To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 79
- compare with another revision
- download diff
- download tarball
- view history from revision 79
- Committer: Teddy Hogeborn
- Date: 2008-08-16 16:58:31 UTC
- Revision ID: teddy@fukt.bsnet.se-20080816165831-cx018vo5i9oqmgo0
* plugins.d/password-request.c (main): Include environment variables
"cryptsource" and "crypttarget"
in password prompt.
"cryptsource" and "crypttarget"
in password prompt.
- files added:
- network-protocol.txt
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugins.d/mandos-client.c => plugins.d/password-request.c
- plugins.d/mandos-client.xml => plugins.d/password-request.xml
- files modified:
- Makefile
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008 Teddy Hogeborn
15
# Copyright © 2008 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
# GNU General Public License for more details.
26
25
#
27
26
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
30
28
#
31
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
30
#
33
31
34
from __future__ import division, with_statement, absolute_import
32
from __future__ import division
35
33
36
34
import SocketServer
37
35
import socket
36
import select
38
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
import pwd
59
from contextlib import closing
60
57
61
58
import dbus
62
import dbus.service
63
59
import gobject
64
60
import avahi
65
61
from dbus.mainloop.glib import DBusGMainLoop
66
62
import ctypes
67
import ctypes.util
68
63
69
version = "1.0.2"
64
version = "1.0"
70
65
71
66
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
67
syslogger = logging.handlers.SysLogHandler\
68
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
69
address = "/dev/log")
70
syslogger.setFormatter(logging.Formatter\
71
('Mandos: %(levelname)s: %(message)s'))
77
72
logger.addHandler(syslogger)
78
73
79
74
console = logging.StreamHandler()
84
79
class AvahiError(Exception):
85
80
def __init__(self, value):
86
81
self.value = value
87
super(AvahiError, self).__init__()
88
82
def __str__(self):
89
83
return repr(self.value)
90
84
112
106
a sensible number of times
113
107
"""
114
108
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
109
type = None, port = None, TXT = None, domain = "",
110
host = "", max_renames = 32768):
117
111
self.interface = interface
118
112
self.name = name
119
self.type = servicetype
113
self.type = type
120
114
self.port = port
121
self.TXT = TXT if TXT is not None else []
115
if TXT is None:
116
self.TXT = []
117
else:
118
self.TXT = TXT
122
119
self.domain = domain
123
120
self.host = host
124
121
self.rename_count = 0
126
123
def rename(self):
127
124
"""Derived from the Avahi example code"""
128
125
if self.rename_count >= self.max_renames:
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
126
logger.critical(u"No suitable service name found after %i"
127
u" retries, exiting.", rename_count)
132
128
raise AvahiServiceError("Too many renames")
133
129
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
130
logger.info(u"Changing name to %r ...", str(self.name))
131
syslogger.setFormatter(logging.Formatter\
137
132
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
133
' %%(message)s' % self.name))
139
134
self.remove()
140
135
self.add()
141
136
self.rename_count += 1
147
142
"""Derived from the Avahi example code"""
148
143
global group
149
144
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
145
group = dbus.Interface\
146
(bus.get_object(avahi.DBUS_NAME,
152
147
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
148
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
149
group.connect_to_signal('StateChanged',
155
150
entry_group_state_changed)
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
151
logger.debug(u"Adding service '%s' of type '%s' ...",
157
152
service.name, service.type)
158
153
group.AddService(
159
154
self.interface, # interface
170
165
# End of Avahi example code
171
166
172
167
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
168
class Client(object):
179
169
"""A representation of a client host served by this server.
180
170
Attributes:
181
name: string; from the config file, used in log messages
171
name: string; from the config file, used in log messages
182
172
fingerprint: string (40 or 32 hexadecimal digits); used to
183
173
uniquely identify the client
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
174
secret: bytestring; sent verbatim (over TLS) to client
175
host: string; available for use by the checker command
176
created: datetime.datetime(); object creation, not client host
177
last_checked_ok: datetime.datetime() or None if not yet checked OK
178
timeout: datetime.timedelta(); How long from last_checked_ok
179
until this client is invalid
180
interval: datetime.timedelta(); How often to start a new checker
181
stop_hook: If set, called by stop() as stop_hook(self)
182
checker: subprocess.Popen(); a running checker process used
183
to see if the client lives.
184
'None' if no process is running.
197
185
checker_initiator_tag: a gobject event source tag, or None
198
disable_initiator_tag: - '' -
186
stop_initiator_tag: - '' -
199
187
checker_callback_tag: - '' -
200
188
checker_command: string; External command which is run to check if
201
189
client lives. %() expansions are done at
202
190
runtime with vars(self) as dict, so that for
203
191
instance %(name)s can be used in the command.
204
dbus_object_path: dbus.ObjectPath
205
192
Private attibutes:
206
193
_timeout: Real variable for 'timeout'
207
194
_interval: Real variable for 'interval'
209
196
_interval_milliseconds: - '' -
210
197
"""
211
198
def _set_timeout(self, timeout):
212
"Setter function for the 'timeout' attribute"
199
"Setter function for 'timeout' attribute"
213
200
self._timeout = timeout
214
201
self._timeout_milliseconds = ((self.timeout.days
215
202
* 24 * 60 * 60 * 1000)
216
203
+ (self.timeout.seconds * 1000)
217
204
+ (self.timeout.microseconds
218
205
// 1000))
219
# Emit D-Bus signal
220
self.PropertyChanged(dbus.String(u"timeout"),
221
(dbus.UInt64(self._timeout_milliseconds,
222
variant_level=1)))
223
timeout = property(lambda self: self._timeout, _set_timeout)
206
timeout = property(lambda self: self._timeout,
207
_set_timeout)
224
208
del _set_timeout
225
226
209
def _set_interval(self, interval):
227
"Setter function for the 'interval' attribute"
210
"Setter function for 'interval' attribute"
228
211
self._interval = interval
229
212
self._interval_milliseconds = ((self.interval.days
230
213
* 24 * 60 * 60 * 1000)
232
215
* 1000)
233
216
+ (self.interval.microseconds
234
217
// 1000))
235
# Emit D-Bus signal
236
self.PropertyChanged(dbus.String(u"interval"),
237
(dbus.UInt64(self._interval_milliseconds,
238
variant_level=1)))
239
interval = property(lambda self: self._interval, _set_interval)
218
interval = property(lambda self: self._interval,
219
_set_interval)
240
220
del _set_interval
241
242
def __init__(self, name = None, disable_hook=None, config=None):
221
def __init__(self, name = None, stop_hook=None, config={}):
243
222
"""Note: the 'checker' key in 'config' sets the
244
223
'checker_command' attribute and *not* the 'checker'
245
224
attribute."""
246
self.dbus_object_path = (dbus.ObjectPath
247
("/Mandos/clients/"
248
+ name.replace(".", "_")))
249
dbus.service.Object.__init__(self, bus,
250
self.dbus_object_path)
251
if config is None:
252
config = {}
253
225
self.name = name
254
226
logger.debug(u"Creating client %r", self.name)
255
227
# Uppercase and remove spaces from fingerprint for later
256
228
# comparison purposes with return value from the fingerprint()
257
229
# function
258
self.fingerprint = (config["fingerprint"].upper()
259
.replace(u" ", u""))
230
self.fingerprint = config["fingerprint"].upper()\
231
.replace(u" ", u"")
260
232
logger.debug(u" Fingerprint: %s", self.fingerprint)
261
233
if "secret" in config:
262
234
self.secret = config["secret"].decode(u"base64")
263
235
elif "secfile" in config:
264
with closing(open(os.path.expanduser
265
(os.path.expandvars
266
(config["secfile"])))) as secfile:
267
self.secret = secfile.read()
236
sf = open(config["secfile"])
237
self.secret = sf.read()
238
sf.close()
268
239
else:
269
240
raise TypeError(u"No secret or secfile for client %s"
270
241
% self.name)
271
242
self.host = config.get("host", "")
272
self.created = datetime.datetime.utcnow()
273
self.enabled = False
274
self.last_enabled = None
243
self.created = datetime.datetime.now()
275
244
self.last_checked_ok = None
276
245
self.timeout = string_to_delta(config["timeout"])
277
246
self.interval = string_to_delta(config["interval"])
278
self.disable_hook = disable_hook
247
self.stop_hook = stop_hook
279
248
self.checker = None
280
249
self.checker_initiator_tag = None
281
self.disable_initiator_tag = None
250
self.stop_initiator_tag = None
282
251
self.checker_callback_tag = None
283
self.checker_command = config["checker"]
284
285
def enable(self):
252
self.check_command = config["checker"]
253
def start(self):
286
254
"""Start this client's checker and timeout hooks"""
287
self.last_enabled = datetime.datetime.utcnow()
288
255
# Schedule a new checker to be started an 'interval' from now,
289
256
# and every interval from then on.
290
self.checker_initiator_tag = (gobject.timeout_add
291
(self._interval_milliseconds,
292
self.start_checker))
257
self.checker_initiator_tag = gobject.timeout_add\
258
(self._interval_milliseconds,
259
self.start_checker)
293
260
# Also start a new checker *right now*.
294
261
self.start_checker()
295
# Schedule a disable() when 'timeout' has passed
296
self.disable_initiator_tag = (gobject.timeout_add
297
(self._timeout_milliseconds,
298
self.disable))
299
self.enabled = True
300
# Emit D-Bus signal
301
self.PropertyChanged(dbus.String(u"enabled"),
302
dbus.Boolean(True, variant_level=1))
303
self.PropertyChanged(dbus.String(u"last_enabled"),
304
(_datetime_to_dbus(self.last_enabled,
305
variant_level=1)))
306
307
def disable(self):
308
"""Disable this client."""
309
if not getattr(self, "enabled", False):
262
# Schedule a stop() when 'timeout' has passed
263
self.stop_initiator_tag = gobject.timeout_add\
264
(self._timeout_milliseconds,
265
self.stop)
266
def stop(self):
267
"""Stop this client.
268
The possibility that a client might be restarted is left open,
269
but not currently used."""
270
# If this client doesn't have a secret, it is already stopped.
271
if hasattr(self, "secret") and self.secret:
272
logger.info(u"Stopping client %s", self.name)
273
self.secret = None
274
else:
310
275
return False
311
logger.info(u"Disabling client %s", self.name)
312
if getattr(self, "disable_initiator_tag", False):
313
gobject.source_remove(self.disable_initiator_tag)
314
self.disable_initiator_tag = None
276
if getattr(self, "stop_initiator_tag", False):
277
gobject.source_remove(self.stop_initiator_tag)
278
self.stop_initiator_tag = None
315
279
if getattr(self, "checker_initiator_tag", False):
316
280
gobject.source_remove(self.checker_initiator_tag)
317
281
self.checker_initiator_tag = None
318
282
self.stop_checker()
319
if self.disable_hook:
320
self.disable_hook(self)
321
self.enabled = False
322
# Emit D-Bus signal
323
self.PropertyChanged(dbus.String(u"enabled"),
324
dbus.Boolean(False, variant_level=1))
283
if self.stop_hook:
284
self.stop_hook(self)
325
285
# Do not run this again if called by a gobject.timeout_add
326
286
return False
327
328
287
def __del__(self):
329
self.disable_hook = None
330
self.disable()
331
332
def checker_callback(self, pid, condition, command):
288
self.stop_hook = None
289
self.stop()
290
def checker_callback(self, pid, condition):
333
291
"""The checker has completed, so take appropriate actions."""
292
now = datetime.datetime.now()
334
293
self.checker_callback_tag = None
335
294
self.checker = None
336
# Emit D-Bus signal
337
self.PropertyChanged(dbus.String(u"checker_running"),
338
dbus.Boolean(False, variant_level=1))
339
if (os.WIFEXITED(condition)
340
and (os.WEXITSTATUS(condition) == 0)):
295
if os.WIFEXITED(condition) \
296
and (os.WEXITSTATUS(condition) == 0):
341
297
logger.info(u"Checker for %(name)s succeeded",
342
298
vars(self))
343
# Emit D-Bus signal
344
self.CheckerCompleted(dbus.Boolean(True),
345
dbus.UInt16(condition),
346
dbus.String(command))
347
self.bump_timeout()
299
self.last_checked_ok = now
300
gobject.source_remove(self.stop_initiator_tag)
301
self.stop_initiator_tag = gobject.timeout_add\
302
(self._timeout_milliseconds,
303
self.stop)
348
304
elif not os.WIFEXITED(condition):
349
305
logger.warning(u"Checker for %(name)s crashed?",
350
306
vars(self))
351
# Emit D-Bus signal
352
self.CheckerCompleted(dbus.Boolean(False),
353
dbus.UInt16(condition),
354
dbus.String(command))
355
307
else:
356
308
logger.info(u"Checker for %(name)s failed",
357
309
vars(self))
358
# Emit D-Bus signal
359
self.CheckerCompleted(dbus.Boolean(False),
360
dbus.UInt16(condition),
361
dbus.String(command))
362
363
def bump_timeout(self):
364
"""Bump up the timeout for this client.
365
This should only be called when the client has been seen,
366
alive and well.
367
"""
368
self.last_checked_ok = datetime.datetime.utcnow()
369
gobject.source_remove(self.disable_initiator_tag)
370
self.disable_initiator_tag = (gobject.timeout_add
371
(self._timeout_milliseconds,
372
self.disable))
373
self.PropertyChanged(dbus.String(u"last_checked_ok"),
374
(_datetime_to_dbus(self.last_checked_ok,
375
variant_level=1)))
376
377
310
def start_checker(self):
378
311
"""Start a new checker subprocess if one is not running.
379
312
If a checker already exists, leave it running and do
388
321
# is as it should be.
389
322
if self.checker is None:
390
323
try:
391
# In case checker_command has exactly one % operator
392
command = self.checker_command % self.host
324
# In case check_command has exactly one % operator
325
command = self.check_command % self.host
393
326
except TypeError:
394
327
# Escape attributes for the shell
395
328
escaped_attrs = dict((key, re.escape(str(val)))
396
329
for key, val in
397
330
vars(self).iteritems())
398
331
try:
399
command = self.checker_command % escaped_attrs
332
command = self.check_command % escaped_attrs
400
333
except TypeError, error:
401
334
logger.error(u'Could not format string "%s":'
402
u' %s', self.checker_command, error)
335
u' %s', self.check_command, error)
403
336
return True # Try again later
404
337
try:
405
338
logger.info(u"Starting checker %r for %s",
406
339
command, self.name)
407
# We don't need to redirect stdout and stderr, since
408
# in normal mode, that is already done by daemon(),
409
# and in debug mode we don't want to. (Stdin is
410
# always replaced by /dev/null.)
411
340
self.checker = subprocess.Popen(command,
412
341
close_fds=True,
413
342
shell=True, cwd="/")
414
# Emit D-Bus signal
415
self.CheckerStarted(command)
416
self.PropertyChanged(dbus.String("checker_running"),
417
dbus.Boolean(True, variant_level=1))
418
self.checker_callback_tag = (gobject.child_watch_add
419
(self.checker.pid,
420
self.checker_callback,
421
data=command))
422
except OSError, error:
343
self.checker_callback_tag = gobject.child_watch_add\
344
(self.checker.pid,
345
self.checker_callback)
346
except subprocess.OSError, error:
423
347
logger.error(u"Failed to start subprocess: %s",
424
348
error)
425
349
# Re-run this periodically if run by gobject.timeout_add
426
350
return True
427
428
351
def stop_checker(self):
429
352
"""Force the checker process, if any, to stop."""
430
353
if self.checker_callback_tag:
442
365
if error.errno != errno.ESRCH: # No such process
443
366
raise
444
367
self.checker = None
445
self.PropertyChanged(dbus.String(u"checker_running"),
446
dbus.Boolean(False, variant_level=1))
447
448
368
def still_valid(self):
449
369
"""Has the timeout not yet passed for this client?"""
450
if not getattr(self, "enabled", False):
451
return False
452
now = datetime.datetime.utcnow()
370
now = datetime.datetime.now()
453
371
if self.last_checked_ok is None:
454
372
return now < (self.created + self.timeout)
455
373
else:
456
374
return now < (self.last_checked_ok + self.timeout)
457
458
## D-Bus methods & signals
459
_interface = u"org.mandos_system.Mandos.Client"
460
461
# BumpTimeout - method
462
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
463
BumpTimeout.__name__ = "BumpTimeout"
464
465
# CheckerCompleted - signal
466
@dbus.service.signal(_interface, signature="bqs")
467
def CheckerCompleted(self, success, condition, command):
468
"D-Bus signal"
469
pass
470
471
# CheckerStarted - signal
472
@dbus.service.signal(_interface, signature="s")
473
def CheckerStarted(self, command):
474
"D-Bus signal"
475
pass
476
477
# GetAllProperties - method
478
@dbus.service.method(_interface, out_signature="a{sv}")
479
def GetAllProperties(self):
480
"D-Bus method"
481
return dbus.Dictionary({
482
dbus.String("name"):
483
dbus.String(self.name, variant_level=1),
484
dbus.String("fingerprint"):
485
dbus.String(self.fingerprint, variant_level=1),
486
dbus.String("host"):
487
dbus.String(self.host, variant_level=1),
488
dbus.String("created"):
489
_datetime_to_dbus(self.created, variant_level=1),
490
dbus.String("last_enabled"):
491
(_datetime_to_dbus(self.last_enabled,
492
variant_level=1)
493
if self.last_enabled is not None
494
else dbus.Boolean(False, variant_level=1)),
495
dbus.String("enabled"):
496
dbus.Boolean(self.enabled, variant_level=1),
497
dbus.String("last_checked_ok"):
498
(_datetime_to_dbus(self.last_checked_ok,
499
variant_level=1)
500
if self.last_checked_ok is not None
501
else dbus.Boolean (False, variant_level=1)),
502
dbus.String("timeout"):
503
dbus.UInt64(self._timeout_milliseconds,
504
variant_level=1),
505
dbus.String("interval"):
506
dbus.UInt64(self._interval_milliseconds,
507
variant_level=1),
508
dbus.String("checker"):
509
dbus.String(self.checker_command,
510
variant_level=1),
511
dbus.String("checker_running"):
512
dbus.Boolean(self.checker is not None,
513
variant_level=1),
514
}, signature="sv")
515
516
# IsStillValid - method
517
IsStillValid = (dbus.service.method(_interface, out_signature="b")
518
(still_valid))
519
IsStillValid.__name__ = "IsStillValid"
520
521
# PropertyChanged - signal
522
@dbus.service.signal(_interface, signature="sv")
523
def PropertyChanged(self, property, value):
524
"D-Bus signal"
525
pass
526
527
# SetChecker - method
528
@dbus.service.method(_interface, in_signature="s")
529
def SetChecker(self, checker):
530
"D-Bus setter method"
531
self.checker_command = checker
532
533
# SetHost - method
534
@dbus.service.method(_interface, in_signature="s")
535
def SetHost(self, host):
536
"D-Bus setter method"
537
self.host = host
538
539
# SetInterval - method
540
@dbus.service.method(_interface, in_signature="t")
541
def SetInterval(self, milliseconds):
542
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
543
544
# SetSecret - method
545
@dbus.service.method(_interface, in_signature="ay",
546
byte_arrays=True)
547
def SetSecret(self, secret):
548
"D-Bus setter method"
549
self.secret = str(secret)
550
551
# SetTimeout - method
552
@dbus.service.method(_interface, in_signature="t")
553
def SetTimeout(self, milliseconds):
554
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
555
556
# Enable - method
557
Enable = dbus.service.method(_interface)(enable)
558
Enable.__name__ = "Enable"
559
560
# StartChecker - method
561
@dbus.service.method(_interface)
562
def StartChecker(self):
563
"D-Bus method"
564
self.start_checker()
565
566
# Disable - method
567
@dbus.service.method(_interface)
568
def Disable(self):
569
"D-Bus method"
570
self.disable()
571
572
# StopChecker - method
573
StopChecker = dbus.service.method(_interface)(stop_checker)
574
StopChecker.__name__ = "StopChecker"
575
576
del _interface
577
375
578
376
579
377
def peer_certificate(session):
580
378
"Return the peer's OpenPGP certificate as a bytestring"
581
379
# If not an OpenPGP certificate...
582
if (gnutls.library.functions
583
.gnutls_certificate_type_get(session._c_object)
584
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
380
if gnutls.library.functions.gnutls_certificate_type_get\
381
(session._c_object) \
382
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
585
383
# ...do the normal thing
586
384
return session.peer_certificate
587
385
list_size = ctypes.c_uint()
588
cert_list = (gnutls.library.functions
589
.gnutls_certificate_get_peers
590
(session._c_object, ctypes.byref(list_size)))
386
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
387
(session._c_object, ctypes.byref(list_size))
591
388
if list_size.value == 0:
592
389
return None
593
390
cert = cert_list[0]
597
394
def fingerprint(openpgp):
598
395
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
599
396
# New GnuTLS "datum" with the OpenPGP public key
600
datum = (gnutls.library.types
601
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
602
ctypes.POINTER
603
(ctypes.c_ubyte)),
604
ctypes.c_uint(len(openpgp))))
397
datum = gnutls.library.types.gnutls_datum_t\
398
(ctypes.cast(ctypes.c_char_p(openpgp),
399
ctypes.POINTER(ctypes.c_ubyte)),
400
ctypes.c_uint(len(openpgp)))
605
401
# New empty GnuTLS certificate
606
402
crt = gnutls.library.types.gnutls_openpgp_crt_t()
607
(gnutls.library.functions
608
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
403
gnutls.library.functions.gnutls_openpgp_crt_init\
404
(ctypes.byref(crt))
609
405
# Import the OpenPGP public key into the certificate
610
(gnutls.library.functions
611
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
612
gnutls.library.constants
613
.GNUTLS_OPENPGP_FMT_RAW))
614
# Verify the self signature in the key
615
crtverify = ctypes.c_uint()
616
(gnutls.library.functions
617
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
618
if crtverify.value != 0:
619
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
620
raise gnutls.errors.CertificateSecurityError("Verify failed")
406
gnutls.library.functions.gnutls_openpgp_crt_import\
407
(crt, ctypes.byref(datum),
408
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
621
409
# New buffer for the fingerprint
622
buf = ctypes.create_string_buffer(20)
623
buf_len = ctypes.c_size_t()
410
buffer = ctypes.create_string_buffer(20)
411
buffer_length = ctypes.c_size_t()
624
412
# Get the fingerprint from the certificate into the buffer
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
627
ctypes.byref(buf_len)))
413
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
414
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
628
415
# Deinit the certificate
629
416
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
630
417
# Convert the buffer to a Python bytestring
631
fpr = ctypes.string_at(buf, buf_len.value)
418
fpr = ctypes.string_at(buffer, buffer_length.value)
632
419
# Convert the bytestring to hexadecimal notation
633
420
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
634
421
return hex_fpr
635
422
636
423
637
class TCP_handler(SocketServer.BaseRequestHandler, object):
424
class tcp_handler(SocketServer.BaseRequestHandler, object):
638
425
"""A TCP request handler class.
639
426
Instantiated by IPv6_TCPServer for each request to handle it.
640
427
Note: This will run in its own forked process."""
641
428
642
429
def handle(self):
643
430
logger.info(u"TCP connection from: %s",
644
unicode(self.client_address))
645
session = (gnutls.connection
646
.ClientSession(self.request,
647
gnutls.connection
648
.X509Credentials()))
431
unicode(self.client_address))
432
session = gnutls.connection.ClientSession\
433
(self.request, gnutls.connection.X509Credentials())
649
434
650
435
line = self.request.makefile().readline()
651
436
logger.debug(u"Protocol version: %r", line)
664
449
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
665
450
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
666
451
# "+DHE-DSS"))
667
# Use a fallback default, since this MUST be set.
668
priority = self.server.settings.get("priority", "NORMAL")
669
(gnutls.library.functions
670
.gnutls_priority_set_direct(session._c_object,
671
priority, None))
452
priority = "NORMAL" # Fallback default, since this
453
# MUST be set.
454
if self.server.settings["priority"]:
455
priority = self.server.settings["priority"]
456
gnutls.library.functions.gnutls_priority_set_direct\
457
(session._c_object, priority, None);
672
458
673
459
try:
674
460
session.handshake()
684
470
session.bye()
685
471
return
686
472
logger.debug(u"Fingerprint: %s", fpr)
473
client = None
687
474
for c in self.server.clients:
688
475
if c.fingerprint == fpr:
689
476
client = c
690
477
break
691
else:
478
if not client:
692
479
logger.warning(u"Client not found for fingerprint: %s",
693
480
fpr)
694
481
session.bye()
701
488
vars(client))
702
489
session.bye()
703
490
return
704
## This won't work here, since we're in a fork.
705
# client.bump_timeout()
706
491
sent_size = 0
707
492
while sent_size < len(client.secret):
708
493
sent = session.send(client.secret[sent_size:])
713
498
session.bye()
714
499
715
500
716
class IPv6_TCPServer(SocketServer.ForkingMixIn,
717
SocketServer.TCPServer, object):
501
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
718
502
"""IPv6 TCP server. Accepts 'None' as address and/or port.
719
503
Attributes:
720
504
settings: Server settings
721
505
clients: Set() of Client objects
722
enabled: Boolean; whether this server is activated yet
723
506
"""
724
507
address_family = socket.AF_INET6
725
508
def __init__(self, *args, **kwargs):
729
512
if "clients" in kwargs:
730
513
self.clients = kwargs["clients"]
731
514
del kwargs["clients"]
732
self.enabled = False
733
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
515
return super(type(self), self).__init__(*args, **kwargs)
734
516
def server_bind(self):
735
517
"""This overrides the normal server_bind() function
736
518
to bind to an interface if one was specified, and also NOT to
765
547
# if_nametoindex
766
548
# (self.settings
767
549
# ["interface"]))
768
return super(IPv6_TCPServer, self).server_bind()
769
def server_activate(self):
770
if self.enabled:
771
return super(IPv6_TCPServer, self).server_activate()
772
def enable(self):
773
self.enabled = True
550
return super(type(self), self).server_bind()
774
551
775
552
776
553
def string_to_delta(interval):
786
563
datetime.timedelta(1)
787
564
>>> string_to_delta(u'1w')
788
565
datetime.timedelta(7)
789
>>> string_to_delta('5m 30s')
790
datetime.timedelta(0, 330)
791
566
"""
792
timevalue = datetime.timedelta(0)
793
for s in interval.split():
794
try:
795
suffix = unicode(s[-1])
796
value = int(s[:-1])
797
if suffix == u"d":
798
delta = datetime.timedelta(value)
799
elif suffix == u"s":
800
delta = datetime.timedelta(0, value)
801
elif suffix == u"m":
802
delta = datetime.timedelta(0, 0, 0, 0, value)
803
elif suffix == u"h":
804
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
805
elif suffix == u"w":
806
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
807
else:
808
raise ValueError
809
except (ValueError, IndexError):
567
try:
568
suffix=unicode(interval[-1])
569
value=int(interval[:-1])
570
if suffix == u"d":
571
delta = datetime.timedelta(value)
572
elif suffix == u"s":
573
delta = datetime.timedelta(0, value)
574
elif suffix == u"m":
575
delta = datetime.timedelta(0, 0, 0, 0, value)
576
elif suffix == u"h":
577
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
578
elif suffix == u"w":
579
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
580
else:
810
581
raise ValueError
811
timevalue += delta
812
return timevalue
582
except (ValueError, IndexError):
583
raise ValueError
584
return delta
813
585
814
586
815
587
def server_state_changed(state):
816
588
"""Derived from the Avahi example code"""
817
589
if state == avahi.SERVER_COLLISION:
818
logger.error(u"Zeroconf server name collision")
590
logger.error(u"Server name collision")
819
591
service.remove()
820
592
elif state == avahi.SERVER_RUNNING:
821
593
service.add()
823
595
824
596
def entry_group_state_changed(state, error):
825
597
"""Derived from the Avahi example code"""
826
logger.debug(u"Avahi state change: %i", state)
598
logger.debug(u"state change: %i", state)
827
599
828
600
if state == avahi.ENTRY_GROUP_ESTABLISHED:
829
logger.debug(u"Zeroconf service established.")
601
logger.debug(u"Service established.")
830
602
elif state == avahi.ENTRY_GROUP_COLLISION:
831
logger.warning(u"Zeroconf service name collision.")
603
logger.warning(u"Service name collision.")
832
604
service.rename()
833
605
elif state == avahi.ENTRY_GROUP_FAILURE:
834
logger.critical(u"Avahi: Error in group state changed %s",
606
logger.critical(u"Error in group state changed %s",
835
607
unicode(error))
836
608
raise AvahiGroupError("State changed: %s", str(error))
837
609
839
611
"""Call the C function if_nametoindex(), or equivalent"""
840
612
global if_nametoindex
841
613
try:
842
if_nametoindex = (ctypes.cdll.LoadLibrary
843
(ctypes.util.find_library("c"))
844
.if_nametoindex)
614
if "ctypes.util" not in sys.modules:
615
import ctypes.util
616
if_nametoindex = ctypes.cdll.LoadLibrary\
617
(ctypes.util.find_library("c")).if_nametoindex
845
618
except (OSError, AttributeError):
846
619
if "struct" not in sys.modules:
847
620
import struct
850
623
def if_nametoindex(interface):
851
624
"Get an interface index the hard way, i.e. using fcntl()"
852
625
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
853
with closing(socket.socket()) as s:
854
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
855
struct.pack("16s16x", interface))
626
s = socket.socket()
627
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
628
struct.pack("16s16x", interface))
629
s.close()
856
630
interface_index = struct.unpack("I", ifreq[16:20])[0]
857
631
return interface_index
858
632
return if_nametoindex(interface)
882
656
883
657
884
658
def main():
659
global main_loop_started
660
main_loop_started = False
661
885
662
parser = OptionParser(version = "%%prog %s" % version)
886
663
parser.add_option("-i", "--interface", type="string",
887
664
metavar="IF", help="Bind to interface IF")
902
679
default="/etc/mandos", metavar="DIR",
903
680
help="Directory to search for configuration"
904
681
" files")
905
options = parser.parse_args()[0]
682
(options, args) = parser.parse_args()
906
683
907
684
if options.check:
908
685
import doctest
923
700
server_config = ConfigParser.SafeConfigParser(server_defaults)
924
701
del server_defaults
925
702
server_config.read(os.path.join(options.configdir, "mandos.conf"))
703
server_section = "server"
926
704
# Convert the SafeConfigParser object to a dict
927
server_settings = server_config.defaults()
705
server_settings = dict(server_config.items(server_section))
928
706
# Use getboolean on the boolean config option
929
server_settings["debug"] = (server_config.getboolean
930
("DEFAULT", "debug"))
707
server_settings["debug"] = server_config.getboolean\
708
(server_section, "debug")
931
709
del server_config
932
710
933
711
# Override the settings from the config file with command line
947
725
console.setLevel(logging.WARNING)
948
726
949
727
if server_settings["servicename"] != "Mandos":
950
syslogger.setFormatter(logging.Formatter
728
syslogger.setFormatter(logging.Formatter\
951
729
('Mandos (%s): %%(levelname)s:'
952
730
' %%(message)s'
953
731
% server_settings["servicename"]))
955
733
# Parse config file with clients
956
734
client_defaults = { "timeout": "1h",
957
735
"interval": "5m",
958
"checker": "fping -q -- %(host)s",
959
"host": "",
736
"checker": "fping -q -- %%(host)s",
960
737
}
961
738
client_config = ConfigParser.SafeConfigParser(client_defaults)
962
739
client_config.read(os.path.join(server_settings["configdir"],
963
740
"clients.conf"))
964
741
965
clients = Set()
966
tcp_server = IPv6_TCPServer((server_settings["address"],
967
server_settings["port"]),
968
TCP_handler,
969
settings=server_settings,
970
clients=clients)
971
pidfilename = "/var/run/mandos.pid"
972
try:
973
pidfile = open(pidfilename, "w")
974
except IOError, error:
975
logger.error("Could not open file %r", pidfilename)
976
977
try:
978
uid = pwd.getpwnam("_mandos").pw_uid
979
except KeyError:
980
try:
981
uid = pwd.getpwnam("mandos").pw_uid
982
except KeyError:
983
try:
984
uid = pwd.getpwnam("nobody").pw_uid
985
except KeyError:
986
uid = 65534
987
try:
988
gid = pwd.getpwnam("_mandos").pw_gid
989
except KeyError:
990
try:
991
gid = pwd.getpwnam("mandos").pw_gid
992
except KeyError:
993
try:
994
gid = pwd.getpwnam("nogroup").pw_gid
995
except KeyError:
996
gid = 65534
997
try:
998
os.setuid(uid)
999
os.setgid(gid)
1000
except OSError, error:
1001
if error[0] != errno.EPERM:
1002
raise error
1003
1004
742
global service
1005
743
service = AvahiService(name = server_settings["servicename"],
1006
servicetype = "_mandos._tcp", )
744
type = "_mandos._tcp", );
1007
745
if server_settings["interface"]:
1008
service.interface = (if_nametoindex
1009
(server_settings["interface"]))
746
service.interface = if_nametoindex(server_settings["interface"])
1010
747
1011
748
global main_loop
1012
749
global bus
1015
752
DBusGMainLoop(set_as_default=True )
1016
753
main_loop = gobject.MainLoop()
1017
754
bus = dbus.SystemBus()
1018
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1019
avahi.DBUS_PATH_SERVER),
1020
avahi.DBUS_INTERFACE_SERVER)
755
server = dbus.Interface(
756
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
757
avahi.DBUS_INTERFACE_SERVER )
1021
758
# End of Avahi example code
1022
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
759
760
clients = Set()
761
def remove_from_clients(client):
762
clients.remove(client)
763
if not clients:
764
logger.critical(u"No clients left, exiting")
765
sys.exit()
1023
766
1024
767
clients.update(Set(Client(name = section,
768
stop_hook = remove_from_clients,
1025
769
config
1026
770
= dict(client_config.items(section)))
1027
771
for section in client_config.sections()))
1029
773
logger.critical(u"No clients defined")
1030
774
sys.exit(1)
1031
775
1032
if debug:
1033
# Redirect stdin so all checkers get /dev/null
1034
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1035
os.dup2(null, sys.stdin.fileno())
1036
if null > 2:
1037
os.close(null)
1038
else:
1039
# No console logging
776
if not debug:
1040
777
logger.removeHandler(console)
1041
# Close all input and output, do double fork, etc.
1042
778
daemon()
1043
779
780
pidfilename = "/var/run/mandos/mandos.pid"
781
pid = os.getpid()
1044
782
try:
1045
pid = os.getpid()
783
pidfile = open(pidfilename, "w")
1046
784
pidfile.write(str(pid) + "\n")
1047
785
pidfile.close()
1048
786
del pidfile
1049
except IOError:
1050
logger.error(u"Could not write to file %r with PID %d",
1051
pidfilename, pid)
1052
except NameError:
1053
# "pidfile" was never created
1054
pass
1055
del pidfilename
787
except IOError, err:
788
logger.error(u"Could not write %s file with PID %d",
789
pidfilename, os.getpid())
1056
790
1057
791
def cleanup():
1058
792
"Cleanup function; run on exit"
1065
799
1066
800
while clients:
1067
801
client = clients.pop()
1068
client.disable_hook = None
1069
client.disable()
802
client.stop_hook = None
803
client.stop()
1070
804
1071
805
atexit.register(cleanup)
1072
806
1075
809
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1076
810
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1077
811
1078
class MandosServer(dbus.service.Object):
1079
"""A D-Bus proxy object"""
1080
def __init__(self):
1081
dbus.service.Object.__init__(self, bus,
1082
"/Mandos")
1083
_interface = u"org.mandos_system.Mandos"
1084
1085
@dbus.service.signal(_interface, signature="oa{sv}")
1086
def ClientAdded(self, objpath, properties):
1087
"D-Bus signal"
1088
pass
1089
1090
@dbus.service.signal(_interface, signature="o")
1091
def ClientRemoved(self, objpath):
1092
"D-Bus signal"
1093
pass
1094
1095
@dbus.service.method(_interface, out_signature="ao")
1096
def GetAllClients(self):
1097
return dbus.Array(c.dbus_object_path for c in clients)
1098
1099
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1100
def GetAllClientsWithProperties(self):
1101
return dbus.Dictionary(
1102
((c.dbus_object_path, c.GetAllProperties())
1103
for c in clients),
1104
signature="oa{sv}")
1105
1106
@dbus.service.method(_interface, in_signature="o")
1107
def RemoveClient(self, object_path):
1108
for c in clients:
1109
if c.dbus_object_path == object_path:
1110
c.disable()
1111
clients.remove(c)
1112
return
1113
raise KeyError
1114
1115
del _interface
1116
1117
mandos_server = MandosServer()
1118
1119
812
for client in clients:
1120
# Emit D-Bus signal
1121
mandos_server.ClientAdded(client.dbus_object_path,
1122
client.GetAllProperties())
1123
client.enable()
1124
1125
tcp_server.enable()
1126
tcp_server.server_activate()
1127
813
client.start()
814
815
tcp_server = IPv6_TCPServer((server_settings["address"],
816
server_settings["port"]),
817
tcp_handler,
818
settings=server_settings,
819
clients=clients)
1128
820
# Find out what port we got
1129
821
service.port = tcp_server.socket.getsockname()[1]
1130
822
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1144
836
1145
837
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1146
838
lambda *args, **kwargs:
1147
(tcp_server.handle_request
1148
(*args[2:], **kwargs) or True))
839
tcp_server.handle_request\
840
(*args[2:], **kwargs) or True)
1149
841
1150
842
logger.debug(u"Starting main loop")
843
main_loop_started = True
1151
844
main_loop.run()
1152
845
except AvahiError, error:
1153
846
logger.critical(u"AvahiError: %s" + unicode(error))
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0