104
124
max_renames: integer; maximum number of renames
105
125
rename_count: integer; counter so we only rename after collisions
106
126
a sensible number of times
127
group: D-Bus Entry Group
129
bus: dbus.SystemBus()
108
131
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
109
type = None, port = None, TXT = None, domain = "",
110
host = "", max_renames = 32768):
132
servicetype = None, port = None, TXT = None,
133
domain = u"", host = u"", max_renames = 32768,
134
protocol = avahi.PROTO_UNSPEC, bus = None):
111
135
self.interface = interface
137
self.type = servicetype
139
self.TXT = TXT if TXT is not None else []
119
140
self.domain = domain
121
142
self.rename_count = 0
122
143
self.max_renames = max_renames
144
self.protocol = protocol
145
self.group = None # our entry group
123
148
def rename(self):
124
149
"""Derived from the Avahi example code"""
125
150
if self.rename_count >= self.max_renames:
126
logger.critical(u"No suitable service name found after %i"
127
u" retries, exiting.", rename_count)
128
raise AvahiServiceError("Too many renames")
129
self.name = server.GetAlternativeServiceName(self.name)
130
logger.info(u"Changing name to %r ...", str(self.name))
131
syslogger.setFormatter(logging.Formatter\
132
('Mandos (%s): %%(levelname)s:'
133
' %%(message)s' % self.name))
151
logger.critical(u"No suitable Zeroconf service name found"
152
u" after %i retries, exiting.",
154
raise AvahiServiceError(u"Too many renames")
155
self.name = self.server.GetAlternativeServiceName(self.name)
156
logger.info(u"Changing Zeroconf service name to %r ...",
158
syslogger.setFormatter(logging.Formatter
159
(u'Mandos (%s) [%%(process)d]:'
160
u' %%(levelname)s: %%(message)s'
136
164
self.rename_count += 1
137
165
def remove(self):
138
166
"""Derived from the Avahi example code"""
139
if group is not None:
167
if self.group is not None:
142
170
"""Derived from the Avahi example code"""
145
group = dbus.Interface\
146
(bus.get_object(avahi.DBUS_NAME,
147
server.EntryGroupNew()),
148
avahi.DBUS_INTERFACE_ENTRY_GROUP)
149
group.connect_to_signal('StateChanged',
150
entry_group_state_changed)
151
logger.debug(u"Adding service '%s' of type '%s' ...",
152
service.name, service.type)
154
self.interface, # interface
155
avahi.PROTO_INET6, # protocol
156
dbus.UInt32(0), # flags
157
self.name, self.type,
158
self.domain, self.host,
159
dbus.UInt16(self.port),
160
avahi.string_array_to_txt_array(self.TXT))
163
# From the Avahi example code:
164
group = None # our entry group
165
# End of Avahi example code
171
if self.group is None:
172
self.group = dbus.Interface(
173
self.bus.get_object(avahi.DBUS_NAME,
174
self.server.EntryGroupNew()),
175
avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
self.group.connect_to_signal('StateChanged',
178
.entry_group_state_changed)
179
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
180
self.name, self.type)
181
self.group.AddService(
184
dbus.UInt32(0), # flags
185
self.name, self.type,
186
self.domain, self.host,
187
dbus.UInt16(self.port),
188
avahi.string_array_to_txt_array(self.TXT))
190
def entry_group_state_changed(self, state, error):
191
"""Derived from the Avahi example code"""
192
logger.debug(u"Avahi state change: %i", state)
194
if state == avahi.ENTRY_GROUP_ESTABLISHED:
195
logger.debug(u"Zeroconf service established.")
196
elif state == avahi.ENTRY_GROUP_COLLISION:
197
logger.warning(u"Zeroconf service name collision.")
199
elif state == avahi.ENTRY_GROUP_FAILURE:
200
logger.critical(u"Avahi: Error in group state changed %s",
202
raise AvahiGroupError(u"State changed: %s"
205
"""Derived from the Avahi example code"""
206
if self.group is not None:
209
def server_state_changed(self, state):
210
"""Derived from the Avahi example code"""
211
if state == avahi.SERVER_COLLISION:
212
logger.error(u"Zeroconf server name collision")
214
elif state == avahi.SERVER_RUNNING:
217
"""Derived from the Avahi example code"""
218
if self.server is None:
219
self.server = dbus.Interface(
220
self.bus.get_object(avahi.DBUS_NAME,
221
avahi.DBUS_PATH_SERVER),
222
avahi.DBUS_INTERFACE_SERVER)
223
self.server.connect_to_signal(u"StateChanged",
224
self.server_state_changed)
225
self.server_state_changed(self.server.GetState())
168
228
class Client(object):
169
229
"""A representation of a client host served by this server.
171
name: string; from the config file, used in log messages
232
name: string; from the config file, used in log messages and
172
234
fingerprint: string (40 or 32 hexadecimal digits); used to
173
235
uniquely identify the client
174
secret: bytestring; sent verbatim (over TLS) to client
175
host: string; available for use by the checker command
176
created: datetime.datetime(); object creation, not client host
177
last_checked_ok: datetime.datetime() or None if not yet checked OK
178
timeout: datetime.timedelta(); How long from last_checked_ok
179
until this client is invalid
180
interval: datetime.timedelta(); How often to start a new checker
181
stop_hook: If set, called by stop() as stop_hook(self)
182
checker: subprocess.Popen(); a running checker process used
183
to see if the client lives.
184
'None' if no process is running.
236
secret: bytestring; sent verbatim (over TLS) to client
237
host: string; available for use by the checker command
238
created: datetime.datetime(); (UTC) object creation
239
last_enabled: datetime.datetime(); (UTC)
241
last_checked_ok: datetime.datetime(); (UTC) or None
242
timeout: datetime.timedelta(); How long from last_checked_ok
243
until this client is invalid
244
interval: datetime.timedelta(); How often to start a new checker
245
disable_hook: If set, called by disable() as disable_hook(self)
246
checker: subprocess.Popen(); a running checker process used
247
to see if the client lives.
248
'None' if no process is running.
185
249
checker_initiator_tag: a gobject event source tag, or None
186
stop_initiator_tag: - '' -
250
disable_initiator_tag: - '' -
187
251
checker_callback_tag: - '' -
188
252
checker_command: string; External command which is run to check if
189
253
client lives. %() expansions are done at
190
254
runtime with vars(self) as dict, so that for
191
255
instance %(name)s can be used in the command.
193
_timeout: Real variable for 'timeout'
194
_interval: Real variable for 'interval'
195
_timeout_milliseconds: Used when calling gobject.timeout_add()
196
_interval_milliseconds: - '' -
256
current_checker_command: string; current running checker_command
198
def _set_timeout(self, timeout):
199
"Setter function for 'timeout' attribute"
200
self._timeout = timeout
201
self._timeout_milliseconds = ((self.timeout.days
202
* 24 * 60 * 60 * 1000)
203
+ (self.timeout.seconds * 1000)
204
+ (self.timeout.microseconds
206
timeout = property(lambda self: self._timeout,
209
def _set_interval(self, interval):
210
"Setter function for 'interval' attribute"
211
self._interval = interval
212
self._interval_milliseconds = ((self.interval.days
213
* 24 * 60 * 60 * 1000)
214
+ (self.interval.seconds
216
+ (self.interval.microseconds
218
interval = property(lambda self: self._interval,
221
def __init__(self, name = None, stop_hook=None, config={}):
260
def _datetime_to_milliseconds(dt):
261
"Convert a datetime.datetime() to milliseconds"
262
return ((dt.days * 24 * 60 * 60 * 1000)
263
+ (dt.seconds * 1000)
264
+ (dt.microseconds // 1000))
266
def timeout_milliseconds(self):
267
"Return the 'timeout' attribute in milliseconds"
268
return self._datetime_to_milliseconds(self.timeout)
270
def interval_milliseconds(self):
271
"Return the 'interval' attribute in milliseconds"
272
return self._datetime_to_milliseconds(self.interval)
274
def __init__(self, name = None, disable_hook=None, config=None):
222
275
"""Note: the 'checker' key in 'config' sets the
223
276
'checker_command' attribute and *not* the 'checker'
226
281
logger.debug(u"Creating client %r", self.name)
227
282
# Uppercase and remove spaces from fingerprint for later
228
283
# comparison purposes with return value from the fingerprint()
230
self.fingerprint = config["fingerprint"].upper()\
285
self.fingerprint = (config[u"fingerprint"].upper()
232
287
logger.debug(u" Fingerprint: %s", self.fingerprint)
233
if "secret" in config:
234
self.secret = config["secret"].decode(u"base64")
235
elif "secfile" in config:
236
sf = open(config["secfile"])
237
self.secret = sf.read()
288
if u"secret" in config:
289
self.secret = config[u"secret"].decode(u"base64")
290
elif u"secfile" in config:
291
with closing(open(os.path.expanduser
293
(config[u"secfile"])))) as secfile:
294
self.secret = secfile.read()
240
296
raise TypeError(u"No secret or secfile for client %s"
242
self.host = config.get("host", "")
243
self.created = datetime.datetime.now()
298
self.host = config.get(u"host", u"")
299
self.created = datetime.datetime.utcnow()
301
self.last_enabled = None
244
302
self.last_checked_ok = None
245
self.timeout = string_to_delta(config["timeout"])
246
self.interval = string_to_delta(config["interval"])
247
self.stop_hook = stop_hook
303
self.timeout = string_to_delta(config[u"timeout"])
304
self.interval = string_to_delta(config[u"interval"])
305
self.disable_hook = disable_hook
248
306
self.checker = None
249
307
self.checker_initiator_tag = None
250
self.stop_initiator_tag = None
308
self.disable_initiator_tag = None
251
309
self.checker_callback_tag = None
252
self.check_command = config["checker"]
310
self.checker_command = config[u"checker"]
311
self.current_checker_command = None
312
self.last_connect = None
254
315
"""Start this client's checker and timeout hooks"""
316
if getattr(self, u"enabled", False):
319
self.last_enabled = datetime.datetime.utcnow()
255
320
# Schedule a new checker to be started an 'interval' from now,
256
321
# and every interval from then on.
257
self.checker_initiator_tag = gobject.timeout_add\
258
(self._interval_milliseconds,
322
self.checker_initiator_tag = (gobject.timeout_add
323
(self.interval_milliseconds(),
260
325
# Also start a new checker *right now*.
261
326
self.start_checker()
262
# Schedule a stop() when 'timeout' has passed
263
self.stop_initiator_tag = gobject.timeout_add\
264
(self._timeout_milliseconds,
268
The possibility that a client might be restarted is left open,
269
but not currently used."""
270
# If this client doesn't have a secret, it is already stopped.
271
if hasattr(self, "secret") and self.secret:
272
logger.info(u"Stopping client %s", self.name)
327
# Schedule a disable() when 'timeout' has passed
328
self.disable_initiator_tag = (gobject.timeout_add
329
(self.timeout_milliseconds(),
334
"""Disable this client."""
335
if not getattr(self, "enabled", False):
276
if getattr(self, "stop_initiator_tag", False):
277
gobject.source_remove(self.stop_initiator_tag)
278
self.stop_initiator_tag = None
279
if getattr(self, "checker_initiator_tag", False):
337
logger.info(u"Disabling client %s", self.name)
338
if getattr(self, u"disable_initiator_tag", False):
339
gobject.source_remove(self.disable_initiator_tag)
340
self.disable_initiator_tag = None
341
if getattr(self, u"checker_initiator_tag", False):
280
342
gobject.source_remove(self.checker_initiator_tag)
281
343
self.checker_initiator_tag = None
282
344
self.stop_checker()
345
if self.disable_hook:
346
self.disable_hook(self)
285
348
# Do not run this again if called by a gobject.timeout_add
287
351
def __del__(self):
288
self.stop_hook = None
290
def checker_callback(self, pid, condition):
352
self.disable_hook = None
355
def checker_callback(self, pid, condition, command):
291
356
"""The checker has completed, so take appropriate actions."""
292
now = datetime.datetime.now()
293
357
self.checker_callback_tag = None
294
358
self.checker = None
295
if os.WIFEXITED(condition) \
296
and (os.WEXITSTATUS(condition) == 0):
297
logger.info(u"Checker for %(name)s succeeded",
299
self.last_checked_ok = now
300
gobject.source_remove(self.stop_initiator_tag)
301
self.stop_initiator_tag = gobject.timeout_add\
302
(self._timeout_milliseconds,
304
elif not os.WIFEXITED(condition):
359
if os.WIFEXITED(condition):
360
exitstatus = os.WEXITSTATUS(condition)
362
logger.info(u"Checker for %(name)s succeeded",
366
logger.info(u"Checker for %(name)s failed",
305
369
logger.warning(u"Checker for %(name)s crashed?",
308
logger.info(u"Checker for %(name)s failed",
372
def checked_ok(self):
373
"""Bump up the timeout for this client.
375
This should only be called when the client has been seen,
378
self.last_checked_ok = datetime.datetime.utcnow()
379
gobject.source_remove(self.disable_initiator_tag)
380
self.disable_initiator_tag = (gobject.timeout_add
381
(self.timeout_milliseconds(),
310
384
def start_checker(self):
311
385
"""Start a new checker subprocess if one is not running.
312
387
If a checker already exists, leave it running and do
314
389
# The reason for not killing a running checker is that if we
369
466
if error.errno != errno.ESRCH: # No such process
371
468
self.checker = None
372
470
def still_valid(self):
373
471
"""Has the timeout not yet passed for this client?"""
374
now = datetime.datetime.now()
472
if not getattr(self, u"enabled", False):
474
now = datetime.datetime.utcnow()
375
475
if self.last_checked_ok is None:
376
476
return now < (self.created + self.timeout)
378
478
return now < (self.last_checked_ok + self.timeout)
381
def peer_certificate(session):
382
"Return the peer's OpenPGP certificate as a bytestring"
383
# If not an OpenPGP certificate...
384
if gnutls.library.functions.gnutls_certificate_type_get\
385
(session._c_object) \
386
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
387
# ...do the normal thing
388
return session.peer_certificate
389
list_size = ctypes.c_uint()
390
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
391
(session._c_object, ctypes.byref(list_size))
392
if list_size.value == 0:
395
return ctypes.string_at(cert.data, cert.size)
398
def fingerprint(openpgp):
399
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
400
# New GnuTLS "datum" with the OpenPGP public key
401
datum = gnutls.library.types.gnutls_datum_t\
402
(ctypes.cast(ctypes.c_char_p(openpgp),
403
ctypes.POINTER(ctypes.c_ubyte)),
404
ctypes.c_uint(len(openpgp)))
405
# New empty GnuTLS certificate
406
crt = gnutls.library.types.gnutls_openpgp_crt_t()
407
gnutls.library.functions.gnutls_openpgp_crt_init\
409
# Import the OpenPGP public key into the certificate
410
gnutls.library.functions.gnutls_openpgp_crt_import\
411
(crt, ctypes.byref(datum),
412
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
413
# Verify the self signature in the key
414
crtverify = ctypes.c_uint();
415
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
416
(crt, ctypes.c_uint(0), ctypes.byref(crtverify))
417
if crtverify.value != 0:
418
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
419
raise gnutls.errors.CertificateSecurityError("Verify failed")
420
# New buffer for the fingerprint
421
buffer = ctypes.create_string_buffer(20)
422
buffer_length = ctypes.c_size_t()
423
# Get the fingerprint from the certificate into the buffer
424
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
425
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
426
# Deinit the certificate
427
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
428
# Convert the buffer to a Python bytestring
429
fpr = ctypes.string_at(buffer, buffer_length.value)
430
# Convert the bytestring to hexadecimal notation
431
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
435
class tcp_handler(SocketServer.BaseRequestHandler, object):
436
"""A TCP request handler class.
437
Instantiated by IPv6_TCPServer for each request to handle it.
481
class ClientDBus(Client, dbus.service.Object):
482
"""A Client class using D-Bus
485
dbus_object_path: dbus.ObjectPath
486
bus: dbus.SystemBus()
488
# dbus.service.Object doesn't use super(), so we can't either.
490
def __init__(self, bus = None, *args, **kwargs):
492
Client.__init__(self, *args, **kwargs)
493
# Only now, when this client is initialized, can it show up on
495
self.dbus_object_path = (dbus.ObjectPath
497
+ self.name.replace(u".", u"_")))
498
dbus.service.Object.__init__(self, self.bus,
499
self.dbus_object_path)
502
def _datetime_to_dbus(dt, variant_level=0):
503
"""Convert a UTC datetime.datetime() to a D-Bus type."""
504
return dbus.String(dt.isoformat(),
505
variant_level=variant_level)
508
oldstate = getattr(self, u"enabled", False)
509
r = Client.enable(self)
510
if oldstate != self.enabled:
512
self.PropertyChanged(dbus.String(u"enabled"),
513
dbus.Boolean(True, variant_level=1))
514
self.PropertyChanged(
515
dbus.String(u"last_enabled"),
516
self._datetime_to_dbus(self.last_enabled,
520
def disable(self, signal = True):
521
oldstate = getattr(self, u"enabled", False)
522
r = Client.disable(self)
523
if signal and oldstate != self.enabled:
525
self.PropertyChanged(dbus.String(u"enabled"),
526
dbus.Boolean(False, variant_level=1))
529
def __del__(self, *args, **kwargs):
531
self.remove_from_connection()
534
if hasattr(dbus.service.Object, u"__del__"):
535
dbus.service.Object.__del__(self, *args, **kwargs)
536
Client.__del__(self, *args, **kwargs)
538
def checker_callback(self, pid, condition, command,
540
self.checker_callback_tag = None
543
self.PropertyChanged(dbus.String(u"checker_running"),
544
dbus.Boolean(False, variant_level=1))
545
if os.WIFEXITED(condition):
546
exitstatus = os.WEXITSTATUS(condition)
548
self.CheckerCompleted(dbus.Int16(exitstatus),
549
dbus.Int64(condition),
550
dbus.String(command))
553
self.CheckerCompleted(dbus.Int16(-1),
554
dbus.Int64(condition),
555
dbus.String(command))
557
return Client.checker_callback(self, pid, condition, command,
560
def checked_ok(self, *args, **kwargs):
561
r = Client.checked_ok(self, *args, **kwargs)
563
self.PropertyChanged(
564
dbus.String(u"last_checked_ok"),
565
(self._datetime_to_dbus(self.last_checked_ok,
569
def start_checker(self, *args, **kwargs):
570
old_checker = self.checker
571
if self.checker is not None:
572
old_checker_pid = self.checker.pid
574
old_checker_pid = None
575
r = Client.start_checker(self, *args, **kwargs)
576
# Only if new checker process was started
577
if (self.checker is not None
578
and old_checker_pid != self.checker.pid):
580
self.CheckerStarted(self.current_checker_command)
581
self.PropertyChanged(
582
dbus.String(u"checker_running"),
583
dbus.Boolean(True, variant_level=1))
586
def stop_checker(self, *args, **kwargs):
587
old_checker = getattr(self, u"checker", None)
588
r = Client.stop_checker(self, *args, **kwargs)
589
if (old_checker is not None
590
and getattr(self, u"checker", None) is None):
591
self.PropertyChanged(dbus.String(u"checker_running"),
592
dbus.Boolean(False, variant_level=1))
595
## D-Bus methods & signals
596
_interface = u"se.bsnet.fukt.Mandos.Client"
599
@dbus.service.method(_interface)
601
return self.checked_ok()
603
# CheckerCompleted - signal
604
@dbus.service.signal(_interface, signature=u"nxs")
605
def CheckerCompleted(self, exitcode, waitstatus, command):
609
# CheckerStarted - signal
610
@dbus.service.signal(_interface, signature=u"s")
611
def CheckerStarted(self, command):
615
# GetAllProperties - method
616
@dbus.service.method(_interface, out_signature=u"a{sv}")
617
def GetAllProperties(self):
619
return dbus.Dictionary({
620
dbus.String(u"name"):
621
dbus.String(self.name, variant_level=1),
622
dbus.String(u"fingerprint"):
623
dbus.String(self.fingerprint, variant_level=1),
624
dbus.String(u"host"):
625
dbus.String(self.host, variant_level=1),
626
dbus.String(u"created"):
627
self._datetime_to_dbus(self.created,
629
dbus.String(u"last_enabled"):
630
(self._datetime_to_dbus(self.last_enabled,
632
if self.last_enabled is not None
633
else dbus.Boolean(False, variant_level=1)),
634
dbus.String(u"enabled"):
635
dbus.Boolean(self.enabled, variant_level=1),
636
dbus.String(u"last_checked_ok"):
637
(self._datetime_to_dbus(self.last_checked_ok,
639
if self.last_checked_ok is not None
640
else dbus.Boolean (False, variant_level=1)),
641
dbus.String(u"timeout"):
642
dbus.UInt64(self.timeout_milliseconds(),
644
dbus.String(u"interval"):
645
dbus.UInt64(self.interval_milliseconds(),
647
dbus.String(u"checker"):
648
dbus.String(self.checker_command,
650
dbus.String(u"checker_running"):
651
dbus.Boolean(self.checker is not None,
653
dbus.String(u"object_path"):
654
dbus.ObjectPath(self.dbus_object_path,
658
# IsStillValid - method
659
@dbus.service.method(_interface, out_signature=u"b")
660
def IsStillValid(self):
661
return self.still_valid()
663
# PropertyChanged - signal
664
@dbus.service.signal(_interface, signature=u"sv")
665
def PropertyChanged(self, property, value):
669
# ReceivedSecret - signal
670
@dbus.service.signal(_interface)
671
def ReceivedSecret(self):
676
@dbus.service.signal(_interface)
681
# SetChecker - method
682
@dbus.service.method(_interface, in_signature=u"s")
683
def SetChecker(self, checker):
684
"D-Bus setter method"
685
self.checker_command = checker
687
self.PropertyChanged(dbus.String(u"checker"),
688
dbus.String(self.checker_command,
692
@dbus.service.method(_interface, in_signature=u"s")
693
def SetHost(self, host):
694
"D-Bus setter method"
697
self.PropertyChanged(dbus.String(u"host"),
698
dbus.String(self.host, variant_level=1))
700
# SetInterval - method
701
@dbus.service.method(_interface, in_signature=u"t")
702
def SetInterval(self, milliseconds):
703
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
705
self.PropertyChanged(dbus.String(u"interval"),
707
.interval_milliseconds(),
711
@dbus.service.method(_interface, in_signature=u"ay",
713
def SetSecret(self, secret):
714
"D-Bus setter method"
715
self.secret = str(secret)
717
# SetTimeout - method
718
@dbus.service.method(_interface, in_signature=u"t")
719
def SetTimeout(self, milliseconds):
720
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
722
self.PropertyChanged(dbus.String(u"timeout"),
723
(dbus.UInt64(self.timeout_milliseconds(),
727
@dbus.service.method(_interface)
732
# StartChecker - method
733
@dbus.service.method(_interface)
734
def StartChecker(self):
739
@dbus.service.method(_interface)
744
# StopChecker - method
745
@dbus.service.method(_interface)
746
def StopChecker(self):
752
class ClientHandler(socketserver.BaseRequestHandler, object):
753
"""A class to handle client connections.
755
Instantiated once for each connection to handle it.
438
756
Note: This will run in its own forked process."""
440
758
def handle(self):
441
759
logger.info(u"TCP connection from: %s",
442
unicode(self.client_address))
443
session = gnutls.connection.ClientSession\
444
(self.request, gnutls.connection.X509Credentials())
446
line = self.request.makefile().readline()
447
logger.debug(u"Protocol version: %r", line)
449
if int(line.strip().split()[0]) > 1:
451
except (ValueError, IndexError, RuntimeError), error:
452
logger.error(u"Unknown protocol version: %s", error)
455
# Note: gnutls.connection.X509Credentials is really a generic
456
# GnuTLS certificate credentials object so long as no X.509
457
# keys are added to it. Therefore, we can use it here despite
458
# using OpenPGP certificates.
460
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
461
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
463
priority = "NORMAL" # Fallback default, since this
465
if self.server.settings["priority"]:
466
priority = self.server.settings["priority"]
467
gnutls.library.functions.gnutls_priority_set_direct\
468
(session._c_object, priority, None);
472
except gnutls.errors.GNUTLSError, error:
473
logger.warning(u"Handshake failed: %s", error)
474
# Do not run session.bye() here: the session is not
475
# established. Just abandon the request.
478
fpr = fingerprint(peer_certificate(session))
479
except (TypeError, gnutls.errors.GNUTLSError), error:
480
logger.warning(u"Bad certificate: %s", error)
483
logger.debug(u"Fingerprint: %s", fpr)
485
for c in self.server.clients:
486
if c.fingerprint == fpr:
490
logger.warning(u"Client not found for fingerprint: %s",
494
# Have to check if client.still_valid(), since it is possible
495
# that the client timed out while establishing the GnuTLS
497
if not client.still_valid():
498
logger.warning(u"Client %(name)s is invalid",
503
while sent_size < len(client.secret):
504
sent = session.send(client.secret[sent_size:])
505
logger.debug(u"Sent: %d, remaining: %d",
506
sent, len(client.secret)
507
- (sent_size + sent))
512
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
513
"""IPv6 TCP server. Accepts 'None' as address and/or port.
760
unicode(self.client_address))
761
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
762
# Open IPC pipe to parent process
763
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
764
session = (gnutls.connection
765
.ClientSession(self.request,
769
line = self.request.makefile().readline()
770
logger.debug(u"Protocol version: %r", line)
772
if int(line.strip().split()[0]) > 1:
774
except (ValueError, IndexError, RuntimeError), error:
775
logger.error(u"Unknown protocol version: %s", error)
778
# Note: gnutls.connection.X509Credentials is really a
779
# generic GnuTLS certificate credentials object so long as
780
# no X.509 keys are added to it. Therefore, we can use it
781
# here despite using OpenPGP certificates.
783
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
784
# u"+AES-256-CBC", u"+SHA1",
785
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
787
# Use a fallback default, since this MUST be set.
788
priority = self.server.gnutls_priority
791
(gnutls.library.functions
792
.gnutls_priority_set_direct(session._c_object,
797
except gnutls.errors.GNUTLSError, error:
798
logger.warning(u"Handshake failed: %s", error)
799
# Do not run session.bye() here: the session is not
800
# established. Just abandon the request.
802
logger.debug(u"Handshake succeeded")
804
fpr = self.fingerprint(self.peer_certificate(session))
805
except (TypeError, gnutls.errors.GNUTLSError), error:
806
logger.warning(u"Bad certificate: %s", error)
809
logger.debug(u"Fingerprint: %s", fpr)
811
for c in self.server.clients:
812
if c.fingerprint == fpr:
816
ipc.write(u"NOTFOUND %s %s\n"
817
% (fpr, unicode(self.client_address)))
820
# Have to check if client.still_valid(), since it is
821
# possible that the client timed out while establishing
822
# the GnuTLS session.
823
if not client.still_valid():
824
ipc.write(u"INVALID %s\n" % client.name)
827
ipc.write(u"SENDING %s\n" % client.name)
829
while sent_size < len(client.secret):
830
sent = session.send(client.secret[sent_size:])
831
logger.debug(u"Sent: %d, remaining: %d",
832
sent, len(client.secret)
833
- (sent_size + sent))
838
def peer_certificate(session):
839
"Return the peer's OpenPGP certificate as a bytestring"
840
# If not an OpenPGP certificate...
841
if (gnutls.library.functions
842
.gnutls_certificate_type_get(session._c_object)
843
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
844
# ...do the normal thing
845
return session.peer_certificate
846
list_size = ctypes.c_uint(1)
847
cert_list = (gnutls.library.functions
848
.gnutls_certificate_get_peers
849
(session._c_object, ctypes.byref(list_size)))
850
if not bool(cert_list) and list_size.value != 0:
851
raise gnutls.errors.GNUTLSError(u"error getting peer"
853
if list_size.value == 0:
856
return ctypes.string_at(cert.data, cert.size)
859
def fingerprint(openpgp):
860
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
861
# New GnuTLS "datum" with the OpenPGP public key
862
datum = (gnutls.library.types
863
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
866
ctypes.c_uint(len(openpgp))))
867
# New empty GnuTLS certificate
868
crt = gnutls.library.types.gnutls_openpgp_crt_t()
869
(gnutls.library.functions
870
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
871
# Import the OpenPGP public key into the certificate
872
(gnutls.library.functions
873
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
874
gnutls.library.constants
875
.GNUTLS_OPENPGP_FMT_RAW))
876
# Verify the self signature in the key
877
crtverify = ctypes.c_uint()
878
(gnutls.library.functions
879
.gnutls_openpgp_crt_verify_self(crt, 0,
880
ctypes.byref(crtverify)))
881
if crtverify.value != 0:
882
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
883
raise (gnutls.errors.CertificateSecurityError
885
# New buffer for the fingerprint
886
buf = ctypes.create_string_buffer(20)
887
buf_len = ctypes.c_size_t()
888
# Get the fingerprint from the certificate into the buffer
889
(gnutls.library.functions
890
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
891
ctypes.byref(buf_len)))
892
# Deinit the certificate
893
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
894
# Convert the buffer to a Python bytestring
895
fpr = ctypes.string_at(buf, buf_len.value)
896
# Convert the bytestring to hexadecimal notation
897
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
901
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
902
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
903
def process_request(self, request, client_address):
904
"""Overrides and wraps the original process_request().
906
This function creates a new pipe in self.pipe
908
self.pipe = os.pipe()
909
super(ForkingMixInWithPipe,
910
self).process_request(request, client_address)
911
os.close(self.pipe[1]) # close write end
912
self.add_pipe(self.pipe[0])
913
def add_pipe(self, pipe):
914
"""Dummy function; override as necessary"""
918
class IPv6_TCPServer(ForkingMixInWithPipe,
919
socketserver.TCPServer, object):
920
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
515
settings: Server settings
516
clients: Set() of Client objects
923
enabled: Boolean; whether this server is activated yet
924
interface: None or a network interface name (string)
925
use_ipv6: Boolean; to use IPv6 or not
518
address_family = socket.AF_INET6
519
def __init__(self, *args, **kwargs):
520
if "settings" in kwargs:
521
self.settings = kwargs["settings"]
522
del kwargs["settings"]
523
if "clients" in kwargs:
524
self.clients = kwargs["clients"]
525
del kwargs["clients"]
526
return super(type(self), self).__init__(*args, **kwargs)
927
def __init__(self, server_address, RequestHandlerClass,
928
interface=None, use_ipv6=True):
929
self.interface = interface
931
self.address_family = socket.AF_INET6
932
socketserver.TCPServer.__init__(self, server_address,
527
934
def server_bind(self):
528
935
"""This overrides the normal server_bind() function
529
936
to bind to an interface if one was specified, and also NOT to
530
937
bind to an address or port if they were not specified."""
531
if self.settings["interface"]:
532
# 25 is from /usr/include/asm-i486/socket.h
533
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
535
self.socket.setsockopt(socket.SOL_SOCKET,
537
self.settings["interface"])
538
except socket.error, error:
539
if error[0] == errno.EPERM:
540
logger.error(u"No permission to"
541
u" bind to interface %s",
542
self.settings["interface"])
938
if self.interface is not None:
939
if SO_BINDTODEVICE is None:
940
logger.error(u"SO_BINDTODEVICE does not exist;"
941
u" cannot bind to interface %s",
945
self.socket.setsockopt(socket.SOL_SOCKET,
949
except socket.error, error:
950
if error[0] == errno.EPERM:
951
logger.error(u"No permission to"
952
u" bind to interface %s",
954
elif error[0] == errno.ENOPROTOOPT:
955
logger.error(u"SO_BINDTODEVICE not available;"
956
u" cannot bind to interface %s",
545
960
# Only bind(2) the socket if we really need to.
546
961
if self.server_address[0] or self.server_address[1]:
547
962
if not self.server_address[0]:
549
self.server_address = (in6addr_any,
963
if self.address_family == socket.AF_INET6:
964
any_address = u"::" # in6addr_any
966
any_address = socket.INADDR_ANY
967
self.server_address = (any_address,
550
968
self.server_address[1])
551
969
elif not self.server_address[1]:
552
970
self.server_address = (self.server_address[0],
554
# if self.settings["interface"]:
555
973
# self.server_address = (self.server_address[0],
561
return super(type(self), self).server_bind()
978
return socketserver.TCPServer.server_bind(self)
981
class MandosServer(IPv6_TCPServer):
985
clients: set of Client objects
986
gnutls_priority GnuTLS priority string
987
use_dbus: Boolean; to emit D-Bus signals or not
989
Assumes a gobject.MainLoop event loop.
991
def __init__(self, server_address, RequestHandlerClass,
992
interface=None, use_ipv6=True, clients=None,
993
gnutls_priority=None, use_dbus=True):
995
self.clients = clients
996
if self.clients is None:
998
self.use_dbus = use_dbus
999
self.gnutls_priority = gnutls_priority
1000
IPv6_TCPServer.__init__(self, server_address,
1001
RequestHandlerClass,
1002
interface = interface,
1003
use_ipv6 = use_ipv6)
1004
def server_activate(self):
1006
return socketserver.TCPServer.server_activate(self)
1009
def add_pipe(self, pipe):
1010
# Call "handle_ipc" for both data and EOF events
1011
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1013
def handle_ipc(self, source, condition, file_objects={}):
1015
gobject.IO_IN: u"IN", # There is data to read.
1016
gobject.IO_OUT: u"OUT", # Data can be written (without
1018
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1019
gobject.IO_ERR: u"ERR", # Error condition.
1020
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1021
# broken, usually for pipes and
1024
conditions_string = ' | '.join(name
1026
condition_names.iteritems()
1027
if cond & condition)
1028
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1031
# Turn the pipe file descriptor into a Python file object
1032
if source not in file_objects:
1033
file_objects[source] = os.fdopen(source, u"r", 1)
1035
# Read a line from the file object
1036
cmdline = file_objects[source].readline()
1037
if not cmdline: # Empty line means end of file
1038
# close the IPC pipe
1039
file_objects[source].close()
1040
del file_objects[source]
1042
# Stop calling this function
1045
logger.debug(u"IPC command: %r", cmdline)
1047
# Parse and act on command
1048
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1050
if cmd == u"NOTFOUND":
1051
logger.warning(u"Client not found for fingerprint: %s",
1055
mandos_dbus_service.ClientNotFound(args)
1056
elif cmd == u"INVALID":
1057
for client in self.clients:
1058
if client.name == args:
1059
logger.warning(u"Client %s is invalid", args)
1065
logger.error(u"Unknown client %s is invalid", args)
1066
elif cmd == u"SENDING":
1067
for client in self.clients:
1068
if client.name == args:
1069
logger.info(u"Sending secret to %s", client.name)
1073
client.ReceivedSecret()
1076
logger.error(u"Sending secret to unknown client %s",
1079
logger.error(u"Unknown IPC command: %r", cmdline)
1081
# Keep calling this function
564
1085
def string_to_delta(interval):
565
1086
"""Parse a string and return a datetime.timedelta
567
>>> string_to_delta('7d')
1088
>>> string_to_delta(u'7d')
568
1089
datetime.timedelta(7)
569
>>> string_to_delta('60s')
1090
>>> string_to_delta(u'60s')
570
1091
datetime.timedelta(0, 60)
571
>>> string_to_delta('60m')
1092
>>> string_to_delta(u'60m')
572
1093
datetime.timedelta(0, 3600)
573
>>> string_to_delta('24h')
1094
>>> string_to_delta(u'24h')
574
1095
datetime.timedelta(1)
575
1096
>>> string_to_delta(u'1w')
576
1097
datetime.timedelta(7)
577
>>> string_to_delta('5m 30s')
1098
>>> string_to_delta(u'5m 30s')
578
1099
datetime.timedelta(0, 330)
580
1101
timevalue = datetime.timedelta(0)
581
1102
for s in interval.split():
583
suffix=unicode(s[-1])
1104
suffix = unicode(s[-1])
585
1106
if suffix == u"d":
586
1107
delta = datetime.timedelta(value)
587
1108
elif suffix == u"s":
705
1209
# Default values for config file for server-global settings
706
server_defaults = { "interface": "",
711
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
712
"servicename": "Mandos",
1210
server_defaults = { u"interface": u"",
1215
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1216
u"servicename": u"Mandos",
1217
u"use_dbus": u"True",
1218
u"use_ipv6": u"True",
715
1221
# Parse config file for server-global settings
716
server_config = ConfigParser.SafeConfigParser(server_defaults)
1222
server_config = configparser.SafeConfigParser(server_defaults)
717
1223
del server_defaults
718
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1224
server_config.read(os.path.join(options.configdir,
719
1226
# Convert the SafeConfigParser object to a dict
720
1227
server_settings = server_config.defaults()
721
# Use getboolean on the boolean config option
722
server_settings["debug"] = server_config.getboolean\
1228
# Use the appropriate methods on the non-string config options
1229
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1230
server_settings[option] = server_config.getboolean(u"DEFAULT",
1232
if server_settings["port"]:
1233
server_settings["port"] = server_config.getint(u"DEFAULT",
724
1235
del server_config
726
1237
# Override the settings from the config file with command line
727
1238
# options, if set.
728
for option in ("interface", "address", "port", "debug",
729
"priority", "servicename", "configdir"):
1239
for option in (u"interface", u"address", u"port", u"debug",
1240
u"priority", u"servicename", u"configdir",
1241
u"use_dbus", u"use_ipv6"):
730
1242
value = getattr(options, option)
731
1243
if value is not None:
732
1244
server_settings[option] = value
1246
# Force all strings to be unicode
1247
for option in server_settings.keys():
1248
if type(server_settings[option]) is str:
1249
server_settings[option] = unicode(server_settings[option])
734
1250
# Now we have our good server settings in "server_settings"
736
debug = server_settings["debug"]
1252
##################################################################
1255
debug = server_settings[u"debug"]
1256
use_dbus = server_settings[u"use_dbus"]
1257
use_ipv6 = server_settings[u"use_ipv6"]
739
1260
syslogger.setLevel(logging.WARNING)
740
1261
console.setLevel(logging.WARNING)
742
if server_settings["servicename"] != "Mandos":
743
syslogger.setFormatter(logging.Formatter\
744
('Mandos (%s): %%(levelname)s:'
746
% server_settings["servicename"]))
1263
if server_settings[u"servicename"] != u"Mandos":
1264
syslogger.setFormatter(logging.Formatter
1265
(u'Mandos (%s) [%%(process)d]:'
1266
u' %%(levelname)s: %%(message)s'
1267
% server_settings[u"servicename"]))
748
1269
# Parse config file with clients
749
client_defaults = { "timeout": "1h",
751
"checker": "fping -q -- %(host)s",
1270
client_defaults = { u"timeout": u"1h",
1272
u"checker": u"fping -q -- %%(host)s",
754
client_config = ConfigParser.SafeConfigParser(client_defaults)
755
client_config.read(os.path.join(server_settings["configdir"],
759
service = AvahiService(name = server_settings["servicename"],
760
type = "_mandos._tcp", );
761
if server_settings["interface"]:
762
service.interface = if_nametoindex(server_settings["interface"])
1275
client_config = configparser.SafeConfigParser(client_defaults)
1276
client_config.read(os.path.join(server_settings[u"configdir"],
1279
global mandos_dbus_service
1280
mandos_dbus_service = None
1282
tcp_server = MandosServer((server_settings[u"address"],
1283
server_settings[u"port"]),
1285
interface=server_settings[u"interface"],
1288
server_settings[u"priority"],
1290
pidfilename = u"/var/run/mandos.pid"
1292
pidfile = open(pidfilename, u"w")
1294
logger.error(u"Could not open file %r", pidfilename)
1297
uid = pwd.getpwnam(u"_mandos").pw_uid
1298
gid = pwd.getpwnam(u"_mandos").pw_gid
1301
uid = pwd.getpwnam(u"mandos").pw_uid
1302
gid = pwd.getpwnam(u"mandos").pw_gid
1305
uid = pwd.getpwnam(u"nobody").pw_uid
1306
gid = pwd.getpwnam(u"nobody").pw_gid
1313
except OSError, error:
1314
if error[0] != errno.EPERM:
1317
# Enable all possible GnuTLS debugging
1319
# "Use a log level over 10 to enable all debugging options."
1321
gnutls.library.functions.gnutls_global_set_log_level(11)
1323
@gnutls.library.types.gnutls_log_func
1324
def debug_gnutls(level, string):
1325
logger.debug(u"GnuTLS: %s", string[:-1])
1327
(gnutls.library.functions
1328
.gnutls_global_set_log_function(debug_gnutls))
764
1330
global main_loop
767
1331
# From the Avahi example code
768
1332
DBusGMainLoop(set_as_default=True )
769
1333
main_loop = gobject.MainLoop()
770
1334
bus = dbus.SystemBus()
771
server = dbus.Interface(
772
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
773
avahi.DBUS_INTERFACE_SERVER )
774
1335
# End of Avahi example code
777
def remove_from_clients(client):
778
clients.remove(client)
780
logger.critical(u"No clients left, exiting")
783
clients.update(Set(Client(name = section,
784
stop_hook = remove_from_clients,
786
= dict(client_config.items(section)))
787
for section in client_config.sections()))
789
logger.critical(u"No clients defined")
1337
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1338
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1339
service = AvahiService(name = server_settings[u"servicename"],
1340
servicetype = u"_mandos._tcp",
1341
protocol = protocol, bus = bus)
1342
if server_settings["interface"]:
1343
service.interface = (if_nametoindex
1344
(str(server_settings[u"interface"])))
1346
client_class = Client
1348
client_class = functools.partial(ClientDBus, bus = bus)
1349
tcp_server.clients.update(set(
1350
client_class(name = section,
1351
config= dict(client_config.items(section)))
1352
for section in client_config.sections()))
1353
if not tcp_server.clients:
1354
logger.warning(u"No clients defined")
793
1357
# Redirect stdin so all checkers get /dev/null