To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 291
- compare with another revision
- download diff
- download tarball
- view history from revision 291
- Committer: Teddy Hogeborn
- Date: 2009-01-31 10:33:17 UTC
- mfrom: (24.1.129 mandos)
- Revision ID: teddy@fukt.bsnet.se-20090131103317-wzqvyr532sjcjt7u
Merge from Björn:
* mandos-ctl: New option "--remove-client". Only default to listing
clients if no clients were given on the command line.
* plugins.d/mandos-client.c: Lower kernel log level while bringing up
network interface. New option "--delay"
to control the maximum delay to wait for
running interface.
* plugins.d/mandos-client.xml (SYNOPSIS, OPTIONS): New option
"--delay".
* mandos-ctl: New option "--remove-client". Only default to listing
clients if no clients were given on the command line.
* plugins.d/mandos-client.c: Lower kernel log level while bringing up
network interface. New option "--delay"
to control the maximum delay to wait for
running interface.
* plugins.d/mandos-client.xml (SYNOPSIS, OPTIONS): New option
"--delay".
- files modified:
- INSTALL
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
34
34
from __future__ import division, with_statement, absolute_import
35
35
36
import SocketServer as socketserver
36
import SocketServer
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
import ConfigParser as configparser
47
import ConfigParser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
from sets import Set
52
53
import subprocess
53
54
import atexit
54
55
import stat
56
57
import logging.handlers
57
58
import pwd
58
59
from contextlib import closing
59
import struct
60
import fcntl
61
import functools
62
60
63
61
import dbus
64
62
import dbus.service
68
66
import ctypes
69
67
import ctypes.util
70
68
71
try:
72
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
73
except AttributeError:
74
try:
75
from IN import SO_BINDTODEVICE
76
except ImportError:
77
SO_BINDTODEVICE = None
78
79
80
version = "1.0.12"
81
82
logger = logging.Logger(u'mandos')
69
version = "1.0.5"
70
71
logger = logging.Logger('mandos')
83
72
syslogger = (logging.handlers.SysLogHandler
84
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
85
74
address = "/dev/log"))
86
75
syslogger.setFormatter(logging.Formatter
87
(u'Mandos [%(process)d]: %(levelname)s:'
88
u' %(message)s'))
76
('Mandos: %(levelname)s: %(message)s'))
89
77
logger.addHandler(syslogger)
90
78
91
79
console = logging.StreamHandler()
92
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
93
u' %(levelname)s:'
94
u' %(message)s'))
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
95
82
logger.addHandler(console)
96
83
97
84
class AvahiError(Exception):
110
97
111
98
class AvahiService(object):
112
99
"""An Avahi (Zeroconf) service.
113
114
100
Attributes:
115
101
interface: integer; avahi.IF_UNSPEC or an interface index.
116
102
Used to optionally bind to the specified interface.
117
name: string; Example: u'Mandos'
118
type: string; Example: u'_mandos._tcp'.
103
name: string; Example: 'Mandos'
104
type: string; Example: '_mandos._tcp'.
119
105
See <http://www.dns-sd.org/ServiceTypes.html>
120
106
port: integer; what port to announce
121
107
TXT: list of strings; TXT record for the service
124
110
max_renames: integer; maximum number of renames
125
111
rename_count: integer; counter so we only rename after collisions
126
112
a sensible number of times
127
group: D-Bus Entry Group
128
server: D-Bus Server
129
bus: dbus.SystemBus()
130
113
"""
131
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
132
115
servicetype = None, port = None, TXT = None,
133
domain = u"", host = u"", max_renames = 32768,
134
protocol = avahi.PROTO_UNSPEC, bus = None):
116
domain = "", host = "", max_renames = 32768):
135
117
self.interface = interface
136
118
self.name = name
137
119
self.type = servicetype
141
123
self.host = host
142
124
self.rename_count = 0
143
125
self.max_renames = max_renames
144
self.protocol = protocol
145
self.group = None # our entry group
146
self.server = None
147
self.bus = bus
148
126
def rename(self):
149
127
"""Derived from the Avahi example code"""
150
128
if self.rename_count >= self.max_renames:
152
130
u" after %i retries, exiting.",
153
131
self.rename_count)
154
132
raise AvahiServiceError(u"Too many renames")
155
self.name = self.server.GetAlternativeServiceName(self.name)
133
self.name = server.GetAlternativeServiceName(self.name)
156
134
logger.info(u"Changing Zeroconf service name to %r ...",
157
unicode(self.name))
135
str(self.name))
158
136
syslogger.setFormatter(logging.Formatter
159
(u'Mandos (%s) [%%(process)d]:'
160
u' %%(levelname)s: %%(message)s'
161
% self.name))
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
162
139
self.remove()
163
140
self.add()
164
141
self.rename_count += 1
165
142
def remove(self):
166
143
"""Derived from the Avahi example code"""
167
if self.group is not None:
168
self.group.Reset()
144
if group is not None:
145
group.Reset()
169
146
def add(self):
170
147
"""Derived from the Avahi example code"""
171
if self.group is None:
172
self.group = dbus.Interface(
173
self.bus.get_object(avahi.DBUS_NAME,
174
self.server.EntryGroupNew()),
175
avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
self.group.connect_to_signal('StateChanged',
177
self.entry_group_state_changed)
148
global group
149
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
178
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
179
self.name, self.type)
180
self.group.AddService(
181
self.interface,
182
self.protocol,
183
dbus.UInt32(0), # flags
184
self.name, self.type,
185
self.domain, self.host,
186
dbus.UInt16(self.port),
187
avahi.string_array_to_txt_array(self.TXT))
188
self.group.Commit()
189
def entry_group_state_changed(self, state, error):
190
"""Derived from the Avahi example code"""
191
logger.debug(u"Avahi state change: %i", state)
192
193
if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
logger.debug(u"Zeroconf service established.")
195
elif state == avahi.ENTRY_GROUP_COLLISION:
196
logger.warning(u"Zeroconf service name collision.")
197
self.rename()
198
elif state == avahi.ENTRY_GROUP_FAILURE:
199
logger.critical(u"Avahi: Error in group state changed %s",
200
unicode(error))
201
raise AvahiGroupError(u"State changed: %s"
202
% unicode(error))
203
def cleanup(self):
204
"""Derived from the Avahi example code"""
205
if self.group is not None:
206
self.group.Free()
207
self.group = None
208
def server_state_changed(self, state):
209
"""Derived from the Avahi example code"""
210
if state == avahi.SERVER_COLLISION:
211
logger.error(u"Zeroconf server name collision")
212
self.remove()
213
elif state == avahi.SERVER_RUNNING:
214
self.add()
215
def activate(self):
216
"""Derived from the Avahi example code"""
217
if self.server is None:
218
self.server = dbus.Interface(
219
self.bus.get_object(avahi.DBUS_NAME,
220
avahi.DBUS_PATH_SERVER),
221
avahi.DBUS_INTERFACE_SERVER)
222
self.server.connect_to_signal(u"StateChanged",
223
self.server_state_changed)
224
self.server_state_changed(self.server.GetState())
225
226
227
class Client(object):
157
service.name, service.type)
158
group.AddService(
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
166
group.Commit()
167
168
# From the Avahi example code:
169
group = None # our entry group
170
# End of Avahi example code
171
172
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
228
179
"""A representation of a client host served by this server.
229
230
180
Attributes:
231
181
name: string; from the config file, used in log messages and
232
182
D-Bus identifiers
252
202
client lives. %() expansions are done at
253
203
runtime with vars(self) as dict, so that for
254
204
instance %(name)s can be used in the command.
255
current_checker_command: string; current running checker_command
205
use_dbus: bool(); Whether to provide D-Bus interface and signals
206
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
256
207
"""
257
258
@staticmethod
259
def _datetime_to_milliseconds(dt):
260
"Convert a datetime.datetime() to milliseconds"
261
return ((dt.days * 24 * 60 * 60 * 1000)
262
+ (dt.seconds * 1000)
263
+ (dt.microseconds // 1000))
264
265
208
def timeout_milliseconds(self):
266
209
"Return the 'timeout' attribute in milliseconds"
267
return self._datetime_to_milliseconds(self.timeout)
210
return ((self.timeout.days * 24 * 60 * 60 * 1000)
211
+ (self.timeout.seconds * 1000)
212
+ (self.timeout.microseconds // 1000))
268
213
269
214
def interval_milliseconds(self):
270
215
"Return the 'interval' attribute in milliseconds"
271
return self._datetime_to_milliseconds(self.interval)
216
return ((self.interval.days * 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds * 1000)
218
+ (self.interval.microseconds // 1000))
272
219
273
def __init__(self, name = None, disable_hook=None, config=None):
220
def __init__(self, name = None, disable_hook=None, config=None,
221
use_dbus=True):
274
222
"""Note: the 'checker' key in 'config' sets the
275
223
'checker_command' attribute and *not* the 'checker'
276
224
attribute."""
278
226
if config is None:
279
227
config = {}
280
228
logger.debug(u"Creating client %r", self.name)
229
self.use_dbus = False # During __init__
281
230
# Uppercase and remove spaces from fingerprint for later
282
231
# comparison purposes with return value from the fingerprint()
283
232
# function
284
self.fingerprint = (config[u"fingerprint"].upper()
233
self.fingerprint = (config["fingerprint"].upper()
285
234
.replace(u" ", u""))
286
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
287
if u"secret" in config:
288
self.secret = config[u"secret"].decode(u"base64")
289
elif u"secfile" in config:
236
if "secret" in config:
237
self.secret = config["secret"].decode(u"base64")
238
elif "secfile" in config:
290
239
with closing(open(os.path.expanduser
291
240
(os.path.expandvars
292
(config[u"secfile"])))) as secfile:
241
(config["secfile"])))) as secfile:
293
242
self.secret = secfile.read()
294
243
else:
295
244
raise TypeError(u"No secret or secfile for client %s"
296
245
% self.name)
297
self.host = config.get(u"host", u"")
246
self.host = config.get("host", "")
298
247
self.created = datetime.datetime.utcnow()
299
248
self.enabled = False
300
249
self.last_enabled = None
301
250
self.last_checked_ok = None
302
self.timeout = string_to_delta(config[u"timeout"])
303
self.interval = string_to_delta(config[u"interval"])
251
self.timeout = string_to_delta(config["timeout"])
252
self.interval = string_to_delta(config["interval"])
304
253
self.disable_hook = disable_hook
305
254
self.checker = None
306
255
self.checker_initiator_tag = None
307
256
self.disable_initiator_tag = None
308
257
self.checker_callback_tag = None
309
self.checker_command = config[u"checker"]
310
self.current_checker_command = None
258
self.checker_command = config["checker"]
311
259
self.last_connect = None
260
# Only now, when this client is initialized, can it show up on
261
# the D-Bus
262
self.use_dbus = use_dbus
263
if self.use_dbus:
264
self.dbus_object_path = (dbus.ObjectPath
265
("/clients/"
266
+ self.name.replace(".", "_")))
267
dbus.service.Object.__init__(self, bus,
268
self.dbus_object_path)
312
269
313
270
def enable(self):
314
271
"""Start this client's checker and timeout hooks"""
315
if getattr(self, u"enabled", False):
316
# Already enabled
317
return
318
272
self.last_enabled = datetime.datetime.utcnow()
319
273
# Schedule a new checker to be started an 'interval' from now,
320
274
# and every interval from then on.
328
282
(self.timeout_milliseconds(),
329
283
self.disable))
330
284
self.enabled = True
285
if self.use_dbus:
286
# Emit D-Bus signals
287
self.PropertyChanged(dbus.String(u"enabled"),
288
dbus.Boolean(True, variant_level=1))
289
self.PropertyChanged(dbus.String(u"last_enabled"),
290
(_datetime_to_dbus(self.last_enabled,
291
variant_level=1)))
331
292
332
293
def disable(self):
333
294
"""Disable this client."""
334
295
if not getattr(self, "enabled", False):
335
296
return False
336
297
logger.info(u"Disabling client %s", self.name)
337
if getattr(self, u"disable_initiator_tag", False):
298
if getattr(self, "disable_initiator_tag", False):
338
299
gobject.source_remove(self.disable_initiator_tag)
339
300
self.disable_initiator_tag = None
340
if getattr(self, u"checker_initiator_tag", False):
301
if getattr(self, "checker_initiator_tag", False):
341
302
gobject.source_remove(self.checker_initiator_tag)
342
303
self.checker_initiator_tag = None
343
304
self.stop_checker()
344
305
if self.disable_hook:
345
306
self.disable_hook(self)
346
307
self.enabled = False
308
if self.use_dbus:
309
# Emit D-Bus signal
310
self.PropertyChanged(dbus.String(u"enabled"),
311
dbus.Boolean(False, variant_level=1))
347
312
# Do not run this again if called by a gobject.timeout_add
348
313
return False
349
314
355
320
"""The checker has completed, so take appropriate actions."""
356
321
self.checker_callback_tag = None
357
322
self.checker = None
323
if self.use_dbus:
324
# Emit D-Bus signal
325
self.PropertyChanged(dbus.String(u"checker_running"),
326
dbus.Boolean(False, variant_level=1))
358
327
if os.WIFEXITED(condition):
359
328
exitstatus = os.WEXITSTATUS(condition)
360
329
if exitstatus == 0:
364
333
else:
365
334
logger.info(u"Checker for %(name)s failed",
366
335
vars(self))
336
if self.use_dbus:
337
# Emit D-Bus signal
338
self.CheckerCompleted(dbus.Int16(exitstatus),
339
dbus.Int64(condition),
340
dbus.String(command))
367
341
else:
368
342
logger.warning(u"Checker for %(name)s crashed?",
369
343
vars(self))
344
if self.use_dbus:
345
# Emit D-Bus signal
346
self.CheckerCompleted(dbus.Int16(-1),
347
dbus.Int64(condition),
348
dbus.String(command))
370
349
371
350
def checked_ok(self):
372
351
"""Bump up the timeout for this client.
373
374
352
This should only be called when the client has been seen,
375
353
alive and well.
376
354
"""
379
357
self.disable_initiator_tag = (gobject.timeout_add
380
358
(self.timeout_milliseconds(),
381
359
self.disable))
360
if self.use_dbus:
361
# Emit D-Bus signal
362
self.PropertyChanged(
363
dbus.String(u"last_checked_ok"),
364
(_datetime_to_dbus(self.last_checked_ok,
365
variant_level=1)))
382
366
383
367
def start_checker(self):
384
368
"""Start a new checker subprocess if one is not running.
385
386
369
If a checker already exists, leave it running and do
387
370
nothing."""
388
371
# The reason for not killing a running checker is that if we
393
376
# checkers alone, the checker would have to take more time
394
377
# than 'timeout' for the client to be declared invalid, which
395
378
# is as it should be.
396
397
# If a checker exists, make sure it is not a zombie
398
if self.checker is not None:
399
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
400
if pid:
401
logger.warning(u"Checker was a zombie")
402
gobject.source_remove(self.checker_callback_tag)
403
self.checker_callback(pid, status,
404
self.current_checker_command)
405
# Start a new checker if needed
406
379
if self.checker is None:
407
380
try:
408
381
# In case checker_command has exactly one % operator
409
382
command = self.checker_command % self.host
410
383
except TypeError:
411
384
# Escape attributes for the shell
412
escaped_attrs = dict((key,
413
re.escape(unicode(str(val),
414
errors=
415
u'replace')))
385
escaped_attrs = dict((key, re.escape(str(val)))
416
386
for key, val in
417
387
vars(self).iteritems())
418
388
try:
421
391
logger.error(u'Could not format string "%s":'
422
392
u' %s', self.checker_command, error)
423
393
return True # Try again later
424
self.current_checker_command = command
425
394
try:
426
395
logger.info(u"Starting checker %r for %s",
427
396
command, self.name)
431
400
# always replaced by /dev/null.)
432
401
self.checker = subprocess.Popen(command,
433
402
close_fds=True,
434
shell=True, cwd=u"/")
403
shell=True, cwd="/")
404
if self.use_dbus:
405
# Emit D-Bus signal
406
self.CheckerStarted(command)
407
self.PropertyChanged(
408
dbus.String("checker_running"),
409
dbus.Boolean(True, variant_level=1))
435
410
self.checker_callback_tag = (gobject.child_watch_add
436
411
(self.checker.pid,
437
412
self.checker_callback,
438
413
data=command))
439
# The checker may have completed before the gobject
440
# watch was added. Check for this.
441
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
442
if pid:
443
gobject.source_remove(self.checker_callback_tag)
444
self.checker_callback(pid, status, command)
445
414
except OSError, error:
446
415
logger.error(u"Failed to start subprocess: %s",
447
416
error)
453
422
if self.checker_callback_tag:
454
423
gobject.source_remove(self.checker_callback_tag)
455
424
self.checker_callback_tag = None
456
if getattr(self, u"checker", None) is None:
425
if getattr(self, "checker", None) is None:
457
426
return
458
427
logger.debug(u"Stopping checker for %(name)s", vars(self))
459
428
try:
465
434
if error.errno != errno.ESRCH: # No such process
466
435
raise
467
436
self.checker = None
437
if self.use_dbus:
438
self.PropertyChanged(dbus.String(u"checker_running"),
439
dbus.Boolean(False, variant_level=1))
468
440
469
441
def still_valid(self):
470
442
"""Has the timeout not yet passed for this client?"""
471
if not getattr(self, u"enabled", False):
443
if not getattr(self, "enabled", False):
472
444
return False
473
445
now = datetime.datetime.utcnow()
474
446
if self.last_checked_ok is None:
475
447
return now < (self.created + self.timeout)
476
448
else:
477
449
return now < (self.last_checked_ok + self.timeout)
478
479
480
class ClientDBus(Client, dbus.service.Object):
481
"""A Client class using D-Bus
482
483
Attributes:
484
dbus_object_path: dbus.ObjectPath
485
bus: dbus.SystemBus()
486
"""
487
# dbus.service.Object doesn't use super(), so we can't either.
488
489
def __init__(self, bus = None, *args, **kwargs):
490
self.bus = bus
491
Client.__init__(self, *args, **kwargs)
492
# Only now, when this client is initialized, can it show up on
493
# the D-Bus
494
self.dbus_object_path = (dbus.ObjectPath
495
(u"/clients/"
496
+ self.name.replace(u".", u"_")))
497
dbus.service.Object.__init__(self, self.bus,
498
self.dbus_object_path)
499
500
@staticmethod
501
def _datetime_to_dbus(dt, variant_level=0):
502
"""Convert a UTC datetime.datetime() to a D-Bus type."""
503
return dbus.String(dt.isoformat(),
504
variant_level=variant_level)
505
506
def enable(self):
507
oldstate = getattr(self, u"enabled", False)
508
r = Client.enable(self)
509
if oldstate != self.enabled:
510
# Emit D-Bus signals
511
self.PropertyChanged(dbus.String(u"enabled"),
512
dbus.Boolean(True, variant_level=1))
513
self.PropertyChanged(
514
dbus.String(u"last_enabled"),
515
self._datetime_to_dbus(self.last_enabled,
516
variant_level=1))
517
return r
518
519
def disable(self, signal = True):
520
oldstate = getattr(self, u"enabled", False)
521
r = Client.disable(self)
522
if signal and oldstate != self.enabled:
523
# Emit D-Bus signal
524
self.PropertyChanged(dbus.String(u"enabled"),
525
dbus.Boolean(False, variant_level=1))
526
return r
527
528
def __del__(self, *args, **kwargs):
529
try:
530
self.remove_from_connection()
531
except LookupError:
532
pass
533
if hasattr(dbus.service.Object, u"__del__"):
534
dbus.service.Object.__del__(self, *args, **kwargs)
535
Client.__del__(self, *args, **kwargs)
536
537
def checker_callback(self, pid, condition, command,
538
*args, **kwargs):
539
self.checker_callback_tag = None
540
self.checker = None
541
# Emit D-Bus signal
542
self.PropertyChanged(dbus.String(u"checker_running"),
543
dbus.Boolean(False, variant_level=1))
544
if os.WIFEXITED(condition):
545
exitstatus = os.WEXITSTATUS(condition)
546
# Emit D-Bus signal
547
self.CheckerCompleted(dbus.Int16(exitstatus),
548
dbus.Int64(condition),
549
dbus.String(command))
550
else:
551
# Emit D-Bus signal
552
self.CheckerCompleted(dbus.Int16(-1),
553
dbus.Int64(condition),
554
dbus.String(command))
555
556
return Client.checker_callback(self, pid, condition, command,
557
*args, **kwargs)
558
559
def checked_ok(self, *args, **kwargs):
560
r = Client.checked_ok(self, *args, **kwargs)
561
# Emit D-Bus signal
562
self.PropertyChanged(
563
dbus.String(u"last_checked_ok"),
564
(self._datetime_to_dbus(self.last_checked_ok,
565
variant_level=1)))
566
return r
567
568
def start_checker(self, *args, **kwargs):
569
old_checker = self.checker
570
if self.checker is not None:
571
old_checker_pid = self.checker.pid
572
else:
573
old_checker_pid = None
574
r = Client.start_checker(self, *args, **kwargs)
575
# Only if new checker process was started
576
if (self.checker is not None
577
and old_checker_pid != self.checker.pid):
578
# Emit D-Bus signal
579
self.CheckerStarted(self.current_checker_command)
580
self.PropertyChanged(
581
dbus.String(u"checker_running"),
582
dbus.Boolean(True, variant_level=1))
583
return r
584
585
def stop_checker(self, *args, **kwargs):
586
old_checker = getattr(self, u"checker", None)
587
r = Client.stop_checker(self, *args, **kwargs)
588
if (old_checker is not None
589
and getattr(self, u"checker", None) is None):
590
self.PropertyChanged(dbus.String(u"checker_running"),
591
dbus.Boolean(False, variant_level=1))
592
return r
593
450
594
451
## D-Bus methods & signals
595
452
_interface = u"se.bsnet.fukt.Mandos.Client"
596
453
597
454
# CheckedOK - method
598
@dbus.service.method(_interface)
599
def CheckedOK(self):
600
return self.checked_ok()
455
CheckedOK = dbus.service.method(_interface)(checked_ok)
456
CheckedOK.__name__ = "CheckedOK"
601
457
602
458
# CheckerCompleted - signal
603
@dbus.service.signal(_interface, signature=u"nxs")
459
@dbus.service.signal(_interface, signature="nxs")
604
460
def CheckerCompleted(self, exitcode, waitstatus, command):
605
461
"D-Bus signal"
606
462
pass
607
463
608
464
# CheckerStarted - signal
609
@dbus.service.signal(_interface, signature=u"s")
465
@dbus.service.signal(_interface, signature="s")
610
466
def CheckerStarted(self, command):
611
467
"D-Bus signal"
612
468
pass
613
469
614
470
# GetAllProperties - method
615
@dbus.service.method(_interface, out_signature=u"a{sv}")
471
@dbus.service.method(_interface, out_signature="a{sv}")
616
472
def GetAllProperties(self):
617
473
"D-Bus method"
618
474
return dbus.Dictionary({
619
dbus.String(u"name"):
475
dbus.String("name"):
620
476
dbus.String(self.name, variant_level=1),
621
dbus.String(u"fingerprint"):
477
dbus.String("fingerprint"):
622
478
dbus.String(self.fingerprint, variant_level=1),
623
dbus.String(u"host"):
479
dbus.String("host"):
624
480
dbus.String(self.host, variant_level=1),
625
dbus.String(u"created"):
626
self._datetime_to_dbus(self.created,
627
variant_level=1),
628
dbus.String(u"last_enabled"):
629
(self._datetime_to_dbus(self.last_enabled,
630
variant_level=1)
481
dbus.String("created"):
482
_datetime_to_dbus(self.created, variant_level=1),
483
dbus.String("last_enabled"):
484
(_datetime_to_dbus(self.last_enabled,
485
variant_level=1)
631
486
if self.last_enabled is not None
632
487
else dbus.Boolean(False, variant_level=1)),
633
dbus.String(u"enabled"):
488
dbus.String("enabled"):
634
489
dbus.Boolean(self.enabled, variant_level=1),
635
dbus.String(u"last_checked_ok"):
636
(self._datetime_to_dbus(self.last_checked_ok,
637
variant_level=1)
490
dbus.String("last_checked_ok"):
491
(_datetime_to_dbus(self.last_checked_ok,
492
variant_level=1)
638
493
if self.last_checked_ok is not None
639
494
else dbus.Boolean (False, variant_level=1)),
640
dbus.String(u"timeout"):
495
dbus.String("timeout"):
641
496
dbus.UInt64(self.timeout_milliseconds(),
642
497
variant_level=1),
643
dbus.String(u"interval"):
498
dbus.String("interval"):
644
499
dbus.UInt64(self.interval_milliseconds(),
645
500
variant_level=1),
646
dbus.String(u"checker"):
501
dbus.String("checker"):
647
502
dbus.String(self.checker_command,
648
503
variant_level=1),
649
dbus.String(u"checker_running"):
504
dbus.String("checker_running"):
650
505
dbus.Boolean(self.checker is not None,
651
506
variant_level=1),
652
dbus.String(u"object_path"):
507
dbus.String("object_path"):
653
508
dbus.ObjectPath(self.dbus_object_path,
654
509
variant_level=1)
655
}, signature=u"sv")
510
}, signature="sv")
656
511
657
512
# IsStillValid - method
658
@dbus.service.method(_interface, out_signature=u"b")
659
def IsStillValid(self):
660
return self.still_valid()
513
IsStillValid = (dbus.service.method(_interface, out_signature="b")
514
(still_valid))
515
IsStillValid.__name__ = "IsStillValid"
661
516
662
517
# PropertyChanged - signal
663
@dbus.service.signal(_interface, signature=u"sv")
518
@dbus.service.signal(_interface, signature="sv")
664
519
def PropertyChanged(self, property, value):
665
520
"D-Bus signal"
666
521
pass
667
522
668
# ReceivedSecret - signal
669
@dbus.service.signal(_interface)
670
def ReceivedSecret(self):
671
"D-Bus signal"
672
pass
673
674
# Rejected - signal
675
@dbus.service.signal(_interface)
676
def Rejected(self):
677
"D-Bus signal"
678
pass
679
680
523
# SetChecker - method
681
@dbus.service.method(_interface, in_signature=u"s")
524
@dbus.service.method(_interface, in_signature="s")
682
525
def SetChecker(self, checker):
683
526
"D-Bus setter method"
684
527
self.checker_command = checker
688
531
variant_level=1))
689
532
690
533
# SetHost - method
691
@dbus.service.method(_interface, in_signature=u"s")
534
@dbus.service.method(_interface, in_signature="s")
692
535
def SetHost(self, host):
693
536
"D-Bus setter method"
694
537
self.host = host
697
540
dbus.String(self.host, variant_level=1))
698
541
699
542
# SetInterval - method
700
@dbus.service.method(_interface, in_signature=u"t")
543
@dbus.service.method(_interface, in_signature="t")
701
544
def SetInterval(self, milliseconds):
702
545
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
703
546
# Emit D-Bus signal
706
549
variant_level=1)))
707
550
708
551
# SetSecret - method
709
@dbus.service.method(_interface, in_signature=u"ay",
552
@dbus.service.method(_interface, in_signature="ay",
710
553
byte_arrays=True)
711
554
def SetSecret(self, secret):
712
555
"D-Bus setter method"
713
556
self.secret = str(secret)
714
557
715
558
# SetTimeout - method
716
@dbus.service.method(_interface, in_signature=u"t")
559
@dbus.service.method(_interface, in_signature="t")
717
560
def SetTimeout(self, milliseconds):
718
561
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
719
562
# Emit D-Bus signal
722
565
variant_level=1)))
723
566
724
567
# Enable - method
725
@dbus.service.method(_interface)
726
def Enable(self):
727
"D-Bus method"
728
self.enable()
568
Enable = dbus.service.method(_interface)(enable)
569
Enable.__name__ = "Enable"
729
570
730
571
# StartChecker - method
731
572
@dbus.service.method(_interface)
740
581
self.disable()
741
582
742
583
# StopChecker - method
743
@dbus.service.method(_interface)
744
def StopChecker(self):
745
self.stop_checker()
584
StopChecker = dbus.service.method(_interface)(stop_checker)
585
StopChecker.__name__ = "StopChecker"
746
586
747
587
del _interface
748
588
749
589
750
class ClientHandler(socketserver.BaseRequestHandler, object):
751
"""A class to handle client connections.
752
753
Instantiated once for each connection to handle it.
590
def peer_certificate(session):
591
"Return the peer's OpenPGP certificate as a bytestring"
592
# If not an OpenPGP certificate...
593
if (gnutls.library.functions
594
.gnutls_certificate_type_get(session._c_object)
595
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
596
# ...do the normal thing
597
return session.peer_certificate
598
list_size = ctypes.c_uint(1)
599
cert_list = (gnutls.library.functions
600
.gnutls_certificate_get_peers
601
(session._c_object, ctypes.byref(list_size)))
602
if not bool(cert_list) and list_size.value != 0:
603
raise gnutls.errors.GNUTLSError("error getting peer"
604
" certificate")
605
if list_size.value == 0:
606
return None
607
cert = cert_list[0]
608
return ctypes.string_at(cert.data, cert.size)
609
610
611
def fingerprint(openpgp):
612
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
613
# New GnuTLS "datum" with the OpenPGP public key
614
datum = (gnutls.library.types
615
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
616
ctypes.POINTER
617
(ctypes.c_ubyte)),
618
ctypes.c_uint(len(openpgp))))
619
# New empty GnuTLS certificate
620
crt = gnutls.library.types.gnutls_openpgp_crt_t()
621
(gnutls.library.functions
622
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
623
# Import the OpenPGP public key into the certificate
624
(gnutls.library.functions
625
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
626
gnutls.library.constants
627
.GNUTLS_OPENPGP_FMT_RAW))
628
# Verify the self signature in the key
629
crtverify = ctypes.c_uint()
630
(gnutls.library.functions
631
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
632
if crtverify.value != 0:
633
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
634
raise gnutls.errors.CertificateSecurityError("Verify failed")
635
# New buffer for the fingerprint
636
buf = ctypes.create_string_buffer(20)
637
buf_len = ctypes.c_size_t()
638
# Get the fingerprint from the certificate into the buffer
639
(gnutls.library.functions
640
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
641
ctypes.byref(buf_len)))
642
# Deinit the certificate
643
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
644
# Convert the buffer to a Python bytestring
645
fpr = ctypes.string_at(buf, buf_len.value)
646
# Convert the bytestring to hexadecimal notation
647
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
648
return hex_fpr
649
650
651
class TCP_handler(SocketServer.BaseRequestHandler, object):
652
"""A TCP request handler class.
653
Instantiated by IPv6_TCPServer for each request to handle it.
754
654
Note: This will run in its own forked process."""
755
655
756
656
def handle(self):
757
657
logger.info(u"TCP connection from: %s",
758
658
unicode(self.client_address))
759
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
# Open IPC pipe to parent process
761
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
762
session = (gnutls.connection
763
.ClientSession(self.request,
764
gnutls.connection
765
.X509Credentials()))
766
767
line = self.request.makefile().readline()
768
logger.debug(u"Protocol version: %r", line)
769
try:
770
if int(line.strip().split()[0]) > 1:
771
raise RuntimeError
772
except (ValueError, IndexError, RuntimeError), error:
773
logger.error(u"Unknown protocol version: %s", error)
774
return
775
776
# Note: gnutls.connection.X509Credentials is really a
777
# generic GnuTLS certificate credentials object so long as
778
# no X.509 keys are added to it. Therefore, we can use it
779
# here despite using OpenPGP certificates.
780
781
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
# u"+AES-256-CBC", u"+SHA1",
783
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
784
# u"+DHE-DSS"))
785
# Use a fallback default, since this MUST be set.
786
priority = self.server.gnutls_priority
787
if priority is None:
788
priority = u"NORMAL"
789
(gnutls.library.functions
790
.gnutls_priority_set_direct(session._c_object,
791
priority, None))
792
793
try:
794
session.handshake()
795
except gnutls.errors.GNUTLSError, error:
796
logger.warning(u"Handshake failed: %s", error)
797
# Do not run session.bye() here: the session is not
798
# established. Just abandon the request.
799
return
800
logger.debug(u"Handshake succeeded")
801
try:
802
fpr = self.fingerprint(self.peer_certificate(session))
803
except (TypeError, gnutls.errors.GNUTLSError), error:
804
logger.warning(u"Bad certificate: %s", error)
805
session.bye()
806
return
807
logger.debug(u"Fingerprint: %s", fpr)
808
809
for c in self.server.clients:
810
if c.fingerprint == fpr:
811
client = c
812
break
813
else:
814
ipc.write(u"NOTFOUND %s %s\n"
815
% (fpr, unicode(self.client_address)))
816
session.bye()
817
return
818
# Have to check if client.still_valid(), since it is
819
# possible that the client timed out while establishing
820
# the GnuTLS session.
821
if not client.still_valid():
822
ipc.write(u"INVALID %s\n" % client.name)
823
session.bye()
824
return
825
ipc.write(u"SENDING %s\n" % client.name)
826
sent_size = 0
827
while sent_size < len(client.secret):
828
sent = session.send(client.secret[sent_size:])
829
logger.debug(u"Sent: %d, remaining: %d",
830
sent, len(client.secret)
831
- (sent_size + sent))
832
sent_size += sent
833
session.bye()
834
835
@staticmethod
836
def peer_certificate(session):
837
"Return the peer's OpenPGP certificate as a bytestring"
838
# If not an OpenPGP certificate...
839
if (gnutls.library.functions
840
.gnutls_certificate_type_get(session._c_object)
841
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
842
# ...do the normal thing
843
return session.peer_certificate
844
list_size = ctypes.c_uint(1)
845
cert_list = (gnutls.library.functions
846
.gnutls_certificate_get_peers
847
(session._c_object, ctypes.byref(list_size)))
848
if not bool(cert_list) and list_size.value != 0:
849
raise gnutls.errors.GNUTLSError(u"error getting peer"
850
u" certificate")
851
if list_size.value == 0:
852
return None
853
cert = cert_list[0]
854
return ctypes.string_at(cert.data, cert.size)
855
856
@staticmethod
857
def fingerprint(openpgp):
858
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
859
# New GnuTLS "datum" with the OpenPGP public key
860
datum = (gnutls.library.types
861
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
862
ctypes.POINTER
863
(ctypes.c_ubyte)),
864
ctypes.c_uint(len(openpgp))))
865
# New empty GnuTLS certificate
866
crt = gnutls.library.types.gnutls_openpgp_crt_t()
867
(gnutls.library.functions
868
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
869
# Import the OpenPGP public key into the certificate
870
(gnutls.library.functions
871
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
872
gnutls.library.constants
873
.GNUTLS_OPENPGP_FMT_RAW))
874
# Verify the self signature in the key
875
crtverify = ctypes.c_uint()
876
(gnutls.library.functions
877
.gnutls_openpgp_crt_verify_self(crt, 0,
878
ctypes.byref(crtverify)))
879
if crtverify.value != 0:
880
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
881
raise (gnutls.errors.CertificateSecurityError
882
(u"Verify failed"))
883
# New buffer for the fingerprint
884
buf = ctypes.create_string_buffer(20)
885
buf_len = ctypes.c_size_t()
886
# Get the fingerprint from the certificate into the buffer
887
(gnutls.library.functions
888
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
889
ctypes.byref(buf_len)))
890
# Deinit the certificate
891
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
892
# Convert the buffer to a Python bytestring
893
fpr = ctypes.string_at(buf, buf_len.value)
894
# Convert the bytestring to hexadecimal notation
895
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
896
return hex_fpr
897
898
899
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
900
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
901
def process_request(self, request, client_address):
902
"""Overrides and wraps the original process_request().
903
904
This function creates a new pipe in self.pipe
905
"""
906
self.pipe = os.pipe()
907
super(ForkingMixInWithPipe,
908
self).process_request(request, client_address)
909
os.close(self.pipe[1]) # close write end
910
self.add_pipe(self.pipe[0])
911
def add_pipe(self, pipe):
912
"""Dummy function; override as necessary"""
913
os.close(pipe)
914
915
916
class IPv6_TCPServer(ForkingMixInWithPipe,
917
socketserver.TCPServer, object):
918
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
919
659
session = (gnutls.connection
660
.ClientSession(self.request,
661
gnutls.connection
662
.X509Credentials()))
663
664
line = self.request.makefile().readline()
665
logger.debug(u"Protocol version: %r", line)
666
try:
667
if int(line.strip().split()[0]) > 1:
668
raise RuntimeError
669
except (ValueError, IndexError, RuntimeError), error:
670
logger.error(u"Unknown protocol version: %s", error)
671
return
672
673
# Note: gnutls.connection.X509Credentials is really a generic
674
# GnuTLS certificate credentials object so long as no X.509
675
# keys are added to it. Therefore, we can use it here despite
676
# using OpenPGP certificates.
677
678
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
679
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
680
# "+DHE-DSS"))
681
# Use a fallback default, since this MUST be set.
682
priority = self.server.settings.get("priority", "NORMAL")
683
(gnutls.library.functions
684
.gnutls_priority_set_direct(session._c_object,
685
priority, None))
686
687
try:
688
session.handshake()
689
except gnutls.errors.GNUTLSError, error:
690
logger.warning(u"Handshake failed: %s", error)
691
# Do not run session.bye() here: the session is not
692
# established. Just abandon the request.
693
return
694
logger.debug(u"Handshake succeeded")
695
try:
696
fpr = fingerprint(peer_certificate(session))
697
except (TypeError, gnutls.errors.GNUTLSError), error:
698
logger.warning(u"Bad certificate: %s", error)
699
session.bye()
700
return
701
logger.debug(u"Fingerprint: %s", fpr)
702
703
for c in self.server.clients:
704
if c.fingerprint == fpr:
705
client = c
706
break
707
else:
708
logger.warning(u"Client not found for fingerprint: %s",
709
fpr)
710
session.bye()
711
return
712
# Have to check if client.still_valid(), since it is possible
713
# that the client timed out while establishing the GnuTLS
714
# session.
715
if not client.still_valid():
716
logger.warning(u"Client %(name)s is invalid",
717
vars(client))
718
session.bye()
719
return
720
## This won't work here, since we're in a fork.
721
# client.checked_ok()
722
sent_size = 0
723
while sent_size < len(client.secret):
724
sent = session.send(client.secret[sent_size:])
725
logger.debug(u"Sent: %d, remaining: %d",
726
sent, len(client.secret)
727
- (sent_size + sent))
728
sent_size += sent
729
session.bye()
730
731
732
class IPv6_TCPServer(SocketServer.ForkingMixIn,
733
SocketServer.TCPServer, object):
734
"""IPv6 TCP server. Accepts 'None' as address and/or port.
920
735
Attributes:
736
settings: Server settings
737
clients: Set() of Client objects
921
738
enabled: Boolean; whether this server is activated yet
922
interface: None or a network interface name (string)
923
use_ipv6: Boolean; to use IPv6 or not
924
739
"""
925
def __init__(self, server_address, RequestHandlerClass,
926
interface=None, use_ipv6=True):
927
self.interface = interface
928
if use_ipv6:
929
self.address_family = socket.AF_INET6
930
socketserver.TCPServer.__init__(self, server_address,
931
RequestHandlerClass)
740
address_family = socket.AF_INET6
741
def __init__(self, *args, **kwargs):
742
if "settings" in kwargs:
743
self.settings = kwargs["settings"]
744
del kwargs["settings"]
745
if "clients" in kwargs:
746
self.clients = kwargs["clients"]
747
del kwargs["clients"]
748
self.enabled = False
749
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
932
750
def server_bind(self):
933
751
"""This overrides the normal server_bind() function
934
752
to bind to an interface if one was specified, and also NOT to
935
753
bind to an address or port if they were not specified."""
936
if self.interface is not None:
937
if SO_BINDTODEVICE is None:
938
logger.error(u"SO_BINDTODEVICE does not exist;"
939
u" cannot bind to interface %s",
940
self.interface)
941
else:
942
try:
943
self.socket.setsockopt(socket.SOL_SOCKET,
944
SO_BINDTODEVICE,
945
str(self.interface
946
+ u'\0'))
947
except socket.error, error:
948
if error[0] == errno.EPERM:
949
logger.error(u"No permission to"
950
u" bind to interface %s",
951
self.interface)
952
elif error[0] == errno.ENOPROTOOPT:
953
logger.error(u"SO_BINDTODEVICE not available;"
954
u" cannot bind to interface %s",
955
self.interface)
956
else:
957
raise
754
if self.settings["interface"]:
755
# 25 is from /usr/include/asm-i486/socket.h
756
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
757
try:
758
self.socket.setsockopt(socket.SOL_SOCKET,
759
SO_BINDTODEVICE,
760
self.settings["interface"])
761
except socket.error, error:
762
if error[0] == errno.EPERM:
763
logger.error(u"No permission to"
764
u" bind to interface %s",
765
self.settings["interface"])
766
else:
767
raise error
958
768
# Only bind(2) the socket if we really need to.
959
769
if self.server_address[0] or self.server_address[1]:
960
770
if not self.server_address[0]:
961
if self.address_family == socket.AF_INET6:
962
any_address = u"::" # in6addr_any
963
else:
964
any_address = socket.INADDR_ANY
965
self.server_address = (any_address,
771
in6addr_any = "::"
772
self.server_address = (in6addr_any,
966
773
self.server_address[1])
967
774
elif not self.server_address[1]:
968
775
self.server_address = (self.server_address[0],
969
776
0)
970
# if self.interface:
777
# if self.settings["interface"]:
971
778
# self.server_address = (self.server_address[0],
972
779
# 0, # port
973
780
# 0, # flowinfo
974
781
# if_nametoindex
975
# (self.interface))
976
return socketserver.TCPServer.server_bind(self)
977
978
979
class MandosServer(IPv6_TCPServer):
980
"""Mandos server.
981
982
Attributes:
983
clients: set of Client objects
984
gnutls_priority GnuTLS priority string
985
use_dbus: Boolean; to emit D-Bus signals or not
986
987
Assumes a gobject.MainLoop event loop.
988
"""
989
def __init__(self, server_address, RequestHandlerClass,
990
interface=None, use_ipv6=True, clients=None,
991
gnutls_priority=None, use_dbus=True):
992
self.enabled = False
993
self.clients = clients
994
if self.clients is None:
995
self.clients = set()
996
self.use_dbus = use_dbus
997
self.gnutls_priority = gnutls_priority
998
IPv6_TCPServer.__init__(self, server_address,
999
RequestHandlerClass,
1000
interface = interface,
1001
use_ipv6 = use_ipv6)
782
# (self.settings
783
# ["interface"]))
784
return super(IPv6_TCPServer, self).server_bind()
1002
785
def server_activate(self):
1003
786
if self.enabled:
1004
return socketserver.TCPServer.server_activate(self)
787
return super(IPv6_TCPServer, self).server_activate()
1005
788
def enable(self):
1006
789
self.enabled = True
1007
def add_pipe(self, pipe):
1008
# Call "handle_ipc" for both data and EOF events
1009
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1010
self.handle_ipc)
1011
def handle_ipc(self, source, condition, file_objects={}):
1012
condition_names = {
1013
gobject.IO_IN: u"IN", # There is data to read.
1014
gobject.IO_OUT: u"OUT", # Data can be written (without
1015
# blocking).
1016
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1017
gobject.IO_ERR: u"ERR", # Error condition.
1018
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1019
# broken, usually for pipes and
1020
# sockets).
1021
}
1022
conditions_string = ' | '.join(name
1023
for cond, name in
1024
condition_names.iteritems()
1025
if cond & condition)
1026
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1027
conditions_string)
1028
1029
# Turn the pipe file descriptor into a Python file object
1030
if source not in file_objects:
1031
file_objects[source] = os.fdopen(source, u"r", 1)
1032
1033
# Read a line from the file object
1034
cmdline = file_objects[source].readline()
1035
if not cmdline: # Empty line means end of file
1036
# close the IPC pipe
1037
file_objects[source].close()
1038
del file_objects[source]
1039
1040
# Stop calling this function
1041
return False
1042
1043
logger.debug(u"IPC command: %r", cmdline)
1044
1045
# Parse and act on command
1046
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1047
1048
if cmd == u"NOTFOUND":
1049
logger.warning(u"Client not found for fingerprint: %s",
1050
args)
1051
if self.use_dbus:
1052
# Emit D-Bus signal
1053
mandos_dbus_service.ClientNotFound(args)
1054
elif cmd == u"INVALID":
1055
for client in self.clients:
1056
if client.name == args:
1057
logger.warning(u"Client %s is invalid", args)
1058
if self.use_dbus:
1059
# Emit D-Bus signal
1060
client.Rejected()
1061
break
1062
else:
1063
logger.error(u"Unknown client %s is invalid", args)
1064
elif cmd == u"SENDING":
1065
for client in self.clients:
1066
if client.name == args:
1067
logger.info(u"Sending secret to %s", client.name)
1068
client.checked_ok()
1069
if self.use_dbus:
1070
# Emit D-Bus signal
1071
client.ReceivedSecret()
1072
break
1073
else:
1074
logger.error(u"Sending secret to unknown client %s",
1075
args)
1076
else:
1077
logger.error(u"Unknown IPC command: %r", cmdline)
1078
1079
# Keep calling this function
1080
return True
1081
790
1082
791
1083
792
def string_to_delta(interval):
1084
793
"""Parse a string and return a datetime.timedelta
1085
794
1086
>>> string_to_delta(u'7d')
795
>>> string_to_delta('7d')
1087
796
datetime.timedelta(7)
1088
>>> string_to_delta(u'60s')
797
>>> string_to_delta('60s')
1089
798
datetime.timedelta(0, 60)
1090
>>> string_to_delta(u'60m')
799
>>> string_to_delta('60m')
1091
800
datetime.timedelta(0, 3600)
1092
>>> string_to_delta(u'24h')
801
>>> string_to_delta('24h')
1093
802
datetime.timedelta(1)
1094
803
>>> string_to_delta(u'1w')
1095
804
datetime.timedelta(7)
1096
>>> string_to_delta(u'5m 30s')
805
>>> string_to_delta('5m 30s')
1097
806
datetime.timedelta(0, 330)
1098
807
"""
1099
808
timevalue = datetime.timedelta(0)
1119
828
return timevalue
1120
829
1121
830
831
def server_state_changed(state):
832
"""Derived from the Avahi example code"""
833
if state == avahi.SERVER_COLLISION:
834
logger.error(u"Zeroconf server name collision")
835
service.remove()
836
elif state == avahi.SERVER_RUNNING:
837
service.add()
838
839
840
def entry_group_state_changed(state, error):
841
"""Derived from the Avahi example code"""
842
logger.debug(u"Avahi state change: %i", state)
843
844
if state == avahi.ENTRY_GROUP_ESTABLISHED:
845
logger.debug(u"Zeroconf service established.")
846
elif state == avahi.ENTRY_GROUP_COLLISION:
847
logger.warning(u"Zeroconf service name collision.")
848
service.rename()
849
elif state == avahi.ENTRY_GROUP_FAILURE:
850
logger.critical(u"Avahi: Error in group state changed %s",
851
unicode(error))
852
raise AvahiGroupError(u"State changed: %s" % unicode(error))
853
1122
854
def if_nametoindex(interface):
1123
"""Call the C function if_nametoindex(), or equivalent
1124
1125
Note: This function cannot accept a unicode string."""
855
"""Call the C function if_nametoindex(), or equivalent"""
1126
856
global if_nametoindex
1127
857
try:
1128
858
if_nametoindex = (ctypes.cdll.LoadLibrary
1129
(ctypes.util.find_library(u"c"))
859
(ctypes.util.find_library("c"))
1130
860
.if_nametoindex)
1131
861
except (OSError, AttributeError):
1132
logger.warning(u"Doing if_nametoindex the hard way")
862
if "struct" not in sys.modules:
863
import struct
864
if "fcntl" not in sys.modules:
865
import fcntl
1133
866
def if_nametoindex(interface):
1134
867
"Get an interface index the hard way, i.e. using fcntl()"
1135
868
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1136
869
with closing(socket.socket()) as s:
1137
870
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1138
struct.pack(str(u"16s16x"),
1139
interface))
1140
interface_index = struct.unpack(str(u"I"),
1141
ifreq[16:20])[0]
871
struct.pack("16s16x", interface))
872
interface_index = struct.unpack("I", ifreq[16:20])[0]
1142
873
return interface_index
1143
874
return if_nametoindex(interface)
1144
875
1145
876
1146
877
def daemon(nochdir = False, noclose = False):
1147
878
"""See daemon(3). Standard BSD Unix function.
1148
1149
879
This should really exist as os.daemon, but it doesn't (yet)."""
1150
880
if os.fork():
1151
881
sys.exit()
1152
882
os.setsid()
1153
883
if not nochdir:
1154
os.chdir(u"/")
884
os.chdir("/")
1155
885
if os.fork():
1156
886
sys.exit()
1157
887
if not noclose:
1159
889
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1160
890
if not stat.S_ISCHR(os.fstat(null).st_mode):
1161
891
raise OSError(errno.ENODEV,
1162
u"/dev/null not a character device")
892
"/dev/null not a character device")
1163
893
os.dup2(null, sys.stdin.fileno())
1164
894
os.dup2(null, sys.stdout.fileno())
1165
895
os.dup2(null, sys.stderr.fileno())
1168
898
1169
899
1170
900
def main():
1171
1172
######################################################################
1173
# Parsing of options, both command line and config file
1174
1175
901
parser = optparse.OptionParser(version = "%%prog %s" % version)
1176
parser.add_option("-i", u"--interface", type=u"string",
1177
metavar="IF", help=u"Bind to interface IF")
1178
parser.add_option("-a", u"--address", type=u"string",
1179
help=u"Address to listen for requests on")
1180
parser.add_option("-p", u"--port", type=u"int",
1181
help=u"Port number to receive requests on")
1182
parser.add_option("--check", action=u"store_true",
1183
help=u"Run self-test")
1184
parser.add_option("--debug", action=u"store_true",
1185
help=u"Debug mode; run in foreground and log to"
1186
u" terminal")
1187
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1188
u" priority string (see GnuTLS documentation)")
1189
parser.add_option("--servicename", type=u"string",
1190
metavar=u"NAME", help=u"Zeroconf service name")
1191
parser.add_option("--configdir", type=u"string",
1192
default=u"/etc/mandos", metavar=u"DIR",
1193
help=u"Directory to search for configuration"
1194
u" files")
1195
parser.add_option("--no-dbus", action=u"store_false",
1196
dest=u"use_dbus", help=u"Do not provide D-Bus"
1197
u" system bus interface")
1198
parser.add_option("--no-ipv6", action=u"store_false",
1199
dest=u"use_ipv6", help=u"Do not use IPv6")
902
parser.add_option("-i", "--interface", type="string",
903
metavar="IF", help="Bind to interface IF")
904
parser.add_option("-a", "--address", type="string",
905
help="Address to listen for requests on")
906
parser.add_option("-p", "--port", type="int",
907
help="Port number to receive requests on")
908
parser.add_option("--check", action="store_true",
909
help="Run self-test")
910
parser.add_option("--debug", action="store_true",
911
help="Debug mode; run in foreground and log to"
912
" terminal")
913
parser.add_option("--priority", type="string", help="GnuTLS"
914
" priority string (see GnuTLS documentation)")
915
parser.add_option("--servicename", type="string", metavar="NAME",
916
help="Zeroconf service name")
917
parser.add_option("--configdir", type="string",
918
default="/etc/mandos", metavar="DIR",
919
help="Directory to search for configuration"
920
" files")
921
parser.add_option("--no-dbus", action="store_false",
922
dest="use_dbus",
923
help="Do not provide D-Bus system bus"
924
" interface")
1200
925
options = parser.parse_args()[0]
1201
926
1202
927
if options.check:
1205
930
sys.exit()
1206
931
1207
932
# Default values for config file for server-global settings
1208
server_defaults = { u"interface": u"",
1209
u"address": u"",
1210
u"port": u"",
1211
u"debug": u"False",
1212
u"priority":
1213
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1214
u"servicename": u"Mandos",
1215
u"use_dbus": u"True",
1216
u"use_ipv6": u"True",
933
server_defaults = { "interface": "",
934
"address": "",
935
"port": "",
936
"debug": "False",
937
"priority":
938
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
939
"servicename": "Mandos",
940
"use_dbus": "True",
1217
941
}
1218
942
1219
943
# Parse config file for server-global settings
1220
server_config = configparser.SafeConfigParser(server_defaults)
944
server_config = ConfigParser.SafeConfigParser(server_defaults)
1221
945
del server_defaults
1222
server_config.read(os.path.join(options.configdir,
1223
u"mandos.conf"))
946
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1224
947
# Convert the SafeConfigParser object to a dict
1225
948
server_settings = server_config.defaults()
1226
949
# Use the appropriate methods on the non-string config options
1227
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1228
server_settings[option] = server_config.getboolean(u"DEFAULT",
1229
option)
950
server_settings["debug"] = server_config.getboolean("DEFAULT",
951
"debug")
952
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
953
"use_dbus")
1230
954
if server_settings["port"]:
1231
server_settings["port"] = server_config.getint(u"DEFAULT",
1232
u"port")
955
server_settings["port"] = server_config.getint("DEFAULT",
956
"port")
1233
957
del server_config
1234
958
1235
959
# Override the settings from the config file with command line
1236
960
# options, if set.
1237
for option in (u"interface", u"address", u"port", u"debug",
1238
u"priority", u"servicename", u"configdir",
1239
u"use_dbus", u"use_ipv6"):
961
for option in ("interface", "address", "port", "debug",
962
"priority", "servicename", "configdir",
963
"use_dbus"):
1240
964
value = getattr(options, option)
1241
965
if value is not None:
1242
966
server_settings[option] = value
1243
967
del options
1244
# Force all strings to be unicode
1245
for option in server_settings.keys():
1246
if type(server_settings[option]) is str:
1247
server_settings[option] = unicode(server_settings[option])
1248
968
# Now we have our good server settings in "server_settings"
1249
969
1250
##################################################################
1251
1252
970
# For convenience
1253
debug = server_settings[u"debug"]
1254
use_dbus = server_settings[u"use_dbus"]
1255
use_ipv6 = server_settings[u"use_ipv6"]
971
debug = server_settings["debug"]
972
use_dbus = server_settings["use_dbus"]
973
974
def sigsegvhandler(signum, frame):
975
raise RuntimeError('Segmentation fault')
1256
976
1257
977
if not debug:
1258
978
syslogger.setLevel(logging.WARNING)
1259
979
console.setLevel(logging.WARNING)
980
else:
981
signal.signal(signal.SIGSEGV, sigsegvhandler)
1260
982
1261
if server_settings[u"servicename"] != u"Mandos":
983
if server_settings["servicename"] != "Mandos":
1262
984
syslogger.setFormatter(logging.Formatter
1263
(u'Mandos (%s) [%%(process)d]:'
1264
u' %%(levelname)s: %%(message)s'
1265
% server_settings[u"servicename"]))
985
('Mandos (%s): %%(levelname)s:'
986
' %%(message)s'
987
% server_settings["servicename"]))
1266
988
1267
989
# Parse config file with clients
1268
client_defaults = { u"timeout": u"1h",
1269
u"interval": u"5m",
1270
u"checker": u"fping -q -- %%(host)s",
1271
u"host": u"",
990
client_defaults = { "timeout": "1h",
991
"interval": "5m",
992
"checker": "fping -q -- %%(host)s",
993
"host": "",
1272
994
}
1273
client_config = configparser.SafeConfigParser(client_defaults)
1274
client_config.read(os.path.join(server_settings[u"configdir"],
1275
u"clients.conf"))
1276
1277
global mandos_dbus_service
1278
mandos_dbus_service = None
1279
1280
tcp_server = MandosServer((server_settings[u"address"],
1281
server_settings[u"port"]),
1282
ClientHandler,
1283
interface=server_settings[u"interface"],
1284
use_ipv6=use_ipv6,
1285
gnutls_priority=
1286
server_settings[u"priority"],
1287
use_dbus=use_dbus)
1288
pidfilename = u"/var/run/mandos.pid"
1289
try:
1290
pidfile = open(pidfilename, u"w")
1291
except IOError:
1292
logger.error(u"Could not open file %r", pidfilename)
1293
1294
try:
1295
uid = pwd.getpwnam(u"_mandos").pw_uid
1296
gid = pwd.getpwnam(u"_mandos").pw_gid
995
client_config = ConfigParser.SafeConfigParser(client_defaults)
996
client_config.read(os.path.join(server_settings["configdir"],
997
"clients.conf"))
998
999
clients = Set()
1000
tcp_server = IPv6_TCPServer((server_settings["address"],
1001
server_settings["port"]),
1002
TCP_handler,
1003
settings=server_settings,
1004
clients=clients)
1005
pidfilename = "/var/run/mandos.pid"
1006
try:
1007
pidfile = open(pidfilename, "w")
1008
except IOError, error:
1009
logger.error("Could not open file %r", pidfilename)
1010
1011
try:
1012
uid = pwd.getpwnam("_mandos").pw_uid
1013
gid = pwd.getpwnam("_mandos").pw_gid
1297
1014
except KeyError:
1298
1015
try:
1299
uid = pwd.getpwnam(u"mandos").pw_uid
1300
gid = pwd.getpwnam(u"mandos").pw_gid
1016
uid = pwd.getpwnam("mandos").pw_uid
1017
gid = pwd.getpwnam("mandos").pw_gid
1301
1018
except KeyError:
1302
1019
try:
1303
uid = pwd.getpwnam(u"nobody").pw_uid
1304
gid = pwd.getpwnam(u"nobody").pw_gid
1020
uid = pwd.getpwnam("nobody").pw_uid
1021
gid = pwd.getpwnam("nogroup").pw_gid
1305
1022
except KeyError:
1306
1023
uid = 65534
1307
1024
gid = 65534
1320
1037
1321
1038
@gnutls.library.types.gnutls_log_func
1322
1039
def debug_gnutls(level, string):
1323
logger.debug(u"GnuTLS: %s", string[:-1])
1040
logger.debug("GnuTLS: %s", string[:-1])
1324
1041
1325
1042
(gnutls.library.functions
1326
1043
.gnutls_global_set_log_function(debug_gnutls))
1327
1044
1045
global service
1046
service = AvahiService(name = server_settings["servicename"],
1047
servicetype = "_mandos._tcp", )
1048
if server_settings["interface"]:
1049
service.interface = (if_nametoindex
1050
(server_settings["interface"]))
1051
1328
1052
global main_loop
1053
global bus
1054
global server
1329
1055
# From the Avahi example code
1330
1056
DBusGMainLoop(set_as_default=True )
1331
1057
main_loop = gobject.MainLoop()
1332
1058
bus = dbus.SystemBus()
1059
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1060
avahi.DBUS_PATH_SERVER),
1061
avahi.DBUS_INTERFACE_SERVER)
1333
1062
# End of Avahi example code
1334
1063
if use_dbus:
1335
1064
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1336
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1337
service = AvahiService(name = server_settings[u"servicename"],
1338
servicetype = u"_mandos._tcp",
1339
protocol = protocol, bus = bus)
1340
if server_settings["interface"]:
1341
service.interface = (if_nametoindex
1342
(str(server_settings[u"interface"])))
1343
1065
1344
client_class = Client
1345
if use_dbus:
1346
client_class = functools.partial(ClientDBus, bus = bus)
1347
tcp_server.clients.update(set(
1348
client_class(name = section,
1349
config= dict(client_config.items(section)))
1350
for section in client_config.sections()))
1351
if not tcp_server.clients:
1066
clients.update(Set(Client(name = section,
1067
config
1068
= dict(client_config.items(section)),
1069
use_dbus = use_dbus)
1070
for section in client_config.sections()))
1071
if not clients:
1352
1072
logger.warning(u"No clients defined")
1353
1073
1354
1074
if debug:
1364
1084
daemon()
1365
1085
1366
1086
try:
1367
with closing(pidfile):
1368
pid = os.getpid()
1369
pidfile.write(str(pid) + "\n")
1087
pid = os.getpid()
1088
pidfile.write(str(pid) + "\n")
1089
pidfile.close()
1370
1090
del pidfile
1371
1091
except IOError:
1372
1092
logger.error(u"Could not write to file %r with PID %d",
1378
1098
1379
1099
def cleanup():
1380
1100
"Cleanup function; run on exit"
1381
service.cleanup()
1101
global group
1102
# From the Avahi example code
1103
if not group is None:
1104
group.Free()
1105
group = None
1106
# End of Avahi example code
1382
1107
1383
while tcp_server.clients:
1384
client = tcp_server.clients.pop()
1108
while clients:
1109
client = clients.pop()
1385
1110
client.disable_hook = None
1386
1111
client.disable()
1387
1112
1393
1118
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1394
1119
1395
1120
if use_dbus:
1396
class MandosDBusService(dbus.service.Object):
1121
class MandosServer(dbus.service.Object):
1397
1122
"""A D-Bus proxy object"""
1398
1123
def __init__(self):
1399
dbus.service.Object.__init__(self, bus, u"/")
1124
dbus.service.Object.__init__(self, bus, "/")
1400
1125
_interface = u"se.bsnet.fukt.Mandos"
1401
1126
1402
@dbus.service.signal(_interface, signature=u"oa{sv}")
1127
@dbus.service.signal(_interface, signature="oa{sv}")
1403
1128
def ClientAdded(self, objpath, properties):
1404
1129
"D-Bus signal"
1405
1130
pass
1406
1131
1407
@dbus.service.signal(_interface, signature=u"s")
1408
def ClientNotFound(self, fingerprint):
1409
"D-Bus signal"
1410
pass
1411
1412
@dbus.service.signal(_interface, signature=u"os")
1132
@dbus.service.signal(_interface, signature="os")
1413
1133
def ClientRemoved(self, objpath, name):
1414
1134
"D-Bus signal"
1415
1135
pass
1416
1136
1417
@dbus.service.method(_interface, out_signature=u"ao")
1137
@dbus.service.method(_interface, out_signature="ao")
1418
1138
def GetAllClients(self):
1419
1139
"D-Bus method"
1420
return dbus.Array(c.dbus_object_path
1421
for c in tcp_server.clients)
1140
return dbus.Array(c.dbus_object_path for c in clients)
1422
1141
1423
@dbus.service.method(_interface,
1424
out_signature=u"a{oa{sv}}")
1142
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1425
1143
def GetAllClientsWithProperties(self):
1426
1144
"D-Bus method"
1427
1145
return dbus.Dictionary(
1428
1146
((c.dbus_object_path, c.GetAllProperties())
1429
for c in tcp_server.clients),
1430
signature=u"oa{sv}")
1147
for c in clients),
1148
signature="oa{sv}")
1431
1149
1432
@dbus.service.method(_interface, in_signature=u"o")
1150
@dbus.service.method(_interface, in_signature="o")
1433
1151
def RemoveClient(self, object_path):
1434
1152
"D-Bus method"
1435
for c in tcp_server.clients:
1153
for c in clients:
1436
1154
if c.dbus_object_path == object_path:
1437
tcp_server.clients.remove(c)
1438
c.remove_from_connection()
1155
clients.remove(c)
1439
1156
# Don't signal anything except ClientRemoved
1440
c.disable(signal=False)
1157
c.use_dbus = False
1158
c.disable()
1441
1159
# Emit D-Bus signal
1442
1160
self.ClientRemoved(object_path, c.name)
1443
1161
return
1445
1163
1446
1164
del _interface
1447
1165
1448
mandos_dbus_service = MandosDBusService()
1166
mandos_server = MandosServer()
1449
1167
1450
for client in tcp_server.clients:
1168
for client in clients:
1451
1169
if use_dbus:
1452
1170
# Emit D-Bus signal
1453
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1454
client.GetAllProperties())
1171
mandos_server.ClientAdded(client.dbus_object_path,
1172
client.GetAllProperties())
1455
1173
client.enable()
1456
1174
1457
1175
tcp_server.enable()
1459
1177
1460
1178
# Find out what port we got
1461
1179
service.port = tcp_server.socket.getsockname()[1]
1462
if use_ipv6:
1463
logger.info(u"Now listening on address %r, port %d,"
1464
" flowinfo %d, scope_id %d"
1465
% tcp_server.socket.getsockname())
1466
else: # IPv4
1467
logger.info(u"Now listening on address %r, port %d"
1468
% tcp_server.socket.getsockname())
1180
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1181
u" scope_id %d" % tcp_server.socket.getsockname())
1469
1182
1470
1183
#service.interface = tcp_server.socket.getsockname()[3]
1471
1184
1472
1185
try:
1473
1186
# From the Avahi example code
1187
server.connect_to_signal("StateChanged", server_state_changed)
1474
1188
try:
1475
service.activate()
1189
server_state_changed(server.GetState())
1476
1190
except dbus.exceptions.DBusException, error:
1477
1191
logger.critical(u"DBusException: %s", error)
1478
1192
sys.exit(1)
1490
1204
sys.exit(1)
1491
1205
except KeyboardInterrupt:
1492
1206
if debug:
1493
print >> sys.stderr
1494
logger.debug(u"Server received KeyboardInterrupt")
1495
logger.debug(u"Server exiting")
1207
print
1496
1208
1497
1209
if __name__ == '__main__':
1498
1210
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0