To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 47
- compare with another revision
- download diff
- download tarball
- view history from revision 47
- Committer: Teddy Hogeborn
- Date: 2008-08-07 21:45:41 UTC
- Revision ID: teddy@fukt.bsnet.se-20080807214541-pyg8itw6kphz1dy5
* plugbasedclient.c: Renamed to "mandos-client.c". All users changed.
* plugins.d/mandosclient.c: Renamed to "plugins.d/password-request.c".
All users changed.
* plugins.d/passprompt.c: Renamed to "plugins.d/password-prompt.c".
All users changed.
* server.conf: Renamed to "mandos.conf". All users changed.
* server.py: Renamed to "mandos".
(daemon): Have default values for arguments. Caller changed.
* Makefile (distclean, mostlyclean, maintainer-clean): New aliases for
"clean".
(check, run-client, run-server): New.
* network-protocol.txt: New.
* plugins.d/mandosclient.c: Renamed to "plugins.d/password-request.c".
All users changed.
* plugins.d/passprompt.c: Renamed to "plugins.d/password-prompt.c".
All users changed.
* server.conf: Renamed to "mandos.conf". All users changed.
* server.py: Renamed to "mandos".
(daemon): Have default values for arguments. Caller changed.
* Makefile (distclean, mostlyclean, maintainer-clean): New aliases for
"clean".
(check, run-client, run-server): New.
* network-protocol.txt: New.
- files added:
- network-protocol.txt
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugin-runner.c => mandos-client.c
- plugins.d/mandos-client.c => plugins.d/password-request.c
- files modified:
- Makefile
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
# GNU General Public License for more details.
26
25
#
27
26
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
30
28
#
31
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
30
#
33
31
34
from __future__ import division, with_statement, absolute_import
32
from __future__ import division
35
33
36
34
import SocketServer
37
35
import socket
38
import optparse
36
import select
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
import pwd
59
from contextlib import closing
60
57
61
58
import dbus
62
import dbus.service
63
59
import gobject
64
60
import avahi
65
61
from dbus.mainloop.glib import DBusGMainLoop
66
62
import ctypes
67
import ctypes.util
68
69
try:
70
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
71
except AttributeError:
72
try:
73
from IN import SO_BINDTODEVICE
74
except ImportError:
75
# From /usr/include/asm/socket.h
76
SO_BINDTODEVICE = 25
77
78
79
version = "1.0.8"
63
80
64
81
65
logger = logging.Logger('mandos')
82
syslogger = (logging.handlers.SysLogHandler
83
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
84
address = "/dev/log"))
85
syslogger.setFormatter(logging.Formatter
86
('Mandos [%(process)d]: %(levelname)s:'
87
' %(message)s'))
66
syslogger = logging.handlers.SysLogHandler\
67
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
68
syslogger.setFormatter(logging.Formatter\
69
('%(levelname)s: %(message)s'))
88
70
logger.addHandler(syslogger)
71
del syslogger
89
72
90
console = logging.StreamHandler()
91
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
92
' %(levelname)s: %(message)s'))
93
logger.addHandler(console)
94
73
95
74
class AvahiError(Exception):
96
def __init__(self, value, *args, **kwargs):
75
def __init__(self, value):
97
76
self.value = value
98
super(AvahiError, self).__init__(value, *args, **kwargs)
99
def __unicode__(self):
100
return unicode(repr(self.value))
77
def __str__(self):
78
return repr(self.value)
101
79
102
80
class AvahiServiceError(AvahiError):
103
81
pass
108
86
109
87
class AvahiService(object):
110
88
"""An Avahi (Zeroconf) service.
111
112
89
Attributes:
113
90
interface: integer; avahi.IF_UNSPEC or an interface index.
114
91
Used to optionally bind to the specified interface.
124
101
a sensible number of times
125
102
"""
126
103
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
127
servicetype = None, port = None, TXT = None,
128
domain = "", host = "", max_renames = 32768,
129
protocol = avahi.PROTO_UNSPEC):
104
type = None, port = None, TXT = None, domain = "",
105
host = "", max_renames = 12):
130
106
self.interface = interface
131
107
self.name = name
132
self.type = servicetype
108
self.type = type
133
109
self.port = port
134
self.TXT = TXT if TXT is not None else []
110
if TXT is None:
111
self.TXT = []
112
else:
113
self.TXT = TXT
135
114
self.domain = domain
136
115
self.host = host
137
116
self.rename_count = 0
138
self.max_renames = max_renames
139
self.protocol = protocol
140
117
def rename(self):
141
118
"""Derived from the Avahi example code"""
142
119
if self.rename_count >= self.max_renames:
143
logger.critical(u"No suitable Zeroconf service name found"
144
u" after %i retries, exiting.",
145
self.rename_count)
146
raise AvahiServiceError(u"Too many renames")
147
self.name = server.GetAlternativeServiceName(self.name)
148
logger.info(u"Changing Zeroconf service name to %r ...",
149
str(self.name))
150
syslogger.setFormatter(logging.Formatter
151
('Mandos (%s) [%%(process)d]:'
152
' %%(levelname)s: %%(message)s'
153
% self.name))
120
logger.critical(u"No suitable service name found after %i"
121
u" retries, exiting.", rename_count)
122
raise AvahiServiceError("Too many renames")
123
name = server.GetAlternativeServiceName(name)
124
logger.error(u"Changing name to %r ...", name)
154
125
self.remove()
155
126
self.add()
156
127
self.rename_count += 1
162
133
"""Derived from the Avahi example code"""
163
134
global group
164
135
if group is None:
165
group = dbus.Interface(bus.get_object
166
(avahi.DBUS_NAME,
136
group = dbus.Interface\
137
(bus.get_object(avahi.DBUS_NAME,
167
138
server.EntryGroupNew()),
168
avahi.DBUS_INTERFACE_ENTRY_GROUP)
139
avahi.DBUS_INTERFACE_ENTRY_GROUP)
169
140
group.connect_to_signal('StateChanged',
170
141
entry_group_state_changed)
171
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
142
logger.debug(u"Adding service '%s' of type '%s' ...",
172
143
service.name, service.type)
173
144
group.AddService(
174
145
self.interface, # interface
175
self.protocol, # protocol
146
avahi.PROTO_INET6, # protocol
176
147
dbus.UInt32(0), # flags
177
148
self.name, self.type,
178
149
self.domain, self.host,
185
156
# End of Avahi example code
186
157
187
158
188
def _datetime_to_dbus(dt, variant_level=0):
189
"""Convert a UTC datetime.datetime() to a D-Bus type."""
190
return dbus.String(dt.isoformat(), variant_level=variant_level)
191
192
193
159
class Client(object):
194
160
"""A representation of a client host served by this server.
195
196
161
Attributes:
197
name: string; from the config file, used in log messages and
198
D-Bus identifiers
162
name: string; from the config file, used in log messages
199
163
fingerprint: string (40 or 32 hexadecimal digits); used to
200
164
uniquely identify the client
201
secret: bytestring; sent verbatim (over TLS) to client
202
host: string; available for use by the checker command
203
created: datetime.datetime(); (UTC) object creation
204
last_enabled: datetime.datetime(); (UTC)
205
enabled: bool()
206
last_checked_ok: datetime.datetime(); (UTC) or None
207
timeout: datetime.timedelta(); How long from last_checked_ok
208
until this client is invalid
209
interval: datetime.timedelta(); How often to start a new checker
210
disable_hook: If set, called by disable() as disable_hook(self)
211
checker: subprocess.Popen(); a running checker process used
212
to see if the client lives.
213
'None' if no process is running.
165
secret: bytestring; sent verbatim (over TLS) to client
166
fqdn: string (FQDN); available for use by the checker command
167
created: datetime.datetime(); object creation, not client host
168
last_checked_ok: datetime.datetime() or None if not yet checked OK
169
timeout: datetime.timedelta(); How long from last_checked_ok
170
until this client is invalid
171
interval: datetime.timedelta(); How often to start a new checker
172
stop_hook: If set, called by stop() as stop_hook(self)
173
checker: subprocess.Popen(); a running checker process used
174
to see if the client lives.
175
'None' if no process is running.
214
176
checker_initiator_tag: a gobject event source tag, or None
215
disable_initiator_tag: - '' -
177
stop_initiator_tag: - '' -
216
178
checker_callback_tag: - '' -
217
179
checker_command: string; External command which is run to check if
218
180
client lives. %() expansions are done at
219
181
runtime with vars(self) as dict, so that for
220
182
instance %(name)s can be used in the command.
221
current_checker_command: string; current running checker_command
183
Private attibutes:
184
_timeout: Real variable for 'timeout'
185
_interval: Real variable for 'interval'
186
_timeout_milliseconds: Used when calling gobject.timeout_add()
187
_interval_milliseconds: - '' -
222
188
"""
223
def timeout_milliseconds(self):
224
"Return the 'timeout' attribute in milliseconds"
225
return ((self.timeout.days * 24 * 60 * 60 * 1000)
226
+ (self.timeout.seconds * 1000)
227
+ (self.timeout.microseconds // 1000))
228
229
def interval_milliseconds(self):
230
"Return the 'interval' attribute in milliseconds"
231
return ((self.interval.days * 24 * 60 * 60 * 1000)
232
+ (self.interval.seconds * 1000)
233
+ (self.interval.microseconds // 1000))
234
235
def __init__(self, name = None, disable_hook=None, config=None):
189
def _set_timeout(self, timeout):
190
"Setter function for 'timeout' attribute"
191
self._timeout = timeout
192
self._timeout_milliseconds = ((self.timeout.days
193
* 24 * 60 * 60 * 1000)
194
+ (self.timeout.seconds * 1000)
195
+ (self.timeout.microseconds
196
// 1000))
197
timeout = property(lambda self: self._timeout,
198
_set_timeout)
199
del _set_timeout
200
def _set_interval(self, interval):
201
"Setter function for 'interval' attribute"
202
self._interval = interval
203
self._interval_milliseconds = ((self.interval.days
204
* 24 * 60 * 60 * 1000)
205
+ (self.interval.seconds
206
* 1000)
207
+ (self.interval.microseconds
208
// 1000))
209
interval = property(lambda self: self._interval,
210
_set_interval)
211
del _set_interval
212
def __init__(self, name = None, stop_hook=None, config={}):
236
213
"""Note: the 'checker' key in 'config' sets the
237
214
'checker_command' attribute and *not* the 'checker'
238
215
attribute."""
239
216
self.name = name
240
if config is None:
241
config = {}
242
217
logger.debug(u"Creating client %r", self.name)
243
218
# Uppercase and remove spaces from fingerprint for later
244
219
# comparison purposes with return value from the fingerprint()
245
220
# function
246
self.fingerprint = (config["fingerprint"].upper()
247
.replace(u" ", u""))
221
self.fingerprint = config["fingerprint"].upper()\
222
.replace(u" ", u"")
248
223
logger.debug(u" Fingerprint: %s", self.fingerprint)
249
224
if "secret" in config:
250
225
self.secret = config["secret"].decode(u"base64")
251
226
elif "secfile" in config:
252
with closing(open(os.path.expanduser
253
(os.path.expandvars
254
(config["secfile"])))) as secfile:
255
self.secret = secfile.read()
227
sf = open(config["secfile"])
228
self.secret = sf.read()
229
sf.close()
256
230
else:
257
231
raise TypeError(u"No secret or secfile for client %s"
258
232
% self.name)
259
self.host = config.get("host", "")
260
self.created = datetime.datetime.utcnow()
261
self.enabled = False
262
self.last_enabled = None
233
self.fqdn = config.get("fqdn", "")
234
self.created = datetime.datetime.now()
263
235
self.last_checked_ok = None
264
236
self.timeout = string_to_delta(config["timeout"])
265
237
self.interval = string_to_delta(config["interval"])
266
self.disable_hook = disable_hook
238
self.stop_hook = stop_hook
267
239
self.checker = None
268
240
self.checker_initiator_tag = None
269
self.disable_initiator_tag = None
241
self.stop_initiator_tag = None
270
242
self.checker_callback_tag = None
271
self.checker_command = config["checker"]
272
self.current_checker_command = None
273
self.last_connect = None
274
275
def enable(self):
243
self.check_command = config["checker"]
244
def start(self):
276
245
"""Start this client's checker and timeout hooks"""
277
self.last_enabled = datetime.datetime.utcnow()
278
246
# Schedule a new checker to be started an 'interval' from now,
279
247
# and every interval from then on.
280
self.checker_initiator_tag = (gobject.timeout_add
281
(self.interval_milliseconds(),
282
self.start_checker))
248
self.checker_initiator_tag = gobject.timeout_add\
249
(self._interval_milliseconds,
250
self.start_checker)
283
251
# Also start a new checker *right now*.
284
252
self.start_checker()
285
# Schedule a disable() when 'timeout' has passed
286
self.disable_initiator_tag = (gobject.timeout_add
287
(self.timeout_milliseconds(),
288
self.disable))
289
self.enabled = True
290
291
def disable(self):
292
"""Disable this client."""
293
if not getattr(self, "enabled", False):
253
# Schedule a stop() when 'timeout' has passed
254
self.stop_initiator_tag = gobject.timeout_add\
255
(self._timeout_milliseconds,
256
self.stop)
257
def stop(self):
258
"""Stop this client.
259
The possibility that a client might be restarted is left open,
260
but not currently used."""
261
# If this client doesn't have a secret, it is already stopped.
262
if self.secret:
263
logger.info(u"Stopping client %s", self.name)
264
self.secret = None
265
else:
294
266
return False
295
logger.info(u"Disabling client %s", self.name)
296
if getattr(self, "disable_initiator_tag", False):
297
gobject.source_remove(self.disable_initiator_tag)
298
self.disable_initiator_tag = None
267
if getattr(self, "stop_initiator_tag", False):
268
gobject.source_remove(self.stop_initiator_tag)
269
self.stop_initiator_tag = None
299
270
if getattr(self, "checker_initiator_tag", False):
300
271
gobject.source_remove(self.checker_initiator_tag)
301
272
self.checker_initiator_tag = None
302
273
self.stop_checker()
303
if self.disable_hook:
304
self.disable_hook(self)
305
self.enabled = False
274
if self.stop_hook:
275
self.stop_hook(self)
306
276
# Do not run this again if called by a gobject.timeout_add
307
277
return False
308
309
278
def __del__(self):
310
self.disable_hook = None
311
self.disable()
312
313
def checker_callback(self, pid, condition, command):
279
self.stop_hook = None
280
self.stop()
281
def checker_callback(self, pid, condition):
314
282
"""The checker has completed, so take appropriate actions."""
283
now = datetime.datetime.now()
315
284
self.checker_callback_tag = None
316
285
self.checker = None
317
if os.WIFEXITED(condition):
318
exitstatus = os.WEXITSTATUS(condition)
319
if exitstatus == 0:
320
logger.info(u"Checker for %(name)s succeeded",
321
vars(self))
322
self.checked_ok()
323
else:
324
logger.info(u"Checker for %(name)s failed",
325
vars(self))
326
else:
286
if os.WIFEXITED(condition) \
287
and (os.WEXITSTATUS(condition) == 0):
288
logger.info(u"Checker for %(name)s succeeded",
289
vars(self))
290
self.last_checked_ok = now
291
gobject.source_remove(self.stop_initiator_tag)
292
self.stop_initiator_tag = gobject.timeout_add\
293
(self._timeout_milliseconds,
294
self.stop)
295
elif not os.WIFEXITED(condition):
327
296
logger.warning(u"Checker for %(name)s crashed?",
328
297
vars(self))
329
330
def checked_ok(self):
331
"""Bump up the timeout for this client.
332
333
This should only be called when the client has been seen,
334
alive and well.
335
"""
336
self.last_checked_ok = datetime.datetime.utcnow()
337
gobject.source_remove(self.disable_initiator_tag)
338
self.disable_initiator_tag = (gobject.timeout_add
339
(self.timeout_milliseconds(),
340
self.disable))
341
298
else:
299
logger.info(u"Checker for %(name)s failed",
300
vars(self))
342
301
def start_checker(self):
343
302
"""Start a new checker subprocess if one is not running.
344
345
303
If a checker already exists, leave it running and do
346
304
nothing."""
347
305
# The reason for not killing a running checker is that if we
352
310
# checkers alone, the checker would have to take more time
353
311
# than 'timeout' for the client to be declared invalid, which
354
312
# is as it should be.
355
356
# If a checker exists, make sure it is not a zombie
357
if self.checker is not None:
358
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
359
if pid:
360
logger.warning("Checker was a zombie")
361
gobject.source_remove(self.checker_callback_tag)
362
self.checker_callback(pid, status,
363
self.current_checker_command)
364
# Start a new checker if needed
365
313
if self.checker is None:
366
314
try:
367
# In case checker_command has exactly one % operator
368
command = self.checker_command % self.host
315
# In case check_command has exactly one % operator
316
command = self.check_command % self.fqdn
369
317
except TypeError:
370
318
# Escape attributes for the shell
371
319
escaped_attrs = dict((key, re.escape(str(val)))
372
320
for key, val in
373
321
vars(self).iteritems())
374
322
try:
375
command = self.checker_command % escaped_attrs
323
command = self.check_command % escaped_attrs
376
324
except TypeError, error:
377
325
logger.error(u'Could not format string "%s":'
378
u' %s', self.checker_command, error)
326
u' %s', self.check_command, error)
379
327
return True # Try again later
380
self.current_checker_command = command
381
328
try:
382
329
logger.info(u"Starting checker %r for %s",
383
330
command, self.name)
384
# We don't need to redirect stdout and stderr, since
385
# in normal mode, that is already done by daemon(),
386
# and in debug mode we don't want to. (Stdin is
387
# always replaced by /dev/null.)
388
331
self.checker = subprocess.Popen(command,
389
332
close_fds=True,
390
333
shell=True, cwd="/")
391
self.checker_callback_tag = (gobject.child_watch_add
392
(self.checker.pid,
393
self.checker_callback,
394
data=command))
395
# The checker may have completed before the gobject
396
# watch was added. Check for this.
397
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
398
if pid:
399
gobject.source_remove(self.checker_callback_tag)
400
self.checker_callback(pid, status, command)
401
except OSError, error:
334
self.checker_callback_tag = gobject.child_watch_add\
335
(self.checker.pid,
336
self.checker_callback)
337
except subprocess.OSError, error:
402
338
logger.error(u"Failed to start subprocess: %s",
403
339
error)
404
340
# Re-run this periodically if run by gobject.timeout_add
405
341
return True
406
407
342
def stop_checker(self):
408
343
"""Force the checker process, if any, to stop."""
409
344
if self.checker_callback_tag:
411
346
self.checker_callback_tag = None
412
347
if getattr(self, "checker", None) is None:
413
348
return
414
logger.debug(u"Stopping checker for %(name)s", vars(self))
349
logger.debug("Stopping checker for %(name)s", vars(self))
415
350
try:
416
351
os.kill(self.checker.pid, signal.SIGTERM)
417
352
#os.sleep(0.5)
421
356
if error.errno != errno.ESRCH: # No such process
422
357
raise
423
358
self.checker = None
424
425
359
def still_valid(self):
426
360
"""Has the timeout not yet passed for this client?"""
427
if not getattr(self, "enabled", False):
428
return False
429
now = datetime.datetime.utcnow()
361
now = datetime.datetime.now()
430
362
if self.last_checked_ok is None:
431
363
return now < (self.created + self.timeout)
432
364
else:
433
365
return now < (self.last_checked_ok + self.timeout)
434
366
435
367
436
class ClientDBus(Client, dbus.service.Object):
437
"""A Client class using D-Bus
438
439
Attributes:
440
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
441
"""
442
# dbus.service.Object doesn't use super(), so we can't either.
443
444
def __init__(self, *args, **kwargs):
445
Client.__init__(self, *args, **kwargs)
446
# Only now, when this client is initialized, can it show up on
447
# the D-Bus
448
self.dbus_object_path = (dbus.ObjectPath
449
("/clients/"
450
+ self.name.replace(".", "_")))
451
dbus.service.Object.__init__(self, bus,
452
self.dbus_object_path)
453
def enable(self):
454
oldstate = getattr(self, "enabled", False)
455
r = Client.enable(self)
456
if oldstate != self.enabled:
457
# Emit D-Bus signals
458
self.PropertyChanged(dbus.String(u"enabled"),
459
dbus.Boolean(True, variant_level=1))
460
self.PropertyChanged(dbus.String(u"last_enabled"),
461
(_datetime_to_dbus(self.last_enabled,
462
variant_level=1)))
463
return r
464
465
def disable(self, signal = True):
466
oldstate = getattr(self, "enabled", False)
467
r = Client.disable(self)
468
if signal and oldstate != self.enabled:
469
# Emit D-Bus signal
470
self.PropertyChanged(dbus.String(u"enabled"),
471
dbus.Boolean(False, variant_level=1))
472
return r
473
474
def __del__(self, *args, **kwargs):
475
try:
476
self.remove_from_connection()
477
except LookupError:
478
pass
479
if hasattr(dbus.service.Object, "__del__"):
480
dbus.service.Object.__del__(self, *args, **kwargs)
481
Client.__del__(self, *args, **kwargs)
482
483
def checker_callback(self, pid, condition, command,
484
*args, **kwargs):
485
self.checker_callback_tag = None
486
self.checker = None
487
# Emit D-Bus signal
488
self.PropertyChanged(dbus.String(u"checker_running"),
489
dbus.Boolean(False, variant_level=1))
490
if os.WIFEXITED(condition):
491
exitstatus = os.WEXITSTATUS(condition)
492
# Emit D-Bus signal
493
self.CheckerCompleted(dbus.Int16(exitstatus),
494
dbus.Int64(condition),
495
dbus.String(command))
496
else:
497
# Emit D-Bus signal
498
self.CheckerCompleted(dbus.Int16(-1),
499
dbus.Int64(condition),
500
dbus.String(command))
501
502
return Client.checker_callback(self, pid, condition, command,
503
*args, **kwargs)
504
505
def checked_ok(self, *args, **kwargs):
506
r = Client.checked_ok(self, *args, **kwargs)
507
# Emit D-Bus signal
508
self.PropertyChanged(
509
dbus.String(u"last_checked_ok"),
510
(_datetime_to_dbus(self.last_checked_ok,
511
variant_level=1)))
512
return r
513
514
def start_checker(self, *args, **kwargs):
515
old_checker = self.checker
516
if self.checker is not None:
517
old_checker_pid = self.checker.pid
518
else:
519
old_checker_pid = None
520
r = Client.start_checker(self, *args, **kwargs)
521
# Only if new checker process was started
522
if (self.checker is not None
523
and old_checker_pid != self.checker.pid):
524
# Emit D-Bus signal
525
self.CheckerStarted(self.current_checker_command)
526
self.PropertyChanged(
527
dbus.String("checker_running"),
528
dbus.Boolean(True, variant_level=1))
529
return r
530
531
def stop_checker(self, *args, **kwargs):
532
old_checker = getattr(self, "checker", None)
533
r = Client.stop_checker(self, *args, **kwargs)
534
if (old_checker is not None
535
and getattr(self, "checker", None) is None):
536
self.PropertyChanged(dbus.String(u"checker_running"),
537
dbus.Boolean(False, variant_level=1))
538
return r
539
540
## D-Bus methods & signals
541
_interface = u"se.bsnet.fukt.Mandos.Client"
542
543
# CheckedOK - method
544
CheckedOK = dbus.service.method(_interface)(checked_ok)
545
CheckedOK.__name__ = "CheckedOK"
546
547
# CheckerCompleted - signal
548
@dbus.service.signal(_interface, signature="nxs")
549
def CheckerCompleted(self, exitcode, waitstatus, command):
550
"D-Bus signal"
551
pass
552
553
# CheckerStarted - signal
554
@dbus.service.signal(_interface, signature="s")
555
def CheckerStarted(self, command):
556
"D-Bus signal"
557
pass
558
559
# GetAllProperties - method
560
@dbus.service.method(_interface, out_signature="a{sv}")
561
def GetAllProperties(self):
562
"D-Bus method"
563
return dbus.Dictionary({
564
dbus.String("name"):
565
dbus.String(self.name, variant_level=1),
566
dbus.String("fingerprint"):
567
dbus.String(self.fingerprint, variant_level=1),
568
dbus.String("host"):
569
dbus.String(self.host, variant_level=1),
570
dbus.String("created"):
571
_datetime_to_dbus(self.created, variant_level=1),
572
dbus.String("last_enabled"):
573
(_datetime_to_dbus(self.last_enabled,
574
variant_level=1)
575
if self.last_enabled is not None
576
else dbus.Boolean(False, variant_level=1)),
577
dbus.String("enabled"):
578
dbus.Boolean(self.enabled, variant_level=1),
579
dbus.String("last_checked_ok"):
580
(_datetime_to_dbus(self.last_checked_ok,
581
variant_level=1)
582
if self.last_checked_ok is not None
583
else dbus.Boolean (False, variant_level=1)),
584
dbus.String("timeout"):
585
dbus.UInt64(self.timeout_milliseconds(),
586
variant_level=1),
587
dbus.String("interval"):
588
dbus.UInt64(self.interval_milliseconds(),
589
variant_level=1),
590
dbus.String("checker"):
591
dbus.String(self.checker_command,
592
variant_level=1),
593
dbus.String("checker_running"):
594
dbus.Boolean(self.checker is not None,
595
variant_level=1),
596
dbus.String("object_path"):
597
dbus.ObjectPath(self.dbus_object_path,
598
variant_level=1)
599
}, signature="sv")
600
601
# IsStillValid - method
602
@dbus.service.method(_interface, out_signature="b")
603
def IsStillValid(self):
604
return self.still_valid()
605
606
# PropertyChanged - signal
607
@dbus.service.signal(_interface, signature="sv")
608
def PropertyChanged(self, property, value):
609
"D-Bus signal"
610
pass
611
612
# ReceivedSecret - signal
613
@dbus.service.signal(_interface)
614
def ReceivedSecret(self):
615
"D-Bus signal"
616
pass
617
618
# Rejected - signal
619
@dbus.service.signal(_interface)
620
def Rejected(self):
621
"D-Bus signal"
622
pass
623
624
# SetChecker - method
625
@dbus.service.method(_interface, in_signature="s")
626
def SetChecker(self, checker):
627
"D-Bus setter method"
628
self.checker_command = checker
629
# Emit D-Bus signal
630
self.PropertyChanged(dbus.String(u"checker"),
631
dbus.String(self.checker_command,
632
variant_level=1))
633
634
# SetHost - method
635
@dbus.service.method(_interface, in_signature="s")
636
def SetHost(self, host):
637
"D-Bus setter method"
638
self.host = host
639
# Emit D-Bus signal
640
self.PropertyChanged(dbus.String(u"host"),
641
dbus.String(self.host, variant_level=1))
642
643
# SetInterval - method
644
@dbus.service.method(_interface, in_signature="t")
645
def SetInterval(self, milliseconds):
646
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
647
# Emit D-Bus signal
648
self.PropertyChanged(dbus.String(u"interval"),
649
(dbus.UInt64(self.interval_milliseconds(),
650
variant_level=1)))
651
652
# SetSecret - method
653
@dbus.service.method(_interface, in_signature="ay",
654
byte_arrays=True)
655
def SetSecret(self, secret):
656
"D-Bus setter method"
657
self.secret = str(secret)
658
659
# SetTimeout - method
660
@dbus.service.method(_interface, in_signature="t")
661
def SetTimeout(self, milliseconds):
662
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
663
# Emit D-Bus signal
664
self.PropertyChanged(dbus.String(u"timeout"),
665
(dbus.UInt64(self.timeout_milliseconds(),
666
variant_level=1)))
667
668
# Enable - method
669
Enable = dbus.service.method(_interface)(enable)
670
Enable.__name__ = "Enable"
671
672
# StartChecker - method
673
@dbus.service.method(_interface)
674
def StartChecker(self):
675
"D-Bus method"
676
self.start_checker()
677
678
# Disable - method
679
@dbus.service.method(_interface)
680
def Disable(self):
681
"D-Bus method"
682
self.disable()
683
684
# StopChecker - method
685
StopChecker = dbus.service.method(_interface)(stop_checker)
686
StopChecker.__name__ = "StopChecker"
687
688
del _interface
689
690
691
class ClientHandler(SocketServer.BaseRequestHandler, object):
692
"""A class to handle client connections.
693
694
Instantiated once for each connection to handle it.
368
def peer_certificate(session):
369
"Return the peer's OpenPGP certificate as a bytestring"
370
# If not an OpenPGP certificate...
371
if gnutls.library.functions.gnutls_certificate_type_get\
372
(session._c_object) \
373
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
374
# ...do the normal thing
375
return session.peer_certificate
376
list_size = ctypes.c_uint()
377
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
378
(session._c_object, ctypes.byref(list_size))
379
if list_size.value == 0:
380
return None
381
cert = cert_list[0]
382
return ctypes.string_at(cert.data, cert.size)
383
384
385
def fingerprint(openpgp):
386
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
387
# New GnuTLS "datum" with the OpenPGP public key
388
datum = gnutls.library.types.gnutls_datum_t\
389
(ctypes.cast(ctypes.c_char_p(openpgp),
390
ctypes.POINTER(ctypes.c_ubyte)),
391
ctypes.c_uint(len(openpgp)))
392
# New empty GnuTLS certificate
393
crt = gnutls.library.types.gnutls_openpgp_crt_t()
394
gnutls.library.functions.gnutls_openpgp_crt_init\
395
(ctypes.byref(crt))
396
# Import the OpenPGP public key into the certificate
397
gnutls.library.functions.gnutls_openpgp_crt_import\
398
(crt, ctypes.byref(datum),
399
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
400
# New buffer for the fingerprint
401
buffer = ctypes.create_string_buffer(20)
402
buffer_length = ctypes.c_size_t()
403
# Get the fingerprint from the certificate into the buffer
404
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
405
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
406
# Deinit the certificate
407
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
408
# Convert the buffer to a Python bytestring
409
fpr = ctypes.string_at(buffer, buffer_length.value)
410
# Convert the bytestring to hexadecimal notation
411
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
412
return hex_fpr
413
414
415
class tcp_handler(SocketServer.BaseRequestHandler, object):
416
"""A TCP request handler class.
417
Instantiated by IPv6_TCPServer for each request to handle it.
695
418
Note: This will run in its own forked process."""
696
419
697
420
def handle(self):
698
421
logger.info(u"TCP connection from: %s",
699
unicode(self.client_address))
700
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
701
# Open IPC pipe to parent process
702
with closing(os.fdopen(self.server.pipe[1], "w", 1)) as ipc:
703
session = (gnutls.connection
704
.ClientSession(self.request,
705
gnutls.connection
706
.X509Credentials()))
707
708
line = self.request.makefile().readline()
709
logger.debug(u"Protocol version: %r", line)
710
try:
711
if int(line.strip().split()[0]) > 1:
712
raise RuntimeError
713
except (ValueError, IndexError, RuntimeError), error:
714
logger.error(u"Unknown protocol version: %s", error)
715
return
716
717
# Note: gnutls.connection.X509Credentials is really a
718
# generic GnuTLS certificate credentials object so long as
719
# no X.509 keys are added to it. Therefore, we can use it
720
# here despite using OpenPGP certificates.
721
722
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
723
# "+AES-256-CBC", "+SHA1",
724
# "+COMP-NULL", "+CTYPE-OPENPGP",
725
# "+DHE-DSS"))
726
# Use a fallback default, since this MUST be set.
727
priority = self.server.gnutls_priority
728
if priority is None:
729
priority = "NORMAL"
730
(gnutls.library.functions
731
.gnutls_priority_set_direct(session._c_object,
732
priority, None))
733
734
try:
735
session.handshake()
736
except gnutls.errors.GNUTLSError, error:
737
logger.warning(u"Handshake failed: %s", error)
738
# Do not run session.bye() here: the session is not
739
# established. Just abandon the request.
740
return
741
logger.debug(u"Handshake succeeded")
742
try:
743
fpr = self.fingerprint(self.peer_certificate(session))
744
except (TypeError, gnutls.errors.GNUTLSError), error:
745
logger.warning(u"Bad certificate: %s", error)
746
session.bye()
747
return
748
logger.debug(u"Fingerprint: %s", fpr)
749
750
for c in self.server.clients:
751
if c.fingerprint == fpr:
752
client = c
753
break
754
else:
755
ipc.write("NOTFOUND %s\n" % fpr)
756
session.bye()
757
return
758
# Have to check if client.still_valid(), since it is
759
# possible that the client timed out while establishing
760
# the GnuTLS session.
761
if not client.still_valid():
762
ipc.write("INVALID %s\n" % client.name)
763
session.bye()
764
return
765
ipc.write("SENDING %s\n" % client.name)
766
sent_size = 0
767
while sent_size < len(client.secret):
768
sent = session.send(client.secret[sent_size:])
769
logger.debug(u"Sent: %d, remaining: %d",
770
sent, len(client.secret)
771
- (sent_size + sent))
772
sent_size += sent
773
session.bye()
774
775
@staticmethod
776
def peer_certificate(session):
777
"Return the peer's OpenPGP certificate as a bytestring"
778
# If not an OpenPGP certificate...
779
if (gnutls.library.functions
780
.gnutls_certificate_type_get(session._c_object)
781
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
782
# ...do the normal thing
783
return session.peer_certificate
784
list_size = ctypes.c_uint(1)
785
cert_list = (gnutls.library.functions
786
.gnutls_certificate_get_peers
787
(session._c_object, ctypes.byref(list_size)))
788
if not bool(cert_list) and list_size.value != 0:
789
raise gnutls.errors.GNUTLSError("error getting peer"
790
" certificate")
791
if list_size.value == 0:
792
return None
793
cert = cert_list[0]
794
return ctypes.string_at(cert.data, cert.size)
795
796
@staticmethod
797
def fingerprint(openpgp):
798
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
799
# New GnuTLS "datum" with the OpenPGP public key
800
datum = (gnutls.library.types
801
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
802
ctypes.POINTER
803
(ctypes.c_ubyte)),
804
ctypes.c_uint(len(openpgp))))
805
# New empty GnuTLS certificate
806
crt = gnutls.library.types.gnutls_openpgp_crt_t()
807
(gnutls.library.functions
808
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
809
# Import the OpenPGP public key into the certificate
810
(gnutls.library.functions
811
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
812
gnutls.library.constants
813
.GNUTLS_OPENPGP_FMT_RAW))
814
# Verify the self signature in the key
815
crtverify = ctypes.c_uint()
816
(gnutls.library.functions
817
.gnutls_openpgp_crt_verify_self(crt, 0,
818
ctypes.byref(crtverify)))
819
if crtverify.value != 0:
820
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
821
raise (gnutls.errors.CertificateSecurityError
822
("Verify failed"))
823
# New buffer for the fingerprint
824
buf = ctypes.create_string_buffer(20)
825
buf_len = ctypes.c_size_t()
826
# Get the fingerprint from the certificate into the buffer
827
(gnutls.library.functions
828
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
829
ctypes.byref(buf_len)))
830
# Deinit the certificate
831
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
832
# Convert the buffer to a Python bytestring
833
fpr = ctypes.string_at(buf, buf_len.value)
834
# Convert the bytestring to hexadecimal notation
835
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
836
return hex_fpr
837
838
839
class ForkingMixInWithPipe(SocketServer.ForkingMixIn, object):
840
"""Like SocketServer.ForkingMixIn, but also pass a pipe.
841
842
Assumes a gobject.MainLoop event loop.
843
"""
844
def process_request(self, request, client_address):
845
"""Overrides and wraps the original process_request().
846
847
This function creates a new pipe in self.pipe
848
"""
849
self.pipe = os.pipe()
850
super(ForkingMixInWithPipe,
851
self).process_request(request, client_address)
852
os.close(self.pipe[1]) # close write end
853
# Call "handle_ipc" for both data and EOF events
854
gobject.io_add_watch(self.pipe[0],
855
gobject.IO_IN | gobject.IO_HUP,
856
self.handle_ipc)
857
def handle_ipc(source, condition):
858
"""Dummy function; override as necessary"""
859
os.close(source)
860
return False
861
862
863
class IPv6_TCPServer(ForkingMixInWithPipe,
864
SocketServer.TCPServer, object):
865
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
866
422
unicode(self.client_address))
423
session = gnutls.connection.ClientSession\
424
(self.request, gnutls.connection.X509Credentials())
425
426
line = self.request.makefile().readline()
427
logger.debug(u"Protocol version: %r", line)
428
try:
429
if int(line.strip().split()[0]) > 1:
430
raise RuntimeError
431
except (ValueError, IndexError, RuntimeError), error:
432
logger.error(u"Unknown protocol version: %s", error)
433
return
434
435
# Note: gnutls.connection.X509Credentials is really a generic
436
# GnuTLS certificate credentials object so long as no X.509
437
# keys are added to it. Therefore, we can use it here despite
438
# using OpenPGP certificates.
439
440
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
441
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
442
# "+DHE-DSS"))
443
priority = "NORMAL" # Fallback default, since this
444
# MUST be set.
445
if self.server.settings["priority"]:
446
priority = self.server.settings["priority"]
447
gnutls.library.functions.gnutls_priority_set_direct\
448
(session._c_object, priority, None);
449
450
try:
451
session.handshake()
452
except gnutls.errors.GNUTLSError, error:
453
logger.warning(u"Handshake failed: %s", error)
454
# Do not run session.bye() here: the session is not
455
# established. Just abandon the request.
456
return
457
try:
458
fpr = fingerprint(peer_certificate(session))
459
except (TypeError, gnutls.errors.GNUTLSError), error:
460
logger.warning(u"Bad certificate: %s", error)
461
session.bye()
462
return
463
logger.debug(u"Fingerprint: %s", fpr)
464
client = None
465
for c in self.server.clients:
466
if c.fingerprint == fpr:
467
client = c
468
break
469
if not client:
470
logger.warning(u"Client not found for fingerprint: %s",
471
fpr)
472
session.bye()
473
return
474
# Have to check if client.still_valid(), since it is possible
475
# that the client timed out while establishing the GnuTLS
476
# session.
477
if not client.still_valid():
478
logger.warning(u"Client %(name)s is invalid",
479
vars(client))
480
session.bye()
481
return
482
sent_size = 0
483
while sent_size < len(client.secret):
484
sent = session.send(client.secret[sent_size:])
485
logger.debug(u"Sent: %d, remaining: %d",
486
sent, len(client.secret)
487
- (sent_size + sent))
488
sent_size += sent
489
session.bye()
490
491
492
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
493
"""IPv6 TCP server. Accepts 'None' as address and/or port.
867
494
Attributes:
868
enabled: Boolean; whether this server is activated yet
869
interface: None or a network interface name (string)
870
use_ipv6: Boolean; to use IPv6 or not
871
----
495
settings: Server settings
872
496
clients: Set() of Client objects
873
gnutls_priority GnuTLS priority string
874
use_dbus: Boolean; to emit D-Bus signals or not
875
497
"""
876
def __init__(self, server_address, RequestHandlerClass,
877
interface=None, use_ipv6=True, clients=None,
878
gnutls_priority=None, use_dbus=True):
879
self.enabled = False
880
self.interface = interface
881
if use_ipv6:
882
self.address_family = socket.AF_INET6
883
self.clients = clients
884
self.use_dbus = use_dbus
885
self.gnutls_priority = gnutls_priority
886
SocketServer.TCPServer.__init__(self, server_address,
887
RequestHandlerClass)
498
address_family = socket.AF_INET6
499
def __init__(self, *args, **kwargs):
500
if "settings" in kwargs:
501
self.settings = kwargs["settings"]
502
del kwargs["settings"]
503
if "clients" in kwargs:
504
self.clients = kwargs["clients"]
505
del kwargs["clients"]
506
return super(type(self), self).__init__(*args, **kwargs)
888
507
def server_bind(self):
889
508
"""This overrides the normal server_bind() function
890
509
to bind to an interface if one was specified, and also NOT to
891
510
bind to an address or port if they were not specified."""
892
if self.interface is not None:
511
if self.settings["interface"]:
512
# 25 is from /usr/include/asm-i486/socket.h
513
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
893
514
try:
894
515
self.socket.setsockopt(socket.SOL_SOCKET,
895
516
SO_BINDTODEVICE,
896
self.interface + '\0')
517
self.settings["interface"])
897
518
except socket.error, error:
898
519
if error[0] == errno.EPERM:
899
520
logger.error(u"No permission to"
900
521
u" bind to interface %s",
901
self.interface)
522
self.settings["interface"])
902
523
else:
903
raise
524
raise error
904
525
# Only bind(2) the socket if we really need to.
905
526
if self.server_address[0] or self.server_address[1]:
906
527
if not self.server_address[0]:
907
if self.address_family == socket.AF_INET6:
908
any_address = "::" # in6addr_any
909
else:
910
any_address = socket.INADDR_ANY
911
self.server_address = (any_address,
528
in6addr_any = "::"
529
self.server_address = (in6addr_any,
912
530
self.server_address[1])
913
elif not self.server_address[1]:
531
elif self.server_address[1] is None:
914
532
self.server_address = (self.server_address[0],
915
533
0)
916
# if self.interface:
917
# self.server_address = (self.server_address[0],
918
# 0, # port
919
# 0, # flowinfo
920
# if_nametoindex
921
# (self.interface))
922
return SocketServer.TCPServer.server_bind(self)
923
def server_activate(self):
924
if self.enabled:
925
return SocketServer.TCPServer.server_activate(self)
926
def enable(self):
927
self.enabled = True
928
def handle_ipc(self, source, condition, file_objects={}):
929
condition_names = {
930
gobject.IO_IN: "IN", # There is data to read.
931
gobject.IO_OUT: "OUT", # Data can be written (without
932
# blocking).
933
gobject.IO_PRI: "PRI", # There is urgent data to read.
934
gobject.IO_ERR: "ERR", # Error condition.
935
gobject.IO_HUP: "HUP" # Hung up (the connection has been
936
# broken, usually for pipes and
937
# sockets).
938
}
939
conditions_string = ' | '.join(name
940
for cond, name in
941
condition_names.iteritems()
942
if cond & condition)
943
logger.debug("Handling IPC: FD = %d, condition = %s", source,
944
conditions_string)
945
946
# Turn the pipe file descriptor into a Python file object
947
if source not in file_objects:
948
file_objects[source] = os.fdopen(source, "r", 1)
949
950
# Read a line from the file object
951
cmdline = file_objects[source].readline()
952
if not cmdline: # Empty line means end of file
953
# close the IPC pipe
954
file_objects[source].close()
955
del file_objects[source]
956
957
# Stop calling this function
958
return False
959
960
logger.debug("IPC command: %r", cmdline)
961
962
# Parse and act on command
963
cmd, args = cmdline.rstrip("\r\n").split(None, 1)
964
965
if cmd == "NOTFOUND":
966
logger.warning(u"Client not found for fingerprint: %s",
967
args)
968
if self.use_dbus:
969
# Emit D-Bus signal
970
mandos_dbus_service.ClientNotFound(args)
971
elif cmd == "INVALID":
972
for client in self.clients:
973
if client.name == args:
974
logger.warning(u"Client %s is invalid", args)
975
if self.use_dbus:
976
# Emit D-Bus signal
977
client.Rejected()
978
break
979
else:
980
logger.error(u"Unknown client %s is invalid", args)
981
elif cmd == "SENDING":
982
for client in self.clients:
983
if client.name == args:
984
logger.info(u"Sending secret to %s", client.name)
985
client.checked_ok()
986
if self.use_dbus:
987
# Emit D-Bus signal
988
client.ReceivedSecret()
989
break
990
else:
991
logger.error(u"Sending secret to unknown client %s",
992
args)
993
else:
994
logger.error("Unknown IPC command: %r", cmdline)
995
996
# Keep calling this function
997
return True
534
return super(type(self), self).server_bind()
998
535
999
536
1000
537
def string_to_delta(interval):
1001
538
"""Parse a string and return a datetime.timedelta
1002
539
1003
540
>>> string_to_delta('7d')
1004
541
datetime.timedelta(7)
1005
542
>>> string_to_delta('60s')
1010
547
datetime.timedelta(1)
1011
548
>>> string_to_delta(u'1w')
1012
549
datetime.timedelta(7)
1013
>>> string_to_delta('5m 30s')
1014
datetime.timedelta(0, 330)
1015
550
"""
1016
timevalue = datetime.timedelta(0)
1017
for s in interval.split():
1018
try:
1019
suffix = unicode(s[-1])
1020
value = int(s[:-1])
1021
if suffix == u"d":
1022
delta = datetime.timedelta(value)
1023
elif suffix == u"s":
1024
delta = datetime.timedelta(0, value)
1025
elif suffix == u"m":
1026
delta = datetime.timedelta(0, 0, 0, 0, value)
1027
elif suffix == u"h":
1028
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1029
elif suffix == u"w":
1030
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1031
else:
1032
raise ValueError
1033
except (ValueError, IndexError):
551
try:
552
suffix=unicode(interval[-1])
553
value=int(interval[:-1])
554
if suffix == u"d":
555
delta = datetime.timedelta(value)
556
elif suffix == u"s":
557
delta = datetime.timedelta(0, value)
558
elif suffix == u"m":
559
delta = datetime.timedelta(0, 0, 0, 0, value)
560
elif suffix == u"h":
561
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
562
elif suffix == u"w":
563
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
564
else:
1034
565
raise ValueError
1035
timevalue += delta
1036
return timevalue
566
except (ValueError, IndexError):
567
raise ValueError
568
return delta
1037
569
1038
570
1039
571
def server_state_changed(state):
1040
572
"""Derived from the Avahi example code"""
1041
573
if state == avahi.SERVER_COLLISION:
1042
logger.error(u"Zeroconf server name collision")
574
logger.error(u"Server name collision")
1043
575
service.remove()
1044
576
elif state == avahi.SERVER_RUNNING:
1045
577
service.add()
1047
579
1048
580
def entry_group_state_changed(state, error):
1049
581
"""Derived from the Avahi example code"""
1050
logger.debug(u"Avahi state change: %i", state)
582
logger.debug(u"state change: %i", state)
1051
583
1052
584
if state == avahi.ENTRY_GROUP_ESTABLISHED:
1053
logger.debug(u"Zeroconf service established.")
585
logger.debug(u"Service established.")
1054
586
elif state == avahi.ENTRY_GROUP_COLLISION:
1055
logger.warning(u"Zeroconf service name collision.")
587
logger.warning(u"Service name collision.")
1056
588
service.rename()
1057
589
elif state == avahi.ENTRY_GROUP_FAILURE:
1058
logger.critical(u"Avahi: Error in group state changed %s",
590
logger.critical(u"Error in group state changed %s",
1059
591
unicode(error))
1060
raise AvahiGroupError(u"State changed: %s" % unicode(error))
592
raise AvahiGroupError("State changed: %s", str(error))
1061
593
1062
594
def if_nametoindex(interface):
1063
595
"""Call the C function if_nametoindex(), or equivalent"""
1064
596
global if_nametoindex
1065
597
try:
1066
if_nametoindex = (ctypes.cdll.LoadLibrary
1067
(ctypes.util.find_library("c"))
1068
.if_nametoindex)
598
if "ctypes.util" not in sys.modules:
599
import ctypes.util
600
if_nametoindex = ctypes.cdll.LoadLibrary\
601
(ctypes.util.find_library("c")).if_nametoindex
1069
602
except (OSError, AttributeError):
1070
603
if "struct" not in sys.modules:
1071
604
import struct
1074
607
def if_nametoindex(interface):
1075
608
"Get an interface index the hard way, i.e. using fcntl()"
1076
609
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1077
with closing(socket.socket()) as s:
1078
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1079
struct.pack("16s16x", interface))
610
s = socket.socket()
611
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
612
struct.pack("16s16x", interface))
613
s.close()
1080
614
interface_index = struct.unpack("I", ifreq[16:20])[0]
1081
615
return interface_index
1082
616
return if_nametoindex(interface)
1084
618
1085
619
def daemon(nochdir = False, noclose = False):
1086
620
"""See daemon(3). Standard BSD Unix function.
1087
1088
621
This should really exist as os.daemon, but it doesn't (yet)."""
1089
622
if os.fork():
1090
623
sys.exit()
1107
640
1108
641
1109
642
def main():
1110
1111
######################################################################
1112
# Parsing of options, both command line and config file
1113
1114
parser = optparse.OptionParser(version = "%%prog %s" % version)
643
global main_loop_started
644
main_loop_started = False
645
646
parser = OptionParser()
1115
647
parser.add_option("-i", "--interface", type="string",
1116
648
metavar="IF", help="Bind to interface IF")
1117
649
parser.add_option("-a", "--address", type="string",
1118
650
help="Address to listen for requests on")
1119
651
parser.add_option("-p", "--port", type="int",
1120
652
help="Port number to receive requests on")
1121
parser.add_option("--check", action="store_true",
653
parser.add_option("--check", action="store_true", default=False,
1122
654
help="Run self-test")
1123
parser.add_option("--debug", action="store_true",
655
parser.add_option("--debug", action="store_true", default=False,
1124
656
help="Debug mode; run in foreground and log to"
1125
657
" terminal")
1126
658
parser.add_option("--priority", type="string", help="GnuTLS"
1131
663
default="/etc/mandos", metavar="DIR",
1132
664
help="Directory to search for configuration"
1133
665
" files")
1134
parser.add_option("--no-dbus", action="store_false",
1135
dest="use_dbus",
1136
help="Do not provide D-Bus system bus"
1137
" interface")
1138
parser.add_option("--no-ipv6", action="store_false",
1139
dest="use_ipv6", help="Do not use IPv6")
1140
options = parser.parse_args()[0]
666
(options, args) = parser.parse_args()
1141
667
1142
668
if options.check:
1143
669
import doctest
1152
678
"priority":
1153
679
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1154
680
"servicename": "Mandos",
1155
"use_dbus": "True",
1156
"use_ipv6": "True",
1157
681
}
1158
682
1159
683
# Parse config file for server-global settings
1160
684
server_config = ConfigParser.SafeConfigParser(server_defaults)
1161
685
del server_defaults
1162
686
server_config.read(os.path.join(options.configdir, "mandos.conf"))
687
server_section = "server"
1163
688
# Convert the SafeConfigParser object to a dict
1164
server_settings = server_config.defaults()
1165
# Use the appropriate methods on the non-string config options
1166
server_settings["debug"] = server_config.getboolean("DEFAULT",
1167
"debug")
1168
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
1169
"use_dbus")
1170
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
1171
"use_ipv6")
1172
if server_settings["port"]:
1173
server_settings["port"] = server_config.getint("DEFAULT",
1174
"port")
689
server_settings = dict(server_config.items(server_section))
690
# Use getboolean on the boolean config option
691
server_settings["debug"] = server_config.getboolean\
692
(server_section, "debug")
1175
693
del server_config
1176
694
1177
695
# Override the settings from the config file with command line
1178
696
# options, if set.
1179
697
for option in ("interface", "address", "port", "debug",
1180
"priority", "servicename", "configdir",
1181
"use_dbus", "use_ipv6"):
698
"priority", "servicename", "configdir"):
1182
699
value = getattr(options, option)
1183
700
if value is not None:
1184
701
server_settings[option] = value
1185
702
del options
1186
703
# Now we have our good server settings in "server_settings"
1187
704
1188
##################################################################
1189
1190
# For convenience
1191
debug = server_settings["debug"]
1192
use_dbus = server_settings["use_dbus"]
1193
use_ipv6 = server_settings["use_ipv6"]
1194
1195
if not debug:
1196
syslogger.setLevel(logging.WARNING)
1197
console.setLevel(logging.WARNING)
1198
1199
if server_settings["servicename"] != "Mandos":
1200
syslogger.setFormatter(logging.Formatter
1201
('Mandos (%s) [%%(process)d]:'
1202
' %%(levelname)s: %%(message)s'
1203
% server_settings["servicename"]))
1204
1205
705
# Parse config file with clients
1206
706
client_defaults = { "timeout": "1h",
1207
707
"interval": "5m",
1208
"checker": "fping -q -- %%(host)s",
1209
"host": "",
708
"checker": "fping -q -- %%(fqdn)s",
1210
709
}
1211
710
client_config = ConfigParser.SafeConfigParser(client_defaults)
1212
711
client_config.read(os.path.join(server_settings["configdir"],
1213
712
"clients.conf"))
1214
1215
global mandos_dbus_service
1216
mandos_dbus_service = None
1217
1218
clients = Set()
1219
tcp_server = IPv6_TCPServer((server_settings["address"],
1220
server_settings["port"]),
1221
ClientHandler,
1222
interface=
1223
server_settings["interface"],
1224
use_ipv6=use_ipv6,
1225
clients=clients,
1226
gnutls_priority=
1227
server_settings["priority"],
1228
use_dbus=use_dbus)
1229
pidfilename = "/var/run/mandos.pid"
1230
try:
1231
pidfile = open(pidfilename, "w")
1232
except IOError:
1233
logger.error("Could not open file %r", pidfilename)
1234
1235
try:
1236
uid = pwd.getpwnam("_mandos").pw_uid
1237
gid = pwd.getpwnam("_mandos").pw_gid
1238
except KeyError:
1239
try:
1240
uid = pwd.getpwnam("mandos").pw_uid
1241
gid = pwd.getpwnam("mandos").pw_gid
1242
except KeyError:
1243
try:
1244
uid = pwd.getpwnam("nobody").pw_uid
1245
gid = pwd.getpwnam("nogroup").pw_gid
1246
except KeyError:
1247
uid = 65534
1248
gid = 65534
1249
try:
1250
os.setgid(gid)
1251
os.setuid(uid)
1252
except OSError, error:
1253
if error[0] != errno.EPERM:
1254
raise error
1255
1256
# Enable all possible GnuTLS debugging
1257
if debug:
1258
# "Use a log level over 10 to enable all debugging options."
1259
# - GnuTLS manual
1260
gnutls.library.functions.gnutls_global_set_log_level(11)
1261
1262
@gnutls.library.types.gnutls_log_func
1263
def debug_gnutls(level, string):
1264
logger.debug("GnuTLS: %s", string[:-1])
1265
1266
(gnutls.library.functions
1267
.gnutls_global_set_log_function(debug_gnutls))
1268
713
1269
714
global service
1270
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1271
715
service = AvahiService(name = server_settings["servicename"],
1272
servicetype = "_mandos._tcp",
1273
protocol = protocol)
716
type = "_mandos._tcp", );
1274
717
if server_settings["interface"]:
1275
service.interface = (if_nametoindex
1276
(server_settings["interface"]))
718
service.interface = if_nametoindex(server_settings["interface"])
1277
719
1278
720
global main_loop
1279
721
global bus
1282
724
DBusGMainLoop(set_as_default=True )
1283
725
main_loop = gobject.MainLoop()
1284
726
bus = dbus.SystemBus()
1285
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1286
avahi.DBUS_PATH_SERVER),
1287
avahi.DBUS_INTERFACE_SERVER)
727
server = dbus.Interface(
728
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
729
avahi.DBUS_INTERFACE_SERVER )
1288
730
# End of Avahi example code
1289
if use_dbus:
1290
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1291
731
1292
client_class = Client
1293
if use_dbus:
1294
client_class = ClientDBus
1295
clients.update(Set(
1296
client_class(name = section,
1297
config= dict(client_config.items(section)))
1298
for section in client_config.sections()))
1299
if not clients:
1300
logger.warning(u"No clients defined")
732
debug = server_settings["debug"]
1301
733
1302
734
if debug:
1303
# Redirect stdin so all checkers get /dev/null
1304
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1305
os.dup2(null, sys.stdin.fileno())
1306
if null > 2:
1307
os.close(null)
1308
else:
1309
# No console logging
1310
logger.removeHandler(console)
1311
# Close all input and output, do double fork, etc.
735
console = logging.StreamHandler()
736
# console.setLevel(logging.DEBUG)
737
console.setFormatter(logging.Formatter\
738
('%(levelname)s: %(message)s'))
739
logger.addHandler(console)
740
del console
741
742
clients = Set()
743
def remove_from_clients(client):
744
clients.remove(client)
745
if not clients:
746
logger.critical(u"No clients left, exiting")
747
sys.exit()
748
749
clients.update(Set(Client(name = section,
750
stop_hook = remove_from_clients,
751
config
752
= dict(client_config.items(section)))
753
for section in client_config.sections()))
754
755
if not debug:
1312
756
daemon()
1313
757
1314
try:
1315
with closing(pidfile):
1316
pid = os.getpid()
1317
pidfile.write(str(pid) + "\n")
1318
del pidfile
1319
except IOError:
1320
logger.error(u"Could not write to file %r with PID %d",
1321
pidfilename, pid)
1322
except NameError:
1323
# "pidfile" was never created
1324
pass
1325
del pidfilename
1326
1327
758
def cleanup():
1328
759
"Cleanup function; run on exit"
1329
760
global group
1335
766
1336
767
while clients:
1337
768
client = clients.pop()
1338
client.disable_hook = None
1339
client.disable()
769
client.stop_hook = None
770
client.stop()
1340
771
1341
772
atexit.register(cleanup)
1342
773
1345
776
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1346
777
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1347
778
1348
if use_dbus:
1349
class MandosDBusService(dbus.service.Object):
1350
"""A D-Bus proxy object"""
1351
def __init__(self):
1352
dbus.service.Object.__init__(self, bus, "/")
1353
_interface = u"se.bsnet.fukt.Mandos"
1354
1355
@dbus.service.signal(_interface, signature="oa{sv}")
1356
def ClientAdded(self, objpath, properties):
1357
"D-Bus signal"
1358
pass
1359
1360
@dbus.service.signal(_interface, signature="s")
1361
def ClientNotFound(self, fingerprint):
1362
"D-Bus signal"
1363
pass
1364
1365
@dbus.service.signal(_interface, signature="os")
1366
def ClientRemoved(self, objpath, name):
1367
"D-Bus signal"
1368
pass
1369
1370
@dbus.service.method(_interface, out_signature="ao")
1371
def GetAllClients(self):
1372
"D-Bus method"
1373
return dbus.Array(c.dbus_object_path for c in clients)
1374
1375
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1376
def GetAllClientsWithProperties(self):
1377
"D-Bus method"
1378
return dbus.Dictionary(
1379
((c.dbus_object_path, c.GetAllProperties())
1380
for c in clients),
1381
signature="oa{sv}")
1382
1383
@dbus.service.method(_interface, in_signature="o")
1384
def RemoveClient(self, object_path):
1385
"D-Bus method"
1386
for c in clients:
1387
if c.dbus_object_path == object_path:
1388
clients.remove(c)
1389
c.remove_from_connection()
1390
# Don't signal anything except ClientRemoved
1391
c.disable(signal=False)
1392
# Emit D-Bus signal
1393
self.ClientRemoved(object_path, c.name)
1394
return
1395
raise KeyError
1396
1397
del _interface
1398
1399
mandos_dbus_service = MandosDBusService()
1400
1401
779
for client in clients:
1402
if use_dbus:
1403
# Emit D-Bus signal
1404
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1405
client.GetAllProperties())
1406
client.enable()
1407
1408
tcp_server.enable()
1409
tcp_server.server_activate()
1410
780
client.start()
781
782
tcp_server = IPv6_TCPServer((server_settings["address"],
783
server_settings["port"]),
784
tcp_handler,
785
settings=server_settings,
786
clients=clients)
1411
787
# Find out what port we got
1412
788
service.port = tcp_server.socket.getsockname()[1]
1413
if use_ipv6:
1414
logger.info(u"Now listening on address %r, port %d,"
1415
" flowinfo %d, scope_id %d"
1416
% tcp_server.socket.getsockname())
1417
else: # IPv4
1418
logger.info(u"Now listening on address %r, port %d"
1419
% tcp_server.socket.getsockname())
789
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
790
u" scope_id %d" % tcp_server.socket.getsockname())
1420
791
1421
792
#service.interface = tcp_server.socket.getsockname()[3]
1422
793
1432
803
1433
804
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1434
805
lambda *args, **kwargs:
1435
(tcp_server.handle_request
1436
(*args[2:], **kwargs) or True))
806
tcp_server.handle_request\
807
(*args[2:], **kwargs) or True)
1437
808
1438
logger.debug(u"Starting main loop")
809
logger.debug("Starting main loop")
810
main_loop_started = True
1439
811
main_loop.run()
1440
812
except AvahiError, error:
1441
logger.critical(u"AvahiError: %s", error)
813
logger.critical(u"AvahiError: %s" + unicode(error))
1442
814
sys.exit(1)
1443
815
except KeyboardInterrupt:
1444
816
if debug:
1445
print >> sys.stderr
1446
logger.debug("Server received KeyboardInterrupt")
1447
logger.debug("Server exiting")
817
print
1448
818
1449
819
if __name__ == '__main__':
1450
820
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0