To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 312
- compare with another revision
- download diff
- download tarball
- view history from revision 312
- Committer: Teddy Hogeborn
- Date: 2009-02-12 19:08:35 UTC
- Revision ID: teddy@fukt.bsnet.se-20090212190835-dqv0piw2u254d0jc
* plugin-runner.c: Whitespace changes only.
- files modified:
- INSTALL
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
14
# Copyright © 2008,2009 Teddy Hogeborn
33
33
34
34
from __future__ import division, with_statement, absolute_import
35
35
36
import SocketServer as socketserver
36
import SocketServer
37
37
import socket
38
38
import optparse
39
39
import datetime
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
import ConfigParser as configparser
47
import ConfigParser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
from sets import Set
52
53
import subprocess
53
54
import atexit
54
55
import stat
56
57
import logging.handlers
57
58
import pwd
58
59
from contextlib import closing
59
import struct
60
import fcntl
61
import functools
62
60
63
61
import dbus
64
62
import dbus.service
68
66
import ctypes
69
67
import ctypes.util
70
68
71
try:
72
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
73
except AttributeError:
74
try:
75
from IN import SO_BINDTODEVICE
76
except ImportError:
77
SO_BINDTODEVICE = None
78
79
80
version = "1.0.8"
81
82
logger = logging.Logger(u'mandos')
69
version = "1.0.5"
70
71
logger = logging.Logger('mandos')
83
72
syslogger = (logging.handlers.SysLogHandler
84
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
85
74
address = "/dev/log"))
86
75
syslogger.setFormatter(logging.Formatter
87
(u'Mandos [%(process)d]: %(levelname)s:'
88
u' %(message)s'))
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
89
78
logger.addHandler(syslogger)
90
79
91
80
console = logging.StreamHandler()
92
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
93
u' %(levelname)s:'
94
u' %(message)s'))
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
95
83
logger.addHandler(console)
96
84
97
85
class AvahiError(Exception):
110
98
111
99
class AvahiService(object):
112
100
"""An Avahi (Zeroconf) service.
113
114
101
Attributes:
115
102
interface: integer; avahi.IF_UNSPEC or an interface index.
116
103
Used to optionally bind to the specified interface.
117
name: string; Example: u'Mandos'
118
type: string; Example: u'_mandos._tcp'.
104
name: string; Example: 'Mandos'
105
type: string; Example: '_mandos._tcp'.
119
106
See <http://www.dns-sd.org/ServiceTypes.html>
120
107
port: integer; what port to announce
121
108
TXT: list of strings; TXT record for the service
124
111
max_renames: integer; maximum number of renames
125
112
rename_count: integer; counter so we only rename after collisions
126
113
a sensible number of times
127
group: D-Bus Entry Group
128
server: D-Bus Server
129
bus: dbus.SystemBus()
130
114
"""
131
115
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
132
116
servicetype = None, port = None, TXT = None,
133
domain = u"", host = u"", max_renames = 32768,
134
protocol = avahi.PROTO_UNSPEC, bus = None):
117
domain = "", host = "", max_renames = 32768):
135
118
self.interface = interface
136
119
self.name = name
137
120
self.type = servicetype
141
124
self.host = host
142
125
self.rename_count = 0
143
126
self.max_renames = max_renames
144
self.protocol = protocol
145
self.group = None # our entry group
146
self.server = None
147
self.bus = bus
148
127
def rename(self):
149
128
"""Derived from the Avahi example code"""
150
129
if self.rename_count >= self.max_renames:
152
131
u" after %i retries, exiting.",
153
132
self.rename_count)
154
133
raise AvahiServiceError(u"Too many renames")
155
self.name = self.server.GetAlternativeServiceName(self.name)
134
self.name = server.GetAlternativeServiceName(self.name)
156
135
logger.info(u"Changing Zeroconf service name to %r ...",
157
unicode(self.name))
136
str(self.name))
158
137
syslogger.setFormatter(logging.Formatter
159
(u'Mandos (%s) [%%(process)d]:'
160
u' %%(levelname)s: %%(message)s'
161
% self.name))
138
('Mandos (%s): %%(levelname)s:'
139
' %%(message)s' % self.name))
162
140
self.remove()
163
141
self.add()
164
142
self.rename_count += 1
165
143
def remove(self):
166
144
"""Derived from the Avahi example code"""
167
if self.group is not None:
168
self.group.Reset()
145
if group is not None:
146
group.Reset()
169
147
def add(self):
170
148
"""Derived from the Avahi example code"""
171
if self.group is None:
172
self.group = dbus.Interface(
173
self.bus.get_object(avahi.DBUS_NAME,
174
self.server.EntryGroupNew()),
175
avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
self.group.connect_to_signal('StateChanged',
177
self.entry_group_state_changed)
149
global group
150
if group is None:
151
group = dbus.Interface(bus.get_object
152
(avahi.DBUS_NAME,
153
server.EntryGroupNew()),
154
avahi.DBUS_INTERFACE_ENTRY_GROUP)
155
group.connect_to_signal('StateChanged',
156
entry_group_state_changed)
178
157
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
179
self.name, self.type)
180
self.group.AddService(
181
self.interface,
182
self.protocol,
183
dbus.UInt32(0), # flags
184
self.name, self.type,
185
self.domain, self.host,
186
dbus.UInt16(self.port),
187
avahi.string_array_to_txt_array(self.TXT))
188
self.group.Commit()
189
def entry_group_state_changed(self, state, error):
190
"""Derived from the Avahi example code"""
191
logger.debug(u"Avahi state change: %i", state)
192
193
if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
logger.debug(u"Zeroconf service established.")
195
elif state == avahi.ENTRY_GROUP_COLLISION:
196
logger.warning(u"Zeroconf service name collision.")
197
self.rename()
198
elif state == avahi.ENTRY_GROUP_FAILURE:
199
logger.critical(u"Avahi: Error in group state changed %s",
200
unicode(error))
201
raise AvahiGroupError(u"State changed: %s"
202
% unicode(error))
203
def cleanup(self):
204
"""Derived from the Avahi example code"""
205
if self.group is not None:
206
self.group.Free()
207
self.group = None
208
def server_state_changed(self, state):
209
"""Derived from the Avahi example code"""
210
if state == avahi.SERVER_COLLISION:
211
logger.error(u"Zeroconf server name collision")
212
self.remove()
213
elif state == avahi.SERVER_RUNNING:
214
self.add()
215
def activate(self):
216
"""Derived from the Avahi example code"""
217
if self.server is None:
218
self.server = dbus.Interface(
219
self.bus.get_object(avahi.DBUS_NAME,
220
avahi.DBUS_PATH_SERVER),
221
avahi.DBUS_INTERFACE_SERVER)
222
self.server.connect_to_signal(u"StateChanged",
223
self.server_state_changed)
224
self.server_state_changed(self.server.GetState())
225
226
227
class Client(object):
158
service.name, service.type)
159
group.AddService(
160
self.interface, # interface
161
avahi.PROTO_INET6, # protocol
162
dbus.UInt32(0), # flags
163
self.name, self.type,
164
self.domain, self.host,
165
dbus.UInt16(self.port),
166
avahi.string_array_to_txt_array(self.TXT))
167
group.Commit()
168
169
# From the Avahi example code:
170
group = None # our entry group
171
# End of Avahi example code
172
173
174
def _datetime_to_dbus(dt, variant_level=0):
175
"""Convert a UTC datetime.datetime() to a D-Bus type."""
176
return dbus.String(dt.isoformat(), variant_level=variant_level)
177
178
179
class Client(dbus.service.Object):
228
180
"""A representation of a client host served by this server.
229
230
181
Attributes:
231
182
name: string; from the config file, used in log messages and
232
183
D-Bus identifiers
252
203
client lives. %() expansions are done at
253
204
runtime with vars(self) as dict, so that for
254
205
instance %(name)s can be used in the command.
255
current_checker_command: string; current running checker_command
206
use_dbus: bool(); Whether to provide D-Bus interface and signals
207
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
256
208
"""
257
258
@staticmethod
259
def _datetime_to_milliseconds(dt):
260
"Convert a datetime.datetime() to milliseconds"
261
return ((dt.days * 24 * 60 * 60 * 1000)
262
+ (dt.seconds * 1000)
263
+ (dt.microseconds // 1000))
264
265
209
def timeout_milliseconds(self):
266
210
"Return the 'timeout' attribute in milliseconds"
267
return self._datetime_to_milliseconds(self.timeout)
211
return ((self.timeout.days * 24 * 60 * 60 * 1000)
212
+ (self.timeout.seconds * 1000)
213
+ (self.timeout.microseconds // 1000))
268
214
269
215
def interval_milliseconds(self):
270
216
"Return the 'interval' attribute in milliseconds"
271
return self._datetime_to_milliseconds(self.interval)
217
return ((self.interval.days * 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds * 1000)
219
+ (self.interval.microseconds // 1000))
272
220
273
def __init__(self, name = None, disable_hook=None, config=None):
221
def __init__(self, name = None, disable_hook=None, config=None,
222
use_dbus=True):
274
223
"""Note: the 'checker' key in 'config' sets the
275
224
'checker_command' attribute and *not* the 'checker'
276
225
attribute."""
278
227
if config is None:
279
228
config = {}
280
229
logger.debug(u"Creating client %r", self.name)
230
self.use_dbus = False # During __init__
281
231
# Uppercase and remove spaces from fingerprint for later
282
232
# comparison purposes with return value from the fingerprint()
283
233
# function
284
self.fingerprint = (config[u"fingerprint"].upper()
234
self.fingerprint = (config["fingerprint"].upper()
285
235
.replace(u" ", u""))
286
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
287
if u"secret" in config:
288
self.secret = config[u"secret"].decode(u"base64")
289
elif u"secfile" in config:
237
if "secret" in config:
238
self.secret = config["secret"].decode(u"base64")
239
elif "secfile" in config:
290
240
with closing(open(os.path.expanduser
291
241
(os.path.expandvars
292
(config[u"secfile"])))) as secfile:
242
(config["secfile"])))) as secfile:
293
243
self.secret = secfile.read()
294
244
else:
295
245
raise TypeError(u"No secret or secfile for client %s"
296
246
% self.name)
297
self.host = config.get(u"host", u"")
247
self.host = config.get("host", "")
298
248
self.created = datetime.datetime.utcnow()
299
249
self.enabled = False
300
250
self.last_enabled = None
301
251
self.last_checked_ok = None
302
self.timeout = string_to_delta(config[u"timeout"])
303
self.interval = string_to_delta(config[u"interval"])
252
self.timeout = string_to_delta(config["timeout"])
253
self.interval = string_to_delta(config["interval"])
304
254
self.disable_hook = disable_hook
305
255
self.checker = None
306
256
self.checker_initiator_tag = None
307
257
self.disable_initiator_tag = None
308
258
self.checker_callback_tag = None
309
self.checker_command = config[u"checker"]
310
self.current_checker_command = None
259
self.checker_command = config["checker"]
311
260
self.last_connect = None
261
# Only now, when this client is initialized, can it show up on
262
# the D-Bus
263
self.use_dbus = use_dbus
264
if self.use_dbus:
265
self.dbus_object_path = (dbus.ObjectPath
266
("/clients/"
267
+ self.name.replace(".", "_")))
268
dbus.service.Object.__init__(self, bus,
269
self.dbus_object_path)
312
270
313
271
def enable(self):
314
272
"""Start this client's checker and timeout hooks"""
315
if getattr(self, u"enabled", False):
316
# Already enabled
317
return
318
273
self.last_enabled = datetime.datetime.utcnow()
319
274
# Schedule a new checker to be started an 'interval' from now,
320
275
# and every interval from then on.
328
283
(self.timeout_milliseconds(),
329
284
self.disable))
330
285
self.enabled = True
286
if self.use_dbus:
287
# Emit D-Bus signals
288
self.PropertyChanged(dbus.String(u"enabled"),
289
dbus.Boolean(True, variant_level=1))
290
self.PropertyChanged(dbus.String(u"last_enabled"),
291
(_datetime_to_dbus(self.last_enabled,
292
variant_level=1)))
331
293
332
294
def disable(self):
333
295
"""Disable this client."""
334
296
if not getattr(self, "enabled", False):
335
297
return False
336
298
logger.info(u"Disabling client %s", self.name)
337
if getattr(self, u"disable_initiator_tag", False):
299
if getattr(self, "disable_initiator_tag", False):
338
300
gobject.source_remove(self.disable_initiator_tag)
339
301
self.disable_initiator_tag = None
340
if getattr(self, u"checker_initiator_tag", False):
302
if getattr(self, "checker_initiator_tag", False):
341
303
gobject.source_remove(self.checker_initiator_tag)
342
304
self.checker_initiator_tag = None
343
305
self.stop_checker()
344
306
if self.disable_hook:
345
307
self.disable_hook(self)
346
308
self.enabled = False
309
if self.use_dbus:
310
# Emit D-Bus signal
311
self.PropertyChanged(dbus.String(u"enabled"),
312
dbus.Boolean(False, variant_level=1))
347
313
# Do not run this again if called by a gobject.timeout_add
348
314
return False
349
315
355
321
"""The checker has completed, so take appropriate actions."""
356
322
self.checker_callback_tag = None
357
323
self.checker = None
324
if self.use_dbus:
325
# Emit D-Bus signal
326
self.PropertyChanged(dbus.String(u"checker_running"),
327
dbus.Boolean(False, variant_level=1))
358
328
if os.WIFEXITED(condition):
359
329
exitstatus = os.WEXITSTATUS(condition)
360
330
if exitstatus == 0:
364
334
else:
365
335
logger.info(u"Checker for %(name)s failed",
366
336
vars(self))
337
if self.use_dbus:
338
# Emit D-Bus signal
339
self.CheckerCompleted(dbus.Int16(exitstatus),
340
dbus.Int64(condition),
341
dbus.String(command))
367
342
else:
368
343
logger.warning(u"Checker for %(name)s crashed?",
369
344
vars(self))
345
if self.use_dbus:
346
# Emit D-Bus signal
347
self.CheckerCompleted(dbus.Int16(-1),
348
dbus.Int64(condition),
349
dbus.String(command))
370
350
371
351
def checked_ok(self):
372
352
"""Bump up the timeout for this client.
373
374
353
This should only be called when the client has been seen,
375
354
alive and well.
376
355
"""
379
358
self.disable_initiator_tag = (gobject.timeout_add
380
359
(self.timeout_milliseconds(),
381
360
self.disable))
361
if self.use_dbus:
362
# Emit D-Bus signal
363
self.PropertyChanged(
364
dbus.String(u"last_checked_ok"),
365
(_datetime_to_dbus(self.last_checked_ok,
366
variant_level=1)))
382
367
383
368
def start_checker(self):
384
369
"""Start a new checker subprocess if one is not running.
385
386
370
If a checker already exists, leave it running and do
387
371
nothing."""
388
372
# The reason for not killing a running checker is that if we
393
377
# checkers alone, the checker would have to take more time
394
378
# than 'timeout' for the client to be declared invalid, which
395
379
# is as it should be.
396
397
# If a checker exists, make sure it is not a zombie
398
if self.checker is not None:
399
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
400
if pid:
401
logger.warning(u"Checker was a zombie")
402
gobject.source_remove(self.checker_callback_tag)
403
self.checker_callback(pid, status,
404
self.current_checker_command)
405
# Start a new checker if needed
406
380
if self.checker is None:
407
381
try:
408
382
# In case checker_command has exactly one % operator
409
383
command = self.checker_command % self.host
410
384
except TypeError:
411
385
# Escape attributes for the shell
412
escaped_attrs = dict((key,
413
re.escape(unicode(str(val),
414
errors=
415
u'replace')))
386
escaped_attrs = dict((key, re.escape(str(val)))
416
387
for key, val in
417
388
vars(self).iteritems())
418
389
try:
421
392
logger.error(u'Could not format string "%s":'
422
393
u' %s', self.checker_command, error)
423
394
return True # Try again later
424
self.current_checker_command = command
425
395
try:
426
396
logger.info(u"Starting checker %r for %s",
427
397
command, self.name)
431
401
# always replaced by /dev/null.)
432
402
self.checker = subprocess.Popen(command,
433
403
close_fds=True,
434
shell=True, cwd=u"/")
404
shell=True, cwd="/")
405
if self.use_dbus:
406
# Emit D-Bus signal
407
self.CheckerStarted(command)
408
self.PropertyChanged(
409
dbus.String("checker_running"),
410
dbus.Boolean(True, variant_level=1))
435
411
self.checker_callback_tag = (gobject.child_watch_add
436
412
(self.checker.pid,
437
413
self.checker_callback,
453
429
if self.checker_callback_tag:
454
430
gobject.source_remove(self.checker_callback_tag)
455
431
self.checker_callback_tag = None
456
if getattr(self, u"checker", None) is None:
432
if getattr(self, "checker", None) is None:
457
433
return
458
434
logger.debug(u"Stopping checker for %(name)s", vars(self))
459
435
try:
465
441
if error.errno != errno.ESRCH: # No such process
466
442
raise
467
443
self.checker = None
444
if self.use_dbus:
445
self.PropertyChanged(dbus.String(u"checker_running"),
446
dbus.Boolean(False, variant_level=1))
468
447
469
448
def still_valid(self):
470
449
"""Has the timeout not yet passed for this client?"""
471
if not getattr(self, u"enabled", False):
450
if not getattr(self, "enabled", False):
472
451
return False
473
452
now = datetime.datetime.utcnow()
474
453
if self.last_checked_ok is None:
475
454
return now < (self.created + self.timeout)
476
455
else:
477
456
return now < (self.last_checked_ok + self.timeout)
478
479
480
class ClientDBus(Client, dbus.service.Object):
481
"""A Client class using D-Bus
482
483
Attributes:
484
dbus_object_path: dbus.ObjectPath
485
bus: dbus.SystemBus()
486
"""
487
# dbus.service.Object doesn't use super(), so we can't either.
488
489
def __init__(self, bus = None, *args, **kwargs):
490
self.bus = bus
491
Client.__init__(self, *args, **kwargs)
492
# Only now, when this client is initialized, can it show up on
493
# the D-Bus
494
self.dbus_object_path = (dbus.ObjectPath
495
(u"/clients/"
496
+ self.name.replace(u".", u"_")))
497
dbus.service.Object.__init__(self, self.bus,
498
self.dbus_object_path)
499
500
@staticmethod
501
def _datetime_to_dbus(dt, variant_level=0):
502
"""Convert a UTC datetime.datetime() to a D-Bus type."""
503
return dbus.String(dt.isoformat(),
504
variant_level=variant_level)
505
506
def enable(self):
507
oldstate = getattr(self, u"enabled", False)
508
r = Client.enable(self)
509
if oldstate != self.enabled:
510
# Emit D-Bus signals
511
self.PropertyChanged(dbus.String(u"enabled"),
512
dbus.Boolean(True, variant_level=1))
513
self.PropertyChanged(
514
dbus.String(u"last_enabled"),
515
self._datetime_to_dbus(self.last_enabled,
516
variant_level=1))
517
return r
518
519
def disable(self, signal = True):
520
oldstate = getattr(self, u"enabled", False)
521
r = Client.disable(self)
522
if signal and oldstate != self.enabled:
523
# Emit D-Bus signal
524
self.PropertyChanged(dbus.String(u"enabled"),
525
dbus.Boolean(False, variant_level=1))
526
return r
527
528
def __del__(self, *args, **kwargs):
529
try:
530
self.remove_from_connection()
531
except LookupError:
532
pass
533
if hasattr(dbus.service.Object, u"__del__"):
534
dbus.service.Object.__del__(self, *args, **kwargs)
535
Client.__del__(self, *args, **kwargs)
536
537
def checker_callback(self, pid, condition, command,
538
*args, **kwargs):
539
self.checker_callback_tag = None
540
self.checker = None
541
# Emit D-Bus signal
542
self.PropertyChanged(dbus.String(u"checker_running"),
543
dbus.Boolean(False, variant_level=1))
544
if os.WIFEXITED(condition):
545
exitstatus = os.WEXITSTATUS(condition)
546
# Emit D-Bus signal
547
self.CheckerCompleted(dbus.Int16(exitstatus),
548
dbus.Int64(condition),
549
dbus.String(command))
550
else:
551
# Emit D-Bus signal
552
self.CheckerCompleted(dbus.Int16(-1),
553
dbus.Int64(condition),
554
dbus.String(command))
555
556
return Client.checker_callback(self, pid, condition, command,
557
*args, **kwargs)
558
559
def checked_ok(self, *args, **kwargs):
560
r = Client.checked_ok(self, *args, **kwargs)
561
# Emit D-Bus signal
562
self.PropertyChanged(
563
dbus.String(u"last_checked_ok"),
564
(self._datetime_to_dbus(self.last_checked_ok,
565
variant_level=1)))
566
return r
567
568
def start_checker(self, *args, **kwargs):
569
old_checker = self.checker
570
if self.checker is not None:
571
old_checker_pid = self.checker.pid
572
else:
573
old_checker_pid = None
574
r = Client.start_checker(self, *args, **kwargs)
575
# Only if new checker process was started
576
if (self.checker is not None
577
and old_checker_pid != self.checker.pid):
578
# Emit D-Bus signal
579
self.CheckerStarted(self.current_checker_command)
580
self.PropertyChanged(
581
dbus.String(u"checker_running"),
582
dbus.Boolean(True, variant_level=1))
583
return r
584
585
def stop_checker(self, *args, **kwargs):
586
old_checker = getattr(self, u"checker", None)
587
r = Client.stop_checker(self, *args, **kwargs)
588
if (old_checker is not None
589
and getattr(self, u"checker", None) is None):
590
self.PropertyChanged(dbus.String(u"checker_running"),
591
dbus.Boolean(False, variant_level=1))
592
return r
593
457
594
458
## D-Bus methods & signals
595
459
_interface = u"se.bsnet.fukt.Mandos.Client"
596
460
597
461
# CheckedOK - method
598
@dbus.service.method(_interface)
599
def CheckedOK(self):
600
return self.checked_ok()
462
CheckedOK = dbus.service.method(_interface)(checked_ok)
463
CheckedOK.__name__ = "CheckedOK"
601
464
602
465
# CheckerCompleted - signal
603
@dbus.service.signal(_interface, signature=u"nxs")
466
@dbus.service.signal(_interface, signature="nxs")
604
467
def CheckerCompleted(self, exitcode, waitstatus, command):
605
468
"D-Bus signal"
606
469
pass
607
470
608
471
# CheckerStarted - signal
609
@dbus.service.signal(_interface, signature=u"s")
472
@dbus.service.signal(_interface, signature="s")
610
473
def CheckerStarted(self, command):
611
474
"D-Bus signal"
612
475
pass
613
476
614
477
# GetAllProperties - method
615
@dbus.service.method(_interface, out_signature=u"a{sv}")
478
@dbus.service.method(_interface, out_signature="a{sv}")
616
479
def GetAllProperties(self):
617
480
"D-Bus method"
618
481
return dbus.Dictionary({
619
dbus.String(u"name"):
482
dbus.String("name"):
620
483
dbus.String(self.name, variant_level=1),
621
dbus.String(u"fingerprint"):
484
dbus.String("fingerprint"):
622
485
dbus.String(self.fingerprint, variant_level=1),
623
dbus.String(u"host"):
486
dbus.String("host"):
624
487
dbus.String(self.host, variant_level=1),
625
dbus.String(u"created"):
626
self._datetime_to_dbus(self.created,
627
variant_level=1),
628
dbus.String(u"last_enabled"):
629
(self._datetime_to_dbus(self.last_enabled,
630
variant_level=1)
488
dbus.String("created"):
489
_datetime_to_dbus(self.created, variant_level=1),
490
dbus.String("last_enabled"):
491
(_datetime_to_dbus(self.last_enabled,
492
variant_level=1)
631
493
if self.last_enabled is not None
632
494
else dbus.Boolean(False, variant_level=1)),
633
dbus.String(u"enabled"):
495
dbus.String("enabled"):
634
496
dbus.Boolean(self.enabled, variant_level=1),
635
dbus.String(u"last_checked_ok"):
636
(self._datetime_to_dbus(self.last_checked_ok,
637
variant_level=1)
497
dbus.String("last_checked_ok"):
498
(_datetime_to_dbus(self.last_checked_ok,
499
variant_level=1)
638
500
if self.last_checked_ok is not None
639
501
else dbus.Boolean (False, variant_level=1)),
640
dbus.String(u"timeout"):
502
dbus.String("timeout"):
641
503
dbus.UInt64(self.timeout_milliseconds(),
642
504
variant_level=1),
643
dbus.String(u"interval"):
505
dbus.String("interval"):
644
506
dbus.UInt64(self.interval_milliseconds(),
645
507
variant_level=1),
646
dbus.String(u"checker"):
508
dbus.String("checker"):
647
509
dbus.String(self.checker_command,
648
510
variant_level=1),
649
dbus.String(u"checker_running"):
511
dbus.String("checker_running"):
650
512
dbus.Boolean(self.checker is not None,
651
513
variant_level=1),
652
dbus.String(u"object_path"):
514
dbus.String("object_path"):
653
515
dbus.ObjectPath(self.dbus_object_path,
654
516
variant_level=1)
655
}, signature=u"sv")
517
}, signature="sv")
656
518
657
519
# IsStillValid - method
658
@dbus.service.method(_interface, out_signature=u"b")
659
def IsStillValid(self):
660
return self.still_valid()
520
IsStillValid = (dbus.service.method(_interface, out_signature="b")
521
(still_valid))
522
IsStillValid.__name__ = "IsStillValid"
661
523
662
524
# PropertyChanged - signal
663
@dbus.service.signal(_interface, signature=u"sv")
525
@dbus.service.signal(_interface, signature="sv")
664
526
def PropertyChanged(self, property, value):
665
527
"D-Bus signal"
666
528
pass
667
529
668
# ReceivedSecret - signal
669
@dbus.service.signal(_interface)
670
def ReceivedSecret(self):
671
"D-Bus signal"
672
pass
673
674
# Rejected - signal
675
@dbus.service.signal(_interface)
676
def Rejected(self):
677
"D-Bus signal"
678
pass
679
680
530
# SetChecker - method
681
@dbus.service.method(_interface, in_signature=u"s")
531
@dbus.service.method(_interface, in_signature="s")
682
532
def SetChecker(self, checker):
683
533
"D-Bus setter method"
684
534
self.checker_command = checker
688
538
variant_level=1))
689
539
690
540
# SetHost - method
691
@dbus.service.method(_interface, in_signature=u"s")
541
@dbus.service.method(_interface, in_signature="s")
692
542
def SetHost(self, host):
693
543
"D-Bus setter method"
694
544
self.host = host
697
547
dbus.String(self.host, variant_level=1))
698
548
699
549
# SetInterval - method
700
@dbus.service.method(_interface, in_signature=u"t")
550
@dbus.service.method(_interface, in_signature="t")
701
551
def SetInterval(self, milliseconds):
702
552
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
703
553
# Emit D-Bus signal
706
556
variant_level=1)))
707
557
708
558
# SetSecret - method
709
@dbus.service.method(_interface, in_signature=u"ay",
559
@dbus.service.method(_interface, in_signature="ay",
710
560
byte_arrays=True)
711
561
def SetSecret(self, secret):
712
562
"D-Bus setter method"
713
563
self.secret = str(secret)
714
564
715
565
# SetTimeout - method
716
@dbus.service.method(_interface, in_signature=u"t")
566
@dbus.service.method(_interface, in_signature="t")
717
567
def SetTimeout(self, milliseconds):
718
568
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
719
569
# Emit D-Bus signal
722
572
variant_level=1)))
723
573
724
574
# Enable - method
725
@dbus.service.method(_interface)
726
def Enable(self):
727
"D-Bus method"
728
self.enable()
575
Enable = dbus.service.method(_interface)(enable)
576
Enable.__name__ = "Enable"
729
577
730
578
# StartChecker - method
731
579
@dbus.service.method(_interface)
740
588
self.disable()
741
589
742
590
# StopChecker - method
743
@dbus.service.method(_interface)
744
def StopChecker(self):
745
self.stop_checker()
591
StopChecker = dbus.service.method(_interface)(stop_checker)
592
StopChecker.__name__ = "StopChecker"
746
593
747
594
del _interface
748
595
749
596
750
class ClientHandler(socketserver.BaseRequestHandler, object):
751
"""A class to handle client connections.
752
753
Instantiated once for each connection to handle it.
597
def peer_certificate(session):
598
"Return the peer's OpenPGP certificate as a bytestring"
599
# If not an OpenPGP certificate...
600
if (gnutls.library.functions
601
.gnutls_certificate_type_get(session._c_object)
602
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
603
# ...do the normal thing
604
return session.peer_certificate
605
list_size = ctypes.c_uint(1)
606
cert_list = (gnutls.library.functions
607
.gnutls_certificate_get_peers
608
(session._c_object, ctypes.byref(list_size)))
609
if not bool(cert_list) and list_size.value != 0:
610
raise gnutls.errors.GNUTLSError("error getting peer"
611
" certificate")
612
if list_size.value == 0:
613
return None
614
cert = cert_list[0]
615
return ctypes.string_at(cert.data, cert.size)
616
617
618
def fingerprint(openpgp):
619
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
620
# New GnuTLS "datum" with the OpenPGP public key
621
datum = (gnutls.library.types
622
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
623
ctypes.POINTER
624
(ctypes.c_ubyte)),
625
ctypes.c_uint(len(openpgp))))
626
# New empty GnuTLS certificate
627
crt = gnutls.library.types.gnutls_openpgp_crt_t()
628
(gnutls.library.functions
629
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
630
# Import the OpenPGP public key into the certificate
631
(gnutls.library.functions
632
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
633
gnutls.library.constants
634
.GNUTLS_OPENPGP_FMT_RAW))
635
# Verify the self signature in the key
636
crtverify = ctypes.c_uint()
637
(gnutls.library.functions
638
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
639
if crtverify.value != 0:
640
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
641
raise gnutls.errors.CertificateSecurityError("Verify failed")
642
# New buffer for the fingerprint
643
buf = ctypes.create_string_buffer(20)
644
buf_len = ctypes.c_size_t()
645
# Get the fingerprint from the certificate into the buffer
646
(gnutls.library.functions
647
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
648
ctypes.byref(buf_len)))
649
# Deinit the certificate
650
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
651
# Convert the buffer to a Python bytestring
652
fpr = ctypes.string_at(buf, buf_len.value)
653
# Convert the bytestring to hexadecimal notation
654
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
655
return hex_fpr
656
657
658
class TCP_handler(SocketServer.BaseRequestHandler, object):
659
"""A TCP request handler class.
660
Instantiated by IPv6_TCPServer for each request to handle it.
754
661
Note: This will run in its own forked process."""
755
662
756
663
def handle(self):
757
664
logger.info(u"TCP connection from: %s",
758
665
unicode(self.client_address))
759
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
# Open IPC pipe to parent process
761
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
762
session = (gnutls.connection
763
.ClientSession(self.request,
764
gnutls.connection
765
.X509Credentials()))
766
767
line = self.request.makefile().readline()
768
logger.debug(u"Protocol version: %r", line)
769
try:
770
if int(line.strip().split()[0]) > 1:
771
raise RuntimeError
772
except (ValueError, IndexError, RuntimeError), error:
773
logger.error(u"Unknown protocol version: %s", error)
774
return
775
776
# Note: gnutls.connection.X509Credentials is really a
777
# generic GnuTLS certificate credentials object so long as
778
# no X.509 keys are added to it. Therefore, we can use it
779
# here despite using OpenPGP certificates.
780
781
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
# u"+AES-256-CBC", u"+SHA1",
783
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
784
# u"+DHE-DSS"))
785
# Use a fallback default, since this MUST be set.
786
priority = self.server.gnutls_priority
787
if priority is None:
788
priority = u"NORMAL"
789
(gnutls.library.functions
790
.gnutls_priority_set_direct(session._c_object,
791
priority, None))
792
793
try:
794
session.handshake()
795
except gnutls.errors.GNUTLSError, error:
796
logger.warning(u"Handshake failed: %s", error)
797
# Do not run session.bye() here: the session is not
798
# established. Just abandon the request.
799
return
800
logger.debug(u"Handshake succeeded")
801
try:
802
fpr = self.fingerprint(self.peer_certificate(session))
803
except (TypeError, gnutls.errors.GNUTLSError), error:
804
logger.warning(u"Bad certificate: %s", error)
805
session.bye()
806
return
807
logger.debug(u"Fingerprint: %s", fpr)
808
809
for c in self.server.clients:
810
if c.fingerprint == fpr:
811
client = c
812
break
813
else:
814
ipc.write(u"NOTFOUND %s\n" % fpr)
815
session.bye()
816
return
817
# Have to check if client.still_valid(), since it is
818
# possible that the client timed out while establishing
819
# the GnuTLS session.
820
if not client.still_valid():
821
ipc.write(u"INVALID %s\n" % client.name)
822
session.bye()
823
return
824
ipc.write(u"SENDING %s\n" % client.name)
825
sent_size = 0
826
while sent_size < len(client.secret):
827
sent = session.send(client.secret[sent_size:])
828
logger.debug(u"Sent: %d, remaining: %d",
829
sent, len(client.secret)
830
- (sent_size + sent))
831
sent_size += sent
832
session.bye()
833
834
@staticmethod
835
def peer_certificate(session):
836
"Return the peer's OpenPGP certificate as a bytestring"
837
# If not an OpenPGP certificate...
838
if (gnutls.library.functions
839
.gnutls_certificate_type_get(session._c_object)
840
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
841
# ...do the normal thing
842
return session.peer_certificate
843
list_size = ctypes.c_uint(1)
844
cert_list = (gnutls.library.functions
845
.gnutls_certificate_get_peers
846
(session._c_object, ctypes.byref(list_size)))
847
if not bool(cert_list) and list_size.value != 0:
848
raise gnutls.errors.GNUTLSError(u"error getting peer"
849
u" certificate")
850
if list_size.value == 0:
851
return None
852
cert = cert_list[0]
853
return ctypes.string_at(cert.data, cert.size)
854
855
@staticmethod
856
def fingerprint(openpgp):
857
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
858
# New GnuTLS "datum" with the OpenPGP public key
859
datum = (gnutls.library.types
860
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
861
ctypes.POINTER
862
(ctypes.c_ubyte)),
863
ctypes.c_uint(len(openpgp))))
864
# New empty GnuTLS certificate
865
crt = gnutls.library.types.gnutls_openpgp_crt_t()
866
(gnutls.library.functions
867
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
868
# Import the OpenPGP public key into the certificate
869
(gnutls.library.functions
870
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
871
gnutls.library.constants
872
.GNUTLS_OPENPGP_FMT_RAW))
873
# Verify the self signature in the key
874
crtverify = ctypes.c_uint()
875
(gnutls.library.functions
876
.gnutls_openpgp_crt_verify_self(crt, 0,
877
ctypes.byref(crtverify)))
878
if crtverify.value != 0:
879
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
880
raise (gnutls.errors.CertificateSecurityError
881
(u"Verify failed"))
882
# New buffer for the fingerprint
883
buf = ctypes.create_string_buffer(20)
884
buf_len = ctypes.c_size_t()
885
# Get the fingerprint from the certificate into the buffer
886
(gnutls.library.functions
887
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
888
ctypes.byref(buf_len)))
889
# Deinit the certificate
890
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
891
# Convert the buffer to a Python bytestring
892
fpr = ctypes.string_at(buf, buf_len.value)
893
# Convert the bytestring to hexadecimal notation
894
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
895
return hex_fpr
896
897
898
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
899
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
900
def process_request(self, request, client_address):
901
"""Overrides and wraps the original process_request().
902
903
This function creates a new pipe in self.pipe
904
"""
905
self.pipe = os.pipe()
906
super(ForkingMixInWithPipe,
907
self).process_request(request, client_address)
908
os.close(self.pipe[1]) # close write end
909
self.add_pipe(self.pipe[0])
910
def add_pipe(self, pipe):
911
"""Dummy function; override as necessary"""
912
os.close(pipe)
913
914
915
class IPv6_TCPServer(ForkingMixInWithPipe,
916
socketserver.TCPServer, object):
917
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
918
666
session = (gnutls.connection
667
.ClientSession(self.request,
668
gnutls.connection
669
.X509Credentials()))
670
671
line = self.request.makefile().readline()
672
logger.debug(u"Protocol version: %r", line)
673
try:
674
if int(line.strip().split()[0]) > 1:
675
raise RuntimeError
676
except (ValueError, IndexError, RuntimeError), error:
677
logger.error(u"Unknown protocol version: %s", error)
678
return
679
680
# Note: gnutls.connection.X509Credentials is really a generic
681
# GnuTLS certificate credentials object so long as no X.509
682
# keys are added to it. Therefore, we can use it here despite
683
# using OpenPGP certificates.
684
685
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
686
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
687
# "+DHE-DSS"))
688
# Use a fallback default, since this MUST be set.
689
priority = self.server.settings.get("priority", "NORMAL")
690
(gnutls.library.functions
691
.gnutls_priority_set_direct(session._c_object,
692
priority, None))
693
694
try:
695
session.handshake()
696
except gnutls.errors.GNUTLSError, error:
697
logger.warning(u"Handshake failed: %s", error)
698
# Do not run session.bye() here: the session is not
699
# established. Just abandon the request.
700
return
701
logger.debug(u"Handshake succeeded")
702
try:
703
fpr = fingerprint(peer_certificate(session))
704
except (TypeError, gnutls.errors.GNUTLSError), error:
705
logger.warning(u"Bad certificate: %s", error)
706
session.bye()
707
return
708
logger.debug(u"Fingerprint: %s", fpr)
709
710
for c in self.server.clients:
711
if c.fingerprint == fpr:
712
client = c
713
break
714
else:
715
logger.warning(u"Client not found for fingerprint: %s",
716
fpr)
717
session.bye()
718
return
719
# Have to check if client.still_valid(), since it is possible
720
# that the client timed out while establishing the GnuTLS
721
# session.
722
if not client.still_valid():
723
logger.warning(u"Client %(name)s is invalid",
724
vars(client))
725
session.bye()
726
return
727
## This won't work here, since we're in a fork.
728
# client.checked_ok()
729
sent_size = 0
730
while sent_size < len(client.secret):
731
sent = session.send(client.secret[sent_size:])
732
logger.debug(u"Sent: %d, remaining: %d",
733
sent, len(client.secret)
734
- (sent_size + sent))
735
sent_size += sent
736
session.bye()
737
738
739
class IPv6_TCPServer(SocketServer.ForkingMixIn,
740
SocketServer.TCPServer, object):
741
"""IPv6 TCP server. Accepts 'None' as address and/or port.
919
742
Attributes:
743
settings: Server settings
744
clients: Set() of Client objects
920
745
enabled: Boolean; whether this server is activated yet
921
interface: None or a network interface name (string)
922
use_ipv6: Boolean; to use IPv6 or not
923
746
"""
924
def __init__(self, server_address, RequestHandlerClass,
925
interface=None, use_ipv6=True):
926
self.interface = interface
927
if use_ipv6:
928
self.address_family = socket.AF_INET6
929
socketserver.TCPServer.__init__(self, server_address,
930
RequestHandlerClass)
747
address_family = socket.AF_INET6
748
def __init__(self, *args, **kwargs):
749
if "settings" in kwargs:
750
self.settings = kwargs["settings"]
751
del kwargs["settings"]
752
if "clients" in kwargs:
753
self.clients = kwargs["clients"]
754
del kwargs["clients"]
755
self.enabled = False
756
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
931
757
def server_bind(self):
932
758
"""This overrides the normal server_bind() function
933
759
to bind to an interface if one was specified, and also NOT to
934
760
bind to an address or port if they were not specified."""
935
if self.interface is not None:
936
if SO_BINDTODEVICE is None:
937
logger.error(u"SO_BINDTODEVICE does not exist;"
938
u" cannot bind to interface %s",
939
self.interface)
940
else:
941
try:
942
self.socket.setsockopt(socket.SOL_SOCKET,
943
SO_BINDTODEVICE,
944
str(self.interface
945
+ u'\0'))
946
except socket.error, error:
947
if error[0] == errno.EPERM:
948
logger.error(u"No permission to"
949
u" bind to interface %s",
950
self.interface)
951
elif error[0] == errno.ENOPROTOOPT:
952
logger.error(u"SO_BINDTODEVICE not available;"
953
u" cannot bind to interface %s",
954
self.interface)
955
else:
956
raise
761
if self.settings["interface"]:
762
# 25 is from /usr/include/asm-i486/socket.h
763
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
764
try:
765
self.socket.setsockopt(socket.SOL_SOCKET,
766
SO_BINDTODEVICE,
767
self.settings["interface"])
768
except socket.error, error:
769
if error[0] == errno.EPERM:
770
logger.error(u"No permission to"
771
u" bind to interface %s",
772
self.settings["interface"])
773
else:
774
raise
957
775
# Only bind(2) the socket if we really need to.
958
776
if self.server_address[0] or self.server_address[1]:
959
777
if not self.server_address[0]:
960
if self.address_family == socket.AF_INET6:
961
any_address = u"::" # in6addr_any
962
else:
963
any_address = socket.INADDR_ANY
964
self.server_address = (any_address,
778
in6addr_any = "::"
779
self.server_address = (in6addr_any,
965
780
self.server_address[1])
966
781
elif not self.server_address[1]:
967
782
self.server_address = (self.server_address[0],
968
783
0)
969
# if self.interface:
784
# if self.settings["interface"]:
970
785
# self.server_address = (self.server_address[0],
971
786
# 0, # port
972
787
# 0, # flowinfo
973
788
# if_nametoindex
974
# (self.interface))
975
return socketserver.TCPServer.server_bind(self)
976
977
978
class MandosServer(IPv6_TCPServer):
979
"""Mandos server.
980
981
Attributes:
982
clients: set of Client objects
983
gnutls_priority GnuTLS priority string
984
use_dbus: Boolean; to emit D-Bus signals or not
985
clients: set of Client objects
986
gnutls_priority GnuTLS priority string
987
use_dbus: Boolean; to emit D-Bus signals or not
988
989
Assumes a gobject.MainLoop event loop.
990
"""
991
def __init__(self, server_address, RequestHandlerClass,
992
interface=None, use_ipv6=True, clients=None,
993
gnutls_priority=None, use_dbus=True):
994
self.enabled = False
995
self.clients = clients
996
if self.clients is None:
997
self.clients = set()
998
self.use_dbus = use_dbus
999
self.gnutls_priority = gnutls_priority
1000
IPv6_TCPServer.__init__(self, server_address,
1001
RequestHandlerClass,
1002
interface = interface,
1003
use_ipv6 = use_ipv6)
789
# (self.settings
790
# ["interface"]))
791
return super(IPv6_TCPServer, self).server_bind()
1004
792
def server_activate(self):
1005
793
if self.enabled:
1006
return socketserver.TCPServer.server_activate(self)
794
return super(IPv6_TCPServer, self).server_activate()
1007
795
def enable(self):
1008
796
self.enabled = True
1009
def add_pipe(self, pipe):
1010
# Call "handle_ipc" for both data and EOF events
1011
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1012
self.handle_ipc)
1013
def handle_ipc(self, source, condition, file_objects={}):
1014
condition_names = {
1015
gobject.IO_IN: u"IN", # There is data to read.
1016
gobject.IO_OUT: u"OUT", # Data can be written (without
1017
# blocking).
1018
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1019
gobject.IO_ERR: u"ERR", # Error condition.
1020
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1021
# broken, usually for pipes and
1022
# sockets).
1023
}
1024
conditions_string = ' | '.join(name
1025
for cond, name in
1026
condition_names.iteritems()
1027
if cond & condition)
1028
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1029
conditions_string)
1030
1031
# Turn the pipe file descriptor into a Python file object
1032
if source not in file_objects:
1033
file_objects[source] = os.fdopen(source, u"r", 1)
1034
1035
# Read a line from the file object
1036
cmdline = file_objects[source].readline()
1037
if not cmdline: # Empty line means end of file
1038
# close the IPC pipe
1039
file_objects[source].close()
1040
del file_objects[source]
1041
1042
# Stop calling this function
1043
return False
1044
1045
logger.debug(u"IPC command: %r", cmdline)
1046
1047
# Parse and act on command
1048
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1049
1050
if cmd == u"NOTFOUND":
1051
logger.warning(u"Client not found for fingerprint: %s",
1052
args)
1053
if self.use_dbus:
1054
# Emit D-Bus signal
1055
mandos_dbus_service.ClientNotFound(args)
1056
elif cmd == u"INVALID":
1057
for client in self.clients:
1058
if client.name == args:
1059
logger.warning(u"Client %s is invalid", args)
1060
if self.use_dbus:
1061
# Emit D-Bus signal
1062
client.Rejected()
1063
break
1064
else:
1065
logger.error(u"Unknown client %s is invalid", args)
1066
elif cmd == u"SENDING":
1067
for client in self.clients:
1068
if client.name == args:
1069
logger.info(u"Sending secret to %s", client.name)
1070
client.checked_ok()
1071
if self.use_dbus:
1072
# Emit D-Bus signal
1073
client.ReceivedSecret()
1074
break
1075
else:
1076
logger.error(u"Sending secret to unknown client %s",
1077
args)
1078
else:
1079
logger.error(u"Unknown IPC command: %r", cmdline)
1080
1081
# Keep calling this function
1082
return True
1083
797
1084
798
1085
799
def string_to_delta(interval):
1086
800
"""Parse a string and return a datetime.timedelta
1087
801
1088
>>> string_to_delta(u'7d')
802
>>> string_to_delta('7d')
1089
803
datetime.timedelta(7)
1090
>>> string_to_delta(u'60s')
804
>>> string_to_delta('60s')
1091
805
datetime.timedelta(0, 60)
1092
>>> string_to_delta(u'60m')
806
>>> string_to_delta('60m')
1093
807
datetime.timedelta(0, 3600)
1094
>>> string_to_delta(u'24h')
808
>>> string_to_delta('24h')
1095
809
datetime.timedelta(1)
1096
810
>>> string_to_delta(u'1w')
1097
811
datetime.timedelta(7)
1098
>>> string_to_delta(u'5m 30s')
812
>>> string_to_delta('5m 30s')
1099
813
datetime.timedelta(0, 330)
1100
814
"""
1101
815
timevalue = datetime.timedelta(0)
1121
835
return timevalue
1122
836
1123
837
838
def server_state_changed(state):
839
"""Derived from the Avahi example code"""
840
if state == avahi.SERVER_COLLISION:
841
logger.error(u"Zeroconf server name collision")
842
service.remove()
843
elif state == avahi.SERVER_RUNNING:
844
service.add()
845
846
847
def entry_group_state_changed(state, error):
848
"""Derived from the Avahi example code"""
849
logger.debug(u"Avahi state change: %i", state)
850
851
if state == avahi.ENTRY_GROUP_ESTABLISHED:
852
logger.debug(u"Zeroconf service established.")
853
elif state == avahi.ENTRY_GROUP_COLLISION:
854
logger.warning(u"Zeroconf service name collision.")
855
service.rename()
856
elif state == avahi.ENTRY_GROUP_FAILURE:
857
logger.critical(u"Avahi: Error in group state changed %s",
858
unicode(error))
859
raise AvahiGroupError(u"State changed: %s" % unicode(error))
860
1124
861
def if_nametoindex(interface):
1125
"""Call the C function if_nametoindex(), or equivalent
1126
1127
Note: This function cannot accept a unicode string."""
862
"""Call the C function if_nametoindex(), or equivalent"""
1128
863
global if_nametoindex
1129
864
try:
1130
865
if_nametoindex = (ctypes.cdll.LoadLibrary
1131
(ctypes.util.find_library(u"c"))
866
(ctypes.util.find_library("c"))
1132
867
.if_nametoindex)
1133
868
except (OSError, AttributeError):
1134
logger.warning(u"Doing if_nametoindex the hard way")
869
if "struct" not in sys.modules:
870
import struct
871
if "fcntl" not in sys.modules:
872
import fcntl
1135
873
def if_nametoindex(interface):
1136
874
"Get an interface index the hard way, i.e. using fcntl()"
1137
875
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1138
876
with closing(socket.socket()) as s:
1139
877
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1140
struct.pack(str(u"16s16x"),
1141
interface))
1142
interface_index = struct.unpack(str(u"I"),
1143
ifreq[16:20])[0]
878
struct.pack("16s16x", interface))
879
interface_index = struct.unpack("I", ifreq[16:20])[0]
1144
880
return interface_index
1145
881
return if_nametoindex(interface)
1146
882
1147
883
1148
884
def daemon(nochdir = False, noclose = False):
1149
885
"""See daemon(3). Standard BSD Unix function.
1150
1151
886
This should really exist as os.daemon, but it doesn't (yet)."""
1152
887
if os.fork():
1153
888
sys.exit()
1154
889
os.setsid()
1155
890
if not nochdir:
1156
os.chdir(u"/")
891
os.chdir("/")
1157
892
if os.fork():
1158
893
sys.exit()
1159
894
if not noclose:
1161
896
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1162
897
if not stat.S_ISCHR(os.fstat(null).st_mode):
1163
898
raise OSError(errno.ENODEV,
1164
u"/dev/null not a character device")
899
"/dev/null not a character device")
1165
900
os.dup2(null, sys.stdin.fileno())
1166
901
os.dup2(null, sys.stdout.fileno())
1167
902
os.dup2(null, sys.stderr.fileno())
1170
905
1171
906
1172
907
def main():
1173
1174
######################################################################
1175
# Parsing of options, both command line and config file
1176
1177
908
parser = optparse.OptionParser(version = "%%prog %s" % version)
1178
parser.add_option("-i", u"--interface", type=u"string",
1179
metavar="IF", help=u"Bind to interface IF")
1180
parser.add_option("-a", u"--address", type=u"string",
1181
help=u"Address to listen for requests on")
1182
parser.add_option("-p", u"--port", type=u"int",
1183
help=u"Port number to receive requests on")
1184
parser.add_option("--check", action=u"store_true",
1185
help=u"Run self-test")
1186
parser.add_option("--debug", action=u"store_true",
1187
help=u"Debug mode; run in foreground and log to"
1188
u" terminal")
1189
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1190
u" priority string (see GnuTLS documentation)")
1191
parser.add_option("--servicename", type=u"string",
1192
metavar=u"NAME", help=u"Zeroconf service name")
1193
parser.add_option("--configdir", type=u"string",
1194
default=u"/etc/mandos", metavar=u"DIR",
1195
help=u"Directory to search for configuration"
1196
u" files")
1197
parser.add_option("--no-dbus", action=u"store_false",
1198
dest=u"use_dbus", help=u"Do not provide D-Bus"
1199
u" system bus interface")
1200
parser.add_option("--no-ipv6", action=u"store_false",
1201
dest=u"use_ipv6", help=u"Do not use IPv6")
909
parser.add_option("-i", "--interface", type="string",
910
metavar="IF", help="Bind to interface IF")
911
parser.add_option("-a", "--address", type="string",
912
help="Address to listen for requests on")
913
parser.add_option("-p", "--port", type="int",
914
help="Port number to receive requests on")
915
parser.add_option("--check", action="store_true",
916
help="Run self-test")
917
parser.add_option("--debug", action="store_true",
918
help="Debug mode; run in foreground and log to"
919
" terminal")
920
parser.add_option("--priority", type="string", help="GnuTLS"
921
" priority string (see GnuTLS documentation)")
922
parser.add_option("--servicename", type="string", metavar="NAME",
923
help="Zeroconf service name")
924
parser.add_option("--configdir", type="string",
925
default="/etc/mandos", metavar="DIR",
926
help="Directory to search for configuration"
927
" files")
928
parser.add_option("--no-dbus", action="store_false",
929
dest="use_dbus",
930
help="Do not provide D-Bus system bus"
931
" interface")
1202
932
options = parser.parse_args()[0]
1203
933
1204
934
if options.check:
1207
937
sys.exit()
1208
938
1209
939
# Default values for config file for server-global settings
1210
server_defaults = { u"interface": u"",
1211
u"address": u"",
1212
u"port": u"",
1213
u"debug": u"False",
1214
u"priority":
1215
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1216
u"servicename": u"Mandos",
1217
u"use_dbus": u"True",
1218
u"use_ipv6": u"True",
940
server_defaults = { "interface": "",
941
"address": "",
942
"port": "",
943
"debug": "False",
944
"priority":
945
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
946
"servicename": "Mandos",
947
"use_dbus": "True",
1219
948
}
1220
949
1221
950
# Parse config file for server-global settings
1222
server_config = configparser.SafeConfigParser(server_defaults)
951
server_config = ConfigParser.SafeConfigParser(server_defaults)
1223
952
del server_defaults
1224
server_config.read(os.path.join(options.configdir,
1225
u"mandos.conf"))
953
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1226
954
# Convert the SafeConfigParser object to a dict
1227
955
server_settings = server_config.defaults()
1228
956
# Use the appropriate methods on the non-string config options
1229
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1230
server_settings[option] = server_config.getboolean(u"DEFAULT",
1231
option)
957
server_settings["debug"] = server_config.getboolean("DEFAULT",
958
"debug")
959
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
960
"use_dbus")
1232
961
if server_settings["port"]:
1233
server_settings["port"] = server_config.getint(u"DEFAULT",
1234
u"port")
962
server_settings["port"] = server_config.getint("DEFAULT",
963
"port")
1235
964
del server_config
1236
965
1237
966
# Override the settings from the config file with command line
1238
967
# options, if set.
1239
for option in (u"interface", u"address", u"port", u"debug",
1240
u"priority", u"servicename", u"configdir",
1241
u"use_dbus", u"use_ipv6"):
968
for option in ("interface", "address", "port", "debug",
969
"priority", "servicename", "configdir",
970
"use_dbus"):
1242
971
value = getattr(options, option)
1243
972
if value is not None:
1244
973
server_settings[option] = value
1245
974
del options
1246
# Force all strings to be unicode
1247
for option in server_settings.keys():
1248
if type(server_settings[option]) is str:
1249
server_settings[option] = unicode(server_settings[option])
1250
975
# Now we have our good server settings in "server_settings"
1251
976
1252
##################################################################
1253
1254
977
# For convenience
1255
debug = server_settings[u"debug"]
1256
use_dbus = server_settings[u"use_dbus"]
1257
use_ipv6 = server_settings[u"use_ipv6"]
978
debug = server_settings["debug"]
979
use_dbus = server_settings["use_dbus"]
1258
980
1259
981
if not debug:
1260
982
syslogger.setLevel(logging.WARNING)
1261
983
console.setLevel(logging.WARNING)
1262
984
1263
if server_settings[u"servicename"] != u"Mandos":
985
if server_settings["servicename"] != "Mandos":
1264
986
syslogger.setFormatter(logging.Formatter
1265
(u'Mandos (%s) [%%(process)d]:'
1266
u' %%(levelname)s: %%(message)s'
1267
% server_settings[u"servicename"]))
987
('Mandos (%s): %%(levelname)s:'
988
' %%(message)s'
989
% server_settings["servicename"]))
1268
990
1269
991
# Parse config file with clients
1270
client_defaults = { u"timeout": u"1h",
1271
u"interval": u"5m",
1272
u"checker": u"fping -q -- %%(host)s",
1273
u"host": u"",
992
client_defaults = { "timeout": "1h",
993
"interval": "5m",
994
"checker": "fping -q -- %%(host)s",
995
"host": "",
1274
996
}
1275
client_config = configparser.SafeConfigParser(client_defaults)
1276
client_config.read(os.path.join(server_settings[u"configdir"],
1277
u"clients.conf"))
1278
1279
global mandos_dbus_service
1280
mandos_dbus_service = None
1281
1282
tcp_server = MandosServer((server_settings[u"address"],
1283
server_settings[u"port"]),
1284
ClientHandler,
1285
interface=server_settings[u"interface"],
1286
use_ipv6=use_ipv6,
1287
gnutls_priority=
1288
server_settings[u"priority"],
1289
use_dbus=use_dbus)
1290
pidfilename = u"/var/run/mandos.pid"
997
client_config = ConfigParser.SafeConfigParser(client_defaults)
998
client_config.read(os.path.join(server_settings["configdir"],
999
"clients.conf"))
1000
1001
clients = Set()
1002
tcp_server = IPv6_TCPServer((server_settings["address"],
1003
server_settings["port"]),
1004
TCP_handler,
1005
settings=server_settings,
1006
clients=clients)
1007
pidfilename = "/var/run/mandos.pid"
1291
1008
try:
1292
pidfile = open(pidfilename, u"w")
1009
pidfile = open(pidfilename, "w")
1293
1010
except IOError:
1294
logger.error(u"Could not open file %r", pidfilename)
1011
logger.error("Could not open file %r", pidfilename)
1295
1012
1296
1013
try:
1297
uid = pwd.getpwnam(u"_mandos").pw_uid
1298
gid = pwd.getpwnam(u"_mandos").pw_gid
1014
uid = pwd.getpwnam("_mandos").pw_uid
1015
gid = pwd.getpwnam("_mandos").pw_gid
1299
1016
except KeyError:
1300
1017
try:
1301
uid = pwd.getpwnam(u"mandos").pw_uid
1302
gid = pwd.getpwnam(u"mandos").pw_gid
1018
uid = pwd.getpwnam("mandos").pw_uid
1019
gid = pwd.getpwnam("mandos").pw_gid
1303
1020
except KeyError:
1304
1021
try:
1305
uid = pwd.getpwnam(u"nobody").pw_uid
1306
gid = pwd.getpwnam(u"nobody").pw_gid
1022
uid = pwd.getpwnam("nobody").pw_uid
1023
gid = pwd.getpwnam("nogroup").pw_gid
1307
1024
except KeyError:
1308
1025
uid = 65534
1309
1026
gid = 65534
1322
1039
1323
1040
@gnutls.library.types.gnutls_log_func
1324
1041
def debug_gnutls(level, string):
1325
logger.debug(u"GnuTLS: %s", string[:-1])
1042
logger.debug("GnuTLS: %s", string[:-1])
1326
1043
1327
1044
(gnutls.library.functions
1328
1045
.gnutls_global_set_log_function(debug_gnutls))
1329
1046
1047
global service
1048
service = AvahiService(name = server_settings["servicename"],
1049
servicetype = "_mandos._tcp", )
1050
if server_settings["interface"]:
1051
service.interface = (if_nametoindex
1052
(server_settings["interface"]))
1053
1330
1054
global main_loop
1055
global bus
1056
global server
1331
1057
# From the Avahi example code
1332
1058
DBusGMainLoop(set_as_default=True )
1333
1059
main_loop = gobject.MainLoop()
1334
1060
bus = dbus.SystemBus()
1061
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1062
avahi.DBUS_PATH_SERVER),
1063
avahi.DBUS_INTERFACE_SERVER)
1335
1064
# End of Avahi example code
1336
1065
if use_dbus:
1337
1066
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1338
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1339
service = AvahiService(name = server_settings[u"servicename"],
1340
servicetype = u"_mandos._tcp",
1341
protocol = protocol, bus = bus)
1342
if server_settings["interface"]:
1343
service.interface = (if_nametoindex
1344
(str(server_settings[u"interface"])))
1345
1067
1346
client_class = Client
1347
if use_dbus:
1348
client_class = functools.partial(ClientDBus, bus = bus)
1349
tcp_server.clients.update(set(
1350
client_class(name = section,
1351
config= dict(client_config.items(section)))
1352
for section in client_config.sections()))
1353
if not tcp_server.clients:
1068
clients.update(Set(Client(name = section,
1069
config
1070
= dict(client_config.items(section)),
1071
use_dbus = use_dbus)
1072
for section in client_config.sections()))
1073
if not clients:
1354
1074
logger.warning(u"No clients defined")
1355
1075
1356
1076
if debug:
1366
1086
daemon()
1367
1087
1368
1088
try:
1369
with closing(pidfile):
1370
pid = os.getpid()
1371
pidfile.write(str(pid) + "\n")
1089
pid = os.getpid()
1090
pidfile.write(str(pid) + "\n")
1091
pidfile.close()
1372
1092
del pidfile
1373
1093
except IOError:
1374
1094
logger.error(u"Could not write to file %r with PID %d",
1380
1100
1381
1101
def cleanup():
1382
1102
"Cleanup function; run on exit"
1383
service.cleanup()
1103
global group
1104
# From the Avahi example code
1105
if not group is None:
1106
group.Free()
1107
group = None
1108
# End of Avahi example code
1384
1109
1385
while tcp_server.clients:
1386
client = tcp_server.clients.pop()
1110
while clients:
1111
client = clients.pop()
1387
1112
client.disable_hook = None
1388
1113
client.disable()
1389
1114
1395
1120
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1396
1121
1397
1122
if use_dbus:
1398
class MandosDBusService(dbus.service.Object):
1123
class MandosServer(dbus.service.Object):
1399
1124
"""A D-Bus proxy object"""
1400
1125
def __init__(self):
1401
dbus.service.Object.__init__(self, bus, u"/")
1126
dbus.service.Object.__init__(self, bus, "/")
1402
1127
_interface = u"se.bsnet.fukt.Mandos"
1403
1128
1404
@dbus.service.signal(_interface, signature=u"oa{sv}")
1129
@dbus.service.signal(_interface, signature="oa{sv}")
1405
1130
def ClientAdded(self, objpath, properties):
1406
1131
"D-Bus signal"
1407
1132
pass
1408
1133
1409
@dbus.service.signal(_interface, signature=u"s")
1410
def ClientNotFound(self, fingerprint):
1411
"D-Bus signal"
1412
pass
1413
1414
@dbus.service.signal(_interface, signature=u"os")
1134
@dbus.service.signal(_interface, signature="os")
1415
1135
def ClientRemoved(self, objpath, name):
1416
1136
"D-Bus signal"
1417
1137
pass
1418
1138
1419
@dbus.service.method(_interface, out_signature=u"ao")
1139
@dbus.service.method(_interface, out_signature="ao")
1420
1140
def GetAllClients(self):
1421
1141
"D-Bus method"
1422
return dbus.Array(c.dbus_object_path
1423
for c in tcp_server.clients)
1142
return dbus.Array(c.dbus_object_path for c in clients)
1424
1143
1425
@dbus.service.method(_interface,
1426
out_signature=u"a{oa{sv}}")
1144
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1427
1145
def GetAllClientsWithProperties(self):
1428
1146
"D-Bus method"
1429
1147
return dbus.Dictionary(
1430
1148
((c.dbus_object_path, c.GetAllProperties())
1431
for c in tcp_server.clients),
1432
signature=u"oa{sv}")
1149
for c in clients),
1150
signature="oa{sv}")
1433
1151
1434
@dbus.service.method(_interface, in_signature=u"o")
1152
@dbus.service.method(_interface, in_signature="o")
1435
1153
def RemoveClient(self, object_path):
1436
1154
"D-Bus method"
1437
for c in tcp_server.clients:
1155
for c in clients:
1438
1156
if c.dbus_object_path == object_path:
1439
tcp_server.clients.remove(c)
1440
c.remove_from_connection()
1157
clients.remove(c)
1441
1158
# Don't signal anything except ClientRemoved
1442
c.disable(signal=False)
1159
c.use_dbus = False
1160
c.disable()
1443
1161
# Emit D-Bus signal
1444
1162
self.ClientRemoved(object_path, c.name)
1445
1163
return
1447
1165
1448
1166
del _interface
1449
1167
1450
mandos_dbus_service = MandosDBusService()
1168
mandos_server = MandosServer()
1451
1169
1452
for client in tcp_server.clients:
1170
for client in clients:
1453
1171
if use_dbus:
1454
1172
# Emit D-Bus signal
1455
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1456
client.GetAllProperties())
1173
mandos_server.ClientAdded(client.dbus_object_path,
1174
client.GetAllProperties())
1457
1175
client.enable()
1458
1176
1459
1177
tcp_server.enable()
1461
1179
1462
1180
# Find out what port we got
1463
1181
service.port = tcp_server.socket.getsockname()[1]
1464
if use_ipv6:
1465
logger.info(u"Now listening on address %r, port %d,"
1466
" flowinfo %d, scope_id %d"
1467
% tcp_server.socket.getsockname())
1468
else: # IPv4
1469
logger.info(u"Now listening on address %r, port %d"
1470
% tcp_server.socket.getsockname())
1182
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1183
u" scope_id %d" % tcp_server.socket.getsockname())
1471
1184
1472
1185
#service.interface = tcp_server.socket.getsockname()[3]
1473
1186
1474
1187
try:
1475
1188
# From the Avahi example code
1189
server.connect_to_signal("StateChanged", server_state_changed)
1476
1190
try:
1477
service.activate()
1191
server_state_changed(server.GetState())
1478
1192
except dbus.exceptions.DBusException, error:
1479
1193
logger.critical(u"DBusException: %s", error)
1480
1194
sys.exit(1)
1493
1207
except KeyboardInterrupt:
1494
1208
if debug:
1495
1209
print >> sys.stderr
1496
logger.debug(u"Server received KeyboardInterrupt")
1497
logger.debug(u"Server exiting")
1210
logger.debug("Server received KeyboardInterrupt")
1211
logger.debug("Server exiting")
1498
1212
1499
1213
if __name__ == '__main__':
1500
1214
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0