To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 24.1.123
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.123
- Committer: Björn Påhlsson
- Date: 2009-01-16 23:19:44 UTC
- mfrom: (271 mandos)
- mto: (24.1.154 mandos) (237.4.3 mandos-release)
- mto: This revision was merged to the branch mainline in revision 291.
- Revision ID: belorn@braxen-20090116231944-qw97sandjaohrywo
merge
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- etc-plugins.d-README
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
30
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
32
#
32
33
33
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
34
35
35
36
import SocketServer
36
37
import socket
37
import select
38
from optparse import OptionParser
38
import optparse
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
56
56
import logging
57
57
import logging.handlers
58
58
import pwd
59
from contextlib import closing
59
60
60
61
import dbus
62
import dbus.service
61
63
import gobject
62
64
import avahi
63
65
from dbus.mainloop.glib import DBusGMainLoop
64
66
import ctypes
67
import ctypes.util
65
68
66
version = "1.0"
69
version = "1.0.4"
67
70
68
71
logger = logging.Logger('mandos')
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
74
77
logger.addHandler(syslogger)
75
78
76
79
console = logging.StreamHandler()
79
82
logger.addHandler(console)
80
83
81
84
class AvahiError(Exception):
82
def __init__(self, value):
85
def __init__(self, value, *args, **kwargs):
83
86
self.value = value
84
def __str__(self):
85
return repr(self.value)
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
86
90
87
91
class AvahiServiceError(AvahiError):
88
92
pass
108
112
a sensible number of times
109
113
"""
110
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
111
type = None, port = None, TXT = None, domain = "",
112
host = "", max_renames = 32768):
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
113
117
self.interface = interface
114
118
self.name = name
115
self.type = type
119
self.type = servicetype
116
120
self.port = port
117
if TXT is None:
118
self.TXT = []
119
else:
120
self.TXT = TXT
121
self.TXT = TXT if TXT is not None else []
121
122
self.domain = domain
122
123
self.host = host
123
124
self.rename_count = 0
127
128
if self.rename_count >= self.max_renames:
128
129
logger.critical(u"No suitable Zeroconf service name found"
129
130
u" after %i retries, exiting.",
130
rename_count)
131
raise AvahiServiceError("Too many renames")
131
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
132
133
self.name = server.GetAlternativeServiceName(self.name)
133
134
logger.info(u"Changing Zeroconf service name to %r ...",
134
135
str(self.name))
135
syslogger.setFormatter(logging.Formatter\
136
syslogger.setFormatter(logging.Formatter
136
137
('Mandos (%s): %%(levelname)s:'
137
' %%(message)s' % self.name))
138
' %%(message)s' % self.name))
138
139
self.remove()
139
140
self.add()
140
141
self.rename_count += 1
146
147
"""Derived from the Avahi example code"""
147
148
global group
148
149
if group is None:
149
group = dbus.Interface\
150
(bus.get_object(avahi.DBUS_NAME,
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
151
152
server.EntryGroupNew()),
152
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
154
group.connect_to_signal('StateChanged',
154
155
entry_group_state_changed)
155
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
169
170
# End of Avahi example code
170
171
171
172
172
class Client(object):
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
173
179
"""A representation of a client host served by this server.
174
180
Attributes:
175
name: string; from the config file, used in log messages
181
name: string; from the config file, used in log messages
176
182
fingerprint: string (40 or 32 hexadecimal digits); used to
177
183
uniquely identify the client
178
secret: bytestring; sent verbatim (over TLS) to client
179
host: string; available for use by the checker command
180
created: datetime.datetime(); object creation, not client host
181
last_checked_ok: datetime.datetime() or None if not yet checked OK
182
timeout: datetime.timedelta(); How long from last_checked_ok
183
until this client is invalid
184
interval: datetime.timedelta(); How often to start a new checker
185
stop_hook: If set, called by stop() as stop_hook(self)
186
checker: subprocess.Popen(); a running checker process used
187
to see if the client lives.
188
'None' if no process is running.
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
189
197
checker_initiator_tag: a gobject event source tag, or None
190
stop_initiator_tag: - '' -
198
disable_initiator_tag: - '' -
191
199
checker_callback_tag: - '' -
192
200
checker_command: string; External command which is run to check if
193
201
client lives. %() expansions are done at
194
202
runtime with vars(self) as dict, so that for
195
203
instance %(name)s can be used in the command.
196
Private attibutes:
197
_timeout: Real variable for 'timeout'
198
_interval: Real variable for 'interval'
199
_timeout_milliseconds: Used when calling gobject.timeout_add()
200
_interval_milliseconds: - '' -
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
201
206
"""
202
def _set_timeout(self, timeout):
203
"Setter function for 'timeout' attribute"
204
self._timeout = timeout
205
self._timeout_milliseconds = ((self.timeout.days
206
* 24 * 60 * 60 * 1000)
207
+ (self.timeout.seconds * 1000)
208
+ (self.timeout.microseconds
209
// 1000))
210
timeout = property(lambda self: self._timeout,
211
_set_timeout)
212
del _set_timeout
213
def _set_interval(self, interval):
214
"Setter function for 'interval' attribute"
215
self._interval = interval
216
self._interval_milliseconds = ((self.interval.days
217
* 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds
219
* 1000)
220
+ (self.interval.microseconds
221
// 1000))
222
interval = property(lambda self: self._interval,
223
_set_interval)
224
del _set_interval
225
def __init__(self, name = None, stop_hook=None, config={}):
207
def timeout_milliseconds(self):
208
"Return the 'timeout' attribute in milliseconds"
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
212
213
def interval_milliseconds(self):
214
"Return the 'interval' attribute in milliseconds"
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
218
219
def __init__(self, name = None, disable_hook=None, config=None,
220
use_dbus=True):
226
221
"""Note: the 'checker' key in 'config' sets the
227
222
'checker_command' attribute and *not* the 'checker'
228
223
attribute."""
229
224
self.name = name
225
if config is None:
226
config = {}
230
227
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
229
if self.use_dbus:
230
self.dbus_object_path = (dbus.ObjectPath
231
("/Mandos/clients/"
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
231
235
# Uppercase and remove spaces from fingerprint for later
232
236
# comparison purposes with return value from the fingerprint()
233
237
# function
234
self.fingerprint = config["fingerprint"].upper()\
235
.replace(u" ", u"")
238
self.fingerprint = (config["fingerprint"].upper()
239
.replace(u" ", u""))
236
240
logger.debug(u" Fingerprint: %s", self.fingerprint)
237
241
if "secret" in config:
238
242
self.secret = config["secret"].decode(u"base64")
239
243
elif "secfile" in config:
240
sf = open(config["secfile"])
241
self.secret = sf.read()
242
sf.close()
244
with closing(open(os.path.expanduser
245
(os.path.expandvars
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
243
248
else:
244
249
raise TypeError(u"No secret or secfile for client %s"
245
250
% self.name)
246
251
self.host = config.get("host", "")
247
self.created = datetime.datetime.now()
252
self.created = datetime.datetime.utcnow()
253
self.enabled = False
254
self.last_enabled = None
248
255
self.last_checked_ok = None
249
256
self.timeout = string_to_delta(config["timeout"])
250
257
self.interval = string_to_delta(config["interval"])
251
self.stop_hook = stop_hook
258
self.disable_hook = disable_hook
252
259
self.checker = None
253
260
self.checker_initiator_tag = None
254
self.stop_initiator_tag = None
261
self.disable_initiator_tag = None
255
262
self.checker_callback_tag = None
256
self.check_command = config["checker"]
257
def start(self):
263
self.checker_command = config["checker"]
264
265
def enable(self):
258
266
"""Start this client's checker and timeout hooks"""
267
self.last_enabled = datetime.datetime.utcnow()
259
268
# Schedule a new checker to be started an 'interval' from now,
260
269
# and every interval from then on.
261
self.checker_initiator_tag = gobject.timeout_add\
262
(self._interval_milliseconds,
263
self.start_checker)
270
self.checker_initiator_tag = (gobject.timeout_add
271
(self.interval_milliseconds(),
272
self.start_checker))
264
273
# Also start a new checker *right now*.
265
274
self.start_checker()
266
# Schedule a stop() when 'timeout' has passed
267
self.stop_initiator_tag = gobject.timeout_add\
268
(self._timeout_milliseconds,
269
self.stop)
270
def stop(self):
271
"""Stop this client.
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
274
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
276
logger.info(u"Stopping client %s", self.name)
277
self.secret = None
278
else:
275
# Schedule a disable() when 'timeout' has passed
276
self.disable_initiator_tag = (gobject.timeout_add
277
(self.timeout_milliseconds(),
278
self.disable))
279
self.enabled = True
280
if self.use_dbus:
281
# Emit D-Bus signals
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
286
variant_level=1)))
287
288
def disable(self):
289
"""Disable this client."""
290
if not getattr(self, "enabled", False):
279
291
return False
280
if getattr(self, "stop_initiator_tag", False):
281
gobject.source_remove(self.stop_initiator_tag)
282
self.stop_initiator_tag = None
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
294
gobject.source_remove(self.disable_initiator_tag)
295
self.disable_initiator_tag = None
283
296
if getattr(self, "checker_initiator_tag", False):
284
297
gobject.source_remove(self.checker_initiator_tag)
285
298
self.checker_initiator_tag = None
286
299
self.stop_checker()
287
if self.stop_hook:
288
self.stop_hook(self)
300
if self.disable_hook:
301
self.disable_hook(self)
302
self.enabled = False
303
if self.use_dbus:
304
# Emit D-Bus signal
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
289
307
# Do not run this again if called by a gobject.timeout_add
290
308
return False
309
291
310
def __del__(self):
292
self.stop_hook = None
293
self.stop()
294
def checker_callback(self, pid, condition):
311
self.disable_hook = None
312
self.disable()
313
314
def checker_callback(self, pid, condition, command):
295
315
"""The checker has completed, so take appropriate actions."""
296
now = datetime.datetime.now()
297
316
self.checker_callback_tag = None
298
317
self.checker = None
299
if os.WIFEXITED(condition) \
300
and (os.WEXITSTATUS(condition) == 0):
318
if self.use_dbus:
319
# Emit D-Bus signal
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
301
324
logger.info(u"Checker for %(name)s succeeded",
302
325
vars(self))
303
self.last_checked_ok = now
304
gobject.source_remove(self.stop_initiator_tag)
305
self.stop_initiator_tag = gobject.timeout_add\
306
(self._timeout_milliseconds,
307
self.stop)
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
331
self.bump_timeout()
308
332
elif not os.WIFEXITED(condition):
309
333
logger.warning(u"Checker for %(name)s crashed?",
310
334
vars(self))
335
if self.use_dbus:
336
# Emit D-Bus signal
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
311
340
else:
312
341
logger.info(u"Checker for %(name)s failed",
313
342
vars(self))
343
if self.use_dbus:
344
# Emit D-Bus signal
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
348
349
def bump_timeout(self):
350
"""Bump up the timeout for this client.
351
This should only be called when the client has been seen,
352
alive and well.
353
"""
354
self.last_checked_ok = datetime.datetime.utcnow()
355
gobject.source_remove(self.disable_initiator_tag)
356
self.disable_initiator_tag = (gobject.timeout_add
357
(self.timeout_milliseconds(),
358
self.disable))
359
if self.use_dbus:
360
# Emit D-Bus signal
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
364
variant_level=1)))
365
314
366
def start_checker(self):
315
367
"""Start a new checker subprocess if one is not running.
316
368
If a checker already exists, leave it running and do
325
377
# is as it should be.
326
378
if self.checker is None:
327
379
try:
328
# In case check_command has exactly one % operator
329
command = self.check_command % self.host
380
# In case checker_command has exactly one % operator
381
command = self.checker_command % self.host
330
382
except TypeError:
331
383
# Escape attributes for the shell
332
384
escaped_attrs = dict((key, re.escape(str(val)))
333
385
for key, val in
334
386
vars(self).iteritems())
335
387
try:
336
command = self.check_command % escaped_attrs
388
command = self.checker_command % escaped_attrs
337
389
except TypeError, error:
338
390
logger.error(u'Could not format string "%s":'
339
u' %s', self.check_command, error)
391
u' %s', self.checker_command, error)
340
392
return True # Try again later
341
393
try:
342
394
logger.info(u"Starting checker %r for %s",
348
400
self.checker = subprocess.Popen(command,
349
401
close_fds=True,
350
402
shell=True, cwd="/")
351
self.checker_callback_tag = gobject.child_watch_add\
352
(self.checker.pid,
353
self.checker_callback)
403
if self.use_dbus:
404
# Emit D-Bus signal
405
self.CheckerStarted(command)
406
self.PropertyChanged(
407
dbus.String("checker_running"),
408
dbus.Boolean(True, variant_level=1))
409
self.checker_callback_tag = (gobject.child_watch_add
410
(self.checker.pid,
411
self.checker_callback,
412
data=command))
354
413
except OSError, error:
355
414
logger.error(u"Failed to start subprocess: %s",
356
415
error)
357
416
# Re-run this periodically if run by gobject.timeout_add
358
417
return True
418
359
419
def stop_checker(self):
360
420
"""Force the checker process, if any, to stop."""
361
421
if self.checker_callback_tag:
373
433
if error.errno != errno.ESRCH: # No such process
374
434
raise
375
435
self.checker = None
436
if self.use_dbus:
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
439
376
440
def still_valid(self):
377
441
"""Has the timeout not yet passed for this client?"""
378
now = datetime.datetime.now()
442
if not getattr(self, "enabled", False):
443
return False
444
now = datetime.datetime.utcnow()
379
445
if self.last_checked_ok is None:
380
446
return now < (self.created + self.timeout)
381
447
else:
382
448
return now < (self.last_checked_ok + self.timeout)
449
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
452
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
456
457
# CheckerCompleted - signal
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
460
"D-Bus signal"
461
pass
462
463
# CheckerStarted - signal
464
@dbus.service.signal(_interface, signature="s")
465
def CheckerStarted(self, command):
466
"D-Bus signal"
467
pass
468
469
# GetAllProperties - method
470
@dbus.service.method(_interface, out_signature="a{sv}")
471
def GetAllProperties(self):
472
"D-Bus method"
473
return dbus.Dictionary({
474
dbus.String("name"):
475
dbus.String(self.name, variant_level=1),
476
dbus.String("fingerprint"):
477
dbus.String(self.fingerprint, variant_level=1),
478
dbus.String("host"):
479
dbus.String(self.host, variant_level=1),
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
484
variant_level=1)
485
if self.last_enabled is not None
486
else dbus.Boolean(False, variant_level=1)),
487
dbus.String("enabled"):
488
dbus.Boolean(self.enabled, variant_level=1),
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
491
variant_level=1)
492
if self.last_checked_ok is not None
493
else dbus.Boolean (False, variant_level=1)),
494
dbus.String("timeout"):
495
dbus.UInt64(self.timeout_milliseconds(),
496
variant_level=1),
497
dbus.String("interval"):
498
dbus.UInt64(self.interval_milliseconds(),
499
variant_level=1),
500
dbus.String("checker"):
501
dbus.String(self.checker_command,
502
variant_level=1),
503
dbus.String("checker_running"):
504
dbus.Boolean(self.checker is not None,
505
variant_level=1),
506
}, signature="sv")
507
508
# IsStillValid - method
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
510
(still_valid))
511
IsStillValid.__name__ = "IsStillValid"
512
513
# PropertyChanged - signal
514
@dbus.service.signal(_interface, signature="sv")
515
def PropertyChanged(self, property, value):
516
"D-Bus signal"
517
pass
518
519
# SetChecker - method
520
@dbus.service.method(_interface, in_signature="s")
521
def SetChecker(self, checker):
522
"D-Bus setter method"
523
self.checker_command = checker
524
# Emit D-Bus signal
525
self.PropertyChanged(dbus.String(u"checker"),
526
dbus.String(self.checker_command,
527
variant_level=1))
528
529
# SetHost - method
530
@dbus.service.method(_interface, in_signature="s")
531
def SetHost(self, host):
532
"D-Bus setter method"
533
self.host = host
534
# Emit D-Bus signal
535
self.PropertyChanged(dbus.String(u"host"),
536
dbus.String(self.host, variant_level=1))
537
538
# SetInterval - method
539
@dbus.service.method(_interface, in_signature="t")
540
def SetInterval(self, milliseconds):
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
542
# Emit D-Bus signal
543
self.PropertyChanged(dbus.String(u"interval"),
544
(dbus.UInt64(self.interval_milliseconds(),
545
variant_level=1)))
546
547
# SetSecret - method
548
@dbus.service.method(_interface, in_signature="ay",
549
byte_arrays=True)
550
def SetSecret(self, secret):
551
"D-Bus setter method"
552
self.secret = str(secret)
553
554
# SetTimeout - method
555
@dbus.service.method(_interface, in_signature="t")
556
def SetTimeout(self, milliseconds):
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
558
# Emit D-Bus signal
559
self.PropertyChanged(dbus.String(u"timeout"),
560
(dbus.UInt64(self.timeout_milliseconds(),
561
variant_level=1)))
562
563
# Enable - method
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
566
567
# StartChecker - method
568
@dbus.service.method(_interface)
569
def StartChecker(self):
570
"D-Bus method"
571
self.start_checker()
572
573
# Disable - method
574
@dbus.service.method(_interface)
575
def Disable(self):
576
"D-Bus method"
577
self.disable()
578
579
# StopChecker - method
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
582
583
del _interface
383
584
384
585
385
586
def peer_certificate(session):
386
587
"Return the peer's OpenPGP certificate as a bytestring"
387
588
# If not an OpenPGP certificate...
388
if gnutls.library.functions.gnutls_certificate_type_get\
389
(session._c_object) \
390
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
391
592
# ...do the normal thing
392
593
return session.peer_certificate
393
594
list_size = ctypes.c_uint()
394
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
(session._c_object, ctypes.byref(list_size))
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
396
598
if list_size.value == 0:
397
599
return None
398
600
cert = cert_list[0]
402
604
def fingerprint(openpgp):
403
605
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
404
606
# New GnuTLS "datum" with the OpenPGP public key
405
datum = gnutls.library.types.gnutls_datum_t\
406
(ctypes.cast(ctypes.c_char_p(openpgp),
407
ctypes.POINTER(ctypes.c_ubyte)),
408
ctypes.c_uint(len(openpgp)))
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
609
ctypes.POINTER
610
(ctypes.c_ubyte)),
611
ctypes.c_uint(len(openpgp))))
409
612
# New empty GnuTLS certificate
410
613
crt = gnutls.library.types.gnutls_openpgp_crt_t()
411
gnutls.library.functions.gnutls_openpgp_crt_init\
412
(ctypes.byref(crt))
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
413
616
# Import the OpenPGP public key into the certificate
414
gnutls.library.functions.gnutls_openpgp_crt_import\
415
(crt, ctypes.byref(datum),
416
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
417
621
# Verify the self signature in the key
418
crtverify = ctypes.c_uint();
419
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
(crt, 0, ctypes.byref(crtverify))
622
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
421
625
if crtverify.value != 0:
422
626
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
423
627
raise gnutls.errors.CertificateSecurityError("Verify failed")
424
628
# New buffer for the fingerprint
425
buffer = ctypes.create_string_buffer(20)
426
buffer_length = ctypes.c_size_t()
629
buf = ctypes.create_string_buffer(20)
630
buf_len = ctypes.c_size_t()
427
631
# Get the fingerprint from the certificate into the buffer
428
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
430
635
# Deinit the certificate
431
636
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
432
637
# Convert the buffer to a Python bytestring
433
fpr = ctypes.string_at(buffer, buffer_length.value)
638
fpr = ctypes.string_at(buf, buf_len.value)
434
639
# Convert the bytestring to hexadecimal notation
435
640
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
436
641
return hex_fpr
437
642
438
643
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
644
class TCP_handler(SocketServer.BaseRequestHandler, object):
440
645
"""A TCP request handler class.
441
646
Instantiated by IPv6_TCPServer for each request to handle it.
442
647
Note: This will run in its own forked process."""
443
648
444
649
def handle(self):
445
650
logger.info(u"TCP connection from: %s",
446
unicode(self.client_address))
447
session = gnutls.connection.ClientSession\
448
(self.request, gnutls.connection.X509Credentials())
651
unicode(self.client_address))
652
session = (gnutls.connection
653
.ClientSession(self.request,
654
gnutls.connection
655
.X509Credentials()))
449
656
450
657
line = self.request.makefile().readline()
451
658
logger.debug(u"Protocol version: %r", line)
464
671
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
465
672
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
466
673
# "+DHE-DSS"))
467
priority = "NORMAL" # Fallback default, since this
468
# MUST be set.
469
if self.server.settings["priority"]:
470
priority = self.server.settings["priority"]
471
gnutls.library.functions.gnutls_priority_set_direct\
472
(session._c_object, priority, None);
674
# Use a fallback default, since this MUST be set.
675
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
678
priority, None))
473
679
474
680
try:
475
681
session.handshake()
485
691
session.bye()
486
692
return
487
693
logger.debug(u"Fingerprint: %s", fpr)
488
client = None
489
694
for c in self.server.clients:
490
695
if c.fingerprint == fpr:
491
696
client = c
492
697
break
493
if not client:
698
else:
494
699
logger.warning(u"Client not found for fingerprint: %s",
495
700
fpr)
496
701
session.bye()
503
708
vars(client))
504
709
session.bye()
505
710
return
711
## This won't work here, since we're in a fork.
712
# client.bump_timeout()
506
713
sent_size = 0
507
714
while sent_size < len(client.secret):
508
715
sent = session.send(client.secret[sent_size:])
513
720
session.bye()
514
721
515
722
516
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
724
SocketServer.TCPServer, object):
517
725
"""IPv6 TCP server. Accepts 'None' as address and/or port.
518
726
Attributes:
519
727
settings: Server settings
529
737
self.clients = kwargs["clients"]
530
738
del kwargs["clients"]
531
739
self.enabled = False
532
return super(type(self), self).__init__(*args, **kwargs)
740
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
533
741
def server_bind(self):
534
742
"""This overrides the normal server_bind() function
535
743
to bind to an interface if one was specified, and also NOT to
564
772
# if_nametoindex
565
773
# (self.settings
566
774
# ["interface"]))
567
return super(type(self), self).server_bind()
775
return super(IPv6_TCPServer, self).server_bind()
568
776
def server_activate(self):
569
777
if self.enabled:
570
return super(type(self), self).server_activate()
778
return super(IPv6_TCPServer, self).server_activate()
571
779
def enable(self):
572
780
self.enabled = True
573
781
591
799
timevalue = datetime.timedelta(0)
592
800
for s in interval.split():
593
801
try:
594
suffix=unicode(s[-1])
595
value=int(s[:-1])
802
suffix = unicode(s[-1])
803
value = int(s[:-1])
596
804
if suffix == u"d":
597
805
delta = datetime.timedelta(value)
598
806
elif suffix == u"s":
632
840
elif state == avahi.ENTRY_GROUP_FAILURE:
633
841
logger.critical(u"Avahi: Error in group state changed %s",
634
842
unicode(error))
635
raise AvahiGroupError("State changed: %s", str(error))
843
raise AvahiGroupError(u"State changed: %s" % unicode(error))
636
844
637
845
def if_nametoindex(interface):
638
846
"""Call the C function if_nametoindex(), or equivalent"""
639
847
global if_nametoindex
640
848
try:
641
if "ctypes.util" not in sys.modules:
642
import ctypes.util
643
if_nametoindex = ctypes.cdll.LoadLibrary\
644
(ctypes.util.find_library("c")).if_nametoindex
849
if_nametoindex = (ctypes.cdll.LoadLibrary
850
(ctypes.util.find_library("c"))
851
.if_nametoindex)
645
852
except (OSError, AttributeError):
646
853
if "struct" not in sys.modules:
647
854
import struct
650
857
def if_nametoindex(interface):
651
858
"Get an interface index the hard way, i.e. using fcntl()"
652
859
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
653
s = socket.socket()
654
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
655
struct.pack("16s16x", interface))
656
s.close()
860
with closing(socket.socket()) as s:
861
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
862
struct.pack("16s16x", interface))
657
863
interface_index = struct.unpack("I", ifreq[16:20])[0]
658
864
return interface_index
659
865
return if_nametoindex(interface)
683
889
684
890
685
891
def main():
686
global main_loop_started
687
main_loop_started = False
688
689
parser = OptionParser(version = "%%prog %s" % version)
892
parser = optparse.OptionParser(version = "%%prog %s" % version)
690
893
parser.add_option("-i", "--interface", type="string",
691
894
metavar="IF", help="Bind to interface IF")
692
895
parser.add_option("-a", "--address", type="string",
693
896
help="Address to listen for requests on")
694
897
parser.add_option("-p", "--port", type="int",
695
898
help="Port number to receive requests on")
696
parser.add_option("--check", action="store_true", default=False,
899
parser.add_option("--check", action="store_true",
697
900
help="Run self-test")
698
901
parser.add_option("--debug", action="store_true",
699
902
help="Debug mode; run in foreground and log to"
706
909
default="/etc/mandos", metavar="DIR",
707
910
help="Directory to search for configuration"
708
911
" files")
709
(options, args) = parser.parse_args()
912
parser.add_option("--no-dbus", action="store_false",
913
dest="use_dbus",
914
help="Do not provide D-Bus system bus"
915
" interface")
916
options = parser.parse_args()[0]
710
917
711
918
if options.check:
712
919
import doctest
721
928
"priority":
722
929
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
723
930
"servicename": "Mandos",
931
"use_dbus": "True",
724
932
}
725
933
726
934
# Parse config file for server-global settings
729
937
server_config.read(os.path.join(options.configdir, "mandos.conf"))
730
938
# Convert the SafeConfigParser object to a dict
731
939
server_settings = server_config.defaults()
732
# Use getboolean on the boolean config option
733
server_settings["debug"] = server_config.getboolean\
734
("DEFAULT", "debug")
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
735
945
del server_config
736
946
737
947
# Override the settings from the config file with command line
738
948
# options, if set.
739
949
for option in ("interface", "address", "port", "debug",
740
"priority", "servicename", "configdir"):
950
"priority", "servicename", "configdir",
951
"use_dbus"):
741
952
value = getattr(options, option)
742
953
if value is not None:
743
954
server_settings[option] = value
744
955
del options
745
956
# Now we have our good server settings in "server_settings"
746
957
958
# For convenience
747
959
debug = server_settings["debug"]
960
use_dbus = server_settings["use_dbus"]
748
961
749
962
if not debug:
750
963
syslogger.setLevel(logging.WARNING)
751
964
console.setLevel(logging.WARNING)
752
965
753
966
if server_settings["servicename"] != "Mandos":
754
syslogger.setFormatter(logging.Formatter\
967
syslogger.setFormatter(logging.Formatter
755
968
('Mandos (%s): %%(levelname)s:'
756
969
' %%(message)s'
757
970
% server_settings["servicename"]))
759
972
# Parse config file with clients
760
973
client_defaults = { "timeout": "1h",
761
974
"interval": "5m",
762
"checker": "fping -q -- %(host)s",
975
"checker": "fping -q -- %%(host)s",
763
976
"host": "",
764
977
}
765
978
client_config = ConfigParser.SafeConfigParser(client_defaults)
769
982
clients = Set()
770
983
tcp_server = IPv6_TCPServer((server_settings["address"],
771
984
server_settings["port"]),
772
tcp_handler,
985
TCP_handler,
773
986
settings=server_settings,
774
987
clients=clients)
775
988
pidfilename = "/var/run/mandos.pid"
778
991
except IOError, error:
779
992
logger.error("Could not open file %r", pidfilename)
780
993
781
uid = 65534
782
gid = 65534
783
try:
784
uid = pwd.getpwnam("mandos").pw_uid
785
except KeyError:
786
try:
787
uid = pwd.getpwnam("nobody").pw_uid
788
except KeyError:
789
pass
790
try:
791
gid = pwd.getpwnam("mandos").pw_gid
792
except KeyError:
793
try:
794
gid = pwd.getpwnam("nogroup").pw_gid
795
except KeyError:
796
pass
994
try:
995
uid = pwd.getpwnam("_mandos").pw_uid
996
gid = pwd.getpwnam("_mandos").pw_gid
997
except KeyError:
998
try:
999
uid = pwd.getpwnam("mandos").pw_uid
1000
gid = pwd.getpwnam("mandos").pw_gid
1001
except KeyError:
1002
try:
1003
uid = pwd.getpwnam("nobody").pw_uid
1004
gid = pwd.getpwnam("nogroup").pw_gid
1005
except KeyError:
1006
uid = 65534
1007
gid = 65534
797
1008
try:
798
1009
os.setuid(uid)
799
1010
os.setgid(gid)
803
1014
804
1015
global service
805
1016
service = AvahiService(name = server_settings["servicename"],
806
type = "_mandos._tcp", );
1017
servicetype = "_mandos._tcp", )
807
1018
if server_settings["interface"]:
808
service.interface = if_nametoindex\
809
(server_settings["interface"])
1019
service.interface = (if_nametoindex
1020
(server_settings["interface"]))
810
1021
811
1022
global main_loop
812
1023
global bus
819
1030
avahi.DBUS_PATH_SERVER),
820
1031
avahi.DBUS_INTERFACE_SERVER)
821
1032
# End of Avahi example code
822
823
def remove_from_clients(client):
824
clients.remove(client)
825
if not clients:
826
logger.critical(u"No clients left, exiting")
827
sys.exit()
1033
if use_dbus:
1034
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1035
bus)
828
1036
829
1037
clients.update(Set(Client(name = section,
830
stop_hook = remove_from_clients,
831
1038
config
832
= dict(client_config.items(section)))
1039
= dict(client_config.items(section)),
1040
use_dbus = use_dbus)
833
1041
for section in client_config.sections()))
834
1042
if not clients:
835
logger.critical(u"No clients defined")
836
sys.exit(1)
1043
logger.warning(u"No clients defined")
837
1044
838
1045
if debug:
839
1046
# Redirect stdin so all checkers get /dev/null
852
1059
pidfile.write(str(pid) + "\n")
853
1060
pidfile.close()
854
1061
del pidfile
855
except IOError, err:
1062
except IOError:
856
1063
logger.error(u"Could not write to file %r with PID %d",
857
1064
pidfilename, pid)
858
1065
except NameError:
871
1078
872
1079
while clients:
873
1080
client = clients.pop()
874
client.stop_hook = None
875
client.stop()
1081
client.disable_hook = None
1082
client.disable()
876
1083
877
1084
atexit.register(cleanup)
878
1085
881
1088
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
882
1089
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
883
1090
1091
if use_dbus:
1092
class MandosServer(dbus.service.Object):
1093
"""A D-Bus proxy object"""
1094
def __init__(self):
1095
dbus.service.Object.__init__(self, bus,
1096
"/Mandos")
1097
_interface = u"org.mandos_system.Mandos"
1098
1099
@dbus.service.signal(_interface, signature="oa{sv}")
1100
def ClientAdded(self, objpath, properties):
1101
"D-Bus signal"
1102
pass
1103
1104
@dbus.service.signal(_interface, signature="o")
1105
def ClientRemoved(self, objpath):
1106
"D-Bus signal"
1107
pass
1108
1109
@dbus.service.method(_interface, out_signature="ao")
1110
def GetAllClients(self):
1111
return dbus.Array(c.dbus_object_path for c in clients)
1112
1113
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1114
def GetAllClientsWithProperties(self):
1115
return dbus.Dictionary(
1116
((c.dbus_object_path, c.GetAllProperties())
1117
for c in clients),
1118
signature="oa{sv}")
1119
1120
@dbus.service.method(_interface, in_signature="o")
1121
def RemoveClient(self, object_path):
1122
for c in clients:
1123
if c.dbus_object_path == object_path:
1124
clients.remove(c)
1125
# Don't signal anything except ClientRemoved
1126
c.use_dbus = False
1127
c.disable()
1128
# Emit D-Bus signal
1129
self.ClientRemoved(object_path)
1130
return
1131
raise KeyError
1132
@dbus.service.method(_interface)
1133
def Quit(self):
1134
main_loop.quit()
1135
1136
del _interface
1137
1138
mandos_server = MandosServer()
1139
884
1140
for client in clients:
885
client.start()
1141
if use_dbus:
1142
# Emit D-Bus signal
1143
mandos_server.ClientAdded(client.dbus_object_path,
1144
client.GetAllProperties())
1145
client.enable()
886
1146
887
1147
tcp_server.enable()
888
1148
tcp_server.server_activate()
906
1166
907
1167
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
908
1168
lambda *args, **kwargs:
909
tcp_server.handle_request\
910
(*args[2:], **kwargs) or True)
1169
(tcp_server.handle_request
1170
(*args[2:], **kwargs) or True))
911
1171
912
1172
logger.debug(u"Starting main loop")
913
main_loop_started = True
914
1173
main_loop.run()
915
1174
except AvahiError, error:
916
logger.critical(u"AvahiError: %s" + unicode(error))
1175
logger.critical(u"AvahiError: %s", error)
917
1176
sys.exit(1)
918
1177
except KeyboardInterrupt:
919
1178
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0