/mandos/trunk : revision 274

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos [%(process)d]: %(levelname)s:'

77

' %(message)s'))

76

('Mandos: %(levelname)s: %(message)s'))

78

77

logger.addHandler(syslogger)

79

78

80

79

console = logging.StreamHandler()

81

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

82

' %(levelname)s: %(message)s'))

80

console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'

81

' %(message)s'))

83

82

logger.addHandler(console)

84

83

85

84

class AvahiError(Exception):

114

113

"""

115

114

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

116

115

servicetype = None, port = None, TXT = None,

117

domain = "", host = "", max_renames = 32768,

118

protocol = avahi.PROTO_UNSPEC):

116

domain = "", host = "", max_renames = 32768):

119

117

self.interface = interface

120

118

self.name = name

121

119

self.type = servicetype

125

123

self.host = host

126

124

self.rename_count = 0

127

125

self.max_renames = max_renames

128

self.protocol = protocol

129

126

def rename(self):

130

127

"""Derived from the Avahi example code"""

131

128

if self.rename_count >= self.max_renames:

160

157

service.name, service.type)

161

158

group.AddService(

162

159

self.interface, # interface

163

self.protocol, # protocol

160

avahi.PROTO_INET6, # protocol

164

161

dbus.UInt32(0), # flags

165

162

self.name, self.type,

166

163

self.domain, self.host,

181

178

class Client(dbus.service.Object):

182

179

"""A representation of a client host served by this server.

183

180

Attributes:

184

name: string; from the config file, used in log messages and

185

D-Bus identifiers

181

name: string; from the config file, used in log messages

186

182

fingerprint: string (40 or 32 hexadecimal digits); used to

187

183

uniquely identify the client

188

184

secret: bytestring; sent verbatim (over TLS) to client

229

225

if config is None:

230

226

config = {}

231

227

logger.debug(u"Creating client %r", self.name)

232

self.use_dbus = False # During __init__

228

self.use_dbus = use_dbus

229

if self.use_dbus:

230

self.dbus_object_path = (dbus.ObjectPath

231

("/Mandos/clients/"

232

+ self.name.replace(".", "_")))

233

dbus.service.Object.__init__(self, bus,

234

self.dbus_object_path)

233

235

# Uppercase and remove spaces from fingerprint for later

234

236

# comparison purposes with return value from the fingerprint()

235

237

# function

259

261

self.disable_initiator_tag = None

260

262

self.checker_callback_tag = None

261

263

self.checker_command = config["checker"]

262

self.last_connect = None

263

# Only now, when this client is initialized, can it show up on

264

# the D-Bus

265

self.use_dbus = use_dbus

266

if self.use_dbus:

267

self.dbus_object_path = (dbus.ObjectPath

268

("/clients/"

269

+ self.name.replace(".", "_")))

270

dbus.service.Object.__init__(self, bus,

271

self.dbus_object_path)

272

264

273

265

def enable(self):

274

266

"""Start this client's checker and timeout hooks"""

327

319

# Emit D-Bus signal

328

320

self.PropertyChanged(dbus.String(u"checker_running"),

329

321

dbus.Boolean(False, variant_level=1))

330

if os.WIFEXITED(condition):

331

exitstatus = os.WEXITSTATUS(condition)

332

if exitstatus == 0:

333

logger.info(u"Checker for %(name)s succeeded",

334

vars(self))

335

self.checked_ok()

336

else:

337

logger.info(u"Checker for %(name)s failed",

338

vars(self))

322

if (os.WIFEXITED(condition)

323

and (os.WEXITSTATUS(condition) == 0)):

324

logger.info(u"Checker for %(name)s succeeded",

325

vars(self))

339

326

if self.use_dbus:

340

327

# Emit D-Bus signal

341

self.CheckerCompleted(dbus.Int16(exitstatus),

342

dbus.Int64(condition),

328

self.CheckerCompleted(dbus.Boolean(True),

329

dbus.UInt16(condition),

343

330

dbus.String(command))

344

else:

331

self.bump_timeout()

332

elif not os.WIFEXITED(condition):

345

333

logger.warning(u"Checker for %(name)s crashed?",

346

334

vars(self))

347

335

if self.use_dbus:

348

336

# Emit D-Bus signal

349

self.CheckerCompleted(dbus.Int16(-1),

350

dbus.Int64(condition),

337

self.CheckerCompleted(dbus.Boolean(False),

338

dbus.UInt16(condition),

339

dbus.String(command))

340

else:

341

logger.info(u"Checker for %(name)s failed",

342

vars(self))

343

if self.use_dbus:

344

# Emit D-Bus signal

345

self.CheckerCompleted(dbus.Boolean(False),

346

dbus.UInt16(condition),

351

347

dbus.String(command))

352

348

353

def checked_ok(self):

349

def bump_timeout(self):

354

350

"""Bump up the timeout for this client.

355

351

This should only be called when the client has been seen,

356

352

alive and well.

414

410

(self.checker.pid,

415

411

self.checker_callback,

416

412

data=command))

417

# The checker may have completed before the gobject

418

# watch was added. Check for this.

419

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

420

if pid:

421

gobject.source_remove(self.checker_callback_tag)

422

self.checker_callback(pid, status, command)

423

413

except OSError, error:

424

414

logger.error(u"Failed to start subprocess: %s",

425

415

error)

458

448

return now < (self.last_checked_ok + self.timeout)

459

449

460

450

## D-Bus methods & signals

461

_interface = u"se.bsnet.fukt.Mandos.Client"

451

_interface = u"org.mandos_system.Mandos.Client"

462

452

463

# CheckedOK - method

464

CheckedOK = dbus.service.method(_interface)(checked_ok)

465

CheckedOK.__name__ = "CheckedOK"

453

# BumpTimeout - method

454

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

455

BumpTimeout.__name__ = "BumpTimeout"

466

456

467

457

# CheckerCompleted - signal

468

@dbus.service.signal(_interface, signature="nxs")

469

def CheckerCompleted(self, exitcode, waitstatus, command):

458

@dbus.service.signal(_interface, signature="bqs")

459

def CheckerCompleted(self, success, condition, command):

470

460

"D-Bus signal"

471

461

pass

472

462

513

503

dbus.String("checker_running"):

514

504

dbus.Boolean(self.checker is not None,

515

505

variant_level=1),

516

dbus.String("object_path"):

517

dbus.ObjectPath(self.dbus_object_path,

518

variant_level=1)

519

506

}, signature="sv")

520

507

521

508

# IsStillValid - method

604

591

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

605

592

# ...do the normal thing

606

593

return session.peer_certificate

607

list_size = ctypes.c_uint(1)

594

list_size = ctypes.c_uint()

608

595

cert_list = (gnutls.library.functions

609

596

.gnutls_certificate_get_peers

610

597

(session._c_object, ctypes.byref(list_size)))

611

if not bool(cert_list) and list_size.value != 0:

612

raise gnutls.errors.GNUTLSError("error getting peer"

613

" certificate")

614

598

if list_size.value == 0:

615

599

return None

616

600

cert = cert_list[0]

685

669

# using OpenPGP certificates.

686

670

687

671

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

688

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

689

# "+DHE-DSS"))

672

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

673

# "+DHE-DSS"))

690

674

# Use a fallback default, since this MUST be set.

691

675

priority = self.server.settings.get("priority", "NORMAL")

692

676

(gnutls.library.functions

700

684

# Do not run session.bye() here: the session is not

701

685

# established. Just abandon the request.

702

686

return

703

logger.debug(u"Handshake succeeded")

704

687

try:

705

688

fpr = fingerprint(peer_certificate(session))

706

689

except (TypeError, gnutls.errors.GNUTLSError), error:

708

691

session.bye()

709

692

return

710

693

logger.debug(u"Fingerprint: %s", fpr)

711

712

694

for c in self.server.clients:

713

695

if c.fingerprint == fpr:

714

696

client = c

727

709

session.bye()

728

710

return

729

711

## This won't work here, since we're in a fork.

730

# client.checked_ok()

712

# client.bump_timeout()

731

713

sent_size = 0

732

714

while sent_size < len(client.secret):

733

715

sent = session.send(client.secret[sent_size:])

740

722

741

723

class IPv6_TCPServer(SocketServer.ForkingMixIn,

742

724

SocketServer.TCPServer, object):

743

"""IPv6-capable TCP server. Accepts 'None' as address and/or port.

725

"""IPv6 TCP server. Accepts 'None' as address and/or port.

744

726

Attributes:

745

727

settings: Server settings

746

728

clients: Set() of Client objects

754

736

if "clients" in kwargs:

755

737

self.clients = kwargs["clients"]

756

738

del kwargs["clients"]

757

if "use_ipv6" in kwargs:

758

if not kwargs["use_ipv6"]:

759

self.address_family = socket.AF_INET

760

del kwargs["use_ipv6"]

761

739

self.enabled = False

762

740

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

763

741

def server_bind(self):

777

755

u" bind to interface %s",

778

756

self.settings["interface"])

779

757

else:

780

raise

758

raise error

781

759

# Only bind(2) the socket if we really need to.

782

760

if self.server_address[0] or self.server_address[1]:

783

761

if not self.server_address[0]:

784

if self.address_family == socket.AF_INET6:

785

any_address = "::" # in6addr_any

786

else:

787

any_address = socket.INADDR_ANY

788

self.server_address = (any_address,

762

in6addr_any = "::"

763

self.server_address = (in6addr_any,

789

764

self.server_address[1])

790

765

elif not self.server_address[1]:

791

766

self.server_address = (self.server_address[0],

807

782

808

783

def string_to_delta(interval):

809

784

"""Parse a string and return a datetime.timedelta

810

785

811

786

>>> string_to_delta('7d')

812

787

datetime.timedelta(7)

813

788

>>> string_to_delta('60s')

938

913

dest="use_dbus",

939

914

help="Do not provide D-Bus system bus"

940

915

" interface")

941

parser.add_option("--no-ipv6", action="store_false",

942

dest="use_ipv6", help="Do not use IPv6")

943

916

options = parser.parse_args()[0]

944

917

945

918

if options.check:

956

929

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

957

930

"servicename": "Mandos",

958

931

"use_dbus": "True",

959

"use_ipv6": "True",

960

932

}

961

933

962

934

# Parse config file for server-global settings

965

937

server_config.read(os.path.join(options.configdir, "mandos.conf"))

966

938

# Convert the SafeConfigParser object to a dict

967

939

server_settings = server_config.defaults()

968

# Use the appropriate methods on the non-string config options

969

server_settings["debug"] = server_config.getboolean("DEFAULT",

970

"debug")

971

server_settings["use_dbus"] = server_config.getboolean("DEFAULT",

972

"use_dbus")

973

server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",

974

"use_ipv6")

975

if server_settings["port"]:

976

server_settings["port"] = server_config.getint("DEFAULT",

977

"port")

940

# Use getboolean on the boolean config options

941

server_settings["debug"] = (server_config.getboolean

942

("DEFAULT", "debug"))

943

server_settings["use_dbus"] = (server_config.getboolean

944

("DEFAULT", "use_dbus"))

978

945

del server_config

979

946

980

947

# Override the settings from the config file with command line

981

948

# options, if set.

982

949

for option in ("interface", "address", "port", "debug",

983

950

"priority", "servicename", "configdir",

984

"use_dbus", "use_ipv6"):

951

"use_dbus"):

985

952

value = getattr(options, option)

986

953

if value is not None:

987

954

server_settings[option] = value

991

958

# For convenience

992

959

debug = server_settings["debug"]

993

960

use_dbus = server_settings["use_dbus"]

994

use_ipv6 = server_settings["use_ipv6"]

995

961

996

962

if not debug:

997

963

syslogger.setLevel(logging.WARNING)

1018

984

server_settings["port"]),

1019

985

TCP_handler,

1020

986

settings=server_settings,

1021

clients=clients, use_ipv6=use_ipv6)

987

clients=clients)

1022

988

pidfilename = "/var/run/mandos.pid"

1023

989

try:

1024

990

pidfile = open(pidfilename, "w")

1025

except IOError:

991

except IOError, error:

1026

992

logger.error("Could not open file %r", pidfilename)

1027

993

1028

994

try:

1040

1006

uid = 65534

1041

1007

gid = 65534

1042

1008

try:

1009

os.setuid(uid)

1043

1010

os.setgid(gid)

1044

os.setuid(uid)

1045

1011

except OSError, error:

1046

1012

if error[0] != errno.EPERM:

1047

1013

raise error

1048

1014

1049

# Enable all possible GnuTLS debugging

1050

if debug:

1051

# "Use a log level over 10 to enable all debugging options."

1052

# - GnuTLS manual

1053

gnutls.library.functions.gnutls_global_set_log_level(11)

1054

1055

@gnutls.library.types.gnutls_log_func

1056

def debug_gnutls(level, string):

1057

logger.debug("GnuTLS: %s", string[:-1])

1058

1059

(gnutls.library.functions

1060

.gnutls_global_set_log_function(debug_gnutls))

1061

1062

1015

global service

1063

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1064

1016

service = AvahiService(name = server_settings["servicename"],

1065

servicetype = "_mandos._tcp",

1066

protocol = protocol)

1017

servicetype = "_mandos._tcp", )

1067

1018

if server_settings["interface"]:

1068

1019

service.interface = (if_nametoindex

1069

1020

(server_settings["interface"]))

1080

1031

avahi.DBUS_INTERFACE_SERVER)

1081

1032

# End of Avahi example code

1082

1033

if use_dbus:

1083

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1034

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",

1035

bus)

1084

1036

1085

1037

clients.update(Set(Client(name = section,

1086

1038

config

1140

1092

class MandosServer(dbus.service.Object):

1141

1093

"""A D-Bus proxy object"""

1142

1094

def __init__(self):

1143

dbus.service.Object.__init__(self, bus, "/")

1144

_interface = u"se.bsnet.fukt.Mandos"

1145

1095

dbus.service.Object.__init__(self, bus,

1096

"/Mandos")

1097

_interface = u"org.mandos_system.Mandos"

1098

1146

1099

@dbus.service.signal(_interface, signature="oa{sv}")

1147

1100

def ClientAdded(self, objpath, properties):

1148

1101

"D-Bus signal"

1149

1102

pass

1150

1151

@dbus.service.signal(_interface, signature="os")

1152

def ClientRemoved(self, objpath, name):

1103

1104

@dbus.service.signal(_interface, signature="o")

1105

def ClientRemoved(self, objpath):

1153

1106

"D-Bus signal"

1154

1107

pass

1155

1108

1156

1109

@dbus.service.method(_interface, out_signature="ao")

1157

1110

def GetAllClients(self):

1158

"D-Bus method"

1159

1111

return dbus.Array(c.dbus_object_path for c in clients)

1160

1112

1161

1113

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1162

1114

def GetAllClientsWithProperties(self):

1163

"D-Bus method"

1164

1115

return dbus.Dictionary(

1165

1116

((c.dbus_object_path, c.GetAllProperties())

1166

1117

for c in clients),

1167

1118

signature="oa{sv}")

1168

1119

1169

1120

@dbus.service.method(_interface, in_signature="o")

1170

1121

def RemoveClient(self, object_path):

1171

"D-Bus method"

1172

1122

for c in clients:

1173

1123

if c.dbus_object_path == object_path:

1174

1124

clients.remove(c)

1176

1126

c.use_dbus = False

1177

1127

c.disable()

1178

1128

# Emit D-Bus signal

1179

self.ClientRemoved(object_path, c.name)

1129

self.ClientRemoved(object_path)

1180

1130

return

1181

1131

raise KeyError

1182

1132

@dbus.service.method(_interface)

1133

def Quit(self):

1134

main_loop.quit()

1135

1183

1136

del _interface

1184

1137

1185

1138

mandos_server = MandosServer()

1186

1139

1187

1140

for client in clients:

1196

1149

1197

1150

# Find out what port we got

1198

1151

service.port = tcp_server.socket.getsockname()[1]

1199

if use_ipv6:

1200

logger.info(u"Now listening on address %r, port %d,"

1201

" flowinfo %d, scope_id %d"

1202

% tcp_server.socket.getsockname())

1203

else: # IPv4

1204

logger.info(u"Now listening on address %r, port %d"

1205

% tcp_server.socket.getsockname())

1152

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

1153

u" scope_id %d" % tcp_server.socket.getsockname())

1206

1154

1207

1155

#service.interface = tcp_server.socket.getsockname()[3]

1208

1156

1228

1176

sys.exit(1)

1229

1177

except KeyboardInterrupt:

1230

1178

if debug:

1231

print >> sys.stderr

1232

logger.debug("Server received KeyboardInterrupt")

1233

logger.debug("Server exiting")

1179

print

1234

1180

1235

1181

if __name__ == '__main__':

1236

1182

main()