To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 319
- compare with another revision
- download diff
- download tarball
- view history from revision 319
- Committer: Teddy Hogeborn
- Date: 2009-02-15 09:28:06 UTC
- Revision ID: teddy@fukt.bsnet.se-20090215092806-l0uq42v3j1rq3gmi
* INSTALL: Changed "Python 2.4" to "Python 2.5".
* mandos.lsm: - '' -
* mandos.lsm: - '' -
- files added:
- NEWS
- files removed:
- debian/mandos-client.config
- files modified:
- INSTALL
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
30
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
32
#
32
33
33
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
34
35
35
36
import SocketServer
36
37
import socket
37
from optparse import OptionParser
38
import optparse
38
39
import datetime
39
40
import errno
40
41
import gnutls.crypto
55
56
import logging
56
57
import logging.handlers
57
58
import pwd
59
from contextlib import closing
58
60
59
61
import dbus
62
import dbus.service
60
63
import gobject
61
64
import avahi
62
65
from dbus.mainloop.glib import DBusGMainLoop
63
66
import ctypes
64
67
import ctypes.util
65
68
66
version = "1.0"
69
version = "1.0.6"
67
70
68
71
logger = logging.Logger('mandos')
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
74
78
logger.addHandler(syslogger)
75
79
76
80
console = logging.StreamHandler()
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
' %(message)s'))
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
79
83
logger.addHandler(console)
80
84
81
85
class AvahiError(Exception):
82
def __init__(self, value):
86
def __init__(self, value, *args, **kwargs):
83
87
self.value = value
84
super(AvahiError, self).__init__()
85
def __str__(self):
86
return repr(self.value)
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
87
91
88
92
class AvahiServiceError(AvahiError):
89
93
pass
109
113
a sensible number of times
110
114
"""
111
115
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
112
servicetype = None, port = None, TXT = None, domain = "",
113
host = "", max_renames = 32768):
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768,
118
protocol = avahi.PROTO_UNSPEC):
114
119
self.interface = interface
115
120
self.name = name
116
121
self.type = servicetype
117
122
self.port = port
118
if TXT is None:
119
self.TXT = []
120
else:
121
self.TXT = TXT
123
self.TXT = TXT if TXT is not None else []
122
124
self.domain = domain
123
125
self.host = host
124
126
self.rename_count = 0
125
127
self.max_renames = max_renames
128
self.protocol = protocol
126
129
def rename(self):
127
130
"""Derived from the Avahi example code"""
128
131
if self.rename_count >= self.max_renames:
129
132
logger.critical(u"No suitable Zeroconf service name found"
130
133
u" after %i retries, exiting.",
131
134
self.rename_count)
132
raise AvahiServiceError("Too many renames")
135
raise AvahiServiceError(u"Too many renames")
133
136
self.name = server.GetAlternativeServiceName(self.name)
134
137
logger.info(u"Changing Zeroconf service name to %r ...",
135
138
str(self.name))
136
syslogger.setFormatter(logging.Formatter\
139
syslogger.setFormatter(logging.Formatter
137
140
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
141
' %%(message)s' % self.name))
139
142
self.remove()
140
143
self.add()
141
144
self.rename_count += 1
147
150
"""Derived from the Avahi example code"""
148
151
global group
149
152
if group is None:
150
group = dbus.Interface\
151
(bus.get_object(avahi.DBUS_NAME,
153
group = dbus.Interface(bus.get_object
154
(avahi.DBUS_NAME,
152
155
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
156
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
157
group.connect_to_signal('StateChanged',
155
158
entry_group_state_changed)
156
159
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
157
160
service.name, service.type)
158
161
group.AddService(
159
162
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
163
self.protocol, # protocol
161
164
dbus.UInt32(0), # flags
162
165
self.name, self.type,
163
166
self.domain, self.host,
170
173
# End of Avahi example code
171
174
172
175
173
class Client(object):
176
def _datetime_to_dbus(dt, variant_level=0):
177
"""Convert a UTC datetime.datetime() to a D-Bus type."""
178
return dbus.String(dt.isoformat(), variant_level=variant_level)
179
180
181
class Client(dbus.service.Object):
174
182
"""A representation of a client host served by this server.
175
183
Attributes:
176
name: string; from the config file, used in log messages
184
name: string; from the config file, used in log messages and
185
D-Bus identifiers
177
186
fingerprint: string (40 or 32 hexadecimal digits); used to
178
187
uniquely identify the client
179
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); object creation, not client host
182
last_checked_ok: datetime.datetime() or None if not yet checked OK
183
timeout: datetime.timedelta(); How long from last_checked_ok
184
until this client is invalid
185
interval: datetime.timedelta(); How often to start a new checker
186
stop_hook: If set, called by stop() as stop_hook(self)
187
checker: subprocess.Popen(); a running checker process used
188
to see if the client lives.
189
'None' if no process is running.
188
secret: bytestring; sent verbatim (over TLS) to client
189
host: string; available for use by the checker command
190
created: datetime.datetime(); (UTC) object creation
191
last_enabled: datetime.datetime(); (UTC)
192
enabled: bool()
193
last_checked_ok: datetime.datetime(); (UTC) or None
194
timeout: datetime.timedelta(); How long from last_checked_ok
195
until this client is invalid
196
interval: datetime.timedelta(); How often to start a new checker
197
disable_hook: If set, called by disable() as disable_hook(self)
198
checker: subprocess.Popen(); a running checker process used
199
to see if the client lives.
200
'None' if no process is running.
190
201
checker_initiator_tag: a gobject event source tag, or None
191
stop_initiator_tag: - '' -
202
disable_initiator_tag: - '' -
192
203
checker_callback_tag: - '' -
193
204
checker_command: string; External command which is run to check if
194
205
client lives. %() expansions are done at
195
206
runtime with vars(self) as dict, so that for
196
207
instance %(name)s can be used in the command.
197
Private attibutes:
198
_timeout: Real variable for 'timeout'
199
_interval: Real variable for 'interval'
200
_timeout_milliseconds: Used when calling gobject.timeout_add()
201
_interval_milliseconds: - '' -
208
current_checker_command: string; current running checker_command
209
use_dbus: bool(); Whether to provide D-Bus interface and signals
210
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
202
211
"""
203
def _set_timeout(self, timeout):
204
"Setter function for 'timeout' attribute"
205
self._timeout = timeout
206
self._timeout_milliseconds = ((self.timeout.days
207
* 24 * 60 * 60 * 1000)
208
+ (self.timeout.seconds * 1000)
209
+ (self.timeout.microseconds
210
// 1000))
211
timeout = property(lambda self: self._timeout,
212
_set_timeout)
213
del _set_timeout
214
def _set_interval(self, interval):
215
"Setter function for 'interval' attribute"
216
self._interval = interval
217
self._interval_milliseconds = ((self.interval.days
218
* 24 * 60 * 60 * 1000)
219
+ (self.interval.seconds
220
* 1000)
221
+ (self.interval.microseconds
222
// 1000))
223
interval = property(lambda self: self._interval,
224
_set_interval)
225
del _set_interval
226
def __init__(self, name = None, stop_hook=None, config=None):
212
def timeout_milliseconds(self):
213
"Return the 'timeout' attribute in milliseconds"
214
return ((self.timeout.days * 24 * 60 * 60 * 1000)
215
+ (self.timeout.seconds * 1000)
216
+ (self.timeout.microseconds // 1000))
217
218
def interval_milliseconds(self):
219
"Return the 'interval' attribute in milliseconds"
220
return ((self.interval.days * 24 * 60 * 60 * 1000)
221
+ (self.interval.seconds * 1000)
222
+ (self.interval.microseconds // 1000))
223
224
def __init__(self, name = None, disable_hook=None, config=None,
225
use_dbus=True):
227
226
"""Note: the 'checker' key in 'config' sets the
228
227
'checker_command' attribute and *not* the 'checker'
229
228
attribute."""
229
self.name = name
230
230
if config is None:
231
231
config = {}
232
self.name = name
233
232
logger.debug(u"Creating client %r", self.name)
233
self.use_dbus = False # During __init__
234
234
# Uppercase and remove spaces from fingerprint for later
235
235
# comparison purposes with return value from the fingerprint()
236
236
# function
237
self.fingerprint = config["fingerprint"].upper()\
238
.replace(u" ", u"")
237
self.fingerprint = (config["fingerprint"].upper()
238
.replace(u" ", u""))
239
239
logger.debug(u" Fingerprint: %s", self.fingerprint)
240
240
if "secret" in config:
241
241
self.secret = config["secret"].decode(u"base64")
242
242
elif "secfile" in config:
243
secfile = open(os.path.expanduser(os.path.expandvars
244
(config["secfile"])))
245
self.secret = secfile.read()
246
secfile.close()
243
with closing(open(os.path.expanduser
244
(os.path.expandvars
245
(config["secfile"])))) as secfile:
246
self.secret = secfile.read()
247
247
else:
248
248
raise TypeError(u"No secret or secfile for client %s"
249
249
% self.name)
250
250
self.host = config.get("host", "")
251
self.created = datetime.datetime.now()
251
self.created = datetime.datetime.utcnow()
252
self.enabled = False
253
self.last_enabled = None
252
254
self.last_checked_ok = None
253
255
self.timeout = string_to_delta(config["timeout"])
254
256
self.interval = string_to_delta(config["interval"])
255
self.stop_hook = stop_hook
257
self.disable_hook = disable_hook
256
258
self.checker = None
257
259
self.checker_initiator_tag = None
258
self.stop_initiator_tag = None
260
self.disable_initiator_tag = None
259
261
self.checker_callback_tag = None
260
self.check_command = config["checker"]
261
def start(self):
262
self.checker_command = config["checker"]
263
self.current_checker_command = None
264
self.last_connect = None
265
# Only now, when this client is initialized, can it show up on
266
# the D-Bus
267
self.use_dbus = use_dbus
268
if self.use_dbus:
269
self.dbus_object_path = (dbus.ObjectPath
270
("/clients/"
271
+ self.name.replace(".", "_")))
272
dbus.service.Object.__init__(self, bus,
273
self.dbus_object_path)
274
275
def enable(self):
262
276
"""Start this client's checker and timeout hooks"""
277
self.last_enabled = datetime.datetime.utcnow()
263
278
# Schedule a new checker to be started an 'interval' from now,
264
279
# and every interval from then on.
265
self.checker_initiator_tag = gobject.timeout_add\
266
(self._interval_milliseconds,
267
self.start_checker)
280
self.checker_initiator_tag = (gobject.timeout_add
281
(self.interval_milliseconds(),
282
self.start_checker))
268
283
# Also start a new checker *right now*.
269
284
self.start_checker()
270
# Schedule a stop() when 'timeout' has passed
271
self.stop_initiator_tag = gobject.timeout_add\
272
(self._timeout_milliseconds,
273
self.stop)
274
def stop(self):
275
"""Stop this client.
276
The possibility that a client might be restarted is left open,
277
but not currently used."""
278
# If this client doesn't have a secret, it is already stopped.
279
if hasattr(self, "secret") and self.secret:
280
logger.info(u"Stopping client %s", self.name)
281
self.secret = None
282
else:
285
# Schedule a disable() when 'timeout' has passed
286
self.disable_initiator_tag = (gobject.timeout_add
287
(self.timeout_milliseconds(),
288
self.disable))
289
self.enabled = True
290
if self.use_dbus:
291
# Emit D-Bus signals
292
self.PropertyChanged(dbus.String(u"enabled"),
293
dbus.Boolean(True, variant_level=1))
294
self.PropertyChanged(dbus.String(u"last_enabled"),
295
(_datetime_to_dbus(self.last_enabled,
296
variant_level=1)))
297
298
def disable(self):
299
"""Disable this client."""
300
if not getattr(self, "enabled", False):
283
301
return False
284
if getattr(self, "stop_initiator_tag", False):
285
gobject.source_remove(self.stop_initiator_tag)
286
self.stop_initiator_tag = None
302
logger.info(u"Disabling client %s", self.name)
303
if getattr(self, "disable_initiator_tag", False):
304
gobject.source_remove(self.disable_initiator_tag)
305
self.disable_initiator_tag = None
287
306
if getattr(self, "checker_initiator_tag", False):
288
307
gobject.source_remove(self.checker_initiator_tag)
289
308
self.checker_initiator_tag = None
290
309
self.stop_checker()
291
if self.stop_hook:
292
self.stop_hook(self)
310
if self.disable_hook:
311
self.disable_hook(self)
312
self.enabled = False
313
if self.use_dbus:
314
# Emit D-Bus signal
315
self.PropertyChanged(dbus.String(u"enabled"),
316
dbus.Boolean(False, variant_level=1))
293
317
# Do not run this again if called by a gobject.timeout_add
294
318
return False
319
295
320
def __del__(self):
296
self.stop_hook = None
297
self.stop()
298
def checker_callback(self, pid, condition):
321
self.disable_hook = None
322
self.disable()
323
324
def checker_callback(self, pid, condition, command):
299
325
"""The checker has completed, so take appropriate actions."""
300
now = datetime.datetime.now()
301
326
self.checker_callback_tag = None
302
327
self.checker = None
303
if os.WIFEXITED(condition) \
304
and (os.WEXITSTATUS(condition) == 0):
305
logger.info(u"Checker for %(name)s succeeded",
306
vars(self))
307
self.last_checked_ok = now
308
gobject.source_remove(self.stop_initiator_tag)
309
self.stop_initiator_tag = gobject.timeout_add\
310
(self._timeout_milliseconds,
311
self.stop)
312
elif not os.WIFEXITED(condition):
328
if self.use_dbus:
329
# Emit D-Bus signal
330
self.PropertyChanged(dbus.String(u"checker_running"),
331
dbus.Boolean(False, variant_level=1))
332
if os.WIFEXITED(condition):
333
exitstatus = os.WEXITSTATUS(condition)
334
if exitstatus == 0:
335
logger.info(u"Checker for %(name)s succeeded",
336
vars(self))
337
self.checked_ok()
338
else:
339
logger.info(u"Checker for %(name)s failed",
340
vars(self))
341
if self.use_dbus:
342
# Emit D-Bus signal
343
self.CheckerCompleted(dbus.Int16(exitstatus),
344
dbus.Int64(condition),
345
dbus.String(command))
346
else:
313
347
logger.warning(u"Checker for %(name)s crashed?",
314
348
vars(self))
315
else:
316
logger.info(u"Checker for %(name)s failed",
317
vars(self))
349
if self.use_dbus:
350
# Emit D-Bus signal
351
self.CheckerCompleted(dbus.Int16(-1),
352
dbus.Int64(condition),
353
dbus.String(command))
354
355
def checked_ok(self):
356
"""Bump up the timeout for this client.
357
This should only be called when the client has been seen,
358
alive and well.
359
"""
360
self.last_checked_ok = datetime.datetime.utcnow()
361
gobject.source_remove(self.disable_initiator_tag)
362
self.disable_initiator_tag = (gobject.timeout_add
363
(self.timeout_milliseconds(),
364
self.disable))
365
if self.use_dbus:
366
# Emit D-Bus signal
367
self.PropertyChanged(
368
dbus.String(u"last_checked_ok"),
369
(_datetime_to_dbus(self.last_checked_ok,
370
variant_level=1)))
371
318
372
def start_checker(self):
319
373
"""Start a new checker subprocess if one is not running.
320
374
If a checker already exists, leave it running and do
327
381
# checkers alone, the checker would have to take more time
328
382
# than 'timeout' for the client to be declared invalid, which
329
383
# is as it should be.
384
385
# If a checker exists, make sure it is not a zombie
386
if self.checker is not None:
387
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
388
if pid:
389
logger.warning("Checker was a zombie")
390
gobject.source_remove(self.checker_callback_tag)
391
self.checker_callback(pid, status,
392
self.current_checker_command)
393
# Start a new checker if needed
330
394
if self.checker is None:
331
395
try:
332
# In case check_command has exactly one % operator
333
command = self.check_command % self.host
396
# In case checker_command has exactly one % operator
397
command = self.checker_command % self.host
334
398
except TypeError:
335
399
# Escape attributes for the shell
336
400
escaped_attrs = dict((key, re.escape(str(val)))
337
401
for key, val in
338
402
vars(self).iteritems())
339
403
try:
340
command = self.check_command % escaped_attrs
404
command = self.checker_command % escaped_attrs
341
405
except TypeError, error:
342
406
logger.error(u'Could not format string "%s":'
343
u' %s', self.check_command, error)
407
u' %s', self.checker_command, error)
344
408
return True # Try again later
409
self.current_checker_command = command
345
410
try:
346
411
logger.info(u"Starting checker %r for %s",
347
412
command, self.name)
352
417
self.checker = subprocess.Popen(command,
353
418
close_fds=True,
354
419
shell=True, cwd="/")
355
self.checker_callback_tag = gobject.child_watch_add\
356
(self.checker.pid,
357
self.checker_callback)
420
if self.use_dbus:
421
# Emit D-Bus signal
422
self.CheckerStarted(command)
423
self.PropertyChanged(
424
dbus.String("checker_running"),
425
dbus.Boolean(True, variant_level=1))
426
self.checker_callback_tag = (gobject.child_watch_add
427
(self.checker.pid,
428
self.checker_callback,
429
data=command))
430
# The checker may have completed before the gobject
431
# watch was added. Check for this.
432
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
433
if pid:
434
gobject.source_remove(self.checker_callback_tag)
435
self.checker_callback(pid, status, command)
358
436
except OSError, error:
359
437
logger.error(u"Failed to start subprocess: %s",
360
438
error)
361
439
# Re-run this periodically if run by gobject.timeout_add
362
440
return True
441
363
442
def stop_checker(self):
364
443
"""Force the checker process, if any, to stop."""
365
444
if self.checker_callback_tag:
377
456
if error.errno != errno.ESRCH: # No such process
378
457
raise
379
458
self.checker = None
459
if self.use_dbus:
460
self.PropertyChanged(dbus.String(u"checker_running"),
461
dbus.Boolean(False, variant_level=1))
462
380
463
def still_valid(self):
381
464
"""Has the timeout not yet passed for this client?"""
382
now = datetime.datetime.now()
465
if not getattr(self, "enabled", False):
466
return False
467
now = datetime.datetime.utcnow()
383
468
if self.last_checked_ok is None:
384
469
return now < (self.created + self.timeout)
385
470
else:
386
471
return now < (self.last_checked_ok + self.timeout)
472
473
## D-Bus methods & signals
474
_interface = u"se.bsnet.fukt.Mandos.Client"
475
476
# CheckedOK - method
477
CheckedOK = dbus.service.method(_interface)(checked_ok)
478
CheckedOK.__name__ = "CheckedOK"
479
480
# CheckerCompleted - signal
481
@dbus.service.signal(_interface, signature="nxs")
482
def CheckerCompleted(self, exitcode, waitstatus, command):
483
"D-Bus signal"
484
pass
485
486
# CheckerStarted - signal
487
@dbus.service.signal(_interface, signature="s")
488
def CheckerStarted(self, command):
489
"D-Bus signal"
490
pass
491
492
# GetAllProperties - method
493
@dbus.service.method(_interface, out_signature="a{sv}")
494
def GetAllProperties(self):
495
"D-Bus method"
496
return dbus.Dictionary({
497
dbus.String("name"):
498
dbus.String(self.name, variant_level=1),
499
dbus.String("fingerprint"):
500
dbus.String(self.fingerprint, variant_level=1),
501
dbus.String("host"):
502
dbus.String(self.host, variant_level=1),
503
dbus.String("created"):
504
_datetime_to_dbus(self.created, variant_level=1),
505
dbus.String("last_enabled"):
506
(_datetime_to_dbus(self.last_enabled,
507
variant_level=1)
508
if self.last_enabled is not None
509
else dbus.Boolean(False, variant_level=1)),
510
dbus.String("enabled"):
511
dbus.Boolean(self.enabled, variant_level=1),
512
dbus.String("last_checked_ok"):
513
(_datetime_to_dbus(self.last_checked_ok,
514
variant_level=1)
515
if self.last_checked_ok is not None
516
else dbus.Boolean (False, variant_level=1)),
517
dbus.String("timeout"):
518
dbus.UInt64(self.timeout_milliseconds(),
519
variant_level=1),
520
dbus.String("interval"):
521
dbus.UInt64(self.interval_milliseconds(),
522
variant_level=1),
523
dbus.String("checker"):
524
dbus.String(self.checker_command,
525
variant_level=1),
526
dbus.String("checker_running"):
527
dbus.Boolean(self.checker is not None,
528
variant_level=1),
529
dbus.String("object_path"):
530
dbus.ObjectPath(self.dbus_object_path,
531
variant_level=1)
532
}, signature="sv")
533
534
# IsStillValid - method
535
IsStillValid = (dbus.service.method(_interface, out_signature="b")
536
(still_valid))
537
IsStillValid.__name__ = "IsStillValid"
538
539
# PropertyChanged - signal
540
@dbus.service.signal(_interface, signature="sv")
541
def PropertyChanged(self, property, value):
542
"D-Bus signal"
543
pass
544
545
# SetChecker - method
546
@dbus.service.method(_interface, in_signature="s")
547
def SetChecker(self, checker):
548
"D-Bus setter method"
549
self.checker_command = checker
550
# Emit D-Bus signal
551
self.PropertyChanged(dbus.String(u"checker"),
552
dbus.String(self.checker_command,
553
variant_level=1))
554
555
# SetHost - method
556
@dbus.service.method(_interface, in_signature="s")
557
def SetHost(self, host):
558
"D-Bus setter method"
559
self.host = host
560
# Emit D-Bus signal
561
self.PropertyChanged(dbus.String(u"host"),
562
dbus.String(self.host, variant_level=1))
563
564
# SetInterval - method
565
@dbus.service.method(_interface, in_signature="t")
566
def SetInterval(self, milliseconds):
567
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
568
# Emit D-Bus signal
569
self.PropertyChanged(dbus.String(u"interval"),
570
(dbus.UInt64(self.interval_milliseconds(),
571
variant_level=1)))
572
573
# SetSecret - method
574
@dbus.service.method(_interface, in_signature="ay",
575
byte_arrays=True)
576
def SetSecret(self, secret):
577
"D-Bus setter method"
578
self.secret = str(secret)
579
580
# SetTimeout - method
581
@dbus.service.method(_interface, in_signature="t")
582
def SetTimeout(self, milliseconds):
583
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
584
# Emit D-Bus signal
585
self.PropertyChanged(dbus.String(u"timeout"),
586
(dbus.UInt64(self.timeout_milliseconds(),
587
variant_level=1)))
588
589
# Enable - method
590
Enable = dbus.service.method(_interface)(enable)
591
Enable.__name__ = "Enable"
592
593
# StartChecker - method
594
@dbus.service.method(_interface)
595
def StartChecker(self):
596
"D-Bus method"
597
self.start_checker()
598
599
# Disable - method
600
@dbus.service.method(_interface)
601
def Disable(self):
602
"D-Bus method"
603
self.disable()
604
605
# StopChecker - method
606
StopChecker = dbus.service.method(_interface)(stop_checker)
607
StopChecker.__name__ = "StopChecker"
608
609
del _interface
387
610
388
611
389
612
def peer_certificate(session):
390
613
"Return the peer's OpenPGP certificate as a bytestring"
391
614
# If not an OpenPGP certificate...
392
if gnutls.library.functions.gnutls_certificate_type_get\
393
(session._c_object) \
394
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
615
if (gnutls.library.functions
616
.gnutls_certificate_type_get(session._c_object)
617
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
395
618
# ...do the normal thing
396
619
return session.peer_certificate
397
list_size = ctypes.c_uint()
398
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
399
(session._c_object, ctypes.byref(list_size))
620
list_size = ctypes.c_uint(1)
621
cert_list = (gnutls.library.functions
622
.gnutls_certificate_get_peers
623
(session._c_object, ctypes.byref(list_size)))
624
if not bool(cert_list) and list_size.value != 0:
625
raise gnutls.errors.GNUTLSError("error getting peer"
626
" certificate")
400
627
if list_size.value == 0:
401
628
return None
402
629
cert = cert_list[0]
406
633
def fingerprint(openpgp):
407
634
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
408
635
# New GnuTLS "datum" with the OpenPGP public key
409
datum = gnutls.library.types.gnutls_datum_t\
410
(ctypes.cast(ctypes.c_char_p(openpgp),
411
ctypes.POINTER(ctypes.c_ubyte)),
412
ctypes.c_uint(len(openpgp)))
636
datum = (gnutls.library.types
637
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
638
ctypes.POINTER
639
(ctypes.c_ubyte)),
640
ctypes.c_uint(len(openpgp))))
413
641
# New empty GnuTLS certificate
414
642
crt = gnutls.library.types.gnutls_openpgp_crt_t()
415
gnutls.library.functions.gnutls_openpgp_crt_init\
416
(ctypes.byref(crt))
643
(gnutls.library.functions
644
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
417
645
# Import the OpenPGP public key into the certificate
418
gnutls.library.functions.gnutls_openpgp_crt_import\
419
(crt, ctypes.byref(datum),
420
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
646
(gnutls.library.functions
647
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
648
gnutls.library.constants
649
.GNUTLS_OPENPGP_FMT_RAW))
421
650
# Verify the self signature in the key
422
651
crtverify = ctypes.c_uint()
423
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
424
(crt, 0, ctypes.byref(crtverify))
652
(gnutls.library.functions
653
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
425
654
if crtverify.value != 0:
426
655
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
427
656
raise gnutls.errors.CertificateSecurityError("Verify failed")
429
658
buf = ctypes.create_string_buffer(20)
430
659
buf_len = ctypes.c_size_t()
431
660
# Get the fingerprint from the certificate into the buffer
432
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
433
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
661
(gnutls.library.functions
662
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
663
ctypes.byref(buf_len)))
434
664
# Deinit the certificate
435
665
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
436
666
# Convert the buffer to a Python bytestring
447
677
448
678
def handle(self):
449
679
logger.info(u"TCP connection from: %s",
450
unicode(self.client_address))
451
session = gnutls.connection.ClientSession\
452
(self.request, gnutls.connection.X509Credentials())
680
unicode(self.client_address))
681
session = (gnutls.connection
682
.ClientSession(self.request,
683
gnutls.connection
684
.X509Credentials()))
453
685
454
686
line = self.request.makefile().readline()
455
687
logger.debug(u"Protocol version: %r", line)
466
698
# using OpenPGP certificates.
467
699
468
700
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
469
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
470
# "+DHE-DSS"))
471
priority = "NORMAL" # Fallback default, since this
472
# MUST be set.
473
if self.server.settings["priority"]:
474
priority = self.server.settings["priority"]
475
gnutls.library.functions.gnutls_priority_set_direct\
476
(session._c_object, priority, None)
701
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
702
# "+DHE-DSS"))
703
# Use a fallback default, since this MUST be set.
704
priority = self.server.settings.get("priority", "NORMAL")
705
(gnutls.library.functions
706
.gnutls_priority_set_direct(session._c_object,
707
priority, None))
477
708
478
709
try:
479
710
session.handshake()
482
713
# Do not run session.bye() here: the session is not
483
714
# established. Just abandon the request.
484
715
return
716
logger.debug(u"Handshake succeeded")
485
717
try:
486
718
fpr = fingerprint(peer_certificate(session))
487
719
except (TypeError, gnutls.errors.GNUTLSError), error:
489
721
session.bye()
490
722
return
491
723
logger.debug(u"Fingerprint: %s", fpr)
492
client = None
724
493
725
for c in self.server.clients:
494
726
if c.fingerprint == fpr:
495
727
client = c
496
728
break
497
if not client:
729
else:
498
730
logger.warning(u"Client not found for fingerprint: %s",
499
731
fpr)
500
732
session.bye()
507
739
vars(client))
508
740
session.bye()
509
741
return
742
## This won't work here, since we're in a fork.
743
# client.checked_ok()
510
744
sent_size = 0
511
745
while sent_size < len(client.secret):
512
746
sent = session.send(client.secret[sent_size:])
517
751
session.bye()
518
752
519
753
520
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
521
"""IPv6 TCP server. Accepts 'None' as address and/or port.
754
class IPv6_TCPServer(SocketServer.ForkingMixIn,
755
SocketServer.TCPServer, object):
756
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
522
757
Attributes:
523
758
settings: Server settings
524
759
clients: Set() of Client objects
532
767
if "clients" in kwargs:
533
768
self.clients = kwargs["clients"]
534
769
del kwargs["clients"]
770
if "use_ipv6" in kwargs:
771
if not kwargs["use_ipv6"]:
772
self.address_family = socket.AF_INET
773
del kwargs["use_ipv6"]
535
774
self.enabled = False
536
775
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
537
776
def server_bind(self):
551
790
u" bind to interface %s",
552
791
self.settings["interface"])
553
792
else:
554
raise error
793
raise
555
794
# Only bind(2) the socket if we really need to.
556
795
if self.server_address[0] or self.server_address[1]:
557
796
if not self.server_address[0]:
558
in6addr_any = "::"
559
self.server_address = (in6addr_any,
797
if self.address_family == socket.AF_INET6:
798
any_address = "::" # in6addr_any
799
else:
800
any_address = socket.INADDR_ANY
801
self.server_address = (any_address,
560
802
self.server_address[1])
561
803
elif not self.server_address[1]:
562
804
self.server_address = (self.server_address[0],
578
820
579
821
def string_to_delta(interval):
580
822
"""Parse a string and return a datetime.timedelta
581
823
582
824
>>> string_to_delta('7d')
583
825
datetime.timedelta(7)
584
826
>>> string_to_delta('60s')
636
878
elif state == avahi.ENTRY_GROUP_FAILURE:
637
879
logger.critical(u"Avahi: Error in group state changed %s",
638
880
unicode(error))
639
raise AvahiGroupError("State changed: %s", str(error))
881
raise AvahiGroupError(u"State changed: %s" % unicode(error))
640
882
641
883
def if_nametoindex(interface):
642
884
"""Call the C function if_nametoindex(), or equivalent"""
643
885
global if_nametoindex
644
886
try:
645
if_nametoindex = ctypes.cdll.LoadLibrary\
646
(ctypes.util.find_library("c")).if_nametoindex
887
if_nametoindex = (ctypes.cdll.LoadLibrary
888
(ctypes.util.find_library("c"))
889
.if_nametoindex)
647
890
except (OSError, AttributeError):
648
891
if "struct" not in sys.modules:
649
892
import struct
652
895
def if_nametoindex(interface):
653
896
"Get an interface index the hard way, i.e. using fcntl()"
654
897
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
655
s = socket.socket()
656
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
657
struct.pack("16s16x", interface))
658
s.close()
898
with closing(socket.socket()) as s:
899
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
900
struct.pack("16s16x", interface))
659
901
interface_index = struct.unpack("I", ifreq[16:20])[0]
660
902
return interface_index
661
903
return if_nametoindex(interface)
685
927
686
928
687
929
def main():
688
parser = OptionParser(version = "%%prog %s" % version)
930
parser = optparse.OptionParser(version = "%%prog %s" % version)
689
931
parser.add_option("-i", "--interface", type="string",
690
932
metavar="IF", help="Bind to interface IF")
691
933
parser.add_option("-a", "--address", type="string",
692
934
help="Address to listen for requests on")
693
935
parser.add_option("-p", "--port", type="int",
694
936
help="Port number to receive requests on")
695
parser.add_option("--check", action="store_true", default=False,
937
parser.add_option("--check", action="store_true",
696
938
help="Run self-test")
697
939
parser.add_option("--debug", action="store_true",
698
940
help="Debug mode; run in foreground and log to"
705
947
default="/etc/mandos", metavar="DIR",
706
948
help="Directory to search for configuration"
707
949
" files")
950
parser.add_option("--no-dbus", action="store_false",
951
dest="use_dbus",
952
help="Do not provide D-Bus system bus"
953
" interface")
954
parser.add_option("--no-ipv6", action="store_false",
955
dest="use_ipv6", help="Do not use IPv6")
708
956
options = parser.parse_args()[0]
709
957
710
958
if options.check:
720
968
"priority":
721
969
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
722
970
"servicename": "Mandos",
971
"use_dbus": "True",
972
"use_ipv6": "True",
723
973
}
724
974
725
975
# Parse config file for server-global settings
728
978
server_config.read(os.path.join(options.configdir, "mandos.conf"))
729
979
# Convert the SafeConfigParser object to a dict
730
980
server_settings = server_config.defaults()
731
# Use getboolean on the boolean config option
732
server_settings["debug"] = server_config.getboolean\
733
("DEFAULT", "debug")
981
# Use the appropriate methods on the non-string config options
982
server_settings["debug"] = server_config.getboolean("DEFAULT",
983
"debug")
984
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
985
"use_dbus")
986
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
987
"use_ipv6")
988
if server_settings["port"]:
989
server_settings["port"] = server_config.getint("DEFAULT",
990
"port")
734
991
del server_config
735
992
736
993
# Override the settings from the config file with command line
737
994
# options, if set.
738
995
for option in ("interface", "address", "port", "debug",
739
"priority", "servicename", "configdir"):
996
"priority", "servicename", "configdir",
997
"use_dbus", "use_ipv6"):
740
998
value = getattr(options, option)
741
999
if value is not None:
742
1000
server_settings[option] = value
743
1001
del options
744
1002
# Now we have our good server settings in "server_settings"
745
1003
1004
# For convenience
746
1005
debug = server_settings["debug"]
1006
use_dbus = server_settings["use_dbus"]
1007
use_ipv6 = server_settings["use_ipv6"]
747
1008
748
1009
if not debug:
749
1010
syslogger.setLevel(logging.WARNING)
750
1011
console.setLevel(logging.WARNING)
751
1012
752
1013
if server_settings["servicename"] != "Mandos":
753
syslogger.setFormatter(logging.Formatter\
1014
syslogger.setFormatter(logging.Formatter
754
1015
('Mandos (%s): %%(levelname)s:'
755
1016
' %%(message)s'
756
1017
% server_settings["servicename"]))
758
1019
# Parse config file with clients
759
1020
client_defaults = { "timeout": "1h",
760
1021
"interval": "5m",
761
"checker": "fping -q -- %(host)s",
1022
"checker": "fping -q -- %%(host)s",
762
1023
"host": "",
763
1024
}
764
1025
client_config = ConfigParser.SafeConfigParser(client_defaults)
770
1031
server_settings["port"]),
771
1032
TCP_handler,
772
1033
settings=server_settings,
773
clients=clients)
1034
clients=clients, use_ipv6=use_ipv6)
774
1035
pidfilename = "/var/run/mandos.pid"
775
1036
try:
776
1037
pidfile = open(pidfilename, "w")
777
except IOError, error:
1038
except IOError:
778
1039
logger.error("Could not open file %r", pidfilename)
779
1040
780
uid = 65534
781
gid = 65534
782
try:
783
uid = pwd.getpwnam("mandos").pw_uid
784
except KeyError:
785
try:
786
uid = pwd.getpwnam("nobody").pw_uid
787
except KeyError:
788
pass
789
try:
790
gid = pwd.getpwnam("mandos").pw_gid
791
except KeyError:
792
try:
793
gid = pwd.getpwnam("nogroup").pw_gid
794
except KeyError:
795
pass
796
try:
1041
try:
1042
uid = pwd.getpwnam("_mandos").pw_uid
1043
gid = pwd.getpwnam("_mandos").pw_gid
1044
except KeyError:
1045
try:
1046
uid = pwd.getpwnam("mandos").pw_uid
1047
gid = pwd.getpwnam("mandos").pw_gid
1048
except KeyError:
1049
try:
1050
uid = pwd.getpwnam("nobody").pw_uid
1051
gid = pwd.getpwnam("nogroup").pw_gid
1052
except KeyError:
1053
uid = 65534
1054
gid = 65534
1055
try:
1056
os.setgid(gid)
797
1057
os.setuid(uid)
798
os.setgid(gid)
799
1058
except OSError, error:
800
1059
if error[0] != errno.EPERM:
801
1060
raise error
802
1061
1062
# Enable all possible GnuTLS debugging
1063
if debug:
1064
# "Use a log level over 10 to enable all debugging options."
1065
# - GnuTLS manual
1066
gnutls.library.functions.gnutls_global_set_log_level(11)
1067
1068
@gnutls.library.types.gnutls_log_func
1069
def debug_gnutls(level, string):
1070
logger.debug("GnuTLS: %s", string[:-1])
1071
1072
(gnutls.library.functions
1073
.gnutls_global_set_log_function(debug_gnutls))
1074
803
1075
global service
1076
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
804
1077
service = AvahiService(name = server_settings["servicename"],
805
servicetype = "_mandos._tcp", )
1078
servicetype = "_mandos._tcp",
1079
protocol = protocol)
806
1080
if server_settings["interface"]:
807
service.interface = if_nametoindex\
808
(server_settings["interface"])
1081
service.interface = (if_nametoindex
1082
(server_settings["interface"]))
809
1083
810
1084
global main_loop
811
1085
global bus
818
1092
avahi.DBUS_PATH_SERVER),
819
1093
avahi.DBUS_INTERFACE_SERVER)
820
1094
# End of Avahi example code
821
822
def remove_from_clients(client):
823
clients.remove(client)
824
if not clients:
825
logger.critical(u"No clients left, exiting")
826
sys.exit()
1095
if use_dbus:
1096
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
827
1097
828
1098
clients.update(Set(Client(name = section,
829
stop_hook = remove_from_clients,
830
1099
config
831
= dict(client_config.items(section)))
1100
= dict(client_config.items(section)),
1101
use_dbus = use_dbus)
832
1102
for section in client_config.sections()))
833
1103
if not clients:
834
logger.critical(u"No clients defined")
835
sys.exit(1)
1104
logger.warning(u"No clients defined")
836
1105
837
1106
if debug:
838
1107
# Redirect stdin so all checkers get /dev/null
870
1139
871
1140
while clients:
872
1141
client = clients.pop()
873
client.stop_hook = None
874
client.stop()
1142
client.disable_hook = None
1143
client.disable()
875
1144
876
1145
atexit.register(cleanup)
877
1146
880
1149
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
881
1150
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
882
1151
1152
if use_dbus:
1153
class MandosServer(dbus.service.Object):
1154
"""A D-Bus proxy object"""
1155
def __init__(self):
1156
dbus.service.Object.__init__(self, bus, "/")
1157
_interface = u"se.bsnet.fukt.Mandos"
1158
1159
@dbus.service.signal(_interface, signature="oa{sv}")
1160
def ClientAdded(self, objpath, properties):
1161
"D-Bus signal"
1162
pass
1163
1164
@dbus.service.signal(_interface, signature="os")
1165
def ClientRemoved(self, objpath, name):
1166
"D-Bus signal"
1167
pass
1168
1169
@dbus.service.method(_interface, out_signature="ao")
1170
def GetAllClients(self):
1171
"D-Bus method"
1172
return dbus.Array(c.dbus_object_path for c in clients)
1173
1174
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1175
def GetAllClientsWithProperties(self):
1176
"D-Bus method"
1177
return dbus.Dictionary(
1178
((c.dbus_object_path, c.GetAllProperties())
1179
for c in clients),
1180
signature="oa{sv}")
1181
1182
@dbus.service.method(_interface, in_signature="o")
1183
def RemoveClient(self, object_path):
1184
"D-Bus method"
1185
for c in clients:
1186
if c.dbus_object_path == object_path:
1187
clients.remove(c)
1188
# Don't signal anything except ClientRemoved
1189
c.use_dbus = False
1190
c.disable()
1191
# Emit D-Bus signal
1192
self.ClientRemoved(object_path, c.name)
1193
return
1194
raise KeyError
1195
1196
del _interface
1197
1198
mandos_server = MandosServer()
1199
883
1200
for client in clients:
884
client.start()
1201
if use_dbus:
1202
# Emit D-Bus signal
1203
mandos_server.ClientAdded(client.dbus_object_path,
1204
client.GetAllProperties())
1205
client.enable()
885
1206
886
1207
tcp_server.enable()
887
1208
tcp_server.server_activate()
888
1209
889
1210
# Find out what port we got
890
1211
service.port = tcp_server.socket.getsockname()[1]
891
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
892
u" scope_id %d" % tcp_server.socket.getsockname())
1212
if use_ipv6:
1213
logger.info(u"Now listening on address %r, port %d,"
1214
" flowinfo %d, scope_id %d"
1215
% tcp_server.socket.getsockname())
1216
else: # IPv4
1217
logger.info(u"Now listening on address %r, port %d"
1218
% tcp_server.socket.getsockname())
893
1219
894
1220
#service.interface = tcp_server.socket.getsockname()[3]
895
1221
905
1231
906
1232
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
907
1233
lambda *args, **kwargs:
908
tcp_server.handle_request\
909
(*args[2:], **kwargs) or True)
1234
(tcp_server.handle_request
1235
(*args[2:], **kwargs) or True))
910
1236
911
1237
logger.debug(u"Starting main loop")
912
1238
main_loop.run()
913
1239
except AvahiError, error:
914
logger.critical(u"AvahiError: %s" + unicode(error))
1240
logger.critical(u"AvahiError: %s", error)
915
1241
sys.exit(1)
916
1242
except KeyboardInterrupt:
917
1243
if debug:
918
print
1244
print >> sys.stderr
1245
logger.debug("Server received KeyboardInterrupt")
1246
logger.debug("Server exiting")
919
1247
920
1248
if __name__ == '__main__':
921
1249
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0