To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 305
- compare with another revision
- download diff
- download tarball
- view history from revision 305
- Committer: Teddy Hogeborn
- Date: 2009-02-09 02:13:58 UTC
- Revision ID: teddy@fukt.bsnet.se-20090209021358-6nrlc91oi08hn5hb
* initramfs-tools-hook: Whitespace change only.
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- plugins.d/usplash
- files renamed:
- plugins.d/password-request.c => plugins.d/mandos-client.c
- plugins.d/password-request.xml => plugins.d/mandos-client.xml
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
30
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
32
#
32
33
33
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
34
35
35
36
import SocketServer
36
37
import socket
37
import select
38
from optparse import OptionParser
38
import optparse
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
55
55
import stat
56
56
import logging
57
57
import logging.handlers
58
import pwd
59
from contextlib import closing
58
60
59
61
import dbus
62
import dbus.service
60
63
import gobject
61
64
import avahi
62
65
from dbus.mainloop.glib import DBusGMainLoop
63
66
import ctypes
67
import ctypes.util
64
68
65
version = "1.0"
69
version = "1.0.5"
66
70
67
71
logger = logging.Logger('mandos')
68
syslogger = logging.handlers.SysLogHandler\
69
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
70
address = "/dev/log")
71
syslogger.setFormatter(logging.Formatter\
72
('Mandos: %(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
73
78
logger.addHandler(syslogger)
74
79
75
80
console = logging.StreamHandler()
76
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
77
' %(message)s'))
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
78
83
logger.addHandler(console)
79
84
80
85
class AvahiError(Exception):
81
def __init__(self, value):
86
def __init__(self, value, *args, **kwargs):
82
87
self.value = value
83
def __str__(self):
84
return repr(self.value)
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
85
91
86
92
class AvahiServiceError(AvahiError):
87
93
pass
107
113
a sensible number of times
108
114
"""
109
115
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
110
type = None, port = None, TXT = None, domain = "",
111
host = "", max_renames = 32768):
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768):
112
118
self.interface = interface
113
119
self.name = name
114
self.type = type
120
self.type = servicetype
115
121
self.port = port
116
if TXT is None:
117
self.TXT = []
118
else:
119
self.TXT = TXT
122
self.TXT = TXT if TXT is not None else []
120
123
self.domain = domain
121
124
self.host = host
122
125
self.rename_count = 0
126
129
if self.rename_count >= self.max_renames:
127
130
logger.critical(u"No suitable Zeroconf service name found"
128
131
u" after %i retries, exiting.",
129
rename_count)
130
raise AvahiServiceError("Too many renames")
132
self.rename_count)
133
raise AvahiServiceError(u"Too many renames")
131
134
self.name = server.GetAlternativeServiceName(self.name)
132
135
logger.info(u"Changing Zeroconf service name to %r ...",
133
136
str(self.name))
134
syslogger.setFormatter(logging.Formatter\
137
syslogger.setFormatter(logging.Formatter
135
138
('Mandos (%s): %%(levelname)s:'
136
' %%(message)s' % self.name))
139
' %%(message)s' % self.name))
137
140
self.remove()
138
141
self.add()
139
142
self.rename_count += 1
145
148
"""Derived from the Avahi example code"""
146
149
global group
147
150
if group is None:
148
group = dbus.Interface\
149
(bus.get_object(avahi.DBUS_NAME,
151
group = dbus.Interface(bus.get_object
152
(avahi.DBUS_NAME,
150
153
server.EntryGroupNew()),
151
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
155
group.connect_to_signal('StateChanged',
153
156
entry_group_state_changed)
154
157
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
168
171
# End of Avahi example code
169
172
170
173
171
class Client(object):
174
def _datetime_to_dbus(dt, variant_level=0):
175
"""Convert a UTC datetime.datetime() to a D-Bus type."""
176
return dbus.String(dt.isoformat(), variant_level=variant_level)
177
178
179
class Client(dbus.service.Object):
172
180
"""A representation of a client host served by this server.
173
181
Attributes:
174
name: string; from the config file, used in log messages
182
name: string; from the config file, used in log messages and
183
D-Bus identifiers
175
184
fingerprint: string (40 or 32 hexadecimal digits); used to
176
185
uniquely identify the client
177
secret: bytestring; sent verbatim (over TLS) to client
178
host: string; available for use by the checker command
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
181
timeout: datetime.timedelta(); How long from last_checked_ok
182
until this client is invalid
183
interval: datetime.timedelta(); How often to start a new checker
184
stop_hook: If set, called by stop() as stop_hook(self)
185
checker: subprocess.Popen(); a running checker process used
186
to see if the client lives.
187
'None' if no process is running.
186
secret: bytestring; sent verbatim (over TLS) to client
187
host: string; available for use by the checker command
188
created: datetime.datetime(); (UTC) object creation
189
last_enabled: datetime.datetime(); (UTC)
190
enabled: bool()
191
last_checked_ok: datetime.datetime(); (UTC) or None
192
timeout: datetime.timedelta(); How long from last_checked_ok
193
until this client is invalid
194
interval: datetime.timedelta(); How often to start a new checker
195
disable_hook: If set, called by disable() as disable_hook(self)
196
checker: subprocess.Popen(); a running checker process used
197
to see if the client lives.
198
'None' if no process is running.
188
199
checker_initiator_tag: a gobject event source tag, or None
189
stop_initiator_tag: - '' -
200
disable_initiator_tag: - '' -
190
201
checker_callback_tag: - '' -
191
202
checker_command: string; External command which is run to check if
192
203
client lives. %() expansions are done at
193
204
runtime with vars(self) as dict, so that for
194
205
instance %(name)s can be used in the command.
195
Private attibutes:
196
_timeout: Real variable for 'timeout'
197
_interval: Real variable for 'interval'
198
_timeout_milliseconds: Used when calling gobject.timeout_add()
199
_interval_milliseconds: - '' -
206
use_dbus: bool(); Whether to provide D-Bus interface and signals
207
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
200
208
"""
201
def _set_timeout(self, timeout):
202
"Setter function for 'timeout' attribute"
203
self._timeout = timeout
204
self._timeout_milliseconds = ((self.timeout.days
205
* 24 * 60 * 60 * 1000)
206
+ (self.timeout.seconds * 1000)
207
+ (self.timeout.microseconds
208
// 1000))
209
timeout = property(lambda self: self._timeout,
210
_set_timeout)
211
del _set_timeout
212
def _set_interval(self, interval):
213
"Setter function for 'interval' attribute"
214
self._interval = interval
215
self._interval_milliseconds = ((self.interval.days
216
* 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds
218
* 1000)
219
+ (self.interval.microseconds
220
// 1000))
221
interval = property(lambda self: self._interval,
222
_set_interval)
223
del _set_interval
224
def __init__(self, name = None, stop_hook=None, config={}):
209
def timeout_milliseconds(self):
210
"Return the 'timeout' attribute in milliseconds"
211
return ((self.timeout.days * 24 * 60 * 60 * 1000)
212
+ (self.timeout.seconds * 1000)
213
+ (self.timeout.microseconds // 1000))
214
215
def interval_milliseconds(self):
216
"Return the 'interval' attribute in milliseconds"
217
return ((self.interval.days * 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds * 1000)
219
+ (self.interval.microseconds // 1000))
220
221
def __init__(self, name = None, disable_hook=None, config=None,
222
use_dbus=True):
225
223
"""Note: the 'checker' key in 'config' sets the
226
224
'checker_command' attribute and *not* the 'checker'
227
225
attribute."""
228
226
self.name = name
227
if config is None:
228
config = {}
229
229
logger.debug(u"Creating client %r", self.name)
230
self.use_dbus = False # During __init__
230
231
# Uppercase and remove spaces from fingerprint for later
231
232
# comparison purposes with return value from the fingerprint()
232
233
# function
233
self.fingerprint = config["fingerprint"].upper()\
234
.replace(u" ", u"")
234
self.fingerprint = (config["fingerprint"].upper()
235
.replace(u" ", u""))
235
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
236
237
if "secret" in config:
237
238
self.secret = config["secret"].decode(u"base64")
238
239
elif "secfile" in config:
239
sf = open(config["secfile"])
240
self.secret = sf.read()
241
sf.close()
240
with closing(open(os.path.expanduser
241
(os.path.expandvars
242
(config["secfile"])))) as secfile:
243
self.secret = secfile.read()
242
244
else:
243
245
raise TypeError(u"No secret or secfile for client %s"
244
246
% self.name)
245
247
self.host = config.get("host", "")
246
self.created = datetime.datetime.now()
248
self.created = datetime.datetime.utcnow()
249
self.enabled = False
250
self.last_enabled = None
247
251
self.last_checked_ok = None
248
252
self.timeout = string_to_delta(config["timeout"])
249
253
self.interval = string_to_delta(config["interval"])
250
self.stop_hook = stop_hook
254
self.disable_hook = disable_hook
251
255
self.checker = None
252
256
self.checker_initiator_tag = None
253
self.stop_initiator_tag = None
257
self.disable_initiator_tag = None
254
258
self.checker_callback_tag = None
255
self.check_command = config["checker"]
256
def start(self):
259
self.checker_command = config["checker"]
260
self.last_connect = None
261
# Only now, when this client is initialized, can it show up on
262
# the D-Bus
263
self.use_dbus = use_dbus
264
if self.use_dbus:
265
self.dbus_object_path = (dbus.ObjectPath
266
("/clients/"
267
+ self.name.replace(".", "_")))
268
dbus.service.Object.__init__(self, bus,
269
self.dbus_object_path)
270
271
def enable(self):
257
272
"""Start this client's checker and timeout hooks"""
273
self.last_enabled = datetime.datetime.utcnow()
258
274
# Schedule a new checker to be started an 'interval' from now,
259
275
# and every interval from then on.
260
self.checker_initiator_tag = gobject.timeout_add\
261
(self._interval_milliseconds,
262
self.start_checker)
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self.interval_milliseconds(),
278
self.start_checker))
263
279
# Also start a new checker *right now*.
264
280
self.start_checker()
265
# Schedule a stop() when 'timeout' has passed
266
self.stop_initiator_tag = gobject.timeout_add\
267
(self._timeout_milliseconds,
268
self.stop)
269
def stop(self):
270
"""Stop this client.
271
The possibility that a client might be restarted is left open,
272
but not currently used."""
273
# If this client doesn't have a secret, it is already stopped.
274
if hasattr(self, "secret") and self.secret:
275
logger.info(u"Stopping client %s", self.name)
276
self.secret = None
277
else:
281
# Schedule a disable() when 'timeout' has passed
282
self.disable_initiator_tag = (gobject.timeout_add
283
(self.timeout_milliseconds(),
284
self.disable))
285
self.enabled = True
286
if self.use_dbus:
287
# Emit D-Bus signals
288
self.PropertyChanged(dbus.String(u"enabled"),
289
dbus.Boolean(True, variant_level=1))
290
self.PropertyChanged(dbus.String(u"last_enabled"),
291
(_datetime_to_dbus(self.last_enabled,
292
variant_level=1)))
293
294
def disable(self):
295
"""Disable this client."""
296
if not getattr(self, "enabled", False):
278
297
return False
279
if getattr(self, "stop_initiator_tag", False):
280
gobject.source_remove(self.stop_initiator_tag)
281
self.stop_initiator_tag = None
298
logger.info(u"Disabling client %s", self.name)
299
if getattr(self, "disable_initiator_tag", False):
300
gobject.source_remove(self.disable_initiator_tag)
301
self.disable_initiator_tag = None
282
302
if getattr(self, "checker_initiator_tag", False):
283
303
gobject.source_remove(self.checker_initiator_tag)
284
304
self.checker_initiator_tag = None
285
305
self.stop_checker()
286
if self.stop_hook:
287
self.stop_hook(self)
306
if self.disable_hook:
307
self.disable_hook(self)
308
self.enabled = False
309
if self.use_dbus:
310
# Emit D-Bus signal
311
self.PropertyChanged(dbus.String(u"enabled"),
312
dbus.Boolean(False, variant_level=1))
288
313
# Do not run this again if called by a gobject.timeout_add
289
314
return False
315
290
316
def __del__(self):
291
self.stop_hook = None
292
self.stop()
293
def checker_callback(self, pid, condition):
317
self.disable_hook = None
318
self.disable()
319
320
def checker_callback(self, pid, condition, command):
294
321
"""The checker has completed, so take appropriate actions."""
295
now = datetime.datetime.now()
296
322
self.checker_callback_tag = None
297
323
self.checker = None
298
if os.WIFEXITED(condition) \
299
and (os.WEXITSTATUS(condition) == 0):
300
logger.info(u"Checker for %(name)s succeeded",
301
vars(self))
302
self.last_checked_ok = now
303
gobject.source_remove(self.stop_initiator_tag)
304
self.stop_initiator_tag = gobject.timeout_add\
305
(self._timeout_milliseconds,
306
self.stop)
307
elif not os.WIFEXITED(condition):
324
if self.use_dbus:
325
# Emit D-Bus signal
326
self.PropertyChanged(dbus.String(u"checker_running"),
327
dbus.Boolean(False, variant_level=1))
328
if os.WIFEXITED(condition):
329
exitstatus = os.WEXITSTATUS(condition)
330
if exitstatus == 0:
331
logger.info(u"Checker for %(name)s succeeded",
332
vars(self))
333
self.checked_ok()
334
else:
335
logger.info(u"Checker for %(name)s failed",
336
vars(self))
337
if self.use_dbus:
338
# Emit D-Bus signal
339
self.CheckerCompleted(dbus.Int16(exitstatus),
340
dbus.Int64(condition),
341
dbus.String(command))
342
else:
308
343
logger.warning(u"Checker for %(name)s crashed?",
309
344
vars(self))
310
else:
311
logger.info(u"Checker for %(name)s failed",
312
vars(self))
345
if self.use_dbus:
346
# Emit D-Bus signal
347
self.CheckerCompleted(dbus.Int16(-1),
348
dbus.Int64(condition),
349
dbus.String(command))
350
351
def checked_ok(self):
352
"""Bump up the timeout for this client.
353
This should only be called when the client has been seen,
354
alive and well.
355
"""
356
self.last_checked_ok = datetime.datetime.utcnow()
357
gobject.source_remove(self.disable_initiator_tag)
358
self.disable_initiator_tag = (gobject.timeout_add
359
(self.timeout_milliseconds(),
360
self.disable))
361
if self.use_dbus:
362
# Emit D-Bus signal
363
self.PropertyChanged(
364
dbus.String(u"last_checked_ok"),
365
(_datetime_to_dbus(self.last_checked_ok,
366
variant_level=1)))
367
313
368
def start_checker(self):
314
369
"""Start a new checker subprocess if one is not running.
315
370
If a checker already exists, leave it running and do
324
379
# is as it should be.
325
380
if self.checker is None:
326
381
try:
327
# In case check_command has exactly one % operator
328
command = self.check_command % self.host
382
# In case checker_command has exactly one % operator
383
command = self.checker_command % self.host
329
384
except TypeError:
330
385
# Escape attributes for the shell
331
386
escaped_attrs = dict((key, re.escape(str(val)))
332
387
for key, val in
333
388
vars(self).iteritems())
334
389
try:
335
command = self.check_command % escaped_attrs
390
command = self.checker_command % escaped_attrs
336
391
except TypeError, error:
337
392
logger.error(u'Could not format string "%s":'
338
u' %s', self.check_command, error)
393
u' %s', self.checker_command, error)
339
394
return True # Try again later
340
395
try:
341
396
logger.info(u"Starting checker %r for %s",
347
402
self.checker = subprocess.Popen(command,
348
403
close_fds=True,
349
404
shell=True, cwd="/")
350
self.checker_callback_tag = gobject.child_watch_add\
351
(self.checker.pid,
352
self.checker_callback)
405
if self.use_dbus:
406
# Emit D-Bus signal
407
self.CheckerStarted(command)
408
self.PropertyChanged(
409
dbus.String("checker_running"),
410
dbus.Boolean(True, variant_level=1))
411
self.checker_callback_tag = (gobject.child_watch_add
412
(self.checker.pid,
413
self.checker_callback,
414
data=command))
353
415
except OSError, error:
354
416
logger.error(u"Failed to start subprocess: %s",
355
417
error)
356
418
# Re-run this periodically if run by gobject.timeout_add
357
419
return True
420
358
421
def stop_checker(self):
359
422
"""Force the checker process, if any, to stop."""
360
423
if self.checker_callback_tag:
372
435
if error.errno != errno.ESRCH: # No such process
373
436
raise
374
437
self.checker = None
438
if self.use_dbus:
439
self.PropertyChanged(dbus.String(u"checker_running"),
440
dbus.Boolean(False, variant_level=1))
441
375
442
def still_valid(self):
376
443
"""Has the timeout not yet passed for this client?"""
377
now = datetime.datetime.now()
444
if not getattr(self, "enabled", False):
445
return False
446
now = datetime.datetime.utcnow()
378
447
if self.last_checked_ok is None:
379
448
return now < (self.created + self.timeout)
380
449
else:
381
450
return now < (self.last_checked_ok + self.timeout)
451
452
## D-Bus methods & signals
453
_interface = u"se.bsnet.fukt.Mandos.Client"
454
455
# CheckedOK - method
456
CheckedOK = dbus.service.method(_interface)(checked_ok)
457
CheckedOK.__name__ = "CheckedOK"
458
459
# CheckerCompleted - signal
460
@dbus.service.signal(_interface, signature="nxs")
461
def CheckerCompleted(self, exitcode, waitstatus, command):
462
"D-Bus signal"
463
pass
464
465
# CheckerStarted - signal
466
@dbus.service.signal(_interface, signature="s")
467
def CheckerStarted(self, command):
468
"D-Bus signal"
469
pass
470
471
# GetAllProperties - method
472
@dbus.service.method(_interface, out_signature="a{sv}")
473
def GetAllProperties(self):
474
"D-Bus method"
475
return dbus.Dictionary({
476
dbus.String("name"):
477
dbus.String(self.name, variant_level=1),
478
dbus.String("fingerprint"):
479
dbus.String(self.fingerprint, variant_level=1),
480
dbus.String("host"):
481
dbus.String(self.host, variant_level=1),
482
dbus.String("created"):
483
_datetime_to_dbus(self.created, variant_level=1),
484
dbus.String("last_enabled"):
485
(_datetime_to_dbus(self.last_enabled,
486
variant_level=1)
487
if self.last_enabled is not None
488
else dbus.Boolean(False, variant_level=1)),
489
dbus.String("enabled"):
490
dbus.Boolean(self.enabled, variant_level=1),
491
dbus.String("last_checked_ok"):
492
(_datetime_to_dbus(self.last_checked_ok,
493
variant_level=1)
494
if self.last_checked_ok is not None
495
else dbus.Boolean (False, variant_level=1)),
496
dbus.String("timeout"):
497
dbus.UInt64(self.timeout_milliseconds(),
498
variant_level=1),
499
dbus.String("interval"):
500
dbus.UInt64(self.interval_milliseconds(),
501
variant_level=1),
502
dbus.String("checker"):
503
dbus.String(self.checker_command,
504
variant_level=1),
505
dbus.String("checker_running"):
506
dbus.Boolean(self.checker is not None,
507
variant_level=1),
508
dbus.String("object_path"):
509
dbus.ObjectPath(self.dbus_object_path,
510
variant_level=1)
511
}, signature="sv")
512
513
# IsStillValid - method
514
IsStillValid = (dbus.service.method(_interface, out_signature="b")
515
(still_valid))
516
IsStillValid.__name__ = "IsStillValid"
517
518
# PropertyChanged - signal
519
@dbus.service.signal(_interface, signature="sv")
520
def PropertyChanged(self, property, value):
521
"D-Bus signal"
522
pass
523
524
# SetChecker - method
525
@dbus.service.method(_interface, in_signature="s")
526
def SetChecker(self, checker):
527
"D-Bus setter method"
528
self.checker_command = checker
529
# Emit D-Bus signal
530
self.PropertyChanged(dbus.String(u"checker"),
531
dbus.String(self.checker_command,
532
variant_level=1))
533
534
# SetHost - method
535
@dbus.service.method(_interface, in_signature="s")
536
def SetHost(self, host):
537
"D-Bus setter method"
538
self.host = host
539
# Emit D-Bus signal
540
self.PropertyChanged(dbus.String(u"host"),
541
dbus.String(self.host, variant_level=1))
542
543
# SetInterval - method
544
@dbus.service.method(_interface, in_signature="t")
545
def SetInterval(self, milliseconds):
546
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
547
# Emit D-Bus signal
548
self.PropertyChanged(dbus.String(u"interval"),
549
(dbus.UInt64(self.interval_milliseconds(),
550
variant_level=1)))
551
552
# SetSecret - method
553
@dbus.service.method(_interface, in_signature="ay",
554
byte_arrays=True)
555
def SetSecret(self, secret):
556
"D-Bus setter method"
557
self.secret = str(secret)
558
559
# SetTimeout - method
560
@dbus.service.method(_interface, in_signature="t")
561
def SetTimeout(self, milliseconds):
562
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
563
# Emit D-Bus signal
564
self.PropertyChanged(dbus.String(u"timeout"),
565
(dbus.UInt64(self.timeout_milliseconds(),
566
variant_level=1)))
567
568
# Enable - method
569
Enable = dbus.service.method(_interface)(enable)
570
Enable.__name__ = "Enable"
571
572
# StartChecker - method
573
@dbus.service.method(_interface)
574
def StartChecker(self):
575
"D-Bus method"
576
self.start_checker()
577
578
# Disable - method
579
@dbus.service.method(_interface)
580
def Disable(self):
581
"D-Bus method"
582
self.disable()
583
584
# StopChecker - method
585
StopChecker = dbus.service.method(_interface)(stop_checker)
586
StopChecker.__name__ = "StopChecker"
587
588
del _interface
382
589
383
590
384
591
def peer_certificate(session):
385
592
"Return the peer's OpenPGP certificate as a bytestring"
386
593
# If not an OpenPGP certificate...
387
if gnutls.library.functions.gnutls_certificate_type_get\
388
(session._c_object) \
389
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
594
if (gnutls.library.functions
595
.gnutls_certificate_type_get(session._c_object)
596
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
390
597
# ...do the normal thing
391
598
return session.peer_certificate
392
list_size = ctypes.c_uint()
393
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
394
(session._c_object, ctypes.byref(list_size))
599
list_size = ctypes.c_uint(1)
600
cert_list = (gnutls.library.functions
601
.gnutls_certificate_get_peers
602
(session._c_object, ctypes.byref(list_size)))
603
if not bool(cert_list) and list_size.value != 0:
604
raise gnutls.errors.GNUTLSError("error getting peer"
605
" certificate")
395
606
if list_size.value == 0:
396
607
return None
397
608
cert = cert_list[0]
401
612
def fingerprint(openpgp):
402
613
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
403
614
# New GnuTLS "datum" with the OpenPGP public key
404
datum = gnutls.library.types.gnutls_datum_t\
405
(ctypes.cast(ctypes.c_char_p(openpgp),
406
ctypes.POINTER(ctypes.c_ubyte)),
407
ctypes.c_uint(len(openpgp)))
615
datum = (gnutls.library.types
616
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
617
ctypes.POINTER
618
(ctypes.c_ubyte)),
619
ctypes.c_uint(len(openpgp))))
408
620
# New empty GnuTLS certificate
409
621
crt = gnutls.library.types.gnutls_openpgp_crt_t()
410
gnutls.library.functions.gnutls_openpgp_crt_init\
411
(ctypes.byref(crt))
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
412
624
# Import the OpenPGP public key into the certificate
413
gnutls.library.functions.gnutls_openpgp_crt_import\
414
(crt, ctypes.byref(datum),
415
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
627
gnutls.library.constants
628
.GNUTLS_OPENPGP_FMT_RAW))
416
629
# Verify the self signature in the key
417
crtverify = ctypes.c_uint();
418
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
419
(crt, 0, ctypes.byref(crtverify))
630
crtverify = ctypes.c_uint()
631
(gnutls.library.functions
632
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
420
633
if crtverify.value != 0:
421
634
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
422
635
raise gnutls.errors.CertificateSecurityError("Verify failed")
423
636
# New buffer for the fingerprint
424
buffer = ctypes.create_string_buffer(20)
425
buffer_length = ctypes.c_size_t()
637
buf = ctypes.create_string_buffer(20)
638
buf_len = ctypes.c_size_t()
426
639
# Get the fingerprint from the certificate into the buffer
427
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
428
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
640
(gnutls.library.functions
641
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
642
ctypes.byref(buf_len)))
429
643
# Deinit the certificate
430
644
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
431
645
# Convert the buffer to a Python bytestring
432
fpr = ctypes.string_at(buffer, buffer_length.value)
646
fpr = ctypes.string_at(buf, buf_len.value)
433
647
# Convert the bytestring to hexadecimal notation
434
648
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
435
649
return hex_fpr
436
650
437
651
438
class tcp_handler(SocketServer.BaseRequestHandler, object):
652
class TCP_handler(SocketServer.BaseRequestHandler, object):
439
653
"""A TCP request handler class.
440
654
Instantiated by IPv6_TCPServer for each request to handle it.
441
655
Note: This will run in its own forked process."""
442
656
443
657
def handle(self):
444
658
logger.info(u"TCP connection from: %s",
445
unicode(self.client_address))
446
session = gnutls.connection.ClientSession\
447
(self.request, gnutls.connection.X509Credentials())
659
unicode(self.client_address))
660
session = (gnutls.connection
661
.ClientSession(self.request,
662
gnutls.connection
663
.X509Credentials()))
448
664
449
665
line = self.request.makefile().readline()
450
666
logger.debug(u"Protocol version: %r", line)
461
677
# using OpenPGP certificates.
462
678
463
679
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
464
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
465
# "+DHE-DSS"))
466
priority = "NORMAL" # Fallback default, since this
467
# MUST be set.
468
if self.server.settings["priority"]:
469
priority = self.server.settings["priority"]
470
gnutls.library.functions.gnutls_priority_set_direct\
471
(session._c_object, priority, None);
680
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
681
# "+DHE-DSS"))
682
# Use a fallback default, since this MUST be set.
683
priority = self.server.settings.get("priority", "NORMAL")
684
(gnutls.library.functions
685
.gnutls_priority_set_direct(session._c_object,
686
priority, None))
472
687
473
688
try:
474
689
session.handshake()
477
692
# Do not run session.bye() here: the session is not
478
693
# established. Just abandon the request.
479
694
return
695
logger.debug(u"Handshake succeeded")
480
696
try:
481
697
fpr = fingerprint(peer_certificate(session))
482
698
except (TypeError, gnutls.errors.GNUTLSError), error:
484
700
session.bye()
485
701
return
486
702
logger.debug(u"Fingerprint: %s", fpr)
487
client = None
703
488
704
for c in self.server.clients:
489
705
if c.fingerprint == fpr:
490
706
client = c
491
707
break
492
if not client:
708
else:
493
709
logger.warning(u"Client not found for fingerprint: %s",
494
710
fpr)
495
711
session.bye()
502
718
vars(client))
503
719
session.bye()
504
720
return
721
## This won't work here, since we're in a fork.
722
# client.checked_ok()
505
723
sent_size = 0
506
724
while sent_size < len(client.secret):
507
725
sent = session.send(client.secret[sent_size:])
512
730
session.bye()
513
731
514
732
515
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
733
class IPv6_TCPServer(SocketServer.ForkingMixIn,
734
SocketServer.TCPServer, object):
516
735
"""IPv6 TCP server. Accepts 'None' as address and/or port.
517
736
Attributes:
518
737
settings: Server settings
519
738
clients: Set() of Client objects
739
enabled: Boolean; whether this server is activated yet
520
740
"""
521
741
address_family = socket.AF_INET6
522
742
def __init__(self, *args, **kwargs):
526
746
if "clients" in kwargs:
527
747
self.clients = kwargs["clients"]
528
748
del kwargs["clients"]
529
return super(type(self), self).__init__(*args, **kwargs)
749
self.enabled = False
750
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
530
751
def server_bind(self):
531
752
"""This overrides the normal server_bind() function
532
753
to bind to an interface if one was specified, and also NOT to
544
765
u" bind to interface %s",
545
766
self.settings["interface"])
546
767
else:
547
raise error
768
raise
548
769
# Only bind(2) the socket if we really need to.
549
770
if self.server_address[0] or self.server_address[1]:
550
771
if not self.server_address[0]:
561
782
# if_nametoindex
562
783
# (self.settings
563
784
# ["interface"]))
564
return super(type(self), self).server_bind()
785
return super(IPv6_TCPServer, self).server_bind()
786
def server_activate(self):
787
if self.enabled:
788
return super(IPv6_TCPServer, self).server_activate()
789
def enable(self):
790
self.enabled = True
565
791
566
792
567
793
def string_to_delta(interval):
568
794
"""Parse a string and return a datetime.timedelta
569
795
570
796
>>> string_to_delta('7d')
571
797
datetime.timedelta(7)
572
798
>>> string_to_delta('60s')
583
809
timevalue = datetime.timedelta(0)
584
810
for s in interval.split():
585
811
try:
586
suffix=unicode(s[-1])
587
value=int(s[:-1])
812
suffix = unicode(s[-1])
813
value = int(s[:-1])
588
814
if suffix == u"d":
589
815
delta = datetime.timedelta(value)
590
816
elif suffix == u"s":
624
850
elif state == avahi.ENTRY_GROUP_FAILURE:
625
851
logger.critical(u"Avahi: Error in group state changed %s",
626
852
unicode(error))
627
raise AvahiGroupError("State changed: %s", str(error))
853
raise AvahiGroupError(u"State changed: %s" % unicode(error))
628
854
629
855
def if_nametoindex(interface):
630
856
"""Call the C function if_nametoindex(), or equivalent"""
631
857
global if_nametoindex
632
858
try:
633
if "ctypes.util" not in sys.modules:
634
import ctypes.util
635
if_nametoindex = ctypes.cdll.LoadLibrary\
636
(ctypes.util.find_library("c")).if_nametoindex
859
if_nametoindex = (ctypes.cdll.LoadLibrary
860
(ctypes.util.find_library("c"))
861
.if_nametoindex)
637
862
except (OSError, AttributeError):
638
863
if "struct" not in sys.modules:
639
864
import struct
642
867
def if_nametoindex(interface):
643
868
"Get an interface index the hard way, i.e. using fcntl()"
644
869
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
645
s = socket.socket()
646
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
647
struct.pack("16s16x", interface))
648
s.close()
870
with closing(socket.socket()) as s:
871
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
872
struct.pack("16s16x", interface))
649
873
interface_index = struct.unpack("I", ifreq[16:20])[0]
650
874
return interface_index
651
875
return if_nametoindex(interface)
675
899
676
900
677
901
def main():
678
global main_loop_started
679
main_loop_started = False
680
681
parser = OptionParser(version = "%%prog %s" % version)
902
parser = optparse.OptionParser(version = "%%prog %s" % version)
682
903
parser.add_option("-i", "--interface", type="string",
683
904
metavar="IF", help="Bind to interface IF")
684
905
parser.add_option("-a", "--address", type="string",
685
906
help="Address to listen for requests on")
686
907
parser.add_option("-p", "--port", type="int",
687
908
help="Port number to receive requests on")
688
parser.add_option("--check", action="store_true", default=False,
909
parser.add_option("--check", action="store_true",
689
910
help="Run self-test")
690
911
parser.add_option("--debug", action="store_true",
691
912
help="Debug mode; run in foreground and log to"
698
919
default="/etc/mandos", metavar="DIR",
699
920
help="Directory to search for configuration"
700
921
" files")
701
(options, args) = parser.parse_args()
922
parser.add_option("--no-dbus", action="store_false",
923
dest="use_dbus",
924
help="Do not provide D-Bus system bus"
925
" interface")
926
options = parser.parse_args()[0]
702
927
703
928
if options.check:
704
929
import doctest
713
938
"priority":
714
939
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
715
940
"servicename": "Mandos",
941
"use_dbus": "True",
716
942
}
717
943
718
944
# Parse config file for server-global settings
721
947
server_config.read(os.path.join(options.configdir, "mandos.conf"))
722
948
# Convert the SafeConfigParser object to a dict
723
949
server_settings = server_config.defaults()
724
# Use getboolean on the boolean config option
725
server_settings["debug"] = server_config.getboolean\
726
("DEFAULT", "debug")
950
# Use the appropriate methods on the non-string config options
951
server_settings["debug"] = server_config.getboolean("DEFAULT",
952
"debug")
953
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
954
"use_dbus")
955
if server_settings["port"]:
956
server_settings["port"] = server_config.getint("DEFAULT",
957
"port")
727
958
del server_config
728
959
729
960
# Override the settings from the config file with command line
730
961
# options, if set.
731
962
for option in ("interface", "address", "port", "debug",
732
"priority", "servicename", "configdir"):
963
"priority", "servicename", "configdir",
964
"use_dbus"):
733
965
value = getattr(options, option)
734
966
if value is not None:
735
967
server_settings[option] = value
736
968
del options
737
969
# Now we have our good server settings in "server_settings"
738
970
971
# For convenience
739
972
debug = server_settings["debug"]
973
use_dbus = server_settings["use_dbus"]
740
974
741
975
if not debug:
742
976
syslogger.setLevel(logging.WARNING)
743
977
console.setLevel(logging.WARNING)
744
978
745
979
if server_settings["servicename"] != "Mandos":
746
syslogger.setFormatter(logging.Formatter\
980
syslogger.setFormatter(logging.Formatter
747
981
('Mandos (%s): %%(levelname)s:'
748
982
' %%(message)s'
749
983
% server_settings["servicename"]))
751
985
# Parse config file with clients
752
986
client_defaults = { "timeout": "1h",
753
987
"interval": "5m",
754
"checker": "fping -q -- %(host)s",
988
"checker": "fping -q -- %%(host)s",
755
989
"host": "",
756
990
}
757
991
client_config = ConfigParser.SafeConfigParser(client_defaults)
758
992
client_config.read(os.path.join(server_settings["configdir"],
759
993
"clients.conf"))
760
994
995
clients = Set()
996
tcp_server = IPv6_TCPServer((server_settings["address"],
997
server_settings["port"]),
998
TCP_handler,
999
settings=server_settings,
1000
clients=clients)
1001
pidfilename = "/var/run/mandos.pid"
1002
try:
1003
pidfile = open(pidfilename, "w")
1004
except IOError:
1005
logger.error("Could not open file %r", pidfilename)
1006
1007
try:
1008
uid = pwd.getpwnam("_mandos").pw_uid
1009
gid = pwd.getpwnam("_mandos").pw_gid
1010
except KeyError:
1011
try:
1012
uid = pwd.getpwnam("mandos").pw_uid
1013
gid = pwd.getpwnam("mandos").pw_gid
1014
except KeyError:
1015
try:
1016
uid = pwd.getpwnam("nobody").pw_uid
1017
gid = pwd.getpwnam("nogroup").pw_gid
1018
except KeyError:
1019
uid = 65534
1020
gid = 65534
1021
try:
1022
os.setgid(gid)
1023
os.setuid(uid)
1024
except OSError, error:
1025
if error[0] != errno.EPERM:
1026
raise error
1027
1028
# Enable all possible GnuTLS debugging
1029
if debug:
1030
# "Use a log level over 10 to enable all debugging options."
1031
# - GnuTLS manual
1032
gnutls.library.functions.gnutls_global_set_log_level(11)
1033
1034
@gnutls.library.types.gnutls_log_func
1035
def debug_gnutls(level, string):
1036
logger.debug("GnuTLS: %s", string[:-1])
1037
1038
(gnutls.library.functions
1039
.gnutls_global_set_log_function(debug_gnutls))
1040
761
1041
global service
762
1042
service = AvahiService(name = server_settings["servicename"],
763
type = "_mandos._tcp", );
1043
servicetype = "_mandos._tcp", )
764
1044
if server_settings["interface"]:
765
service.interface = if_nametoindex\
766
(server_settings["interface"])
1045
service.interface = (if_nametoindex
1046
(server_settings["interface"]))
767
1047
768
1048
global main_loop
769
1049
global bus
776
1056
avahi.DBUS_PATH_SERVER),
777
1057
avahi.DBUS_INTERFACE_SERVER)
778
1058
# End of Avahi example code
779
780
clients = Set()
781
def remove_from_clients(client):
782
clients.remove(client)
783
if not clients:
784
logger.critical(u"No clients left, exiting")
785
sys.exit()
1059
if use_dbus:
1060
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
786
1061
787
1062
clients.update(Set(Client(name = section,
788
stop_hook = remove_from_clients,
789
1063
config
790
= dict(client_config.items(section)))
1064
= dict(client_config.items(section)),
1065
use_dbus = use_dbus)
791
1066
for section in client_config.sections()))
792
1067
if not clients:
793
logger.critical(u"No clients defined")
794
sys.exit(1)
1068
logger.warning(u"No clients defined")
795
1069
796
1070
if debug:
797
1071
# Redirect stdin so all checkers get /dev/null
805
1079
# Close all input and output, do double fork, etc.
806
1080
daemon()
807
1081
808
pidfilename = "/var/run/mandos/mandos.pid"
809
pid = os.getpid()
810
1082
try:
811
pidfile = open(pidfilename, "w")
1083
pid = os.getpid()
812
1084
pidfile.write(str(pid) + "\n")
813
1085
pidfile.close()
814
1086
del pidfile
815
except IOError, err:
816
logger.error(u"Could not write %s file with PID %d",
817
pidfilename, os.getpid())
1087
except IOError:
1088
logger.error(u"Could not write to file %r with PID %d",
1089
pidfilename, pid)
1090
except NameError:
1091
# "pidfile" was never created
1092
pass
1093
del pidfilename
818
1094
819
1095
def cleanup():
820
1096
"Cleanup function; run on exit"
827
1103
828
1104
while clients:
829
1105
client = clients.pop()
830
client.stop_hook = None
831
client.stop()
1106
client.disable_hook = None
1107
client.disable()
832
1108
833
1109
atexit.register(cleanup)
834
1110
837
1113
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
838
1114
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
839
1115
1116
if use_dbus:
1117
class MandosServer(dbus.service.Object):
1118
"""A D-Bus proxy object"""
1119
def __init__(self):
1120
dbus.service.Object.__init__(self, bus, "/")
1121
_interface = u"se.bsnet.fukt.Mandos"
1122
1123
@dbus.service.signal(_interface, signature="oa{sv}")
1124
def ClientAdded(self, objpath, properties):
1125
"D-Bus signal"
1126
pass
1127
1128
@dbus.service.signal(_interface, signature="os")
1129
def ClientRemoved(self, objpath, name):
1130
"D-Bus signal"
1131
pass
1132
1133
@dbus.service.method(_interface, out_signature="ao")
1134
def GetAllClients(self):
1135
"D-Bus method"
1136
return dbus.Array(c.dbus_object_path for c in clients)
1137
1138
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1139
def GetAllClientsWithProperties(self):
1140
"D-Bus method"
1141
return dbus.Dictionary(
1142
((c.dbus_object_path, c.GetAllProperties())
1143
for c in clients),
1144
signature="oa{sv}")
1145
1146
@dbus.service.method(_interface, in_signature="o")
1147
def RemoveClient(self, object_path):
1148
"D-Bus method"
1149
for c in clients:
1150
if c.dbus_object_path == object_path:
1151
clients.remove(c)
1152
# Don't signal anything except ClientRemoved
1153
c.use_dbus = False
1154
c.disable()
1155
# Emit D-Bus signal
1156
self.ClientRemoved(object_path, c.name)
1157
return
1158
raise KeyError
1159
1160
del _interface
1161
1162
mandos_server = MandosServer()
1163
840
1164
for client in clients:
841
client.start()
842
843
tcp_server = IPv6_TCPServer((server_settings["address"],
844
server_settings["port"]),
845
tcp_handler,
846
settings=server_settings,
847
clients=clients)
1165
if use_dbus:
1166
# Emit D-Bus signal
1167
mandos_server.ClientAdded(client.dbus_object_path,
1168
client.GetAllProperties())
1169
client.enable()
1170
1171
tcp_server.enable()
1172
tcp_server.server_activate()
1173
848
1174
# Find out what port we got
849
1175
service.port = tcp_server.socket.getsockname()[1]
850
1176
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
864
1190
865
1191
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
866
1192
lambda *args, **kwargs:
867
tcp_server.handle_request\
868
(*args[2:], **kwargs) or True)
1193
(tcp_server.handle_request
1194
(*args[2:], **kwargs) or True))
869
1195
870
1196
logger.debug(u"Starting main loop")
871
main_loop_started = True
872
1197
main_loop.run()
873
1198
except AvahiError, error:
874
logger.critical(u"AvahiError: %s" + unicode(error))
1199
logger.critical(u"AvahiError: %s", error)
875
1200
sys.exit(1)
876
1201
except KeyboardInterrupt:
877
1202
if debug:
878
print
1203
print >> sys.stderr
1204
logger.debug("Server received KeyboardInterrupt")
1205
logger.debug("Server exiting")
879
1206
880
1207
if __name__ == '__main__':
881
1208
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0