To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 94
- compare with another revision
- download diff
- download tarball
- view history from revision 94
- Committer: Teddy Hogeborn
- Date: 2008-08-22 00:16:20 UTC
- mfrom: (24.1.57 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080822001620-vxpn1evy0t0kyvj0
* clients.conf ([DEFAULT]/checker): Update to new default value.
* mandos (Client.start_checker): Bug fix: OSError, not
subprocess.OSError.
(main): Use "fping -q -- %(host)s" instead of "fping -q --
%%(host)s" as default value for "checker". Always redirect
stdin to be from /dev/null, even if in debug mode.
* mandos-clients.conf.xml (DESCRIPTION): Improved wording and refer to
the EXPANSION section.
(OPTIONS): Added synopsis and improved wording for "checker",
"fingerprint", and "secret". Refer to the RUNTIME
EXPANSION section for the "checker" option.
(EXAMPLE): Update to new default value for "checker".
* mandos-keygen (trap): Split lines and add "set +e".
* mandos (Client.start_checker): Bug fix: OSError, not
subprocess.OSError.
(main): Use "fping -q -- %(host)s" instead of "fping -q --
%%(host)s" as default value for "checker". Always redirect
stdin to be from /dev/null, even if in debug mode.
* mandos-clients.conf.xml (DESCRIPTION): Improved wording and refer to
the EXPANSION section.
(OPTIONS): Added synopsis and improved wording for "checker",
"fingerprint", and "secret". Refer to the RUNTIME
EXPANSION section for the "checker" option.
(EXAMPLE): Update to new default value for "checker".
* mandos-keygen (trap): Split lines and add "set +e".
- files added:
- plugins.d/usplash
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugins.d/mandos-client.c => plugins.d/password-request.c
- plugins.d/mandos-client.xml => plugins.d/password-request.xml
- files modified:
- Makefile
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
# GNU General Public License for more details.
26
25
#
27
26
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
30
28
#
31
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
30
#
33
31
34
from __future__ import division, with_statement, absolute_import
32
from __future__ import division
35
33
36
34
import SocketServer
37
35
import socket
38
import optparse
36
import select
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
import pwd
59
from contextlib import closing
60
57
61
58
import dbus
62
import dbus.service
63
59
import gobject
64
60
import avahi
65
61
from dbus.mainloop.glib import DBusGMainLoop
66
62
import ctypes
67
import ctypes.util
68
63
69
version = "1.0.5"
64
version = "1.0"
70
65
71
66
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
67
syslogger = logging.handlers.SysLogHandler\
68
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
69
address = "/dev/log")
70
syslogger.setFormatter(logging.Formatter\
71
('Mandos: %(levelname)s: %(message)s'))
78
72
logger.addHandler(syslogger)
79
73
80
74
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
75
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
76
' %(message)s'))
83
77
logger.addHandler(console)
84
78
85
79
class AvahiError(Exception):
86
def __init__(self, value, *args, **kwargs):
80
def __init__(self, value):
87
81
self.value = value
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
82
def __str__(self):
83
return repr(self.value)
91
84
92
85
class AvahiServiceError(AvahiError):
93
86
pass
113
106
a sensible number of times
114
107
"""
115
108
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768):
109
type = None, port = None, TXT = None, domain = "",
110
host = "", max_renames = 32768):
118
111
self.interface = interface
119
112
self.name = name
120
self.type = servicetype
113
self.type = type
121
114
self.port = port
122
self.TXT = TXT if TXT is not None else []
115
if TXT is None:
116
self.TXT = []
117
else:
118
self.TXT = TXT
123
119
self.domain = domain
124
120
self.host = host
125
121
self.rename_count = 0
127
123
def rename(self):
128
124
"""Derived from the Avahi example code"""
129
125
if self.rename_count >= self.max_renames:
130
logger.critical(u"No suitable Zeroconf service name found"
131
u" after %i retries, exiting.",
132
self.rename_count)
133
raise AvahiServiceError(u"Too many renames")
126
logger.critical(u"No suitable service name found after %i"
127
u" retries, exiting.", rename_count)
128
raise AvahiServiceError("Too many renames")
134
129
self.name = server.GetAlternativeServiceName(self.name)
135
logger.info(u"Changing Zeroconf service name to %r ...",
136
str(self.name))
137
syslogger.setFormatter(logging.Formatter
130
logger.info(u"Changing name to %r ...", str(self.name))
131
syslogger.setFormatter(logging.Formatter\
138
132
('Mandos (%s): %%(levelname)s:'
139
' %%(message)s' % self.name))
133
' %%(message)s' % self.name))
140
134
self.remove()
141
135
self.add()
142
136
self.rename_count += 1
148
142
"""Derived from the Avahi example code"""
149
143
global group
150
144
if group is None:
151
group = dbus.Interface(bus.get_object
152
(avahi.DBUS_NAME,
145
group = dbus.Interface\
146
(bus.get_object(avahi.DBUS_NAME,
153
147
server.EntryGroupNew()),
154
avahi.DBUS_INTERFACE_ENTRY_GROUP)
148
avahi.DBUS_INTERFACE_ENTRY_GROUP)
155
149
group.connect_to_signal('StateChanged',
156
150
entry_group_state_changed)
157
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
151
logger.debug(u"Adding service '%s' of type '%s' ...",
158
152
service.name, service.type)
159
153
group.AddService(
160
154
self.interface, # interface
171
165
# End of Avahi example code
172
166
173
167
174
def _datetime_to_dbus(dt, variant_level=0):
175
"""Convert a UTC datetime.datetime() to a D-Bus type."""
176
return dbus.String(dt.isoformat(), variant_level=variant_level)
177
178
179
class Client(dbus.service.Object):
168
class Client(object):
180
169
"""A representation of a client host served by this server.
181
170
Attributes:
182
name: string; from the config file, used in log messages and
183
D-Bus identifiers
171
name: string; from the config file, used in log messages
184
172
fingerprint: string (40 or 32 hexadecimal digits); used to
185
173
uniquely identify the client
186
secret: bytestring; sent verbatim (over TLS) to client
187
host: string; available for use by the checker command
188
created: datetime.datetime(); (UTC) object creation
189
last_enabled: datetime.datetime(); (UTC)
190
enabled: bool()
191
last_checked_ok: datetime.datetime(); (UTC) or None
192
timeout: datetime.timedelta(); How long from last_checked_ok
193
until this client is invalid
194
interval: datetime.timedelta(); How often to start a new checker
195
disable_hook: If set, called by disable() as disable_hook(self)
196
checker: subprocess.Popen(); a running checker process used
197
to see if the client lives.
198
'None' if no process is running.
174
secret: bytestring; sent verbatim (over TLS) to client
175
host: string; available for use by the checker command
176
created: datetime.datetime(); object creation, not client host
177
last_checked_ok: datetime.datetime() or None if not yet checked OK
178
timeout: datetime.timedelta(); How long from last_checked_ok
179
until this client is invalid
180
interval: datetime.timedelta(); How often to start a new checker
181
stop_hook: If set, called by stop() as stop_hook(self)
182
checker: subprocess.Popen(); a running checker process used
183
to see if the client lives.
184
'None' if no process is running.
199
185
checker_initiator_tag: a gobject event source tag, or None
200
disable_initiator_tag: - '' -
186
stop_initiator_tag: - '' -
201
187
checker_callback_tag: - '' -
202
188
checker_command: string; External command which is run to check if
203
189
client lives. %() expansions are done at
204
190
runtime with vars(self) as dict, so that for
205
191
instance %(name)s can be used in the command.
206
use_dbus: bool(); Whether to provide D-Bus interface and signals
207
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
192
Private attibutes:
193
_timeout: Real variable for 'timeout'
194
_interval: Real variable for 'interval'
195
_timeout_milliseconds: Used when calling gobject.timeout_add()
196
_interval_milliseconds: - '' -
208
197
"""
209
def timeout_milliseconds(self):
210
"Return the 'timeout' attribute in milliseconds"
211
return ((self.timeout.days * 24 * 60 * 60 * 1000)
212
+ (self.timeout.seconds * 1000)
213
+ (self.timeout.microseconds // 1000))
214
215
def interval_milliseconds(self):
216
"Return the 'interval' attribute in milliseconds"
217
return ((self.interval.days * 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds * 1000)
219
+ (self.interval.microseconds // 1000))
220
221
def __init__(self, name = None, disable_hook=None, config=None,
222
use_dbus=True):
198
def _set_timeout(self, timeout):
199
"Setter function for 'timeout' attribute"
200
self._timeout = timeout
201
self._timeout_milliseconds = ((self.timeout.days
202
* 24 * 60 * 60 * 1000)
203
+ (self.timeout.seconds * 1000)
204
+ (self.timeout.microseconds
205
// 1000))
206
timeout = property(lambda self: self._timeout,
207
_set_timeout)
208
del _set_timeout
209
def _set_interval(self, interval):
210
"Setter function for 'interval' attribute"
211
self._interval = interval
212
self._interval_milliseconds = ((self.interval.days
213
* 24 * 60 * 60 * 1000)
214
+ (self.interval.seconds
215
* 1000)
216
+ (self.interval.microseconds
217
// 1000))
218
interval = property(lambda self: self._interval,
219
_set_interval)
220
del _set_interval
221
def __init__(self, name = None, stop_hook=None, config={}):
223
222
"""Note: the 'checker' key in 'config' sets the
224
223
'checker_command' attribute and *not* the 'checker'
225
224
attribute."""
226
225
self.name = name
227
if config is None:
228
config = {}
229
226
logger.debug(u"Creating client %r", self.name)
230
self.use_dbus = False # During __init__
231
227
# Uppercase and remove spaces from fingerprint for later
232
228
# comparison purposes with return value from the fingerprint()
233
229
# function
234
self.fingerprint = (config["fingerprint"].upper()
235
.replace(u" ", u""))
230
self.fingerprint = config["fingerprint"].upper()\
231
.replace(u" ", u"")
236
232
logger.debug(u" Fingerprint: %s", self.fingerprint)
237
233
if "secret" in config:
238
234
self.secret = config["secret"].decode(u"base64")
239
235
elif "secfile" in config:
240
with closing(open(os.path.expanduser
241
(os.path.expandvars
242
(config["secfile"])))) as secfile:
243
self.secret = secfile.read()
236
sf = open(config["secfile"])
237
self.secret = sf.read()
238
sf.close()
244
239
else:
245
240
raise TypeError(u"No secret or secfile for client %s"
246
241
% self.name)
247
242
self.host = config.get("host", "")
248
self.created = datetime.datetime.utcnow()
249
self.enabled = False
250
self.last_enabled = None
243
self.created = datetime.datetime.now()
251
244
self.last_checked_ok = None
252
245
self.timeout = string_to_delta(config["timeout"])
253
246
self.interval = string_to_delta(config["interval"])
254
self.disable_hook = disable_hook
247
self.stop_hook = stop_hook
255
248
self.checker = None
256
249
self.checker_initiator_tag = None
257
self.disable_initiator_tag = None
250
self.stop_initiator_tag = None
258
251
self.checker_callback_tag = None
259
self.checker_command = config["checker"]
260
self.last_connect = None
261
# Only now, when this client is initialized, can it show up on
262
# the D-Bus
263
self.use_dbus = use_dbus
264
if self.use_dbus:
265
self.dbus_object_path = (dbus.ObjectPath
266
("/clients/"
267
+ self.name.replace(".", "_")))
268
dbus.service.Object.__init__(self, bus,
269
self.dbus_object_path)
270
271
def enable(self):
252
self.check_command = config["checker"]
253
def start(self):
272
254
"""Start this client's checker and timeout hooks"""
273
self.last_enabled = datetime.datetime.utcnow()
274
255
# Schedule a new checker to be started an 'interval' from now,
275
256
# and every interval from then on.
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self.interval_milliseconds(),
278
self.start_checker))
257
self.checker_initiator_tag = gobject.timeout_add\
258
(self._interval_milliseconds,
259
self.start_checker)
279
260
# Also start a new checker *right now*.
280
261
self.start_checker()
281
# Schedule a disable() when 'timeout' has passed
282
self.disable_initiator_tag = (gobject.timeout_add
283
(self.timeout_milliseconds(),
284
self.disable))
285
self.enabled = True
286
if self.use_dbus:
287
# Emit D-Bus signals
288
self.PropertyChanged(dbus.String(u"enabled"),
289
dbus.Boolean(True, variant_level=1))
290
self.PropertyChanged(dbus.String(u"last_enabled"),
291
(_datetime_to_dbus(self.last_enabled,
292
variant_level=1)))
293
294
def disable(self):
295
"""Disable this client."""
296
if not getattr(self, "enabled", False):
262
# Schedule a stop() when 'timeout' has passed
263
self.stop_initiator_tag = gobject.timeout_add\
264
(self._timeout_milliseconds,
265
self.stop)
266
def stop(self):
267
"""Stop this client.
268
The possibility that a client might be restarted is left open,
269
but not currently used."""
270
# If this client doesn't have a secret, it is already stopped.
271
if hasattr(self, "secret") and self.secret:
272
logger.info(u"Stopping client %s", self.name)
273
self.secret = None
274
else:
297
275
return False
298
logger.info(u"Disabling client %s", self.name)
299
if getattr(self, "disable_initiator_tag", False):
300
gobject.source_remove(self.disable_initiator_tag)
301
self.disable_initiator_tag = None
276
if getattr(self, "stop_initiator_tag", False):
277
gobject.source_remove(self.stop_initiator_tag)
278
self.stop_initiator_tag = None
302
279
if getattr(self, "checker_initiator_tag", False):
303
280
gobject.source_remove(self.checker_initiator_tag)
304
281
self.checker_initiator_tag = None
305
282
self.stop_checker()
306
if self.disable_hook:
307
self.disable_hook(self)
308
self.enabled = False
309
if self.use_dbus:
310
# Emit D-Bus signal
311
self.PropertyChanged(dbus.String(u"enabled"),
312
dbus.Boolean(False, variant_level=1))
283
if self.stop_hook:
284
self.stop_hook(self)
313
285
# Do not run this again if called by a gobject.timeout_add
314
286
return False
315
316
287
def __del__(self):
317
self.disable_hook = None
318
self.disable()
319
320
def checker_callback(self, pid, condition, command):
288
self.stop_hook = None
289
self.stop()
290
def checker_callback(self, pid, condition):
321
291
"""The checker has completed, so take appropriate actions."""
292
now = datetime.datetime.now()
322
293
self.checker_callback_tag = None
323
294
self.checker = None
324
if self.use_dbus:
325
# Emit D-Bus signal
326
self.PropertyChanged(dbus.String(u"checker_running"),
327
dbus.Boolean(False, variant_level=1))
328
if os.WIFEXITED(condition):
329
exitstatus = os.WEXITSTATUS(condition)
330
if exitstatus == 0:
331
logger.info(u"Checker for %(name)s succeeded",
332
vars(self))
333
self.checked_ok()
334
else:
335
logger.info(u"Checker for %(name)s failed",
336
vars(self))
337
if self.use_dbus:
338
# Emit D-Bus signal
339
self.CheckerCompleted(dbus.Int16(exitstatus),
340
dbus.Int64(condition),
341
dbus.String(command))
342
else:
295
if os.WIFEXITED(condition) \
296
and (os.WEXITSTATUS(condition) == 0):
297
logger.info(u"Checker for %(name)s succeeded",
298
vars(self))
299
self.last_checked_ok = now
300
gobject.source_remove(self.stop_initiator_tag)
301
self.stop_initiator_tag = gobject.timeout_add\
302
(self._timeout_milliseconds,
303
self.stop)
304
elif not os.WIFEXITED(condition):
343
305
logger.warning(u"Checker for %(name)s crashed?",
344
306
vars(self))
345
if self.use_dbus:
346
# Emit D-Bus signal
347
self.CheckerCompleted(dbus.Int16(-1),
348
dbus.Int64(condition),
349
dbus.String(command))
350
351
def checked_ok(self):
352
"""Bump up the timeout for this client.
353
This should only be called when the client has been seen,
354
alive and well.
355
"""
356
self.last_checked_ok = datetime.datetime.utcnow()
357
gobject.source_remove(self.disable_initiator_tag)
358
self.disable_initiator_tag = (gobject.timeout_add
359
(self.timeout_milliseconds(),
360
self.disable))
361
if self.use_dbus:
362
# Emit D-Bus signal
363
self.PropertyChanged(
364
dbus.String(u"last_checked_ok"),
365
(_datetime_to_dbus(self.last_checked_ok,
366
variant_level=1)))
367
307
else:
308
logger.info(u"Checker for %(name)s failed",
309
vars(self))
368
310
def start_checker(self):
369
311
"""Start a new checker subprocess if one is not running.
370
312
If a checker already exists, leave it running and do
379
321
# is as it should be.
380
322
if self.checker is None:
381
323
try:
382
# In case checker_command has exactly one % operator
383
command = self.checker_command % self.host
324
# In case check_command has exactly one % operator
325
command = self.check_command % self.host
384
326
except TypeError:
385
327
# Escape attributes for the shell
386
328
escaped_attrs = dict((key, re.escape(str(val)))
387
329
for key, val in
388
330
vars(self).iteritems())
389
331
try:
390
command = self.checker_command % escaped_attrs
332
command = self.check_command % escaped_attrs
391
333
except TypeError, error:
392
334
logger.error(u'Could not format string "%s":'
393
u' %s', self.checker_command, error)
335
u' %s', self.check_command, error)
394
336
return True # Try again later
395
337
try:
396
338
logger.info(u"Starting checker %r for %s",
402
344
self.checker = subprocess.Popen(command,
403
345
close_fds=True,
404
346
shell=True, cwd="/")
405
if self.use_dbus:
406
# Emit D-Bus signal
407
self.CheckerStarted(command)
408
self.PropertyChanged(
409
dbus.String("checker_running"),
410
dbus.Boolean(True, variant_level=1))
411
self.checker_callback_tag = (gobject.child_watch_add
412
(self.checker.pid,
413
self.checker_callback,
414
data=command))
347
self.checker_callback_tag = gobject.child_watch_add\
348
(self.checker.pid,
349
self.checker_callback)
415
350
except OSError, error:
416
351
logger.error(u"Failed to start subprocess: %s",
417
352
error)
418
353
# Re-run this periodically if run by gobject.timeout_add
419
354
return True
420
421
355
def stop_checker(self):
422
356
"""Force the checker process, if any, to stop."""
423
357
if self.checker_callback_tag:
435
369
if error.errno != errno.ESRCH: # No such process
436
370
raise
437
371
self.checker = None
438
if self.use_dbus:
439
self.PropertyChanged(dbus.String(u"checker_running"),
440
dbus.Boolean(False, variant_level=1))
441
442
372
def still_valid(self):
443
373
"""Has the timeout not yet passed for this client?"""
444
if not getattr(self, "enabled", False):
445
return False
446
now = datetime.datetime.utcnow()
374
now = datetime.datetime.now()
447
375
if self.last_checked_ok is None:
448
376
return now < (self.created + self.timeout)
449
377
else:
450
378
return now < (self.last_checked_ok + self.timeout)
451
452
## D-Bus methods & signals
453
_interface = u"se.bsnet.fukt.Mandos.Client"
454
455
# CheckedOK - method
456
CheckedOK = dbus.service.method(_interface)(checked_ok)
457
CheckedOK.__name__ = "CheckedOK"
458
459
# CheckerCompleted - signal
460
@dbus.service.signal(_interface, signature="nxs")
461
def CheckerCompleted(self, exitcode, waitstatus, command):
462
"D-Bus signal"
463
pass
464
465
# CheckerStarted - signal
466
@dbus.service.signal(_interface, signature="s")
467
def CheckerStarted(self, command):
468
"D-Bus signal"
469
pass
470
471
# GetAllProperties - method
472
@dbus.service.method(_interface, out_signature="a{sv}")
473
def GetAllProperties(self):
474
"D-Bus method"
475
return dbus.Dictionary({
476
dbus.String("name"):
477
dbus.String(self.name, variant_level=1),
478
dbus.String("fingerprint"):
479
dbus.String(self.fingerprint, variant_level=1),
480
dbus.String("host"):
481
dbus.String(self.host, variant_level=1),
482
dbus.String("created"):
483
_datetime_to_dbus(self.created, variant_level=1),
484
dbus.String("last_enabled"):
485
(_datetime_to_dbus(self.last_enabled,
486
variant_level=1)
487
if self.last_enabled is not None
488
else dbus.Boolean(False, variant_level=1)),
489
dbus.String("enabled"):
490
dbus.Boolean(self.enabled, variant_level=1),
491
dbus.String("last_checked_ok"):
492
(_datetime_to_dbus(self.last_checked_ok,
493
variant_level=1)
494
if self.last_checked_ok is not None
495
else dbus.Boolean (False, variant_level=1)),
496
dbus.String("timeout"):
497
dbus.UInt64(self.timeout_milliseconds(),
498
variant_level=1),
499
dbus.String("interval"):
500
dbus.UInt64(self.interval_milliseconds(),
501
variant_level=1),
502
dbus.String("checker"):
503
dbus.String(self.checker_command,
504
variant_level=1),
505
dbus.String("checker_running"):
506
dbus.Boolean(self.checker is not None,
507
variant_level=1),
508
dbus.String("object_path"):
509
dbus.ObjectPath(self.dbus_object_path,
510
variant_level=1)
511
}, signature="sv")
512
513
# IsStillValid - method
514
IsStillValid = (dbus.service.method(_interface, out_signature="b")
515
(still_valid))
516
IsStillValid.__name__ = "IsStillValid"
517
518
# PropertyChanged - signal
519
@dbus.service.signal(_interface, signature="sv")
520
def PropertyChanged(self, property, value):
521
"D-Bus signal"
522
pass
523
524
# SetChecker - method
525
@dbus.service.method(_interface, in_signature="s")
526
def SetChecker(self, checker):
527
"D-Bus setter method"
528
self.checker_command = checker
529
# Emit D-Bus signal
530
self.PropertyChanged(dbus.String(u"checker"),
531
dbus.String(self.checker_command,
532
variant_level=1))
533
534
# SetHost - method
535
@dbus.service.method(_interface, in_signature="s")
536
def SetHost(self, host):
537
"D-Bus setter method"
538
self.host = host
539
# Emit D-Bus signal
540
self.PropertyChanged(dbus.String(u"host"),
541
dbus.String(self.host, variant_level=1))
542
543
# SetInterval - method
544
@dbus.service.method(_interface, in_signature="t")
545
def SetInterval(self, milliseconds):
546
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
547
# Emit D-Bus signal
548
self.PropertyChanged(dbus.String(u"interval"),
549
(dbus.UInt64(self.interval_milliseconds(),
550
variant_level=1)))
551
552
# SetSecret - method
553
@dbus.service.method(_interface, in_signature="ay",
554
byte_arrays=True)
555
def SetSecret(self, secret):
556
"D-Bus setter method"
557
self.secret = str(secret)
558
559
# SetTimeout - method
560
@dbus.service.method(_interface, in_signature="t")
561
def SetTimeout(self, milliseconds):
562
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
563
# Emit D-Bus signal
564
self.PropertyChanged(dbus.String(u"timeout"),
565
(dbus.UInt64(self.timeout_milliseconds(),
566
variant_level=1)))
567
568
# Enable - method
569
Enable = dbus.service.method(_interface)(enable)
570
Enable.__name__ = "Enable"
571
572
# StartChecker - method
573
@dbus.service.method(_interface)
574
def StartChecker(self):
575
"D-Bus method"
576
self.start_checker()
577
578
# Disable - method
579
@dbus.service.method(_interface)
580
def Disable(self):
581
"D-Bus method"
582
self.disable()
583
584
# StopChecker - method
585
StopChecker = dbus.service.method(_interface)(stop_checker)
586
StopChecker.__name__ = "StopChecker"
587
588
del _interface
589
379
590
380
591
381
def peer_certificate(session):
592
382
"Return the peer's OpenPGP certificate as a bytestring"
593
383
# If not an OpenPGP certificate...
594
if (gnutls.library.functions
595
.gnutls_certificate_type_get(session._c_object)
596
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
384
if gnutls.library.functions.gnutls_certificate_type_get\
385
(session._c_object) \
386
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
597
387
# ...do the normal thing
598
388
return session.peer_certificate
599
list_size = ctypes.c_uint(1)
600
cert_list = (gnutls.library.functions
601
.gnutls_certificate_get_peers
602
(session._c_object, ctypes.byref(list_size)))
603
if not bool(cert_list) and list_size.value != 0:
604
raise gnutls.errors.GNUTLSError("error getting peer"
605
" certificate")
389
list_size = ctypes.c_uint()
390
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
391
(session._c_object, ctypes.byref(list_size))
606
392
if list_size.value == 0:
607
393
return None
608
394
cert = cert_list[0]
612
398
def fingerprint(openpgp):
613
399
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
614
400
# New GnuTLS "datum" with the OpenPGP public key
615
datum = (gnutls.library.types
616
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
617
ctypes.POINTER
618
(ctypes.c_ubyte)),
619
ctypes.c_uint(len(openpgp))))
401
datum = gnutls.library.types.gnutls_datum_t\
402
(ctypes.cast(ctypes.c_char_p(openpgp),
403
ctypes.POINTER(ctypes.c_ubyte)),
404
ctypes.c_uint(len(openpgp)))
620
405
# New empty GnuTLS certificate
621
406
crt = gnutls.library.types.gnutls_openpgp_crt_t()
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
407
gnutls.library.functions.gnutls_openpgp_crt_init\
408
(ctypes.byref(crt))
624
409
# Import the OpenPGP public key into the certificate
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
627
gnutls.library.constants
628
.GNUTLS_OPENPGP_FMT_RAW))
629
# Verify the self signature in the key
630
crtverify = ctypes.c_uint()
631
(gnutls.library.functions
632
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
633
if crtverify.value != 0:
634
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
635
raise gnutls.errors.CertificateSecurityError("Verify failed")
410
gnutls.library.functions.gnutls_openpgp_crt_import\
411
(crt, ctypes.byref(datum),
412
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
636
413
# New buffer for the fingerprint
637
buf = ctypes.create_string_buffer(20)
638
buf_len = ctypes.c_size_t()
414
buffer = ctypes.create_string_buffer(20)
415
buffer_length = ctypes.c_size_t()
639
416
# Get the fingerprint from the certificate into the buffer
640
(gnutls.library.functions
641
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
642
ctypes.byref(buf_len)))
417
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
418
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
643
419
# Deinit the certificate
644
420
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
645
421
# Convert the buffer to a Python bytestring
646
fpr = ctypes.string_at(buf, buf_len.value)
422
fpr = ctypes.string_at(buffer, buffer_length.value)
647
423
# Convert the bytestring to hexadecimal notation
648
424
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
649
425
return hex_fpr
650
426
651
427
652
class TCP_handler(SocketServer.BaseRequestHandler, object):
428
class tcp_handler(SocketServer.BaseRequestHandler, object):
653
429
"""A TCP request handler class.
654
430
Instantiated by IPv6_TCPServer for each request to handle it.
655
431
Note: This will run in its own forked process."""
656
432
657
433
def handle(self):
658
434
logger.info(u"TCP connection from: %s",
659
unicode(self.client_address))
660
session = (gnutls.connection
661
.ClientSession(self.request,
662
gnutls.connection
663
.X509Credentials()))
435
unicode(self.client_address))
436
session = gnutls.connection.ClientSession\
437
(self.request, gnutls.connection.X509Credentials())
664
438
665
439
line = self.request.makefile().readline()
666
440
logger.debug(u"Protocol version: %r", line)
677
451
# using OpenPGP certificates.
678
452
679
453
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
680
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
681
# "+DHE-DSS"))
682
# Use a fallback default, since this MUST be set.
683
priority = self.server.settings.get("priority", "NORMAL")
684
(gnutls.library.functions
685
.gnutls_priority_set_direct(session._c_object,
686
priority, None))
454
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
455
# "+DHE-DSS"))
456
priority = "NORMAL" # Fallback default, since this
457
# MUST be set.
458
if self.server.settings["priority"]:
459
priority = self.server.settings["priority"]
460
gnutls.library.functions.gnutls_priority_set_direct\
461
(session._c_object, priority, None);
687
462
688
463
try:
689
464
session.handshake()
692
467
# Do not run session.bye() here: the session is not
693
468
# established. Just abandon the request.
694
469
return
695
logger.debug(u"Handshake succeeded")
696
470
try:
697
471
fpr = fingerprint(peer_certificate(session))
698
472
except (TypeError, gnutls.errors.GNUTLSError), error:
700
474
session.bye()
701
475
return
702
476
logger.debug(u"Fingerprint: %s", fpr)
703
477
client = None
704
478
for c in self.server.clients:
705
479
if c.fingerprint == fpr:
706
480
client = c
707
481
break
708
else:
482
if not client:
709
483
logger.warning(u"Client not found for fingerprint: %s",
710
484
fpr)
711
485
session.bye()
718
492
vars(client))
719
493
session.bye()
720
494
return
721
## This won't work here, since we're in a fork.
722
# client.checked_ok()
723
495
sent_size = 0
724
496
while sent_size < len(client.secret):
725
497
sent = session.send(client.secret[sent_size:])
730
502
session.bye()
731
503
732
504
733
class IPv6_TCPServer(SocketServer.ForkingMixIn,
734
SocketServer.TCPServer, object):
505
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
735
506
"""IPv6 TCP server. Accepts 'None' as address and/or port.
736
507
Attributes:
737
508
settings: Server settings
738
509
clients: Set() of Client objects
739
enabled: Boolean; whether this server is activated yet
740
510
"""
741
511
address_family = socket.AF_INET6
742
512
def __init__(self, *args, **kwargs):
746
516
if "clients" in kwargs:
747
517
self.clients = kwargs["clients"]
748
518
del kwargs["clients"]
749
self.enabled = False
750
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
519
return super(type(self), self).__init__(*args, **kwargs)
751
520
def server_bind(self):
752
521
"""This overrides the normal server_bind() function
753
522
to bind to an interface if one was specified, and also NOT to
765
534
u" bind to interface %s",
766
535
self.settings["interface"])
767
536
else:
768
raise
537
raise error
769
538
# Only bind(2) the socket if we really need to.
770
539
if self.server_address[0] or self.server_address[1]:
771
540
if not self.server_address[0]:
782
551
# if_nametoindex
783
552
# (self.settings
784
553
# ["interface"]))
785
return super(IPv6_TCPServer, self).server_bind()
786
def server_activate(self):
787
if self.enabled:
788
return super(IPv6_TCPServer, self).server_activate()
789
def enable(self):
790
self.enabled = True
554
return super(type(self), self).server_bind()
791
555
792
556
793
557
def string_to_delta(interval):
794
558
"""Parse a string and return a datetime.timedelta
795
559
796
560
>>> string_to_delta('7d')
797
561
datetime.timedelta(7)
798
562
>>> string_to_delta('60s')
809
573
timevalue = datetime.timedelta(0)
810
574
for s in interval.split():
811
575
try:
812
suffix = unicode(s[-1])
813
value = int(s[:-1])
576
suffix=unicode(s[-1])
577
value=int(s[:-1])
814
578
if suffix == u"d":
815
579
delta = datetime.timedelta(value)
816
580
elif suffix == u"s":
832
596
def server_state_changed(state):
833
597
"""Derived from the Avahi example code"""
834
598
if state == avahi.SERVER_COLLISION:
835
logger.error(u"Zeroconf server name collision")
599
logger.error(u"Server name collision")
836
600
service.remove()
837
601
elif state == avahi.SERVER_RUNNING:
838
602
service.add()
840
604
841
605
def entry_group_state_changed(state, error):
842
606
"""Derived from the Avahi example code"""
843
logger.debug(u"Avahi state change: %i", state)
607
logger.debug(u"state change: %i", state)
844
608
845
609
if state == avahi.ENTRY_GROUP_ESTABLISHED:
846
logger.debug(u"Zeroconf service established.")
610
logger.debug(u"Service established.")
847
611
elif state == avahi.ENTRY_GROUP_COLLISION:
848
logger.warning(u"Zeroconf service name collision.")
612
logger.warning(u"Service name collision.")
849
613
service.rename()
850
614
elif state == avahi.ENTRY_GROUP_FAILURE:
851
logger.critical(u"Avahi: Error in group state changed %s",
615
logger.critical(u"Error in group state changed %s",
852
616
unicode(error))
853
raise AvahiGroupError(u"State changed: %s" % unicode(error))
617
raise AvahiGroupError("State changed: %s", str(error))
854
618
855
619
def if_nametoindex(interface):
856
620
"""Call the C function if_nametoindex(), or equivalent"""
857
621
global if_nametoindex
858
622
try:
859
if_nametoindex = (ctypes.cdll.LoadLibrary
860
(ctypes.util.find_library("c"))
861
.if_nametoindex)
623
if "ctypes.util" not in sys.modules:
624
import ctypes.util
625
if_nametoindex = ctypes.cdll.LoadLibrary\
626
(ctypes.util.find_library("c")).if_nametoindex
862
627
except (OSError, AttributeError):
863
628
if "struct" not in sys.modules:
864
629
import struct
867
632
def if_nametoindex(interface):
868
633
"Get an interface index the hard way, i.e. using fcntl()"
869
634
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
870
with closing(socket.socket()) as s:
871
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
872
struct.pack("16s16x", interface))
635
s = socket.socket()
636
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
637
struct.pack("16s16x", interface))
638
s.close()
873
639
interface_index = struct.unpack("I", ifreq[16:20])[0]
874
640
return interface_index
875
641
return if_nametoindex(interface)
899
665
900
666
901
667
def main():
902
parser = optparse.OptionParser(version = "%%prog %s" % version)
668
global main_loop_started
669
main_loop_started = False
670
671
parser = OptionParser(version = "%%prog %s" % version)
903
672
parser.add_option("-i", "--interface", type="string",
904
673
metavar="IF", help="Bind to interface IF")
905
674
parser.add_option("-a", "--address", type="string",
906
675
help="Address to listen for requests on")
907
676
parser.add_option("-p", "--port", type="int",
908
677
help="Port number to receive requests on")
909
parser.add_option("--check", action="store_true",
678
parser.add_option("--check", action="store_true", default=False,
910
679
help="Run self-test")
911
680
parser.add_option("--debug", action="store_true",
912
681
help="Debug mode; run in foreground and log to"
919
688
default="/etc/mandos", metavar="DIR",
920
689
help="Directory to search for configuration"
921
690
" files")
922
parser.add_option("--no-dbus", action="store_false",
923
dest="use_dbus",
924
help="Do not provide D-Bus system bus"
925
" interface")
926
options = parser.parse_args()[0]
691
(options, args) = parser.parse_args()
927
692
928
693
if options.check:
929
694
import doctest
938
703
"priority":
939
704
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
940
705
"servicename": "Mandos",
941
"use_dbus": "True",
942
706
}
943
707
944
708
# Parse config file for server-global settings
947
711
server_config.read(os.path.join(options.configdir, "mandos.conf"))
948
712
# Convert the SafeConfigParser object to a dict
949
713
server_settings = server_config.defaults()
950
# Use the appropriate methods on the non-string config options
951
server_settings["debug"] = server_config.getboolean("DEFAULT",
952
"debug")
953
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
954
"use_dbus")
955
if server_settings["port"]:
956
server_settings["port"] = server_config.getint("DEFAULT",
957
"port")
714
# Use getboolean on the boolean config option
715
server_settings["debug"] = server_config.getboolean\
716
("DEFAULT", "debug")
958
717
del server_config
959
718
960
719
# Override the settings from the config file with command line
961
720
# options, if set.
962
721
for option in ("interface", "address", "port", "debug",
963
"priority", "servicename", "configdir",
964
"use_dbus"):
722
"priority", "servicename", "configdir"):
965
723
value = getattr(options, option)
966
724
if value is not None:
967
725
server_settings[option] = value
968
726
del options
969
727
# Now we have our good server settings in "server_settings"
970
728
971
# For convenience
972
729
debug = server_settings["debug"]
973
use_dbus = server_settings["use_dbus"]
974
730
975
731
if not debug:
976
732
syslogger.setLevel(logging.WARNING)
977
733
console.setLevel(logging.WARNING)
978
734
979
735
if server_settings["servicename"] != "Mandos":
980
syslogger.setFormatter(logging.Formatter
736
syslogger.setFormatter(logging.Formatter\
981
737
('Mandos (%s): %%(levelname)s:'
982
738
' %%(message)s'
983
739
% server_settings["servicename"]))
985
741
# Parse config file with clients
986
742
client_defaults = { "timeout": "1h",
987
743
"interval": "5m",
988
"checker": "fping -q -- %%(host)s",
744
"checker": "fping -q -- %(host)s",
989
745
"host": "",
990
746
}
991
747
client_config = ConfigParser.SafeConfigParser(client_defaults)
992
748
client_config.read(os.path.join(server_settings["configdir"],
993
749
"clients.conf"))
994
750
995
clients = Set()
996
tcp_server = IPv6_TCPServer((server_settings["address"],
997
server_settings["port"]),
998
TCP_handler,
999
settings=server_settings,
1000
clients=clients)
1001
pidfilename = "/var/run/mandos.pid"
1002
try:
1003
pidfile = open(pidfilename, "w")
1004
except IOError:
1005
logger.error("Could not open file %r", pidfilename)
1006
1007
try:
1008
uid = pwd.getpwnam("_mandos").pw_uid
1009
gid = pwd.getpwnam("_mandos").pw_gid
1010
except KeyError:
1011
try:
1012
uid = pwd.getpwnam("mandos").pw_uid
1013
gid = pwd.getpwnam("mandos").pw_gid
1014
except KeyError:
1015
try:
1016
uid = pwd.getpwnam("nobody").pw_uid
1017
gid = pwd.getpwnam("nogroup").pw_gid
1018
except KeyError:
1019
uid = 65534
1020
gid = 65534
1021
try:
1022
os.setgid(gid)
1023
os.setuid(uid)
1024
except OSError, error:
1025
if error[0] != errno.EPERM:
1026
raise error
1027
1028
# Enable all possible GnuTLS debugging
1029
if debug:
1030
# "Use a log level over 10 to enable all debugging options."
1031
# - GnuTLS manual
1032
gnutls.library.functions.gnutls_global_set_log_level(11)
1033
1034
@gnutls.library.types.gnutls_log_func
1035
def debug_gnutls(level, string):
1036
logger.debug("GnuTLS: %s", string[:-1])
1037
1038
(gnutls.library.functions
1039
.gnutls_global_set_log_function(debug_gnutls))
1040
1041
751
global service
1042
752
service = AvahiService(name = server_settings["servicename"],
1043
servicetype = "_mandos._tcp", )
753
type = "_mandos._tcp", );
1044
754
if server_settings["interface"]:
1045
service.interface = (if_nametoindex
1046
(server_settings["interface"]))
755
service.interface = if_nametoindex(server_settings["interface"])
1047
756
1048
757
global main_loop
1049
758
global bus
1052
761
DBusGMainLoop(set_as_default=True )
1053
762
main_loop = gobject.MainLoop()
1054
763
bus = dbus.SystemBus()
1055
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1056
avahi.DBUS_PATH_SERVER),
1057
avahi.DBUS_INTERFACE_SERVER)
764
server = dbus.Interface(
765
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
766
avahi.DBUS_INTERFACE_SERVER )
1058
767
# End of Avahi example code
1059
if use_dbus:
1060
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
768
769
clients = Set()
770
def remove_from_clients(client):
771
clients.remove(client)
772
if not clients:
773
logger.critical(u"No clients left, exiting")
774
sys.exit()
1061
775
1062
776
clients.update(Set(Client(name = section,
777
stop_hook = remove_from_clients,
1063
778
config
1064
= dict(client_config.items(section)),
1065
use_dbus = use_dbus)
779
= dict(client_config.items(section)))
1066
780
for section in client_config.sections()))
1067
781
if not clients:
1068
logger.warning(u"No clients defined")
782
logger.critical(u"No clients defined")
783
sys.exit(1)
1069
784
1070
785
if debug:
1071
786
# Redirect stdin so all checkers get /dev/null
1079
794
# Close all input and output, do double fork, etc.
1080
795
daemon()
1081
796
797
pidfilename = "/var/run/mandos/mandos.pid"
798
pid = os.getpid()
1082
799
try:
1083
pid = os.getpid()
800
pidfile = open(pidfilename, "w")
1084
801
pidfile.write(str(pid) + "\n")
1085
802
pidfile.close()
1086
803
del pidfile
1087
except IOError:
1088
logger.error(u"Could not write to file %r with PID %d",
1089
pidfilename, pid)
1090
except NameError:
1091
# "pidfile" was never created
1092
pass
1093
del pidfilename
804
except IOError, err:
805
logger.error(u"Could not write %s file with PID %d",
806
pidfilename, os.getpid())
1094
807
1095
808
def cleanup():
1096
809
"Cleanup function; run on exit"
1103
816
1104
817
while clients:
1105
818
client = clients.pop()
1106
client.disable_hook = None
1107
client.disable()
819
client.stop_hook = None
820
client.stop()
1108
821
1109
822
atexit.register(cleanup)
1110
823
1113
826
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1114
827
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1115
828
1116
if use_dbus:
1117
class MandosServer(dbus.service.Object):
1118
"""A D-Bus proxy object"""
1119
def __init__(self):
1120
dbus.service.Object.__init__(self, bus, "/")
1121
_interface = u"se.bsnet.fukt.Mandos"
1122
1123
@dbus.service.signal(_interface, signature="oa{sv}")
1124
def ClientAdded(self, objpath, properties):
1125
"D-Bus signal"
1126
pass
1127
1128
@dbus.service.signal(_interface, signature="os")
1129
def ClientRemoved(self, objpath, name):
1130
"D-Bus signal"
1131
pass
1132
1133
@dbus.service.method(_interface, out_signature="ao")
1134
def GetAllClients(self):
1135
"D-Bus method"
1136
return dbus.Array(c.dbus_object_path for c in clients)
1137
1138
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1139
def GetAllClientsWithProperties(self):
1140
"D-Bus method"
1141
return dbus.Dictionary(
1142
((c.dbus_object_path, c.GetAllProperties())
1143
for c in clients),
1144
signature="oa{sv}")
1145
1146
@dbus.service.method(_interface, in_signature="o")
1147
def RemoveClient(self, object_path):
1148
"D-Bus method"
1149
for c in clients:
1150
if c.dbus_object_path == object_path:
1151
clients.remove(c)
1152
# Don't signal anything except ClientRemoved
1153
c.use_dbus = False
1154
c.disable()
1155
# Emit D-Bus signal
1156
self.ClientRemoved(object_path, c.name)
1157
return
1158
raise KeyError
1159
1160
del _interface
1161
1162
mandos_server = MandosServer()
1163
1164
829
for client in clients:
1165
if use_dbus:
1166
# Emit D-Bus signal
1167
mandos_server.ClientAdded(client.dbus_object_path,
1168
client.GetAllProperties())
1169
client.enable()
1170
1171
tcp_server.enable()
1172
tcp_server.server_activate()
1173
830
client.start()
831
832
tcp_server = IPv6_TCPServer((server_settings["address"],
833
server_settings["port"]),
834
tcp_handler,
835
settings=server_settings,
836
clients=clients)
1174
837
# Find out what port we got
1175
838
service.port = tcp_server.socket.getsockname()[1]
1176
839
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1190
853
1191
854
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1192
855
lambda *args, **kwargs:
1193
(tcp_server.handle_request
1194
(*args[2:], **kwargs) or True))
856
tcp_server.handle_request\
857
(*args[2:], **kwargs) or True)
1195
858
1196
859
logger.debug(u"Starting main loop")
860
main_loop_started = True
1197
861
main_loop.run()
1198
862
except AvahiError, error:
1199
logger.critical(u"AvahiError: %s", error)
863
logger.critical(u"AvahiError: %s" + unicode(error))
1200
864
sys.exit(1)
1201
865
except KeyboardInterrupt:
1202
866
if debug:
1203
print >> sys.stderr
1204
logger.debug("Server received KeyboardInterrupt")
1205
logger.debug("Server exiting")
867
print
1206
868
1207
869
if __name__ == '__main__':
1208
870
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0