To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 13
- compare with another revision
- download diff
- download tarball
- view history from revision 13
- Committer: Björn Påhlsson
- Date: 2008-07-20 02:52:20 UTC
- Revision ID: belorn@braxen-20080720025220-r5u0388uy9iu23h6
Added following support:
Pluginbased client handler
rewritten Mandos client
Avahi instead of udp server discovery
openpgp encrypted key support
Passprompt stand alone application for direct console input
Added logging for Mandos server
Pluginbased client handler
rewritten Mandos client
Avahi instead of udp server discovery
openpgp encrypted key support
Passprompt stand alone application for direct console input
Added logging for Mandos server
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- clients.conf => mandos-clients.conf
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
server.py
1
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
# Mandos server - give out binary blobs to connecting clients.
5
#
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
#
13
# Everything else is
14
# Copyright © 2008 Teddy Hogeborn
15
# Copyright © 2008 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
19
# the Free Software Foundation, either version 3 of the License, or
20
# (at your option) any later version.
21
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
# GNU General Public License for more details.
26
#
27
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
#
33
2
34
from __future__ import division, with_statement, absolute_import
3
from __future__ import division
35
4
36
5
import SocketServer
37
6
import socket
7
import select
38
8
from optparse import OptionParser
39
9
import datetime
40
10
import errno
51
21
import signal
52
22
from sets import Set
53
23
import subprocess
54
import atexit
55
import stat
56
import logging
57
import logging.handlers
58
import pwd
59
from contextlib import closing
60
24
61
25
import dbus
62
import dbus.service
63
26
import gobject
64
27
import avahi
65
28
from dbus.mainloop.glib import DBusGMainLoop
66
29
import ctypes
67
import ctypes.util
68
69
version = "1.0.2"
30
31
import logging
32
import logging.handlers
33
34
# logghandler.setFormatter(logging.Formatter('%(levelname)s %(message)s')
70
35
71
36
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
77
logger.addHandler(syslogger)
78
79
console = logging.StreamHandler()
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
82
logger.addHandler(console)
83
84
class AvahiError(Exception):
85
def __init__(self, value):
86
self.value = value
87
super(AvahiError, self).__init__()
88
def __str__(self):
89
return repr(self.value)
90
91
class AvahiServiceError(AvahiError):
92
pass
93
94
class AvahiGroupError(AvahiError):
95
pass
96
97
98
class AvahiService(object):
99
"""An Avahi (Zeroconf) service.
100
Attributes:
101
interface: integer; avahi.IF_UNSPEC or an interface index.
102
Used to optionally bind to the specified interface.
103
name: string; Example: 'Mandos'
104
type: string; Example: '_mandos._tcp'.
105
See <http://www.dns-sd.org/ServiceTypes.html>
106
port: integer; what port to announce
107
TXT: list of strings; TXT record for the service
108
domain: string; Domain to publish on, default to .local if empty.
109
host: string; Host to publish records for, default is localhost
110
max_renames: integer; maximum number of renames
111
rename_count: integer; counter so we only rename after collisions
112
a sensible number of times
113
"""
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
117
self.interface = interface
118
self.name = name
119
self.type = servicetype
120
self.port = port
121
self.TXT = TXT if TXT is not None else []
122
self.domain = domain
123
self.host = host
124
self.rename_count = 0
125
self.max_renames = max_renames
126
def rename(self):
127
"""Derived from the Avahi example code"""
128
if self.rename_count >= self.max_renames:
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
132
raise AvahiServiceError("Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
139
self.remove()
140
self.add()
141
self.rename_count += 1
142
def remove(self):
143
"""Derived from the Avahi example code"""
144
if group is not None:
145
group.Reset()
146
def add(self):
147
"""Derived from the Avahi example code"""
148
global group
149
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
157
service.name, service.type)
158
group.AddService(
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
166
group.Commit()
167
168
# From the Avahi example code:
169
group = None # our entry group
37
logger.addHandler(logging.handlers.SysLogHandler(facility = logging.handlers.SysLogHandler.LOG_DAEMON))
38
39
# This variable is used to optionally bind to a specified interface.
40
# It is a global variable to fit in with the other variables from the
41
# Avahi server example code.
42
serviceInterface = avahi.IF_UNSPEC
43
# From the Avahi server example code:
44
serviceName = "Mandos"
45
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
46
servicePort = None # Not known at startup
47
serviceTXT = [] # TXT record for the service
48
domain = "" # Domain to publish on, default to .local
49
host = "" # Host to publish records for, default to localhost
50
group = None #our entry group
51
rename_count = 12 # Counter so we only rename after collisions a
52
# sensible number of times
170
53
# End of Avahi example code
171
54
172
55
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
56
class Client(object):
179
57
"""A representation of a client host served by this server.
180
58
Attributes:
181
name: string; from the config file, used in log messages
59
name: string; from the config file, used in log messages
182
60
fingerprint: string (40 or 32 hexadecimal digits); used to
183
61
uniquely identify the client
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
62
secret: bytestring; sent verbatim (over TLS) to client
63
fqdn: string (FQDN); available for use by the checker command
64
created: datetime.datetime()
65
last_seen: datetime.datetime() or None if not yet seen
66
timeout: datetime.timedelta(); How long from last_seen until
67
this client is invalid
68
interval: datetime.timedelta(); How often to start a new checker
69
stop_hook: If set, called by stop() as stop_hook(self)
70
checker: subprocess.Popen(); a running checker process used
71
to see if the client lives.
72
Is None if no process is running.
197
73
checker_initiator_tag: a gobject event source tag, or None
198
disable_initiator_tag: - '' -
74
stop_initiator_tag: - '' -
199
75
checker_callback_tag: - '' -
200
76
checker_command: string; External command which is run to check if
201
client lives. %() expansions are done at
77
client lives. %()s expansions are done at
202
78
runtime with vars(self) as dict, so that for
203
79
instance %(name)s can be used in the command.
204
dbus_object_path: dbus.ObjectPath
205
80
Private attibutes:
206
81
_timeout: Real variable for 'timeout'
207
82
_interval: Real variable for 'interval'
208
_timeout_milliseconds: Used when calling gobject.timeout_add()
83
_timeout_milliseconds: Used by gobject.timeout_add()
209
84
_interval_milliseconds: - '' -
210
85
"""
211
86
def _set_timeout(self, timeout):
212
"Setter function for the 'timeout' attribute"
87
"Setter function for 'timeout' attribute"
213
88
self._timeout = timeout
214
89
self._timeout_milliseconds = ((self.timeout.days
215
90
* 24 * 60 * 60 * 1000)
216
91
+ (self.timeout.seconds * 1000)
217
92
+ (self.timeout.microseconds
218
93
// 1000))
219
# Emit D-Bus signal
220
self.PropertyChanged(dbus.String(u"timeout"),
221
(dbus.UInt64(self._timeout_milliseconds,
222
variant_level=1)))
223
timeout = property(lambda self: self._timeout, _set_timeout)
94
timeout = property(lambda self: self._timeout,
95
_set_timeout)
224
96
del _set_timeout
225
226
97
def _set_interval(self, interval):
227
"Setter function for the 'interval' attribute"
98
"Setter function for 'interval' attribute"
228
99
self._interval = interval
229
100
self._interval_milliseconds = ((self.interval.days
230
101
* 24 * 60 * 60 * 1000)
232
103
* 1000)
233
104
+ (self.interval.microseconds
234
105
// 1000))
235
# Emit D-Bus signal
236
self.PropertyChanged(dbus.String(u"interval"),
237
(dbus.UInt64(self._interval_milliseconds,
238
variant_level=1)))
239
interval = property(lambda self: self._interval, _set_interval)
106
interval = property(lambda self: self._interval,
107
_set_interval)
240
108
del _set_interval
241
242
def __init__(self, name = None, disable_hook=None, config=None):
243
"""Note: the 'checker' key in 'config' sets the
244
'checker_command' attribute and *not* the 'checker'
245
attribute."""
246
self.dbus_object_path = (dbus.ObjectPath
247
("/Mandos/clients/"
248
+ name.replace(".", "_")))
249
dbus.service.Object.__init__(self, bus,
250
self.dbus_object_path)
251
if config is None:
252
config = {}
109
def __init__(self, name=None, options=None, stop_hook=None,
110
fingerprint=None, secret=None, secfile=None, fqdn=None,
111
timeout=None, interval=-1, checker=None):
253
112
self.name = name
254
logger.debug(u"Creating client %r", self.name)
255
# Uppercase and remove spaces from fingerprint for later
256
# comparison purposes with return value from the fingerprint()
257
# function
258
self.fingerprint = (config["fingerprint"].upper()
259
.replace(u" ", u""))
260
logger.debug(u" Fingerprint: %s", self.fingerprint)
261
if "secret" in config:
262
self.secret = config["secret"].decode(u"base64")
263
elif "secfile" in config:
264
with closing(open(os.path.expanduser
265
(os.path.expandvars
266
(config["secfile"])))) as secfile:
267
self.secret = secfile.read()
268
else:
269
raise TypeError(u"No secret or secfile for client %s"
270
% self.name)
271
self.host = config.get("host", "")
272
self.created = datetime.datetime.utcnow()
273
self.enabled = False
274
self.last_enabled = None
275
self.last_checked_ok = None
276
self.timeout = string_to_delta(config["timeout"])
277
self.interval = string_to_delta(config["interval"])
278
self.disable_hook = disable_hook
113
# Uppercase and remove spaces from fingerprint
114
# for later comparison purposes with return value of
115
# the fingerprint() function
116
self.fingerprint = fingerprint.upper().replace(u" ", u"")
117
if secret:
118
self.secret = secret.decode(u"base64")
119
elif secfile:
120
sf = open(secfile)
121
self.secret = sf.read()
122
sf.close()
123
else:
124
raise RuntimeError(u"No secret or secfile for client %s"
125
% self.name)
126
self.fqdn = fqdn # string
127
self.created = datetime.datetime.now()
128
self.last_seen = None
129
if timeout is None:
130
timeout = options.timeout
131
self.timeout = timeout
132
if interval == -1:
133
interval = options.interval
134
else:
135
interval = string_to_delta(interval)
136
self.interval = interval
137
self.stop_hook = stop_hook
279
138
self.checker = None
280
139
self.checker_initiator_tag = None
281
self.disable_initiator_tag = None
140
self.stop_initiator_tag = None
282
141
self.checker_callback_tag = None
283
self.checker_command = config["checker"]
284
285
def enable(self):
286
"""Start this client's checker and timeout hooks"""
287
self.last_enabled = datetime.datetime.utcnow()
142
self.check_command = checker
143
def start(self):
144
"""Start this clients checker and timeout hooks"""
288
145
# Schedule a new checker to be started an 'interval' from now,
289
146
# and every interval from then on.
290
self.checker_initiator_tag = (gobject.timeout_add
291
(self._interval_milliseconds,
292
self.start_checker))
147
self.checker_initiator_tag = gobject.timeout_add\
148
(self._interval_milliseconds,
149
self.start_checker)
293
150
# Also start a new checker *right now*.
294
151
self.start_checker()
295
# Schedule a disable() when 'timeout' has passed
296
self.disable_initiator_tag = (gobject.timeout_add
297
(self._timeout_milliseconds,
298
self.disable))
299
self.enabled = True
300
# Emit D-Bus signal
301
self.PropertyChanged(dbus.String(u"enabled"),
302
dbus.Boolean(True, variant_level=1))
303
self.PropertyChanged(dbus.String(u"last_enabled"),
304
(_datetime_to_dbus(self.last_enabled,
305
variant_level=1)))
306
307
def disable(self):
308
"""Disable this client."""
309
if not getattr(self, "enabled", False):
310
return False
311
logger.info(u"Disabling client %s", self.name)
312
if getattr(self, "disable_initiator_tag", False):
313
gobject.source_remove(self.disable_initiator_tag)
314
self.disable_initiator_tag = None
315
if getattr(self, "checker_initiator_tag", False):
152
# Schedule a stop() when 'timeout' has passed
153
self.stop_initiator_tag = gobject.timeout_add\
154
(self._timeout_milliseconds,
155
self.stop)
156
def stop(self):
157
"""Stop this client.
158
The possibility that this client might be restarted is left
159
open, but not currently used."""
160
logger.debug(u"Stopping client %s", self.name)
161
self.secret = None
162
if self.stop_initiator_tag:
163
gobject.source_remove(self.stop_initiator_tag)
164
self.stop_initiator_tag = None
165
if self.checker_initiator_tag:
316
166
gobject.source_remove(self.checker_initiator_tag)
317
167
self.checker_initiator_tag = None
318
168
self.stop_checker()
319
if self.disable_hook:
320
self.disable_hook(self)
321
self.enabled = False
322
# Emit D-Bus signal
323
self.PropertyChanged(dbus.String(u"enabled"),
324
dbus.Boolean(False, variant_level=1))
169
if self.stop_hook:
170
self.stop_hook(self)
325
171
# Do not run this again if called by a gobject.timeout_add
326
172
return False
327
328
173
def __del__(self):
329
self.disable_hook = None
330
self.disable()
331
332
def checker_callback(self, pid, condition, command):
174
# Some code duplication here and in stop()
175
if hasattr(self, "stop_initiator_tag") \
176
and self.stop_initiator_tag:
177
gobject.source_remove(self.stop_initiator_tag)
178
self.stop_initiator_tag = None
179
if hasattr(self, "checker_initiator_tag") \
180
and self.checker_initiator_tag:
181
gobject.source_remove(self.checker_initiator_tag)
182
self.checker_initiator_tag = None
183
self.stop_checker()
184
def checker_callback(self, pid, condition):
333
185
"""The checker has completed, so take appropriate actions."""
334
self.checker_callback_tag = None
335
self.checker = None
336
# Emit D-Bus signal
337
self.PropertyChanged(dbus.String(u"checker_running"),
338
dbus.Boolean(False, variant_level=1))
339
if (os.WIFEXITED(condition)
340
and (os.WEXITSTATUS(condition) == 0)):
341
logger.info(u"Checker for %(name)s succeeded",
342
vars(self))
343
# Emit D-Bus signal
344
self.CheckerCompleted(dbus.Boolean(True),
345
dbus.UInt16(condition),
346
dbus.String(command))
347
self.bump_timeout()
348
elif not os.WIFEXITED(condition):
186
now = datetime.datetime.now()
187
if os.WIFEXITED(condition) \
188
and (os.WEXITSTATUS(condition) == 0):
189
logger.debug(u"Checker for %(name)s succeeded",
190
vars(self))
191
self.last_seen = now
192
gobject.source_remove(self.stop_initiator_tag)
193
self.stop_initiator_tag = gobject.timeout_add\
194
(self._timeout_milliseconds,
195
self.stop)
196
if not os.WIFEXITED(condition):
349
197
logger.warning(u"Checker for %(name)s crashed?",
350
198
vars(self))
351
# Emit D-Bus signal
352
self.CheckerCompleted(dbus.Boolean(False),
353
dbus.UInt16(condition),
354
dbus.String(command))
355
199
else:
356
logger.info(u"Checker for %(name)s failed",
357
vars(self))
358
# Emit D-Bus signal
359
self.CheckerCompleted(dbus.Boolean(False),
360
dbus.UInt16(condition),
361
dbus.String(command))
362
363
def bump_timeout(self):
364
"""Bump up the timeout for this client.
365
This should only be called when the client has been seen,
366
alive and well.
367
"""
368
self.last_checked_ok = datetime.datetime.utcnow()
369
gobject.source_remove(self.disable_initiator_tag)
370
self.disable_initiator_tag = (gobject.timeout_add
371
(self._timeout_milliseconds,
372
self.disable))
373
self.PropertyChanged(dbus.String(u"last_checked_ok"),
374
(_datetime_to_dbus(self.last_checked_ok,
375
variant_level=1)))
376
200
logger.debug(u"Checker for %(name)s failed",
201
vars(self))
202
self.checker = None
203
self.checker_callback_tag = None
377
204
def start_checker(self):
378
205
"""Start a new checker subprocess if one is not running.
379
206
If a checker already exists, leave it running and do
380
207
nothing."""
381
# The reason for not killing a running checker is that if we
382
# did that, then if a checker (for some reason) started
383
# running slowly and taking more than 'interval' time, the
384
# client would inevitably timeout, since no checker would get
385
# a chance to run to completion. If we instead leave running
386
# checkers alone, the checker would have to take more time
387
# than 'timeout' for the client to be declared invalid, which
388
# is as it should be.
389
208
if self.checker is None:
209
logger.debug(u"Starting checker for %s",
210
self.name)
390
211
try:
391
# In case checker_command has exactly one % operator
392
command = self.checker_command % self.host
212
command = self.check_command % self.fqdn
393
213
except TypeError:
394
# Escape attributes for the shell
395
214
escaped_attrs = dict((key, re.escape(str(val)))
396
215
for key, val in
397
216
vars(self).iteritems())
398
217
try:
399
command = self.checker_command % escaped_attrs
218
command = self.check_command % escaped_attrs
400
219
except TypeError, error:
401
logger.error(u'Could not format string "%s":'
402
u' %s', self.checker_command, error)
220
logger.critical(u'Could not format string "%s": %s',
221
self.check_command, error)
403
222
return True # Try again later
404
223
try:
405
logger.info(u"Starting checker %r for %s",
406
command, self.name)
407
# We don't need to redirect stdout and stderr, since
408
# in normal mode, that is already done by daemon(),
409
# and in debug mode we don't want to. (Stdin is
410
# always replaced by /dev/null.)
411
self.checker = subprocess.Popen(command,
412
close_fds=True,
413
shell=True, cwd="/")
414
# Emit D-Bus signal
415
self.CheckerStarted(command)
416
self.PropertyChanged(dbus.String("checker_running"),
417
dbus.Boolean(True, variant_level=1))
418
self.checker_callback_tag = (gobject.child_watch_add
419
(self.checker.pid,
420
self.checker_callback,
421
data=command))
422
except OSError, error:
224
self.checker = subprocess.\
225
Popen(command,
226
stdout=subprocess.PIPE,
227
close_fds=True, shell=True,
228
cwd="/")
229
self.checker_callback_tag = gobject.\
230
child_watch_add(self.checker.pid,
231
self.\
232
checker_callback)
233
except subprocess.OSError, error:
423
234
logger.error(u"Failed to start subprocess: %s",
424
235
error)
425
236
# Re-run this periodically if run by gobject.timeout_add
426
237
return True
427
428
238
def stop_checker(self):
429
239
"""Force the checker process, if any, to stop."""
430
if self.checker_callback_tag:
431
gobject.source_remove(self.checker_callback_tag)
432
self.checker_callback_tag = None
433
if getattr(self, "checker", None) is None:
240
if not hasattr(self, "checker") or self.checker is None:
434
241
return
435
logger.debug(u"Stopping checker for %(name)s", vars(self))
436
try:
437
os.kill(self.checker.pid, signal.SIGTERM)
438
#os.sleep(0.5)
439
#if self.checker.poll() is None:
440
# os.kill(self.checker.pid, signal.SIGKILL)
441
except OSError, error:
442
if error.errno != errno.ESRCH: # No such process
443
raise
242
gobject.source_remove(self.checker_callback_tag)
243
self.checker_callback_tag = None
244
os.kill(self.checker.pid, signal.SIGTERM)
245
if self.checker.poll() is None:
246
os.kill(self.checker.pid, signal.SIGKILL)
444
247
self.checker = None
445
self.PropertyChanged(dbus.String(u"checker_running"),
446
dbus.Boolean(False, variant_level=1))
447
448
def still_valid(self):
248
def still_valid(self, now=None):
449
249
"""Has the timeout not yet passed for this client?"""
450
if not getattr(self, "enabled", False):
451
return False
452
now = datetime.datetime.utcnow()
453
if self.last_checked_ok is None:
250
if now is None:
251
now = datetime.datetime.now()
252
if self.last_seen is None:
454
253
return now < (self.created + self.timeout)
455
254
else:
456
return now < (self.last_checked_ok + self.timeout)
457
458
## D-Bus methods & signals
459
_interface = u"org.mandos_system.Mandos.Client"
460
461
# BumpTimeout - method
462
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
463
BumpTimeout.__name__ = "BumpTimeout"
464
465
# CheckerCompleted - signal
466
@dbus.service.signal(_interface, signature="bqs")
467
def CheckerCompleted(self, success, condition, command):
468
"D-Bus signal"
469
pass
470
471
# CheckerStarted - signal
472
@dbus.service.signal(_interface, signature="s")
473
def CheckerStarted(self, command):
474
"D-Bus signal"
475
pass
476
477
# GetAllProperties - method
478
@dbus.service.method(_interface, out_signature="a{sv}")
479
def GetAllProperties(self):
480
"D-Bus method"
481
return dbus.Dictionary({
482
dbus.String("name"):
483
dbus.String(self.name, variant_level=1),
484
dbus.String("fingerprint"):
485
dbus.String(self.fingerprint, variant_level=1),
486
dbus.String("host"):
487
dbus.String(self.host, variant_level=1),
488
dbus.String("created"):
489
_datetime_to_dbus(self.created, variant_level=1),
490
dbus.String("last_enabled"):
491
(_datetime_to_dbus(self.last_enabled,
492
variant_level=1)
493
if self.last_enabled is not None
494
else dbus.Boolean(False, variant_level=1)),
495
dbus.String("enabled"):
496
dbus.Boolean(self.enabled, variant_level=1),
497
dbus.String("last_checked_ok"):
498
(_datetime_to_dbus(self.last_checked_ok,
499
variant_level=1)
500
if self.last_checked_ok is not None
501
else dbus.Boolean (False, variant_level=1)),
502
dbus.String("timeout"):
503
dbus.UInt64(self._timeout_milliseconds,
504
variant_level=1),
505
dbus.String("interval"):
506
dbus.UInt64(self._interval_milliseconds,
507
variant_level=1),
508
dbus.String("checker"):
509
dbus.String(self.checker_command,
510
variant_level=1),
511
dbus.String("checker_running"):
512
dbus.Boolean(self.checker is not None,
513
variant_level=1),
514
}, signature="sv")
515
516
# IsStillValid - method
517
IsStillValid = (dbus.service.method(_interface, out_signature="b")
518
(still_valid))
519
IsStillValid.__name__ = "IsStillValid"
520
521
# PropertyChanged - signal
522
@dbus.service.signal(_interface, signature="sv")
523
def PropertyChanged(self, property, value):
524
"D-Bus signal"
525
pass
526
527
# SetChecker - method
528
@dbus.service.method(_interface, in_signature="s")
529
def SetChecker(self, checker):
530
"D-Bus setter method"
531
self.checker_command = checker
532
533
# SetHost - method
534
@dbus.service.method(_interface, in_signature="s")
535
def SetHost(self, host):
536
"D-Bus setter method"
537
self.host = host
538
539
# SetInterval - method
540
@dbus.service.method(_interface, in_signature="t")
541
def SetInterval(self, milliseconds):
542
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
543
544
# SetSecret - method
545
@dbus.service.method(_interface, in_signature="ay",
546
byte_arrays=True)
547
def SetSecret(self, secret):
548
"D-Bus setter method"
549
self.secret = str(secret)
550
551
# SetTimeout - method
552
@dbus.service.method(_interface, in_signature="t")
553
def SetTimeout(self, milliseconds):
554
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
555
556
# Enable - method
557
Enable = dbus.service.method(_interface)(enable)
558
Enable.__name__ = "Enable"
559
560
# StartChecker - method
561
@dbus.service.method(_interface)
562
def StartChecker(self):
563
"D-Bus method"
564
self.start_checker()
565
566
# Disable - method
567
@dbus.service.method(_interface)
568
def Disable(self):
569
"D-Bus method"
570
self.disable()
571
572
# StopChecker - method
573
StopChecker = dbus.service.method(_interface)(stop_checker)
574
StopChecker.__name__ = "StopChecker"
575
576
del _interface
255
return now < (self.last_seen + self.timeout)
577
256
578
257
579
258
def peer_certificate(session):
580
"Return the peer's OpenPGP certificate as a bytestring"
581
259
# If not an OpenPGP certificate...
582
if (gnutls.library.functions
583
.gnutls_certificate_type_get(session._c_object)
584
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
260
if gnutls.library.functions.gnutls_certificate_type_get\
261
(session._c_object) \
262
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
585
263
# ...do the normal thing
586
264
return session.peer_certificate
587
265
list_size = ctypes.c_uint()
588
cert_list = (gnutls.library.functions
589
.gnutls_certificate_get_peers
590
(session._c_object, ctypes.byref(list_size)))
266
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
267
(session._c_object, ctypes.byref(list_size))
591
268
if list_size.value == 0:
592
269
return None
593
270
cert = cert_list[0]
595
272
596
273
597
274
def fingerprint(openpgp):
598
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
599
# New GnuTLS "datum" with the OpenPGP public key
600
datum = (gnutls.library.types
601
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
602
ctypes.POINTER
603
(ctypes.c_ubyte)),
604
ctypes.c_uint(len(openpgp))))
605
275
# New empty GnuTLS certificate
606
276
crt = gnutls.library.types.gnutls_openpgp_crt_t()
607
(gnutls.library.functions
608
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
277
gnutls.library.functions.gnutls_openpgp_crt_init\
278
(ctypes.byref(crt))
279
# New GnuTLS "datum" with the OpenPGP public key
280
datum = gnutls.library.types.gnutls_datum_t\
281
(ctypes.cast(ctypes.c_char_p(openpgp),
282
ctypes.POINTER(ctypes.c_ubyte)),
283
ctypes.c_uint(len(openpgp)))
609
284
# Import the OpenPGP public key into the certificate
610
(gnutls.library.functions
611
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
612
gnutls.library.constants
613
.GNUTLS_OPENPGP_FMT_RAW))
614
# Verify the self signature in the key
615
crtverify = ctypes.c_uint()
616
(gnutls.library.functions
617
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
618
if crtverify.value != 0:
619
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
620
raise gnutls.errors.CertificateSecurityError("Verify failed")
285
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
286
(crt,
287
ctypes.byref(datum),
288
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
621
289
# New buffer for the fingerprint
622
buf = ctypes.create_string_buffer(20)
623
buf_len = ctypes.c_size_t()
290
buffer = ctypes.create_string_buffer(20)
291
buffer_length = ctypes.c_size_t()
624
292
# Get the fingerprint from the certificate into the buffer
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
627
ctypes.byref(buf_len)))
293
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
294
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
628
295
# Deinit the certificate
629
296
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
630
297
# Convert the buffer to a Python bytestring
631
fpr = ctypes.string_at(buf, buf_len.value)
298
fpr = ctypes.string_at(buffer, buffer_length.value)
632
299
# Convert the bytestring to hexadecimal notation
633
300
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
634
301
return hex_fpr
635
302
636
303
637
class TCP_handler(SocketServer.BaseRequestHandler, object):
304
class tcp_handler(SocketServer.BaseRequestHandler, object):
638
305
"""A TCP request handler class.
639
306
Instantiated by IPv6_TCPServer for each request to handle it.
640
307
Note: This will run in its own forked process."""
641
308
642
309
def handle(self):
643
logger.info(u"TCP connection from: %s",
644
unicode(self.client_address))
645
session = (gnutls.connection
646
.ClientSession(self.request,
647
gnutls.connection
648
.X509Credentials()))
649
650
line = self.request.makefile().readline()
651
logger.debug(u"Protocol version: %r", line)
652
try:
653
if int(line.strip().split()[0]) > 1:
654
raise RuntimeError
655
except (ValueError, IndexError, RuntimeError), error:
656
logger.error(u"Unknown protocol version: %s", error)
657
return
658
659
# Note: gnutls.connection.X509Credentials is really a generic
660
# GnuTLS certificate credentials object so long as no X.509
661
# keys are added to it. Therefore, we can use it here despite
662
# using OpenPGP certificates.
310
logger.debug(u"TCP connection from: %s",
311
unicode(self.client_address))
312
session = gnutls.connection.ClientSession(self.request,
313
gnutls.connection.\
314
X509Credentials())
663
315
664
316
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
665
317
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
666
318
# "+DHE-DSS"))
667
# Use a fallback default, since this MUST be set.
668
priority = self.server.settings.get("priority", "NORMAL")
669
(gnutls.library.functions
670
.gnutls_priority_set_direct(session._c_object,
671
priority, None))
319
priority = "SECURE256"
320
321
gnutls.library.functions.gnutls_priority_set_direct\
322
(session._c_object, priority, None);
672
323
673
324
try:
674
325
session.handshake()
675
326
except gnutls.errors.GNUTLSError, error:
676
logger.warning(u"Handshake failed: %s", error)
327
logger.debug(u"Handshake failed: %s", error)
677
328
# Do not run session.bye() here: the session is not
678
329
# established. Just abandon the request.
679
330
return
680
331
try:
681
332
fpr = fingerprint(peer_certificate(session))
682
333
except (TypeError, gnutls.errors.GNUTLSError), error:
683
logger.warning(u"Bad certificate: %s", error)
334
logger.debug(u"Bad certificate: %s", error)
684
335
session.bye()
685
336
return
686
337
logger.debug(u"Fingerprint: %s", fpr)
687
for c in self.server.clients:
338
client = None
339
for c in clients:
688
340
if c.fingerprint == fpr:
689
341
client = c
690
342
break
691
else:
692
logger.warning(u"Client not found for fingerprint: %s",
693
fpr)
694
session.bye()
695
return
696
343
# Have to check if client.still_valid(), since it is possible
697
344
# that the client timed out while establishing the GnuTLS
698
345
# session.
699
if not client.still_valid():
700
logger.warning(u"Client %(name)s is invalid",
701
vars(client))
346
if (not client) or (not client.still_valid()):
347
if client:
348
logger.debug(u"Client %(name)s is invalid",
349
vars(client))
350
else:
351
logger.debug(u"Client not found for fingerprint: %s",
352
fpr)
702
353
session.bye()
703
354
return
704
## This won't work here, since we're in a fork.
705
# client.bump_timeout()
706
355
sent_size = 0
707
356
while sent_size < len(client.secret):
708
357
sent = session.send(client.secret[sent_size:])
713
362
session.bye()
714
363
715
364
716
class IPv6_TCPServer(SocketServer.ForkingMixIn,
717
SocketServer.TCPServer, object):
365
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
718
366
"""IPv6 TCP server. Accepts 'None' as address and/or port.
719
367
Attributes:
720
settings: Server settings
368
options: Command line options
721
369
clients: Set() of Client objects
722
enabled: Boolean; whether this server is activated yet
723
370
"""
724
371
address_family = socket.AF_INET6
725
372
def __init__(self, *args, **kwargs):
726
if "settings" in kwargs:
727
self.settings = kwargs["settings"]
728
del kwargs["settings"]
373
if "options" in kwargs:
374
self.options = kwargs["options"]
375
del kwargs["options"]
729
376
if "clients" in kwargs:
730
377
self.clients = kwargs["clients"]
731
378
del kwargs["clients"]
732
self.enabled = False
733
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
379
return super(type(self), self).__init__(*args, **kwargs)
734
380
def server_bind(self):
735
381
"""This overrides the normal server_bind() function
736
382
to bind to an interface if one was specified, and also NOT to
737
383
bind to an address or port if they were not specified."""
738
if self.settings["interface"]:
739
# 25 is from /usr/include/asm-i486/socket.h
740
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
384
if self.options.interface:
385
if not hasattr(socket, "SO_BINDTODEVICE"):
386
# From /usr/include/asm-i486/socket.h
387
socket.SO_BINDTODEVICE = 25
741
388
try:
742
389
self.socket.setsockopt(socket.SOL_SOCKET,
743
SO_BINDTODEVICE,
744
self.settings["interface"])
390
socket.SO_BINDTODEVICE,
391
self.options.interface)
745
392
except socket.error, error:
746
393
if error[0] == errno.EPERM:
747
logger.error(u"No permission to"
748
u" bind to interface %s",
749
self.settings["interface"])
394
logger.warning(u"No permission to"
395
u" bind to interface %s",
396
self.options.interface)
750
397
else:
751
398
raise error
752
399
# Only bind(2) the socket if we really need to.
755
402
in6addr_any = "::"
756
403
self.server_address = (in6addr_any,
757
404
self.server_address[1])
758
elif not self.server_address[1]:
405
elif self.server_address[1] is None:
759
406
self.server_address = (self.server_address[0],
760
407
0)
761
# if self.settings["interface"]:
762
# self.server_address = (self.server_address[0],
763
# 0, # port
764
# 0, # flowinfo
765
# if_nametoindex
766
# (self.settings
767
# ["interface"]))
768
return super(IPv6_TCPServer, self).server_bind()
769
def server_activate(self):
770
if self.enabled:
771
return super(IPv6_TCPServer, self).server_activate()
772
def enable(self):
773
self.enabled = True
408
return super(type(self), self).server_bind()
774
409
775
410
776
411
def string_to_delta(interval):
786
421
datetime.timedelta(1)
787
422
>>> string_to_delta(u'1w')
788
423
datetime.timedelta(7)
789
>>> string_to_delta('5m 30s')
790
datetime.timedelta(0, 330)
791
424
"""
792
timevalue = datetime.timedelta(0)
793
for s in interval.split():
794
try:
795
suffix = unicode(s[-1])
796
value = int(s[:-1])
797
if suffix == u"d":
798
delta = datetime.timedelta(value)
799
elif suffix == u"s":
800
delta = datetime.timedelta(0, value)
801
elif suffix == u"m":
802
delta = datetime.timedelta(0, 0, 0, 0, value)
803
elif suffix == u"h":
804
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
805
elif suffix == u"w":
806
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
807
else:
808
raise ValueError
809
except (ValueError, IndexError):
425
try:
426
suffix=unicode(interval[-1])
427
value=int(interval[:-1])
428
if suffix == u"d":
429
delta = datetime.timedelta(value)
430
elif suffix == u"s":
431
delta = datetime.timedelta(0, value)
432
elif suffix == u"m":
433
delta = datetime.timedelta(0, 0, 0, 0, value)
434
elif suffix == u"h":
435
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
436
elif suffix == u"w":
437
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
438
else:
810
439
raise ValueError
811
timevalue += delta
812
return timevalue
440
except (ValueError, IndexError):
441
raise ValueError
442
return delta
443
444
445
def add_service():
446
"""From the Avahi server example code"""
447
global group, serviceName, serviceType, servicePort, serviceTXT, \
448
domain, host
449
if group is None:
450
group = dbus.Interface(
451
bus.get_object( avahi.DBUS_NAME,
452
server.EntryGroupNew()),
453
avahi.DBUS_INTERFACE_ENTRY_GROUP)
454
group.connect_to_signal('StateChanged',
455
entry_group_state_changed)
456
logger.debug(u"Adding service '%s' of type '%s' ...",
457
serviceName, serviceType)
458
459
group.AddService(
460
serviceInterface, # interface
461
avahi.PROTO_INET6, # protocol
462
dbus.UInt32(0), # flags
463
serviceName, serviceType,
464
domain, host,
465
dbus.UInt16(servicePort),
466
avahi.string_array_to_txt_array(serviceTXT))
467
group.Commit()
468
469
470
def remove_service():
471
"""From the Avahi server example code"""
472
global group
473
474
if not group is None:
475
group.Reset()
813
476
814
477
815
478
def server_state_changed(state):
816
"""Derived from the Avahi example code"""
479
"""From the Avahi server example code"""
817
480
if state == avahi.SERVER_COLLISION:
818
logger.error(u"Zeroconf server name collision")
819
service.remove()
481
logger.warning(u"Server name collision")
482
remove_service()
820
483
elif state == avahi.SERVER_RUNNING:
821
service.add()
484
add_service()
822
485
823
486
824
487
def entry_group_state_changed(state, error):
825
"""Derived from the Avahi example code"""
826
logger.debug(u"Avahi state change: %i", state)
488
"""From the Avahi server example code"""
489
global serviceName, server, rename_count
490
491
logger.debug(u"state change: %i", state)
827
492
828
493
if state == avahi.ENTRY_GROUP_ESTABLISHED:
829
logger.debug(u"Zeroconf service established.")
494
logger.debug(u"Service established.")
830
495
elif state == avahi.ENTRY_GROUP_COLLISION:
831
logger.warning(u"Zeroconf service name collision.")
832
service.rename()
496
497
rename_count = rename_count - 1
498
if rename_count > 0:
499
name = server.GetAlternativeServiceName(name)
500
logger.warning(u"Service name collision, "
501
u"changing name to '%s' ...", name)
502
remove_service()
503
add_service()
504
505
else:
506
logger.error(u"No suitable service name found "
507
u"after %i retries, exiting.",
508
n_rename)
509
main_loop.quit()
833
510
elif state == avahi.ENTRY_GROUP_FAILURE:
834
logger.critical(u"Avahi: Error in group state changed %s",
835
unicode(error))
836
raise AvahiGroupError("State changed: %s", str(error))
511
logger.error(u"Error in group state changed %s",
512
unicode(error))
513
main_loop.quit()
514
return
515
837
516
838
517
def if_nametoindex(interface):
839
"""Call the C function if_nametoindex(), or equivalent"""
840
global if_nametoindex
518
"""Call the C function if_nametoindex()"""
841
519
try:
842
if_nametoindex = (ctypes.cdll.LoadLibrary
843
(ctypes.util.find_library("c"))
844
.if_nametoindex)
520
libc = ctypes.cdll.LoadLibrary("libc.so.6")
521
return libc.if_nametoindex(interface)
845
522
except (OSError, AttributeError):
846
523
if "struct" not in sys.modules:
847
524
import struct
848
525
if "fcntl" not in sys.modules:
849
526
import fcntl
850
def if_nametoindex(interface):
851
"Get an interface index the hard way, i.e. using fcntl()"
852
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
853
with closing(socket.socket()) as s:
854
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
855
struct.pack("16s16x", interface))
856
interface_index = struct.unpack("I", ifreq[16:20])[0]
857
return interface_index
858
return if_nametoindex(interface)
859
860
861
def daemon(nochdir = False, noclose = False):
862
"""See daemon(3). Standard BSD Unix function.
863
This should really exist as os.daemon, but it doesn't (yet)."""
864
if os.fork():
865
sys.exit()
866
os.setsid()
867
if not nochdir:
868
os.chdir("/")
869
if os.fork():
870
sys.exit()
871
if not noclose:
872
# Close all standard open file descriptors
873
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
874
if not stat.S_ISCHR(os.fstat(null).st_mode):
875
raise OSError(errno.ENODEV,
876
"/dev/null not a character device")
877
os.dup2(null, sys.stdin.fileno())
878
os.dup2(null, sys.stdout.fileno())
879
os.dup2(null, sys.stderr.fileno())
880
if null > 2:
881
os.close(null)
882
883
884
def main():
885
parser = OptionParser(version = "%%prog %s" % version)
527
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
528
s = socket.socket()
529
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
530
struct.pack("16s16x", interface))
531
s.close()
532
interface_index = struct.unpack("I", ifreq[16:20])[0]
533
return interface_index
534
535
536
if __name__ == '__main__':
537
parser = OptionParser()
886
538
parser.add_option("-i", "--interface", type="string",
887
metavar="IF", help="Bind to interface IF")
888
parser.add_option("-a", "--address", type="string",
889
help="Address to listen for requests on")
890
parser.add_option("-p", "--port", type="int",
539
default=None, metavar="IF",
540
help="Bind to interface IF")
541
parser.add_option("--cert", type="string", default="cert.pem",
542
metavar="FILE",
543
help="Public key certificate PEM file to use")
544
parser.add_option("--key", type="string", default="key.pem",
545
metavar="FILE",
546
help="Private key PEM file to use")
547
parser.add_option("--ca", type="string", default="ca.pem",
548
metavar="FILE",
549
help="Certificate Authority certificate PEM file to use")
550
parser.add_option("--crl", type="string", default="crl.pem",
551
metavar="FILE",
552
help="Certificate Revokation List PEM file to use")
553
parser.add_option("-p", "--port", type="int", default=None,
891
554
help="Port number to receive requests on")
555
parser.add_option("--timeout", type="string", # Parsed later
556
default="1h",
557
help="Amount of downtime allowed for clients")
558
parser.add_option("--interval", type="string", # Parsed later
559
default="5m",
560
help="How often to check that a client is up")
892
561
parser.add_option("--check", action="store_true", default=False,
893
562
help="Run self-test")
894
parser.add_option("--debug", action="store_true",
895
help="Debug mode; run in foreground and log to"
896
" terminal")
897
parser.add_option("--priority", type="string", help="GnuTLS"
898
" priority string (see GnuTLS documentation)")
899
parser.add_option("--servicename", type="string", metavar="NAME",
900
help="Zeroconf service name")
901
parser.add_option("--configdir", type="string",
902
default="/etc/mandos", metavar="DIR",
903
help="Directory to search for configuration"
904
" files")
905
options = parser.parse_args()[0]
563
parser.add_option("--debug", action="store_true", default=False,
564
help="Debug mode")
565
(options, args) = parser.parse_args()
906
566
907
567
if options.check:
908
568
import doctest
909
569
doctest.testmod()
910
570
sys.exit()
911
571
912
# Default values for config file for server-global settings
913
server_defaults = { "interface": "",
914
"address": "",
915
"port": "",
916
"debug": "False",
917
"priority":
918
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
919
"servicename": "Mandos",
920
}
921
922
# Parse config file for server-global settings
923
server_config = ConfigParser.SafeConfigParser(server_defaults)
924
del server_defaults
925
server_config.read(os.path.join(options.configdir, "mandos.conf"))
926
# Convert the SafeConfigParser object to a dict
927
server_settings = server_config.defaults()
928
# Use getboolean on the boolean config option
929
server_settings["debug"] = (server_config.getboolean
930
("DEFAULT", "debug"))
931
del server_config
932
933
# Override the settings from the config file with command line
934
# options, if set.
935
for option in ("interface", "address", "port", "debug",
936
"priority", "servicename", "configdir"):
937
value = getattr(options, option)
938
if value is not None:
939
server_settings[option] = value
940
del options
941
# Now we have our good server settings in "server_settings"
942
943
debug = server_settings["debug"]
944
945
if not debug:
946
syslogger.setLevel(logging.WARNING)
947
console.setLevel(logging.WARNING)
948
949
if server_settings["servicename"] != "Mandos":
950
syslogger.setFormatter(logging.Formatter
951
('Mandos (%s): %%(levelname)s:'
952
' %%(message)s'
953
% server_settings["servicename"]))
954
955
# Parse config file with clients
956
client_defaults = { "timeout": "1h",
957
"interval": "5m",
958
"checker": "fping -q -- %(host)s",
959
"host": "",
960
}
961
client_config = ConfigParser.SafeConfigParser(client_defaults)
962
client_config.read(os.path.join(server_settings["configdir"],
963
"clients.conf"))
964
965
clients = Set()
966
tcp_server = IPv6_TCPServer((server_settings["address"],
967
server_settings["port"]),
968
TCP_handler,
969
settings=server_settings,
970
clients=clients)
971
pidfilename = "/var/run/mandos.pid"
972
try:
973
pidfile = open(pidfilename, "w")
974
except IOError, error:
975
logger.error("Could not open file %r", pidfilename)
976
977
try:
978
uid = pwd.getpwnam("_mandos").pw_uid
979
except KeyError:
980
try:
981
uid = pwd.getpwnam("mandos").pw_uid
982
except KeyError:
983
try:
984
uid = pwd.getpwnam("nobody").pw_uid
985
except KeyError:
986
uid = 65534
987
try:
988
gid = pwd.getpwnam("_mandos").pw_gid
989
except KeyError:
990
try:
991
gid = pwd.getpwnam("mandos").pw_gid
992
except KeyError:
993
try:
994
gid = pwd.getpwnam("nogroup").pw_gid
995
except KeyError:
996
gid = 65534
997
try:
998
os.setuid(uid)
999
os.setgid(gid)
1000
except OSError, error:
1001
if error[0] != errno.EPERM:
1002
raise error
1003
1004
global service
1005
service = AvahiService(name = server_settings["servicename"],
1006
servicetype = "_mandos._tcp", )
1007
if server_settings["interface"]:
1008
service.interface = (if_nametoindex
1009
(server_settings["interface"]))
1010
1011
global main_loop
1012
global bus
1013
global server
1014
# From the Avahi example code
572
# Parse the time arguments
573
try:
574
options.timeout = string_to_delta(options.timeout)
575
except ValueError:
576
parser.error("option --timeout: Unparseable time")
577
try:
578
options.interval = string_to_delta(options.interval)
579
except ValueError:
580
parser.error("option --interval: Unparseable time")
581
582
# Parse config file
583
defaults = { "checker": "sleep 1; fping -q -- %%(fqdn)s" }
584
client_config = ConfigParser.SafeConfigParser(defaults)
585
#client_config.readfp(open("secrets.conf"), "secrets.conf")
586
client_config.read("mandos-clients.conf")
587
588
# From the Avahi server example code
1015
589
DBusGMainLoop(set_as_default=True )
1016
590
main_loop = gobject.MainLoop()
1017
591
bus = dbus.SystemBus()
1018
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1019
avahi.DBUS_PATH_SERVER),
1020
avahi.DBUS_INTERFACE_SERVER)
592
server = dbus.Interface(
593
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
594
avahi.DBUS_INTERFACE_SERVER )
1021
595
# End of Avahi example code
1022
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
1023
1024
clients.update(Set(Client(name = section,
1025
config
1026
= dict(client_config.items(section)))
596
597
debug = options.debug
598
599
clients = Set()
600
def remove_from_clients(client):
601
clients.remove(client)
602
if not clients:
603
logger.debug(u"No clients left, exiting")
604
main_loop.quit()
605
606
clients.update(Set(Client(name=section, options=options,
607
stop_hook = remove_from_clients,
608
**(dict(client_config\
609
.items(section))))
1027
610
for section in client_config.sections()))
1028
if not clients:
1029
logger.critical(u"No clients defined")
1030
sys.exit(1)
1031
1032
if debug:
1033
# Redirect stdin so all checkers get /dev/null
1034
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1035
os.dup2(null, sys.stdin.fileno())
1036
if null > 2:
1037
os.close(null)
1038
else:
1039
# No console logging
1040
logger.removeHandler(console)
1041
# Close all input and output, do double fork, etc.
1042
daemon()
1043
1044
try:
1045
pid = os.getpid()
1046
pidfile.write(str(pid) + "\n")
1047
pidfile.close()
1048
del pidfile
1049
except IOError:
1050
logger.error(u"Could not write to file %r with PID %d",
1051
pidfilename, pid)
1052
except NameError:
1053
# "pidfile" was never created
1054
pass
1055
del pidfilename
1056
1057
def cleanup():
1058
"Cleanup function; run on exit"
1059
global group
1060
# From the Avahi example code
1061
if not group is None:
1062
group.Free()
1063
group = None
1064
# End of Avahi example code
1065
1066
while clients:
1067
client = clients.pop()
1068
client.disable_hook = None
1069
client.disable()
1070
1071
atexit.register(cleanup)
1072
1073
if not debug:
1074
signal.signal(signal.SIGINT, signal.SIG_IGN)
1075
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1076
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1077
1078
class MandosServer(dbus.service.Object):
1079
"""A D-Bus proxy object"""
1080
def __init__(self):
1081
dbus.service.Object.__init__(self, bus,
1082
"/Mandos")
1083
_interface = u"org.mandos_system.Mandos"
1084
1085
@dbus.service.signal(_interface, signature="oa{sv}")
1086
def ClientAdded(self, objpath, properties):
1087
"D-Bus signal"
1088
pass
1089
1090
@dbus.service.signal(_interface, signature="o")
1091
def ClientRemoved(self, objpath):
1092
"D-Bus signal"
1093
pass
1094
1095
@dbus.service.method(_interface, out_signature="ao")
1096
def GetAllClients(self):
1097
return dbus.Array(c.dbus_object_path for c in clients)
1098
1099
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1100
def GetAllClientsWithProperties(self):
1101
return dbus.Dictionary(
1102
((c.dbus_object_path, c.GetAllProperties())
1103
for c in clients),
1104
signature="oa{sv}")
1105
1106
@dbus.service.method(_interface, in_signature="o")
1107
def RemoveClient(self, object_path):
1108
for c in clients:
1109
if c.dbus_object_path == object_path:
1110
c.disable()
1111
clients.remove(c)
1112
return
1113
raise KeyError
1114
1115
del _interface
1116
1117
mandos_server = MandosServer()
1118
1119
611
for client in clients:
1120
# Emit D-Bus signal
1121
mandos_server.ClientAdded(client.dbus_object_path,
1122
client.GetAllProperties())
1123
client.enable()
1124
1125
tcp_server.enable()
1126
tcp_server.server_activate()
1127
1128
# Find out what port we got
1129
service.port = tcp_server.socket.getsockname()[1]
1130
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1131
u" scope_id %d" % tcp_server.socket.getsockname())
1132
1133
#service.interface = tcp_server.socket.getsockname()[3]
1134
612
client.start()
613
614
tcp_server = IPv6_TCPServer((None, options.port),
615
tcp_handler,
616
options=options,
617
clients=clients)
618
# Find out what random port we got
619
servicePort = tcp_server.socket.getsockname()[1]
620
logger.debug(u"Now listening on port %d", servicePort)
621
622
if options.interface is not None:
623
serviceInterface = if_nametoindex(options.interface)
624
625
# From the Avahi server example code
626
server.connect_to_signal("StateChanged", server_state_changed)
627
server_state_changed(server.GetState())
628
# End of Avahi example code
629
630
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
631
lambda *args, **kwargs:
632
tcp_server.handle_request(*args[2:],
633
**kwargs) or True)
1135
634
try:
1136
# From the Avahi example code
1137
server.connect_to_signal("StateChanged", server_state_changed)
1138
try:
1139
server_state_changed(server.GetState())
1140
except dbus.exceptions.DBusException, error:
1141
logger.critical(u"DBusException: %s", error)
1142
sys.exit(1)
1143
# End of Avahi example code
1144
1145
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1146
lambda *args, **kwargs:
1147
(tcp_server.handle_request
1148
(*args[2:], **kwargs) or True))
1149
1150
logger.debug(u"Starting main loop")
1151
635
main_loop.run()
1152
except AvahiError, error:
1153
logger.critical(u"AvahiError: %s" + unicode(error))
1154
sys.exit(1)
1155
636
except KeyboardInterrupt:
1156
if debug:
1157
print
637
print
638
639
# Cleanup here
1158
640
1159
if __name__ == '__main__':
1160
main()
641
# From the Avahi server example code
642
if not group is None:
643
group.Free()
644
# End of Avahi example code
645
646
for client in clients:
647
client.stop_hook = None
648
client.stop()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0