/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2008-09-12 19:12:40 UTC
  • Revision ID: teddy@fukt.bsnet.se-20080912191240-edjlcll43eoijkx0
* Makefile (install): Use "install-client-nokey".
  (install-server): Create "/etc/default" and "/usr/sbin", too.
  (install-client): Do not depend on "$(INITRAMFSTOOLS)/hooks/.".
                    Renamed to "install-client-nokey".  Split out
                    post-installation-stuff to new "install-client"
                    target.

* mandos-clients.conf.xml: White space adjustments.
* mandos-keygen.xml: - '' -
* mandos.conf.xml: - '' -
* mandos.xml: - '' -
* plugin-runner.xml: - '' -
* plugins.d/mandos-client.xml: - '' -

* overview.xml: Improved grammar.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
 
# following functions: "AvahiService.add", "AvahiService.remove",
10
 
# "server_state_changed", "entry_group_state_changed", and some lines
11
 
# in "main".
 
9
# methods "add" and "remove" in the "AvahiService" class, the
 
10
# "server_state_changed" and "entry_group_state_changed" functions,
 
11
# and some lines in "main".
12
12
# 
13
13
# Everything else is
14
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
24
24
#     GNU General Public License for more details.
25
25
# 
26
26
# You should have received a copy of the GNU General Public License
27
 
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
27
# along with this program.  If not, see
 
28
# <http://www.gnu.org/licenses/>.
28
29
# 
29
30
# Contact the authors at <mandos@fukt.bsnet.se>.
30
31
# 
54
55
import stat
55
56
import logging
56
57
import logging.handlers
 
58
import pwd
57
59
 
58
60
import dbus
59
61
import gobject
61
63
from dbus.mainloop.glib import DBusGMainLoop
62
64
import ctypes
63
65
 
64
 
# Brief description of the operation of this program:
65
 
# 
66
 
# This server announces itself as a Zeroconf service.  Connecting
67
 
# clients use the TLS protocol, with the unusual quirk that this
68
 
# server program acts as a TLS "client" while a connecting client acts
69
 
# as a TLS "server".  The client (acting as a TLS "server") must
70
 
# supply an OpenPGP certificate, and the fingerprint of this
71
 
# certificate is used by this server to look up (in a list read from a
72
 
# file at start time) which binary blob to give the client.  No other
73
 
# authentication or authorization is done by this server.
74
 
 
 
66
version = "1.0"
75
67
 
76
68
logger = logging.Logger('mandos')
77
69
syslogger = logging.handlers.SysLogHandler\
78
 
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON)
 
70
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
71
             address = "/dev/log")
79
72
syslogger.setFormatter(logging.Formatter\
80
 
                        ('%(levelname)s: %(message)s'))
 
73
                        ('Mandos: %(levelname)s: %(message)s'))
81
74
logger.addHandler(syslogger)
82
 
del syslogger
83
75
 
 
76
console = logging.StreamHandler()
 
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
 
78
                                       ' %(message)s'))
 
79
logger.addHandler(console)
84
80
 
85
81
class AvahiError(Exception):
86
82
    def __init__(self, value):
96
92
 
97
93
 
98
94
class AvahiService(object):
99
 
    """
 
95
    """An Avahi (Zeroconf) service.
 
96
    Attributes:
100
97
    interface: integer; avahi.IF_UNSPEC or an interface index.
101
98
               Used to optionally bind to the specified interface.
102
 
    name = string; Example: "Mandos"
103
 
    type = string; Example: "_mandos._tcp".
104
 
                   See <http://www.dns-sd.org/ServiceTypes.html>
105
 
    port = integer; what port to announce
106
 
    TXT = list of strings; TXT record for the service
107
 
    domain = string; Domain to publish on, default to .local if empty.
108
 
    host = string; Host to publish records for, default to localhost
109
 
                   if empty.
110
 
    max_renames = integer; maximum number of renames
111
 
    rename_count = integer; counter so we only rename after collisions
112
 
                   a sensible number of times
 
99
    name: string; Example: 'Mandos'
 
100
    type: string; Example: '_mandos._tcp'.
 
101
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
102
    port: integer; what port to announce
 
103
    TXT: list of strings; TXT record for the service
 
104
    domain: string; Domain to publish on, default to .local if empty.
 
105
    host: string; Host to publish records for, default is localhost
 
106
    max_renames: integer; maximum number of renames
 
107
    rename_count: integer; counter so we only rename after collisions
 
108
                  a sensible number of times
113
109
    """
114
110
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
111
                 type = None, port = None, TXT = None, domain = "",
116
 
                 host = "", max_renames = 12):
117
 
        """An Avahi (Zeroconf) service. """
 
112
                 host = "", max_renames = 32768):
118
113
        self.interface = interface
119
114
        self.name = name
120
115
        self.type = type
126
121
        self.domain = domain
127
122
        self.host = host
128
123
        self.rename_count = 0
 
124
        self.max_renames = max_renames
129
125
    def rename(self):
130
126
        """Derived from the Avahi example code"""
131
127
        if self.rename_count >= self.max_renames:
132
 
            logger.critical(u"No suitable service name found after %i"
133
 
                            u" retries, exiting.", rename_count)
 
128
            logger.critical(u"No suitable Zeroconf service name found"
 
129
                            u" after %i retries, exiting.",
 
130
                            rename_count)
134
131
            raise AvahiServiceError("Too many renames")
135
 
        name = server.GetAlternativeServiceName(name)
136
 
        logger.notice(u"Changing name to %r ...", name)
 
132
        self.name = server.GetAlternativeServiceName(self.name)
 
133
        logger.info(u"Changing Zeroconf service name to %r ...",
 
134
                    str(self.name))
 
135
        syslogger.setFormatter(logging.Formatter\
 
136
                               ('Mandos (%s): %%(levelname)s:'
 
137
                               ' %%(message)s' % self.name))
137
138
        self.remove()
138
139
        self.add()
139
140
        self.rename_count += 1
151
152
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
153
            group.connect_to_signal('StateChanged',
153
154
                                    entry_group_state_changed)
154
 
        logger.debug(u"Adding service '%s' of type '%s' ...",
 
155
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
155
156
                     service.name, service.type)
156
157
        group.AddService(
157
158
                self.interface,         # interface
175
176
    fingerprint: string (40 or 32 hexadecimal digits); used to
176
177
                 uniquely identify the client
177
178
    secret:    bytestring; sent verbatim (over TLS) to client
178
 
    fqdn:      string (FQDN); available for use by the checker command
 
179
    host:      string; available for use by the checker command
179
180
    created:   datetime.datetime(); object creation, not client host
180
181
    last_checked_ok: datetime.datetime() or None if not yet checked OK
181
182
    timeout:   datetime.timedelta(); How long from last_checked_ok
221
222
    interval = property(lambda self: self._interval,
222
223
                        _set_interval)
223
224
    del _set_interval
224
 
    def __init__(self, name=None, stop_hook=None, fingerprint=None,
225
 
                 secret=None, secfile=None, fqdn=None, timeout=None,
226
 
                 interval=-1, checker=None):
227
 
        """Note: the 'checker' argument sets the 'checker_command'
228
 
        attribute and not the 'checker' attribute.."""
 
225
    def __init__(self, name = None, stop_hook=None, config={}):
 
226
        """Note: the 'checker' key in 'config' sets the
 
227
        'checker_command' attribute and *not* the 'checker'
 
228
        attribute."""
229
229
        self.name = name
230
230
        logger.debug(u"Creating client %r", self.name)
231
 
        # Uppercase and remove spaces from fingerprint
232
 
        # for later comparison purposes with return value of
233
 
        # the fingerprint() function
234
 
        self.fingerprint = fingerprint.upper().replace(u" ", u"")
 
231
        # Uppercase and remove spaces from fingerprint for later
 
232
        # comparison purposes with return value from the fingerprint()
 
233
        # function
 
234
        self.fingerprint = config["fingerprint"].upper()\
 
235
                           .replace(u" ", u"")
235
236
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
236
 
        if secret:
237
 
            self.secret = secret.decode(u"base64")
238
 
        elif secfile:
239
 
            sf = open(secfile)
 
237
        if "secret" in config:
 
238
            self.secret = config["secret"].decode(u"base64")
 
239
        elif "secfile" in config:
 
240
            sf = open(config["secfile"])
240
241
            self.secret = sf.read()
241
242
            sf.close()
242
243
        else:
243
244
            raise TypeError(u"No secret or secfile for client %s"
244
245
                            % self.name)
245
 
        self.fqdn = fqdn
 
246
        self.host = config.get("host", "")
246
247
        self.created = datetime.datetime.now()
247
248
        self.last_checked_ok = None
248
 
        self.timeout = string_to_delta(timeout)
249
 
        self.interval = string_to_delta(interval)
 
249
        self.timeout = string_to_delta(config["timeout"])
 
250
        self.interval = string_to_delta(config["interval"])
250
251
        self.stop_hook = stop_hook
251
252
        self.checker = None
252
253
        self.checker_initiator_tag = None
253
254
        self.stop_initiator_tag = None
254
255
        self.checker_callback_tag = None
255
 
        self.check_command = checker
 
256
        self.check_command = config["checker"]
256
257
    def start(self):
257
258
        """Start this client's checker and timeout hooks"""
258
259
        # Schedule a new checker to be started an 'interval' from now,
271
272
        The possibility that a client might be restarted is left open,
272
273
        but not currently used."""
273
274
        # If this client doesn't have a secret, it is already stopped.
274
 
        if self.secret:
275
 
            logger.debug(u"Stopping client %s", self.name)
 
275
        if hasattr(self, "secret") and self.secret:
 
276
            logger.info(u"Stopping client %s", self.name)
276
277
            self.secret = None
277
278
        else:
278
279
            return False
297
298
        self.checker = None
298
299
        if os.WIFEXITED(condition) \
299
300
               and (os.WEXITSTATUS(condition) == 0):
300
 
            logger.debug(u"Checker for %(name)s succeeded",
301
 
                         vars(self))
 
301
            logger.info(u"Checker for %(name)s succeeded",
 
302
                        vars(self))
302
303
            self.last_checked_ok = now
303
304
            gobject.source_remove(self.stop_initiator_tag)
304
305
            self.stop_initiator_tag = gobject.timeout_add\
308
309
            logger.warning(u"Checker for %(name)s crashed?",
309
310
                           vars(self))
310
311
        else:
311
 
            logger.debug(u"Checker for %(name)s failed",
312
 
                         vars(self))
 
312
            logger.info(u"Checker for %(name)s failed",
 
313
                        vars(self))
313
314
    def start_checker(self):
314
315
        """Start a new checker subprocess if one is not running.
315
316
        If a checker already exists, leave it running and do
325
326
        if self.checker is None:
326
327
            try:
327
328
                # In case check_command has exactly one % operator
328
 
                command = self.check_command % self.fqdn
 
329
                command = self.check_command % self.host
329
330
            except TypeError:
330
331
                # Escape attributes for the shell
331
332
                escaped_attrs = dict((key, re.escape(str(val)))
338
339
                                 u' %s', self.check_command, error)
339
340
                    return True # Try again later
340
341
            try:
341
 
                logger.debug(u"Starting checker %r for %s",
342
 
                             command, self.name)
 
342
                logger.info(u"Starting checker %r for %s",
 
343
                            command, self.name)
 
344
                # We don't need to redirect stdout and stderr, since
 
345
                # in normal mode, that is already done by daemon(),
 
346
                # and in debug mode we don't want to.  (Stdin is
 
347
                # always replaced by /dev/null.)
343
348
                self.checker = subprocess.Popen(command,
344
349
                                                close_fds=True,
345
350
                                                shell=True, cwd="/")
346
351
                self.checker_callback_tag = gobject.child_watch_add\
347
352
                                            (self.checker.pid,
348
353
                                             self.checker_callback)
349
 
            except subprocess.OSError, error:
 
354
            except OSError, error:
350
355
                logger.error(u"Failed to start subprocess: %s",
351
356
                             error)
352
357
        # Re-run this periodically if run by gobject.timeout_add
358
363
            self.checker_callback_tag = None
359
364
        if getattr(self, "checker", None) is None:
360
365
            return
361
 
        logger.debug("Stopping checker for %(name)s", vars(self))
 
366
        logger.debug(u"Stopping checker for %(name)s", vars(self))
362
367
        try:
363
368
            os.kill(self.checker.pid, signal.SIGTERM)
364
369
            #os.sleep(0.5)
396
401
 
397
402
def fingerprint(openpgp):
398
403
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
399
 
    # New empty GnuTLS certificate
400
 
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
401
 
    gnutls.library.functions.gnutls_openpgp_crt_init\
402
 
        (ctypes.byref(crt))
403
404
    # New GnuTLS "datum" with the OpenPGP public key
404
405
    datum = gnutls.library.types.gnutls_datum_t\
405
406
        (ctypes.cast(ctypes.c_char_p(openpgp),
406
407
                     ctypes.POINTER(ctypes.c_ubyte)),
407
408
         ctypes.c_uint(len(openpgp)))
 
409
    # New empty GnuTLS certificate
 
410
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
411
    gnutls.library.functions.gnutls_openpgp_crt_init\
 
412
        (ctypes.byref(crt))
408
413
    # Import the OpenPGP public key into the certificate
409
 
    ret = gnutls.library.functions.gnutls_openpgp_crt_import\
410
 
        (crt,
411
 
         ctypes.byref(datum),
412
 
         gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
414
    gnutls.library.functions.gnutls_openpgp_crt_import\
 
415
                    (crt, ctypes.byref(datum),
 
416
                     gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
417
    # Verify the self signature in the key
 
418
    crtverify = ctypes.c_uint();
 
419
    gnutls.library.functions.gnutls_openpgp_crt_verify_self\
 
420
        (crt, 0, ctypes.byref(crtverify))
 
421
    if crtverify.value != 0:
 
422
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
423
        raise gnutls.errors.CertificateSecurityError("Verify failed")
413
424
    # New buffer for the fingerprint
414
425
    buffer = ctypes.create_string_buffer(20)
415
426
    buffer_length = ctypes.c_size_t()
431
442
    Note: This will run in its own forked process."""
432
443
    
433
444
    def handle(self):
434
 
        logger.debug(u"TCP connection from: %s",
 
445
        logger.info(u"TCP connection from: %s",
435
446
                     unicode(self.client_address))
436
447
        session = gnutls.connection.ClientSession\
437
448
                  (self.request, gnutls.connection.X509Credentials())
463
474
        try:
464
475
            session.handshake()
465
476
        except gnutls.errors.GNUTLSError, error:
466
 
            logger.debug(u"Handshake failed: %s", error)
 
477
            logger.warning(u"Handshake failed: %s", error)
467
478
            # Do not run session.bye() here: the session is not
468
479
            # established.  Just abandon the request.
469
480
            return
470
481
        try:
471
482
            fpr = fingerprint(peer_certificate(session))
472
483
        except (TypeError, gnutls.errors.GNUTLSError), error:
473
 
            logger.debug(u"Bad certificate: %s", error)
 
484
            logger.warning(u"Bad certificate: %s", error)
474
485
            session.bye()
475
486
            return
476
487
        logger.debug(u"Fingerprint: %s", fpr)
480
491
                client = c
481
492
                break
482
493
        if not client:
483
 
            logger.debug(u"Client not found for fingerprint: %s", fpr)
 
494
            logger.warning(u"Client not found for fingerprint: %s",
 
495
                           fpr)
484
496
            session.bye()
485
497
            return
486
498
        # Have to check if client.still_valid(), since it is possible
487
499
        # that the client timed out while establishing the GnuTLS
488
500
        # session.
489
501
        if not client.still_valid():
490
 
            logger.debug(u"Client %(name)s is invalid", vars(client))
 
502
            logger.warning(u"Client %(name)s is invalid",
 
503
                           vars(client))
491
504
            session.bye()
492
505
            return
493
506
        sent_size = 0
505
518
    Attributes:
506
519
        settings:       Server settings
507
520
        clients:        Set() of Client objects
 
521
        enabled:        Boolean; whether this server is activated yet
508
522
    """
509
523
    address_family = socket.AF_INET6
510
524
    def __init__(self, *args, **kwargs):
514
528
        if "clients" in kwargs:
515
529
            self.clients = kwargs["clients"]
516
530
            del kwargs["clients"]
 
531
        self.enabled = False
517
532
        return super(type(self), self).__init__(*args, **kwargs)
518
533
    def server_bind(self):
519
534
        """This overrides the normal server_bind() function
528
543
                                       self.settings["interface"])
529
544
            except socket.error, error:
530
545
                if error[0] == errno.EPERM:
531
 
                    logger.warning(u"No permission to"
532
 
                                   u" bind to interface %s",
533
 
                                   self.settings["interface"])
 
546
                    logger.error(u"No permission to"
 
547
                                 u" bind to interface %s",
 
548
                                 self.settings["interface"])
534
549
                else:
535
550
                    raise error
536
551
        # Only bind(2) the socket if we really need to.
539
554
                in6addr_any = "::"
540
555
                self.server_address = (in6addr_any,
541
556
                                       self.server_address[1])
542
 
            elif self.server_address[1] is None:
 
557
            elif not self.server_address[1]:
543
558
                self.server_address = (self.server_address[0],
544
559
                                       0)
 
560
#                 if self.settings["interface"]:
 
561
#                     self.server_address = (self.server_address[0],
 
562
#                                            0, # port
 
563
#                                            0, # flowinfo
 
564
#                                            if_nametoindex
 
565
#                                            (self.settings
 
566
#                                             ["interface"]))
545
567
            return super(type(self), self).server_bind()
 
568
    def server_activate(self):
 
569
        if self.enabled:
 
570
            return super(type(self), self).server_activate()
 
571
    def enable(self):
 
572
        self.enabled = True
546
573
 
547
574
 
548
575
def string_to_delta(interval):
558
585
    datetime.timedelta(1)
559
586
    >>> string_to_delta(u'1w')
560
587
    datetime.timedelta(7)
 
588
    >>> string_to_delta('5m 30s')
 
589
    datetime.timedelta(0, 330)
561
590
    """
562
 
    try:
563
 
        suffix=unicode(interval[-1])
564
 
        value=int(interval[:-1])
565
 
        if suffix == u"d":
566
 
            delta = datetime.timedelta(value)
567
 
        elif suffix == u"s":
568
 
            delta = datetime.timedelta(0, value)
569
 
        elif suffix == u"m":
570
 
            delta = datetime.timedelta(0, 0, 0, 0, value)
571
 
        elif suffix == u"h":
572
 
            delta = datetime.timedelta(0, 0, 0, 0, 0, value)
573
 
        elif suffix == u"w":
574
 
            delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
575
 
        else:
 
591
    timevalue = datetime.timedelta(0)
 
592
    for s in interval.split():
 
593
        try:
 
594
            suffix=unicode(s[-1])
 
595
            value=int(s[:-1])
 
596
            if suffix == u"d":
 
597
                delta = datetime.timedelta(value)
 
598
            elif suffix == u"s":
 
599
                delta = datetime.timedelta(0, value)
 
600
            elif suffix == u"m":
 
601
                delta = datetime.timedelta(0, 0, 0, 0, value)
 
602
            elif suffix == u"h":
 
603
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
 
604
            elif suffix == u"w":
 
605
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
 
606
            else:
 
607
                raise ValueError
 
608
        except (ValueError, IndexError):
576
609
            raise ValueError
577
 
    except (ValueError, IndexError):
578
 
        raise ValueError
579
 
    return delta
 
610
        timevalue += delta
 
611
    return timevalue
580
612
 
581
613
 
582
614
def server_state_changed(state):
583
615
    """Derived from the Avahi example code"""
584
616
    if state == avahi.SERVER_COLLISION:
585
 
        logger.warning(u"Server name collision")
 
617
        logger.error(u"Zeroconf server name collision")
586
618
        service.remove()
587
619
    elif state == avahi.SERVER_RUNNING:
588
620
        service.add()
590
622
 
591
623
def entry_group_state_changed(state, error):
592
624
    """Derived from the Avahi example code"""
593
 
    logger.debug(u"state change: %i", state)
 
625
    logger.debug(u"Avahi state change: %i", state)
594
626
    
595
627
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
596
 
        logger.debug(u"Service established.")
 
628
        logger.debug(u"Zeroconf service established.")
597
629
    elif state == avahi.ENTRY_GROUP_COLLISION:
598
 
        logger.warning(u"Service name collision.")
 
630
        logger.warning(u"Zeroconf service name collision.")
599
631
        service.rename()
600
632
    elif state == avahi.ENTRY_GROUP_FAILURE:
601
 
        logger.critical(u"Error in group state changed %s",
 
633
        logger.critical(u"Avahi: Error in group state changed %s",
602
634
                        unicode(error))
603
635
        raise AvahiGroupError("State changed: %s", str(error))
604
636
 
627
659
    return if_nametoindex(interface)
628
660
 
629
661
 
630
 
def daemon(nochdir, noclose):
 
662
def daemon(nochdir = False, noclose = False):
631
663
    """See daemon(3).  Standard BSD Unix function.
632
664
    This should really exist as os.daemon, but it doesn't (yet)."""
633
665
    if os.fork():
635
667
    os.setsid()
636
668
    if not nochdir:
637
669
        os.chdir("/")
 
670
    if os.fork():
 
671
        sys.exit()
638
672
    if not noclose:
639
673
        # Close all standard open file descriptors
640
674
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
652
686
    global main_loop_started
653
687
    main_loop_started = False
654
688
    
655
 
    parser = OptionParser()
 
689
    parser = OptionParser(version = "%%prog %s" % version)
656
690
    parser.add_option("-i", "--interface", type="string",
657
691
                      metavar="IF", help="Bind to interface IF")
658
692
    parser.add_option("-a", "--address", type="string",
661
695
                      help="Port number to receive requests on")
662
696
    parser.add_option("--check", action="store_true", default=False,
663
697
                      help="Run self-test")
664
 
    parser.add_option("--debug", action="store_true", default=False,
 
698
    parser.add_option("--debug", action="store_true",
665
699
                      help="Debug mode; run in foreground and log to"
666
700
                      " terminal")
667
701
    parser.add_option("--priority", type="string", help="GnuTLS"
692
726
    # Parse config file for server-global settings
693
727
    server_config = ConfigParser.SafeConfigParser(server_defaults)
694
728
    del server_defaults
695
 
    server_config.read(os.path.join(options.configdir, "server.conf"))
696
 
    server_section = "server"
 
729
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
697
730
    # Convert the SafeConfigParser object to a dict
698
 
    server_settings = dict(server_config.items(server_section))
 
731
    server_settings = server_config.defaults()
699
732
    # Use getboolean on the boolean config option
700
733
    server_settings["debug"] = server_config.getboolean\
701
 
                               (server_section, "debug")
 
734
                               ("DEFAULT", "debug")
702
735
    del server_config
703
736
    
704
737
    # Override the settings from the config file with command line
711
744
    del options
712
745
    # Now we have our good server settings in "server_settings"
713
746
    
 
747
    debug = server_settings["debug"]
 
748
    
 
749
    if not debug:
 
750
        syslogger.setLevel(logging.WARNING)
 
751
        console.setLevel(logging.WARNING)
 
752
    
 
753
    if server_settings["servicename"] != "Mandos":
 
754
        syslogger.setFormatter(logging.Formatter\
 
755
                               ('Mandos (%s): %%(levelname)s:'
 
756
                                ' %%(message)s'
 
757
                                % server_settings["servicename"]))
 
758
    
714
759
    # Parse config file with clients
715
760
    client_defaults = { "timeout": "1h",
716
761
                        "interval": "5m",
717
 
                        "checker": "fping -q -- %%(fqdn)s",
 
762
                        "checker": "fping -q -- %(host)s",
 
763
                        "host": "",
718
764
                        }
719
765
    client_config = ConfigParser.SafeConfigParser(client_defaults)
720
766
    client_config.read(os.path.join(server_settings["configdir"],
721
767
                                    "clients.conf"))
722
768
    
 
769
    clients = Set()
 
770
    tcp_server = IPv6_TCPServer((server_settings["address"],
 
771
                                 server_settings["port"]),
 
772
                                tcp_handler,
 
773
                                settings=server_settings,
 
774
                                clients=clients)
 
775
    pidfilename = "/var/run/mandos.pid"
 
776
    try:
 
777
        pidfile = open(pidfilename, "w")
 
778
    except IOError, error:
 
779
        logger.error("Could not open file %r", pidfilename)
 
780
    
 
781
    uid = 65534
 
782
    gid = 65534
 
783
    try:
 
784
        uid = pwd.getpwnam("mandos").pw_uid
 
785
    except KeyError:
 
786
        try:
 
787
            uid = pwd.getpwnam("nobody").pw_uid
 
788
        except KeyError:
 
789
            pass
 
790
    try:
 
791
        gid = pwd.getpwnam("mandos").pw_gid
 
792
    except KeyError:
 
793
        try:
 
794
            gid = pwd.getpwnam("nogroup").pw_gid
 
795
        except KeyError:
 
796
            pass
 
797
    try:
 
798
        os.setuid(uid)
 
799
        os.setgid(gid)
 
800
    except OSError, error:
 
801
        if error[0] != errno.EPERM:
 
802
            raise error
 
803
    
723
804
    global service
724
805
    service = AvahiService(name = server_settings["servicename"],
725
806
                           type = "_mandos._tcp", );
726
807
    if server_settings["interface"]:
727
 
        service.interface = if_nametoindex(server_settings["interface"])
 
808
        service.interface = if_nametoindex\
 
809
                            (server_settings["interface"])
728
810
    
729
811
    global main_loop
730
812
    global bus
733
815
    DBusGMainLoop(set_as_default=True )
734
816
    main_loop = gobject.MainLoop()
735
817
    bus = dbus.SystemBus()
736
 
    server = dbus.Interface(
737
 
            bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
738
 
            avahi.DBUS_INTERFACE_SERVER )
 
818
    server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
 
819
                                           avahi.DBUS_PATH_SERVER),
 
820
                            avahi.DBUS_INTERFACE_SERVER)
739
821
    # End of Avahi example code
740
822
    
741
 
    debug = server_settings["debug"]
742
 
    
743
 
    if debug:
744
 
        console = logging.StreamHandler()
745
 
        # console.setLevel(logging.DEBUG)
746
 
        console.setFormatter(logging.Formatter\
747
 
                             ('%(levelname)s: %(message)s'))
748
 
        logger.addHandler(console)
749
 
        del console
750
 
    
751
 
    clients = Set()
752
823
    def remove_from_clients(client):
753
824
        clients.remove(client)
754
825
        if not clients:
755
 
            logger.debug(u"No clients left, exiting")
 
826
            logger.critical(u"No clients left, exiting")
756
827
            sys.exit()
757
828
    
758
 
    clients.update(Set(Client(name=section,
 
829
    clients.update(Set(Client(name = section,
759
830
                              stop_hook = remove_from_clients,
760
 
                              **(dict(client_config\
761
 
                                      .items(section))))
 
831
                              config
 
832
                              = dict(client_config.items(section)))
762
833
                       for section in client_config.sections()))
763
 
    
764
 
    if not debug:
765
 
        daemon(False, False)
 
834
    if not clients:
 
835
        logger.critical(u"No clients defined")
 
836
        sys.exit(1)
 
837
    
 
838
    if debug:
 
839
        # Redirect stdin so all checkers get /dev/null
 
840
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
841
        os.dup2(null, sys.stdin.fileno())
 
842
        if null > 2:
 
843
            os.close(null)
 
844
    else:
 
845
        # No console logging
 
846
        logger.removeHandler(console)
 
847
        # Close all input and output, do double fork, etc.
 
848
        daemon()
 
849
    
 
850
    try:
 
851
        pid = os.getpid()
 
852
        pidfile.write(str(pid) + "\n")
 
853
        pidfile.close()
 
854
        del pidfile
 
855
    except IOError, err:
 
856
        logger.error(u"Could not write to file %r with PID %d",
 
857
                     pidfilename, pid)
 
858
    except NameError:
 
859
        # "pidfile" was never created
 
860
        pass
 
861
    del pidfilename
766
862
    
767
863
    def cleanup():
768
864
        "Cleanup function; run on exit"
788
884
    for client in clients:
789
885
        client.start()
790
886
    
791
 
    tcp_server = IPv6_TCPServer((server_settings["address"],
792
 
                                 server_settings["port"]),
793
 
                                tcp_handler,
794
 
                                settings=server_settings,
795
 
                                clients=clients)
 
887
    tcp_server.enable()
 
888
    tcp_server.server_activate()
 
889
    
796
890
    # Find out what port we got
797
891
    service.port = tcp_server.socket.getsockname()[1]
798
 
    logger.debug(u"Now listening on address %r, port %d, flowinfo %d,"
799
 
                 u" scope_id %d" % tcp_server.socket.getsockname())
 
892
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
 
893
                u" scope_id %d" % tcp_server.socket.getsockname())
800
894
    
801
895
    #service.interface = tcp_server.socket.getsockname()[3]
802
896
    
815
909
                             tcp_server.handle_request\
816
910
                             (*args[2:], **kwargs) or True)
817
911
        
818
 
        logger.debug("Starting main loop")
 
912
        logger.debug(u"Starting main loop")
819
913
        main_loop_started = True
820
914
        main_loop.run()
821
915
    except AvahiError, error: