/mandos/trunk : revision 24.1.69

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

14

16

15

#

17

16

# This program is free software: you can redistribute it and/or modify

18

17

# it under the terms of the GNU General Public License as published by

25

24

# GNU General Public License for more details.

26

25

#

27

26

# You should have received a copy of the GNU General Public License

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

30

28

#

31

29

# Contact the authors at <mandos@fukt.bsnet.se>.

32

30

#

33

31

34

from __future__ import division, with_statement, absolute_import

32

from __future__ import division

35

33

36

34

import SocketServer

37

35

import socket

36

import select

38

37

from optparse import OptionParser

39

38

import datetime

40

39

import errno

55

54

import stat

56

55

import logging

57

56

import logging.handlers

58

import pwd

59

from contextlib import closing

60

57

61

58

import dbus

62

import dbus.service

63

59

import gobject

64

60

import avahi

65

61

from dbus.mainloop.glib import DBusGMainLoop

66

62

import ctypes

67

import ctypes.util

68

63

69

version = "1.0.2"

64

version = "1.0"

70

65

71

66

logger = logging.Logger('mandos')

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos: %(levelname)s: %(message)s'))

67

syslogger = logging.handlers.SysLogHandler\

68

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

69

address = "/dev/log")

70

syslogger.setFormatter(logging.Formatter\

71

('Mandos: %(levelname)s: %(message)s'))

77

72

logger.addHandler(syslogger)

78

73

79

74

console = logging.StreamHandler()

84

79

class AvahiError(Exception):

85

80

def __init__(self, value):

86

81

self.value = value

87

super(AvahiError, self).__init__()

88

82

def __str__(self):

89

83

return repr(self.value)

90

84

112

106

a sensible number of times

113

107

"""

114

108

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

115

servicetype = None, port = None, TXT = None,

116

domain = "", host = "", max_renames = 32768):

109

type = None, port = None, TXT = None, domain = "",

110

host = "", max_renames = 32768):

117

111

self.interface = interface

118

112

self.name = name

119

self.type = servicetype

113

self.type = type

120

114

self.port = port

121

self.TXT = TXT if TXT is not None else []

115

if TXT is None:

116

self.TXT = []

117

else:

118

self.TXT = TXT

122

119

self.domain = domain

123

120

self.host = host

124

121

self.rename_count = 0

126

123

def rename(self):

127

124

"""Derived from the Avahi example code"""

128

125

if self.rename_count >= self.max_renames:

129

logger.critical(u"No suitable Zeroconf service name found"

130

u" after %i retries, exiting.",

131

self.rename_count)

126

logger.critical(u"No suitable service name found after %i"

127

u" retries, exiting.", rename_count)

132

128

raise AvahiServiceError("Too many renames")

133

129

self.name = server.GetAlternativeServiceName(self.name)

134

logger.info(u"Changing Zeroconf service name to %r ...",

135

str(self.name))

136

syslogger.setFormatter(logging.Formatter

130

logger.info(u"Changing name to %r ...", str(self.name))

131

syslogger.setFormatter(logging.Formatter\

137

132

('Mandos (%s): %%(levelname)s:'

138

' %%(message)s' % self.name))

133

' %%(message)s' % self.name))

139

134

self.remove()

140

135

self.add()

141

136

self.rename_count += 1

147

142

"""Derived from the Avahi example code"""

148

143

global group

149

144

if group is None:

150

group = dbus.Interface(bus.get_object

151

(avahi.DBUS_NAME,

145

group = dbus.Interface\

146

(bus.get_object(avahi.DBUS_NAME,

152

147

server.EntryGroupNew()),

153

avahi.DBUS_INTERFACE_ENTRY_GROUP)

148

avahi.DBUS_INTERFACE_ENTRY_GROUP)

154

149

group.connect_to_signal('StateChanged',

155

150

entry_group_state_changed)

156

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

151

logger.debug(u"Adding service '%s' of type '%s' ...",

157

152

service.name, service.type)

158

153

group.AddService(

159

154

self.interface, # interface

170

165

# End of Avahi example code

171

166

172

167

173

def _datetime_to_dbus(dt, variant_level=0):

174

"""Convert a UTC datetime.datetime() to a D-Bus type."""

175

return dbus.String(dt.isoformat(), variant_level=variant_level)

176

177

178

class Client(dbus.service.Object):

168

class Client(object):

179

169

"""A representation of a client host served by this server.

180

170

Attributes:

181

name: string; from the config file, used in log messages

171

name: string; from the config file, used in log messages

182

172

fingerprint: string (40 or 32 hexadecimal digits); used to

183

173

uniquely identify the client

184

secret: bytestring; sent verbatim (over TLS) to client

185

host: string; available for use by the checker command

186

created: datetime.datetime(); (UTC) object creation

187

last_enabled: datetime.datetime(); (UTC)

188

enabled: bool()

189

last_checked_ok: datetime.datetime(); (UTC) or None

190

timeout: datetime.timedelta(); How long from last_checked_ok

191

until this client is invalid

192

interval: datetime.timedelta(); How often to start a new checker

193

disable_hook: If set, called by disable() as disable_hook(self)

194

checker: subprocess.Popen(); a running checker process used

195

to see if the client lives.

196

'None' if no process is running.

174

secret: bytestring; sent verbatim (over TLS) to client

175

host: string; available for use by the checker command

176

created: datetime.datetime(); object creation, not client host

177

last_checked_ok: datetime.datetime() or None if not yet checked OK

178

timeout: datetime.timedelta(); How long from last_checked_ok

179

until this client is invalid

180

interval: datetime.timedelta(); How often to start a new checker

181

stop_hook: If set, called by stop() as stop_hook(self)

182

checker: subprocess.Popen(); a running checker process used

183

to see if the client lives.

184

'None' if no process is running.

197

185

checker_initiator_tag: a gobject event source tag, or None

198

disable_initiator_tag: - '' -

186

stop_initiator_tag: - '' -

199

187

checker_callback_tag: - '' -

200

188

checker_command: string; External command which is run to check if

201

189

client lives. %() expansions are done at

202

190

runtime with vars(self) as dict, so that for

203

191

instance %(name)s can be used in the command.

204

dbus_object_path: dbus.ObjectPath

205

192

Private attibutes:

206

193

_timeout: Real variable for 'timeout'

207

194

_interval: Real variable for 'interval'

209

196

_interval_milliseconds: - '' -

210

197

"""

211

198

def _set_timeout(self, timeout):

212

"Setter function for the 'timeout' attribute"

199

"Setter function for 'timeout' attribute"

213

200

self._timeout = timeout

214

201

self._timeout_milliseconds = ((self.timeout.days

215

202

* 24 * 60 * 60 * 1000)

216

203

+ (self.timeout.seconds * 1000)

217

204

+ (self.timeout.microseconds

218

205

// 1000))

219

# Emit D-Bus signal

220

self.PropertyChanged(dbus.String(u"timeout"),

221

(dbus.UInt64(self._timeout_milliseconds,

222

variant_level=1)))

223

timeout = property(lambda self: self._timeout, _set_timeout)

206

timeout = property(lambda self: self._timeout,

207

_set_timeout)

224

208

del _set_timeout

225

226

209

def _set_interval(self, interval):

227

"Setter function for the 'interval' attribute"

210

"Setter function for 'interval' attribute"

228

211

self._interval = interval

229

212

self._interval_milliseconds = ((self.interval.days

230

213

* 24 * 60 * 60 * 1000)

232

215

* 1000)

233

216

+ (self.interval.microseconds

234

217

// 1000))

235

# Emit D-Bus signal

236

self.PropertyChanged(dbus.String(u"interval"),

237

(dbus.UInt64(self._interval_milliseconds,

238

variant_level=1)))

239

interval = property(lambda self: self._interval, _set_interval)

218

interval = property(lambda self: self._interval,

219

_set_interval)

240

220

del _set_interval

241

242

def __init__(self, name = None, disable_hook=None, config=None):

221

def __init__(self, name = None, stop_hook=None, config={}):

243

222

"""Note: the 'checker' key in 'config' sets the

244

223

'checker_command' attribute and *not* the 'checker'

245

224

attribute."""

246

self.dbus_object_path = (dbus.ObjectPath

247

("/Mandos/clients/"

248

+ name.replace(".", "_")))

249

dbus.service.Object.__init__(self, bus,

250

self.dbus_object_path)

251

if config is None:

252

config = {}

253

225

self.name = name

254

226

logger.debug(u"Creating client %r", self.name)

255

227

# Uppercase and remove spaces from fingerprint for later

256

228

# comparison purposes with return value from the fingerprint()

257

229

# function

258

self.fingerprint = (config["fingerprint"].upper()

259

.replace(u" ", u""))

230

self.fingerprint = config["fingerprint"].upper()\

231

.replace(u" ", u"")

260

232

logger.debug(u" Fingerprint: %s", self.fingerprint)

261

233

if "secret" in config:

262

234

self.secret = config["secret"].decode(u"base64")

263

235

elif "secfile" in config:

264

with closing(open(os.path.expanduser

265

(os.path.expandvars

266

(config["secfile"])))) as secfile:

267

self.secret = secfile.read()

236

sf = open(config["secfile"])

237

self.secret = sf.read()

238

sf.close()

268

239

else:

269

240

raise TypeError(u"No secret or secfile for client %s"

270

241

% self.name)

271

242

self.host = config.get("host", "")

272

self.created = datetime.datetime.utcnow()

273

self.enabled = False

274

self.last_enabled = None

243

self.created = datetime.datetime.now()

275

244

self.last_checked_ok = None

276

245

self.timeout = string_to_delta(config["timeout"])

277

246

self.interval = string_to_delta(config["interval"])

278

self.disable_hook = disable_hook

247

self.stop_hook = stop_hook

279

248

self.checker = None

280

249

self.checker_initiator_tag = None

281

self.disable_initiator_tag = None

250

self.stop_initiator_tag = None

282

251

self.checker_callback_tag = None

283

self.checker_command = config["checker"]

284

285

def enable(self):

252

self.check_command = config["checker"]

253

def start(self):

286

254

"""Start this client's checker and timeout hooks"""

287

self.last_enabled = datetime.datetime.utcnow()

288

255

# Schedule a new checker to be started an 'interval' from now,

289

256

# and every interval from then on.

290

self.checker_initiator_tag = (gobject.timeout_add

291

(self._interval_milliseconds,

292

self.start_checker))

257

self.checker_initiator_tag = gobject.timeout_add\

258

(self._interval_milliseconds,

259

self.start_checker)

293

260

# Also start a new checker *right now*.

294

261

self.start_checker()

295

# Schedule a disable() when 'timeout' has passed

296

self.disable_initiator_tag = (gobject.timeout_add

297

(self._timeout_milliseconds,

298

self.disable))

299

self.enabled = True

300

# Emit D-Bus signal

301

self.PropertyChanged(dbus.String(u"enabled"),

302

dbus.Boolean(True, variant_level=1))

303

self.PropertyChanged(dbus.String(u"last_enabled"),

304

(_datetime_to_dbus(self.last_enabled,

305

variant_level=1)))

306

307

def disable(self):

308

"""Disable this client."""

309

if not getattr(self, "enabled", False):

262

# Schedule a stop() when 'timeout' has passed

263

self.stop_initiator_tag = gobject.timeout_add\

264

(self._timeout_milliseconds,

265

self.stop)

266

def stop(self):

267

"""Stop this client.

268

The possibility that a client might be restarted is left open,

269

but not currently used."""

270

# If this client doesn't have a secret, it is already stopped.

271

if hasattr(self, "secret") and self.secret:

272

logger.info(u"Stopping client %s", self.name)

273

self.secret = None

274

else:

310

275

return False

311

logger.info(u"Disabling client %s", self.name)

312

if getattr(self, "disable_initiator_tag", False):

313

gobject.source_remove(self.disable_initiator_tag)

314

self.disable_initiator_tag = None

276

if getattr(self, "stop_initiator_tag", False):

277

gobject.source_remove(self.stop_initiator_tag)

278

self.stop_initiator_tag = None

315

279

if getattr(self, "checker_initiator_tag", False):

316

280

gobject.source_remove(self.checker_initiator_tag)

317

281

self.checker_initiator_tag = None

318

282

self.stop_checker()

319

if self.disable_hook:

320

self.disable_hook(self)

321

self.enabled = False

322

# Emit D-Bus signal

323

self.PropertyChanged(dbus.String(u"enabled"),

324

dbus.Boolean(False, variant_level=1))

283

if self.stop_hook:

284

self.stop_hook(self)

325

285

# Do not run this again if called by a gobject.timeout_add

326

286

return False

327

328

287

def __del__(self):

329

self.disable_hook = None

330

self.disable()

331

332

def checker_callback(self, pid, condition, command):

288

self.stop_hook = None

289

self.stop()

290

def checker_callback(self, pid, condition):

333

291

"""The checker has completed, so take appropriate actions."""

292

now = datetime.datetime.now()

334

293

self.checker_callback_tag = None

335

294

self.checker = None

336

# Emit D-Bus signal

337

self.PropertyChanged(dbus.String(u"checker_running"),

338

dbus.Boolean(False, variant_level=1))

339

if (os.WIFEXITED(condition)

340

and (os.WEXITSTATUS(condition) == 0)):

295

if os.WIFEXITED(condition) \

296

and (os.WEXITSTATUS(condition) == 0):

341

297

logger.info(u"Checker for %(name)s succeeded",

342

298

vars(self))

343

# Emit D-Bus signal

344

self.CheckerCompleted(dbus.Boolean(True),

345

dbus.UInt16(condition),

346

dbus.String(command))

347

self.bump_timeout()

299

self.last_checked_ok = now

300

gobject.source_remove(self.stop_initiator_tag)

301

self.stop_initiator_tag = gobject.timeout_add\

302

(self._timeout_milliseconds,

303

self.stop)

348

304

elif not os.WIFEXITED(condition):

349

305

logger.warning(u"Checker for %(name)s crashed?",

350

306

vars(self))

351

# Emit D-Bus signal

352

self.CheckerCompleted(dbus.Boolean(False),

353

dbus.UInt16(condition),

354

dbus.String(command))

355

307

else:

356

308

logger.info(u"Checker for %(name)s failed",

357

309

vars(self))

358

# Emit D-Bus signal

359

self.CheckerCompleted(dbus.Boolean(False),

360

dbus.UInt16(condition),

361

dbus.String(command))

362

363

def bump_timeout(self):

364

"""Bump up the timeout for this client.

365

This should only be called when the client has been seen,

366

alive and well.

367

"""

368

self.last_checked_ok = datetime.datetime.utcnow()

369

gobject.source_remove(self.disable_initiator_tag)

370

self.disable_initiator_tag = (gobject.timeout_add

371

(self._timeout_milliseconds,

372

self.disable))

373

self.PropertyChanged(dbus.String(u"last_checked_ok"),

374

(_datetime_to_dbus(self.last_checked_ok,

375

variant_level=1)))

376

377

310

def start_checker(self):

378

311

"""Start a new checker subprocess if one is not running.

379

312

If a checker already exists, leave it running and do

388

321

# is as it should be.

389

322

if self.checker is None:

390

323

try:

391

# In case checker_command has exactly one % operator

392

command = self.checker_command % self.host

324

# In case check_command has exactly one % operator

325

command = self.check_command % self.host

393

326

except TypeError:

394

327

# Escape attributes for the shell

395

328

escaped_attrs = dict((key, re.escape(str(val)))

396

329

for key, val in

397

330

vars(self).iteritems())

398

331

try:

399

command = self.checker_command % escaped_attrs

332

command = self.check_command % escaped_attrs

400

333

except TypeError, error:

401

334

logger.error(u'Could not format string "%s":'

402

u' %s', self.checker_command, error)

335

u' %s', self.check_command, error)

403

336

return True # Try again later

404

337

try:

405

338

logger.info(u"Starting checker %r for %s",

411

344

self.checker = subprocess.Popen(command,

412

345

close_fds=True,

413

346

shell=True, cwd="/")

414

# Emit D-Bus signal

415

self.CheckerStarted(command)

416

self.PropertyChanged(dbus.String("checker_running"),

417

dbus.Boolean(True, variant_level=1))

418

self.checker_callback_tag = (gobject.child_watch_add

419

(self.checker.pid,

420

self.checker_callback,

421

data=command))

347

self.checker_callback_tag = gobject.child_watch_add\

348

(self.checker.pid,

349

self.checker_callback)

422

350

except OSError, error:

423

351

logger.error(u"Failed to start subprocess: %s",

424

352

error)

425

353

# Re-run this periodically if run by gobject.timeout_add

426

354

return True

427

428

355

def stop_checker(self):

429

356

"""Force the checker process, if any, to stop."""

430

357

if self.checker_callback_tag:

442

369

if error.errno != errno.ESRCH: # No such process

443

370

raise

444

371

self.checker = None

445

self.PropertyChanged(dbus.String(u"checker_running"),

446

dbus.Boolean(False, variant_level=1))

447

448

372

def still_valid(self):

449

373

"""Has the timeout not yet passed for this client?"""

450

if not getattr(self, "enabled", False):

451

return False

452

now = datetime.datetime.utcnow()

374

now = datetime.datetime.now()

453

375

if self.last_checked_ok is None:

454

376

return now < (self.created + self.timeout)

455

377

else:

456

378

return now < (self.last_checked_ok + self.timeout)

457

458

## D-Bus methods & signals

459

_interface = u"org.mandos_system.Mandos.Client"

460

461

# BumpTimeout - method

462

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

463

BumpTimeout.__name__ = "BumpTimeout"

464

465

# CheckerCompleted - signal

466

@dbus.service.signal(_interface, signature="bqs")

467

def CheckerCompleted(self, success, condition, command):

468

"D-Bus signal"

469

pass

470

471

# CheckerStarted - signal

472

@dbus.service.signal(_interface, signature="s")

473

def CheckerStarted(self, command):

474

"D-Bus signal"

475

pass

476

477

# GetAllProperties - method

478

@dbus.service.method(_interface, out_signature="a{sv}")

479

def GetAllProperties(self):

480

"D-Bus method"

481

return dbus.Dictionary({

482

dbus.String("name"):

483

dbus.String(self.name, variant_level=1),

484

dbus.String("fingerprint"):

485

dbus.String(self.fingerprint, variant_level=1),

486

dbus.String("host"):

487

dbus.String(self.host, variant_level=1),

488

dbus.String("created"):

489

_datetime_to_dbus(self.created, variant_level=1),

490

dbus.String("last_enabled"):

491

(_datetime_to_dbus(self.last_enabled,

492

variant_level=1)

493

if self.last_enabled is not None

494

else dbus.Boolean(False, variant_level=1)),

495

dbus.String("enabled"):

496

dbus.Boolean(self.enabled, variant_level=1),

497

dbus.String("last_checked_ok"):

498

(_datetime_to_dbus(self.last_checked_ok,

499

variant_level=1)

500

if self.last_checked_ok is not None

501

else dbus.Boolean (False, variant_level=1)),

502

dbus.String("timeout"):

503

dbus.UInt64(self._timeout_milliseconds,

504

variant_level=1),

505

dbus.String("interval"):

506

dbus.UInt64(self._interval_milliseconds,

507

variant_level=1),

508

dbus.String("checker"):

509

dbus.String(self.checker_command,

510

variant_level=1),

511

dbus.String("checker_running"):

512

dbus.Boolean(self.checker is not None,

513

variant_level=1),

514

}, signature="sv")

515

516

# IsStillValid - method

517

IsStillValid = (dbus.service.method(_interface, out_signature="b")

518

(still_valid))

519

IsStillValid.__name__ = "IsStillValid"

520

521

# PropertyChanged - signal

522

@dbus.service.signal(_interface, signature="sv")

523

def PropertyChanged(self, property, value):

524

"D-Bus signal"

525

pass

526

527

# SetChecker - method

528

@dbus.service.method(_interface, in_signature="s")

529

def SetChecker(self, checker):

530

"D-Bus setter method"

531

self.checker_command = checker

532

533

# SetHost - method

534

@dbus.service.method(_interface, in_signature="s")

535

def SetHost(self, host):

536

"D-Bus setter method"

537

self.host = host

538

539

# SetInterval - method

540

@dbus.service.method(_interface, in_signature="t")

541

def SetInterval(self, milliseconds):

542

self.interval = datetime.timdeelta(0, 0, 0, milliseconds)

543

544

# SetSecret - method

545

@dbus.service.method(_interface, in_signature="ay",

546

byte_arrays=True)

547

def SetSecret(self, secret):

548

"D-Bus setter method"

549

self.secret = str(secret)

550

551

# SetTimeout - method

552

@dbus.service.method(_interface, in_signature="t")

553

def SetTimeout(self, milliseconds):

554

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

555

556

# Enable - method

557

Enable = dbus.service.method(_interface)(enable)

558

Enable.__name__ = "Enable"

559

560

# StartChecker - method

561

@dbus.service.method(_interface)

562

def StartChecker(self):

563

"D-Bus method"

564

self.start_checker()

565

566

# Disable - method

567

@dbus.service.method(_interface)

568

def Disable(self):

569

"D-Bus method"

570

self.disable()

571

572

# StopChecker - method

573

StopChecker = dbus.service.method(_interface)(stop_checker)

574

StopChecker.__name__ = "StopChecker"

575

576

del _interface

577

379

578

380

579

381

def peer_certificate(session):

580

382

"Return the peer's OpenPGP certificate as a bytestring"

581

383

# If not an OpenPGP certificate...

582

if (gnutls.library.functions

583

.gnutls_certificate_type_get(session._c_object)

584

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

384

if gnutls.library.functions.gnutls_certificate_type_get\

385

(session._c_object) \

386

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

585

387

# ...do the normal thing

586

388

return session.peer_certificate

587

389

list_size = ctypes.c_uint()

588

cert_list = (gnutls.library.functions

589

.gnutls_certificate_get_peers

590

(session._c_object, ctypes.byref(list_size)))

390

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

391

(session._c_object, ctypes.byref(list_size))

591

392

if list_size.value == 0:

592

393

return None

593

394

cert = cert_list[0]

597

398

def fingerprint(openpgp):

598

399

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

599

400

# New GnuTLS "datum" with the OpenPGP public key

600

datum = (gnutls.library.types

601

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

602

ctypes.POINTER

603

(ctypes.c_ubyte)),

604

ctypes.c_uint(len(openpgp))))

401

datum = gnutls.library.types.gnutls_datum_t\

402

(ctypes.cast(ctypes.c_char_p(openpgp),

403

ctypes.POINTER(ctypes.c_ubyte)),

404

ctypes.c_uint(len(openpgp)))

605

405

# New empty GnuTLS certificate

606

406

crt = gnutls.library.types.gnutls_openpgp_crt_t()

607

(gnutls.library.functions

608

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

407

gnutls.library.functions.gnutls_openpgp_crt_init\

408

(ctypes.byref(crt))

609

409

# Import the OpenPGP public key into the certificate

610

(gnutls.library.functions

611

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

612

gnutls.library.constants

613

.GNUTLS_OPENPGP_FMT_RAW))

410

gnutls.library.functions.gnutls_openpgp_crt_import\

411

(crt, ctypes.byref(datum),

412

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

614

413

# Verify the self signature in the key

615

crtverify = ctypes.c_uint()

616

(gnutls.library.functions

617

.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))

414

crtverify = ctypes.c_uint();

415

gnutls.library.functions.gnutls_openpgp_crt_verify_self\

416

(crt, ctypes.c_uint(0), ctypes.byref(crtverify))

618

417

if crtverify.value != 0:

619

418

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

620

419

raise gnutls.errors.CertificateSecurityError("Verify failed")

621

420

# New buffer for the fingerprint

622

buf = ctypes.create_string_buffer(20)

623

buf_len = ctypes.c_size_t()

421

buffer = ctypes.create_string_buffer(20)

422

buffer_length = ctypes.c_size_t()

624

423

# Get the fingerprint from the certificate into the buffer

625

(gnutls.library.functions

626

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

627

ctypes.byref(buf_len)))

424

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

425

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

628

426

# Deinit the certificate

629

427

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

630

428

# Convert the buffer to a Python bytestring

631

fpr = ctypes.string_at(buf, buf_len.value)

429

fpr = ctypes.string_at(buffer, buffer_length.value)

632

430

# Convert the bytestring to hexadecimal notation

633

431

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

634

432

return hex_fpr

635

433

636

434

637

class TCP_handler(SocketServer.BaseRequestHandler, object):

435

class tcp_handler(SocketServer.BaseRequestHandler, object):

638

436

"""A TCP request handler class.

639

437

Instantiated by IPv6_TCPServer for each request to handle it.

640

438

Note: This will run in its own forked process."""

641

439

642

440

def handle(self):

643

441

logger.info(u"TCP connection from: %s",

644

unicode(self.client_address))

645

session = (gnutls.connection

646

.ClientSession(self.request,

647

gnutls.connection

648

.X509Credentials()))

442

unicode(self.client_address))

443

session = gnutls.connection.ClientSession\

444

(self.request, gnutls.connection.X509Credentials())

649

445

650

446

line = self.request.makefile().readline()

651

447

logger.debug(u"Protocol version: %r", line)

664

460

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

665

461

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

666

462

# "+DHE-DSS"))

667

# Use a fallback default, since this MUST be set.

668

priority = self.server.settings.get("priority", "NORMAL")

669

(gnutls.library.functions

670

.gnutls_priority_set_direct(session._c_object,

671

priority, None))

463

priority = "NORMAL" # Fallback default, since this

464

# MUST be set.

465

if self.server.settings["priority"]:

466

priority = self.server.settings["priority"]

467

gnutls.library.functions.gnutls_priority_set_direct\

468

(session._c_object, priority, None);

672

469

673

470

try:

674

471

session.handshake()

684

481

session.bye()

685

482

return

686

483

logger.debug(u"Fingerprint: %s", fpr)

484

client = None

687

485

for c in self.server.clients:

688

486

if c.fingerprint == fpr:

689

487

client = c

690

488

break

691

else:

489

if not client:

692

490

logger.warning(u"Client not found for fingerprint: %s",

693

491

fpr)

694

492

session.bye()

701

499

vars(client))

702

500

session.bye()

703

501

return

704

## This won't work here, since we're in a fork.

705

# client.bump_timeout()

706

502

sent_size = 0

707

503

while sent_size < len(client.secret):

708

504

sent = session.send(client.secret[sent_size:])

713

509

session.bye()

714

510

715

511

716

class IPv6_TCPServer(SocketServer.ForkingMixIn,

717

SocketServer.TCPServer, object):

512

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

718

513

"""IPv6 TCP server. Accepts 'None' as address and/or port.

719

514

Attributes:

720

515

settings: Server settings

721

516

clients: Set() of Client objects

722

enabled: Boolean; whether this server is activated yet

723

517

"""

724

518

address_family = socket.AF_INET6

725

519

def __init__(self, *args, **kwargs):

729

523

if "clients" in kwargs:

730

524

self.clients = kwargs["clients"]

731

525

del kwargs["clients"]

732

self.enabled = False

733

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

526

return super(type(self), self).__init__(*args, **kwargs)

734

527

def server_bind(self):

735

528

"""This overrides the normal server_bind() function

736

529

to bind to an interface if one was specified, and also NOT to

765

558

# if_nametoindex

766

559

# (self.settings

767

560

# ["interface"]))

768

return super(IPv6_TCPServer, self).server_bind()

769

def server_activate(self):

770

if self.enabled:

771

return super(IPv6_TCPServer, self).server_activate()

772

def enable(self):

773

self.enabled = True

561

return super(type(self), self).server_bind()

774

562

775

563

776

564

def string_to_delta(interval):

792

580

timevalue = datetime.timedelta(0)

793

581

for s in interval.split():

794

582

try:

795

suffix = unicode(s[-1])

796

value = int(s[:-1])

583

suffix=unicode(s[-1])

584

value=int(s[:-1])

797

585

if suffix == u"d":

798

586

delta = datetime.timedelta(value)

799

587

elif suffix == u"s":

815

603

def server_state_changed(state):

816

604

"""Derived from the Avahi example code"""

817

605

if state == avahi.SERVER_COLLISION:

818

logger.error(u"Zeroconf server name collision")

606

logger.error(u"Server name collision")

819

607

service.remove()

820

608

elif state == avahi.SERVER_RUNNING:

821

609

service.add()

823

611

824

612

def entry_group_state_changed(state, error):

825

613

"""Derived from the Avahi example code"""

826

logger.debug(u"Avahi state change: %i", state)

614

logger.debug(u"state change: %i", state)

827

615

828

616

if state == avahi.ENTRY_GROUP_ESTABLISHED:

829

logger.debug(u"Zeroconf service established.")

617

logger.debug(u"Service established.")

830

618

elif state == avahi.ENTRY_GROUP_COLLISION:

831

logger.warning(u"Zeroconf service name collision.")

619

logger.warning(u"Service name collision.")

832

620

service.rename()

833

621

elif state == avahi.ENTRY_GROUP_FAILURE:

834

logger.critical(u"Avahi: Error in group state changed %s",

622

logger.critical(u"Error in group state changed %s",

835

623

unicode(error))

836

624

raise AvahiGroupError("State changed: %s", str(error))

837

625

839

627

"""Call the C function if_nametoindex(), or equivalent"""

840

628

global if_nametoindex

841

629

try:

842

if_nametoindex = (ctypes.cdll.LoadLibrary

843

(ctypes.util.find_library("c"))

844

.if_nametoindex)

630

if "ctypes.util" not in sys.modules:

631

import ctypes.util

632

if_nametoindex = ctypes.cdll.LoadLibrary\

633

(ctypes.util.find_library("c")).if_nametoindex

845

634

except (OSError, AttributeError):

846

635

if "struct" not in sys.modules:

847

636

import struct

850

639

def if_nametoindex(interface):

851

640

"Get an interface index the hard way, i.e. using fcntl()"

852

641

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

853

with closing(socket.socket()) as s:

854

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

855

struct.pack("16s16x", interface))

642

s = socket.socket()

643

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

644

struct.pack("16s16x", interface))

645

s.close()

856

646

interface_index = struct.unpack("I", ifreq[16:20])[0]

857

647

return interface_index

858

648

return if_nametoindex(interface)

882

672

883

673

884

674

def main():

675

global main_loop_started

676

main_loop_started = False

677

885

678

parser = OptionParser(version = "%%prog %s" % version)

886

679

parser.add_option("-i", "--interface", type="string",

887

680

metavar="IF", help="Bind to interface IF")

902

695

default="/etc/mandos", metavar="DIR",

903

696

help="Directory to search for configuration"

904

697

" files")

905

options = parser.parse_args()[0]

698

(options, args) = parser.parse_args()

906

699

907

700

if options.check:

908

701

import doctest

926

719

# Convert the SafeConfigParser object to a dict

927

720

server_settings = server_config.defaults()

928

721

# Use getboolean on the boolean config option

929

server_settings["debug"] = (server_config.getboolean

930

("DEFAULT", "debug"))

722

server_settings["debug"] = server_config.getboolean\

723

("DEFAULT", "debug")

931

724

del server_config

932

725

933

726

# Override the settings from the config file with command line

947

740

console.setLevel(logging.WARNING)

948

741

949

742

if server_settings["servicename"] != "Mandos":

950

syslogger.setFormatter(logging.Formatter

743

syslogger.setFormatter(logging.Formatter\

951

744

('Mandos (%s): %%(levelname)s:'

952

745

' %%(message)s'

953

746

% server_settings["servicename"]))

962

755

client_config.read(os.path.join(server_settings["configdir"],

963

756

"clients.conf"))

964

757

965

clients = Set()

966

tcp_server = IPv6_TCPServer((server_settings["address"],

967

server_settings["port"]),

968

TCP_handler,

969

settings=server_settings,

970

clients=clients)

971

pidfilename = "/var/run/mandos.pid"

972

try:

973

pidfile = open(pidfilename, "w")

974

except IOError, error:

975

logger.error("Could not open file %r", pidfilename)

976

977

try:

978

uid = pwd.getpwnam("_mandos").pw_uid

979

except KeyError:

980

try:

981

uid = pwd.getpwnam("mandos").pw_uid

982

except KeyError:

983

try:

984

uid = pwd.getpwnam("nobody").pw_uid

985

except KeyError:

986

uid = 65534

987

try:

988

gid = pwd.getpwnam("_mandos").pw_gid

989

except KeyError:

990

try:

991

gid = pwd.getpwnam("mandos").pw_gid

992

except KeyError:

993

try:

994

gid = pwd.getpwnam("nogroup").pw_gid

995

except KeyError:

996

gid = 65534

997

try:

998

os.setuid(uid)

999

os.setgid(gid)

1000

except OSError, error:

1001

if error[0] != errno.EPERM:

1002

raise error

1003

1004

758

global service

1005

759

service = AvahiService(name = server_settings["servicename"],

1006

servicetype = "_mandos._tcp", )

760

type = "_mandos._tcp", );

1007

761

if server_settings["interface"]:

1008

service.interface = (if_nametoindex

1009

(server_settings["interface"]))

762

service.interface = if_nametoindex(server_settings["interface"])

1010

763

1011

764

global main_loop

1012

765

global bus

1015

768

DBusGMainLoop(set_as_default=True )

1016

769

main_loop = gobject.MainLoop()

1017

770

bus = dbus.SystemBus()

1018

server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,

1019

avahi.DBUS_PATH_SERVER),

1020

avahi.DBUS_INTERFACE_SERVER)

771

server = dbus.Interface(

772

bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),

773

avahi.DBUS_INTERFACE_SERVER )

1021

774

# End of Avahi example code

1022

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)

775

776

clients = Set()

777

def remove_from_clients(client):

778

clients.remove(client)

779

if not clients:

780

logger.critical(u"No clients left, exiting")

781

sys.exit()

1023

782

1024

783

clients.update(Set(Client(name = section,

784

stop_hook = remove_from_clients,

1025

785

config

1026

786

= dict(client_config.items(section)))

1027

787

for section in client_config.sections()))

1041

801

# Close all input and output, do double fork, etc.

1042

802

daemon()

1043

803

804

pidfilename = "/var/run/mandos/mandos.pid"

805

pid = os.getpid()

1044

806

try:

1045

pid = os.getpid()

807

pidfile = open(pidfilename, "w")

1046

808

pidfile.write(str(pid) + "\n")

1047

809

pidfile.close()

1048

810

del pidfile

1049

except IOError:

1050

logger.error(u"Could not write to file %r with PID %d",

1051

pidfilename, pid)

1052

except NameError:

1053

# "pidfile" was never created

1054

pass

1055

del pidfilename

811

except IOError, err:

812

logger.error(u"Could not write %s file with PID %d",

813

pidfilename, os.getpid())

1056

814

1057

815

def cleanup():

1058

816

"Cleanup function; run on exit"

1065

823

1066

824

while clients:

1067

825

client = clients.pop()

1068

client.disable_hook = None

1069

client.disable()

826

client.stop_hook = None

827

client.stop()

1070

828

1071

829

atexit.register(cleanup)

1072

830

1075

833

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1076

834

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1077

835

1078

class MandosServer(dbus.service.Object):

1079

"""A D-Bus proxy object"""

1080

def __init__(self):

1081

dbus.service.Object.__init__(self, bus,

1082

"/Mandos")

1083

_interface = u"org.mandos_system.Mandos"

1084

1085

@dbus.service.signal(_interface, signature="oa{sv}")

1086

def ClientAdded(self, objpath, properties):

1087

"D-Bus signal"

1088

pass

1089

1090

@dbus.service.signal(_interface, signature="o")

1091

def ClientRemoved(self, objpath):

1092

"D-Bus signal"

1093

pass

1094

1095

@dbus.service.method(_interface, out_signature="ao")

1096

def GetAllClients(self):

1097

return dbus.Array(c.dbus_object_path for c in clients)

1098

1099

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1100

def GetAllClientsWithProperties(self):

1101

return dbus.Dictionary(

1102

((c.dbus_object_path, c.GetAllProperties())

1103

for c in clients),

1104

signature="oa{sv}")

1105

1106

@dbus.service.method(_interface, in_signature="o")

1107

def RemoveClient(self, object_path):

1108

for c in clients:

1109

if c.dbus_object_path == object_path:

1110

c.disable()

1111

clients.remove(c)

1112

return

1113

raise KeyError

1114

1115

del _interface

1116

1117

mandos_server = MandosServer()

1118

1119

836

for client in clients:

1120

# Emit D-Bus signal

1121

mandos_server.ClientAdded(client.dbus_object_path,

1122

client.GetAllProperties())

1123

client.enable()

1124

1125

tcp_server.enable()

1126

tcp_server.server_activate()

1127

837

client.start()

838

839

tcp_server = IPv6_TCPServer((server_settings["address"],

840

server_settings["port"]),

841

tcp_handler,

842

settings=server_settings,

843

clients=clients)

1128

844

# Find out what port we got

1129

845

service.port = tcp_server.socket.getsockname()[1]

1130

846

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

1144

860

1145

861

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

1146

862

lambda *args, **kwargs:

1147

(tcp_server.handle_request

1148

(*args[2:], **kwargs) or True))

863

tcp_server.handle_request\

864

(*args[2:], **kwargs) or True)

1149

865

1150

866

logger.debug(u"Starting main loop")

867

main_loop_started = True

1151

868

main_loop.run()

1152

869

except AvahiError, error:

1153

870

logger.critical(u"AvahiError: %s" + unicode(error))