To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 94
- compare with another revision
- download diff
- download tarball
- view history from revision 94
- Committer: Teddy Hogeborn
- Date: 2008-08-22 00:16:20 UTC
- mfrom: (24.1.57 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080822001620-vxpn1evy0t0kyvj0
* clients.conf ([DEFAULT]/checker): Update to new default value.
* mandos (Client.start_checker): Bug fix: OSError, not
subprocess.OSError.
(main): Use "fping -q -- %(host)s" instead of "fping -q --
%%(host)s" as default value for "checker". Always redirect
stdin to be from /dev/null, even if in debug mode.
* mandos-clients.conf.xml (DESCRIPTION): Improved wording and refer to
the EXPANSION section.
(OPTIONS): Added synopsis and improved wording for "checker",
"fingerprint", and "secret". Refer to the RUNTIME
EXPANSION section for the "checker" option.
(EXAMPLE): Update to new default value for "checker".
* mandos-keygen (trap): Split lines and add "set +e".
* mandos (Client.start_checker): Bug fix: OSError, not
subprocess.OSError.
(main): Use "fping -q -- %(host)s" instead of "fping -q --
%%(host)s" as default value for "checker". Always redirect
stdin to be from /dev/null, even if in debug mode.
* mandos-clients.conf.xml (DESCRIPTION): Improved wording and refer to
the EXPANSION section.
(OPTIONS): Added synopsis and improved wording for "checker",
"fingerprint", and "secret". Refer to the RUNTIME
EXPANSION section for the "checker" option.
(EXAMPLE): Update to new default value for "checker".
* mandos-keygen (trap): Split lines and add "set +e".
- files added:
- plugins.d/usplash
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugins.d/mandos-client.c => plugins.d/password-request.c
- plugins.d/mandos-client.xml => plugins.d/password-request.xml
- files modified:
- Makefile
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
# GNU General Public License for more details.
26
25
#
27
26
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
30
28
#
31
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
30
#
33
31
34
from __future__ import division, with_statement, absolute_import
32
from __future__ import division
35
33
36
34
import SocketServer
37
35
import socket
38
import optparse
36
import select
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
import pwd
59
from contextlib import closing
60
import struct
61
import fcntl
62
57
63
58
import dbus
64
import dbus.service
65
59
import gobject
66
60
import avahi
67
61
from dbus.mainloop.glib import DBusGMainLoop
68
62
import ctypes
69
import ctypes.util
70
71
try:
72
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
73
except AttributeError:
74
try:
75
from IN import SO_BINDTODEVICE
76
except ImportError:
77
# From /usr/include/asm/socket.h
78
SO_BINDTODEVICE = 25
79
80
81
version = "1.0.8"
82
83
logger = logging.Logger(u'mandos')
84
syslogger = (logging.handlers.SysLogHandler
85
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
86
address = "/dev/log"))
87
syslogger.setFormatter(logging.Formatter
88
(u'Mandos [%(process)d]: %(levelname)s:'
89
u' %(message)s'))
63
64
version = "1.0"
65
66
logger = logging.Logger('mandos')
67
syslogger = logging.handlers.SysLogHandler\
68
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
69
address = "/dev/log")
70
syslogger.setFormatter(logging.Formatter\
71
('Mandos: %(levelname)s: %(message)s'))
90
72
logger.addHandler(syslogger)
91
73
92
74
console = logging.StreamHandler()
93
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
94
u' %(levelname)s:'
95
u' %(message)s'))
75
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
76
' %(message)s'))
96
77
logger.addHandler(console)
97
78
98
79
class AvahiError(Exception):
99
def __init__(self, value, *args, **kwargs):
80
def __init__(self, value):
100
81
self.value = value
101
super(AvahiError, self).__init__(value, *args, **kwargs)
102
def __unicode__(self):
103
return unicode(repr(self.value))
82
def __str__(self):
83
return repr(self.value)
104
84
105
85
class AvahiServiceError(AvahiError):
106
86
pass
111
91
112
92
class AvahiService(object):
113
93
"""An Avahi (Zeroconf) service.
114
115
94
Attributes:
116
95
interface: integer; avahi.IF_UNSPEC or an interface index.
117
96
Used to optionally bind to the specified interface.
118
name: string; Example: u'Mandos'
119
type: string; Example: u'_mandos._tcp'.
97
name: string; Example: 'Mandos'
98
type: string; Example: '_mandos._tcp'.
120
99
See <http://www.dns-sd.org/ServiceTypes.html>
121
100
port: integer; what port to announce
122
101
TXT: list of strings; TXT record for the service
127
106
a sensible number of times
128
107
"""
129
108
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
130
servicetype = None, port = None, TXT = None,
131
domain = u"", host = u"", max_renames = 32768,
132
protocol = avahi.PROTO_UNSPEC):
109
type = None, port = None, TXT = None, domain = "",
110
host = "", max_renames = 32768):
133
111
self.interface = interface
134
112
self.name = name
135
self.type = servicetype
113
self.type = type
136
114
self.port = port
137
self.TXT = TXT if TXT is not None else []
115
if TXT is None:
116
self.TXT = []
117
else:
118
self.TXT = TXT
138
119
self.domain = domain
139
120
self.host = host
140
121
self.rename_count = 0
141
122
self.max_renames = max_renames
142
self.protocol = protocol
143
123
def rename(self):
144
124
"""Derived from the Avahi example code"""
145
125
if self.rename_count >= self.max_renames:
146
logger.critical(u"No suitable Zeroconf service name found"
147
u" after %i retries, exiting.",
148
self.rename_count)
149
raise AvahiServiceError(u"Too many renames")
126
logger.critical(u"No suitable service name found after %i"
127
u" retries, exiting.", rename_count)
128
raise AvahiServiceError("Too many renames")
150
129
self.name = server.GetAlternativeServiceName(self.name)
151
logger.info(u"Changing Zeroconf service name to %r ...",
152
self.name)
153
syslogger.setFormatter(logging.Formatter
154
(u'Mandos (%s) [%%(process)d]:'
155
u' %%(levelname)s: %%(message)s'
156
% self.name))
130
logger.info(u"Changing name to %r ...", str(self.name))
131
syslogger.setFormatter(logging.Formatter\
132
('Mandos (%s): %%(levelname)s:'
133
' %%(message)s' % self.name))
157
134
self.remove()
158
135
self.add()
159
136
self.rename_count += 1
165
142
"""Derived from the Avahi example code"""
166
143
global group
167
144
if group is None:
168
group = dbus.Interface(bus.get_object
169
(avahi.DBUS_NAME,
145
group = dbus.Interface\
146
(bus.get_object(avahi.DBUS_NAME,
170
147
server.EntryGroupNew()),
171
avahi.DBUS_INTERFACE_ENTRY_GROUP)
148
avahi.DBUS_INTERFACE_ENTRY_GROUP)
172
149
group.connect_to_signal('StateChanged',
173
150
entry_group_state_changed)
174
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
151
logger.debug(u"Adding service '%s' of type '%s' ...",
175
152
service.name, service.type)
176
153
group.AddService(
177
154
self.interface, # interface
178
self.protocol, # protocol
155
avahi.PROTO_INET6, # protocol
179
156
dbus.UInt32(0), # flags
180
157
self.name, self.type,
181
158
self.domain, self.host,
188
165
# End of Avahi example code
189
166
190
167
191
def _datetime_to_dbus(dt, variant_level=0):
192
"""Convert a UTC datetime.datetime() to a D-Bus type."""
193
return dbus.String(dt.isoformat(), variant_level=variant_level)
194
195
196
168
class Client(object):
197
169
"""A representation of a client host served by this server.
198
199
170
Attributes:
200
name: string; from the config file, used in log messages and
201
D-Bus identifiers
171
name: string; from the config file, used in log messages
202
172
fingerprint: string (40 or 32 hexadecimal digits); used to
203
173
uniquely identify the client
204
secret: bytestring; sent verbatim (over TLS) to client
205
host: string; available for use by the checker command
206
created: datetime.datetime(); (UTC) object creation
207
last_enabled: datetime.datetime(); (UTC)
208
enabled: bool()
209
last_checked_ok: datetime.datetime(); (UTC) or None
210
timeout: datetime.timedelta(); How long from last_checked_ok
211
until this client is invalid
212
interval: datetime.timedelta(); How often to start a new checker
213
disable_hook: If set, called by disable() as disable_hook(self)
214
checker: subprocess.Popen(); a running checker process used
215
to see if the client lives.
216
'None' if no process is running.
174
secret: bytestring; sent verbatim (over TLS) to client
175
host: string; available for use by the checker command
176
created: datetime.datetime(); object creation, not client host
177
last_checked_ok: datetime.datetime() or None if not yet checked OK
178
timeout: datetime.timedelta(); How long from last_checked_ok
179
until this client is invalid
180
interval: datetime.timedelta(); How often to start a new checker
181
stop_hook: If set, called by stop() as stop_hook(self)
182
checker: subprocess.Popen(); a running checker process used
183
to see if the client lives.
184
'None' if no process is running.
217
185
checker_initiator_tag: a gobject event source tag, or None
218
disable_initiator_tag: - '' -
186
stop_initiator_tag: - '' -
219
187
checker_callback_tag: - '' -
220
188
checker_command: string; External command which is run to check if
221
189
client lives. %() expansions are done at
222
190
runtime with vars(self) as dict, so that for
223
191
instance %(name)s can be used in the command.
224
current_checker_command: string; current running checker_command
192
Private attibutes:
193
_timeout: Real variable for 'timeout'
194
_interval: Real variable for 'interval'
195
_timeout_milliseconds: Used when calling gobject.timeout_add()
196
_interval_milliseconds: - '' -
225
197
"""
226
227
@staticmethod
228
def _datetime_to_milliseconds(dt):
229
"Convert a datetime.datetime() to milliseconds"
230
return ((dt.days * 24 * 60 * 60 * 1000)
231
+ (dt.seconds * 1000)
232
+ (dt.microseconds // 1000))
233
234
def timeout_milliseconds(self):
235
"Return the 'timeout' attribute in milliseconds"
236
return self._datetime_to_milliseconds(self.timeout)
237
238
def interval_milliseconds(self):
239
"Return the 'interval' attribute in milliseconds"
240
return self._datetime_to_milliseconds(self.interval)
241
242
def __init__(self, name = None, disable_hook=None, config=None):
198
def _set_timeout(self, timeout):
199
"Setter function for 'timeout' attribute"
200
self._timeout = timeout
201
self._timeout_milliseconds = ((self.timeout.days
202
* 24 * 60 * 60 * 1000)
203
+ (self.timeout.seconds * 1000)
204
+ (self.timeout.microseconds
205
// 1000))
206
timeout = property(lambda self: self._timeout,
207
_set_timeout)
208
del _set_timeout
209
def _set_interval(self, interval):
210
"Setter function for 'interval' attribute"
211
self._interval = interval
212
self._interval_milliseconds = ((self.interval.days
213
* 24 * 60 * 60 * 1000)
214
+ (self.interval.seconds
215
* 1000)
216
+ (self.interval.microseconds
217
// 1000))
218
interval = property(lambda self: self._interval,
219
_set_interval)
220
del _set_interval
221
def __init__(self, name = None, stop_hook=None, config={}):
243
222
"""Note: the 'checker' key in 'config' sets the
244
223
'checker_command' attribute and *not* the 'checker'
245
224
attribute."""
246
225
self.name = name
247
if config is None:
248
config = {}
249
226
logger.debug(u"Creating client %r", self.name)
250
227
# Uppercase and remove spaces from fingerprint for later
251
228
# comparison purposes with return value from the fingerprint()
252
229
# function
253
self.fingerprint = (config[u"fingerprint"].upper()
254
.replace(u" ", u""))
230
self.fingerprint = config["fingerprint"].upper()\
231
.replace(u" ", u"")
255
232
logger.debug(u" Fingerprint: %s", self.fingerprint)
256
if u"secret" in config:
257
self.secret = config[u"secret"].decode(u"base64")
258
elif u"secfile" in config:
259
with closing(open(os.path.expanduser
260
(os.path.expandvars
261
(config[u"secfile"])))) as secfile:
262
self.secret = secfile.read()
233
if "secret" in config:
234
self.secret = config["secret"].decode(u"base64")
235
elif "secfile" in config:
236
sf = open(config["secfile"])
237
self.secret = sf.read()
238
sf.close()
263
239
else:
264
240
raise TypeError(u"No secret or secfile for client %s"
265
241
% self.name)
266
self.host = config.get(u"host", u"")
267
self.created = datetime.datetime.utcnow()
268
self.enabled = False
269
self.last_enabled = None
242
self.host = config.get("host", "")
243
self.created = datetime.datetime.now()
270
244
self.last_checked_ok = None
271
self.timeout = string_to_delta(config[u"timeout"])
272
self.interval = string_to_delta(config[u"interval"])
273
self.disable_hook = disable_hook
245
self.timeout = string_to_delta(config["timeout"])
246
self.interval = string_to_delta(config["interval"])
247
self.stop_hook = stop_hook
274
248
self.checker = None
275
249
self.checker_initiator_tag = None
276
self.disable_initiator_tag = None
250
self.stop_initiator_tag = None
277
251
self.checker_callback_tag = None
278
self.checker_command = config[u"checker"]
279
self.current_checker_command = None
280
self.last_connect = None
281
282
def enable(self):
252
self.check_command = config["checker"]
253
def start(self):
283
254
"""Start this client's checker and timeout hooks"""
284
self.last_enabled = datetime.datetime.utcnow()
285
255
# Schedule a new checker to be started an 'interval' from now,
286
256
# and every interval from then on.
287
self.checker_initiator_tag = (gobject.timeout_add
288
(self.interval_milliseconds(),
289
self.start_checker))
257
self.checker_initiator_tag = gobject.timeout_add\
258
(self._interval_milliseconds,
259
self.start_checker)
290
260
# Also start a new checker *right now*.
291
261
self.start_checker()
292
# Schedule a disable() when 'timeout' has passed
293
self.disable_initiator_tag = (gobject.timeout_add
294
(self.timeout_milliseconds(),
295
self.disable))
296
self.enabled = True
297
298
def disable(self):
299
"""Disable this client."""
300
if not getattr(self, "enabled", False):
262
# Schedule a stop() when 'timeout' has passed
263
self.stop_initiator_tag = gobject.timeout_add\
264
(self._timeout_milliseconds,
265
self.stop)
266
def stop(self):
267
"""Stop this client.
268
The possibility that a client might be restarted is left open,
269
but not currently used."""
270
# If this client doesn't have a secret, it is already stopped.
271
if hasattr(self, "secret") and self.secret:
272
logger.info(u"Stopping client %s", self.name)
273
self.secret = None
274
else:
301
275
return False
302
logger.info(u"Disabling client %s", self.name)
303
if getattr(self, u"disable_initiator_tag", False):
304
gobject.source_remove(self.disable_initiator_tag)
305
self.disable_initiator_tag = None
306
if getattr(self, u"checker_initiator_tag", False):
276
if getattr(self, "stop_initiator_tag", False):
277
gobject.source_remove(self.stop_initiator_tag)
278
self.stop_initiator_tag = None
279
if getattr(self, "checker_initiator_tag", False):
307
280
gobject.source_remove(self.checker_initiator_tag)
308
281
self.checker_initiator_tag = None
309
282
self.stop_checker()
310
if self.disable_hook:
311
self.disable_hook(self)
312
self.enabled = False
283
if self.stop_hook:
284
self.stop_hook(self)
313
285
# Do not run this again if called by a gobject.timeout_add
314
286
return False
315
316
287
def __del__(self):
317
self.disable_hook = None
318
self.disable()
319
320
def checker_callback(self, pid, condition, command):
288
self.stop_hook = None
289
self.stop()
290
def checker_callback(self, pid, condition):
321
291
"""The checker has completed, so take appropriate actions."""
292
now = datetime.datetime.now()
322
293
self.checker_callback_tag = None
323
294
self.checker = None
324
if os.WIFEXITED(condition):
325
exitstatus = os.WEXITSTATUS(condition)
326
if exitstatus == 0:
327
logger.info(u"Checker for %(name)s succeeded",
328
vars(self))
329
self.checked_ok()
330
else:
331
logger.info(u"Checker for %(name)s failed",
332
vars(self))
333
else:
295
if os.WIFEXITED(condition) \
296
and (os.WEXITSTATUS(condition) == 0):
297
logger.info(u"Checker for %(name)s succeeded",
298
vars(self))
299
self.last_checked_ok = now
300
gobject.source_remove(self.stop_initiator_tag)
301
self.stop_initiator_tag = gobject.timeout_add\
302
(self._timeout_milliseconds,
303
self.stop)
304
elif not os.WIFEXITED(condition):
334
305
logger.warning(u"Checker for %(name)s crashed?",
335
306
vars(self))
336
337
def checked_ok(self):
338
"""Bump up the timeout for this client.
339
340
This should only be called when the client has been seen,
341
alive and well.
342
"""
343
self.last_checked_ok = datetime.datetime.utcnow()
344
gobject.source_remove(self.disable_initiator_tag)
345
self.disable_initiator_tag = (gobject.timeout_add
346
(self.timeout_milliseconds(),
347
self.disable))
348
307
else:
308
logger.info(u"Checker for %(name)s failed",
309
vars(self))
349
310
def start_checker(self):
350
311
"""Start a new checker subprocess if one is not running.
351
352
312
If a checker already exists, leave it running and do
353
313
nothing."""
354
314
# The reason for not killing a running checker is that if we
359
319
# checkers alone, the checker would have to take more time
360
320
# than 'timeout' for the client to be declared invalid, which
361
321
# is as it should be.
362
363
# If a checker exists, make sure it is not a zombie
364
if self.checker is not None:
365
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
366
if pid:
367
logger.warning(u"Checker was a zombie")
368
gobject.source_remove(self.checker_callback_tag)
369
self.checker_callback(pid, status,
370
self.current_checker_command)
371
# Start a new checker if needed
372
322
if self.checker is None:
373
323
try:
374
# In case checker_command has exactly one % operator
375
command = self.checker_command % self.host
324
# In case check_command has exactly one % operator
325
command = self.check_command % self.host
376
326
except TypeError:
377
327
# Escape attributes for the shell
378
escaped_attrs = dict((key,
379
re.escape(unicode(str(val),
380
errors=
381
u'replace')))
328
escaped_attrs = dict((key, re.escape(str(val)))
382
329
for key, val in
383
330
vars(self).iteritems())
384
331
try:
385
command = self.checker_command % escaped_attrs
332
command = self.check_command % escaped_attrs
386
333
except TypeError, error:
387
334
logger.error(u'Could not format string "%s":'
388
u' %s', self.checker_command, error)
335
u' %s', self.check_command, error)
389
336
return True # Try again later
390
self.current_checker_command = command
391
337
try:
392
338
logger.info(u"Starting checker %r for %s",
393
339
command, self.name)
397
343
# always replaced by /dev/null.)
398
344
self.checker = subprocess.Popen(command,
399
345
close_fds=True,
400
shell=True, cwd=u"/")
401
self.checker_callback_tag = (gobject.child_watch_add
402
(self.checker.pid,
403
self.checker_callback,
404
data=command))
405
# The checker may have completed before the gobject
406
# watch was added. Check for this.
407
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
408
if pid:
409
gobject.source_remove(self.checker_callback_tag)
410
self.checker_callback(pid, status, command)
346
shell=True, cwd="/")
347
self.checker_callback_tag = gobject.child_watch_add\
348
(self.checker.pid,
349
self.checker_callback)
411
350
except OSError, error:
412
351
logger.error(u"Failed to start subprocess: %s",
413
352
error)
414
353
# Re-run this periodically if run by gobject.timeout_add
415
354
return True
416
417
355
def stop_checker(self):
418
356
"""Force the checker process, if any, to stop."""
419
357
if self.checker_callback_tag:
420
358
gobject.source_remove(self.checker_callback_tag)
421
359
self.checker_callback_tag = None
422
if getattr(self, u"checker", None) is None:
360
if getattr(self, "checker", None) is None:
423
361
return
424
362
logger.debug(u"Stopping checker for %(name)s", vars(self))
425
363
try:
431
369
if error.errno != errno.ESRCH: # No such process
432
370
raise
433
371
self.checker = None
434
435
372
def still_valid(self):
436
373
"""Has the timeout not yet passed for this client?"""
437
if not getattr(self, u"enabled", False):
438
return False
439
now = datetime.datetime.utcnow()
374
now = datetime.datetime.now()
440
375
if self.last_checked_ok is None:
441
376
return now < (self.created + self.timeout)
442
377
else:
443
378
return now < (self.last_checked_ok + self.timeout)
444
379
445
380
446
class ClientDBus(Client, dbus.service.Object):
447
"""A Client class using D-Bus
448
449
Attributes:
450
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
451
"""
452
# dbus.service.Object doesn't use super(), so we can't either.
453
454
def __init__(self, *args, **kwargs):
455
Client.__init__(self, *args, **kwargs)
456
# Only now, when this client is initialized, can it show up on
457
# the D-Bus
458
self.dbus_object_path = (dbus.ObjectPath
459
(u"/clients/"
460
+ self.name.replace(u".", u"_")))
461
dbus.service.Object.__init__(self, bus,
462
self.dbus_object_path)
463
def enable(self):
464
oldstate = getattr(self, u"enabled", False)
465
r = Client.enable(self)
466
if oldstate != self.enabled:
467
# Emit D-Bus signals
468
self.PropertyChanged(dbus.String(u"enabled"),
469
dbus.Boolean(True, variant_level=1))
470
self.PropertyChanged(dbus.String(u"last_enabled"),
471
(_datetime_to_dbus(self.last_enabled,
472
variant_level=1)))
473
return r
474
475
def disable(self, signal = True):
476
oldstate = getattr(self, u"enabled", False)
477
r = Client.disable(self)
478
if signal and oldstate != self.enabled:
479
# Emit D-Bus signal
480
self.PropertyChanged(dbus.String(u"enabled"),
481
dbus.Boolean(False, variant_level=1))
482
return r
483
484
def __del__(self, *args, **kwargs):
485
try:
486
self.remove_from_connection()
487
except LookupError:
488
pass
489
if hasattr(dbus.service.Object, u"__del__"):
490
dbus.service.Object.__del__(self, *args, **kwargs)
491
Client.__del__(self, *args, **kwargs)
492
493
def checker_callback(self, pid, condition, command,
494
*args, **kwargs):
495
self.checker_callback_tag = None
496
self.checker = None
497
# Emit D-Bus signal
498
self.PropertyChanged(dbus.String(u"checker_running"),
499
dbus.Boolean(False, variant_level=1))
500
if os.WIFEXITED(condition):
501
exitstatus = os.WEXITSTATUS(condition)
502
# Emit D-Bus signal
503
self.CheckerCompleted(dbus.Int16(exitstatus),
504
dbus.Int64(condition),
505
dbus.String(command))
506
else:
507
# Emit D-Bus signal
508
self.CheckerCompleted(dbus.Int16(-1),
509
dbus.Int64(condition),
510
dbus.String(command))
511
512
return Client.checker_callback(self, pid, condition, command,
513
*args, **kwargs)
514
515
def checked_ok(self, *args, **kwargs):
516
r = Client.checked_ok(self, *args, **kwargs)
517
# Emit D-Bus signal
518
self.PropertyChanged(
519
dbus.String(u"last_checked_ok"),
520
(_datetime_to_dbus(self.last_checked_ok,
521
variant_level=1)))
522
return r
523
524
def start_checker(self, *args, **kwargs):
525
old_checker = self.checker
526
if self.checker is not None:
527
old_checker_pid = self.checker.pid
528
else:
529
old_checker_pid = None
530
r = Client.start_checker(self, *args, **kwargs)
531
# Only if new checker process was started
532
if (self.checker is not None
533
and old_checker_pid != self.checker.pid):
534
# Emit D-Bus signal
535
self.CheckerStarted(self.current_checker_command)
536
self.PropertyChanged(
537
dbus.String(u"checker_running"),
538
dbus.Boolean(True, variant_level=1))
539
return r
540
541
def stop_checker(self, *args, **kwargs):
542
old_checker = getattr(self, u"checker", None)
543
r = Client.stop_checker(self, *args, **kwargs)
544
if (old_checker is not None
545
and getattr(self, u"checker", None) is None):
546
self.PropertyChanged(dbus.String(u"checker_running"),
547
dbus.Boolean(False, variant_level=1))
548
return r
549
550
## D-Bus methods & signals
551
_interface = u"se.bsnet.fukt.Mandos.Client"
552
553
# CheckedOK - method
554
@dbus.service.method(_interface)
555
def CheckedOK(self):
556
return self.checked_ok()
557
558
# CheckerCompleted - signal
559
@dbus.service.signal(_interface, signature=u"nxs")
560
def CheckerCompleted(self, exitcode, waitstatus, command):
561
"D-Bus signal"
562
pass
563
564
# CheckerStarted - signal
565
@dbus.service.signal(_interface, signature=u"s")
566
def CheckerStarted(self, command):
567
"D-Bus signal"
568
pass
569
570
# GetAllProperties - method
571
@dbus.service.method(_interface, out_signature=u"a{sv}")
572
def GetAllProperties(self):
573
"D-Bus method"
574
return dbus.Dictionary({
575
dbus.String(u"name"):
576
dbus.String(self.name, variant_level=1),
577
dbus.String(u"fingerprint"):
578
dbus.String(self.fingerprint, variant_level=1),
579
dbus.String(u"host"):
580
dbus.String(self.host, variant_level=1),
581
dbus.String(u"created"):
582
_datetime_to_dbus(self.created, variant_level=1),
583
dbus.String(u"last_enabled"):
584
(_datetime_to_dbus(self.last_enabled,
585
variant_level=1)
586
if self.last_enabled is not None
587
else dbus.Boolean(False, variant_level=1)),
588
dbus.String(u"enabled"):
589
dbus.Boolean(self.enabled, variant_level=1),
590
dbus.String(u"last_checked_ok"):
591
(_datetime_to_dbus(self.last_checked_ok,
592
variant_level=1)
593
if self.last_checked_ok is not None
594
else dbus.Boolean (False, variant_level=1)),
595
dbus.String(u"timeout"):
596
dbus.UInt64(self.timeout_milliseconds(),
597
variant_level=1),
598
dbus.String(u"interval"):
599
dbus.UInt64(self.interval_milliseconds(),
600
variant_level=1),
601
dbus.String(u"checker"):
602
dbus.String(self.checker_command,
603
variant_level=1),
604
dbus.String(u"checker_running"):
605
dbus.Boolean(self.checker is not None,
606
variant_level=1),
607
dbus.String(u"object_path"):
608
dbus.ObjectPath(self.dbus_object_path,
609
variant_level=1)
610
}, signature=u"sv")
611
612
# IsStillValid - method
613
@dbus.service.method(_interface, out_signature=u"b")
614
def IsStillValid(self):
615
return self.still_valid()
616
617
# PropertyChanged - signal
618
@dbus.service.signal(_interface, signature=u"sv")
619
def PropertyChanged(self, property, value):
620
"D-Bus signal"
621
pass
622
623
# ReceivedSecret - signal
624
@dbus.service.signal(_interface)
625
def ReceivedSecret(self):
626
"D-Bus signal"
627
pass
628
629
# Rejected - signal
630
@dbus.service.signal(_interface)
631
def Rejected(self):
632
"D-Bus signal"
633
pass
634
635
# SetChecker - method
636
@dbus.service.method(_interface, in_signature=u"s")
637
def SetChecker(self, checker):
638
"D-Bus setter method"
639
self.checker_command = checker
640
# Emit D-Bus signal
641
self.PropertyChanged(dbus.String(u"checker"),
642
dbus.String(self.checker_command,
643
variant_level=1))
644
645
# SetHost - method
646
@dbus.service.method(_interface, in_signature=u"s")
647
def SetHost(self, host):
648
"D-Bus setter method"
649
self.host = host
650
# Emit D-Bus signal
651
self.PropertyChanged(dbus.String(u"host"),
652
dbus.String(self.host, variant_level=1))
653
654
# SetInterval - method
655
@dbus.service.method(_interface, in_signature=u"t")
656
def SetInterval(self, milliseconds):
657
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
658
# Emit D-Bus signal
659
self.PropertyChanged(dbus.String(u"interval"),
660
(dbus.UInt64(self.interval_milliseconds(),
661
variant_level=1)))
662
663
# SetSecret - method
664
@dbus.service.method(_interface, in_signature=u"ay",
665
byte_arrays=True)
666
def SetSecret(self, secret):
667
"D-Bus setter method"
668
self.secret = str(secret)
669
670
# SetTimeout - method
671
@dbus.service.method(_interface, in_signature=u"t")
672
def SetTimeout(self, milliseconds):
673
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
674
# Emit D-Bus signal
675
self.PropertyChanged(dbus.String(u"timeout"),
676
(dbus.UInt64(self.timeout_milliseconds(),
677
variant_level=1)))
678
679
# Enable - method
680
@dbus.service.method(_interface)
681
def Enable(self):
682
"D-Bus method"
683
self.enable()
684
685
# StartChecker - method
686
@dbus.service.method(_interface)
687
def StartChecker(self):
688
"D-Bus method"
689
self.start_checker()
690
691
# Disable - method
692
@dbus.service.method(_interface)
693
def Disable(self):
694
"D-Bus method"
695
self.disable()
696
697
# StopChecker - method
698
@dbus.service.method(_interface)
699
def StopChecker(self):
700
self.stop_checker()
701
702
del _interface
703
704
705
class ClientHandler(SocketServer.BaseRequestHandler, object):
706
"""A class to handle client connections.
707
708
Instantiated once for each connection to handle it.
381
def peer_certificate(session):
382
"Return the peer's OpenPGP certificate as a bytestring"
383
# If not an OpenPGP certificate...
384
if gnutls.library.functions.gnutls_certificate_type_get\
385
(session._c_object) \
386
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
387
# ...do the normal thing
388
return session.peer_certificate
389
list_size = ctypes.c_uint()
390
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
391
(session._c_object, ctypes.byref(list_size))
392
if list_size.value == 0:
393
return None
394
cert = cert_list[0]
395
return ctypes.string_at(cert.data, cert.size)
396
397
398
def fingerprint(openpgp):
399
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
400
# New GnuTLS "datum" with the OpenPGP public key
401
datum = gnutls.library.types.gnutls_datum_t\
402
(ctypes.cast(ctypes.c_char_p(openpgp),
403
ctypes.POINTER(ctypes.c_ubyte)),
404
ctypes.c_uint(len(openpgp)))
405
# New empty GnuTLS certificate
406
crt = gnutls.library.types.gnutls_openpgp_crt_t()
407
gnutls.library.functions.gnutls_openpgp_crt_init\
408
(ctypes.byref(crt))
409
# Import the OpenPGP public key into the certificate
410
gnutls.library.functions.gnutls_openpgp_crt_import\
411
(crt, ctypes.byref(datum),
412
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
413
# New buffer for the fingerprint
414
buffer = ctypes.create_string_buffer(20)
415
buffer_length = ctypes.c_size_t()
416
# Get the fingerprint from the certificate into the buffer
417
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
418
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
419
# Deinit the certificate
420
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
421
# Convert the buffer to a Python bytestring
422
fpr = ctypes.string_at(buffer, buffer_length.value)
423
# Convert the bytestring to hexadecimal notation
424
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
425
return hex_fpr
426
427
428
class tcp_handler(SocketServer.BaseRequestHandler, object):
429
"""A TCP request handler class.
430
Instantiated by IPv6_TCPServer for each request to handle it.
709
431
Note: This will run in its own forked process."""
710
432
711
433
def handle(self):
712
434
logger.info(u"TCP connection from: %s",
713
unicode(self.client_address))
714
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
715
# Open IPC pipe to parent process
716
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
717
session = (gnutls.connection
718
.ClientSession(self.request,
719
gnutls.connection
720
.X509Credentials()))
721
722
line = self.request.makefile().readline()
723
logger.debug(u"Protocol version: %r", line)
724
try:
725
if int(line.strip().split()[0]) > 1:
726
raise RuntimeError
727
except (ValueError, IndexError, RuntimeError), error:
728
logger.error(u"Unknown protocol version: %s", error)
729
return
730
731
# Note: gnutls.connection.X509Credentials is really a
732
# generic GnuTLS certificate credentials object so long as
733
# no X.509 keys are added to it. Therefore, we can use it
734
# here despite using OpenPGP certificates.
735
736
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
737
# u"+AES-256-CBC", u"+SHA1",
738
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
739
# u"+DHE-DSS"))
740
# Use a fallback default, since this MUST be set.
741
priority = self.server.gnutls_priority
742
if priority is None:
743
priority = u"NORMAL"
744
(gnutls.library.functions
745
.gnutls_priority_set_direct(session._c_object,
746
priority, None))
747
748
try:
749
session.handshake()
750
except gnutls.errors.GNUTLSError, error:
751
logger.warning(u"Handshake failed: %s", error)
752
# Do not run session.bye() here: the session is not
753
# established. Just abandon the request.
754
return
755
logger.debug(u"Handshake succeeded")
756
try:
757
fpr = self.fingerprint(self.peer_certificate(session))
758
except (TypeError, gnutls.errors.GNUTLSError), error:
759
logger.warning(u"Bad certificate: %s", error)
760
session.bye()
761
return
762
logger.debug(u"Fingerprint: %s", fpr)
763
764
for c in self.server.clients:
765
if c.fingerprint == fpr:
766
client = c
767
break
768
else:
769
ipc.write(u"NOTFOUND %s\n" % fpr)
770
session.bye()
771
return
772
# Have to check if client.still_valid(), since it is
773
# possible that the client timed out while establishing
774
# the GnuTLS session.
775
if not client.still_valid():
776
ipc.write(u"INVALID %s\n" % client.name)
777
session.bye()
778
return
779
ipc.write(u"SENDING %s\n" % client.name)
780
sent_size = 0
781
while sent_size < len(client.secret):
782
sent = session.send(client.secret[sent_size:])
783
logger.debug(u"Sent: %d, remaining: %d",
784
sent, len(client.secret)
785
- (sent_size + sent))
786
sent_size += sent
787
session.bye()
788
789
@staticmethod
790
def peer_certificate(session):
791
"Return the peer's OpenPGP certificate as a bytestring"
792
# If not an OpenPGP certificate...
793
if (gnutls.library.functions
794
.gnutls_certificate_type_get(session._c_object)
795
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
796
# ...do the normal thing
797
return session.peer_certificate
798
list_size = ctypes.c_uint(1)
799
cert_list = (gnutls.library.functions
800
.gnutls_certificate_get_peers
801
(session._c_object, ctypes.byref(list_size)))
802
if not bool(cert_list) and list_size.value != 0:
803
raise gnutls.errors.GNUTLSError(u"error getting peer"
804
u" certificate")
805
if list_size.value == 0:
806
return None
807
cert = cert_list[0]
808
return ctypes.string_at(cert.data, cert.size)
809
810
@staticmethod
811
def fingerprint(openpgp):
812
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
813
# New GnuTLS "datum" with the OpenPGP public key
814
datum = (gnutls.library.types
815
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
816
ctypes.POINTER
817
(ctypes.c_ubyte)),
818
ctypes.c_uint(len(openpgp))))
819
# New empty GnuTLS certificate
820
crt = gnutls.library.types.gnutls_openpgp_crt_t()
821
(gnutls.library.functions
822
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
823
# Import the OpenPGP public key into the certificate
824
(gnutls.library.functions
825
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
826
gnutls.library.constants
827
.GNUTLS_OPENPGP_FMT_RAW))
828
# Verify the self signature in the key
829
crtverify = ctypes.c_uint()
830
(gnutls.library.functions
831
.gnutls_openpgp_crt_verify_self(crt, 0,
832
ctypes.byref(crtverify)))
833
if crtverify.value != 0:
834
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
835
raise (gnutls.errors.CertificateSecurityError
836
(u"Verify failed"))
837
# New buffer for the fingerprint
838
buf = ctypes.create_string_buffer(20)
839
buf_len = ctypes.c_size_t()
840
# Get the fingerprint from the certificate into the buffer
841
(gnutls.library.functions
842
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
843
ctypes.byref(buf_len)))
844
# Deinit the certificate
845
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
846
# Convert the buffer to a Python bytestring
847
fpr = ctypes.string_at(buf, buf_len.value)
848
# Convert the bytestring to hexadecimal notation
849
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
850
return hex_fpr
851
852
853
class ForkingMixInWithPipe(SocketServer.ForkingMixIn, object):
854
"""Like SocketServer.ForkingMixIn, but also pass a pipe.
855
856
Assumes a gobject.MainLoop event loop.
857
"""
858
def process_request(self, request, client_address):
859
"""Overrides and wraps the original process_request().
860
861
This function creates a new pipe in self.pipe
862
"""
863
self.pipe = os.pipe()
864
super(ForkingMixInWithPipe,
865
self).process_request(request, client_address)
866
os.close(self.pipe[1]) # close write end
867
# Call "handle_ipc" for both data and EOF events
868
gobject.io_add_watch(self.pipe[0],
869
gobject.IO_IN | gobject.IO_HUP,
870
self.handle_ipc)
871
def handle_ipc(source, condition):
872
"""Dummy function; override as necessary"""
873
os.close(source)
874
return False
875
876
877
class IPv6_TCPServer(ForkingMixInWithPipe,
878
SocketServer.TCPServer, object):
879
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
880
435
unicode(self.client_address))
436
session = gnutls.connection.ClientSession\
437
(self.request, gnutls.connection.X509Credentials())
438
439
line = self.request.makefile().readline()
440
logger.debug(u"Protocol version: %r", line)
441
try:
442
if int(line.strip().split()[0]) > 1:
443
raise RuntimeError
444
except (ValueError, IndexError, RuntimeError), error:
445
logger.error(u"Unknown protocol version: %s", error)
446
return
447
448
# Note: gnutls.connection.X509Credentials is really a generic
449
# GnuTLS certificate credentials object so long as no X.509
450
# keys are added to it. Therefore, we can use it here despite
451
# using OpenPGP certificates.
452
453
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
454
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
455
# "+DHE-DSS"))
456
priority = "NORMAL" # Fallback default, since this
457
# MUST be set.
458
if self.server.settings["priority"]:
459
priority = self.server.settings["priority"]
460
gnutls.library.functions.gnutls_priority_set_direct\
461
(session._c_object, priority, None);
462
463
try:
464
session.handshake()
465
except gnutls.errors.GNUTLSError, error:
466
logger.warning(u"Handshake failed: %s", error)
467
# Do not run session.bye() here: the session is not
468
# established. Just abandon the request.
469
return
470
try:
471
fpr = fingerprint(peer_certificate(session))
472
except (TypeError, gnutls.errors.GNUTLSError), error:
473
logger.warning(u"Bad certificate: %s", error)
474
session.bye()
475
return
476
logger.debug(u"Fingerprint: %s", fpr)
477
client = None
478
for c in self.server.clients:
479
if c.fingerprint == fpr:
480
client = c
481
break
482
if not client:
483
logger.warning(u"Client not found for fingerprint: %s",
484
fpr)
485
session.bye()
486
return
487
# Have to check if client.still_valid(), since it is possible
488
# that the client timed out while establishing the GnuTLS
489
# session.
490
if not client.still_valid():
491
logger.warning(u"Client %(name)s is invalid",
492
vars(client))
493
session.bye()
494
return
495
sent_size = 0
496
while sent_size < len(client.secret):
497
sent = session.send(client.secret[sent_size:])
498
logger.debug(u"Sent: %d, remaining: %d",
499
sent, len(client.secret)
500
- (sent_size + sent))
501
sent_size += sent
502
session.bye()
503
504
505
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
506
"""IPv6 TCP server. Accepts 'None' as address and/or port.
881
507
Attributes:
882
enabled: Boolean; whether this server is activated yet
883
interface: None or a network interface name (string)
884
use_ipv6: Boolean; to use IPv6 or not
885
----
508
settings: Server settings
886
509
clients: Set() of Client objects
887
gnutls_priority GnuTLS priority string
888
use_dbus: Boolean; to emit D-Bus signals or not
889
510
"""
890
def __init__(self, server_address, RequestHandlerClass,
891
interface=None, use_ipv6=True, clients=None,
892
gnutls_priority=None, use_dbus=True):
893
self.enabled = False
894
self.interface = interface
895
if use_ipv6:
896
self.address_family = socket.AF_INET6
897
self.clients = clients
898
self.use_dbus = use_dbus
899
self.gnutls_priority = gnutls_priority
900
SocketServer.TCPServer.__init__(self, server_address,
901
RequestHandlerClass)
511
address_family = socket.AF_INET6
512
def __init__(self, *args, **kwargs):
513
if "settings" in kwargs:
514
self.settings = kwargs["settings"]
515
del kwargs["settings"]
516
if "clients" in kwargs:
517
self.clients = kwargs["clients"]
518
del kwargs["clients"]
519
return super(type(self), self).__init__(*args, **kwargs)
902
520
def server_bind(self):
903
521
"""This overrides the normal server_bind() function
904
522
to bind to an interface if one was specified, and also NOT to
905
523
bind to an address or port if they were not specified."""
906
if self.interface is not None:
524
if self.settings["interface"]:
525
# 25 is from /usr/include/asm-i486/socket.h
526
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
907
527
try:
908
528
self.socket.setsockopt(socket.SOL_SOCKET,
909
529
SO_BINDTODEVICE,
910
str(self.interface + u'\0'))
530
self.settings["interface"])
911
531
except socket.error, error:
912
532
if error[0] == errno.EPERM:
913
533
logger.error(u"No permission to"
914
534
u" bind to interface %s",
915
self.interface)
535
self.settings["interface"])
916
536
else:
917
raise
537
raise error
918
538
# Only bind(2) the socket if we really need to.
919
539
if self.server_address[0] or self.server_address[1]:
920
540
if not self.server_address[0]:
921
if self.address_family == socket.AF_INET6:
922
any_address = u"::" # in6addr_any
923
else:
924
any_address = socket.INADDR_ANY
925
self.server_address = (any_address,
541
in6addr_any = "::"
542
self.server_address = (in6addr_any,
926
543
self.server_address[1])
927
544
elif not self.server_address[1]:
928
545
self.server_address = (self.server_address[0],
929
546
0)
930
# if self.interface:
547
# if self.settings["interface"]:
931
548
# self.server_address = (self.server_address[0],
932
549
# 0, # port
933
550
# 0, # flowinfo
934
551
# if_nametoindex
935
# (self.interface))
936
return SocketServer.TCPServer.server_bind(self)
937
def server_activate(self):
938
if self.enabled:
939
return SocketServer.TCPServer.server_activate(self)
940
def enable(self):
941
self.enabled = True
942
def handle_ipc(self, source, condition, file_objects={}):
943
condition_names = {
944
gobject.IO_IN: u"IN", # There is data to read.
945
gobject.IO_OUT: u"OUT", # Data can be written (without
946
# blocking).
947
gobject.IO_PRI: u"PRI", # There is urgent data to read.
948
gobject.IO_ERR: u"ERR", # Error condition.
949
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
950
# broken, usually for pipes and
951
# sockets).
952
}
953
conditions_string = ' | '.join(name
954
for cond, name in
955
condition_names.iteritems()
956
if cond & condition)
957
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
958
conditions_string)
959
960
# Turn the pipe file descriptor into a Python file object
961
if source not in file_objects:
962
file_objects[source] = os.fdopen(source, u"r", 1)
963
964
# Read a line from the file object
965
cmdline = file_objects[source].readline()
966
if not cmdline: # Empty line means end of file
967
# close the IPC pipe
968
file_objects[source].close()
969
del file_objects[source]
970
971
# Stop calling this function
972
return False
973
974
logger.debug(u"IPC command: %r", cmdline)
975
976
# Parse and act on command
977
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
978
979
if cmd == u"NOTFOUND":
980
logger.warning(u"Client not found for fingerprint: %s",
981
args)
982
if self.use_dbus:
983
# Emit D-Bus signal
984
mandos_dbus_service.ClientNotFound(args)
985
elif cmd == u"INVALID":
986
for client in self.clients:
987
if client.name == args:
988
logger.warning(u"Client %s is invalid", args)
989
if self.use_dbus:
990
# Emit D-Bus signal
991
client.Rejected()
992
break
993
else:
994
logger.error(u"Unknown client %s is invalid", args)
995
elif cmd == u"SENDING":
996
for client in self.clients:
997
if client.name == args:
998
logger.info(u"Sending secret to %s", client.name)
999
client.checked_ok()
1000
if self.use_dbus:
1001
# Emit D-Bus signal
1002
client.ReceivedSecret()
1003
break
1004
else:
1005
logger.error(u"Sending secret to unknown client %s",
1006
args)
1007
else:
1008
logger.error(u"Unknown IPC command: %r", cmdline)
1009
1010
# Keep calling this function
1011
return True
552
# (self.settings
553
# ["interface"]))
554
return super(type(self), self).server_bind()
1012
555
1013
556
1014
557
def string_to_delta(interval):
1015
558
"""Parse a string and return a datetime.timedelta
1016
1017
>>> string_to_delta(u'7d')
559
560
>>> string_to_delta('7d')
1018
561
datetime.timedelta(7)
1019
>>> string_to_delta(u'60s')
562
>>> string_to_delta('60s')
1020
563
datetime.timedelta(0, 60)
1021
>>> string_to_delta(u'60m')
564
>>> string_to_delta('60m')
1022
565
datetime.timedelta(0, 3600)
1023
>>> string_to_delta(u'24h')
566
>>> string_to_delta('24h')
1024
567
datetime.timedelta(1)
1025
568
>>> string_to_delta(u'1w')
1026
569
datetime.timedelta(7)
1027
>>> string_to_delta(u'5m 30s')
570
>>> string_to_delta('5m 30s')
1028
571
datetime.timedelta(0, 330)
1029
572
"""
1030
573
timevalue = datetime.timedelta(0)
1031
574
for s in interval.split():
1032
575
try:
1033
suffix = unicode(s[-1])
1034
value = int(s[:-1])
576
suffix=unicode(s[-1])
577
value=int(s[:-1])
1035
578
if suffix == u"d":
1036
579
delta = datetime.timedelta(value)
1037
580
elif suffix == u"s":
1053
596
def server_state_changed(state):
1054
597
"""Derived from the Avahi example code"""
1055
598
if state == avahi.SERVER_COLLISION:
1056
logger.error(u"Zeroconf server name collision")
599
logger.error(u"Server name collision")
1057
600
service.remove()
1058
601
elif state == avahi.SERVER_RUNNING:
1059
602
service.add()
1061
604
1062
605
def entry_group_state_changed(state, error):
1063
606
"""Derived from the Avahi example code"""
1064
logger.debug(u"Avahi state change: %i", state)
607
logger.debug(u"state change: %i", state)
1065
608
1066
609
if state == avahi.ENTRY_GROUP_ESTABLISHED:
1067
logger.debug(u"Zeroconf service established.")
610
logger.debug(u"Service established.")
1068
611
elif state == avahi.ENTRY_GROUP_COLLISION:
1069
logger.warning(u"Zeroconf service name collision.")
612
logger.warning(u"Service name collision.")
1070
613
service.rename()
1071
614
elif state == avahi.ENTRY_GROUP_FAILURE:
1072
logger.critical(u"Avahi: Error in group state changed %s",
615
logger.critical(u"Error in group state changed %s",
1073
616
unicode(error))
1074
raise AvahiGroupError(u"State changed: %s" % unicode(error))
617
raise AvahiGroupError("State changed: %s", str(error))
1075
618
1076
619
def if_nametoindex(interface):
1077
"""Call the C function if_nametoindex(), or equivalent
1078
1079
Note: This function cannot accept a unicode string."""
620
"""Call the C function if_nametoindex(), or equivalent"""
1080
621
global if_nametoindex
1081
622
try:
1082
if_nametoindex = (ctypes.cdll.LoadLibrary
1083
(ctypes.util.find_library(u"c"))
1084
.if_nametoindex)
623
if "ctypes.util" not in sys.modules:
624
import ctypes.util
625
if_nametoindex = ctypes.cdll.LoadLibrary\
626
(ctypes.util.find_library("c")).if_nametoindex
1085
627
except (OSError, AttributeError):
1086
logger.warning(u"Doing if_nametoindex the hard way")
628
if "struct" not in sys.modules:
629
import struct
630
if "fcntl" not in sys.modules:
631
import fcntl
1087
632
def if_nametoindex(interface):
1088
633
"Get an interface index the hard way, i.e. using fcntl()"
1089
634
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1090
with closing(socket.socket()) as s:
1091
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1092
struct.pack(str(u"16s16x"),
1093
interface))
1094
interface_index = struct.unpack(str(u"I"),
1095
ifreq[16:20])[0]
635
s = socket.socket()
636
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
637
struct.pack("16s16x", interface))
638
s.close()
639
interface_index = struct.unpack("I", ifreq[16:20])[0]
1096
640
return interface_index
1097
641
return if_nametoindex(interface)
1098
642
1099
643
1100
644
def daemon(nochdir = False, noclose = False):
1101
645
"""See daemon(3). Standard BSD Unix function.
1102
1103
646
This should really exist as os.daemon, but it doesn't (yet)."""
1104
647
if os.fork():
1105
648
sys.exit()
1106
649
os.setsid()
1107
650
if not nochdir:
1108
os.chdir(u"/")
651
os.chdir("/")
1109
652
if os.fork():
1110
653
sys.exit()
1111
654
if not noclose:
1113
656
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1114
657
if not stat.S_ISCHR(os.fstat(null).st_mode):
1115
658
raise OSError(errno.ENODEV,
1116
u"/dev/null not a character device")
659
"/dev/null not a character device")
1117
660
os.dup2(null, sys.stdin.fileno())
1118
661
os.dup2(null, sys.stdout.fileno())
1119
662
os.dup2(null, sys.stderr.fileno())
1122
665
1123
666
1124
667
def main():
1125
1126
######################################################################
1127
# Parsing of options, both command line and config file
1128
1129
parser = optparse.OptionParser(version = "%%prog %s" % version)
1130
parser.add_option("-i", u"--interface", type=u"string",
1131
metavar="IF", help=u"Bind to interface IF")
1132
parser.add_option("-a", u"--address", type=u"string",
1133
help=u"Address to listen for requests on")
1134
parser.add_option("-p", u"--port", type=u"int",
1135
help=u"Port number to receive requests on")
1136
parser.add_option("--check", action=u"store_true",
1137
help=u"Run self-test")
1138
parser.add_option("--debug", action=u"store_true",
1139
help=u"Debug mode; run in foreground and log to"
1140
u" terminal")
1141
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1142
u" priority string (see GnuTLS documentation)")
1143
parser.add_option("--servicename", type=u"string",
1144
metavar=u"NAME", help=u"Zeroconf service name")
1145
parser.add_option("--configdir", type=u"string",
1146
default=u"/etc/mandos", metavar=u"DIR",
1147
help=u"Directory to search for configuration"
1148
u" files")
1149
parser.add_option("--no-dbus", action=u"store_false",
1150
dest=u"use_dbus", help=u"Do not provide D-Bus"
1151
u" system bus interface")
1152
parser.add_option("--no-ipv6", action=u"store_false",
1153
dest=u"use_ipv6", help=u"Do not use IPv6")
1154
options = parser.parse_args()[0]
668
global main_loop_started
669
main_loop_started = False
670
671
parser = OptionParser(version = "%%prog %s" % version)
672
parser.add_option("-i", "--interface", type="string",
673
metavar="IF", help="Bind to interface IF")
674
parser.add_option("-a", "--address", type="string",
675
help="Address to listen for requests on")
676
parser.add_option("-p", "--port", type="int",
677
help="Port number to receive requests on")
678
parser.add_option("--check", action="store_true", default=False,
679
help="Run self-test")
680
parser.add_option("--debug", action="store_true",
681
help="Debug mode; run in foreground and log to"
682
" terminal")
683
parser.add_option("--priority", type="string", help="GnuTLS"
684
" priority string (see GnuTLS documentation)")
685
parser.add_option("--servicename", type="string", metavar="NAME",
686
help="Zeroconf service name")
687
parser.add_option("--configdir", type="string",
688
default="/etc/mandos", metavar="DIR",
689
help="Directory to search for configuration"
690
" files")
691
(options, args) = parser.parse_args()
1155
692
1156
693
if options.check:
1157
694
import doctest
1159
696
sys.exit()
1160
697
1161
698
# Default values for config file for server-global settings
1162
server_defaults = { u"interface": u"",
1163
u"address": u"",
1164
u"port": u"",
1165
u"debug": u"False",
1166
u"priority":
1167
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1168
u"servicename": u"Mandos",
1169
u"use_dbus": u"True",
1170
u"use_ipv6": u"True",
699
server_defaults = { "interface": "",
700
"address": "",
701
"port": "",
702
"debug": "False",
703
"priority":
704
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
705
"servicename": "Mandos",
1171
706
}
1172
707
1173
708
# Parse config file for server-global settings
1174
709
server_config = ConfigParser.SafeConfigParser(server_defaults)
1175
710
del server_defaults
1176
server_config.read(os.path.join(options.configdir,
1177
u"mandos.conf"))
711
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1178
712
# Convert the SafeConfigParser object to a dict
1179
713
server_settings = server_config.defaults()
1180
# Use the appropriate methods on the non-string config options
1181
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1182
server_settings[option] = server_config.getboolean(u"DEFAULT",
1183
option)
1184
if server_settings["port"]:
1185
server_settings["port"] = server_config.getint(u"DEFAULT",
1186
u"port")
714
# Use getboolean on the boolean config option
715
server_settings["debug"] = server_config.getboolean\
716
("DEFAULT", "debug")
1187
717
del server_config
1188
718
1189
719
# Override the settings from the config file with command line
1190
720
# options, if set.
1191
for option in (u"interface", u"address", u"port", u"debug",
1192
u"priority", u"servicename", u"configdir",
1193
u"use_dbus", u"use_ipv6"):
721
for option in ("interface", "address", "port", "debug",
722
"priority", "servicename", "configdir"):
1194
723
value = getattr(options, option)
1195
724
if value is not None:
1196
725
server_settings[option] = value
1197
726
del options
1198
# Force all strings to be unicode
1199
for option in server_settings.keys():
1200
if type(server_settings[option]) is str:
1201
server_settings[option] = unicode(server_settings[option])
1202
727
# Now we have our good server settings in "server_settings"
1203
728
1204
##################################################################
1205
1206
# For convenience
1207
debug = server_settings[u"debug"]
1208
use_dbus = server_settings[u"use_dbus"]
1209
use_ipv6 = server_settings[u"use_ipv6"]
729
debug = server_settings["debug"]
1210
730
1211
731
if not debug:
1212
732
syslogger.setLevel(logging.WARNING)
1213
733
console.setLevel(logging.WARNING)
1214
734
1215
if server_settings[u"servicename"] != u"Mandos":
1216
syslogger.setFormatter(logging.Formatter
1217
(u'Mandos (%s) [%%(process)d]:'
1218
u' %%(levelname)s: %%(message)s'
1219
% server_settings[u"servicename"]))
735
if server_settings["servicename"] != "Mandos":
736
syslogger.setFormatter(logging.Formatter\
737
('Mandos (%s): %%(levelname)s:'
738
' %%(message)s'
739
% server_settings["servicename"]))
1220
740
1221
741
# Parse config file with clients
1222
client_defaults = { u"timeout": u"1h",
1223
u"interval": u"5m",
1224
u"checker": u"fping -q -- %%(host)s",
1225
u"host": u"",
742
client_defaults = { "timeout": "1h",
743
"interval": "5m",
744
"checker": "fping -q -- %(host)s",
745
"host": "",
1226
746
}
1227
747
client_config = ConfigParser.SafeConfigParser(client_defaults)
1228
client_config.read(os.path.join(server_settings[u"configdir"],
1229
u"clients.conf"))
1230
1231
global mandos_dbus_service
1232
mandos_dbus_service = None
1233
1234
clients = Set()
1235
tcp_server = IPv6_TCPServer((server_settings[u"address"],
1236
server_settings[u"port"]),
1237
ClientHandler,
1238
interface=
1239
server_settings[u"interface"],
1240
use_ipv6=use_ipv6,
1241
clients=clients,
1242
gnutls_priority=
1243
server_settings[u"priority"],
1244
use_dbus=use_dbus)
1245
pidfilename = u"/var/run/mandos.pid"
1246
try:
1247
pidfile = open(pidfilename, u"w")
1248
except IOError:
1249
logger.error(u"Could not open file %r", pidfilename)
1250
1251
try:
1252
uid = pwd.getpwnam(u"_mandos").pw_uid
1253
gid = pwd.getpwnam(u"_mandos").pw_gid
1254
except KeyError:
1255
try:
1256
uid = pwd.getpwnam(u"mandos").pw_uid
1257
gid = pwd.getpwnam(u"mandos").pw_gid
1258
except KeyError:
1259
try:
1260
uid = pwd.getpwnam(u"nobody").pw_uid
1261
gid = pwd.getpwnam(u"nobody").pw_gid
1262
except KeyError:
1263
uid = 65534
1264
gid = 65534
1265
try:
1266
os.setgid(gid)
1267
os.setuid(uid)
1268
except OSError, error:
1269
if error[0] != errno.EPERM:
1270
raise error
1271
1272
# Enable all possible GnuTLS debugging
1273
if debug:
1274
# "Use a log level over 10 to enable all debugging options."
1275
# - GnuTLS manual
1276
gnutls.library.functions.gnutls_global_set_log_level(11)
1277
1278
@gnutls.library.types.gnutls_log_func
1279
def debug_gnutls(level, string):
1280
logger.debug(u"GnuTLS: %s", string[:-1])
1281
1282
(gnutls.library.functions
1283
.gnutls_global_set_log_function(debug_gnutls))
748
client_config.read(os.path.join(server_settings["configdir"],
749
"clients.conf"))
1284
750
1285
751
global service
1286
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1287
service = AvahiService(name = server_settings[u"servicename"],
1288
servicetype = u"_mandos._tcp",
1289
protocol = protocol)
752
service = AvahiService(name = server_settings["servicename"],
753
type = "_mandos._tcp", );
1290
754
if server_settings["interface"]:
1291
service.interface = (if_nametoindex
1292
(str(server_settings[u"interface"])))
755
service.interface = if_nametoindex(server_settings["interface"])
1293
756
1294
757
global main_loop
1295
758
global bus
1298
761
DBusGMainLoop(set_as_default=True )
1299
762
main_loop = gobject.MainLoop()
1300
763
bus = dbus.SystemBus()
1301
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1302
avahi.DBUS_PATH_SERVER),
1303
avahi.DBUS_INTERFACE_SERVER)
764
server = dbus.Interface(
765
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
766
avahi.DBUS_INTERFACE_SERVER )
1304
767
# End of Avahi example code
1305
if use_dbus:
1306
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1307
1308
client_class = Client
1309
if use_dbus:
1310
client_class = ClientDBus
1311
clients.update(Set(
1312
client_class(name = section,
1313
config= dict(client_config.items(section)))
1314
for section in client_config.sections()))
768
769
clients = Set()
770
def remove_from_clients(client):
771
clients.remove(client)
772
if not clients:
773
logger.critical(u"No clients left, exiting")
774
sys.exit()
775
776
clients.update(Set(Client(name = section,
777
stop_hook = remove_from_clients,
778
config
779
= dict(client_config.items(section)))
780
for section in client_config.sections()))
1315
781
if not clients:
1316
logger.warning(u"No clients defined")
782
logger.critical(u"No clients defined")
783
sys.exit(1)
1317
784
1318
785
if debug:
1319
786
# Redirect stdin so all checkers get /dev/null
1327
794
# Close all input and output, do double fork, etc.
1328
795
daemon()
1329
796
797
pidfilename = "/var/run/mandos/mandos.pid"
798
pid = os.getpid()
1330
799
try:
1331
with closing(pidfile):
1332
pid = os.getpid()
1333
pidfile.write(str(pid) + "\n")
800
pidfile = open(pidfilename, "w")
801
pidfile.write(str(pid) + "\n")
802
pidfile.close()
1334
803
del pidfile
1335
except IOError:
1336
logger.error(u"Could not write to file %r with PID %d",
1337
pidfilename, pid)
1338
except NameError:
1339
# "pidfile" was never created
1340
pass
1341
del pidfilename
804
except IOError, err:
805
logger.error(u"Could not write %s file with PID %d",
806
pidfilename, os.getpid())
1342
807
1343
808
def cleanup():
1344
809
"Cleanup function; run on exit"
1351
816
1352
817
while clients:
1353
818
client = clients.pop()
1354
client.disable_hook = None
1355
client.disable()
819
client.stop_hook = None
820
client.stop()
1356
821
1357
822
atexit.register(cleanup)
1358
823
1361
826
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1362
827
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1363
828
1364
if use_dbus:
1365
class MandosDBusService(dbus.service.Object):
1366
"""A D-Bus proxy object"""
1367
def __init__(self):
1368
dbus.service.Object.__init__(self, bus, u"/")
1369
_interface = u"se.bsnet.fukt.Mandos"
1370
1371
@dbus.service.signal(_interface, signature=u"oa{sv}")
1372
def ClientAdded(self, objpath, properties):
1373
"D-Bus signal"
1374
pass
1375
1376
@dbus.service.signal(_interface, signature=u"s")
1377
def ClientNotFound(self, fingerprint):
1378
"D-Bus signal"
1379
pass
1380
1381
@dbus.service.signal(_interface, signature=u"os")
1382
def ClientRemoved(self, objpath, name):
1383
"D-Bus signal"
1384
pass
1385
1386
@dbus.service.method(_interface, out_signature=u"ao")
1387
def GetAllClients(self):
1388
"D-Bus method"
1389
return dbus.Array(c.dbus_object_path for c in clients)
1390
1391
@dbus.service.method(_interface,
1392
out_signature=u"a{oa{sv}}")
1393
def GetAllClientsWithProperties(self):
1394
"D-Bus method"
1395
return dbus.Dictionary(
1396
((c.dbus_object_path, c.GetAllProperties())
1397
for c in clients),
1398
signature=u"oa{sv}")
1399
1400
@dbus.service.method(_interface, in_signature=u"o")
1401
def RemoveClient(self, object_path):
1402
"D-Bus method"
1403
for c in clients:
1404
if c.dbus_object_path == object_path:
1405
clients.remove(c)
1406
c.remove_from_connection()
1407
# Don't signal anything except ClientRemoved
1408
c.disable(signal=False)
1409
# Emit D-Bus signal
1410
self.ClientRemoved(object_path, c.name)
1411
return
1412
raise KeyError
1413
1414
del _interface
1415
1416
mandos_dbus_service = MandosDBusService()
1417
1418
829
for client in clients:
1419
if use_dbus:
1420
# Emit D-Bus signal
1421
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1422
client.GetAllProperties())
1423
client.enable()
1424
1425
tcp_server.enable()
1426
tcp_server.server_activate()
1427
830
client.start()
831
832
tcp_server = IPv6_TCPServer((server_settings["address"],
833
server_settings["port"]),
834
tcp_handler,
835
settings=server_settings,
836
clients=clients)
1428
837
# Find out what port we got
1429
838
service.port = tcp_server.socket.getsockname()[1]
1430
if use_ipv6:
1431
logger.info(u"Now listening on address %r, port %d,"
1432
" flowinfo %d, scope_id %d"
1433
% tcp_server.socket.getsockname())
1434
else: # IPv4
1435
logger.info(u"Now listening on address %r, port %d"
1436
% tcp_server.socket.getsockname())
839
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
840
u" scope_id %d" % tcp_server.socket.getsockname())
1437
841
1438
842
#service.interface = tcp_server.socket.getsockname()[3]
1439
843
1440
844
try:
1441
845
# From the Avahi example code
1442
server.connect_to_signal(u"StateChanged", server_state_changed)
846
server.connect_to_signal("StateChanged", server_state_changed)
1443
847
try:
1444
848
server_state_changed(server.GetState())
1445
849
except dbus.exceptions.DBusException, error:
1449
853
1450
854
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1451
855
lambda *args, **kwargs:
1452
(tcp_server.handle_request
1453
(*args[2:], **kwargs) or True))
856
tcp_server.handle_request\
857
(*args[2:], **kwargs) or True)
1454
858
1455
859
logger.debug(u"Starting main loop")
860
main_loop_started = True
1456
861
main_loop.run()
1457
862
except AvahiError, error:
1458
logger.critical(u"AvahiError: %s", error)
863
logger.critical(u"AvahiError: %s" + unicode(error))
1459
864
sys.exit(1)
1460
865
except KeyboardInterrupt:
1461
866
if debug:
1462
print >> sys.stderr
1463
logger.debug(u"Server received KeyboardInterrupt")
1464
logger.debug(u"Server exiting")
867
print
1465
868
1466
869
if __name__ == '__main__':
1467
870
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0