To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 150
- compare with another revision
- download diff
- download tarball
- view history from revision 150
- Committer: Teddy Hogeborn
- Date: 2008-09-03 19:37:07 UTC
- Revision ID: teddy@fukt.bsnet.se-20080903193707-sas85ud9r37ubs9r
* mandos-clients.conf.xml (OPTIONS): Add info to all options about
whether it is a required or
optional.
whether it is a required or
optional.
- files added:
- plugins.d/usplash
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugins.d/mandos-client.c => plugins.d/password-request.c
- plugins.d/mandos-client.xml => plugins.d/password-request.xml
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008 Teddy Hogeborn
15
# Copyright © 2008 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import division, with_statement, absolute_import
33
from __future__ import division
35
34
36
35
import SocketServer
37
36
import socket
37
import select
38
38
from optparse import OptionParser
39
39
import datetime
40
40
import errno
55
55
import stat
56
56
import logging
57
57
import logging.handlers
58
import pwd
59
from contextlib import closing
60
58
61
59
import dbus
62
import dbus.service
63
60
import gobject
64
61
import avahi
65
62
from dbus.mainloop.glib import DBusGMainLoop
66
63
import ctypes
67
import ctypes.util
68
64
69
version = "1.0.2"
65
version = "1.0"
70
66
71
67
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
68
syslogger = logging.handlers.SysLogHandler\
69
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
70
address = "/dev/log")
71
syslogger.setFormatter(logging.Formatter\
72
('Mandos: %(levelname)s: %(message)s'))
77
73
logger.addHandler(syslogger)
78
74
79
75
console = logging.StreamHandler()
84
80
class AvahiError(Exception):
85
81
def __init__(self, value):
86
82
self.value = value
87
super(AvahiError, self).__init__()
88
83
def __str__(self):
89
84
return repr(self.value)
90
85
112
107
a sensible number of times
113
108
"""
114
109
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
110
type = None, port = None, TXT = None, domain = "",
111
host = "", max_renames = 32768):
117
112
self.interface = interface
118
113
self.name = name
119
self.type = servicetype
114
self.type = type
120
115
self.port = port
121
self.TXT = TXT if TXT is not None else []
116
if TXT is None:
117
self.TXT = []
118
else:
119
self.TXT = TXT
122
120
self.domain = domain
123
121
self.host = host
124
122
self.rename_count = 0
128
126
if self.rename_count >= self.max_renames:
129
127
logger.critical(u"No suitable Zeroconf service name found"
130
128
u" after %i retries, exiting.",
131
self.rename_count)
129
rename_count)
132
130
raise AvahiServiceError("Too many renames")
133
131
self.name = server.GetAlternativeServiceName(self.name)
134
132
logger.info(u"Changing Zeroconf service name to %r ...",
135
133
str(self.name))
136
syslogger.setFormatter(logging.Formatter
134
syslogger.setFormatter(logging.Formatter\
137
135
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
136
' %%(message)s' % self.name))
139
137
self.remove()
140
138
self.add()
141
139
self.rename_count += 1
147
145
"""Derived from the Avahi example code"""
148
146
global group
149
147
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
148
group = dbus.Interface\
149
(bus.get_object(avahi.DBUS_NAME,
152
150
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
151
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
152
group.connect_to_signal('StateChanged',
155
153
entry_group_state_changed)
156
154
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
170
168
# End of Avahi example code
171
169
172
170
173
class Client(dbus.service.Object):
171
class Client(object):
174
172
"""A representation of a client host served by this server.
175
173
Attributes:
176
174
name: string; from the config file, used in log messages
178
176
uniquely identify the client
179
177
secret: bytestring; sent verbatim (over TLS) to client
180
178
host: string; available for use by the checker command
181
created: datetime.datetime(); (UTC) object creation
182
started: datetime.datetime(); (UTC) last started
183
last_checked_ok: datetime.datetime(); (UTC) or None
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
184
181
timeout: datetime.timedelta(); How long from last_checked_ok
185
182
until this client is invalid
186
183
interval: datetime.timedelta(); How often to start a new checker
202
199
_interval_milliseconds: - '' -
203
200
"""
204
201
def _set_timeout(self, timeout):
205
"Setter function for the 'timeout' attribute"
202
"Setter function for 'timeout' attribute"
206
203
self._timeout = timeout
207
204
self._timeout_milliseconds = ((self.timeout.days
208
205
* 24 * 60 * 60 * 1000)
209
206
+ (self.timeout.seconds * 1000)
210
207
+ (self.timeout.microseconds
211
208
// 1000))
212
# Emit D-Bus signal
213
self.TimeoutChanged(self._timeout_milliseconds)
214
timeout = property(lambda self: self._timeout, _set_timeout)
209
timeout = property(lambda self: self._timeout,
210
_set_timeout)
215
211
del _set_timeout
216
217
212
def _set_interval(self, interval):
218
"Setter function for the 'interval' attribute"
213
"Setter function for 'interval' attribute"
219
214
self._interval = interval
220
215
self._interval_milliseconds = ((self.interval.days
221
216
* 24 * 60 * 60 * 1000)
223
218
* 1000)
224
219
+ (self.interval.microseconds
225
220
// 1000))
226
# Emit D-Bus signal
227
self.IntervalChanged(self._interval_milliseconds)
228
interval = property(lambda self: self._interval, _set_interval)
221
interval = property(lambda self: self._interval,
222
_set_interval)
229
223
del _set_interval
230
231
def __init__(self, name = None, stop_hook=None, config=None):
224
def __init__(self, name = None, stop_hook=None, config={}):
232
225
"""Note: the 'checker' key in 'config' sets the
233
226
'checker_command' attribute and *not* the 'checker'
234
227
attribute."""
235
dbus.service.Object.__init__(self, bus,
236
"/Mandos/clients/%s"
237
% name.replace(".", "_"))
238
if config is None:
239
config = {}
240
228
self.name = name
241
229
logger.debug(u"Creating client %r", self.name)
242
230
# Uppercase and remove spaces from fingerprint for later
243
231
# comparison purposes with return value from the fingerprint()
244
232
# function
245
self.fingerprint = (config["fingerprint"].upper()
246
.replace(u" ", u""))
233
self.fingerprint = config["fingerprint"].upper()\
234
.replace(u" ", u"")
247
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
248
236
if "secret" in config:
249
237
self.secret = config["secret"].decode(u"base64")
250
238
elif "secfile" in config:
251
with closing(open(os.path.expanduser
252
(os.path.expandvars
253
(config["secfile"])))) as secfile:
254
self.secret = secfile.read()
239
sf = open(config["secfile"])
240
self.secret = sf.read()
241
sf.close()
255
242
else:
256
243
raise TypeError(u"No secret or secfile for client %s"
257
244
% self.name)
258
245
self.host = config.get("host", "")
259
self.created = datetime.datetime.utcnow()
260
self.started = None
246
self.created = datetime.datetime.now()
261
247
self.last_checked_ok = None
262
248
self.timeout = string_to_delta(config["timeout"])
263
249
self.interval = string_to_delta(config["interval"])
267
253
self.stop_initiator_tag = None
268
254
self.checker_callback_tag = None
269
255
self.check_command = config["checker"]
270
271
256
def start(self):
272
257
"""Start this client's checker and timeout hooks"""
273
self.started = datetime.datetime.utcnow()
274
258
# Schedule a new checker to be started an 'interval' from now,
275
259
# and every interval from then on.
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self._interval_milliseconds,
278
self.start_checker))
260
self.checker_initiator_tag = gobject.timeout_add\
261
(self._interval_milliseconds,
262
self.start_checker)
279
263
# Also start a new checker *right now*.
280
264
self.start_checker()
281
265
# Schedule a stop() when 'timeout' has passed
282
self.stop_initiator_tag = (gobject.timeout_add
283
(self._timeout_milliseconds,
284
self.stop))
285
# Emit D-Bus signal
286
self.StateChanged(True)
287
266
self.stop_initiator_tag = gobject.timeout_add\
267
(self._timeout_milliseconds,
268
self.stop)
288
269
def stop(self):
289
"""Stop this client."""
290
if getattr(self, "started", None) is not None:
270
"""Stop this client.
271
The possibility that a client might be restarted is left open,
272
but not currently used."""
273
# If this client doesn't have a secret, it is already stopped.
274
if hasattr(self, "secret") and self.secret:
291
275
logger.info(u"Stopping client %s", self.name)
276
self.secret = None
292
277
else:
293
278
return False
294
279
if getattr(self, "stop_initiator_tag", False):
300
285
self.stop_checker()
301
286
if self.stop_hook:
302
287
self.stop_hook(self)
303
self.started = None
304
# Emit D-Bus signal
305
self.StateChanged(False)
306
288
# Do not run this again if called by a gobject.timeout_add
307
289
return False
308
309
290
def __del__(self):
310
291
self.stop_hook = None
311
292
self.stop()
312
313
293
def checker_callback(self, pid, condition):
314
294
"""The checker has completed, so take appropriate actions."""
295
now = datetime.datetime.now()
315
296
self.checker_callback_tag = None
316
297
self.checker = None
317
if (os.WIFEXITED(condition)
318
and (os.WEXITSTATUS(condition) == 0)):
298
if os.WIFEXITED(condition) \
299
and (os.WEXITSTATUS(condition) == 0):
319
300
logger.info(u"Checker for %(name)s succeeded",
320
301
vars(self))
321
# Emit D-Bus signal
322
self.CheckerCompleted(True)
323
self.bump_timeout()
302
self.last_checked_ok = now
303
gobject.source_remove(self.stop_initiator_tag)
304
self.stop_initiator_tag = gobject.timeout_add\
305
(self._timeout_milliseconds,
306
self.stop)
324
307
elif not os.WIFEXITED(condition):
325
308
logger.warning(u"Checker for %(name)s crashed?",
326
309
vars(self))
327
# Emit D-Bus signal
328
self.CheckerCompleted(False)
329
310
else:
330
311
logger.info(u"Checker for %(name)s failed",
331
312
vars(self))
332
# Emit D-Bus signal
333
self.CheckerCompleted(False)
334
335
def bump_timeout(self):
336
"""Bump up the timeout for this client.
337
This should only be called when the client has been seen,
338
alive and well.
339
"""
340
self.last_checked_ok = datetime.datetime.utcnow()
341
gobject.source_remove(self.stop_initiator_tag)
342
self.stop_initiator_tag = (gobject.timeout_add
343
(self._timeout_milliseconds,
344
self.stop))
345
346
313
def start_checker(self):
347
314
"""Start a new checker subprocess if one is not running.
348
315
If a checker already exists, leave it running and do
380
347
self.checker = subprocess.Popen(command,
381
348
close_fds=True,
382
349
shell=True, cwd="/")
383
self.checker_callback_tag = (gobject.child_watch_add
384
(self.checker.pid,
385
self.checker_callback))
386
# Emit D-Bus signal
387
self.CheckerStarted(command)
350
self.checker_callback_tag = gobject.child_watch_add\
351
(self.checker.pid,
352
self.checker_callback)
388
353
except OSError, error:
389
354
logger.error(u"Failed to start subprocess: %s",
390
355
error)
391
356
# Re-run this periodically if run by gobject.timeout_add
392
357
return True
393
394
358
def stop_checker(self):
395
359
"""Force the checker process, if any, to stop."""
396
360
if self.checker_callback_tag:
408
372
if error.errno != errno.ESRCH: # No such process
409
373
raise
410
374
self.checker = None
411
412
375
def still_valid(self):
413
376
"""Has the timeout not yet passed for this client?"""
414
if not self.started:
415
return False
416
now = datetime.datetime.utcnow()
377
now = datetime.datetime.now()
417
378
if self.last_checked_ok is None:
418
379
return now < (self.created + self.timeout)
419
380
else:
420
381
return now < (self.last_checked_ok + self.timeout)
421
422
## D-Bus methods & signals
423
_interface = u"org.mandos_system.Mandos.Client"
424
425
def _datetime_to_dbus_struct(dt):
426
return dbus.Struct(dt.year, dt.month, dt.day, dt.hour,
427
dt.minute, dt.second, dt.microsecond,
428
signature="nyyyyyu")
429
430
# BumpTimeout - method
431
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
432
BumpTimeout.__name__ = "BumpTimeout"
433
434
# IntervalChanged - signal
435
@dbus.service.signal(_interface, signature="t")
436
def IntervalChanged(self, t):
437
"D-Bus signal"
438
pass
439
440
# CheckerCompleted - signal
441
@dbus.service.signal(_interface, signature="b")
442
def CheckerCompleted(self, success):
443
"D-Bus signal"
444
pass
445
446
# CheckerIsRunning - method
447
@dbus.service.method(_interface, out_signature="b")
448
def CheckerIsRunning(self):
449
"D-Bus getter method"
450
return self.checker is not None
451
452
# CheckerStarted - signal
453
@dbus.service.signal(_interface, signature="s")
454
def CheckerStarted(self, command):
455
"D-Bus signal"
456
pass
457
458
# GetChecker - method
459
@dbus.service.method(_interface, out_signature="s")
460
def GetChecker(self):
461
"D-Bus getter method"
462
return self.checker_command
463
464
# GetCreated - method
465
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
466
def GetCreated(self):
467
"D-Bus getter method"
468
return datetime_to_dbus_struct(self.created)
469
470
# GetFingerprint - method
471
@dbus.service.method(_interface, out_signature="s")
472
def GetFingerprint(self):
473
"D-Bus getter method"
474
return self.fingerprint
475
476
# GetHost - method
477
@dbus.service.method(_interface, out_signature="s")
478
def GetHost(self):
479
"D-Bus getter method"
480
return self.host
481
482
# GetInterval - method
483
@dbus.service.method(_interface, out_signature="t")
484
def GetInterval(self):
485
"D-Bus getter method"
486
return self._interval_milliseconds
487
488
# GetName - method
489
@dbus.service.method(_interface, out_signature="s")
490
def GetName(self):
491
"D-Bus getter method"
492
return self.name
493
494
# GetStarted - method
495
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
496
def GetStarted(self):
497
"D-Bus getter method"
498
if self.started is not None:
499
return datetime_to_dbus_struct(self.started)
500
else:
501
return dbus.Struct(0, 0, 0, 0, 0, 0, 0,
502
signature="nyyyyyu")
503
504
# GetTimeout - method
505
@dbus.service.method(_interface, out_signature="t")
506
def GetTimeout(self):
507
"D-Bus getter method"
508
return self._timeout_milliseconds
509
510
# SetChecker - method
511
@dbus.service.method(_interface, in_signature="s")
512
def SetChecker(self, checker):
513
"D-Bus setter method"
514
self.checker_command = checker
515
516
# SetHost - method
517
@dbus.service.method(_interface, in_signature="s")
518
def SetHost(self, host):
519
"D-Bus setter method"
520
self.host = host
521
522
# SetInterval - method
523
@dbus.service.method(_interface, in_signature="t")
524
def SetInterval(self, milliseconds):
525
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
526
527
# SetTimeout - method
528
@dbus.service.method(_interface, in_signature="t")
529
def SetTimeout(self, milliseconds):
530
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
531
532
# SetSecret - method
533
@dbus.service.method(_interface, in_signature="ay",
534
byte_arrays=True)
535
def SetSecret(self, secret):
536
"D-Bus setter method"
537
self.secret = str(secret)
538
539
# Start - method
540
Start = dbus.service.method(_interface)(start)
541
Start.__name__ = "Start"
542
543
# StartChecker - method
544
StartChecker = dbus.service.method(_interface)(start_checker)
545
StartChecker.__name__ = "StartChecker"
546
547
# StateChanged - signal
548
@dbus.service.signal(_interface, signature="b")
549
def StateChanged(self, started):
550
"D-Bus signal"
551
pass
552
553
# StillValid - method
554
StillValid = (dbus.service.method(_interface, out_signature="b")
555
(still_valid))
556
StillValid.__name__ = "StillValid"
557
558
# Stop - method
559
Stop = dbus.service.method(_interface)(stop)
560
Stop.__name__ = "Stop"
561
562
# StopChecker - method
563
StopChecker = dbus.service.method(_interface)(stop_checker)
564
StopChecker.__name__ = "StopChecker"
565
566
# TimeoutChanged - signal
567
@dbus.service.signal(_interface, signature="t")
568
def TimeoutChanged(self, t):
569
"D-Bus signal"
570
pass
571
572
del _datetime_to_dbus_struct
573
del _interface
574
382
575
383
576
384
def peer_certificate(session):
577
385
"Return the peer's OpenPGP certificate as a bytestring"
578
386
# If not an OpenPGP certificate...
579
if (gnutls.library.functions
580
.gnutls_certificate_type_get(session._c_object)
581
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
387
if gnutls.library.functions.gnutls_certificate_type_get\
388
(session._c_object) \
389
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
582
390
# ...do the normal thing
583
391
return session.peer_certificate
584
392
list_size = ctypes.c_uint()
585
cert_list = (gnutls.library.functions
586
.gnutls_certificate_get_peers
587
(session._c_object, ctypes.byref(list_size)))
393
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
394
(session._c_object, ctypes.byref(list_size))
588
395
if list_size.value == 0:
589
396
return None
590
397
cert = cert_list[0]
594
401
def fingerprint(openpgp):
595
402
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
596
403
# New GnuTLS "datum" with the OpenPGP public key
597
datum = (gnutls.library.types
598
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
599
ctypes.POINTER
600
(ctypes.c_ubyte)),
601
ctypes.c_uint(len(openpgp))))
404
datum = gnutls.library.types.gnutls_datum_t\
405
(ctypes.cast(ctypes.c_char_p(openpgp),
406
ctypes.POINTER(ctypes.c_ubyte)),
407
ctypes.c_uint(len(openpgp)))
602
408
# New empty GnuTLS certificate
603
409
crt = gnutls.library.types.gnutls_openpgp_crt_t()
604
(gnutls.library.functions
605
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
410
gnutls.library.functions.gnutls_openpgp_crt_init\
411
(ctypes.byref(crt))
606
412
# Import the OpenPGP public key into the certificate
607
(gnutls.library.functions
608
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
609
gnutls.library.constants
610
.GNUTLS_OPENPGP_FMT_RAW))
413
gnutls.library.functions.gnutls_openpgp_crt_import\
414
(crt, ctypes.byref(datum),
415
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
611
416
# Verify the self signature in the key
612
crtverify = ctypes.c_uint()
613
(gnutls.library.functions
614
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
417
crtverify = ctypes.c_uint();
418
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
419
(crt, 0, ctypes.byref(crtverify))
615
420
if crtverify.value != 0:
616
421
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
617
422
raise gnutls.errors.CertificateSecurityError("Verify failed")
618
423
# New buffer for the fingerprint
619
buf = ctypes.create_string_buffer(20)
620
buf_len = ctypes.c_size_t()
424
buffer = ctypes.create_string_buffer(20)
425
buffer_length = ctypes.c_size_t()
621
426
# Get the fingerprint from the certificate into the buffer
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
624
ctypes.byref(buf_len)))
427
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
428
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
625
429
# Deinit the certificate
626
430
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
431
# Convert the buffer to a Python bytestring
628
fpr = ctypes.string_at(buf, buf_len.value)
432
fpr = ctypes.string_at(buffer, buffer_length.value)
629
433
# Convert the bytestring to hexadecimal notation
630
434
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
631
435
return hex_fpr
632
436
633
437
634
class TCP_handler(SocketServer.BaseRequestHandler, object):
438
class tcp_handler(SocketServer.BaseRequestHandler, object):
635
439
"""A TCP request handler class.
636
440
Instantiated by IPv6_TCPServer for each request to handle it.
637
441
Note: This will run in its own forked process."""
638
442
639
443
def handle(self):
640
444
logger.info(u"TCP connection from: %s",
641
unicode(self.client_address))
642
session = (gnutls.connection
643
.ClientSession(self.request,
644
gnutls.connection
645
.X509Credentials()))
445
unicode(self.client_address))
446
session = gnutls.connection.ClientSession\
447
(self.request, gnutls.connection.X509Credentials())
646
448
647
449
line = self.request.makefile().readline()
648
450
logger.debug(u"Protocol version: %r", line)
661
463
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
662
464
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
663
465
# "+DHE-DSS"))
664
# Use a fallback default, since this MUST be set.
665
priority = self.server.settings.get("priority", "NORMAL")
666
(gnutls.library.functions
667
.gnutls_priority_set_direct(session._c_object,
668
priority, None))
466
priority = "NORMAL" # Fallback default, since this
467
# MUST be set.
468
if self.server.settings["priority"]:
469
priority = self.server.settings["priority"]
470
gnutls.library.functions.gnutls_priority_set_direct\
471
(session._c_object, priority, None);
669
472
670
473
try:
671
474
session.handshake()
681
484
session.bye()
682
485
return
683
486
logger.debug(u"Fingerprint: %s", fpr)
487
client = None
684
488
for c in self.server.clients:
685
489
if c.fingerprint == fpr:
686
490
client = c
687
491
break
688
else:
492
if not client:
689
493
logger.warning(u"Client not found for fingerprint: %s",
690
494
fpr)
691
495
session.bye()
698
502
vars(client))
699
503
session.bye()
700
504
return
701
## This won't work here, since we're in a fork.
702
# client.bump_timeout()
703
505
sent_size = 0
704
506
while sent_size < len(client.secret):
705
507
sent = session.send(client.secret[sent_size:])
710
512
session.bye()
711
513
712
514
713
class IPv6_TCPServer(SocketServer.ForkingMixIn,
714
SocketServer.TCPServer, object):
515
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
715
516
"""IPv6 TCP server. Accepts 'None' as address and/or port.
716
517
Attributes:
717
518
settings: Server settings
718
519
clients: Set() of Client objects
719
enabled: Boolean; whether this server is activated yet
720
520
"""
721
521
address_family = socket.AF_INET6
722
522
def __init__(self, *args, **kwargs):
726
526
if "clients" in kwargs:
727
527
self.clients = kwargs["clients"]
728
528
del kwargs["clients"]
729
self.enabled = False
730
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
529
return super(type(self), self).__init__(*args, **kwargs)
731
530
def server_bind(self):
732
531
"""This overrides the normal server_bind() function
733
532
to bind to an interface if one was specified, and also NOT to
762
561
# if_nametoindex
763
562
# (self.settings
764
563
# ["interface"]))
765
return super(IPv6_TCPServer, self).server_bind()
766
def server_activate(self):
767
if self.enabled:
768
return super(IPv6_TCPServer, self).server_activate()
769
def enable(self):
770
self.enabled = True
564
return super(type(self), self).server_bind()
771
565
772
566
773
567
def string_to_delta(interval):
789
583
timevalue = datetime.timedelta(0)
790
584
for s in interval.split():
791
585
try:
792
suffix = unicode(s[-1])
793
value = int(s[:-1])
586
suffix=unicode(s[-1])
587
value=int(s[:-1])
794
588
if suffix == u"d":
795
589
delta = datetime.timedelta(value)
796
590
elif suffix == u"s":
836
630
"""Call the C function if_nametoindex(), or equivalent"""
837
631
global if_nametoindex
838
632
try:
839
if_nametoindex = (ctypes.cdll.LoadLibrary
840
(ctypes.util.find_library("c"))
841
.if_nametoindex)
633
if "ctypes.util" not in sys.modules:
634
import ctypes.util
635
if_nametoindex = ctypes.cdll.LoadLibrary\
636
(ctypes.util.find_library("c")).if_nametoindex
842
637
except (OSError, AttributeError):
843
638
if "struct" not in sys.modules:
844
639
import struct
847
642
def if_nametoindex(interface):
848
643
"Get an interface index the hard way, i.e. using fcntl()"
849
644
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
850
with closing(socket.socket()) as s:
851
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
852
struct.pack("16s16x", interface))
645
s = socket.socket()
646
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
647
struct.pack("16s16x", interface))
648
s.close()
853
649
interface_index = struct.unpack("I", ifreq[16:20])[0]
854
650
return interface_index
855
651
return if_nametoindex(interface)
879
675
880
676
881
677
def main():
678
global main_loop_started
679
main_loop_started = False
680
882
681
parser = OptionParser(version = "%%prog %s" % version)
883
682
parser.add_option("-i", "--interface", type="string",
884
683
metavar="IF", help="Bind to interface IF")
899
698
default="/etc/mandos", metavar="DIR",
900
699
help="Directory to search for configuration"
901
700
" files")
902
options = parser.parse_args()[0]
701
(options, args) = parser.parse_args()
903
702
904
703
if options.check:
905
704
import doctest
923
722
# Convert the SafeConfigParser object to a dict
924
723
server_settings = server_config.defaults()
925
724
# Use getboolean on the boolean config option
926
server_settings["debug"] = (server_config.getboolean
927
("DEFAULT", "debug"))
725
server_settings["debug"] = server_config.getboolean\
726
("DEFAULT", "debug")
928
727
del server_config
929
728
930
729
# Override the settings from the config file with command line
944
743
console.setLevel(logging.WARNING)
945
744
946
745
if server_settings["servicename"] != "Mandos":
947
syslogger.setFormatter(logging.Formatter
746
syslogger.setFormatter(logging.Formatter\
948
747
('Mandos (%s): %%(levelname)s:'
949
748
' %%(message)s'
950
749
% server_settings["servicename"]))
959
758
client_config.read(os.path.join(server_settings["configdir"],
960
759
"clients.conf"))
961
760
962
clients = Set()
963
tcp_server = IPv6_TCPServer((server_settings["address"],
964
server_settings["port"]),
965
TCP_handler,
966
settings=server_settings,
967
clients=clients)
968
pidfilename = "/var/run/mandos.pid"
969
try:
970
pidfile = open(pidfilename, "w")
971
except IOError, error:
972
logger.error("Could not open file %r", pidfilename)
973
974
uid = 65534
975
gid = 65534
976
try:
977
uid = pwd.getpwnam("mandos").pw_uid
978
except KeyError:
979
try:
980
uid = pwd.getpwnam("nobody").pw_uid
981
except KeyError:
982
pass
983
try:
984
gid = pwd.getpwnam("mandos").pw_gid
985
except KeyError:
986
try:
987
gid = pwd.getpwnam("nogroup").pw_gid
988
except KeyError:
989
pass
990
try:
991
os.setuid(uid)
992
os.setgid(gid)
993
except OSError, error:
994
if error[0] != errno.EPERM:
995
raise error
996
997
761
global service
998
762
service = AvahiService(name = server_settings["servicename"],
999
servicetype = "_mandos._tcp", )
763
type = "_mandos._tcp", );
1000
764
if server_settings["interface"]:
1001
service.interface = (if_nametoindex
1002
(server_settings["interface"]))
765
service.interface = if_nametoindex\
766
(server_settings["interface"])
1003
767
1004
768
global main_loop
1005
769
global bus
1012
776
avahi.DBUS_PATH_SERVER),
1013
777
avahi.DBUS_INTERFACE_SERVER)
1014
778
# End of Avahi example code
1015
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
1016
779
780
clients = Set()
1017
781
def remove_from_clients(client):
1018
782
clients.remove(client)
1019
783
if not clients:
1041
805
# Close all input and output, do double fork, etc.
1042
806
daemon()
1043
807
808
pidfilename = "/var/run/mandos/mandos.pid"
809
pid = os.getpid()
1044
810
try:
1045
pid = os.getpid()
811
pidfile = open(pidfilename, "w")
1046
812
pidfile.write(str(pid) + "\n")
1047
813
pidfile.close()
1048
814
del pidfile
1049
except IOError:
1050
logger.error(u"Could not write to file %r with PID %d",
1051
pidfilename, pid)
1052
except NameError:
1053
# "pidfile" was never created
1054
pass
1055
del pidfilename
815
except IOError, err:
816
logger.error(u"Could not write %s file with PID %d",
817
pidfilename, os.getpid())
1056
818
1057
819
def cleanup():
1058
820
"Cleanup function; run on exit"
1078
840
for client in clients:
1079
841
client.start()
1080
842
1081
tcp_server.enable()
1082
tcp_server.server_activate()
1083
843
tcp_server = IPv6_TCPServer((server_settings["address"],
844
server_settings["port"]),
845
tcp_handler,
846
settings=server_settings,
847
clients=clients)
1084
848
# Find out what port we got
1085
849
service.port = tcp_server.socket.getsockname()[1]
1086
850
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1100
864
1101
865
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1102
866
lambda *args, **kwargs:
1103
(tcp_server.handle_request
1104
(*args[2:], **kwargs) or True))
867
tcp_server.handle_request\
868
(*args[2:], **kwargs) or True)
1105
869
1106
870
logger.debug(u"Starting main loop")
871
main_loop_started = True
1107
872
main_loop.run()
1108
873
except AvahiError, error:
1109
874
logger.critical(u"AvahiError: %s" + unicode(error))
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0