To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 276
- compare with another revision
- download diff
- download tarball
- view history from revision 276
- Committer: Teddy Hogeborn
- Date: 2009-01-18 00:18:50 UTC
- Revision ID: teddy@fukt.bsnet.se-20090118001850-pvg8xjwmbyt23fom
* debian/rules (install-indep): Removed "--no-start" from
dh_installinit.
dh_installinit.
- files added:
- debian/watch
- files removed:
- debian/mandos-client.config
- files modified:
- INSTALL
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
30
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
32
#
32
33
33
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
34
35
35
36
import SocketServer
36
37
import socket
37
from optparse import OptionParser
38
import optparse
38
39
import datetime
39
40
import errno
40
41
import gnutls.crypto
55
56
import logging
56
57
import logging.handlers
57
58
import pwd
59
from contextlib import closing
58
60
59
61
import dbus
62
import dbus.service
60
63
import gobject
61
64
import avahi
62
65
from dbus.mainloop.glib import DBusGMainLoop
63
66
import ctypes
64
67
import ctypes.util
65
68
66
version = "1.0.1"
69
version = "1.0.5"
67
70
68
71
logger = logging.Logger('mandos')
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
74
77
logger.addHandler(syslogger)
75
78
76
79
console = logging.StreamHandler()
79
82
logger.addHandler(console)
80
83
81
84
class AvahiError(Exception):
82
def __init__(self, value):
85
def __init__(self, value, *args, **kwargs):
83
86
self.value = value
84
super(AvahiError, self).__init__()
85
def __str__(self):
86
return repr(self.value)
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
87
90
88
91
class AvahiServiceError(AvahiError):
89
92
pass
109
112
a sensible number of times
110
113
"""
111
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
112
servicetype = None, port = None, TXT = None, domain = "",
113
host = "", max_renames = 32768):
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
114
117
self.interface = interface
115
118
self.name = name
116
119
self.type = servicetype
117
120
self.port = port
118
if TXT is None:
119
self.TXT = []
120
else:
121
self.TXT = TXT
121
self.TXT = TXT if TXT is not None else []
122
122
self.domain = domain
123
123
self.host = host
124
124
self.rename_count = 0
129
129
logger.critical(u"No suitable Zeroconf service name found"
130
130
u" after %i retries, exiting.",
131
131
self.rename_count)
132
raise AvahiServiceError("Too many renames")
132
raise AvahiServiceError(u"Too many renames")
133
133
self.name = server.GetAlternativeServiceName(self.name)
134
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter\
136
syslogger.setFormatter(logging.Formatter
137
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
138
' %%(message)s' % self.name))
139
139
self.remove()
140
140
self.add()
141
141
self.rename_count += 1
147
147
"""Derived from the Avahi example code"""
148
148
global group
149
149
if group is None:
150
group = dbus.Interface\
151
(bus.get_object(avahi.DBUS_NAME,
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
152
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
154
group.connect_to_signal('StateChanged',
155
155
entry_group_state_changed)
156
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
170
170
# End of Avahi example code
171
171
172
172
173
class Client(object):
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
174
179
"""A representation of a client host served by this server.
175
180
Attributes:
176
name: string; from the config file, used in log messages
181
name: string; from the config file, used in log messages
177
182
fingerprint: string (40 or 32 hexadecimal digits); used to
178
183
uniquely identify the client
179
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); object creation, not client host
182
last_checked_ok: datetime.datetime() or None if not yet checked OK
183
timeout: datetime.timedelta(); How long from last_checked_ok
184
until this client is invalid
185
interval: datetime.timedelta(); How often to start a new checker
186
stop_hook: If set, called by stop() as stop_hook(self)
187
checker: subprocess.Popen(); a running checker process used
188
to see if the client lives.
189
'None' if no process is running.
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
190
197
checker_initiator_tag: a gobject event source tag, or None
191
stop_initiator_tag: - '' -
198
disable_initiator_tag: - '' -
192
199
checker_callback_tag: - '' -
193
200
checker_command: string; External command which is run to check if
194
201
client lives. %() expansions are done at
195
202
runtime with vars(self) as dict, so that for
196
203
instance %(name)s can be used in the command.
197
Private attibutes:
198
_timeout: Real variable for 'timeout'
199
_interval: Real variable for 'interval'
200
_timeout_milliseconds: Used when calling gobject.timeout_add()
201
_interval_milliseconds: - '' -
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
202
206
"""
203
def _set_timeout(self, timeout):
204
"Setter function for 'timeout' attribute"
205
self._timeout = timeout
206
self._timeout_milliseconds = ((self.timeout.days
207
* 24 * 60 * 60 * 1000)
208
+ (self.timeout.seconds * 1000)
209
+ (self.timeout.microseconds
210
// 1000))
211
timeout = property(lambda self: self._timeout,
212
_set_timeout)
213
del _set_timeout
214
def _set_interval(self, interval):
215
"Setter function for 'interval' attribute"
216
self._interval = interval
217
self._interval_milliseconds = ((self.interval.days
218
* 24 * 60 * 60 * 1000)
219
+ (self.interval.seconds
220
* 1000)
221
+ (self.interval.microseconds
222
// 1000))
223
interval = property(lambda self: self._interval,
224
_set_interval)
225
del _set_interval
226
def __init__(self, name = None, stop_hook=None, config=None):
207
def timeout_milliseconds(self):
208
"Return the 'timeout' attribute in milliseconds"
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
212
213
def interval_milliseconds(self):
214
"Return the 'interval' attribute in milliseconds"
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
218
219
def __init__(self, name = None, disable_hook=None, config=None,
220
use_dbus=True):
227
221
"""Note: the 'checker' key in 'config' sets the
228
222
'checker_command' attribute and *not* the 'checker'
229
223
attribute."""
224
self.name = name
230
225
if config is None:
231
226
config = {}
232
self.name = name
233
227
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
229
if self.use_dbus:
230
self.dbus_object_path = (dbus.ObjectPath
231
("/Mandos/clients/"
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
234
235
# Uppercase and remove spaces from fingerprint for later
235
236
# comparison purposes with return value from the fingerprint()
236
237
# function
237
self.fingerprint = config["fingerprint"].upper()\
238
.replace(u" ", u"")
238
self.fingerprint = (config["fingerprint"].upper()
239
.replace(u" ", u""))
239
240
logger.debug(u" Fingerprint: %s", self.fingerprint)
240
241
if "secret" in config:
241
242
self.secret = config["secret"].decode(u"base64")
242
243
elif "secfile" in config:
243
secfile = open(os.path.expanduser(os.path.expandvars
244
(config["secfile"])))
245
self.secret = secfile.read()
246
secfile.close()
244
with closing(open(os.path.expanduser
245
(os.path.expandvars
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
247
248
else:
248
249
raise TypeError(u"No secret or secfile for client %s"
249
250
% self.name)
250
251
self.host = config.get("host", "")
251
self.created = datetime.datetime.now()
252
self.created = datetime.datetime.utcnow()
253
self.enabled = False
254
self.last_enabled = None
252
255
self.last_checked_ok = None
253
256
self.timeout = string_to_delta(config["timeout"])
254
257
self.interval = string_to_delta(config["interval"])
255
self.stop_hook = stop_hook
258
self.disable_hook = disable_hook
256
259
self.checker = None
257
260
self.checker_initiator_tag = None
258
self.stop_initiator_tag = None
261
self.disable_initiator_tag = None
259
262
self.checker_callback_tag = None
260
self.check_command = config["checker"]
261
def start(self):
263
self.checker_command = config["checker"]
264
265
def enable(self):
262
266
"""Start this client's checker and timeout hooks"""
267
self.last_enabled = datetime.datetime.utcnow()
263
268
# Schedule a new checker to be started an 'interval' from now,
264
269
# and every interval from then on.
265
self.checker_initiator_tag = gobject.timeout_add\
266
(self._interval_milliseconds,
267
self.start_checker)
270
self.checker_initiator_tag = (gobject.timeout_add
271
(self.interval_milliseconds(),
272
self.start_checker))
268
273
# Also start a new checker *right now*.
269
274
self.start_checker()
270
# Schedule a stop() when 'timeout' has passed
271
self.stop_initiator_tag = gobject.timeout_add\
272
(self._timeout_milliseconds,
273
self.stop)
274
def stop(self):
275
"""Stop this client.
276
The possibility that a client might be restarted is left open,
277
but not currently used."""
278
# If this client doesn't have a secret, it is already stopped.
279
if hasattr(self, "secret") and self.secret:
280
logger.info(u"Stopping client %s", self.name)
281
self.secret = None
282
else:
275
# Schedule a disable() when 'timeout' has passed
276
self.disable_initiator_tag = (gobject.timeout_add
277
(self.timeout_milliseconds(),
278
self.disable))
279
self.enabled = True
280
if self.use_dbus:
281
# Emit D-Bus signals
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
286
variant_level=1)))
287
288
def disable(self):
289
"""Disable this client."""
290
if not getattr(self, "enabled", False):
283
291
return False
284
if getattr(self, "stop_initiator_tag", False):
285
gobject.source_remove(self.stop_initiator_tag)
286
self.stop_initiator_tag = None
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
294
gobject.source_remove(self.disable_initiator_tag)
295
self.disable_initiator_tag = None
287
296
if getattr(self, "checker_initiator_tag", False):
288
297
gobject.source_remove(self.checker_initiator_tag)
289
298
self.checker_initiator_tag = None
290
299
self.stop_checker()
291
if self.stop_hook:
292
self.stop_hook(self)
300
if self.disable_hook:
301
self.disable_hook(self)
302
self.enabled = False
303
if self.use_dbus:
304
# Emit D-Bus signal
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
293
307
# Do not run this again if called by a gobject.timeout_add
294
308
return False
309
295
310
def __del__(self):
296
self.stop_hook = None
297
self.stop()
298
def checker_callback(self, pid, condition):
311
self.disable_hook = None
312
self.disable()
313
314
def checker_callback(self, pid, condition, command):
299
315
"""The checker has completed, so take appropriate actions."""
300
now = datetime.datetime.now()
301
316
self.checker_callback_tag = None
302
317
self.checker = None
303
if os.WIFEXITED(condition) \
304
and (os.WEXITSTATUS(condition) == 0):
318
if self.use_dbus:
319
# Emit D-Bus signal
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
305
324
logger.info(u"Checker for %(name)s succeeded",
306
325
vars(self))
307
self.last_checked_ok = now
308
gobject.source_remove(self.stop_initiator_tag)
309
self.stop_initiator_tag = gobject.timeout_add\
310
(self._timeout_milliseconds,
311
self.stop)
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
331
self.bump_timeout()
312
332
elif not os.WIFEXITED(condition):
313
333
logger.warning(u"Checker for %(name)s crashed?",
314
334
vars(self))
335
if self.use_dbus:
336
# Emit D-Bus signal
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
315
340
else:
316
341
logger.info(u"Checker for %(name)s failed",
317
342
vars(self))
343
if self.use_dbus:
344
# Emit D-Bus signal
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
348
349
def bump_timeout(self):
350
"""Bump up the timeout for this client.
351
This should only be called when the client has been seen,
352
alive and well.
353
"""
354
self.last_checked_ok = datetime.datetime.utcnow()
355
gobject.source_remove(self.disable_initiator_tag)
356
self.disable_initiator_tag = (gobject.timeout_add
357
(self.timeout_milliseconds(),
358
self.disable))
359
if self.use_dbus:
360
# Emit D-Bus signal
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
364
variant_level=1)))
365
318
366
def start_checker(self):
319
367
"""Start a new checker subprocess if one is not running.
320
368
If a checker already exists, leave it running and do
329
377
# is as it should be.
330
378
if self.checker is None:
331
379
try:
332
# In case check_command has exactly one % operator
333
command = self.check_command % self.host
380
# In case checker_command has exactly one % operator
381
command = self.checker_command % self.host
334
382
except TypeError:
335
383
# Escape attributes for the shell
336
384
escaped_attrs = dict((key, re.escape(str(val)))
337
385
for key, val in
338
386
vars(self).iteritems())
339
387
try:
340
command = self.check_command % escaped_attrs
388
command = self.checker_command % escaped_attrs
341
389
except TypeError, error:
342
390
logger.error(u'Could not format string "%s":'
343
u' %s', self.check_command, error)
391
u' %s', self.checker_command, error)
344
392
return True # Try again later
345
393
try:
346
394
logger.info(u"Starting checker %r for %s",
352
400
self.checker = subprocess.Popen(command,
353
401
close_fds=True,
354
402
shell=True, cwd="/")
355
self.checker_callback_tag = gobject.child_watch_add\
356
(self.checker.pid,
357
self.checker_callback)
403
if self.use_dbus:
404
# Emit D-Bus signal
405
self.CheckerStarted(command)
406
self.PropertyChanged(
407
dbus.String("checker_running"),
408
dbus.Boolean(True, variant_level=1))
409
self.checker_callback_tag = (gobject.child_watch_add
410
(self.checker.pid,
411
self.checker_callback,
412
data=command))
358
413
except OSError, error:
359
414
logger.error(u"Failed to start subprocess: %s",
360
415
error)
361
416
# Re-run this periodically if run by gobject.timeout_add
362
417
return True
418
363
419
def stop_checker(self):
364
420
"""Force the checker process, if any, to stop."""
365
421
if self.checker_callback_tag:
377
433
if error.errno != errno.ESRCH: # No such process
378
434
raise
379
435
self.checker = None
436
if self.use_dbus:
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
439
380
440
def still_valid(self):
381
441
"""Has the timeout not yet passed for this client?"""
382
now = datetime.datetime.now()
442
if not getattr(self, "enabled", False):
443
return False
444
now = datetime.datetime.utcnow()
383
445
if self.last_checked_ok is None:
384
446
return now < (self.created + self.timeout)
385
447
else:
386
448
return now < (self.last_checked_ok + self.timeout)
449
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
452
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
456
457
# CheckerCompleted - signal
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
460
"D-Bus signal"
461
pass
462
463
# CheckerStarted - signal
464
@dbus.service.signal(_interface, signature="s")
465
def CheckerStarted(self, command):
466
"D-Bus signal"
467
pass
468
469
# GetAllProperties - method
470
@dbus.service.method(_interface, out_signature="a{sv}")
471
def GetAllProperties(self):
472
"D-Bus method"
473
return dbus.Dictionary({
474
dbus.String("name"):
475
dbus.String(self.name, variant_level=1),
476
dbus.String("fingerprint"):
477
dbus.String(self.fingerprint, variant_level=1),
478
dbus.String("host"):
479
dbus.String(self.host, variant_level=1),
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
484
variant_level=1)
485
if self.last_enabled is not None
486
else dbus.Boolean(False, variant_level=1)),
487
dbus.String("enabled"):
488
dbus.Boolean(self.enabled, variant_level=1),
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
491
variant_level=1)
492
if self.last_checked_ok is not None
493
else dbus.Boolean (False, variant_level=1)),
494
dbus.String("timeout"):
495
dbus.UInt64(self.timeout_milliseconds(),
496
variant_level=1),
497
dbus.String("interval"):
498
dbus.UInt64(self.interval_milliseconds(),
499
variant_level=1),
500
dbus.String("checker"):
501
dbus.String(self.checker_command,
502
variant_level=1),
503
dbus.String("checker_running"):
504
dbus.Boolean(self.checker is not None,
505
variant_level=1),
506
}, signature="sv")
507
508
# IsStillValid - method
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
510
(still_valid))
511
IsStillValid.__name__ = "IsStillValid"
512
513
# PropertyChanged - signal
514
@dbus.service.signal(_interface, signature="sv")
515
def PropertyChanged(self, property, value):
516
"D-Bus signal"
517
pass
518
519
# SetChecker - method
520
@dbus.service.method(_interface, in_signature="s")
521
def SetChecker(self, checker):
522
"D-Bus setter method"
523
self.checker_command = checker
524
# Emit D-Bus signal
525
self.PropertyChanged(dbus.String(u"checker"),
526
dbus.String(self.checker_command,
527
variant_level=1))
528
529
# SetHost - method
530
@dbus.service.method(_interface, in_signature="s")
531
def SetHost(self, host):
532
"D-Bus setter method"
533
self.host = host
534
# Emit D-Bus signal
535
self.PropertyChanged(dbus.String(u"host"),
536
dbus.String(self.host, variant_level=1))
537
538
# SetInterval - method
539
@dbus.service.method(_interface, in_signature="t")
540
def SetInterval(self, milliseconds):
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
542
# Emit D-Bus signal
543
self.PropertyChanged(dbus.String(u"interval"),
544
(dbus.UInt64(self.interval_milliseconds(),
545
variant_level=1)))
546
547
# SetSecret - method
548
@dbus.service.method(_interface, in_signature="ay",
549
byte_arrays=True)
550
def SetSecret(self, secret):
551
"D-Bus setter method"
552
self.secret = str(secret)
553
554
# SetTimeout - method
555
@dbus.service.method(_interface, in_signature="t")
556
def SetTimeout(self, milliseconds):
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
558
# Emit D-Bus signal
559
self.PropertyChanged(dbus.String(u"timeout"),
560
(dbus.UInt64(self.timeout_milliseconds(),
561
variant_level=1)))
562
563
# Enable - method
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
566
567
# StartChecker - method
568
@dbus.service.method(_interface)
569
def StartChecker(self):
570
"D-Bus method"
571
self.start_checker()
572
573
# Disable - method
574
@dbus.service.method(_interface)
575
def Disable(self):
576
"D-Bus method"
577
self.disable()
578
579
# StopChecker - method
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
582
583
del _interface
387
584
388
585
389
586
def peer_certificate(session):
390
587
"Return the peer's OpenPGP certificate as a bytestring"
391
588
# If not an OpenPGP certificate...
392
if gnutls.library.functions.gnutls_certificate_type_get\
393
(session._c_object) \
394
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
395
592
# ...do the normal thing
396
593
return session.peer_certificate
397
594
list_size = ctypes.c_uint()
398
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
399
(session._c_object, ctypes.byref(list_size))
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
400
598
if list_size.value == 0:
401
599
return None
402
600
cert = cert_list[0]
406
604
def fingerprint(openpgp):
407
605
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
408
606
# New GnuTLS "datum" with the OpenPGP public key
409
datum = gnutls.library.types.gnutls_datum_t\
410
(ctypes.cast(ctypes.c_char_p(openpgp),
411
ctypes.POINTER(ctypes.c_ubyte)),
412
ctypes.c_uint(len(openpgp)))
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
609
ctypes.POINTER
610
(ctypes.c_ubyte)),
611
ctypes.c_uint(len(openpgp))))
413
612
# New empty GnuTLS certificate
414
613
crt = gnutls.library.types.gnutls_openpgp_crt_t()
415
gnutls.library.functions.gnutls_openpgp_crt_init\
416
(ctypes.byref(crt))
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
417
616
# Import the OpenPGP public key into the certificate
418
gnutls.library.functions.gnutls_openpgp_crt_import\
419
(crt, ctypes.byref(datum),
420
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
421
621
# Verify the self signature in the key
422
622
crtverify = ctypes.c_uint()
423
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
424
(crt, 0, ctypes.byref(crtverify))
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
425
625
if crtverify.value != 0:
426
626
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
427
627
raise gnutls.errors.CertificateSecurityError("Verify failed")
429
629
buf = ctypes.create_string_buffer(20)
430
630
buf_len = ctypes.c_size_t()
431
631
# Get the fingerprint from the certificate into the buffer
432
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
433
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
434
635
# Deinit the certificate
435
636
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
436
637
# Convert the buffer to a Python bytestring
447
648
448
649
def handle(self):
449
650
logger.info(u"TCP connection from: %s",
450
unicode(self.client_address))
451
session = gnutls.connection.ClientSession\
452
(self.request, gnutls.connection.X509Credentials())
651
unicode(self.client_address))
652
session = (gnutls.connection
653
.ClientSession(self.request,
654
gnutls.connection
655
.X509Credentials()))
453
656
454
657
line = self.request.makefile().readline()
455
658
logger.debug(u"Protocol version: %r", line)
468
671
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
469
672
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
470
673
# "+DHE-DSS"))
471
priority = "NORMAL" # Fallback default, since this
472
# MUST be set.
473
if self.server.settings["priority"]:
474
priority = self.server.settings["priority"]
475
gnutls.library.functions.gnutls_priority_set_direct\
476
(session._c_object, priority, None)
674
# Use a fallback default, since this MUST be set.
675
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
678
priority, None))
477
679
478
680
try:
479
681
session.handshake()
489
691
session.bye()
490
692
return
491
693
logger.debug(u"Fingerprint: %s", fpr)
492
client = None
493
694
for c in self.server.clients:
494
695
if c.fingerprint == fpr:
495
696
client = c
496
697
break
497
if not client:
698
else:
498
699
logger.warning(u"Client not found for fingerprint: %s",
499
700
fpr)
500
701
session.bye()
507
708
vars(client))
508
709
session.bye()
509
710
return
711
## This won't work here, since we're in a fork.
712
# client.bump_timeout()
510
713
sent_size = 0
511
714
while sent_size < len(client.secret):
512
715
sent = session.send(client.secret[sent_size:])
517
720
session.bye()
518
721
519
722
520
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
724
SocketServer.TCPServer, object):
521
725
"""IPv6 TCP server. Accepts 'None' as address and/or port.
522
726
Attributes:
523
727
settings: Server settings
636
840
elif state == avahi.ENTRY_GROUP_FAILURE:
637
841
logger.critical(u"Avahi: Error in group state changed %s",
638
842
unicode(error))
639
raise AvahiGroupError("State changed: %s", str(error))
843
raise AvahiGroupError(u"State changed: %s" % unicode(error))
640
844
641
845
def if_nametoindex(interface):
642
846
"""Call the C function if_nametoindex(), or equivalent"""
643
847
global if_nametoindex
644
848
try:
645
if_nametoindex = ctypes.cdll.LoadLibrary\
646
(ctypes.util.find_library("c")).if_nametoindex
849
if_nametoindex = (ctypes.cdll.LoadLibrary
850
(ctypes.util.find_library("c"))
851
.if_nametoindex)
647
852
except (OSError, AttributeError):
648
853
if "struct" not in sys.modules:
649
854
import struct
652
857
def if_nametoindex(interface):
653
858
"Get an interface index the hard way, i.e. using fcntl()"
654
859
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
655
s = socket.socket()
656
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
657
struct.pack("16s16x", interface))
658
s.close()
860
with closing(socket.socket()) as s:
861
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
862
struct.pack("16s16x", interface))
659
863
interface_index = struct.unpack("I", ifreq[16:20])[0]
660
864
return interface_index
661
865
return if_nametoindex(interface)
685
889
686
890
687
891
def main():
688
parser = OptionParser(version = "%%prog %s" % version)
892
parser = optparse.OptionParser(version = "%%prog %s" % version)
689
893
parser.add_option("-i", "--interface", type="string",
690
894
metavar="IF", help="Bind to interface IF")
691
895
parser.add_option("-a", "--address", type="string",
692
896
help="Address to listen for requests on")
693
897
parser.add_option("-p", "--port", type="int",
694
898
help="Port number to receive requests on")
695
parser.add_option("--check", action="store_true", default=False,
899
parser.add_option("--check", action="store_true",
696
900
help="Run self-test")
697
901
parser.add_option("--debug", action="store_true",
698
902
help="Debug mode; run in foreground and log to"
705
909
default="/etc/mandos", metavar="DIR",
706
910
help="Directory to search for configuration"
707
911
" files")
912
parser.add_option("--no-dbus", action="store_false",
913
dest="use_dbus",
914
help="Do not provide D-Bus system bus"
915
" interface")
708
916
options = parser.parse_args()[0]
709
917
710
918
if options.check:
720
928
"priority":
721
929
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
722
930
"servicename": "Mandos",
931
"use_dbus": "True",
723
932
}
724
933
725
934
# Parse config file for server-global settings
728
937
server_config.read(os.path.join(options.configdir, "mandos.conf"))
729
938
# Convert the SafeConfigParser object to a dict
730
939
server_settings = server_config.defaults()
731
# Use getboolean on the boolean config option
732
server_settings["debug"] = server_config.getboolean\
733
("DEFAULT", "debug")
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
734
945
del server_config
735
946
736
947
# Override the settings from the config file with command line
737
948
# options, if set.
738
949
for option in ("interface", "address", "port", "debug",
739
"priority", "servicename", "configdir"):
950
"priority", "servicename", "configdir",
951
"use_dbus"):
740
952
value = getattr(options, option)
741
953
if value is not None:
742
954
server_settings[option] = value
743
955
del options
744
956
# Now we have our good server settings in "server_settings"
745
957
958
# For convenience
746
959
debug = server_settings["debug"]
960
use_dbus = server_settings["use_dbus"]
747
961
748
962
if not debug:
749
963
syslogger.setLevel(logging.WARNING)
750
964
console.setLevel(logging.WARNING)
751
965
752
966
if server_settings["servicename"] != "Mandos":
753
syslogger.setFormatter(logging.Formatter\
967
syslogger.setFormatter(logging.Formatter
754
968
('Mandos (%s): %%(levelname)s:'
755
969
' %%(message)s'
756
970
% server_settings["servicename"]))
758
972
# Parse config file with clients
759
973
client_defaults = { "timeout": "1h",
760
974
"interval": "5m",
761
"checker": "fping -q -- %(host)s",
975
"checker": "fping -q -- %%(host)s",
762
976
"host": "",
763
977
}
764
978
client_config = ConfigParser.SafeConfigParser(client_defaults)
777
991
except IOError, error:
778
992
logger.error("Could not open file %r", pidfilename)
779
993
780
uid = 65534
781
gid = 65534
782
try:
783
uid = pwd.getpwnam("mandos").pw_uid
784
except KeyError:
785
try:
786
uid = pwd.getpwnam("nobody").pw_uid
787
except KeyError:
788
pass
789
try:
790
gid = pwd.getpwnam("mandos").pw_gid
791
except KeyError:
792
try:
793
gid = pwd.getpwnam("nogroup").pw_gid
794
except KeyError:
795
pass
994
try:
995
uid = pwd.getpwnam("_mandos").pw_uid
996
gid = pwd.getpwnam("_mandos").pw_gid
997
except KeyError:
998
try:
999
uid = pwd.getpwnam("mandos").pw_uid
1000
gid = pwd.getpwnam("mandos").pw_gid
1001
except KeyError:
1002
try:
1003
uid = pwd.getpwnam("nobody").pw_uid
1004
gid = pwd.getpwnam("nogroup").pw_gid
1005
except KeyError:
1006
uid = 65534
1007
gid = 65534
796
1008
try:
797
1009
os.setuid(uid)
798
1010
os.setgid(gid)
804
1016
service = AvahiService(name = server_settings["servicename"],
805
1017
servicetype = "_mandos._tcp", )
806
1018
if server_settings["interface"]:
807
service.interface = if_nametoindex\
808
(server_settings["interface"])
1019
service.interface = (if_nametoindex
1020
(server_settings["interface"]))
809
1021
810
1022
global main_loop
811
1023
global bus
818
1030
avahi.DBUS_PATH_SERVER),
819
1031
avahi.DBUS_INTERFACE_SERVER)
820
1032
# End of Avahi example code
821
822
def remove_from_clients(client):
823
clients.remove(client)
824
if not clients:
825
logger.critical(u"No clients left, exiting")
826
sys.exit()
1033
if use_dbus:
1034
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1035
bus)
827
1036
828
1037
clients.update(Set(Client(name = section,
829
stop_hook = remove_from_clients,
830
1038
config
831
= dict(client_config.items(section)))
1039
= dict(client_config.items(section)),
1040
use_dbus = use_dbus)
832
1041
for section in client_config.sections()))
833
1042
if not clients:
834
logger.critical(u"No clients defined")
835
sys.exit(1)
1043
logger.warning(u"No clients defined")
836
1044
837
1045
if debug:
838
1046
# Redirect stdin so all checkers get /dev/null
870
1078
871
1079
while clients:
872
1080
client = clients.pop()
873
client.stop_hook = None
874
client.stop()
1081
client.disable_hook = None
1082
client.disable()
875
1083
876
1084
atexit.register(cleanup)
877
1085
880
1088
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
881
1089
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
882
1090
1091
if use_dbus:
1092
class MandosServer(dbus.service.Object):
1093
"""A D-Bus proxy object"""
1094
def __init__(self):
1095
dbus.service.Object.__init__(self, bus,
1096
"/Mandos")
1097
_interface = u"org.mandos_system.Mandos"
1098
1099
@dbus.service.signal(_interface, signature="oa{sv}")
1100
def ClientAdded(self, objpath, properties):
1101
"D-Bus signal"
1102
pass
1103
1104
@dbus.service.signal(_interface, signature="o")
1105
def ClientRemoved(self, objpath):
1106
"D-Bus signal"
1107
pass
1108
1109
@dbus.service.method(_interface, out_signature="ao")
1110
def GetAllClients(self):
1111
return dbus.Array(c.dbus_object_path for c in clients)
1112
1113
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1114
def GetAllClientsWithProperties(self):
1115
return dbus.Dictionary(
1116
((c.dbus_object_path, c.GetAllProperties())
1117
for c in clients),
1118
signature="oa{sv}")
1119
1120
@dbus.service.method(_interface, in_signature="o")
1121
def RemoveClient(self, object_path):
1122
for c in clients:
1123
if c.dbus_object_path == object_path:
1124
clients.remove(c)
1125
# Don't signal anything except ClientRemoved
1126
c.use_dbus = False
1127
c.disable()
1128
# Emit D-Bus signal
1129
self.ClientRemoved(object_path)
1130
return
1131
raise KeyError
1132
@dbus.service.method(_interface)
1133
def Quit(self):
1134
main_loop.quit()
1135
1136
del _interface
1137
1138
mandos_server = MandosServer()
1139
883
1140
for client in clients:
884
client.start()
1141
if use_dbus:
1142
# Emit D-Bus signal
1143
mandos_server.ClientAdded(client.dbus_object_path,
1144
client.GetAllProperties())
1145
client.enable()
885
1146
886
1147
tcp_server.enable()
887
1148
tcp_server.server_activate()
905
1166
906
1167
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
907
1168
lambda *args, **kwargs:
908
tcp_server.handle_request\
909
(*args[2:], **kwargs) or True)
1169
(tcp_server.handle_request
1170
(*args[2:], **kwargs) or True))
910
1171
911
1172
logger.debug(u"Starting main loop")
912
1173
main_loop.run()
913
1174
except AvahiError, error:
914
logger.critical(u"AvahiError: %s" + unicode(error))
1175
logger.critical(u"AvahiError: %s", error)
915
1176
sys.exit(1)
916
1177
except KeyboardInterrupt:
917
1178
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0