/mandos/trunk : revision 291

66

import ctypes

67

import ctypes.util

68

69

version = "1.0.8"

69

version = "1.0.5"

70

71

logger = logging.Logger('mandos')

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos [%(process)d]: %(levelname)s:'

77

' %(message)s'))

76

('Mandos: %(levelname)s: %(message)s'))

78

77

logger.addHandler(syslogger)

79

78

80

79

console = logging.StreamHandler()

81

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

82

' %(levelname)s: %(message)s'))

80

console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'

81

' %(message)s'))

83

82

logger.addHandler(console)

84

83

85

84

class AvahiError(Exception):

114

113

"""

115

114

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

116

115

servicetype = None, port = None, TXT = None,

117

domain = "", host = "", max_renames = 32768,

118

protocol = avahi.PROTO_UNSPEC):

116

domain = "", host = "", max_renames = 32768):

119

117

self.interface = interface

120

118

self.name = name

121

119

self.type = servicetype

125

123

self.host = host

126

124

self.rename_count = 0

127

125

self.max_renames = max_renames

128

self.protocol = protocol

129

126

def rename(self):

130

127

"""Derived from the Avahi example code"""

131

128

if self.rename_count >= self.max_renames:

137

134

logger.info(u"Changing Zeroconf service name to %r ...",

138

135

str(self.name))

139

136

syslogger.setFormatter(logging.Formatter

140

('Mandos (%s) [%%(process)d]:'

141

' %%(levelname)s: %%(message)s'

142

% self.name))

137

('Mandos (%s): %%(levelname)s:'

138

' %%(message)s' % self.name))

143

139

self.remove()

144

140

self.add()

145

141

self.rename_count += 1

161

157

service.name, service.type)

162

158

group.AddService(

163

159

self.interface, # interface

164

self.protocol, # protocol

160

avahi.PROTO_INET6, # protocol

165

161

dbus.UInt32(0), # flags

166

162

self.name, self.type,

167

163

self.domain, self.host,

206

202

client lives. %() expansions are done at

207

203

runtime with vars(self) as dict, so that for

208

204

instance %(name)s can be used in the command.

209

current_checker_command: string; current running checker_command

210

205

use_dbus: bool(); Whether to provide D-Bus interface and signals

211

206

dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus

212

207

"""

261

256

self.disable_initiator_tag = None

262

257

self.checker_callback_tag = None

263

258

self.checker_command = config["checker"]

264

self.current_checker_command = None

265

259

self.last_connect = None

266

260

# Only now, when this client is initialized, can it show up on

267

261

# the D-Bus

382

376

# checkers alone, the checker would have to take more time

383

377

# than 'timeout' for the client to be declared invalid, which

384

378

# is as it should be.

385

386

# If a checker exists, make sure it is not a zombie

387

if self.checker is not None:

388

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

389

if pid:

390

logger.warning("Checker was a zombie")

391

gobject.source_remove(self.checker_callback_tag)

392

self.checker_callback(pid, status,

393

self.current_checker_command)

394

# Start a new checker if needed

395

379

if self.checker is None:

396

380

try:

397

381

# In case checker_command has exactly one % operator

407

391

logger.error(u'Could not format string "%s":'

408

392

u' %s', self.checker_command, error)

409

393

return True # Try again later

410

self.current_checker_command = command

411

394

try:

412

395

logger.info(u"Starting checker %r for %s",

413

396

command, self.name)

428

411

(self.checker.pid,

429

412

self.checker_callback,

430

413

data=command))

431

# The checker may have completed before the gobject

432

# watch was added. Check for this.

433

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

434

if pid:

435

gobject.source_remove(self.checker_callback_tag)

436

self.checker_callback(pid, status, command)

437

414

except OSError, error:

438

415

logger.error(u"Failed to start subprocess: %s",

439

416

error)

543

520

"D-Bus signal"

544

521

pass

545

522

546

# ReceivedSecret - signal

547

@dbus.service.signal(_interface)

548

def ReceivedSecret(self):

549

"D-Bus signal"

550

pass

551

552

# Rejected - signal

553

@dbus.service.signal(_interface)

554

def Rejected(self):

555

"D-Bus signal"

556

pass

557

558

523

# SetChecker - method

559

524

@dbus.service.method(_interface, in_signature="s")

560

525

def SetChecker(self, checker):

691

656

def handle(self):

692

657

logger.info(u"TCP connection from: %s",

693

658

unicode(self.client_address))

694

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

695

# Open IPC pipe to parent process

696

with closing(os.fdopen(self.server.pipe[1], "w", 1)) as ipc:

697

session = (gnutls.connection

698

.ClientSession(self.request,

699

gnutls.connection

700

.X509Credentials()))

701

702

line = self.request.makefile().readline()

703

logger.debug(u"Protocol version: %r", line)

704

try:

705

if int(line.strip().split()[0]) > 1:

706

raise RuntimeError

707

except (ValueError, IndexError, RuntimeError), error:

708

logger.error(u"Unknown protocol version: %s", error)

709

return

710

711

# Note: gnutls.connection.X509Credentials is really a

712

# generic GnuTLS certificate credentials object so long as

713

# no X.509 keys are added to it. Therefore, we can use it

714

# here despite using OpenPGP certificates.

715

716

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

717

# "+AES-256-CBC", "+SHA1",

718

# "+COMP-NULL", "+CTYPE-OPENPGP",

719

# "+DHE-DSS"))

720

# Use a fallback default, since this MUST be set.

721

priority = self.server.settings.get("priority", "NORMAL")

722

(gnutls.library.functions

723

.gnutls_priority_set_direct(session._c_object,

724

priority, None))

725

726

try:

727

session.handshake()

728

except gnutls.errors.GNUTLSError, error:

729

logger.warning(u"Handshake failed: %s", error)

730

# Do not run session.bye() here: the session is not

731

# established. Just abandon the request.

732

return

733

logger.debug(u"Handshake succeeded")

734

try:

735

fpr = fingerprint(peer_certificate(session))

736

except (TypeError, gnutls.errors.GNUTLSError), error:

737

logger.warning(u"Bad certificate: %s", error)

738

session.bye()

739

return

740

logger.debug(u"Fingerprint: %s", fpr)

741

742

for c in self.server.clients:

743

if c.fingerprint == fpr:

744

client = c

745

break

746

else:

747

logger.warning(u"Client not found for fingerprint: %s",

748

fpr)

749

ipc.write("NOTFOUND %s\n" % fpr)

750

session.bye()

751

return

752

# Have to check if client.still_valid(), since it is

753

# possible that the client timed out while establishing

754

# the GnuTLS session.

755

if not client.still_valid():

756

logger.warning(u"Client %(name)s is invalid",

757

vars(client))

758

ipc.write("INVALID %s\n" % client.name)

759

session.bye()

760

return

761

ipc.write("SENDING %s\n" % client.name)

762

sent_size = 0

763

while sent_size < len(client.secret):

764

sent = session.send(client.secret[sent_size:])

765

logger.debug(u"Sent: %d, remaining: %d",

766

sent, len(client.secret)

767

- (sent_size + sent))

768

sent_size += sent

769

session.bye()

770

771

772

class ForkingMixInWithPipe(SocketServer.ForkingMixIn, object):

773

"""Like SocketServer.ForkingMixIn, but also pass a pipe.

774

Assumes a gobject.MainLoop event loop.

775

"""

776

def process_request(self, request, client_address):

777

"""This overrides and wraps the original process_request().

778

This function creates a new pipe in self.pipe

779

"""

780

self.pipe = os.pipe()

781

super(ForkingMixInWithPipe,

782

self).process_request(request, client_address)

783

os.close(self.pipe[1]) # close write end

784

# Call "handle_ipc" for both data and EOF events

785

gobject.io_add_watch(self.pipe[0],

786

gobject.IO_IN | gobject.IO_HUP,

787

self.handle_ipc)

788

def handle_ipc(source, condition):

789

"""Dummy function; override as necessary"""

790

os.close(source)

791

return False

792

793

794

class IPv6_TCPServer(ForkingMixInWithPipe,

659

session = (gnutls.connection

660

.ClientSession(self.request,

661

gnutls.connection

662

.X509Credentials()))

663

664

line = self.request.makefile().readline()

665

logger.debug(u"Protocol version: %r", line)

666

try:

667

if int(line.strip().split()[0]) > 1:

668

raise RuntimeError

669

except (ValueError, IndexError, RuntimeError), error:

670

logger.error(u"Unknown protocol version: %s", error)

671

return

672

673

# Note: gnutls.connection.X509Credentials is really a generic

674

# GnuTLS certificate credentials object so long as no X.509

675

# keys are added to it. Therefore, we can use it here despite

676

# using OpenPGP certificates.

677

678

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

679

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

680

# "+DHE-DSS"))

681

# Use a fallback default, since this MUST be set.

682

priority = self.server.settings.get("priority", "NORMAL")

683

(gnutls.library.functions

684

.gnutls_priority_set_direct(session._c_object,

685

priority, None))

686

687

try:

688

session.handshake()

689

except gnutls.errors.GNUTLSError, error:

690

logger.warning(u"Handshake failed: %s", error)

691

# Do not run session.bye() here: the session is not

692

# established. Just abandon the request.

693

return

694

logger.debug(u"Handshake succeeded")

695

try:

696

fpr = fingerprint(peer_certificate(session))

697

except (TypeError, gnutls.errors.GNUTLSError), error:

698

logger.warning(u"Bad certificate: %s", error)

699

session.bye()

700

return

701

logger.debug(u"Fingerprint: %s", fpr)

702

703

for c in self.server.clients:

704

if c.fingerprint == fpr:

705

client = c

706

break

707

else:

708

logger.warning(u"Client not found for fingerprint: %s",

709

fpr)

710

session.bye()

711

return

712

# Have to check if client.still_valid(), since it is possible

713

# that the client timed out while establishing the GnuTLS

714

# session.

715

if not client.still_valid():

716

logger.warning(u"Client %(name)s is invalid",

717

vars(client))

718

session.bye()

719

return

720

## This won't work here, since we're in a fork.

721

# client.checked_ok()

722

sent_size = 0

723

while sent_size < len(client.secret):

724

sent = session.send(client.secret[sent_size:])

725

logger.debug(u"Sent: %d, remaining: %d",

726

sent, len(client.secret)

727

- (sent_size + sent))

728

sent_size += sent

729

session.bye()

730

731

732

class IPv6_TCPServer(SocketServer.ForkingMixIn,

795

733

SocketServer.TCPServer, object):

796

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

734

"""IPv6 TCP server. Accepts 'None' as address and/or port.

797

735

Attributes:

798

736

settings: Server settings

799

737

clients: Set() of Client objects

807

745

if "clients" in kwargs:

808

746

self.clients = kwargs["clients"]

809

747

del kwargs["clients"]

810

if "use_ipv6" in kwargs:

811

if not kwargs["use_ipv6"]:

812

self.address_family = socket.AF_INET

813

del kwargs["use_ipv6"]

814

748

self.enabled = False

815

749

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

816

750

def server_bind(self):

830

764

u" bind to interface %s",

831

765

self.settings["interface"])

832

766

else:

833

raise

767

raise error

834

768

# Only bind(2) the socket if we really need to.

835

769

if self.server_address[0] or self.server_address[1]:

836

770

if not self.server_address[0]:

837

if self.address_family == socket.AF_INET6:

838

any_address = "::" # in6addr_any

839

else:

840

any_address = socket.INADDR_ANY

841

self.server_address = (any_address,

771

in6addr_any = "::"

772

self.server_address = (in6addr_any,

842

773

self.server_address[1])

843

774

elif not self.server_address[1]:

844

775

self.server_address = (self.server_address[0],

856

787

return super(IPv6_TCPServer, self).server_activate()

857

788

def enable(self):

858

789

self.enabled = True

859

def handle_ipc(self, source, condition, file_objects={}):

860

condition_names = {

861

gobject.IO_IN: "IN", # There is data to read.

862

gobject.IO_OUT: "OUT", # Data can be written (without

863

# blocking).

864

gobject.IO_PRI: "PRI", # There is urgent data to read.

865

gobject.IO_ERR: "ERR", # Error condition.

866

gobject.IO_HUP: "HUP" # Hung up (the connection has been

867

# broken, usually for pipes and

868

# sockets).

869

}

870

conditions_string = ' | '.join(name

871

for cond, name in

872

condition_names.iteritems()

873

if cond & condition)

874

logger.debug("Handling IPC: FD = %d, condition = %s", source,

875

conditions_string)

876

877

# Turn the pipe file descriptor into a Python file object

878

if source not in file_objects:

879

file_objects[source] = os.fdopen(source, "r", 1)

880

881

# Read a line from the file object

882

cmdline = file_objects[source].readline()

883

if not cmdline: # Empty line means end of file

884

# close the IPC pipe

885

file_objects[source].close()

886

del file_objects[source]

887

888

# Stop calling this function

889

return False

890

891

logger.debug("IPC command: %r\n" % cmdline)

892

893

# Parse and act on command

894

cmd, args = cmdline.split(None, 1)

895

if cmd == "NOTFOUND":

896

if self.settings["use_dbus"]:

897

# Emit D-Bus signal

898

mandos_dbus_service.ClientNotFound(args)

899

elif cmd == "INVALID":

900

if self.settings["use_dbus"]:

901

for client in self.clients:

902

if client.name == args:

903

# Emit D-Bus signal

904

client.Rejected()

905

break

906

elif cmd == "SENDING":

907

for client in self.clients:

908

if client.name == args:

909

client.checked_ok()

910

if self.settings["use_dbus"]:

911

# Emit D-Bus signal

912

client.ReceivedSecret()

913

break

914

else:

915

logger.error("Unknown IPC command: %r", cmdline)

916

917

# Keep calling this function

918

return True

919

790

920

791

921

792

def string_to_delta(interval):

1027

898

1028

899

1029

900

def main():

1030

1031

######################################################################

1032

# Parsing of options, both command line and config file

1033

1034

901

parser = optparse.OptionParser(version = "%%prog %s" % version)

1035

902

parser.add_option("-i", "--interface", type="string",

1036

903

metavar="IF", help="Bind to interface IF")

1055

922

dest="use_dbus",

1056

923

help="Do not provide D-Bus system bus"

1057

924

" interface")

1058

parser.add_option("--no-ipv6", action="store_false",

1059

dest="use_ipv6", help="Do not use IPv6")

1060

925

options = parser.parse_args()[0]

1061

926

1062

927

if options.check:

1073

938

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1074

939

"servicename": "Mandos",

1075

940

"use_dbus": "True",

1076

"use_ipv6": "True",

1077

941

}

1078

942

1079

943

# Parse config file for server-global settings

1087

951

"debug")

1088

952

server_settings["use_dbus"] = server_config.getboolean("DEFAULT",

1089

953

"use_dbus")

1090

server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",

1091

"use_ipv6")

1092

954

if server_settings["port"]:

1093

955

server_settings["port"] = server_config.getint("DEFAULT",

1094

956

"port")

1098

960

# options, if set.

1099

961

for option in ("interface", "address", "port", "debug",

1100

962

"priority", "servicename", "configdir",

1101

"use_dbus", "use_ipv6"):

963

"use_dbus"):

1102

964

value = getattr(options, option)

1103

965

if value is not None:

1104

966

server_settings[option] = value

1105

967

del options

1106

968

# Now we have our good server settings in "server_settings"

1107

969

1108

##################################################################

1109

1110

970

# For convenience

1111

971

debug = server_settings["debug"]

1112

972

use_dbus = server_settings["use_dbus"]

1113

use_ipv6 = server_settings["use_ipv6"]

973

974

def sigsegvhandler(signum, frame):

975

raise RuntimeError('Segmentation fault')

1114

976

1115

977

if not debug:

1116

978

syslogger.setLevel(logging.WARNING)

1117

979

console.setLevel(logging.WARNING)

980

else:

981

signal.signal(signal.SIGSEGV, sigsegvhandler)

1118

982

1119

983

if server_settings["servicename"] != "Mandos":

1120

984

syslogger.setFormatter(logging.Formatter

1121

('Mandos (%s) [%%(process)d]:'

1122

' %%(levelname)s: %%(message)s'

985

('Mandos (%s): %%(levelname)s:'

986

' %%(message)s'

1123

987

% server_settings["servicename"]))

1124

988

1125

989

# Parse config file with clients

1131

995

client_config = ConfigParser.SafeConfigParser(client_defaults)

1132

996

client_config.read(os.path.join(server_settings["configdir"],

1133

997

"clients.conf"))

1134

1135

global mandos_dbus_service

1136

mandos_dbus_service = None

1137

998

1138

999

clients = Set()

1139

1000

tcp_server = IPv6_TCPServer((server_settings["address"],

1140

1001

server_settings["port"]),

1141

1002

TCP_handler,

1142

1003

settings=server_settings,

1143

clients=clients, use_ipv6=use_ipv6)

1004

clients=clients)

1144

1005

pidfilename = "/var/run/mandos.pid"

1145

1006

try:

1146

1007

pidfile = open(pidfilename, "w")

1147

except IOError:

1008

except IOError, error:

1148

1009

logger.error("Could not open file %r", pidfilename)

1149

1010

1150

1011

try:

1182

1043

.gnutls_global_set_log_function(debug_gnutls))

1183

1044

1184

1045

global service

1185

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1186

1046

service = AvahiService(name = server_settings["servicename"],

1187

servicetype = "_mandos._tcp",

1188

protocol = protocol)

1047

servicetype = "_mandos._tcp", )

1189

1048

if server_settings["interface"]:

1190

1049

service.interface = (if_nametoindex

1191

1050

(server_settings["interface"]))

1225

1084

daemon()

1226

1085

1227

1086

try:

1228

with closing(pidfile):

1229

pid = os.getpid()

1230

pidfile.write(str(pid) + "\n")

1087

pid = os.getpid()

1088

pidfile.write(str(pid) + "\n")

1089

pidfile.close()

1231

1090

del pidfile

1232

1091

except IOError:

1233

1092

logger.error(u"Could not write to file %r with PID %d",

1259

1118

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1260

1119

1261

1120

if use_dbus:

1262

class MandosDBusService(dbus.service.Object):

1121

class MandosServer(dbus.service.Object):

1263

1122

"""A D-Bus proxy object"""

1264

1123

def __init__(self):

1265

1124

dbus.service.Object.__init__(self, bus, "/")

1270

1129

"D-Bus signal"

1271

1130

pass

1272

1131

1273

@dbus.service.signal(_interface, signature="s")

1274

def ClientNotFound(self, fingerprint):

1275

"D-Bus signal"

1276

pass

1277

1278

1132

@dbus.service.signal(_interface, signature="os")

1279

1133

def ClientRemoved(self, objpath, name):

1280

1134

"D-Bus signal"

1309

1163

1310

1164

del _interface

1311

1165

1312

mandos_dbus_service = MandosDBusService()

1166

mandos_server = MandosServer()

1313

1167

1314

1168

for client in clients:

1315

1169

if use_dbus:

1316

1170

# Emit D-Bus signal

1317

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1318

client.GetAllProperties())

1171

mandos_server.ClientAdded(client.dbus_object_path,

1172

client.GetAllProperties())

1319

1173

client.enable()

1320

1174

1321

1175

tcp_server.enable()

1323

1177

1324

1178

# Find out what port we got

1325

1179

service.port = tcp_server.socket.getsockname()[1]

1326

if use_ipv6:

1327

logger.info(u"Now listening on address %r, port %d,"

1328

" flowinfo %d, scope_id %d"

1329

% tcp_server.socket.getsockname())

1330

else: # IPv4

1331

logger.info(u"Now listening on address %r, port %d"

1332

% tcp_server.socket.getsockname())

1180

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

1181

u" scope_id %d" % tcp_server.socket.getsockname())

1333

1182

1334

1183

#service.interface = tcp_server.socket.getsockname()[3]

1335

1184

1355

1204

sys.exit(1)

1356

1205

except KeyboardInterrupt:

1357

1206

if debug:

1358

print >> sys.stderr

1359

logger.debug("Server received KeyboardInterrupt")

1360

logger.debug("Server exiting")

1207

print

1361

1208

1362

1209

if __name__ == '__main__':

1363

1210

main()