To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 291
- compare with another revision
- download diff
- download tarball
- view history from revision 291
- Committer: Teddy Hogeborn
- Date: 2009-01-31 10:33:17 UTC
- mfrom: (24.1.129 mandos)
- Revision ID: teddy@fukt.bsnet.se-20090131103317-wzqvyr532sjcjt7u
Merge from Björn:
* mandos-ctl: New option "--remove-client". Only default to listing
clients if no clients were given on the command line.
* plugins.d/mandos-client.c: Lower kernel log level while bringing up
network interface. New option "--delay"
to control the maximum delay to wait for
running interface.
* plugins.d/mandos-client.xml (SYNOPSIS, OPTIONS): New option
"--delay".
* mandos-ctl: New option "--remove-client". Only default to listing
clients if no clients were given on the command line.
* plugins.d/mandos-client.c: Lower kernel log level while bringing up
network interface. New option "--delay"
to control the maximum delay to wait for
running interface.
* plugins.d/mandos-client.xml (SYNOPSIS, OPTIONS): New option
"--delay".
- files modified:
- INSTALL
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
34
34
from __future__ import division, with_statement, absolute_import
35
35
36
import SocketServer as socketserver
36
import SocketServer
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
import ConfigParser as configparser
47
import ConfigParser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
from sets import Set
52
53
import subprocess
53
54
import atexit
54
55
import stat
56
57
import logging.handlers
57
58
import pwd
58
59
from contextlib import closing
59
import struct
60
import fcntl
61
import functools
62
60
63
61
import dbus
64
62
import dbus.service
68
66
import ctypes
69
67
import ctypes.util
70
68
71
try:
72
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
73
except AttributeError:
74
try:
75
from IN import SO_BINDTODEVICE
76
except ImportError:
77
SO_BINDTODEVICE = None
78
79
80
version = "1.0.10"
81
82
logger = logging.Logger(u'mandos')
69
version = "1.0.5"
70
71
logger = logging.Logger('mandos')
83
72
syslogger = (logging.handlers.SysLogHandler
84
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
85
74
address = "/dev/log"))
86
75
syslogger.setFormatter(logging.Formatter
87
(u'Mandos [%(process)d]: %(levelname)s:'
88
u' %(message)s'))
76
('Mandos: %(levelname)s: %(message)s'))
89
77
logger.addHandler(syslogger)
90
78
91
79
console = logging.StreamHandler()
92
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
93
u' %(levelname)s:'
94
u' %(message)s'))
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
95
82
logger.addHandler(console)
96
83
97
84
class AvahiError(Exception):
110
97
111
98
class AvahiService(object):
112
99
"""An Avahi (Zeroconf) service.
113
114
100
Attributes:
115
101
interface: integer; avahi.IF_UNSPEC or an interface index.
116
102
Used to optionally bind to the specified interface.
117
name: string; Example: u'Mandos'
118
type: string; Example: u'_mandos._tcp'.
103
name: string; Example: 'Mandos'
104
type: string; Example: '_mandos._tcp'.
119
105
See <http://www.dns-sd.org/ServiceTypes.html>
120
106
port: integer; what port to announce
121
107
TXT: list of strings; TXT record for the service
124
110
max_renames: integer; maximum number of renames
125
111
rename_count: integer; counter so we only rename after collisions
126
112
a sensible number of times
127
group: D-Bus Entry Group
128
server: D-Bus Server
129
bus: dbus.SystemBus()
130
113
"""
131
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
132
115
servicetype = None, port = None, TXT = None,
133
domain = u"", host = u"", max_renames = 32768,
134
protocol = avahi.PROTO_UNSPEC, bus = None):
116
domain = "", host = "", max_renames = 32768):
135
117
self.interface = interface
136
118
self.name = name
137
119
self.type = servicetype
141
123
self.host = host
142
124
self.rename_count = 0
143
125
self.max_renames = max_renames
144
self.protocol = protocol
145
self.group = None # our entry group
146
self.server = None
147
self.bus = bus
148
126
def rename(self):
149
127
"""Derived from the Avahi example code"""
150
128
if self.rename_count >= self.max_renames:
152
130
u" after %i retries, exiting.",
153
131
self.rename_count)
154
132
raise AvahiServiceError(u"Too many renames")
155
self.name = self.server.GetAlternativeServiceName(self.name)
133
self.name = server.GetAlternativeServiceName(self.name)
156
134
logger.info(u"Changing Zeroconf service name to %r ...",
157
unicode(self.name))
135
str(self.name))
158
136
syslogger.setFormatter(logging.Formatter
159
(u'Mandos (%s) [%%(process)d]:'
160
u' %%(levelname)s: %%(message)s'
161
% self.name))
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
162
139
self.remove()
163
140
self.add()
164
141
self.rename_count += 1
165
142
def remove(self):
166
143
"""Derived from the Avahi example code"""
167
if self.group is not None:
168
self.group.Reset()
144
if group is not None:
145
group.Reset()
169
146
def add(self):
170
147
"""Derived from the Avahi example code"""
171
if self.group is None:
172
self.group = dbus.Interface(
173
self.bus.get_object(avahi.DBUS_NAME,
174
self.server.EntryGroupNew()),
175
avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
self.group.connect_to_signal('StateChanged',
177
self.entry_group_state_changed)
148
global group
149
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
178
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
179
self.name, self.type)
180
self.group.AddService(
181
self.interface,
182
self.protocol,
183
dbus.UInt32(0), # flags
184
self.name, self.type,
185
self.domain, self.host,
186
dbus.UInt16(self.port),
187
avahi.string_array_to_txt_array(self.TXT))
188
self.group.Commit()
189
def entry_group_state_changed(self, state, error):
190
"""Derived from the Avahi example code"""
191
logger.debug(u"Avahi state change: %i", state)
192
193
if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
logger.debug(u"Zeroconf service established.")
195
elif state == avahi.ENTRY_GROUP_COLLISION:
196
logger.warning(u"Zeroconf service name collision.")
197
self.rename()
198
elif state == avahi.ENTRY_GROUP_FAILURE:
199
logger.critical(u"Avahi: Error in group state changed %s",
200
unicode(error))
201
raise AvahiGroupError(u"State changed: %s"
202
% unicode(error))
203
def cleanup(self):
204
"""Derived from the Avahi example code"""
205
if self.group is not None:
206
self.group.Free()
207
self.group = None
208
def server_state_changed(self, state):
209
"""Derived from the Avahi example code"""
210
if state == avahi.SERVER_COLLISION:
211
logger.error(u"Zeroconf server name collision")
212
self.remove()
213
elif state == avahi.SERVER_RUNNING:
214
self.add()
215
def activate(self):
216
"""Derived from the Avahi example code"""
217
if self.server is None:
218
self.server = dbus.Interface(
219
self.bus.get_object(avahi.DBUS_NAME,
220
avahi.DBUS_PATH_SERVER),
221
avahi.DBUS_INTERFACE_SERVER)
222
self.server.connect_to_signal(u"StateChanged",
223
self.server_state_changed)
224
self.server_state_changed(self.server.GetState())
225
226
227
class Client(object):
157
service.name, service.type)
158
group.AddService(
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
166
group.Commit()
167
168
# From the Avahi example code:
169
group = None # our entry group
170
# End of Avahi example code
171
172
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
228
179
"""A representation of a client host served by this server.
229
230
180
Attributes:
231
181
name: string; from the config file, used in log messages and
232
182
D-Bus identifiers
252
202
client lives. %() expansions are done at
253
203
runtime with vars(self) as dict, so that for
254
204
instance %(name)s can be used in the command.
255
current_checker_command: string; current running checker_command
205
use_dbus: bool(); Whether to provide D-Bus interface and signals
206
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
256
207
"""
257
258
@staticmethod
259
def _datetime_to_milliseconds(dt):
260
"Convert a datetime.datetime() to milliseconds"
261
return ((dt.days * 24 * 60 * 60 * 1000)
262
+ (dt.seconds * 1000)
263
+ (dt.microseconds // 1000))
264
265
208
def timeout_milliseconds(self):
266
209
"Return the 'timeout' attribute in milliseconds"
267
return self._datetime_to_milliseconds(self.timeout)
210
return ((self.timeout.days * 24 * 60 * 60 * 1000)
211
+ (self.timeout.seconds * 1000)
212
+ (self.timeout.microseconds // 1000))
268
213
269
214
def interval_milliseconds(self):
270
215
"Return the 'interval' attribute in milliseconds"
271
return self._datetime_to_milliseconds(self.interval)
216
return ((self.interval.days * 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds * 1000)
218
+ (self.interval.microseconds // 1000))
272
219
273
def __init__(self, name = None, disable_hook=None, config=None):
220
def __init__(self, name = None, disable_hook=None, config=None,
221
use_dbus=True):
274
222
"""Note: the 'checker' key in 'config' sets the
275
223
'checker_command' attribute and *not* the 'checker'
276
224
attribute."""
278
226
if config is None:
279
227
config = {}
280
228
logger.debug(u"Creating client %r", self.name)
229
self.use_dbus = False # During __init__
281
230
# Uppercase and remove spaces from fingerprint for later
282
231
# comparison purposes with return value from the fingerprint()
283
232
# function
284
self.fingerprint = (config[u"fingerprint"].upper()
233
self.fingerprint = (config["fingerprint"].upper()
285
234
.replace(u" ", u""))
286
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
287
if u"secret" in config:
288
self.secret = config[u"secret"].decode(u"base64")
289
elif u"secfile" in config:
236
if "secret" in config:
237
self.secret = config["secret"].decode(u"base64")
238
elif "secfile" in config:
290
239
with closing(open(os.path.expanduser
291
240
(os.path.expandvars
292
(config[u"secfile"])))) as secfile:
241
(config["secfile"])))) as secfile:
293
242
self.secret = secfile.read()
294
243
else:
295
244
raise TypeError(u"No secret or secfile for client %s"
296
245
% self.name)
297
self.host = config.get(u"host", u"")
246
self.host = config.get("host", "")
298
247
self.created = datetime.datetime.utcnow()
299
248
self.enabled = False
300
249
self.last_enabled = None
301
250
self.last_checked_ok = None
302
self.timeout = string_to_delta(config[u"timeout"])
303
self.interval = string_to_delta(config[u"interval"])
251
self.timeout = string_to_delta(config["timeout"])
252
self.interval = string_to_delta(config["interval"])
304
253
self.disable_hook = disable_hook
305
254
self.checker = None
306
255
self.checker_initiator_tag = None
307
256
self.disable_initiator_tag = None
308
257
self.checker_callback_tag = None
309
self.checker_command = config[u"checker"]
310
self.current_checker_command = None
258
self.checker_command = config["checker"]
311
259
self.last_connect = None
260
# Only now, when this client is initialized, can it show up on
261
# the D-Bus
262
self.use_dbus = use_dbus
263
if self.use_dbus:
264
self.dbus_object_path = (dbus.ObjectPath
265
("/clients/"
266
+ self.name.replace(".", "_")))
267
dbus.service.Object.__init__(self, bus,
268
self.dbus_object_path)
312
269
313
270
def enable(self):
314
271
"""Start this client's checker and timeout hooks"""
315
if getattr(self, u"enabled", False):
316
# Already enabled
317
return
318
272
self.last_enabled = datetime.datetime.utcnow()
319
273
# Schedule a new checker to be started an 'interval' from now,
320
274
# and every interval from then on.
328
282
(self.timeout_milliseconds(),
329
283
self.disable))
330
284
self.enabled = True
285
if self.use_dbus:
286
# Emit D-Bus signals
287
self.PropertyChanged(dbus.String(u"enabled"),
288
dbus.Boolean(True, variant_level=1))
289
self.PropertyChanged(dbus.String(u"last_enabled"),
290
(_datetime_to_dbus(self.last_enabled,
291
variant_level=1)))
331
292
332
293
def disable(self):
333
294
"""Disable this client."""
334
295
if not getattr(self, "enabled", False):
335
296
return False
336
297
logger.info(u"Disabling client %s", self.name)
337
if getattr(self, u"disable_initiator_tag", False):
298
if getattr(self, "disable_initiator_tag", False):
338
299
gobject.source_remove(self.disable_initiator_tag)
339
300
self.disable_initiator_tag = None
340
if getattr(self, u"checker_initiator_tag", False):
301
if getattr(self, "checker_initiator_tag", False):
341
302
gobject.source_remove(self.checker_initiator_tag)
342
303
self.checker_initiator_tag = None
343
304
self.stop_checker()
344
305
if self.disable_hook:
345
306
self.disable_hook(self)
346
307
self.enabled = False
308
if self.use_dbus:
309
# Emit D-Bus signal
310
self.PropertyChanged(dbus.String(u"enabled"),
311
dbus.Boolean(False, variant_level=1))
347
312
# Do not run this again if called by a gobject.timeout_add
348
313
return False
349
314
355
320
"""The checker has completed, so take appropriate actions."""
356
321
self.checker_callback_tag = None
357
322
self.checker = None
323
if self.use_dbus:
324
# Emit D-Bus signal
325
self.PropertyChanged(dbus.String(u"checker_running"),
326
dbus.Boolean(False, variant_level=1))
358
327
if os.WIFEXITED(condition):
359
328
exitstatus = os.WEXITSTATUS(condition)
360
329
if exitstatus == 0:
364
333
else:
365
334
logger.info(u"Checker for %(name)s failed",
366
335
vars(self))
336
if self.use_dbus:
337
# Emit D-Bus signal
338
self.CheckerCompleted(dbus.Int16(exitstatus),
339
dbus.Int64(condition),
340
dbus.String(command))
367
341
else:
368
342
logger.warning(u"Checker for %(name)s crashed?",
369
343
vars(self))
344
if self.use_dbus:
345
# Emit D-Bus signal
346
self.CheckerCompleted(dbus.Int16(-1),
347
dbus.Int64(condition),
348
dbus.String(command))
370
349
371
350
def checked_ok(self):
372
351
"""Bump up the timeout for this client.
373
374
352
This should only be called when the client has been seen,
375
353
alive and well.
376
354
"""
379
357
self.disable_initiator_tag = (gobject.timeout_add
380
358
(self.timeout_milliseconds(),
381
359
self.disable))
360
if self.use_dbus:
361
# Emit D-Bus signal
362
self.PropertyChanged(
363
dbus.String(u"last_checked_ok"),
364
(_datetime_to_dbus(self.last_checked_ok,
365
variant_level=1)))
382
366
383
367
def start_checker(self):
384
368
"""Start a new checker subprocess if one is not running.
385
386
369
If a checker already exists, leave it running and do
387
370
nothing."""
388
371
# The reason for not killing a running checker is that if we
393
376
# checkers alone, the checker would have to take more time
394
377
# than 'timeout' for the client to be declared invalid, which
395
378
# is as it should be.
396
397
# If a checker exists, make sure it is not a zombie
398
if self.checker is not None:
399
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
400
if pid:
401
logger.warning(u"Checker was a zombie")
402
gobject.source_remove(self.checker_callback_tag)
403
self.checker_callback(pid, status,
404
self.current_checker_command)
405
# Start a new checker if needed
406
379
if self.checker is None:
407
380
try:
408
381
# In case checker_command has exactly one % operator
409
382
command = self.checker_command % self.host
410
383
except TypeError:
411
384
# Escape attributes for the shell
412
escaped_attrs = dict((key,
413
re.escape(unicode(str(val),
414
errors=
415
u'replace')))
385
escaped_attrs = dict((key, re.escape(str(val)))
416
386
for key, val in
417
387
vars(self).iteritems())
418
388
try:
421
391
logger.error(u'Could not format string "%s":'
422
392
u' %s', self.checker_command, error)
423
393
return True # Try again later
424
self.current_checker_command = command
425
394
try:
426
395
logger.info(u"Starting checker %r for %s",
427
396
command, self.name)
431
400
# always replaced by /dev/null.)
432
401
self.checker = subprocess.Popen(command,
433
402
close_fds=True,
434
shell=True, cwd=u"/")
403
shell=True, cwd="/")
404
if self.use_dbus:
405
# Emit D-Bus signal
406
self.CheckerStarted(command)
407
self.PropertyChanged(
408
dbus.String("checker_running"),
409
dbus.Boolean(True, variant_level=1))
435
410
self.checker_callback_tag = (gobject.child_watch_add
436
411
(self.checker.pid,
437
412
self.checker_callback,
438
413
data=command))
439
# The checker may have completed before the gobject
440
# watch was added. Check for this.
441
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
442
if pid:
443
gobject.source_remove(self.checker_callback_tag)
444
self.checker_callback(pid, status, command)
445
414
except OSError, error:
446
415
logger.error(u"Failed to start subprocess: %s",
447
416
error)
453
422
if self.checker_callback_tag:
454
423
gobject.source_remove(self.checker_callback_tag)
455
424
self.checker_callback_tag = None
456
if getattr(self, u"checker", None) is None:
425
if getattr(self, "checker", None) is None:
457
426
return
458
427
logger.debug(u"Stopping checker for %(name)s", vars(self))
459
428
try:
465
434
if error.errno != errno.ESRCH: # No such process
466
435
raise
467
436
self.checker = None
437
if self.use_dbus:
438
self.PropertyChanged(dbus.String(u"checker_running"),
439
dbus.Boolean(False, variant_level=1))
468
440
469
441
def still_valid(self):
470
442
"""Has the timeout not yet passed for this client?"""
471
if not getattr(self, u"enabled", False):
443
if not getattr(self, "enabled", False):
472
444
return False
473
445
now = datetime.datetime.utcnow()
474
446
if self.last_checked_ok is None:
475
447
return now < (self.created + self.timeout)
476
448
else:
477
449
return now < (self.last_checked_ok + self.timeout)
478
479
480
class ClientDBus(Client, dbus.service.Object):
481
"""A Client class using D-Bus
482
483
Attributes:
484
dbus_object_path: dbus.ObjectPath
485
bus: dbus.SystemBus()
486
"""
487
# dbus.service.Object doesn't use super(), so we can't either.
488
489
def __init__(self, bus = None, *args, **kwargs):
490
self.bus = bus
491
Client.__init__(self, *args, **kwargs)
492
# Only now, when this client is initialized, can it show up on
493
# the D-Bus
494
self.dbus_object_path = (dbus.ObjectPath
495
(u"/clients/"
496
+ self.name.replace(u".", u"_")))
497
dbus.service.Object.__init__(self, self.bus,
498
self.dbus_object_path)
499
500
@staticmethod
501
def _datetime_to_dbus(dt, variant_level=0):
502
"""Convert a UTC datetime.datetime() to a D-Bus type."""
503
return dbus.String(dt.isoformat(),
504
variant_level=variant_level)
505
506
def enable(self):
507
oldstate = getattr(self, u"enabled", False)
508
r = Client.enable(self)
509
if oldstate != self.enabled:
510
# Emit D-Bus signals
511
self.PropertyChanged(dbus.String(u"enabled"),
512
dbus.Boolean(True, variant_level=1))
513
self.PropertyChanged(
514
dbus.String(u"last_enabled"),
515
self._datetime_to_dbus(self.last_enabled,
516
variant_level=1))
517
return r
518
519
def disable(self, signal = True):
520
oldstate = getattr(self, u"enabled", False)
521
r = Client.disable(self)
522
if signal and oldstate != self.enabled:
523
# Emit D-Bus signal
524
self.PropertyChanged(dbus.String(u"enabled"),
525
dbus.Boolean(False, variant_level=1))
526
return r
527
528
def __del__(self, *args, **kwargs):
529
try:
530
self.remove_from_connection()
531
except LookupError:
532
pass
533
if hasattr(dbus.service.Object, u"__del__"):
534
dbus.service.Object.__del__(self, *args, **kwargs)
535
Client.__del__(self, *args, **kwargs)
536
537
def checker_callback(self, pid, condition, command,
538
*args, **kwargs):
539
self.checker_callback_tag = None
540
self.checker = None
541
# Emit D-Bus signal
542
self.PropertyChanged(dbus.String(u"checker_running"),
543
dbus.Boolean(False, variant_level=1))
544
if os.WIFEXITED(condition):
545
exitstatus = os.WEXITSTATUS(condition)
546
# Emit D-Bus signal
547
self.CheckerCompleted(dbus.Int16(exitstatus),
548
dbus.Int64(condition),
549
dbus.String(command))
550
else:
551
# Emit D-Bus signal
552
self.CheckerCompleted(dbus.Int16(-1),
553
dbus.Int64(condition),
554
dbus.String(command))
555
556
return Client.checker_callback(self, pid, condition, command,
557
*args, **kwargs)
558
559
def checked_ok(self, *args, **kwargs):
560
r = Client.checked_ok(self, *args, **kwargs)
561
# Emit D-Bus signal
562
self.PropertyChanged(
563
dbus.String(u"last_checked_ok"),
564
(self._datetime_to_dbus(self.last_checked_ok,
565
variant_level=1)))
566
return r
567
568
def start_checker(self, *args, **kwargs):
569
old_checker = self.checker
570
if self.checker is not None:
571
old_checker_pid = self.checker.pid
572
else:
573
old_checker_pid = None
574
r = Client.start_checker(self, *args, **kwargs)
575
# Only if new checker process was started
576
if (self.checker is not None
577
and old_checker_pid != self.checker.pid):
578
# Emit D-Bus signal
579
self.CheckerStarted(self.current_checker_command)
580
self.PropertyChanged(
581
dbus.String(u"checker_running"),
582
dbus.Boolean(True, variant_level=1))
583
return r
584
585
def stop_checker(self, *args, **kwargs):
586
old_checker = getattr(self, u"checker", None)
587
r = Client.stop_checker(self, *args, **kwargs)
588
if (old_checker is not None
589
and getattr(self, u"checker", None) is None):
590
self.PropertyChanged(dbus.String(u"checker_running"),
591
dbus.Boolean(False, variant_level=1))
592
return r
593
450
594
451
## D-Bus methods & signals
595
452
_interface = u"se.bsnet.fukt.Mandos.Client"
596
453
597
454
# CheckedOK - method
598
@dbus.service.method(_interface)
599
def CheckedOK(self):
600
return self.checked_ok()
455
CheckedOK = dbus.service.method(_interface)(checked_ok)
456
CheckedOK.__name__ = "CheckedOK"
601
457
602
458
# CheckerCompleted - signal
603
@dbus.service.signal(_interface, signature=u"nxs")
459
@dbus.service.signal(_interface, signature="nxs")
604
460
def CheckerCompleted(self, exitcode, waitstatus, command):
605
461
"D-Bus signal"
606
462
pass
607
463
608
464
# CheckerStarted - signal
609
@dbus.service.signal(_interface, signature=u"s")
465
@dbus.service.signal(_interface, signature="s")
610
466
def CheckerStarted(self, command):
611
467
"D-Bus signal"
612
468
pass
613
469
614
470
# GetAllProperties - method
615
@dbus.service.method(_interface, out_signature=u"a{sv}")
471
@dbus.service.method(_interface, out_signature="a{sv}")
616
472
def GetAllProperties(self):
617
473
"D-Bus method"
618
474
return dbus.Dictionary({
619
dbus.String(u"name"):
475
dbus.String("name"):
620
476
dbus.String(self.name, variant_level=1),
621
dbus.String(u"fingerprint"):
477
dbus.String("fingerprint"):
622
478
dbus.String(self.fingerprint, variant_level=1),
623
dbus.String(u"host"):
479
dbus.String("host"):
624
480
dbus.String(self.host, variant_level=1),
625
dbus.String(u"created"):
626
self._datetime_to_dbus(self.created,
627
variant_level=1),
628
dbus.String(u"last_enabled"):
629
(self._datetime_to_dbus(self.last_enabled,
630
variant_level=1)
481
dbus.String("created"):
482
_datetime_to_dbus(self.created, variant_level=1),
483
dbus.String("last_enabled"):
484
(_datetime_to_dbus(self.last_enabled,
485
variant_level=1)
631
486
if self.last_enabled is not None
632
487
else dbus.Boolean(False, variant_level=1)),
633
dbus.String(u"enabled"):
488
dbus.String("enabled"):
634
489
dbus.Boolean(self.enabled, variant_level=1),
635
dbus.String(u"last_checked_ok"):
636
(self._datetime_to_dbus(self.last_checked_ok,
637
variant_level=1)
490
dbus.String("last_checked_ok"):
491
(_datetime_to_dbus(self.last_checked_ok,
492
variant_level=1)
638
493
if self.last_checked_ok is not None
639
494
else dbus.Boolean (False, variant_level=1)),
640
dbus.String(u"timeout"):
495
dbus.String("timeout"):
641
496
dbus.UInt64(self.timeout_milliseconds(),
642
497
variant_level=1),
643
dbus.String(u"interval"):
498
dbus.String("interval"):
644
499
dbus.UInt64(self.interval_milliseconds(),
645
500
variant_level=1),
646
dbus.String(u"checker"):
501
dbus.String("checker"):
647
502
dbus.String(self.checker_command,
648
503
variant_level=1),
649
dbus.String(u"checker_running"):
504
dbus.String("checker_running"):
650
505
dbus.Boolean(self.checker is not None,
651
506
variant_level=1),
652
dbus.String(u"object_path"):
507
dbus.String("object_path"):
653
508
dbus.ObjectPath(self.dbus_object_path,
654
509
variant_level=1)
655
}, signature=u"sv")
510
}, signature="sv")
656
511
657
512
# IsStillValid - method
658
@dbus.service.method(_interface, out_signature=u"b")
659
def IsStillValid(self):
660
return self.still_valid()
513
IsStillValid = (dbus.service.method(_interface, out_signature="b")
514
(still_valid))
515
IsStillValid.__name__ = "IsStillValid"
661
516
662
517
# PropertyChanged - signal
663
@dbus.service.signal(_interface, signature=u"sv")
518
@dbus.service.signal(_interface, signature="sv")
664
519
def PropertyChanged(self, property, value):
665
520
"D-Bus signal"
666
521
pass
667
522
668
# ReceivedSecret - signal
669
@dbus.service.signal(_interface)
670
def ReceivedSecret(self):
671
"D-Bus signal"
672
pass
673
674
# Rejected - signal
675
@dbus.service.signal(_interface)
676
def Rejected(self):
677
"D-Bus signal"
678
pass
679
680
523
# SetChecker - method
681
@dbus.service.method(_interface, in_signature=u"s")
524
@dbus.service.method(_interface, in_signature="s")
682
525
def SetChecker(self, checker):
683
526
"D-Bus setter method"
684
527
self.checker_command = checker
688
531
variant_level=1))
689
532
690
533
# SetHost - method
691
@dbus.service.method(_interface, in_signature=u"s")
534
@dbus.service.method(_interface, in_signature="s")
692
535
def SetHost(self, host):
693
536
"D-Bus setter method"
694
537
self.host = host
697
540
dbus.String(self.host, variant_level=1))
698
541
699
542
# SetInterval - method
700
@dbus.service.method(_interface, in_signature=u"t")
543
@dbus.service.method(_interface, in_signature="t")
701
544
def SetInterval(self, milliseconds):
702
545
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
703
546
# Emit D-Bus signal
706
549
variant_level=1)))
707
550
708
551
# SetSecret - method
709
@dbus.service.method(_interface, in_signature=u"ay",
552
@dbus.service.method(_interface, in_signature="ay",
710
553
byte_arrays=True)
711
554
def SetSecret(self, secret):
712
555
"D-Bus setter method"
713
556
self.secret = str(secret)
714
557
715
558
# SetTimeout - method
716
@dbus.service.method(_interface, in_signature=u"t")
559
@dbus.service.method(_interface, in_signature="t")
717
560
def SetTimeout(self, milliseconds):
718
561
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
719
562
# Emit D-Bus signal
722
565
variant_level=1)))
723
566
724
567
# Enable - method
725
@dbus.service.method(_interface)
726
def Enable(self):
727
"D-Bus method"
728
self.enable()
568
Enable = dbus.service.method(_interface)(enable)
569
Enable.__name__ = "Enable"
729
570
730
571
# StartChecker - method
731
572
@dbus.service.method(_interface)
740
581
self.disable()
741
582
742
583
# StopChecker - method
743
@dbus.service.method(_interface)
744
def StopChecker(self):
745
self.stop_checker()
584
StopChecker = dbus.service.method(_interface)(stop_checker)
585
StopChecker.__name__ = "StopChecker"
746
586
747
587
del _interface
748
588
749
589
750
class ClientHandler(socketserver.BaseRequestHandler, object):
751
"""A class to handle client connections.
752
753
Instantiated once for each connection to handle it.
590
def peer_certificate(session):
591
"Return the peer's OpenPGP certificate as a bytestring"
592
# If not an OpenPGP certificate...
593
if (gnutls.library.functions
594
.gnutls_certificate_type_get(session._c_object)
595
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
596
# ...do the normal thing
597
return session.peer_certificate
598
list_size = ctypes.c_uint(1)
599
cert_list = (gnutls.library.functions
600
.gnutls_certificate_get_peers
601
(session._c_object, ctypes.byref(list_size)))
602
if not bool(cert_list) and list_size.value != 0:
603
raise gnutls.errors.GNUTLSError("error getting peer"
604
" certificate")
605
if list_size.value == 0:
606
return None
607
cert = cert_list[0]
608
return ctypes.string_at(cert.data, cert.size)
609
610
611
def fingerprint(openpgp):
612
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
613
# New GnuTLS "datum" with the OpenPGP public key
614
datum = (gnutls.library.types
615
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
616
ctypes.POINTER
617
(ctypes.c_ubyte)),
618
ctypes.c_uint(len(openpgp))))
619
# New empty GnuTLS certificate
620
crt = gnutls.library.types.gnutls_openpgp_crt_t()
621
(gnutls.library.functions
622
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
623
# Import the OpenPGP public key into the certificate
624
(gnutls.library.functions
625
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
626
gnutls.library.constants
627
.GNUTLS_OPENPGP_FMT_RAW))
628
# Verify the self signature in the key
629
crtverify = ctypes.c_uint()
630
(gnutls.library.functions
631
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
632
if crtverify.value != 0:
633
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
634
raise gnutls.errors.CertificateSecurityError("Verify failed")
635
# New buffer for the fingerprint
636
buf = ctypes.create_string_buffer(20)
637
buf_len = ctypes.c_size_t()
638
# Get the fingerprint from the certificate into the buffer
639
(gnutls.library.functions
640
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
641
ctypes.byref(buf_len)))
642
# Deinit the certificate
643
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
644
# Convert the buffer to a Python bytestring
645
fpr = ctypes.string_at(buf, buf_len.value)
646
# Convert the bytestring to hexadecimal notation
647
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
648
return hex_fpr
649
650
651
class TCP_handler(SocketServer.BaseRequestHandler, object):
652
"""A TCP request handler class.
653
Instantiated by IPv6_TCPServer for each request to handle it.
754
654
Note: This will run in its own forked process."""
755
655
756
656
def handle(self):
757
657
logger.info(u"TCP connection from: %s",
758
658
unicode(self.client_address))
759
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
# Open IPC pipe to parent process
761
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
762
session = (gnutls.connection
763
.ClientSession(self.request,
764
gnutls.connection
765
.X509Credentials()))
766
767
line = self.request.makefile().readline()
768
logger.debug(u"Protocol version: %r", line)
769
try:
770
if int(line.strip().split()[0]) > 1:
771
raise RuntimeError
772
except (ValueError, IndexError, RuntimeError), error:
773
logger.error(u"Unknown protocol version: %s", error)
774
return
775
776
# Note: gnutls.connection.X509Credentials is really a
777
# generic GnuTLS certificate credentials object so long as
778
# no X.509 keys are added to it. Therefore, we can use it
779
# here despite using OpenPGP certificates.
780
781
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
# u"+AES-256-CBC", u"+SHA1",
783
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
784
# u"+DHE-DSS"))
785
# Use a fallback default, since this MUST be set.
786
priority = self.server.gnutls_priority
787
if priority is None:
788
priority = u"NORMAL"
789
(gnutls.library.functions
790
.gnutls_priority_set_direct(session._c_object,
791
priority, None))
792
793
try:
794
session.handshake()
795
except gnutls.errors.GNUTLSError, error:
796
logger.warning(u"Handshake failed: %s", error)
797
# Do not run session.bye() here: the session is not
798
# established. Just abandon the request.
799
return
800
logger.debug(u"Handshake succeeded")
801
try:
802
fpr = self.fingerprint(self.peer_certificate(session))
803
except (TypeError, gnutls.errors.GNUTLSError), error:
804
logger.warning(u"Bad certificate: %s", error)
805
session.bye()
806
return
807
logger.debug(u"Fingerprint: %s", fpr)
808
809
for c in self.server.clients:
810
if c.fingerprint == fpr:
811
client = c
812
break
813
else:
814
ipc.write(u"NOTFOUND %s\n" % fpr)
815
session.bye()
816
return
817
# Have to check if client.still_valid(), since it is
818
# possible that the client timed out while establishing
819
# the GnuTLS session.
820
if not client.still_valid():
821
ipc.write(u"INVALID %s\n" % client.name)
822
session.bye()
823
return
824
ipc.write(u"SENDING %s\n" % client.name)
825
sent_size = 0
826
while sent_size < len(client.secret):
827
sent = session.send(client.secret[sent_size:])
828
logger.debug(u"Sent: %d, remaining: %d",
829
sent, len(client.secret)
830
- (sent_size + sent))
831
sent_size += sent
832
session.bye()
833
834
@staticmethod
835
def peer_certificate(session):
836
"Return the peer's OpenPGP certificate as a bytestring"
837
# If not an OpenPGP certificate...
838
if (gnutls.library.functions
839
.gnutls_certificate_type_get(session._c_object)
840
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
841
# ...do the normal thing
842
return session.peer_certificate
843
list_size = ctypes.c_uint(1)
844
cert_list = (gnutls.library.functions
845
.gnutls_certificate_get_peers
846
(session._c_object, ctypes.byref(list_size)))
847
if not bool(cert_list) and list_size.value != 0:
848
raise gnutls.errors.GNUTLSError(u"error getting peer"
849
u" certificate")
850
if list_size.value == 0:
851
return None
852
cert = cert_list[0]
853
return ctypes.string_at(cert.data, cert.size)
854
855
@staticmethod
856
def fingerprint(openpgp):
857
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
858
# New GnuTLS "datum" with the OpenPGP public key
859
datum = (gnutls.library.types
860
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
861
ctypes.POINTER
862
(ctypes.c_ubyte)),
863
ctypes.c_uint(len(openpgp))))
864
# New empty GnuTLS certificate
865
crt = gnutls.library.types.gnutls_openpgp_crt_t()
866
(gnutls.library.functions
867
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
868
# Import the OpenPGP public key into the certificate
869
(gnutls.library.functions
870
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
871
gnutls.library.constants
872
.GNUTLS_OPENPGP_FMT_RAW))
873
# Verify the self signature in the key
874
crtverify = ctypes.c_uint()
875
(gnutls.library.functions
876
.gnutls_openpgp_crt_verify_self(crt, 0,
877
ctypes.byref(crtverify)))
878
if crtverify.value != 0:
879
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
880
raise (gnutls.errors.CertificateSecurityError
881
(u"Verify failed"))
882
# New buffer for the fingerprint
883
buf = ctypes.create_string_buffer(20)
884
buf_len = ctypes.c_size_t()
885
# Get the fingerprint from the certificate into the buffer
886
(gnutls.library.functions
887
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
888
ctypes.byref(buf_len)))
889
# Deinit the certificate
890
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
891
# Convert the buffer to a Python bytestring
892
fpr = ctypes.string_at(buf, buf_len.value)
893
# Convert the bytestring to hexadecimal notation
894
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
895
return hex_fpr
896
897
898
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
899
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
900
def process_request(self, request, client_address):
901
"""Overrides and wraps the original process_request().
902
903
This function creates a new pipe in self.pipe
904
"""
905
self.pipe = os.pipe()
906
super(ForkingMixInWithPipe,
907
self).process_request(request, client_address)
908
os.close(self.pipe[1]) # close write end
909
self.add_pipe(self.pipe[0])
910
def add_pipe(self, pipe):
911
"""Dummy function; override as necessary"""
912
os.close(pipe)
913
914
915
class IPv6_TCPServer(ForkingMixInWithPipe,
916
socketserver.TCPServer, object):
917
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
918
659
session = (gnutls.connection
660
.ClientSession(self.request,
661
gnutls.connection
662
.X509Credentials()))
663
664
line = self.request.makefile().readline()
665
logger.debug(u"Protocol version: %r", line)
666
try:
667
if int(line.strip().split()[0]) > 1:
668
raise RuntimeError
669
except (ValueError, IndexError, RuntimeError), error:
670
logger.error(u"Unknown protocol version: %s", error)
671
return
672
673
# Note: gnutls.connection.X509Credentials is really a generic
674
# GnuTLS certificate credentials object so long as no X.509
675
# keys are added to it. Therefore, we can use it here despite
676
# using OpenPGP certificates.
677
678
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
679
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
680
# "+DHE-DSS"))
681
# Use a fallback default, since this MUST be set.
682
priority = self.server.settings.get("priority", "NORMAL")
683
(gnutls.library.functions
684
.gnutls_priority_set_direct(session._c_object,
685
priority, None))
686
687
try:
688
session.handshake()
689
except gnutls.errors.GNUTLSError, error:
690
logger.warning(u"Handshake failed: %s", error)
691
# Do not run session.bye() here: the session is not
692
# established. Just abandon the request.
693
return
694
logger.debug(u"Handshake succeeded")
695
try:
696
fpr = fingerprint(peer_certificate(session))
697
except (TypeError, gnutls.errors.GNUTLSError), error:
698
logger.warning(u"Bad certificate: %s", error)
699
session.bye()
700
return
701
logger.debug(u"Fingerprint: %s", fpr)
702
703
for c in self.server.clients:
704
if c.fingerprint == fpr:
705
client = c
706
break
707
else:
708
logger.warning(u"Client not found for fingerprint: %s",
709
fpr)
710
session.bye()
711
return
712
# Have to check if client.still_valid(), since it is possible
713
# that the client timed out while establishing the GnuTLS
714
# session.
715
if not client.still_valid():
716
logger.warning(u"Client %(name)s is invalid",
717
vars(client))
718
session.bye()
719
return
720
## This won't work here, since we're in a fork.
721
# client.checked_ok()
722
sent_size = 0
723
while sent_size < len(client.secret):
724
sent = session.send(client.secret[sent_size:])
725
logger.debug(u"Sent: %d, remaining: %d",
726
sent, len(client.secret)
727
- (sent_size + sent))
728
sent_size += sent
729
session.bye()
730
731
732
class IPv6_TCPServer(SocketServer.ForkingMixIn,
733
SocketServer.TCPServer, object):
734
"""IPv6 TCP server. Accepts 'None' as address and/or port.
919
735
Attributes:
736
settings: Server settings
737
clients: Set() of Client objects
920
738
enabled: Boolean; whether this server is activated yet
921
interface: None or a network interface name (string)
922
use_ipv6: Boolean; to use IPv6 or not
923
739
"""
924
def __init__(self, server_address, RequestHandlerClass,
925
interface=None, use_ipv6=True):
926
self.interface = interface
927
if use_ipv6:
928
self.address_family = socket.AF_INET6
929
socketserver.TCPServer.__init__(self, server_address,
930
RequestHandlerClass)
740
address_family = socket.AF_INET6
741
def __init__(self, *args, **kwargs):
742
if "settings" in kwargs:
743
self.settings = kwargs["settings"]
744
del kwargs["settings"]
745
if "clients" in kwargs:
746
self.clients = kwargs["clients"]
747
del kwargs["clients"]
748
self.enabled = False
749
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
931
750
def server_bind(self):
932
751
"""This overrides the normal server_bind() function
933
752
to bind to an interface if one was specified, and also NOT to
934
753
bind to an address or port if they were not specified."""
935
if self.interface is not None:
936
if SO_BINDTODEVICE is None:
937
logger.error(u"SO_BINDTODEVICE does not exist;"
938
u" cannot bind to interface %s",
939
self.interface)
940
else:
941
try:
942
self.socket.setsockopt(socket.SOL_SOCKET,
943
SO_BINDTODEVICE,
944
str(self.interface
945
+ u'\0'))
946
except socket.error, error:
947
if error[0] == errno.EPERM:
948
logger.error(u"No permission to"
949
u" bind to interface %s",
950
self.interface)
951
elif error[0] == errno.ENOPROTOOPT:
952
logger.error(u"SO_BINDTODEVICE not available;"
953
u" cannot bind to interface %s",
954
self.interface)
955
else:
956
raise
754
if self.settings["interface"]:
755
# 25 is from /usr/include/asm-i486/socket.h
756
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
757
try:
758
self.socket.setsockopt(socket.SOL_SOCKET,
759
SO_BINDTODEVICE,
760
self.settings["interface"])
761
except socket.error, error:
762
if error[0] == errno.EPERM:
763
logger.error(u"No permission to"
764
u" bind to interface %s",
765
self.settings["interface"])
766
else:
767
raise error
957
768
# Only bind(2) the socket if we really need to.
958
769
if self.server_address[0] or self.server_address[1]:
959
770
if not self.server_address[0]:
960
if self.address_family == socket.AF_INET6:
961
any_address = u"::" # in6addr_any
962
else:
963
any_address = socket.INADDR_ANY
964
self.server_address = (any_address,
771
in6addr_any = "::"
772
self.server_address = (in6addr_any,
965
773
self.server_address[1])
966
774
elif not self.server_address[1]:
967
775
self.server_address = (self.server_address[0],
968
776
0)
969
# if self.interface:
777
# if self.settings["interface"]:
970
778
# self.server_address = (self.server_address[0],
971
779
# 0, # port
972
780
# 0, # flowinfo
973
781
# if_nametoindex
974
# (self.interface))
975
return socketserver.TCPServer.server_bind(self)
976
977
978
class MandosServer(IPv6_TCPServer):
979
"""Mandos server.
980
981
Attributes:
982
clients: set of Client objects
983
gnutls_priority GnuTLS priority string
984
use_dbus: Boolean; to emit D-Bus signals or not
985
clients: set of Client objects
986
gnutls_priority GnuTLS priority string
987
use_dbus: Boolean; to emit D-Bus signals or not
988
989
Assumes a gobject.MainLoop event loop.
990
"""
991
def __init__(self, server_address, RequestHandlerClass,
992
interface=None, use_ipv6=True, clients=None,
993
gnutls_priority=None, use_dbus=True):
994
self.enabled = False
995
self.clients = clients
996
if self.clients is None:
997
self.clients = set()
998
self.use_dbus = use_dbus
999
self.gnutls_priority = gnutls_priority
1000
IPv6_TCPServer.__init__(self, server_address,
1001
RequestHandlerClass,
1002
interface = interface,
1003
use_ipv6 = use_ipv6)
782
# (self.settings
783
# ["interface"]))
784
return super(IPv6_TCPServer, self).server_bind()
1004
785
def server_activate(self):
1005
786
if self.enabled:
1006
return socketserver.TCPServer.server_activate(self)
787
return super(IPv6_TCPServer, self).server_activate()
1007
788
def enable(self):
1008
789
self.enabled = True
1009
def add_pipe(self, pipe):
1010
# Call "handle_ipc" for both data and EOF events
1011
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1012
self.handle_ipc)
1013
def handle_ipc(self, source, condition, file_objects={}):
1014
condition_names = {
1015
gobject.IO_IN: u"IN", # There is data to read.
1016
gobject.IO_OUT: u"OUT", # Data can be written (without
1017
# blocking).
1018
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1019
gobject.IO_ERR: u"ERR", # Error condition.
1020
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1021
# broken, usually for pipes and
1022
# sockets).
1023
}
1024
conditions_string = ' | '.join(name
1025
for cond, name in
1026
condition_names.iteritems()
1027
if cond & condition)
1028
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1029
conditions_string)
1030
1031
# Turn the pipe file descriptor into a Python file object
1032
if source not in file_objects:
1033
file_objects[source] = os.fdopen(source, u"r", 1)
1034
1035
# Read a line from the file object
1036
cmdline = file_objects[source].readline()
1037
if not cmdline: # Empty line means end of file
1038
# close the IPC pipe
1039
file_objects[source].close()
1040
del file_objects[source]
1041
1042
# Stop calling this function
1043
return False
1044
1045
logger.debug(u"IPC command: %r", cmdline)
1046
1047
# Parse and act on command
1048
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1049
1050
if cmd == u"NOTFOUND":
1051
logger.warning(u"Client not found for fingerprint: %s",
1052
args)
1053
if self.use_dbus:
1054
# Emit D-Bus signal
1055
mandos_dbus_service.ClientNotFound(args)
1056
elif cmd == u"INVALID":
1057
for client in self.clients:
1058
if client.name == args:
1059
logger.warning(u"Client %s is invalid", args)
1060
if self.use_dbus:
1061
# Emit D-Bus signal
1062
client.Rejected()
1063
break
1064
else:
1065
logger.error(u"Unknown client %s is invalid", args)
1066
elif cmd == u"SENDING":
1067
for client in self.clients:
1068
if client.name == args:
1069
logger.info(u"Sending secret to %s", client.name)
1070
client.checked_ok()
1071
if self.use_dbus:
1072
# Emit D-Bus signal
1073
client.ReceivedSecret()
1074
break
1075
else:
1076
logger.error(u"Sending secret to unknown client %s",
1077
args)
1078
else:
1079
logger.error(u"Unknown IPC command: %r", cmdline)
1080
1081
# Keep calling this function
1082
return True
1083
790
1084
791
1085
792
def string_to_delta(interval):
1086
793
"""Parse a string and return a datetime.timedelta
1087
794
1088
>>> string_to_delta(u'7d')
795
>>> string_to_delta('7d')
1089
796
datetime.timedelta(7)
1090
>>> string_to_delta(u'60s')
797
>>> string_to_delta('60s')
1091
798
datetime.timedelta(0, 60)
1092
>>> string_to_delta(u'60m')
799
>>> string_to_delta('60m')
1093
800
datetime.timedelta(0, 3600)
1094
>>> string_to_delta(u'24h')
801
>>> string_to_delta('24h')
1095
802
datetime.timedelta(1)
1096
803
>>> string_to_delta(u'1w')
1097
804
datetime.timedelta(7)
1098
>>> string_to_delta(u'5m 30s')
805
>>> string_to_delta('5m 30s')
1099
806
datetime.timedelta(0, 330)
1100
807
"""
1101
808
timevalue = datetime.timedelta(0)
1121
828
return timevalue
1122
829
1123
830
831
def server_state_changed(state):
832
"""Derived from the Avahi example code"""
833
if state == avahi.SERVER_COLLISION:
834
logger.error(u"Zeroconf server name collision")
835
service.remove()
836
elif state == avahi.SERVER_RUNNING:
837
service.add()
838
839
840
def entry_group_state_changed(state, error):
841
"""Derived from the Avahi example code"""
842
logger.debug(u"Avahi state change: %i", state)
843
844
if state == avahi.ENTRY_GROUP_ESTABLISHED:
845
logger.debug(u"Zeroconf service established.")
846
elif state == avahi.ENTRY_GROUP_COLLISION:
847
logger.warning(u"Zeroconf service name collision.")
848
service.rename()
849
elif state == avahi.ENTRY_GROUP_FAILURE:
850
logger.critical(u"Avahi: Error in group state changed %s",
851
unicode(error))
852
raise AvahiGroupError(u"State changed: %s" % unicode(error))
853
1124
854
def if_nametoindex(interface):
1125
"""Call the C function if_nametoindex(), or equivalent
1126
1127
Note: This function cannot accept a unicode string."""
855
"""Call the C function if_nametoindex(), or equivalent"""
1128
856
global if_nametoindex
1129
857
try:
1130
858
if_nametoindex = (ctypes.cdll.LoadLibrary
1131
(ctypes.util.find_library(u"c"))
859
(ctypes.util.find_library("c"))
1132
860
.if_nametoindex)
1133
861
except (OSError, AttributeError):
1134
logger.warning(u"Doing if_nametoindex the hard way")
862
if "struct" not in sys.modules:
863
import struct
864
if "fcntl" not in sys.modules:
865
import fcntl
1135
866
def if_nametoindex(interface):
1136
867
"Get an interface index the hard way, i.e. using fcntl()"
1137
868
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1138
869
with closing(socket.socket()) as s:
1139
870
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1140
struct.pack(str(u"16s16x"),
1141
interface))
1142
interface_index = struct.unpack(str(u"I"),
1143
ifreq[16:20])[0]
871
struct.pack("16s16x", interface))
872
interface_index = struct.unpack("I", ifreq[16:20])[0]
1144
873
return interface_index
1145
874
return if_nametoindex(interface)
1146
875
1147
876
1148
877
def daemon(nochdir = False, noclose = False):
1149
878
"""See daemon(3). Standard BSD Unix function.
1150
1151
879
This should really exist as os.daemon, but it doesn't (yet)."""
1152
880
if os.fork():
1153
881
sys.exit()
1154
882
os.setsid()
1155
883
if not nochdir:
1156
os.chdir(u"/")
884
os.chdir("/")
1157
885
if os.fork():
1158
886
sys.exit()
1159
887
if not noclose:
1161
889
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1162
890
if not stat.S_ISCHR(os.fstat(null).st_mode):
1163
891
raise OSError(errno.ENODEV,
1164
u"/dev/null not a character device")
892
"/dev/null not a character device")
1165
893
os.dup2(null, sys.stdin.fileno())
1166
894
os.dup2(null, sys.stdout.fileno())
1167
895
os.dup2(null, sys.stderr.fileno())
1170
898
1171
899
1172
900
def main():
1173
1174
######################################################################
1175
# Parsing of options, both command line and config file
1176
1177
901
parser = optparse.OptionParser(version = "%%prog %s" % version)
1178
parser.add_option("-i", u"--interface", type=u"string",
1179
metavar="IF", help=u"Bind to interface IF")
1180
parser.add_option("-a", u"--address", type=u"string",
1181
help=u"Address to listen for requests on")
1182
parser.add_option("-p", u"--port", type=u"int",
1183
help=u"Port number to receive requests on")
1184
parser.add_option("--check", action=u"store_true",
1185
help=u"Run self-test")
1186
parser.add_option("--debug", action=u"store_true",
1187
help=u"Debug mode; run in foreground and log to"
1188
u" terminal")
1189
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1190
u" priority string (see GnuTLS documentation)")
1191
parser.add_option("--servicename", type=u"string",
1192
metavar=u"NAME", help=u"Zeroconf service name")
1193
parser.add_option("--configdir", type=u"string",
1194
default=u"/etc/mandos", metavar=u"DIR",
1195
help=u"Directory to search for configuration"
1196
u" files")
1197
parser.add_option("--no-dbus", action=u"store_false",
1198
dest=u"use_dbus", help=u"Do not provide D-Bus"
1199
u" system bus interface")
1200
parser.add_option("--no-ipv6", action=u"store_false",
1201
dest=u"use_ipv6", help=u"Do not use IPv6")
902
parser.add_option("-i", "--interface", type="string",
903
metavar="IF", help="Bind to interface IF")
904
parser.add_option("-a", "--address", type="string",
905
help="Address to listen for requests on")
906
parser.add_option("-p", "--port", type="int",
907
help="Port number to receive requests on")
908
parser.add_option("--check", action="store_true",
909
help="Run self-test")
910
parser.add_option("--debug", action="store_true",
911
help="Debug mode; run in foreground and log to"
912
" terminal")
913
parser.add_option("--priority", type="string", help="GnuTLS"
914
" priority string (see GnuTLS documentation)")
915
parser.add_option("--servicename", type="string", metavar="NAME",
916
help="Zeroconf service name")
917
parser.add_option("--configdir", type="string",
918
default="/etc/mandos", metavar="DIR",
919
help="Directory to search for configuration"
920
" files")
921
parser.add_option("--no-dbus", action="store_false",
922
dest="use_dbus",
923
help="Do not provide D-Bus system bus"
924
" interface")
1202
925
options = parser.parse_args()[0]
1203
926
1204
927
if options.check:
1207
930
sys.exit()
1208
931
1209
932
# Default values for config file for server-global settings
1210
server_defaults = { u"interface": u"",
1211
u"address": u"",
1212
u"port": u"",
1213
u"debug": u"False",
1214
u"priority":
1215
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1216
u"servicename": u"Mandos",
1217
u"use_dbus": u"True",
1218
u"use_ipv6": u"True",
933
server_defaults = { "interface": "",
934
"address": "",
935
"port": "",
936
"debug": "False",
937
"priority":
938
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
939
"servicename": "Mandos",
940
"use_dbus": "True",
1219
941
}
1220
942
1221
943
# Parse config file for server-global settings
1222
server_config = configparser.SafeConfigParser(server_defaults)
944
server_config = ConfigParser.SafeConfigParser(server_defaults)
1223
945
del server_defaults
1224
server_config.read(os.path.join(options.configdir,
1225
u"mandos.conf"))
946
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1226
947
# Convert the SafeConfigParser object to a dict
1227
948
server_settings = server_config.defaults()
1228
949
# Use the appropriate methods on the non-string config options
1229
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1230
server_settings[option] = server_config.getboolean(u"DEFAULT",
1231
option)
950
server_settings["debug"] = server_config.getboolean("DEFAULT",
951
"debug")
952
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
953
"use_dbus")
1232
954
if server_settings["port"]:
1233
server_settings["port"] = server_config.getint(u"DEFAULT",
1234
u"port")
955
server_settings["port"] = server_config.getint("DEFAULT",
956
"port")
1235
957
del server_config
1236
958
1237
959
# Override the settings from the config file with command line
1238
960
# options, if set.
1239
for option in (u"interface", u"address", u"port", u"debug",
1240
u"priority", u"servicename", u"configdir",
1241
u"use_dbus", u"use_ipv6"):
961
for option in ("interface", "address", "port", "debug",
962
"priority", "servicename", "configdir",
963
"use_dbus"):
1242
964
value = getattr(options, option)
1243
965
if value is not None:
1244
966
server_settings[option] = value
1245
967
del options
1246
# Force all strings to be unicode
1247
for option in server_settings.keys():
1248
if type(server_settings[option]) is str:
1249
server_settings[option] = unicode(server_settings[option])
1250
968
# Now we have our good server settings in "server_settings"
1251
969
1252
##################################################################
1253
1254
970
# For convenience
1255
debug = server_settings[u"debug"]
1256
use_dbus = server_settings[u"use_dbus"]
1257
use_ipv6 = server_settings[u"use_ipv6"]
971
debug = server_settings["debug"]
972
use_dbus = server_settings["use_dbus"]
973
974
def sigsegvhandler(signum, frame):
975
raise RuntimeError('Segmentation fault')
1258
976
1259
977
if not debug:
1260
978
syslogger.setLevel(logging.WARNING)
1261
979
console.setLevel(logging.WARNING)
980
else:
981
signal.signal(signal.SIGSEGV, sigsegvhandler)
1262
982
1263
if server_settings[u"servicename"] != u"Mandos":
983
if server_settings["servicename"] != "Mandos":
1264
984
syslogger.setFormatter(logging.Formatter
1265
(u'Mandos (%s) [%%(process)d]:'
1266
u' %%(levelname)s: %%(message)s'
1267
% server_settings[u"servicename"]))
985
('Mandos (%s): %%(levelname)s:'
986
' %%(message)s'
987
% server_settings["servicename"]))
1268
988
1269
989
# Parse config file with clients
1270
client_defaults = { u"timeout": u"1h",
1271
u"interval": u"5m",
1272
u"checker": u"fping -q -- %%(host)s",
1273
u"host": u"",
990
client_defaults = { "timeout": "1h",
991
"interval": "5m",
992
"checker": "fping -q -- %%(host)s",
993
"host": "",
1274
994
}
1275
client_config = configparser.SafeConfigParser(client_defaults)
1276
client_config.read(os.path.join(server_settings[u"configdir"],
1277
u"clients.conf"))
1278
1279
global mandos_dbus_service
1280
mandos_dbus_service = None
1281
1282
tcp_server = MandosServer((server_settings[u"address"],
1283
server_settings[u"port"]),
1284
ClientHandler,
1285
interface=server_settings[u"interface"],
1286
use_ipv6=use_ipv6,
1287
gnutls_priority=
1288
server_settings[u"priority"],
1289
use_dbus=use_dbus)
1290
pidfilename = u"/var/run/mandos.pid"
1291
try:
1292
pidfile = open(pidfilename, u"w")
1293
except IOError:
1294
logger.error(u"Could not open file %r", pidfilename)
1295
1296
try:
1297
uid = pwd.getpwnam(u"_mandos").pw_uid
1298
gid = pwd.getpwnam(u"_mandos").pw_gid
995
client_config = ConfigParser.SafeConfigParser(client_defaults)
996
client_config.read(os.path.join(server_settings["configdir"],
997
"clients.conf"))
998
999
clients = Set()
1000
tcp_server = IPv6_TCPServer((server_settings["address"],
1001
server_settings["port"]),
1002
TCP_handler,
1003
settings=server_settings,
1004
clients=clients)
1005
pidfilename = "/var/run/mandos.pid"
1006
try:
1007
pidfile = open(pidfilename, "w")
1008
except IOError, error:
1009
logger.error("Could not open file %r", pidfilename)
1010
1011
try:
1012
uid = pwd.getpwnam("_mandos").pw_uid
1013
gid = pwd.getpwnam("_mandos").pw_gid
1299
1014
except KeyError:
1300
1015
try:
1301
uid = pwd.getpwnam(u"mandos").pw_uid
1302
gid = pwd.getpwnam(u"mandos").pw_gid
1016
uid = pwd.getpwnam("mandos").pw_uid
1017
gid = pwd.getpwnam("mandos").pw_gid
1303
1018
except KeyError:
1304
1019
try:
1305
uid = pwd.getpwnam(u"nobody").pw_uid
1306
gid = pwd.getpwnam(u"nobody").pw_gid
1020
uid = pwd.getpwnam("nobody").pw_uid
1021
gid = pwd.getpwnam("nogroup").pw_gid
1307
1022
except KeyError:
1308
1023
uid = 65534
1309
1024
gid = 65534
1322
1037
1323
1038
@gnutls.library.types.gnutls_log_func
1324
1039
def debug_gnutls(level, string):
1325
logger.debug(u"GnuTLS: %s", string[:-1])
1040
logger.debug("GnuTLS: %s", string[:-1])
1326
1041
1327
1042
(gnutls.library.functions
1328
1043
.gnutls_global_set_log_function(debug_gnutls))
1329
1044
1045
global service
1046
service = AvahiService(name = server_settings["servicename"],
1047
servicetype = "_mandos._tcp", )
1048
if server_settings["interface"]:
1049
service.interface = (if_nametoindex
1050
(server_settings["interface"]))
1051
1330
1052
global main_loop
1053
global bus
1054
global server
1331
1055
# From the Avahi example code
1332
1056
DBusGMainLoop(set_as_default=True )
1333
1057
main_loop = gobject.MainLoop()
1334
1058
bus = dbus.SystemBus()
1059
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1060
avahi.DBUS_PATH_SERVER),
1061
avahi.DBUS_INTERFACE_SERVER)
1335
1062
# End of Avahi example code
1336
1063
if use_dbus:
1337
1064
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1338
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1339
service = AvahiService(name = server_settings[u"servicename"],
1340
servicetype = u"_mandos._tcp",
1341
protocol = protocol, bus = bus)
1342
if server_settings["interface"]:
1343
service.interface = (if_nametoindex
1344
(str(server_settings[u"interface"])))
1345
1065
1346
client_class = Client
1347
if use_dbus:
1348
client_class = functools.partial(ClientDBus, bus = bus)
1349
tcp_server.clients.update(set(
1350
client_class(name = section,
1351
config= dict(client_config.items(section)))
1352
for section in client_config.sections()))
1353
if not tcp_server.clients:
1066
clients.update(Set(Client(name = section,
1067
config
1068
= dict(client_config.items(section)),
1069
use_dbus = use_dbus)
1070
for section in client_config.sections()))
1071
if not clients:
1354
1072
logger.warning(u"No clients defined")
1355
1073
1356
1074
if debug:
1366
1084
daemon()
1367
1085
1368
1086
try:
1369
with closing(pidfile):
1370
pid = os.getpid()
1371
pidfile.write(str(pid) + "\n")
1087
pid = os.getpid()
1088
pidfile.write(str(pid) + "\n")
1089
pidfile.close()
1372
1090
del pidfile
1373
1091
except IOError:
1374
1092
logger.error(u"Could not write to file %r with PID %d",
1380
1098
1381
1099
def cleanup():
1382
1100
"Cleanup function; run on exit"
1383
service.cleanup()
1101
global group
1102
# From the Avahi example code
1103
if not group is None:
1104
group.Free()
1105
group = None
1106
# End of Avahi example code
1384
1107
1385
while tcp_server.clients:
1386
client = tcp_server.clients.pop()
1108
while clients:
1109
client = clients.pop()
1387
1110
client.disable_hook = None
1388
1111
client.disable()
1389
1112
1395
1118
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1396
1119
1397
1120
if use_dbus:
1398
class MandosDBusService(dbus.service.Object):
1121
class MandosServer(dbus.service.Object):
1399
1122
"""A D-Bus proxy object"""
1400
1123
def __init__(self):
1401
dbus.service.Object.__init__(self, bus, u"/")
1124
dbus.service.Object.__init__(self, bus, "/")
1402
1125
_interface = u"se.bsnet.fukt.Mandos"
1403
1126
1404
@dbus.service.signal(_interface, signature=u"oa{sv}")
1127
@dbus.service.signal(_interface, signature="oa{sv}")
1405
1128
def ClientAdded(self, objpath, properties):
1406
1129
"D-Bus signal"
1407
1130
pass
1408
1131
1409
@dbus.service.signal(_interface, signature=u"s")
1410
def ClientNotFound(self, fingerprint):
1411
"D-Bus signal"
1412
pass
1413
1414
@dbus.service.signal(_interface, signature=u"os")
1132
@dbus.service.signal(_interface, signature="os")
1415
1133
def ClientRemoved(self, objpath, name):
1416
1134
"D-Bus signal"
1417
1135
pass
1418
1136
1419
@dbus.service.method(_interface, out_signature=u"ao")
1137
@dbus.service.method(_interface, out_signature="ao")
1420
1138
def GetAllClients(self):
1421
1139
"D-Bus method"
1422
return dbus.Array(c.dbus_object_path
1423
for c in tcp_server.clients)
1140
return dbus.Array(c.dbus_object_path for c in clients)
1424
1141
1425
@dbus.service.method(_interface,
1426
out_signature=u"a{oa{sv}}")
1142
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1427
1143
def GetAllClientsWithProperties(self):
1428
1144
"D-Bus method"
1429
1145
return dbus.Dictionary(
1430
1146
((c.dbus_object_path, c.GetAllProperties())
1431
for c in tcp_server.clients),
1432
signature=u"oa{sv}")
1147
for c in clients),
1148
signature="oa{sv}")
1433
1149
1434
@dbus.service.method(_interface, in_signature=u"o")
1150
@dbus.service.method(_interface, in_signature="o")
1435
1151
def RemoveClient(self, object_path):
1436
1152
"D-Bus method"
1437
for c in tcp_server.clients:
1153
for c in clients:
1438
1154
if c.dbus_object_path == object_path:
1439
tcp_server.clients.remove(c)
1440
c.remove_from_connection()
1155
clients.remove(c)
1441
1156
# Don't signal anything except ClientRemoved
1442
c.disable(signal=False)
1157
c.use_dbus = False
1158
c.disable()
1443
1159
# Emit D-Bus signal
1444
1160
self.ClientRemoved(object_path, c.name)
1445
1161
return
1447
1163
1448
1164
del _interface
1449
1165
1450
mandos_dbus_service = MandosDBusService()
1166
mandos_server = MandosServer()
1451
1167
1452
for client in tcp_server.clients:
1168
for client in clients:
1453
1169
if use_dbus:
1454
1170
# Emit D-Bus signal
1455
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1456
client.GetAllProperties())
1171
mandos_server.ClientAdded(client.dbus_object_path,
1172
client.GetAllProperties())
1457
1173
client.enable()
1458
1174
1459
1175
tcp_server.enable()
1461
1177
1462
1178
# Find out what port we got
1463
1179
service.port = tcp_server.socket.getsockname()[1]
1464
if use_ipv6:
1465
logger.info(u"Now listening on address %r, port %d,"
1466
" flowinfo %d, scope_id %d"
1467
% tcp_server.socket.getsockname())
1468
else: # IPv4
1469
logger.info(u"Now listening on address %r, port %d"
1470
% tcp_server.socket.getsockname())
1180
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1181
u" scope_id %d" % tcp_server.socket.getsockname())
1471
1182
1472
1183
#service.interface = tcp_server.socket.getsockname()[3]
1473
1184
1474
1185
try:
1475
1186
# From the Avahi example code
1187
server.connect_to_signal("StateChanged", server_state_changed)
1476
1188
try:
1477
service.activate()
1189
server_state_changed(server.GetState())
1478
1190
except dbus.exceptions.DBusException, error:
1479
1191
logger.critical(u"DBusException: %s", error)
1480
1192
sys.exit(1)
1492
1204
sys.exit(1)
1493
1205
except KeyboardInterrupt:
1494
1206
if debug:
1495
print >> sys.stderr
1496
logger.debug(u"Server received KeyboardInterrupt")
1497
logger.debug(u"Server exiting")
1207
print
1498
1208
1499
1209
if __name__ == '__main__':
1500
1210
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0