To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 45
- compare with another revision
- download diff
- download tarball
- view history from revision 45
- Committer: Teddy Hogeborn
- Date: 2008-08-04 21:25:55 UTC
- Revision ID: teddy@fukt.bsnet.se-20080804212555-rm7xxjze65f8avy3
* server.py: Cosmetic changes.
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos.conf => server.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
server.py
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
9
# following functions: "AvahiService.add", "AvahiService.remove",
10
# "server_state_changed", "entry_group_state_changed", and some lines
11
# in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008 Teddy Hogeborn
15
# Copyright © 2008 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
# GNU General Public License for more details.
26
25
#
27
26
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
30
28
#
31
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
30
#
33
31
34
from __future__ import division, with_statement, absolute_import
32
from __future__ import division
35
33
36
34
import SocketServer
37
35
import socket
36
import select
38
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
import pwd
59
from contextlib import closing
60
57
61
58
import dbus
62
import dbus.service
63
59
import gobject
64
60
import avahi
65
61
from dbus.mainloop.glib import DBusGMainLoop
66
62
import ctypes
67
import ctypes.util
68
69
version = "1.0.2"
63
64
# Brief description of the operation of this program:
65
#
66
# This server announces itself as a Zeroconf service. Connecting
67
# clients use the TLS protocol, with the unusual quirk that this
68
# server program acts as a TLS "client" while a connecting client acts
69
# as a TLS "server". The client (acting as a TLS "server") must
70
# supply an OpenPGP certificate, and the fingerprint of this
71
# certificate is used by this server to look up (in a list read from a
72
# file at start time) which binary blob to give the client. No other
73
# authentication or authorization is done by this server.
74
70
75
71
76
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
77
syslogger = logging.handlers.SysLogHandler\
78
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
79
syslogger.setFormatter(logging.Formatter\
80
('%(levelname)s: %(message)s'))
77
81
logger.addHandler(syslogger)
82
del syslogger
78
83
79
console = logging.StreamHandler()
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
82
logger.addHandler(console)
83
84
84
85
class AvahiError(Exception):
85
86
def __init__(self, value):
86
87
self.value = value
87
super(AvahiError, self).__init__()
88
88
def __str__(self):
89
89
return repr(self.value)
90
90
112
112
a sensible number of times
113
113
"""
114
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
115
type = None, port = None, TXT = None, domain = "",
116
host = "", max_renames = 12):
117
117
self.interface = interface
118
118
self.name = name
119
self.type = servicetype
119
self.type = type
120
120
self.port = port
121
self.TXT = TXT if TXT is not None else []
121
if TXT is None:
122
self.TXT = []
123
else:
124
self.TXT = TXT
122
125
self.domain = domain
123
126
self.host = host
124
127
self.rename_count = 0
125
self.max_renames = max_renames
126
128
def rename(self):
127
129
"""Derived from the Avahi example code"""
128
130
if self.rename_count >= self.max_renames:
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
131
logger.critical(u"No suitable service name found after %i"
132
u" retries, exiting.", rename_count)
132
133
raise AvahiServiceError("Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
134
name = server.GetAlternativeServiceName(name)
135
logger.error(u"Changing name to %r ...", name)
139
136
self.remove()
140
137
self.add()
141
138
self.rename_count += 1
147
144
"""Derived from the Avahi example code"""
148
145
global group
149
146
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
147
group = dbus.Interface\
148
(bus.get_object(avahi.DBUS_NAME,
152
149
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
150
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
151
group.connect_to_signal('StateChanged',
155
152
entry_group_state_changed)
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
153
logger.debug(u"Adding service '%s' of type '%s' ...",
157
154
service.name, service.type)
158
155
group.AddService(
159
156
self.interface, # interface
170
167
# End of Avahi example code
171
168
172
169
173
class Client(dbus.service.Object):
170
class Client(object):
174
171
"""A representation of a client host served by this server.
175
172
Attributes:
176
173
name: string; from the config file, used in log messages
177
174
fingerprint: string (40 or 32 hexadecimal digits); used to
178
175
uniquely identify the client
179
176
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); (UTC) object creation
182
started: datetime.datetime(); (UTC) last started
183
last_checked_ok: datetime.datetime(); (UTC) or None
177
fqdn: string (FQDN); available for use by the checker command
178
created: datetime.datetime(); object creation, not client host
179
last_checked_ok: datetime.datetime() or None if not yet checked OK
184
180
timeout: datetime.timedelta(); How long from last_checked_ok
185
181
until this client is invalid
186
182
interval: datetime.timedelta(); How often to start a new checker
202
198
_interval_milliseconds: - '' -
203
199
"""
204
200
def _set_timeout(self, timeout):
205
"Setter function for the 'timeout' attribute"
201
"Setter function for 'timeout' attribute"
206
202
self._timeout = timeout
207
203
self._timeout_milliseconds = ((self.timeout.days
208
204
* 24 * 60 * 60 * 1000)
209
205
+ (self.timeout.seconds * 1000)
210
206
+ (self.timeout.microseconds
211
207
// 1000))
212
# Emit D-Bus signal
213
self.TimeoutChanged(self._timeout_milliseconds)
214
timeout = property(lambda self: self._timeout, _set_timeout)
208
timeout = property(lambda self: self._timeout,
209
_set_timeout)
215
210
del _set_timeout
216
217
211
def _set_interval(self, interval):
218
"Setter function for the 'interval' attribute"
212
"Setter function for 'interval' attribute"
219
213
self._interval = interval
220
214
self._interval_milliseconds = ((self.interval.days
221
215
* 24 * 60 * 60 * 1000)
223
217
* 1000)
224
218
+ (self.interval.microseconds
225
219
// 1000))
226
# Emit D-Bus signal
227
self.IntervalChanged(self._interval_milliseconds)
228
interval = property(lambda self: self._interval, _set_interval)
220
interval = property(lambda self: self._interval,
221
_set_interval)
229
222
del _set_interval
230
231
def __init__(self, name = None, stop_hook=None, config=None):
223
def __init__(self, name = None, stop_hook=None, config={}):
232
224
"""Note: the 'checker' key in 'config' sets the
233
225
'checker_command' attribute and *not* the 'checker'
234
226
attribute."""
235
dbus.service.Object.__init__(self, bus,
236
"/Mandos/clients/%s"
237
% name.replace(".", "_"))
238
if config is None:
239
config = {}
240
227
self.name = name
241
228
logger.debug(u"Creating client %r", self.name)
242
229
# Uppercase and remove spaces from fingerprint for later
243
230
# comparison purposes with return value from the fingerprint()
244
231
# function
245
self.fingerprint = (config["fingerprint"].upper()
246
.replace(u" ", u""))
232
self.fingerprint = config["fingerprint"].upper()\
233
.replace(u" ", u"")
247
234
logger.debug(u" Fingerprint: %s", self.fingerprint)
248
235
if "secret" in config:
249
236
self.secret = config["secret"].decode(u"base64")
250
237
elif "secfile" in config:
251
with closing(open(os.path.expanduser
252
(os.path.expandvars
253
(config["secfile"])))) as secfile:
254
self.secret = secfile.read()
238
sf = open(config["secfile"])
239
self.secret = sf.read()
240
sf.close()
255
241
else:
256
242
raise TypeError(u"No secret or secfile for client %s"
257
243
% self.name)
258
self.host = config.get("host", "")
259
self.created = datetime.datetime.utcnow()
260
self.started = None
244
self.fqdn = config.get("fqdn", "")
245
self.created = datetime.datetime.now()
261
246
self.last_checked_ok = None
262
247
self.timeout = string_to_delta(config["timeout"])
263
248
self.interval = string_to_delta(config["interval"])
267
252
self.stop_initiator_tag = None
268
253
self.checker_callback_tag = None
269
254
self.check_command = config["checker"]
270
271
255
def start(self):
272
256
"""Start this client's checker and timeout hooks"""
273
self.started = datetime.datetime.utcnow()
274
257
# Schedule a new checker to be started an 'interval' from now,
275
258
# and every interval from then on.
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self._interval_milliseconds,
278
self.start_checker))
259
self.checker_initiator_tag = gobject.timeout_add\
260
(self._interval_milliseconds,
261
self.start_checker)
279
262
# Also start a new checker *right now*.
280
263
self.start_checker()
281
264
# Schedule a stop() when 'timeout' has passed
282
self.stop_initiator_tag = (gobject.timeout_add
283
(self._timeout_milliseconds,
284
self.stop))
285
# Emit D-Bus signal
286
self.StateChanged(True)
287
265
self.stop_initiator_tag = gobject.timeout_add\
266
(self._timeout_milliseconds,
267
self.stop)
288
268
def stop(self):
289
"""Stop this client."""
290
if getattr(self, "started", None) is not None:
269
"""Stop this client.
270
The possibility that a client might be restarted is left open,
271
but not currently used."""
272
# If this client doesn't have a secret, it is already stopped.
273
if self.secret:
291
274
logger.info(u"Stopping client %s", self.name)
275
self.secret = None
292
276
else:
293
277
return False
294
278
if getattr(self, "stop_initiator_tag", False):
300
284
self.stop_checker()
301
285
if self.stop_hook:
302
286
self.stop_hook(self)
303
self.started = None
304
# Emit D-Bus signal
305
self.StateChanged(False)
306
287
# Do not run this again if called by a gobject.timeout_add
307
288
return False
308
309
289
def __del__(self):
310
290
self.stop_hook = None
311
291
self.stop()
312
313
292
def checker_callback(self, pid, condition):
314
293
"""The checker has completed, so take appropriate actions."""
294
now = datetime.datetime.now()
315
295
self.checker_callback_tag = None
316
296
self.checker = None
317
if (os.WIFEXITED(condition)
318
and (os.WEXITSTATUS(condition) == 0)):
297
if os.WIFEXITED(condition) \
298
and (os.WEXITSTATUS(condition) == 0):
319
299
logger.info(u"Checker for %(name)s succeeded",
320
300
vars(self))
321
# Emit D-Bus signal
322
self.CheckerCompleted(True)
323
self.bump_timeout()
301
self.last_checked_ok = now
302
gobject.source_remove(self.stop_initiator_tag)
303
self.stop_initiator_tag = gobject.timeout_add\
304
(self._timeout_milliseconds,
305
self.stop)
324
306
elif not os.WIFEXITED(condition):
325
307
logger.warning(u"Checker for %(name)s crashed?",
326
308
vars(self))
327
# Emit D-Bus signal
328
self.CheckerCompleted(False)
329
309
else:
330
310
logger.info(u"Checker for %(name)s failed",
331
311
vars(self))
332
# Emit D-Bus signal
333
self.CheckerCompleted(False)
334
335
def bump_timeout(self):
336
"""Bump up the timeout for this client.
337
This should only be called when the client has been seen,
338
alive and well.
339
"""
340
self.last_checked_ok = datetime.datetime.utcnow()
341
gobject.source_remove(self.stop_initiator_tag)
342
self.stop_initiator_tag = (gobject.timeout_add
343
(self._timeout_milliseconds,
344
self.stop))
345
346
312
def start_checker(self):
347
313
"""Start a new checker subprocess if one is not running.
348
314
If a checker already exists, leave it running and do
358
324
if self.checker is None:
359
325
try:
360
326
# In case check_command has exactly one % operator
361
command = self.check_command % self.host
327
command = self.check_command % self.fqdn
362
328
except TypeError:
363
329
# Escape attributes for the shell
364
330
escaped_attrs = dict((key, re.escape(str(val)))
373
339
try:
374
340
logger.info(u"Starting checker %r for %s",
375
341
command, self.name)
376
# We don't need to redirect stdout and stderr, since
377
# in normal mode, that is already done by daemon(),
378
# and in debug mode we don't want to. (Stdin is
379
# always replaced by /dev/null.)
380
342
self.checker = subprocess.Popen(command,
381
343
close_fds=True,
382
344
shell=True, cwd="/")
383
self.checker_callback_tag = (gobject.child_watch_add
384
(self.checker.pid,
385
self.checker_callback))
386
# Emit D-Bus signal
387
self.CheckerStarted(command)
388
except OSError, error:
345
self.checker_callback_tag = gobject.child_watch_add\
346
(self.checker.pid,
347
self.checker_callback)
348
except subprocess.OSError, error:
389
349
logger.error(u"Failed to start subprocess: %s",
390
350
error)
391
351
# Re-run this periodically if run by gobject.timeout_add
392
352
return True
393
394
353
def stop_checker(self):
395
354
"""Force the checker process, if any, to stop."""
396
355
if self.checker_callback_tag:
398
357
self.checker_callback_tag = None
399
358
if getattr(self, "checker", None) is None:
400
359
return
401
logger.debug(u"Stopping checker for %(name)s", vars(self))
360
logger.debug("Stopping checker for %(name)s", vars(self))
402
361
try:
403
362
os.kill(self.checker.pid, signal.SIGTERM)
404
363
#os.sleep(0.5)
408
367
if error.errno != errno.ESRCH: # No such process
409
368
raise
410
369
self.checker = None
411
412
370
def still_valid(self):
413
371
"""Has the timeout not yet passed for this client?"""
414
if not self.started:
415
return False
416
now = datetime.datetime.utcnow()
372
now = datetime.datetime.now()
417
373
if self.last_checked_ok is None:
418
374
return now < (self.created + self.timeout)
419
375
else:
420
376
return now < (self.last_checked_ok + self.timeout)
421
422
## D-Bus methods & signals
423
_interface = u"org.mandos_system.Mandos.Client"
424
425
def _datetime_to_dbus_struct(dt):
426
return dbus.Struct(dt.year, dt.month, dt.day, dt.hour,
427
dt.minute, dt.second, dt.microsecond,
428
signature="nyyyyyu")
429
430
# BumpTimeout - method
431
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
432
BumpTimeout.__name__ = "BumpTimeout"
433
434
# IntervalChanged - signal
435
@dbus.service.signal(_interface, signature="t")
436
def IntervalChanged(self, t):
437
"D-Bus signal"
438
pass
439
440
# CheckerCompleted - signal
441
@dbus.service.signal(_interface, signature="b")
442
def CheckerCompleted(self, success):
443
"D-Bus signal"
444
pass
445
446
# CheckerIsRunning - method
447
@dbus.service.method(_interface, out_signature="b")
448
def CheckerIsRunning(self):
449
"D-Bus getter method"
450
return self.checker is not None
451
452
# CheckerStarted - signal
453
@dbus.service.signal(_interface, signature="s")
454
def CheckerStarted(self, command):
455
"D-Bus signal"
456
pass
457
458
# GetChecker - method
459
@dbus.service.method(_interface, out_signature="s")
460
def GetChecker(self):
461
"D-Bus getter method"
462
return self.checker_command
463
464
# GetCreated - method
465
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
466
def GetCreated(self):
467
"D-Bus getter method"
468
return datetime_to_dbus_struct(self.created)
469
470
# GetFingerprint - method
471
@dbus.service.method(_interface, out_signature="s")
472
def GetFingerprint(self):
473
"D-Bus getter method"
474
return self.fingerprint
475
476
# GetHost - method
477
@dbus.service.method(_interface, out_signature="s")
478
def GetHost(self):
479
"D-Bus getter method"
480
return self.host
481
482
# GetInterval - method
483
@dbus.service.method(_interface, out_signature="t")
484
def GetInterval(self):
485
"D-Bus getter method"
486
return self._interval_milliseconds
487
488
# GetName - method
489
@dbus.service.method(_interface, out_signature="s")
490
def GetName(self):
491
"D-Bus getter method"
492
return self.name
493
494
# GetStarted - method
495
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
496
def GetStarted(self):
497
"D-Bus getter method"
498
if self.started is not None:
499
return datetime_to_dbus_struct(self.started)
500
else:
501
return dbus.Struct(0, 0, 0, 0, 0, 0, 0,
502
signature="nyyyyyu")
503
504
# GetTimeout - method
505
@dbus.service.method(_interface, out_signature="t")
506
def GetTimeout(self):
507
"D-Bus getter method"
508
return self._timeout_milliseconds
509
510
# SetChecker - method
511
@dbus.service.method(_interface, in_signature="s")
512
def SetChecker(self, checker):
513
"D-Bus setter method"
514
self.checker_command = checker
515
516
# SetHost - method
517
@dbus.service.method(_interface, in_signature="s")
518
def SetHost(self, host):
519
"D-Bus setter method"
520
self.host = host
521
522
# SetInterval - method
523
@dbus.service.method(_interface, in_signature="t")
524
def SetInterval(self, milliseconds):
525
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
526
527
# SetTimeout - method
528
@dbus.service.method(_interface, in_signature="t")
529
def SetTimeout(self, milliseconds):
530
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
531
532
# SetSecret - method
533
@dbus.service.method(_interface, in_signature="ay",
534
byte_arrays=True)
535
def SetSecret(self, secret):
536
"D-Bus setter method"
537
self.secret = str(secret)
538
539
# Start - method
540
Start = dbus.service.method(_interface)(start)
541
Start.__name__ = "Start"
542
543
# StartChecker - method
544
StartChecker = dbus.service.method(_interface)(start_checker)
545
StartChecker.__name__ = "StartChecker"
546
547
# StateChanged - signal
548
@dbus.service.signal(_interface, signature="b")
549
def StateChanged(self, started):
550
"D-Bus signal"
551
pass
552
553
# StillValid - method
554
StillValid = (dbus.service.method(_interface, out_signature="b")
555
(still_valid))
556
StillValid.__name__ = "StillValid"
557
558
# Stop - method
559
Stop = dbus.service.method(_interface)(stop)
560
Stop.__name__ = "Stop"
561
562
# StopChecker - method
563
StopChecker = dbus.service.method(_interface)(stop_checker)
564
StopChecker.__name__ = "StopChecker"
565
566
# TimeoutChanged - signal
567
@dbus.service.signal(_interface, signature="t")
568
def TimeoutChanged(self, t):
569
"D-Bus signal"
570
pass
571
572
del _datetime_to_dbus_struct
573
del _interface
574
377
575
378
576
379
def peer_certificate(session):
577
380
"Return the peer's OpenPGP certificate as a bytestring"
578
381
# If not an OpenPGP certificate...
579
if (gnutls.library.functions
580
.gnutls_certificate_type_get(session._c_object)
581
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
382
if gnutls.library.functions.gnutls_certificate_type_get\
383
(session._c_object) \
384
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
582
385
# ...do the normal thing
583
386
return session.peer_certificate
584
387
list_size = ctypes.c_uint()
585
cert_list = (gnutls.library.functions
586
.gnutls_certificate_get_peers
587
(session._c_object, ctypes.byref(list_size)))
388
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
389
(session._c_object, ctypes.byref(list_size))
588
390
if list_size.value == 0:
589
391
return None
590
392
cert = cert_list[0]
594
396
def fingerprint(openpgp):
595
397
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
596
398
# New GnuTLS "datum" with the OpenPGP public key
597
datum = (gnutls.library.types
598
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
599
ctypes.POINTER
600
(ctypes.c_ubyte)),
601
ctypes.c_uint(len(openpgp))))
399
datum = gnutls.library.types.gnutls_datum_t\
400
(ctypes.cast(ctypes.c_char_p(openpgp),
401
ctypes.POINTER(ctypes.c_ubyte)),
402
ctypes.c_uint(len(openpgp)))
602
403
# New empty GnuTLS certificate
603
404
crt = gnutls.library.types.gnutls_openpgp_crt_t()
604
(gnutls.library.functions
605
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
405
gnutls.library.functions.gnutls_openpgp_crt_init\
406
(ctypes.byref(crt))
606
407
# Import the OpenPGP public key into the certificate
607
(gnutls.library.functions
608
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
609
gnutls.library.constants
610
.GNUTLS_OPENPGP_FMT_RAW))
611
# Verify the self signature in the key
612
crtverify = ctypes.c_uint()
613
(gnutls.library.functions
614
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
615
if crtverify.value != 0:
616
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
617
raise gnutls.errors.CertificateSecurityError("Verify failed")
408
gnutls.library.functions.gnutls_openpgp_crt_import\
409
(crt, ctypes.byref(datum),
410
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
618
411
# New buffer for the fingerprint
619
buf = ctypes.create_string_buffer(20)
620
buf_len = ctypes.c_size_t()
412
buffer = ctypes.create_string_buffer(20)
413
buffer_length = ctypes.c_size_t()
621
414
# Get the fingerprint from the certificate into the buffer
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
624
ctypes.byref(buf_len)))
415
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
416
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
625
417
# Deinit the certificate
626
418
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
419
# Convert the buffer to a Python bytestring
628
fpr = ctypes.string_at(buf, buf_len.value)
420
fpr = ctypes.string_at(buffer, buffer_length.value)
629
421
# Convert the bytestring to hexadecimal notation
630
422
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
631
423
return hex_fpr
632
424
633
425
634
class TCP_handler(SocketServer.BaseRequestHandler, object):
426
class tcp_handler(SocketServer.BaseRequestHandler, object):
635
427
"""A TCP request handler class.
636
428
Instantiated by IPv6_TCPServer for each request to handle it.
637
429
Note: This will run in its own forked process."""
638
430
639
431
def handle(self):
640
432
logger.info(u"TCP connection from: %s",
641
unicode(self.client_address))
642
session = (gnutls.connection
643
.ClientSession(self.request,
644
gnutls.connection
645
.X509Credentials()))
433
unicode(self.client_address))
434
session = gnutls.connection.ClientSession\
435
(self.request, gnutls.connection.X509Credentials())
646
436
647
437
line = self.request.makefile().readline()
648
438
logger.debug(u"Protocol version: %r", line)
661
451
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
662
452
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
663
453
# "+DHE-DSS"))
664
# Use a fallback default, since this MUST be set.
665
priority = self.server.settings.get("priority", "NORMAL")
666
(gnutls.library.functions
667
.gnutls_priority_set_direct(session._c_object,
668
priority, None))
454
priority = "NORMAL" # Fallback default, since this
455
# MUST be set.
456
if self.server.settings["priority"]:
457
priority = self.server.settings["priority"]
458
gnutls.library.functions.gnutls_priority_set_direct\
459
(session._c_object, priority, None);
669
460
670
461
try:
671
462
session.handshake()
681
472
session.bye()
682
473
return
683
474
logger.debug(u"Fingerprint: %s", fpr)
475
client = None
684
476
for c in self.server.clients:
685
477
if c.fingerprint == fpr:
686
478
client = c
687
479
break
688
else:
480
if not client:
689
481
logger.warning(u"Client not found for fingerprint: %s",
690
482
fpr)
691
483
session.bye()
698
490
vars(client))
699
491
session.bye()
700
492
return
701
## This won't work here, since we're in a fork.
702
# client.bump_timeout()
703
493
sent_size = 0
704
494
while sent_size < len(client.secret):
705
495
sent = session.send(client.secret[sent_size:])
710
500
session.bye()
711
501
712
502
713
class IPv6_TCPServer(SocketServer.ForkingMixIn,
714
SocketServer.TCPServer, object):
503
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
715
504
"""IPv6 TCP server. Accepts 'None' as address and/or port.
716
505
Attributes:
717
506
settings: Server settings
718
507
clients: Set() of Client objects
719
enabled: Boolean; whether this server is activated yet
720
508
"""
721
509
address_family = socket.AF_INET6
722
510
def __init__(self, *args, **kwargs):
726
514
if "clients" in kwargs:
727
515
self.clients = kwargs["clients"]
728
516
del kwargs["clients"]
729
self.enabled = False
730
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
517
return super(type(self), self).__init__(*args, **kwargs)
731
518
def server_bind(self):
732
519
"""This overrides the normal server_bind() function
733
520
to bind to an interface if one was specified, and also NOT to
752
539
in6addr_any = "::"
753
540
self.server_address = (in6addr_any,
754
541
self.server_address[1])
755
elif not self.server_address[1]:
542
elif self.server_address[1] is None:
756
543
self.server_address = (self.server_address[0],
757
544
0)
758
# if self.settings["interface"]:
759
# self.server_address = (self.server_address[0],
760
# 0, # port
761
# 0, # flowinfo
762
# if_nametoindex
763
# (self.settings
764
# ["interface"]))
765
return super(IPv6_TCPServer, self).server_bind()
766
def server_activate(self):
767
if self.enabled:
768
return super(IPv6_TCPServer, self).server_activate()
769
def enable(self):
770
self.enabled = True
545
return super(type(self), self).server_bind()
771
546
772
547
773
548
def string_to_delta(interval):
783
558
datetime.timedelta(1)
784
559
>>> string_to_delta(u'1w')
785
560
datetime.timedelta(7)
786
>>> string_to_delta('5m 30s')
787
datetime.timedelta(0, 330)
788
561
"""
789
timevalue = datetime.timedelta(0)
790
for s in interval.split():
791
try:
792
suffix = unicode(s[-1])
793
value = int(s[:-1])
794
if suffix == u"d":
795
delta = datetime.timedelta(value)
796
elif suffix == u"s":
797
delta = datetime.timedelta(0, value)
798
elif suffix == u"m":
799
delta = datetime.timedelta(0, 0, 0, 0, value)
800
elif suffix == u"h":
801
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
802
elif suffix == u"w":
803
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
804
else:
805
raise ValueError
806
except (ValueError, IndexError):
562
try:
563
suffix=unicode(interval[-1])
564
value=int(interval[:-1])
565
if suffix == u"d":
566
delta = datetime.timedelta(value)
567
elif suffix == u"s":
568
delta = datetime.timedelta(0, value)
569
elif suffix == u"m":
570
delta = datetime.timedelta(0, 0, 0, 0, value)
571
elif suffix == u"h":
572
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
573
elif suffix == u"w":
574
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
575
else:
807
576
raise ValueError
808
timevalue += delta
809
return timevalue
577
except (ValueError, IndexError):
578
raise ValueError
579
return delta
810
580
811
581
812
582
def server_state_changed(state):
813
583
"""Derived from the Avahi example code"""
814
584
if state == avahi.SERVER_COLLISION:
815
logger.error(u"Zeroconf server name collision")
585
logger.error(u"Server name collision")
816
586
service.remove()
817
587
elif state == avahi.SERVER_RUNNING:
818
588
service.add()
820
590
821
591
def entry_group_state_changed(state, error):
822
592
"""Derived from the Avahi example code"""
823
logger.debug(u"Avahi state change: %i", state)
593
logger.debug(u"state change: %i", state)
824
594
825
595
if state == avahi.ENTRY_GROUP_ESTABLISHED:
826
logger.debug(u"Zeroconf service established.")
596
logger.debug(u"Service established.")
827
597
elif state == avahi.ENTRY_GROUP_COLLISION:
828
logger.warning(u"Zeroconf service name collision.")
598
logger.warning(u"Service name collision.")
829
599
service.rename()
830
600
elif state == avahi.ENTRY_GROUP_FAILURE:
831
logger.critical(u"Avahi: Error in group state changed %s",
601
logger.critical(u"Error in group state changed %s",
832
602
unicode(error))
833
603
raise AvahiGroupError("State changed: %s", str(error))
834
604
836
606
"""Call the C function if_nametoindex(), or equivalent"""
837
607
global if_nametoindex
838
608
try:
839
if_nametoindex = (ctypes.cdll.LoadLibrary
840
(ctypes.util.find_library("c"))
841
.if_nametoindex)
609
if "ctypes.util" not in sys.modules:
610
import ctypes.util
611
if_nametoindex = ctypes.cdll.LoadLibrary\
612
(ctypes.util.find_library("c")).if_nametoindex
842
613
except (OSError, AttributeError):
843
614
if "struct" not in sys.modules:
844
615
import struct
847
618
def if_nametoindex(interface):
848
619
"Get an interface index the hard way, i.e. using fcntl()"
849
620
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
850
with closing(socket.socket()) as s:
851
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
852
struct.pack("16s16x", interface))
621
s = socket.socket()
622
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
623
struct.pack("16s16x", interface))
624
s.close()
853
625
interface_index = struct.unpack("I", ifreq[16:20])[0]
854
626
return interface_index
855
627
return if_nametoindex(interface)
856
628
857
629
858
def daemon(nochdir = False, noclose = False):
630
def daemon(nochdir, noclose):
859
631
"""See daemon(3). Standard BSD Unix function.
860
632
This should really exist as os.daemon, but it doesn't (yet)."""
861
633
if os.fork():
863
635
os.setsid()
864
636
if not nochdir:
865
637
os.chdir("/")
866
if os.fork():
867
sys.exit()
868
638
if not noclose:
869
639
# Close all standard open file descriptors
870
640
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
879
649
880
650
881
651
def main():
882
parser = OptionParser(version = "%%prog %s" % version)
652
global main_loop_started
653
main_loop_started = False
654
655
parser = OptionParser()
883
656
parser.add_option("-i", "--interface", type="string",
884
657
metavar="IF", help="Bind to interface IF")
885
658
parser.add_option("-a", "--address", type="string",
888
661
help="Port number to receive requests on")
889
662
parser.add_option("--check", action="store_true", default=False,
890
663
help="Run self-test")
891
parser.add_option("--debug", action="store_true",
664
parser.add_option("--debug", action="store_true", default=False,
892
665
help="Debug mode; run in foreground and log to"
893
666
" terminal")
894
667
parser.add_option("--priority", type="string", help="GnuTLS"
899
672
default="/etc/mandos", metavar="DIR",
900
673
help="Directory to search for configuration"
901
674
" files")
902
options = parser.parse_args()[0]
675
(options, args) = parser.parse_args()
903
676
904
677
if options.check:
905
678
import doctest
919
692
# Parse config file for server-global settings
920
693
server_config = ConfigParser.SafeConfigParser(server_defaults)
921
694
del server_defaults
922
server_config.read(os.path.join(options.configdir, "mandos.conf"))
695
server_config.read(os.path.join(options.configdir, "server.conf"))
696
server_section = "server"
923
697
# Convert the SafeConfigParser object to a dict
924
server_settings = server_config.defaults()
698
server_settings = dict(server_config.items(server_section))
925
699
# Use getboolean on the boolean config option
926
server_settings["debug"] = (server_config.getboolean
927
("DEFAULT", "debug"))
700
server_settings["debug"] = server_config.getboolean\
701
(server_section, "debug")
928
702
del server_config
929
703
930
704
# Override the settings from the config file with command line
937
711
del options
938
712
# Now we have our good server settings in "server_settings"
939
713
940
debug = server_settings["debug"]
941
942
if not debug:
943
syslogger.setLevel(logging.WARNING)
944
console.setLevel(logging.WARNING)
945
946
if server_settings["servicename"] != "Mandos":
947
syslogger.setFormatter(logging.Formatter
948
('Mandos (%s): %%(levelname)s:'
949
' %%(message)s'
950
% server_settings["servicename"]))
951
952
714
# Parse config file with clients
953
715
client_defaults = { "timeout": "1h",
954
716
"interval": "5m",
955
"checker": "fping -q -- %(host)s",
956
"host": "",
717
"checker": "fping -q -- %%(fqdn)s",
957
718
}
958
719
client_config = ConfigParser.SafeConfigParser(client_defaults)
959
720
client_config.read(os.path.join(server_settings["configdir"],
960
721
"clients.conf"))
961
722
962
clients = Set()
963
tcp_server = IPv6_TCPServer((server_settings["address"],
964
server_settings["port"]),
965
TCP_handler,
966
settings=server_settings,
967
clients=clients)
968
pidfilename = "/var/run/mandos.pid"
969
try:
970
pidfile = open(pidfilename, "w")
971
except IOError, error:
972
logger.error("Could not open file %r", pidfilename)
973
974
uid = 65534
975
gid = 65534
976
try:
977
uid = pwd.getpwnam("mandos").pw_uid
978
except KeyError:
979
try:
980
uid = pwd.getpwnam("nobody").pw_uid
981
except KeyError:
982
pass
983
try:
984
gid = pwd.getpwnam("mandos").pw_gid
985
except KeyError:
986
try:
987
gid = pwd.getpwnam("nogroup").pw_gid
988
except KeyError:
989
pass
990
try:
991
os.setuid(uid)
992
os.setgid(gid)
993
except OSError, error:
994
if error[0] != errno.EPERM:
995
raise error
996
997
723
global service
998
724
service = AvahiService(name = server_settings["servicename"],
999
servicetype = "_mandos._tcp", )
725
type = "_mandos._tcp", );
1000
726
if server_settings["interface"]:
1001
service.interface = (if_nametoindex
1002
(server_settings["interface"]))
727
service.interface = if_nametoindex(server_settings["interface"])
1003
728
1004
729
global main_loop
1005
730
global bus
1008
733
DBusGMainLoop(set_as_default=True )
1009
734
main_loop = gobject.MainLoop()
1010
735
bus = dbus.SystemBus()
1011
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1012
avahi.DBUS_PATH_SERVER),
1013
avahi.DBUS_INTERFACE_SERVER)
736
server = dbus.Interface(
737
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
738
avahi.DBUS_INTERFACE_SERVER )
1014
739
# End of Avahi example code
1015
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
1016
740
741
debug = server_settings["debug"]
742
743
if debug:
744
console = logging.StreamHandler()
745
# console.setLevel(logging.DEBUG)
746
console.setFormatter(logging.Formatter\
747
('%(levelname)s: %(message)s'))
748
logger.addHandler(console)
749
del console
750
751
clients = Set()
1017
752
def remove_from_clients(client):
1018
753
clients.remove(client)
1019
754
if not clients:
1025
760
config
1026
761
= dict(client_config.items(section)))
1027
762
for section in client_config.sections()))
1028
if not clients:
1029
logger.critical(u"No clients defined")
1030
sys.exit(1)
1031
1032
if debug:
1033
# Redirect stdin so all checkers get /dev/null
1034
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1035
os.dup2(null, sys.stdin.fileno())
1036
if null > 2:
1037
os.close(null)
1038
else:
1039
# No console logging
1040
logger.removeHandler(console)
1041
# Close all input and output, do double fork, etc.
1042
daemon()
1043
1044
try:
1045
pid = os.getpid()
1046
pidfile.write(str(pid) + "\n")
1047
pidfile.close()
1048
del pidfile
1049
except IOError:
1050
logger.error(u"Could not write to file %r with PID %d",
1051
pidfilename, pid)
1052
except NameError:
1053
# "pidfile" was never created
1054
pass
1055
del pidfilename
763
764
if not debug:
765
daemon(False, False)
1056
766
1057
767
def cleanup():
1058
768
"Cleanup function; run on exit"
1078
788
for client in clients:
1079
789
client.start()
1080
790
1081
tcp_server.enable()
1082
tcp_server.server_activate()
1083
791
tcp_server = IPv6_TCPServer((server_settings["address"],
792
server_settings["port"]),
793
tcp_handler,
794
settings=server_settings,
795
clients=clients)
1084
796
# Find out what port we got
1085
797
service.port = tcp_server.socket.getsockname()[1]
1086
798
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1100
812
1101
813
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1102
814
lambda *args, **kwargs:
1103
(tcp_server.handle_request
1104
(*args[2:], **kwargs) or True))
815
tcp_server.handle_request\
816
(*args[2:], **kwargs) or True)
1105
817
1106
logger.debug(u"Starting main loop")
818
logger.debug("Starting main loop")
819
main_loop_started = True
1107
820
main_loop.run()
1108
821
except AvahiError, error:
1109
822
logger.critical(u"AvahiError: %s" + unicode(error))
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0