To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 302
- compare with another revision
- download diff
- download tarball
- view history from revision 302
- Committer: Teddy Hogeborn
- Date: 2009-02-07 04:50:39 UTC
- Revision ID: teddy@fukt.bsnet.se-20090207045039-xkr6b80vtqwqrq8l
* Makefile (install-client-nokey): Move "initramfs-tools-script" from
"/scripts/local-top/mandos" to
"/scripts/init-premount/mandos".
(uninstall-client): - '' -
* debian/mandos-client.dirs: - '' -
* initramfs-tools-script (PREREQ): Added "udev".
"/scripts/local-top/mandos" to
"/scripts/init-premount/mandos".
(uninstall-client): - '' -
* debian/mandos-client.dirs: - '' -
* initramfs-tools-script (PREREQ): Added "udev".
- files added:
- NEWS
- files removed:
- debian/mandos-client.config
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
30
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
32
#
32
33
33
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
34
35
35
36
import SocketServer
36
37
import socket
37
from optparse import OptionParser
38
import optparse
38
39
import datetime
39
40
import errno
40
41
import gnutls.crypto
55
56
import logging
56
57
import logging.handlers
57
58
import pwd
59
from contextlib import closing
58
60
59
61
import dbus
62
import dbus.service
60
63
import gobject
61
64
import avahi
62
65
from dbus.mainloop.glib import DBusGMainLoop
63
66
import ctypes
64
67
import ctypes.util
65
68
66
version = "1.0"
69
version = "1.0.5"
67
70
68
71
logger = logging.Logger('mandos')
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
74
78
logger.addHandler(syslogger)
75
79
76
80
console = logging.StreamHandler()
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
' %(message)s'))
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
79
83
logger.addHandler(console)
80
84
81
85
class AvahiError(Exception):
82
def __init__(self, value):
86
def __init__(self, value, *args, **kwargs):
83
87
self.value = value
84
super(AvahiError, self).__init__()
85
def __str__(self):
86
return repr(self.value)
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
87
91
88
92
class AvahiServiceError(AvahiError):
89
93
pass
109
113
a sensible number of times
110
114
"""
111
115
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
112
servicetype = None, port = None, TXT = None, domain = "",
113
host = "", max_renames = 32768):
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768):
114
118
self.interface = interface
115
119
self.name = name
116
120
self.type = servicetype
117
121
self.port = port
118
if TXT is None:
119
self.TXT = []
120
else:
121
self.TXT = TXT
122
self.TXT = TXT if TXT is not None else []
122
123
self.domain = domain
123
124
self.host = host
124
125
self.rename_count = 0
129
130
logger.critical(u"No suitable Zeroconf service name found"
130
131
u" after %i retries, exiting.",
131
132
self.rename_count)
132
raise AvahiServiceError("Too many renames")
133
raise AvahiServiceError(u"Too many renames")
133
134
self.name = server.GetAlternativeServiceName(self.name)
134
135
logger.info(u"Changing Zeroconf service name to %r ...",
135
136
str(self.name))
136
syslogger.setFormatter(logging.Formatter\
137
syslogger.setFormatter(logging.Formatter
137
138
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
139
' %%(message)s' % self.name))
139
140
self.remove()
140
141
self.add()
141
142
self.rename_count += 1
147
148
"""Derived from the Avahi example code"""
148
149
global group
149
150
if group is None:
150
group = dbus.Interface\
151
(bus.get_object(avahi.DBUS_NAME,
151
group = dbus.Interface(bus.get_object
152
(avahi.DBUS_NAME,
152
153
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
155
group.connect_to_signal('StateChanged',
155
156
entry_group_state_changed)
156
157
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
170
171
# End of Avahi example code
171
172
172
173
173
class Client(object):
174
def _datetime_to_dbus(dt, variant_level=0):
175
"""Convert a UTC datetime.datetime() to a D-Bus type."""
176
return dbus.String(dt.isoformat(), variant_level=variant_level)
177
178
179
class Client(dbus.service.Object):
174
180
"""A representation of a client host served by this server.
175
181
Attributes:
176
name: string; from the config file, used in log messages
182
name: string; from the config file, used in log messages and
183
D-Bus identifiers
177
184
fingerprint: string (40 or 32 hexadecimal digits); used to
178
185
uniquely identify the client
179
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); object creation, not client host
182
last_checked_ok: datetime.datetime() or None if not yet checked OK
183
timeout: datetime.timedelta(); How long from last_checked_ok
184
until this client is invalid
185
interval: datetime.timedelta(); How often to start a new checker
186
stop_hook: If set, called by stop() as stop_hook(self)
187
checker: subprocess.Popen(); a running checker process used
188
to see if the client lives.
189
'None' if no process is running.
186
secret: bytestring; sent verbatim (over TLS) to client
187
host: string; available for use by the checker command
188
created: datetime.datetime(); (UTC) object creation
189
last_enabled: datetime.datetime(); (UTC)
190
enabled: bool()
191
last_checked_ok: datetime.datetime(); (UTC) or None
192
timeout: datetime.timedelta(); How long from last_checked_ok
193
until this client is invalid
194
interval: datetime.timedelta(); How often to start a new checker
195
disable_hook: If set, called by disable() as disable_hook(self)
196
checker: subprocess.Popen(); a running checker process used
197
to see if the client lives.
198
'None' if no process is running.
190
199
checker_initiator_tag: a gobject event source tag, or None
191
stop_initiator_tag: - '' -
200
disable_initiator_tag: - '' -
192
201
checker_callback_tag: - '' -
193
202
checker_command: string; External command which is run to check if
194
203
client lives. %() expansions are done at
195
204
runtime with vars(self) as dict, so that for
196
205
instance %(name)s can be used in the command.
197
Private attibutes:
198
_timeout: Real variable for 'timeout'
199
_interval: Real variable for 'interval'
200
_timeout_milliseconds: Used when calling gobject.timeout_add()
201
_interval_milliseconds: - '' -
206
use_dbus: bool(); Whether to provide D-Bus interface and signals
207
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
202
208
"""
203
def _set_timeout(self, timeout):
204
"Setter function for 'timeout' attribute"
205
self._timeout = timeout
206
self._timeout_milliseconds = ((self.timeout.days
207
* 24 * 60 * 60 * 1000)
208
+ (self.timeout.seconds * 1000)
209
+ (self.timeout.microseconds
210
// 1000))
211
timeout = property(lambda self: self._timeout,
212
_set_timeout)
213
del _set_timeout
214
def _set_interval(self, interval):
215
"Setter function for 'interval' attribute"
216
self._interval = interval
217
self._interval_milliseconds = ((self.interval.days
218
* 24 * 60 * 60 * 1000)
219
+ (self.interval.seconds
220
* 1000)
221
+ (self.interval.microseconds
222
// 1000))
223
interval = property(lambda self: self._interval,
224
_set_interval)
225
del _set_interval
226
def __init__(self, name = None, stop_hook=None, config=None):
209
def timeout_milliseconds(self):
210
"Return the 'timeout' attribute in milliseconds"
211
return ((self.timeout.days * 24 * 60 * 60 * 1000)
212
+ (self.timeout.seconds * 1000)
213
+ (self.timeout.microseconds // 1000))
214
215
def interval_milliseconds(self):
216
"Return the 'interval' attribute in milliseconds"
217
return ((self.interval.days * 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds * 1000)
219
+ (self.interval.microseconds // 1000))
220
221
def __init__(self, name = None, disable_hook=None, config=None,
222
use_dbus=True):
227
223
"""Note: the 'checker' key in 'config' sets the
228
224
'checker_command' attribute and *not* the 'checker'
229
225
attribute."""
226
self.name = name
230
227
if config is None:
231
228
config = {}
232
self.name = name
233
229
logger.debug(u"Creating client %r", self.name)
230
self.use_dbus = False # During __init__
234
231
# Uppercase and remove spaces from fingerprint for later
235
232
# comparison purposes with return value from the fingerprint()
236
233
# function
237
self.fingerprint = config["fingerprint"].upper()\
238
.replace(u" ", u"")
234
self.fingerprint = (config["fingerprint"].upper()
235
.replace(u" ", u""))
239
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
240
237
if "secret" in config:
241
238
self.secret = config["secret"].decode(u"base64")
242
239
elif "secfile" in config:
243
secfile = open(config["secfile"])
244
self.secret = secfile.read()
245
secfile.close()
240
with closing(open(os.path.expanduser
241
(os.path.expandvars
242
(config["secfile"])))) as secfile:
243
self.secret = secfile.read()
246
244
else:
247
245
raise TypeError(u"No secret or secfile for client %s"
248
246
% self.name)
249
247
self.host = config.get("host", "")
250
self.created = datetime.datetime.now()
248
self.created = datetime.datetime.utcnow()
249
self.enabled = False
250
self.last_enabled = None
251
251
self.last_checked_ok = None
252
252
self.timeout = string_to_delta(config["timeout"])
253
253
self.interval = string_to_delta(config["interval"])
254
self.stop_hook = stop_hook
254
self.disable_hook = disable_hook
255
255
self.checker = None
256
256
self.checker_initiator_tag = None
257
self.stop_initiator_tag = None
257
self.disable_initiator_tag = None
258
258
self.checker_callback_tag = None
259
self.check_command = config["checker"]
260
def start(self):
259
self.checker_command = config["checker"]
260
self.last_connect = None
261
# Only now, when this client is initialized, can it show up on
262
# the D-Bus
263
self.use_dbus = use_dbus
264
if self.use_dbus:
265
self.dbus_object_path = (dbus.ObjectPath
266
("/clients/"
267
+ self.name.replace(".", "_")))
268
dbus.service.Object.__init__(self, bus,
269
self.dbus_object_path)
270
271
def enable(self):
261
272
"""Start this client's checker and timeout hooks"""
273
self.last_enabled = datetime.datetime.utcnow()
262
274
# Schedule a new checker to be started an 'interval' from now,
263
275
# and every interval from then on.
264
self.checker_initiator_tag = gobject.timeout_add\
265
(self._interval_milliseconds,
266
self.start_checker)
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self.interval_milliseconds(),
278
self.start_checker))
267
279
# Also start a new checker *right now*.
268
280
self.start_checker()
269
# Schedule a stop() when 'timeout' has passed
270
self.stop_initiator_tag = gobject.timeout_add\
271
(self._timeout_milliseconds,
272
self.stop)
273
def stop(self):
274
"""Stop this client.
275
The possibility that a client might be restarted is left open,
276
but not currently used."""
277
# If this client doesn't have a secret, it is already stopped.
278
if hasattr(self, "secret") and self.secret:
279
logger.info(u"Stopping client %s", self.name)
280
self.secret = None
281
else:
281
# Schedule a disable() when 'timeout' has passed
282
self.disable_initiator_tag = (gobject.timeout_add
283
(self.timeout_milliseconds(),
284
self.disable))
285
self.enabled = True
286
if self.use_dbus:
287
# Emit D-Bus signals
288
self.PropertyChanged(dbus.String(u"enabled"),
289
dbus.Boolean(True, variant_level=1))
290
self.PropertyChanged(dbus.String(u"last_enabled"),
291
(_datetime_to_dbus(self.last_enabled,
292
variant_level=1)))
293
294
def disable(self):
295
"""Disable this client."""
296
if not getattr(self, "enabled", False):
282
297
return False
283
if getattr(self, "stop_initiator_tag", False):
284
gobject.source_remove(self.stop_initiator_tag)
285
self.stop_initiator_tag = None
298
logger.info(u"Disabling client %s", self.name)
299
if getattr(self, "disable_initiator_tag", False):
300
gobject.source_remove(self.disable_initiator_tag)
301
self.disable_initiator_tag = None
286
302
if getattr(self, "checker_initiator_tag", False):
287
303
gobject.source_remove(self.checker_initiator_tag)
288
304
self.checker_initiator_tag = None
289
305
self.stop_checker()
290
if self.stop_hook:
291
self.stop_hook(self)
306
if self.disable_hook:
307
self.disable_hook(self)
308
self.enabled = False
309
if self.use_dbus:
310
# Emit D-Bus signal
311
self.PropertyChanged(dbus.String(u"enabled"),
312
dbus.Boolean(False, variant_level=1))
292
313
# Do not run this again if called by a gobject.timeout_add
293
314
return False
315
294
316
def __del__(self):
295
self.stop_hook = None
296
self.stop()
297
def checker_callback(self, pid, condition):
317
self.disable_hook = None
318
self.disable()
319
320
def checker_callback(self, pid, condition, command):
298
321
"""The checker has completed, so take appropriate actions."""
299
now = datetime.datetime.now()
300
322
self.checker_callback_tag = None
301
323
self.checker = None
302
if os.WIFEXITED(condition) \
303
and (os.WEXITSTATUS(condition) == 0):
304
logger.info(u"Checker for %(name)s succeeded",
305
vars(self))
306
self.last_checked_ok = now
307
gobject.source_remove(self.stop_initiator_tag)
308
self.stop_initiator_tag = gobject.timeout_add\
309
(self._timeout_milliseconds,
310
self.stop)
311
elif not os.WIFEXITED(condition):
324
if self.use_dbus:
325
# Emit D-Bus signal
326
self.PropertyChanged(dbus.String(u"checker_running"),
327
dbus.Boolean(False, variant_level=1))
328
if os.WIFEXITED(condition):
329
exitstatus = os.WEXITSTATUS(condition)
330
if exitstatus == 0:
331
logger.info(u"Checker for %(name)s succeeded",
332
vars(self))
333
self.checked_ok()
334
else:
335
logger.info(u"Checker for %(name)s failed",
336
vars(self))
337
if self.use_dbus:
338
# Emit D-Bus signal
339
self.CheckerCompleted(dbus.Int16(exitstatus),
340
dbus.Int64(condition),
341
dbus.String(command))
342
else:
312
343
logger.warning(u"Checker for %(name)s crashed?",
313
344
vars(self))
314
else:
315
logger.info(u"Checker for %(name)s failed",
316
vars(self))
345
if self.use_dbus:
346
# Emit D-Bus signal
347
self.CheckerCompleted(dbus.Int16(-1),
348
dbus.Int64(condition),
349
dbus.String(command))
350
351
def checked_ok(self):
352
"""Bump up the timeout for this client.
353
This should only be called when the client has been seen,
354
alive and well.
355
"""
356
self.last_checked_ok = datetime.datetime.utcnow()
357
gobject.source_remove(self.disable_initiator_tag)
358
self.disable_initiator_tag = (gobject.timeout_add
359
(self.timeout_milliseconds(),
360
self.disable))
361
if self.use_dbus:
362
# Emit D-Bus signal
363
self.PropertyChanged(
364
dbus.String(u"last_checked_ok"),
365
(_datetime_to_dbus(self.last_checked_ok,
366
variant_level=1)))
367
317
368
def start_checker(self):
318
369
"""Start a new checker subprocess if one is not running.
319
370
If a checker already exists, leave it running and do
328
379
# is as it should be.
329
380
if self.checker is None:
330
381
try:
331
# In case check_command has exactly one % operator
332
command = self.check_command % self.host
382
# In case checker_command has exactly one % operator
383
command = self.checker_command % self.host
333
384
except TypeError:
334
385
# Escape attributes for the shell
335
386
escaped_attrs = dict((key, re.escape(str(val)))
336
387
for key, val in
337
388
vars(self).iteritems())
338
389
try:
339
command = self.check_command % escaped_attrs
390
command = self.checker_command % escaped_attrs
340
391
except TypeError, error:
341
392
logger.error(u'Could not format string "%s":'
342
u' %s', self.check_command, error)
393
u' %s', self.checker_command, error)
343
394
return True # Try again later
344
395
try:
345
396
logger.info(u"Starting checker %r for %s",
351
402
self.checker = subprocess.Popen(command,
352
403
close_fds=True,
353
404
shell=True, cwd="/")
354
self.checker_callback_tag = gobject.child_watch_add\
355
(self.checker.pid,
356
self.checker_callback)
405
if self.use_dbus:
406
# Emit D-Bus signal
407
self.CheckerStarted(command)
408
self.PropertyChanged(
409
dbus.String("checker_running"),
410
dbus.Boolean(True, variant_level=1))
411
self.checker_callback_tag = (gobject.child_watch_add
412
(self.checker.pid,
413
self.checker_callback,
414
data=command))
357
415
except OSError, error:
358
416
logger.error(u"Failed to start subprocess: %s",
359
417
error)
360
418
# Re-run this periodically if run by gobject.timeout_add
361
419
return True
420
362
421
def stop_checker(self):
363
422
"""Force the checker process, if any, to stop."""
364
423
if self.checker_callback_tag:
376
435
if error.errno != errno.ESRCH: # No such process
377
436
raise
378
437
self.checker = None
438
if self.use_dbus:
439
self.PropertyChanged(dbus.String(u"checker_running"),
440
dbus.Boolean(False, variant_level=1))
441
379
442
def still_valid(self):
380
443
"""Has the timeout not yet passed for this client?"""
381
now = datetime.datetime.now()
444
if not getattr(self, "enabled", False):
445
return False
446
now = datetime.datetime.utcnow()
382
447
if self.last_checked_ok is None:
383
448
return now < (self.created + self.timeout)
384
449
else:
385
450
return now < (self.last_checked_ok + self.timeout)
451
452
## D-Bus methods & signals
453
_interface = u"se.bsnet.fukt.Mandos.Client"
454
455
# CheckedOK - method
456
CheckedOK = dbus.service.method(_interface)(checked_ok)
457
CheckedOK.__name__ = "CheckedOK"
458
459
# CheckerCompleted - signal
460
@dbus.service.signal(_interface, signature="nxs")
461
def CheckerCompleted(self, exitcode, waitstatus, command):
462
"D-Bus signal"
463
pass
464
465
# CheckerStarted - signal
466
@dbus.service.signal(_interface, signature="s")
467
def CheckerStarted(self, command):
468
"D-Bus signal"
469
pass
470
471
# GetAllProperties - method
472
@dbus.service.method(_interface, out_signature="a{sv}")
473
def GetAllProperties(self):
474
"D-Bus method"
475
return dbus.Dictionary({
476
dbus.String("name"):
477
dbus.String(self.name, variant_level=1),
478
dbus.String("fingerprint"):
479
dbus.String(self.fingerprint, variant_level=1),
480
dbus.String("host"):
481
dbus.String(self.host, variant_level=1),
482
dbus.String("created"):
483
_datetime_to_dbus(self.created, variant_level=1),
484
dbus.String("last_enabled"):
485
(_datetime_to_dbus(self.last_enabled,
486
variant_level=1)
487
if self.last_enabled is not None
488
else dbus.Boolean(False, variant_level=1)),
489
dbus.String("enabled"):
490
dbus.Boolean(self.enabled, variant_level=1),
491
dbus.String("last_checked_ok"):
492
(_datetime_to_dbus(self.last_checked_ok,
493
variant_level=1)
494
if self.last_checked_ok is not None
495
else dbus.Boolean (False, variant_level=1)),
496
dbus.String("timeout"):
497
dbus.UInt64(self.timeout_milliseconds(),
498
variant_level=1),
499
dbus.String("interval"):
500
dbus.UInt64(self.interval_milliseconds(),
501
variant_level=1),
502
dbus.String("checker"):
503
dbus.String(self.checker_command,
504
variant_level=1),
505
dbus.String("checker_running"):
506
dbus.Boolean(self.checker is not None,
507
variant_level=1),
508
dbus.String("object_path"):
509
dbus.ObjectPath(self.dbus_object_path,
510
variant_level=1)
511
}, signature="sv")
512
513
# IsStillValid - method
514
IsStillValid = (dbus.service.method(_interface, out_signature="b")
515
(still_valid))
516
IsStillValid.__name__ = "IsStillValid"
517
518
# PropertyChanged - signal
519
@dbus.service.signal(_interface, signature="sv")
520
def PropertyChanged(self, property, value):
521
"D-Bus signal"
522
pass
523
524
# SetChecker - method
525
@dbus.service.method(_interface, in_signature="s")
526
def SetChecker(self, checker):
527
"D-Bus setter method"
528
self.checker_command = checker
529
# Emit D-Bus signal
530
self.PropertyChanged(dbus.String(u"checker"),
531
dbus.String(self.checker_command,
532
variant_level=1))
533
534
# SetHost - method
535
@dbus.service.method(_interface, in_signature="s")
536
def SetHost(self, host):
537
"D-Bus setter method"
538
self.host = host
539
# Emit D-Bus signal
540
self.PropertyChanged(dbus.String(u"host"),
541
dbus.String(self.host, variant_level=1))
542
543
# SetInterval - method
544
@dbus.service.method(_interface, in_signature="t")
545
def SetInterval(self, milliseconds):
546
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
547
# Emit D-Bus signal
548
self.PropertyChanged(dbus.String(u"interval"),
549
(dbus.UInt64(self.interval_milliseconds(),
550
variant_level=1)))
551
552
# SetSecret - method
553
@dbus.service.method(_interface, in_signature="ay",
554
byte_arrays=True)
555
def SetSecret(self, secret):
556
"D-Bus setter method"
557
self.secret = str(secret)
558
559
# SetTimeout - method
560
@dbus.service.method(_interface, in_signature="t")
561
def SetTimeout(self, milliseconds):
562
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
563
# Emit D-Bus signal
564
self.PropertyChanged(dbus.String(u"timeout"),
565
(dbus.UInt64(self.timeout_milliseconds(),
566
variant_level=1)))
567
568
# Enable - method
569
Enable = dbus.service.method(_interface)(enable)
570
Enable.__name__ = "Enable"
571
572
# StartChecker - method
573
@dbus.service.method(_interface)
574
def StartChecker(self):
575
"D-Bus method"
576
self.start_checker()
577
578
# Disable - method
579
@dbus.service.method(_interface)
580
def Disable(self):
581
"D-Bus method"
582
self.disable()
583
584
# StopChecker - method
585
StopChecker = dbus.service.method(_interface)(stop_checker)
586
StopChecker.__name__ = "StopChecker"
587
588
del _interface
386
589
387
590
388
591
def peer_certificate(session):
389
592
"Return the peer's OpenPGP certificate as a bytestring"
390
593
# If not an OpenPGP certificate...
391
if gnutls.library.functions.gnutls_certificate_type_get\
392
(session._c_object) \
393
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
594
if (gnutls.library.functions
595
.gnutls_certificate_type_get(session._c_object)
596
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
394
597
# ...do the normal thing
395
598
return session.peer_certificate
396
list_size = ctypes.c_uint()
397
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
398
(session._c_object, ctypes.byref(list_size))
599
list_size = ctypes.c_uint(1)
600
cert_list = (gnutls.library.functions
601
.gnutls_certificate_get_peers
602
(session._c_object, ctypes.byref(list_size)))
603
if not bool(cert_list) and list_size.value != 0:
604
raise gnutls.errors.GNUTLSError("error getting peer"
605
" certificate")
399
606
if list_size.value == 0:
400
607
return None
401
608
cert = cert_list[0]
405
612
def fingerprint(openpgp):
406
613
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
407
614
# New GnuTLS "datum" with the OpenPGP public key
408
datum = gnutls.library.types.gnutls_datum_t\
409
(ctypes.cast(ctypes.c_char_p(openpgp),
410
ctypes.POINTER(ctypes.c_ubyte)),
411
ctypes.c_uint(len(openpgp)))
615
datum = (gnutls.library.types
616
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
617
ctypes.POINTER
618
(ctypes.c_ubyte)),
619
ctypes.c_uint(len(openpgp))))
412
620
# New empty GnuTLS certificate
413
621
crt = gnutls.library.types.gnutls_openpgp_crt_t()
414
gnutls.library.functions.gnutls_openpgp_crt_init\
415
(ctypes.byref(crt))
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
416
624
# Import the OpenPGP public key into the certificate
417
gnutls.library.functions.gnutls_openpgp_crt_import\
418
(crt, ctypes.byref(datum),
419
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
627
gnutls.library.constants
628
.GNUTLS_OPENPGP_FMT_RAW))
420
629
# Verify the self signature in the key
421
630
crtverify = ctypes.c_uint()
422
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
423
(crt, 0, ctypes.byref(crtverify))
631
(gnutls.library.functions
632
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
424
633
if crtverify.value != 0:
425
634
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
426
635
raise gnutls.errors.CertificateSecurityError("Verify failed")
428
637
buf = ctypes.create_string_buffer(20)
429
638
buf_len = ctypes.c_size_t()
430
639
# Get the fingerprint from the certificate into the buffer
431
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
432
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
640
(gnutls.library.functions
641
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
642
ctypes.byref(buf_len)))
433
643
# Deinit the certificate
434
644
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
435
645
# Convert the buffer to a Python bytestring
446
656
447
657
def handle(self):
448
658
logger.info(u"TCP connection from: %s",
449
unicode(self.client_address))
450
session = gnutls.connection.ClientSession\
451
(self.request, gnutls.connection.X509Credentials())
659
unicode(self.client_address))
660
session = (gnutls.connection
661
.ClientSession(self.request,
662
gnutls.connection
663
.X509Credentials()))
452
664
453
665
line = self.request.makefile().readline()
454
666
logger.debug(u"Protocol version: %r", line)
465
677
# using OpenPGP certificates.
466
678
467
679
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
468
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
469
# "+DHE-DSS"))
470
priority = "NORMAL" # Fallback default, since this
471
# MUST be set.
472
if self.server.settings["priority"]:
473
priority = self.server.settings["priority"]
474
gnutls.library.functions.gnutls_priority_set_direct\
475
(session._c_object, priority, None)
680
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
681
# "+DHE-DSS"))
682
# Use a fallback default, since this MUST be set.
683
priority = self.server.settings.get("priority", "NORMAL")
684
(gnutls.library.functions
685
.gnutls_priority_set_direct(session._c_object,
686
priority, None))
476
687
477
688
try:
478
689
session.handshake()
481
692
# Do not run session.bye() here: the session is not
482
693
# established. Just abandon the request.
483
694
return
695
logger.debug(u"Handshake succeeded")
484
696
try:
485
697
fpr = fingerprint(peer_certificate(session))
486
698
except (TypeError, gnutls.errors.GNUTLSError), error:
488
700
session.bye()
489
701
return
490
702
logger.debug(u"Fingerprint: %s", fpr)
491
client = None
703
492
704
for c in self.server.clients:
493
705
if c.fingerprint == fpr:
494
706
client = c
495
707
break
496
if not client:
708
else:
497
709
logger.warning(u"Client not found for fingerprint: %s",
498
710
fpr)
499
711
session.bye()
506
718
vars(client))
507
719
session.bye()
508
720
return
721
## This won't work here, since we're in a fork.
722
# client.checked_ok()
509
723
sent_size = 0
510
724
while sent_size < len(client.secret):
511
725
sent = session.send(client.secret[sent_size:])
516
730
session.bye()
517
731
518
732
519
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
733
class IPv6_TCPServer(SocketServer.ForkingMixIn,
734
SocketServer.TCPServer, object):
520
735
"""IPv6 TCP server. Accepts 'None' as address and/or port.
521
736
Attributes:
522
737
settings: Server settings
550
765
u" bind to interface %s",
551
766
self.settings["interface"])
552
767
else:
553
raise error
768
raise
554
769
# Only bind(2) the socket if we really need to.
555
770
if self.server_address[0] or self.server_address[1]:
556
771
if not self.server_address[0]:
577
792
578
793
def string_to_delta(interval):
579
794
"""Parse a string and return a datetime.timedelta
580
795
581
796
>>> string_to_delta('7d')
582
797
datetime.timedelta(7)
583
798
>>> string_to_delta('60s')
635
850
elif state == avahi.ENTRY_GROUP_FAILURE:
636
851
logger.critical(u"Avahi: Error in group state changed %s",
637
852
unicode(error))
638
raise AvahiGroupError("State changed: %s", str(error))
853
raise AvahiGroupError(u"State changed: %s" % unicode(error))
639
854
640
855
def if_nametoindex(interface):
641
856
"""Call the C function if_nametoindex(), or equivalent"""
642
857
global if_nametoindex
643
858
try:
644
if_nametoindex = ctypes.cdll.LoadLibrary\
645
(ctypes.util.find_library("c")).if_nametoindex
859
if_nametoindex = (ctypes.cdll.LoadLibrary
860
(ctypes.util.find_library("c"))
861
.if_nametoindex)
646
862
except (OSError, AttributeError):
647
863
if "struct" not in sys.modules:
648
864
import struct
651
867
def if_nametoindex(interface):
652
868
"Get an interface index the hard way, i.e. using fcntl()"
653
869
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
654
s = socket.socket()
655
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
656
struct.pack("16s16x", interface))
657
s.close()
870
with closing(socket.socket()) as s:
871
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
872
struct.pack("16s16x", interface))
658
873
interface_index = struct.unpack("I", ifreq[16:20])[0]
659
874
return interface_index
660
875
return if_nametoindex(interface)
684
899
685
900
686
901
def main():
687
parser = OptionParser(version = "%%prog %s" % version)
902
parser = optparse.OptionParser(version = "%%prog %s" % version)
688
903
parser.add_option("-i", "--interface", type="string",
689
904
metavar="IF", help="Bind to interface IF")
690
905
parser.add_option("-a", "--address", type="string",
691
906
help="Address to listen for requests on")
692
907
parser.add_option("-p", "--port", type="int",
693
908
help="Port number to receive requests on")
694
parser.add_option("--check", action="store_true", default=False,
909
parser.add_option("--check", action="store_true",
695
910
help="Run self-test")
696
911
parser.add_option("--debug", action="store_true",
697
912
help="Debug mode; run in foreground and log to"
704
919
default="/etc/mandos", metavar="DIR",
705
920
help="Directory to search for configuration"
706
921
" files")
922
parser.add_option("--no-dbus", action="store_false",
923
dest="use_dbus",
924
help="Do not provide D-Bus system bus"
925
" interface")
707
926
options = parser.parse_args()[0]
708
927
709
928
if options.check:
719
938
"priority":
720
939
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
721
940
"servicename": "Mandos",
941
"use_dbus": "True",
722
942
}
723
943
724
944
# Parse config file for server-global settings
727
947
server_config.read(os.path.join(options.configdir, "mandos.conf"))
728
948
# Convert the SafeConfigParser object to a dict
729
949
server_settings = server_config.defaults()
730
# Use getboolean on the boolean config option
731
server_settings["debug"] = server_config.getboolean\
732
("DEFAULT", "debug")
950
# Use the appropriate methods on the non-string config options
951
server_settings["debug"] = server_config.getboolean("DEFAULT",
952
"debug")
953
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
954
"use_dbus")
955
if server_settings["port"]:
956
server_settings["port"] = server_config.getint("DEFAULT",
957
"port")
733
958
del server_config
734
959
735
960
# Override the settings from the config file with command line
736
961
# options, if set.
737
962
for option in ("interface", "address", "port", "debug",
738
"priority", "servicename", "configdir"):
963
"priority", "servicename", "configdir",
964
"use_dbus"):
739
965
value = getattr(options, option)
740
966
if value is not None:
741
967
server_settings[option] = value
742
968
del options
743
969
# Now we have our good server settings in "server_settings"
744
970
971
# For convenience
745
972
debug = server_settings["debug"]
973
use_dbus = server_settings["use_dbus"]
746
974
747
975
if not debug:
748
976
syslogger.setLevel(logging.WARNING)
749
977
console.setLevel(logging.WARNING)
750
978
751
979
if server_settings["servicename"] != "Mandos":
752
syslogger.setFormatter(logging.Formatter\
980
syslogger.setFormatter(logging.Formatter
753
981
('Mandos (%s): %%(levelname)s:'
754
982
' %%(message)s'
755
983
% server_settings["servicename"]))
757
985
# Parse config file with clients
758
986
client_defaults = { "timeout": "1h",
759
987
"interval": "5m",
760
"checker": "fping -q -- %(host)s",
988
"checker": "fping -q -- %%(host)s",
761
989
"host": "",
762
990
}
763
991
client_config = ConfigParser.SafeConfigParser(client_defaults)
773
1001
pidfilename = "/var/run/mandos.pid"
774
1002
try:
775
1003
pidfile = open(pidfilename, "w")
776
except IOError, error:
1004
except IOError:
777
1005
logger.error("Could not open file %r", pidfilename)
778
1006
779
uid = 65534
780
gid = 65534
781
try:
782
uid = pwd.getpwnam("mandos").pw_uid
783
except KeyError:
784
try:
785
uid = pwd.getpwnam("nobody").pw_uid
786
except KeyError:
787
pass
788
try:
789
gid = pwd.getpwnam("mandos").pw_gid
790
except KeyError:
791
try:
792
gid = pwd.getpwnam("nogroup").pw_gid
793
except KeyError:
794
pass
795
try:
1007
try:
1008
uid = pwd.getpwnam("_mandos").pw_uid
1009
gid = pwd.getpwnam("_mandos").pw_gid
1010
except KeyError:
1011
try:
1012
uid = pwd.getpwnam("mandos").pw_uid
1013
gid = pwd.getpwnam("mandos").pw_gid
1014
except KeyError:
1015
try:
1016
uid = pwd.getpwnam("nobody").pw_uid
1017
gid = pwd.getpwnam("nogroup").pw_gid
1018
except KeyError:
1019
uid = 65534
1020
gid = 65534
1021
try:
1022
os.setgid(gid)
796
1023
os.setuid(uid)
797
os.setgid(gid)
798
1024
except OSError, error:
799
1025
if error[0] != errno.EPERM:
800
1026
raise error
801
1027
1028
# Enable all possible GnuTLS debugging
1029
if debug:
1030
# "Use a log level over 10 to enable all debugging options."
1031
# - GnuTLS manual
1032
gnutls.library.functions.gnutls_global_set_log_level(11)
1033
1034
@gnutls.library.types.gnutls_log_func
1035
def debug_gnutls(level, string):
1036
logger.debug("GnuTLS: %s", string[:-1])
1037
1038
(gnutls.library.functions
1039
.gnutls_global_set_log_function(debug_gnutls))
1040
802
1041
global service
803
1042
service = AvahiService(name = server_settings["servicename"],
804
1043
servicetype = "_mandos._tcp", )
805
1044
if server_settings["interface"]:
806
service.interface = if_nametoindex\
807
(server_settings["interface"])
1045
service.interface = (if_nametoindex
1046
(server_settings["interface"]))
808
1047
809
1048
global main_loop
810
1049
global bus
817
1056
avahi.DBUS_PATH_SERVER),
818
1057
avahi.DBUS_INTERFACE_SERVER)
819
1058
# End of Avahi example code
820
821
def remove_from_clients(client):
822
clients.remove(client)
823
if not clients:
824
logger.critical(u"No clients left, exiting")
825
sys.exit()
1059
if use_dbus:
1060
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
826
1061
827
1062
clients.update(Set(Client(name = section,
828
stop_hook = remove_from_clients,
829
1063
config
830
= dict(client_config.items(section)))
1064
= dict(client_config.items(section)),
1065
use_dbus = use_dbus)
831
1066
for section in client_config.sections()))
832
1067
if not clients:
833
logger.critical(u"No clients defined")
834
sys.exit(1)
1068
logger.warning(u"No clients defined")
835
1069
836
1070
if debug:
837
1071
# Redirect stdin so all checkers get /dev/null
869
1103
870
1104
while clients:
871
1105
client = clients.pop()
872
client.stop_hook = None
873
client.stop()
1106
client.disable_hook = None
1107
client.disable()
874
1108
875
1109
atexit.register(cleanup)
876
1110
879
1113
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
880
1114
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
881
1115
1116
if use_dbus:
1117
class MandosServer(dbus.service.Object):
1118
"""A D-Bus proxy object"""
1119
def __init__(self):
1120
dbus.service.Object.__init__(self, bus, "/")
1121
_interface = u"se.bsnet.fukt.Mandos"
1122
1123
@dbus.service.signal(_interface, signature="oa{sv}")
1124
def ClientAdded(self, objpath, properties):
1125
"D-Bus signal"
1126
pass
1127
1128
@dbus.service.signal(_interface, signature="os")
1129
def ClientRemoved(self, objpath, name):
1130
"D-Bus signal"
1131
pass
1132
1133
@dbus.service.method(_interface, out_signature="ao")
1134
def GetAllClients(self):
1135
"D-Bus method"
1136
return dbus.Array(c.dbus_object_path for c in clients)
1137
1138
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1139
def GetAllClientsWithProperties(self):
1140
"D-Bus method"
1141
return dbus.Dictionary(
1142
((c.dbus_object_path, c.GetAllProperties())
1143
for c in clients),
1144
signature="oa{sv}")
1145
1146
@dbus.service.method(_interface, in_signature="o")
1147
def RemoveClient(self, object_path):
1148
"D-Bus method"
1149
for c in clients:
1150
if c.dbus_object_path == object_path:
1151
clients.remove(c)
1152
# Don't signal anything except ClientRemoved
1153
c.use_dbus = False
1154
c.disable()
1155
# Emit D-Bus signal
1156
self.ClientRemoved(object_path, c.name)
1157
return
1158
raise KeyError
1159
1160
del _interface
1161
1162
mandos_server = MandosServer()
1163
882
1164
for client in clients:
883
client.start()
1165
if use_dbus:
1166
# Emit D-Bus signal
1167
mandos_server.ClientAdded(client.dbus_object_path,
1168
client.GetAllProperties())
1169
client.enable()
884
1170
885
1171
tcp_server.enable()
886
1172
tcp_server.server_activate()
904
1190
905
1191
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
906
1192
lambda *args, **kwargs:
907
tcp_server.handle_request\
908
(*args[2:], **kwargs) or True)
1193
(tcp_server.handle_request
1194
(*args[2:], **kwargs) or True))
909
1195
910
1196
logger.debug(u"Starting main loop")
911
1197
main_loop.run()
912
1198
except AvahiError, error:
913
logger.critical(u"AvahiError: %s" + unicode(error))
1199
logger.critical(u"AvahiError: %s", error)
914
1200
sys.exit(1)
915
1201
except KeyboardInterrupt:
916
1202
if debug:
917
print
1203
print >> sys.stderr
1204
logger.debug("Server received KeyboardInterrupt")
1205
logger.debug("Server exiting")
918
1206
919
1207
if __name__ == '__main__':
920
1208
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0