106
124
max_renames: integer; maximum number of renames
107
125
rename_count: integer; counter so we only rename after collisions
108
126
a sensible number of times
127
group: D-Bus Entry Group
129
bus: dbus.SystemBus()
110
131
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
111
type = None, port = None, TXT = None, domain = "",
112
host = "", max_renames = 32768):
132
servicetype = None, port = None, TXT = None,
133
domain = u"", host = u"", max_renames = 32768,
134
protocol = avahi.PROTO_UNSPEC, bus = None):
113
135
self.interface = interface
137
self.type = servicetype
139
self.TXT = TXT if TXT is not None else []
121
140
self.domain = domain
123
142
self.rename_count = 0
124
143
self.max_renames = max_renames
144
self.protocol = protocol
145
self.group = None # our entry group
125
148
def rename(self):
126
149
"""Derived from the Avahi example code"""
127
150
if self.rename_count >= self.max_renames:
128
151
logger.critical(u"No suitable Zeroconf service name found"
129
152
u" after %i retries, exiting.",
131
raise AvahiServiceError("Too many renames")
132
self.name = server.GetAlternativeServiceName(self.name)
154
raise AvahiServiceError(u"Too many renames")
155
self.name = self.server.GetAlternativeServiceName(self.name)
133
156
logger.info(u"Changing Zeroconf service name to %r ...",
135
syslogger.setFormatter(logging.Formatter\
136
('Mandos (%s): %%(levelname)s:'
137
' %%(message)s' % self.name))
158
syslogger.setFormatter(logging.Formatter
159
(u'Mandos (%s) [%%(process)d]:'
160
u' %%(levelname)s: %%(message)s'
140
164
self.rename_count += 1
141
165
def remove(self):
142
166
"""Derived from the Avahi example code"""
143
if group is not None:
167
if self.group is not None:
146
170
"""Derived from the Avahi example code"""
149
group = dbus.Interface\
150
(bus.get_object(avahi.DBUS_NAME,
151
server.EntryGroupNew()),
152
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
group.connect_to_signal('StateChanged',
154
entry_group_state_changed)
171
if self.group is None:
172
self.group = dbus.Interface(
173
self.bus.get_object(avahi.DBUS_NAME,
174
self.server.EntryGroupNew()),
175
avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
self.group.connect_to_signal('StateChanged',
178
.entry_group_state_changed)
155
179
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
156
service.name, service.type)
158
self.interface, # interface
159
avahi.PROTO_INET6, # protocol
160
dbus.UInt32(0), # flags
161
self.name, self.type,
162
self.domain, self.host,
163
dbus.UInt16(self.port),
164
avahi.string_array_to_txt_array(self.TXT))
167
# From the Avahi example code:
168
group = None # our entry group
169
# End of Avahi example code
180
self.name, self.type)
181
self.group.AddService(
184
dbus.UInt32(0), # flags
185
self.name, self.type,
186
self.domain, self.host,
187
dbus.UInt16(self.port),
188
avahi.string_array_to_txt_array(self.TXT))
190
def entry_group_state_changed(self, state, error):
191
"""Derived from the Avahi example code"""
192
logger.debug(u"Avahi state change: %i", state)
194
if state == avahi.ENTRY_GROUP_ESTABLISHED:
195
logger.debug(u"Zeroconf service established.")
196
elif state == avahi.ENTRY_GROUP_COLLISION:
197
logger.warning(u"Zeroconf service name collision.")
199
elif state == avahi.ENTRY_GROUP_FAILURE:
200
logger.critical(u"Avahi: Error in group state changed %s",
202
raise AvahiGroupError(u"State changed: %s"
205
"""Derived from the Avahi example code"""
206
if self.group is not None:
209
def server_state_changed(self, state):
210
"""Derived from the Avahi example code"""
211
if state == avahi.SERVER_COLLISION:
212
logger.error(u"Zeroconf server name collision")
214
elif state == avahi.SERVER_RUNNING:
217
"""Derived from the Avahi example code"""
218
if self.server is None:
219
self.server = dbus.Interface(
220
self.bus.get_object(avahi.DBUS_NAME,
221
avahi.DBUS_PATH_SERVER),
222
avahi.DBUS_INTERFACE_SERVER)
223
self.server.connect_to_signal(u"StateChanged",
224
self.server_state_changed)
225
self.server_state_changed(self.server.GetState())
172
228
class Client(object):
173
229
"""A representation of a client host served by this server.
175
name: string; from the config file, used in log messages
232
name: string; from the config file, used in log messages and
176
234
fingerprint: string (40 or 32 hexadecimal digits); used to
177
235
uniquely identify the client
178
secret: bytestring; sent verbatim (over TLS) to client
179
host: string; available for use by the checker command
180
created: datetime.datetime(); object creation, not client host
181
last_checked_ok: datetime.datetime() or None if not yet checked OK
182
timeout: datetime.timedelta(); How long from last_checked_ok
183
until this client is invalid
184
interval: datetime.timedelta(); How often to start a new checker
185
stop_hook: If set, called by stop() as stop_hook(self)
186
checker: subprocess.Popen(); a running checker process used
187
to see if the client lives.
188
'None' if no process is running.
236
secret: bytestring; sent verbatim (over TLS) to client
237
host: string; available for use by the checker command
238
created: datetime.datetime(); (UTC) object creation
239
last_enabled: datetime.datetime(); (UTC)
241
last_checked_ok: datetime.datetime(); (UTC) or None
242
timeout: datetime.timedelta(); How long from last_checked_ok
243
until this client is invalid
244
interval: datetime.timedelta(); How often to start a new checker
245
disable_hook: If set, called by disable() as disable_hook(self)
246
checker: subprocess.Popen(); a running checker process used
247
to see if the client lives.
248
'None' if no process is running.
189
249
checker_initiator_tag: a gobject event source tag, or None
190
stop_initiator_tag: - '' -
250
disable_initiator_tag: - '' -
191
251
checker_callback_tag: - '' -
192
252
checker_command: string; External command which is run to check if
193
253
client lives. %() expansions are done at
194
254
runtime with vars(self) as dict, so that for
195
255
instance %(name)s can be used in the command.
197
_timeout: Real variable for 'timeout'
198
_interval: Real variable for 'interval'
199
_timeout_milliseconds: Used when calling gobject.timeout_add()
200
_interval_milliseconds: - '' -
256
current_checker_command: string; current running checker_command
202
def _set_timeout(self, timeout):
203
"Setter function for 'timeout' attribute"
204
self._timeout = timeout
205
self._timeout_milliseconds = ((self.timeout.days
206
* 24 * 60 * 60 * 1000)
207
+ (self.timeout.seconds * 1000)
208
+ (self.timeout.microseconds
210
timeout = property(lambda self: self._timeout,
213
def _set_interval(self, interval):
214
"Setter function for 'interval' attribute"
215
self._interval = interval
216
self._interval_milliseconds = ((self.interval.days
217
* 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds
220
+ (self.interval.microseconds
222
interval = property(lambda self: self._interval,
225
def __init__(self, name = None, stop_hook=None, config={}):
260
def _datetime_to_milliseconds(dt):
261
"Convert a datetime.datetime() to milliseconds"
262
return ((dt.days * 24 * 60 * 60 * 1000)
263
+ (dt.seconds * 1000)
264
+ (dt.microseconds // 1000))
266
def timeout_milliseconds(self):
267
"Return the 'timeout' attribute in milliseconds"
268
return self._datetime_to_milliseconds(self.timeout)
270
def interval_milliseconds(self):
271
"Return the 'interval' attribute in milliseconds"
272
return self._datetime_to_milliseconds(self.interval)
274
def __init__(self, name = None, disable_hook=None, config=None):
226
275
"""Note: the 'checker' key in 'config' sets the
227
276
'checker_command' attribute and *not* the 'checker'
230
281
logger.debug(u"Creating client %r", self.name)
231
282
# Uppercase and remove spaces from fingerprint for later
232
283
# comparison purposes with return value from the fingerprint()
234
self.fingerprint = config["fingerprint"].upper()\
285
self.fingerprint = (config[u"fingerprint"].upper()
236
287
logger.debug(u" Fingerprint: %s", self.fingerprint)
237
if "secret" in config:
238
self.secret = config["secret"].decode(u"base64")
239
elif "secfile" in config:
240
sf = open(config["secfile"])
241
self.secret = sf.read()
288
if u"secret" in config:
289
self.secret = config[u"secret"].decode(u"base64")
290
elif u"secfile" in config:
291
with closing(open(os.path.expanduser
293
(config[u"secfile"])))) as secfile:
294
self.secret = secfile.read()
244
296
raise TypeError(u"No secret or secfile for client %s"
246
self.host = config.get("host", "")
247
self.created = datetime.datetime.now()
298
self.host = config.get(u"host", u"")
299
self.created = datetime.datetime.utcnow()
301
self.last_enabled = None
248
302
self.last_checked_ok = None
249
self.timeout = string_to_delta(config["timeout"])
250
self.interval = string_to_delta(config["interval"])
251
self.stop_hook = stop_hook
303
self.timeout = string_to_delta(config[u"timeout"])
304
self.interval = string_to_delta(config[u"interval"])
305
self.disable_hook = disable_hook
252
306
self.checker = None
253
307
self.checker_initiator_tag = None
254
self.stop_initiator_tag = None
308
self.disable_initiator_tag = None
255
309
self.checker_callback_tag = None
256
self.check_command = config["checker"]
310
self.checker_command = config[u"checker"]
311
self.current_checker_command = None
312
self.last_connect = None
258
315
"""Start this client's checker and timeout hooks"""
316
if getattr(self, u"enabled", False):
319
self.last_enabled = datetime.datetime.utcnow()
259
320
# Schedule a new checker to be started an 'interval' from now,
260
321
# and every interval from then on.
261
self.checker_initiator_tag = gobject.timeout_add\
262
(self._interval_milliseconds,
322
self.checker_initiator_tag = (gobject.timeout_add
323
(self.interval_milliseconds(),
264
325
# Also start a new checker *right now*.
265
326
self.start_checker()
266
# Schedule a stop() when 'timeout' has passed
267
self.stop_initiator_tag = gobject.timeout_add\
268
(self._timeout_milliseconds,
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
274
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
276
logger.info(u"Stopping client %s", self.name)
327
# Schedule a disable() when 'timeout' has passed
328
self.disable_initiator_tag = (gobject.timeout_add
329
(self.timeout_milliseconds(),
334
"""Disable this client."""
335
if not getattr(self, "enabled", False):
280
if getattr(self, "stop_initiator_tag", False):
281
gobject.source_remove(self.stop_initiator_tag)
282
self.stop_initiator_tag = None
283
if getattr(self, "checker_initiator_tag", False):
337
logger.info(u"Disabling client %s", self.name)
338
if getattr(self, u"disable_initiator_tag", False):
339
gobject.source_remove(self.disable_initiator_tag)
340
self.disable_initiator_tag = None
341
if getattr(self, u"checker_initiator_tag", False):
284
342
gobject.source_remove(self.checker_initiator_tag)
285
343
self.checker_initiator_tag = None
286
344
self.stop_checker()
345
if self.disable_hook:
346
self.disable_hook(self)
289
348
# Do not run this again if called by a gobject.timeout_add
291
351
def __del__(self):
292
self.stop_hook = None
294
def checker_callback(self, pid, condition):
352
self.disable_hook = None
355
def checker_callback(self, pid, condition, command):
295
356
"""The checker has completed, so take appropriate actions."""
296
now = datetime.datetime.now()
297
357
self.checker_callback_tag = None
298
358
self.checker = None
299
if os.WIFEXITED(condition) \
300
and (os.WEXITSTATUS(condition) == 0):
301
logger.info(u"Checker for %(name)s succeeded",
303
self.last_checked_ok = now
304
gobject.source_remove(self.stop_initiator_tag)
305
self.stop_initiator_tag = gobject.timeout_add\
306
(self._timeout_milliseconds,
308
elif not os.WIFEXITED(condition):
359
if os.WIFEXITED(condition):
360
exitstatus = os.WEXITSTATUS(condition)
362
logger.info(u"Checker for %(name)s succeeded",
366
logger.info(u"Checker for %(name)s failed",
309
369
logger.warning(u"Checker for %(name)s crashed?",
312
logger.info(u"Checker for %(name)s failed",
372
def checked_ok(self):
373
"""Bump up the timeout for this client.
375
This should only be called when the client has been seen,
378
self.last_checked_ok = datetime.datetime.utcnow()
379
gobject.source_remove(self.disable_initiator_tag)
380
self.disable_initiator_tag = (gobject.timeout_add
381
(self.timeout_milliseconds(),
314
384
def start_checker(self):
315
385
"""Start a new checker subprocess if one is not running.
316
387
If a checker already exists, leave it running and do
318
389
# The reason for not killing a running checker is that if we
373
466
if error.errno != errno.ESRCH: # No such process
375
468
self.checker = None
376
470
def still_valid(self):
377
471
"""Has the timeout not yet passed for this client?"""
378
now = datetime.datetime.now()
472
if not getattr(self, u"enabled", False):
474
now = datetime.datetime.utcnow()
379
475
if self.last_checked_ok is None:
380
476
return now < (self.created + self.timeout)
382
478
return now < (self.last_checked_ok + self.timeout)
385
def peer_certificate(session):
386
"Return the peer's OpenPGP certificate as a bytestring"
387
# If not an OpenPGP certificate...
388
if gnutls.library.functions.gnutls_certificate_type_get\
389
(session._c_object) \
390
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
391
# ...do the normal thing
392
return session.peer_certificate
393
list_size = ctypes.c_uint()
394
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
(session._c_object, ctypes.byref(list_size))
396
if list_size.value == 0:
399
return ctypes.string_at(cert.data, cert.size)
402
def fingerprint(openpgp):
403
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
404
# New GnuTLS "datum" with the OpenPGP public key
405
datum = gnutls.library.types.gnutls_datum_t\
406
(ctypes.cast(ctypes.c_char_p(openpgp),
407
ctypes.POINTER(ctypes.c_ubyte)),
408
ctypes.c_uint(len(openpgp)))
409
# New empty GnuTLS certificate
410
crt = gnutls.library.types.gnutls_openpgp_crt_t()
411
gnutls.library.functions.gnutls_openpgp_crt_init\
413
# Import the OpenPGP public key into the certificate
414
gnutls.library.functions.gnutls_openpgp_crt_import\
415
(crt, ctypes.byref(datum),
416
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
417
# Verify the self signature in the key
418
crtverify = ctypes.c_uint();
419
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
(crt, 0, ctypes.byref(crtverify))
421
if crtverify.value != 0:
422
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
423
raise gnutls.errors.CertificateSecurityError("Verify failed")
424
# New buffer for the fingerprint
425
buffer = ctypes.create_string_buffer(20)
426
buffer_length = ctypes.c_size_t()
427
# Get the fingerprint from the certificate into the buffer
428
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
430
# Deinit the certificate
431
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
432
# Convert the buffer to a Python bytestring
433
fpr = ctypes.string_at(buffer, buffer_length.value)
434
# Convert the bytestring to hexadecimal notation
435
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
440
"""A TCP request handler class.
441
Instantiated by IPv6_TCPServer for each request to handle it.
481
class ClientDBus(Client, dbus.service.Object):
482
"""A Client class using D-Bus
485
dbus_object_path: dbus.ObjectPath
486
bus: dbus.SystemBus()
488
# dbus.service.Object doesn't use super(), so we can't either.
490
def __init__(self, bus = None, *args, **kwargs):
492
Client.__init__(self, *args, **kwargs)
493
# Only now, when this client is initialized, can it show up on
495
self.dbus_object_path = (dbus.ObjectPath
497
+ self.name.replace(u".", u"_")))
498
dbus.service.Object.__init__(self, self.bus,
499
self.dbus_object_path)
502
def _datetime_to_dbus(dt, variant_level=0):
503
"""Convert a UTC datetime.datetime() to a D-Bus type."""
504
return dbus.String(dt.isoformat(),
505
variant_level=variant_level)
508
oldstate = getattr(self, u"enabled", False)
509
r = Client.enable(self)
510
if oldstate != self.enabled:
512
self.PropertyChanged(dbus.String(u"enabled"),
513
dbus.Boolean(True, variant_level=1))
514
self.PropertyChanged(
515
dbus.String(u"last_enabled"),
516
self._datetime_to_dbus(self.last_enabled,
520
def disable(self, signal = True):
521
oldstate = getattr(self, u"enabled", False)
522
r = Client.disable(self)
523
if signal and oldstate != self.enabled:
525
self.PropertyChanged(dbus.String(u"enabled"),
526
dbus.Boolean(False, variant_level=1))
529
def __del__(self, *args, **kwargs):
531
self.remove_from_connection()
534
if hasattr(dbus.service.Object, u"__del__"):
535
dbus.service.Object.__del__(self, *args, **kwargs)
536
Client.__del__(self, *args, **kwargs)
538
def checker_callback(self, pid, condition, command,
540
self.checker_callback_tag = None
543
self.PropertyChanged(dbus.String(u"checker_running"),
544
dbus.Boolean(False, variant_level=1))
545
if os.WIFEXITED(condition):
546
exitstatus = os.WEXITSTATUS(condition)
548
self.CheckerCompleted(dbus.Int16(exitstatus),
549
dbus.Int64(condition),
550
dbus.String(command))
553
self.CheckerCompleted(dbus.Int16(-1),
554
dbus.Int64(condition),
555
dbus.String(command))
557
return Client.checker_callback(self, pid, condition, command,
560
def checked_ok(self, *args, **kwargs):
561
r = Client.checked_ok(self, *args, **kwargs)
563
self.PropertyChanged(
564
dbus.String(u"last_checked_ok"),
565
(self._datetime_to_dbus(self.last_checked_ok,
569
def start_checker(self, *args, **kwargs):
570
old_checker = self.checker
571
if self.checker is not None:
572
old_checker_pid = self.checker.pid
574
old_checker_pid = None
575
r = Client.start_checker(self, *args, **kwargs)
576
# Only if new checker process was started
577
if (self.checker is not None
578
and old_checker_pid != self.checker.pid):
580
self.CheckerStarted(self.current_checker_command)
581
self.PropertyChanged(
582
dbus.String(u"checker_running"),
583
dbus.Boolean(True, variant_level=1))
586
def stop_checker(self, *args, **kwargs):
587
old_checker = getattr(self, u"checker", None)
588
r = Client.stop_checker(self, *args, **kwargs)
589
if (old_checker is not None
590
and getattr(self, u"checker", None) is None):
591
self.PropertyChanged(dbus.String(u"checker_running"),
592
dbus.Boolean(False, variant_level=1))
595
## D-Bus methods & signals
596
_interface = u"se.bsnet.fukt.Mandos.Client"
599
@dbus.service.method(_interface)
601
return self.checked_ok()
603
# CheckerCompleted - signal
604
@dbus.service.signal(_interface, signature=u"nxs")
605
def CheckerCompleted(self, exitcode, waitstatus, command):
609
# CheckerStarted - signal
610
@dbus.service.signal(_interface, signature=u"s")
611
def CheckerStarted(self, command):
615
# GetAllProperties - method
616
@dbus.service.method(_interface, out_signature=u"a{sv}")
617
def GetAllProperties(self):
619
return dbus.Dictionary({
620
dbus.String(u"name"):
621
dbus.String(self.name, variant_level=1),
622
dbus.String(u"fingerprint"):
623
dbus.String(self.fingerprint, variant_level=1),
624
dbus.String(u"host"):
625
dbus.String(self.host, variant_level=1),
626
dbus.String(u"created"):
627
self._datetime_to_dbus(self.created,
629
dbus.String(u"last_enabled"):
630
(self._datetime_to_dbus(self.last_enabled,
632
if self.last_enabled is not None
633
else dbus.Boolean(False, variant_level=1)),
634
dbus.String(u"enabled"):
635
dbus.Boolean(self.enabled, variant_level=1),
636
dbus.String(u"last_checked_ok"):
637
(self._datetime_to_dbus(self.last_checked_ok,
639
if self.last_checked_ok is not None
640
else dbus.Boolean (False, variant_level=1)),
641
dbus.String(u"timeout"):
642
dbus.UInt64(self.timeout_milliseconds(),
644
dbus.String(u"interval"):
645
dbus.UInt64(self.interval_milliseconds(),
647
dbus.String(u"checker"):
648
dbus.String(self.checker_command,
650
dbus.String(u"checker_running"):
651
dbus.Boolean(self.checker is not None,
653
dbus.String(u"object_path"):
654
dbus.ObjectPath(self.dbus_object_path,
658
# IsStillValid - method
659
@dbus.service.method(_interface, out_signature=u"b")
660
def IsStillValid(self):
661
return self.still_valid()
663
# PropertyChanged - signal
664
@dbus.service.signal(_interface, signature=u"sv")
665
def PropertyChanged(self, property, value):
669
# ReceivedSecret - signal
670
@dbus.service.signal(_interface)
671
def ReceivedSecret(self):
676
@dbus.service.signal(_interface)
681
# SetChecker - method
682
@dbus.service.method(_interface, in_signature=u"s")
683
def SetChecker(self, checker):
684
"D-Bus setter method"
685
self.checker_command = checker
687
self.PropertyChanged(dbus.String(u"checker"),
688
dbus.String(self.checker_command,
692
@dbus.service.method(_interface, in_signature=u"s")
693
def SetHost(self, host):
694
"D-Bus setter method"
697
self.PropertyChanged(dbus.String(u"host"),
698
dbus.String(self.host, variant_level=1))
700
# SetInterval - method
701
@dbus.service.method(_interface, in_signature=u"t")
702
def SetInterval(self, milliseconds):
703
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
705
self.PropertyChanged(dbus.String(u"interval"),
707
.interval_milliseconds(),
711
@dbus.service.method(_interface, in_signature=u"ay",
713
def SetSecret(self, secret):
714
"D-Bus setter method"
715
self.secret = str(secret)
717
# SetTimeout - method
718
@dbus.service.method(_interface, in_signature=u"t")
719
def SetTimeout(self, milliseconds):
720
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
722
self.PropertyChanged(dbus.String(u"timeout"),
723
(dbus.UInt64(self.timeout_milliseconds(),
727
@dbus.service.method(_interface)
732
# StartChecker - method
733
@dbus.service.method(_interface)
734
def StartChecker(self):
739
@dbus.service.method(_interface)
744
# StopChecker - method
745
@dbus.service.method(_interface)
746
def StopChecker(self):
752
class ClientHandler(socketserver.BaseRequestHandler, object):
753
"""A class to handle client connections.
755
Instantiated once for each connection to handle it.
442
756
Note: This will run in its own forked process."""
444
758
def handle(self):
445
759
logger.info(u"TCP connection from: %s",
446
unicode(self.client_address))
447
session = gnutls.connection.ClientSession\
448
(self.request, gnutls.connection.X509Credentials())
450
line = self.request.makefile().readline()
451
logger.debug(u"Protocol version: %r", line)
453
if int(line.strip().split()[0]) > 1:
455
except (ValueError, IndexError, RuntimeError), error:
456
logger.error(u"Unknown protocol version: %s", error)
459
# Note: gnutls.connection.X509Credentials is really a generic
460
# GnuTLS certificate credentials object so long as no X.509
461
# keys are added to it. Therefore, we can use it here despite
462
# using OpenPGP certificates.
464
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
465
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
467
priority = "NORMAL" # Fallback default, since this
469
if self.server.settings["priority"]:
470
priority = self.server.settings["priority"]
471
gnutls.library.functions.gnutls_priority_set_direct\
472
(session._c_object, priority, None);
476
except gnutls.errors.GNUTLSError, error:
477
logger.warning(u"Handshake failed: %s", error)
478
# Do not run session.bye() here: the session is not
479
# established. Just abandon the request.
482
fpr = fingerprint(peer_certificate(session))
483
except (TypeError, gnutls.errors.GNUTLSError), error:
484
logger.warning(u"Bad certificate: %s", error)
487
logger.debug(u"Fingerprint: %s", fpr)
489
for c in self.server.clients:
490
if c.fingerprint == fpr:
494
logger.warning(u"Client not found for fingerprint: %s",
498
# Have to check if client.still_valid(), since it is possible
499
# that the client timed out while establishing the GnuTLS
501
if not client.still_valid():
502
logger.warning(u"Client %(name)s is invalid",
507
while sent_size < len(client.secret):
508
sent = session.send(client.secret[sent_size:])
509
logger.debug(u"Sent: %d, remaining: %d",
510
sent, len(client.secret)
511
- (sent_size + sent))
516
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
517
"""IPv6 TCP server. Accepts 'None' as address and/or port.
760
unicode(self.client_address))
761
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
762
# Open IPC pipe to parent process
763
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
764
session = (gnutls.connection
765
.ClientSession(self.request,
769
line = self.request.makefile().readline()
770
logger.debug(u"Protocol version: %r", line)
772
if int(line.strip().split()[0]) > 1:
774
except (ValueError, IndexError, RuntimeError), error:
775
logger.error(u"Unknown protocol version: %s", error)
778
# Note: gnutls.connection.X509Credentials is really a
779
# generic GnuTLS certificate credentials object so long as
780
# no X.509 keys are added to it. Therefore, we can use it
781
# here despite using OpenPGP certificates.
783
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
784
# u"+AES-256-CBC", u"+SHA1",
785
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
787
# Use a fallback default, since this MUST be set.
788
priority = self.server.gnutls_priority
791
(gnutls.library.functions
792
.gnutls_priority_set_direct(session._c_object,
797
except gnutls.errors.GNUTLSError, error:
798
logger.warning(u"Handshake failed: %s", error)
799
# Do not run session.bye() here: the session is not
800
# established. Just abandon the request.
802
logger.debug(u"Handshake succeeded")
804
fpr = self.fingerprint(self.peer_certificate(session))
805
except (TypeError, gnutls.errors.GNUTLSError), error:
806
logger.warning(u"Bad certificate: %s", error)
809
logger.debug(u"Fingerprint: %s", fpr)
811
for c in self.server.clients:
812
if c.fingerprint == fpr:
816
ipc.write(u"NOTFOUND %s %s\n"
817
% (fpr, unicode(self.client_address)))
820
# Have to check if client.still_valid(), since it is
821
# possible that the client timed out while establishing
822
# the GnuTLS session.
823
if not client.still_valid():
824
ipc.write(u"INVALID %s\n" % client.name)
827
ipc.write(u"SENDING %s\n" % client.name)
829
while sent_size < len(client.secret):
830
sent = session.send(client.secret[sent_size:])
831
logger.debug(u"Sent: %d, remaining: %d",
832
sent, len(client.secret)
833
- (sent_size + sent))
838
def peer_certificate(session):
839
"Return the peer's OpenPGP certificate as a bytestring"
840
# If not an OpenPGP certificate...
841
if (gnutls.library.functions
842
.gnutls_certificate_type_get(session._c_object)
843
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
844
# ...do the normal thing
845
return session.peer_certificate
846
list_size = ctypes.c_uint(1)
847
cert_list = (gnutls.library.functions
848
.gnutls_certificate_get_peers
849
(session._c_object, ctypes.byref(list_size)))
850
if not bool(cert_list) and list_size.value != 0:
851
raise gnutls.errors.GNUTLSError(u"error getting peer"
853
if list_size.value == 0:
856
return ctypes.string_at(cert.data, cert.size)
859
def fingerprint(openpgp):
860
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
861
# New GnuTLS "datum" with the OpenPGP public key
862
datum = (gnutls.library.types
863
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
866
ctypes.c_uint(len(openpgp))))
867
# New empty GnuTLS certificate
868
crt = gnutls.library.types.gnutls_openpgp_crt_t()
869
(gnutls.library.functions
870
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
871
# Import the OpenPGP public key into the certificate
872
(gnutls.library.functions
873
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
874
gnutls.library.constants
875
.GNUTLS_OPENPGP_FMT_RAW))
876
# Verify the self signature in the key
877
crtverify = ctypes.c_uint()
878
(gnutls.library.functions
879
.gnutls_openpgp_crt_verify_self(crt, 0,
880
ctypes.byref(crtverify)))
881
if crtverify.value != 0:
882
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
883
raise (gnutls.errors.CertificateSecurityError
885
# New buffer for the fingerprint
886
buf = ctypes.create_string_buffer(20)
887
buf_len = ctypes.c_size_t()
888
# Get the fingerprint from the certificate into the buffer
889
(gnutls.library.functions
890
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
891
ctypes.byref(buf_len)))
892
# Deinit the certificate
893
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
894
# Convert the buffer to a Python bytestring
895
fpr = ctypes.string_at(buf, buf_len.value)
896
# Convert the bytestring to hexadecimal notation
897
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
901
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
902
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
903
def process_request(self, request, client_address):
904
"""Overrides and wraps the original process_request().
906
This function creates a new pipe in self.pipe
908
self.pipe = os.pipe()
909
super(ForkingMixInWithPipe,
910
self).process_request(request, client_address)
911
os.close(self.pipe[1]) # close write end
912
self.add_pipe(self.pipe[0])
913
def add_pipe(self, pipe):
914
"""Dummy function; override as necessary"""
918
class IPv6_TCPServer(ForkingMixInWithPipe,
919
socketserver.TCPServer, object):
920
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
519
settings: Server settings
520
clients: Set() of Client objects
521
923
enabled: Boolean; whether this server is activated yet
924
interface: None or a network interface name (string)
925
use_ipv6: Boolean; to use IPv6 or not
523
address_family = socket.AF_INET6
524
def __init__(self, *args, **kwargs):
525
if "settings" in kwargs:
526
self.settings = kwargs["settings"]
527
del kwargs["settings"]
528
if "clients" in kwargs:
529
self.clients = kwargs["clients"]
530
del kwargs["clients"]
532
return super(type(self), self).__init__(*args, **kwargs)
927
def __init__(self, server_address, RequestHandlerClass,
928
interface=None, use_ipv6=True):
929
self.interface = interface
931
self.address_family = socket.AF_INET6
932
socketserver.TCPServer.__init__(self, server_address,
533
934
def server_bind(self):
534
935
"""This overrides the normal server_bind() function
535
936
to bind to an interface if one was specified, and also NOT to
536
937
bind to an address or port if they were not specified."""
537
if self.settings["interface"]:
538
# 25 is from /usr/include/asm-i486/socket.h
539
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
541
self.socket.setsockopt(socket.SOL_SOCKET,
543
self.settings["interface"])
544
except socket.error, error:
545
if error[0] == errno.EPERM:
546
logger.error(u"No permission to"
547
u" bind to interface %s",
548
self.settings["interface"])
938
if self.interface is not None:
939
if SO_BINDTODEVICE is None:
940
logger.error(u"SO_BINDTODEVICE does not exist;"
941
u" cannot bind to interface %s",
945
self.socket.setsockopt(socket.SOL_SOCKET,
949
except socket.error, error:
950
if error[0] == errno.EPERM:
951
logger.error(u"No permission to"
952
u" bind to interface %s",
954
elif error[0] == errno.ENOPROTOOPT:
955
logger.error(u"SO_BINDTODEVICE not available;"
956
u" cannot bind to interface %s",
551
960
# Only bind(2) the socket if we really need to.
552
961
if self.server_address[0] or self.server_address[1]:
553
962
if not self.server_address[0]:
555
self.server_address = (in6addr_any,
963
if self.address_family == socket.AF_INET6:
964
any_address = u"::" # in6addr_any
966
any_address = socket.INADDR_ANY
967
self.server_address = (any_address,
556
968
self.server_address[1])
557
969
elif not self.server_address[1]:
558
970
self.server_address = (self.server_address[0],
560
# if self.settings["interface"]:
561
973
# self.server_address = (self.server_address[0],
567
return super(type(self), self).server_bind()
978
return socketserver.TCPServer.server_bind(self)
981
class MandosServer(IPv6_TCPServer):
985
clients: set of Client objects
986
gnutls_priority GnuTLS priority string
987
use_dbus: Boolean; to emit D-Bus signals or not
989
Assumes a gobject.MainLoop event loop.
991
def __init__(self, server_address, RequestHandlerClass,
992
interface=None, use_ipv6=True, clients=None,
993
gnutls_priority=None, use_dbus=True):
995
self.clients = clients
996
if self.clients is None:
998
self.use_dbus = use_dbus
999
self.gnutls_priority = gnutls_priority
1000
IPv6_TCPServer.__init__(self, server_address,
1001
RequestHandlerClass,
1002
interface = interface,
1003
use_ipv6 = use_ipv6)
568
1004
def server_activate(self):
569
1005
if self.enabled:
570
return super(type(self), self).server_activate()
1006
return socketserver.TCPServer.server_activate(self)
571
1007
def enable(self):
572
1008
self.enabled = True
1009
def add_pipe(self, pipe):
1010
# Call "handle_ipc" for both data and EOF events
1011
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1013
def handle_ipc(self, source, condition, file_objects={}):
1015
gobject.IO_IN: u"IN", # There is data to read.
1016
gobject.IO_OUT: u"OUT", # Data can be written (without
1018
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1019
gobject.IO_ERR: u"ERR", # Error condition.
1020
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1021
# broken, usually for pipes and
1024
conditions_string = ' | '.join(name
1026
condition_names.iteritems()
1027
if cond & condition)
1028
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1031
# Turn the pipe file descriptor into a Python file object
1032
if source not in file_objects:
1033
file_objects[source] = os.fdopen(source, u"r", 1)
1035
# Read a line from the file object
1036
cmdline = file_objects[source].readline()
1037
if not cmdline: # Empty line means end of file
1038
# close the IPC pipe
1039
file_objects[source].close()
1040
del file_objects[source]
1042
# Stop calling this function
1045
logger.debug(u"IPC command: %r", cmdline)
1047
# Parse and act on command
1048
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1050
if cmd == u"NOTFOUND":
1051
logger.warning(u"Client not found for fingerprint: %s",
1055
mandos_dbus_service.ClientNotFound(args)
1056
elif cmd == u"INVALID":
1057
for client in self.clients:
1058
if client.name == args:
1059
logger.warning(u"Client %s is invalid", args)
1065
logger.error(u"Unknown client %s is invalid", args)
1066
elif cmd == u"SENDING":
1067
for client in self.clients:
1068
if client.name == args:
1069
logger.info(u"Sending secret to %s", client.name)
1073
client.ReceivedSecret()
1076
logger.error(u"Sending secret to unknown client %s",
1079
logger.error(u"Unknown IPC command: %r", cmdline)
1081
# Keep calling this function
575
1085
def string_to_delta(interval):
576
1086
"""Parse a string and return a datetime.timedelta
578
>>> string_to_delta('7d')
1088
>>> string_to_delta(u'7d')
579
1089
datetime.timedelta(7)
580
>>> string_to_delta('60s')
1090
>>> string_to_delta(u'60s')
581
1091
datetime.timedelta(0, 60)
582
>>> string_to_delta('60m')
1092
>>> string_to_delta(u'60m')
583
1093
datetime.timedelta(0, 3600)
584
>>> string_to_delta('24h')
1094
>>> string_to_delta(u'24h')
585
1095
datetime.timedelta(1)
586
1096
>>> string_to_delta(u'1w')
587
1097
datetime.timedelta(7)
588
>>> string_to_delta('5m 30s')
1098
>>> string_to_delta(u'5m 30s')
589
1099
datetime.timedelta(0, 330)
591
1101
timevalue = datetime.timedelta(0)
592
1102
for s in interval.split():
594
suffix=unicode(s[-1])
1104
suffix = unicode(s[-1])
596
1106
if suffix == u"d":
597
1107
delta = datetime.timedelta(value)
598
1108
elif suffix == u"s":
716
1209
# Default values for config file for server-global settings
717
server_defaults = { "interface": "",
722
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
723
"servicename": "Mandos",
1210
server_defaults = { u"interface": u"",
1215
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1216
u"servicename": u"Mandos",
1217
u"use_dbus": u"True",
1218
u"use_ipv6": u"True",
726
1221
# Parse config file for server-global settings
727
server_config = ConfigParser.SafeConfigParser(server_defaults)
1222
server_config = configparser.SafeConfigParser(server_defaults)
728
1223
del server_defaults
729
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1224
server_config.read(os.path.join(options.configdir,
730
1226
# Convert the SafeConfigParser object to a dict
731
1227
server_settings = server_config.defaults()
732
# Use getboolean on the boolean config option
733
server_settings["debug"] = server_config.getboolean\
1228
# Use the appropriate methods on the non-string config options
1229
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1230
server_settings[option] = server_config.getboolean(u"DEFAULT",
1232
if server_settings["port"]:
1233
server_settings["port"] = server_config.getint(u"DEFAULT",
735
1235
del server_config
737
1237
# Override the settings from the config file with command line
738
1238
# options, if set.
739
for option in ("interface", "address", "port", "debug",
740
"priority", "servicename", "configdir"):
1239
for option in (u"interface", u"address", u"port", u"debug",
1240
u"priority", u"servicename", u"configdir",
1241
u"use_dbus", u"use_ipv6"):
741
1242
value = getattr(options, option)
742
1243
if value is not None:
743
1244
server_settings[option] = value
1246
# Force all strings to be unicode
1247
for option in server_settings.keys():
1248
if type(server_settings[option]) is str:
1249
server_settings[option] = unicode(server_settings[option])
745
1250
# Now we have our good server settings in "server_settings"
747
debug = server_settings["debug"]
1252
##################################################################
1255
debug = server_settings[u"debug"]
1256
use_dbus = server_settings[u"use_dbus"]
1257
use_ipv6 = server_settings[u"use_ipv6"]
750
1260
syslogger.setLevel(logging.WARNING)
751
1261
console.setLevel(logging.WARNING)
753
if server_settings["servicename"] != "Mandos":
754
syslogger.setFormatter(logging.Formatter\
755
('Mandos (%s): %%(levelname)s:'
757
% server_settings["servicename"]))
1263
if server_settings[u"servicename"] != u"Mandos":
1264
syslogger.setFormatter(logging.Formatter
1265
(u'Mandos (%s) [%%(process)d]:'
1266
u' %%(levelname)s: %%(message)s'
1267
% server_settings[u"servicename"]))
759
1269
# Parse config file with clients
760
client_defaults = { "timeout": "1h",
762
"checker": "fping -q -- %(host)s",
1270
client_defaults = { u"timeout": u"1h",
1272
u"checker": u"fping -q -- %%(host)s",
765
client_config = ConfigParser.SafeConfigParser(client_defaults)
766
client_config.read(os.path.join(server_settings["configdir"],
770
tcp_server = IPv6_TCPServer((server_settings["address"],
771
server_settings["port"]),
773
settings=server_settings,
775
pidfilename = "/var/run/mandos.pid"
777
pidfile = open(pidfilename, "w")
778
except IOError, error:
779
logger.error("Could not open file %r", pidfilename)
784
uid = pwd.getpwnam("mandos").pw_uid
787
uid = pwd.getpwnam("nobody").pw_uid
791
gid = pwd.getpwnam("mandos").pw_gid
794
gid = pwd.getpwnam("nogroup").pw_gid
1275
client_config = configparser.SafeConfigParser(client_defaults)
1276
client_config.read(os.path.join(server_settings[u"configdir"],
1279
global mandos_dbus_service
1280
mandos_dbus_service = None
1282
tcp_server = MandosServer((server_settings[u"address"],
1283
server_settings[u"port"]),
1285
interface=server_settings[u"interface"],
1288
server_settings[u"priority"],
1290
pidfilename = u"/var/run/mandos.pid"
1292
pidfile = open(pidfilename, u"w")
1294
logger.error(u"Could not open file %r", pidfilename)
1297
uid = pwd.getpwnam(u"_mandos").pw_uid
1298
gid = pwd.getpwnam(u"_mandos").pw_gid
1301
uid = pwd.getpwnam(u"mandos").pw_uid
1302
gid = pwd.getpwnam(u"mandos").pw_gid
1305
uid = pwd.getpwnam(u"nobody").pw_uid
1306
gid = pwd.getpwnam(u"nobody").pw_gid
800
1313
except OSError, error:
801
1314
if error[0] != errno.EPERM:
805
service = AvahiService(name = server_settings["servicename"],
806
type = "_mandos._tcp", );
807
if server_settings["interface"]:
808
service.interface = if_nametoindex\
809
(server_settings["interface"])
1317
# Enable all possible GnuTLS debugging
1319
# "Use a log level over 10 to enable all debugging options."
1321
gnutls.library.functions.gnutls_global_set_log_level(11)
1323
@gnutls.library.types.gnutls_log_func
1324
def debug_gnutls(level, string):
1325
logger.debug(u"GnuTLS: %s", string[:-1])
1327
(gnutls.library.functions
1328
.gnutls_global_set_log_function(debug_gnutls))
811
1330
global main_loop
814
1331
# From the Avahi example code
815
1332
DBusGMainLoop(set_as_default=True )
816
1333
main_loop = gobject.MainLoop()
817
1334
bus = dbus.SystemBus()
818
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
819
avahi.DBUS_PATH_SERVER),
820
avahi.DBUS_INTERFACE_SERVER)
821
1335
# End of Avahi example code
823
def remove_from_clients(client):
824
clients.remove(client)
826
logger.critical(u"No clients left, exiting")
829
clients.update(Set(Client(name = section,
830
stop_hook = remove_from_clients,
832
= dict(client_config.items(section)))
833
for section in client_config.sections()))
835
logger.critical(u"No clients defined")
1337
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1338
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1339
service = AvahiService(name = server_settings[u"servicename"],
1340
servicetype = u"_mandos._tcp",
1341
protocol = protocol, bus = bus)
1342
if server_settings["interface"]:
1343
service.interface = (if_nametoindex
1344
(str(server_settings[u"interface"])))
1346
client_class = Client
1348
client_class = functools.partial(ClientDBus, bus = bus)
1349
tcp_server.clients.update(set(
1350
client_class(name = section,
1351
config= dict(client_config.items(section)))
1352
for section in client_config.sections()))
1353
if not tcp_server.clients:
1354
logger.warning(u"No clients defined")
839
1357
# Redirect stdin so all checkers get /dev/null