/mandos/trunk : revision 24.1.113

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

16

#

16

17

# This program is free software: you can redistribute it and/or modify

17

18

# it under the terms of the GNU General Public License as published by

24

25

# GNU General Public License for more details.

25

26

#

26

27

# You should have received a copy of the GNU General Public License

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

28

30

#

29

31

# Contact the authors at <mandos@fukt.bsnet.se>.

30

32

#

31

33

32

from __future__ import division

34

from __future__ import division, with_statement, absolute_import

33

35

34

36

import SocketServer

35

37

import socket

36

import select

37

38

from optparse import OptionParser

38

39

import datetime

39

40

import errno

54

55

import stat

55

56

import logging

56

57

import logging.handlers

58

import pwd

59

from contextlib import closing

57

60

58

61

import dbus

62

import dbus.service

59

63

import gobject

60

64

import avahi

61

65

from dbus.mainloop.glib import DBusGMainLoop

62

66

import ctypes

67

import ctypes.util

63

68

69

version = "1.0.2"

64

70

65

71

logger = logging.Logger('mandos')

66

syslogger = logging.handlers.SysLogHandler\

67

(facility = logging.handlers.SysLogHandler.LOG_DAEMON)

68

syslogger.setFormatter(logging.Formatter\

69

('%(levelname)s: %(message)s'))

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos: %(levelname)s: %(message)s'))

70

77

logger.addHandler(syslogger)

71

del syslogger

72

78

79

console = logging.StreamHandler()

80

console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'

81

' %(message)s'))

82

logger.addHandler(console)

73

83

74

84

class AvahiError(Exception):

75

85

def __init__(self, value):

76

86

self.value = value

87

super(AvahiError, self).__init__()

77

88

def __str__(self):

78

89

return repr(self.value)

79

90

101

112

a sensible number of times

102

113

"""

103

114

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

104

type = None, port = None, TXT = None, domain = "",

105

host = "", max_renames = 12):

115

servicetype = None, port = None, TXT = None,

116

domain = "", host = "", max_renames = 32768):

106

117

self.interface = interface

107

118

self.name = name

108

self.type = type

119

self.type = servicetype

109

120

self.port = port

110

if TXT is None:

111

self.TXT = []

112

else:

113

self.TXT = TXT

121

self.TXT = TXT if TXT is not None else []

114

122

self.domain = domain

115

123

self.host = host

116

124

self.rename_count = 0

125

self.max_renames = max_renames

117

126

def rename(self):

118

127

"""Derived from the Avahi example code"""

119

128

if self.rename_count >= self.max_renames:

120

logger.critical(u"No suitable service name found after %i"

121

u" retries, exiting.", rename_count)

129

logger.critical(u"No suitable Zeroconf service name found"

130

u" after %i retries, exiting.",

131

self.rename_count)

122

132

raise AvahiServiceError("Too many renames")

123

name = server.GetAlternativeServiceName(name)

124

logger.error(u"Changing name to %r ...", name)

133

self.name = server.GetAlternativeServiceName(self.name)

134

logger.info(u"Changing Zeroconf service name to %r ...",

135

str(self.name))

136

syslogger.setFormatter(logging.Formatter

137

('Mandos (%s): %%(levelname)s:'

138

' %%(message)s' % self.name))

125

139

self.remove()

126

140

self.add()

127

141

self.rename_count += 1

133

147

"""Derived from the Avahi example code"""

134

148

global group

135

149

if group is None:

136

group = dbus.Interface\

137

(bus.get_object(avahi.DBUS_NAME,

150

group = dbus.Interface(bus.get_object

151

(avahi.DBUS_NAME,

138

152

server.EntryGroupNew()),

139

avahi.DBUS_INTERFACE_ENTRY_GROUP)

153

avahi.DBUS_INTERFACE_ENTRY_GROUP)

140

154

group.connect_to_signal('StateChanged',

141

155

entry_group_state_changed)

142

logger.debug(u"Adding service '%s' of type '%s' ...",

156

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

143

157

service.name, service.type)

144

158

group.AddService(

145

159

self.interface, # interface

156

170

# End of Avahi example code

157

171

158

172

159

class Client(object):

173

class Client(dbus.service.Object):

160

174

"""A representation of a client host served by this server.

161

175

Attributes:

162

176

name: string; from the config file, used in log messages

163

177

fingerprint: string (40 or 32 hexadecimal digits); used to

164

178

uniquely identify the client

165

179

secret: bytestring; sent verbatim (over TLS) to client

166

fqdn: string (FQDN); available for use by the checker command

167

created: datetime.datetime(); object creation, not client host

168

last_checked_ok: datetime.datetime() or None if not yet checked OK

180

host: string; available for use by the checker command

181

created: datetime.datetime(); (UTC) object creation

182

started: datetime.datetime(); (UTC) last started

183

last_checked_ok: datetime.datetime(); (UTC) or None

169

184

timeout: datetime.timedelta(); How long from last_checked_ok

170

185

until this client is invalid

171

186

interval: datetime.timedelta(); How often to start a new checker

187

202

_interval_milliseconds: - '' -

188

203

"""

189

204

def _set_timeout(self, timeout):

190

"Setter function for 'timeout' attribute"

205

"Setter function for the 'timeout' attribute"

191

206

self._timeout = timeout

192

207

self._timeout_milliseconds = ((self.timeout.days

193

208

* 24 * 60 * 60 * 1000)

194

209

+ (self.timeout.seconds * 1000)

195

210

+ (self.timeout.microseconds

196

211

// 1000))

197

timeout = property(lambda self: self._timeout,

198

_set_timeout)

212

# Emit D-Bus signal

213

self.TimeoutChanged(self._timeout_milliseconds)

214

timeout = property(lambda self: self._timeout, _set_timeout)

199

215

del _set_timeout

216

200

217

def _set_interval(self, interval):

201

"Setter function for 'interval' attribute"

218

"Setter function for the 'interval' attribute"

202

219

self._interval = interval

203

220

self._interval_milliseconds = ((self.interval.days

204

221

* 24 * 60 * 60 * 1000)

206

223

* 1000)

207

224

+ (self.interval.microseconds

208

225

// 1000))

209

interval = property(lambda self: self._interval,

210

_set_interval)

226

# Emit D-Bus signal

227

self.IntervalChanged(self._interval_milliseconds)

228

interval = property(lambda self: self._interval, _set_interval)

211

229

del _set_interval

212

def __init__(self, name = None, stop_hook=None, config={}):

230

231

def __init__(self, name = None, stop_hook=None, config=None):

213

232

"""Note: the 'checker' key in 'config' sets the

214

233

'checker_command' attribute and *not* the 'checker'

215

234

attribute."""

235

dbus.service.Object.__init__(self, bus,

236

"/Mandos/clients/%s"

237

% name.replace(".", "_"))

238

if config is None:

239

config = {}

216

240

self.name = name

217

241

logger.debug(u"Creating client %r", self.name)

218

242

# Uppercase and remove spaces from fingerprint for later

219

243

# comparison purposes with return value from the fingerprint()

220

244

# function

221

self.fingerprint = config["fingerprint"].upper()\

222

.replace(u" ", u"")

245

self.fingerprint = (config["fingerprint"].upper()

246

.replace(u" ", u""))

223

247

logger.debug(u" Fingerprint: %s", self.fingerprint)

224

248

if "secret" in config:

225

249

self.secret = config["secret"].decode(u"base64")

226

250

elif "secfile" in config:

227

sf = open(config["secfile"])

228

self.secret = sf.read()

229

sf.close()

251

with closing(open(os.path.expanduser

252

(os.path.expandvars

253

(config["secfile"])))) as secfile:

254

self.secret = secfile.read()

230

255

else:

231

256

raise TypeError(u"No secret or secfile for client %s"

232

257

% self.name)

233

self.fqdn = config.get("fqdn", "")

234

self.created = datetime.datetime.now()

258

self.host = config.get("host", "")

259

self.created = datetime.datetime.utcnow()

260

self.started = None

235

261

self.last_checked_ok = None

236

262

self.timeout = string_to_delta(config["timeout"])

237

263

self.interval = string_to_delta(config["interval"])

241

267

self.stop_initiator_tag = None

242

268

self.checker_callback_tag = None

243

269

self.check_command = config["checker"]

270

244

271

def start(self):

245

272

"""Start this client's checker and timeout hooks"""

273

self.started = datetime.datetime.utcnow()

246

274

# Schedule a new checker to be started an 'interval' from now,

247

275

# and every interval from then on.

248

self.checker_initiator_tag = gobject.timeout_add\

249

(self._interval_milliseconds,

250

self.start_checker)

276

self.checker_initiator_tag = (gobject.timeout_add

277

(self._interval_milliseconds,

278

self.start_checker))

251

279

# Also start a new checker *right now*.

252

280

self.start_checker()

253

281

# Schedule a stop() when 'timeout' has passed

254

self.stop_initiator_tag = gobject.timeout_add\

255

(self._timeout_milliseconds,

256

self.stop)

282

self.stop_initiator_tag = (gobject.timeout_add

283

(self._timeout_milliseconds,

284

self.stop))

285

# Emit D-Bus signal

286

self.StateChanged(True)

287

257

288

def stop(self):

258

"""Stop this client.

259

The possibility that a client might be restarted is left open,

260

but not currently used."""

261

# If this client doesn't have a secret, it is already stopped.

262

if self.secret:

289

"""Stop this client."""

290

if getattr(self, "started", None) is not None:

263

291

logger.info(u"Stopping client %s", self.name)

264

self.secret = None

265

292

else:

266

293

return False

267

294

if getattr(self, "stop_initiator_tag", False):

273

300

self.stop_checker()

274

301

if self.stop_hook:

275

302

self.stop_hook(self)

303

self.started = None

304

# Emit D-Bus signal

305

self.StateChanged(False)

276

306

# Do not run this again if called by a gobject.timeout_add

277

307

return False

308

278

309

def __del__(self):

279

310

self.stop_hook = None

280

311

self.stop()

312

281

313

def checker_callback(self, pid, condition):

282

314

"""The checker has completed, so take appropriate actions."""

283

now = datetime.datetime.now()

284

315

self.checker_callback_tag = None

285

316

self.checker = None

286

if os.WIFEXITED(condition) \

287

and (os.WEXITSTATUS(condition) == 0):

317

if (os.WIFEXITED(condition)

318

and (os.WEXITSTATUS(condition) == 0)):

288

319

logger.info(u"Checker for %(name)s succeeded",

289

320

vars(self))

290

self.last_checked_ok = now

291

gobject.source_remove(self.stop_initiator_tag)

292

self.stop_initiator_tag = gobject.timeout_add\

293

(self._timeout_milliseconds,

294

self.stop)

321

# Emit D-Bus signal

322

self.CheckerCompleted(True)

323

self.bump_timeout()

295

324

elif not os.WIFEXITED(condition):

296

325

logger.warning(u"Checker for %(name)s crashed?",

297

326

vars(self))

327

# Emit D-Bus signal

328

self.CheckerCompleted(False)

298

329

else:

299

330

logger.info(u"Checker for %(name)s failed",

300

331

vars(self))

332

# Emit D-Bus signal

333

self.CheckerCompleted(False)

334

335

def bump_timeout(self):

336

"""Bump up the timeout for this client.

337

This should only be called when the client has been seen,

338

alive and well.

339

"""

340

self.last_checked_ok = datetime.datetime.utcnow()

341

gobject.source_remove(self.stop_initiator_tag)

342

self.stop_initiator_tag = (gobject.timeout_add

343

(self._timeout_milliseconds,

344

self.stop))

345

301

346

def start_checker(self):

302

347

"""Start a new checker subprocess if one is not running.

303

348

If a checker already exists, leave it running and do

313

358

if self.checker is None:

314

359

try:

315

360

# In case check_command has exactly one % operator

316

command = self.check_command % self.fqdn

361

command = self.check_command % self.host

317

362

except TypeError:

318

363

# Escape attributes for the shell

319

364

escaped_attrs = dict((key, re.escape(str(val)))

328

373

try:

329

374

logger.info(u"Starting checker %r for %s",

330

375

command, self.name)

376

# We don't need to redirect stdout and stderr, since

377

# in normal mode, that is already done by daemon(),

378

# and in debug mode we don't want to. (Stdin is

379

# always replaced by /dev/null.)

331

380

self.checker = subprocess.Popen(command,

332

381

close_fds=True,

333

382

shell=True, cwd="/")

334

self.checker_callback_tag = gobject.child_watch_add\

335

(self.checker.pid,

336

self.checker_callback)

337

except subprocess.OSError, error:

383

self.checker_callback_tag = (gobject.child_watch_add

384

(self.checker.pid,

385

self.checker_callback))

386

# Emit D-Bus signal

387

self.CheckerStarted(command)

388

except OSError, error:

338

389

logger.error(u"Failed to start subprocess: %s",

339

390

error)

340

391

# Re-run this periodically if run by gobject.timeout_add

341

392

return True

393

342

394

def stop_checker(self):

343

395

"""Force the checker process, if any, to stop."""

344

396

if self.checker_callback_tag:

346

398

self.checker_callback_tag = None

347

399

if getattr(self, "checker", None) is None:

348

400

return

349

logger.debug("Stopping checker for %(name)s", vars(self))

401

logger.debug(u"Stopping checker for %(name)s", vars(self))

350

402

try:

351

403

os.kill(self.checker.pid, signal.SIGTERM)

352

404

#os.sleep(0.5)

356

408

if error.errno != errno.ESRCH: # No such process

357

409

raise

358

410

self.checker = None

411

359

412

def still_valid(self):

360

413

"""Has the timeout not yet passed for this client?"""

361

now = datetime.datetime.now()

414

if not self.started:

415

return False

416

now = datetime.datetime.utcnow()

362

417

if self.last_checked_ok is None:

363

418

return now < (self.created + self.timeout)

364

419

else:

365

420

return now < (self.last_checked_ok + self.timeout)

421

422

## D-Bus methods & signals

423

_interface = u"org.mandos_system.Mandos.Client"

424

425

def _datetime_to_dbus_struct(dt):

426

return dbus.Struct(dt.year, dt.month, dt.day, dt.hour,

427

dt.minute, dt.second, dt.microsecond,

428

signature="nyyyyyu")

429

430

# BumpTimeout - method

431

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

432

BumpTimeout.__name__ = "BumpTimeout"

433

434

# IntervalChanged - signal

435

@dbus.service.signal(_interface, signature="t")

436

def IntervalChanged(self, t):

437

"D-Bus signal"

438

pass

439

440

# CheckerCompleted - signal

441

@dbus.service.signal(_interface, signature="b")

442

def CheckerCompleted(self, success):

443

"D-Bus signal"

444

pass

445

446

# CheckerIsRunning - method

447

@dbus.service.method(_interface, out_signature="b")

448

def CheckerIsRunning(self):

449

"D-Bus getter method"

450

return self.checker is not None

451

452

# CheckerStarted - signal

453

@dbus.service.signal(_interface, signature="s")

454

def CheckerStarted(self, command):

455

"D-Bus signal"

456

pass

457

458

# GetChecker - method

459

@dbus.service.method(_interface, out_signature="s")

460

def GetChecker(self):

461

"D-Bus getter method"

462

return self.checker_command

463

464

# GetCreated - method

465

@dbus.service.method(_interface, out_signature="(nyyyyyu)")

466

def GetCreated(self):

467

"D-Bus getter method"

468

return datetime_to_dbus_struct(self.created)

469

470

# GetFingerprint - method

471

@dbus.service.method(_interface, out_signature="s")

472

def GetFingerprint(self):

473

"D-Bus getter method"

474

return self.fingerprint

475

476

# GetHost - method

477

@dbus.service.method(_interface, out_signature="s")

478

def GetHost(self):

479

"D-Bus getter method"

480

return self.host

481

482

# GetInterval - method

483

@dbus.service.method(_interface, out_signature="t")

484

def GetInterval(self):

485

"D-Bus getter method"

486

return self._interval_milliseconds

487

488

# GetName - method

489

@dbus.service.method(_interface, out_signature="s")

490

def GetName(self):

491

"D-Bus getter method"

492

return self.name

493

494

# GetStarted - method

495

@dbus.service.method(_interface, out_signature="(nyyyyyu)")

496

def GetStarted(self):

497

"D-Bus getter method"

498

if self.started is not None:

499

return datetime_to_dbus_struct(self.started)

500

else:

501

return dbus.Struct(0, 0, 0, 0, 0, 0, 0,

502

signature="nyyyyyu")

503

504

# GetTimeout - method

505

@dbus.service.method(_interface, out_signature="t")

506

def GetTimeout(self):

507

"D-Bus getter method"

508

return self._timeout_milliseconds

509

510

# SetChecker - method

511

@dbus.service.method(_interface, in_signature="s")

512

def SetChecker(self, checker):

513

"D-Bus setter method"

514

self.checker_command = checker

515

516

# SetHost - method

517

@dbus.service.method(_interface, in_signature="s")

518

def SetHost(self, host):

519

"D-Bus setter method"

520

self.host = host

521

522

# SetInterval - method

523

@dbus.service.method(_interface, in_signature="t")

524

def SetInterval(self, milliseconds):

525

self.interval = datetime.timdeelta(0, 0, 0, milliseconds)

526

527

# SetTimeout - method

528

@dbus.service.method(_interface, in_signature="t")

529

def SetTimeout(self, milliseconds):

530

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

531

532

# SetSecret - method

533

@dbus.service.method(_interface, in_signature="ay",

534

byte_arrays=True)

535

def SetSecret(self, secret):

536

"D-Bus setter method"

537

self.secret = str(secret)

538

539

# Start - method

540

Start = dbus.service.method(_interface)(start)

541

Start.__name__ = "Start"

542

543

# StartChecker - method

544

StartChecker = dbus.service.method(_interface)(start_checker)

545

StartChecker.__name__ = "StartChecker"

546

547

# StateChanged - signal

548

@dbus.service.signal(_interface, signature="b")

549

def StateChanged(self, started):

550

"D-Bus signal"

551

pass

552

553

# StillValid - method

554

StillValid = (dbus.service.method(_interface, out_signature="b")

555

(still_valid))

556

StillValid.__name__ = "StillValid"

557

558

# Stop - method

559

Stop = dbus.service.method(_interface)(stop)

560

Stop.__name__ = "Stop"

561

562

# StopChecker - method

563

StopChecker = dbus.service.method(_interface)(stop_checker)

564

StopChecker.__name__ = "StopChecker"

565

566

# TimeoutChanged - signal

567

@dbus.service.signal(_interface, signature="t")

568

def TimeoutChanged(self, t):

569

"D-Bus signal"

570

pass

571

572

del _datetime_to_dbus_struct

573

del _interface

366

574

367

575

368

576

def peer_certificate(session):

369

577

"Return the peer's OpenPGP certificate as a bytestring"

370

578

# If not an OpenPGP certificate...

371

if gnutls.library.functions.gnutls_certificate_type_get\

372

(session._c_object) \

373

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

579

if (gnutls.library.functions

580

.gnutls_certificate_type_get(session._c_object)

581

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

374

582

# ...do the normal thing

375

583

return session.peer_certificate

376

584

list_size = ctypes.c_uint()

377

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

378

(session._c_object, ctypes.byref(list_size))

585

cert_list = (gnutls.library.functions

586

.gnutls_certificate_get_peers

587

(session._c_object, ctypes.byref(list_size)))

379

588

if list_size.value == 0:

380

589

return None

381

590

cert = cert_list[0]

385

594

def fingerprint(openpgp):

386

595

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

387

596

# New GnuTLS "datum" with the OpenPGP public key

388

datum = gnutls.library.types.gnutls_datum_t\

389

(ctypes.cast(ctypes.c_char_p(openpgp),

390

ctypes.POINTER(ctypes.c_ubyte)),

391

ctypes.c_uint(len(openpgp)))

597

datum = (gnutls.library.types

598

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

599

ctypes.POINTER

600

(ctypes.c_ubyte)),

601

ctypes.c_uint(len(openpgp))))

392

602

# New empty GnuTLS certificate

393

603

crt = gnutls.library.types.gnutls_openpgp_crt_t()

394

gnutls.library.functions.gnutls_openpgp_crt_init\

395

(ctypes.byref(crt))

604

(gnutls.library.functions

605

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

396

606

# Import the OpenPGP public key into the certificate

397

gnutls.library.functions.gnutls_openpgp_crt_import\

398

(crt, ctypes.byref(datum),

399

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

607

(gnutls.library.functions

608

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

609

gnutls.library.constants

610

.GNUTLS_OPENPGP_FMT_RAW))

611

# Verify the self signature in the key

612

crtverify = ctypes.c_uint()

613

(gnutls.library.functions

614

.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))

615

if crtverify.value != 0:

616

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

617

raise gnutls.errors.CertificateSecurityError("Verify failed")

400

618

# New buffer for the fingerprint

401

buffer = ctypes.create_string_buffer(20)

402

buffer_length = ctypes.c_size_t()

619

buf = ctypes.create_string_buffer(20)

620

buf_len = ctypes.c_size_t()

403

621

# Get the fingerprint from the certificate into the buffer

404

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

405

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

622

(gnutls.library.functions

623

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

624

ctypes.byref(buf_len)))

406

625

# Deinit the certificate

407

626

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

408

627

# Convert the buffer to a Python bytestring

409

fpr = ctypes.string_at(buffer, buffer_length.value)

628

fpr = ctypes.string_at(buf, buf_len.value)

410

629

# Convert the bytestring to hexadecimal notation

411

630

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

412

631

return hex_fpr

413

632

414

633

415

class tcp_handler(SocketServer.BaseRequestHandler, object):

634

class TCP_handler(SocketServer.BaseRequestHandler, object):

416

635

"""A TCP request handler class.

417

636

Instantiated by IPv6_TCPServer for each request to handle it.

418

637

Note: This will run in its own forked process."""

419

638

420

639

def handle(self):

421

640

logger.info(u"TCP connection from: %s",

422

unicode(self.client_address))

423

session = gnutls.connection.ClientSession\

424

(self.request, gnutls.connection.X509Credentials())

641

unicode(self.client_address))

642

session = (gnutls.connection

643

.ClientSession(self.request,

644

gnutls.connection

645

.X509Credentials()))

425

646

426

647

line = self.request.makefile().readline()

427

648

logger.debug(u"Protocol version: %r", line)

440

661

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

441

662

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

442

663

# "+DHE-DSS"))

443

priority = "NORMAL" # Fallback default, since this

444

# MUST be set.

445

if self.server.settings["priority"]:

446

priority = self.server.settings["priority"]

447

gnutls.library.functions.gnutls_priority_set_direct\

448

(session._c_object, priority, None);

664

# Use a fallback default, since this MUST be set.

665

priority = self.server.settings.get("priority", "NORMAL")

666

(gnutls.library.functions

667

.gnutls_priority_set_direct(session._c_object,

668

priority, None))

449

669

450

670

try:

451

671

session.handshake()

461

681

session.bye()

462

682

return

463

683

logger.debug(u"Fingerprint: %s", fpr)

464

client = None

465

684

for c in self.server.clients:

466

685

if c.fingerprint == fpr:

467

686

client = c

468

687

break

469

if not client:

688

else:

470

689

logger.warning(u"Client not found for fingerprint: %s",

471

690

fpr)

472

691

session.bye()

479

698

vars(client))

480

699

session.bye()

481

700

return

701

## This won't work here, since we're in a fork.

702

# client.bump_timeout()

482

703

sent_size = 0

483

704

while sent_size < len(client.secret):

484

705

sent = session.send(client.secret[sent_size:])

489

710

session.bye()

490

711

491

712

492

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

713

class IPv6_TCPServer(SocketServer.ForkingMixIn,

714

SocketServer.TCPServer, object):

493

715

"""IPv6 TCP server. Accepts 'None' as address and/or port.

494

716

Attributes:

495

717

settings: Server settings

496

718

clients: Set() of Client objects

719

enabled: Boolean; whether this server is activated yet

497

720

"""

498

721

address_family = socket.AF_INET6

499

722

def __init__(self, *args, **kwargs):

503

726

if "clients" in kwargs:

504

727

self.clients = kwargs["clients"]

505

728

del kwargs["clients"]

506

return super(type(self), self).__init__(*args, **kwargs)

729

self.enabled = False

730

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

507

731

def server_bind(self):

508

732

"""This overrides the normal server_bind() function

509

733

to bind to an interface if one was specified, and also NOT to

538

762

# if_nametoindex

539

763

# (self.settings

540

764

# ["interface"]))

541

return super(type(self), self).server_bind()

765

return super(IPv6_TCPServer, self).server_bind()

766

def server_activate(self):

767

if self.enabled:

768

return super(IPv6_TCPServer, self).server_activate()

769

def enable(self):

770

self.enabled = True

542

771

543

772

544

773

def string_to_delta(interval):

554

783

datetime.timedelta(1)

555

784

>>> string_to_delta(u'1w')

556

785

datetime.timedelta(7)

786

>>> string_to_delta('5m 30s')

787

datetime.timedelta(0, 330)

557

788

"""

558

try:

559

suffix=unicode(interval[-1])

560

value=int(interval[:-1])

561

if suffix == u"d":

562

delta = datetime.timedelta(value)

563

elif suffix == u"s":

564

delta = datetime.timedelta(0, value)

565

elif suffix == u"m":

566

delta = datetime.timedelta(0, 0, 0, 0, value)

567

elif suffix == u"h":

568

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

569

elif suffix == u"w":

570

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

571

else:

789

timevalue = datetime.timedelta(0)

790

for s in interval.split():

791

try:

792

suffix = unicode(s[-1])

793

value = int(s[:-1])

794

if suffix == u"d":

795

delta = datetime.timedelta(value)

796

elif suffix == u"s":

797

delta = datetime.timedelta(0, value)

798

elif suffix == u"m":

799

delta = datetime.timedelta(0, 0, 0, 0, value)

800

elif suffix == u"h":

801

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

802

elif suffix == u"w":

803

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

804

else:

805

raise ValueError

806

except (ValueError, IndexError):

572

807

raise ValueError

573

except (ValueError, IndexError):

574

raise ValueError

575

return delta

808

timevalue += delta

809

return timevalue

576

810

577

811

578

812

def server_state_changed(state):

579

813

"""Derived from the Avahi example code"""

580

814

if state == avahi.SERVER_COLLISION:

581

logger.error(u"Server name collision")

815

logger.error(u"Zeroconf server name collision")

582

816

service.remove()

583

817

elif state == avahi.SERVER_RUNNING:

584

818

service.add()

586

820

587

821

def entry_group_state_changed(state, error):

588

822

"""Derived from the Avahi example code"""

589

logger.debug(u"state change: %i", state)

823

logger.debug(u"Avahi state change: %i", state)

590

824

591

825

if state == avahi.ENTRY_GROUP_ESTABLISHED:

592

logger.debug(u"Service established.")

826

logger.debug(u"Zeroconf service established.")

593

827

elif state == avahi.ENTRY_GROUP_COLLISION:

594

logger.warning(u"Service name collision.")

828

logger.warning(u"Zeroconf service name collision.")

595

829

service.rename()

596

830

elif state == avahi.ENTRY_GROUP_FAILURE:

597

logger.critical(u"Error in group state changed %s",

831

logger.critical(u"Avahi: Error in group state changed %s",

598

832

unicode(error))

599

833

raise AvahiGroupError("State changed: %s", str(error))

600

834

602

836

"""Call the C function if_nametoindex(), or equivalent"""

603

837

global if_nametoindex

604

838

try:

605

if "ctypes.util" not in sys.modules:

606

import ctypes.util

607

if_nametoindex = ctypes.cdll.LoadLibrary\

608

(ctypes.util.find_library("c")).if_nametoindex

839

if_nametoindex = (ctypes.cdll.LoadLibrary

840

(ctypes.util.find_library("c"))

841

.if_nametoindex)

609

842

except (OSError, AttributeError):

610

843

if "struct" not in sys.modules:

611

844

import struct

614

847

def if_nametoindex(interface):

615

848

"Get an interface index the hard way, i.e. using fcntl()"

616

849

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

617

s = socket.socket()

618

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

619

struct.pack("16s16x", interface))

620

s.close()

850

with closing(socket.socket()) as s:

851

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

852

struct.pack("16s16x", interface))

621

853

interface_index = struct.unpack("I", ifreq[16:20])[0]

622

854

return interface_index

623

855

return if_nametoindex(interface)

647

879

648

880

649

881

def main():

650

global main_loop_started

651

main_loop_started = False

652

653

parser = OptionParser()

882

parser = OptionParser(version = "%%prog %s" % version)

654

883

parser.add_option("-i", "--interface", type="string",

655

884

metavar="IF", help="Bind to interface IF")

656

885

parser.add_option("-a", "--address", type="string",

670

899

default="/etc/mandos", metavar="DIR",

671

900

help="Directory to search for configuration"

672

901

" files")

673

(options, args) = parser.parse_args()

902

options = parser.parse_args()[0]

674

903

675

904

if options.check:

676

905

import doctest

691

920

server_config = ConfigParser.SafeConfigParser(server_defaults)

692

921

del server_defaults

693

922

server_config.read(os.path.join(options.configdir, "mandos.conf"))

694

server_section = "server"

695

923

# Convert the SafeConfigParser object to a dict

696

server_settings = dict(server_config.items(server_section))

924

server_settings = server_config.defaults()

697

925

# Use getboolean on the boolean config option

698

server_settings["debug"] = server_config.getboolean\

699

(server_section, "debug")

926

server_settings["debug"] = (server_config.getboolean

927

("DEFAULT", "debug"))

700

928

del server_config

701

929

702

930

# Override the settings from the config file with command line

709

937

del options

710

938

# Now we have our good server settings in "server_settings"

711

939

940

debug = server_settings["debug"]

941

942

if not debug:

943

syslogger.setLevel(logging.WARNING)

944

console.setLevel(logging.WARNING)

945

946

if server_settings["servicename"] != "Mandos":

947

syslogger.setFormatter(logging.Formatter

948

('Mandos (%s): %%(levelname)s:'

949

' %%(message)s'

950

% server_settings["servicename"]))

951

712

952

# Parse config file with clients

713

953

client_defaults = { "timeout": "1h",

714

954

"interval": "5m",

715

"checker": "fping -q -- %%(fqdn)s",

955

"checker": "fping -q -- %(host)s",

956

"host": "",

716

957

}

717

958

client_config = ConfigParser.SafeConfigParser(client_defaults)

718

959

client_config.read(os.path.join(server_settings["configdir"],

719

960

"clients.conf"))

720

961

962

clients = Set()

963

tcp_server = IPv6_TCPServer((server_settings["address"],

964

server_settings["port"]),

965

TCP_handler,

966

settings=server_settings,

967

clients=clients)

968

pidfilename = "/var/run/mandos.pid"

969

try:

970

pidfile = open(pidfilename, "w")

971

except IOError, error:

972

logger.error("Could not open file %r", pidfilename)

973

974

uid = 65534

975

gid = 65534

976

try:

977

uid = pwd.getpwnam("mandos").pw_uid

978

except KeyError:

979

try:

980

uid = pwd.getpwnam("nobody").pw_uid

981

except KeyError:

982

pass

983

try:

984

gid = pwd.getpwnam("mandos").pw_gid

985

except KeyError:

986

try:

987

gid = pwd.getpwnam("nogroup").pw_gid

988

except KeyError:

989

pass

990

try:

991

os.setuid(uid)

992

os.setgid(gid)

993

except OSError, error:

994

if error[0] != errno.EPERM:

995

raise error

996

721

997

global service

722

998

service = AvahiService(name = server_settings["servicename"],

723

type = "_mandos._tcp", );

999

servicetype = "_mandos._tcp", )

724

1000

if server_settings["interface"]:

725

service.interface = if_nametoindex(server_settings["interface"])

1001

service.interface = (if_nametoindex

1002

(server_settings["interface"]))

726

1003

727

1004

global main_loop

728

1005

global bus

731

1008

DBusGMainLoop(set_as_default=True )

732

1009

main_loop = gobject.MainLoop()

733

1010

bus = dbus.SystemBus()

734

server = dbus.Interface(

735

bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),

736

avahi.DBUS_INTERFACE_SERVER )

1011

server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,

1012

avahi.DBUS_PATH_SERVER),

1013

avahi.DBUS_INTERFACE_SERVER)

737

1014

# End of Avahi example code

738

739

debug = server_settings["debug"]

740

741

if debug:

742

console = logging.StreamHandler()

743

# console.setLevel(logging.DEBUG)

744

console.setFormatter(logging.Formatter\

745

('%(levelname)s: %(message)s'))

746

logger.addHandler(console)

747

del console

748

749

clients = Set()

1015

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)

1016

750

1017

def remove_from_clients(client):

751

1018

clients.remove(client)

752

1019

if not clients:

758

1025

config

759

1026

= dict(client_config.items(section)))

760

1027

for section in client_config.sections()))

1028

if not clients:

1029

logger.critical(u"No clients defined")

1030

sys.exit(1)

761

1031

762

if not debug:

1032

if debug:

1033

# Redirect stdin so all checkers get /dev/null

1034

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1035

os.dup2(null, sys.stdin.fileno())

1036

if null > 2:

1037

os.close(null)

1038

else:

1039

# No console logging

1040

logger.removeHandler(console)

1041

# Close all input and output, do double fork, etc.

763

1042

daemon()

764

765

pidfilename = "/var/run/mandos/mandos.pid"

766

pid = os.getpid()

1043

767

1044

try:

768

pidfile = open(pidfilename, "w")

1045

pid = os.getpid()

769

1046

pidfile.write(str(pid) + "\n")

770

1047

pidfile.close()

771

1048

del pidfile

772

except IOError, err:

773

logger.error("Could not write %s file with PID %d",

774

pidfilename, os.getpid())

1049

except IOError:

1050

logger.error(u"Could not write to file %r with PID %d",

1051

pidfilename, pid)

1052

except NameError:

1053

# "pidfile" was never created

1054

pass

1055

del pidfilename

775

1056

776

1057

def cleanup():

777

1058

"Cleanup function; run on exit"

797

1078

for client in clients:

798

1079

client.start()

799

1080

800

tcp_server = IPv6_TCPServer((server_settings["address"],

801

server_settings["port"]),

802

tcp_handler,

803

settings=server_settings,

804

clients=clients)

1081

tcp_server.enable()

1082

tcp_server.server_activate()

1083

805

1084

# Find out what port we got

806

1085

service.port = tcp_server.socket.getsockname()[1]

807

1086

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

821

1100

822

1101

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

823

1102

lambda *args, **kwargs:

824

tcp_server.handle_request\

825

(*args[2:], **kwargs) or True)

1103

(tcp_server.handle_request

1104

(*args[2:], **kwargs) or True))

826

1105

827

logger.debug("Starting main loop")

828

main_loop_started = True

1106

logger.debug(u"Starting main loop")

829

1107

main_loop.run()

830

1108

except AvahiError, error:

831

1109

logger.critical(u"AvahiError: %s" + unicode(error))