To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 274
- compare with another revision
- download diff
- download tarball
- view history from revision 274
- Committer: Teddy Hogeborn
- Date: 2009-01-17 09:46:54 UTC
- Revision ID: teddy@fukt.bsnet.se-20090117094654-ydvanis7caqoxxn7
* mandos-keygen (password): Remove bashism "${PIPESTATUS}".
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- network-protocol.txt
- files renamed:
- server.py => mandos
- server.conf => mandos.conf
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
24
25
# GNU General Public License for more details.
25
26
#
26
27
# You should have received a copy of the GNU General Public License
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
28
30
#
29
31
# Contact the authors at <mandos@fukt.bsnet.se>.
30
32
#
31
33
32
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
33
35
34
36
import SocketServer
35
37
import socket
36
import select
37
from optparse import OptionParser
38
import optparse
38
39
import datetime
39
40
import errno
40
41
import gnutls.crypto
54
55
import stat
55
56
import logging
56
57
import logging.handlers
58
import pwd
59
from contextlib import closing
57
60
58
61
import dbus
62
import dbus.service
59
63
import gobject
60
64
import avahi
61
65
from dbus.mainloop.glib import DBusGMainLoop
62
66
import ctypes
67
import ctypes.util
63
68
69
version = "1.0.5"
64
70
65
71
logger = logging.Logger('mandos')
66
syslogger = logging.handlers.SysLogHandler\
67
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
68
syslogger.setFormatter(logging.Formatter\
69
('%(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
70
77
logger.addHandler(syslogger)
71
del syslogger
72
78
79
console = logging.StreamHandler()
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
82
logger.addHandler(console)
73
83
74
84
class AvahiError(Exception):
75
def __init__(self, value):
85
def __init__(self, value, *args, **kwargs):
76
86
self.value = value
77
def __str__(self):
78
return repr(self.value)
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
79
90
80
91
class AvahiServiceError(AvahiError):
81
92
pass
101
112
a sensible number of times
102
113
"""
103
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
104
type = None, port = None, TXT = None, domain = "",
105
host = "", max_renames = 12):
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
106
117
self.interface = interface
107
118
self.name = name
108
self.type = type
119
self.type = servicetype
109
120
self.port = port
110
if TXT is None:
111
self.TXT = []
112
else:
113
self.TXT = TXT
121
self.TXT = TXT if TXT is not None else []
114
122
self.domain = domain
115
123
self.host = host
116
124
self.rename_count = 0
125
self.max_renames = max_renames
117
126
def rename(self):
118
127
"""Derived from the Avahi example code"""
119
128
if self.rename_count >= self.max_renames:
120
logger.critical(u"No suitable service name found after %i"
121
u" retries, exiting.", rename_count)
122
raise AvahiServiceError("Too many renames")
123
name = server.GetAlternativeServiceName(name)
124
logger.error(u"Changing name to %r ...", name)
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
125
139
self.remove()
126
140
self.add()
127
141
self.rename_count += 1
133
147
"""Derived from the Avahi example code"""
134
148
global group
135
149
if group is None:
136
group = dbus.Interface\
137
(bus.get_object(avahi.DBUS_NAME,
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
138
152
server.EntryGroupNew()),
139
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
140
154
group.connect_to_signal('StateChanged',
141
155
entry_group_state_changed)
142
logger.debug(u"Adding service '%s' of type '%s' ...",
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
143
157
service.name, service.type)
144
158
group.AddService(
145
159
self.interface, # interface
156
170
# End of Avahi example code
157
171
158
172
159
class Client(object):
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
160
179
"""A representation of a client host served by this server.
161
180
Attributes:
162
name: string; from the config file, used in log messages
181
name: string; from the config file, used in log messages
163
182
fingerprint: string (40 or 32 hexadecimal digits); used to
164
183
uniquely identify the client
165
secret: bytestring; sent verbatim (over TLS) to client
166
fqdn: string (FQDN); available for use by the checker command
167
created: datetime.datetime(); object creation, not client host
168
last_checked_ok: datetime.datetime() or None if not yet checked OK
169
timeout: datetime.timedelta(); How long from last_checked_ok
170
until this client is invalid
171
interval: datetime.timedelta(); How often to start a new checker
172
stop_hook: If set, called by stop() as stop_hook(self)
173
checker: subprocess.Popen(); a running checker process used
174
to see if the client lives.
175
'None' if no process is running.
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
176
197
checker_initiator_tag: a gobject event source tag, or None
177
stop_initiator_tag: - '' -
198
disable_initiator_tag: - '' -
178
199
checker_callback_tag: - '' -
179
200
checker_command: string; External command which is run to check if
180
201
client lives. %() expansions are done at
181
202
runtime with vars(self) as dict, so that for
182
203
instance %(name)s can be used in the command.
183
Private attibutes:
184
_timeout: Real variable for 'timeout'
185
_interval: Real variable for 'interval'
186
_timeout_milliseconds: Used when calling gobject.timeout_add()
187
_interval_milliseconds: - '' -
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
188
206
"""
189
def _set_timeout(self, timeout):
190
"Setter function for 'timeout' attribute"
191
self._timeout = timeout
192
self._timeout_milliseconds = ((self.timeout.days
193
* 24 * 60 * 60 * 1000)
194
+ (self.timeout.seconds * 1000)
195
+ (self.timeout.microseconds
196
// 1000))
197
timeout = property(lambda self: self._timeout,
198
_set_timeout)
199
del _set_timeout
200
def _set_interval(self, interval):
201
"Setter function for 'interval' attribute"
202
self._interval = interval
203
self._interval_milliseconds = ((self.interval.days
204
* 24 * 60 * 60 * 1000)
205
+ (self.interval.seconds
206
* 1000)
207
+ (self.interval.microseconds
208
// 1000))
209
interval = property(lambda self: self._interval,
210
_set_interval)
211
del _set_interval
212
def __init__(self, name = None, stop_hook=None, config={}):
207
def timeout_milliseconds(self):
208
"Return the 'timeout' attribute in milliseconds"
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
212
213
def interval_milliseconds(self):
214
"Return the 'interval' attribute in milliseconds"
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
218
219
def __init__(self, name = None, disable_hook=None, config=None,
220
use_dbus=True):
213
221
"""Note: the 'checker' key in 'config' sets the
214
222
'checker_command' attribute and *not* the 'checker'
215
223
attribute."""
216
224
self.name = name
225
if config is None:
226
config = {}
217
227
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
229
if self.use_dbus:
230
self.dbus_object_path = (dbus.ObjectPath
231
("/Mandos/clients/"
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
218
235
# Uppercase and remove spaces from fingerprint for later
219
236
# comparison purposes with return value from the fingerprint()
220
237
# function
221
self.fingerprint = config["fingerprint"].upper()\
222
.replace(u" ", u"")
238
self.fingerprint = (config["fingerprint"].upper()
239
.replace(u" ", u""))
223
240
logger.debug(u" Fingerprint: %s", self.fingerprint)
224
241
if "secret" in config:
225
242
self.secret = config["secret"].decode(u"base64")
226
243
elif "secfile" in config:
227
sf = open(config["secfile"])
228
self.secret = sf.read()
229
sf.close()
244
with closing(open(os.path.expanduser
245
(os.path.expandvars
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
230
248
else:
231
249
raise TypeError(u"No secret or secfile for client %s"
232
250
% self.name)
233
self.fqdn = config.get("fqdn", "")
234
self.created = datetime.datetime.now()
251
self.host = config.get("host", "")
252
self.created = datetime.datetime.utcnow()
253
self.enabled = False
254
self.last_enabled = None
235
255
self.last_checked_ok = None
236
256
self.timeout = string_to_delta(config["timeout"])
237
257
self.interval = string_to_delta(config["interval"])
238
self.stop_hook = stop_hook
258
self.disable_hook = disable_hook
239
259
self.checker = None
240
260
self.checker_initiator_tag = None
241
self.stop_initiator_tag = None
261
self.disable_initiator_tag = None
242
262
self.checker_callback_tag = None
243
self.check_command = config["checker"]
244
def start(self):
263
self.checker_command = config["checker"]
264
265
def enable(self):
245
266
"""Start this client's checker and timeout hooks"""
267
self.last_enabled = datetime.datetime.utcnow()
246
268
# Schedule a new checker to be started an 'interval' from now,
247
269
# and every interval from then on.
248
self.checker_initiator_tag = gobject.timeout_add\
249
(self._interval_milliseconds,
250
self.start_checker)
270
self.checker_initiator_tag = (gobject.timeout_add
271
(self.interval_milliseconds(),
272
self.start_checker))
251
273
# Also start a new checker *right now*.
252
274
self.start_checker()
253
# Schedule a stop() when 'timeout' has passed
254
self.stop_initiator_tag = gobject.timeout_add\
255
(self._timeout_milliseconds,
256
self.stop)
257
def stop(self):
258
"""Stop this client.
259
The possibility that a client might be restarted is left open,
260
but not currently used."""
261
# If this client doesn't have a secret, it is already stopped.
262
if self.secret:
263
logger.info(u"Stopping client %s", self.name)
264
self.secret = None
265
else:
275
# Schedule a disable() when 'timeout' has passed
276
self.disable_initiator_tag = (gobject.timeout_add
277
(self.timeout_milliseconds(),
278
self.disable))
279
self.enabled = True
280
if self.use_dbus:
281
# Emit D-Bus signals
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
286
variant_level=1)))
287
288
def disable(self):
289
"""Disable this client."""
290
if not getattr(self, "enabled", False):
266
291
return False
267
if getattr(self, "stop_initiator_tag", False):
268
gobject.source_remove(self.stop_initiator_tag)
269
self.stop_initiator_tag = None
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
294
gobject.source_remove(self.disable_initiator_tag)
295
self.disable_initiator_tag = None
270
296
if getattr(self, "checker_initiator_tag", False):
271
297
gobject.source_remove(self.checker_initiator_tag)
272
298
self.checker_initiator_tag = None
273
299
self.stop_checker()
274
if self.stop_hook:
275
self.stop_hook(self)
300
if self.disable_hook:
301
self.disable_hook(self)
302
self.enabled = False
303
if self.use_dbus:
304
# Emit D-Bus signal
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
276
307
# Do not run this again if called by a gobject.timeout_add
277
308
return False
309
278
310
def __del__(self):
279
self.stop_hook = None
280
self.stop()
281
def checker_callback(self, pid, condition):
311
self.disable_hook = None
312
self.disable()
313
314
def checker_callback(self, pid, condition, command):
282
315
"""The checker has completed, so take appropriate actions."""
283
now = datetime.datetime.now()
284
316
self.checker_callback_tag = None
285
317
self.checker = None
286
if os.WIFEXITED(condition) \
287
and (os.WEXITSTATUS(condition) == 0):
318
if self.use_dbus:
319
# Emit D-Bus signal
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
288
324
logger.info(u"Checker for %(name)s succeeded",
289
325
vars(self))
290
self.last_checked_ok = now
291
gobject.source_remove(self.stop_initiator_tag)
292
self.stop_initiator_tag = gobject.timeout_add\
293
(self._timeout_milliseconds,
294
self.stop)
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
331
self.bump_timeout()
295
332
elif not os.WIFEXITED(condition):
296
333
logger.warning(u"Checker for %(name)s crashed?",
297
334
vars(self))
335
if self.use_dbus:
336
# Emit D-Bus signal
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
298
340
else:
299
341
logger.info(u"Checker for %(name)s failed",
300
342
vars(self))
343
if self.use_dbus:
344
# Emit D-Bus signal
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
348
349
def bump_timeout(self):
350
"""Bump up the timeout for this client.
351
This should only be called when the client has been seen,
352
alive and well.
353
"""
354
self.last_checked_ok = datetime.datetime.utcnow()
355
gobject.source_remove(self.disable_initiator_tag)
356
self.disable_initiator_tag = (gobject.timeout_add
357
(self.timeout_milliseconds(),
358
self.disable))
359
if self.use_dbus:
360
# Emit D-Bus signal
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
364
variant_level=1)))
365
301
366
def start_checker(self):
302
367
"""Start a new checker subprocess if one is not running.
303
368
If a checker already exists, leave it running and do
312
377
# is as it should be.
313
378
if self.checker is None:
314
379
try:
315
# In case check_command has exactly one % operator
316
command = self.check_command % self.fqdn
380
# In case checker_command has exactly one % operator
381
command = self.checker_command % self.host
317
382
except TypeError:
318
383
# Escape attributes for the shell
319
384
escaped_attrs = dict((key, re.escape(str(val)))
320
385
for key, val in
321
386
vars(self).iteritems())
322
387
try:
323
command = self.check_command % escaped_attrs
388
command = self.checker_command % escaped_attrs
324
389
except TypeError, error:
325
390
logger.error(u'Could not format string "%s":'
326
u' %s', self.check_command, error)
391
u' %s', self.checker_command, error)
327
392
return True # Try again later
328
393
try:
329
394
logger.info(u"Starting checker %r for %s",
330
395
command, self.name)
396
# We don't need to redirect stdout and stderr, since
397
# in normal mode, that is already done by daemon(),
398
# and in debug mode we don't want to. (Stdin is
399
# always replaced by /dev/null.)
331
400
self.checker = subprocess.Popen(command,
332
401
close_fds=True,
333
402
shell=True, cwd="/")
334
self.checker_callback_tag = gobject.child_watch_add\
335
(self.checker.pid,
336
self.checker_callback)
337
except subprocess.OSError, error:
403
if self.use_dbus:
404
# Emit D-Bus signal
405
self.CheckerStarted(command)
406
self.PropertyChanged(
407
dbus.String("checker_running"),
408
dbus.Boolean(True, variant_level=1))
409
self.checker_callback_tag = (gobject.child_watch_add
410
(self.checker.pid,
411
self.checker_callback,
412
data=command))
413
except OSError, error:
338
414
logger.error(u"Failed to start subprocess: %s",
339
415
error)
340
416
# Re-run this periodically if run by gobject.timeout_add
341
417
return True
418
342
419
def stop_checker(self):
343
420
"""Force the checker process, if any, to stop."""
344
421
if self.checker_callback_tag:
346
423
self.checker_callback_tag = None
347
424
if getattr(self, "checker", None) is None:
348
425
return
349
logger.debug("Stopping checker for %(name)s", vars(self))
426
logger.debug(u"Stopping checker for %(name)s", vars(self))
350
427
try:
351
428
os.kill(self.checker.pid, signal.SIGTERM)
352
429
#os.sleep(0.5)
356
433
if error.errno != errno.ESRCH: # No such process
357
434
raise
358
435
self.checker = None
436
if self.use_dbus:
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
439
359
440
def still_valid(self):
360
441
"""Has the timeout not yet passed for this client?"""
361
now = datetime.datetime.now()
442
if not getattr(self, "enabled", False):
443
return False
444
now = datetime.datetime.utcnow()
362
445
if self.last_checked_ok is None:
363
446
return now < (self.created + self.timeout)
364
447
else:
365
448
return now < (self.last_checked_ok + self.timeout)
449
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
452
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
456
457
# CheckerCompleted - signal
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
460
"D-Bus signal"
461
pass
462
463
# CheckerStarted - signal
464
@dbus.service.signal(_interface, signature="s")
465
def CheckerStarted(self, command):
466
"D-Bus signal"
467
pass
468
469
# GetAllProperties - method
470
@dbus.service.method(_interface, out_signature="a{sv}")
471
def GetAllProperties(self):
472
"D-Bus method"
473
return dbus.Dictionary({
474
dbus.String("name"):
475
dbus.String(self.name, variant_level=1),
476
dbus.String("fingerprint"):
477
dbus.String(self.fingerprint, variant_level=1),
478
dbus.String("host"):
479
dbus.String(self.host, variant_level=1),
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
484
variant_level=1)
485
if self.last_enabled is not None
486
else dbus.Boolean(False, variant_level=1)),
487
dbus.String("enabled"):
488
dbus.Boolean(self.enabled, variant_level=1),
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
491
variant_level=1)
492
if self.last_checked_ok is not None
493
else dbus.Boolean (False, variant_level=1)),
494
dbus.String("timeout"):
495
dbus.UInt64(self.timeout_milliseconds(),
496
variant_level=1),
497
dbus.String("interval"):
498
dbus.UInt64(self.interval_milliseconds(),
499
variant_level=1),
500
dbus.String("checker"):
501
dbus.String(self.checker_command,
502
variant_level=1),
503
dbus.String("checker_running"):
504
dbus.Boolean(self.checker is not None,
505
variant_level=1),
506
}, signature="sv")
507
508
# IsStillValid - method
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
510
(still_valid))
511
IsStillValid.__name__ = "IsStillValid"
512
513
# PropertyChanged - signal
514
@dbus.service.signal(_interface, signature="sv")
515
def PropertyChanged(self, property, value):
516
"D-Bus signal"
517
pass
518
519
# SetChecker - method
520
@dbus.service.method(_interface, in_signature="s")
521
def SetChecker(self, checker):
522
"D-Bus setter method"
523
self.checker_command = checker
524
# Emit D-Bus signal
525
self.PropertyChanged(dbus.String(u"checker"),
526
dbus.String(self.checker_command,
527
variant_level=1))
528
529
# SetHost - method
530
@dbus.service.method(_interface, in_signature="s")
531
def SetHost(self, host):
532
"D-Bus setter method"
533
self.host = host
534
# Emit D-Bus signal
535
self.PropertyChanged(dbus.String(u"host"),
536
dbus.String(self.host, variant_level=1))
537
538
# SetInterval - method
539
@dbus.service.method(_interface, in_signature="t")
540
def SetInterval(self, milliseconds):
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
542
# Emit D-Bus signal
543
self.PropertyChanged(dbus.String(u"interval"),
544
(dbus.UInt64(self.interval_milliseconds(),
545
variant_level=1)))
546
547
# SetSecret - method
548
@dbus.service.method(_interface, in_signature="ay",
549
byte_arrays=True)
550
def SetSecret(self, secret):
551
"D-Bus setter method"
552
self.secret = str(secret)
553
554
# SetTimeout - method
555
@dbus.service.method(_interface, in_signature="t")
556
def SetTimeout(self, milliseconds):
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
558
# Emit D-Bus signal
559
self.PropertyChanged(dbus.String(u"timeout"),
560
(dbus.UInt64(self.timeout_milliseconds(),
561
variant_level=1)))
562
563
# Enable - method
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
566
567
# StartChecker - method
568
@dbus.service.method(_interface)
569
def StartChecker(self):
570
"D-Bus method"
571
self.start_checker()
572
573
# Disable - method
574
@dbus.service.method(_interface)
575
def Disable(self):
576
"D-Bus method"
577
self.disable()
578
579
# StopChecker - method
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
582
583
del _interface
366
584
367
585
368
586
def peer_certificate(session):
369
587
"Return the peer's OpenPGP certificate as a bytestring"
370
588
# If not an OpenPGP certificate...
371
if gnutls.library.functions.gnutls_certificate_type_get\
372
(session._c_object) \
373
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
374
592
# ...do the normal thing
375
593
return session.peer_certificate
376
594
list_size = ctypes.c_uint()
377
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
378
(session._c_object, ctypes.byref(list_size))
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
379
598
if list_size.value == 0:
380
599
return None
381
600
cert = cert_list[0]
385
604
def fingerprint(openpgp):
386
605
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
387
606
# New GnuTLS "datum" with the OpenPGP public key
388
datum = gnutls.library.types.gnutls_datum_t\
389
(ctypes.cast(ctypes.c_char_p(openpgp),
390
ctypes.POINTER(ctypes.c_ubyte)),
391
ctypes.c_uint(len(openpgp)))
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
609
ctypes.POINTER
610
(ctypes.c_ubyte)),
611
ctypes.c_uint(len(openpgp))))
392
612
# New empty GnuTLS certificate
393
613
crt = gnutls.library.types.gnutls_openpgp_crt_t()
394
gnutls.library.functions.gnutls_openpgp_crt_init\
395
(ctypes.byref(crt))
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
396
616
# Import the OpenPGP public key into the certificate
397
gnutls.library.functions.gnutls_openpgp_crt_import\
398
(crt, ctypes.byref(datum),
399
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
621
# Verify the self signature in the key
622
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
625
if crtverify.value != 0:
626
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
raise gnutls.errors.CertificateSecurityError("Verify failed")
400
628
# New buffer for the fingerprint
401
buffer = ctypes.create_string_buffer(20)
402
buffer_length = ctypes.c_size_t()
629
buf = ctypes.create_string_buffer(20)
630
buf_len = ctypes.c_size_t()
403
631
# Get the fingerprint from the certificate into the buffer
404
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
405
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
406
635
# Deinit the certificate
407
636
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
408
637
# Convert the buffer to a Python bytestring
409
fpr = ctypes.string_at(buffer, buffer_length.value)
638
fpr = ctypes.string_at(buf, buf_len.value)
410
639
# Convert the bytestring to hexadecimal notation
411
640
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
412
641
return hex_fpr
413
642
414
643
415
class tcp_handler(SocketServer.BaseRequestHandler, object):
644
class TCP_handler(SocketServer.BaseRequestHandler, object):
416
645
"""A TCP request handler class.
417
646
Instantiated by IPv6_TCPServer for each request to handle it.
418
647
Note: This will run in its own forked process."""
419
648
420
649
def handle(self):
421
650
logger.info(u"TCP connection from: %s",
422
unicode(self.client_address))
423
session = gnutls.connection.ClientSession\
424
(self.request, gnutls.connection.X509Credentials())
651
unicode(self.client_address))
652
session = (gnutls.connection
653
.ClientSession(self.request,
654
gnutls.connection
655
.X509Credentials()))
425
656
426
657
line = self.request.makefile().readline()
427
658
logger.debug(u"Protocol version: %r", line)
440
671
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
441
672
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
442
673
# "+DHE-DSS"))
443
priority = "NORMAL" # Fallback default, since this
444
# MUST be set.
445
if self.server.settings["priority"]:
446
priority = self.server.settings["priority"]
447
gnutls.library.functions.gnutls_priority_set_direct\
448
(session._c_object, priority, None);
674
# Use a fallback default, since this MUST be set.
675
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
678
priority, None))
449
679
450
680
try:
451
681
session.handshake()
461
691
session.bye()
462
692
return
463
693
logger.debug(u"Fingerprint: %s", fpr)
464
client = None
465
694
for c in self.server.clients:
466
695
if c.fingerprint == fpr:
467
696
client = c
468
697
break
469
if not client:
698
else:
470
699
logger.warning(u"Client not found for fingerprint: %s",
471
700
fpr)
472
701
session.bye()
479
708
vars(client))
480
709
session.bye()
481
710
return
711
## This won't work here, since we're in a fork.
712
# client.bump_timeout()
482
713
sent_size = 0
483
714
while sent_size < len(client.secret):
484
715
sent = session.send(client.secret[sent_size:])
489
720
session.bye()
490
721
491
722
492
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
724
SocketServer.TCPServer, object):
493
725
"""IPv6 TCP server. Accepts 'None' as address and/or port.
494
726
Attributes:
495
727
settings: Server settings
496
728
clients: Set() of Client objects
729
enabled: Boolean; whether this server is activated yet
497
730
"""
498
731
address_family = socket.AF_INET6
499
732
def __init__(self, *args, **kwargs):
503
736
if "clients" in kwargs:
504
737
self.clients = kwargs["clients"]
505
738
del kwargs["clients"]
506
return super(type(self), self).__init__(*args, **kwargs)
739
self.enabled = False
740
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
507
741
def server_bind(self):
508
742
"""This overrides the normal server_bind() function
509
743
to bind to an interface if one was specified, and also NOT to
528
762
in6addr_any = "::"
529
763
self.server_address = (in6addr_any,
530
764
self.server_address[1])
531
elif self.server_address[1] is None:
765
elif not self.server_address[1]:
532
766
self.server_address = (self.server_address[0],
533
767
0)
534
return super(type(self), self).server_bind()
768
# if self.settings["interface"]:
769
# self.server_address = (self.server_address[0],
770
# 0, # port
771
# 0, # flowinfo
772
# if_nametoindex
773
# (self.settings
774
# ["interface"]))
775
return super(IPv6_TCPServer, self).server_bind()
776
def server_activate(self):
777
if self.enabled:
778
return super(IPv6_TCPServer, self).server_activate()
779
def enable(self):
780
self.enabled = True
535
781
536
782
537
783
def string_to_delta(interval):
547
793
datetime.timedelta(1)
548
794
>>> string_to_delta(u'1w')
549
795
datetime.timedelta(7)
796
>>> string_to_delta('5m 30s')
797
datetime.timedelta(0, 330)
550
798
"""
551
try:
552
suffix=unicode(interval[-1])
553
value=int(interval[:-1])
554
if suffix == u"d":
555
delta = datetime.timedelta(value)
556
elif suffix == u"s":
557
delta = datetime.timedelta(0, value)
558
elif suffix == u"m":
559
delta = datetime.timedelta(0, 0, 0, 0, value)
560
elif suffix == u"h":
561
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
562
elif suffix == u"w":
563
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
564
else:
799
timevalue = datetime.timedelta(0)
800
for s in interval.split():
801
try:
802
suffix = unicode(s[-1])
803
value = int(s[:-1])
804
if suffix == u"d":
805
delta = datetime.timedelta(value)
806
elif suffix == u"s":
807
delta = datetime.timedelta(0, value)
808
elif suffix == u"m":
809
delta = datetime.timedelta(0, 0, 0, 0, value)
810
elif suffix == u"h":
811
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
812
elif suffix == u"w":
813
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
814
else:
815
raise ValueError
816
except (ValueError, IndexError):
565
817
raise ValueError
566
except (ValueError, IndexError):
567
raise ValueError
568
return delta
818
timevalue += delta
819
return timevalue
569
820
570
821
571
822
def server_state_changed(state):
572
823
"""Derived from the Avahi example code"""
573
824
if state == avahi.SERVER_COLLISION:
574
logger.error(u"Server name collision")
825
logger.error(u"Zeroconf server name collision")
575
826
service.remove()
576
827
elif state == avahi.SERVER_RUNNING:
577
828
service.add()
579
830
580
831
def entry_group_state_changed(state, error):
581
832
"""Derived from the Avahi example code"""
582
logger.debug(u"state change: %i", state)
833
logger.debug(u"Avahi state change: %i", state)
583
834
584
835
if state == avahi.ENTRY_GROUP_ESTABLISHED:
585
logger.debug(u"Service established.")
836
logger.debug(u"Zeroconf service established.")
586
837
elif state == avahi.ENTRY_GROUP_COLLISION:
587
logger.warning(u"Service name collision.")
838
logger.warning(u"Zeroconf service name collision.")
588
839
service.rename()
589
840
elif state == avahi.ENTRY_GROUP_FAILURE:
590
logger.critical(u"Error in group state changed %s",
841
logger.critical(u"Avahi: Error in group state changed %s",
591
842
unicode(error))
592
raise AvahiGroupError("State changed: %s", str(error))
843
raise AvahiGroupError(u"State changed: %s" % unicode(error))
593
844
594
845
def if_nametoindex(interface):
595
846
"""Call the C function if_nametoindex(), or equivalent"""
596
847
global if_nametoindex
597
848
try:
598
if "ctypes.util" not in sys.modules:
599
import ctypes.util
600
if_nametoindex = ctypes.cdll.LoadLibrary\
601
(ctypes.util.find_library("c")).if_nametoindex
849
if_nametoindex = (ctypes.cdll.LoadLibrary
850
(ctypes.util.find_library("c"))
851
.if_nametoindex)
602
852
except (OSError, AttributeError):
603
853
if "struct" not in sys.modules:
604
854
import struct
607
857
def if_nametoindex(interface):
608
858
"Get an interface index the hard way, i.e. using fcntl()"
609
859
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
610
s = socket.socket()
611
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
612
struct.pack("16s16x", interface))
613
s.close()
860
with closing(socket.socket()) as s:
861
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
862
struct.pack("16s16x", interface))
614
863
interface_index = struct.unpack("I", ifreq[16:20])[0]
615
864
return interface_index
616
865
return if_nametoindex(interface)
617
866
618
867
619
def daemon(nochdir, noclose):
868
def daemon(nochdir = False, noclose = False):
620
869
"""See daemon(3). Standard BSD Unix function.
621
870
This should really exist as os.daemon, but it doesn't (yet)."""
622
871
if os.fork():
640
889
641
890
642
891
def main():
643
global main_loop_started
644
main_loop_started = False
645
646
parser = OptionParser()
892
parser = optparse.OptionParser(version = "%%prog %s" % version)
647
893
parser.add_option("-i", "--interface", type="string",
648
894
metavar="IF", help="Bind to interface IF")
649
895
parser.add_option("-a", "--address", type="string",
650
896
help="Address to listen for requests on")
651
897
parser.add_option("-p", "--port", type="int",
652
898
help="Port number to receive requests on")
653
parser.add_option("--check", action="store_true", default=False,
899
parser.add_option("--check", action="store_true",
654
900
help="Run self-test")
655
parser.add_option("--debug", action="store_true", default=False,
901
parser.add_option("--debug", action="store_true",
656
902
help="Debug mode; run in foreground and log to"
657
903
" terminal")
658
904
parser.add_option("--priority", type="string", help="GnuTLS"
663
909
default="/etc/mandos", metavar="DIR",
664
910
help="Directory to search for configuration"
665
911
" files")
666
(options, args) = parser.parse_args()
912
parser.add_option("--no-dbus", action="store_false",
913
dest="use_dbus",
914
help="Do not provide D-Bus system bus"
915
" interface")
916
options = parser.parse_args()[0]
667
917
668
918
if options.check:
669
919
import doctest
678
928
"priority":
679
929
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
680
930
"servicename": "Mandos",
931
"use_dbus": "True",
681
932
}
682
933
683
934
# Parse config file for server-global settings
684
935
server_config = ConfigParser.SafeConfigParser(server_defaults)
685
936
del server_defaults
686
server_config.read(os.path.join(options.configdir, "server.conf"))
687
server_section = "server"
937
server_config.read(os.path.join(options.configdir, "mandos.conf"))
688
938
# Convert the SafeConfigParser object to a dict
689
server_settings = dict(server_config.items(server_section))
690
# Use getboolean on the boolean config option
691
server_settings["debug"] = server_config.getboolean\
692
(server_section, "debug")
939
server_settings = server_config.defaults()
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
693
945
del server_config
694
946
695
947
# Override the settings from the config file with command line
696
948
# options, if set.
697
949
for option in ("interface", "address", "port", "debug",
698
"priority", "servicename", "configdir"):
950
"priority", "servicename", "configdir",
951
"use_dbus"):
699
952
value = getattr(options, option)
700
953
if value is not None:
701
954
server_settings[option] = value
702
955
del options
703
956
# Now we have our good server settings in "server_settings"
704
957
958
# For convenience
959
debug = server_settings["debug"]
960
use_dbus = server_settings["use_dbus"]
961
962
if not debug:
963
syslogger.setLevel(logging.WARNING)
964
console.setLevel(logging.WARNING)
965
966
if server_settings["servicename"] != "Mandos":
967
syslogger.setFormatter(logging.Formatter
968
('Mandos (%s): %%(levelname)s:'
969
' %%(message)s'
970
% server_settings["servicename"]))
971
705
972
# Parse config file with clients
706
973
client_defaults = { "timeout": "1h",
707
974
"interval": "5m",
708
"checker": "fping -q -- %%(fqdn)s",
975
"checker": "fping -q -- %%(host)s",
976
"host": "",
709
977
}
710
978
client_config = ConfigParser.SafeConfigParser(client_defaults)
711
979
client_config.read(os.path.join(server_settings["configdir"],
712
980
"clients.conf"))
713
981
982
clients = Set()
983
tcp_server = IPv6_TCPServer((server_settings["address"],
984
server_settings["port"]),
985
TCP_handler,
986
settings=server_settings,
987
clients=clients)
988
pidfilename = "/var/run/mandos.pid"
989
try:
990
pidfile = open(pidfilename, "w")
991
except IOError, error:
992
logger.error("Could not open file %r", pidfilename)
993
994
try:
995
uid = pwd.getpwnam("_mandos").pw_uid
996
gid = pwd.getpwnam("_mandos").pw_gid
997
except KeyError:
998
try:
999
uid = pwd.getpwnam("mandos").pw_uid
1000
gid = pwd.getpwnam("mandos").pw_gid
1001
except KeyError:
1002
try:
1003
uid = pwd.getpwnam("nobody").pw_uid
1004
gid = pwd.getpwnam("nogroup").pw_gid
1005
except KeyError:
1006
uid = 65534
1007
gid = 65534
1008
try:
1009
os.setuid(uid)
1010
os.setgid(gid)
1011
except OSError, error:
1012
if error[0] != errno.EPERM:
1013
raise error
1014
714
1015
global service
715
1016
service = AvahiService(name = server_settings["servicename"],
716
type = "_mandos._tcp", );
1017
servicetype = "_mandos._tcp", )
717
1018
if server_settings["interface"]:
718
service.interface = if_nametoindex(server_settings["interface"])
1019
service.interface = (if_nametoindex
1020
(server_settings["interface"]))
719
1021
720
1022
global main_loop
721
1023
global bus
724
1026
DBusGMainLoop(set_as_default=True )
725
1027
main_loop = gobject.MainLoop()
726
1028
bus = dbus.SystemBus()
727
server = dbus.Interface(
728
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
729
avahi.DBUS_INTERFACE_SERVER )
1029
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1030
avahi.DBUS_PATH_SERVER),
1031
avahi.DBUS_INTERFACE_SERVER)
730
1032
# End of Avahi example code
731
732
debug = server_settings["debug"]
733
734
if debug:
735
console = logging.StreamHandler()
736
# console.setLevel(logging.DEBUG)
737
console.setFormatter(logging.Formatter\
738
('%(levelname)s: %(message)s'))
739
logger.addHandler(console)
740
del console
741
742
clients = Set()
743
def remove_from_clients(client):
744
clients.remove(client)
745
if not clients:
746
logger.critical(u"No clients left, exiting")
747
sys.exit()
1033
if use_dbus:
1034
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1035
bus)
748
1036
749
1037
clients.update(Set(Client(name = section,
750
stop_hook = remove_from_clients,
751
1038
config
752
= dict(client_config.items(section)))
1039
= dict(client_config.items(section)),
1040
use_dbus = use_dbus)
753
1041
for section in client_config.sections()))
754
755
if not debug:
756
daemon(False, False)
1042
if not clients:
1043
logger.warning(u"No clients defined")
1044
1045
if debug:
1046
# Redirect stdin so all checkers get /dev/null
1047
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1048
os.dup2(null, sys.stdin.fileno())
1049
if null > 2:
1050
os.close(null)
1051
else:
1052
# No console logging
1053
logger.removeHandler(console)
1054
# Close all input and output, do double fork, etc.
1055
daemon()
1056
1057
try:
1058
pid = os.getpid()
1059
pidfile.write(str(pid) + "\n")
1060
pidfile.close()
1061
del pidfile
1062
except IOError:
1063
logger.error(u"Could not write to file %r with PID %d",
1064
pidfilename, pid)
1065
except NameError:
1066
# "pidfile" was never created
1067
pass
1068
del pidfilename
757
1069
758
1070
def cleanup():
759
1071
"Cleanup function; run on exit"
766
1078
767
1079
while clients:
768
1080
client = clients.pop()
769
client.stop_hook = None
770
client.stop()
1081
client.disable_hook = None
1082
client.disable()
771
1083
772
1084
atexit.register(cleanup)
773
1085
776
1088
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
777
1089
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
778
1090
1091
if use_dbus:
1092
class MandosServer(dbus.service.Object):
1093
"""A D-Bus proxy object"""
1094
def __init__(self):
1095
dbus.service.Object.__init__(self, bus,
1096
"/Mandos")
1097
_interface = u"org.mandos_system.Mandos"
1098
1099
@dbus.service.signal(_interface, signature="oa{sv}")
1100
def ClientAdded(self, objpath, properties):
1101
"D-Bus signal"
1102
pass
1103
1104
@dbus.service.signal(_interface, signature="o")
1105
def ClientRemoved(self, objpath):
1106
"D-Bus signal"
1107
pass
1108
1109
@dbus.service.method(_interface, out_signature="ao")
1110
def GetAllClients(self):
1111
return dbus.Array(c.dbus_object_path for c in clients)
1112
1113
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1114
def GetAllClientsWithProperties(self):
1115
return dbus.Dictionary(
1116
((c.dbus_object_path, c.GetAllProperties())
1117
for c in clients),
1118
signature="oa{sv}")
1119
1120
@dbus.service.method(_interface, in_signature="o")
1121
def RemoveClient(self, object_path):
1122
for c in clients:
1123
if c.dbus_object_path == object_path:
1124
clients.remove(c)
1125
# Don't signal anything except ClientRemoved
1126
c.use_dbus = False
1127
c.disable()
1128
# Emit D-Bus signal
1129
self.ClientRemoved(object_path)
1130
return
1131
raise KeyError
1132
@dbus.service.method(_interface)
1133
def Quit(self):
1134
main_loop.quit()
1135
1136
del _interface
1137
1138
mandos_server = MandosServer()
1139
779
1140
for client in clients:
780
client.start()
781
782
tcp_server = IPv6_TCPServer((server_settings["address"],
783
server_settings["port"]),
784
tcp_handler,
785
settings=server_settings,
786
clients=clients)
1141
if use_dbus:
1142
# Emit D-Bus signal
1143
mandos_server.ClientAdded(client.dbus_object_path,
1144
client.GetAllProperties())
1145
client.enable()
1146
1147
tcp_server.enable()
1148
tcp_server.server_activate()
1149
787
1150
# Find out what port we got
788
1151
service.port = tcp_server.socket.getsockname()[1]
789
1152
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
803
1166
804
1167
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
805
1168
lambda *args, **kwargs:
806
tcp_server.handle_request\
807
(*args[2:], **kwargs) or True)
1169
(tcp_server.handle_request
1170
(*args[2:], **kwargs) or True))
808
1171
809
logger.debug("Starting main loop")
810
main_loop_started = True
1172
logger.debug(u"Starting main loop")
811
1173
main_loop.run()
812
1174
except AvahiError, error:
813
logger.critical(u"AvahiError: %s" + unicode(error))
1175
logger.critical(u"AvahiError: %s", error)
814
1176
sys.exit(1)
815
1177
except KeyboardInterrupt:
816
1178
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0