To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 24.1.34
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.34
- Committer: Björn Påhlsson
- Date: 2008-08-10 00:07:55 UTC
- mfrom: (57 mandos)
- mto: (24.1.154 mandos) (237.4.3 mandos-release)
- mto: This revision was merged to the branch mainline in revision 58.
- Revision ID: belorn@braxen-20080810000755-8njs8ag58cos29rh
merge
- files added:
- network-protocol.txt
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugin-runner.c => mandos-client.c
- plugin-runner.xml => mandos-client.xml
- plugins.d/mandos-client.c => plugins.d/password-request.c
- plugins.d/mandos-client.xml => plugins.d/password-request.xml
- files modified:
- Makefile
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
# GNU General Public License for more details.
26
25
#
27
26
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
30
28
#
31
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
30
#
33
31
34
from __future__ import division, with_statement, absolute_import
32
from __future__ import division
35
33
36
34
import SocketServer
37
35
import socket
36
import select
38
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
import pwd
59
from contextlib import closing
60
57
61
58
import dbus
62
import dbus.service
63
59
import gobject
64
60
import avahi
65
61
from dbus.mainloop.glib import DBusGMainLoop
66
62
import ctypes
67
import ctypes.util
68
63
69
version = "1.0.3"
64
version = "1.0"
70
65
71
66
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
67
syslogger = logging.handlers.SysLogHandler\
68
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
69
address = "/dev/log")
70
syslogger.setFormatter(logging.Formatter\
71
('Mandos: %(levelname)s: %(message)s'))
77
72
logger.addHandler(syslogger)
78
73
79
console = logging.StreamHandler()
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
82
logger.addHandler(console)
83
74
84
75
class AvahiError(Exception):
85
def __init__(self, value, *args, **kwargs):
76
def __init__(self, value):
86
77
self.value = value
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
78
def __str__(self):
79
return repr(self.value)
90
80
91
81
class AvahiServiceError(AvahiError):
92
82
pass
112
102
a sensible number of times
113
103
"""
114
104
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
105
type = None, port = None, TXT = None, domain = "",
106
host = "", max_renames = 32768):
117
107
self.interface = interface
118
108
self.name = name
119
self.type = servicetype
109
self.type = type
120
110
self.port = port
121
self.TXT = TXT if TXT is not None else []
111
if TXT is None:
112
self.TXT = []
113
else:
114
self.TXT = TXT
122
115
self.domain = domain
123
116
self.host = host
124
117
self.rename_count = 0
125
self.max_renames = max_renames
126
118
def rename(self):
127
119
"""Derived from the Avahi example code"""
128
120
if self.rename_count >= self.max_renames:
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
121
logger.critical(u"No suitable service name found after %i"
122
u" retries, exiting.", rename_count)
123
raise AvahiServiceError("Too many renames")
124
name = server.GetAlternativeServiceName(name)
125
logger.error(u"Changing name to %r ...", name)
126
syslogger.setFormatter(logging.Formatter\
137
127
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
128
' %%(message)s' % name))
139
129
self.remove()
140
130
self.add()
141
131
self.rename_count += 1
147
137
"""Derived from the Avahi example code"""
148
138
global group
149
139
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
140
group = dbus.Interface\
141
(bus.get_object(avahi.DBUS_NAME,
152
142
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
143
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
144
group.connect_to_signal('StateChanged',
155
145
entry_group_state_changed)
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
146
logger.debug(u"Adding service '%s' of type '%s' ...",
157
147
service.name, service.type)
158
148
group.AddService(
159
149
self.interface, # interface
170
160
# End of Avahi example code
171
161
172
162
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
163
class Client(object):
179
164
"""A representation of a client host served by this server.
180
165
Attributes:
181
name: string; from the config file, used in log messages
166
name: string; from the config file, used in log messages
182
167
fingerprint: string (40 or 32 hexadecimal digits); used to
183
168
uniquely identify the client
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
169
secret: bytestring; sent verbatim (over TLS) to client
170
host: string; available for use by the checker command
171
created: datetime.datetime(); object creation, not client host
172
last_checked_ok: datetime.datetime() or None if not yet checked OK
173
timeout: datetime.timedelta(); How long from last_checked_ok
174
until this client is invalid
175
interval: datetime.timedelta(); How often to start a new checker
176
stop_hook: If set, called by stop() as stop_hook(self)
177
checker: subprocess.Popen(); a running checker process used
178
to see if the client lives.
179
'None' if no process is running.
197
180
checker_initiator_tag: a gobject event source tag, or None
198
disable_initiator_tag: - '' -
181
stop_initiator_tag: - '' -
199
182
checker_callback_tag: - '' -
200
183
checker_command: string; External command which is run to check if
201
184
client lives. %() expansions are done at
202
185
runtime with vars(self) as dict, so that for
203
186
instance %(name)s can be used in the command.
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
187
Private attibutes:
188
_timeout: Real variable for 'timeout'
189
_interval: Real variable for 'interval'
190
_timeout_milliseconds: Used when calling gobject.timeout_add()
191
_interval_milliseconds: - '' -
206
192
"""
207
def timeout_milliseconds(self):
208
"Return the 'timeout' attribute in milliseconds"
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
212
213
def interval_milliseconds(self):
214
"Return the 'interval' attribute in milliseconds"
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
218
219
def __init__(self, name = None, disable_hook=None, config=None,
220
use_dbus=True):
193
def _set_timeout(self, timeout):
194
"Setter function for 'timeout' attribute"
195
self._timeout = timeout
196
self._timeout_milliseconds = ((self.timeout.days
197
* 24 * 60 * 60 * 1000)
198
+ (self.timeout.seconds * 1000)
199
+ (self.timeout.microseconds
200
// 1000))
201
timeout = property(lambda self: self._timeout,
202
_set_timeout)
203
del _set_timeout
204
def _set_interval(self, interval):
205
"Setter function for 'interval' attribute"
206
self._interval = interval
207
self._interval_milliseconds = ((self.interval.days
208
* 24 * 60 * 60 * 1000)
209
+ (self.interval.seconds
210
* 1000)
211
+ (self.interval.microseconds
212
// 1000))
213
interval = property(lambda self: self._interval,
214
_set_interval)
215
del _set_interval
216
def __init__(self, name = None, stop_hook=None, config={}):
221
217
"""Note: the 'checker' key in 'config' sets the
222
218
'checker_command' attribute and *not* the 'checker'
223
219
attribute."""
224
220
self.name = name
225
if config is None:
226
config = {}
227
221
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
229
if self.use_dbus:
230
self.dbus_object_path = (dbus.ObjectPath
231
("/Mandos/clients/"
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
235
222
# Uppercase and remove spaces from fingerprint for later
236
223
# comparison purposes with return value from the fingerprint()
237
224
# function
238
self.fingerprint = (config["fingerprint"].upper()
239
.replace(u" ", u""))
225
self.fingerprint = config["fingerprint"].upper()\
226
.replace(u" ", u"")
240
227
logger.debug(u" Fingerprint: %s", self.fingerprint)
241
228
if "secret" in config:
242
229
self.secret = config["secret"].decode(u"base64")
243
230
elif "secfile" in config:
244
with closing(open(os.path.expanduser
245
(os.path.expandvars
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
231
sf = open(config["secfile"])
232
self.secret = sf.read()
233
sf.close()
248
234
else:
249
235
raise TypeError(u"No secret or secfile for client %s"
250
236
% self.name)
251
237
self.host = config.get("host", "")
252
self.created = datetime.datetime.utcnow()
253
self.enabled = False
254
self.last_enabled = None
238
self.created = datetime.datetime.now()
255
239
self.last_checked_ok = None
256
240
self.timeout = string_to_delta(config["timeout"])
257
241
self.interval = string_to_delta(config["interval"])
258
self.disable_hook = disable_hook
242
self.stop_hook = stop_hook
259
243
self.checker = None
260
244
self.checker_initiator_tag = None
261
self.disable_initiator_tag = None
245
self.stop_initiator_tag = None
262
246
self.checker_callback_tag = None
263
self.checker_command = config["checker"]
264
265
def enable(self):
247
self.check_command = config["checker"]
248
def start(self):
266
249
"""Start this client's checker and timeout hooks"""
267
self.last_enabled = datetime.datetime.utcnow()
268
250
# Schedule a new checker to be started an 'interval' from now,
269
251
# and every interval from then on.
270
self.checker_initiator_tag = (gobject.timeout_add
271
(self.interval_milliseconds(),
272
self.start_checker))
252
self.checker_initiator_tag = gobject.timeout_add\
253
(self._interval_milliseconds,
254
self.start_checker)
273
255
# Also start a new checker *right now*.
274
256
self.start_checker()
275
# Schedule a disable() when 'timeout' has passed
276
self.disable_initiator_tag = (gobject.timeout_add
277
(self.timeout_milliseconds(),
278
self.disable))
279
self.enabled = True
280
if self.use_dbus:
281
# Emit D-Bus signals
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
286
variant_level=1)))
287
288
def disable(self):
289
"""Disable this client."""
290
if not getattr(self, "enabled", False):
257
# Schedule a stop() when 'timeout' has passed
258
self.stop_initiator_tag = gobject.timeout_add\
259
(self._timeout_milliseconds,
260
self.stop)
261
def stop(self):
262
"""Stop this client.
263
The possibility that a client might be restarted is left open,
264
but not currently used."""
265
# If this client doesn't have a secret, it is already stopped.
266
if hasattr(self, "secret") and self.secret:
267
logger.info(u"Stopping client %s", self.name)
268
self.secret = None
269
else:
291
270
return False
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
294
gobject.source_remove(self.disable_initiator_tag)
295
self.disable_initiator_tag = None
271
if getattr(self, "stop_initiator_tag", False):
272
gobject.source_remove(self.stop_initiator_tag)
273
self.stop_initiator_tag = None
296
274
if getattr(self, "checker_initiator_tag", False):
297
275
gobject.source_remove(self.checker_initiator_tag)
298
276
self.checker_initiator_tag = None
299
277
self.stop_checker()
300
if self.disable_hook:
301
self.disable_hook(self)
302
self.enabled = False
303
if self.use_dbus:
304
# Emit D-Bus signal
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
278
if self.stop_hook:
279
self.stop_hook(self)
307
280
# Do not run this again if called by a gobject.timeout_add
308
281
return False
309
310
282
def __del__(self):
311
self.disable_hook = None
312
self.disable()
313
314
def checker_callback(self, pid, condition, command):
283
self.stop_hook = None
284
self.stop()
285
def checker_callback(self, pid, condition):
315
286
"""The checker has completed, so take appropriate actions."""
287
now = datetime.datetime.now()
316
288
self.checker_callback_tag = None
317
289
self.checker = None
318
if self.use_dbus:
319
# Emit D-Bus signal
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
290
if os.WIFEXITED(condition) \
291
and (os.WEXITSTATUS(condition) == 0):
324
292
logger.info(u"Checker for %(name)s succeeded",
325
293
vars(self))
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
331
self.bump_timeout()
294
self.last_checked_ok = now
295
gobject.source_remove(self.stop_initiator_tag)
296
self.stop_initiator_tag = gobject.timeout_add\
297
(self._timeout_milliseconds,
298
self.stop)
332
299
elif not os.WIFEXITED(condition):
333
300
logger.warning(u"Checker for %(name)s crashed?",
334
301
vars(self))
335
if self.use_dbus:
336
# Emit D-Bus signal
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
340
302
else:
341
303
logger.info(u"Checker for %(name)s failed",
342
304
vars(self))
343
if self.use_dbus:
344
# Emit D-Bus signal
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
348
349
def bump_timeout(self):
350
"""Bump up the timeout for this client.
351
This should only be called when the client has been seen,
352
alive and well.
353
"""
354
self.last_checked_ok = datetime.datetime.utcnow()
355
gobject.source_remove(self.disable_initiator_tag)
356
self.disable_initiator_tag = (gobject.timeout_add
357
(self.timeout_milliseconds(),
358
self.disable))
359
if self.use_dbus:
360
# Emit D-Bus signal
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
364
variant_level=1)))
365
366
305
def start_checker(self):
367
306
"""Start a new checker subprocess if one is not running.
368
307
If a checker already exists, leave it running and do
377
316
# is as it should be.
378
317
if self.checker is None:
379
318
try:
380
# In case checker_command has exactly one % operator
381
command = self.checker_command % self.host
319
# In case check_command has exactly one % operator
320
command = self.check_command % self.host
382
321
except TypeError:
383
322
# Escape attributes for the shell
384
323
escaped_attrs = dict((key, re.escape(str(val)))
385
324
for key, val in
386
325
vars(self).iteritems())
387
326
try:
388
command = self.checker_command % escaped_attrs
327
command = self.check_command % escaped_attrs
389
328
except TypeError, error:
390
329
logger.error(u'Could not format string "%s":'
391
u' %s', self.checker_command, error)
330
u' %s', self.check_command, error)
392
331
return True # Try again later
393
332
try:
394
333
logger.info(u"Starting checker %r for %s",
395
334
command, self.name)
396
# We don't need to redirect stdout and stderr, since
397
# in normal mode, that is already done by daemon(),
398
# and in debug mode we don't want to. (Stdin is
399
# always replaced by /dev/null.)
400
335
self.checker = subprocess.Popen(command,
401
336
close_fds=True,
402
337
shell=True, cwd="/")
403
if self.use_dbus:
404
# Emit D-Bus signal
405
self.CheckerStarted(command)
406
self.PropertyChanged(
407
dbus.String("checker_running"),
408
dbus.Boolean(True, variant_level=1))
409
self.checker_callback_tag = (gobject.child_watch_add
410
(self.checker.pid,
411
self.checker_callback,
412
data=command))
413
except OSError, error:
338
self.checker_callback_tag = gobject.child_watch_add\
339
(self.checker.pid,
340
self.checker_callback)
341
except subprocess.OSError, error:
414
342
logger.error(u"Failed to start subprocess: %s",
415
343
error)
416
344
# Re-run this periodically if run by gobject.timeout_add
417
345
return True
418
419
346
def stop_checker(self):
420
347
"""Force the checker process, if any, to stop."""
421
348
if self.checker_callback_tag:
433
360
if error.errno != errno.ESRCH: # No such process
434
361
raise
435
362
self.checker = None
436
if self.use_dbus:
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
439
440
363
def still_valid(self):
441
364
"""Has the timeout not yet passed for this client?"""
442
if not getattr(self, "enabled", False):
443
return False
444
now = datetime.datetime.utcnow()
365
now = datetime.datetime.now()
445
366
if self.last_checked_ok is None:
446
367
return now < (self.created + self.timeout)
447
368
else:
448
369
return now < (self.last_checked_ok + self.timeout)
449
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
452
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
456
457
# CheckerCompleted - signal
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
460
"D-Bus signal"
461
pass
462
463
# CheckerStarted - signal
464
@dbus.service.signal(_interface, signature="s")
465
def CheckerStarted(self, command):
466
"D-Bus signal"
467
pass
468
469
# GetAllProperties - method
470
@dbus.service.method(_interface, out_signature="a{sv}")
471
def GetAllProperties(self):
472
"D-Bus method"
473
return dbus.Dictionary({
474
dbus.String("name"):
475
dbus.String(self.name, variant_level=1),
476
dbus.String("fingerprint"):
477
dbus.String(self.fingerprint, variant_level=1),
478
dbus.String("host"):
479
dbus.String(self.host, variant_level=1),
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
484
variant_level=1)
485
if self.last_enabled is not None
486
else dbus.Boolean(False, variant_level=1)),
487
dbus.String("enabled"):
488
dbus.Boolean(self.enabled, variant_level=1),
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
491
variant_level=1)
492
if self.last_checked_ok is not None
493
else dbus.Boolean (False, variant_level=1)),
494
dbus.String("timeout"):
495
dbus.UInt64(self.timeout_milliseconds(),
496
variant_level=1),
497
dbus.String("interval"):
498
dbus.UInt64(self.interval_milliseconds(),
499
variant_level=1),
500
dbus.String("checker"):
501
dbus.String(self.checker_command,
502
variant_level=1),
503
dbus.String("checker_running"):
504
dbus.Boolean(self.checker is not None,
505
variant_level=1),
506
}, signature="sv")
507
508
# IsStillValid - method
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
510
(still_valid))
511
IsStillValid.__name__ = "IsStillValid"
512
513
# PropertyChanged - signal
514
@dbus.service.signal(_interface, signature="sv")
515
def PropertyChanged(self, property, value):
516
"D-Bus signal"
517
pass
518
519
# SetChecker - method
520
@dbus.service.method(_interface, in_signature="s")
521
def SetChecker(self, checker):
522
"D-Bus setter method"
523
self.checker_command = checker
524
# Emit D-Bus signal
525
self.PropertyChanged(dbus.String(u"checker"),
526
dbus.String(self.checker_command,
527
variant_level=1))
528
529
# SetHost - method
530
@dbus.service.method(_interface, in_signature="s")
531
def SetHost(self, host):
532
"D-Bus setter method"
533
self.host = host
534
# Emit D-Bus signal
535
self.PropertyChanged(dbus.String(u"host"),
536
dbus.String(self.host, variant_level=1))
537
538
# SetInterval - method
539
@dbus.service.method(_interface, in_signature="t")
540
def SetInterval(self, milliseconds):
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
542
# Emit D-Bus signal
543
self.PropertyChanged(dbus.String(u"interval"),
544
(dbus.UInt64(self.interval_milliseconds(),
545
variant_level=1)))
546
547
# SetSecret - method
548
@dbus.service.method(_interface, in_signature="ay",
549
byte_arrays=True)
550
def SetSecret(self, secret):
551
"D-Bus setter method"
552
self.secret = str(secret)
553
554
# SetTimeout - method
555
@dbus.service.method(_interface, in_signature="t")
556
def SetTimeout(self, milliseconds):
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
558
# Emit D-Bus signal
559
self.PropertyChanged(dbus.String(u"timeout"),
560
(dbus.UInt64(self.timeout_milliseconds(),
561
variant_level=1)))
562
563
# Enable - method
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
566
567
# StartChecker - method
568
@dbus.service.method(_interface)
569
def StartChecker(self):
570
"D-Bus method"
571
self.start_checker()
572
573
# Disable - method
574
@dbus.service.method(_interface)
575
def Disable(self):
576
"D-Bus method"
577
self.disable()
578
579
# StopChecker - method
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
582
583
del _interface
584
370
585
371
586
372
def peer_certificate(session):
587
373
"Return the peer's OpenPGP certificate as a bytestring"
588
374
# If not an OpenPGP certificate...
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
375
if gnutls.library.functions.gnutls_certificate_type_get\
376
(session._c_object) \
377
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
592
378
# ...do the normal thing
593
379
return session.peer_certificate
594
380
list_size = ctypes.c_uint()
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
381
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
382
(session._c_object, ctypes.byref(list_size))
598
383
if list_size.value == 0:
599
384
return None
600
385
cert = cert_list[0]
604
389
def fingerprint(openpgp):
605
390
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
606
391
# New GnuTLS "datum" with the OpenPGP public key
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
609
ctypes.POINTER
610
(ctypes.c_ubyte)),
611
ctypes.c_uint(len(openpgp))))
392
datum = gnutls.library.types.gnutls_datum_t\
393
(ctypes.cast(ctypes.c_char_p(openpgp),
394
ctypes.POINTER(ctypes.c_ubyte)),
395
ctypes.c_uint(len(openpgp)))
612
396
# New empty GnuTLS certificate
613
397
crt = gnutls.library.types.gnutls_openpgp_crt_t()
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
398
gnutls.library.functions.gnutls_openpgp_crt_init\
399
(ctypes.byref(crt))
616
400
# Import the OpenPGP public key into the certificate
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
621
# Verify the self signature in the key
622
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
625
if crtverify.value != 0:
626
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
raise gnutls.errors.CertificateSecurityError("Verify failed")
401
gnutls.library.functions.gnutls_openpgp_crt_import\
402
(crt, ctypes.byref(datum),
403
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
628
404
# New buffer for the fingerprint
629
buf = ctypes.create_string_buffer(20)
630
buf_len = ctypes.c_size_t()
405
buffer = ctypes.create_string_buffer(20)
406
buffer_length = ctypes.c_size_t()
631
407
# Get the fingerprint from the certificate into the buffer
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
408
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
409
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
635
410
# Deinit the certificate
636
411
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
637
412
# Convert the buffer to a Python bytestring
638
fpr = ctypes.string_at(buf, buf_len.value)
413
fpr = ctypes.string_at(buffer, buffer_length.value)
639
414
# Convert the bytestring to hexadecimal notation
640
415
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
641
416
return hex_fpr
642
417
643
418
644
class TCP_handler(SocketServer.BaseRequestHandler, object):
419
class tcp_handler(SocketServer.BaseRequestHandler, object):
645
420
"""A TCP request handler class.
646
421
Instantiated by IPv6_TCPServer for each request to handle it.
647
422
Note: This will run in its own forked process."""
648
423
649
424
def handle(self):
650
425
logger.info(u"TCP connection from: %s",
651
unicode(self.client_address))
652
session = (gnutls.connection
653
.ClientSession(self.request,
654
gnutls.connection
655
.X509Credentials()))
426
unicode(self.client_address))
427
session = gnutls.connection.ClientSession\
428
(self.request, gnutls.connection.X509Credentials())
656
429
657
430
line = self.request.makefile().readline()
658
431
logger.debug(u"Protocol version: %r", line)
671
444
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
672
445
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
673
446
# "+DHE-DSS"))
674
# Use a fallback default, since this MUST be set.
675
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
678
priority, None))
447
priority = "NORMAL" # Fallback default, since this
448
# MUST be set.
449
if self.server.settings["priority"]:
450
priority = self.server.settings["priority"]
451
gnutls.library.functions.gnutls_priority_set_direct\
452
(session._c_object, priority, None);
679
453
680
454
try:
681
455
session.handshake()
691
465
session.bye()
692
466
return
693
467
logger.debug(u"Fingerprint: %s", fpr)
468
client = None
694
469
for c in self.server.clients:
695
470
if c.fingerprint == fpr:
696
471
client = c
697
472
break
698
else:
473
if not client:
699
474
logger.warning(u"Client not found for fingerprint: %s",
700
475
fpr)
701
476
session.bye()
708
483
vars(client))
709
484
session.bye()
710
485
return
711
## This won't work here, since we're in a fork.
712
# client.bump_timeout()
713
486
sent_size = 0
714
487
while sent_size < len(client.secret):
715
488
sent = session.send(client.secret[sent_size:])
720
493
session.bye()
721
494
722
495
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
724
SocketServer.TCPServer, object):
496
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
725
497
"""IPv6 TCP server. Accepts 'None' as address and/or port.
726
498
Attributes:
727
499
settings: Server settings
728
500
clients: Set() of Client objects
729
enabled: Boolean; whether this server is activated yet
730
501
"""
731
502
address_family = socket.AF_INET6
732
503
def __init__(self, *args, **kwargs):
736
507
if "clients" in kwargs:
737
508
self.clients = kwargs["clients"]
738
509
del kwargs["clients"]
739
self.enabled = False
740
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
510
return super(type(self), self).__init__(*args, **kwargs)
741
511
def server_bind(self):
742
512
"""This overrides the normal server_bind() function
743
513
to bind to an interface if one was specified, and also NOT to
772
542
# if_nametoindex
773
543
# (self.settings
774
544
# ["interface"]))
775
return super(IPv6_TCPServer, self).server_bind()
776
def server_activate(self):
777
if self.enabled:
778
return super(IPv6_TCPServer, self).server_activate()
779
def enable(self):
780
self.enabled = True
545
return super(type(self), self).server_bind()
781
546
782
547
783
548
def string_to_delta(interval):
793
558
datetime.timedelta(1)
794
559
>>> string_to_delta(u'1w')
795
560
datetime.timedelta(7)
796
>>> string_to_delta('5m 30s')
797
datetime.timedelta(0, 330)
798
561
"""
799
timevalue = datetime.timedelta(0)
800
for s in interval.split():
801
try:
802
suffix = unicode(s[-1])
803
value = int(s[:-1])
804
if suffix == u"d":
805
delta = datetime.timedelta(value)
806
elif suffix == u"s":
807
delta = datetime.timedelta(0, value)
808
elif suffix == u"m":
809
delta = datetime.timedelta(0, 0, 0, 0, value)
810
elif suffix == u"h":
811
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
812
elif suffix == u"w":
813
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
814
else:
815
raise ValueError
816
except (ValueError, IndexError):
562
try:
563
suffix=unicode(interval[-1])
564
value=int(interval[:-1])
565
if suffix == u"d":
566
delta = datetime.timedelta(value)
567
elif suffix == u"s":
568
delta = datetime.timedelta(0, value)
569
elif suffix == u"m":
570
delta = datetime.timedelta(0, 0, 0, 0, value)
571
elif suffix == u"h":
572
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
573
elif suffix == u"w":
574
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
575
else:
817
576
raise ValueError
818
timevalue += delta
819
return timevalue
577
except (ValueError, IndexError):
578
raise ValueError
579
return delta
820
580
821
581
822
582
def server_state_changed(state):
823
583
"""Derived from the Avahi example code"""
824
584
if state == avahi.SERVER_COLLISION:
825
logger.error(u"Zeroconf server name collision")
585
logger.error(u"Server name collision")
826
586
service.remove()
827
587
elif state == avahi.SERVER_RUNNING:
828
588
service.add()
830
590
831
591
def entry_group_state_changed(state, error):
832
592
"""Derived from the Avahi example code"""
833
logger.debug(u"Avahi state change: %i", state)
593
logger.debug(u"state change: %i", state)
834
594
835
595
if state == avahi.ENTRY_GROUP_ESTABLISHED:
836
logger.debug(u"Zeroconf service established.")
596
logger.debug(u"Service established.")
837
597
elif state == avahi.ENTRY_GROUP_COLLISION:
838
logger.warning(u"Zeroconf service name collision.")
598
logger.warning(u"Service name collision.")
839
599
service.rename()
840
600
elif state == avahi.ENTRY_GROUP_FAILURE:
841
logger.critical(u"Avahi: Error in group state changed %s",
601
logger.critical(u"Error in group state changed %s",
842
602
unicode(error))
843
raise AvahiGroupError(u"State changed: %s" % unicode(error))
603
raise AvahiGroupError("State changed: %s", str(error))
844
604
845
605
def if_nametoindex(interface):
846
606
"""Call the C function if_nametoindex(), or equivalent"""
847
607
global if_nametoindex
848
608
try:
849
if_nametoindex = (ctypes.cdll.LoadLibrary
850
(ctypes.util.find_library("c"))
851
.if_nametoindex)
609
if "ctypes.util" not in sys.modules:
610
import ctypes.util
611
if_nametoindex = ctypes.cdll.LoadLibrary\
612
(ctypes.util.find_library("c")).if_nametoindex
852
613
except (OSError, AttributeError):
853
614
if "struct" not in sys.modules:
854
615
import struct
857
618
def if_nametoindex(interface):
858
619
"Get an interface index the hard way, i.e. using fcntl()"
859
620
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
860
with closing(socket.socket()) as s:
861
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
862
struct.pack("16s16x", interface))
621
s = socket.socket()
622
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
623
struct.pack("16s16x", interface))
624
s.close()
863
625
interface_index = struct.unpack("I", ifreq[16:20])[0]
864
626
return interface_index
865
627
return if_nametoindex(interface)
889
651
890
652
891
653
def main():
892
parser = OptionParser(version = "%%prog %s" % version)
654
global main_loop_started
655
main_loop_started = False
656
657
parser = OptionParser(version = "Mandos server %s" % version)
893
658
parser.add_option("-i", "--interface", type="string",
894
659
metavar="IF", help="Bind to interface IF")
895
660
parser.add_option("-a", "--address", type="string",
896
661
help="Address to listen for requests on")
897
662
parser.add_option("-p", "--port", type="int",
898
663
help="Port number to receive requests on")
899
parser.add_option("--check", action="store_true",
664
parser.add_option("--check", action="store_true", default=False,
900
665
help="Run self-test")
901
666
parser.add_option("--debug", action="store_true",
902
667
help="Debug mode; run in foreground and log to"
909
674
default="/etc/mandos", metavar="DIR",
910
675
help="Directory to search for configuration"
911
676
" files")
912
parser.add_option("--no-dbus", action="store_false",
913
dest="use_dbus",
914
help="Do not provide D-Bus system bus"
915
" interface")
916
options = parser.parse_args()[0]
677
(options, args) = parser.parse_args()
917
678
918
679
if options.check:
919
680
import doctest
928
689
"priority":
929
690
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
930
691
"servicename": "Mandos",
931
"use_dbus": "True",
932
692
}
933
693
934
694
# Parse config file for server-global settings
935
695
server_config = ConfigParser.SafeConfigParser(server_defaults)
936
696
del server_defaults
937
697
server_config.read(os.path.join(options.configdir, "mandos.conf"))
698
server_section = "server"
938
699
# Convert the SafeConfigParser object to a dict
939
server_settings = server_config.defaults()
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
700
server_settings = dict(server_config.items(server_section))
701
# Use getboolean on the boolean config option
702
server_settings["debug"] = server_config.getboolean\
703
(server_section, "debug")
945
704
del server_config
946
705
947
706
# Override the settings from the config file with command line
948
707
# options, if set.
949
708
for option in ("interface", "address", "port", "debug",
950
"priority", "servicename", "configdir",
951
"use_dbus"):
709
"priority", "servicename", "configdir"):
952
710
value = getattr(options, option)
953
711
if value is not None:
954
712
server_settings[option] = value
955
713
del options
956
714
# Now we have our good server settings in "server_settings"
957
715
958
# For convenience
959
716
debug = server_settings["debug"]
960
use_dbus = server_settings["use_dbus"]
961
717
962
718
if not debug:
963
719
syslogger.setLevel(logging.WARNING)
964
console.setLevel(logging.WARNING)
965
720
966
721
if server_settings["servicename"] != "Mandos":
967
syslogger.setFormatter(logging.Formatter
722
syslogger.setFormatter(logging.Formatter\
968
723
('Mandos (%s): %%(levelname)s:'
969
724
' %%(message)s'
970
725
% server_settings["servicename"]))
972
727
# Parse config file with clients
973
728
client_defaults = { "timeout": "1h",
974
729
"interval": "5m",
975
"checker": "fping -q -- %(host)s",
976
"host": "",
730
"checker": "fping -q -- %%(host)s",
977
731
}
978
732
client_config = ConfigParser.SafeConfigParser(client_defaults)
979
733
client_config.read(os.path.join(server_settings["configdir"],
980
734
"clients.conf"))
981
735
982
clients = Set()
983
tcp_server = IPv6_TCPServer((server_settings["address"],
984
server_settings["port"]),
985
TCP_handler,
986
settings=server_settings,
987
clients=clients)
988
pidfilename = "/var/run/mandos.pid"
989
try:
990
pidfile = open(pidfilename, "w")
991
except IOError, error:
992
logger.error("Could not open file %r", pidfilename)
993
994
try:
995
uid = pwd.getpwnam("_mandos").pw_uid
996
except KeyError:
997
try:
998
uid = pwd.getpwnam("mandos").pw_uid
999
except KeyError:
1000
try:
1001
uid = pwd.getpwnam("nobody").pw_uid
1002
except KeyError:
1003
uid = 65534
1004
try:
1005
gid = pwd.getpwnam("_mandos").pw_gid
1006
except KeyError:
1007
try:
1008
gid = pwd.getpwnam("mandos").pw_gid
1009
except KeyError:
1010
try:
1011
gid = pwd.getpwnam("nogroup").pw_gid
1012
except KeyError:
1013
gid = 65534
1014
try:
1015
os.setuid(uid)
1016
os.setgid(gid)
1017
except OSError, error:
1018
if error[0] != errno.EPERM:
1019
raise error
1020
1021
736
global service
1022
737
service = AvahiService(name = server_settings["servicename"],
1023
servicetype = "_mandos._tcp", )
738
type = "_mandos._tcp", );
1024
739
if server_settings["interface"]:
1025
service.interface = (if_nametoindex
1026
(server_settings["interface"]))
740
service.interface = if_nametoindex(server_settings["interface"])
1027
741
1028
742
global main_loop
1029
743
global bus
1032
746
DBusGMainLoop(set_as_default=True )
1033
747
main_loop = gobject.MainLoop()
1034
748
bus = dbus.SystemBus()
1035
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1036
avahi.DBUS_PATH_SERVER),
1037
avahi.DBUS_INTERFACE_SERVER)
749
server = dbus.Interface(
750
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
751
avahi.DBUS_INTERFACE_SERVER )
1038
752
# End of Avahi example code
1039
if use_dbus:
1040
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1041
bus)
753
754
if debug:
755
console = logging.StreamHandler()
756
# console.setLevel(logging.DEBUG)
757
console.setFormatter(logging.Formatter\
758
('%(levelname)s: %(message)s'))
759
logger.addHandler(console)
760
del console
761
762
clients = Set()
763
def remove_from_clients(client):
764
clients.remove(client)
765
if not clients:
766
logger.critical(u"No clients left, exiting")
767
sys.exit()
1042
768
1043
769
clients.update(Set(Client(name = section,
770
stop_hook = remove_from_clients,
1044
771
config
1045
= dict(client_config.items(section)),
1046
use_dbus = use_dbus)
772
= dict(client_config.items(section)))
1047
773
for section in client_config.sections()))
1048
774
if not clients:
1049
logger.warning(u"No clients defined")
775
logger.critical(u"No clients defined")
776
sys.exit(1)
1050
777
1051
if debug:
1052
# Redirect stdin so all checkers get /dev/null
1053
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1054
os.dup2(null, sys.stdin.fileno())
1055
if null > 2:
1056
os.close(null)
1057
else:
1058
# No console logging
1059
logger.removeHandler(console)
1060
# Close all input and output, do double fork, etc.
778
if not debug:
1061
779
daemon()
1062
780
781
pidfilename = "/var/run/mandos/mandos.pid"
782
pid = os.getpid()
1063
783
try:
1064
pid = os.getpid()
784
pidfile = open(pidfilename, "w")
1065
785
pidfile.write(str(pid) + "\n")
1066
786
pidfile.close()
1067
787
del pidfile
1068
except IOError:
1069
logger.error(u"Could not write to file %r with PID %d",
1070
pidfilename, pid)
1071
except NameError:
1072
# "pidfile" was never created
1073
pass
1074
del pidfilename
788
except IOError, err:
789
logger.error(u"Could not write %s file with PID %d",
790
pidfilename, os.getpid())
1075
791
1076
792
def cleanup():
1077
793
"Cleanup function; run on exit"
1084
800
1085
801
while clients:
1086
802
client = clients.pop()
1087
client.disable_hook = None
1088
client.disable()
803
client.stop_hook = None
804
client.stop()
1089
805
1090
806
atexit.register(cleanup)
1091
807
1094
810
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1095
811
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1096
812
1097
if use_dbus:
1098
class MandosServer(dbus.service.Object):
1099
"""A D-Bus proxy object"""
1100
def __init__(self):
1101
dbus.service.Object.__init__(self, bus,
1102
"/Mandos")
1103
_interface = u"org.mandos_system.Mandos"
1104
1105
@dbus.service.signal(_interface, signature="oa{sv}")
1106
def ClientAdded(self, objpath, properties):
1107
"D-Bus signal"
1108
pass
1109
1110
@dbus.service.signal(_interface, signature="o")
1111
def ClientRemoved(self, objpath):
1112
"D-Bus signal"
1113
pass
1114
1115
@dbus.service.method(_interface, out_signature="ao")
1116
def GetAllClients(self):
1117
return dbus.Array(c.dbus_object_path for c in clients)
1118
1119
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1120
def GetAllClientsWithProperties(self):
1121
return dbus.Dictionary(
1122
((c.dbus_object_path, c.GetAllProperties())
1123
for c in clients),
1124
signature="oa{sv}")
1125
1126
@dbus.service.method(_interface, in_signature="o")
1127
def RemoveClient(self, object_path):
1128
for c in clients:
1129
if c.dbus_object_path == object_path:
1130
clients.remove(c)
1131
# Don't signal anything except ClientRemoved
1132
c.use_dbus = False
1133
c.disable()
1134
# Emit D-Bus signal
1135
self.ClientRemoved(object_path)
1136
return
1137
raise KeyError
1138
@dbus.service.method(_interface)
1139
def Quit(self):
1140
main_loop.quit()
1141
1142
del _interface
1143
1144
mandos_server = MandosServer()
1145
1146
813
for client in clients:
1147
if use_dbus:
1148
# Emit D-Bus signal
1149
mandos_server.ClientAdded(client.dbus_object_path,
1150
client.GetAllProperties())
1151
client.enable()
1152
1153
tcp_server.enable()
1154
tcp_server.server_activate()
1155
814
client.start()
815
816
tcp_server = IPv6_TCPServer((server_settings["address"],
817
server_settings["port"]),
818
tcp_handler,
819
settings=server_settings,
820
clients=clients)
1156
821
# Find out what port we got
1157
822
service.port = tcp_server.socket.getsockname()[1]
1158
823
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1172
837
1173
838
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1174
839
lambda *args, **kwargs:
1175
(tcp_server.handle_request
1176
(*args[2:], **kwargs) or True))
840
tcp_server.handle_request\
841
(*args[2:], **kwargs) or True)
1177
842
1178
843
logger.debug(u"Starting main loop")
844
main_loop_started = True
1179
845
main_loop.run()
1180
846
except AvahiError, error:
1181
logger.critical(u"AvahiError: %s", error)
847
logger.critical(u"AvahiError: %s" + unicode(error))
1182
848
sys.exit(1)
1183
849
except KeyboardInterrupt:
1184
850
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0