To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 24.1.129
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.129
- Committer: Björn Påhlsson
- Date: 2009-01-20 02:33:43 UTC
- mfrom: (280 mandos)
- mto: (24.1.154 mandos) (237.4.3 mandos-release)
- mto: This revision was merged to the branch mainline in revision 291.
- Revision ID: belorn@braxen-20090120023343-0zeh3wkm35zn80nv
merge
- files modified:
- INSTALL
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
34
34
from __future__ import division, with_statement, absolute_import
35
35
36
import SocketServer as socketserver
36
import SocketServer
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
import ConfigParser as configparser
47
import ConfigParser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
from sets import Set
52
53
import subprocess
53
54
import atexit
54
55
import stat
56
57
import logging.handlers
57
58
import pwd
58
59
from contextlib import closing
59
import struct
60
import fcntl
61
import functools
62
60
63
61
import dbus
64
62
import dbus.service
68
66
import ctypes
69
67
import ctypes.util
70
68
71
try:
72
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
73
except AttributeError:
74
try:
75
from IN import SO_BINDTODEVICE
76
except ImportError:
77
SO_BINDTODEVICE = None
78
79
80
version = "1.0.11"
81
82
logger = logging.Logger(u'mandos')
69
version = "1.0.5"
70
71
logger = logging.Logger('mandos')
83
72
syslogger = (logging.handlers.SysLogHandler
84
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
85
74
address = "/dev/log"))
86
75
syslogger.setFormatter(logging.Formatter
87
(u'Mandos [%(process)d]: %(levelname)s:'
88
u' %(message)s'))
76
('Mandos: %(levelname)s: %(message)s'))
89
77
logger.addHandler(syslogger)
90
78
91
79
console = logging.StreamHandler()
92
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
93
u' %(levelname)s:'
94
u' %(message)s'))
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
95
82
logger.addHandler(console)
96
83
97
84
class AvahiError(Exception):
110
97
111
98
class AvahiService(object):
112
99
"""An Avahi (Zeroconf) service.
113
114
100
Attributes:
115
101
interface: integer; avahi.IF_UNSPEC or an interface index.
116
102
Used to optionally bind to the specified interface.
117
name: string; Example: u'Mandos'
118
type: string; Example: u'_mandos._tcp'.
103
name: string; Example: 'Mandos'
104
type: string; Example: '_mandos._tcp'.
119
105
See <http://www.dns-sd.org/ServiceTypes.html>
120
106
port: integer; what port to announce
121
107
TXT: list of strings; TXT record for the service
124
110
max_renames: integer; maximum number of renames
125
111
rename_count: integer; counter so we only rename after collisions
126
112
a sensible number of times
127
group: D-Bus Entry Group
128
server: D-Bus Server
129
bus: dbus.SystemBus()
130
113
"""
131
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
132
115
servicetype = None, port = None, TXT = None,
133
domain = u"", host = u"", max_renames = 32768,
134
protocol = avahi.PROTO_UNSPEC, bus = None):
116
domain = "", host = "", max_renames = 32768):
135
117
self.interface = interface
136
118
self.name = name
137
119
self.type = servicetype
141
123
self.host = host
142
124
self.rename_count = 0
143
125
self.max_renames = max_renames
144
self.protocol = protocol
145
self.group = None # our entry group
146
self.server = None
147
self.bus = bus
148
126
def rename(self):
149
127
"""Derived from the Avahi example code"""
150
128
if self.rename_count >= self.max_renames:
152
130
u" after %i retries, exiting.",
153
131
self.rename_count)
154
132
raise AvahiServiceError(u"Too many renames")
155
self.name = self.server.GetAlternativeServiceName(self.name)
133
self.name = server.GetAlternativeServiceName(self.name)
156
134
logger.info(u"Changing Zeroconf service name to %r ...",
157
unicode(self.name))
135
str(self.name))
158
136
syslogger.setFormatter(logging.Formatter
159
(u'Mandos (%s) [%%(process)d]:'
160
u' %%(levelname)s: %%(message)s'
161
% self.name))
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
162
139
self.remove()
163
140
self.add()
164
141
self.rename_count += 1
165
142
def remove(self):
166
143
"""Derived from the Avahi example code"""
167
if self.group is not None:
168
self.group.Reset()
144
if group is not None:
145
group.Reset()
169
146
def add(self):
170
147
"""Derived from the Avahi example code"""
171
if self.group is None:
172
self.group = dbus.Interface(
173
self.bus.get_object(avahi.DBUS_NAME,
174
self.server.EntryGroupNew()),
175
avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
self.group.connect_to_signal('StateChanged',
177
self.entry_group_state_changed)
148
global group
149
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
178
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
179
self.name, self.type)
180
self.group.AddService(
181
self.interface,
182
self.protocol,
183
dbus.UInt32(0), # flags
184
self.name, self.type,
185
self.domain, self.host,
186
dbus.UInt16(self.port),
187
avahi.string_array_to_txt_array(self.TXT))
188
self.group.Commit()
189
def entry_group_state_changed(self, state, error):
190
"""Derived from the Avahi example code"""
191
logger.debug(u"Avahi state change: %i", state)
192
193
if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
logger.debug(u"Zeroconf service established.")
195
elif state == avahi.ENTRY_GROUP_COLLISION:
196
logger.warning(u"Zeroconf service name collision.")
197
self.rename()
198
elif state == avahi.ENTRY_GROUP_FAILURE:
199
logger.critical(u"Avahi: Error in group state changed %s",
200
unicode(error))
201
raise AvahiGroupError(u"State changed: %s"
202
% unicode(error))
203
def cleanup(self):
204
"""Derived from the Avahi example code"""
205
if self.group is not None:
206
self.group.Free()
207
self.group = None
208
def server_state_changed(self, state):
209
"""Derived from the Avahi example code"""
210
if state == avahi.SERVER_COLLISION:
211
logger.error(u"Zeroconf server name collision")
212
self.remove()
213
elif state == avahi.SERVER_RUNNING:
214
self.add()
215
def activate(self):
216
"""Derived from the Avahi example code"""
217
if self.server is None:
218
self.server = dbus.Interface(
219
self.bus.get_object(avahi.DBUS_NAME,
220
avahi.DBUS_PATH_SERVER),
221
avahi.DBUS_INTERFACE_SERVER)
222
self.server.connect_to_signal(u"StateChanged",
223
self.server_state_changed)
224
self.server_state_changed(self.server.GetState())
225
226
227
class Client(object):
157
service.name, service.type)
158
group.AddService(
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
166
group.Commit()
167
168
# From the Avahi example code:
169
group = None # our entry group
170
# End of Avahi example code
171
172
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
228
179
"""A representation of a client host served by this server.
229
230
180
Attributes:
231
181
name: string; from the config file, used in log messages and
232
182
D-Bus identifiers
252
202
client lives. %() expansions are done at
253
203
runtime with vars(self) as dict, so that for
254
204
instance %(name)s can be used in the command.
255
current_checker_command: string; current running checker_command
205
use_dbus: bool(); Whether to provide D-Bus interface and signals
206
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
256
207
"""
257
258
@staticmethod
259
def _datetime_to_milliseconds(dt):
260
"Convert a datetime.datetime() to milliseconds"
261
return ((dt.days * 24 * 60 * 60 * 1000)
262
+ (dt.seconds * 1000)
263
+ (dt.microseconds // 1000))
264
265
208
def timeout_milliseconds(self):
266
209
"Return the 'timeout' attribute in milliseconds"
267
return self._datetime_to_milliseconds(self.timeout)
210
return ((self.timeout.days * 24 * 60 * 60 * 1000)
211
+ (self.timeout.seconds * 1000)
212
+ (self.timeout.microseconds // 1000))
268
213
269
214
def interval_milliseconds(self):
270
215
"Return the 'interval' attribute in milliseconds"
271
return self._datetime_to_milliseconds(self.interval)
216
return ((self.interval.days * 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds * 1000)
218
+ (self.interval.microseconds // 1000))
272
219
273
def __init__(self, name = None, disable_hook=None, config=None):
220
def __init__(self, name = None, disable_hook=None, config=None,
221
use_dbus=True):
274
222
"""Note: the 'checker' key in 'config' sets the
275
223
'checker_command' attribute and *not* the 'checker'
276
224
attribute."""
278
226
if config is None:
279
227
config = {}
280
228
logger.debug(u"Creating client %r", self.name)
229
self.use_dbus = False # During __init__
281
230
# Uppercase and remove spaces from fingerprint for later
282
231
# comparison purposes with return value from the fingerprint()
283
232
# function
284
self.fingerprint = (config[u"fingerprint"].upper()
233
self.fingerprint = (config["fingerprint"].upper()
285
234
.replace(u" ", u""))
286
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
287
if u"secret" in config:
288
self.secret = config[u"secret"].decode(u"base64")
289
elif u"secfile" in config:
236
if "secret" in config:
237
self.secret = config["secret"].decode(u"base64")
238
elif "secfile" in config:
290
239
with closing(open(os.path.expanduser
291
240
(os.path.expandvars
292
(config[u"secfile"])))) as secfile:
241
(config["secfile"])))) as secfile:
293
242
self.secret = secfile.read()
294
243
else:
295
244
raise TypeError(u"No secret or secfile for client %s"
296
245
% self.name)
297
self.host = config.get(u"host", u"")
246
self.host = config.get("host", "")
298
247
self.created = datetime.datetime.utcnow()
299
248
self.enabled = False
300
249
self.last_enabled = None
301
250
self.last_checked_ok = None
302
self.timeout = string_to_delta(config[u"timeout"])
303
self.interval = string_to_delta(config[u"interval"])
251
self.timeout = string_to_delta(config["timeout"])
252
self.interval = string_to_delta(config["interval"])
304
253
self.disable_hook = disable_hook
305
254
self.checker = None
306
255
self.checker_initiator_tag = None
307
256
self.disable_initiator_tag = None
308
257
self.checker_callback_tag = None
309
self.checker_command = config[u"checker"]
310
self.current_checker_command = None
258
self.checker_command = config["checker"]
311
259
self.last_connect = None
260
# Only now, when this client is initialized, can it show up on
261
# the D-Bus
262
self.use_dbus = use_dbus
263
if self.use_dbus:
264
self.dbus_object_path = (dbus.ObjectPath
265
("/clients/"
266
+ self.name.replace(".", "_")))
267
dbus.service.Object.__init__(self, bus,
268
self.dbus_object_path)
312
269
313
270
def enable(self):
314
271
"""Start this client's checker and timeout hooks"""
315
if getattr(self, u"enabled", False):
316
# Already enabled
317
return
318
272
self.last_enabled = datetime.datetime.utcnow()
319
273
# Schedule a new checker to be started an 'interval' from now,
320
274
# and every interval from then on.
328
282
(self.timeout_milliseconds(),
329
283
self.disable))
330
284
self.enabled = True
285
if self.use_dbus:
286
# Emit D-Bus signals
287
self.PropertyChanged(dbus.String(u"enabled"),
288
dbus.Boolean(True, variant_level=1))
289
self.PropertyChanged(dbus.String(u"last_enabled"),
290
(_datetime_to_dbus(self.last_enabled,
291
variant_level=1)))
331
292
332
293
def disable(self):
333
294
"""Disable this client."""
334
295
if not getattr(self, "enabled", False):
335
296
return False
336
297
logger.info(u"Disabling client %s", self.name)
337
if getattr(self, u"disable_initiator_tag", False):
298
if getattr(self, "disable_initiator_tag", False):
338
299
gobject.source_remove(self.disable_initiator_tag)
339
300
self.disable_initiator_tag = None
340
if getattr(self, u"checker_initiator_tag", False):
301
if getattr(self, "checker_initiator_tag", False):
341
302
gobject.source_remove(self.checker_initiator_tag)
342
303
self.checker_initiator_tag = None
343
304
self.stop_checker()
344
305
if self.disable_hook:
345
306
self.disable_hook(self)
346
307
self.enabled = False
308
if self.use_dbus:
309
# Emit D-Bus signal
310
self.PropertyChanged(dbus.String(u"enabled"),
311
dbus.Boolean(False, variant_level=1))
347
312
# Do not run this again if called by a gobject.timeout_add
348
313
return False
349
314
355
320
"""The checker has completed, so take appropriate actions."""
356
321
self.checker_callback_tag = None
357
322
self.checker = None
323
if self.use_dbus:
324
# Emit D-Bus signal
325
self.PropertyChanged(dbus.String(u"checker_running"),
326
dbus.Boolean(False, variant_level=1))
358
327
if os.WIFEXITED(condition):
359
328
exitstatus = os.WEXITSTATUS(condition)
360
329
if exitstatus == 0:
361
330
logger.info(u"Checker for %(name)s succeeded",
362
331
vars(self))
363
self.checked_ok()
332
self.bump_timeout()
364
333
else:
365
334
logger.info(u"Checker for %(name)s failed",
366
335
vars(self))
336
if self.use_dbus:
337
# Emit D-Bus signal
338
self.CheckerCompleted(dbus.Int16(exitstatus),
339
dbus.Int64(condition),
340
dbus.String(command))
367
341
else:
368
342
logger.warning(u"Checker for %(name)s crashed?",
369
343
vars(self))
344
if self.use_dbus:
345
# Emit D-Bus signal
346
self.CheckerCompleted(dbus.Int16(-1),
347
dbus.Int64(condition),
348
dbus.String(command))
370
349
371
def checked_ok(self):
350
def bump_timeout(self):
372
351
"""Bump up the timeout for this client.
373
374
352
This should only be called when the client has been seen,
375
353
alive and well.
376
354
"""
379
357
self.disable_initiator_tag = (gobject.timeout_add
380
358
(self.timeout_milliseconds(),
381
359
self.disable))
360
if self.use_dbus:
361
# Emit D-Bus signal
362
self.PropertyChanged(
363
dbus.String(u"last_checked_ok"),
364
(_datetime_to_dbus(self.last_checked_ok,
365
variant_level=1)))
382
366
383
367
def start_checker(self):
384
368
"""Start a new checker subprocess if one is not running.
385
386
369
If a checker already exists, leave it running and do
387
370
nothing."""
388
371
# The reason for not killing a running checker is that if we
393
376
# checkers alone, the checker would have to take more time
394
377
# than 'timeout' for the client to be declared invalid, which
395
378
# is as it should be.
396
397
# If a checker exists, make sure it is not a zombie
398
if self.checker is not None:
399
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
400
if pid:
401
logger.warning(u"Checker was a zombie")
402
gobject.source_remove(self.checker_callback_tag)
403
self.checker_callback(pid, status,
404
self.current_checker_command)
405
# Start a new checker if needed
406
379
if self.checker is None:
407
380
try:
408
381
# In case checker_command has exactly one % operator
409
382
command = self.checker_command % self.host
410
383
except TypeError:
411
384
# Escape attributes for the shell
412
escaped_attrs = dict((key,
413
re.escape(unicode(str(val),
414
errors=
415
u'replace')))
385
escaped_attrs = dict((key, re.escape(str(val)))
416
386
for key, val in
417
387
vars(self).iteritems())
418
388
try:
421
391
logger.error(u'Could not format string "%s":'
422
392
u' %s', self.checker_command, error)
423
393
return True # Try again later
424
self.current_checker_command = command
425
394
try:
426
395
logger.info(u"Starting checker %r for %s",
427
396
command, self.name)
431
400
# always replaced by /dev/null.)
432
401
self.checker = subprocess.Popen(command,
433
402
close_fds=True,
434
shell=True, cwd=u"/")
403
shell=True, cwd="/")
404
if self.use_dbus:
405
# Emit D-Bus signal
406
self.CheckerStarted(command)
407
self.PropertyChanged(
408
dbus.String("checker_running"),
409
dbus.Boolean(True, variant_level=1))
435
410
self.checker_callback_tag = (gobject.child_watch_add
436
411
(self.checker.pid,
437
412
self.checker_callback,
438
413
data=command))
439
# The checker may have completed before the gobject
440
# watch was added. Check for this.
441
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
442
if pid:
443
gobject.source_remove(self.checker_callback_tag)
444
self.checker_callback(pid, status, command)
445
414
except OSError, error:
446
415
logger.error(u"Failed to start subprocess: %s",
447
416
error)
453
422
if self.checker_callback_tag:
454
423
gobject.source_remove(self.checker_callback_tag)
455
424
self.checker_callback_tag = None
456
if getattr(self, u"checker", None) is None:
425
if getattr(self, "checker", None) is None:
457
426
return
458
427
logger.debug(u"Stopping checker for %(name)s", vars(self))
459
428
try:
465
434
if error.errno != errno.ESRCH: # No such process
466
435
raise
467
436
self.checker = None
437
if self.use_dbus:
438
self.PropertyChanged(dbus.String(u"checker_running"),
439
dbus.Boolean(False, variant_level=1))
468
440
469
441
def still_valid(self):
470
442
"""Has the timeout not yet passed for this client?"""
471
if not getattr(self, u"enabled", False):
443
if not getattr(self, "enabled", False):
472
444
return False
473
445
now = datetime.datetime.utcnow()
474
446
if self.last_checked_ok is None:
475
447
return now < (self.created + self.timeout)
476
448
else:
477
449
return now < (self.last_checked_ok + self.timeout)
478
479
480
class ClientDBus(Client, dbus.service.Object):
481
"""A Client class using D-Bus
482
483
Attributes:
484
dbus_object_path: dbus.ObjectPath
485
bus: dbus.SystemBus()
486
"""
487
# dbus.service.Object doesn't use super(), so we can't either.
488
489
def __init__(self, bus = None, *args, **kwargs):
490
self.bus = bus
491
Client.__init__(self, *args, **kwargs)
492
# Only now, when this client is initialized, can it show up on
493
# the D-Bus
494
self.dbus_object_path = (dbus.ObjectPath
495
(u"/clients/"
496
+ self.name.replace(u".", u"_")))
497
dbus.service.Object.__init__(self, self.bus,
498
self.dbus_object_path)
499
500
@staticmethod
501
def _datetime_to_dbus(dt, variant_level=0):
502
"""Convert a UTC datetime.datetime() to a D-Bus type."""
503
return dbus.String(dt.isoformat(),
504
variant_level=variant_level)
505
506
def enable(self):
507
oldstate = getattr(self, u"enabled", False)
508
r = Client.enable(self)
509
if oldstate != self.enabled:
510
# Emit D-Bus signals
511
self.PropertyChanged(dbus.String(u"enabled"),
512
dbus.Boolean(True, variant_level=1))
513
self.PropertyChanged(
514
dbus.String(u"last_enabled"),
515
self._datetime_to_dbus(self.last_enabled,
516
variant_level=1))
517
return r
518
519
def disable(self, signal = True):
520
oldstate = getattr(self, u"enabled", False)
521
r = Client.disable(self)
522
if signal and oldstate != self.enabled:
523
# Emit D-Bus signal
524
self.PropertyChanged(dbus.String(u"enabled"),
525
dbus.Boolean(False, variant_level=1))
526
return r
527
528
def __del__(self, *args, **kwargs):
529
try:
530
self.remove_from_connection()
531
except LookupError:
532
pass
533
if hasattr(dbus.service.Object, u"__del__"):
534
dbus.service.Object.__del__(self, *args, **kwargs)
535
Client.__del__(self, *args, **kwargs)
536
537
def checker_callback(self, pid, condition, command,
538
*args, **kwargs):
539
self.checker_callback_tag = None
540
self.checker = None
541
# Emit D-Bus signal
542
self.PropertyChanged(dbus.String(u"checker_running"),
543
dbus.Boolean(False, variant_level=1))
544
if os.WIFEXITED(condition):
545
exitstatus = os.WEXITSTATUS(condition)
546
# Emit D-Bus signal
547
self.CheckerCompleted(dbus.Int16(exitstatus),
548
dbus.Int64(condition),
549
dbus.String(command))
550
else:
551
# Emit D-Bus signal
552
self.CheckerCompleted(dbus.Int16(-1),
553
dbus.Int64(condition),
554
dbus.String(command))
555
556
return Client.checker_callback(self, pid, condition, command,
557
*args, **kwargs)
558
559
def checked_ok(self, *args, **kwargs):
560
r = Client.checked_ok(self, *args, **kwargs)
561
# Emit D-Bus signal
562
self.PropertyChanged(
563
dbus.String(u"last_checked_ok"),
564
(self._datetime_to_dbus(self.last_checked_ok,
565
variant_level=1)))
566
return r
567
568
def start_checker(self, *args, **kwargs):
569
old_checker = self.checker
570
if self.checker is not None:
571
old_checker_pid = self.checker.pid
572
else:
573
old_checker_pid = None
574
r = Client.start_checker(self, *args, **kwargs)
575
# Only if new checker process was started
576
if (self.checker is not None
577
and old_checker_pid != self.checker.pid):
578
# Emit D-Bus signal
579
self.CheckerStarted(self.current_checker_command)
580
self.PropertyChanged(
581
dbus.String(u"checker_running"),
582
dbus.Boolean(True, variant_level=1))
583
return r
584
585
def stop_checker(self, *args, **kwargs):
586
old_checker = getattr(self, u"checker", None)
587
r = Client.stop_checker(self, *args, **kwargs)
588
if (old_checker is not None
589
and getattr(self, u"checker", None) is None):
590
self.PropertyChanged(dbus.String(u"checker_running"),
591
dbus.Boolean(False, variant_level=1))
592
return r
593
450
594
451
## D-Bus methods & signals
595
452
_interface = u"se.bsnet.fukt.Mandos.Client"
596
453
597
# CheckedOK - method
598
@dbus.service.method(_interface)
599
def CheckedOK(self):
600
return self.checked_ok()
454
# BumpTimeout - method
455
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
456
BumpTimeout.__name__ = "BumpTimeout"
601
457
602
458
# CheckerCompleted - signal
603
@dbus.service.signal(_interface, signature=u"nxs")
459
@dbus.service.signal(_interface, signature="nxs")
604
460
def CheckerCompleted(self, exitcode, waitstatus, command):
605
461
"D-Bus signal"
606
462
pass
607
463
608
464
# CheckerStarted - signal
609
@dbus.service.signal(_interface, signature=u"s")
465
@dbus.service.signal(_interface, signature="s")
610
466
def CheckerStarted(self, command):
611
467
"D-Bus signal"
612
468
pass
613
469
614
470
# GetAllProperties - method
615
@dbus.service.method(_interface, out_signature=u"a{sv}")
471
@dbus.service.method(_interface, out_signature="a{sv}")
616
472
def GetAllProperties(self):
617
473
"D-Bus method"
618
474
return dbus.Dictionary({
619
dbus.String(u"name"):
475
dbus.String("name"):
620
476
dbus.String(self.name, variant_level=1),
621
dbus.String(u"fingerprint"):
477
dbus.String("fingerprint"):
622
478
dbus.String(self.fingerprint, variant_level=1),
623
dbus.String(u"host"):
479
dbus.String("host"):
624
480
dbus.String(self.host, variant_level=1),
625
dbus.String(u"created"):
626
self._datetime_to_dbus(self.created,
627
variant_level=1),
628
dbus.String(u"last_enabled"):
629
(self._datetime_to_dbus(self.last_enabled,
630
variant_level=1)
481
dbus.String("created"):
482
_datetime_to_dbus(self.created, variant_level=1),
483
dbus.String("last_enabled"):
484
(_datetime_to_dbus(self.last_enabled,
485
variant_level=1)
631
486
if self.last_enabled is not None
632
487
else dbus.Boolean(False, variant_level=1)),
633
dbus.String(u"enabled"):
488
dbus.String("enabled"):
634
489
dbus.Boolean(self.enabled, variant_level=1),
635
dbus.String(u"last_checked_ok"):
636
(self._datetime_to_dbus(self.last_checked_ok,
637
variant_level=1)
490
dbus.String("last_checked_ok"):
491
(_datetime_to_dbus(self.last_checked_ok,
492
variant_level=1)
638
493
if self.last_checked_ok is not None
639
494
else dbus.Boolean (False, variant_level=1)),
640
dbus.String(u"timeout"):
495
dbus.String("timeout"):
641
496
dbus.UInt64(self.timeout_milliseconds(),
642
497
variant_level=1),
643
dbus.String(u"interval"):
498
dbus.String("interval"):
644
499
dbus.UInt64(self.interval_milliseconds(),
645
500
variant_level=1),
646
dbus.String(u"checker"):
501
dbus.String("checker"):
647
502
dbus.String(self.checker_command,
648
503
variant_level=1),
649
dbus.String(u"checker_running"):
504
dbus.String("checker_running"):
650
505
dbus.Boolean(self.checker is not None,
651
506
variant_level=1),
652
dbus.String(u"object_path"):
507
dbus.String("object_path"):
653
508
dbus.ObjectPath(self.dbus_object_path,
654
509
variant_level=1)
655
}, signature=u"sv")
510
}, signature="sv")
656
511
657
512
# IsStillValid - method
658
@dbus.service.method(_interface, out_signature=u"b")
659
def IsStillValid(self):
660
return self.still_valid()
513
IsStillValid = (dbus.service.method(_interface, out_signature="b")
514
(still_valid))
515
IsStillValid.__name__ = "IsStillValid"
661
516
662
517
# PropertyChanged - signal
663
@dbus.service.signal(_interface, signature=u"sv")
518
@dbus.service.signal(_interface, signature="sv")
664
519
def PropertyChanged(self, property, value):
665
520
"D-Bus signal"
666
521
pass
667
522
668
# ReceivedSecret - signal
669
@dbus.service.signal(_interface)
670
def ReceivedSecret(self):
671
"D-Bus signal"
672
pass
673
674
# Rejected - signal
675
@dbus.service.signal(_interface)
676
def Rejected(self):
677
"D-Bus signal"
678
pass
679
680
523
# SetChecker - method
681
@dbus.service.method(_interface, in_signature=u"s")
524
@dbus.service.method(_interface, in_signature="s")
682
525
def SetChecker(self, checker):
683
526
"D-Bus setter method"
684
527
self.checker_command = checker
688
531
variant_level=1))
689
532
690
533
# SetHost - method
691
@dbus.service.method(_interface, in_signature=u"s")
534
@dbus.service.method(_interface, in_signature="s")
692
535
def SetHost(self, host):
693
536
"D-Bus setter method"
694
537
self.host = host
697
540
dbus.String(self.host, variant_level=1))
698
541
699
542
# SetInterval - method
700
@dbus.service.method(_interface, in_signature=u"t")
543
@dbus.service.method(_interface, in_signature="t")
701
544
def SetInterval(self, milliseconds):
702
545
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
703
546
# Emit D-Bus signal
706
549
variant_level=1)))
707
550
708
551
# SetSecret - method
709
@dbus.service.method(_interface, in_signature=u"ay",
552
@dbus.service.method(_interface, in_signature="ay",
710
553
byte_arrays=True)
711
554
def SetSecret(self, secret):
712
555
"D-Bus setter method"
713
556
self.secret = str(secret)
714
557
715
558
# SetTimeout - method
716
@dbus.service.method(_interface, in_signature=u"t")
559
@dbus.service.method(_interface, in_signature="t")
717
560
def SetTimeout(self, milliseconds):
718
561
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
719
562
# Emit D-Bus signal
722
565
variant_level=1)))
723
566
724
567
# Enable - method
725
@dbus.service.method(_interface)
726
def Enable(self):
727
"D-Bus method"
728
self.enable()
568
Enable = dbus.service.method(_interface)(enable)
569
Enable.__name__ = "Enable"
729
570
730
571
# StartChecker - method
731
572
@dbus.service.method(_interface)
740
581
self.disable()
741
582
742
583
# StopChecker - method
743
@dbus.service.method(_interface)
744
def StopChecker(self):
745
self.stop_checker()
584
StopChecker = dbus.service.method(_interface)(stop_checker)
585
StopChecker.__name__ = "StopChecker"
746
586
747
587
del _interface
748
588
749
589
750
class ClientHandler(socketserver.BaseRequestHandler, object):
751
"""A class to handle client connections.
752
753
Instantiated once for each connection to handle it.
590
def peer_certificate(session):
591
"Return the peer's OpenPGP certificate as a bytestring"
592
# If not an OpenPGP certificate...
593
if (gnutls.library.functions
594
.gnutls_certificate_type_get(session._c_object)
595
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
596
# ...do the normal thing
597
return session.peer_certificate
598
list_size = ctypes.c_uint()
599
cert_list = (gnutls.library.functions
600
.gnutls_certificate_get_peers
601
(session._c_object, ctypes.byref(list_size)))
602
if list_size.value == 0:
603
return None
604
cert = cert_list[0]
605
return ctypes.string_at(cert.data, cert.size)
606
607
608
def fingerprint(openpgp):
609
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
610
# New GnuTLS "datum" with the OpenPGP public key
611
datum = (gnutls.library.types
612
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
613
ctypes.POINTER
614
(ctypes.c_ubyte)),
615
ctypes.c_uint(len(openpgp))))
616
# New empty GnuTLS certificate
617
crt = gnutls.library.types.gnutls_openpgp_crt_t()
618
(gnutls.library.functions
619
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
620
# Import the OpenPGP public key into the certificate
621
(gnutls.library.functions
622
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
623
gnutls.library.constants
624
.GNUTLS_OPENPGP_FMT_RAW))
625
# Verify the self signature in the key
626
crtverify = ctypes.c_uint()
627
(gnutls.library.functions
628
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
629
if crtverify.value != 0:
630
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
631
raise gnutls.errors.CertificateSecurityError("Verify failed")
632
# New buffer for the fingerprint
633
buf = ctypes.create_string_buffer(20)
634
buf_len = ctypes.c_size_t()
635
# Get the fingerprint from the certificate into the buffer
636
(gnutls.library.functions
637
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
638
ctypes.byref(buf_len)))
639
# Deinit the certificate
640
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
641
# Convert the buffer to a Python bytestring
642
fpr = ctypes.string_at(buf, buf_len.value)
643
# Convert the bytestring to hexadecimal notation
644
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
645
return hex_fpr
646
647
648
class TCP_handler(SocketServer.BaseRequestHandler, object):
649
"""A TCP request handler class.
650
Instantiated by IPv6_TCPServer for each request to handle it.
754
651
Note: This will run in its own forked process."""
755
652
756
653
def handle(self):
757
654
logger.info(u"TCP connection from: %s",
758
655
unicode(self.client_address))
759
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
# Open IPC pipe to parent process
761
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
762
session = (gnutls.connection
763
.ClientSession(self.request,
764
gnutls.connection
765
.X509Credentials()))
766
767
line = self.request.makefile().readline()
768
logger.debug(u"Protocol version: %r", line)
769
try:
770
if int(line.strip().split()[0]) > 1:
771
raise RuntimeError
772
except (ValueError, IndexError, RuntimeError), error:
773
logger.error(u"Unknown protocol version: %s", error)
774
return
775
776
# Note: gnutls.connection.X509Credentials is really a
777
# generic GnuTLS certificate credentials object so long as
778
# no X.509 keys are added to it. Therefore, we can use it
779
# here despite using OpenPGP certificates.
780
781
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
# u"+AES-256-CBC", u"+SHA1",
783
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
784
# u"+DHE-DSS"))
785
# Use a fallback default, since this MUST be set.
786
priority = self.server.gnutls_priority
787
if priority is None:
788
priority = u"NORMAL"
789
(gnutls.library.functions
790
.gnutls_priority_set_direct(session._c_object,
791
priority, None))
792
793
try:
794
session.handshake()
795
except gnutls.errors.GNUTLSError, error:
796
logger.warning(u"Handshake failed: %s", error)
797
# Do not run session.bye() here: the session is not
798
# established. Just abandon the request.
799
return
800
logger.debug(u"Handshake succeeded")
801
try:
802
fpr = self.fingerprint(self.peer_certificate(session))
803
except (TypeError, gnutls.errors.GNUTLSError), error:
804
logger.warning(u"Bad certificate: %s", error)
805
session.bye()
806
return
807
logger.debug(u"Fingerprint: %s", fpr)
808
809
for c in self.server.clients:
810
if c.fingerprint == fpr:
811
client = c
812
break
813
else:
814
ipc.write(u"NOTFOUND %s\n" % fpr)
815
session.bye()
816
return
817
# Have to check if client.still_valid(), since it is
818
# possible that the client timed out while establishing
819
# the GnuTLS session.
820
if not client.still_valid():
821
ipc.write(u"INVALID %s\n" % client.name)
822
session.bye()
823
return
824
ipc.write(u"SENDING %s\n" % client.name)
825
sent_size = 0
826
while sent_size < len(client.secret):
827
sent = session.send(client.secret[sent_size:])
828
logger.debug(u"Sent: %d, remaining: %d",
829
sent, len(client.secret)
830
- (sent_size + sent))
831
sent_size += sent
832
session.bye()
833
834
@staticmethod
835
def peer_certificate(session):
836
"Return the peer's OpenPGP certificate as a bytestring"
837
# If not an OpenPGP certificate...
838
if (gnutls.library.functions
839
.gnutls_certificate_type_get(session._c_object)
840
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
841
# ...do the normal thing
842
return session.peer_certificate
843
list_size = ctypes.c_uint(1)
844
cert_list = (gnutls.library.functions
845
.gnutls_certificate_get_peers
846
(session._c_object, ctypes.byref(list_size)))
847
if not bool(cert_list) and list_size.value != 0:
848
raise gnutls.errors.GNUTLSError(u"error getting peer"
849
u" certificate")
850
if list_size.value == 0:
851
return None
852
cert = cert_list[0]
853
return ctypes.string_at(cert.data, cert.size)
854
855
@staticmethod
856
def fingerprint(openpgp):
857
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
858
# New GnuTLS "datum" with the OpenPGP public key
859
datum = (gnutls.library.types
860
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
861
ctypes.POINTER
862
(ctypes.c_ubyte)),
863
ctypes.c_uint(len(openpgp))))
864
# New empty GnuTLS certificate
865
crt = gnutls.library.types.gnutls_openpgp_crt_t()
866
(gnutls.library.functions
867
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
868
# Import the OpenPGP public key into the certificate
869
(gnutls.library.functions
870
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
871
gnutls.library.constants
872
.GNUTLS_OPENPGP_FMT_RAW))
873
# Verify the self signature in the key
874
crtverify = ctypes.c_uint()
875
(gnutls.library.functions
876
.gnutls_openpgp_crt_verify_self(crt, 0,
877
ctypes.byref(crtverify)))
878
if crtverify.value != 0:
879
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
880
raise (gnutls.errors.CertificateSecurityError
881
(u"Verify failed"))
882
# New buffer for the fingerprint
883
buf = ctypes.create_string_buffer(20)
884
buf_len = ctypes.c_size_t()
885
# Get the fingerprint from the certificate into the buffer
886
(gnutls.library.functions
887
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
888
ctypes.byref(buf_len)))
889
# Deinit the certificate
890
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
891
# Convert the buffer to a Python bytestring
892
fpr = ctypes.string_at(buf, buf_len.value)
893
# Convert the bytestring to hexadecimal notation
894
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
895
return hex_fpr
896
897
898
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
899
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
900
def process_request(self, request, client_address):
901
"""Overrides and wraps the original process_request().
902
903
This function creates a new pipe in self.pipe
904
"""
905
self.pipe = os.pipe()
906
super(ForkingMixInWithPipe,
907
self).process_request(request, client_address)
908
os.close(self.pipe[1]) # close write end
909
self.add_pipe(self.pipe[0])
910
def add_pipe(self, pipe):
911
"""Dummy function; override as necessary"""
912
os.close(pipe)
913
914
915
class IPv6_TCPServer(ForkingMixInWithPipe,
916
socketserver.TCPServer, object):
917
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
918
656
session = (gnutls.connection
657
.ClientSession(self.request,
658
gnutls.connection
659
.X509Credentials()))
660
661
line = self.request.makefile().readline()
662
logger.debug(u"Protocol version: %r", line)
663
try:
664
if int(line.strip().split()[0]) > 1:
665
raise RuntimeError
666
except (ValueError, IndexError, RuntimeError), error:
667
logger.error(u"Unknown protocol version: %s", error)
668
return
669
670
# Note: gnutls.connection.X509Credentials is really a generic
671
# GnuTLS certificate credentials object so long as no X.509
672
# keys are added to it. Therefore, we can use it here despite
673
# using OpenPGP certificates.
674
675
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
676
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
677
# "+DHE-DSS"))
678
# Use a fallback default, since this MUST be set.
679
priority = self.server.settings.get("priority", "NORMAL")
680
(gnutls.library.functions
681
.gnutls_priority_set_direct(session._c_object,
682
priority, None))
683
684
try:
685
session.handshake()
686
except gnutls.errors.GNUTLSError, error:
687
logger.warning(u"Handshake failed: %s", error)
688
# Do not run session.bye() here: the session is not
689
# established. Just abandon the request.
690
return
691
try:
692
fpr = fingerprint(peer_certificate(session))
693
except (TypeError, gnutls.errors.GNUTLSError), error:
694
logger.warning(u"Bad certificate: %s", error)
695
session.bye()
696
return
697
logger.debug(u"Fingerprint: %s", fpr)
698
for c in self.server.clients:
699
if c.fingerprint == fpr:
700
client = c
701
break
702
else:
703
logger.warning(u"Client not found for fingerprint: %s",
704
fpr)
705
session.bye()
706
return
707
# Have to check if client.still_valid(), since it is possible
708
# that the client timed out while establishing the GnuTLS
709
# session.
710
if not client.still_valid():
711
logger.warning(u"Client %(name)s is invalid",
712
vars(client))
713
session.bye()
714
return
715
## This won't work here, since we're in a fork.
716
# client.bump_timeout()
717
sent_size = 0
718
while sent_size < len(client.secret):
719
sent = session.send(client.secret[sent_size:])
720
logger.debug(u"Sent: %d, remaining: %d",
721
sent, len(client.secret)
722
- (sent_size + sent))
723
sent_size += sent
724
session.bye()
725
726
727
class IPv6_TCPServer(SocketServer.ForkingMixIn,
728
SocketServer.TCPServer, object):
729
"""IPv6 TCP server. Accepts 'None' as address and/or port.
919
730
Attributes:
731
settings: Server settings
732
clients: Set() of Client objects
920
733
enabled: Boolean; whether this server is activated yet
921
interface: None or a network interface name (string)
922
use_ipv6: Boolean; to use IPv6 or not
923
734
"""
924
def __init__(self, server_address, RequestHandlerClass,
925
interface=None, use_ipv6=True):
926
self.interface = interface
927
if use_ipv6:
928
self.address_family = socket.AF_INET6
929
socketserver.TCPServer.__init__(self, server_address,
930
RequestHandlerClass)
735
address_family = socket.AF_INET6
736
def __init__(self, *args, **kwargs):
737
if "settings" in kwargs:
738
self.settings = kwargs["settings"]
739
del kwargs["settings"]
740
if "clients" in kwargs:
741
self.clients = kwargs["clients"]
742
del kwargs["clients"]
743
self.enabled = False
744
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
931
745
def server_bind(self):
932
746
"""This overrides the normal server_bind() function
933
747
to bind to an interface if one was specified, and also NOT to
934
748
bind to an address or port if they were not specified."""
935
if self.interface is not None:
936
if SO_BINDTODEVICE is None:
937
logger.error(u"SO_BINDTODEVICE does not exist;"
938
u" cannot bind to interface %s",
939
self.interface)
940
else:
941
try:
942
self.socket.setsockopt(socket.SOL_SOCKET,
943
SO_BINDTODEVICE,
944
str(self.interface
945
+ u'\0'))
946
except socket.error, error:
947
if error[0] == errno.EPERM:
948
logger.error(u"No permission to"
949
u" bind to interface %s",
950
self.interface)
951
elif error[0] == errno.ENOPROTOOPT:
952
logger.error(u"SO_BINDTODEVICE not available;"
953
u" cannot bind to interface %s",
954
self.interface)
955
else:
956
raise
749
if self.settings["interface"]:
750
# 25 is from /usr/include/asm-i486/socket.h
751
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
752
try:
753
self.socket.setsockopt(socket.SOL_SOCKET,
754
SO_BINDTODEVICE,
755
self.settings["interface"])
756
except socket.error, error:
757
if error[0] == errno.EPERM:
758
logger.error(u"No permission to"
759
u" bind to interface %s",
760
self.settings["interface"])
761
else:
762
raise error
957
763
# Only bind(2) the socket if we really need to.
958
764
if self.server_address[0] or self.server_address[1]:
959
765
if not self.server_address[0]:
960
if self.address_family == socket.AF_INET6:
961
any_address = u"::" # in6addr_any
962
else:
963
any_address = socket.INADDR_ANY
964
self.server_address = (any_address,
766
in6addr_any = "::"
767
self.server_address = (in6addr_any,
965
768
self.server_address[1])
966
769
elif not self.server_address[1]:
967
770
self.server_address = (self.server_address[0],
968
771
0)
969
# if self.interface:
772
# if self.settings["interface"]:
970
773
# self.server_address = (self.server_address[0],
971
774
# 0, # port
972
775
# 0, # flowinfo
973
776
# if_nametoindex
974
# (self.interface))
975
return socketserver.TCPServer.server_bind(self)
976
977
978
class MandosServer(IPv6_TCPServer):
979
"""Mandos server.
980
981
Attributes:
982
clients: set of Client objects
983
gnutls_priority GnuTLS priority string
984
use_dbus: Boolean; to emit D-Bus signals or not
985
clients: set of Client objects
986
gnutls_priority GnuTLS priority string
987
use_dbus: Boolean; to emit D-Bus signals or not
988
989
Assumes a gobject.MainLoop event loop.
990
"""
991
def __init__(self, server_address, RequestHandlerClass,
992
interface=None, use_ipv6=True, clients=None,
993
gnutls_priority=None, use_dbus=True):
994
self.enabled = False
995
self.clients = clients
996
if self.clients is None:
997
self.clients = set()
998
self.use_dbus = use_dbus
999
self.gnutls_priority = gnutls_priority
1000
IPv6_TCPServer.__init__(self, server_address,
1001
RequestHandlerClass,
1002
interface = interface,
1003
use_ipv6 = use_ipv6)
777
# (self.settings
778
# ["interface"]))
779
return super(IPv6_TCPServer, self).server_bind()
1004
780
def server_activate(self):
1005
781
if self.enabled:
1006
return socketserver.TCPServer.server_activate(self)
782
return super(IPv6_TCPServer, self).server_activate()
1007
783
def enable(self):
1008
784
self.enabled = True
1009
def add_pipe(self, pipe):
1010
# Call "handle_ipc" for both data and EOF events
1011
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1012
self.handle_ipc)
1013
def handle_ipc(self, source, condition, file_objects={}):
1014
condition_names = {
1015
gobject.IO_IN: u"IN", # There is data to read.
1016
gobject.IO_OUT: u"OUT", # Data can be written (without
1017
# blocking).
1018
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1019
gobject.IO_ERR: u"ERR", # Error condition.
1020
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1021
# broken, usually for pipes and
1022
# sockets).
1023
}
1024
conditions_string = ' | '.join(name
1025
for cond, name in
1026
condition_names.iteritems()
1027
if cond & condition)
1028
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1029
conditions_string)
1030
1031
# Turn the pipe file descriptor into a Python file object
1032
if source not in file_objects:
1033
file_objects[source] = os.fdopen(source, u"r", 1)
1034
1035
# Read a line from the file object
1036
cmdline = file_objects[source].readline()
1037
if not cmdline: # Empty line means end of file
1038
# close the IPC pipe
1039
file_objects[source].close()
1040
del file_objects[source]
1041
1042
# Stop calling this function
1043
return False
1044
1045
logger.debug(u"IPC command: %r", cmdline)
1046
1047
# Parse and act on command
1048
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1049
1050
if cmd == u"NOTFOUND":
1051
logger.warning(u"Client not found for fingerprint: %s",
1052
args)
1053
if self.use_dbus:
1054
# Emit D-Bus signal
1055
mandos_dbus_service.ClientNotFound(args)
1056
elif cmd == u"INVALID":
1057
for client in self.clients:
1058
if client.name == args:
1059
logger.warning(u"Client %s is invalid", args)
1060
if self.use_dbus:
1061
# Emit D-Bus signal
1062
client.Rejected()
1063
break
1064
else:
1065
logger.error(u"Unknown client %s is invalid", args)
1066
elif cmd == u"SENDING":
1067
for client in self.clients:
1068
if client.name == args:
1069
logger.info(u"Sending secret to %s", client.name)
1070
client.checked_ok()
1071
if self.use_dbus:
1072
# Emit D-Bus signal
1073
client.ReceivedSecret()
1074
break
1075
else:
1076
logger.error(u"Sending secret to unknown client %s",
1077
args)
1078
else:
1079
logger.error(u"Unknown IPC command: %r", cmdline)
1080
1081
# Keep calling this function
1082
return True
1083
785
1084
786
1085
787
def string_to_delta(interval):
1086
788
"""Parse a string and return a datetime.timedelta
1087
1088
>>> string_to_delta(u'7d')
789
790
>>> string_to_delta('7d')
1089
791
datetime.timedelta(7)
1090
>>> string_to_delta(u'60s')
792
>>> string_to_delta('60s')
1091
793
datetime.timedelta(0, 60)
1092
>>> string_to_delta(u'60m')
794
>>> string_to_delta('60m')
1093
795
datetime.timedelta(0, 3600)
1094
>>> string_to_delta(u'24h')
796
>>> string_to_delta('24h')
1095
797
datetime.timedelta(1)
1096
798
>>> string_to_delta(u'1w')
1097
799
datetime.timedelta(7)
1098
>>> string_to_delta(u'5m 30s')
800
>>> string_to_delta('5m 30s')
1099
801
datetime.timedelta(0, 330)
1100
802
"""
1101
803
timevalue = datetime.timedelta(0)
1121
823
return timevalue
1122
824
1123
825
826
def server_state_changed(state):
827
"""Derived from the Avahi example code"""
828
if state == avahi.SERVER_COLLISION:
829
logger.error(u"Zeroconf server name collision")
830
service.remove()
831
elif state == avahi.SERVER_RUNNING:
832
service.add()
833
834
835
def entry_group_state_changed(state, error):
836
"""Derived from the Avahi example code"""
837
logger.debug(u"Avahi state change: %i", state)
838
839
if state == avahi.ENTRY_GROUP_ESTABLISHED:
840
logger.debug(u"Zeroconf service established.")
841
elif state == avahi.ENTRY_GROUP_COLLISION:
842
logger.warning(u"Zeroconf service name collision.")
843
service.rename()
844
elif state == avahi.ENTRY_GROUP_FAILURE:
845
logger.critical(u"Avahi: Error in group state changed %s",
846
unicode(error))
847
raise AvahiGroupError(u"State changed: %s" % unicode(error))
848
1124
849
def if_nametoindex(interface):
1125
"""Call the C function if_nametoindex(), or equivalent
1126
1127
Note: This function cannot accept a unicode string."""
850
"""Call the C function if_nametoindex(), or equivalent"""
1128
851
global if_nametoindex
1129
852
try:
1130
853
if_nametoindex = (ctypes.cdll.LoadLibrary
1131
(ctypes.util.find_library(u"c"))
854
(ctypes.util.find_library("c"))
1132
855
.if_nametoindex)
1133
856
except (OSError, AttributeError):
1134
logger.warning(u"Doing if_nametoindex the hard way")
857
if "struct" not in sys.modules:
858
import struct
859
if "fcntl" not in sys.modules:
860
import fcntl
1135
861
def if_nametoindex(interface):
1136
862
"Get an interface index the hard way, i.e. using fcntl()"
1137
863
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1138
864
with closing(socket.socket()) as s:
1139
865
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1140
struct.pack(str(u"16s16x"),
1141
interface))
1142
interface_index = struct.unpack(str(u"I"),
1143
ifreq[16:20])[0]
866
struct.pack("16s16x", interface))
867
interface_index = struct.unpack("I", ifreq[16:20])[0]
1144
868
return interface_index
1145
869
return if_nametoindex(interface)
1146
870
1147
871
1148
872
def daemon(nochdir = False, noclose = False):
1149
873
"""See daemon(3). Standard BSD Unix function.
1150
1151
874
This should really exist as os.daemon, but it doesn't (yet)."""
1152
875
if os.fork():
1153
876
sys.exit()
1154
877
os.setsid()
1155
878
if not nochdir:
1156
os.chdir(u"/")
879
os.chdir("/")
1157
880
if os.fork():
1158
881
sys.exit()
1159
882
if not noclose:
1161
884
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1162
885
if not stat.S_ISCHR(os.fstat(null).st_mode):
1163
886
raise OSError(errno.ENODEV,
1164
u"/dev/null not a character device")
887
"/dev/null not a character device")
1165
888
os.dup2(null, sys.stdin.fileno())
1166
889
os.dup2(null, sys.stdout.fileno())
1167
890
os.dup2(null, sys.stderr.fileno())
1170
893
1171
894
1172
895
def main():
1173
1174
######################################################################
1175
# Parsing of options, both command line and config file
1176
1177
896
parser = optparse.OptionParser(version = "%%prog %s" % version)
1178
parser.add_option("-i", u"--interface", type=u"string",
1179
metavar="IF", help=u"Bind to interface IF")
1180
parser.add_option("-a", u"--address", type=u"string",
1181
help=u"Address to listen for requests on")
1182
parser.add_option("-p", u"--port", type=u"int",
1183
help=u"Port number to receive requests on")
1184
parser.add_option("--check", action=u"store_true",
1185
help=u"Run self-test")
1186
parser.add_option("--debug", action=u"store_true",
1187
help=u"Debug mode; run in foreground and log to"
1188
u" terminal")
1189
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1190
u" priority string (see GnuTLS documentation)")
1191
parser.add_option("--servicename", type=u"string",
1192
metavar=u"NAME", help=u"Zeroconf service name")
1193
parser.add_option("--configdir", type=u"string",
1194
default=u"/etc/mandos", metavar=u"DIR",
1195
help=u"Directory to search for configuration"
1196
u" files")
1197
parser.add_option("--no-dbus", action=u"store_false",
1198
dest=u"use_dbus", help=u"Do not provide D-Bus"
1199
u" system bus interface")
1200
parser.add_option("--no-ipv6", action=u"store_false",
1201
dest=u"use_ipv6", help=u"Do not use IPv6")
897
parser.add_option("-i", "--interface", type="string",
898
metavar="IF", help="Bind to interface IF")
899
parser.add_option("-a", "--address", type="string",
900
help="Address to listen for requests on")
901
parser.add_option("-p", "--port", type="int",
902
help="Port number to receive requests on")
903
parser.add_option("--check", action="store_true",
904
help="Run self-test")
905
parser.add_option("--debug", action="store_true",
906
help="Debug mode; run in foreground and log to"
907
" terminal")
908
parser.add_option("--priority", type="string", help="GnuTLS"
909
" priority string (see GnuTLS documentation)")
910
parser.add_option("--servicename", type="string", metavar="NAME",
911
help="Zeroconf service name")
912
parser.add_option("--configdir", type="string",
913
default="/etc/mandos", metavar="DIR",
914
help="Directory to search for configuration"
915
" files")
916
parser.add_option("--no-dbus", action="store_false",
917
dest="use_dbus",
918
help="Do not provide D-Bus system bus"
919
" interface")
1202
920
options = parser.parse_args()[0]
1203
921
1204
922
if options.check:
1207
925
sys.exit()
1208
926
1209
927
# Default values for config file for server-global settings
1210
server_defaults = { u"interface": u"",
1211
u"address": u"",
1212
u"port": u"",
1213
u"debug": u"False",
1214
u"priority":
1215
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1216
u"servicename": u"Mandos",
1217
u"use_dbus": u"True",
1218
u"use_ipv6": u"True",
928
server_defaults = { "interface": "",
929
"address": "",
930
"port": "",
931
"debug": "False",
932
"priority":
933
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
934
"servicename": "Mandos",
935
"use_dbus": "True",
1219
936
}
1220
937
1221
938
# Parse config file for server-global settings
1222
server_config = configparser.SafeConfigParser(server_defaults)
939
server_config = ConfigParser.SafeConfigParser(server_defaults)
1223
940
del server_defaults
1224
server_config.read(os.path.join(options.configdir,
1225
u"mandos.conf"))
941
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1226
942
# Convert the SafeConfigParser object to a dict
1227
943
server_settings = server_config.defaults()
1228
# Use the appropriate methods on the non-string config options
1229
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1230
server_settings[option] = server_config.getboolean(u"DEFAULT",
1231
option)
1232
if server_settings["port"]:
1233
server_settings["port"] = server_config.getint(u"DEFAULT",
1234
u"port")
944
# Use getboolean on the boolean config options
945
server_settings["debug"] = (server_config.getboolean
946
("DEFAULT", "debug"))
947
server_settings["use_dbus"] = (server_config.getboolean
948
("DEFAULT", "use_dbus"))
1235
949
del server_config
1236
950
1237
951
# Override the settings from the config file with command line
1238
952
# options, if set.
1239
for option in (u"interface", u"address", u"port", u"debug",
1240
u"priority", u"servicename", u"configdir",
1241
u"use_dbus", u"use_ipv6"):
953
for option in ("interface", "address", "port", "debug",
954
"priority", "servicename", "configdir",
955
"use_dbus"):
1242
956
value = getattr(options, option)
1243
957
if value is not None:
1244
958
server_settings[option] = value
1245
959
del options
1246
# Force all strings to be unicode
1247
for option in server_settings.keys():
1248
if type(server_settings[option]) is str:
1249
server_settings[option] = unicode(server_settings[option])
1250
960
# Now we have our good server settings in "server_settings"
1251
961
1252
##################################################################
1253
1254
962
# For convenience
1255
debug = server_settings[u"debug"]
1256
use_dbus = server_settings[u"use_dbus"]
1257
use_ipv6 = server_settings[u"use_ipv6"]
963
debug = server_settings["debug"]
964
use_dbus = server_settings["use_dbus"]
1258
965
1259
966
if not debug:
1260
967
syslogger.setLevel(logging.WARNING)
1261
968
console.setLevel(logging.WARNING)
1262
969
1263
if server_settings[u"servicename"] != u"Mandos":
970
if server_settings["servicename"] != "Mandos":
1264
971
syslogger.setFormatter(logging.Formatter
1265
(u'Mandos (%s) [%%(process)d]:'
1266
u' %%(levelname)s: %%(message)s'
1267
% server_settings[u"servicename"]))
972
('Mandos (%s): %%(levelname)s:'
973
' %%(message)s'
974
% server_settings["servicename"]))
1268
975
1269
976
# Parse config file with clients
1270
client_defaults = { u"timeout": u"1h",
1271
u"interval": u"5m",
1272
u"checker": u"fping -q -- %%(host)s",
1273
u"host": u"",
977
client_defaults = { "timeout": "1h",
978
"interval": "5m",
979
"checker": "fping -q -- %%(host)s",
980
"host": "",
1274
981
}
1275
client_config = configparser.SafeConfigParser(client_defaults)
1276
client_config.read(os.path.join(server_settings[u"configdir"],
1277
u"clients.conf"))
1278
1279
global mandos_dbus_service
1280
mandos_dbus_service = None
1281
1282
tcp_server = MandosServer((server_settings[u"address"],
1283
server_settings[u"port"]),
1284
ClientHandler,
1285
interface=server_settings[u"interface"],
1286
use_ipv6=use_ipv6,
1287
gnutls_priority=
1288
server_settings[u"priority"],
1289
use_dbus=use_dbus)
1290
pidfilename = u"/var/run/mandos.pid"
1291
try:
1292
pidfile = open(pidfilename, u"w")
1293
except IOError:
1294
logger.error(u"Could not open file %r", pidfilename)
1295
1296
try:
1297
uid = pwd.getpwnam(u"_mandos").pw_uid
1298
gid = pwd.getpwnam(u"_mandos").pw_gid
982
client_config = ConfigParser.SafeConfigParser(client_defaults)
983
client_config.read(os.path.join(server_settings["configdir"],
984
"clients.conf"))
985
986
clients = Set()
987
tcp_server = IPv6_TCPServer((server_settings["address"],
988
server_settings["port"]),
989
TCP_handler,
990
settings=server_settings,
991
clients=clients)
992
pidfilename = "/var/run/mandos.pid"
993
try:
994
pidfile = open(pidfilename, "w")
995
except IOError, error:
996
logger.error("Could not open file %r", pidfilename)
997
998
try:
999
uid = pwd.getpwnam("_mandos").pw_uid
1000
gid = pwd.getpwnam("_mandos").pw_gid
1299
1001
except KeyError:
1300
1002
try:
1301
uid = pwd.getpwnam(u"mandos").pw_uid
1302
gid = pwd.getpwnam(u"mandos").pw_gid
1003
uid = pwd.getpwnam("mandos").pw_uid
1004
gid = pwd.getpwnam("mandos").pw_gid
1303
1005
except KeyError:
1304
1006
try:
1305
uid = pwd.getpwnam(u"nobody").pw_uid
1306
gid = pwd.getpwnam(u"nobody").pw_gid
1007
uid = pwd.getpwnam("nobody").pw_uid
1008
gid = pwd.getpwnam("nogroup").pw_gid
1307
1009
except KeyError:
1308
1010
uid = 65534
1309
1011
gid = 65534
1310
1012
try:
1013
os.setuid(uid)
1311
1014
os.setgid(gid)
1312
os.setuid(uid)
1313
1015
except OSError, error:
1314
1016
if error[0] != errno.EPERM:
1315
1017
raise error
1316
1018
1317
# Enable all possible GnuTLS debugging
1318
if debug:
1319
# "Use a log level over 10 to enable all debugging options."
1320
# - GnuTLS manual
1321
gnutls.library.functions.gnutls_global_set_log_level(11)
1322
1323
@gnutls.library.types.gnutls_log_func
1324
def debug_gnutls(level, string):
1325
logger.debug(u"GnuTLS: %s", string[:-1])
1326
1327
(gnutls.library.functions
1328
.gnutls_global_set_log_function(debug_gnutls))
1019
global service
1020
service = AvahiService(name = server_settings["servicename"],
1021
servicetype = "_mandos._tcp", )
1022
if server_settings["interface"]:
1023
service.interface = (if_nametoindex
1024
(server_settings["interface"]))
1329
1025
1330
1026
global main_loop
1027
global bus
1028
global server
1331
1029
# From the Avahi example code
1332
1030
DBusGMainLoop(set_as_default=True )
1333
1031
main_loop = gobject.MainLoop()
1334
1032
bus = dbus.SystemBus()
1033
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1034
avahi.DBUS_PATH_SERVER),
1035
avahi.DBUS_INTERFACE_SERVER)
1335
1036
# End of Avahi example code
1336
1037
if use_dbus:
1337
1038
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1338
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1339
service = AvahiService(name = server_settings[u"servicename"],
1340
servicetype = u"_mandos._tcp",
1341
protocol = protocol, bus = bus)
1342
if server_settings["interface"]:
1343
service.interface = (if_nametoindex
1344
(str(server_settings[u"interface"])))
1345
1039
1346
client_class = Client
1347
if use_dbus:
1348
client_class = functools.partial(ClientDBus, bus = bus)
1349
tcp_server.clients.update(set(
1350
client_class(name = section,
1351
config= dict(client_config.items(section)))
1352
for section in client_config.sections()))
1353
if not tcp_server.clients:
1040
clients.update(Set(Client(name = section,
1041
config
1042
= dict(client_config.items(section)),
1043
use_dbus = use_dbus)
1044
for section in client_config.sections()))
1045
if not clients:
1354
1046
logger.warning(u"No clients defined")
1355
1047
1356
1048
if debug:
1366
1058
daemon()
1367
1059
1368
1060
try:
1369
with closing(pidfile):
1370
pid = os.getpid()
1371
pidfile.write(str(pid) + "\n")
1061
pid = os.getpid()
1062
pidfile.write(str(pid) + "\n")
1063
pidfile.close()
1372
1064
del pidfile
1373
1065
except IOError:
1374
1066
logger.error(u"Could not write to file %r with PID %d",
1380
1072
1381
1073
def cleanup():
1382
1074
"Cleanup function; run on exit"
1383
service.cleanup()
1075
global group
1076
# From the Avahi example code
1077
if not group is None:
1078
group.Free()
1079
group = None
1080
# End of Avahi example code
1384
1081
1385
while tcp_server.clients:
1386
client = tcp_server.clients.pop()
1082
while clients:
1083
client = clients.pop()
1387
1084
client.disable_hook = None
1388
1085
client.disable()
1389
1086
1395
1092
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1396
1093
1397
1094
if use_dbus:
1398
class MandosDBusService(dbus.service.Object):
1095
class MandosServer(dbus.service.Object):
1399
1096
"""A D-Bus proxy object"""
1400
1097
def __init__(self):
1401
dbus.service.Object.__init__(self, bus, u"/")
1098
dbus.service.Object.__init__(self, bus, "/")
1402
1099
_interface = u"se.bsnet.fukt.Mandos"
1403
1100
1404
@dbus.service.signal(_interface, signature=u"oa{sv}")
1101
@dbus.service.signal(_interface, signature="oa{sv}")
1405
1102
def ClientAdded(self, objpath, properties):
1406
1103
"D-Bus signal"
1407
1104
pass
1408
1105
1409
@dbus.service.signal(_interface, signature=u"s")
1410
def ClientNotFound(self, fingerprint):
1411
"D-Bus signal"
1412
pass
1413
1414
@dbus.service.signal(_interface, signature=u"os")
1106
@dbus.service.signal(_interface, signature="os")
1415
1107
def ClientRemoved(self, objpath, name):
1416
1108
"D-Bus signal"
1417
1109
pass
1418
1110
1419
@dbus.service.method(_interface, out_signature=u"ao")
1111
@dbus.service.method(_interface, out_signature="ao")
1420
1112
def GetAllClients(self):
1421
"D-Bus method"
1422
return dbus.Array(c.dbus_object_path
1423
for c in tcp_server.clients)
1113
return dbus.Array(c.dbus_object_path for c in clients)
1424
1114
1425
@dbus.service.method(_interface,
1426
out_signature=u"a{oa{sv}}")
1115
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1427
1116
def GetAllClientsWithProperties(self):
1428
"D-Bus method"
1429
1117
return dbus.Dictionary(
1430
1118
((c.dbus_object_path, c.GetAllProperties())
1431
for c in tcp_server.clients),
1432
signature=u"oa{sv}")
1119
for c in clients),
1120
signature="oa{sv}")
1433
1121
1434
@dbus.service.method(_interface, in_signature=u"o")
1122
@dbus.service.method(_interface, in_signature="o")
1435
1123
def RemoveClient(self, object_path):
1436
"D-Bus method"
1437
for c in tcp_server.clients:
1124
for c in clients:
1438
1125
if c.dbus_object_path == object_path:
1439
tcp_server.clients.remove(c)
1440
c.remove_from_connection()
1126
clients.remove(c)
1441
1127
# Don't signal anything except ClientRemoved
1442
c.disable(signal=False)
1128
c.use_dbus = False
1129
c.disable()
1443
1130
# Emit D-Bus signal
1444
1131
self.ClientRemoved(object_path, c.name)
1445
1132
return
1447
1134
1448
1135
del _interface
1449
1136
1450
mandos_dbus_service = MandosDBusService()
1137
mandos_server = MandosServer()
1451
1138
1452
for client in tcp_server.clients:
1139
for client in clients:
1453
1140
if use_dbus:
1454
1141
# Emit D-Bus signal
1455
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1456
client.GetAllProperties())
1142
mandos_server.ClientAdded(client.dbus_object_path,
1143
client.GetAllProperties())
1457
1144
client.enable()
1458
1145
1459
1146
tcp_server.enable()
1461
1148
1462
1149
# Find out what port we got
1463
1150
service.port = tcp_server.socket.getsockname()[1]
1464
if use_ipv6:
1465
logger.info(u"Now listening on address %r, port %d,"
1466
" flowinfo %d, scope_id %d"
1467
% tcp_server.socket.getsockname())
1468
else: # IPv4
1469
logger.info(u"Now listening on address %r, port %d"
1470
% tcp_server.socket.getsockname())
1151
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1152
u" scope_id %d" % tcp_server.socket.getsockname())
1471
1153
1472
1154
#service.interface = tcp_server.socket.getsockname()[3]
1473
1155
1474
1156
try:
1475
1157
# From the Avahi example code
1158
server.connect_to_signal("StateChanged", server_state_changed)
1476
1159
try:
1477
service.activate()
1160
server_state_changed(server.GetState())
1478
1161
except dbus.exceptions.DBusException, error:
1479
1162
logger.critical(u"DBusException: %s", error)
1480
1163
sys.exit(1)
1492
1175
sys.exit(1)
1493
1176
except KeyboardInterrupt:
1494
1177
if debug:
1495
print >> sys.stderr
1496
logger.debug(u"Server received KeyboardInterrupt")
1497
logger.debug(u"Server exiting")
1178
print
1498
1179
1499
1180
if __name__ == '__main__':
1500
1181
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0