/mandos/trunk : revision 240

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

16

#

16

17

# This program is free software: you can redistribute it and/or modify

17

18

# it under the terms of the GNU General Public License as published by

24

25

# GNU General Public License for more details.

25

26

#

26

27

# You should have received a copy of the GNU General Public License

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

28

30

#

29

31

# Contact the authors at <mandos@fukt.bsnet.se>.

30

32

#

31

33

32

from __future__ import division

34

from __future__ import division, with_statement, absolute_import

33

35

34

36

import SocketServer

35

37

import socket

36

import select

37

38

from optparse import OptionParser

38

39

import datetime

39

40

import errno

54

55

import stat

55

56

import logging

56

57

import logging.handlers

58

import pwd

59

from contextlib import closing

57

60

58

61

import dbus

62

import dbus.service

59

63

import gobject

60

64

import avahi

61

65

from dbus.mainloop.glib import DBusGMainLoop

62

66

import ctypes

67

import ctypes.util

63

68

64

version = "1.0"

69

version = "1.0.2"

65

70

66

71

logger = logging.Logger('mandos')

67

syslogger = logging.handlers.SysLogHandler\

68

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

69

address = "/dev/log")

70

syslogger.setFormatter(logging.Formatter\

71

('Mandos: %(levelname)s: %(message)s'))

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos: %(levelname)s: %(message)s'))

72

77

logger.addHandler(syslogger)

73

78

74

79

console = logging.StreamHandler()

79

84

class AvahiError(Exception):

80

85

def __init__(self, value):

81

86

self.value = value

87

super(AvahiError, self).__init__()

82

88

def __str__(self):

83

89

return repr(self.value)

84

90

106

112

a sensible number of times

107

113

"""

108

114

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

109

type = None, port = None, TXT = None, domain = "",

110

host = "", max_renames = 32768):

115

servicetype = None, port = None, TXT = None,

116

domain = "", host = "", max_renames = 32768):

111

117

self.interface = interface

112

118

self.name = name

113

self.type = type

119

self.type = servicetype

114

120

self.port = port

115

if TXT is None:

116

self.TXT = []

117

else:

118

self.TXT = TXT

121

self.TXT = TXT if TXT is not None else []

119

122

self.domain = domain

120

123

self.host = host

121

124

self.rename_count = 0

125

self.max_renames = max_renames

122

126

def rename(self):

123

127

"""Derived from the Avahi example code"""

124

128

if self.rename_count >= self.max_renames:

125

logger.critical(u"No suitable service name found after %i"

126

u" retries, exiting.", rename_count)

129

logger.critical(u"No suitable Zeroconf service name found"

130

u" after %i retries, exiting.",

131

self.rename_count)

127

132

raise AvahiServiceError("Too many renames")

128

name = server.GetAlternativeServiceName(name)

129

logger.error(u"Changing name to %r ...", name)

130

syslogger.setFormatter(logging.Formatter\

133

self.name = server.GetAlternativeServiceName(self.name)

134

logger.info(u"Changing Zeroconf service name to %r ...",

135

str(self.name))

136

syslogger.setFormatter(logging.Formatter

131

137

('Mandos (%s): %%(levelname)s:'

132

' %%(message)s' % name))

138

' %%(message)s' % self.name))

133

139

self.remove()

134

140

self.add()

135

141

self.rename_count += 1

141

147

"""Derived from the Avahi example code"""

142

148

global group

143

149

if group is None:

144

group = dbus.Interface\

145

(bus.get_object(avahi.DBUS_NAME,

150

group = dbus.Interface(bus.get_object

151

(avahi.DBUS_NAME,

146

152

server.EntryGroupNew()),

147

avahi.DBUS_INTERFACE_ENTRY_GROUP)

153

avahi.DBUS_INTERFACE_ENTRY_GROUP)

148

154

group.connect_to_signal('StateChanged',

149

155

entry_group_state_changed)

150

logger.debug(u"Adding service '%s' of type '%s' ...",

156

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

151

157

service.name, service.type)

152

158

group.AddService(

153

159

self.interface, # interface

164

170

# End of Avahi example code

165

171

166

172

167

class Client(object):

173

def _datetime_to_dbus(dt, variant_level=0):

174

"""Convert a UTC datetime.datetime() to a D-Bus type."""

175

return dbus.String(dt.isoformat(), variant_level=variant_level)

176

177

178

class Client(dbus.service.Object):

168

179

"""A representation of a client host served by this server.

169

180

Attributes:

170

name: string; from the config file, used in log messages

181

name: string; from the config file, used in log messages

171

182

fingerprint: string (40 or 32 hexadecimal digits); used to

172

183

uniquely identify the client

173

secret: bytestring; sent verbatim (over TLS) to client

174

host: string; available for use by the checker command

175

created: datetime.datetime(); object creation, not client host

176

last_checked_ok: datetime.datetime() or None if not yet checked OK

177

timeout: datetime.timedelta(); How long from last_checked_ok

178

until this client is invalid

179

interval: datetime.timedelta(); How often to start a new checker

180

stop_hook: If set, called by stop() as stop_hook(self)

181

checker: subprocess.Popen(); a running checker process used

182

to see if the client lives.

183

'None' if no process is running.

184

secret: bytestring; sent verbatim (over TLS) to client

185

host: string; available for use by the checker command

186

created: datetime.datetime(); (UTC) object creation

187

last_enabled: datetime.datetime(); (UTC)

188

enabled: bool()

189

last_checked_ok: datetime.datetime(); (UTC) or None

190

timeout: datetime.timedelta(); How long from last_checked_ok

191

until this client is invalid

192

interval: datetime.timedelta(); How often to start a new checker

193

disable_hook: If set, called by disable() as disable_hook(self)

194

checker: subprocess.Popen(); a running checker process used

195

to see if the client lives.

196

'None' if no process is running.

184

197

checker_initiator_tag: a gobject event source tag, or None

185

stop_initiator_tag: - '' -

198

disable_initiator_tag: - '' -

186

199

checker_callback_tag: - '' -

187

200

checker_command: string; External command which is run to check if

188

201

client lives. %() expansions are done at

189

202

runtime with vars(self) as dict, so that for

190

203

instance %(name)s can be used in the command.

204

dbus_object_path: dbus.ObjectPath

191

205

Private attibutes:

192

206

_timeout: Real variable for 'timeout'

193

207

_interval: Real variable for 'interval'

195

209

_interval_milliseconds: - '' -

196

210

"""

197

211

def _set_timeout(self, timeout):

198

"Setter function for 'timeout' attribute"

212

"Setter function for the 'timeout' attribute"

199

213

self._timeout = timeout

200

214

self._timeout_milliseconds = ((self.timeout.days

201

215

* 24 * 60 * 60 * 1000)

202

216

+ (self.timeout.seconds * 1000)

203

217

+ (self.timeout.microseconds

204

218

// 1000))

205

timeout = property(lambda self: self._timeout,

206

_set_timeout)

219

# Emit D-Bus signal

220

self.PropertyChanged(dbus.String(u"timeout"),

221

(dbus.UInt64(self._timeout_milliseconds,

222

variant_level=1)))

223

timeout = property(lambda self: self._timeout, _set_timeout)

207

224

del _set_timeout

225

208

226

def _set_interval(self, interval):

209

"Setter function for 'interval' attribute"

227

"Setter function for the 'interval' attribute"

210

228

self._interval = interval

211

229

self._interval_milliseconds = ((self.interval.days

212

230

* 24 * 60 * 60 * 1000)

214

232

* 1000)

215

233

+ (self.interval.microseconds

216

234

// 1000))

217

interval = property(lambda self: self._interval,

218

_set_interval)

235

# Emit D-Bus signal

236

self.PropertyChanged(dbus.String(u"interval"),

237

(dbus.UInt64(self._interval_milliseconds,

238

variant_level=1)))

239

interval = property(lambda self: self._interval, _set_interval)

219

240

del _set_interval

220

def __init__(self, name = None, stop_hook=None, config={}):

241

242

def __init__(self, name = None, disable_hook=None, config=None):

221

243

"""Note: the 'checker' key in 'config' sets the

222

244

'checker_command' attribute and *not* the 'checker'

223

245

attribute."""

246

self.dbus_object_path = (dbus.ObjectPath

247

("/Mandos/clients/"

248

+ name.replace(".", "_")))

249

dbus.service.Object.__init__(self, bus,

250

self.dbus_object_path)

251

if config is None:

252

config = {}

224

253

self.name = name

225

254

logger.debug(u"Creating client %r", self.name)

226

255

# Uppercase and remove spaces from fingerprint for later

227

256

# comparison purposes with return value from the fingerprint()

228

257

# function

229

self.fingerprint = config["fingerprint"].upper()\

230

.replace(u" ", u"")

258

self.fingerprint = (config["fingerprint"].upper()

259

.replace(u" ", u""))

231

260

logger.debug(u" Fingerprint: %s", self.fingerprint)

232

261

if "secret" in config:

233

262

self.secret = config["secret"].decode(u"base64")

234

263

elif "secfile" in config:

235

sf = open(config["secfile"])

236

self.secret = sf.read()

237

sf.close()

264

with closing(open(os.path.expanduser

265

(os.path.expandvars

266

(config["secfile"])))) as secfile:

267

self.secret = secfile.read()

238

268

else:

239

269

raise TypeError(u"No secret or secfile for client %s"

240

270

% self.name)

241

271

self.host = config.get("host", "")

242

self.created = datetime.datetime.now()

272

self.created = datetime.datetime.utcnow()

273

self.enabled = False

274

self.last_enabled = None

243

275

self.last_checked_ok = None

244

276

self.timeout = string_to_delta(config["timeout"])

245

277

self.interval = string_to_delta(config["interval"])

246

self.stop_hook = stop_hook

278

self.disable_hook = disable_hook

247

279

self.checker = None

248

280

self.checker_initiator_tag = None

249

self.stop_initiator_tag = None

281

self.disable_initiator_tag = None

250

282

self.checker_callback_tag = None

251

self.check_command = config["checker"]

252

def start(self):

283

self.checker_command = config["checker"]

284

285

def enable(self):

253

286

"""Start this client's checker and timeout hooks"""

287

self.last_enabled = datetime.datetime.utcnow()

254

288

# Schedule a new checker to be started an 'interval' from now,

255

289

# and every interval from then on.

256

self.checker_initiator_tag = gobject.timeout_add\

257

(self._interval_milliseconds,

258

self.start_checker)

290

self.checker_initiator_tag = (gobject.timeout_add

291

(self._interval_milliseconds,

292

self.start_checker))

259

293

# Also start a new checker *right now*.

260

294

self.start_checker()

261

# Schedule a stop() when 'timeout' has passed

262

self.stop_initiator_tag = gobject.timeout_add\

263

(self._timeout_milliseconds,

264

self.stop)

265

def stop(self):

266

"""Stop this client.

267

The possibility that a client might be restarted is left open,

268

but not currently used."""

269

# If this client doesn't have a secret, it is already stopped.

270

if hasattr(self, "secret") and self.secret:

271

logger.info(u"Stopping client %s", self.name)

272

self.secret = None

273

else:

295

# Schedule a disable() when 'timeout' has passed

296

self.disable_initiator_tag = (gobject.timeout_add

297

(self._timeout_milliseconds,

298

self.disable))

299

self.enabled = True

300

# Emit D-Bus signal

301

self.PropertyChanged(dbus.String(u"enabled"),

302

dbus.Boolean(True, variant_level=1))

303

self.PropertyChanged(dbus.String(u"last_enabled"),

304

(_datetime_to_dbus(self.last_enabled,

305

variant_level=1)))

306

307

def disable(self):

308

"""Disable this client."""

309

if not getattr(self, "enabled", False):

274

310

return False

275

if getattr(self, "stop_initiator_tag", False):

276

gobject.source_remove(self.stop_initiator_tag)

277

self.stop_initiator_tag = None

311

logger.info(u"Disabling client %s", self.name)

312

if getattr(self, "disable_initiator_tag", False):

313

gobject.source_remove(self.disable_initiator_tag)

314

self.disable_initiator_tag = None

278

315

if getattr(self, "checker_initiator_tag", False):

279

316

gobject.source_remove(self.checker_initiator_tag)

280

317

self.checker_initiator_tag = None

281

318

self.stop_checker()

282

if self.stop_hook:

283

self.stop_hook(self)

319

if self.disable_hook:

320

self.disable_hook(self)

321

self.enabled = False

322

# Emit D-Bus signal

323

self.PropertyChanged(dbus.String(u"enabled"),

324

dbus.Boolean(False, variant_level=1))

284

325

# Do not run this again if called by a gobject.timeout_add

285

326

return False

327

286

328

def __del__(self):

287

self.stop_hook = None

288

self.stop()

289

def checker_callback(self, pid, condition):

329

self.disable_hook = None

330

self.disable()

331

332

def checker_callback(self, pid, condition, command):

290

333

"""The checker has completed, so take appropriate actions."""

291

now = datetime.datetime.now()

292

334

self.checker_callback_tag = None

293

335

self.checker = None

294

if os.WIFEXITED(condition) \

295

and (os.WEXITSTATUS(condition) == 0):

336

# Emit D-Bus signal

337

self.PropertyChanged(dbus.String(u"checker_running"),

338

dbus.Boolean(False, variant_level=1))

339

if (os.WIFEXITED(condition)

340

and (os.WEXITSTATUS(condition) == 0)):

296

341

logger.info(u"Checker for %(name)s succeeded",

297

342

vars(self))

298

self.last_checked_ok = now

299

gobject.source_remove(self.stop_initiator_tag)

300

self.stop_initiator_tag = gobject.timeout_add\

301

(self._timeout_milliseconds,

302

self.stop)

343

# Emit D-Bus signal

344

self.CheckerCompleted(dbus.Boolean(True),

345

dbus.UInt16(condition),

346

dbus.String(command))

347

self.bump_timeout()

303

348

elif not os.WIFEXITED(condition):

304

349

logger.warning(u"Checker for %(name)s crashed?",

305

350

vars(self))

351

# Emit D-Bus signal

352

self.CheckerCompleted(dbus.Boolean(False),

353

dbus.UInt16(condition),

354

dbus.String(command))

306

355

else:

307

356

logger.info(u"Checker for %(name)s failed",

308

357

vars(self))

358

# Emit D-Bus signal

359

self.CheckerCompleted(dbus.Boolean(False),

360

dbus.UInt16(condition),

361

dbus.String(command))

362

363

def bump_timeout(self):

364

"""Bump up the timeout for this client.

365

This should only be called when the client has been seen,

366

alive and well.

367

"""

368

self.last_checked_ok = datetime.datetime.utcnow()

369

gobject.source_remove(self.disable_initiator_tag)

370

self.disable_initiator_tag = (gobject.timeout_add

371

(self._timeout_milliseconds,

372

self.disable))

373

self.PropertyChanged(dbus.String(u"last_checked_ok"),

374

(_datetime_to_dbus(self.last_checked_ok,

375

variant_level=1)))

376

309

377

def start_checker(self):

310

378

"""Start a new checker subprocess if one is not running.

311

379

If a checker already exists, leave it running and do

320

388

# is as it should be.

321

389

if self.checker is None:

322

390

try:

323

# In case check_command has exactly one % operator

324

command = self.check_command % self.host

391

# In case checker_command has exactly one % operator

392

command = self.checker_command % self.host

325

393

except TypeError:

326

394

# Escape attributes for the shell

327

395

escaped_attrs = dict((key, re.escape(str(val)))

328

396

for key, val in

329

397

vars(self).iteritems())

330

398

try:

331

command = self.check_command % escaped_attrs

399

command = self.checker_command % escaped_attrs

332

400

except TypeError, error:

333

401

logger.error(u'Could not format string "%s":'

334

u' %s', self.check_command, error)

402

u' %s', self.checker_command, error)

335

403

return True # Try again later

336

404

try:

337

405

logger.info(u"Starting checker %r for %s",

338

406

command, self.name)

407

# We don't need to redirect stdout and stderr, since

408

# in normal mode, that is already done by daemon(),

409

# and in debug mode we don't want to. (Stdin is

410

# always replaced by /dev/null.)

339

411

self.checker = subprocess.Popen(command,

340

412

close_fds=True,

341

413

shell=True, cwd="/")

342

self.checker_callback_tag = gobject.child_watch_add\

343

(self.checker.pid,

344

self.checker_callback)

345

except subprocess.OSError, error:

414

# Emit D-Bus signal

415

self.CheckerStarted(command)

416

self.PropertyChanged(dbus.String("checker_running"),

417

dbus.Boolean(True, variant_level=1))

418

self.checker_callback_tag = (gobject.child_watch_add

419

(self.checker.pid,

420

self.checker_callback,

421

data=command))

422

except OSError, error:

346

423

logger.error(u"Failed to start subprocess: %s",

347

424

error)

348

425

# Re-run this periodically if run by gobject.timeout_add

349

426

return True

427

350

428

def stop_checker(self):

351

429

"""Force the checker process, if any, to stop."""

352

430

if self.checker_callback_tag:

364

442

if error.errno != errno.ESRCH: # No such process

365

443

raise

366

444

self.checker = None

445

self.PropertyChanged(dbus.String(u"checker_running"),

446

dbus.Boolean(False, variant_level=1))

447

367

448

def still_valid(self):

368

449

"""Has the timeout not yet passed for this client?"""

369

now = datetime.datetime.now()

450

if not getattr(self, "enabled", False):

451

return False

452

now = datetime.datetime.utcnow()

370

453

if self.last_checked_ok is None:

371

454

return now < (self.created + self.timeout)

372

455

else:

373

456

return now < (self.last_checked_ok + self.timeout)

457

458

## D-Bus methods & signals

459

_interface = u"org.mandos_system.Mandos.Client"

460

461

# BumpTimeout - method

462

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

463

BumpTimeout.__name__ = "BumpTimeout"

464

465

# CheckerCompleted - signal

466

@dbus.service.signal(_interface, signature="bqs")

467

def CheckerCompleted(self, success, condition, command):

468

"D-Bus signal"

469

pass

470

471

# CheckerStarted - signal

472

@dbus.service.signal(_interface, signature="s")

473

def CheckerStarted(self, command):

474

"D-Bus signal"

475

pass

476

477

# GetAllProperties - method

478

@dbus.service.method(_interface, out_signature="a{sv}")

479

def GetAllProperties(self):

480

"D-Bus method"

481

return dbus.Dictionary({

482

dbus.String("name"):

483

dbus.String(self.name, variant_level=1),

484

dbus.String("fingerprint"):

485

dbus.String(self.fingerprint, variant_level=1),

486

dbus.String("host"):

487

dbus.String(self.host, variant_level=1),

488

dbus.String("created"):

489

_datetime_to_dbus(self.created, variant_level=1),

490

dbus.String("last_enabled"):

491

(_datetime_to_dbus(self.last_enabled,

492

variant_level=1)

493

if self.last_enabled is not None

494

else dbus.Boolean(False, variant_level=1)),

495

dbus.String("enabled"):

496

dbus.Boolean(self.enabled, variant_level=1),

497

dbus.String("last_checked_ok"):

498

(_datetime_to_dbus(self.last_checked_ok,

499

variant_level=1)

500

if self.last_checked_ok is not None

501

else dbus.Boolean (False, variant_level=1)),

502

dbus.String("timeout"):

503

dbus.UInt64(self._timeout_milliseconds,

504

variant_level=1),

505

dbus.String("interval"):

506

dbus.UInt64(self._interval_milliseconds,

507

variant_level=1),

508

dbus.String("checker"):

509

dbus.String(self.checker_command,

510

variant_level=1),

511

dbus.String("checker_running"):

512

dbus.Boolean(self.checker is not None,

513

variant_level=1),

514

}, signature="sv")

515

516

# IsStillValid - method

517

IsStillValid = (dbus.service.method(_interface, out_signature="b")

518

(still_valid))

519

IsStillValid.__name__ = "IsStillValid"

520

521

# PropertyChanged - signal

522

@dbus.service.signal(_interface, signature="sv")

523

def PropertyChanged(self, property, value):

524

"D-Bus signal"

525

pass

526

527

# SetChecker - method

528

@dbus.service.method(_interface, in_signature="s")

529

def SetChecker(self, checker):

530

"D-Bus setter method"

531

self.checker_command = checker

532

533

# SetHost - method

534

@dbus.service.method(_interface, in_signature="s")

535

def SetHost(self, host):

536

"D-Bus setter method"

537

self.host = host

538

539

# SetInterval - method

540

@dbus.service.method(_interface, in_signature="t")

541

def SetInterval(self, milliseconds):

542

self.interval = datetime.timdeelta(0, 0, 0, milliseconds)

543

544

# SetSecret - method

545

@dbus.service.method(_interface, in_signature="ay",

546

byte_arrays=True)

547

def SetSecret(self, secret):

548

"D-Bus setter method"

549

self.secret = str(secret)

550

551

# SetTimeout - method

552

@dbus.service.method(_interface, in_signature="t")

553

def SetTimeout(self, milliseconds):

554

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

555

556

# Enable - method

557

Enable = dbus.service.method(_interface)(enable)

558

Enable.__name__ = "Enable"

559

560

# StartChecker - method

561

@dbus.service.method(_interface)

562

def StartChecker(self):

563

"D-Bus method"

564

self.start_checker()

565

566

# Disable - method

567

@dbus.service.method(_interface)

568

def Disable(self):

569

"D-Bus method"

570

self.disable()

571

572

# StopChecker - method

573

StopChecker = dbus.service.method(_interface)(stop_checker)

574

StopChecker.__name__ = "StopChecker"

575

576

del _interface

374

577

375

578

376

579

def peer_certificate(session):

377

580

"Return the peer's OpenPGP certificate as a bytestring"

378

581

# If not an OpenPGP certificate...

379

if gnutls.library.functions.gnutls_certificate_type_get\

380

(session._c_object) \

381

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

582

if (gnutls.library.functions

583

.gnutls_certificate_type_get(session._c_object)

584

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

382

585

# ...do the normal thing

383

586

return session.peer_certificate

384

587

list_size = ctypes.c_uint()

385

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

386

(session._c_object, ctypes.byref(list_size))

588

cert_list = (gnutls.library.functions

589

.gnutls_certificate_get_peers

590

(session._c_object, ctypes.byref(list_size)))

387

591

if list_size.value == 0:

388

592

return None

389

593

cert = cert_list[0]

393

597

def fingerprint(openpgp):

394

598

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

395

599

# New GnuTLS "datum" with the OpenPGP public key

396

datum = gnutls.library.types.gnutls_datum_t\

397

(ctypes.cast(ctypes.c_char_p(openpgp),

398

ctypes.POINTER(ctypes.c_ubyte)),

399

ctypes.c_uint(len(openpgp)))

600

datum = (gnutls.library.types

601

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

602

ctypes.POINTER

603

(ctypes.c_ubyte)),

604

ctypes.c_uint(len(openpgp))))

400

605

# New empty GnuTLS certificate

401

606

crt = gnutls.library.types.gnutls_openpgp_crt_t()

402

gnutls.library.functions.gnutls_openpgp_crt_init\

403

(ctypes.byref(crt))

607

(gnutls.library.functions

608

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

404

609

# Import the OpenPGP public key into the certificate

405

gnutls.library.functions.gnutls_openpgp_crt_import\

406

(crt, ctypes.byref(datum),

407

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

610

(gnutls.library.functions

611

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

612

gnutls.library.constants

613

.GNUTLS_OPENPGP_FMT_RAW))

614

# Verify the self signature in the key

615

crtverify = ctypes.c_uint()

616

(gnutls.library.functions

617

.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))

618

if crtverify.value != 0:

619

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

620

raise gnutls.errors.CertificateSecurityError("Verify failed")

408

621

# New buffer for the fingerprint

409

buffer = ctypes.create_string_buffer(20)

410

buffer_length = ctypes.c_size_t()

622

buf = ctypes.create_string_buffer(20)

623

buf_len = ctypes.c_size_t()

411

624

# Get the fingerprint from the certificate into the buffer

412

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

413

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

625

(gnutls.library.functions

626

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

627

ctypes.byref(buf_len)))

414

628

# Deinit the certificate

415

629

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

416

630

# Convert the buffer to a Python bytestring

417

fpr = ctypes.string_at(buffer, buffer_length.value)

631

fpr = ctypes.string_at(buf, buf_len.value)

418

632

# Convert the bytestring to hexadecimal notation

419

633

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

420

634

return hex_fpr

421

635

422

636

423

class tcp_handler(SocketServer.BaseRequestHandler, object):

637

class TCP_handler(SocketServer.BaseRequestHandler, object):

424

638

"""A TCP request handler class.

425

639

Instantiated by IPv6_TCPServer for each request to handle it.

426

640

Note: This will run in its own forked process."""

427

641

428

642

def handle(self):

429

643

logger.info(u"TCP connection from: %s",

430

unicode(self.client_address))

431

session = gnutls.connection.ClientSession\

432

(self.request, gnutls.connection.X509Credentials())

644

unicode(self.client_address))

645

session = (gnutls.connection

646

.ClientSession(self.request,

647

gnutls.connection

648

.X509Credentials()))

433

649

434

650

line = self.request.makefile().readline()

435

651

logger.debug(u"Protocol version: %r", line)

448

664

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

449

665

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

450

666

# "+DHE-DSS"))

451

priority = "NORMAL" # Fallback default, since this

452

# MUST be set.

453

if self.server.settings["priority"]:

454

priority = self.server.settings["priority"]

455

gnutls.library.functions.gnutls_priority_set_direct\

456

(session._c_object, priority, None);

667

# Use a fallback default, since this MUST be set.

668

priority = self.server.settings.get("priority", "NORMAL")

669

(gnutls.library.functions

670

.gnutls_priority_set_direct(session._c_object,

671

priority, None))

457

672

458

673

try:

459

674

session.handshake()

469

684

session.bye()

470

685

return

471

686

logger.debug(u"Fingerprint: %s", fpr)

472

client = None

473

687

for c in self.server.clients:

474

688

if c.fingerprint == fpr:

475

689

client = c

476

690

break

477

if not client:

691

else:

478

692

logger.warning(u"Client not found for fingerprint: %s",

479

693

fpr)

480

694

session.bye()

487

701

vars(client))

488

702

session.bye()

489

703

return

704

## This won't work here, since we're in a fork.

705

# client.bump_timeout()

490

706

sent_size = 0

491

707

while sent_size < len(client.secret):

492

708

sent = session.send(client.secret[sent_size:])

497

713

session.bye()

498

714

499

715

500

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

716

class IPv6_TCPServer(SocketServer.ForkingMixIn,

717

SocketServer.TCPServer, object):

501

718

"""IPv6 TCP server. Accepts 'None' as address and/or port.

502

719

Attributes:

503

720

settings: Server settings

504

721

clients: Set() of Client objects

722

enabled: Boolean; whether this server is activated yet

505

723

"""

506

724

address_family = socket.AF_INET6

507

725

def __init__(self, *args, **kwargs):

511

729

if "clients" in kwargs:

512

730

self.clients = kwargs["clients"]

513

731

del kwargs["clients"]

514

return super(type(self), self).__init__(*args, **kwargs)

732

self.enabled = False

733

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

515

734

def server_bind(self):

516

735

"""This overrides the normal server_bind() function

517

736

to bind to an interface if one was specified, and also NOT to

546

765

# if_nametoindex

547

766

# (self.settings

548

767

# ["interface"]))

549

return super(type(self), self).server_bind()

768

return super(IPv6_TCPServer, self).server_bind()

769

def server_activate(self):

770

if self.enabled:

771

return super(IPv6_TCPServer, self).server_activate()

772

def enable(self):

773

self.enabled = True

550

774

551

775

552

776

def string_to_delta(interval):

562

786

datetime.timedelta(1)

563

787

>>> string_to_delta(u'1w')

564

788

datetime.timedelta(7)

789

>>> string_to_delta('5m 30s')

790

datetime.timedelta(0, 330)

565

791

"""

566

try:

567

suffix=unicode(interval[-1])

568

value=int(interval[:-1])

569

if suffix == u"d":

570

delta = datetime.timedelta(value)

571

elif suffix == u"s":

572

delta = datetime.timedelta(0, value)

573

elif suffix == u"m":

574

delta = datetime.timedelta(0, 0, 0, 0, value)

575

elif suffix == u"h":

576

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

577

elif suffix == u"w":

578

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

579

else:

792

timevalue = datetime.timedelta(0)

793

for s in interval.split():

794

try:

795

suffix = unicode(s[-1])

796

value = int(s[:-1])

797

if suffix == u"d":

798

delta = datetime.timedelta(value)

799

elif suffix == u"s":

800

delta = datetime.timedelta(0, value)

801

elif suffix == u"m":

802

delta = datetime.timedelta(0, 0, 0, 0, value)

803

elif suffix == u"h":

804

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

805

elif suffix == u"w":

806

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

807

else:

808

raise ValueError

809

except (ValueError, IndexError):

580

810

raise ValueError

581

except (ValueError, IndexError):

582

raise ValueError

583

return delta

811

timevalue += delta

812

return timevalue

584

813

585

814

586

815

def server_state_changed(state):

587

816

"""Derived from the Avahi example code"""

588

817

if state == avahi.SERVER_COLLISION:

589

logger.error(u"Server name collision")

818

logger.error(u"Zeroconf server name collision")

590

819

service.remove()

591

820

elif state == avahi.SERVER_RUNNING:

592

821

service.add()

594

823

595

824

def entry_group_state_changed(state, error):

596

825

"""Derived from the Avahi example code"""

597

logger.debug(u"state change: %i", state)

826

logger.debug(u"Avahi state change: %i", state)

598

827

599

828

if state == avahi.ENTRY_GROUP_ESTABLISHED:

600

logger.debug(u"Service established.")

829

logger.debug(u"Zeroconf service established.")

601

830

elif state == avahi.ENTRY_GROUP_COLLISION:

602

logger.warning(u"Service name collision.")

831

logger.warning(u"Zeroconf service name collision.")

603

832

service.rename()

604

833

elif state == avahi.ENTRY_GROUP_FAILURE:

605

logger.critical(u"Error in group state changed %s",

834

logger.critical(u"Avahi: Error in group state changed %s",

606

835

unicode(error))

607

836

raise AvahiGroupError("State changed: %s", str(error))

608

837

610

839

"""Call the C function if_nametoindex(), or equivalent"""

611

840

global if_nametoindex

612

841

try:

613

if "ctypes.util" not in sys.modules:

614

import ctypes.util

615

if_nametoindex = ctypes.cdll.LoadLibrary\

616

(ctypes.util.find_library("c")).if_nametoindex

842

if_nametoindex = (ctypes.cdll.LoadLibrary

843

(ctypes.util.find_library("c"))

844

.if_nametoindex)

617

845

except (OSError, AttributeError):

618

846

if "struct" not in sys.modules:

619

847

import struct

622

850

def if_nametoindex(interface):

623

851

"Get an interface index the hard way, i.e. using fcntl()"

624

852

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

625

s = socket.socket()

626

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

627

struct.pack("16s16x", interface))

628

s.close()

853

with closing(socket.socket()) as s:

854

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

855

struct.pack("16s16x", interface))

629

856

interface_index = struct.unpack("I", ifreq[16:20])[0]

630

857

return interface_index

631

858

return if_nametoindex(interface)

655

882

656

883

657

884

def main():

658

global main_loop_started

659

main_loop_started = False

660

661

885

parser = OptionParser(version = "%%prog %s" % version)

662

886

parser.add_option("-i", "--interface", type="string",

663

887

metavar="IF", help="Bind to interface IF")

678

902

default="/etc/mandos", metavar="DIR",

679

903

help="Directory to search for configuration"

680

904

" files")

681

(options, args) = parser.parse_args()

905

options = parser.parse_args()[0]

682

906

683

907

if options.check:

684

908

import doctest

699

923

server_config = ConfigParser.SafeConfigParser(server_defaults)

700

924

del server_defaults

701

925

server_config.read(os.path.join(options.configdir, "mandos.conf"))

702

server_section = "server"

703

926

# Convert the SafeConfigParser object to a dict

704

server_settings = dict(server_config.items(server_section))

927

server_settings = server_config.defaults()

705

928

# Use getboolean on the boolean config option

706

server_settings["debug"] = server_config.getboolean\

707

(server_section, "debug")

929

server_settings["debug"] = (server_config.getboolean

930

("DEFAULT", "debug"))

708

931

del server_config

709

932

710

933

# Override the settings from the config file with command line

724

947

console.setLevel(logging.WARNING)

725

948

726

949

if server_settings["servicename"] != "Mandos":

727

syslogger.setFormatter(logging.Formatter\

950

syslogger.setFormatter(logging.Formatter

728

951

('Mandos (%s): %%(levelname)s:'

729

952

' %%(message)s'

730

953

% server_settings["servicename"]))

732

955

# Parse config file with clients

733

956

client_defaults = { "timeout": "1h",

734

957

"interval": "5m",

735

"checker": "fping -q -- %%(host)s",

958

"checker": "fping -q -- %(host)s",

959

"host": "",

736

960

}

737

961

client_config = ConfigParser.SafeConfigParser(client_defaults)

738

962

client_config.read(os.path.join(server_settings["configdir"],

739

963

"clients.conf"))

740

964

965

clients = Set()

966

tcp_server = IPv6_TCPServer((server_settings["address"],

967

server_settings["port"]),

968

TCP_handler,

969

settings=server_settings,

970

clients=clients)

971

pidfilename = "/var/run/mandos.pid"

972

try:

973

pidfile = open(pidfilename, "w")

974

except IOError, error:

975

logger.error("Could not open file %r", pidfilename)

976

977

try:

978

uid = pwd.getpwnam("_mandos").pw_uid

979

except KeyError:

980

try:

981

uid = pwd.getpwnam("mandos").pw_uid

982

except KeyError:

983

try:

984

uid = pwd.getpwnam("nobody").pw_uid

985

except KeyError:

986

uid = 65534

987

try:

988

gid = pwd.getpwnam("_mandos").pw_gid

989

except KeyError:

990

try:

991

gid = pwd.getpwnam("mandos").pw_gid

992

except KeyError:

993

try:

994

gid = pwd.getpwnam("nogroup").pw_gid

995

except KeyError:

996

gid = 65534

997

try:

998

os.setuid(uid)

999

os.setgid(gid)

1000

except OSError, error:

1001

if error[0] != errno.EPERM:

1002

raise error

1003

741

1004

global service

742

1005

service = AvahiService(name = server_settings["servicename"],

743

type = "_mandos._tcp", );

1006

servicetype = "_mandos._tcp", )

744

1007

if server_settings["interface"]:

745

service.interface = if_nametoindex(server_settings["interface"])

1008

service.interface = (if_nametoindex

1009

(server_settings["interface"]))

746

1010

747

1011

global main_loop

748

1012

global bus

751

1015

DBusGMainLoop(set_as_default=True )

752

1016

main_loop = gobject.MainLoop()

753

1017

bus = dbus.SystemBus()

754

server = dbus.Interface(

755

bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),

756

avahi.DBUS_INTERFACE_SERVER )

1018

server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,

1019

avahi.DBUS_PATH_SERVER),

1020

avahi.DBUS_INTERFACE_SERVER)

757

1021

# End of Avahi example code

758

759

clients = Set()

760

def remove_from_clients(client):

761

clients.remove(client)

762

if not clients:

763

logger.critical(u"No clients left, exiting")

764

sys.exit()

1022

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)

765

1023

766

1024

clients.update(Set(Client(name = section,

767

stop_hook = remove_from_clients,

768

1025

config

769

1026

= dict(client_config.items(section)))

770

1027

for section in client_config.sections()))

772

1029

logger.critical(u"No clients defined")

773

1030

sys.exit(1)

774

1031

775

if not debug:

1032

if debug:

1033

# Redirect stdin so all checkers get /dev/null

1034

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1035

os.dup2(null, sys.stdin.fileno())

1036

if null > 2:

1037

os.close(null)

1038

else:

1039

# No console logging

776

1040

logger.removeHandler(console)

1041

# Close all input and output, do double fork, etc.

777

1042

daemon()

778

1043

779

pidfilename = "/var/run/mandos/mandos.pid"

780

pid = os.getpid()

781

1044

try:

782

pidfile = open(pidfilename, "w")

1045

pid = os.getpid()

783

1046

pidfile.write(str(pid) + "\n")

784

1047

pidfile.close()

785

1048

del pidfile

786

except IOError, err:

787

logger.error(u"Could not write %s file with PID %d",

788

pidfilename, os.getpid())

1049

except IOError:

1050

logger.error(u"Could not write to file %r with PID %d",

1051

pidfilename, pid)

1052

except NameError:

1053

# "pidfile" was never created

1054

pass

1055

del pidfilename

789

1056

790

1057

def cleanup():

791

1058

"Cleanup function; run on exit"

798

1065

799

1066

while clients:

800

1067

client = clients.pop()

801

client.stop_hook = None

802

client.stop()

1068

client.disable_hook = None

1069

client.disable()

803

1070

804

1071

atexit.register(cleanup)

805

1072

808

1075

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

809

1076

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

810

1077

1078

class MandosServer(dbus.service.Object):

1079

"""A D-Bus proxy object"""

1080

def __init__(self):

1081

dbus.service.Object.__init__(self, bus,

1082

"/Mandos")

1083

_interface = u"org.mandos_system.Mandos"

1084

1085

@dbus.service.signal(_interface, signature="oa{sv}")

1086

def ClientAdded(self, objpath, properties):

1087

"D-Bus signal"

1088

pass

1089

1090

@dbus.service.signal(_interface, signature="o")

1091

def ClientRemoved(self, objpath):

1092

"D-Bus signal"

1093

pass

1094

1095

@dbus.service.method(_interface, out_signature="ao")

1096

def GetAllClients(self):

1097

return dbus.Array(c.dbus_object_path for c in clients)

1098

1099

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1100

def GetAllClientsWithProperties(self):

1101

return dbus.Dictionary(

1102

((c.dbus_object_path, c.GetAllProperties())

1103

for c in clients),

1104

signature="oa{sv}")

1105

1106

@dbus.service.method(_interface, in_signature="o")

1107

def RemoveClient(self, object_path):

1108

for c in clients:

1109

if c.dbus_object_path == object_path:

1110

c.disable()

1111

clients.remove(c)

1112

return

1113

raise KeyError

1114

1115

del _interface

1116

1117

mandos_server = MandosServer()

1118

811

1119

for client in clients:

812

client.start()

813

814

tcp_server = IPv6_TCPServer((server_settings["address"],

815

server_settings["port"]),

816

tcp_handler,

817

settings=server_settings,

818

clients=clients)

1120

# Emit D-Bus signal

1121

mandos_server.ClientAdded(client.dbus_object_path,

1122

client.GetAllProperties())

1123

client.enable()

1124

1125

tcp_server.enable()

1126

tcp_server.server_activate()

1127

819

1128

# Find out what port we got

820

1129

service.port = tcp_server.socket.getsockname()[1]

821

1130

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

835

1144

836

1145

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

837

1146

lambda *args, **kwargs:

838

tcp_server.handle_request\

839

(*args[2:], **kwargs) or True)

1147

(tcp_server.handle_request

1148

(*args[2:], **kwargs) or True))

840

1149

841

1150

logger.debug(u"Starting main loop")

842

main_loop_started = True

843

1151

main_loop.run()

844

1152

except AvahiError, error:

845

1153

logger.critical(u"AvahiError: %s" + unicode(error))