To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 24.1.63
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.63
- Committer: Björn Påhlsson
- Date: 2008-08-24 10:19:59 UTC
- mfrom: (98 mandos)
- mto: (24.1.154 mandos) (237.4.3 mandos-release)
- mto: This revision was merged to the branch mainline in revision 99.
- Revision ID: belorn@braxen-20080824101959-cbs6x05jwgqrlp2s
merge + fallback bugg
- files added:
- plugins.d/usplash
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugins.d/mandos-client.c => plugins.d/password-request.c
- plugins.d/mandos-client.xml => plugins.d/password-request.xml
- files modified:
- Makefile
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
# GNU General Public License for more details.
26
25
#
27
26
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
30
28
#
31
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
30
#
33
31
34
from __future__ import division, with_statement, absolute_import
32
from __future__ import division
35
33
36
34
import SocketServer
37
35
import socket
38
import optparse
36
import select
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
import pwd
59
from contextlib import closing
60
57
61
58
import dbus
62
import dbus.service
63
59
import gobject
64
60
import avahi
65
61
from dbus.mainloop.glib import DBusGMainLoop
66
62
import ctypes
67
import ctypes.util
68
63
69
version = "1.0.5"
64
version = "1.0"
70
65
71
66
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
67
syslogger = logging.handlers.SysLogHandler\
68
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
69
address = "/dev/log")
70
syslogger.setFormatter(logging.Formatter\
71
('Mandos: %(levelname)s: %(message)s'))
77
72
logger.addHandler(syslogger)
78
73
79
74
console = logging.StreamHandler()
82
77
logger.addHandler(console)
83
78
84
79
class AvahiError(Exception):
85
def __init__(self, value, *args, **kwargs):
80
def __init__(self, value):
86
81
self.value = value
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
82
def __str__(self):
83
return repr(self.value)
90
84
91
85
class AvahiServiceError(AvahiError):
92
86
pass
112
106
a sensible number of times
113
107
"""
114
108
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
109
type = None, port = None, TXT = None, domain = "",
110
host = "", max_renames = 32768):
117
111
self.interface = interface
118
112
self.name = name
119
self.type = servicetype
113
self.type = type
120
114
self.port = port
121
self.TXT = TXT if TXT is not None else []
115
if TXT is None:
116
self.TXT = []
117
else:
118
self.TXT = TXT
122
119
self.domain = domain
123
120
self.host = host
124
121
self.rename_count = 0
126
123
def rename(self):
127
124
"""Derived from the Avahi example code"""
128
125
if self.rename_count >= self.max_renames:
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
126
logger.critical(u"No suitable service name found after %i"
127
u" retries, exiting.", rename_count)
128
raise AvahiServiceError("Too many renames")
133
129
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
130
logger.info(u"Changing name to %r ...", str(self.name))
131
syslogger.setFormatter(logging.Formatter\
137
132
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
133
' %%(message)s' % self.name))
139
134
self.remove()
140
135
self.add()
141
136
self.rename_count += 1
147
142
"""Derived from the Avahi example code"""
148
143
global group
149
144
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
145
group = dbus.Interface\
146
(bus.get_object(avahi.DBUS_NAME,
152
147
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
148
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
149
group.connect_to_signal('StateChanged',
155
150
entry_group_state_changed)
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
151
logger.debug(u"Adding service '%s' of type '%s' ...",
157
152
service.name, service.type)
158
153
group.AddService(
159
154
self.interface, # interface
170
165
# End of Avahi example code
171
166
172
167
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
168
class Client(object):
179
169
"""A representation of a client host served by this server.
180
170
Attributes:
181
name: string; from the config file, used in log messages
171
name: string; from the config file, used in log messages
182
172
fingerprint: string (40 or 32 hexadecimal digits); used to
183
173
uniquely identify the client
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
174
secret: bytestring; sent verbatim (over TLS) to client
175
host: string; available for use by the checker command
176
created: datetime.datetime(); object creation, not client host
177
last_checked_ok: datetime.datetime() or None if not yet checked OK
178
timeout: datetime.timedelta(); How long from last_checked_ok
179
until this client is invalid
180
interval: datetime.timedelta(); How often to start a new checker
181
stop_hook: If set, called by stop() as stop_hook(self)
182
checker: subprocess.Popen(); a running checker process used
183
to see if the client lives.
184
'None' if no process is running.
197
185
checker_initiator_tag: a gobject event source tag, or None
198
disable_initiator_tag: - '' -
186
stop_initiator_tag: - '' -
199
187
checker_callback_tag: - '' -
200
188
checker_command: string; External command which is run to check if
201
189
client lives. %() expansions are done at
202
190
runtime with vars(self) as dict, so that for
203
191
instance %(name)s can be used in the command.
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
192
Private attibutes:
193
_timeout: Real variable for 'timeout'
194
_interval: Real variable for 'interval'
195
_timeout_milliseconds: Used when calling gobject.timeout_add()
196
_interval_milliseconds: - '' -
206
197
"""
207
def timeout_milliseconds(self):
208
"Return the 'timeout' attribute in milliseconds"
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
212
213
def interval_milliseconds(self):
214
"Return the 'interval' attribute in milliseconds"
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
218
219
def __init__(self, name = None, disable_hook=None, config=None,
220
use_dbus=True):
198
def _set_timeout(self, timeout):
199
"Setter function for 'timeout' attribute"
200
self._timeout = timeout
201
self._timeout_milliseconds = ((self.timeout.days
202
* 24 * 60 * 60 * 1000)
203
+ (self.timeout.seconds * 1000)
204
+ (self.timeout.microseconds
205
// 1000))
206
timeout = property(lambda self: self._timeout,
207
_set_timeout)
208
del _set_timeout
209
def _set_interval(self, interval):
210
"Setter function for 'interval' attribute"
211
self._interval = interval
212
self._interval_milliseconds = ((self.interval.days
213
* 24 * 60 * 60 * 1000)
214
+ (self.interval.seconds
215
* 1000)
216
+ (self.interval.microseconds
217
// 1000))
218
interval = property(lambda self: self._interval,
219
_set_interval)
220
del _set_interval
221
def __init__(self, name = None, stop_hook=None, config={}):
221
222
"""Note: the 'checker' key in 'config' sets the
222
223
'checker_command' attribute and *not* the 'checker'
223
224
attribute."""
224
225
self.name = name
225
if config is None:
226
config = {}
227
226
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
229
if self.use_dbus:
230
self.dbus_object_path = (dbus.ObjectPath
231
("/Mandos/clients/"
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
235
227
# Uppercase and remove spaces from fingerprint for later
236
228
# comparison purposes with return value from the fingerprint()
237
229
# function
238
self.fingerprint = (config["fingerprint"].upper()
239
.replace(u" ", u""))
230
self.fingerprint = config["fingerprint"].upper()\
231
.replace(u" ", u"")
240
232
logger.debug(u" Fingerprint: %s", self.fingerprint)
241
233
if "secret" in config:
242
234
self.secret = config["secret"].decode(u"base64")
243
235
elif "secfile" in config:
244
with closing(open(os.path.expanduser
245
(os.path.expandvars
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
236
sf = open(config["secfile"])
237
self.secret = sf.read()
238
sf.close()
248
239
else:
249
240
raise TypeError(u"No secret or secfile for client %s"
250
241
% self.name)
251
242
self.host = config.get("host", "")
252
self.created = datetime.datetime.utcnow()
253
self.enabled = False
254
self.last_enabled = None
243
self.created = datetime.datetime.now()
255
244
self.last_checked_ok = None
256
245
self.timeout = string_to_delta(config["timeout"])
257
246
self.interval = string_to_delta(config["interval"])
258
self.disable_hook = disable_hook
247
self.stop_hook = stop_hook
259
248
self.checker = None
260
249
self.checker_initiator_tag = None
261
self.disable_initiator_tag = None
250
self.stop_initiator_tag = None
262
251
self.checker_callback_tag = None
263
self.checker_command = config["checker"]
264
265
def enable(self):
252
self.check_command = config["checker"]
253
def start(self):
266
254
"""Start this client's checker and timeout hooks"""
267
self.last_enabled = datetime.datetime.utcnow()
268
255
# Schedule a new checker to be started an 'interval' from now,
269
256
# and every interval from then on.
270
self.checker_initiator_tag = (gobject.timeout_add
271
(self.interval_milliseconds(),
272
self.start_checker))
257
self.checker_initiator_tag = gobject.timeout_add\
258
(self._interval_milliseconds,
259
self.start_checker)
273
260
# Also start a new checker *right now*.
274
261
self.start_checker()
275
# Schedule a disable() when 'timeout' has passed
276
self.disable_initiator_tag = (gobject.timeout_add
277
(self.timeout_milliseconds(),
278
self.disable))
279
self.enabled = True
280
if self.use_dbus:
281
# Emit D-Bus signals
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
286
variant_level=1)))
287
288
def disable(self):
289
"""Disable this client."""
290
if not getattr(self, "enabled", False):
262
# Schedule a stop() when 'timeout' has passed
263
self.stop_initiator_tag = gobject.timeout_add\
264
(self._timeout_milliseconds,
265
self.stop)
266
def stop(self):
267
"""Stop this client.
268
The possibility that a client might be restarted is left open,
269
but not currently used."""
270
# If this client doesn't have a secret, it is already stopped.
271
if hasattr(self, "secret") and self.secret:
272
logger.info(u"Stopping client %s", self.name)
273
self.secret = None
274
else:
291
275
return False
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
294
gobject.source_remove(self.disable_initiator_tag)
295
self.disable_initiator_tag = None
276
if getattr(self, "stop_initiator_tag", False):
277
gobject.source_remove(self.stop_initiator_tag)
278
self.stop_initiator_tag = None
296
279
if getattr(self, "checker_initiator_tag", False):
297
280
gobject.source_remove(self.checker_initiator_tag)
298
281
self.checker_initiator_tag = None
299
282
self.stop_checker()
300
if self.disable_hook:
301
self.disable_hook(self)
302
self.enabled = False
303
if self.use_dbus:
304
# Emit D-Bus signal
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
283
if self.stop_hook:
284
self.stop_hook(self)
307
285
# Do not run this again if called by a gobject.timeout_add
308
286
return False
309
310
287
def __del__(self):
311
self.disable_hook = None
312
self.disable()
313
314
def checker_callback(self, pid, condition, command):
288
self.stop_hook = None
289
self.stop()
290
def checker_callback(self, pid, condition):
315
291
"""The checker has completed, so take appropriate actions."""
292
now = datetime.datetime.now()
316
293
self.checker_callback_tag = None
317
294
self.checker = None
318
if self.use_dbus:
319
# Emit D-Bus signal
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
295
if os.WIFEXITED(condition) \
296
and (os.WEXITSTATUS(condition) == 0):
324
297
logger.info(u"Checker for %(name)s succeeded",
325
298
vars(self))
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
331
self.bump_timeout()
299
self.last_checked_ok = now
300
gobject.source_remove(self.stop_initiator_tag)
301
self.stop_initiator_tag = gobject.timeout_add\
302
(self._timeout_milliseconds,
303
self.stop)
332
304
elif not os.WIFEXITED(condition):
333
305
logger.warning(u"Checker for %(name)s crashed?",
334
306
vars(self))
335
if self.use_dbus:
336
# Emit D-Bus signal
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
340
307
else:
341
308
logger.info(u"Checker for %(name)s failed",
342
309
vars(self))
343
if self.use_dbus:
344
# Emit D-Bus signal
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
348
349
def bump_timeout(self):
350
"""Bump up the timeout for this client.
351
This should only be called when the client has been seen,
352
alive and well.
353
"""
354
self.last_checked_ok = datetime.datetime.utcnow()
355
gobject.source_remove(self.disable_initiator_tag)
356
self.disable_initiator_tag = (gobject.timeout_add
357
(self.timeout_milliseconds(),
358
self.disable))
359
if self.use_dbus:
360
# Emit D-Bus signal
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
364
variant_level=1)))
365
366
310
def start_checker(self):
367
311
"""Start a new checker subprocess if one is not running.
368
312
If a checker already exists, leave it running and do
377
321
# is as it should be.
378
322
if self.checker is None:
379
323
try:
380
# In case checker_command has exactly one % operator
381
command = self.checker_command % self.host
324
# In case check_command has exactly one % operator
325
command = self.check_command % self.host
382
326
except TypeError:
383
327
# Escape attributes for the shell
384
328
escaped_attrs = dict((key, re.escape(str(val)))
385
329
for key, val in
386
330
vars(self).iteritems())
387
331
try:
388
command = self.checker_command % escaped_attrs
332
command = self.check_command % escaped_attrs
389
333
except TypeError, error:
390
334
logger.error(u'Could not format string "%s":'
391
u' %s', self.checker_command, error)
335
u' %s', self.check_command, error)
392
336
return True # Try again later
393
337
try:
394
338
logger.info(u"Starting checker %r for %s",
400
344
self.checker = subprocess.Popen(command,
401
345
close_fds=True,
402
346
shell=True, cwd="/")
403
if self.use_dbus:
404
# Emit D-Bus signal
405
self.CheckerStarted(command)
406
self.PropertyChanged(
407
dbus.String("checker_running"),
408
dbus.Boolean(True, variant_level=1))
409
self.checker_callback_tag = (gobject.child_watch_add
410
(self.checker.pid,
411
self.checker_callback,
412
data=command))
347
self.checker_callback_tag = gobject.child_watch_add\
348
(self.checker.pid,
349
self.checker_callback)
413
350
except OSError, error:
414
351
logger.error(u"Failed to start subprocess: %s",
415
352
error)
416
353
# Re-run this periodically if run by gobject.timeout_add
417
354
return True
418
419
355
def stop_checker(self):
420
356
"""Force the checker process, if any, to stop."""
421
357
if self.checker_callback_tag:
433
369
if error.errno != errno.ESRCH: # No such process
434
370
raise
435
371
self.checker = None
436
if self.use_dbus:
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
439
440
372
def still_valid(self):
441
373
"""Has the timeout not yet passed for this client?"""
442
if not getattr(self, "enabled", False):
443
return False
444
now = datetime.datetime.utcnow()
374
now = datetime.datetime.now()
445
375
if self.last_checked_ok is None:
446
376
return now < (self.created + self.timeout)
447
377
else:
448
378
return now < (self.last_checked_ok + self.timeout)
449
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
452
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
456
457
# CheckerCompleted - signal
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
460
"D-Bus signal"
461
pass
462
463
# CheckerStarted - signal
464
@dbus.service.signal(_interface, signature="s")
465
def CheckerStarted(self, command):
466
"D-Bus signal"
467
pass
468
469
# GetAllProperties - method
470
@dbus.service.method(_interface, out_signature="a{sv}")
471
def GetAllProperties(self):
472
"D-Bus method"
473
return dbus.Dictionary({
474
dbus.String("name"):
475
dbus.String(self.name, variant_level=1),
476
dbus.String("fingerprint"):
477
dbus.String(self.fingerprint, variant_level=1),
478
dbus.String("host"):
479
dbus.String(self.host, variant_level=1),
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
484
variant_level=1)
485
if self.last_enabled is not None
486
else dbus.Boolean(False, variant_level=1)),
487
dbus.String("enabled"):
488
dbus.Boolean(self.enabled, variant_level=1),
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
491
variant_level=1)
492
if self.last_checked_ok is not None
493
else dbus.Boolean (False, variant_level=1)),
494
dbus.String("timeout"):
495
dbus.UInt64(self.timeout_milliseconds(),
496
variant_level=1),
497
dbus.String("interval"):
498
dbus.UInt64(self.interval_milliseconds(),
499
variant_level=1),
500
dbus.String("checker"):
501
dbus.String(self.checker_command,
502
variant_level=1),
503
dbus.String("checker_running"):
504
dbus.Boolean(self.checker is not None,
505
variant_level=1),
506
}, signature="sv")
507
508
# IsStillValid - method
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
510
(still_valid))
511
IsStillValid.__name__ = "IsStillValid"
512
513
# PropertyChanged - signal
514
@dbus.service.signal(_interface, signature="sv")
515
def PropertyChanged(self, property, value):
516
"D-Bus signal"
517
pass
518
519
# SetChecker - method
520
@dbus.service.method(_interface, in_signature="s")
521
def SetChecker(self, checker):
522
"D-Bus setter method"
523
self.checker_command = checker
524
# Emit D-Bus signal
525
self.PropertyChanged(dbus.String(u"checker"),
526
dbus.String(self.checker_command,
527
variant_level=1))
528
529
# SetHost - method
530
@dbus.service.method(_interface, in_signature="s")
531
def SetHost(self, host):
532
"D-Bus setter method"
533
self.host = host
534
# Emit D-Bus signal
535
self.PropertyChanged(dbus.String(u"host"),
536
dbus.String(self.host, variant_level=1))
537
538
# SetInterval - method
539
@dbus.service.method(_interface, in_signature="t")
540
def SetInterval(self, milliseconds):
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
542
# Emit D-Bus signal
543
self.PropertyChanged(dbus.String(u"interval"),
544
(dbus.UInt64(self.interval_milliseconds(),
545
variant_level=1)))
546
547
# SetSecret - method
548
@dbus.service.method(_interface, in_signature="ay",
549
byte_arrays=True)
550
def SetSecret(self, secret):
551
"D-Bus setter method"
552
self.secret = str(secret)
553
554
# SetTimeout - method
555
@dbus.service.method(_interface, in_signature="t")
556
def SetTimeout(self, milliseconds):
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
558
# Emit D-Bus signal
559
self.PropertyChanged(dbus.String(u"timeout"),
560
(dbus.UInt64(self.timeout_milliseconds(),
561
variant_level=1)))
562
563
# Enable - method
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
566
567
# StartChecker - method
568
@dbus.service.method(_interface)
569
def StartChecker(self):
570
"D-Bus method"
571
self.start_checker()
572
573
# Disable - method
574
@dbus.service.method(_interface)
575
def Disable(self):
576
"D-Bus method"
577
self.disable()
578
579
# StopChecker - method
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
582
583
del _interface
584
379
585
380
586
381
def peer_certificate(session):
587
382
"Return the peer's OpenPGP certificate as a bytestring"
588
383
# If not an OpenPGP certificate...
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
384
if gnutls.library.functions.gnutls_certificate_type_get\
385
(session._c_object) \
386
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
592
387
# ...do the normal thing
593
388
return session.peer_certificate
594
389
list_size = ctypes.c_uint()
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
390
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
391
(session._c_object, ctypes.byref(list_size))
598
392
if list_size.value == 0:
599
393
return None
600
394
cert = cert_list[0]
604
398
def fingerprint(openpgp):
605
399
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
606
400
# New GnuTLS "datum" with the OpenPGP public key
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
609
ctypes.POINTER
610
(ctypes.c_ubyte)),
611
ctypes.c_uint(len(openpgp))))
401
datum = gnutls.library.types.gnutls_datum_t\
402
(ctypes.cast(ctypes.c_char_p(openpgp),
403
ctypes.POINTER(ctypes.c_ubyte)),
404
ctypes.c_uint(len(openpgp)))
612
405
# New empty GnuTLS certificate
613
406
crt = gnutls.library.types.gnutls_openpgp_crt_t()
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
407
gnutls.library.functions.gnutls_openpgp_crt_init\
408
(ctypes.byref(crt))
616
409
# Import the OpenPGP public key into the certificate
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
410
gnutls.library.functions.gnutls_openpgp_crt_import\
411
(crt, ctypes.byref(datum),
412
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
621
413
# Verify the self signature in the key
622
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
625
if crtverify.value != 0:
414
crtverify = ctypes.c_uint();
415
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
416
(crt, ctypes.c_uint(0), ctypes.byref(crtverify))
417
if crtverify != 0:
626
418
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
419
raise gnutls.errors.CertificateSecurityError("Verify failed")
628
420
# New buffer for the fingerprint
629
buf = ctypes.create_string_buffer(20)
630
buf_len = ctypes.c_size_t()
421
buffer = ctypes.create_string_buffer(20)
422
buffer_length = ctypes.c_size_t()
631
423
# Get the fingerprint from the certificate into the buffer
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
424
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
425
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
635
426
# Deinit the certificate
636
427
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
637
428
# Convert the buffer to a Python bytestring
638
fpr = ctypes.string_at(buf, buf_len.value)
429
fpr = ctypes.string_at(buffer, buffer_length.value)
639
430
# Convert the bytestring to hexadecimal notation
640
431
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
641
432
return hex_fpr
642
433
643
434
644
class TCP_handler(SocketServer.BaseRequestHandler, object):
435
class tcp_handler(SocketServer.BaseRequestHandler, object):
645
436
"""A TCP request handler class.
646
437
Instantiated by IPv6_TCPServer for each request to handle it.
647
438
Note: This will run in its own forked process."""
648
439
649
440
def handle(self):
650
441
logger.info(u"TCP connection from: %s",
651
unicode(self.client_address))
652
session = (gnutls.connection
653
.ClientSession(self.request,
654
gnutls.connection
655
.X509Credentials()))
442
unicode(self.client_address))
443
session = gnutls.connection.ClientSession\
444
(self.request, gnutls.connection.X509Credentials())
656
445
657
446
line = self.request.makefile().readline()
658
447
logger.debug(u"Protocol version: %r", line)
671
460
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
672
461
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
673
462
# "+DHE-DSS"))
674
# Use a fallback default, since this MUST be set.
675
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
678
priority, None))
463
priority = "NORMAL" # Fallback default, since this
464
# MUST be set.
465
if self.server.settings["priority"]:
466
priority = self.server.settings["priority"]
467
gnutls.library.functions.gnutls_priority_set_direct\
468
(session._c_object, priority, None);
679
469
680
470
try:
681
471
session.handshake()
691
481
session.bye()
692
482
return
693
483
logger.debug(u"Fingerprint: %s", fpr)
484
client = None
694
485
for c in self.server.clients:
695
486
if c.fingerprint == fpr:
696
487
client = c
697
488
break
698
else:
489
if not client:
699
490
logger.warning(u"Client not found for fingerprint: %s",
700
491
fpr)
701
492
session.bye()
708
499
vars(client))
709
500
session.bye()
710
501
return
711
## This won't work here, since we're in a fork.
712
# client.bump_timeout()
713
502
sent_size = 0
714
503
while sent_size < len(client.secret):
715
504
sent = session.send(client.secret[sent_size:])
720
509
session.bye()
721
510
722
511
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
724
SocketServer.TCPServer, object):
512
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
725
513
"""IPv6 TCP server. Accepts 'None' as address and/or port.
726
514
Attributes:
727
515
settings: Server settings
728
516
clients: Set() of Client objects
729
enabled: Boolean; whether this server is activated yet
730
517
"""
731
518
address_family = socket.AF_INET6
732
519
def __init__(self, *args, **kwargs):
736
523
if "clients" in kwargs:
737
524
self.clients = kwargs["clients"]
738
525
del kwargs["clients"]
739
self.enabled = False
740
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
526
return super(type(self), self).__init__(*args, **kwargs)
741
527
def server_bind(self):
742
528
"""This overrides the normal server_bind() function
743
529
to bind to an interface if one was specified, and also NOT to
772
558
# if_nametoindex
773
559
# (self.settings
774
560
# ["interface"]))
775
return super(IPv6_TCPServer, self).server_bind()
776
def server_activate(self):
777
if self.enabled:
778
return super(IPv6_TCPServer, self).server_activate()
779
def enable(self):
780
self.enabled = True
561
return super(type(self), self).server_bind()
781
562
782
563
783
564
def string_to_delta(interval):
799
580
timevalue = datetime.timedelta(0)
800
581
for s in interval.split():
801
582
try:
802
suffix = unicode(s[-1])
803
value = int(s[:-1])
583
suffix=unicode(s[-1])
584
value=int(s[:-1])
804
585
if suffix == u"d":
805
586
delta = datetime.timedelta(value)
806
587
elif suffix == u"s":
822
603
def server_state_changed(state):
823
604
"""Derived from the Avahi example code"""
824
605
if state == avahi.SERVER_COLLISION:
825
logger.error(u"Zeroconf server name collision")
606
logger.error(u"Server name collision")
826
607
service.remove()
827
608
elif state == avahi.SERVER_RUNNING:
828
609
service.add()
830
611
831
612
def entry_group_state_changed(state, error):
832
613
"""Derived from the Avahi example code"""
833
logger.debug(u"Avahi state change: %i", state)
614
logger.debug(u"state change: %i", state)
834
615
835
616
if state == avahi.ENTRY_GROUP_ESTABLISHED:
836
logger.debug(u"Zeroconf service established.")
617
logger.debug(u"Service established.")
837
618
elif state == avahi.ENTRY_GROUP_COLLISION:
838
logger.warning(u"Zeroconf service name collision.")
619
logger.warning(u"Service name collision.")
839
620
service.rename()
840
621
elif state == avahi.ENTRY_GROUP_FAILURE:
841
logger.critical(u"Avahi: Error in group state changed %s",
622
logger.critical(u"Error in group state changed %s",
842
623
unicode(error))
843
raise AvahiGroupError(u"State changed: %s" % unicode(error))
624
raise AvahiGroupError("State changed: %s", str(error))
844
625
845
626
def if_nametoindex(interface):
846
627
"""Call the C function if_nametoindex(), or equivalent"""
847
628
global if_nametoindex
848
629
try:
849
if_nametoindex = (ctypes.cdll.LoadLibrary
850
(ctypes.util.find_library("c"))
851
.if_nametoindex)
630
if "ctypes.util" not in sys.modules:
631
import ctypes.util
632
if_nametoindex = ctypes.cdll.LoadLibrary\
633
(ctypes.util.find_library("c")).if_nametoindex
852
634
except (OSError, AttributeError):
853
635
if "struct" not in sys.modules:
854
636
import struct
857
639
def if_nametoindex(interface):
858
640
"Get an interface index the hard way, i.e. using fcntl()"
859
641
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
860
with closing(socket.socket()) as s:
861
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
862
struct.pack("16s16x", interface))
642
s = socket.socket()
643
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
644
struct.pack("16s16x", interface))
645
s.close()
863
646
interface_index = struct.unpack("I", ifreq[16:20])[0]
864
647
return interface_index
865
648
return if_nametoindex(interface)
889
672
890
673
891
674
def main():
892
parser = optparse.OptionParser(version = "%%prog %s" % version)
675
global main_loop_started
676
main_loop_started = False
677
678
parser = OptionParser(version = "%%prog %s" % version)
893
679
parser.add_option("-i", "--interface", type="string",
894
680
metavar="IF", help="Bind to interface IF")
895
681
parser.add_option("-a", "--address", type="string",
896
682
help="Address to listen for requests on")
897
683
parser.add_option("-p", "--port", type="int",
898
684
help="Port number to receive requests on")
899
parser.add_option("--check", action="store_true",
685
parser.add_option("--check", action="store_true", default=False,
900
686
help="Run self-test")
901
687
parser.add_option("--debug", action="store_true",
902
688
help="Debug mode; run in foreground and log to"
909
695
default="/etc/mandos", metavar="DIR",
910
696
help="Directory to search for configuration"
911
697
" files")
912
parser.add_option("--no-dbus", action="store_false",
913
dest="use_dbus",
914
help="Do not provide D-Bus system bus"
915
" interface")
916
options = parser.parse_args()[0]
698
(options, args) = parser.parse_args()
917
699
918
700
if options.check:
919
701
import doctest
928
710
"priority":
929
711
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
930
712
"servicename": "Mandos",
931
"use_dbus": "True",
932
713
}
933
714
934
715
# Parse config file for server-global settings
937
718
server_config.read(os.path.join(options.configdir, "mandos.conf"))
938
719
# Convert the SafeConfigParser object to a dict
939
720
server_settings = server_config.defaults()
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
721
# Use getboolean on the boolean config option
722
server_settings["debug"] = server_config.getboolean\
723
("DEFAULT", "debug")
945
724
del server_config
946
725
947
726
# Override the settings from the config file with command line
948
727
# options, if set.
949
728
for option in ("interface", "address", "port", "debug",
950
"priority", "servicename", "configdir",
951
"use_dbus"):
729
"priority", "servicename", "configdir"):
952
730
value = getattr(options, option)
953
731
if value is not None:
954
732
server_settings[option] = value
955
733
del options
956
734
# Now we have our good server settings in "server_settings"
957
735
958
# For convenience
959
736
debug = server_settings["debug"]
960
use_dbus = server_settings["use_dbus"]
961
737
962
738
if not debug:
963
739
syslogger.setLevel(logging.WARNING)
964
740
console.setLevel(logging.WARNING)
965
741
966
742
if server_settings["servicename"] != "Mandos":
967
syslogger.setFormatter(logging.Formatter
743
syslogger.setFormatter(logging.Formatter\
968
744
('Mandos (%s): %%(levelname)s:'
969
745
' %%(message)s'
970
746
% server_settings["servicename"]))
972
748
# Parse config file with clients
973
749
client_defaults = { "timeout": "1h",
974
750
"interval": "5m",
975
"checker": "fping -q -- %%(host)s",
751
"checker": "fping -q -- %(host)s",
976
752
"host": "",
977
753
}
978
754
client_config = ConfigParser.SafeConfigParser(client_defaults)
979
755
client_config.read(os.path.join(server_settings["configdir"],
980
756
"clients.conf"))
981
757
982
clients = Set()
983
tcp_server = IPv6_TCPServer((server_settings["address"],
984
server_settings["port"]),
985
TCP_handler,
986
settings=server_settings,
987
clients=clients)
988
pidfilename = "/var/run/mandos.pid"
989
try:
990
pidfile = open(pidfilename, "w")
991
except IOError, error:
992
logger.error("Could not open file %r", pidfilename)
993
994
try:
995
uid = pwd.getpwnam("_mandos").pw_uid
996
gid = pwd.getpwnam("_mandos").pw_gid
997
except KeyError:
998
try:
999
uid = pwd.getpwnam("mandos").pw_uid
1000
gid = pwd.getpwnam("mandos").pw_gid
1001
except KeyError:
1002
try:
1003
uid = pwd.getpwnam("nobody").pw_uid
1004
gid = pwd.getpwnam("nogroup").pw_gid
1005
except KeyError:
1006
uid = 65534
1007
gid = 65534
1008
try:
1009
os.setuid(uid)
1010
os.setgid(gid)
1011
except OSError, error:
1012
if error[0] != errno.EPERM:
1013
raise error
1014
1015
758
global service
1016
759
service = AvahiService(name = server_settings["servicename"],
1017
servicetype = "_mandos._tcp", )
760
type = "_mandos._tcp", );
1018
761
if server_settings["interface"]:
1019
service.interface = (if_nametoindex
1020
(server_settings["interface"]))
762
service.interface = if_nametoindex(server_settings["interface"])
1021
763
1022
764
global main_loop
1023
765
global bus
1026
768
DBusGMainLoop(set_as_default=True )
1027
769
main_loop = gobject.MainLoop()
1028
770
bus = dbus.SystemBus()
1029
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1030
avahi.DBUS_PATH_SERVER),
1031
avahi.DBUS_INTERFACE_SERVER)
771
server = dbus.Interface(
772
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
773
avahi.DBUS_INTERFACE_SERVER )
1032
774
# End of Avahi example code
1033
if use_dbus:
1034
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1035
bus)
775
776
clients = Set()
777
def remove_from_clients(client):
778
clients.remove(client)
779
if not clients:
780
logger.critical(u"No clients left, exiting")
781
sys.exit()
1036
782
1037
783
clients.update(Set(Client(name = section,
784
stop_hook = remove_from_clients,
1038
785
config
1039
= dict(client_config.items(section)),
1040
use_dbus = use_dbus)
786
= dict(client_config.items(section)))
1041
787
for section in client_config.sections()))
1042
788
if not clients:
1043
logger.warning(u"No clients defined")
789
logger.critical(u"No clients defined")
790
sys.exit(1)
1044
791
1045
792
if debug:
1046
793
# Redirect stdin so all checkers get /dev/null
1054
801
# Close all input and output, do double fork, etc.
1055
802
daemon()
1056
803
804
pidfilename = "/var/run/mandos/mandos.pid"
805
pid = os.getpid()
1057
806
try:
1058
pid = os.getpid()
807
pidfile = open(pidfilename, "w")
1059
808
pidfile.write(str(pid) + "\n")
1060
809
pidfile.close()
1061
810
del pidfile
1062
except IOError:
1063
logger.error(u"Could not write to file %r with PID %d",
1064
pidfilename, pid)
1065
except NameError:
1066
# "pidfile" was never created
1067
pass
1068
del pidfilename
811
except IOError, err:
812
logger.error(u"Could not write %s file with PID %d",
813
pidfilename, os.getpid())
1069
814
1070
815
def cleanup():
1071
816
"Cleanup function; run on exit"
1078
823
1079
824
while clients:
1080
825
client = clients.pop()
1081
client.disable_hook = None
1082
client.disable()
826
client.stop_hook = None
827
client.stop()
1083
828
1084
829
atexit.register(cleanup)
1085
830
1088
833
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1089
834
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1090
835
1091
if use_dbus:
1092
class MandosServer(dbus.service.Object):
1093
"""A D-Bus proxy object"""
1094
def __init__(self):
1095
dbus.service.Object.__init__(self, bus,
1096
"/Mandos")
1097
_interface = u"org.mandos_system.Mandos"
1098
1099
@dbus.service.signal(_interface, signature="oa{sv}")
1100
def ClientAdded(self, objpath, properties):
1101
"D-Bus signal"
1102
pass
1103
1104
@dbus.service.signal(_interface, signature="o")
1105
def ClientRemoved(self, objpath):
1106
"D-Bus signal"
1107
pass
1108
1109
@dbus.service.method(_interface, out_signature="ao")
1110
def GetAllClients(self):
1111
return dbus.Array(c.dbus_object_path for c in clients)
1112
1113
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1114
def GetAllClientsWithProperties(self):
1115
return dbus.Dictionary(
1116
((c.dbus_object_path, c.GetAllProperties())
1117
for c in clients),
1118
signature="oa{sv}")
1119
1120
@dbus.service.method(_interface, in_signature="o")
1121
def RemoveClient(self, object_path):
1122
for c in clients:
1123
if c.dbus_object_path == object_path:
1124
clients.remove(c)
1125
# Don't signal anything except ClientRemoved
1126
c.use_dbus = False
1127
c.disable()
1128
# Emit D-Bus signal
1129
self.ClientRemoved(object_path)
1130
return
1131
raise KeyError
1132
@dbus.service.method(_interface)
1133
def Quit(self):
1134
main_loop.quit()
1135
1136
del _interface
1137
1138
mandos_server = MandosServer()
1139
1140
836
for client in clients:
1141
if use_dbus:
1142
# Emit D-Bus signal
1143
mandos_server.ClientAdded(client.dbus_object_path,
1144
client.GetAllProperties())
1145
client.enable()
1146
1147
tcp_server.enable()
1148
tcp_server.server_activate()
1149
837
client.start()
838
839
tcp_server = IPv6_TCPServer((server_settings["address"],
840
server_settings["port"]),
841
tcp_handler,
842
settings=server_settings,
843
clients=clients)
1150
844
# Find out what port we got
1151
845
service.port = tcp_server.socket.getsockname()[1]
1152
846
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1166
860
1167
861
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1168
862
lambda *args, **kwargs:
1169
(tcp_server.handle_request
1170
(*args[2:], **kwargs) or True))
863
tcp_server.handle_request\
864
(*args[2:], **kwargs) or True)
1171
865
1172
866
logger.debug(u"Starting main loop")
867
main_loop_started = True
1173
868
main_loop.run()
1174
869
except AvahiError, error:
1175
logger.critical(u"AvahiError: %s", error)
870
logger.critical(u"AvahiError: %s" + unicode(error))
1176
871
sys.exit(1)
1177
872
except KeyboardInterrupt:
1178
873
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0