"D-Bus signal"
444
pass
445
446
# CheckerIsRunning - method
447
@dbus.service.method(_interface, out_signature="b")
448
def CheckerIsRunning(self):
449
"D-Bus getter method"
450
return self.checker is not None
451
452
# CheckerStarted - signal
453
@dbus.service.signal(_interface, signature="s")
454
def CheckerStarted(self, command):
455
"D-Bus signal"
456
pass
457
458
# GetChecker - method
459
@dbus.service.method(_interface, out_signature="s")
460
def GetChecker(self):
461
"D-Bus getter method"
462
return self.checker_command
463
464
# GetCreated - method
465
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
466
def GetCreated(self):
467
"D-Bus getter method"
468
return datetime_to_dbus_struct(self.created)
469
470
# GetFingerprint - method
471
@dbus.service.method(_interface, out_signature="s")
472
def GetFingerprint(self):
473
"D-Bus getter method"
474
return self.fingerprint
475
476
# GetHost - method
477
@dbus.service.method(_interface, out_signature="s")
478
def GetHost(self):
479
"D-Bus getter method"
480
return self.host
481
482
# GetInterval - method
483
@dbus.service.method(_interface, out_signature="t")
484
def GetInterval(self):
485
"D-Bus getter method"
486
return self._interval_milliseconds
487
488
# GetName - method
489
@dbus.service.method(_interface, out_signature="s")
490
def GetName(self):
491
"D-Bus getter method"
492
return self.name
493
494
# GetStarted - method
495
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
496
def GetStarted(self):
497
"D-Bus getter method"
498
if self.started is not None:
499
return datetime_to_dbus_struct(self.started)
500
else:
501
return dbus.Struct(0, 0, 0, 0, 0, 0, 0,
502
signature="nyyyyyu")
503
504
# GetTimeout - method
505
@dbus.service.method(_interface, out_signature="t")
506
def GetTimeout(self):
507
"D-Bus getter method"
508
return self._timeout_milliseconds
509
510
# SetChecker - method
511
@dbus.service.method(_interface, in_signature="s")
512
def SetChecker(self, checker):
513
"D-Bus setter method"
514
self.checker_command = checker
515
516
# SetHost - method
517
@dbus.service.method(_interface, in_signature="s")
518
def SetHost(self, host):
519
"D-Bus setter method"
520
self.host = host
521
522
# SetInterval - method
523
@dbus.service.method(_interface, in_signature="t")
524
def SetInterval(self, milliseconds):
525
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
526
527
# SetTimeout - method
528
@dbus.service.method(_interface, in_signature="t")
529
def SetTimeout(self, milliseconds):
530
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
531
532
# SetSecret - method
533
@dbus.service.method(_interface, in_signature="ay",
534
byte_arrays=True)
535
def SetSecret(self, secret):
536
"D-Bus setter method"
537
self.secret = str(secret)
538
539
# Start - method
540
Start = dbus.service.method(_interface)(start)
541
Start.__name__ = "Start"
542
543
# StartChecker - method
544
StartChecker = dbus.service.method(_interface)(start_checker)
545
StartChecker.__name__ = "StartChecker"
546
547
# StateChanged - signal
548
@dbus.service.signal(_interface, signature="b")
549
def StateChanged(self, started):
550
"D-Bus signal"
551
pass
552
553
# StillValid - method
554
StillValid = (dbus.service.method(_interface, out_signature="b")
555
(still_valid))
556
StillValid.__name__ = "StillValid"
557
558
# Stop - method
559
Stop = dbus.service.method(_interface)(stop)
560
Stop.__name__ = "Stop"
561
562
# StopChecker - method
563
StopChecker = dbus.service.method(_interface)(stop_checker)
564
StopChecker.__name__ = "StopChecker"
565
566
# TimeoutChanged - signal
567
@dbus.service.signal(_interface, signature="t")
568
def TimeoutChanged(self, t):
569
"D-Bus signal"
570
pass
571
572
del _datetime_to_dbus_struct
573
del _interface
378
574
379
575
380
576
def peer_certificate(session):
381
577
"Return the peer's OpenPGP certificate as a bytestring"
382
578
# If not an OpenPGP certificate...
383
if gnutls.library.functions.gnutls_certificate_type_get\
384
(session._c_object) \
385
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
579
if (gnutls.library.functions
580
.gnutls_certificate_type_get(session._c_object)
581
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
386
582
# ...do the normal thing
387
583
return session.peer_certificate
388
584
list_size = ctypes.c_uint()
389
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
390
(session._c_object, ctypes.byref(list_size))
585
cert_list = (gnutls.library.functions
586
.gnutls_certificate_get_peers
587
(session._c_object, ctypes.byref(list_size)))
391
588
if list_size.value == 0:
392
589
return None
393
590
cert = cert_list[0]
396
593
397
594
def fingerprint(openpgp):
398
595
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
596
# New GnuTLS "datum" with the OpenPGP public key
597
datum = (gnutls.library.types
598
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
599
ctypes.POINTER
600
(ctypes.c_ubyte)),
601
ctypes.c_uint(len(openpgp))))
399
602
# New empty GnuTLS certificate
400
603
crt = gnutls.library.types.gnutls_openpgp_crt_t()
401
gnutls.library.functions.gnutls_openpgp_crt_init\
402
(ctypes.byref(crt))
403
# New GnuTLS "datum" with the OpenPGP public key
404
datum = gnutls.library.types.gnutls_datum_t\
405
(ctypes.cast(ctypes.c_char_p(openpgp),
406
ctypes.POINTER(ctypes.c_ubyte)),
407
ctypes.c_uint(len(openpgp)))
604
(gnutls.library.functions
605
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
408
606
# Import the OpenPGP public key into the certificate
409
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
410
(crt,
411
ctypes.byref(datum),
412
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
607
(gnutls.library.functions
608
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
609
gnutls.library.constants
610
.GNUTLS_OPENPGP_FMT_RAW))
611
# Verify the self signature in the key
612
crtverify = ctypes.c_uint()
613
(gnutls.library.functions
614
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
615
if crtverify.value != 0:
616
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
617
raise gnutls.errors.CertificateSecurityError("Verify failed")
413
618
# New buffer for the fingerprint
414
buffer = ctypes.create_string_buffer(20)
415
buffer_length = ctypes.c_size_t()
619
buf = ctypes.create_string_buffer(20)
620
buf_len = ctypes.c_size_t()
416
621
# Get the fingerprint from the certificate into the buffer
417
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
418
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
624
ctypes.byref(buf_len)))
419
625
# Deinit the certificate
420
626
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
421
627
# Convert the buffer to a Python bytestring
422
fpr = ctypes.string_at(buffer, buffer_length.value)
628
fpr = ctypes.string_at(buf, buf_len.value)
423
629
# Convert the bytestring to hexadecimal notation
424
630
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
425
631
return hex_fpr
426
632
427
633
428
class tcp_handler(SocketServer.BaseRequestHandler, object):
634
class TCP_handler(SocketServer.BaseRequestHandler, object):
429
635
"""A TCP request handler class.
430
636
Instantiated by IPv6_TCPServer for each request to handle it.
431
637
Note: This will run in its own forked process."""
432
638
433
639
def handle(self):
434
logger.debug(u"TCP connection from: %s",
435
unicode(self.client_address))
436
session = gnutls.connection.ClientSession\
437
(self.request, gnutls.connection.X509Credentials())
640
logger.info(u"TCP connection from: %s",
641
unicode(self.client_address))
642
session = (gnutls.connection
643
.ClientSession(self.request,
644
gnutls.connection
645
.X509Credentials()))
646
647
line = self.request.makefile().readline()
648
logger.debug(u"Protocol version: %r", line)
649
try:
650
if int(line.strip().split()[0]) > 1:
651
raise RuntimeError
652
except (ValueError, IndexError, RuntimeError), error:
653
logger.error(u"Unknown protocol version: %s", error)
654
return
655
438
656
# Note: gnutls.connection.X509Credentials is really a generic
439
657
# GnuTLS certificate credentials object so long as no X.509
440
658
# keys are added to it. Therefore, we can use it here despite
443
661
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
444
662
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
445
663
# "+DHE-DSS"))
446
priority = "NORMAL" # Fallback default, since this
447
# MUST be set.
448
if self.server.settings["priority"]:
449
priority = self.server.settings["priority"]
450
gnutls.library.functions.gnutls_priority_set_direct\
451
(session._c_object, priority, None);
664
# Use a fallback default, since this MUST be set.
665
priority = self.server.settings.get("priority", "NORMAL")
666
(gnutls.library.functions
667
.gnutls_priority_set_direct(session._c_object,
668
priority, None))
452
669
453
670
try:
454
671
session.handshake()
455
672
except gnutls.errors.GNUTLSError, error:
456
logger.debug(u"Handshake failed: %s", error)
673
logger.warning(u"Handshake failed: %s", error)
457
674
# Do not run session.bye() here: the session is not
458
675
# established. Just abandon the request.
459
676
return
460
677
try:
461
678
fpr = fingerprint(peer_certificate(session))
462
679
except (TypeError, gnutls.errors.GNUTLSError), error:
463
logger.debug(u"Bad certificate: %s", error)
680
logger.warning(u"Bad certificate: %s", error)
464
681
session.bye()
465
682
return
466
683
logger.debug(u"Fingerprint: %s", fpr)
467
client = None
468
684
for c in self.server.clients:
469
685
if c.fingerprint == fpr:
470
686
client = c
471
687
break
472
if not client:
473
logger.debug(u"Client not found for fingerprint: %s", fpr)
688
else:
689
logger.warning(u"Client not found for fingerprint: %s",
690
fpr)
474
691
session.bye()
475
692
return
476
693
# Have to check if client.still_valid(), since it is possible
477
694
# that the client timed out while establishing the GnuTLS
478
695
# session.
479
696
if not client.still_valid():
480
logger.debug(u"Client %(name)s is invalid", vars(client))
697
logger.warning(u"Client %(name)s is invalid",
698
vars(client))
481
699
session.bye()
482
700
return
701
## This won't work here, since we're in a fork.
702
# client.bump_timeout()
483
703
sent_size = 0
484
704
while sent_size < len(client.secret):
485
705
sent = session.send(client.secret[sent_size:])
490
710
session.bye()
491
711
492
712
493
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
713
class IPv6_TCPServer(SocketServer.ForkingMixIn,
714
SocketServer.TCPServer, object):
494
715
"""IPv6 TCP server. Accepts 'None' as address and/or port.
495
716
Attributes:
496
717
settings: Server settings
497
718
clients: Set() of Client objects
719
enabled: Boolean; whether this server is activated yet
498
720
"""
499
721
address_family = socket.AF_INET6
500
722
def __init__(self, *args, **kwargs):
504
726
if "clients" in kwargs:
505
727
self.clients = kwargs["clients"]
506
728
del kwargs["clients"]
507
return super(type(self), self).__init__(*args, **kwargs)
729
self.enabled = False
730
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
508
731
def server_bind(self):
509
732
"""This overrides the normal server_bind() function
510
733
to bind to an interface if one was specified, and also NOT to
518
741
self.settings["interface"])
519
742
except socket.error, error:
520
743
if error[0] == errno.EPERM:
521
logger.warning(u"No permission to"
522
u" bind to interface %s",
523
self.settings["interface"])
744
logger.error(u"No permission to"
745
u" bind to interface %s",
746
self.settings["interface"])
524
747
else:
525
748
raise error
526
749
# Only bind(2) the socket if we really need to.
529
752
in6addr_any = "::"
530
753
self.server_address = (in6addr_any,
531
754
self.server_address[1])
532
elif self.server_address[1] is None:
755
elif not self.server_address[1]:
533
756
self.server_address = (self.server_address[0],
534
757
0)
535
return super(type(self), self).server_bind()
758
# if self.settings["interface"]:
759
# self.server_address = (self.server_address[0],
760
# 0, # port
761
# 0, # flowinfo
762
# if_nametoindex
763
# (self.settings
764
# ["interface"]))
765
return super(IPv6_TCPServer, self).server_bind()
766
def server_activate(self):
767
if self.enabled:
768
return super(IPv6_TCPServer, self).server_activate()
769
def enable(self):
770
self.enabled = True
536
771
537
772
538
773
def string_to_delta(interval):
548
783
datetime.timedelta(1)
549
784
>>> string_to_delta(u'1w')
550
785
datetime.timedelta(7)
786
>>> string_to_delta('5m 30s')
787
datetime.timedelta(0, 330)
551
788
"""
552
try:
553
suffix=unicode(interval[-1])
554
value=int(interval[:-1])
555
if suffix == u"d":
556
delta = datetime.timedelta(value)
557
elif suffix == u"s":
558
delta = datetime.timedelta(0, value)
559
elif suffix == u"m":
560
delta = datetime.timedelta(0, 0, 0, 0, value)
561
elif suffix == u"h":
562
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
563
elif suffix == u"w":
564
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
565
else:
789
timevalue = datetime.timedelta(0)
790
for s in interval.split():
791
try:
792
suffix = unicode(s[-1])
793
value = int(s[:-1])
794
if suffix == u"d":
795
delta = datetime.timedelta(value)
796
elif suffix == u"s":
797
delta = datetime.timedelta(0, value)
798
elif suffix == u"m":
799
delta = datetime.timedelta(0, 0, 0, 0, value)
800
elif suffix == u"h":
801
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
802
elif suffix == u"w":
803
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
804
else:
805
raise ValueError
806
except (ValueError, IndexError):
566
807
raise ValueError
567
except (ValueError, IndexError):
568
raise ValueError
569
return delta
808
timevalue += delta
809
return timevalue
570
810
571
811
572
812
def server_state_changed(state):
573
813
"""Derived from the Avahi example code"""
574
814
if state == avahi.SERVER_COLLISION:
575
logger.warning(u"Server name collision")
815
logger.error(u"Zeroconf server name collision")
576
816
service.remove()
577
817
elif state == avahi.SERVER_RUNNING:
578
818
service.add()
580
820
581
821
def entry_group_state_changed(state, error):
582
822
"""Derived from the Avahi example code"""
583
logger.debug(u"state change: %i", state)
823
logger.debug(u"Avahi state change: %i", state)
584
824
585
825
if state == avahi.ENTRY_GROUP_ESTABLISHED:
586
logger.debug(u"Service established.")
826
logger.debug(u"Zeroconf service established.")
587
827
elif state == avahi.ENTRY_GROUP_COLLISION:
588
logger.warning(u"Service name collision.")
828
logger.warning(u"Zeroconf service name collision.")
589
829
service.rename()
590
830
elif state == avahi.ENTRY_GROUP_FAILURE:
591
logger.critical(u"Error in group state changed %s",
831
logger.critical(u"Avahi: Error in group state changed %s",
592
832
unicode(error))
593
833
raise AvahiGroupError("State changed: %s", str(error))
594
834
595
def if_nametoindex(interface, _func=[None]):
835
def if_nametoindex(interface):
596
836
"""Call the C function if_nametoindex(), or equivalent"""
597
if _func[0] is not None:
598
return _func[0](interface)
837
global if_nametoindex
599
838
try:
600
if "ctypes.util" not in sys.modules:
601
import ctypes.util
602
while True:
603
try:
604
libc = ctypes.cdll.LoadLibrary\
605
(ctypes.util.find_library("c"))
606
_func[0] = libc.if_nametoindex
607
return _func[0](interface)
608
except IOError, e:
609
if e != errno.EINTR:
610
raise
839
if_nametoindex = (ctypes.cdll.LoadLibrary
840
(ctypes.util.find_library("c"))
841
.if_nametoindex)
611
842
except (OSError, AttributeError):
612
843
if "struct" not in sys.modules:
613
844
import struct
614
845
if "fcntl" not in sys.modules:
615
846
import fcntl
616
def the_hard_way(interface):
847
def if_nametoindex(interface):
617
848
"Get an interface index the hard way, i.e. using fcntl()"
618
849
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
619
s = socket.socket()
620
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
621
struct.pack("16s16x", interface))
622
s.close()
850
with closing(socket.socket()) as s:
851
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
852
struct.pack("16s16x", interface))
623
853
interface_index = struct.unpack("I", ifreq[16:20])[0]
624
854
return interface_index
625
_func[0] = the_hard_way
626
return _func[0](interface)
627
628
629
def daemon(nochdir, noclose):
855
return if_nametoindex(interface)
856
857
858
def daemon(nochdir = False, noclose = False):
630
859
"""See daemon(3). Standard BSD Unix function.
631
860
This should really exist as os.daemon, but it doesn't (yet)."""
632
861
if os.fork():
634
863
os.setsid()
635
864
if not nochdir:
636
865
os.chdir("/")
866
if os.fork():
867
sys.exit()
637
868
if not noclose:
638
869
# Close all standard open file descriptors
639
870
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
648
879
649
880
650
881
def main():
651
global main_loop_started
652
main_loop_started = False
653
654
parser = OptionParser()
882
parser = OptionParser(version = "%%prog %s" % version)
655
883
parser.add_option("-i", "--interface", type="string",
656
884
metavar="IF", help="Bind to interface IF")
657
885
parser.add_option("-a", "--address", type="string",
660
888
help="Port number to receive requests on")
661
889
parser.add_option("--check", action="store_true", default=False,
662
890
help="Run self-test")
663
parser.add_option("--debug", action="store_true", default=False,
891
parser.add_option("--debug", action="store_true",
664
892
help="Debug mode; run in foreground and log to"
665
893
" terminal")
666
894
parser.add_option("--priority", type="string", help="GnuTLS"
671
899
default="/etc/mandos", metavar="DIR",
672
900
help="Directory to search for configuration"
673
901
" files")
674
(options, args) = parser.parse_args()
902
options = parser.parse_args()[0]
675
903
676
904
if options.check:
677
905
import doctest
691
919
# Parse config file for server-global settings
692
920
server_config = ConfigParser.SafeConfigParser(server_defaults)
693
921
del server_defaults
694
server_config.read(os.path.join(options.configdir, "server.conf"))
695
server_section = "server"
922
server_config.read(os.path.join(options.configdir, "mandos.conf"))
696
923
# Convert the SafeConfigParser object to a dict
697
server_settings = dict(server_config.items(server_section))
924
server_settings = server_config.defaults()
698
925
# Use getboolean on the boolean config option
699
server_settings["debug"] = server_config.getboolean\
700
(server_section, "debug")
926
server_settings["debug"] = (server_config.getboolean
927
("DEFAULT", "debug"))
701
928
del server_config
702
929
703
930
# Override the settings from the config file with command line
710
937
del options
711
938
# Now we have our good server settings in "server_settings"
712
939
940
debug = server_settings["debug"]
941
942
if not debug:
943
syslogger.setLevel(logging.WARNING)
944
console.setLevel(logging.WARNING)
945
946
if server_settings["servicename"] != "Mandos":
947
syslogger.setFormatter(logging.Formatter
948
('Mandos (%s): %%(levelname)s:'
949
' %%(message)s'
950
% server_settings["servicename"]))
951
713
952
# Parse config file with clients
714
953
client_defaults = { "timeout": "1h",
715
954
"interval": "5m",
716
"checker": "fping -q -- %%(fqdn)s",
955
"checker": "fping -q -- %(host)s",
956
"host": "",
717
957
}
718
958
client_config = ConfigParser.SafeConfigParser(client_defaults)
719
959
client_config.read(os.path.join(server_settings["configdir"],
720
960
"clients.conf"))
721
961
962
clients = Set()
963
tcp_server = IPv6_TCPServer((server_settings["address"],
964
server_settings["port"]),
965
TCP_handler,
966
settings=server_settings,
967
clients=clients)
968
pidfilename = "/var/run/mandos.pid"
969
try:
970
pidfile = open(pidfilename, "w")
971
except IOError, error:
972
logger.error("Could not open file %r", pidfilename)
973
974
uid = 65534
975
gid = 65534
976
try:
977
uid = pwd.getpwnam("mandos").pw_uid
978
except KeyError:
979
try:
980
uid = pwd.getpwnam("nobody").pw_uid
981
except KeyError:
982
pass
983
try:
984
gid = pwd.getpwnam("mandos").pw_gid
985
except KeyError:
986
try:
987
gid = pwd.getpwnam("nogroup").pw_gid
988
except KeyError:
989
pass
990
try:
991
os.setuid(uid)
992
os.setgid(gid)
993
except OSError, error:
994
if error[0] != errno.EPERM:
995
raise error
996
722
997
global service
723
998
service = AvahiService(name = server_settings["servicename"],
724
type = "_mandos._tcp", );
999
servicetype = "_mandos._tcp", )
725
1000
if server_settings["interface"]:
726
service.interface = if_nametoindex(server_settings["interface"])
1001
service.interface = (if_nametoindex
1002
(server_settings["interface"]))
727
1003
728
1004
global main_loop
729
1005
global bus
732
1008
DBusGMainLoop(set_as_default=True )
733
1009
main_loop = gobject.MainLoop()
734
1010
bus = dbus.SystemBus()
735
server = dbus.Interface(
736
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
737
avahi.DBUS_INTERFACE_SERVER )
1011
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1012
avahi.DBUS_PATH_SERVER),
1013
avahi.DBUS_INTERFACE_SERVER)
738
1014
# End of Avahi example code
739
740
debug = server_settings["debug"]
741
742
if debug:
743
console = logging.StreamHandler()
744
# console.setLevel(logging.DEBUG)
745
console.setFormatter(logging.Formatter\
746
('%(levelname)s: %(message)s'))
747
logger.addHandler(console)
748
del console
749
750
clients = Set()
1015
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
1016
751
1017
def remove_from_clients(client):
752
1018
clients.remove(client)
753
1019
if not clients:
754
logger.debug(u"No clients left, exiting")
1020
logger.critical(u"No clients left, exiting")
755
1021
sys.exit()
756
1022
757
clients.update(Set(Client(name=section,
1023
clients.update(Set(Client(name = section,
758
1024
stop_hook = remove_from_clients,
759
**(dict(client_config\
760
.items(section))))
1025
config
1026
= dict(client_config.items(section)))
761
1027
for section in client_config.sections()))
762
763
if not debug:
764
daemon(False, False)
1028
if not clients:
1029
logger.critical(u"No clients defined")
1030
sys.exit(1)
1031
1032
if debug:
1033
# Redirect stdin so all checkers get /dev/null
1034
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1035
os.dup2(null, sys.stdin.fileno())
1036
if null > 2:
1037
os.close(null)
1038
else:
1039
# No console logging
1040
logger.removeHandler(console)
1041
# Close all input and output, do double fork, etc.
1042
daemon()
1043
1044
try:
1045
pid = os.getpid()
1046
pidfile.write(str(pid) + "\n")
1047
pidfile.close()
1048
del pidfile
1049
except IOError:
1050
logger.error(u"Could not write to file %r with PID %d",
1051
pidfilename, pid)
1052
except NameError:
1053
# "pidfile" was never created
1054
pass
1055
del pidfilename
765
1056
766
1057
def cleanup():
767
1058
"Cleanup function; run on exit"
787
1078
for client in clients:
788
1079
client.start()
789
1080
790
tcp_server = IPv6_TCPServer((server_settings["address"],
791
server_settings["port"]),
792
tcp_handler,
793
settings=server_settings,
794
clients=clients)
1081
tcp_server.enable()
1082
tcp_server.server_activate()
1083
795
1084
# Find out what port we got
796
1085
service.port = tcp_server.socket.getsockname()[1]
797
logger.debug(u"Now listening on address %r, port %d, flowinfo %d,"
798
u" scope_id %d" % tcp_server.socket.getsockname())
1086
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1087
u" scope_id %d" % tcp_server.socket.getsockname())
799
1088
800
1089
#service.interface = tcp_server.socket.getsockname()[3]
801
1090
811
1100
812
1101
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
813
1102
lambda *args, **kwargs:
814
tcp_server.handle_request\
815
(*args[2:], **kwargs) or True)
1103
(tcp_server.handle_request
1104
(*args[2:], **kwargs) or True))
816
1105
817
logger.debug("Starting main loop")
818
main_loop_started = True
1106
logger.debug(u"Starting main loop")
819
1107
main_loop.run()
820
1108
except AvahiError, error:
821
1109
logger.critical(u"AvahiError: %s" + unicode(error))
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0