173
165
# End of Avahi example code
176
def _datetime_to_dbus(dt, variant_level=0):
177
"""Convert a UTC datetime.datetime() to a D-Bus type."""
178
return dbus.String(dt.isoformat(), variant_level=variant_level)
181
class Client(dbus.service.Object):
168
class Client(object):
182
169
"""A representation of a client host served by this server.
184
name: string; from the config file, used in log messages and
171
name: string; from the config file, used in log messages
186
172
fingerprint: string (40 or 32 hexadecimal digits); used to
187
173
uniquely identify the client
188
secret: bytestring; sent verbatim (over TLS) to client
189
host: string; available for use by the checker command
190
created: datetime.datetime(); (UTC) object creation
191
last_enabled: datetime.datetime(); (UTC)
193
last_checked_ok: datetime.datetime(); (UTC) or None
194
timeout: datetime.timedelta(); How long from last_checked_ok
195
until this client is invalid
196
interval: datetime.timedelta(); How often to start a new checker
197
disable_hook: If set, called by disable() as disable_hook(self)
198
checker: subprocess.Popen(); a running checker process used
199
to see if the client lives.
200
'None' if no process is running.
174
secret: bytestring; sent verbatim (over TLS) to client
175
host: string; available for use by the checker command
176
created: datetime.datetime(); object creation, not client host
177
last_checked_ok: datetime.datetime() or None if not yet checked OK
178
timeout: datetime.timedelta(); How long from last_checked_ok
179
until this client is invalid
180
interval: datetime.timedelta(); How often to start a new checker
181
stop_hook: If set, called by stop() as stop_hook(self)
182
checker: subprocess.Popen(); a running checker process used
183
to see if the client lives.
184
'None' if no process is running.
201
185
checker_initiator_tag: a gobject event source tag, or None
202
disable_initiator_tag: - '' -
186
stop_initiator_tag: - '' -
203
187
checker_callback_tag: - '' -
204
188
checker_command: string; External command which is run to check if
205
189
client lives. %() expansions are done at
206
190
runtime with vars(self) as dict, so that for
207
191
instance %(name)s can be used in the command.
208
use_dbus: bool(); Whether to provide D-Bus interface and signals
209
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
193
_timeout: Real variable for 'timeout'
194
_interval: Real variable for 'interval'
195
_timeout_milliseconds: Used when calling gobject.timeout_add()
196
_interval_milliseconds: - '' -
211
def timeout_milliseconds(self):
212
"Return the 'timeout' attribute in milliseconds"
213
return ((self.timeout.days * 24 * 60 * 60 * 1000)
214
+ (self.timeout.seconds * 1000)
215
+ (self.timeout.microseconds // 1000))
217
def interval_milliseconds(self):
218
"Return the 'interval' attribute in milliseconds"
219
return ((self.interval.days * 24 * 60 * 60 * 1000)
220
+ (self.interval.seconds * 1000)
221
+ (self.interval.microseconds // 1000))
223
def __init__(self, name = None, disable_hook=None, config=None,
198
def _set_timeout(self, timeout):
199
"Setter function for 'timeout' attribute"
200
self._timeout = timeout
201
self._timeout_milliseconds = ((self.timeout.days
202
* 24 * 60 * 60 * 1000)
203
+ (self.timeout.seconds * 1000)
204
+ (self.timeout.microseconds
206
timeout = property(lambda self: self._timeout,
209
def _set_interval(self, interval):
210
"Setter function for 'interval' attribute"
211
self._interval = interval
212
self._interval_milliseconds = ((self.interval.days
213
* 24 * 60 * 60 * 1000)
214
+ (self.interval.seconds
216
+ (self.interval.microseconds
218
interval = property(lambda self: self._interval,
221
def __init__(self, name = None, stop_hook=None, config={}):
225
222
"""Note: the 'checker' key in 'config' sets the
226
223
'checker_command' attribute and *not* the 'checker'
231
226
logger.debug(u"Creating client %r", self.name)
232
self.use_dbus = False # During __init__
233
227
# Uppercase and remove spaces from fingerprint for later
234
228
# comparison purposes with return value from the fingerprint()
236
self.fingerprint = (config["fingerprint"].upper()
230
self.fingerprint = config["fingerprint"].upper()\
238
232
logger.debug(u" Fingerprint: %s", self.fingerprint)
239
233
if "secret" in config:
240
234
self.secret = config["secret"].decode(u"base64")
241
235
elif "secfile" in config:
242
with closing(open(os.path.expanduser
244
(config["secfile"])))) as secfile:
245
self.secret = secfile.read()
236
sf = open(config["secfile"])
237
self.secret = sf.read()
247
240
raise TypeError(u"No secret or secfile for client %s"
249
242
self.host = config.get("host", "")
250
self.created = datetime.datetime.utcnow()
252
self.last_enabled = None
243
self.created = datetime.datetime.now()
253
244
self.last_checked_ok = None
254
245
self.timeout = string_to_delta(config["timeout"])
255
246
self.interval = string_to_delta(config["interval"])
256
self.disable_hook = disable_hook
247
self.stop_hook = stop_hook
257
248
self.checker = None
258
249
self.checker_initiator_tag = None
259
self.disable_initiator_tag = None
250
self.stop_initiator_tag = None
260
251
self.checker_callback_tag = None
261
self.checker_command = config["checker"]
262
self.last_connect = None
263
# Only now, when this client is initialized, can it show up on
265
self.use_dbus = use_dbus
267
self.dbus_object_path = (dbus.ObjectPath
269
+ self.name.replace(".", "_")))
270
dbus.service.Object.__init__(self, bus,
271
self.dbus_object_path)
252
self.check_command = config["checker"]
274
254
"""Start this client's checker and timeout hooks"""
275
self.last_enabled = datetime.datetime.utcnow()
276
255
# Schedule a new checker to be started an 'interval' from now,
277
256
# and every interval from then on.
278
self.checker_initiator_tag = (gobject.timeout_add
279
(self.interval_milliseconds(),
257
self.checker_initiator_tag = gobject.timeout_add\
258
(self._interval_milliseconds,
281
260
# Also start a new checker *right now*.
282
261
self.start_checker()
283
# Schedule a disable() when 'timeout' has passed
284
self.disable_initiator_tag = (gobject.timeout_add
285
(self.timeout_milliseconds(),
290
self.PropertyChanged(dbus.String(u"enabled"),
291
dbus.Boolean(True, variant_level=1))
292
self.PropertyChanged(dbus.String(u"last_enabled"),
293
(_datetime_to_dbus(self.last_enabled,
297
"""Disable this client."""
298
if not getattr(self, "enabled", False):
262
# Schedule a stop() when 'timeout' has passed
263
self.stop_initiator_tag = gobject.timeout_add\
264
(self._timeout_milliseconds,
268
The possibility that a client might be restarted is left open,
269
but not currently used."""
270
# If this client doesn't have a secret, it is already stopped.
271
if hasattr(self, "secret") and self.secret:
272
logger.info(u"Stopping client %s", self.name)
300
logger.info(u"Disabling client %s", self.name)
301
if getattr(self, "disable_initiator_tag", False):
302
gobject.source_remove(self.disable_initiator_tag)
303
self.disable_initiator_tag = None
276
if getattr(self, "stop_initiator_tag", False):
277
gobject.source_remove(self.stop_initiator_tag)
278
self.stop_initiator_tag = None
304
279
if getattr(self, "checker_initiator_tag", False):
305
280
gobject.source_remove(self.checker_initiator_tag)
306
281
self.checker_initiator_tag = None
307
282
self.stop_checker()
308
if self.disable_hook:
309
self.disable_hook(self)
313
self.PropertyChanged(dbus.String(u"enabled"),
314
dbus.Boolean(False, variant_level=1))
315
285
# Do not run this again if called by a gobject.timeout_add
318
287
def __del__(self):
319
self.disable_hook = None
322
def checker_callback(self, pid, condition, command):
288
self.stop_hook = None
290
def checker_callback(self, pid, condition):
323
291
"""The checker has completed, so take appropriate actions."""
292
now = datetime.datetime.now()
324
293
self.checker_callback_tag = None
325
294
self.checker = None
328
self.PropertyChanged(dbus.String(u"checker_running"),
329
dbus.Boolean(False, variant_level=1))
330
if os.WIFEXITED(condition):
331
exitstatus = os.WEXITSTATUS(condition)
333
logger.info(u"Checker for %(name)s succeeded",
337
logger.info(u"Checker for %(name)s failed",
341
self.CheckerCompleted(dbus.Int16(exitstatus),
342
dbus.Int64(condition),
343
dbus.String(command))
295
if os.WIFEXITED(condition) \
296
and (os.WEXITSTATUS(condition) == 0):
297
logger.info(u"Checker for %(name)s succeeded",
299
self.last_checked_ok = now
300
gobject.source_remove(self.stop_initiator_tag)
301
self.stop_initiator_tag = gobject.timeout_add\
302
(self._timeout_milliseconds,
304
elif not os.WIFEXITED(condition):
345
305
logger.warning(u"Checker for %(name)s crashed?",
349
self.CheckerCompleted(dbus.Int16(-1),
350
dbus.Int64(condition),
351
dbus.String(command))
353
def checked_ok(self):
354
"""Bump up the timeout for this client.
355
This should only be called when the client has been seen,
358
self.last_checked_ok = datetime.datetime.utcnow()
359
gobject.source_remove(self.disable_initiator_tag)
360
self.disable_initiator_tag = (gobject.timeout_add
361
(self.timeout_milliseconds(),
365
self.PropertyChanged(
366
dbus.String(u"last_checked_ok"),
367
(_datetime_to_dbus(self.last_checked_ok,
308
logger.info(u"Checker for %(name)s failed",
370
310
def start_checker(self):
371
311
"""Start a new checker subprocess if one is not running.
372
312
If a checker already exists, leave it running and do
443
369
if error.errno != errno.ESRCH: # No such process
445
371
self.checker = None
447
self.PropertyChanged(dbus.String(u"checker_running"),
448
dbus.Boolean(False, variant_level=1))
450
372
def still_valid(self):
451
373
"""Has the timeout not yet passed for this client?"""
452
if not getattr(self, "enabled", False):
454
now = datetime.datetime.utcnow()
374
now = datetime.datetime.now()
455
375
if self.last_checked_ok is None:
456
376
return now < (self.created + self.timeout)
458
378
return now < (self.last_checked_ok + self.timeout)
460
## D-Bus methods & signals
461
_interface = u"se.bsnet.fukt.Mandos.Client"
464
CheckedOK = dbus.service.method(_interface)(checked_ok)
465
CheckedOK.__name__ = "CheckedOK"
467
# CheckerCompleted - signal
468
@dbus.service.signal(_interface, signature="nxs")
469
def CheckerCompleted(self, exitcode, waitstatus, command):
473
# CheckerStarted - signal
474
@dbus.service.signal(_interface, signature="s")
475
def CheckerStarted(self, command):
479
# GetAllProperties - method
480
@dbus.service.method(_interface, out_signature="a{sv}")
481
def GetAllProperties(self):
483
return dbus.Dictionary({
485
dbus.String(self.name, variant_level=1),
486
dbus.String("fingerprint"):
487
dbus.String(self.fingerprint, variant_level=1),
489
dbus.String(self.host, variant_level=1),
490
dbus.String("created"):
491
_datetime_to_dbus(self.created, variant_level=1),
492
dbus.String("last_enabled"):
493
(_datetime_to_dbus(self.last_enabled,
495
if self.last_enabled is not None
496
else dbus.Boolean(False, variant_level=1)),
497
dbus.String("enabled"):
498
dbus.Boolean(self.enabled, variant_level=1),
499
dbus.String("last_checked_ok"):
500
(_datetime_to_dbus(self.last_checked_ok,
502
if self.last_checked_ok is not None
503
else dbus.Boolean (False, variant_level=1)),
504
dbus.String("timeout"):
505
dbus.UInt64(self.timeout_milliseconds(),
507
dbus.String("interval"):
508
dbus.UInt64(self.interval_milliseconds(),
510
dbus.String("checker"):
511
dbus.String(self.checker_command,
513
dbus.String("checker_running"):
514
dbus.Boolean(self.checker is not None,
516
dbus.String("object_path"):
517
dbus.ObjectPath(self.dbus_object_path,
521
# IsStillValid - method
522
IsStillValid = (dbus.service.method(_interface, out_signature="b")
524
IsStillValid.__name__ = "IsStillValid"
526
# PropertyChanged - signal
527
@dbus.service.signal(_interface, signature="sv")
528
def PropertyChanged(self, property, value):
532
# SetChecker - method
533
@dbus.service.method(_interface, in_signature="s")
534
def SetChecker(self, checker):
535
"D-Bus setter method"
536
self.checker_command = checker
538
self.PropertyChanged(dbus.String(u"checker"),
539
dbus.String(self.checker_command,
543
@dbus.service.method(_interface, in_signature="s")
544
def SetHost(self, host):
545
"D-Bus setter method"
548
self.PropertyChanged(dbus.String(u"host"),
549
dbus.String(self.host, variant_level=1))
551
# SetInterval - method
552
@dbus.service.method(_interface, in_signature="t")
553
def SetInterval(self, milliseconds):
554
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
556
self.PropertyChanged(dbus.String(u"interval"),
557
(dbus.UInt64(self.interval_milliseconds(),
561
@dbus.service.method(_interface, in_signature="ay",
563
def SetSecret(self, secret):
564
"D-Bus setter method"
565
self.secret = str(secret)
567
# SetTimeout - method
568
@dbus.service.method(_interface, in_signature="t")
569
def SetTimeout(self, milliseconds):
570
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
572
self.PropertyChanged(dbus.String(u"timeout"),
573
(dbus.UInt64(self.timeout_milliseconds(),
577
Enable = dbus.service.method(_interface)(enable)
578
Enable.__name__ = "Enable"
580
# StartChecker - method
581
@dbus.service.method(_interface)
582
def StartChecker(self):
587
@dbus.service.method(_interface)
592
# StopChecker - method
593
StopChecker = dbus.service.method(_interface)(stop_checker)
594
StopChecker.__name__ = "StopChecker"
599
381
def peer_certificate(session):
600
382
"Return the peer's OpenPGP certificate as a bytestring"
601
383
# If not an OpenPGP certificate...
602
if (gnutls.library.functions
603
.gnutls_certificate_type_get(session._c_object)
604
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
384
if gnutls.library.functions.gnutls_certificate_type_get\
385
(session._c_object) \
386
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
605
387
# ...do the normal thing
606
388
return session.peer_certificate
607
list_size = ctypes.c_uint(1)
608
cert_list = (gnutls.library.functions
609
.gnutls_certificate_get_peers
610
(session._c_object, ctypes.byref(list_size)))
611
if not bool(cert_list) and list_size.value != 0:
612
raise gnutls.errors.GNUTLSError("error getting peer"
389
list_size = ctypes.c_uint()
390
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
391
(session._c_object, ctypes.byref(list_size))
614
392
if list_size.value == 0:
616
394
cert = cert_list[0]
620
398
def fingerprint(openpgp):
621
399
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
622
400
# New GnuTLS "datum" with the OpenPGP public key
623
datum = (gnutls.library.types
624
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
627
ctypes.c_uint(len(openpgp))))
401
datum = gnutls.library.types.gnutls_datum_t\
402
(ctypes.cast(ctypes.c_char_p(openpgp),
403
ctypes.POINTER(ctypes.c_ubyte)),
404
ctypes.c_uint(len(openpgp)))
628
405
# New empty GnuTLS certificate
629
406
crt = gnutls.library.types.gnutls_openpgp_crt_t()
630
(gnutls.library.functions
631
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
407
gnutls.library.functions.gnutls_openpgp_crt_init\
632
409
# Import the OpenPGP public key into the certificate
633
(gnutls.library.functions
634
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
635
gnutls.library.constants
636
.GNUTLS_OPENPGP_FMT_RAW))
410
gnutls.library.functions.gnutls_openpgp_crt_import\
411
(crt, ctypes.byref(datum),
412
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
637
413
# Verify the self signature in the key
638
crtverify = ctypes.c_uint()
639
(gnutls.library.functions
640
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
641
if crtverify.value != 0:
414
crtverify = ctypes.c_uint();
415
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
416
(crt, ctypes.c_uint(0), ctypes.byref(crtverify))
642
418
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
643
419
raise gnutls.errors.CertificateSecurityError("Verify failed")
644
420
# New buffer for the fingerprint
645
buf = ctypes.create_string_buffer(20)
646
buf_len = ctypes.c_size_t()
421
buffer = ctypes.create_string_buffer(20)
422
buffer_length = ctypes.c_size_t()
647
423
# Get the fingerprint from the certificate into the buffer
648
(gnutls.library.functions
649
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
650
ctypes.byref(buf_len)))
424
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
425
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
651
426
# Deinit the certificate
652
427
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
653
428
# Convert the buffer to a Python bytestring
654
fpr = ctypes.string_at(buf, buf_len.value)
429
fpr = ctypes.string_at(buffer, buffer_length.value)
655
430
# Convert the bytestring to hexadecimal notation
656
431
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
660
class TCP_handler(SocketServer.BaseRequestHandler, object):
435
class tcp_handler(SocketServer.BaseRequestHandler, object):
661
436
"""A TCP request handler class.
662
437
Instantiated by IPv6_TCPServer for each request to handle it.
663
438
Note: This will run in its own forked process."""
665
440
def handle(self):
666
441
logger.info(u"TCP connection from: %s",
667
unicode(self.client_address))
668
session = (gnutls.connection
669
.ClientSession(self.request,
442
unicode(self.client_address))
443
session = gnutls.connection.ClientSession\
444
(self.request, gnutls.connection.X509Credentials())
673
446
line = self.request.makefile().readline()
674
447
logger.debug(u"Protocol version: %r", line)
1006
748
# Parse config file with clients
1007
749
client_defaults = { "timeout": "1h",
1008
750
"interval": "5m",
1009
"checker": "fping -q -- %%(host)s",
751
"checker": "fping -q -- %(host)s",
1012
754
client_config = ConfigParser.SafeConfigParser(client_defaults)
1013
755
client_config.read(os.path.join(server_settings["configdir"],
1014
756
"clients.conf"))
1017
tcp_server = IPv6_TCPServer((server_settings["address"],
1018
server_settings["port"]),
1020
settings=server_settings,
1021
clients=clients, use_ipv6=use_ipv6)
1022
pidfilename = "/var/run/mandos.pid"
1024
pidfile = open(pidfilename, "w")
1026
logger.error("Could not open file %r", pidfilename)
1029
uid = pwd.getpwnam("_mandos").pw_uid
1030
gid = pwd.getpwnam("_mandos").pw_gid
1033
uid = pwd.getpwnam("mandos").pw_uid
1034
gid = pwd.getpwnam("mandos").pw_gid
1037
uid = pwd.getpwnam("nobody").pw_uid
1038
gid = pwd.getpwnam("nogroup").pw_gid
1045
except OSError, error:
1046
if error[0] != errno.EPERM:
1049
# Enable all possible GnuTLS debugging
1051
# "Use a log level over 10 to enable all debugging options."
1053
gnutls.library.functions.gnutls_global_set_log_level(11)
1055
@gnutls.library.types.gnutls_log_func
1056
def debug_gnutls(level, string):
1057
logger.debug("GnuTLS: %s", string[:-1])
1059
(gnutls.library.functions
1060
.gnutls_global_set_log_function(debug_gnutls))
1063
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1064
759
service = AvahiService(name = server_settings["servicename"],
1065
servicetype = "_mandos._tcp",
1066
protocol = protocol)
760
type = "_mandos._tcp", );
1067
761
if server_settings["interface"]:
1068
service.interface = (if_nametoindex
1069
(server_settings["interface"]))
762
service.interface = if_nametoindex(server_settings["interface"])
1071
764
global main_loop
1136
833
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1137
834
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1140
class MandosServer(dbus.service.Object):
1141
"""A D-Bus proxy object"""
1143
dbus.service.Object.__init__(self, bus, "/")
1144
_interface = u"se.bsnet.fukt.Mandos"
1146
@dbus.service.signal(_interface, signature="oa{sv}")
1147
def ClientAdded(self, objpath, properties):
1151
@dbus.service.signal(_interface, signature="os")
1152
def ClientRemoved(self, objpath, name):
1156
@dbus.service.method(_interface, out_signature="ao")
1157
def GetAllClients(self):
1159
return dbus.Array(c.dbus_object_path for c in clients)
1161
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1162
def GetAllClientsWithProperties(self):
1164
return dbus.Dictionary(
1165
((c.dbus_object_path, c.GetAllProperties())
1169
@dbus.service.method(_interface, in_signature="o")
1170
def RemoveClient(self, object_path):
1173
if c.dbus_object_path == object_path:
1175
# Don't signal anything except ClientRemoved
1179
self.ClientRemoved(object_path, c.name)
1185
mandos_server = MandosServer()
1187
836
for client in clients:
1190
mandos_server.ClientAdded(client.dbus_object_path,
1191
client.GetAllProperties())
1195
tcp_server.server_activate()
839
tcp_server = IPv6_TCPServer((server_settings["address"],
840
server_settings["port"]),
842
settings=server_settings,
1197
844
# Find out what port we got
1198
845
service.port = tcp_server.socket.getsockname()[1]
1200
logger.info(u"Now listening on address %r, port %d,"
1201
" flowinfo %d, scope_id %d"
1202
% tcp_server.socket.getsockname())
1204
logger.info(u"Now listening on address %r, port %d"
1205
% tcp_server.socket.getsockname())
846
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
847
u" scope_id %d" % tcp_server.socket.getsockname())
1207
849
#service.interface = tcp_server.socket.getsockname()[3]