To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 305
- compare with another revision
- download diff
- download tarball
- view history from revision 305
- Committer: Teddy Hogeborn
- Date: 2009-02-09 02:13:58 UTC
- Revision ID: teddy@fukt.bsnet.se-20090209021358-6nrlc91oi08hn5hb
* initramfs-tools-hook: Whitespace change only.
- files added:
- NEWS
- files removed:
- debian/mandos-client.config
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
30
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
32
#
32
33
33
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
34
35
35
36
import SocketServer
36
37
import socket
37
import select
38
from optparse import OptionParser
38
import optparse
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
56
56
import logging
57
57
import logging.handlers
58
58
import pwd
59
from contextlib import closing
59
60
60
61
import dbus
62
import dbus.service
61
63
import gobject
62
64
import avahi
63
65
from dbus.mainloop.glib import DBusGMainLoop
64
66
import ctypes
67
import ctypes.util
65
68
66
version = "1.0"
69
version = "1.0.5"
67
70
68
71
logger = logging.Logger('mandos')
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
74
78
logger.addHandler(syslogger)
75
79
76
80
console = logging.StreamHandler()
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
' %(message)s'))
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
79
83
logger.addHandler(console)
80
84
81
85
class AvahiError(Exception):
82
def __init__(self, value):
86
def __init__(self, value, *args, **kwargs):
83
87
self.value = value
84
def __str__(self):
85
return repr(self.value)
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
86
91
87
92
class AvahiServiceError(AvahiError):
88
93
pass
108
113
a sensible number of times
109
114
"""
110
115
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
111
type = None, port = None, TXT = None, domain = "",
112
host = "", max_renames = 32768):
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768):
113
118
self.interface = interface
114
119
self.name = name
115
self.type = type
120
self.type = servicetype
116
121
self.port = port
117
if TXT is None:
118
self.TXT = []
119
else:
120
self.TXT = TXT
122
self.TXT = TXT if TXT is not None else []
121
123
self.domain = domain
122
124
self.host = host
123
125
self.rename_count = 0
127
129
if self.rename_count >= self.max_renames:
128
130
logger.critical(u"No suitable Zeroconf service name found"
129
131
u" after %i retries, exiting.",
130
rename_count)
131
raise AvahiServiceError("Too many renames")
132
self.rename_count)
133
raise AvahiServiceError(u"Too many renames")
132
134
self.name = server.GetAlternativeServiceName(self.name)
133
135
logger.info(u"Changing Zeroconf service name to %r ...",
134
136
str(self.name))
135
syslogger.setFormatter(logging.Formatter\
137
syslogger.setFormatter(logging.Formatter
136
138
('Mandos (%s): %%(levelname)s:'
137
' %%(message)s' % self.name))
139
' %%(message)s' % self.name))
138
140
self.remove()
139
141
self.add()
140
142
self.rename_count += 1
146
148
"""Derived from the Avahi example code"""
147
149
global group
148
150
if group is None:
149
group = dbus.Interface\
150
(bus.get_object(avahi.DBUS_NAME,
151
group = dbus.Interface(bus.get_object
152
(avahi.DBUS_NAME,
151
153
server.EntryGroupNew()),
152
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
155
group.connect_to_signal('StateChanged',
154
156
entry_group_state_changed)
155
157
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
169
171
# End of Avahi example code
170
172
171
173
172
class Client(object):
174
def _datetime_to_dbus(dt, variant_level=0):
175
"""Convert a UTC datetime.datetime() to a D-Bus type."""
176
return dbus.String(dt.isoformat(), variant_level=variant_level)
177
178
179
class Client(dbus.service.Object):
173
180
"""A representation of a client host served by this server.
174
181
Attributes:
175
name: string; from the config file, used in log messages
182
name: string; from the config file, used in log messages and
183
D-Bus identifiers
176
184
fingerprint: string (40 or 32 hexadecimal digits); used to
177
185
uniquely identify the client
178
secret: bytestring; sent verbatim (over TLS) to client
179
host: string; available for use by the checker command
180
created: datetime.datetime(); object creation, not client host
181
last_checked_ok: datetime.datetime() or None if not yet checked OK
182
timeout: datetime.timedelta(); How long from last_checked_ok
183
until this client is invalid
184
interval: datetime.timedelta(); How often to start a new checker
185
stop_hook: If set, called by stop() as stop_hook(self)
186
checker: subprocess.Popen(); a running checker process used
187
to see if the client lives.
188
'None' if no process is running.
186
secret: bytestring; sent verbatim (over TLS) to client
187
host: string; available for use by the checker command
188
created: datetime.datetime(); (UTC) object creation
189
last_enabled: datetime.datetime(); (UTC)
190
enabled: bool()
191
last_checked_ok: datetime.datetime(); (UTC) or None
192
timeout: datetime.timedelta(); How long from last_checked_ok
193
until this client is invalid
194
interval: datetime.timedelta(); How often to start a new checker
195
disable_hook: If set, called by disable() as disable_hook(self)
196
checker: subprocess.Popen(); a running checker process used
197
to see if the client lives.
198
'None' if no process is running.
189
199
checker_initiator_tag: a gobject event source tag, or None
190
stop_initiator_tag: - '' -
200
disable_initiator_tag: - '' -
191
201
checker_callback_tag: - '' -
192
202
checker_command: string; External command which is run to check if
193
203
client lives. %() expansions are done at
194
204
runtime with vars(self) as dict, so that for
195
205
instance %(name)s can be used in the command.
196
Private attibutes:
197
_timeout: Real variable for 'timeout'
198
_interval: Real variable for 'interval'
199
_timeout_milliseconds: Used when calling gobject.timeout_add()
200
_interval_milliseconds: - '' -
206
use_dbus: bool(); Whether to provide D-Bus interface and signals
207
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
201
208
"""
202
def _set_timeout(self, timeout):
203
"Setter function for 'timeout' attribute"
204
self._timeout = timeout
205
self._timeout_milliseconds = ((self.timeout.days
206
* 24 * 60 * 60 * 1000)
207
+ (self.timeout.seconds * 1000)
208
+ (self.timeout.microseconds
209
// 1000))
210
timeout = property(lambda self: self._timeout,
211
_set_timeout)
212
del _set_timeout
213
def _set_interval(self, interval):
214
"Setter function for 'interval' attribute"
215
self._interval = interval
216
self._interval_milliseconds = ((self.interval.days
217
* 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds
219
* 1000)
220
+ (self.interval.microseconds
221
// 1000))
222
interval = property(lambda self: self._interval,
223
_set_interval)
224
del _set_interval
225
def __init__(self, name = None, stop_hook=None, config={}):
209
def timeout_milliseconds(self):
210
"Return the 'timeout' attribute in milliseconds"
211
return ((self.timeout.days * 24 * 60 * 60 * 1000)
212
+ (self.timeout.seconds * 1000)
213
+ (self.timeout.microseconds // 1000))
214
215
def interval_milliseconds(self):
216
"Return the 'interval' attribute in milliseconds"
217
return ((self.interval.days * 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds * 1000)
219
+ (self.interval.microseconds // 1000))
220
221
def __init__(self, name = None, disable_hook=None, config=None,
222
use_dbus=True):
226
223
"""Note: the 'checker' key in 'config' sets the
227
224
'checker_command' attribute and *not* the 'checker'
228
225
attribute."""
229
226
self.name = name
227
if config is None:
228
config = {}
230
229
logger.debug(u"Creating client %r", self.name)
230
self.use_dbus = False # During __init__
231
231
# Uppercase and remove spaces from fingerprint for later
232
232
# comparison purposes with return value from the fingerprint()
233
233
# function
234
self.fingerprint = config["fingerprint"].upper()\
235
.replace(u" ", u"")
234
self.fingerprint = (config["fingerprint"].upper()
235
.replace(u" ", u""))
236
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
237
237
if "secret" in config:
238
238
self.secret = config["secret"].decode(u"base64")
239
239
elif "secfile" in config:
240
sf = open(config["secfile"])
241
self.secret = sf.read()
242
sf.close()
240
with closing(open(os.path.expanduser
241
(os.path.expandvars
242
(config["secfile"])))) as secfile:
243
self.secret = secfile.read()
243
244
else:
244
245
raise TypeError(u"No secret or secfile for client %s"
245
246
% self.name)
246
247
self.host = config.get("host", "")
247
self.created = datetime.datetime.now()
248
self.created = datetime.datetime.utcnow()
249
self.enabled = False
250
self.last_enabled = None
248
251
self.last_checked_ok = None
249
252
self.timeout = string_to_delta(config["timeout"])
250
253
self.interval = string_to_delta(config["interval"])
251
self.stop_hook = stop_hook
254
self.disable_hook = disable_hook
252
255
self.checker = None
253
256
self.checker_initiator_tag = None
254
self.stop_initiator_tag = None
257
self.disable_initiator_tag = None
255
258
self.checker_callback_tag = None
256
self.check_command = config["checker"]
257
def start(self):
259
self.checker_command = config["checker"]
260
self.last_connect = None
261
# Only now, when this client is initialized, can it show up on
262
# the D-Bus
263
self.use_dbus = use_dbus
264
if self.use_dbus:
265
self.dbus_object_path = (dbus.ObjectPath
266
("/clients/"
267
+ self.name.replace(".", "_")))
268
dbus.service.Object.__init__(self, bus,
269
self.dbus_object_path)
270
271
def enable(self):
258
272
"""Start this client's checker and timeout hooks"""
273
self.last_enabled = datetime.datetime.utcnow()
259
274
# Schedule a new checker to be started an 'interval' from now,
260
275
# and every interval from then on.
261
self.checker_initiator_tag = gobject.timeout_add\
262
(self._interval_milliseconds,
263
self.start_checker)
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self.interval_milliseconds(),
278
self.start_checker))
264
279
# Also start a new checker *right now*.
265
280
self.start_checker()
266
# Schedule a stop() when 'timeout' has passed
267
self.stop_initiator_tag = gobject.timeout_add\
268
(self._timeout_milliseconds,
269
self.stop)
270
def stop(self):
271
"""Stop this client.
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
274
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
276
logger.info(u"Stopping client %s", self.name)
277
self.secret = None
278
else:
281
# Schedule a disable() when 'timeout' has passed
282
self.disable_initiator_tag = (gobject.timeout_add
283
(self.timeout_milliseconds(),
284
self.disable))
285
self.enabled = True
286
if self.use_dbus:
287
# Emit D-Bus signals
288
self.PropertyChanged(dbus.String(u"enabled"),
289
dbus.Boolean(True, variant_level=1))
290
self.PropertyChanged(dbus.String(u"last_enabled"),
291
(_datetime_to_dbus(self.last_enabled,
292
variant_level=1)))
293
294
def disable(self):
295
"""Disable this client."""
296
if not getattr(self, "enabled", False):
279
297
return False
280
if getattr(self, "stop_initiator_tag", False):
281
gobject.source_remove(self.stop_initiator_tag)
282
self.stop_initiator_tag = None
298
logger.info(u"Disabling client %s", self.name)
299
if getattr(self, "disable_initiator_tag", False):
300
gobject.source_remove(self.disable_initiator_tag)
301
self.disable_initiator_tag = None
283
302
if getattr(self, "checker_initiator_tag", False):
284
303
gobject.source_remove(self.checker_initiator_tag)
285
304
self.checker_initiator_tag = None
286
305
self.stop_checker()
287
if self.stop_hook:
288
self.stop_hook(self)
306
if self.disable_hook:
307
self.disable_hook(self)
308
self.enabled = False
309
if self.use_dbus:
310
# Emit D-Bus signal
311
self.PropertyChanged(dbus.String(u"enabled"),
312
dbus.Boolean(False, variant_level=1))
289
313
# Do not run this again if called by a gobject.timeout_add
290
314
return False
315
291
316
def __del__(self):
292
self.stop_hook = None
293
self.stop()
294
def checker_callback(self, pid, condition):
317
self.disable_hook = None
318
self.disable()
319
320
def checker_callback(self, pid, condition, command):
295
321
"""The checker has completed, so take appropriate actions."""
296
now = datetime.datetime.now()
297
322
self.checker_callback_tag = None
298
323
self.checker = None
299
if os.WIFEXITED(condition) \
300
and (os.WEXITSTATUS(condition) == 0):
301
logger.info(u"Checker for %(name)s succeeded",
302
vars(self))
303
self.last_checked_ok = now
304
gobject.source_remove(self.stop_initiator_tag)
305
self.stop_initiator_tag = gobject.timeout_add\
306
(self._timeout_milliseconds,
307
self.stop)
308
elif not os.WIFEXITED(condition):
324
if self.use_dbus:
325
# Emit D-Bus signal
326
self.PropertyChanged(dbus.String(u"checker_running"),
327
dbus.Boolean(False, variant_level=1))
328
if os.WIFEXITED(condition):
329
exitstatus = os.WEXITSTATUS(condition)
330
if exitstatus == 0:
331
logger.info(u"Checker for %(name)s succeeded",
332
vars(self))
333
self.checked_ok()
334
else:
335
logger.info(u"Checker for %(name)s failed",
336
vars(self))
337
if self.use_dbus:
338
# Emit D-Bus signal
339
self.CheckerCompleted(dbus.Int16(exitstatus),
340
dbus.Int64(condition),
341
dbus.String(command))
342
else:
309
343
logger.warning(u"Checker for %(name)s crashed?",
310
344
vars(self))
311
else:
312
logger.info(u"Checker for %(name)s failed",
313
vars(self))
345
if self.use_dbus:
346
# Emit D-Bus signal
347
self.CheckerCompleted(dbus.Int16(-1),
348
dbus.Int64(condition),
349
dbus.String(command))
350
351
def checked_ok(self):
352
"""Bump up the timeout for this client.
353
This should only be called when the client has been seen,
354
alive and well.
355
"""
356
self.last_checked_ok = datetime.datetime.utcnow()
357
gobject.source_remove(self.disable_initiator_tag)
358
self.disable_initiator_tag = (gobject.timeout_add
359
(self.timeout_milliseconds(),
360
self.disable))
361
if self.use_dbus:
362
# Emit D-Bus signal
363
self.PropertyChanged(
364
dbus.String(u"last_checked_ok"),
365
(_datetime_to_dbus(self.last_checked_ok,
366
variant_level=1)))
367
314
368
def start_checker(self):
315
369
"""Start a new checker subprocess if one is not running.
316
370
If a checker already exists, leave it running and do
325
379
# is as it should be.
326
380
if self.checker is None:
327
381
try:
328
# In case check_command has exactly one % operator
329
command = self.check_command % self.host
382
# In case checker_command has exactly one % operator
383
command = self.checker_command % self.host
330
384
except TypeError:
331
385
# Escape attributes for the shell
332
386
escaped_attrs = dict((key, re.escape(str(val)))
333
387
for key, val in
334
388
vars(self).iteritems())
335
389
try:
336
command = self.check_command % escaped_attrs
390
command = self.checker_command % escaped_attrs
337
391
except TypeError, error:
338
392
logger.error(u'Could not format string "%s":'
339
u' %s', self.check_command, error)
393
u' %s', self.checker_command, error)
340
394
return True # Try again later
341
395
try:
342
396
logger.info(u"Starting checker %r for %s",
348
402
self.checker = subprocess.Popen(command,
349
403
close_fds=True,
350
404
shell=True, cwd="/")
351
self.checker_callback_tag = gobject.child_watch_add\
352
(self.checker.pid,
353
self.checker_callback)
405
if self.use_dbus:
406
# Emit D-Bus signal
407
self.CheckerStarted(command)
408
self.PropertyChanged(
409
dbus.String("checker_running"),
410
dbus.Boolean(True, variant_level=1))
411
self.checker_callback_tag = (gobject.child_watch_add
412
(self.checker.pid,
413
self.checker_callback,
414
data=command))
354
415
except OSError, error:
355
416
logger.error(u"Failed to start subprocess: %s",
356
417
error)
357
418
# Re-run this periodically if run by gobject.timeout_add
358
419
return True
420
359
421
def stop_checker(self):
360
422
"""Force the checker process, if any, to stop."""
361
423
if self.checker_callback_tag:
373
435
if error.errno != errno.ESRCH: # No such process
374
436
raise
375
437
self.checker = None
438
if self.use_dbus:
439
self.PropertyChanged(dbus.String(u"checker_running"),
440
dbus.Boolean(False, variant_level=1))
441
376
442
def still_valid(self):
377
443
"""Has the timeout not yet passed for this client?"""
378
now = datetime.datetime.now()
444
if not getattr(self, "enabled", False):
445
return False
446
now = datetime.datetime.utcnow()
379
447
if self.last_checked_ok is None:
380
448
return now < (self.created + self.timeout)
381
449
else:
382
450
return now < (self.last_checked_ok + self.timeout)
451
452
## D-Bus methods & signals
453
_interface = u"se.bsnet.fukt.Mandos.Client"
454
455
# CheckedOK - method
456
CheckedOK = dbus.service.method(_interface)(checked_ok)
457
CheckedOK.__name__ = "CheckedOK"
458
459
# CheckerCompleted - signal
460
@dbus.service.signal(_interface, signature="nxs")
461
def CheckerCompleted(self, exitcode, waitstatus, command):
462
"D-Bus signal"
463
pass
464
465
# CheckerStarted - signal
466
@dbus.service.signal(_interface, signature="s")
467
def CheckerStarted(self, command):
468
"D-Bus signal"
469
pass
470
471
# GetAllProperties - method
472
@dbus.service.method(_interface, out_signature="a{sv}")
473
def GetAllProperties(self):
474
"D-Bus method"
475
return dbus.Dictionary({
476
dbus.String("name"):
477
dbus.String(self.name, variant_level=1),
478
dbus.String("fingerprint"):
479
dbus.String(self.fingerprint, variant_level=1),
480
dbus.String("host"):
481
dbus.String(self.host, variant_level=1),
482
dbus.String("created"):
483
_datetime_to_dbus(self.created, variant_level=1),
484
dbus.String("last_enabled"):
485
(_datetime_to_dbus(self.last_enabled,
486
variant_level=1)
487
if self.last_enabled is not None
488
else dbus.Boolean(False, variant_level=1)),
489
dbus.String("enabled"):
490
dbus.Boolean(self.enabled, variant_level=1),
491
dbus.String("last_checked_ok"):
492
(_datetime_to_dbus(self.last_checked_ok,
493
variant_level=1)
494
if self.last_checked_ok is not None
495
else dbus.Boolean (False, variant_level=1)),
496
dbus.String("timeout"):
497
dbus.UInt64(self.timeout_milliseconds(),
498
variant_level=1),
499
dbus.String("interval"):
500
dbus.UInt64(self.interval_milliseconds(),
501
variant_level=1),
502
dbus.String("checker"):
503
dbus.String(self.checker_command,
504
variant_level=1),
505
dbus.String("checker_running"):
506
dbus.Boolean(self.checker is not None,
507
variant_level=1),
508
dbus.String("object_path"):
509
dbus.ObjectPath(self.dbus_object_path,
510
variant_level=1)
511
}, signature="sv")
512
513
# IsStillValid - method
514
IsStillValid = (dbus.service.method(_interface, out_signature="b")
515
(still_valid))
516
IsStillValid.__name__ = "IsStillValid"
517
518
# PropertyChanged - signal
519
@dbus.service.signal(_interface, signature="sv")
520
def PropertyChanged(self, property, value):
521
"D-Bus signal"
522
pass
523
524
# SetChecker - method
525
@dbus.service.method(_interface, in_signature="s")
526
def SetChecker(self, checker):
527
"D-Bus setter method"
528
self.checker_command = checker
529
# Emit D-Bus signal
530
self.PropertyChanged(dbus.String(u"checker"),
531
dbus.String(self.checker_command,
532
variant_level=1))
533
534
# SetHost - method
535
@dbus.service.method(_interface, in_signature="s")
536
def SetHost(self, host):
537
"D-Bus setter method"
538
self.host = host
539
# Emit D-Bus signal
540
self.PropertyChanged(dbus.String(u"host"),
541
dbus.String(self.host, variant_level=1))
542
543
# SetInterval - method
544
@dbus.service.method(_interface, in_signature="t")
545
def SetInterval(self, milliseconds):
546
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
547
# Emit D-Bus signal
548
self.PropertyChanged(dbus.String(u"interval"),
549
(dbus.UInt64(self.interval_milliseconds(),
550
variant_level=1)))
551
552
# SetSecret - method
553
@dbus.service.method(_interface, in_signature="ay",
554
byte_arrays=True)
555
def SetSecret(self, secret):
556
"D-Bus setter method"
557
self.secret = str(secret)
558
559
# SetTimeout - method
560
@dbus.service.method(_interface, in_signature="t")
561
def SetTimeout(self, milliseconds):
562
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
563
# Emit D-Bus signal
564
self.PropertyChanged(dbus.String(u"timeout"),
565
(dbus.UInt64(self.timeout_milliseconds(),
566
variant_level=1)))
567
568
# Enable - method
569
Enable = dbus.service.method(_interface)(enable)
570
Enable.__name__ = "Enable"
571
572
# StartChecker - method
573
@dbus.service.method(_interface)
574
def StartChecker(self):
575
"D-Bus method"
576
self.start_checker()
577
578
# Disable - method
579
@dbus.service.method(_interface)
580
def Disable(self):
581
"D-Bus method"
582
self.disable()
583
584
# StopChecker - method
585
StopChecker = dbus.service.method(_interface)(stop_checker)
586
StopChecker.__name__ = "StopChecker"
587
588
del _interface
383
589
384
590
385
591
def peer_certificate(session):
386
592
"Return the peer's OpenPGP certificate as a bytestring"
387
593
# If not an OpenPGP certificate...
388
if gnutls.library.functions.gnutls_certificate_type_get\
389
(session._c_object) \
390
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
594
if (gnutls.library.functions
595
.gnutls_certificate_type_get(session._c_object)
596
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
391
597
# ...do the normal thing
392
598
return session.peer_certificate
393
list_size = ctypes.c_uint()
394
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
(session._c_object, ctypes.byref(list_size))
599
list_size = ctypes.c_uint(1)
600
cert_list = (gnutls.library.functions
601
.gnutls_certificate_get_peers
602
(session._c_object, ctypes.byref(list_size)))
603
if not bool(cert_list) and list_size.value != 0:
604
raise gnutls.errors.GNUTLSError("error getting peer"
605
" certificate")
396
606
if list_size.value == 0:
397
607
return None
398
608
cert = cert_list[0]
402
612
def fingerprint(openpgp):
403
613
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
404
614
# New GnuTLS "datum" with the OpenPGP public key
405
datum = gnutls.library.types.gnutls_datum_t\
406
(ctypes.cast(ctypes.c_char_p(openpgp),
407
ctypes.POINTER(ctypes.c_ubyte)),
408
ctypes.c_uint(len(openpgp)))
615
datum = (gnutls.library.types
616
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
617
ctypes.POINTER
618
(ctypes.c_ubyte)),
619
ctypes.c_uint(len(openpgp))))
409
620
# New empty GnuTLS certificate
410
621
crt = gnutls.library.types.gnutls_openpgp_crt_t()
411
gnutls.library.functions.gnutls_openpgp_crt_init\
412
(ctypes.byref(crt))
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
413
624
# Import the OpenPGP public key into the certificate
414
gnutls.library.functions.gnutls_openpgp_crt_import\
415
(crt, ctypes.byref(datum),
416
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
627
gnutls.library.constants
628
.GNUTLS_OPENPGP_FMT_RAW))
417
629
# Verify the self signature in the key
418
crtverify = ctypes.c_uint();
419
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
(crt, 0, ctypes.byref(crtverify))
630
crtverify = ctypes.c_uint()
631
(gnutls.library.functions
632
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
421
633
if crtverify.value != 0:
422
634
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
423
635
raise gnutls.errors.CertificateSecurityError("Verify failed")
424
636
# New buffer for the fingerprint
425
buffer = ctypes.create_string_buffer(20)
426
buffer_length = ctypes.c_size_t()
637
buf = ctypes.create_string_buffer(20)
638
buf_len = ctypes.c_size_t()
427
639
# Get the fingerprint from the certificate into the buffer
428
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
640
(gnutls.library.functions
641
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
642
ctypes.byref(buf_len)))
430
643
# Deinit the certificate
431
644
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
432
645
# Convert the buffer to a Python bytestring
433
fpr = ctypes.string_at(buffer, buffer_length.value)
646
fpr = ctypes.string_at(buf, buf_len.value)
434
647
# Convert the bytestring to hexadecimal notation
435
648
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
436
649
return hex_fpr
437
650
438
651
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
652
class TCP_handler(SocketServer.BaseRequestHandler, object):
440
653
"""A TCP request handler class.
441
654
Instantiated by IPv6_TCPServer for each request to handle it.
442
655
Note: This will run in its own forked process."""
443
656
444
657
def handle(self):
445
658
logger.info(u"TCP connection from: %s",
446
unicode(self.client_address))
447
session = gnutls.connection.ClientSession\
448
(self.request, gnutls.connection.X509Credentials())
659
unicode(self.client_address))
660
session = (gnutls.connection
661
.ClientSession(self.request,
662
gnutls.connection
663
.X509Credentials()))
449
664
450
665
line = self.request.makefile().readline()
451
666
logger.debug(u"Protocol version: %r", line)
462
677
# using OpenPGP certificates.
463
678
464
679
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
465
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
466
# "+DHE-DSS"))
467
priority = "NORMAL" # Fallback default, since this
468
# MUST be set.
469
if self.server.settings["priority"]:
470
priority = self.server.settings["priority"]
471
gnutls.library.functions.gnutls_priority_set_direct\
472
(session._c_object, priority, None);
680
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
681
# "+DHE-DSS"))
682
# Use a fallback default, since this MUST be set.
683
priority = self.server.settings.get("priority", "NORMAL")
684
(gnutls.library.functions
685
.gnutls_priority_set_direct(session._c_object,
686
priority, None))
473
687
474
688
try:
475
689
session.handshake()
478
692
# Do not run session.bye() here: the session is not
479
693
# established. Just abandon the request.
480
694
return
695
logger.debug(u"Handshake succeeded")
481
696
try:
482
697
fpr = fingerprint(peer_certificate(session))
483
698
except (TypeError, gnutls.errors.GNUTLSError), error:
485
700
session.bye()
486
701
return
487
702
logger.debug(u"Fingerprint: %s", fpr)
488
client = None
703
489
704
for c in self.server.clients:
490
705
if c.fingerprint == fpr:
491
706
client = c
492
707
break
493
if not client:
708
else:
494
709
logger.warning(u"Client not found for fingerprint: %s",
495
710
fpr)
496
711
session.bye()
503
718
vars(client))
504
719
session.bye()
505
720
return
721
## This won't work here, since we're in a fork.
722
# client.checked_ok()
506
723
sent_size = 0
507
724
while sent_size < len(client.secret):
508
725
sent = session.send(client.secret[sent_size:])
513
730
session.bye()
514
731
515
732
516
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
733
class IPv6_TCPServer(SocketServer.ForkingMixIn,
734
SocketServer.TCPServer, object):
517
735
"""IPv6 TCP server. Accepts 'None' as address and/or port.
518
736
Attributes:
519
737
settings: Server settings
529
747
self.clients = kwargs["clients"]
530
748
del kwargs["clients"]
531
749
self.enabled = False
532
return super(type(self), self).__init__(*args, **kwargs)
750
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
533
751
def server_bind(self):
534
752
"""This overrides the normal server_bind() function
535
753
to bind to an interface if one was specified, and also NOT to
547
765
u" bind to interface %s",
548
766
self.settings["interface"])
549
767
else:
550
raise error
768
raise
551
769
# Only bind(2) the socket if we really need to.
552
770
if self.server_address[0] or self.server_address[1]:
553
771
if not self.server_address[0]:
564
782
# if_nametoindex
565
783
# (self.settings
566
784
# ["interface"]))
567
return super(type(self), self).server_bind()
785
return super(IPv6_TCPServer, self).server_bind()
568
786
def server_activate(self):
569
787
if self.enabled:
570
return super(type(self), self).server_activate()
788
return super(IPv6_TCPServer, self).server_activate()
571
789
def enable(self):
572
790
self.enabled = True
573
791
574
792
575
793
def string_to_delta(interval):
576
794
"""Parse a string and return a datetime.timedelta
577
795
578
796
>>> string_to_delta('7d')
579
797
datetime.timedelta(7)
580
798
>>> string_to_delta('60s')
591
809
timevalue = datetime.timedelta(0)
592
810
for s in interval.split():
593
811
try:
594
suffix=unicode(s[-1])
595
value=int(s[:-1])
812
suffix = unicode(s[-1])
813
value = int(s[:-1])
596
814
if suffix == u"d":
597
815
delta = datetime.timedelta(value)
598
816
elif suffix == u"s":
632
850
elif state == avahi.ENTRY_GROUP_FAILURE:
633
851
logger.critical(u"Avahi: Error in group state changed %s",
634
852
unicode(error))
635
raise AvahiGroupError("State changed: %s", str(error))
853
raise AvahiGroupError(u"State changed: %s" % unicode(error))
636
854
637
855
def if_nametoindex(interface):
638
856
"""Call the C function if_nametoindex(), or equivalent"""
639
857
global if_nametoindex
640
858
try:
641
if "ctypes.util" not in sys.modules:
642
import ctypes.util
643
if_nametoindex = ctypes.cdll.LoadLibrary\
644
(ctypes.util.find_library("c")).if_nametoindex
859
if_nametoindex = (ctypes.cdll.LoadLibrary
860
(ctypes.util.find_library("c"))
861
.if_nametoindex)
645
862
except (OSError, AttributeError):
646
863
if "struct" not in sys.modules:
647
864
import struct
650
867
def if_nametoindex(interface):
651
868
"Get an interface index the hard way, i.e. using fcntl()"
652
869
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
653
s = socket.socket()
654
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
655
struct.pack("16s16x", interface))
656
s.close()
870
with closing(socket.socket()) as s:
871
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
872
struct.pack("16s16x", interface))
657
873
interface_index = struct.unpack("I", ifreq[16:20])[0]
658
874
return interface_index
659
875
return if_nametoindex(interface)
683
899
684
900
685
901
def main():
686
global main_loop_started
687
main_loop_started = False
688
689
parser = OptionParser(version = "%%prog %s" % version)
902
parser = optparse.OptionParser(version = "%%prog %s" % version)
690
903
parser.add_option("-i", "--interface", type="string",
691
904
metavar="IF", help="Bind to interface IF")
692
905
parser.add_option("-a", "--address", type="string",
693
906
help="Address to listen for requests on")
694
907
parser.add_option("-p", "--port", type="int",
695
908
help="Port number to receive requests on")
696
parser.add_option("--check", action="store_true", default=False,
909
parser.add_option("--check", action="store_true",
697
910
help="Run self-test")
698
911
parser.add_option("--debug", action="store_true",
699
912
help="Debug mode; run in foreground and log to"
706
919
default="/etc/mandos", metavar="DIR",
707
920
help="Directory to search for configuration"
708
921
" files")
709
(options, args) = parser.parse_args()
922
parser.add_option("--no-dbus", action="store_false",
923
dest="use_dbus",
924
help="Do not provide D-Bus system bus"
925
" interface")
926
options = parser.parse_args()[0]
710
927
711
928
if options.check:
712
929
import doctest
721
938
"priority":
722
939
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
723
940
"servicename": "Mandos",
941
"use_dbus": "True",
724
942
}
725
943
726
944
# Parse config file for server-global settings
729
947
server_config.read(os.path.join(options.configdir, "mandos.conf"))
730
948
# Convert the SafeConfigParser object to a dict
731
949
server_settings = server_config.defaults()
732
# Use getboolean on the boolean config option
733
server_settings["debug"] = server_config.getboolean\
734
("DEFAULT", "debug")
950
# Use the appropriate methods on the non-string config options
951
server_settings["debug"] = server_config.getboolean("DEFAULT",
952
"debug")
953
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
954
"use_dbus")
955
if server_settings["port"]:
956
server_settings["port"] = server_config.getint("DEFAULT",
957
"port")
735
958
del server_config
736
959
737
960
# Override the settings from the config file with command line
738
961
# options, if set.
739
962
for option in ("interface", "address", "port", "debug",
740
"priority", "servicename", "configdir"):
963
"priority", "servicename", "configdir",
964
"use_dbus"):
741
965
value = getattr(options, option)
742
966
if value is not None:
743
967
server_settings[option] = value
744
968
del options
745
969
# Now we have our good server settings in "server_settings"
746
970
971
# For convenience
747
972
debug = server_settings["debug"]
973
use_dbus = server_settings["use_dbus"]
748
974
749
975
if not debug:
750
976
syslogger.setLevel(logging.WARNING)
751
977
console.setLevel(logging.WARNING)
752
978
753
979
if server_settings["servicename"] != "Mandos":
754
syslogger.setFormatter(logging.Formatter\
980
syslogger.setFormatter(logging.Formatter
755
981
('Mandos (%s): %%(levelname)s:'
756
982
' %%(message)s'
757
983
% server_settings["servicename"]))
759
985
# Parse config file with clients
760
986
client_defaults = { "timeout": "1h",
761
987
"interval": "5m",
762
"checker": "fping -q -- %(host)s",
988
"checker": "fping -q -- %%(host)s",
763
989
"host": "",
764
990
}
765
991
client_config = ConfigParser.SafeConfigParser(client_defaults)
769
995
clients = Set()
770
996
tcp_server = IPv6_TCPServer((server_settings["address"],
771
997
server_settings["port"]),
772
tcp_handler,
998
TCP_handler,
773
999
settings=server_settings,
774
1000
clients=clients)
775
1001
pidfilename = "/var/run/mandos.pid"
776
1002
try:
777
1003
pidfile = open(pidfilename, "w")
778
except IOError, error:
1004
except IOError:
779
1005
logger.error("Could not open file %r", pidfilename)
780
1006
781
uid = 65534
782
gid = 65534
783
try:
784
uid = pwd.getpwnam("mandos").pw_uid
785
except KeyError:
786
try:
787
uid = pwd.getpwnam("nobody").pw_uid
788
except KeyError:
789
pass
790
try:
791
gid = pwd.getpwnam("mandos").pw_gid
792
except KeyError:
793
try:
794
gid = pwd.getpwnam("nogroup").pw_gid
795
except KeyError:
796
pass
797
try:
1007
try:
1008
uid = pwd.getpwnam("_mandos").pw_uid
1009
gid = pwd.getpwnam("_mandos").pw_gid
1010
except KeyError:
1011
try:
1012
uid = pwd.getpwnam("mandos").pw_uid
1013
gid = pwd.getpwnam("mandos").pw_gid
1014
except KeyError:
1015
try:
1016
uid = pwd.getpwnam("nobody").pw_uid
1017
gid = pwd.getpwnam("nogroup").pw_gid
1018
except KeyError:
1019
uid = 65534
1020
gid = 65534
1021
try:
1022
os.setgid(gid)
798
1023
os.setuid(uid)
799
os.setgid(gid)
800
1024
except OSError, error:
801
1025
if error[0] != errno.EPERM:
802
1026
raise error
803
1027
1028
# Enable all possible GnuTLS debugging
1029
if debug:
1030
# "Use a log level over 10 to enable all debugging options."
1031
# - GnuTLS manual
1032
gnutls.library.functions.gnutls_global_set_log_level(11)
1033
1034
@gnutls.library.types.gnutls_log_func
1035
def debug_gnutls(level, string):
1036
logger.debug("GnuTLS: %s", string[:-1])
1037
1038
(gnutls.library.functions
1039
.gnutls_global_set_log_function(debug_gnutls))
1040
804
1041
global service
805
1042
service = AvahiService(name = server_settings["servicename"],
806
type = "_mandos._tcp", );
1043
servicetype = "_mandos._tcp", )
807
1044
if server_settings["interface"]:
808
service.interface = if_nametoindex\
809
(server_settings["interface"])
1045
service.interface = (if_nametoindex
1046
(server_settings["interface"]))
810
1047
811
1048
global main_loop
812
1049
global bus
819
1056
avahi.DBUS_PATH_SERVER),
820
1057
avahi.DBUS_INTERFACE_SERVER)
821
1058
# End of Avahi example code
822
823
def remove_from_clients(client):
824
clients.remove(client)
825
if not clients:
826
logger.critical(u"No clients left, exiting")
827
sys.exit()
1059
if use_dbus:
1060
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
828
1061
829
1062
clients.update(Set(Client(name = section,
830
stop_hook = remove_from_clients,
831
1063
config
832
= dict(client_config.items(section)))
1064
= dict(client_config.items(section)),
1065
use_dbus = use_dbus)
833
1066
for section in client_config.sections()))
834
1067
if not clients:
835
logger.critical(u"No clients defined")
836
sys.exit(1)
1068
logger.warning(u"No clients defined")
837
1069
838
1070
if debug:
839
1071
# Redirect stdin so all checkers get /dev/null
852
1084
pidfile.write(str(pid) + "\n")
853
1085
pidfile.close()
854
1086
del pidfile
855
except IOError, err:
1087
except IOError:
856
1088
logger.error(u"Could not write to file %r with PID %d",
857
1089
pidfilename, pid)
858
1090
except NameError:
871
1103
872
1104
while clients:
873
1105
client = clients.pop()
874
client.stop_hook = None
875
client.stop()
1106
client.disable_hook = None
1107
client.disable()
876
1108
877
1109
atexit.register(cleanup)
878
1110
881
1113
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
882
1114
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
883
1115
1116
if use_dbus:
1117
class MandosServer(dbus.service.Object):
1118
"""A D-Bus proxy object"""
1119
def __init__(self):
1120
dbus.service.Object.__init__(self, bus, "/")
1121
_interface = u"se.bsnet.fukt.Mandos"
1122
1123
@dbus.service.signal(_interface, signature="oa{sv}")
1124
def ClientAdded(self, objpath, properties):
1125
"D-Bus signal"
1126
pass
1127
1128
@dbus.service.signal(_interface, signature="os")
1129
def ClientRemoved(self, objpath, name):
1130
"D-Bus signal"
1131
pass
1132
1133
@dbus.service.method(_interface, out_signature="ao")
1134
def GetAllClients(self):
1135
"D-Bus method"
1136
return dbus.Array(c.dbus_object_path for c in clients)
1137
1138
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1139
def GetAllClientsWithProperties(self):
1140
"D-Bus method"
1141
return dbus.Dictionary(
1142
((c.dbus_object_path, c.GetAllProperties())
1143
for c in clients),
1144
signature="oa{sv}")
1145
1146
@dbus.service.method(_interface, in_signature="o")
1147
def RemoveClient(self, object_path):
1148
"D-Bus method"
1149
for c in clients:
1150
if c.dbus_object_path == object_path:
1151
clients.remove(c)
1152
# Don't signal anything except ClientRemoved
1153
c.use_dbus = False
1154
c.disable()
1155
# Emit D-Bus signal
1156
self.ClientRemoved(object_path, c.name)
1157
return
1158
raise KeyError
1159
1160
del _interface
1161
1162
mandos_server = MandosServer()
1163
884
1164
for client in clients:
885
client.start()
1165
if use_dbus:
1166
# Emit D-Bus signal
1167
mandos_server.ClientAdded(client.dbus_object_path,
1168
client.GetAllProperties())
1169
client.enable()
886
1170
887
1171
tcp_server.enable()
888
1172
tcp_server.server_activate()
906
1190
907
1191
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
908
1192
lambda *args, **kwargs:
909
tcp_server.handle_request\
910
(*args[2:], **kwargs) or True)
1193
(tcp_server.handle_request
1194
(*args[2:], **kwargs) or True))
911
1195
912
1196
logger.debug(u"Starting main loop")
913
main_loop_started = True
914
1197
main_loop.run()
915
1198
except AvahiError, error:
916
logger.critical(u"AvahiError: %s" + unicode(error))
1199
logger.critical(u"AvahiError: %s", error)
917
1200
sys.exit(1)
918
1201
except KeyboardInterrupt:
919
1202
if debug:
920
print
1203
print >> sys.stderr
1204
logger.debug("Server received KeyboardInterrupt")
1205
logger.debug("Server exiting")
921
1206
922
1207
if __name__ == '__main__':
923
1208
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0