To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 305
- compare with another revision
- download diff
- download tarball
- view history from revision 305
- Committer: Teddy Hogeborn
- Date: 2009-02-09 02:13:58 UTC
- Revision ID: teddy@fukt.bsnet.se-20090209021358-6nrlc91oi08hn5hb
* initramfs-tools-hook: Whitespace change only.
- files added:
- debian/watch
- files removed:
- debian/mandos-client.config
- files modified:
- INSTALL
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
30
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
32
#
32
33
33
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
34
35
35
36
import SocketServer
36
37
import socket
37
from optparse import OptionParser
38
import optparse
38
39
import datetime
39
40
import errno
40
41
import gnutls.crypto
55
56
import logging
56
57
import logging.handlers
57
58
import pwd
59
from contextlib import closing
58
60
59
61
import dbus
62
import dbus.service
60
63
import gobject
61
64
import avahi
62
65
from dbus.mainloop.glib import DBusGMainLoop
63
66
import ctypes
64
67
import ctypes.util
65
68
66
version = "1.0.2"
69
version = "1.0.5"
67
70
68
71
logger = logging.Logger('mandos')
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
74
78
logger.addHandler(syslogger)
75
79
76
80
console = logging.StreamHandler()
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
' %(message)s'))
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
79
83
logger.addHandler(console)
80
84
81
85
class AvahiError(Exception):
82
def __init__(self, value):
86
def __init__(self, value, *args, **kwargs):
83
87
self.value = value
84
super(AvahiError, self).__init__()
85
def __str__(self):
86
return repr(self.value)
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
87
91
88
92
class AvahiServiceError(AvahiError):
89
93
pass
109
113
a sensible number of times
110
114
"""
111
115
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
112
servicetype = None, port = None, TXT = None, domain = "",
113
host = "", max_renames = 32768):
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768):
114
118
self.interface = interface
115
119
self.name = name
116
120
self.type = servicetype
117
121
self.port = port
118
if TXT is None:
119
self.TXT = []
120
else:
121
self.TXT = TXT
122
self.TXT = TXT if TXT is not None else []
122
123
self.domain = domain
123
124
self.host = host
124
125
self.rename_count = 0
129
130
logger.critical(u"No suitable Zeroconf service name found"
130
131
u" after %i retries, exiting.",
131
132
self.rename_count)
132
raise AvahiServiceError("Too many renames")
133
raise AvahiServiceError(u"Too many renames")
133
134
self.name = server.GetAlternativeServiceName(self.name)
134
135
logger.info(u"Changing Zeroconf service name to %r ...",
135
136
str(self.name))
136
syslogger.setFormatter(logging.Formatter\
137
syslogger.setFormatter(logging.Formatter
137
138
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
139
' %%(message)s' % self.name))
139
140
self.remove()
140
141
self.add()
141
142
self.rename_count += 1
147
148
"""Derived from the Avahi example code"""
148
149
global group
149
150
if group is None:
150
group = dbus.Interface\
151
(bus.get_object(avahi.DBUS_NAME,
151
group = dbus.Interface(bus.get_object
152
(avahi.DBUS_NAME,
152
153
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
155
group.connect_to_signal('StateChanged',
155
156
entry_group_state_changed)
156
157
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
170
171
# End of Avahi example code
171
172
172
173
173
class Client(object):
174
def _datetime_to_dbus(dt, variant_level=0):
175
"""Convert a UTC datetime.datetime() to a D-Bus type."""
176
return dbus.String(dt.isoformat(), variant_level=variant_level)
177
178
179
class Client(dbus.service.Object):
174
180
"""A representation of a client host served by this server.
175
181
Attributes:
176
name: string; from the config file, used in log messages
182
name: string; from the config file, used in log messages and
183
D-Bus identifiers
177
184
fingerprint: string (40 or 32 hexadecimal digits); used to
178
185
uniquely identify the client
179
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); object creation, not client host
182
last_checked_ok: datetime.datetime() or None if not yet checked OK
183
timeout: datetime.timedelta(); How long from last_checked_ok
184
until this client is invalid
185
interval: datetime.timedelta(); How often to start a new checker
186
stop_hook: If set, called by stop() as stop_hook(self)
187
checker: subprocess.Popen(); a running checker process used
188
to see if the client lives.
189
'None' if no process is running.
186
secret: bytestring; sent verbatim (over TLS) to client
187
host: string; available for use by the checker command
188
created: datetime.datetime(); (UTC) object creation
189
last_enabled: datetime.datetime(); (UTC)
190
enabled: bool()
191
last_checked_ok: datetime.datetime(); (UTC) or None
192
timeout: datetime.timedelta(); How long from last_checked_ok
193
until this client is invalid
194
interval: datetime.timedelta(); How often to start a new checker
195
disable_hook: If set, called by disable() as disable_hook(self)
196
checker: subprocess.Popen(); a running checker process used
197
to see if the client lives.
198
'None' if no process is running.
190
199
checker_initiator_tag: a gobject event source tag, or None
191
stop_initiator_tag: - '' -
200
disable_initiator_tag: - '' -
192
201
checker_callback_tag: - '' -
193
202
checker_command: string; External command which is run to check if
194
203
client lives. %() expansions are done at
195
204
runtime with vars(self) as dict, so that for
196
205
instance %(name)s can be used in the command.
197
Private attibutes:
198
_timeout: Real variable for 'timeout'
199
_interval: Real variable for 'interval'
200
_timeout_milliseconds: Used when calling gobject.timeout_add()
201
_interval_milliseconds: - '' -
206
use_dbus: bool(); Whether to provide D-Bus interface and signals
207
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
202
208
"""
203
def _set_timeout(self, timeout):
204
"Setter function for 'timeout' attribute"
205
self._timeout = timeout
206
self._timeout_milliseconds = ((self.timeout.days
207
* 24 * 60 * 60 * 1000)
208
+ (self.timeout.seconds * 1000)
209
+ (self.timeout.microseconds
210
// 1000))
211
timeout = property(lambda self: self._timeout,
212
_set_timeout)
213
del _set_timeout
214
def _set_interval(self, interval):
215
"Setter function for 'interval' attribute"
216
self._interval = interval
217
self._interval_milliseconds = ((self.interval.days
218
* 24 * 60 * 60 * 1000)
219
+ (self.interval.seconds
220
* 1000)
221
+ (self.interval.microseconds
222
// 1000))
223
interval = property(lambda self: self._interval,
224
_set_interval)
225
del _set_interval
226
def __init__(self, name = None, stop_hook=None, config=None):
209
def timeout_milliseconds(self):
210
"Return the 'timeout' attribute in milliseconds"
211
return ((self.timeout.days * 24 * 60 * 60 * 1000)
212
+ (self.timeout.seconds * 1000)
213
+ (self.timeout.microseconds // 1000))
214
215
def interval_milliseconds(self):
216
"Return the 'interval' attribute in milliseconds"
217
return ((self.interval.days * 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds * 1000)
219
+ (self.interval.microseconds // 1000))
220
221
def __init__(self, name = None, disable_hook=None, config=None,
222
use_dbus=True):
227
223
"""Note: the 'checker' key in 'config' sets the
228
224
'checker_command' attribute and *not* the 'checker'
229
225
attribute."""
226
self.name = name
230
227
if config is None:
231
228
config = {}
232
self.name = name
233
229
logger.debug(u"Creating client %r", self.name)
230
self.use_dbus = False # During __init__
234
231
# Uppercase and remove spaces from fingerprint for later
235
232
# comparison purposes with return value from the fingerprint()
236
233
# function
237
self.fingerprint = config["fingerprint"].upper()\
238
.replace(u" ", u"")
234
self.fingerprint = (config["fingerprint"].upper()
235
.replace(u" ", u""))
239
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
240
237
if "secret" in config:
241
238
self.secret = config["secret"].decode(u"base64")
242
239
elif "secfile" in config:
243
secfile = open(os.path.expanduser(os.path.expandvars
244
(config["secfile"])))
245
self.secret = secfile.read()
246
secfile.close()
240
with closing(open(os.path.expanduser
241
(os.path.expandvars
242
(config["secfile"])))) as secfile:
243
self.secret = secfile.read()
247
244
else:
248
245
raise TypeError(u"No secret or secfile for client %s"
249
246
% self.name)
250
247
self.host = config.get("host", "")
251
self.created = datetime.datetime.now()
248
self.created = datetime.datetime.utcnow()
249
self.enabled = False
250
self.last_enabled = None
252
251
self.last_checked_ok = None
253
252
self.timeout = string_to_delta(config["timeout"])
254
253
self.interval = string_to_delta(config["interval"])
255
self.stop_hook = stop_hook
254
self.disable_hook = disable_hook
256
255
self.checker = None
257
256
self.checker_initiator_tag = None
258
self.stop_initiator_tag = None
257
self.disable_initiator_tag = None
259
258
self.checker_callback_tag = None
260
self.check_command = config["checker"]
261
def start(self):
259
self.checker_command = config["checker"]
260
self.last_connect = None
261
# Only now, when this client is initialized, can it show up on
262
# the D-Bus
263
self.use_dbus = use_dbus
264
if self.use_dbus:
265
self.dbus_object_path = (dbus.ObjectPath
266
("/clients/"
267
+ self.name.replace(".", "_")))
268
dbus.service.Object.__init__(self, bus,
269
self.dbus_object_path)
270
271
def enable(self):
262
272
"""Start this client's checker and timeout hooks"""
273
self.last_enabled = datetime.datetime.utcnow()
263
274
# Schedule a new checker to be started an 'interval' from now,
264
275
# and every interval from then on.
265
self.checker_initiator_tag = gobject.timeout_add\
266
(self._interval_milliseconds,
267
self.start_checker)
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self.interval_milliseconds(),
278
self.start_checker))
268
279
# Also start a new checker *right now*.
269
280
self.start_checker()
270
# Schedule a stop() when 'timeout' has passed
271
self.stop_initiator_tag = gobject.timeout_add\
272
(self._timeout_milliseconds,
273
self.stop)
274
def stop(self):
275
"""Stop this client.
276
The possibility that a client might be restarted is left open,
277
but not currently used."""
278
# If this client doesn't have a secret, it is already stopped.
279
if hasattr(self, "secret") and self.secret:
280
logger.info(u"Stopping client %s", self.name)
281
self.secret = None
282
else:
281
# Schedule a disable() when 'timeout' has passed
282
self.disable_initiator_tag = (gobject.timeout_add
283
(self.timeout_milliseconds(),
284
self.disable))
285
self.enabled = True
286
if self.use_dbus:
287
# Emit D-Bus signals
288
self.PropertyChanged(dbus.String(u"enabled"),
289
dbus.Boolean(True, variant_level=1))
290
self.PropertyChanged(dbus.String(u"last_enabled"),
291
(_datetime_to_dbus(self.last_enabled,
292
variant_level=1)))
293
294
def disable(self):
295
"""Disable this client."""
296
if not getattr(self, "enabled", False):
283
297
return False
284
if getattr(self, "stop_initiator_tag", False):
285
gobject.source_remove(self.stop_initiator_tag)
286
self.stop_initiator_tag = None
298
logger.info(u"Disabling client %s", self.name)
299
if getattr(self, "disable_initiator_tag", False):
300
gobject.source_remove(self.disable_initiator_tag)
301
self.disable_initiator_tag = None
287
302
if getattr(self, "checker_initiator_tag", False):
288
303
gobject.source_remove(self.checker_initiator_tag)
289
304
self.checker_initiator_tag = None
290
305
self.stop_checker()
291
if self.stop_hook:
292
self.stop_hook(self)
306
if self.disable_hook:
307
self.disable_hook(self)
308
self.enabled = False
309
if self.use_dbus:
310
# Emit D-Bus signal
311
self.PropertyChanged(dbus.String(u"enabled"),
312
dbus.Boolean(False, variant_level=1))
293
313
# Do not run this again if called by a gobject.timeout_add
294
314
return False
315
295
316
def __del__(self):
296
self.stop_hook = None
297
self.stop()
298
def checker_callback(self, pid, condition):
317
self.disable_hook = None
318
self.disable()
319
320
def checker_callback(self, pid, condition, command):
299
321
"""The checker has completed, so take appropriate actions."""
300
now = datetime.datetime.now()
301
322
self.checker_callback_tag = None
302
323
self.checker = None
303
if os.WIFEXITED(condition) \
304
and (os.WEXITSTATUS(condition) == 0):
305
logger.info(u"Checker for %(name)s succeeded",
306
vars(self))
307
self.last_checked_ok = now
308
gobject.source_remove(self.stop_initiator_tag)
309
self.stop_initiator_tag = gobject.timeout_add\
310
(self._timeout_milliseconds,
311
self.stop)
312
elif not os.WIFEXITED(condition):
324
if self.use_dbus:
325
# Emit D-Bus signal
326
self.PropertyChanged(dbus.String(u"checker_running"),
327
dbus.Boolean(False, variant_level=1))
328
if os.WIFEXITED(condition):
329
exitstatus = os.WEXITSTATUS(condition)
330
if exitstatus == 0:
331
logger.info(u"Checker for %(name)s succeeded",
332
vars(self))
333
self.checked_ok()
334
else:
335
logger.info(u"Checker for %(name)s failed",
336
vars(self))
337
if self.use_dbus:
338
# Emit D-Bus signal
339
self.CheckerCompleted(dbus.Int16(exitstatus),
340
dbus.Int64(condition),
341
dbus.String(command))
342
else:
313
343
logger.warning(u"Checker for %(name)s crashed?",
314
344
vars(self))
315
else:
316
logger.info(u"Checker for %(name)s failed",
317
vars(self))
345
if self.use_dbus:
346
# Emit D-Bus signal
347
self.CheckerCompleted(dbus.Int16(-1),
348
dbus.Int64(condition),
349
dbus.String(command))
350
351
def checked_ok(self):
352
"""Bump up the timeout for this client.
353
This should only be called when the client has been seen,
354
alive and well.
355
"""
356
self.last_checked_ok = datetime.datetime.utcnow()
357
gobject.source_remove(self.disable_initiator_tag)
358
self.disable_initiator_tag = (gobject.timeout_add
359
(self.timeout_milliseconds(),
360
self.disable))
361
if self.use_dbus:
362
# Emit D-Bus signal
363
self.PropertyChanged(
364
dbus.String(u"last_checked_ok"),
365
(_datetime_to_dbus(self.last_checked_ok,
366
variant_level=1)))
367
318
368
def start_checker(self):
319
369
"""Start a new checker subprocess if one is not running.
320
370
If a checker already exists, leave it running and do
329
379
# is as it should be.
330
380
if self.checker is None:
331
381
try:
332
# In case check_command has exactly one % operator
333
command = self.check_command % self.host
382
# In case checker_command has exactly one % operator
383
command = self.checker_command % self.host
334
384
except TypeError:
335
385
# Escape attributes for the shell
336
386
escaped_attrs = dict((key, re.escape(str(val)))
337
387
for key, val in
338
388
vars(self).iteritems())
339
389
try:
340
command = self.check_command % escaped_attrs
390
command = self.checker_command % escaped_attrs
341
391
except TypeError, error:
342
392
logger.error(u'Could not format string "%s":'
343
u' %s', self.check_command, error)
393
u' %s', self.checker_command, error)
344
394
return True # Try again later
345
395
try:
346
396
logger.info(u"Starting checker %r for %s",
352
402
self.checker = subprocess.Popen(command,
353
403
close_fds=True,
354
404
shell=True, cwd="/")
355
self.checker_callback_tag = gobject.child_watch_add\
356
(self.checker.pid,
357
self.checker_callback)
405
if self.use_dbus:
406
# Emit D-Bus signal
407
self.CheckerStarted(command)
408
self.PropertyChanged(
409
dbus.String("checker_running"),
410
dbus.Boolean(True, variant_level=1))
411
self.checker_callback_tag = (gobject.child_watch_add
412
(self.checker.pid,
413
self.checker_callback,
414
data=command))
358
415
except OSError, error:
359
416
logger.error(u"Failed to start subprocess: %s",
360
417
error)
361
418
# Re-run this periodically if run by gobject.timeout_add
362
419
return True
420
363
421
def stop_checker(self):
364
422
"""Force the checker process, if any, to stop."""
365
423
if self.checker_callback_tag:
377
435
if error.errno != errno.ESRCH: # No such process
378
436
raise
379
437
self.checker = None
438
if self.use_dbus:
439
self.PropertyChanged(dbus.String(u"checker_running"),
440
dbus.Boolean(False, variant_level=1))
441
380
442
def still_valid(self):
381
443
"""Has the timeout not yet passed for this client?"""
382
now = datetime.datetime.now()
444
if not getattr(self, "enabled", False):
445
return False
446
now = datetime.datetime.utcnow()
383
447
if self.last_checked_ok is None:
384
448
return now < (self.created + self.timeout)
385
449
else:
386
450
return now < (self.last_checked_ok + self.timeout)
451
452
## D-Bus methods & signals
453
_interface = u"se.bsnet.fukt.Mandos.Client"
454
455
# CheckedOK - method
456
CheckedOK = dbus.service.method(_interface)(checked_ok)
457
CheckedOK.__name__ = "CheckedOK"
458
459
# CheckerCompleted - signal
460
@dbus.service.signal(_interface, signature="nxs")
461
def CheckerCompleted(self, exitcode, waitstatus, command):
462
"D-Bus signal"
463
pass
464
465
# CheckerStarted - signal
466
@dbus.service.signal(_interface, signature="s")
467
def CheckerStarted(self, command):
468
"D-Bus signal"
469
pass
470
471
# GetAllProperties - method
472
@dbus.service.method(_interface, out_signature="a{sv}")
473
def GetAllProperties(self):
474
"D-Bus method"
475
return dbus.Dictionary({
476
dbus.String("name"):
477
dbus.String(self.name, variant_level=1),
478
dbus.String("fingerprint"):
479
dbus.String(self.fingerprint, variant_level=1),
480
dbus.String("host"):
481
dbus.String(self.host, variant_level=1),
482
dbus.String("created"):
483
_datetime_to_dbus(self.created, variant_level=1),
484
dbus.String("last_enabled"):
485
(_datetime_to_dbus(self.last_enabled,
486
variant_level=1)
487
if self.last_enabled is not None
488
else dbus.Boolean(False, variant_level=1)),
489
dbus.String("enabled"):
490
dbus.Boolean(self.enabled, variant_level=1),
491
dbus.String("last_checked_ok"):
492
(_datetime_to_dbus(self.last_checked_ok,
493
variant_level=1)
494
if self.last_checked_ok is not None
495
else dbus.Boolean (False, variant_level=1)),
496
dbus.String("timeout"):
497
dbus.UInt64(self.timeout_milliseconds(),
498
variant_level=1),
499
dbus.String("interval"):
500
dbus.UInt64(self.interval_milliseconds(),
501
variant_level=1),
502
dbus.String("checker"):
503
dbus.String(self.checker_command,
504
variant_level=1),
505
dbus.String("checker_running"):
506
dbus.Boolean(self.checker is not None,
507
variant_level=1),
508
dbus.String("object_path"):
509
dbus.ObjectPath(self.dbus_object_path,
510
variant_level=1)
511
}, signature="sv")
512
513
# IsStillValid - method
514
IsStillValid = (dbus.service.method(_interface, out_signature="b")
515
(still_valid))
516
IsStillValid.__name__ = "IsStillValid"
517
518
# PropertyChanged - signal
519
@dbus.service.signal(_interface, signature="sv")
520
def PropertyChanged(self, property, value):
521
"D-Bus signal"
522
pass
523
524
# SetChecker - method
525
@dbus.service.method(_interface, in_signature="s")
526
def SetChecker(self, checker):
527
"D-Bus setter method"
528
self.checker_command = checker
529
# Emit D-Bus signal
530
self.PropertyChanged(dbus.String(u"checker"),
531
dbus.String(self.checker_command,
532
variant_level=1))
533
534
# SetHost - method
535
@dbus.service.method(_interface, in_signature="s")
536
def SetHost(self, host):
537
"D-Bus setter method"
538
self.host = host
539
# Emit D-Bus signal
540
self.PropertyChanged(dbus.String(u"host"),
541
dbus.String(self.host, variant_level=1))
542
543
# SetInterval - method
544
@dbus.service.method(_interface, in_signature="t")
545
def SetInterval(self, milliseconds):
546
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
547
# Emit D-Bus signal
548
self.PropertyChanged(dbus.String(u"interval"),
549
(dbus.UInt64(self.interval_milliseconds(),
550
variant_level=1)))
551
552
# SetSecret - method
553
@dbus.service.method(_interface, in_signature="ay",
554
byte_arrays=True)
555
def SetSecret(self, secret):
556
"D-Bus setter method"
557
self.secret = str(secret)
558
559
# SetTimeout - method
560
@dbus.service.method(_interface, in_signature="t")
561
def SetTimeout(self, milliseconds):
562
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
563
# Emit D-Bus signal
564
self.PropertyChanged(dbus.String(u"timeout"),
565
(dbus.UInt64(self.timeout_milliseconds(),
566
variant_level=1)))
567
568
# Enable - method
569
Enable = dbus.service.method(_interface)(enable)
570
Enable.__name__ = "Enable"
571
572
# StartChecker - method
573
@dbus.service.method(_interface)
574
def StartChecker(self):
575
"D-Bus method"
576
self.start_checker()
577
578
# Disable - method
579
@dbus.service.method(_interface)
580
def Disable(self):
581
"D-Bus method"
582
self.disable()
583
584
# StopChecker - method
585
StopChecker = dbus.service.method(_interface)(stop_checker)
586
StopChecker.__name__ = "StopChecker"
587
588
del _interface
387
589
388
590
389
591
def peer_certificate(session):
390
592
"Return the peer's OpenPGP certificate as a bytestring"
391
593
# If not an OpenPGP certificate...
392
if gnutls.library.functions.gnutls_certificate_type_get\
393
(session._c_object) \
394
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
594
if (gnutls.library.functions
595
.gnutls_certificate_type_get(session._c_object)
596
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
395
597
# ...do the normal thing
396
598
return session.peer_certificate
397
list_size = ctypes.c_uint()
398
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
399
(session._c_object, ctypes.byref(list_size))
599
list_size = ctypes.c_uint(1)
600
cert_list = (gnutls.library.functions
601
.gnutls_certificate_get_peers
602
(session._c_object, ctypes.byref(list_size)))
603
if not bool(cert_list) and list_size.value != 0:
604
raise gnutls.errors.GNUTLSError("error getting peer"
605
" certificate")
400
606
if list_size.value == 0:
401
607
return None
402
608
cert = cert_list[0]
406
612
def fingerprint(openpgp):
407
613
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
408
614
# New GnuTLS "datum" with the OpenPGP public key
409
datum = gnutls.library.types.gnutls_datum_t\
410
(ctypes.cast(ctypes.c_char_p(openpgp),
411
ctypes.POINTER(ctypes.c_ubyte)),
412
ctypes.c_uint(len(openpgp)))
615
datum = (gnutls.library.types
616
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
617
ctypes.POINTER
618
(ctypes.c_ubyte)),
619
ctypes.c_uint(len(openpgp))))
413
620
# New empty GnuTLS certificate
414
621
crt = gnutls.library.types.gnutls_openpgp_crt_t()
415
gnutls.library.functions.gnutls_openpgp_crt_init\
416
(ctypes.byref(crt))
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
417
624
# Import the OpenPGP public key into the certificate
418
gnutls.library.functions.gnutls_openpgp_crt_import\
419
(crt, ctypes.byref(datum),
420
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
627
gnutls.library.constants
628
.GNUTLS_OPENPGP_FMT_RAW))
421
629
# Verify the self signature in the key
422
630
crtverify = ctypes.c_uint()
423
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
424
(crt, 0, ctypes.byref(crtverify))
631
(gnutls.library.functions
632
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
425
633
if crtverify.value != 0:
426
634
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
427
635
raise gnutls.errors.CertificateSecurityError("Verify failed")
429
637
buf = ctypes.create_string_buffer(20)
430
638
buf_len = ctypes.c_size_t()
431
639
# Get the fingerprint from the certificate into the buffer
432
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
433
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
640
(gnutls.library.functions
641
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
642
ctypes.byref(buf_len)))
434
643
# Deinit the certificate
435
644
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
436
645
# Convert the buffer to a Python bytestring
447
656
448
657
def handle(self):
449
658
logger.info(u"TCP connection from: %s",
450
unicode(self.client_address))
451
session = gnutls.connection.ClientSession\
452
(self.request, gnutls.connection.X509Credentials())
659
unicode(self.client_address))
660
session = (gnutls.connection
661
.ClientSession(self.request,
662
gnutls.connection
663
.X509Credentials()))
453
664
454
665
line = self.request.makefile().readline()
455
666
logger.debug(u"Protocol version: %r", line)
466
677
# using OpenPGP certificates.
467
678
468
679
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
469
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
470
# "+DHE-DSS"))
471
priority = "NORMAL" # Fallback default, since this
472
# MUST be set.
473
if self.server.settings["priority"]:
474
priority = self.server.settings["priority"]
475
gnutls.library.functions.gnutls_priority_set_direct\
476
(session._c_object, priority, None)
680
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
681
# "+DHE-DSS"))
682
# Use a fallback default, since this MUST be set.
683
priority = self.server.settings.get("priority", "NORMAL")
684
(gnutls.library.functions
685
.gnutls_priority_set_direct(session._c_object,
686
priority, None))
477
687
478
688
try:
479
689
session.handshake()
482
692
# Do not run session.bye() here: the session is not
483
693
# established. Just abandon the request.
484
694
return
695
logger.debug(u"Handshake succeeded")
485
696
try:
486
697
fpr = fingerprint(peer_certificate(session))
487
698
except (TypeError, gnutls.errors.GNUTLSError), error:
489
700
session.bye()
490
701
return
491
702
logger.debug(u"Fingerprint: %s", fpr)
492
client = None
703
493
704
for c in self.server.clients:
494
705
if c.fingerprint == fpr:
495
706
client = c
496
707
break
497
if not client:
708
else:
498
709
logger.warning(u"Client not found for fingerprint: %s",
499
710
fpr)
500
711
session.bye()
507
718
vars(client))
508
719
session.bye()
509
720
return
721
## This won't work here, since we're in a fork.
722
# client.checked_ok()
510
723
sent_size = 0
511
724
while sent_size < len(client.secret):
512
725
sent = session.send(client.secret[sent_size:])
517
730
session.bye()
518
731
519
732
520
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
733
class IPv6_TCPServer(SocketServer.ForkingMixIn,
734
SocketServer.TCPServer, object):
521
735
"""IPv6 TCP server. Accepts 'None' as address and/or port.
522
736
Attributes:
523
737
settings: Server settings
551
765
u" bind to interface %s",
552
766
self.settings["interface"])
553
767
else:
554
raise error
768
raise
555
769
# Only bind(2) the socket if we really need to.
556
770
if self.server_address[0] or self.server_address[1]:
557
771
if not self.server_address[0]:
578
792
579
793
def string_to_delta(interval):
580
794
"""Parse a string and return a datetime.timedelta
581
795
582
796
>>> string_to_delta('7d')
583
797
datetime.timedelta(7)
584
798
>>> string_to_delta('60s')
636
850
elif state == avahi.ENTRY_GROUP_FAILURE:
637
851
logger.critical(u"Avahi: Error in group state changed %s",
638
852
unicode(error))
639
raise AvahiGroupError("State changed: %s", str(error))
853
raise AvahiGroupError(u"State changed: %s" % unicode(error))
640
854
641
855
def if_nametoindex(interface):
642
856
"""Call the C function if_nametoindex(), or equivalent"""
643
857
global if_nametoindex
644
858
try:
645
if_nametoindex = ctypes.cdll.LoadLibrary\
646
(ctypes.util.find_library("c")).if_nametoindex
859
if_nametoindex = (ctypes.cdll.LoadLibrary
860
(ctypes.util.find_library("c"))
861
.if_nametoindex)
647
862
except (OSError, AttributeError):
648
863
if "struct" not in sys.modules:
649
864
import struct
652
867
def if_nametoindex(interface):
653
868
"Get an interface index the hard way, i.e. using fcntl()"
654
869
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
655
s = socket.socket()
656
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
657
struct.pack("16s16x", interface))
658
s.close()
870
with closing(socket.socket()) as s:
871
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
872
struct.pack("16s16x", interface))
659
873
interface_index = struct.unpack("I", ifreq[16:20])[0]
660
874
return interface_index
661
875
return if_nametoindex(interface)
685
899
686
900
687
901
def main():
688
parser = OptionParser(version = "%%prog %s" % version)
902
parser = optparse.OptionParser(version = "%%prog %s" % version)
689
903
parser.add_option("-i", "--interface", type="string",
690
904
metavar="IF", help="Bind to interface IF")
691
905
parser.add_option("-a", "--address", type="string",
692
906
help="Address to listen for requests on")
693
907
parser.add_option("-p", "--port", type="int",
694
908
help="Port number to receive requests on")
695
parser.add_option("--check", action="store_true", default=False,
909
parser.add_option("--check", action="store_true",
696
910
help="Run self-test")
697
911
parser.add_option("--debug", action="store_true",
698
912
help="Debug mode; run in foreground and log to"
705
919
default="/etc/mandos", metavar="DIR",
706
920
help="Directory to search for configuration"
707
921
" files")
922
parser.add_option("--no-dbus", action="store_false",
923
dest="use_dbus",
924
help="Do not provide D-Bus system bus"
925
" interface")
708
926
options = parser.parse_args()[0]
709
927
710
928
if options.check:
720
938
"priority":
721
939
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
722
940
"servicename": "Mandos",
941
"use_dbus": "True",
723
942
}
724
943
725
944
# Parse config file for server-global settings
728
947
server_config.read(os.path.join(options.configdir, "mandos.conf"))
729
948
# Convert the SafeConfigParser object to a dict
730
949
server_settings = server_config.defaults()
731
# Use getboolean on the boolean config option
732
server_settings["debug"] = server_config.getboolean\
733
("DEFAULT", "debug")
950
# Use the appropriate methods on the non-string config options
951
server_settings["debug"] = server_config.getboolean("DEFAULT",
952
"debug")
953
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
954
"use_dbus")
955
if server_settings["port"]:
956
server_settings["port"] = server_config.getint("DEFAULT",
957
"port")
734
958
del server_config
735
959
736
960
# Override the settings from the config file with command line
737
961
# options, if set.
738
962
for option in ("interface", "address", "port", "debug",
739
"priority", "servicename", "configdir"):
963
"priority", "servicename", "configdir",
964
"use_dbus"):
740
965
value = getattr(options, option)
741
966
if value is not None:
742
967
server_settings[option] = value
743
968
del options
744
969
# Now we have our good server settings in "server_settings"
745
970
971
# For convenience
746
972
debug = server_settings["debug"]
973
use_dbus = server_settings["use_dbus"]
747
974
748
975
if not debug:
749
976
syslogger.setLevel(logging.WARNING)
750
977
console.setLevel(logging.WARNING)
751
978
752
979
if server_settings["servicename"] != "Mandos":
753
syslogger.setFormatter(logging.Formatter\
980
syslogger.setFormatter(logging.Formatter
754
981
('Mandos (%s): %%(levelname)s:'
755
982
' %%(message)s'
756
983
% server_settings["servicename"]))
758
985
# Parse config file with clients
759
986
client_defaults = { "timeout": "1h",
760
987
"interval": "5m",
761
"checker": "fping -q -- %(host)s",
988
"checker": "fping -q -- %%(host)s",
762
989
"host": "",
763
990
}
764
991
client_config = ConfigParser.SafeConfigParser(client_defaults)
774
1001
pidfilename = "/var/run/mandos.pid"
775
1002
try:
776
1003
pidfile = open(pidfilename, "w")
777
except IOError, error:
1004
except IOError:
778
1005
logger.error("Could not open file %r", pidfilename)
779
1006
780
uid = 65534
781
gid = 65534
782
try:
783
uid = pwd.getpwnam("mandos").pw_uid
784
except KeyError:
785
try:
786
uid = pwd.getpwnam("nobody").pw_uid
787
except KeyError:
788
pass
789
try:
790
gid = pwd.getpwnam("mandos").pw_gid
791
except KeyError:
792
try:
793
gid = pwd.getpwnam("nogroup").pw_gid
794
except KeyError:
795
pass
796
try:
1007
try:
1008
uid = pwd.getpwnam("_mandos").pw_uid
1009
gid = pwd.getpwnam("_mandos").pw_gid
1010
except KeyError:
1011
try:
1012
uid = pwd.getpwnam("mandos").pw_uid
1013
gid = pwd.getpwnam("mandos").pw_gid
1014
except KeyError:
1015
try:
1016
uid = pwd.getpwnam("nobody").pw_uid
1017
gid = pwd.getpwnam("nogroup").pw_gid
1018
except KeyError:
1019
uid = 65534
1020
gid = 65534
1021
try:
1022
os.setgid(gid)
797
1023
os.setuid(uid)
798
os.setgid(gid)
799
1024
except OSError, error:
800
1025
if error[0] != errno.EPERM:
801
1026
raise error
802
1027
1028
# Enable all possible GnuTLS debugging
1029
if debug:
1030
# "Use a log level over 10 to enable all debugging options."
1031
# - GnuTLS manual
1032
gnutls.library.functions.gnutls_global_set_log_level(11)
1033
1034
@gnutls.library.types.gnutls_log_func
1035
def debug_gnutls(level, string):
1036
logger.debug("GnuTLS: %s", string[:-1])
1037
1038
(gnutls.library.functions
1039
.gnutls_global_set_log_function(debug_gnutls))
1040
803
1041
global service
804
1042
service = AvahiService(name = server_settings["servicename"],
805
1043
servicetype = "_mandos._tcp", )
806
1044
if server_settings["interface"]:
807
service.interface = if_nametoindex\
808
(server_settings["interface"])
1045
service.interface = (if_nametoindex
1046
(server_settings["interface"]))
809
1047
810
1048
global main_loop
811
1049
global bus
818
1056
avahi.DBUS_PATH_SERVER),
819
1057
avahi.DBUS_INTERFACE_SERVER)
820
1058
# End of Avahi example code
821
822
def remove_from_clients(client):
823
clients.remove(client)
824
if not clients:
825
logger.critical(u"No clients left, exiting")
826
sys.exit()
1059
if use_dbus:
1060
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
827
1061
828
1062
clients.update(Set(Client(name = section,
829
stop_hook = remove_from_clients,
830
1063
config
831
= dict(client_config.items(section)))
1064
= dict(client_config.items(section)),
1065
use_dbus = use_dbus)
832
1066
for section in client_config.sections()))
833
1067
if not clients:
834
logger.critical(u"No clients defined")
835
sys.exit(1)
1068
logger.warning(u"No clients defined")
836
1069
837
1070
if debug:
838
1071
# Redirect stdin so all checkers get /dev/null
870
1103
871
1104
while clients:
872
1105
client = clients.pop()
873
client.stop_hook = None
874
client.stop()
1106
client.disable_hook = None
1107
client.disable()
875
1108
876
1109
atexit.register(cleanup)
877
1110
880
1113
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
881
1114
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
882
1115
1116
if use_dbus:
1117
class MandosServer(dbus.service.Object):
1118
"""A D-Bus proxy object"""
1119
def __init__(self):
1120
dbus.service.Object.__init__(self, bus, "/")
1121
_interface = u"se.bsnet.fukt.Mandos"
1122
1123
@dbus.service.signal(_interface, signature="oa{sv}")
1124
def ClientAdded(self, objpath, properties):
1125
"D-Bus signal"
1126
pass
1127
1128
@dbus.service.signal(_interface, signature="os")
1129
def ClientRemoved(self, objpath, name):
1130
"D-Bus signal"
1131
pass
1132
1133
@dbus.service.method(_interface, out_signature="ao")
1134
def GetAllClients(self):
1135
"D-Bus method"
1136
return dbus.Array(c.dbus_object_path for c in clients)
1137
1138
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1139
def GetAllClientsWithProperties(self):
1140
"D-Bus method"
1141
return dbus.Dictionary(
1142
((c.dbus_object_path, c.GetAllProperties())
1143
for c in clients),
1144
signature="oa{sv}")
1145
1146
@dbus.service.method(_interface, in_signature="o")
1147
def RemoveClient(self, object_path):
1148
"D-Bus method"
1149
for c in clients:
1150
if c.dbus_object_path == object_path:
1151
clients.remove(c)
1152
# Don't signal anything except ClientRemoved
1153
c.use_dbus = False
1154
c.disable()
1155
# Emit D-Bus signal
1156
self.ClientRemoved(object_path, c.name)
1157
return
1158
raise KeyError
1159
1160
del _interface
1161
1162
mandos_server = MandosServer()
1163
883
1164
for client in clients:
884
client.start()
1165
if use_dbus:
1166
# Emit D-Bus signal
1167
mandos_server.ClientAdded(client.dbus_object_path,
1168
client.GetAllProperties())
1169
client.enable()
885
1170
886
1171
tcp_server.enable()
887
1172
tcp_server.server_activate()
905
1190
906
1191
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
907
1192
lambda *args, **kwargs:
908
tcp_server.handle_request\
909
(*args[2:], **kwargs) or True)
1193
(tcp_server.handle_request
1194
(*args[2:], **kwargs) or True))
910
1195
911
1196
logger.debug(u"Starting main loop")
912
1197
main_loop.run()
913
1198
except AvahiError, error:
914
logger.critical(u"AvahiError: %s" + unicode(error))
1199
logger.critical(u"AvahiError: %s", error)
915
1200
sys.exit(1)
916
1201
except KeyboardInterrupt:
917
1202
if debug:
918
print
1203
print >> sys.stderr
1204
logger.debug("Server received KeyboardInterrupt")
1205
logger.debug("Server exiting")
919
1206
920
1207
if __name__ == '__main__':
921
1208
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0