2
# -*- mode: python; coding: utf-8 -*-
4
# Mandos server - give out binary blobs to connecting clients.
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# following functions: "add_service", "remove_service",
10
# "server_state_changed", "entry_group_state_changed", and some lines
13
# Everything else is Copyright © 2007-2008 Teddy Hogeborn and Björn
16
# This program is free software: you can redistribute it and/or modify
17
# it under the terms of the GNU General Public License as published by
18
# the Free Software Foundation, either version 3 of the License, or
19
# (at your option) any later version.
21
# This program is distributed in the hope that it will be useful,
22
# but WITHOUT ANY WARRANTY; without even the implied warranty of
23
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24
# GNU General Public License for more details.
26
# You should have received a copy of the GNU General Public License
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
29
# Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
30
# <https://www.fukt.bsnet.se/~teddy/>.
3
33
from __future__ import division
28
62
from dbus.mainloop.glib import DBusGMainLoop
65
# Brief description of the operation of this program:
67
# This server announces itself as a Zeroconf service. Connecting
68
# clients use the TLS protocol, with the unusual quirk that this
69
# server program acts as a TLS "client" while the connecting clients
70
# acts as a TLS "server". The clients (acting as a TLS "server") must
71
# supply an OpenPGP certificate, and the fingerprint of this
72
# certificate is used by this server to look up (in a list read from a
73
# file at start time) which binary blob to give the client. No other
74
# authentication or authorization is done by this server.
77
logger = logging.Logger('mandos')
78
syslogger = logging.handlers.SysLogHandler\
79
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
80
syslogger.setFormatter(logging.Formatter\
81
('%(levelname)s: %(message)s'))
82
logger.addHandler(syslogger)
31
85
# This variable is used to optionally bind to a specified interface.
32
86
# It is a global variable to fit in with the other variables from the
33
# Avahi server example code.
34
88
serviceInterface = avahi.IF_UNSPEC
35
# From the Avahi server example code:
36
serviceName = "Mandos"
89
# From the Avahi example code:
37
91
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
38
92
servicePort = None # Not known at startup
39
93
serviceTXT = [] # TXT record for the service
98
152
interval = property(lambda self: self._interval,
100
154
del _set_interval
101
def __init__(self, name=None, options=None, stop_hook=None,
102
fingerprint=None, secret=None, secfile=None, fqdn=None,
103
timeout=None, interval=-1, checker=None):
155
def __init__(self, name=None, stop_hook=None, fingerprint=None,
156
secret=None, secfile=None, fqdn=None, timeout=None,
157
interval=-1, checker=None):
158
"""Note: the 'checker' argument sets the 'checker_command'
159
attribute and not the 'checker' attribute.."""
161
logger.debug(u"Creating client %r", self.name)
105
162
# Uppercase and remove spaces from fingerprint
106
163
# for later comparison purposes with return value of
107
164
# the fingerprint() function
108
165
self.fingerprint = fingerprint.upper().replace(u" ", u"")
166
logger.debug(u" Fingerprint: %s", self.fingerprint)
110
168
self.secret = secret.decode(u"base64")
149
201
"""Stop this client.
150
202
The possibility that this client might be restarted is left
151
203
open, but not currently used."""
153
sys.stderr.write(u"Stopping client %s\n" % self.name)
155
if self.stop_initiator_tag:
204
# If this client doesn't have a secret, it is already stopped.
206
logger.debug(u"Stopping client %s", self.name)
210
if hasattr(self, "stop_initiator_tag") \
211
and self.stop_initiator_tag:
156
212
gobject.source_remove(self.stop_initiator_tag)
157
213
self.stop_initiator_tag = None
158
if self.checker_initiator_tag:
214
if hasattr(self, "checker_initiator_tag") \
215
and self.checker_initiator_tag:
159
216
gobject.source_remove(self.checker_initiator_tag)
160
217
self.checker_initiator_tag = None
161
218
self.stop_checker()
164
221
# Do not run this again if called by a gobject.timeout_add
166
223
def __del__(self):
167
# Some code duplication here and in stop()
168
if hasattr(self, "stop_initiator_tag") \
169
and self.stop_initiator_tag:
170
gobject.source_remove(self.stop_initiator_tag)
171
self.stop_initiator_tag = None
172
if hasattr(self, "checker_initiator_tag") \
173
and self.checker_initiator_tag:
174
gobject.source_remove(self.checker_initiator_tag)
175
self.checker_initiator_tag = None
224
self.stop_hook = None
177
226
def checker_callback(self, pid, condition):
178
227
"""The checker has completed, so take appropriate actions."""
179
228
now = datetime.datetime.now()
229
self.checker_callback_tag = None
180
231
if os.WIFEXITED(condition) \
181
232
and (os.WEXITSTATUS(condition) == 0):
183
sys.stderr.write(u"Checker for %(name)s succeeded\n"
233
logger.debug(u"Checker for %(name)s succeeded",
185
235
self.last_seen = now
186
236
gobject.source_remove(self.stop_initiator_tag)
187
237
self.stop_initiator_tag = gobject.timeout_add\
188
238
(self._timeout_milliseconds,
191
if not os.WIFEXITED(condition):
192
sys.stderr.write(u"Checker for %(name)s crashed?\n"
195
sys.stderr.write(u"Checker for %(name)s failed\n"
198
self.checker_callback_tag = None
240
elif not os.WIFEXITED(condition):
241
logger.warning(u"Checker for %(name)s crashed?",
244
logger.debug(u"Checker for %(name)s failed",
199
246
def start_checker(self):
200
247
"""Start a new checker subprocess if one is not running.
201
248
If a checker already exists, leave it running and do
250
# The reason for not killing a running checker is that if we
251
# did that, then if a checker (for some reason) started
252
# running slowly and taking more than 'interval' time, the
253
# client would inevitably timeout, since no checker would get
254
# a chance to run to completion. If we instead leave running
255
# checkers alone, the checker would have to take more time
256
# than 'timeout' for the client to be declared invalid, which
257
# is as it should be.
203
258
if self.checker is None:
205
sys.stderr.write(u"Starting checker for %s\n"
208
260
command = self.check_command % self.fqdn
209
261
except TypeError:
210
262
escaped_attrs = dict((key, re.escape(str(val)))
212
264
vars(self).iteritems())
213
command = self.check_command % escaped_attrs
266
command = self.check_command % escaped_attrs
267
except TypeError, error:
268
logger.critical(u'Could not format string "%s":'
269
u' %s', self.check_command, error)
270
return True # Try again later
272
logger.debug(u"Starting checker %r for %s",
215
274
self.checker = subprocess.\
217
stdout=subprocess.PIPE,
218
276
close_fds=True, shell=True,
220
self.checker_callback_tag = gobject.\
221
child_watch_add(self.checker.pid,
278
self.checker_callback_tag = gobject.child_watch_add\
280
self.checker_callback)
224
281
except subprocess.OSError, error:
225
sys.stderr.write(u"Failed to start subprocess: %s\n"
282
logger.error(u"Failed to start subprocess: %s",
227
284
# Re-run this periodically if run by gobject.timeout_add
229
286
def stop_checker(self):
230
287
"""Force the checker process, if any, to stop."""
288
if self.checker_callback_tag:
289
gobject.source_remove(self.checker_callback_tag)
290
self.checker_callback_tag = None
231
291
if not hasattr(self, "checker") or self.checker is None:
233
gobject.source_remove(self.checker_callback_tag)
234
self.checker_callback_tag = None
235
os.kill(self.checker.pid, signal.SIGTERM)
236
if self.checker.poll() is None:
237
os.kill(self.checker.pid, signal.SIGKILL)
293
logger.debug("Stopping checker for %(name)s", vars(self))
295
os.kill(self.checker.pid, signal.SIGTERM)
297
#if self.checker.poll() is None:
298
# os.kill(self.checker.pid, signal.SIGKILL)
299
except OSError, error:
300
if error.errno != errno.ESRCH:
238
302
self.checker = None
239
303
def still_valid(self, now=None):
240
304
"""Has the timeout not yet passed for this client?"""
311
373
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
312
374
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
314
priority = "SECURE256"
377
if self.server.options.priority:
378
priority = self.server.options.priority
316
379
gnutls.library.functions.gnutls_priority_set_direct\
317
380
(session._c_object, priority, None);
320
383
session.handshake()
321
384
except gnutls.errors.GNUTLSError, error:
323
sys.stderr.write(u"Handshake failed: %s\n" % error)
385
logger.debug(u"Handshake failed: %s", error)
324
386
# Do not run session.bye() here: the session is not
325
387
# established. Just abandon the request.
328
390
fpr = fingerprint(peer_certificate(session))
329
391
except (TypeError, gnutls.errors.GNUTLSError), error:
331
sys.stderr.write(u"Bad certificate: %s\n" % error)
392
logger.debug(u"Bad certificate: %s", error)
335
sys.stderr.write(u"Fingerprint: %s\n" % fpr)
395
logger.debug(u"Fingerprint: %s", fpr)
397
for c in self.server.clients:
338
398
if c.fingerprint == fpr:
342
402
# that the client timed out while establishing the GnuTLS
344
404
if (not client) or (not client.still_valid()):
347
sys.stderr.write(u"Client %(name)s is invalid\n"
350
sys.stderr.write(u"Client not found for "
351
u"fingerprint: %s\n" % fpr)
406
logger.debug(u"Client %(name)s is invalid",
409
logger.debug(u"Client not found for fingerprint: %s",
355
414
while sent_size < len(client.secret):
356
415
sent = session.send(client.secret[sent_size:])
358
sys.stderr.write(u"Sent: %d, remaining: %d\n"
359
% (sent, len(client.secret)
360
- (sent_size + sent)))
416
logger.debug(u"Sent: %d, remaining: %d",
417
sent, len(client.secret)
418
- (sent_size + sent))
361
419
sent_size += sent
479
536
def server_state_changed(state):
480
"""From the Avahi server example code"""
537
"""Derived from the Avahi example code"""
481
538
if state == avahi.SERVER_COLLISION:
482
sys.stderr.write(u"WARNING: Server name collision\n")
539
logger.warning(u"Server name collision")
484
541
elif state == avahi.SERVER_RUNNING:
488
545
def entry_group_state_changed(state, error):
489
"""From the Avahi server example code"""
546
"""Derived from the Avahi example code"""
490
547
global serviceName, server, rename_count
493
sys.stderr.write(u"state change: %i\n" % state)
549
logger.debug(u"state change: %i", state)
495
551
if state == avahi.ENTRY_GROUP_ESTABLISHED:
497
sys.stderr.write(u"Service established.\n")
552
logger.debug(u"Service established.")
498
553
elif state == avahi.ENTRY_GROUP_COLLISION:
500
555
rename_count = rename_count - 1
501
556
if rename_count > 0:
502
557
name = server.GetAlternativeServiceName(name)
503
sys.stderr.write(u"WARNING: Service name collision, "
504
u"changing name to '%s' ...\n" % name)
558
logger.warning(u"Service name collision, "
559
u"changing name to '%s' ...", name)
509
sys.stderr.write(u"ERROR: No suitable service name found "
510
u"after %i retries, exiting.\n"
564
logger.error(u"No suitable service name found after %i"
565
u" retries, exiting.", n_rename)
513
567
elif state == avahi.ENTRY_GROUP_FAILURE:
514
sys.stderr.write(u"Error in group state changed %s\n"
568
logger.error(u"Error in group state changed %s",
520
573
def if_nametoindex(interface):
536
589
return interface_index
539
if __name__ == '__main__':
592
def daemon(nochdir, noclose):
593
"""See daemon(3). Standard BSD Unix function.
594
This should really exist as os.daemon, but it doesn't (yet)."""
601
# Close all standard open file descriptors
602
null = os.open("/dev/null", os.O_NOCTTY | os.O_RDWR)
603
if not stat.S_ISCHR(os.fstat(null).st_mode):
604
raise OSError(errno.ENODEV,
605
"/dev/null not a character device")
606
os.dup2(null, sys.stdin.fileno())
607
os.dup2(null, sys.stdout.fileno())
608
os.dup2(null, sys.stderr.fileno())
613
def killme(status = 0):
614
logger.debug("Stopping server with exit status %d", status)
616
if main_loop_started:
625
global main_loop_started
626
main_loop_started = False
540
628
parser = OptionParser()
541
629
parser.add_option("-i", "--interface", type="string",
542
630
default=None, metavar="IF",
543
631
help="Bind to interface IF")
544
parser.add_option("--cert", type="string", default="cert.pem",
546
help="Public key certificate PEM file to use")
547
parser.add_option("--key", type="string", default="key.pem",
549
help="Private key PEM file to use")
550
parser.add_option("--ca", type="string", default="ca.pem",
552
help="Certificate Authority certificate PEM file to use")
553
parser.add_option("--crl", type="string", default="crl.pem",
555
help="Certificate Revokation List PEM file to use")
632
parser.add_option("-a", "--address", type="string", default=None,
633
help="Address to listen for requests on")
556
634
parser.add_option("-p", "--port", type="int", default=None,
557
635
help="Port number to receive requests on")
558
parser.add_option("--timeout", type="string", # Parsed later
560
help="Amount of downtime allowed for clients")
561
parser.add_option("--interval", type="string", # Parsed later
563
help="How often to check that a client is up")
564
636
parser.add_option("--check", action="store_true", default=False,
565
637
help="Run self-test")
566
638
parser.add_option("--debug", action="store_true", default=False,
567
639
help="Debug mode")
640
parser.add_option("--priority", type="string",
642
help="GnuTLS priority string"
643
" (see GnuTLS documentation)")
644
parser.add_option("--servicename", type="string",
645
default="Mandos", help="Zeroconf service name")
568
646
(options, args) = parser.parse_args()
570
648
if options.check:
572
650
doctest.testmod()
575
# Parse the time arguments
577
options.timeout = string_to_delta(options.timeout)
579
parser.error("option --timeout: Unparseable time")
581
options.interval = string_to_delta(options.interval)
583
parser.error("option --interval: Unparseable time")
585
653
# Parse config file
586
defaults = { "checker": "sleep 1; fping -q -- %%(fqdn)s" }
654
defaults = { "timeout": "1h",
656
"checker": "fping -q -- %%(fqdn)s",
587
658
client_config = ConfigParser.SafeConfigParser(defaults)
588
#client_config.readfp(open("secrets.conf"), "secrets.conf")
659
#client_config.readfp(open("global.conf"), "global.conf")
589
660
client_config.read("mandos-clients.conf")
591
# From the Avahi server example code
663
serviceName = options.servicename;
668
# From the Avahi example code
592
669
DBusGMainLoop(set_as_default=True )
593
670
main_loop = gobject.MainLoop()
594
671
bus = dbus.SystemBus()
600
677
debug = options.debug
680
console = logging.StreamHandler()
681
# console.setLevel(logging.DEBUG)
682
console.setFormatter(logging.Formatter\
683
('%(levelname)s: %(message)s'))
684
logger.addHandler(console)
603
688
def remove_from_clients(client):
604
689
clients.remove(client)
607
sys.stderr.write(u"No clients left, exiting\n")
691
logger.debug(u"No clients left, exiting")
610
clients.update(Set(Client(name=section, options=options,
694
clients.update(Set(Client(name=section,
611
695
stop_hook = remove_from_clients,
612
696
**(dict(client_config\
613
697
.items(section))))
614
698
for section in client_config.sections()))
704
"Cleanup function; run on exit"
706
# From the Avahi example code
707
if not group is None:
710
# End of Avahi example code
713
client = clients.pop()
714
client.stop_hook = None
717
atexit.register(cleanup)
720
signal.signal(signal.SIGINT, signal.SIG_IGN)
721
signal.signal(signal.SIGHUP, lambda signum, frame: killme())
722
signal.signal(signal.SIGTERM, lambda signum, frame: killme())
615
724
for client in clients:
618
tcp_server = IPv6_TCPServer((None, options.port),
727
tcp_server = IPv6_TCPServer((options.address, options.port),
622
731
# Find out what random port we got
623
733
servicePort = tcp_server.socket.getsockname()[1]
625
sys.stderr.write(u"Now listening on port %d\n" % servicePort)
734
logger.debug(u"Now listening on port %d", servicePort)
627
736
if options.interface is not None:
737
global serviceInterface
628
738
serviceInterface = if_nametoindex(options.interface)
630
# From the Avahi server example code
740
# From the Avahi example code
631
741
server.connect_to_signal("StateChanged", server_state_changed)
632
server_state_changed(server.GetState())
743
server_state_changed(server.GetState())
744
except dbus.exceptions.DBusException, error:
745
logger.critical(u"DBusException: %s", error)
633
747
# End of Avahi example code
635
749
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,