To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 276
- compare with another revision
- download diff
- download tarball
- view history from revision 276
- Committer: Teddy Hogeborn
- Date: 2009-01-18 00:18:50 UTC
- Revision ID: teddy@fukt.bsnet.se-20090118001850-pvg8xjwmbyt23fom
* debian/rules (install-indep): Removed "--no-start" from
dh_installinit.
dh_installinit.
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- plugins.d/usplash
- files renamed:
- plugins.d/password-request.c => plugins.d/mandos-client.c
- plugins.d/password-request.xml => plugins.d/mandos-client.xml
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
30
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
32
#
32
33
33
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
34
35
35
36
import SocketServer
36
37
import socket
37
import select
38
from optparse import OptionParser
38
import optparse
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
55
55
import stat
56
56
import logging
57
57
import logging.handlers
58
import pwd
59
from contextlib import closing
58
60
59
61
import dbus
62
import dbus.service
60
63
import gobject
61
64
import avahi
62
65
from dbus.mainloop.glib import DBusGMainLoop
63
66
import ctypes
67
import ctypes.util
64
68
65
version = "1.0"
69
version = "1.0.5"
66
70
67
71
logger = logging.Logger('mandos')
68
syslogger = logging.handlers.SysLogHandler\
69
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
70
address = "/dev/log")
71
syslogger.setFormatter(logging.Formatter\
72
('Mandos: %(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
73
77
logger.addHandler(syslogger)
74
78
75
79
console = logging.StreamHandler()
78
82
logger.addHandler(console)
79
83
80
84
class AvahiError(Exception):
81
def __init__(self, value):
85
def __init__(self, value, *args, **kwargs):
82
86
self.value = value
83
def __str__(self):
84
return repr(self.value)
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
85
90
86
91
class AvahiServiceError(AvahiError):
87
92
pass
107
112
a sensible number of times
108
113
"""
109
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
110
type = None, port = None, TXT = None, domain = "",
111
host = "", max_renames = 32768):
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
112
117
self.interface = interface
113
118
self.name = name
114
self.type = type
119
self.type = servicetype
115
120
self.port = port
116
if TXT is None:
117
self.TXT = []
118
else:
119
self.TXT = TXT
121
self.TXT = TXT if TXT is not None else []
120
122
self.domain = domain
121
123
self.host = host
122
124
self.rename_count = 0
126
128
if self.rename_count >= self.max_renames:
127
129
logger.critical(u"No suitable Zeroconf service name found"
128
130
u" after %i retries, exiting.",
129
rename_count)
130
raise AvahiServiceError("Too many renames")
131
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
131
133
self.name = server.GetAlternativeServiceName(self.name)
132
134
logger.info(u"Changing Zeroconf service name to %r ...",
133
135
str(self.name))
134
syslogger.setFormatter(logging.Formatter\
136
syslogger.setFormatter(logging.Formatter
135
137
('Mandos (%s): %%(levelname)s:'
136
' %%(message)s' % self.name))
138
' %%(message)s' % self.name))
137
139
self.remove()
138
140
self.add()
139
141
self.rename_count += 1
145
147
"""Derived from the Avahi example code"""
146
148
global group
147
149
if group is None:
148
group = dbus.Interface\
149
(bus.get_object(avahi.DBUS_NAME,
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
150
152
server.EntryGroupNew()),
151
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
154
group.connect_to_signal('StateChanged',
153
155
entry_group_state_changed)
154
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
168
170
# End of Avahi example code
169
171
170
172
171
class Client(object):
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
172
179
"""A representation of a client host served by this server.
173
180
Attributes:
174
name: string; from the config file, used in log messages
181
name: string; from the config file, used in log messages
175
182
fingerprint: string (40 or 32 hexadecimal digits); used to
176
183
uniquely identify the client
177
secret: bytestring; sent verbatim (over TLS) to client
178
host: string; available for use by the checker command
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
181
timeout: datetime.timedelta(); How long from last_checked_ok
182
until this client is invalid
183
interval: datetime.timedelta(); How often to start a new checker
184
stop_hook: If set, called by stop() as stop_hook(self)
185
checker: subprocess.Popen(); a running checker process used
186
to see if the client lives.
187
'None' if no process is running.
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
188
197
checker_initiator_tag: a gobject event source tag, or None
189
stop_initiator_tag: - '' -
198
disable_initiator_tag: - '' -
190
199
checker_callback_tag: - '' -
191
200
checker_command: string; External command which is run to check if
192
201
client lives. %() expansions are done at
193
202
runtime with vars(self) as dict, so that for
194
203
instance %(name)s can be used in the command.
195
Private attibutes:
196
_timeout: Real variable for 'timeout'
197
_interval: Real variable for 'interval'
198
_timeout_milliseconds: Used when calling gobject.timeout_add()
199
_interval_milliseconds: - '' -
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
200
206
"""
201
def _set_timeout(self, timeout):
202
"Setter function for 'timeout' attribute"
203
self._timeout = timeout
204
self._timeout_milliseconds = ((self.timeout.days
205
* 24 * 60 * 60 * 1000)
206
+ (self.timeout.seconds * 1000)
207
+ (self.timeout.microseconds
208
// 1000))
209
timeout = property(lambda self: self._timeout,
210
_set_timeout)
211
del _set_timeout
212
def _set_interval(self, interval):
213
"Setter function for 'interval' attribute"
214
self._interval = interval
215
self._interval_milliseconds = ((self.interval.days
216
* 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds
218
* 1000)
219
+ (self.interval.microseconds
220
// 1000))
221
interval = property(lambda self: self._interval,
222
_set_interval)
223
del _set_interval
224
def __init__(self, name = None, stop_hook=None, config={}):
207
def timeout_milliseconds(self):
208
"Return the 'timeout' attribute in milliseconds"
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
212
213
def interval_milliseconds(self):
214
"Return the 'interval' attribute in milliseconds"
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
218
219
def __init__(self, name = None, disable_hook=None, config=None,
220
use_dbus=True):
225
221
"""Note: the 'checker' key in 'config' sets the
226
222
'checker_command' attribute and *not* the 'checker'
227
223
attribute."""
228
224
self.name = name
225
if config is None:
226
config = {}
229
227
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
229
if self.use_dbus:
230
self.dbus_object_path = (dbus.ObjectPath
231
("/Mandos/clients/"
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
230
235
# Uppercase and remove spaces from fingerprint for later
231
236
# comparison purposes with return value from the fingerprint()
232
237
# function
233
self.fingerprint = config["fingerprint"].upper()\
234
.replace(u" ", u"")
238
self.fingerprint = (config["fingerprint"].upper()
239
.replace(u" ", u""))
235
240
logger.debug(u" Fingerprint: %s", self.fingerprint)
236
241
if "secret" in config:
237
242
self.secret = config["secret"].decode(u"base64")
238
243
elif "secfile" in config:
239
sf = open(config["secfile"])
240
self.secret = sf.read()
241
sf.close()
244
with closing(open(os.path.expanduser
245
(os.path.expandvars
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
242
248
else:
243
249
raise TypeError(u"No secret or secfile for client %s"
244
250
% self.name)
245
251
self.host = config.get("host", "")
246
self.created = datetime.datetime.now()
252
self.created = datetime.datetime.utcnow()
253
self.enabled = False
254
self.last_enabled = None
247
255
self.last_checked_ok = None
248
256
self.timeout = string_to_delta(config["timeout"])
249
257
self.interval = string_to_delta(config["interval"])
250
self.stop_hook = stop_hook
258
self.disable_hook = disable_hook
251
259
self.checker = None
252
260
self.checker_initiator_tag = None
253
self.stop_initiator_tag = None
261
self.disable_initiator_tag = None
254
262
self.checker_callback_tag = None
255
self.check_command = config["checker"]
256
def start(self):
263
self.checker_command = config["checker"]
264
265
def enable(self):
257
266
"""Start this client's checker and timeout hooks"""
267
self.last_enabled = datetime.datetime.utcnow()
258
268
# Schedule a new checker to be started an 'interval' from now,
259
269
# and every interval from then on.
260
self.checker_initiator_tag = gobject.timeout_add\
261
(self._interval_milliseconds,
262
self.start_checker)
270
self.checker_initiator_tag = (gobject.timeout_add
271
(self.interval_milliseconds(),
272
self.start_checker))
263
273
# Also start a new checker *right now*.
264
274
self.start_checker()
265
# Schedule a stop() when 'timeout' has passed
266
self.stop_initiator_tag = gobject.timeout_add\
267
(self._timeout_milliseconds,
268
self.stop)
269
def stop(self):
270
"""Stop this client.
271
The possibility that a client might be restarted is left open,
272
but not currently used."""
273
# If this client doesn't have a secret, it is already stopped.
274
if hasattr(self, "secret") and self.secret:
275
logger.info(u"Stopping client %s", self.name)
276
self.secret = None
277
else:
275
# Schedule a disable() when 'timeout' has passed
276
self.disable_initiator_tag = (gobject.timeout_add
277
(self.timeout_milliseconds(),
278
self.disable))
279
self.enabled = True
280
if self.use_dbus:
281
# Emit D-Bus signals
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
286
variant_level=1)))
287
288
def disable(self):
289
"""Disable this client."""
290
if not getattr(self, "enabled", False):
278
291
return False
279
if getattr(self, "stop_initiator_tag", False):
280
gobject.source_remove(self.stop_initiator_tag)
281
self.stop_initiator_tag = None
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
294
gobject.source_remove(self.disable_initiator_tag)
295
self.disable_initiator_tag = None
282
296
if getattr(self, "checker_initiator_tag", False):
283
297
gobject.source_remove(self.checker_initiator_tag)
284
298
self.checker_initiator_tag = None
285
299
self.stop_checker()
286
if self.stop_hook:
287
self.stop_hook(self)
300
if self.disable_hook:
301
self.disable_hook(self)
302
self.enabled = False
303
if self.use_dbus:
304
# Emit D-Bus signal
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
288
307
# Do not run this again if called by a gobject.timeout_add
289
308
return False
309
290
310
def __del__(self):
291
self.stop_hook = None
292
self.stop()
293
def checker_callback(self, pid, condition):
311
self.disable_hook = None
312
self.disable()
313
314
def checker_callback(self, pid, condition, command):
294
315
"""The checker has completed, so take appropriate actions."""
295
now = datetime.datetime.now()
296
316
self.checker_callback_tag = None
297
317
self.checker = None
298
if os.WIFEXITED(condition) \
299
and (os.WEXITSTATUS(condition) == 0):
318
if self.use_dbus:
319
# Emit D-Bus signal
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
300
324
logger.info(u"Checker for %(name)s succeeded",
301
325
vars(self))
302
self.last_checked_ok = now
303
gobject.source_remove(self.stop_initiator_tag)
304
self.stop_initiator_tag = gobject.timeout_add\
305
(self._timeout_milliseconds,
306
self.stop)
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
331
self.bump_timeout()
307
332
elif not os.WIFEXITED(condition):
308
333
logger.warning(u"Checker for %(name)s crashed?",
309
334
vars(self))
335
if self.use_dbus:
336
# Emit D-Bus signal
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
310
340
else:
311
341
logger.info(u"Checker for %(name)s failed",
312
342
vars(self))
343
if self.use_dbus:
344
# Emit D-Bus signal
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
348
349
def bump_timeout(self):
350
"""Bump up the timeout for this client.
351
This should only be called when the client has been seen,
352
alive and well.
353
"""
354
self.last_checked_ok = datetime.datetime.utcnow()
355
gobject.source_remove(self.disable_initiator_tag)
356
self.disable_initiator_tag = (gobject.timeout_add
357
(self.timeout_milliseconds(),
358
self.disable))
359
if self.use_dbus:
360
# Emit D-Bus signal
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
364
variant_level=1)))
365
313
366
def start_checker(self):
314
367
"""Start a new checker subprocess if one is not running.
315
368
If a checker already exists, leave it running and do
324
377
# is as it should be.
325
378
if self.checker is None:
326
379
try:
327
# In case check_command has exactly one % operator
328
command = self.check_command % self.host
380
# In case checker_command has exactly one % operator
381
command = self.checker_command % self.host
329
382
except TypeError:
330
383
# Escape attributes for the shell
331
384
escaped_attrs = dict((key, re.escape(str(val)))
332
385
for key, val in
333
386
vars(self).iteritems())
334
387
try:
335
command = self.check_command % escaped_attrs
388
command = self.checker_command % escaped_attrs
336
389
except TypeError, error:
337
390
logger.error(u'Could not format string "%s":'
338
u' %s', self.check_command, error)
391
u' %s', self.checker_command, error)
339
392
return True # Try again later
340
393
try:
341
394
logger.info(u"Starting checker %r for %s",
347
400
self.checker = subprocess.Popen(command,
348
401
close_fds=True,
349
402
shell=True, cwd="/")
350
self.checker_callback_tag = gobject.child_watch_add\
351
(self.checker.pid,
352
self.checker_callback)
403
if self.use_dbus:
404
# Emit D-Bus signal
405
self.CheckerStarted(command)
406
self.PropertyChanged(
407
dbus.String("checker_running"),
408
dbus.Boolean(True, variant_level=1))
409
self.checker_callback_tag = (gobject.child_watch_add
410
(self.checker.pid,
411
self.checker_callback,
412
data=command))
353
413
except OSError, error:
354
414
logger.error(u"Failed to start subprocess: %s",
355
415
error)
356
416
# Re-run this periodically if run by gobject.timeout_add
357
417
return True
418
358
419
def stop_checker(self):
359
420
"""Force the checker process, if any, to stop."""
360
421
if self.checker_callback_tag:
372
433
if error.errno != errno.ESRCH: # No such process
373
434
raise
374
435
self.checker = None
436
if self.use_dbus:
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
439
375
440
def still_valid(self):
376
441
"""Has the timeout not yet passed for this client?"""
377
now = datetime.datetime.now()
442
if not getattr(self, "enabled", False):
443
return False
444
now = datetime.datetime.utcnow()
378
445
if self.last_checked_ok is None:
379
446
return now < (self.created + self.timeout)
380
447
else:
381
448
return now < (self.last_checked_ok + self.timeout)
449
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
452
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
456
457
# CheckerCompleted - signal
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
460
"D-Bus signal"
461
pass
462
463
# CheckerStarted - signal
464
@dbus.service.signal(_interface, signature="s")
465
def CheckerStarted(self, command):
466
"D-Bus signal"
467
pass
468
469
# GetAllProperties - method
470
@dbus.service.method(_interface, out_signature="a{sv}")
471
def GetAllProperties(self):
472
"D-Bus method"
473
return dbus.Dictionary({
474
dbus.String("name"):
475
dbus.String(self.name, variant_level=1),
476
dbus.String("fingerprint"):
477
dbus.String(self.fingerprint, variant_level=1),
478
dbus.String("host"):
479
dbus.String(self.host, variant_level=1),
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
484
variant_level=1)
485
if self.last_enabled is not None
486
else dbus.Boolean(False, variant_level=1)),
487
dbus.String("enabled"):
488
dbus.Boolean(self.enabled, variant_level=1),
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
491
variant_level=1)
492
if self.last_checked_ok is not None
493
else dbus.Boolean (False, variant_level=1)),
494
dbus.String("timeout"):
495
dbus.UInt64(self.timeout_milliseconds(),
496
variant_level=1),
497
dbus.String("interval"):
498
dbus.UInt64(self.interval_milliseconds(),
499
variant_level=1),
500
dbus.String("checker"):
501
dbus.String(self.checker_command,
502
variant_level=1),
503
dbus.String("checker_running"):
504
dbus.Boolean(self.checker is not None,
505
variant_level=1),
506
}, signature="sv")
507
508
# IsStillValid - method
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
510
(still_valid))
511
IsStillValid.__name__ = "IsStillValid"
512
513
# PropertyChanged - signal
514
@dbus.service.signal(_interface, signature="sv")
515
def PropertyChanged(self, property, value):
516
"D-Bus signal"
517
pass
518
519
# SetChecker - method
520
@dbus.service.method(_interface, in_signature="s")
521
def SetChecker(self, checker):
522
"D-Bus setter method"
523
self.checker_command = checker
524
# Emit D-Bus signal
525
self.PropertyChanged(dbus.String(u"checker"),
526
dbus.String(self.checker_command,
527
variant_level=1))
528
529
# SetHost - method
530
@dbus.service.method(_interface, in_signature="s")
531
def SetHost(self, host):
532
"D-Bus setter method"
533
self.host = host
534
# Emit D-Bus signal
535
self.PropertyChanged(dbus.String(u"host"),
536
dbus.String(self.host, variant_level=1))
537
538
# SetInterval - method
539
@dbus.service.method(_interface, in_signature="t")
540
def SetInterval(self, milliseconds):
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
542
# Emit D-Bus signal
543
self.PropertyChanged(dbus.String(u"interval"),
544
(dbus.UInt64(self.interval_milliseconds(),
545
variant_level=1)))
546
547
# SetSecret - method
548
@dbus.service.method(_interface, in_signature="ay",
549
byte_arrays=True)
550
def SetSecret(self, secret):
551
"D-Bus setter method"
552
self.secret = str(secret)
553
554
# SetTimeout - method
555
@dbus.service.method(_interface, in_signature="t")
556
def SetTimeout(self, milliseconds):
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
558
# Emit D-Bus signal
559
self.PropertyChanged(dbus.String(u"timeout"),
560
(dbus.UInt64(self.timeout_milliseconds(),
561
variant_level=1)))
562
563
# Enable - method
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
566
567
# StartChecker - method
568
@dbus.service.method(_interface)
569
def StartChecker(self):
570
"D-Bus method"
571
self.start_checker()
572
573
# Disable - method
574
@dbus.service.method(_interface)
575
def Disable(self):
576
"D-Bus method"
577
self.disable()
578
579
# StopChecker - method
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
582
583
del _interface
382
584
383
585
384
586
def peer_certificate(session):
385
587
"Return the peer's OpenPGP certificate as a bytestring"
386
588
# If not an OpenPGP certificate...
387
if gnutls.library.functions.gnutls_certificate_type_get\
388
(session._c_object) \
389
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
390
592
# ...do the normal thing
391
593
return session.peer_certificate
392
594
list_size = ctypes.c_uint()
393
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
394
(session._c_object, ctypes.byref(list_size))
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
395
598
if list_size.value == 0:
396
599
return None
397
600
cert = cert_list[0]
401
604
def fingerprint(openpgp):
402
605
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
403
606
# New GnuTLS "datum" with the OpenPGP public key
404
datum = gnutls.library.types.gnutls_datum_t\
405
(ctypes.cast(ctypes.c_char_p(openpgp),
406
ctypes.POINTER(ctypes.c_ubyte)),
407
ctypes.c_uint(len(openpgp)))
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
609
ctypes.POINTER
610
(ctypes.c_ubyte)),
611
ctypes.c_uint(len(openpgp))))
408
612
# New empty GnuTLS certificate
409
613
crt = gnutls.library.types.gnutls_openpgp_crt_t()
410
gnutls.library.functions.gnutls_openpgp_crt_init\
411
(ctypes.byref(crt))
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
412
616
# Import the OpenPGP public key into the certificate
413
gnutls.library.functions.gnutls_openpgp_crt_import\
414
(crt, ctypes.byref(datum),
415
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
416
621
# Verify the self signature in the key
417
crtverify = ctypes.c_uint();
418
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
419
(crt, 0, ctypes.byref(crtverify))
622
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
420
625
if crtverify.value != 0:
421
626
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
422
627
raise gnutls.errors.CertificateSecurityError("Verify failed")
423
628
# New buffer for the fingerprint
424
buffer = ctypes.create_string_buffer(20)
425
buffer_length = ctypes.c_size_t()
629
buf = ctypes.create_string_buffer(20)
630
buf_len = ctypes.c_size_t()
426
631
# Get the fingerprint from the certificate into the buffer
427
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
428
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
429
635
# Deinit the certificate
430
636
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
431
637
# Convert the buffer to a Python bytestring
432
fpr = ctypes.string_at(buffer, buffer_length.value)
638
fpr = ctypes.string_at(buf, buf_len.value)
433
639
# Convert the bytestring to hexadecimal notation
434
640
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
435
641
return hex_fpr
436
642
437
643
438
class tcp_handler(SocketServer.BaseRequestHandler, object):
644
class TCP_handler(SocketServer.BaseRequestHandler, object):
439
645
"""A TCP request handler class.
440
646
Instantiated by IPv6_TCPServer for each request to handle it.
441
647
Note: This will run in its own forked process."""
442
648
443
649
def handle(self):
444
650
logger.info(u"TCP connection from: %s",
445
unicode(self.client_address))
446
session = gnutls.connection.ClientSession\
447
(self.request, gnutls.connection.X509Credentials())
651
unicode(self.client_address))
652
session = (gnutls.connection
653
.ClientSession(self.request,
654
gnutls.connection
655
.X509Credentials()))
448
656
449
657
line = self.request.makefile().readline()
450
658
logger.debug(u"Protocol version: %r", line)
463
671
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
464
672
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
465
673
# "+DHE-DSS"))
466
priority = "NORMAL" # Fallback default, since this
467
# MUST be set.
468
if self.server.settings["priority"]:
469
priority = self.server.settings["priority"]
470
gnutls.library.functions.gnutls_priority_set_direct\
471
(session._c_object, priority, None);
674
# Use a fallback default, since this MUST be set.
675
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
678
priority, None))
472
679
473
680
try:
474
681
session.handshake()
484
691
session.bye()
485
692
return
486
693
logger.debug(u"Fingerprint: %s", fpr)
487
client = None
488
694
for c in self.server.clients:
489
695
if c.fingerprint == fpr:
490
696
client = c
491
697
break
492
if not client:
698
else:
493
699
logger.warning(u"Client not found for fingerprint: %s",
494
700
fpr)
495
701
session.bye()
502
708
vars(client))
503
709
session.bye()
504
710
return
711
## This won't work here, since we're in a fork.
712
# client.bump_timeout()
505
713
sent_size = 0
506
714
while sent_size < len(client.secret):
507
715
sent = session.send(client.secret[sent_size:])
512
720
session.bye()
513
721
514
722
515
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
724
SocketServer.TCPServer, object):
516
725
"""IPv6 TCP server. Accepts 'None' as address and/or port.
517
726
Attributes:
518
727
settings: Server settings
519
728
clients: Set() of Client objects
729
enabled: Boolean; whether this server is activated yet
520
730
"""
521
731
address_family = socket.AF_INET6
522
732
def __init__(self, *args, **kwargs):
526
736
if "clients" in kwargs:
527
737
self.clients = kwargs["clients"]
528
738
del kwargs["clients"]
529
return super(type(self), self).__init__(*args, **kwargs)
739
self.enabled = False
740
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
530
741
def server_bind(self):
531
742
"""This overrides the normal server_bind() function
532
743
to bind to an interface if one was specified, and also NOT to
561
772
# if_nametoindex
562
773
# (self.settings
563
774
# ["interface"]))
564
return super(type(self), self).server_bind()
775
return super(IPv6_TCPServer, self).server_bind()
776
def server_activate(self):
777
if self.enabled:
778
return super(IPv6_TCPServer, self).server_activate()
779
def enable(self):
780
self.enabled = True
565
781
566
782
567
783
def string_to_delta(interval):
583
799
timevalue = datetime.timedelta(0)
584
800
for s in interval.split():
585
801
try:
586
suffix=unicode(s[-1])
587
value=int(s[:-1])
802
suffix = unicode(s[-1])
803
value = int(s[:-1])
588
804
if suffix == u"d":
589
805
delta = datetime.timedelta(value)
590
806
elif suffix == u"s":
624
840
elif state == avahi.ENTRY_GROUP_FAILURE:
625
841
logger.critical(u"Avahi: Error in group state changed %s",
626
842
unicode(error))
627
raise AvahiGroupError("State changed: %s", str(error))
843
raise AvahiGroupError(u"State changed: %s" % unicode(error))
628
844
629
845
def if_nametoindex(interface):
630
846
"""Call the C function if_nametoindex(), or equivalent"""
631
847
global if_nametoindex
632
848
try:
633
if "ctypes.util" not in sys.modules:
634
import ctypes.util
635
if_nametoindex = ctypes.cdll.LoadLibrary\
636
(ctypes.util.find_library("c")).if_nametoindex
849
if_nametoindex = (ctypes.cdll.LoadLibrary
850
(ctypes.util.find_library("c"))
851
.if_nametoindex)
637
852
except (OSError, AttributeError):
638
853
if "struct" not in sys.modules:
639
854
import struct
642
857
def if_nametoindex(interface):
643
858
"Get an interface index the hard way, i.e. using fcntl()"
644
859
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
645
s = socket.socket()
646
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
647
struct.pack("16s16x", interface))
648
s.close()
860
with closing(socket.socket()) as s:
861
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
862
struct.pack("16s16x", interface))
649
863
interface_index = struct.unpack("I", ifreq[16:20])[0]
650
864
return interface_index
651
865
return if_nametoindex(interface)
675
889
676
890
677
891
def main():
678
global main_loop_started
679
main_loop_started = False
680
681
parser = OptionParser(version = "%%prog %s" % version)
892
parser = optparse.OptionParser(version = "%%prog %s" % version)
682
893
parser.add_option("-i", "--interface", type="string",
683
894
metavar="IF", help="Bind to interface IF")
684
895
parser.add_option("-a", "--address", type="string",
685
896
help="Address to listen for requests on")
686
897
parser.add_option("-p", "--port", type="int",
687
898
help="Port number to receive requests on")
688
parser.add_option("--check", action="store_true", default=False,
899
parser.add_option("--check", action="store_true",
689
900
help="Run self-test")
690
901
parser.add_option("--debug", action="store_true",
691
902
help="Debug mode; run in foreground and log to"
698
909
default="/etc/mandos", metavar="DIR",
699
910
help="Directory to search for configuration"
700
911
" files")
701
(options, args) = parser.parse_args()
912
parser.add_option("--no-dbus", action="store_false",
913
dest="use_dbus",
914
help="Do not provide D-Bus system bus"
915
" interface")
916
options = parser.parse_args()[0]
702
917
703
918
if options.check:
704
919
import doctest
713
928
"priority":
714
929
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
715
930
"servicename": "Mandos",
931
"use_dbus": "True",
716
932
}
717
933
718
934
# Parse config file for server-global settings
721
937
server_config.read(os.path.join(options.configdir, "mandos.conf"))
722
938
# Convert the SafeConfigParser object to a dict
723
939
server_settings = server_config.defaults()
724
# Use getboolean on the boolean config option
725
server_settings["debug"] = server_config.getboolean\
726
("DEFAULT", "debug")
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
727
945
del server_config
728
946
729
947
# Override the settings from the config file with command line
730
948
# options, if set.
731
949
for option in ("interface", "address", "port", "debug",
732
"priority", "servicename", "configdir"):
950
"priority", "servicename", "configdir",
951
"use_dbus"):
733
952
value = getattr(options, option)
734
953
if value is not None:
735
954
server_settings[option] = value
736
955
del options
737
956
# Now we have our good server settings in "server_settings"
738
957
958
# For convenience
739
959
debug = server_settings["debug"]
960
use_dbus = server_settings["use_dbus"]
740
961
741
962
if not debug:
742
963
syslogger.setLevel(logging.WARNING)
743
964
console.setLevel(logging.WARNING)
744
965
745
966
if server_settings["servicename"] != "Mandos":
746
syslogger.setFormatter(logging.Formatter\
967
syslogger.setFormatter(logging.Formatter
747
968
('Mandos (%s): %%(levelname)s:'
748
969
' %%(message)s'
749
970
% server_settings["servicename"]))
751
972
# Parse config file with clients
752
973
client_defaults = { "timeout": "1h",
753
974
"interval": "5m",
754
"checker": "fping -q -- %(host)s",
975
"checker": "fping -q -- %%(host)s",
755
976
"host": "",
756
977
}
757
978
client_config = ConfigParser.SafeConfigParser(client_defaults)
758
979
client_config.read(os.path.join(server_settings["configdir"],
759
980
"clients.conf"))
760
981
982
clients = Set()
983
tcp_server = IPv6_TCPServer((server_settings["address"],
984
server_settings["port"]),
985
TCP_handler,
986
settings=server_settings,
987
clients=clients)
988
pidfilename = "/var/run/mandos.pid"
989
try:
990
pidfile = open(pidfilename, "w")
991
except IOError, error:
992
logger.error("Could not open file %r", pidfilename)
993
994
try:
995
uid = pwd.getpwnam("_mandos").pw_uid
996
gid = pwd.getpwnam("_mandos").pw_gid
997
except KeyError:
998
try:
999
uid = pwd.getpwnam("mandos").pw_uid
1000
gid = pwd.getpwnam("mandos").pw_gid
1001
except KeyError:
1002
try:
1003
uid = pwd.getpwnam("nobody").pw_uid
1004
gid = pwd.getpwnam("nogroup").pw_gid
1005
except KeyError:
1006
uid = 65534
1007
gid = 65534
1008
try:
1009
os.setuid(uid)
1010
os.setgid(gid)
1011
except OSError, error:
1012
if error[0] != errno.EPERM:
1013
raise error
1014
761
1015
global service
762
1016
service = AvahiService(name = server_settings["servicename"],
763
type = "_mandos._tcp", );
1017
servicetype = "_mandos._tcp", )
764
1018
if server_settings["interface"]:
765
service.interface = if_nametoindex\
766
(server_settings["interface"])
1019
service.interface = (if_nametoindex
1020
(server_settings["interface"]))
767
1021
768
1022
global main_loop
769
1023
global bus
776
1030
avahi.DBUS_PATH_SERVER),
777
1031
avahi.DBUS_INTERFACE_SERVER)
778
1032
# End of Avahi example code
779
780
clients = Set()
781
def remove_from_clients(client):
782
clients.remove(client)
783
if not clients:
784
logger.critical(u"No clients left, exiting")
785
sys.exit()
1033
if use_dbus:
1034
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1035
bus)
786
1036
787
1037
clients.update(Set(Client(name = section,
788
stop_hook = remove_from_clients,
789
1038
config
790
= dict(client_config.items(section)))
1039
= dict(client_config.items(section)),
1040
use_dbus = use_dbus)
791
1041
for section in client_config.sections()))
792
1042
if not clients:
793
logger.critical(u"No clients defined")
794
sys.exit(1)
1043
logger.warning(u"No clients defined")
795
1044
796
1045
if debug:
797
1046
# Redirect stdin so all checkers get /dev/null
805
1054
# Close all input and output, do double fork, etc.
806
1055
daemon()
807
1056
808
pidfilename = "/var/run/mandos/mandos.pid"
809
pid = os.getpid()
810
1057
try:
811
pidfile = open(pidfilename, "w")
1058
pid = os.getpid()
812
1059
pidfile.write(str(pid) + "\n")
813
1060
pidfile.close()
814
1061
del pidfile
815
except IOError, err:
816
logger.error(u"Could not write %s file with PID %d",
817
pidfilename, os.getpid())
1062
except IOError:
1063
logger.error(u"Could not write to file %r with PID %d",
1064
pidfilename, pid)
1065
except NameError:
1066
# "pidfile" was never created
1067
pass
1068
del pidfilename
818
1069
819
1070
def cleanup():
820
1071
"Cleanup function; run on exit"
827
1078
828
1079
while clients:
829
1080
client = clients.pop()
830
client.stop_hook = None
831
client.stop()
1081
client.disable_hook = None
1082
client.disable()
832
1083
833
1084
atexit.register(cleanup)
834
1085
837
1088
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
838
1089
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
839
1090
1091
if use_dbus:
1092
class MandosServer(dbus.service.Object):
1093
"""A D-Bus proxy object"""
1094
def __init__(self):
1095
dbus.service.Object.__init__(self, bus,
1096
"/Mandos")
1097
_interface = u"org.mandos_system.Mandos"
1098
1099
@dbus.service.signal(_interface, signature="oa{sv}")
1100
def ClientAdded(self, objpath, properties):
1101
"D-Bus signal"
1102
pass
1103
1104
@dbus.service.signal(_interface, signature="o")
1105
def ClientRemoved(self, objpath):
1106
"D-Bus signal"
1107
pass
1108
1109
@dbus.service.method(_interface, out_signature="ao")
1110
def GetAllClients(self):
1111
return dbus.Array(c.dbus_object_path for c in clients)
1112
1113
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1114
def GetAllClientsWithProperties(self):
1115
return dbus.Dictionary(
1116
((c.dbus_object_path, c.GetAllProperties())
1117
for c in clients),
1118
signature="oa{sv}")
1119
1120
@dbus.service.method(_interface, in_signature="o")
1121
def RemoveClient(self, object_path):
1122
for c in clients:
1123
if c.dbus_object_path == object_path:
1124
clients.remove(c)
1125
# Don't signal anything except ClientRemoved
1126
c.use_dbus = False
1127
c.disable()
1128
# Emit D-Bus signal
1129
self.ClientRemoved(object_path)
1130
return
1131
raise KeyError
1132
@dbus.service.method(_interface)
1133
def Quit(self):
1134
main_loop.quit()
1135
1136
del _interface
1137
1138
mandos_server = MandosServer()
1139
840
1140
for client in clients:
841
client.start()
842
843
tcp_server = IPv6_TCPServer((server_settings["address"],
844
server_settings["port"]),
845
tcp_handler,
846
settings=server_settings,
847
clients=clients)
1141
if use_dbus:
1142
# Emit D-Bus signal
1143
mandos_server.ClientAdded(client.dbus_object_path,
1144
client.GetAllProperties())
1145
client.enable()
1146
1147
tcp_server.enable()
1148
tcp_server.server_activate()
1149
848
1150
# Find out what port we got
849
1151
service.port = tcp_server.socket.getsockname()[1]
850
1152
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
864
1166
865
1167
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
866
1168
lambda *args, **kwargs:
867
tcp_server.handle_request\
868
(*args[2:], **kwargs) or True)
1169
(tcp_server.handle_request
1170
(*args[2:], **kwargs) or True))
869
1171
870
1172
logger.debug(u"Starting main loop")
871
main_loop_started = True
872
1173
main_loop.run()
873
1174
except AvahiError, error:
874
logger.critical(u"AvahiError: %s" + unicode(error))
1175
logger.critical(u"AvahiError: %s", error)
875
1176
sys.exit(1)
876
1177
except KeyboardInterrupt:
877
1178
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0