170
156
# End of Avahi example code
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
178
class Client(dbus.service.Object):
159
class Client(object):
179
160
"""A representation of a client host served by this server.
181
name: string; from the config file, used in log messages
162
name: string; from the config file, used in log messages
182
163
fingerprint: string (40 or 32 hexadecimal digits); used to
183
164
uniquely identify the client
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
165
secret: bytestring; sent verbatim (over TLS) to client
166
fqdn: string (FQDN); available for use by the checker command
167
created: datetime.datetime(); object creation, not client host
168
last_checked_ok: datetime.datetime() or None if not yet checked OK
169
timeout: datetime.timedelta(); How long from last_checked_ok
170
until this client is invalid
171
interval: datetime.timedelta(); How often to start a new checker
172
stop_hook: If set, called by stop() as stop_hook(self)
173
checker: subprocess.Popen(); a running checker process used
174
to see if the client lives.
175
'None' if no process is running.
197
176
checker_initiator_tag: a gobject event source tag, or None
198
disable_initiator_tag: - '' -
177
stop_initiator_tag: - '' -
199
178
checker_callback_tag: - '' -
200
179
checker_command: string; External command which is run to check if
201
180
client lives. %() expansions are done at
202
181
runtime with vars(self) as dict, so that for
203
182
instance %(name)s can be used in the command.
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
184
_timeout: Real variable for 'timeout'
185
_interval: Real variable for 'interval'
186
_timeout_milliseconds: Used when calling gobject.timeout_add()
187
_interval_milliseconds: - '' -
207
def timeout_milliseconds(self):
208
"Return the 'timeout' attribute in milliseconds"
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
213
def interval_milliseconds(self):
214
"Return the 'interval' attribute in milliseconds"
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
219
def __init__(self, name = None, disable_hook=None, config=None,
189
def _set_timeout(self, timeout):
190
"Setter function for 'timeout' attribute"
191
self._timeout = timeout
192
self._timeout_milliseconds = ((self.timeout.days
193
* 24 * 60 * 60 * 1000)
194
+ (self.timeout.seconds * 1000)
195
+ (self.timeout.microseconds
197
timeout = property(lambda self: self._timeout,
200
def _set_interval(self, interval):
201
"Setter function for 'interval' attribute"
202
self._interval = interval
203
self._interval_milliseconds = ((self.interval.days
204
* 24 * 60 * 60 * 1000)
205
+ (self.interval.seconds
207
+ (self.interval.microseconds
209
interval = property(lambda self: self._interval,
212
def __init__(self, name = None, stop_hook=None, config={}):
221
213
"""Note: the 'checker' key in 'config' sets the
222
214
'checker_command' attribute and *not* the 'checker'
227
217
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
230
self.dbus_object_path = (dbus.ObjectPath
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
235
218
# Uppercase and remove spaces from fingerprint for later
236
219
# comparison purposes with return value from the fingerprint()
238
self.fingerprint = (config["fingerprint"].upper()
221
self.fingerprint = config["fingerprint"].upper()\
240
223
logger.debug(u" Fingerprint: %s", self.fingerprint)
241
224
if "secret" in config:
242
225
self.secret = config["secret"].decode(u"base64")
243
226
elif "secfile" in config:
244
with closing(open(os.path.expanduser
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
227
sf = open(config["secfile"])
228
self.secret = sf.read()
249
231
raise TypeError(u"No secret or secfile for client %s"
251
self.host = config.get("host", "")
252
self.created = datetime.datetime.utcnow()
254
self.last_enabled = None
233
self.fqdn = config.get("fqdn", "")
234
self.created = datetime.datetime.now()
255
235
self.last_checked_ok = None
256
236
self.timeout = string_to_delta(config["timeout"])
257
237
self.interval = string_to_delta(config["interval"])
258
self.disable_hook = disable_hook
238
self.stop_hook = stop_hook
259
239
self.checker = None
260
240
self.checker_initiator_tag = None
261
self.disable_initiator_tag = None
241
self.stop_initiator_tag = None
262
242
self.checker_callback_tag = None
263
self.checker_command = config["checker"]
243
self.check_command = config["checker"]
266
245
"""Start this client's checker and timeout hooks"""
267
self.last_enabled = datetime.datetime.utcnow()
268
246
# Schedule a new checker to be started an 'interval' from now,
269
247
# and every interval from then on.
270
self.checker_initiator_tag = (gobject.timeout_add
271
(self.interval_milliseconds(),
248
self.checker_initiator_tag = gobject.timeout_add\
249
(self._interval_milliseconds,
273
251
# Also start a new checker *right now*.
274
252
self.start_checker()
275
# Schedule a disable() when 'timeout' has passed
276
self.disable_initiator_tag = (gobject.timeout_add
277
(self.timeout_milliseconds(),
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
289
"""Disable this client."""
290
if not getattr(self, "enabled", False):
253
# Schedule a stop() when 'timeout' has passed
254
self.stop_initiator_tag = gobject.timeout_add\
255
(self._timeout_milliseconds,
259
The possibility that a client might be restarted is left open,
260
but not currently used."""
261
# If this client doesn't have a secret, it is already stopped.
263
logger.info(u"Stopping client %s", self.name)
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
294
gobject.source_remove(self.disable_initiator_tag)
295
self.disable_initiator_tag = None
267
if getattr(self, "stop_initiator_tag", False):
268
gobject.source_remove(self.stop_initiator_tag)
269
self.stop_initiator_tag = None
296
270
if getattr(self, "checker_initiator_tag", False):
297
271
gobject.source_remove(self.checker_initiator_tag)
298
272
self.checker_initiator_tag = None
299
273
self.stop_checker()
300
if self.disable_hook:
301
self.disable_hook(self)
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
307
276
# Do not run this again if called by a gobject.timeout_add
310
278
def __del__(self):
311
self.disable_hook = None
314
def checker_callback(self, pid, condition, command):
279
self.stop_hook = None
281
def checker_callback(self, pid, condition):
315
282
"""The checker has completed, so take appropriate actions."""
283
now = datetime.datetime.now()
316
284
self.checker_callback_tag = None
317
285
self.checker = None
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
286
if os.WIFEXITED(condition) \
287
and (os.WEXITSTATUS(condition) == 0):
324
288
logger.info(u"Checker for %(name)s succeeded",
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
290
self.last_checked_ok = now
291
gobject.source_remove(self.stop_initiator_tag)
292
self.stop_initiator_tag = gobject.timeout_add\
293
(self._timeout_milliseconds,
332
295
elif not os.WIFEXITED(condition):
333
296
logger.warning(u"Checker for %(name)s crashed?",
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
341
299
logger.info(u"Checker for %(name)s failed",
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
349
def bump_timeout(self):
350
"""Bump up the timeout for this client.
351
This should only be called when the client has been seen,
354
self.last_checked_ok = datetime.datetime.utcnow()
355
gobject.source_remove(self.disable_initiator_tag)
356
self.disable_initiator_tag = (gobject.timeout_add
357
(self.timeout_milliseconds(),
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
366
301
def start_checker(self):
367
302
"""Start a new checker subprocess if one is not running.
368
303
If a checker already exists, leave it running and do
433
356
if error.errno != errno.ESRCH: # No such process
435
358
self.checker = None
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
440
359
def still_valid(self):
441
360
"""Has the timeout not yet passed for this client?"""
442
if not getattr(self, "enabled", False):
444
now = datetime.datetime.utcnow()
361
now = datetime.datetime.now()
445
362
if self.last_checked_ok is None:
446
363
return now < (self.created + self.timeout)
448
365
return now < (self.last_checked_ok + self.timeout)
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
457
# CheckerCompleted - signal
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
463
# CheckerStarted - signal
464
@dbus.service.signal(_interface, signature="s")
465
def CheckerStarted(self, command):
469
# GetAllProperties - method
470
@dbus.service.method(_interface, out_signature="a{sv}")
471
def GetAllProperties(self):
473
return dbus.Dictionary({
475
dbus.String(self.name, variant_level=1),
476
dbus.String("fingerprint"):
477
dbus.String(self.fingerprint, variant_level=1),
479
dbus.String(self.host, variant_level=1),
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
485
if self.last_enabled is not None
486
else dbus.Boolean(False, variant_level=1)),
487
dbus.String("enabled"):
488
dbus.Boolean(self.enabled, variant_level=1),
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
492
if self.last_checked_ok is not None
493
else dbus.Boolean (False, variant_level=1)),
494
dbus.String("timeout"):
495
dbus.UInt64(self.timeout_milliseconds(),
497
dbus.String("interval"):
498
dbus.UInt64(self.interval_milliseconds(),
500
dbus.String("checker"):
501
dbus.String(self.checker_command,
503
dbus.String("checker_running"):
504
dbus.Boolean(self.checker is not None,
508
# IsStillValid - method
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
511
IsStillValid.__name__ = "IsStillValid"
513
# PropertyChanged - signal
514
@dbus.service.signal(_interface, signature="sv")
515
def PropertyChanged(self, property, value):
519
# SetChecker - method
520
@dbus.service.method(_interface, in_signature="s")
521
def SetChecker(self, checker):
522
"D-Bus setter method"
523
self.checker_command = checker
525
self.PropertyChanged(dbus.String(u"checker"),
526
dbus.String(self.checker_command,
530
@dbus.service.method(_interface, in_signature="s")
531
def SetHost(self, host):
532
"D-Bus setter method"
535
self.PropertyChanged(dbus.String(u"host"),
536
dbus.String(self.host, variant_level=1))
538
# SetInterval - method
539
@dbus.service.method(_interface, in_signature="t")
540
def SetInterval(self, milliseconds):
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
543
self.PropertyChanged(dbus.String(u"interval"),
544
(dbus.UInt64(self.interval_milliseconds(),
548
@dbus.service.method(_interface, in_signature="ay",
550
def SetSecret(self, secret):
551
"D-Bus setter method"
552
self.secret = str(secret)
554
# SetTimeout - method
555
@dbus.service.method(_interface, in_signature="t")
556
def SetTimeout(self, milliseconds):
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
559
self.PropertyChanged(dbus.String(u"timeout"),
560
(dbus.UInt64(self.timeout_milliseconds(),
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
567
# StartChecker - method
568
@dbus.service.method(_interface)
569
def StartChecker(self):
574
@dbus.service.method(_interface)
579
# StopChecker - method
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
586
368
def peer_certificate(session):
587
369
"Return the peer's OpenPGP certificate as a bytestring"
588
370
# If not an OpenPGP certificate...
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
371
if gnutls.library.functions.gnutls_certificate_type_get\
372
(session._c_object) \
373
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
592
374
# ...do the normal thing
593
375
return session.peer_certificate
594
376
list_size = ctypes.c_uint()
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
377
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
378
(session._c_object, ctypes.byref(list_size))
598
379
if list_size.value == 0:
600
381
cert = cert_list[0]
604
385
def fingerprint(openpgp):
605
386
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
606
387
# New GnuTLS "datum" with the OpenPGP public key
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
611
ctypes.c_uint(len(openpgp))))
388
datum = gnutls.library.types.gnutls_datum_t\
389
(ctypes.cast(ctypes.c_char_p(openpgp),
390
ctypes.POINTER(ctypes.c_ubyte)),
391
ctypes.c_uint(len(openpgp)))
612
392
# New empty GnuTLS certificate
613
393
crt = gnutls.library.types.gnutls_openpgp_crt_t()
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
394
gnutls.library.functions.gnutls_openpgp_crt_init\
616
396
# Import the OpenPGP public key into the certificate
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
621
# Verify the self signature in the key
622
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
625
if crtverify.value != 0:
626
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
raise gnutls.errors.CertificateSecurityError("Verify failed")
397
gnutls.library.functions.gnutls_openpgp_crt_import\
398
(crt, ctypes.byref(datum),
399
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
628
400
# New buffer for the fingerprint
629
buf = ctypes.create_string_buffer(20)
630
buf_len = ctypes.c_size_t()
401
buffer = ctypes.create_string_buffer(20)
402
buffer_length = ctypes.c_size_t()
631
403
# Get the fingerprint from the certificate into the buffer
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
404
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
405
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
635
406
# Deinit the certificate
636
407
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
637
408
# Convert the buffer to a Python bytestring
638
fpr = ctypes.string_at(buf, buf_len.value)
409
fpr = ctypes.string_at(buffer, buffer_length.value)
639
410
# Convert the bytestring to hexadecimal notation
640
411
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
644
class TCP_handler(SocketServer.BaseRequestHandler, object):
415
class tcp_handler(SocketServer.BaseRequestHandler, object):
645
416
"""A TCP request handler class.
646
417
Instantiated by IPv6_TCPServer for each request to handle it.
647
418
Note: This will run in its own forked process."""
649
420
def handle(self):
650
421
logger.info(u"TCP connection from: %s",
651
unicode(self.client_address))
652
session = (gnutls.connection
653
.ClientSession(self.request,
422
unicode(self.client_address))
423
session = gnutls.connection.ClientSession\
424
(self.request, gnutls.connection.X509Credentials())
657
426
line = self.request.makefile().readline()
658
427
logger.debug(u"Protocol version: %r", line)
793
554
datetime.timedelta(1)
794
555
>>> string_to_delta(u'1w')
795
556
datetime.timedelta(7)
796
>>> string_to_delta('5m 30s')
797
datetime.timedelta(0, 330)
799
timevalue = datetime.timedelta(0)
800
for s in interval.split():
802
suffix = unicode(s[-1])
805
delta = datetime.timedelta(value)
807
delta = datetime.timedelta(0, value)
809
delta = datetime.timedelta(0, 0, 0, 0, value)
811
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
813
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
816
except (ValueError, IndexError):
559
suffix=unicode(interval[-1])
560
value=int(interval[:-1])
562
delta = datetime.timedelta(value)
564
delta = datetime.timedelta(0, value)
566
delta = datetime.timedelta(0, 0, 0, 0, value)
568
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
570
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
573
except (ValueError, IndexError):
822
578
def server_state_changed(state):
823
579
"""Derived from the Avahi example code"""
824
580
if state == avahi.SERVER_COLLISION:
825
logger.error(u"Zeroconf server name collision")
581
logger.error(u"Server name collision")
827
583
elif state == avahi.SERVER_RUNNING:
929
686
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
930
687
"servicename": "Mandos",
934
690
# Parse config file for server-global settings
935
691
server_config = ConfigParser.SafeConfigParser(server_defaults)
936
692
del server_defaults
937
693
server_config.read(os.path.join(options.configdir, "mandos.conf"))
694
server_section = "server"
938
695
# Convert the SafeConfigParser object to a dict
939
server_settings = server_config.defaults()
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
696
server_settings = dict(server_config.items(server_section))
697
# Use getboolean on the boolean config option
698
server_settings["debug"] = server_config.getboolean\
699
(server_section, "debug")
945
700
del server_config
947
702
# Override the settings from the config file with command line
948
703
# options, if set.
949
704
for option in ("interface", "address", "port", "debug",
950
"priority", "servicename", "configdir",
705
"priority", "servicename", "configdir"):
952
706
value = getattr(options, option)
953
707
if value is not None:
954
708
server_settings[option] = value
956
710
# Now we have our good server settings in "server_settings"
959
debug = server_settings["debug"]
960
use_dbus = server_settings["use_dbus"]
963
syslogger.setLevel(logging.WARNING)
964
console.setLevel(logging.WARNING)
966
if server_settings["servicename"] != "Mandos":
967
syslogger.setFormatter(logging.Formatter
968
('Mandos (%s): %%(levelname)s:'
970
% server_settings["servicename"]))
972
712
# Parse config file with clients
973
713
client_defaults = { "timeout": "1h",
974
714
"interval": "5m",
975
"checker": "fping -q -- %(host)s",
715
"checker": "fping -q -- %%(fqdn)s",
978
717
client_config = ConfigParser.SafeConfigParser(client_defaults)
979
718
client_config.read(os.path.join(server_settings["configdir"],
983
tcp_server = IPv6_TCPServer((server_settings["address"],
984
server_settings["port"]),
986
settings=server_settings,
988
pidfilename = "/var/run/mandos.pid"
990
pidfile = open(pidfilename, "w")
991
except IOError, error:
992
logger.error("Could not open file %r", pidfilename)
995
uid = pwd.getpwnam("_mandos").pw_uid
998
uid = pwd.getpwnam("mandos").pw_uid
1001
uid = pwd.getpwnam("nobody").pw_uid
1005
gid = pwd.getpwnam("_mandos").pw_gid
1008
gid = pwd.getpwnam("mandos").pw_gid
1011
gid = pwd.getpwnam("nogroup").pw_gid
1017
except OSError, error:
1018
if error[0] != errno.EPERM:
1022
722
service = AvahiService(name = server_settings["servicename"],
1023
servicetype = "_mandos._tcp", )
723
type = "_mandos._tcp", );
1024
724
if server_settings["interface"]:
1025
service.interface = (if_nametoindex
1026
(server_settings["interface"]))
725
service.interface = if_nametoindex(server_settings["interface"])
1028
727
global main_loop
1094
783
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1095
784
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1098
class MandosServer(dbus.service.Object):
1099
"""A D-Bus proxy object"""
1101
dbus.service.Object.__init__(self, bus,
1103
_interface = u"org.mandos_system.Mandos"
1105
@dbus.service.signal(_interface, signature="oa{sv}")
1106
def ClientAdded(self, objpath, properties):
1110
@dbus.service.signal(_interface, signature="o")
1111
def ClientRemoved(self, objpath):
1115
@dbus.service.method(_interface, out_signature="ao")
1116
def GetAllClients(self):
1117
return dbus.Array(c.dbus_object_path for c in clients)
1119
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1120
def GetAllClientsWithProperties(self):
1121
return dbus.Dictionary(
1122
((c.dbus_object_path, c.GetAllProperties())
1126
@dbus.service.method(_interface, in_signature="o")
1127
def RemoveClient(self, object_path):
1129
if c.dbus_object_path == object_path:
1131
# Don't signal anything except ClientRemoved
1135
self.ClientRemoved(object_path)
1138
@dbus.service.method(_interface)
1144
mandos_server = MandosServer()
1146
786
for client in clients:
1149
mandos_server.ClientAdded(client.dbus_object_path,
1150
client.GetAllProperties())
1154
tcp_server.server_activate()
789
tcp_server = IPv6_TCPServer((server_settings["address"],
790
server_settings["port"]),
792
settings=server_settings,
1156
794
# Find out what port we got
1157
795
service.port = tcp_server.socket.getsockname()[1]
1158
796
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"