To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 276
- compare with another revision
- download diff
- download tarball
- view history from revision 276
- Committer: Teddy Hogeborn
- Date: 2009-01-18 00:18:50 UTC
- Revision ID: teddy@fukt.bsnet.se-20090118001850-pvg8xjwmbyt23fom
* debian/rules (install-indep): Removed "--no-start" from
dh_installinit.
dh_installinit.
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- plugins.d/usplash
- files renamed:
- plugins.d/password-request.c => plugins.d/mandos-client.c
- plugins.d/password-request.xml => plugins.d/mandos-client.xml
- files modified:
- Makefile
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
24
25
# GNU General Public License for more details.
25
26
#
26
27
# You should have received a copy of the GNU General Public License
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
28
30
#
29
31
# Contact the authors at <mandos@fukt.bsnet.se>.
30
32
#
31
33
32
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
33
35
34
36
import SocketServer
35
37
import socket
36
import select
37
from optparse import OptionParser
38
import optparse
38
39
import datetime
39
40
import errno
40
41
import gnutls.crypto
54
55
import stat
55
56
import logging
56
57
import logging.handlers
58
import pwd
59
from contextlib import closing
57
60
58
61
import dbus
62
import dbus.service
59
63
import gobject
60
64
import avahi
61
65
from dbus.mainloop.glib import DBusGMainLoop
62
66
import ctypes
67
import ctypes.util
63
68
64
version = "1.0"
69
version = "1.0.5"
65
70
66
71
logger = logging.Logger('mandos')
67
syslogger = logging.handlers.SysLogHandler\
68
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
69
address = "/dev/log")
70
syslogger.setFormatter(logging.Formatter\
71
('Mandos: %(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
72
77
logger.addHandler(syslogger)
73
78
74
79
console = logging.StreamHandler()
77
82
logger.addHandler(console)
78
83
79
84
class AvahiError(Exception):
80
def __init__(self, value):
85
def __init__(self, value, *args, **kwargs):
81
86
self.value = value
82
def __str__(self):
83
return repr(self.value)
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
84
90
85
91
class AvahiServiceError(AvahiError):
86
92
pass
106
112
a sensible number of times
107
113
"""
108
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
109
type = None, port = None, TXT = None, domain = "",
110
host = "", max_renames = 32768):
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
111
117
self.interface = interface
112
118
self.name = name
113
self.type = type
119
self.type = servicetype
114
120
self.port = port
115
if TXT is None:
116
self.TXT = []
117
else:
118
self.TXT = TXT
121
self.TXT = TXT if TXT is not None else []
119
122
self.domain = domain
120
123
self.host = host
121
124
self.rename_count = 0
123
126
def rename(self):
124
127
"""Derived from the Avahi example code"""
125
128
if self.rename_count >= self.max_renames:
126
logger.critical(u"No suitable service name found after %i"
127
u" retries, exiting.", rename_count)
128
raise AvahiServiceError("Too many renames")
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
129
133
self.name = server.GetAlternativeServiceName(self.name)
130
logger.info(u"Changing name to %r ...", str(self.name))
131
syslogger.setFormatter(logging.Formatter\
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
132
137
('Mandos (%s): %%(levelname)s:'
133
' %%(message)s' % self.name))
138
' %%(message)s' % self.name))
134
139
self.remove()
135
140
self.add()
136
141
self.rename_count += 1
142
147
"""Derived from the Avahi example code"""
143
148
global group
144
149
if group is None:
145
group = dbus.Interface\
146
(bus.get_object(avahi.DBUS_NAME,
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
147
152
server.EntryGroupNew()),
148
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
149
154
group.connect_to_signal('StateChanged',
150
155
entry_group_state_changed)
151
logger.debug(u"Adding service '%s' of type '%s' ...",
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
152
157
service.name, service.type)
153
158
group.AddService(
154
159
self.interface, # interface
165
170
# End of Avahi example code
166
171
167
172
168
class Client(object):
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
169
179
"""A representation of a client host served by this server.
170
180
Attributes:
171
name: string; from the config file, used in log messages
181
name: string; from the config file, used in log messages
172
182
fingerprint: string (40 or 32 hexadecimal digits); used to
173
183
uniquely identify the client
174
secret: bytestring; sent verbatim (over TLS) to client
175
host: string; available for use by the checker command
176
created: datetime.datetime(); object creation, not client host
177
last_checked_ok: datetime.datetime() or None if not yet checked OK
178
timeout: datetime.timedelta(); How long from last_checked_ok
179
until this client is invalid
180
interval: datetime.timedelta(); How often to start a new checker
181
stop_hook: If set, called by stop() as stop_hook(self)
182
checker: subprocess.Popen(); a running checker process used
183
to see if the client lives.
184
'None' if no process is running.
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
185
197
checker_initiator_tag: a gobject event source tag, or None
186
stop_initiator_tag: - '' -
198
disable_initiator_tag: - '' -
187
199
checker_callback_tag: - '' -
188
200
checker_command: string; External command which is run to check if
189
201
client lives. %() expansions are done at
190
202
runtime with vars(self) as dict, so that for
191
203
instance %(name)s can be used in the command.
192
Private attibutes:
193
_timeout: Real variable for 'timeout'
194
_interval: Real variable for 'interval'
195
_timeout_milliseconds: Used when calling gobject.timeout_add()
196
_interval_milliseconds: - '' -
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
197
206
"""
198
def _set_timeout(self, timeout):
199
"Setter function for 'timeout' attribute"
200
self._timeout = timeout
201
self._timeout_milliseconds = ((self.timeout.days
202
* 24 * 60 * 60 * 1000)
203
+ (self.timeout.seconds * 1000)
204
+ (self.timeout.microseconds
205
// 1000))
206
timeout = property(lambda self: self._timeout,
207
_set_timeout)
208
del _set_timeout
209
def _set_interval(self, interval):
210
"Setter function for 'interval' attribute"
211
self._interval = interval
212
self._interval_milliseconds = ((self.interval.days
213
* 24 * 60 * 60 * 1000)
214
+ (self.interval.seconds
215
* 1000)
216
+ (self.interval.microseconds
217
// 1000))
218
interval = property(lambda self: self._interval,
219
_set_interval)
220
del _set_interval
221
def __init__(self, name = None, stop_hook=None, config={}):
207
def timeout_milliseconds(self):
208
"Return the 'timeout' attribute in milliseconds"
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
212
213
def interval_milliseconds(self):
214
"Return the 'interval' attribute in milliseconds"
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
218
219
def __init__(self, name = None, disable_hook=None, config=None,
220
use_dbus=True):
222
221
"""Note: the 'checker' key in 'config' sets the
223
222
'checker_command' attribute and *not* the 'checker'
224
223
attribute."""
225
224
self.name = name
225
if config is None:
226
config = {}
226
227
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
229
if self.use_dbus:
230
self.dbus_object_path = (dbus.ObjectPath
231
("/Mandos/clients/"
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
227
235
# Uppercase and remove spaces from fingerprint for later
228
236
# comparison purposes with return value from the fingerprint()
229
237
# function
230
self.fingerprint = config["fingerprint"].upper()\
231
.replace(u" ", u"")
238
self.fingerprint = (config["fingerprint"].upper()
239
.replace(u" ", u""))
232
240
logger.debug(u" Fingerprint: %s", self.fingerprint)
233
241
if "secret" in config:
234
242
self.secret = config["secret"].decode(u"base64")
235
243
elif "secfile" in config:
236
sf = open(config["secfile"])
237
self.secret = sf.read()
238
sf.close()
244
with closing(open(os.path.expanduser
245
(os.path.expandvars
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
239
248
else:
240
249
raise TypeError(u"No secret or secfile for client %s"
241
250
% self.name)
242
251
self.host = config.get("host", "")
243
self.created = datetime.datetime.now()
252
self.created = datetime.datetime.utcnow()
253
self.enabled = False
254
self.last_enabled = None
244
255
self.last_checked_ok = None
245
256
self.timeout = string_to_delta(config["timeout"])
246
257
self.interval = string_to_delta(config["interval"])
247
self.stop_hook = stop_hook
258
self.disable_hook = disable_hook
248
259
self.checker = None
249
260
self.checker_initiator_tag = None
250
self.stop_initiator_tag = None
261
self.disable_initiator_tag = None
251
262
self.checker_callback_tag = None
252
self.check_command = config["checker"]
253
def start(self):
263
self.checker_command = config["checker"]
264
265
def enable(self):
254
266
"""Start this client's checker and timeout hooks"""
267
self.last_enabled = datetime.datetime.utcnow()
255
268
# Schedule a new checker to be started an 'interval' from now,
256
269
# and every interval from then on.
257
self.checker_initiator_tag = gobject.timeout_add\
258
(self._interval_milliseconds,
259
self.start_checker)
270
self.checker_initiator_tag = (gobject.timeout_add
271
(self.interval_milliseconds(),
272
self.start_checker))
260
273
# Also start a new checker *right now*.
261
274
self.start_checker()
262
# Schedule a stop() when 'timeout' has passed
263
self.stop_initiator_tag = gobject.timeout_add\
264
(self._timeout_milliseconds,
265
self.stop)
266
def stop(self):
267
"""Stop this client.
268
The possibility that a client might be restarted is left open,
269
but not currently used."""
270
# If this client doesn't have a secret, it is already stopped.
271
if hasattr(self, "secret") and self.secret:
272
logger.info(u"Stopping client %s", self.name)
273
self.secret = None
274
else:
275
# Schedule a disable() when 'timeout' has passed
276
self.disable_initiator_tag = (gobject.timeout_add
277
(self.timeout_milliseconds(),
278
self.disable))
279
self.enabled = True
280
if self.use_dbus:
281
# Emit D-Bus signals
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
286
variant_level=1)))
287
288
def disable(self):
289
"""Disable this client."""
290
if not getattr(self, "enabled", False):
275
291
return False
276
if getattr(self, "stop_initiator_tag", False):
277
gobject.source_remove(self.stop_initiator_tag)
278
self.stop_initiator_tag = None
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
294
gobject.source_remove(self.disable_initiator_tag)
295
self.disable_initiator_tag = None
279
296
if getattr(self, "checker_initiator_tag", False):
280
297
gobject.source_remove(self.checker_initiator_tag)
281
298
self.checker_initiator_tag = None
282
299
self.stop_checker()
283
if self.stop_hook:
284
self.stop_hook(self)
300
if self.disable_hook:
301
self.disable_hook(self)
302
self.enabled = False
303
if self.use_dbus:
304
# Emit D-Bus signal
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
285
307
# Do not run this again if called by a gobject.timeout_add
286
308
return False
309
287
310
def __del__(self):
288
self.stop_hook = None
289
self.stop()
290
def checker_callback(self, pid, condition):
311
self.disable_hook = None
312
self.disable()
313
314
def checker_callback(self, pid, condition, command):
291
315
"""The checker has completed, so take appropriate actions."""
292
now = datetime.datetime.now()
293
316
self.checker_callback_tag = None
294
317
self.checker = None
295
if os.WIFEXITED(condition) \
296
and (os.WEXITSTATUS(condition) == 0):
318
if self.use_dbus:
319
# Emit D-Bus signal
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
297
324
logger.info(u"Checker for %(name)s succeeded",
298
325
vars(self))
299
self.last_checked_ok = now
300
gobject.source_remove(self.stop_initiator_tag)
301
self.stop_initiator_tag = gobject.timeout_add\
302
(self._timeout_milliseconds,
303
self.stop)
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
331
self.bump_timeout()
304
332
elif not os.WIFEXITED(condition):
305
333
logger.warning(u"Checker for %(name)s crashed?",
306
334
vars(self))
335
if self.use_dbus:
336
# Emit D-Bus signal
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
307
340
else:
308
341
logger.info(u"Checker for %(name)s failed",
309
342
vars(self))
343
if self.use_dbus:
344
# Emit D-Bus signal
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
348
349
def bump_timeout(self):
350
"""Bump up the timeout for this client.
351
This should only be called when the client has been seen,
352
alive and well.
353
"""
354
self.last_checked_ok = datetime.datetime.utcnow()
355
gobject.source_remove(self.disable_initiator_tag)
356
self.disable_initiator_tag = (gobject.timeout_add
357
(self.timeout_milliseconds(),
358
self.disable))
359
if self.use_dbus:
360
# Emit D-Bus signal
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
364
variant_level=1)))
365
310
366
def start_checker(self):
311
367
"""Start a new checker subprocess if one is not running.
312
368
If a checker already exists, leave it running and do
321
377
# is as it should be.
322
378
if self.checker is None:
323
379
try:
324
# In case check_command has exactly one % operator
325
command = self.check_command % self.host
380
# In case checker_command has exactly one % operator
381
command = self.checker_command % self.host
326
382
except TypeError:
327
383
# Escape attributes for the shell
328
384
escaped_attrs = dict((key, re.escape(str(val)))
329
385
for key, val in
330
386
vars(self).iteritems())
331
387
try:
332
command = self.check_command % escaped_attrs
388
command = self.checker_command % escaped_attrs
333
389
except TypeError, error:
334
390
logger.error(u'Could not format string "%s":'
335
u' %s', self.check_command, error)
391
u' %s', self.checker_command, error)
336
392
return True # Try again later
337
393
try:
338
394
logger.info(u"Starting checker %r for %s",
344
400
self.checker = subprocess.Popen(command,
345
401
close_fds=True,
346
402
shell=True, cwd="/")
347
self.checker_callback_tag = gobject.child_watch_add\
348
(self.checker.pid,
349
self.checker_callback)
403
if self.use_dbus:
404
# Emit D-Bus signal
405
self.CheckerStarted(command)
406
self.PropertyChanged(
407
dbus.String("checker_running"),
408
dbus.Boolean(True, variant_level=1))
409
self.checker_callback_tag = (gobject.child_watch_add
410
(self.checker.pid,
411
self.checker_callback,
412
data=command))
350
413
except OSError, error:
351
414
logger.error(u"Failed to start subprocess: %s",
352
415
error)
353
416
# Re-run this periodically if run by gobject.timeout_add
354
417
return True
418
355
419
def stop_checker(self):
356
420
"""Force the checker process, if any, to stop."""
357
421
if self.checker_callback_tag:
369
433
if error.errno != errno.ESRCH: # No such process
370
434
raise
371
435
self.checker = None
436
if self.use_dbus:
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
439
372
440
def still_valid(self):
373
441
"""Has the timeout not yet passed for this client?"""
374
now = datetime.datetime.now()
442
if not getattr(self, "enabled", False):
443
return False
444
now = datetime.datetime.utcnow()
375
445
if self.last_checked_ok is None:
376
446
return now < (self.created + self.timeout)
377
447
else:
378
448
return now < (self.last_checked_ok + self.timeout)
449
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
452
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
456
457
# CheckerCompleted - signal
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
460
"D-Bus signal"
461
pass
462
463
# CheckerStarted - signal
464
@dbus.service.signal(_interface, signature="s")
465
def CheckerStarted(self, command):
466
"D-Bus signal"
467
pass
468
469
# GetAllProperties - method
470
@dbus.service.method(_interface, out_signature="a{sv}")
471
def GetAllProperties(self):
472
"D-Bus method"
473
return dbus.Dictionary({
474
dbus.String("name"):
475
dbus.String(self.name, variant_level=1),
476
dbus.String("fingerprint"):
477
dbus.String(self.fingerprint, variant_level=1),
478
dbus.String("host"):
479
dbus.String(self.host, variant_level=1),
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
484
variant_level=1)
485
if self.last_enabled is not None
486
else dbus.Boolean(False, variant_level=1)),
487
dbus.String("enabled"):
488
dbus.Boolean(self.enabled, variant_level=1),
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
491
variant_level=1)
492
if self.last_checked_ok is not None
493
else dbus.Boolean (False, variant_level=1)),
494
dbus.String("timeout"):
495
dbus.UInt64(self.timeout_milliseconds(),
496
variant_level=1),
497
dbus.String("interval"):
498
dbus.UInt64(self.interval_milliseconds(),
499
variant_level=1),
500
dbus.String("checker"):
501
dbus.String(self.checker_command,
502
variant_level=1),
503
dbus.String("checker_running"):
504
dbus.Boolean(self.checker is not None,
505
variant_level=1),
506
}, signature="sv")
507
508
# IsStillValid - method
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
510
(still_valid))
511
IsStillValid.__name__ = "IsStillValid"
512
513
# PropertyChanged - signal
514
@dbus.service.signal(_interface, signature="sv")
515
def PropertyChanged(self, property, value):
516
"D-Bus signal"
517
pass
518
519
# SetChecker - method
520
@dbus.service.method(_interface, in_signature="s")
521
def SetChecker(self, checker):
522
"D-Bus setter method"
523
self.checker_command = checker
524
# Emit D-Bus signal
525
self.PropertyChanged(dbus.String(u"checker"),
526
dbus.String(self.checker_command,
527
variant_level=1))
528
529
# SetHost - method
530
@dbus.service.method(_interface, in_signature="s")
531
def SetHost(self, host):
532
"D-Bus setter method"
533
self.host = host
534
# Emit D-Bus signal
535
self.PropertyChanged(dbus.String(u"host"),
536
dbus.String(self.host, variant_level=1))
537
538
# SetInterval - method
539
@dbus.service.method(_interface, in_signature="t")
540
def SetInterval(self, milliseconds):
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
542
# Emit D-Bus signal
543
self.PropertyChanged(dbus.String(u"interval"),
544
(dbus.UInt64(self.interval_milliseconds(),
545
variant_level=1)))
546
547
# SetSecret - method
548
@dbus.service.method(_interface, in_signature="ay",
549
byte_arrays=True)
550
def SetSecret(self, secret):
551
"D-Bus setter method"
552
self.secret = str(secret)
553
554
# SetTimeout - method
555
@dbus.service.method(_interface, in_signature="t")
556
def SetTimeout(self, milliseconds):
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
558
# Emit D-Bus signal
559
self.PropertyChanged(dbus.String(u"timeout"),
560
(dbus.UInt64(self.timeout_milliseconds(),
561
variant_level=1)))
562
563
# Enable - method
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
566
567
# StartChecker - method
568
@dbus.service.method(_interface)
569
def StartChecker(self):
570
"D-Bus method"
571
self.start_checker()
572
573
# Disable - method
574
@dbus.service.method(_interface)
575
def Disable(self):
576
"D-Bus method"
577
self.disable()
578
579
# StopChecker - method
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
582
583
del _interface
379
584
380
585
381
586
def peer_certificate(session):
382
587
"Return the peer's OpenPGP certificate as a bytestring"
383
588
# If not an OpenPGP certificate...
384
if gnutls.library.functions.gnutls_certificate_type_get\
385
(session._c_object) \
386
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
387
592
# ...do the normal thing
388
593
return session.peer_certificate
389
594
list_size = ctypes.c_uint()
390
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
391
(session._c_object, ctypes.byref(list_size))
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
392
598
if list_size.value == 0:
393
599
return None
394
600
cert = cert_list[0]
398
604
def fingerprint(openpgp):
399
605
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
400
606
# New GnuTLS "datum" with the OpenPGP public key
401
datum = gnutls.library.types.gnutls_datum_t\
402
(ctypes.cast(ctypes.c_char_p(openpgp),
403
ctypes.POINTER(ctypes.c_ubyte)),
404
ctypes.c_uint(len(openpgp)))
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
609
ctypes.POINTER
610
(ctypes.c_ubyte)),
611
ctypes.c_uint(len(openpgp))))
405
612
# New empty GnuTLS certificate
406
613
crt = gnutls.library.types.gnutls_openpgp_crt_t()
407
gnutls.library.functions.gnutls_openpgp_crt_init\
408
(ctypes.byref(crt))
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
409
616
# Import the OpenPGP public key into the certificate
410
gnutls.library.functions.gnutls_openpgp_crt_import\
411
(crt, ctypes.byref(datum),
412
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
413
621
# Verify the self signature in the key
414
crtverify = ctypes.c_uint();
415
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
416
(crt, ctypes.c_uint(0), ctypes.byref(crtverify))
622
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
417
625
if crtverify.value != 0:
418
626
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
419
627
raise gnutls.errors.CertificateSecurityError("Verify failed")
420
628
# New buffer for the fingerprint
421
buffer = ctypes.create_string_buffer(20)
422
buffer_length = ctypes.c_size_t()
629
buf = ctypes.create_string_buffer(20)
630
buf_len = ctypes.c_size_t()
423
631
# Get the fingerprint from the certificate into the buffer
424
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
425
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
426
635
# Deinit the certificate
427
636
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
428
637
# Convert the buffer to a Python bytestring
429
fpr = ctypes.string_at(buffer, buffer_length.value)
638
fpr = ctypes.string_at(buf, buf_len.value)
430
639
# Convert the bytestring to hexadecimal notation
431
640
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
432
641
return hex_fpr
433
642
434
643
435
class tcp_handler(SocketServer.BaseRequestHandler, object):
644
class TCP_handler(SocketServer.BaseRequestHandler, object):
436
645
"""A TCP request handler class.
437
646
Instantiated by IPv6_TCPServer for each request to handle it.
438
647
Note: This will run in its own forked process."""
439
648
440
649
def handle(self):
441
650
logger.info(u"TCP connection from: %s",
442
unicode(self.client_address))
443
session = gnutls.connection.ClientSession\
444
(self.request, gnutls.connection.X509Credentials())
651
unicode(self.client_address))
652
session = (gnutls.connection
653
.ClientSession(self.request,
654
gnutls.connection
655
.X509Credentials()))
445
656
446
657
line = self.request.makefile().readline()
447
658
logger.debug(u"Protocol version: %r", line)
460
671
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
461
672
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
462
673
# "+DHE-DSS"))
463
priority = "NORMAL" # Fallback default, since this
464
# MUST be set.
465
if self.server.settings["priority"]:
466
priority = self.server.settings["priority"]
467
gnutls.library.functions.gnutls_priority_set_direct\
468
(session._c_object, priority, None);
674
# Use a fallback default, since this MUST be set.
675
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
678
priority, None))
469
679
470
680
try:
471
681
session.handshake()
481
691
session.bye()
482
692
return
483
693
logger.debug(u"Fingerprint: %s", fpr)
484
client = None
485
694
for c in self.server.clients:
486
695
if c.fingerprint == fpr:
487
696
client = c
488
697
break
489
if not client:
698
else:
490
699
logger.warning(u"Client not found for fingerprint: %s",
491
700
fpr)
492
701
session.bye()
499
708
vars(client))
500
709
session.bye()
501
710
return
711
## This won't work here, since we're in a fork.
712
# client.bump_timeout()
502
713
sent_size = 0
503
714
while sent_size < len(client.secret):
504
715
sent = session.send(client.secret[sent_size:])
509
720
session.bye()
510
721
511
722
512
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
724
SocketServer.TCPServer, object):
513
725
"""IPv6 TCP server. Accepts 'None' as address and/or port.
514
726
Attributes:
515
727
settings: Server settings
516
728
clients: Set() of Client objects
729
enabled: Boolean; whether this server is activated yet
517
730
"""
518
731
address_family = socket.AF_INET6
519
732
def __init__(self, *args, **kwargs):
523
736
if "clients" in kwargs:
524
737
self.clients = kwargs["clients"]
525
738
del kwargs["clients"]
526
return super(type(self), self).__init__(*args, **kwargs)
739
self.enabled = False
740
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
527
741
def server_bind(self):
528
742
"""This overrides the normal server_bind() function
529
743
to bind to an interface if one was specified, and also NOT to
558
772
# if_nametoindex
559
773
# (self.settings
560
774
# ["interface"]))
561
return super(type(self), self).server_bind()
775
return super(IPv6_TCPServer, self).server_bind()
776
def server_activate(self):
777
if self.enabled:
778
return super(IPv6_TCPServer, self).server_activate()
779
def enable(self):
780
self.enabled = True
562
781
563
782
564
783
def string_to_delta(interval):
580
799
timevalue = datetime.timedelta(0)
581
800
for s in interval.split():
582
801
try:
583
suffix=unicode(s[-1])
584
value=int(s[:-1])
802
suffix = unicode(s[-1])
803
value = int(s[:-1])
585
804
if suffix == u"d":
586
805
delta = datetime.timedelta(value)
587
806
elif suffix == u"s":
603
822
def server_state_changed(state):
604
823
"""Derived from the Avahi example code"""
605
824
if state == avahi.SERVER_COLLISION:
606
logger.error(u"Server name collision")
825
logger.error(u"Zeroconf server name collision")
607
826
service.remove()
608
827
elif state == avahi.SERVER_RUNNING:
609
828
service.add()
611
830
612
831
def entry_group_state_changed(state, error):
613
832
"""Derived from the Avahi example code"""
614
logger.debug(u"state change: %i", state)
833
logger.debug(u"Avahi state change: %i", state)
615
834
616
835
if state == avahi.ENTRY_GROUP_ESTABLISHED:
617
logger.debug(u"Service established.")
836
logger.debug(u"Zeroconf service established.")
618
837
elif state == avahi.ENTRY_GROUP_COLLISION:
619
logger.warning(u"Service name collision.")
838
logger.warning(u"Zeroconf service name collision.")
620
839
service.rename()
621
840
elif state == avahi.ENTRY_GROUP_FAILURE:
622
logger.critical(u"Error in group state changed %s",
841
logger.critical(u"Avahi: Error in group state changed %s",
623
842
unicode(error))
624
raise AvahiGroupError("State changed: %s", str(error))
843
raise AvahiGroupError(u"State changed: %s" % unicode(error))
625
844
626
845
def if_nametoindex(interface):
627
846
"""Call the C function if_nametoindex(), or equivalent"""
628
847
global if_nametoindex
629
848
try:
630
if "ctypes.util" not in sys.modules:
631
import ctypes.util
632
if_nametoindex = ctypes.cdll.LoadLibrary\
633
(ctypes.util.find_library("c")).if_nametoindex
849
if_nametoindex = (ctypes.cdll.LoadLibrary
850
(ctypes.util.find_library("c"))
851
.if_nametoindex)
634
852
except (OSError, AttributeError):
635
853
if "struct" not in sys.modules:
636
854
import struct
639
857
def if_nametoindex(interface):
640
858
"Get an interface index the hard way, i.e. using fcntl()"
641
859
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
642
s = socket.socket()
643
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
644
struct.pack("16s16x", interface))
645
s.close()
860
with closing(socket.socket()) as s:
861
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
862
struct.pack("16s16x", interface))
646
863
interface_index = struct.unpack("I", ifreq[16:20])[0]
647
864
return interface_index
648
865
return if_nametoindex(interface)
672
889
673
890
674
891
def main():
675
global main_loop_started
676
main_loop_started = False
677
678
parser = OptionParser(version = "%%prog %s" % version)
892
parser = optparse.OptionParser(version = "%%prog %s" % version)
679
893
parser.add_option("-i", "--interface", type="string",
680
894
metavar="IF", help="Bind to interface IF")
681
895
parser.add_option("-a", "--address", type="string",
682
896
help="Address to listen for requests on")
683
897
parser.add_option("-p", "--port", type="int",
684
898
help="Port number to receive requests on")
685
parser.add_option("--check", action="store_true", default=False,
899
parser.add_option("--check", action="store_true",
686
900
help="Run self-test")
687
901
parser.add_option("--debug", action="store_true",
688
902
help="Debug mode; run in foreground and log to"
695
909
default="/etc/mandos", metavar="DIR",
696
910
help="Directory to search for configuration"
697
911
" files")
698
(options, args) = parser.parse_args()
912
parser.add_option("--no-dbus", action="store_false",
913
dest="use_dbus",
914
help="Do not provide D-Bus system bus"
915
" interface")
916
options = parser.parse_args()[0]
699
917
700
918
if options.check:
701
919
import doctest
710
928
"priority":
711
929
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
712
930
"servicename": "Mandos",
931
"use_dbus": "True",
713
932
}
714
933
715
934
# Parse config file for server-global settings
718
937
server_config.read(os.path.join(options.configdir, "mandos.conf"))
719
938
# Convert the SafeConfigParser object to a dict
720
939
server_settings = server_config.defaults()
721
# Use getboolean on the boolean config option
722
server_settings["debug"] = server_config.getboolean\
723
("DEFAULT", "debug")
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
724
945
del server_config
725
946
726
947
# Override the settings from the config file with command line
727
948
# options, if set.
728
949
for option in ("interface", "address", "port", "debug",
729
"priority", "servicename", "configdir"):
950
"priority", "servicename", "configdir",
951
"use_dbus"):
730
952
value = getattr(options, option)
731
953
if value is not None:
732
954
server_settings[option] = value
733
955
del options
734
956
# Now we have our good server settings in "server_settings"
735
957
958
# For convenience
736
959
debug = server_settings["debug"]
960
use_dbus = server_settings["use_dbus"]
737
961
738
962
if not debug:
739
963
syslogger.setLevel(logging.WARNING)
740
964
console.setLevel(logging.WARNING)
741
965
742
966
if server_settings["servicename"] != "Mandos":
743
syslogger.setFormatter(logging.Formatter\
967
syslogger.setFormatter(logging.Formatter
744
968
('Mandos (%s): %%(levelname)s:'
745
969
' %%(message)s'
746
970
% server_settings["servicename"]))
748
972
# Parse config file with clients
749
973
client_defaults = { "timeout": "1h",
750
974
"interval": "5m",
751
"checker": "fping -q -- %(host)s",
975
"checker": "fping -q -- %%(host)s",
752
976
"host": "",
753
977
}
754
978
client_config = ConfigParser.SafeConfigParser(client_defaults)
755
979
client_config.read(os.path.join(server_settings["configdir"],
756
980
"clients.conf"))
757
981
982
clients = Set()
983
tcp_server = IPv6_TCPServer((server_settings["address"],
984
server_settings["port"]),
985
TCP_handler,
986
settings=server_settings,
987
clients=clients)
988
pidfilename = "/var/run/mandos.pid"
989
try:
990
pidfile = open(pidfilename, "w")
991
except IOError, error:
992
logger.error("Could not open file %r", pidfilename)
993
994
try:
995
uid = pwd.getpwnam("_mandos").pw_uid
996
gid = pwd.getpwnam("_mandos").pw_gid
997
except KeyError:
998
try:
999
uid = pwd.getpwnam("mandos").pw_uid
1000
gid = pwd.getpwnam("mandos").pw_gid
1001
except KeyError:
1002
try:
1003
uid = pwd.getpwnam("nobody").pw_uid
1004
gid = pwd.getpwnam("nogroup").pw_gid
1005
except KeyError:
1006
uid = 65534
1007
gid = 65534
1008
try:
1009
os.setuid(uid)
1010
os.setgid(gid)
1011
except OSError, error:
1012
if error[0] != errno.EPERM:
1013
raise error
1014
758
1015
global service
759
1016
service = AvahiService(name = server_settings["servicename"],
760
type = "_mandos._tcp", );
1017
servicetype = "_mandos._tcp", )
761
1018
if server_settings["interface"]:
762
service.interface = if_nametoindex(server_settings["interface"])
1019
service.interface = (if_nametoindex
1020
(server_settings["interface"]))
763
1021
764
1022
global main_loop
765
1023
global bus
768
1026
DBusGMainLoop(set_as_default=True )
769
1027
main_loop = gobject.MainLoop()
770
1028
bus = dbus.SystemBus()
771
server = dbus.Interface(
772
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
773
avahi.DBUS_INTERFACE_SERVER )
1029
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1030
avahi.DBUS_PATH_SERVER),
1031
avahi.DBUS_INTERFACE_SERVER)
774
1032
# End of Avahi example code
775
776
clients = Set()
777
def remove_from_clients(client):
778
clients.remove(client)
779
if not clients:
780
logger.critical(u"No clients left, exiting")
781
sys.exit()
1033
if use_dbus:
1034
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1035
bus)
782
1036
783
1037
clients.update(Set(Client(name = section,
784
stop_hook = remove_from_clients,
785
1038
config
786
= dict(client_config.items(section)))
1039
= dict(client_config.items(section)),
1040
use_dbus = use_dbus)
787
1041
for section in client_config.sections()))
788
1042
if not clients:
789
logger.critical(u"No clients defined")
790
sys.exit(1)
1043
logger.warning(u"No clients defined")
791
1044
792
1045
if debug:
793
1046
# Redirect stdin so all checkers get /dev/null
801
1054
# Close all input and output, do double fork, etc.
802
1055
daemon()
803
1056
804
pidfilename = "/var/run/mandos/mandos.pid"
805
pid = os.getpid()
806
1057
try:
807
pidfile = open(pidfilename, "w")
1058
pid = os.getpid()
808
1059
pidfile.write(str(pid) + "\n")
809
1060
pidfile.close()
810
1061
del pidfile
811
except IOError, err:
812
logger.error(u"Could not write %s file with PID %d",
813
pidfilename, os.getpid())
1062
except IOError:
1063
logger.error(u"Could not write to file %r with PID %d",
1064
pidfilename, pid)
1065
except NameError:
1066
# "pidfile" was never created
1067
pass
1068
del pidfilename
814
1069
815
1070
def cleanup():
816
1071
"Cleanup function; run on exit"
823
1078
824
1079
while clients:
825
1080
client = clients.pop()
826
client.stop_hook = None
827
client.stop()
1081
client.disable_hook = None
1082
client.disable()
828
1083
829
1084
atexit.register(cleanup)
830
1085
833
1088
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
834
1089
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
835
1090
1091
if use_dbus:
1092
class MandosServer(dbus.service.Object):
1093
"""A D-Bus proxy object"""
1094
def __init__(self):
1095
dbus.service.Object.__init__(self, bus,
1096
"/Mandos")
1097
_interface = u"org.mandos_system.Mandos"
1098
1099
@dbus.service.signal(_interface, signature="oa{sv}")
1100
def ClientAdded(self, objpath, properties):
1101
"D-Bus signal"
1102
pass
1103
1104
@dbus.service.signal(_interface, signature="o")
1105
def ClientRemoved(self, objpath):
1106
"D-Bus signal"
1107
pass
1108
1109
@dbus.service.method(_interface, out_signature="ao")
1110
def GetAllClients(self):
1111
return dbus.Array(c.dbus_object_path for c in clients)
1112
1113
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1114
def GetAllClientsWithProperties(self):
1115
return dbus.Dictionary(
1116
((c.dbus_object_path, c.GetAllProperties())
1117
for c in clients),
1118
signature="oa{sv}")
1119
1120
@dbus.service.method(_interface, in_signature="o")
1121
def RemoveClient(self, object_path):
1122
for c in clients:
1123
if c.dbus_object_path == object_path:
1124
clients.remove(c)
1125
# Don't signal anything except ClientRemoved
1126
c.use_dbus = False
1127
c.disable()
1128
# Emit D-Bus signal
1129
self.ClientRemoved(object_path)
1130
return
1131
raise KeyError
1132
@dbus.service.method(_interface)
1133
def Quit(self):
1134
main_loop.quit()
1135
1136
del _interface
1137
1138
mandos_server = MandosServer()
1139
836
1140
for client in clients:
837
client.start()
838
839
tcp_server = IPv6_TCPServer((server_settings["address"],
840
server_settings["port"]),
841
tcp_handler,
842
settings=server_settings,
843
clients=clients)
1141
if use_dbus:
1142
# Emit D-Bus signal
1143
mandos_server.ClientAdded(client.dbus_object_path,
1144
client.GetAllProperties())
1145
client.enable()
1146
1147
tcp_server.enable()
1148
tcp_server.server_activate()
1149
844
1150
# Find out what port we got
845
1151
service.port = tcp_server.socket.getsockname()[1]
846
1152
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
860
1166
861
1167
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
862
1168
lambda *args, **kwargs:
863
tcp_server.handle_request\
864
(*args[2:], **kwargs) or True)
1169
(tcp_server.handle_request
1170
(*args[2:], **kwargs) or True))
865
1171
866
1172
logger.debug(u"Starting main loop")
867
main_loop_started = True
868
1173
main_loop.run()
869
1174
except AvahiError, error:
870
logger.critical(u"AvahiError: %s" + unicode(error))
1175
logger.critical(u"AvahiError: %s", error)
871
1176
sys.exit(1)
872
1177
except KeyboardInterrupt:
873
1178
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0