To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 280
- compare with another revision
- download diff
- download tarball
- view history from revision 280
- Committer: Teddy Hogeborn
- Date: 2009-01-20 02:23:59 UTC
- Revision ID: teddy@fukt.bsnet.se-20090120022359-0go4voqdz5pxc1pu
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
exitstatus and waitstatus, not
just a bool and waitstatus. All
emitters changed.
exitstatus and waitstatus, not
just a bool and waitstatus. All
emitters changed.
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- plugins.d/usplash
- files renamed:
- plugins.d/password-request.c => plugins.d/mandos-client.c
- plugins.d/password-request.xml => plugins.d/mandos-client.xml
- files modified:
- Makefile
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
24
25
# GNU General Public License for more details.
25
26
#
26
27
# You should have received a copy of the GNU General Public License
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
28
30
#
29
31
# Contact the authors at <mandos@fukt.bsnet.se>.
30
32
#
31
33
32
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
33
35
34
36
import SocketServer
35
37
import socket
36
import select
37
from optparse import OptionParser
38
import optparse
38
39
import datetime
39
40
import errno
40
41
import gnutls.crypto
54
55
import stat
55
56
import logging
56
57
import logging.handlers
58
import pwd
59
from contextlib import closing
57
60
58
61
import dbus
62
import dbus.service
59
63
import gobject
60
64
import avahi
61
65
from dbus.mainloop.glib import DBusGMainLoop
62
66
import ctypes
67
import ctypes.util
63
68
64
version = "1.0"
69
version = "1.0.5"
65
70
66
71
logger = logging.Logger('mandos')
67
syslogger = logging.handlers.SysLogHandler\
68
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
69
address = "/dev/log")
70
syslogger.setFormatter(logging.Formatter\
71
('Mandos: %(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
72
77
logger.addHandler(syslogger)
73
78
74
79
console = logging.StreamHandler()
77
82
logger.addHandler(console)
78
83
79
84
class AvahiError(Exception):
80
def __init__(self, value):
85
def __init__(self, value, *args, **kwargs):
81
86
self.value = value
82
def __str__(self):
83
return repr(self.value)
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
84
90
85
91
class AvahiServiceError(AvahiError):
86
92
pass
106
112
a sensible number of times
107
113
"""
108
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
109
type = None, port = None, TXT = None, domain = "",
110
host = "", max_renames = 32768):
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
111
117
self.interface = interface
112
118
self.name = name
113
self.type = type
119
self.type = servicetype
114
120
self.port = port
115
if TXT is None:
116
self.TXT = []
117
else:
118
self.TXT = TXT
121
self.TXT = TXT if TXT is not None else []
119
122
self.domain = domain
120
123
self.host = host
121
124
self.rename_count = 0
123
126
def rename(self):
124
127
"""Derived from the Avahi example code"""
125
128
if self.rename_count >= self.max_renames:
126
logger.critical(u"No suitable service name found after %i"
127
u" retries, exiting.", rename_count)
128
raise AvahiServiceError("Too many renames")
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
129
133
self.name = server.GetAlternativeServiceName(self.name)
130
logger.info(u"Changing name to %r ...", str(self.name))
131
syslogger.setFormatter(logging.Formatter\
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
132
137
('Mandos (%s): %%(levelname)s:'
133
' %%(message)s' % self.name))
138
' %%(message)s' % self.name))
134
139
self.remove()
135
140
self.add()
136
141
self.rename_count += 1
142
147
"""Derived from the Avahi example code"""
143
148
global group
144
149
if group is None:
145
group = dbus.Interface\
146
(bus.get_object(avahi.DBUS_NAME,
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
147
152
server.EntryGroupNew()),
148
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
149
154
group.connect_to_signal('StateChanged',
150
155
entry_group_state_changed)
151
logger.debug(u"Adding service '%s' of type '%s' ...",
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
152
157
service.name, service.type)
153
158
group.AddService(
154
159
self.interface, # interface
165
170
# End of Avahi example code
166
171
167
172
168
class Client(object):
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
169
179
"""A representation of a client host served by this server.
170
180
Attributes:
171
name: string; from the config file, used in log messages
181
name: string; from the config file, used in log messages and
182
D-Bus identifiers
172
183
fingerprint: string (40 or 32 hexadecimal digits); used to
173
184
uniquely identify the client
174
secret: bytestring; sent verbatim (over TLS) to client
175
host: string; available for use by the checker command
176
created: datetime.datetime(); object creation, not client host
177
last_checked_ok: datetime.datetime() or None if not yet checked OK
178
timeout: datetime.timedelta(); How long from last_checked_ok
179
until this client is invalid
180
interval: datetime.timedelta(); How often to start a new checker
181
stop_hook: If set, called by stop() as stop_hook(self)
182
checker: subprocess.Popen(); a running checker process used
183
to see if the client lives.
184
'None' if no process is running.
185
secret: bytestring; sent verbatim (over TLS) to client
186
host: string; available for use by the checker command
187
created: datetime.datetime(); (UTC) object creation
188
last_enabled: datetime.datetime(); (UTC)
189
enabled: bool()
190
last_checked_ok: datetime.datetime(); (UTC) or None
191
timeout: datetime.timedelta(); How long from last_checked_ok
192
until this client is invalid
193
interval: datetime.timedelta(); How often to start a new checker
194
disable_hook: If set, called by disable() as disable_hook(self)
195
checker: subprocess.Popen(); a running checker process used
196
to see if the client lives.
197
'None' if no process is running.
185
198
checker_initiator_tag: a gobject event source tag, or None
186
stop_initiator_tag: - '' -
199
disable_initiator_tag: - '' -
187
200
checker_callback_tag: - '' -
188
201
checker_command: string; External command which is run to check if
189
202
client lives. %() expansions are done at
190
203
runtime with vars(self) as dict, so that for
191
204
instance %(name)s can be used in the command.
192
Private attibutes:
193
_timeout: Real variable for 'timeout'
194
_interval: Real variable for 'interval'
195
_timeout_milliseconds: Used when calling gobject.timeout_add()
196
_interval_milliseconds: - '' -
205
use_dbus: bool(); Whether to provide D-Bus interface and signals
206
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
197
207
"""
198
def _set_timeout(self, timeout):
199
"Setter function for 'timeout' attribute"
200
self._timeout = timeout
201
self._timeout_milliseconds = ((self.timeout.days
202
* 24 * 60 * 60 * 1000)
203
+ (self.timeout.seconds * 1000)
204
+ (self.timeout.microseconds
205
// 1000))
206
timeout = property(lambda self: self._timeout,
207
_set_timeout)
208
del _set_timeout
209
def _set_interval(self, interval):
210
"Setter function for 'interval' attribute"
211
self._interval = interval
212
self._interval_milliseconds = ((self.interval.days
213
* 24 * 60 * 60 * 1000)
214
+ (self.interval.seconds
215
* 1000)
216
+ (self.interval.microseconds
217
// 1000))
218
interval = property(lambda self: self._interval,
219
_set_interval)
220
del _set_interval
221
def __init__(self, name = None, stop_hook=None, config={}):
208
def timeout_milliseconds(self):
209
"Return the 'timeout' attribute in milliseconds"
210
return ((self.timeout.days * 24 * 60 * 60 * 1000)
211
+ (self.timeout.seconds * 1000)
212
+ (self.timeout.microseconds // 1000))
213
214
def interval_milliseconds(self):
215
"Return the 'interval' attribute in milliseconds"
216
return ((self.interval.days * 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds * 1000)
218
+ (self.interval.microseconds // 1000))
219
220
def __init__(self, name = None, disable_hook=None, config=None,
221
use_dbus=True):
222
222
"""Note: the 'checker' key in 'config' sets the
223
223
'checker_command' attribute and *not* the 'checker'
224
224
attribute."""
225
225
self.name = name
226
if config is None:
227
config = {}
226
228
logger.debug(u"Creating client %r", self.name)
229
self.use_dbus = False # During __init__
227
230
# Uppercase and remove spaces from fingerprint for later
228
231
# comparison purposes with return value from the fingerprint()
229
232
# function
230
self.fingerprint = config["fingerprint"].upper()\
231
.replace(u" ", u"")
233
self.fingerprint = (config["fingerprint"].upper()
234
.replace(u" ", u""))
232
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
233
236
if "secret" in config:
234
237
self.secret = config["secret"].decode(u"base64")
235
238
elif "secfile" in config:
236
sf = open(config["secfile"])
237
self.secret = sf.read()
238
sf.close()
239
with closing(open(os.path.expanduser
240
(os.path.expandvars
241
(config["secfile"])))) as secfile:
242
self.secret = secfile.read()
239
243
else:
240
244
raise TypeError(u"No secret or secfile for client %s"
241
245
% self.name)
242
246
self.host = config.get("host", "")
243
self.created = datetime.datetime.now()
247
self.created = datetime.datetime.utcnow()
248
self.enabled = False
249
self.last_enabled = None
244
250
self.last_checked_ok = None
245
251
self.timeout = string_to_delta(config["timeout"])
246
252
self.interval = string_to_delta(config["interval"])
247
self.stop_hook = stop_hook
253
self.disable_hook = disable_hook
248
254
self.checker = None
249
255
self.checker_initiator_tag = None
250
self.stop_initiator_tag = None
256
self.disable_initiator_tag = None
251
257
self.checker_callback_tag = None
252
self.check_command = config["checker"]
253
def start(self):
258
self.checker_command = config["checker"]
259
self.last_connect = None
260
# Only now, when this client is initialized, can it show up on
261
# the D-Bus
262
self.use_dbus = use_dbus
263
if self.use_dbus:
264
self.dbus_object_path = (dbus.ObjectPath
265
("/clients/"
266
+ self.name.replace(".", "_")))
267
dbus.service.Object.__init__(self, bus,
268
self.dbus_object_path)
269
270
def enable(self):
254
271
"""Start this client's checker and timeout hooks"""
272
self.last_enabled = datetime.datetime.utcnow()
255
273
# Schedule a new checker to be started an 'interval' from now,
256
274
# and every interval from then on.
257
self.checker_initiator_tag = gobject.timeout_add\
258
(self._interval_milliseconds,
259
self.start_checker)
275
self.checker_initiator_tag = (gobject.timeout_add
276
(self.interval_milliseconds(),
277
self.start_checker))
260
278
# Also start a new checker *right now*.
261
279
self.start_checker()
262
# Schedule a stop() when 'timeout' has passed
263
self.stop_initiator_tag = gobject.timeout_add\
264
(self._timeout_milliseconds,
265
self.stop)
266
def stop(self):
267
"""Stop this client.
268
The possibility that a client might be restarted is left open,
269
but not currently used."""
270
# If this client doesn't have a secret, it is already stopped.
271
if hasattr(self, "secret") and self.secret:
272
logger.info(u"Stopping client %s", self.name)
273
self.secret = None
274
else:
280
# Schedule a disable() when 'timeout' has passed
281
self.disable_initiator_tag = (gobject.timeout_add
282
(self.timeout_milliseconds(),
283
self.disable))
284
self.enabled = True
285
if self.use_dbus:
286
# Emit D-Bus signals
287
self.PropertyChanged(dbus.String(u"enabled"),
288
dbus.Boolean(True, variant_level=1))
289
self.PropertyChanged(dbus.String(u"last_enabled"),
290
(_datetime_to_dbus(self.last_enabled,
291
variant_level=1)))
292
293
def disable(self):
294
"""Disable this client."""
295
if not getattr(self, "enabled", False):
275
296
return False
276
if getattr(self, "stop_initiator_tag", False):
277
gobject.source_remove(self.stop_initiator_tag)
278
self.stop_initiator_tag = None
297
logger.info(u"Disabling client %s", self.name)
298
if getattr(self, "disable_initiator_tag", False):
299
gobject.source_remove(self.disable_initiator_tag)
300
self.disable_initiator_tag = None
279
301
if getattr(self, "checker_initiator_tag", False):
280
302
gobject.source_remove(self.checker_initiator_tag)
281
303
self.checker_initiator_tag = None
282
304
self.stop_checker()
283
if self.stop_hook:
284
self.stop_hook(self)
305
if self.disable_hook:
306
self.disable_hook(self)
307
self.enabled = False
308
if self.use_dbus:
309
# Emit D-Bus signal
310
self.PropertyChanged(dbus.String(u"enabled"),
311
dbus.Boolean(False, variant_level=1))
285
312
# Do not run this again if called by a gobject.timeout_add
286
313
return False
314
287
315
def __del__(self):
288
self.stop_hook = None
289
self.stop()
290
def checker_callback(self, pid, condition):
316
self.disable_hook = None
317
self.disable()
318
319
def checker_callback(self, pid, condition, command):
291
320
"""The checker has completed, so take appropriate actions."""
292
now = datetime.datetime.now()
293
321
self.checker_callback_tag = None
294
322
self.checker = None
295
if os.WIFEXITED(condition) \
296
and (os.WEXITSTATUS(condition) == 0):
297
logger.info(u"Checker for %(name)s succeeded",
298
vars(self))
299
self.last_checked_ok = now
300
gobject.source_remove(self.stop_initiator_tag)
301
self.stop_initiator_tag = gobject.timeout_add\
302
(self._timeout_milliseconds,
303
self.stop)
304
elif not os.WIFEXITED(condition):
323
if self.use_dbus:
324
# Emit D-Bus signal
325
self.PropertyChanged(dbus.String(u"checker_running"),
326
dbus.Boolean(False, variant_level=1))
327
if os.WIFEXITED(condition):
328
exitstatus = os.WEXITSTATUS(condition)
329
if exitstatus == 0:
330
logger.info(u"Checker for %(name)s succeeded",
331
vars(self))
332
self.bump_timeout()
333
else:
334
logger.info(u"Checker for %(name)s failed",
335
vars(self))
336
if self.use_dbus:
337
# Emit D-Bus signal
338
self.CheckerCompleted(dbus.Int16(exitstatus),
339
dbus.Int64(condition),
340
dbus.String(command))
341
else:
305
342
logger.warning(u"Checker for %(name)s crashed?",
306
343
vars(self))
307
else:
308
logger.info(u"Checker for %(name)s failed",
309
vars(self))
344
if self.use_dbus:
345
# Emit D-Bus signal
346
self.CheckerCompleted(dbus.Int16(-1),
347
dbus.Int64(condition),
348
dbus.String(command))
349
350
def bump_timeout(self):
351
"""Bump up the timeout for this client.
352
This should only be called when the client has been seen,
353
alive and well.
354
"""
355
self.last_checked_ok = datetime.datetime.utcnow()
356
gobject.source_remove(self.disable_initiator_tag)
357
self.disable_initiator_tag = (gobject.timeout_add
358
(self.timeout_milliseconds(),
359
self.disable))
360
if self.use_dbus:
361
# Emit D-Bus signal
362
self.PropertyChanged(
363
dbus.String(u"last_checked_ok"),
364
(_datetime_to_dbus(self.last_checked_ok,
365
variant_level=1)))
366
310
367
def start_checker(self):
311
368
"""Start a new checker subprocess if one is not running.
312
369
If a checker already exists, leave it running and do
321
378
# is as it should be.
322
379
if self.checker is None:
323
380
try:
324
# In case check_command has exactly one % operator
325
command = self.check_command % self.host
381
# In case checker_command has exactly one % operator
382
command = self.checker_command % self.host
326
383
except TypeError:
327
384
# Escape attributes for the shell
328
385
escaped_attrs = dict((key, re.escape(str(val)))
329
386
for key, val in
330
387
vars(self).iteritems())
331
388
try:
332
command = self.check_command % escaped_attrs
389
command = self.checker_command % escaped_attrs
333
390
except TypeError, error:
334
391
logger.error(u'Could not format string "%s":'
335
u' %s', self.check_command, error)
392
u' %s', self.checker_command, error)
336
393
return True # Try again later
337
394
try:
338
395
logger.info(u"Starting checker %r for %s",
344
401
self.checker = subprocess.Popen(command,
345
402
close_fds=True,
346
403
shell=True, cwd="/")
347
self.checker_callback_tag = gobject.child_watch_add\
348
(self.checker.pid,
349
self.checker_callback)
404
if self.use_dbus:
405
# Emit D-Bus signal
406
self.CheckerStarted(command)
407
self.PropertyChanged(
408
dbus.String("checker_running"),
409
dbus.Boolean(True, variant_level=1))
410
self.checker_callback_tag = (gobject.child_watch_add
411
(self.checker.pid,
412
self.checker_callback,
413
data=command))
350
414
except OSError, error:
351
415
logger.error(u"Failed to start subprocess: %s",
352
416
error)
353
417
# Re-run this periodically if run by gobject.timeout_add
354
418
return True
419
355
420
def stop_checker(self):
356
421
"""Force the checker process, if any, to stop."""
357
422
if self.checker_callback_tag:
369
434
if error.errno != errno.ESRCH: # No such process
370
435
raise
371
436
self.checker = None
437
if self.use_dbus:
438
self.PropertyChanged(dbus.String(u"checker_running"),
439
dbus.Boolean(False, variant_level=1))
440
372
441
def still_valid(self):
373
442
"""Has the timeout not yet passed for this client?"""
374
now = datetime.datetime.now()
443
if not getattr(self, "enabled", False):
444
return False
445
now = datetime.datetime.utcnow()
375
446
if self.last_checked_ok is None:
376
447
return now < (self.created + self.timeout)
377
448
else:
378
449
return now < (self.last_checked_ok + self.timeout)
450
451
## D-Bus methods & signals
452
_interface = u"se.bsnet.fukt.Mandos.Client"
453
454
# BumpTimeout - method
455
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
456
BumpTimeout.__name__ = "BumpTimeout"
457
458
# CheckerCompleted - signal
459
@dbus.service.signal(_interface, signature="nxs")
460
def CheckerCompleted(self, exitcode, waitstatus, command):
461
"D-Bus signal"
462
pass
463
464
# CheckerStarted - signal
465
@dbus.service.signal(_interface, signature="s")
466
def CheckerStarted(self, command):
467
"D-Bus signal"
468
pass
469
470
# GetAllProperties - method
471
@dbus.service.method(_interface, out_signature="a{sv}")
472
def GetAllProperties(self):
473
"D-Bus method"
474
return dbus.Dictionary({
475
dbus.String("name"):
476
dbus.String(self.name, variant_level=1),
477
dbus.String("fingerprint"):
478
dbus.String(self.fingerprint, variant_level=1),
479
dbus.String("host"):
480
dbus.String(self.host, variant_level=1),
481
dbus.String("created"):
482
_datetime_to_dbus(self.created, variant_level=1),
483
dbus.String("last_enabled"):
484
(_datetime_to_dbus(self.last_enabled,
485
variant_level=1)
486
if self.last_enabled is not None
487
else dbus.Boolean(False, variant_level=1)),
488
dbus.String("enabled"):
489
dbus.Boolean(self.enabled, variant_level=1),
490
dbus.String("last_checked_ok"):
491
(_datetime_to_dbus(self.last_checked_ok,
492
variant_level=1)
493
if self.last_checked_ok is not None
494
else dbus.Boolean (False, variant_level=1)),
495
dbus.String("timeout"):
496
dbus.UInt64(self.timeout_milliseconds(),
497
variant_level=1),
498
dbus.String("interval"):
499
dbus.UInt64(self.interval_milliseconds(),
500
variant_level=1),
501
dbus.String("checker"):
502
dbus.String(self.checker_command,
503
variant_level=1),
504
dbus.String("checker_running"):
505
dbus.Boolean(self.checker is not None,
506
variant_level=1),
507
dbus.String("object_path"):
508
dbus.ObjectPath(self.dbus_object_path,
509
variant_level=1)
510
}, signature="sv")
511
512
# IsStillValid - method
513
IsStillValid = (dbus.service.method(_interface, out_signature="b")
514
(still_valid))
515
IsStillValid.__name__ = "IsStillValid"
516
517
# PropertyChanged - signal
518
@dbus.service.signal(_interface, signature="sv")
519
def PropertyChanged(self, property, value):
520
"D-Bus signal"
521
pass
522
523
# SetChecker - method
524
@dbus.service.method(_interface, in_signature="s")
525
def SetChecker(self, checker):
526
"D-Bus setter method"
527
self.checker_command = checker
528
# Emit D-Bus signal
529
self.PropertyChanged(dbus.String(u"checker"),
530
dbus.String(self.checker_command,
531
variant_level=1))
532
533
# SetHost - method
534
@dbus.service.method(_interface, in_signature="s")
535
def SetHost(self, host):
536
"D-Bus setter method"
537
self.host = host
538
# Emit D-Bus signal
539
self.PropertyChanged(dbus.String(u"host"),
540
dbus.String(self.host, variant_level=1))
541
542
# SetInterval - method
543
@dbus.service.method(_interface, in_signature="t")
544
def SetInterval(self, milliseconds):
545
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
546
# Emit D-Bus signal
547
self.PropertyChanged(dbus.String(u"interval"),
548
(dbus.UInt64(self.interval_milliseconds(),
549
variant_level=1)))
550
551
# SetSecret - method
552
@dbus.service.method(_interface, in_signature="ay",
553
byte_arrays=True)
554
def SetSecret(self, secret):
555
"D-Bus setter method"
556
self.secret = str(secret)
557
558
# SetTimeout - method
559
@dbus.service.method(_interface, in_signature="t")
560
def SetTimeout(self, milliseconds):
561
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
562
# Emit D-Bus signal
563
self.PropertyChanged(dbus.String(u"timeout"),
564
(dbus.UInt64(self.timeout_milliseconds(),
565
variant_level=1)))
566
567
# Enable - method
568
Enable = dbus.service.method(_interface)(enable)
569
Enable.__name__ = "Enable"
570
571
# StartChecker - method
572
@dbus.service.method(_interface)
573
def StartChecker(self):
574
"D-Bus method"
575
self.start_checker()
576
577
# Disable - method
578
@dbus.service.method(_interface)
579
def Disable(self):
580
"D-Bus method"
581
self.disable()
582
583
# StopChecker - method
584
StopChecker = dbus.service.method(_interface)(stop_checker)
585
StopChecker.__name__ = "StopChecker"
586
587
del _interface
379
588
380
589
381
590
def peer_certificate(session):
382
591
"Return the peer's OpenPGP certificate as a bytestring"
383
592
# If not an OpenPGP certificate...
384
if gnutls.library.functions.gnutls_certificate_type_get\
385
(session._c_object) \
386
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
593
if (gnutls.library.functions
594
.gnutls_certificate_type_get(session._c_object)
595
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
387
596
# ...do the normal thing
388
597
return session.peer_certificate
389
598
list_size = ctypes.c_uint()
390
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
391
(session._c_object, ctypes.byref(list_size))
599
cert_list = (gnutls.library.functions
600
.gnutls_certificate_get_peers
601
(session._c_object, ctypes.byref(list_size)))
392
602
if list_size.value == 0:
393
603
return None
394
604
cert = cert_list[0]
398
608
def fingerprint(openpgp):
399
609
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
400
610
# New GnuTLS "datum" with the OpenPGP public key
401
datum = gnutls.library.types.gnutls_datum_t\
402
(ctypes.cast(ctypes.c_char_p(openpgp),
403
ctypes.POINTER(ctypes.c_ubyte)),
404
ctypes.c_uint(len(openpgp)))
611
datum = (gnutls.library.types
612
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
613
ctypes.POINTER
614
(ctypes.c_ubyte)),
615
ctypes.c_uint(len(openpgp))))
405
616
# New empty GnuTLS certificate
406
617
crt = gnutls.library.types.gnutls_openpgp_crt_t()
407
gnutls.library.functions.gnutls_openpgp_crt_init\
408
(ctypes.byref(crt))
618
(gnutls.library.functions
619
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
409
620
# Import the OpenPGP public key into the certificate
410
gnutls.library.functions.gnutls_openpgp_crt_import\
411
(crt, ctypes.byref(datum),
412
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
621
(gnutls.library.functions
622
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
623
gnutls.library.constants
624
.GNUTLS_OPENPGP_FMT_RAW))
413
625
# Verify the self signature in the key
414
crtverify = ctypes.c_uint();
415
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
416
(crt, ctypes.c_uint(0), ctypes.byref(crtverify))
626
crtverify = ctypes.c_uint()
627
(gnutls.library.functions
628
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
417
629
if crtverify.value != 0:
418
630
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
419
631
raise gnutls.errors.CertificateSecurityError("Verify failed")
420
632
# New buffer for the fingerprint
421
buffer = ctypes.create_string_buffer(20)
422
buffer_length = ctypes.c_size_t()
633
buf = ctypes.create_string_buffer(20)
634
buf_len = ctypes.c_size_t()
423
635
# Get the fingerprint from the certificate into the buffer
424
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
425
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
636
(gnutls.library.functions
637
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
638
ctypes.byref(buf_len)))
426
639
# Deinit the certificate
427
640
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
428
641
# Convert the buffer to a Python bytestring
429
fpr = ctypes.string_at(buffer, buffer_length.value)
642
fpr = ctypes.string_at(buf, buf_len.value)
430
643
# Convert the bytestring to hexadecimal notation
431
644
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
432
645
return hex_fpr
433
646
434
647
435
class tcp_handler(SocketServer.BaseRequestHandler, object):
648
class TCP_handler(SocketServer.BaseRequestHandler, object):
436
649
"""A TCP request handler class.
437
650
Instantiated by IPv6_TCPServer for each request to handle it.
438
651
Note: This will run in its own forked process."""
439
652
440
653
def handle(self):
441
654
logger.info(u"TCP connection from: %s",
442
unicode(self.client_address))
443
session = gnutls.connection.ClientSession\
444
(self.request, gnutls.connection.X509Credentials())
655
unicode(self.client_address))
656
session = (gnutls.connection
657
.ClientSession(self.request,
658
gnutls.connection
659
.X509Credentials()))
445
660
446
661
line = self.request.makefile().readline()
447
662
logger.debug(u"Protocol version: %r", line)
460
675
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
461
676
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
462
677
# "+DHE-DSS"))
463
priority = "NORMAL" # Fallback default, since this
464
# MUST be set.
465
if self.server.settings["priority"]:
466
priority = self.server.settings["priority"]
467
gnutls.library.functions.gnutls_priority_set_direct\
468
(session._c_object, priority, None);
678
# Use a fallback default, since this MUST be set.
679
priority = self.server.settings.get("priority", "NORMAL")
680
(gnutls.library.functions
681
.gnutls_priority_set_direct(session._c_object,
682
priority, None))
469
683
470
684
try:
471
685
session.handshake()
481
695
session.bye()
482
696
return
483
697
logger.debug(u"Fingerprint: %s", fpr)
484
client = None
485
698
for c in self.server.clients:
486
699
if c.fingerprint == fpr:
487
700
client = c
488
701
break
489
if not client:
702
else:
490
703
logger.warning(u"Client not found for fingerprint: %s",
491
704
fpr)
492
705
session.bye()
499
712
vars(client))
500
713
session.bye()
501
714
return
715
## This won't work here, since we're in a fork.
716
# client.bump_timeout()
502
717
sent_size = 0
503
718
while sent_size < len(client.secret):
504
719
sent = session.send(client.secret[sent_size:])
509
724
session.bye()
510
725
511
726
512
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
727
class IPv6_TCPServer(SocketServer.ForkingMixIn,
728
SocketServer.TCPServer, object):
513
729
"""IPv6 TCP server. Accepts 'None' as address and/or port.
514
730
Attributes:
515
731
settings: Server settings
516
732
clients: Set() of Client objects
733
enabled: Boolean; whether this server is activated yet
517
734
"""
518
735
address_family = socket.AF_INET6
519
736
def __init__(self, *args, **kwargs):
523
740
if "clients" in kwargs:
524
741
self.clients = kwargs["clients"]
525
742
del kwargs["clients"]
526
return super(type(self), self).__init__(*args, **kwargs)
743
self.enabled = False
744
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
527
745
def server_bind(self):
528
746
"""This overrides the normal server_bind() function
529
747
to bind to an interface if one was specified, and also NOT to
558
776
# if_nametoindex
559
777
# (self.settings
560
778
# ["interface"]))
561
return super(type(self), self).server_bind()
779
return super(IPv6_TCPServer, self).server_bind()
780
def server_activate(self):
781
if self.enabled:
782
return super(IPv6_TCPServer, self).server_activate()
783
def enable(self):
784
self.enabled = True
562
785
563
786
564
787
def string_to_delta(interval):
580
803
timevalue = datetime.timedelta(0)
581
804
for s in interval.split():
582
805
try:
583
suffix=unicode(s[-1])
584
value=int(s[:-1])
806
suffix = unicode(s[-1])
807
value = int(s[:-1])
585
808
if suffix == u"d":
586
809
delta = datetime.timedelta(value)
587
810
elif suffix == u"s":
603
826
def server_state_changed(state):
604
827
"""Derived from the Avahi example code"""
605
828
if state == avahi.SERVER_COLLISION:
606
logger.error(u"Server name collision")
829
logger.error(u"Zeroconf server name collision")
607
830
service.remove()
608
831
elif state == avahi.SERVER_RUNNING:
609
832
service.add()
611
834
612
835
def entry_group_state_changed(state, error):
613
836
"""Derived from the Avahi example code"""
614
logger.debug(u"state change: %i", state)
837
logger.debug(u"Avahi state change: %i", state)
615
838
616
839
if state == avahi.ENTRY_GROUP_ESTABLISHED:
617
logger.debug(u"Service established.")
840
logger.debug(u"Zeroconf service established.")
618
841
elif state == avahi.ENTRY_GROUP_COLLISION:
619
logger.warning(u"Service name collision.")
842
logger.warning(u"Zeroconf service name collision.")
620
843
service.rename()
621
844
elif state == avahi.ENTRY_GROUP_FAILURE:
622
logger.critical(u"Error in group state changed %s",
845
logger.critical(u"Avahi: Error in group state changed %s",
623
846
unicode(error))
624
raise AvahiGroupError("State changed: %s", str(error))
847
raise AvahiGroupError(u"State changed: %s" % unicode(error))
625
848
626
849
def if_nametoindex(interface):
627
850
"""Call the C function if_nametoindex(), or equivalent"""
628
851
global if_nametoindex
629
852
try:
630
if "ctypes.util" not in sys.modules:
631
import ctypes.util
632
if_nametoindex = ctypes.cdll.LoadLibrary\
633
(ctypes.util.find_library("c")).if_nametoindex
853
if_nametoindex = (ctypes.cdll.LoadLibrary
854
(ctypes.util.find_library("c"))
855
.if_nametoindex)
634
856
except (OSError, AttributeError):
635
857
if "struct" not in sys.modules:
636
858
import struct
639
861
def if_nametoindex(interface):
640
862
"Get an interface index the hard way, i.e. using fcntl()"
641
863
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
642
s = socket.socket()
643
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
644
struct.pack("16s16x", interface))
645
s.close()
864
with closing(socket.socket()) as s:
865
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
866
struct.pack("16s16x", interface))
646
867
interface_index = struct.unpack("I", ifreq[16:20])[0]
647
868
return interface_index
648
869
return if_nametoindex(interface)
672
893
673
894
674
895
def main():
675
global main_loop_started
676
main_loop_started = False
677
678
parser = OptionParser(version = "%%prog %s" % version)
896
parser = optparse.OptionParser(version = "%%prog %s" % version)
679
897
parser.add_option("-i", "--interface", type="string",
680
898
metavar="IF", help="Bind to interface IF")
681
899
parser.add_option("-a", "--address", type="string",
682
900
help="Address to listen for requests on")
683
901
parser.add_option("-p", "--port", type="int",
684
902
help="Port number to receive requests on")
685
parser.add_option("--check", action="store_true", default=False,
903
parser.add_option("--check", action="store_true",
686
904
help="Run self-test")
687
905
parser.add_option("--debug", action="store_true",
688
906
help="Debug mode; run in foreground and log to"
695
913
default="/etc/mandos", metavar="DIR",
696
914
help="Directory to search for configuration"
697
915
" files")
698
(options, args) = parser.parse_args()
916
parser.add_option("--no-dbus", action="store_false",
917
dest="use_dbus",
918
help="Do not provide D-Bus system bus"
919
" interface")
920
options = parser.parse_args()[0]
699
921
700
922
if options.check:
701
923
import doctest
710
932
"priority":
711
933
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
712
934
"servicename": "Mandos",
935
"use_dbus": "True",
713
936
}
714
937
715
938
# Parse config file for server-global settings
718
941
server_config.read(os.path.join(options.configdir, "mandos.conf"))
719
942
# Convert the SafeConfigParser object to a dict
720
943
server_settings = server_config.defaults()
721
# Use getboolean on the boolean config option
722
server_settings["debug"] = server_config.getboolean\
723
("DEFAULT", "debug")
944
# Use getboolean on the boolean config options
945
server_settings["debug"] = (server_config.getboolean
946
("DEFAULT", "debug"))
947
server_settings["use_dbus"] = (server_config.getboolean
948
("DEFAULT", "use_dbus"))
724
949
del server_config
725
950
726
951
# Override the settings from the config file with command line
727
952
# options, if set.
728
953
for option in ("interface", "address", "port", "debug",
729
"priority", "servicename", "configdir"):
954
"priority", "servicename", "configdir",
955
"use_dbus"):
730
956
value = getattr(options, option)
731
957
if value is not None:
732
958
server_settings[option] = value
733
959
del options
734
960
# Now we have our good server settings in "server_settings"
735
961
962
# For convenience
736
963
debug = server_settings["debug"]
964
use_dbus = server_settings["use_dbus"]
737
965
738
966
if not debug:
739
967
syslogger.setLevel(logging.WARNING)
740
968
console.setLevel(logging.WARNING)
741
969
742
970
if server_settings["servicename"] != "Mandos":
743
syslogger.setFormatter(logging.Formatter\
971
syslogger.setFormatter(logging.Formatter
744
972
('Mandos (%s): %%(levelname)s:'
745
973
' %%(message)s'
746
974
% server_settings["servicename"]))
748
976
# Parse config file with clients
749
977
client_defaults = { "timeout": "1h",
750
978
"interval": "5m",
751
"checker": "fping -q -- %(host)s",
979
"checker": "fping -q -- %%(host)s",
752
980
"host": "",
753
981
}
754
982
client_config = ConfigParser.SafeConfigParser(client_defaults)
755
983
client_config.read(os.path.join(server_settings["configdir"],
756
984
"clients.conf"))
757
985
986
clients = Set()
987
tcp_server = IPv6_TCPServer((server_settings["address"],
988
server_settings["port"]),
989
TCP_handler,
990
settings=server_settings,
991
clients=clients)
992
pidfilename = "/var/run/mandos.pid"
993
try:
994
pidfile = open(pidfilename, "w")
995
except IOError, error:
996
logger.error("Could not open file %r", pidfilename)
997
998
try:
999
uid = pwd.getpwnam("_mandos").pw_uid
1000
gid = pwd.getpwnam("_mandos").pw_gid
1001
except KeyError:
1002
try:
1003
uid = pwd.getpwnam("mandos").pw_uid
1004
gid = pwd.getpwnam("mandos").pw_gid
1005
except KeyError:
1006
try:
1007
uid = pwd.getpwnam("nobody").pw_uid
1008
gid = pwd.getpwnam("nogroup").pw_gid
1009
except KeyError:
1010
uid = 65534
1011
gid = 65534
1012
try:
1013
os.setuid(uid)
1014
os.setgid(gid)
1015
except OSError, error:
1016
if error[0] != errno.EPERM:
1017
raise error
1018
758
1019
global service
759
1020
service = AvahiService(name = server_settings["servicename"],
760
type = "_mandos._tcp", );
1021
servicetype = "_mandos._tcp", )
761
1022
if server_settings["interface"]:
762
service.interface = if_nametoindex(server_settings["interface"])
1023
service.interface = (if_nametoindex
1024
(server_settings["interface"]))
763
1025
764
1026
global main_loop
765
1027
global bus
768
1030
DBusGMainLoop(set_as_default=True )
769
1031
main_loop = gobject.MainLoop()
770
1032
bus = dbus.SystemBus()
771
server = dbus.Interface(
772
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
773
avahi.DBUS_INTERFACE_SERVER )
1033
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1034
avahi.DBUS_PATH_SERVER),
1035
avahi.DBUS_INTERFACE_SERVER)
774
1036
# End of Avahi example code
775
776
clients = Set()
777
def remove_from_clients(client):
778
clients.remove(client)
779
if not clients:
780
logger.critical(u"No clients left, exiting")
781
sys.exit()
1037
if use_dbus:
1038
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
782
1039
783
1040
clients.update(Set(Client(name = section,
784
stop_hook = remove_from_clients,
785
1041
config
786
= dict(client_config.items(section)))
1042
= dict(client_config.items(section)),
1043
use_dbus = use_dbus)
787
1044
for section in client_config.sections()))
788
1045
if not clients:
789
logger.critical(u"No clients defined")
790
sys.exit(1)
1046
logger.warning(u"No clients defined")
791
1047
792
1048
if debug:
793
1049
# Redirect stdin so all checkers get /dev/null
801
1057
# Close all input and output, do double fork, etc.
802
1058
daemon()
803
1059
804
pidfilename = "/var/run/mandos/mandos.pid"
805
pid = os.getpid()
806
1060
try:
807
pidfile = open(pidfilename, "w")
1061
pid = os.getpid()
808
1062
pidfile.write(str(pid) + "\n")
809
1063
pidfile.close()
810
1064
del pidfile
811
except IOError, err:
812
logger.error(u"Could not write %s file with PID %d",
813
pidfilename, os.getpid())
1065
except IOError:
1066
logger.error(u"Could not write to file %r with PID %d",
1067
pidfilename, pid)
1068
except NameError:
1069
# "pidfile" was never created
1070
pass
1071
del pidfilename
814
1072
815
1073
def cleanup():
816
1074
"Cleanup function; run on exit"
823
1081
824
1082
while clients:
825
1083
client = clients.pop()
826
client.stop_hook = None
827
client.stop()
1084
client.disable_hook = None
1085
client.disable()
828
1086
829
1087
atexit.register(cleanup)
830
1088
833
1091
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
834
1092
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
835
1093
1094
if use_dbus:
1095
class MandosServer(dbus.service.Object):
1096
"""A D-Bus proxy object"""
1097
def __init__(self):
1098
dbus.service.Object.__init__(self, bus, "/")
1099
_interface = u"se.bsnet.fukt.Mandos"
1100
1101
@dbus.service.signal(_interface, signature="oa{sv}")
1102
def ClientAdded(self, objpath, properties):
1103
"D-Bus signal"
1104
pass
1105
1106
@dbus.service.signal(_interface, signature="os")
1107
def ClientRemoved(self, objpath, name):
1108
"D-Bus signal"
1109
pass
1110
1111
@dbus.service.method(_interface, out_signature="ao")
1112
def GetAllClients(self):
1113
return dbus.Array(c.dbus_object_path for c in clients)
1114
1115
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1116
def GetAllClientsWithProperties(self):
1117
return dbus.Dictionary(
1118
((c.dbus_object_path, c.GetAllProperties())
1119
for c in clients),
1120
signature="oa{sv}")
1121
1122
@dbus.service.method(_interface, in_signature="o")
1123
def RemoveClient(self, object_path):
1124
for c in clients:
1125
if c.dbus_object_path == object_path:
1126
clients.remove(c)
1127
# Don't signal anything except ClientRemoved
1128
c.use_dbus = False
1129
c.disable()
1130
# Emit D-Bus signal
1131
self.ClientRemoved(object_path, c.name)
1132
return
1133
raise KeyError
1134
1135
del _interface
1136
1137
mandos_server = MandosServer()
1138
836
1139
for client in clients:
837
client.start()
838
839
tcp_server = IPv6_TCPServer((server_settings["address"],
840
server_settings["port"]),
841
tcp_handler,
842
settings=server_settings,
843
clients=clients)
1140
if use_dbus:
1141
# Emit D-Bus signal
1142
mandos_server.ClientAdded(client.dbus_object_path,
1143
client.GetAllProperties())
1144
client.enable()
1145
1146
tcp_server.enable()
1147
tcp_server.server_activate()
1148
844
1149
# Find out what port we got
845
1150
service.port = tcp_server.socket.getsockname()[1]
846
1151
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
860
1165
861
1166
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
862
1167
lambda *args, **kwargs:
863
tcp_server.handle_request\
864
(*args[2:], **kwargs) or True)
1168
(tcp_server.handle_request
1169
(*args[2:], **kwargs) or True))
865
1170
866
1171
logger.debug(u"Starting main loop")
867
main_loop_started = True
868
1172
main_loop.run()
869
1173
except AvahiError, error:
870
logger.critical(u"AvahiError: %s" + unicode(error))
1174
logger.critical(u"AvahiError: %s", error)
871
1175
sys.exit(1)
872
1176
except KeyboardInterrupt:
873
1177
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0