/mandos/trunk : revision 24.1.42

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

14

16

15

#

17

16

# This program is free software: you can redistribute it and/or modify

18

17

# it under the terms of the GNU General Public License as published by

25

24

# GNU General Public License for more details.

26

25

#

27

26

# You should have received a copy of the GNU General Public License

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

30

28

#

31

29

# Contact the authors at <mandos@fukt.bsnet.se>.

32

30

#

33

31

34

from __future__ import division, with_statement, absolute_import

32

from __future__ import division

35

33

36

34

import SocketServer

37

35

import socket

36

import select

38

37

from optparse import OptionParser

39

38

import datetime

40

39

import errno

55

54

import stat

56

55

import logging

57

56

import logging.handlers

58

import pwd

59

from contextlib import closing

60

57

61

58

import dbus

62

import dbus.service

63

59

import gobject

64

60

import avahi

65

61

from dbus.mainloop.glib import DBusGMainLoop

66

62

import ctypes

67

import ctypes.util

68

63

69

version = "1.0.2"

64

version = "1.0"

70

65

71

66

logger = logging.Logger('mandos')

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos: %(levelname)s: %(message)s'))

67

syslogger = logging.handlers.SysLogHandler\

68

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

69

address = "/dev/log")

70

syslogger.setFormatter(logging.Formatter\

71

('Mandos: %(levelname)s: %(message)s'))

77

72

logger.addHandler(syslogger)

78

73

79

74

console = logging.StreamHandler()

84

79

class AvahiError(Exception):

85

80

def __init__(self, value):

86

81

self.value = value

87

super(AvahiError, self).__init__()

88

82

def __str__(self):

89

83

return repr(self.value)

90

84

112

106

a sensible number of times

113

107

"""

114

108

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

115

servicetype = None, port = None, TXT = None,

116

domain = "", host = "", max_renames = 32768):

109

type = None, port = None, TXT = None, domain = "",

110

host = "", max_renames = 32768):

117

111

self.interface = interface

118

112

self.name = name

119

self.type = servicetype

113

self.type = type

120

114

self.port = port

121

self.TXT = TXT if TXT is not None else []

115

if TXT is None:

116

self.TXT = []

117

else:

118

self.TXT = TXT

122

119

self.domain = domain

123

120

self.host = host

124

121

self.rename_count = 0

125

self.max_renames = max_renames

126

122

def rename(self):

127

123

"""Derived from the Avahi example code"""

128

124

if self.rename_count >= self.max_renames:

129

logger.critical(u"No suitable Zeroconf service name found"

130

u" after %i retries, exiting.",

131

self.rename_count)

125

logger.critical(u"No suitable service name found after %i"

126

u" retries, exiting.", rename_count)

132

127

raise AvahiServiceError("Too many renames")

133

self.name = server.GetAlternativeServiceName(self.name)

134

logger.info(u"Changing Zeroconf service name to %r ...",

135

str(self.name))

136

syslogger.setFormatter(logging.Formatter

128

name = server.GetAlternativeServiceName(name)

129

logger.error(u"Changing name to %r ...", name)

130

syslogger.setFormatter(logging.Formatter\

137

131

('Mandos (%s): %%(levelname)s:'

138

' %%(message)s' % self.name))

132

' %%(message)s' % name))

139

133

self.remove()

140

134

self.add()

141

135

self.rename_count += 1

147

141

"""Derived from the Avahi example code"""

148

142

global group

149

143

if group is None:

150

group = dbus.Interface(bus.get_object

151

(avahi.DBUS_NAME,

144

group = dbus.Interface\

145

(bus.get_object(avahi.DBUS_NAME,

152

146

server.EntryGroupNew()),

153

avahi.DBUS_INTERFACE_ENTRY_GROUP)

147

avahi.DBUS_INTERFACE_ENTRY_GROUP)

154

148

group.connect_to_signal('StateChanged',

155

149

entry_group_state_changed)

156

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

150

logger.debug(u"Adding service '%s' of type '%s' ...",

157

151

service.name, service.type)

158

152

group.AddService(

159

153

self.interface, # interface

170

164

# End of Avahi example code

171

165

172

166

173

def _datetime_to_dbus_struct(dt, variant_level=0):

174

"""Convert a UTC datetime.datetime() to a D-Bus struct.

175

The format is special to this application, since we could not find

176

any other standard way."""

177

return dbus.Struct((dbus.Int16(dt.year),

178

dbus.Byte(dt.month),

179

dbus.Byte(dt.day),

180

dbus.Byte(dt.hour),

181

dbus.Byte(dt.minute),

182

dbus.Byte(dt.second),

183

dbus.UInt32(dt.microsecond)),

184

signature="nyyyyyu",

185

variant_level=variant_level)

186

187

188

class Client(dbus.service.Object):

167

class Client(object):

189

168

"""A representation of a client host served by this server.

190

169

Attributes:

191

name: string; from the config file, used in log messages

170

name: string; from the config file, used in log messages

192

171

fingerprint: string (40 or 32 hexadecimal digits); used to

193

172

uniquely identify the client

194

secret: bytestring; sent verbatim (over TLS) to client

195

host: string; available for use by the checker command

196

created: datetime.datetime(); (UTC) object creation

197

last_started: datetime.datetime(); (UTC)

198

started: bool()

199

last_checked_ok: datetime.datetime(); (UTC) or None

200

timeout: datetime.timedelta(); How long from last_checked_ok

201

until this client is invalid

202

interval: datetime.timedelta(); How often to start a new checker

203

stop_hook: If set, called by stop() as stop_hook(self)

204

checker: subprocess.Popen(); a running checker process used

205

to see if the client lives.

206

'None' if no process is running.

173

secret: bytestring; sent verbatim (over TLS) to client

174

host: string; available for use by the checker command

175

created: datetime.datetime(); object creation, not client host

176

last_checked_ok: datetime.datetime() or None if not yet checked OK

177

timeout: datetime.timedelta(); How long from last_checked_ok

178

until this client is invalid

179

interval: datetime.timedelta(); How often to start a new checker

180

stop_hook: If set, called by stop() as stop_hook(self)

181

checker: subprocess.Popen(); a running checker process used

182

to see if the client lives.

183

'None' if no process is running.

207

184

checker_initiator_tag: a gobject event source tag, or None

208

185

stop_initiator_tag: - '' -

209

186

checker_callback_tag: - '' -

211

188

client lives. %() expansions are done at

212

189

runtime with vars(self) as dict, so that for

213

190

instance %(name)s can be used in the command.

214

dbus_object_path: dbus.ObjectPath

215

191

Private attibutes:

216

192

_timeout: Real variable for 'timeout'

217

193

_interval: Real variable for 'interval'

219

195

_interval_milliseconds: - '' -

220

196

"""

221

197

def _set_timeout(self, timeout):

222

"Setter function for the 'timeout' attribute"

198

"Setter function for 'timeout' attribute"

223

199

self._timeout = timeout

224

200

self._timeout_milliseconds = ((self.timeout.days

225

201

* 24 * 60 * 60 * 1000)

226

202

+ (self.timeout.seconds * 1000)

227

203

+ (self.timeout.microseconds

228

204

// 1000))

229

# Emit D-Bus signal

230

self.PropertyChanged(dbus.String(u"timeout"),

231

(dbus.UInt64(self._timeout_milliseconds,

232

variant_level=1)))

233

timeout = property(lambda self: self._timeout, _set_timeout)

205

timeout = property(lambda self: self._timeout,

206

_set_timeout)

234

207

del _set_timeout

235

236

208

def _set_interval(self, interval):

237

"Setter function for the 'interval' attribute"

209

"Setter function for 'interval' attribute"

238

210

self._interval = interval

239

211

self._interval_milliseconds = ((self.interval.days

240

212

* 24 * 60 * 60 * 1000)

242

214

* 1000)

243

215

+ (self.interval.microseconds

244

216

// 1000))

245

# Emit D-Bus signal

246

self.PropertyChanged(dbus.String(u"interval"),

247

(dbus.UInt64(self._interval_milliseconds,

248

variant_level=1)))

249

interval = property(lambda self: self._interval, _set_interval)

217

interval = property(lambda self: self._interval,

218

_set_interval)

250

219

del _set_interval

251

252

def __init__(self, name = None, stop_hook=None, config=None):

220

def __init__(self, name = None, stop_hook=None, config={}):

253

221

"""Note: the 'checker' key in 'config' sets the

254

222

'checker_command' attribute and *not* the 'checker'

255

223

attribute."""

256

self.dbus_object_path = (dbus.ObjectPath

257

("/Mandos/clients/"

258

+ name.replace(".", "_")))

259

dbus.service.Object.__init__(self, bus,

260

self.dbus_object_path)

261

if config is None:

262

config = {}

263

224

self.name = name

264

225

logger.debug(u"Creating client %r", self.name)

265

226

# Uppercase and remove spaces from fingerprint for later

266

227

# comparison purposes with return value from the fingerprint()

267

228

# function

268

self.fingerprint = (config["fingerprint"].upper()

269

.replace(u" ", u""))

229

self.fingerprint = config["fingerprint"].upper()\

230

.replace(u" ", u"")

270

231

logger.debug(u" Fingerprint: %s", self.fingerprint)

271

232

if "secret" in config:

272

233

self.secret = config["secret"].decode(u"base64")

273

234

elif "secfile" in config:

274

with closing(open(os.path.expanduser

275

(os.path.expandvars

276

(config["secfile"])))) as secfile:

277

self.secret = secfile.read()

235

sf = open(config["secfile"])

236

self.secret = sf.read()

237

sf.close()

278

238

else:

279

239

raise TypeError(u"No secret or secfile for client %s"

280

240

% self.name)

281

241

self.host = config.get("host", "")

282

self.created = datetime.datetime.utcnow()

283

self.started = False

284

self.last_started = None

242

self.created = datetime.datetime.now()

285

243

self.last_checked_ok = None

286

244

self.timeout = string_to_delta(config["timeout"])

287

245

self.interval = string_to_delta(config["interval"])

290

248

self.checker_initiator_tag = None

291

249

self.stop_initiator_tag = None

292

250

self.checker_callback_tag = None

293

self.checker_command = config["checker"]

294

251

self.check_command = config["checker"]

295

252

def start(self):

296

253

"""Start this client's checker and timeout hooks"""

297

self.last_started = datetime.datetime.utcnow()

298

254

# Schedule a new checker to be started an 'interval' from now,

299

255

# and every interval from then on.

300

self.checker_initiator_tag = (gobject.timeout_add

301

(self._interval_milliseconds,

302

self.start_checker))

256

self.checker_initiator_tag = gobject.timeout_add\

257

(self._interval_milliseconds,

258

self.start_checker)

303

259

# Also start a new checker *right now*.

304

260

self.start_checker()

305

261

# Schedule a stop() when 'timeout' has passed

306

self.stop_initiator_tag = (gobject.timeout_add

307

(self._timeout_milliseconds,

308

self.stop))

309

self.started = True

310

# Emit D-Bus signal

311

self.PropertyChanged(dbus.String(u"started"),

312

dbus.Boolean(True, variant_level=1))

313

self.PropertyChanged(dbus.String(u"last_started"),

314

(_datetime_to_dbus_struct

315

(self.last_started, variant_level=1)))

316

262

self.stop_initiator_tag = gobject.timeout_add\

263

(self._timeout_milliseconds,

264

self.stop)

317

265

def stop(self):

318

"""Stop this client."""

319

if not getattr(self, "started", False):

266

"""Stop this client.

267

The possibility that a client might be restarted is left open,

268

but not currently used."""

269

# If this client doesn't have a secret, it is already stopped.

270

if hasattr(self, "secret") and self.secret:

271

logger.info(u"Stopping client %s", self.name)

272

self.secret = None

273

else:

320

274

return False

321

logger.info(u"Stopping client %s", self.name)

322

275

if getattr(self, "stop_initiator_tag", False):

323

276

gobject.source_remove(self.stop_initiator_tag)

324

277

self.stop_initiator_tag = None

328

281

self.stop_checker()

329

282

if self.stop_hook:

330

283

self.stop_hook(self)

331

self.started = False

332

# Emit D-Bus signal

333

self.PropertyChanged(dbus.String(u"started"),

334

dbus.Boolean(False, variant_level=1))

335

284

# Do not run this again if called by a gobject.timeout_add

336

285

return False

337

338

286

def __del__(self):

339

287

self.stop_hook = None

340

288

self.stop()

341

342

def checker_callback(self, pid, condition, command):

289

def checker_callback(self, pid, condition):

343

290

"""The checker has completed, so take appropriate actions."""

291

now = datetime.datetime.now()

344

292

self.checker_callback_tag = None

345

293

self.checker = None

346

# Emit D-Bus signal

347

self.PropertyChanged(dbus.String(u"checker_running"),

348

dbus.Boolean(False, variant_level=1))

349

if (os.WIFEXITED(condition)

350

and (os.WEXITSTATUS(condition) == 0)):

294

if os.WIFEXITED(condition) \

295

and (os.WEXITSTATUS(condition) == 0):

351

296

logger.info(u"Checker for %(name)s succeeded",

352

297

vars(self))

353

# Emit D-Bus signal

354

self.CheckerCompleted(dbus.Boolean(True),

355

dbus.UInt16(condition),

356

dbus.String(command))

357

self.bump_timeout()

298

self.last_checked_ok = now

299

gobject.source_remove(self.stop_initiator_tag)

300

self.stop_initiator_tag = gobject.timeout_add\

301

(self._timeout_milliseconds,

302

self.stop)

358

303

elif not os.WIFEXITED(condition):

359

304

logger.warning(u"Checker for %(name)s crashed?",

360

305

vars(self))

361

# Emit D-Bus signal

362

self.CheckerCompleted(dbus.Boolean(False),

363

dbus.UInt16(condition),

364

dbus.String(command))

365

306

else:

366

307

logger.info(u"Checker for %(name)s failed",

367

308

vars(self))

368

# Emit D-Bus signal

369

self.CheckerCompleted(dbus.Boolean(False),

370

dbus.UInt16(condition),

371

dbus.String(command))

372

373

def bump_timeout(self):

374

"""Bump up the timeout for this client.

375

This should only be called when the client has been seen,

376

alive and well.

377

"""

378

self.last_checked_ok = datetime.datetime.utcnow()

379

gobject.source_remove(self.stop_initiator_tag)

380

self.stop_initiator_tag = (gobject.timeout_add

381

(self._timeout_milliseconds,

382

self.stop))

383

self.PropertyChanged(dbus.String(u"last_checked_ok"),

384

(_datetime_to_dbus_struct

385

(self.last_checked_ok,

386

variant_level=1)))

387

388

309

def start_checker(self):

389

310

"""Start a new checker subprocess if one is not running.

390

311

If a checker already exists, leave it running and do

399

320

# is as it should be.

400

321

if self.checker is None:

401

322

try:

402

# In case checker_command has exactly one % operator

403

command = self.checker_command % self.host

323

# In case check_command has exactly one % operator

324

command = self.check_command % self.host

404

325

except TypeError:

405

326

# Escape attributes for the shell

406

327

escaped_attrs = dict((key, re.escape(str(val)))

407

328

for key, val in

408

329

vars(self).iteritems())

409

330

try:

410

command = self.checker_command % escaped_attrs

331

command = self.check_command % escaped_attrs

411

332

except TypeError, error:

412

333

logger.error(u'Could not format string "%s":'

413

u' %s', self.checker_command, error)

334

u' %s', self.check_command, error)

414

335

return True # Try again later

415

336

try:

416

337

logger.info(u"Starting checker %r for %s",

417

338

command, self.name)

418

# We don't need to redirect stdout and stderr, since

419

# in normal mode, that is already done by daemon(),

420

# and in debug mode we don't want to. (Stdin is

421

# always replaced by /dev/null.)

422

339

self.checker = subprocess.Popen(command,

423

340

close_fds=True,

424

341

shell=True, cwd="/")

425

# Emit D-Bus signal

426

self.CheckerStarted(command)

427

self.PropertyChanged(dbus.String("checker_running"),

428

dbus.Boolean(True, variant_level=1))

429

self.checker_callback_tag = (gobject.child_watch_add

430

(self.checker.pid,

431

self.checker_callback,

432

data=command))

433

except OSError, error:

342

self.checker_callback_tag = gobject.child_watch_add\

343

(self.checker.pid,

344

self.checker_callback)

345

except subprocess.OSError, error:

434

346

logger.error(u"Failed to start subprocess: %s",

435

347

error)

436

348

# Re-run this periodically if run by gobject.timeout_add

437

349

return True

438

439

350

def stop_checker(self):

440

351

"""Force the checker process, if any, to stop."""

441

352

if self.checker_callback_tag:

453

364

if error.errno != errno.ESRCH: # No such process

454

365

raise

455

366

self.checker = None

456

self.PropertyChanged(dbus.String(u"checker_running"),

457

dbus.Boolean(False, variant_level=1))

458

459

367

def still_valid(self):

460

368

"""Has the timeout not yet passed for this client?"""

461

if not getattr(self, "started", False):

462

return False

463

now = datetime.datetime.utcnow()

369

now = datetime.datetime.now()

464

370

if self.last_checked_ok is None:

465

371

return now < (self.created + self.timeout)

466

372

else:

467

373

return now < (self.last_checked_ok + self.timeout)

468

469

## D-Bus methods & signals

470

_interface = u"org.mandos_system.Mandos.Client"

471

472

# BumpTimeout - method

473

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

474

BumpTimeout.__name__ = "BumpTimeout"

475

476

# CheckerCompleted - signal

477

@dbus.service.signal(_interface, signature="bqs")

478

def CheckerCompleted(self, success, condition, command):

479

"D-Bus signal"

480

pass

481

482

# CheckerStarted - signal

483

@dbus.service.signal(_interface, signature="s")

484

def CheckerStarted(self, command):

485

"D-Bus signal"

486

pass

487

488

# GetAllProperties - method

489

@dbus.service.method(_interface, out_signature="a{sv}")

490

def GetAllProperties(self):

491

"D-Bus method"

492

return dbus.Dictionary({

493

dbus.String("name"):

494

dbus.String(self.name, variant_level=1),

495

dbus.String("fingerprint"):

496

dbus.String(self.fingerprint, variant_level=1),

497

dbus.String("host"):

498

dbus.String(self.host, variant_level=1),

499

dbus.String("created"):

500

_datetime_to_dbus_struct(self.created,

501

variant_level=1),

502

dbus.String("last_started"):

503

(_datetime_to_dbus_struct(self.last_started,

504

variant_level=1)

505

if self.last_started is not None

506

else dbus.Boolean(False, variant_level=1)),

507

dbus.String("started"):

508

dbus.Boolean(self.started, variant_level=1),

509

dbus.String("last_checked_ok"):

510

(_datetime_to_dbus_struct(self.last_checked_ok,

511

variant_level=1)

512

if self.last_checked_ok is not None

513

else dbus.Boolean (False, variant_level=1)),

514

dbus.String("timeout"):

515

dbus.UInt64(self._timeout_milliseconds,

516

variant_level=1),

517

dbus.String("interval"):

518

dbus.UInt64(self._interval_milliseconds,

519

variant_level=1),

520

dbus.String("checker"):

521

dbus.String(self.checker_command,

522

variant_level=1),

523

dbus.String("checker_running"):

524

dbus.Boolean(self.checker is not None,

525

variant_level=1),

526

}, signature="sv")

527

528

# IsStillValid - method

529

IsStillValid = (dbus.service.method(_interface, out_signature="b")

530

(still_valid))

531

IsStillValid.__name__ = "IsStillValid"

532

533

# PropertyChanged - signal

534

@dbus.service.signal(_interface, signature="sv")

535

def PropertyChanged(self, property, value):

536

"D-Bus signal"

537

pass

538

539

# SetChecker - method

540

@dbus.service.method(_interface, in_signature="s")

541

def SetChecker(self, checker):

542

"D-Bus setter method"

543

self.checker_command = checker

544

545

# SetHost - method

546

@dbus.service.method(_interface, in_signature="s")

547

def SetHost(self, host):

548

"D-Bus setter method"

549

self.host = host

550

551

# SetInterval - method

552

@dbus.service.method(_interface, in_signature="t")

553

def SetInterval(self, milliseconds):

554

self.interval = datetime.timdeelta(0, 0, 0, milliseconds)

555

556

# SetSecret - method

557

@dbus.service.method(_interface, in_signature="ay",

558

byte_arrays=True)

559

def SetSecret(self, secret):

560

"D-Bus setter method"

561

self.secret = str(secret)

562

563

# SetTimeout - method

564

@dbus.service.method(_interface, in_signature="t")

565

def SetTimeout(self, milliseconds):

566

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

567

568

# Start - method

569

Start = dbus.service.method(_interface)(start)

570

Start.__name__ = "Start"

571

572

# StartChecker - method

573

@dbus.service.method(_interface)

574

def StartChecker(self):

575

"D-Bus method"

576

self.start_checker()

577

578

# Stop - method

579

@dbus.service.method(_interface)

580

def Stop(self):

581

"D-Bus method"

582

self.stop()

583

584

# StopChecker - method

585

StopChecker = dbus.service.method(_interface)(stop_checker)

586

StopChecker.__name__ = "StopChecker"

587

588

del _interface

589

374

590

375

591

376

def peer_certificate(session):

592

377

"Return the peer's OpenPGP certificate as a bytestring"

593

378

# If not an OpenPGP certificate...

594

if (gnutls.library.functions

595

.gnutls_certificate_type_get(session._c_object)

596

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

379

if gnutls.library.functions.gnutls_certificate_type_get\

380

(session._c_object) \

381

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

597

382

# ...do the normal thing

598

383

return session.peer_certificate

599

384

list_size = ctypes.c_uint()

600

cert_list = (gnutls.library.functions

601

.gnutls_certificate_get_peers

602

(session._c_object, ctypes.byref(list_size)))

385

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

386

(session._c_object, ctypes.byref(list_size))

603

387

if list_size.value == 0:

604

388

return None

605

389

cert = cert_list[0]

609

393

def fingerprint(openpgp):

610

394

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

611

395

# New GnuTLS "datum" with the OpenPGP public key

612

datum = (gnutls.library.types

613

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

614

ctypes.POINTER

615

(ctypes.c_ubyte)),

616

ctypes.c_uint(len(openpgp))))

396

datum = gnutls.library.types.gnutls_datum_t\

397

(ctypes.cast(ctypes.c_char_p(openpgp),

398

ctypes.POINTER(ctypes.c_ubyte)),

399

ctypes.c_uint(len(openpgp)))

617

400

# New empty GnuTLS certificate

618

401

crt = gnutls.library.types.gnutls_openpgp_crt_t()

619

(gnutls.library.functions

620

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

402

gnutls.library.functions.gnutls_openpgp_crt_init\

403

(ctypes.byref(crt))

621

404

# Import the OpenPGP public key into the certificate

622

(gnutls.library.functions

623

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

624

gnutls.library.constants

625

.GNUTLS_OPENPGP_FMT_RAW))

626

# Verify the self signature in the key

627

crtverify = ctypes.c_uint()

628

(gnutls.library.functions

629

.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))

630

if crtverify.value != 0:

631

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

632

raise gnutls.errors.CertificateSecurityError("Verify failed")

405

gnutls.library.functions.gnutls_openpgp_crt_import\

406

(crt, ctypes.byref(datum),

407

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

633

408

# New buffer for the fingerprint

634

buf = ctypes.create_string_buffer(20)

635

buf_len = ctypes.c_size_t()

409

buffer = ctypes.create_string_buffer(20)

410

buffer_length = ctypes.c_size_t()

636

411

# Get the fingerprint from the certificate into the buffer

637

(gnutls.library.functions

638

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

639

ctypes.byref(buf_len)))

412

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

413

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

640

414

# Deinit the certificate

641

415

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

642

416

# Convert the buffer to a Python bytestring

643

fpr = ctypes.string_at(buf, buf_len.value)

417

fpr = ctypes.string_at(buffer, buffer_length.value)

644

418

# Convert the bytestring to hexadecimal notation

645

419

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

646

420

return hex_fpr

647

421

648

422

649

class TCP_handler(SocketServer.BaseRequestHandler, object):

423

class tcp_handler(SocketServer.BaseRequestHandler, object):

650

424

"""A TCP request handler class.

651

425

Instantiated by IPv6_TCPServer for each request to handle it.

652

426

Note: This will run in its own forked process."""

653

427

654

428

def handle(self):

655

429

logger.info(u"TCP connection from: %s",

656

unicode(self.client_address))

657

session = (gnutls.connection

658

.ClientSession(self.request,

659

gnutls.connection

660

.X509Credentials()))

430

unicode(self.client_address))

431

session = gnutls.connection.ClientSession\

432

(self.request, gnutls.connection.X509Credentials())

661

433

662

434

line = self.request.makefile().readline()

663

435

logger.debug(u"Protocol version: %r", line)

676

448

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

677

449

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

678

450

# "+DHE-DSS"))

679

# Use a fallback default, since this MUST be set.

680

priority = self.server.settings.get("priority", "NORMAL")

681

(gnutls.library.functions

682

.gnutls_priority_set_direct(session._c_object,

683

priority, None))

451

priority = "NORMAL" # Fallback default, since this

452

# MUST be set.

453

if self.server.settings["priority"]:

454

priority = self.server.settings["priority"]

455

gnutls.library.functions.gnutls_priority_set_direct\

456

(session._c_object, priority, None);

684

457

685

458

try:

686

459

session.handshake()

696

469

session.bye()

697

470

return

698

471

logger.debug(u"Fingerprint: %s", fpr)

472

client = None

699

473

for c in self.server.clients:

700

474

if c.fingerprint == fpr:

701

475

client = c

702

476

break

703

else:

477

if not client:

704

478

logger.warning(u"Client not found for fingerprint: %s",

705

479

fpr)

706

480

session.bye()

713

487

vars(client))

714

488

session.bye()

715

489

return

716

## This won't work here, since we're in a fork.

717

# client.bump_timeout()

718

490

sent_size = 0

719

491

while sent_size < len(client.secret):

720

492

sent = session.send(client.secret[sent_size:])

725

497

session.bye()

726

498

727

499

728

class IPv6_TCPServer(SocketServer.ForkingMixIn,

729

SocketServer.TCPServer, object):

500

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

730

501

"""IPv6 TCP server. Accepts 'None' as address and/or port.

731

502

Attributes:

732

503

settings: Server settings

733

504

clients: Set() of Client objects

734

enabled: Boolean; whether this server is activated yet

735

505

"""

736

506

address_family = socket.AF_INET6

737

507

def __init__(self, *args, **kwargs):

741

511

if "clients" in kwargs:

742

512

self.clients = kwargs["clients"]

743

513

del kwargs["clients"]

744

self.enabled = False

745

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

514

return super(type(self), self).__init__(*args, **kwargs)

746

515

def server_bind(self):

747

516

"""This overrides the normal server_bind() function

748

517

to bind to an interface if one was specified, and also NOT to

777

546

# if_nametoindex

778

547

# (self.settings

779

548

# ["interface"]))

780

return super(IPv6_TCPServer, self).server_bind()

781

def server_activate(self):

782

if self.enabled:

783

return super(IPv6_TCPServer, self).server_activate()

784

def enable(self):

785

self.enabled = True

549

return super(type(self), self).server_bind()

786

550

787

551

788

552

def string_to_delta(interval):

798

562

datetime.timedelta(1)

799

563

>>> string_to_delta(u'1w')

800

564

datetime.timedelta(7)

801

>>> string_to_delta('5m 30s')

802

datetime.timedelta(0, 330)

803

565

"""

804

timevalue = datetime.timedelta(0)

805

for s in interval.split():

806

try:

807

suffix = unicode(s[-1])

808

value = int(s[:-1])

809

if suffix == u"d":

810

delta = datetime.timedelta(value)

811

elif suffix == u"s":

812

delta = datetime.timedelta(0, value)

813

elif suffix == u"m":

814

delta = datetime.timedelta(0, 0, 0, 0, value)

815

elif suffix == u"h":

816

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

817

elif suffix == u"w":

818

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

819

else:

820

raise ValueError

821

except (ValueError, IndexError):

566

try:

567

suffix=unicode(interval[-1])

568

value=int(interval[:-1])

569

if suffix == u"d":

570

delta = datetime.timedelta(value)

571

elif suffix == u"s":

572

delta = datetime.timedelta(0, value)

573

elif suffix == u"m":

574

delta = datetime.timedelta(0, 0, 0, 0, value)

575

elif suffix == u"h":

576

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

577

elif suffix == u"w":

578

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

579

else:

822

580

raise ValueError

823

timevalue += delta

824

return timevalue

581

except (ValueError, IndexError):

582

raise ValueError

583

return delta

825

584

826

585

827

586

def server_state_changed(state):

828

587

"""Derived from the Avahi example code"""

829

588

if state == avahi.SERVER_COLLISION:

830

logger.error(u"Zeroconf server name collision")

589

logger.error(u"Server name collision")

831

590

service.remove()

832

591

elif state == avahi.SERVER_RUNNING:

833

592

service.add()

835

594

836

595

def entry_group_state_changed(state, error):

837

596

"""Derived from the Avahi example code"""

838

logger.debug(u"Avahi state change: %i", state)

597

logger.debug(u"state change: %i", state)

839

598

840

599

if state == avahi.ENTRY_GROUP_ESTABLISHED:

841

logger.debug(u"Zeroconf service established.")

600

logger.debug(u"Service established.")

842

601

elif state == avahi.ENTRY_GROUP_COLLISION:

843

logger.warning(u"Zeroconf service name collision.")

602

logger.warning(u"Service name collision.")

844

603

service.rename()

845

604

elif state == avahi.ENTRY_GROUP_FAILURE:

846

logger.critical(u"Avahi: Error in group state changed %s",

605

logger.critical(u"Error in group state changed %s",

847

606

unicode(error))

848

607

raise AvahiGroupError("State changed: %s", str(error))

849

608

851

610

"""Call the C function if_nametoindex(), or equivalent"""

852

611

global if_nametoindex

853

612

try:

854

if_nametoindex = (ctypes.cdll.LoadLibrary

855

(ctypes.util.find_library("c"))

856

.if_nametoindex)

613

if "ctypes.util" not in sys.modules:

614

import ctypes.util

615

if_nametoindex = ctypes.cdll.LoadLibrary\

616

(ctypes.util.find_library("c")).if_nametoindex

857

617

except (OSError, AttributeError):

858

618

if "struct" not in sys.modules:

859

619

import struct

862

622

def if_nametoindex(interface):

863

623

"Get an interface index the hard way, i.e. using fcntl()"

864

624

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

865

with closing(socket.socket()) as s:

866

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

867

struct.pack("16s16x", interface))

625

s = socket.socket()

626

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

627

struct.pack("16s16x", interface))

628

s.close()

868

629

interface_index = struct.unpack("I", ifreq[16:20])[0]

869

630

return interface_index

870

631

return if_nametoindex(interface)

894

655

895

656

896

657

def main():

658

global main_loop_started

659

main_loop_started = False

660

897

661

parser = OptionParser(version = "%%prog %s" % version)

898

662

parser.add_option("-i", "--interface", type="string",

899

663

metavar="IF", help="Bind to interface IF")

914

678

default="/etc/mandos", metavar="DIR",

915

679

help="Directory to search for configuration"

916

680

" files")

917

options = parser.parse_args()[0]

681

(options, args) = parser.parse_args()

918

682

919

683

if options.check:

920

684

import doctest

935

699

server_config = ConfigParser.SafeConfigParser(server_defaults)

936

700

del server_defaults

937

701

server_config.read(os.path.join(options.configdir, "mandos.conf"))

702

server_section = "server"

938

703

# Convert the SafeConfigParser object to a dict

939

server_settings = server_config.defaults()

704

server_settings = dict(server_config.items(server_section))

940

705

# Use getboolean on the boolean config option

941

server_settings["debug"] = (server_config.getboolean

942

("DEFAULT", "debug"))

706

server_settings["debug"] = server_config.getboolean\

707

(server_section, "debug")

943

708

del server_config

944

709

945

710

# Override the settings from the config file with command line

959

724

console.setLevel(logging.WARNING)

960

725

961

726

if server_settings["servicename"] != "Mandos":

962

syslogger.setFormatter(logging.Formatter

727

syslogger.setFormatter(logging.Formatter\

963

728

('Mandos (%s): %%(levelname)s:'

964

729

' %%(message)s'

965

730

% server_settings["servicename"]))

967

732

# Parse config file with clients

968

733

client_defaults = { "timeout": "1h",

969

734

"interval": "5m",

970

"checker": "fping -q -- %(host)s",

971

"host": "",

735

"checker": "fping -q -- %%(host)s",

972

736

}

973

737

client_config = ConfigParser.SafeConfigParser(client_defaults)

974

738

client_config.read(os.path.join(server_settings["configdir"],

975

739

"clients.conf"))

976

740

977

clients = Set()

978

tcp_server = IPv6_TCPServer((server_settings["address"],

979

server_settings["port"]),

980

TCP_handler,

981

settings=server_settings,

982

clients=clients)

983

pidfilename = "/var/run/mandos.pid"

984

try:

985

pidfile = open(pidfilename, "w")

986

except IOError, error:

987

logger.error("Could not open file %r", pidfilename)

988

989

try:

990

uid = pwd.getpwnam("_mandos").pw_uid

991

except KeyError:

992

try:

993

uid = pwd.getpwnam("mandos").pw_uid

994

except KeyError:

995

try:

996

uid = pwd.getpwnam("nobody").pw_uid

997

except KeyError:

998

uid = 65534

999

try:

1000

gid = pwd.getpwnam("_mandos").pw_gid

1001

except KeyError:

1002

try:

1003

gid = pwd.getpwnam("mandos").pw_gid

1004

except KeyError:

1005

try:

1006

gid = pwd.getpwnam("nogroup").pw_gid

1007

except KeyError:

1008

gid = 65534

1009

try:

1010

os.setuid(uid)

1011

os.setgid(gid)

1012

except OSError, error:

1013

if error[0] != errno.EPERM:

1014

raise error

1015

1016

741

global service

1017

742

service = AvahiService(name = server_settings["servicename"],

1018

servicetype = "_mandos._tcp", )

743

type = "_mandos._tcp", );

1019

744

if server_settings["interface"]:

1020

service.interface = (if_nametoindex

1021

(server_settings["interface"]))

745

service.interface = if_nametoindex(server_settings["interface"])

1022

746

1023

747

global main_loop

1024

748

global bus

1027

751

DBusGMainLoop(set_as_default=True )

1028

752

main_loop = gobject.MainLoop()

1029

753

bus = dbus.SystemBus()

1030

server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,

1031

avahi.DBUS_PATH_SERVER),

1032

avahi.DBUS_INTERFACE_SERVER)

754

server = dbus.Interface(

755

bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),

756

avahi.DBUS_INTERFACE_SERVER )

1033

757

# End of Avahi example code

1034

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)

758

759

clients = Set()

760

def remove_from_clients(client):

761

clients.remove(client)

762

if not clients:

763

logger.critical(u"No clients left, exiting")

764

sys.exit()

1035

765

1036

766

clients.update(Set(Client(name = section,

767

stop_hook = remove_from_clients,

1037

768

config

1038

769

= dict(client_config.items(section)))

1039

770

for section in client_config.sections()))

1041

772

logger.critical(u"No clients defined")

1042

773

sys.exit(1)

1043

774

1044

if debug:

1045

# Redirect stdin so all checkers get /dev/null

1046

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1047

os.dup2(null, sys.stdin.fileno())

1048

if null > 2:

1049

os.close(null)

1050

else:

1051

# No console logging

775

if not debug:

1052

776

logger.removeHandler(console)

1053

# Close all input and output, do double fork, etc.

1054

777

daemon()

1055

778

779

pidfilename = "/var/run/mandos/mandos.pid"

780

pid = os.getpid()

1056

781

try:

1057

pid = os.getpid()

782

pidfile = open(pidfilename, "w")

1058

783

pidfile.write(str(pid) + "\n")

1059

784

pidfile.close()

1060

785

del pidfile

1061

except IOError:

1062

logger.error(u"Could not write to file %r with PID %d",

1063

pidfilename, pid)

1064

except NameError:

1065

# "pidfile" was never created

1066

pass

1067

del pidfilename

786

except IOError, err:

787

logger.error(u"Could not write %s file with PID %d",

788

pidfilename, os.getpid())

1068

789

1069

790

def cleanup():

1070

791

"Cleanup function; run on exit"

1087

808

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1088

809

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1089

810

1090

class MandosServer(dbus.service.Object):

1091

"""A D-Bus proxy object"""

1092

def __init__(self):

1093

dbus.service.Object.__init__(self, bus,

1094

"/Mandos")

1095

_interface = u"org.mandos_system.Mandos"

1096

1097

@dbus.service.signal(_interface, signature="oa{sv}")

1098

def ClientAdded(self, objpath, properties):

1099

"D-Bus signal"

1100

pass

1101

1102

@dbus.service.signal(_interface, signature="o")

1103

def ClientRemoved(self, objpath):

1104

"D-Bus signal"

1105

pass

1106

1107

@dbus.service.method(_interface, out_signature="ao")

1108

def GetAllClients(self):

1109

return dbus.Array(c.dbus_object_path for c in clients)

1110

1111

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1112

def GetAllClientsWithProperties(self):

1113

return dbus.Dictionary(

1114

((c.dbus_object_path, c.GetAllProperties())

1115

for c in clients),

1116

signature="oa{sv}")

1117

1118

@dbus.service.method(_interface, in_signature="o")

1119

def RemoveClient(self, object_path):

1120

for c in clients:

1121

if c.dbus_object_path == object_path:

1122

c.stop()

1123

clients.remove(c)

1124

return

1125

raise KeyError

1126

1127

del _interface

1128

1129

mandos_server = MandosServer()

1130

1131

811

for client in clients:

1132

# Emit D-Bus signal

1133

mandos_server.ClientAdded(client.dbus_object_path,

1134

client.GetAllProperties())

1135

812

client.start()

1136

813

1137

tcp_server.enable()

1138

tcp_server.server_activate()

1139

814

tcp_server = IPv6_TCPServer((server_settings["address"],

815

server_settings["port"]),

816

tcp_handler,

817

settings=server_settings,

818

clients=clients)

1140

819

# Find out what port we got

1141

820

service.port = tcp_server.socket.getsockname()[1]

1142

821

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

1156

835

1157

836

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

1158

837

lambda *args, **kwargs:

1159

(tcp_server.handle_request

1160

(*args[2:], **kwargs) or True))

838

tcp_server.handle_request\

839

(*args[2:], **kwargs) or True)

1161

840

1162

841

logger.debug(u"Starting main loop")

842

main_loop_started = True

1163

843

main_loop.run()

1164

844

except AvahiError, error:

1165

845

logger.critical(u"AvahiError: %s" + unicode(error))