/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release
3 by Björn Påhlsson
Python based server
1
#!/usr/bin/python
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2
# -*- mode: python; coding: utf-8 -*-
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3
# 
4
# Mandos server - give out binary blobs to connecting clients.
5
# 
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
46 by Teddy Hogeborn
* network-protocol.txt: New.
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
12
# 
28 by Teddy Hogeborn
* server.conf: New file.
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
15
# 
16
# This program is free software: you can redistribute it and/or modify
17
# it under the terms of the GNU General Public License as published by
18
# the Free Software Foundation, either version 3 of the License, or
19
# (at your option) any later version.
20
#
21
#     This program is distributed in the hope that it will be useful,
22
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
23
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
24
#     GNU General Public License for more details.
25
# 
26
# You should have received a copy of the GNU General Public License
109 by Teddy Hogeborn
* .bzrignore: New.
27
# along with this program.  If not, see
28
# <http://www.gnu.org/licenses/>.
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
29
# 
28 by Teddy Hogeborn
* server.conf: New file.
30
# Contact the authors at <mandos@fukt.bsnet.se>.
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
31
# 
3 by Björn Påhlsson
Python based server
32
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
33
from __future__ import division
34
3 by Björn Påhlsson
Python based server
35
import SocketServer
36
import socket
37
import select
38
from optparse import OptionParser
39
import datetime
40
import errno
41
import gnutls.crypto
42
import gnutls.connection
43
import gnutls.errors
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
44
import gnutls.library.functions
45
import gnutls.library.constants
46
import gnutls.library.types
3 by Björn Påhlsson
Python based server
47
import ConfigParser
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
48
import sys
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
49
import re
50
import os
51
import signal
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
52
from sets import Set
53
import subprocess
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
54
import atexit
55
import stat
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
56
import logging
57
import logging.handlers
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
58
import pwd
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
59
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
60
import dbus
61
import gobject
62
import avahi
63
from dbus.mainloop.glib import DBusGMainLoop
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
64
import ctypes
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
65
57 by Teddy Hogeborn
* mandos (version): New variable.
66
version = "1.0"
13 by Björn Påhlsson
Added following support:
67
68
logger = logging.Logger('mandos')
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
69
syslogger = logging.handlers.SysLogHandler\
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
70
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
             address = "/dev/log")
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
72
syslogger.setFormatter(logging.Formatter\
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
73
                        ('Mandos: %(levelname)s: %(message)s'))
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
74
logger.addHandler(syslogger)
13 by Björn Påhlsson
Added following support:
75
61 by Teddy Hogeborn
* mandos (console): Define handler globally.
76
console = logging.StreamHandler()
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
                                       ' %(message)s'))
79
logger.addHandler(console)
28 by Teddy Hogeborn
* server.conf: New file.
80
81
class AvahiError(Exception):
82
    def __init__(self, value):
83
        self.value = value
84
    def __str__(self):
85
        return repr(self.value)
86
87
class AvahiServiceError(AvahiError):
88
    pass
89
90
class AvahiGroupError(AvahiError):
91
    pass
92
93
94
class AvahiService(object):
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
95
    """An Avahi (Zeroconf) service.
96
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
97
    interface: integer; avahi.IF_UNSPEC or an interface index.
98
               Used to optionally bind to the specified interface.
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
99
    name: string; Example: 'Mandos'
100
    type: string; Example: '_mandos._tcp'.
101
                  See <http://www.dns-sd.org/ServiceTypes.html>
102
    port: integer; what port to announce
103
    TXT: list of strings; TXT record for the service
104
    domain: string; Domain to publish on, default to .local if empty.
105
    host: string; Host to publish records for, default is localhost
106
    max_renames: integer; maximum number of renames
107
    rename_count: integer; counter so we only rename after collisions
108
                  a sensible number of times
28 by Teddy Hogeborn
* server.conf: New file.
109
    """
110
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
111
                 type = None, port = None, TXT = None, domain = "",
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
112
                 host = "", max_renames = 32768):
28 by Teddy Hogeborn
* server.conf: New file.
113
        self.interface = interface
114
        self.name = name
115
        self.type = type
116
        self.port = port
117
        if TXT is None:
118
            self.TXT = []
119
        else:
120
            self.TXT = TXT
121
        self.domain = domain
122
        self.host = host
123
        self.rename_count = 0
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
124
        self.max_renames = max_renames
28 by Teddy Hogeborn
* server.conf: New file.
125
    def rename(self):
126
        """Derived from the Avahi example code"""
127
        if self.rename_count >= self.max_renames:
109 by Teddy Hogeborn
* .bzrignore: New.
128
            logger.critical(u"No suitable Zeroconf service name found"
129
                            u" after %i retries, exiting.",
130
                            rename_count)
28 by Teddy Hogeborn
* server.conf: New file.
131
            raise AvahiServiceError("Too many renames")
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
132
        self.name = server.GetAlternativeServiceName(self.name)
109 by Teddy Hogeborn
* .bzrignore: New.
133
        logger.info(u"Changing Zeroconf service name to %r ...",
134
                    str(self.name))
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
135
        syslogger.setFormatter(logging.Formatter\
136
                               ('Mandos (%s): %%(levelname)s:'
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
137
                               ' %%(message)s' % self.name))
28 by Teddy Hogeborn
* server.conf: New file.
138
        self.remove()
139
        self.add()
140
        self.rename_count += 1
141
    def remove(self):
142
        """Derived from the Avahi example code"""
143
        if group is not None:
144
            group.Reset()
145
    def add(self):
146
        """Derived from the Avahi example code"""
147
        global group
148
        if group is None:
149
            group = dbus.Interface\
150
                    (bus.get_object(avahi.DBUS_NAME,
151
                                    server.EntryGroupNew()),
152
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
            group.connect_to_signal('StateChanged',
154
                                    entry_group_state_changed)
109 by Teddy Hogeborn
* .bzrignore: New.
155
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
28 by Teddy Hogeborn
* server.conf: New file.
156
                     service.name, service.type)
157
        group.AddService(
158
                self.interface,         # interface
159
                avahi.PROTO_INET6,      # protocol
160
                dbus.UInt32(0),         # flags
161
                self.name, self.type,
162
                self.domain, self.host,
163
                dbus.UInt16(self.port),
164
                avahi.string_array_to_txt_array(self.TXT))
165
        group.Commit()
166
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
167
# From the Avahi example code:
28 by Teddy Hogeborn
* server.conf: New file.
168
group = None                            # our entry group
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
169
# End of Avahi example code
170
171
3 by Björn Påhlsson
Python based server
172
class Client(object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
173
    """A representation of a client host served by this server.
174
    Attributes:
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
175
    name:      string; from the config file, used in log messages
176
    fingerprint: string (40 or 32 hexadecimal digits); used to
177
                 uniquely identify the client
178
    secret:    bytestring; sent verbatim (over TLS) to client
51 by Teddy Hogeborn
* clients.conf: Better comments.
179
    host:      string; available for use by the checker command
28 by Teddy Hogeborn
* server.conf: New file.
180
    created:   datetime.datetime(); object creation, not client host
181
    last_checked_ok: datetime.datetime() or None if not yet checked OK
182
    timeout:   datetime.timedelta(); How long from last_checked_ok
183
                                     until this client is invalid
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
184
    interval:  datetime.timedelta(); How often to start a new checker
185
    stop_hook: If set, called by stop() as stop_hook(self)
186
    checker:   subprocess.Popen(); a running checker process used
187
                                   to see if the client lives.
28 by Teddy Hogeborn
* server.conf: New file.
188
                                   'None' if no process is running.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
189
    checker_initiator_tag: a gobject event source tag, or None
190
    stop_initiator_tag:    - '' -
191
    checker_callback_tag:  - '' -
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
192
    checker_command: string; External command which is run to check if
28 by Teddy Hogeborn
* server.conf: New file.
193
                     client lives.  %() expansions are done at
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
194
                     runtime with vars(self) as dict, so that for
195
                     instance %(name)s can be used in the command.
196
    Private attibutes:
197
    _timeout: Real variable for 'timeout'
198
    _interval: Real variable for 'interval'
28 by Teddy Hogeborn
* server.conf: New file.
199
    _timeout_milliseconds: Used when calling gobject.timeout_add()
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
200
    _interval_milliseconds: - '' -
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
201
    """
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
202
    def _set_timeout(self, timeout):
203
        "Setter function for 'timeout' attribute"
204
        self._timeout = timeout
205
        self._timeout_milliseconds = ((self.timeout.days
206
                                       * 24 * 60 * 60 * 1000)
207
                                      + (self.timeout.seconds * 1000)
208
                                      + (self.timeout.microseconds
209
                                         // 1000))
210
    timeout = property(lambda self: self._timeout,
211
                       _set_timeout)
212
    del _set_timeout
213
    def _set_interval(self, interval):
214
        "Setter function for 'interval' attribute"
215
        self._interval = interval
216
        self._interval_milliseconds = ((self.interval.days
217
                                        * 24 * 60 * 60 * 1000)
218
                                       + (self.interval.seconds
219
                                          * 1000)
220
                                       + (self.interval.microseconds
221
                                          // 1000))
222
    interval = property(lambda self: self._interval,
223
                        _set_interval)
224
    del _set_interval
44 by Teddy Hogeborn
* ca.pem: Removed.
225
    def __init__(self, name = None, stop_hook=None, config={}):
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
226
        """Note: the 'checker' key in 'config' sets the
227
        'checker_command' attribute and *not* the 'checker'
228
        attribute."""
3 by Björn Påhlsson
Python based server
229
        self.name = name
25 by Teddy Hogeborn
* mandos-clients.conf ([DEFAULT]): New section.
230
        logger.debug(u"Creating client %r", self.name)
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
231
        # Uppercase and remove spaces from fingerprint for later
232
        # comparison purposes with return value from the fingerprint()
233
        # function
44 by Teddy Hogeborn
* ca.pem: Removed.
234
        self.fingerprint = config["fingerprint"].upper()\
235
                           .replace(u" ", u"")
25 by Teddy Hogeborn
* mandos-clients.conf ([DEFAULT]): New section.
236
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
44 by Teddy Hogeborn
* ca.pem: Removed.
237
        if "secret" in config:
238
            self.secret = config["secret"].decode(u"base64")
239
        elif "secfile" in config:
240
            sf = open(config["secfile"])
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
241
            self.secret = sf.read()
242
            sf.close()
3 by Björn Påhlsson
Python based server
243
        else:
28 by Teddy Hogeborn
* server.conf: New file.
244
            raise TypeError(u"No secret or secfile for client %s"
245
                            % self.name)
51 by Teddy Hogeborn
* clients.conf: Better comments.
246
        self.host = config.get("host", "")
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
247
        self.created = datetime.datetime.now()
28 by Teddy Hogeborn
* server.conf: New file.
248
        self.last_checked_ok = None
44 by Teddy Hogeborn
* ca.pem: Removed.
249
        self.timeout = string_to_delta(config["timeout"])
250
        self.interval = string_to_delta(config["interval"])
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
251
        self.stop_hook = stop_hook
252
        self.checker = None
253
        self.checker_initiator_tag = None
254
        self.stop_initiator_tag = None
255
        self.checker_callback_tag = None
44 by Teddy Hogeborn
* ca.pem: Removed.
256
        self.check_command = config["checker"]
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
257
    def start(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
258
        """Start this client's checker and timeout hooks"""
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
259
        # Schedule a new checker to be started an 'interval' from now,
260
        # and every interval from then on.
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
261
        self.checker_initiator_tag = gobject.timeout_add\
262
                                     (self._interval_milliseconds,
263
                                      self.start_checker)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
264
        # Also start a new checker *right now*.
265
        self.start_checker()
266
        # Schedule a stop() when 'timeout' has passed
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
267
        self.stop_initiator_tag = gobject.timeout_add\
268
                                  (self._timeout_milliseconds,
269
                                   self.stop)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
270
    def stop(self):
271
        """Stop this client.
28 by Teddy Hogeborn
* server.conf: New file.
272
        The possibility that a client might be restarted is left open,
273
        but not currently used."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
274
        # If this client doesn't have a secret, it is already stopped.
51 by Teddy Hogeborn
* clients.conf: Better comments.
275
        if hasattr(self, "secret") and self.secret:
44 by Teddy Hogeborn
* ca.pem: Removed.
276
            logger.info(u"Stopping client %s", self.name)
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
277
            self.secret = None
278
        else:
279
            return False
28 by Teddy Hogeborn
* server.conf: New file.
280
        if getattr(self, "stop_initiator_tag", False):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
281
            gobject.source_remove(self.stop_initiator_tag)
282
            self.stop_initiator_tag = None
28 by Teddy Hogeborn
* server.conf: New file.
283
        if getattr(self, "checker_initiator_tag", False):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
284
            gobject.source_remove(self.checker_initiator_tag)
285
            self.checker_initiator_tag = None
286
        self.stop_checker()
287
        if self.stop_hook:
288
            self.stop_hook(self)
289
        # Do not run this again if called by a gobject.timeout_add
290
        return False
291
    def __del__(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
292
        self.stop_hook = None
293
        self.stop()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
294
    def checker_callback(self, pid, condition):
295
        """The checker has completed, so take appropriate actions."""
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
296
        now = datetime.datetime.now()
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
297
        self.checker_callback_tag = None
298
        self.checker = None
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
299
        if os.WIFEXITED(condition) \
300
               and (os.WEXITSTATUS(condition) == 0):
44 by Teddy Hogeborn
* ca.pem: Removed.
301
            logger.info(u"Checker for %(name)s succeeded",
302
                        vars(self))
28 by Teddy Hogeborn
* server.conf: New file.
303
            self.last_checked_ok = now
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
304
            gobject.source_remove(self.stop_initiator_tag)
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
305
            self.stop_initiator_tag = gobject.timeout_add\
306
                                      (self._timeout_milliseconds,
307
                                       self.stop)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
308
        elif not os.WIFEXITED(condition):
13 by Björn Påhlsson
Added following support:
309
            logger.warning(u"Checker for %(name)s crashed?",
310
                           vars(self))
311
        else:
44 by Teddy Hogeborn
* ca.pem: Removed.
312
            logger.info(u"Checker for %(name)s failed",
313
                        vars(self))
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
314
    def start_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
315
        """Start a new checker subprocess if one is not running.
316
        If a checker already exists, leave it running and do
317
        nothing."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
318
        # The reason for not killing a running checker is that if we
319
        # did that, then if a checker (for some reason) started
320
        # running slowly and taking more than 'interval' time, the
321
        # client would inevitably timeout, since no checker would get
322
        # a chance to run to completion.  If we instead leave running
323
        # checkers alone, the checker would have to take more time
324
        # than 'timeout' for the client to be declared invalid, which
325
        # is as it should be.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
326
        if self.checker is None:
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
327
            try:
28 by Teddy Hogeborn
* server.conf: New file.
328
                # In case check_command has exactly one % operator
51 by Teddy Hogeborn
* clients.conf: Better comments.
329
                command = self.check_command % self.host
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
330
            except TypeError:
28 by Teddy Hogeborn
* server.conf: New file.
331
                # Escape attributes for the shell
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
332
                escaped_attrs = dict((key, re.escape(str(val)))
333
                                     for key, val in
334
                                     vars(self).iteritems())
13 by Björn Påhlsson
Added following support:
335
                try:
336
                    command = self.check_command % escaped_attrs
337
                except TypeError, error:
28 by Teddy Hogeborn
* server.conf: New file.
338
                    logger.error(u'Could not format string "%s":'
339
                                 u' %s', self.check_command, error)
13 by Björn Påhlsson
Added following support:
340
                    return True # Try again later
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
341
            try:
44 by Teddy Hogeborn
* ca.pem: Removed.
342
                logger.info(u"Starting checker %r for %s",
343
                            command, self.name)
94 by Teddy Hogeborn
* clients.conf ([DEFAULT]/checker): Update to new default value.
344
                # We don't need to redirect stdout and stderr, since
345
                # in normal mode, that is already done by daemon(),
346
                # and in debug mode we don't want to.  (Stdin is
347
                # always replaced by /dev/null.)
28 by Teddy Hogeborn
* server.conf: New file.
348
                self.checker = subprocess.Popen(command,
349
                                                close_fds=True,
350
                                                shell=True, cwd="/")
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
351
                self.checker_callback_tag = gobject.child_watch_add\
352
                                            (self.checker.pid,
353
                                             self.checker_callback)
94 by Teddy Hogeborn
* clients.conf ([DEFAULT]/checker): Update to new default value.
354
            except OSError, error:
13 by Björn Påhlsson
Added following support:
355
                logger.error(u"Failed to start subprocess: %s",
356
                             error)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
357
        # Re-run this periodically if run by gobject.timeout_add
358
        return True
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
359
    def stop_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
360
        """Force the checker process, if any, to stop."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
361
        if self.checker_callback_tag:
362
            gobject.source_remove(self.checker_callback_tag)
363
            self.checker_callback_tag = None
28 by Teddy Hogeborn
* server.conf: New file.
364
        if getattr(self, "checker", None) is None:
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
365
            return
51 by Teddy Hogeborn
* clients.conf: Better comments.
366
        logger.debug(u"Stopping checker for %(name)s", vars(self))
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
367
        try:
368
            os.kill(self.checker.pid, signal.SIGTERM)
369
            #os.sleep(0.5)
370
            #if self.checker.poll() is None:
371
            #    os.kill(self.checker.pid, signal.SIGKILL)
372
        except OSError, error:
28 by Teddy Hogeborn
* server.conf: New file.
373
            if error.errno != errno.ESRCH: # No such process
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
374
                raise
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
375
        self.checker = None
28 by Teddy Hogeborn
* server.conf: New file.
376
    def still_valid(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
377
        """Has the timeout not yet passed for this client?"""
28 by Teddy Hogeborn
* server.conf: New file.
378
        now = datetime.datetime.now()
379
        if self.last_checked_ok is None:
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
380
            return now < (self.created + self.timeout)
381
        else:
28 by Teddy Hogeborn
* server.conf: New file.
382
            return now < (self.last_checked_ok + self.timeout)
3 by Björn Påhlsson
Python based server
383
384
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
385
def peer_certificate(session):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
386
    "Return the peer's OpenPGP certificate as a bytestring"
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
387
    # If not an OpenPGP certificate...
388
    if gnutls.library.functions.gnutls_certificate_type_get\
389
            (session._c_object) \
390
           != gnutls.library.constants.GNUTLS_CRT_OPENPGP:
391
        # ...do the normal thing
392
        return session.peer_certificate
393
    list_size = ctypes.c_uint()
394
    cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
        (session._c_object, ctypes.byref(list_size))
396
    if list_size.value == 0:
397
        return None
398
    cert = cert_list[0]
399
    return ctypes.string_at(cert.data, cert.size)
400
401
402
def fingerprint(openpgp):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
403
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
404
    # New GnuTLS "datum" with the OpenPGP public key
405
    datum = gnutls.library.types.gnutls_datum_t\
406
        (ctypes.cast(ctypes.c_char_p(openpgp),
407
                     ctypes.POINTER(ctypes.c_ubyte)),
408
         ctypes.c_uint(len(openpgp)))
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
409
    # New empty GnuTLS certificate
410
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
411
    gnutls.library.functions.gnutls_openpgp_crt_init\
412
        (ctypes.byref(crt))
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
413
    # Import the OpenPGP public key into the certificate
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
414
    gnutls.library.functions.gnutls_openpgp_crt_import\
415
                    (crt, ctypes.byref(datum),
416
                     gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
24.1.62 by Björn Påhlsson
merge + small bugfix
417
    # Verify the self signature in the key
418
    crtverify = ctypes.c_uint();
419
    gnutls.library.functions.gnutls_openpgp_crt_verify_self\
109 by Teddy Hogeborn
* .bzrignore: New.
420
        (crt, 0, ctypes.byref(crtverify))
99 by Teddy Hogeborn
* mandos (fingerprint): Bug fix: Check crtverify.value, not crtverify.
421
    if crtverify.value != 0:
24.1.62 by Björn Påhlsson
merge + small bugfix
422
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
423
        raise gnutls.errors.CertificateSecurityError("Verify failed")
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
424
    # New buffer for the fingerprint
425
    buffer = ctypes.create_string_buffer(20)
426
    buffer_length = ctypes.c_size_t()
427
    # Get the fingerprint from the certificate into the buffer
428
    gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
        (crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
430
    # Deinit the certificate
431
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
432
    # Convert the buffer to a Python bytestring
433
    fpr = ctypes.string_at(buffer, buffer_length.value)
434
    # Convert the bytestring to hexadecimal notation
435
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
436
    return hex_fpr
437
438
3 by Björn Påhlsson
Python based server
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
440
    """A TCP request handler class.
441
    Instantiated by IPv6_TCPServer for each request to handle it.
442
    Note: This will run in its own forked process."""
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
443
    
3 by Björn Påhlsson
Python based server
444
    def handle(self):
44 by Teddy Hogeborn
* ca.pem: Removed.
445
        logger.info(u"TCP connection from: %s",
13 by Björn Påhlsson
Added following support:
446
                     unicode(self.client_address))
41 by Teddy Hogeborn
Merge.
447
        session = gnutls.connection.ClientSession\
448
                  (self.request, gnutls.connection.X509Credentials())
449
        
24.1.12 by Björn Påhlsson
merge +
450
        line = self.request.makefile().readline()
451
        logger.debug(u"Protocol version: %r", line)
24.1.11 by Björn Påhlsson
Added support for protocol version handling
452
        try:
453
            if int(line.strip().split()[0]) > 1:
454
                raise RuntimeError
455
        except (ValueError, IndexError, RuntimeError), error:
456
            logger.error(u"Unknown protocol version: %s", error)
457
            return
458
        
28 by Teddy Hogeborn
* server.conf: New file.
459
        # Note: gnutls.connection.X509Credentials is really a generic
460
        # GnuTLS certificate credentials object so long as no X.509
461
        # keys are added to it.  Therefore, we can use it here despite
462
        # using OpenPGP certificates.
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
463
        
464
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
465
        #                "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
466
        #                "+DHE-DSS"))
28 by Teddy Hogeborn
* server.conf: New file.
467
        priority = "NORMAL"             # Fallback default, since this
468
                                        # MUST be set.
469
        if self.server.settings["priority"]:
470
            priority = self.server.settings["priority"]
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
471
        gnutls.library.functions.gnutls_priority_set_direct\
472
            (session._c_object, priority, None);
473
        
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
474
        try:
475
            session.handshake()
476
        except gnutls.errors.GNUTLSError, error:
44 by Teddy Hogeborn
* ca.pem: Removed.
477
            logger.warning(u"Handshake failed: %s", error)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
478
            # Do not run session.bye() here: the session is not
479
            # established.  Just abandon the request.
480
            return
3 by Björn Påhlsson
Python based server
481
        try:
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
482
            fpr = fingerprint(peer_certificate(session))
483
        except (TypeError, gnutls.errors.GNUTLSError), error:
44 by Teddy Hogeborn
* ca.pem: Removed.
484
            logger.warning(u"Bad certificate: %s", error)
3 by Björn Påhlsson
Python based server
485
            session.bye()
486
            return
13 by Björn Påhlsson
Added following support:
487
        logger.debug(u"Fingerprint: %s", fpr)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
488
        client = None
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
489
        for c in self.server.clients:
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
490
            if c.fingerprint == fpr:
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
491
                client = c
492
                break
28 by Teddy Hogeborn
* server.conf: New file.
493
        if not client:
44 by Teddy Hogeborn
* ca.pem: Removed.
494
            logger.warning(u"Client not found for fingerprint: %s",
495
                           fpr)
28 by Teddy Hogeborn
* server.conf: New file.
496
            session.bye()
497
            return
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
498
        # Have to check if client.still_valid(), since it is possible
499
        # that the client timed out while establishing the GnuTLS
500
        # session.
28 by Teddy Hogeborn
* server.conf: New file.
501
        if not client.still_valid():
44 by Teddy Hogeborn
* ca.pem: Removed.
502
            logger.warning(u"Client %(name)s is invalid",
503
                           vars(client))
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
504
            session.bye()
505
            return
506
        sent_size = 0
507
        while sent_size < len(client.secret):
508
            sent = session.send(client.secret[sent_size:])
13 by Björn Påhlsson
Added following support:
509
            logger.debug(u"Sent: %d, remaining: %d",
510
                         sent, len(client.secret)
511
                         - (sent_size + sent))
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
512
            sent_size += sent
3 by Björn Påhlsson
Python based server
513
        session.bye()
514
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
515
3 by Björn Påhlsson
Python based server
516
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
517
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
518
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
519
        settings:       Server settings
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
520
        clients:        Set() of Client objects
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
521
        enabled:        Boolean; whether this server is activated yet
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
522
    """
523
    address_family = socket.AF_INET6
524
    def __init__(self, *args, **kwargs):
28 by Teddy Hogeborn
* server.conf: New file.
525
        if "settings" in kwargs:
526
            self.settings = kwargs["settings"]
527
            del kwargs["settings"]
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
528
        if "clients" in kwargs:
529
            self.clients = kwargs["clients"]
530
            del kwargs["clients"]
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
531
        self.enabled = False
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
532
        return super(type(self), self).__init__(*args, **kwargs)
533
    def server_bind(self):
534
        """This overrides the normal server_bind() function
535
        to bind to an interface if one was specified, and also NOT to
536
        bind to an address or port if they were not specified."""
29 by Teddy Hogeborn
* plugins.d/mandosclient.c (start_mandos_communication): Changed
537
        if self.settings["interface"]:
28 by Teddy Hogeborn
* server.conf: New file.
538
            # 25 is from /usr/include/asm-i486/socket.h
539
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
540
            try:
541
                self.socket.setsockopt(socket.SOL_SOCKET,
28 by Teddy Hogeborn
* server.conf: New file.
542
                                       SO_BINDTODEVICE,
543
                                       self.settings["interface"])
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
544
            except socket.error, error:
545
                if error[0] == errno.EPERM:
44 by Teddy Hogeborn
* ca.pem: Removed.
546
                    logger.error(u"No permission to"
547
                                 u" bind to interface %s",
548
                                 self.settings["interface"])
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
549
                else:
550
                    raise error
551
        # Only bind(2) the socket if we really need to.
552
        if self.server_address[0] or self.server_address[1]:
553
            if not self.server_address[0]:
554
                in6addr_any = "::"
555
                self.server_address = (in6addr_any,
556
                                       self.server_address[1])
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
557
            elif not self.server_address[1]:
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
558
                self.server_address = (self.server_address[0],
559
                                       0)
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
560
#                 if self.settings["interface"]:
561
#                     self.server_address = (self.server_address[0],
562
#                                            0, # port
563
#                                            0, # flowinfo
564
#                                            if_nametoindex
565
#                                            (self.settings
566
#                                             ["interface"]))
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
567
            return super(type(self), self).server_bind()
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
568
    def server_activate(self):
569
        if self.enabled:
570
            return super(type(self), self).server_activate()
571
    def enable(self):
572
        self.enabled = True
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
573
3 by Björn Påhlsson
Python based server
574
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
575
def string_to_delta(interval):
576
    """Parse a string and return a datetime.timedelta
577
578
    >>> string_to_delta('7d')
579
    datetime.timedelta(7)
580
    >>> string_to_delta('60s')
581
    datetime.timedelta(0, 60)
582
    >>> string_to_delta('60m')
583
    datetime.timedelta(0, 3600)
584
    >>> string_to_delta('24h')
585
    datetime.timedelta(1)
586
    >>> string_to_delta(u'1w')
587
    datetime.timedelta(7)
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
588
    >>> string_to_delta('5m 30s')
589
    datetime.timedelta(0, 330)
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
590
    """
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
591
    timevalue = datetime.timedelta(0)
592
    for s in interval.split():
593
        try:
594
            suffix=unicode(s[-1])
595
            value=int(s[:-1])
596
            if suffix == u"d":
597
                delta = datetime.timedelta(value)
598
            elif suffix == u"s":
599
                delta = datetime.timedelta(0, value)
600
            elif suffix == u"m":
601
                delta = datetime.timedelta(0, 0, 0, 0, value)
602
            elif suffix == u"h":
603
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
604
            elif suffix == u"w":
605
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
606
            else:
607
                raise ValueError
608
        except (ValueError, IndexError):
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
609
            raise ValueError
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
610
        timevalue += delta
611
    return timevalue
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
612
8 by Teddy Hogeborn
* Makefile (client_debug): Bug fix; add quotes and / to CERT_ROOT.
613
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
614
def server_state_changed(state):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
615
    """Derived from the Avahi example code"""
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
616
    if state == avahi.SERVER_COLLISION:
109 by Teddy Hogeborn
* .bzrignore: New.
617
        logger.error(u"Zeroconf server name collision")
28 by Teddy Hogeborn
* server.conf: New file.
618
        service.remove()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
619
    elif state == avahi.SERVER_RUNNING:
28 by Teddy Hogeborn
* server.conf: New file.
620
        service.add()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
621
622
623
def entry_group_state_changed(state, error):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
624
    """Derived from the Avahi example code"""
109 by Teddy Hogeborn
* .bzrignore: New.
625
    logger.debug(u"Avahi state change: %i", state)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
626
    
627
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
109 by Teddy Hogeborn
* .bzrignore: New.
628
        logger.debug(u"Zeroconf service established.")
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
629
    elif state == avahi.ENTRY_GROUP_COLLISION:
109 by Teddy Hogeborn
* .bzrignore: New.
630
        logger.warning(u"Zeroconf service name collision.")
28 by Teddy Hogeborn
* server.conf: New file.
631
        service.rename()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
632
    elif state == avahi.ENTRY_GROUP_FAILURE:
109 by Teddy Hogeborn
* .bzrignore: New.
633
        logger.critical(u"Avahi: Error in group state changed %s",
28 by Teddy Hogeborn
* server.conf: New file.
634
                        unicode(error))
635
        raise AvahiGroupError("State changed: %s", str(error))
636
24.1.13 by Björn Påhlsson
mandosclient
637
def if_nametoindex(interface):
28 by Teddy Hogeborn
* server.conf: New file.
638
    """Call the C function if_nametoindex(), or equivalent"""
24.1.13 by Björn Påhlsson
mandosclient
639
    global if_nametoindex
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
640
    try:
28 by Teddy Hogeborn
* server.conf: New file.
641
        if "ctypes.util" not in sys.modules:
642
            import ctypes.util
24.1.13 by Björn Påhlsson
mandosclient
643
        if_nametoindex = ctypes.cdll.LoadLibrary\
644
            (ctypes.util.find_library("c")).if_nametoindex
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
645
    except (OSError, AttributeError):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
646
        if "struct" not in sys.modules:
647
            import struct
648
        if "fcntl" not in sys.modules:
649
            import fcntl
24.1.13 by Björn Påhlsson
mandosclient
650
        def if_nametoindex(interface):
28 by Teddy Hogeborn
* server.conf: New file.
651
            "Get an interface index the hard way, i.e. using fcntl()"
652
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
653
            s = socket.socket()
654
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
655
                                struct.pack("16s16x", interface))
656
            s.close()
657
            interface_index = struct.unpack("I", ifreq[16:20])[0]
658
            return interface_index
24.1.13 by Björn Påhlsson
mandosclient
659
    return if_nametoindex(interface)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
660
661
47 by Teddy Hogeborn
* plugbasedclient.c: Renamed to "mandos-client.c". All users changed.
662
def daemon(nochdir = False, noclose = False):
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
663
    """See daemon(3).  Standard BSD Unix function.
664
    This should really exist as os.daemon, but it doesn't (yet)."""
665
    if os.fork():
666
        sys.exit()
667
    os.setsid()
668
    if not nochdir:
669
        os.chdir("/")
46 by Teddy Hogeborn
* network-protocol.txt: New.
670
    if os.fork():
671
        sys.exit()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
672
    if not noclose:
673
        # Close all standard open file descriptors
28 by Teddy Hogeborn
* server.conf: New file.
674
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
675
        if not stat.S_ISCHR(os.fstat(null).st_mode):
676
            raise OSError(errno.ENODEV,
677
                          "/dev/null not a character device")
678
        os.dup2(null, sys.stdin.fileno())
679
        os.dup2(null, sys.stdout.fileno())
680
        os.dup2(null, sys.stderr.fileno())
681
        if null > 2:
682
            os.close(null)
683
684
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
685
def main():
686
    global main_loop_started
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
687
    main_loop_started = False
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
688
    
59 by Teddy Hogeborn
* mandos (main): Use program name in --version output.
689
    parser = OptionParser(version = "%%prog %s" % version)
3 by Björn Påhlsson
Python based server
690
    parser.add_option("-i", "--interface", type="string",
28 by Teddy Hogeborn
* server.conf: New file.
691
                      metavar="IF", help="Bind to interface IF")
692
    parser.add_option("-a", "--address", type="string",
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
693
                      help="Address to listen for requests on")
28 by Teddy Hogeborn
* server.conf: New file.
694
    parser.add_option("-p", "--port", type="int",
3 by Björn Påhlsson
Python based server
695
                      help="Port number to receive requests on")
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
696
    parser.add_option("--check", action="store_true", default=False,
697
                      help="Run self-test")
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
698
    parser.add_option("--debug", action="store_true",
28 by Teddy Hogeborn
* server.conf: New file.
699
                      help="Debug mode; run in foreground and log to"
700
                      " terminal")
701
    parser.add_option("--priority", type="string", help="GnuTLS"
702
                      " priority string (see GnuTLS documentation)")
703
    parser.add_option("--servicename", type="string", metavar="NAME",
704
                      help="Zeroconf service name")
705
    parser.add_option("--configdir", type="string",
706
                      default="/etc/mandos", metavar="DIR",
707
                      help="Directory to search for configuration"
708
                      " files")
3 by Björn Påhlsson
Python based server
709
    (options, args) = parser.parse_args()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
710
    
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
711
    if options.check:
712
        import doctest
713
        doctest.testmod()
714
        sys.exit()
3 by Björn Påhlsson
Python based server
715
    
28 by Teddy Hogeborn
* server.conf: New file.
716
    # Default values for config file for server-global settings
717
    server_defaults = { "interface": "",
718
                        "address": "",
719
                        "port": "",
720
                        "debug": "False",
721
                        "priority":
722
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
723
                        "servicename": "Mandos",
724
                        }
725
    
726
    # Parse config file for server-global settings
727
    server_config = ConfigParser.SafeConfigParser(server_defaults)
728
    del server_defaults
47 by Teddy Hogeborn
* plugbasedclient.c: Renamed to "mandos-client.c". All users changed.
729
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
28 by Teddy Hogeborn
* server.conf: New file.
730
    # Convert the SafeConfigParser object to a dict
89 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages for section 5 pages.
731
    server_settings = server_config.defaults()
28 by Teddy Hogeborn
* server.conf: New file.
732
    # Use getboolean on the boolean config option
733
    server_settings["debug"] = server_config.getboolean\
89 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages for section 5 pages.
734
                               ("DEFAULT", "debug")
28 by Teddy Hogeborn
* server.conf: New file.
735
    del server_config
736
    
737
    # Override the settings from the config file with command line
738
    # options, if set.
739
    for option in ("interface", "address", "port", "debug",
740
                   "priority", "servicename", "configdir"):
741
        value = getattr(options, option)
742
        if value is not None:
743
            server_settings[option] = value
744
    del options
745
    # Now we have our good server settings in "server_settings"
746
    
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
747
    debug = server_settings["debug"]
748
    
749
    if not debug:
750
        syslogger.setLevel(logging.WARNING)
61 by Teddy Hogeborn
* mandos (console): Define handler globally.
751
        console.setLevel(logging.WARNING)
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
752
    
753
    if server_settings["servicename"] != "Mandos":
754
        syslogger.setFormatter(logging.Formatter\
755
                               ('Mandos (%s): %%(levelname)s:'
756
                                ' %%(message)s'
757
                                % server_settings["servicename"]))
758
    
28 by Teddy Hogeborn
* server.conf: New file.
759
    # Parse config file with clients
760
    client_defaults = { "timeout": "1h",
761
                        "interval": "5m",
94 by Teddy Hogeborn
* clients.conf ([DEFAULT]/checker): Update to new default value.
762
                        "checker": "fping -q -- %(host)s",
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
763
                        "host": "",
28 by Teddy Hogeborn
* server.conf: New file.
764
                        }
765
    client_config = ConfigParser.SafeConfigParser(client_defaults)
766
    client_config.read(os.path.join(server_settings["configdir"],
767
                                    "clients.conf"))
768
    
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
769
    clients = Set()
770
    tcp_server = IPv6_TCPServer((server_settings["address"],
771
                                 server_settings["port"]),
772
                                tcp_handler,
773
                                settings=server_settings,
774
                                clients=clients)
164 by Teddy Hogeborn
* mandos: Open the PID file before daemonizing, but write to it
775
    pidfilename = "/var/run/mandos.pid"
776
    try:
777
        pidfile = open(pidfilename, "w")
778
    except IOError, error:
779
        logger.error("Could not open file %r", pidfilename)
780
    
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
781
    uid = 65534
782
    gid = 65534
783
    try:
784
        uid = pwd.getpwnam("mandos").pw_uid
785
    except KeyError:
786
        try:
787
            uid = pwd.getpwnam("nobody").pw_uid
788
        except KeyError:
789
            pass
790
    try:
791
        gid = pwd.getpwnam("mandos").pw_gid
792
    except KeyError:
793
        try:
794
            gid = pwd.getpwnam("nogroup").pw_gid
795
        except KeyError:
796
            pass
797
    try:
798
        os.setuid(uid)
799
        os.setgid(gid)
800
    except OSError, error:
801
        if error[0] != errno.EPERM:
802
            raise error
164 by Teddy Hogeborn
* mandos: Open the PID file before daemonizing, but write to it
803
    
28 by Teddy Hogeborn
* server.conf: New file.
804
    global service
805
    service = AvahiService(name = server_settings["servicename"],
806
                           type = "_mandos._tcp", );
29 by Teddy Hogeborn
* plugins.d/mandosclient.c (start_mandos_communication): Changed
807
    if server_settings["interface"]:
109 by Teddy Hogeborn
* .bzrignore: New.
808
        service.interface = if_nametoindex\
809
                            (server_settings["interface"])
25 by Teddy Hogeborn
* mandos-clients.conf ([DEFAULT]): New section.
810
    
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
811
    global main_loop
812
    global bus
813
    global server
814
    # From the Avahi example code
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
815
    DBusGMainLoop(set_as_default=True )
816
    main_loop = gobject.MainLoop()
817
    bus = dbus.SystemBus()
109 by Teddy Hogeborn
* .bzrignore: New.
818
    server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
819
                                           avahi.DBUS_PATH_SERVER),
820
                            avahi.DBUS_INTERFACE_SERVER)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
821
    # End of Avahi example code
822
    
823
    def remove_from_clients(client):
824
        clients.remove(client)
825
        if not clients:
44 by Teddy Hogeborn
* ca.pem: Removed.
826
            logger.critical(u"No clients left, exiting")
28 by Teddy Hogeborn
* server.conf: New file.
827
            sys.exit()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
828
    
44 by Teddy Hogeborn
* ca.pem: Removed.
829
    clients.update(Set(Client(name = section,
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
830
                              stop_hook = remove_from_clients,
44 by Teddy Hogeborn
* ca.pem: Removed.
831
                              config
832
                              = dict(client_config.items(section)))
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
833
                       for section in client_config.sections()))
51 by Teddy Hogeborn
* clients.conf: Better comments.
834
    if not clients:
835
        logger.critical(u"No clients defined")
836
        sys.exit(1)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
837
    
94 by Teddy Hogeborn
* clients.conf ([DEFAULT]/checker): Update to new default value.
838
    if debug:
839
        # Redirect stdin so all checkers get /dev/null
840
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
841
        os.dup2(null, sys.stdin.fileno())
842
        if null > 2:
843
            os.close(null)
844
    else:
845
        # No console logging
61 by Teddy Hogeborn
* mandos (console): Define handler globally.
846
        logger.removeHandler(console)
94 by Teddy Hogeborn
* clients.conf ([DEFAULT]/checker): Update to new default value.
847
        # Close all input and output, do double fork, etc.
47 by Teddy Hogeborn
* plugbasedclient.c: Renamed to "mandos-client.c". All users changed.
848
        daemon()
51 by Teddy Hogeborn
* clients.conf: Better comments.
849
    
165 by Teddy Hogeborn
* mandos (main): Use EAFP with pidfile.
850
    try:
164 by Teddy Hogeborn
* mandos: Open the PID file before daemonizing, but write to it
851
        pid = os.getpid()
165 by Teddy Hogeborn
* mandos (main): Use EAFP with pidfile.
852
        pidfile.write(str(pid) + "\n")
853
        pidfile.close()
854
        del pidfile
855
    except IOError, err:
856
        logger.error(u"Could not write to file %r with PID %d",
857
                     pidfilename, pid)
858
    except NameError:
859
        # "pidfile" was never created
860
        pass
164 by Teddy Hogeborn
* mandos: Open the PID file before daemonizing, but write to it
861
    del pidfilename
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
862
    
863
    def cleanup():
864
        "Cleanup function; run on exit"
865
        global group
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
866
        # From the Avahi example code
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
867
        if not group is None:
868
            group.Free()
869
            group = None
870
        # End of Avahi example code
871
        
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
872
        while clients:
873
            client = clients.pop()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
874
            client.stop_hook = None
875
            client.stop()
876
    
877
    atexit.register(cleanup)
878
    
879
    if not debug:
880
        signal.signal(signal.SIGINT, signal.SIG_IGN)
28 by Teddy Hogeborn
* server.conf: New file.
881
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
882
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
883
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
884
    for client in clients:
885
        client.start()
886
    
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
887
    tcp_server.enable()
888
    tcp_server.server_activate()
889
    
28 by Teddy Hogeborn
* server.conf: New file.
890
    # Find out what port we got
891
    service.port = tcp_server.socket.getsockname()[1]
44 by Teddy Hogeborn
* ca.pem: Removed.
892
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
893
                u" scope_id %d" % tcp_server.socket.getsockname())
28 by Teddy Hogeborn
* server.conf: New file.
894
    
29 by Teddy Hogeborn
* plugins.d/mandosclient.c (start_mandos_communication): Changed
895
    #service.interface = tcp_server.socket.getsockname()[3]
28 by Teddy Hogeborn
* server.conf: New file.
896
    
897
    try:
898
        # From the Avahi example code
899
        server.connect_to_signal("StateChanged", server_state_changed)
900
        try:
901
            server_state_changed(server.GetState())
902
        except dbus.exceptions.DBusException, error:
903
            logger.critical(u"DBusException: %s", error)
904
            sys.exit(1)
905
        # End of Avahi example code
906
        
907
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
908
                             lambda *args, **kwargs:
909
                             tcp_server.handle_request\
910
                             (*args[2:], **kwargs) or True)
911
        
51 by Teddy Hogeborn
* clients.conf: Better comments.
912
        logger.debug(u"Starting main loop")
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
913
        main_loop_started = True
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
914
        main_loop.run()
28 by Teddy Hogeborn
* server.conf: New file.
915
    except AvahiError, error:
916
        logger.critical(u"AvahiError: %s" + unicode(error))
917
        sys.exit(1)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
918
    except KeyboardInterrupt:
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
919
        if debug:
920
            print
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
921
922
if __name__ == '__main__':
923
    main()