/mandos/trunk : revision 86

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

14

16

15

#

17

16

# This program is free software: you can redistribute it and/or modify

18

17

# it under the terms of the GNU General Public License as published by

25

24

# GNU General Public License for more details.

26

25

#

27

26

# You should have received a copy of the GNU General Public License

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

30

28

#

31

29

# Contact the authors at <mandos@fukt.bsnet.se>.

32

30

#

33

31

34

from __future__ import division, with_statement, absolute_import

32

from __future__ import division

35

33

36

34

import SocketServer

37

35

import socket

36

import select

38

37

from optparse import OptionParser

39

38

import datetime

40

39

import errno

55

54

import stat

56

55

import logging

57

56

import logging.handlers

58

import pwd

59

from contextlib import closing

60

57

61

58

import dbus

62

import dbus.service

63

59

import gobject

64

60

import avahi

65

61

from dbus.mainloop.glib import DBusGMainLoop

66

62

import ctypes

67

import ctypes.util

68

63

69

version = "1.0.2"

64

version = "1.0"

70

65

71

66

logger = logging.Logger('mandos')

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos: %(levelname)s: %(message)s'))

67

syslogger = logging.handlers.SysLogHandler\

68

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

69

address = "/dev/log")

70

syslogger.setFormatter(logging.Formatter\

71

('Mandos: %(levelname)s: %(message)s'))

77

72

logger.addHandler(syslogger)

78

73

79

74

console = logging.StreamHandler()

84

79

class AvahiError(Exception):

85

80

def __init__(self, value):

86

81

self.value = value

87

super(AvahiError, self).__init__()

88

82

def __str__(self):

89

83

return repr(self.value)

90

84

112

106

a sensible number of times

113

107

"""

114

108

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

115

servicetype = None, port = None, TXT = None,

116

domain = "", host = "", max_renames = 32768):

109

type = None, port = None, TXT = None, domain = "",

110

host = "", max_renames = 32768):

117

111

self.interface = interface

118

112

self.name = name

119

self.type = servicetype

113

self.type = type

120

114

self.port = port

121

self.TXT = TXT if TXT is not None else []

115

if TXT is None:

116

self.TXT = []

117

else:

118

self.TXT = TXT

122

119

self.domain = domain

123

120

self.host = host

124

121

self.rename_count = 0

126

123

def rename(self):

127

124

"""Derived from the Avahi example code"""

128

125

if self.rename_count >= self.max_renames:

129

logger.critical(u"No suitable Zeroconf service name found"

130

u" after %i retries, exiting.",

131

self.rename_count)

126

logger.critical(u"No suitable service name found after %i"

127

u" retries, exiting.", rename_count)

132

128

raise AvahiServiceError("Too many renames")

133

129

self.name = server.GetAlternativeServiceName(self.name)

134

logger.info(u"Changing Zeroconf service name to %r ...",

135

str(self.name))

136

syslogger.setFormatter(logging.Formatter

130

logger.info(u"Changing name to %r ...", str(self.name))

131

syslogger.setFormatter(logging.Formatter\

137

132

('Mandos (%s): %%(levelname)s:'

138

' %%(message)s' % self.name))

133

' %%(message)s' % self.name))

139

134

self.remove()

140

135

self.add()

141

136

self.rename_count += 1

147

142

"""Derived from the Avahi example code"""

148

143

global group

149

144

if group is None:

150

group = dbus.Interface(bus.get_object

151

(avahi.DBUS_NAME,

145

group = dbus.Interface\

146

(bus.get_object(avahi.DBUS_NAME,

152

147

server.EntryGroupNew()),

153

avahi.DBUS_INTERFACE_ENTRY_GROUP)

148

avahi.DBUS_INTERFACE_ENTRY_GROUP)

154

149

group.connect_to_signal('StateChanged',

155

150

entry_group_state_changed)

156

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

151

logger.debug(u"Adding service '%s' of type '%s' ...",

157

152

service.name, service.type)

158

153

group.AddService(

159

154

self.interface, # interface

170

165

# End of Avahi example code

171

166

172

167

173

def _datetime_to_dbus_struct(dt, variant_level=0):

174

"""Convert a UTC datetime.datetime() to a D-Bus struct.

175

The format is special to this application, since we could not find

176

any other standard way."""

177

return dbus.Struct((dbus.Int16(dt.year),

178

dbus.Byte(dt.month),

179

dbus.Byte(dt.day),

180

dbus.Byte(dt.hour),

181

dbus.Byte(dt.minute),

182

dbus.Byte(dt.second),

183

dbus.UInt32(dt.microsecond)),

184

signature="nyyyyyu",

185

variant_level=variant_level)

186

187

188

class Client(dbus.service.Object):

168

class Client(object):

189

169

"""A representation of a client host served by this server.

190

170

Attributes:

191

name: string; from the config file, used in log messages

171

name: string; from the config file, used in log messages

192

172

fingerprint: string (40 or 32 hexadecimal digits); used to

193

173

uniquely identify the client

194

secret: bytestring; sent verbatim (over TLS) to client

195

host: string; available for use by the checker command

196

created: datetime.datetime(); (UTC) object creation

197

last_started: datetime.datetime(); (UTC)

198

started: bool()

199

last_checked_ok: datetime.datetime(); (UTC) or None

200

timeout: datetime.timedelta(); How long from last_checked_ok

201

until this client is invalid

202

interval: datetime.timedelta(); How often to start a new checker

203

stop_hook: If set, called by stop() as stop_hook(self)

204

checker: subprocess.Popen(); a running checker process used

205

to see if the client lives.

206

'None' if no process is running.

174

secret: bytestring; sent verbatim (over TLS) to client

175

host: string; available for use by the checker command

176

created: datetime.datetime(); object creation, not client host

177

last_checked_ok: datetime.datetime() or None if not yet checked OK

178

timeout: datetime.timedelta(); How long from last_checked_ok

179

until this client is invalid

180

interval: datetime.timedelta(); How often to start a new checker

181

stop_hook: If set, called by stop() as stop_hook(self)

182

checker: subprocess.Popen(); a running checker process used

183

to see if the client lives.

184

'None' if no process is running.

207

185

checker_initiator_tag: a gobject event source tag, or None

208

186

stop_initiator_tag: - '' -

209

187

checker_callback_tag: - '' -

211

189

client lives. %() expansions are done at

212

190

runtime with vars(self) as dict, so that for

213

191

instance %(name)s can be used in the command.

214

dbus_object_path: dbus.ObjectPath

215

192

Private attibutes:

216

193

_timeout: Real variable for 'timeout'

217

194

_interval: Real variable for 'interval'

219

196

_interval_milliseconds: - '' -

220

197

"""

221

198

def _set_timeout(self, timeout):

222

"Setter function for the 'timeout' attribute"

199

"Setter function for 'timeout' attribute"

223

200

self._timeout = timeout

224

201

self._timeout_milliseconds = ((self.timeout.days

225

202

* 24 * 60 * 60 * 1000)

226

203

+ (self.timeout.seconds * 1000)

227

204

+ (self.timeout.microseconds

228

205

// 1000))

229

# Emit D-Bus signal

230

self.PropertyChanged(dbus.String(u"timeout"),

231

(dbus.UInt64(self._timeout_milliseconds,

232

variant_level=1)))

233

timeout = property(lambda self: self._timeout, _set_timeout)

206

timeout = property(lambda self: self._timeout,

207

_set_timeout)

234

208

del _set_timeout

235

236

209

def _set_interval(self, interval):

237

"Setter function for the 'interval' attribute"

210

"Setter function for 'interval' attribute"

238

211

self._interval = interval

239

212

self._interval_milliseconds = ((self.interval.days

240

213

* 24 * 60 * 60 * 1000)

242

215

* 1000)

243

216

+ (self.interval.microseconds

244

217

// 1000))

245

# Emit D-Bus signal

246

self.PropertyChanged(dbus.String(u"interval"),

247

(dbus.UInt64(self._interval_milliseconds,

248

variant_level=1)))

249

interval = property(lambda self: self._interval, _set_interval)

218

interval = property(lambda self: self._interval,

219

_set_interval)

250

220

del _set_interval

251

252

def __init__(self, name = None, stop_hook=None, config=None):

221

def __init__(self, name = None, stop_hook=None, config={}):

253

222

"""Note: the 'checker' key in 'config' sets the

254

223

'checker_command' attribute and *not* the 'checker'

255

224

attribute."""

256

self.dbus_object_path = (dbus.ObjectPath

257

("/Mandos/clients/"

258

+ name.replace(".", "_")))

259

dbus.service.Object.__init__(self, bus,

260

self.dbus_object_path)

261

if config is None:

262

config = {}

263

225

self.name = name

264

226

logger.debug(u"Creating client %r", self.name)

265

227

# Uppercase and remove spaces from fingerprint for later

266

228

# comparison purposes with return value from the fingerprint()

267

229

# function

268

self.fingerprint = (config["fingerprint"].upper()

269

.replace(u" ", u""))

230

self.fingerprint = config["fingerprint"].upper()\

231

.replace(u" ", u"")

270

232

logger.debug(u" Fingerprint: %s", self.fingerprint)

271

233

if "secret" in config:

272

234

self.secret = config["secret"].decode(u"base64")

273

235

elif "secfile" in config:

274

with closing(open(os.path.expanduser

275

(os.path.expandvars

276

(config["secfile"])))) as secfile:

277

self.secret = secfile.read()

236

sf = open(config["secfile"])

237

self.secret = sf.read()

238

sf.close()

278

239

else:

279

240

raise TypeError(u"No secret or secfile for client %s"

280

241

% self.name)

281

242

self.host = config.get("host", "")

282

self.created = datetime.datetime.utcnow()

283

self.started = False

284

self.last_started = None

243

self.created = datetime.datetime.now()

285

244

self.last_checked_ok = None

286

245

self.timeout = string_to_delta(config["timeout"])

287

246

self.interval = string_to_delta(config["interval"])

290

249

self.checker_initiator_tag = None

291

250

self.stop_initiator_tag = None

292

251

self.checker_callback_tag = None

293

self.checker_command = config["checker"]

294

252

self.check_command = config["checker"]

295

253

def start(self):

296

254

"""Start this client's checker and timeout hooks"""

297

self.last_started = datetime.datetime.utcnow()

298

255

# Schedule a new checker to be started an 'interval' from now,

299

256

# and every interval from then on.

300

self.checker_initiator_tag = (gobject.timeout_add

301

(self._interval_milliseconds,

302

self.start_checker))

257

self.checker_initiator_tag = gobject.timeout_add\

258

(self._interval_milliseconds,

259

self.start_checker)

303

260

# Also start a new checker *right now*.

304

261

self.start_checker()

305

262

# Schedule a stop() when 'timeout' has passed

306

self.stop_initiator_tag = (gobject.timeout_add

307

(self._timeout_milliseconds,

308

self.stop))

309

self.started = True

310

# Emit D-Bus signal

311

self.PropertyChanged(dbus.String(u"started"),

312

dbus.Boolean(True, variant_level=1))

313

self.PropertyChanged(dbus.String(u"last_started"),

314

(_datetime_to_dbus_struct

315

(self.last_started, variant_level=1)))

316

263

self.stop_initiator_tag = gobject.timeout_add\

264

(self._timeout_milliseconds,

265

self.stop)

317

266

def stop(self):

318

"""Stop this client."""

319

if not getattr(self, "started", False):

267

"""Stop this client.

268

The possibility that a client might be restarted is left open,

269

but not currently used."""

270

# If this client doesn't have a secret, it is already stopped.

271

if hasattr(self, "secret") and self.secret:

272

logger.info(u"Stopping client %s", self.name)

273

self.secret = None

274

else:

320

275

return False

321

logger.info(u"Stopping client %s", self.name)

322

276

if getattr(self, "stop_initiator_tag", False):

323

277

gobject.source_remove(self.stop_initiator_tag)

324

278

self.stop_initiator_tag = None

328

282

self.stop_checker()

329

283

if self.stop_hook:

330

284

self.stop_hook(self)

331

self.started = False

332

# Emit D-Bus signal

333

self.PropertyChanged(dbus.String(u"started"),

334

dbus.Boolean(False, variant_level=1))

335

285

# Do not run this again if called by a gobject.timeout_add

336

286

return False

337

338

287

def __del__(self):

339

288

self.stop_hook = None

340

289

self.stop()

341

342

def checker_callback(self, pid, condition, command):

290

def checker_callback(self, pid, condition):

343

291

"""The checker has completed, so take appropriate actions."""

292

now = datetime.datetime.now()

344

293

self.checker_callback_tag = None

345

294

self.checker = None

346

# Emit D-Bus signal

347

self.PropertyChanged(dbus.String(u"checker_running"),

348

dbus.Boolean(False, variant_level=1))

349

if (os.WIFEXITED(condition)

350

and (os.WEXITSTATUS(condition) == 0)):

295

if os.WIFEXITED(condition) \

296

and (os.WEXITSTATUS(condition) == 0):

351

297

logger.info(u"Checker for %(name)s succeeded",

352

298

vars(self))

353

# Emit D-Bus signal

354

self.CheckerCompleted(dbus.Boolean(True),

355

dbus.UInt16(condition),

356

dbus.String(command))

357

self.bump_timeout()

299

self.last_checked_ok = now

300

gobject.source_remove(self.stop_initiator_tag)

301

self.stop_initiator_tag = gobject.timeout_add\

302

(self._timeout_milliseconds,

303

self.stop)

358

304

elif not os.WIFEXITED(condition):

359

305

logger.warning(u"Checker for %(name)s crashed?",

360

306

vars(self))

361

# Emit D-Bus signal

362

self.CheckerCompleted(dbus.Boolean(False),

363

dbus.UInt16(condition),

364

dbus.String(command))

365

307

else:

366

308

logger.info(u"Checker for %(name)s failed",

367

309

vars(self))

368

# Emit D-Bus signal

369

self.CheckerCompleted(dbus.Boolean(False),

370

dbus.UInt16(condition),

371

dbus.String(command))

372

373

def bump_timeout(self):

374

"""Bump up the timeout for this client.

375

This should only be called when the client has been seen,

376

alive and well.

377

"""

378

self.last_checked_ok = datetime.datetime.utcnow()

379

gobject.source_remove(self.stop_initiator_tag)

380

self.stop_initiator_tag = (gobject.timeout_add

381

(self._timeout_milliseconds,

382

self.stop))

383

self.PropertyChanged(dbus.String(u"last_checked_ok"),

384

(_datetime_to_dbus_struct

385

(self.last_checked_ok,

386

variant_level=1)))

387

388

310

def start_checker(self):

389

311

"""Start a new checker subprocess if one is not running.

390

312

If a checker already exists, leave it running and do

399

321

# is as it should be.

400

322

if self.checker is None:

401

323

try:

402

# In case checker_command has exactly one % operator

403

command = self.checker_command % self.host

324

# In case check_command has exactly one % operator

325

command = self.check_command % self.host

404

326

except TypeError:

405

327

# Escape attributes for the shell

406

328

escaped_attrs = dict((key, re.escape(str(val)))

407

329

for key, val in

408

330

vars(self).iteritems())

409

331

try:

410

command = self.checker_command % escaped_attrs

332

command = self.check_command % escaped_attrs

411

333

except TypeError, error:

412

334

logger.error(u'Could not format string "%s":'

413

u' %s', self.checker_command, error)

335

u' %s', self.check_command, error)

414

336

return True # Try again later

415

337

try:

416

338

logger.info(u"Starting checker %r for %s",

417

339

command, self.name)

418

# We don't need to redirect stdout and stderr, since

419

# in normal mode, that is already done by daemon(),

420

# and in debug mode we don't want to. (Stdin is

421

# always replaced by /dev/null.)

422

340

self.checker = subprocess.Popen(command,

423

341

close_fds=True,

424

342

shell=True, cwd="/")

425

# Emit D-Bus signal

426

self.CheckerStarted(command)

427

self.PropertyChanged(dbus.String("checker_running"),

428

dbus.Boolean(True, variant_level=1))

429

self.checker_callback_tag = (gobject.child_watch_add

430

(self.checker.pid,

431

self.checker_callback,

432

data=command))

433

except OSError, error:

343

self.checker_callback_tag = gobject.child_watch_add\

344

(self.checker.pid,

345

self.checker_callback)

346

except subprocess.OSError, error:

434

347

logger.error(u"Failed to start subprocess: %s",

435

348

error)

436

349

# Re-run this periodically if run by gobject.timeout_add

437

350

return True

438

439

351

def stop_checker(self):

440

352

"""Force the checker process, if any, to stop."""

441

353

if self.checker_callback_tag:

453

365

if error.errno != errno.ESRCH: # No such process

454

366

raise

455

367

self.checker = None

456

self.PropertyChanged(dbus.String(u"checker_running"),

457

dbus.Boolean(False, variant_level=1))

458

459

368

def still_valid(self):

460

369

"""Has the timeout not yet passed for this client?"""

461

if not getattr(self, "started", False):

462

return False

463

now = datetime.datetime.utcnow()

370

now = datetime.datetime.now()

464

371

if self.last_checked_ok is None:

465

372

return now < (self.created + self.timeout)

466

373

else:

467

374

return now < (self.last_checked_ok + self.timeout)

468

469

## D-Bus methods & signals

470

_interface = u"org.mandos_system.Mandos.Client"

471

472

# BumpTimeout - method

473

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

474

BumpTimeout.__name__ = "BumpTimeout"

475

476

# CheckerCompleted - signal

477

@dbus.service.signal(_interface, signature="bqs")

478

def CheckerCompleted(self, success, condition, command):

479

"D-Bus signal"

480

pass

481

482

# CheckerStarted - signal

483

@dbus.service.signal(_interface, signature="s")

484

def CheckerStarted(self, command):

485

"D-Bus signal"

486

pass

487

488

# GetAllProperties - method

489

@dbus.service.method(_interface, out_signature="a{sv}")

490

def GetAllProperties(self):

491

"D-Bus method"

492

return dbus.Dictionary({

493

dbus.String("name"):

494

dbus.String(self.name, variant_level=1),

495

dbus.String("fingerprint"):

496

dbus.String(self.fingerprint, variant_level=1),

497

dbus.String("host"):

498

dbus.String(self.host, variant_level=1),

499

dbus.String("created"):

500

_datetime_to_dbus_struct(self.created,

501

variant_level=1),

502

dbus.String("last_started"):

503

(_datetime_to_dbus_struct(self.last_started,

504

variant_level=1)

505

if self.last_started is not None

506

else dbus.Boolean(False, variant_level=1)),

507

dbus.String("started"):

508

dbus.Boolean(self.started, variant_level=1),

509

dbus.String("last_checked_ok"):

510

(_datetime_to_dbus_struct(self.last_checked_ok,

511

variant_level=1)

512

if self.last_checked_ok is not None

513

else dbus.Boolean (False, variant_level=1)),

514

dbus.String("timeout"):

515

dbus.UInt64(self._timeout_milliseconds,

516

variant_level=1),

517

dbus.String("interval"):

518

dbus.UInt64(self._interval_milliseconds,

519

variant_level=1),

520

dbus.String("checker"):

521

dbus.String(self.checker_command,

522

variant_level=1),

523

dbus.String("checker_running"):

524

dbus.Boolean(self.checker is not None,

525

variant_level=1),

526

}, signature="sv")

527

528

# IsStillValid - method

529

IsStillValid = (dbus.service.method(_interface, out_signature="b")

530

(still_valid))

531

IsStillValid.__name__ = "IsStillValid"

532

533

# PropertyChanged - signal

534

@dbus.service.signal(_interface, signature="sv")

535

def PropertyChanged(self, property, value):

536

"D-Bus signal"

537

pass

538

539

# SetChecker - method

540

@dbus.service.method(_interface, in_signature="s")

541

def SetChecker(self, checker):

542

"D-Bus setter method"

543

self.checker_command = checker

544

545

# SetHost - method

546

@dbus.service.method(_interface, in_signature="s")

547

def SetHost(self, host):

548

"D-Bus setter method"

549

self.host = host

550

551

# SetInterval - method

552

@dbus.service.method(_interface, in_signature="t")

553

def SetInterval(self, milliseconds):

554

self.interval = datetime.timdeelta(0, 0, 0, milliseconds)

555

556

# SetSecret - method

557

@dbus.service.method(_interface, in_signature="ay",

558

byte_arrays=True)

559

def SetSecret(self, secret):

560

"D-Bus setter method"

561

self.secret = str(secret)

562

563

# SetTimeout - method

564

@dbus.service.method(_interface, in_signature="t")

565

def SetTimeout(self, milliseconds):

566

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

567

568

# Start - method

569

Start = dbus.service.method(_interface)(start)

570

Start.__name__ = "Start"

571

572

# StartChecker - method

573

@dbus.service.method(_interface)

574

def StartChecker(self):

575

"D-Bus method"

576

self.start_checker()

577

578

# Stop - method

579

@dbus.service.method(_interface)

580

def Stop(self):

581

"D-Bus method"

582

self.stop()

583

584

# StopChecker - method

585

StopChecker = dbus.service.method(_interface)(stop_checker)

586

StopChecker.__name__ = "StopChecker"

587

588

del _interface

589

375

590

376

591

377

def peer_certificate(session):

592

378

"Return the peer's OpenPGP certificate as a bytestring"

593

379

# If not an OpenPGP certificate...

594

if (gnutls.library.functions

595

.gnutls_certificate_type_get(session._c_object)

596

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

380

if gnutls.library.functions.gnutls_certificate_type_get\

381

(session._c_object) \

382

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

597

383

# ...do the normal thing

598

384

return session.peer_certificate

599

385

list_size = ctypes.c_uint()

600

cert_list = (gnutls.library.functions

601

.gnutls_certificate_get_peers

602

(session._c_object, ctypes.byref(list_size)))

386

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

387

(session._c_object, ctypes.byref(list_size))

603

388

if list_size.value == 0:

604

389

return None

605

390

cert = cert_list[0]

609

394

def fingerprint(openpgp):

610

395

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

611

396

# New GnuTLS "datum" with the OpenPGP public key

612

datum = (gnutls.library.types

613

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

614

ctypes.POINTER

615

(ctypes.c_ubyte)),

616

ctypes.c_uint(len(openpgp))))

397

datum = gnutls.library.types.gnutls_datum_t\

398

(ctypes.cast(ctypes.c_char_p(openpgp),

399

ctypes.POINTER(ctypes.c_ubyte)),

400

ctypes.c_uint(len(openpgp)))

617

401

# New empty GnuTLS certificate

618

402

crt = gnutls.library.types.gnutls_openpgp_crt_t()

619

(gnutls.library.functions

620

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

403

gnutls.library.functions.gnutls_openpgp_crt_init\

404

(ctypes.byref(crt))

621

405

# Import the OpenPGP public key into the certificate

622

(gnutls.library.functions

623

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

624

gnutls.library.constants

625

.GNUTLS_OPENPGP_FMT_RAW))

626

# Verify the self signature in the key

627

crtverify = ctypes.c_uint()

628

(gnutls.library.functions

629

.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))

630

if crtverify.value != 0:

631

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

632

raise gnutls.errors.CertificateSecurityError("Verify failed")

406

gnutls.library.functions.gnutls_openpgp_crt_import\

407

(crt, ctypes.byref(datum),

408

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

633

409

# New buffer for the fingerprint

634

buf = ctypes.create_string_buffer(20)

635

buf_len = ctypes.c_size_t()

410

buffer = ctypes.create_string_buffer(20)

411

buffer_length = ctypes.c_size_t()

636

412

# Get the fingerprint from the certificate into the buffer

637

(gnutls.library.functions

638

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

639

ctypes.byref(buf_len)))

413

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

414

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

640

415

# Deinit the certificate

641

416

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

642

417

# Convert the buffer to a Python bytestring

643

fpr = ctypes.string_at(buf, buf_len.value)

418

fpr = ctypes.string_at(buffer, buffer_length.value)

644

419

# Convert the bytestring to hexadecimal notation

645

420

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

646

421

return hex_fpr

647

422

648

423

649

class TCP_handler(SocketServer.BaseRequestHandler, object):

424

class tcp_handler(SocketServer.BaseRequestHandler, object):

650

425

"""A TCP request handler class.

651

426

Instantiated by IPv6_TCPServer for each request to handle it.

652

427

Note: This will run in its own forked process."""

653

428

654

429

def handle(self):

655

430

logger.info(u"TCP connection from: %s",

656

unicode(self.client_address))

657

session = (gnutls.connection

658

.ClientSession(self.request,

659

gnutls.connection

660

.X509Credentials()))

431

unicode(self.client_address))

432

session = gnutls.connection.ClientSession\

433

(self.request, gnutls.connection.X509Credentials())

661

434

662

435

line = self.request.makefile().readline()

663

436

logger.debug(u"Protocol version: %r", line)

676

449

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

677

450

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

678

451

# "+DHE-DSS"))

679

# Use a fallback default, since this MUST be set.

680

priority = self.server.settings.get("priority", "NORMAL")

681

(gnutls.library.functions

682

.gnutls_priority_set_direct(session._c_object,

683

priority, None))

452

priority = "NORMAL" # Fallback default, since this

453

# MUST be set.

454

if self.server.settings["priority"]:

455

priority = self.server.settings["priority"]

456

gnutls.library.functions.gnutls_priority_set_direct\

457

(session._c_object, priority, None);

684

458

685

459

try:

686

460

session.handshake()

696

470

session.bye()

697

471

return

698

472

logger.debug(u"Fingerprint: %s", fpr)

473

client = None

699

474

for c in self.server.clients:

700

475

if c.fingerprint == fpr:

701

476

client = c

702

477

break

703

else:

478

if not client:

704

479

logger.warning(u"Client not found for fingerprint: %s",

705

480

fpr)

706

481

session.bye()

713

488

vars(client))

714

489

session.bye()

715

490

return

716

## This won't work here, since we're in a fork.

717

# client.bump_timeout()

718

491

sent_size = 0

719

492

while sent_size < len(client.secret):

720

493

sent = session.send(client.secret[sent_size:])

725

498

session.bye()

726

499

727

500

728

class IPv6_TCPServer(SocketServer.ForkingMixIn,

729

SocketServer.TCPServer, object):

501

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

730

502

"""IPv6 TCP server. Accepts 'None' as address and/or port.

731

503

Attributes:

732

504

settings: Server settings

733

505

clients: Set() of Client objects

734

enabled: Boolean; whether this server is activated yet

735

506

"""

736

507

address_family = socket.AF_INET6

737

508

def __init__(self, *args, **kwargs):

741

512

if "clients" in kwargs:

742

513

self.clients = kwargs["clients"]

743

514

del kwargs["clients"]

744

self.enabled = False

745

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

515

return super(type(self), self).__init__(*args, **kwargs)

746

516

def server_bind(self):

747

517

"""This overrides the normal server_bind() function

748

518

to bind to an interface if one was specified, and also NOT to

777

547

# if_nametoindex

778

548

# (self.settings

779

549

# ["interface"]))

780

return super(IPv6_TCPServer, self).server_bind()

781

def server_activate(self):

782

if self.enabled:

783

return super(IPv6_TCPServer, self).server_activate()

784

def enable(self):

785

self.enabled = True

550

return super(type(self), self).server_bind()

786

551

787

552

788

553

def string_to_delta(interval):

798

563

datetime.timedelta(1)

799

564

>>> string_to_delta(u'1w')

800

565

datetime.timedelta(7)

801

>>> string_to_delta('5m 30s')

802

datetime.timedelta(0, 330)

803

566

"""

804

timevalue = datetime.timedelta(0)

805

for s in interval.split():

806

try:

807

suffix = unicode(s[-1])

808

value = int(s[:-1])

809

if suffix == u"d":

810

delta = datetime.timedelta(value)

811

elif suffix == u"s":

812

delta = datetime.timedelta(0, value)

813

elif suffix == u"m":

814

delta = datetime.timedelta(0, 0, 0, 0, value)

815

elif suffix == u"h":

816

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

817

elif suffix == u"w":

818

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

819

else:

820

raise ValueError

821

except (ValueError, IndexError):

567

try:

568

suffix=unicode(interval[-1])

569

value=int(interval[:-1])

570

if suffix == u"d":

571

delta = datetime.timedelta(value)

572

elif suffix == u"s":

573

delta = datetime.timedelta(0, value)

574

elif suffix == u"m":

575

delta = datetime.timedelta(0, 0, 0, 0, value)

576

elif suffix == u"h":

577

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

578

elif suffix == u"w":

579

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

580

else:

822

581

raise ValueError

823

timevalue += delta

824

return timevalue

582

except (ValueError, IndexError):

583

raise ValueError

584

return delta

825

585

826

586

827

587

def server_state_changed(state):

828

588

"""Derived from the Avahi example code"""

829

589

if state == avahi.SERVER_COLLISION:

830

logger.error(u"Zeroconf server name collision")

590

logger.error(u"Server name collision")

831

591

service.remove()

832

592

elif state == avahi.SERVER_RUNNING:

833

593

service.add()

835

595

836

596

def entry_group_state_changed(state, error):

837

597

"""Derived from the Avahi example code"""

838

logger.debug(u"Avahi state change: %i", state)

598

logger.debug(u"state change: %i", state)

839

599

840

600

if state == avahi.ENTRY_GROUP_ESTABLISHED:

841

logger.debug(u"Zeroconf service established.")

601

logger.debug(u"Service established.")

842

602

elif state == avahi.ENTRY_GROUP_COLLISION:

843

logger.warning(u"Zeroconf service name collision.")

603

logger.warning(u"Service name collision.")

844

604

service.rename()

845

605

elif state == avahi.ENTRY_GROUP_FAILURE:

846

logger.critical(u"Avahi: Error in group state changed %s",

606

logger.critical(u"Error in group state changed %s",

847

607

unicode(error))

848

608

raise AvahiGroupError("State changed: %s", str(error))

849

609

851

611

"""Call the C function if_nametoindex(), or equivalent"""

852

612

global if_nametoindex

853

613

try:

854

if_nametoindex = (ctypes.cdll.LoadLibrary

855

(ctypes.util.find_library("c"))

856

.if_nametoindex)

614

if "ctypes.util" not in sys.modules:

615

import ctypes.util

616

if_nametoindex = ctypes.cdll.LoadLibrary\

617

(ctypes.util.find_library("c")).if_nametoindex

857

618

except (OSError, AttributeError):

858

619

if "struct" not in sys.modules:

859

620

import struct

862

623

def if_nametoindex(interface):

863

624

"Get an interface index the hard way, i.e. using fcntl()"

864

625

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

865

with closing(socket.socket()) as s:

866

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

867

struct.pack("16s16x", interface))

626

s = socket.socket()

627

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

628

struct.pack("16s16x", interface))

629

s.close()

868

630

interface_index = struct.unpack("I", ifreq[16:20])[0]

869

631

return interface_index

870

632

return if_nametoindex(interface)

894

656

895

657

896

658

def main():

659

global main_loop_started

660

main_loop_started = False

661

897

662

parser = OptionParser(version = "%%prog %s" % version)

898

663

parser.add_option("-i", "--interface", type="string",

899

664

metavar="IF", help="Bind to interface IF")

914

679

default="/etc/mandos", metavar="DIR",

915

680

help="Directory to search for configuration"

916

681

" files")

917

options = parser.parse_args()[0]

682

(options, args) = parser.parse_args()

918

683

919

684

if options.check:

920

685

import doctest

935

700

server_config = ConfigParser.SafeConfigParser(server_defaults)

936

701

del server_defaults

937

702

server_config.read(os.path.join(options.configdir, "mandos.conf"))

703

server_section = "server"

938

704

# Convert the SafeConfigParser object to a dict

939

server_settings = server_config.defaults()

705

server_settings = dict(server_config.items(server_section))

940

706

# Use getboolean on the boolean config option

941

server_settings["debug"] = (server_config.getboolean

942

("DEFAULT", "debug"))

707

server_settings["debug"] = server_config.getboolean\

708

(server_section, "debug")

943

709

del server_config

944

710

945

711

# Override the settings from the config file with command line

959

725

console.setLevel(logging.WARNING)

960

726

961

727

if server_settings["servicename"] != "Mandos":

962

syslogger.setFormatter(logging.Formatter

728

syslogger.setFormatter(logging.Formatter\

963

729

('Mandos (%s): %%(levelname)s:'

964

730

' %%(message)s'

965

731

% server_settings["servicename"]))

967

733

# Parse config file with clients

968

734

client_defaults = { "timeout": "1h",

969

735

"interval": "5m",

970

"checker": "fping -q -- %(host)s",

971

"host": "",

736

"checker": "fping -q -- %%(host)s",

972

737

}

973

738

client_config = ConfigParser.SafeConfigParser(client_defaults)

974

739

client_config.read(os.path.join(server_settings["configdir"],

975

740

"clients.conf"))

976

741

977

clients = Set()

978

tcp_server = IPv6_TCPServer((server_settings["address"],

979

server_settings["port"]),

980

TCP_handler,

981

settings=server_settings,

982

clients=clients)

983

pidfilename = "/var/run/mandos.pid"

984

try:

985

pidfile = open(pidfilename, "w")

986

except IOError, error:

987

logger.error("Could not open file %r", pidfilename)

988

989

try:

990

uid = pwd.getpwnam("_mandos").pw_uid

991

except KeyError:

992

try:

993

uid = pwd.getpwnam("mandos").pw_uid

994

except KeyError:

995

try:

996

uid = pwd.getpwnam("nobody").pw_uid

997

except KeyError:

998

uid = 65534

999

try:

1000

gid = pwd.getpwnam("_mandos").pw_gid

1001

except KeyError:

1002

try:

1003

gid = pwd.getpwnam("mandos").pw_gid

1004

except KeyError:

1005

try:

1006

gid = pwd.getpwnam("nogroup").pw_gid

1007

except KeyError:

1008

gid = 65534

1009

try:

1010

os.setuid(uid)

1011

os.setgid(gid)

1012

except OSError, error:

1013

if error[0] != errno.EPERM:

1014

raise error

1015

1016

742

global service

1017

743

service = AvahiService(name = server_settings["servicename"],

1018

servicetype = "_mandos._tcp", )

744

type = "_mandos._tcp", );

1019

745

if server_settings["interface"]:

1020

service.interface = (if_nametoindex

1021

(server_settings["interface"]))

746

service.interface = if_nametoindex(server_settings["interface"])

1022

747

1023

748

global main_loop

1024

749

global bus

1027

752

DBusGMainLoop(set_as_default=True )

1028

753

main_loop = gobject.MainLoop()

1029

754

bus = dbus.SystemBus()

1030

server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,

1031

avahi.DBUS_PATH_SERVER),

1032

avahi.DBUS_INTERFACE_SERVER)

755

server = dbus.Interface(

756

bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),

757

avahi.DBUS_INTERFACE_SERVER )

1033

758

# End of Avahi example code

1034

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)

759

760

clients = Set()

761

def remove_from_clients(client):

762

clients.remove(client)

763

if not clients:

764

logger.critical(u"No clients left, exiting")

765

sys.exit()

1035

766

1036

767

clients.update(Set(Client(name = section,

768

stop_hook = remove_from_clients,

1037

769

config

1038

770

= dict(client_config.items(section)))

1039

771

for section in client_config.sections()))

1041

773

logger.critical(u"No clients defined")

1042

774

sys.exit(1)

1043

775

1044

if debug:

1045

# Redirect stdin so all checkers get /dev/null

1046

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1047

os.dup2(null, sys.stdin.fileno())

1048

if null > 2:

1049

os.close(null)

1050

else:

1051

# No console logging

776

if not debug:

1052

777

logger.removeHandler(console)

1053

# Close all input and output, do double fork, etc.

1054

778

daemon()

1055

779

780

pidfilename = "/var/run/mandos/mandos.pid"

781

pid = os.getpid()

1056

782

try:

1057

pid = os.getpid()

783

pidfile = open(pidfilename, "w")

1058

784

pidfile.write(str(pid) + "\n")

1059

785

pidfile.close()

1060

786

del pidfile

1061

except IOError:

1062

logger.error(u"Could not write to file %r with PID %d",

1063

pidfilename, pid)

1064

except NameError:

1065

# "pidfile" was never created

1066

pass

1067

del pidfilename

787

except IOError, err:

788

logger.error(u"Could not write %s file with PID %d",

789

pidfilename, os.getpid())

1068

790

1069

791

def cleanup():

1070

792

"Cleanup function; run on exit"

1087

809

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1088

810

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1089

811

1090

class MandosServer(dbus.service.Object):

1091

"""A D-Bus proxy object"""

1092

def __init__(self):

1093

dbus.service.Object.__init__(self, bus,

1094

"/Mandos")

1095

_interface = u"org.mandos_system.Mandos"

1096

1097

@dbus.service.signal(_interface, signature="oa{sv}")

1098

def ClientAdded(self, objpath, properties):

1099

"D-Bus signal"

1100

pass

1101

1102

@dbus.service.signal(_interface, signature="o")

1103

def ClientRemoved(self, objpath):

1104

"D-Bus signal"

1105

pass

1106

1107

@dbus.service.method(_interface, out_signature="ao")

1108

def GetAllClients(self):

1109

return dbus.Array(c.dbus_object_path for c in clients)

1110

1111

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1112

def GetAllClientsWithProperties(self):

1113

return dbus.Dictionary(

1114

((c.dbus_object_path, c.GetAllProperties())

1115

for c in clients),

1116

signature="oa{sv}")

1117

1118

@dbus.service.method(_interface, in_signature="o")

1119

def RemoveClient(self, object_path):

1120

for c in clients:

1121

if c.dbus_object_path == object_path:

1122

c.stop()

1123

clients.remove(c)

1124

return

1125

raise KeyError

1126

1127

del _interface

1128

1129

mandos_server = MandosServer()

1130

1131

812

for client in clients:

1132

# Emit D-Bus signal

1133

mandos_server.ClientAdded(client.dbus_object_path,

1134

client.GetAllProperties())

1135

813

client.start()

1136

814

1137

tcp_server.enable()

1138

tcp_server.server_activate()

1139

815

tcp_server = IPv6_TCPServer((server_settings["address"],

816

server_settings["port"]),

817

tcp_handler,

818

settings=server_settings,

819

clients=clients)

1140

820

# Find out what port we got

1141

821

service.port = tcp_server.socket.getsockname()[1]

1142

822

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

1156

836

1157

837

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

1158

838

lambda *args, **kwargs:

1159

(tcp_server.handle_request

1160

(*args[2:], **kwargs) or True))

839

tcp_server.handle_request\

840

(*args[2:], **kwargs) or True)

1161

841

1162

842

logger.debug(u"Starting main loop")

843

main_loop_started = True

1163

844

main_loop.run()

1164

845

except AvahiError, error:

1165

846

logger.critical(u"AvahiError: %s" + unicode(error))