/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2008-10-04 01:55:56 UTC
  • Revision ID: teddy@fukt.bsnet.se-20081004015556-hp0374bc62khen0z
* mandos-keygen.xml (FILES): Fixed id to be "files", not "file".
* mandos.xml (FILES): - '' -
  (CLIENTS, SERVER): Changed id attribute to lower case.  All
                     referrers changed.
* plugins.d/mandos-client.xml (FILES): Fixed id to be "files", not
                                       "file".

* plugins.d/password-prompt.xml (DESCRIPTION): Improved wording.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008,2009 Teddy Hogeborn
15
 
# Copyright © 2008,2009 Björn Påhlsson
 
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
16
15
# 
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
# 
33
32
 
34
 
from __future__ import division, with_statement, absolute_import
 
33
from __future__ import division
35
34
 
36
35
import SocketServer
37
36
import socket
38
 
import optparse
 
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
59
 
from contextlib import closing
60
58
 
61
59
import dbus
62
 
import dbus.service
63
60
import gobject
64
61
import avahi
65
62
from dbus.mainloop.glib import DBusGMainLoop
66
63
import ctypes
67
64
import ctypes.util
68
65
 
69
 
version = "1.0.8"
 
66
version = "1.0"
70
67
 
71
68
logger = logging.Logger('mandos')
72
 
syslogger = (logging.handlers.SysLogHandler
73
 
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
 
              address = "/dev/log"))
75
 
syslogger.setFormatter(logging.Formatter
76
 
                       ('Mandos [%(process)d]: %(levelname)s:'
77
 
                        ' %(message)s'))
 
69
syslogger = logging.handlers.SysLogHandler\
 
70
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
71
             address = "/dev/log")
 
72
syslogger.setFormatter(logging.Formatter\
 
73
                        ('Mandos: %(levelname)s: %(message)s'))
78
74
logger.addHandler(syslogger)
79
75
 
80
76
console = logging.StreamHandler()
81
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
 
                                       ' %(levelname)s: %(message)s'))
 
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
 
78
                                       ' %(message)s'))
83
79
logger.addHandler(console)
84
80
 
85
81
class AvahiError(Exception):
86
 
    def __init__(self, value, *args, **kwargs):
 
82
    def __init__(self, value):
87
83
        self.value = value
88
 
        super(AvahiError, self).__init__(value, *args, **kwargs)
89
 
    def __unicode__(self):
90
 
        return unicode(repr(self.value))
 
84
        super(AvahiError, self).__init__()
 
85
    def __str__(self):
 
86
        return repr(self.value)
91
87
 
92
88
class AvahiServiceError(AvahiError):
93
89
    pass
113
109
                  a sensible number of times
114
110
    """
115
111
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
 
                 servicetype = None, port = None, TXT = None,
117
 
                 domain = "", host = "", max_renames = 32768,
118
 
                 protocol = avahi.PROTO_UNSPEC):
 
112
                 servicetype = None, port = None, TXT = None, domain = "",
 
113
                 host = "", max_renames = 32768):
119
114
        self.interface = interface
120
115
        self.name = name
121
116
        self.type = servicetype
122
117
        self.port = port
123
 
        self.TXT = TXT if TXT is not None else []
 
118
        if TXT is None:
 
119
            self.TXT = []
 
120
        else:
 
121
            self.TXT = TXT
124
122
        self.domain = domain
125
123
        self.host = host
126
124
        self.rename_count = 0
127
125
        self.max_renames = max_renames
128
 
        self.protocol = protocol
129
126
    def rename(self):
130
127
        """Derived from the Avahi example code"""
131
128
        if self.rename_count >= self.max_renames:
132
129
            logger.critical(u"No suitable Zeroconf service name found"
133
130
                            u" after %i retries, exiting.",
134
131
                            self.rename_count)
135
 
            raise AvahiServiceError(u"Too many renames")
 
132
            raise AvahiServiceError("Too many renames")
136
133
        self.name = server.GetAlternativeServiceName(self.name)
137
134
        logger.info(u"Changing Zeroconf service name to %r ...",
138
135
                    str(self.name))
139
 
        syslogger.setFormatter(logging.Formatter
 
136
        syslogger.setFormatter(logging.Formatter\
140
137
                               ('Mandos (%s): %%(levelname)s:'
141
 
                                ' %%(message)s' % self.name))
 
138
                               ' %%(message)s' % self.name))
142
139
        self.remove()
143
140
        self.add()
144
141
        self.rename_count += 1
150
147
        """Derived from the Avahi example code"""
151
148
        global group
152
149
        if group is None:
153
 
            group = dbus.Interface(bus.get_object
154
 
                                   (avahi.DBUS_NAME,
 
150
            group = dbus.Interface\
 
151
                    (bus.get_object(avahi.DBUS_NAME,
155
152
                                    server.EntryGroupNew()),
156
 
                                   avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
153
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
157
154
            group.connect_to_signal('StateChanged',
158
155
                                    entry_group_state_changed)
159
156
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
160
157
                     service.name, service.type)
161
158
        group.AddService(
162
159
                self.interface,         # interface
163
 
                self.protocol,          # protocol
 
160
                avahi.PROTO_INET6,      # protocol
164
161
                dbus.UInt32(0),         # flags
165
162
                self.name, self.type,
166
163
                self.domain, self.host,
173
170
# End of Avahi example code
174
171
 
175
172
 
176
 
def _datetime_to_dbus(dt, variant_level=0):
177
 
    """Convert a UTC datetime.datetime() to a D-Bus type."""
178
 
    return dbus.String(dt.isoformat(), variant_level=variant_level)
179
 
 
180
 
 
181
 
class Client(dbus.service.Object):
 
173
class Client(object):
182
174
    """A representation of a client host served by this server.
183
175
    Attributes:
184
 
    name:       string; from the config file, used in log messages and
185
 
                        D-Bus identifiers
 
176
    name:      string; from the config file, used in log messages
186
177
    fingerprint: string (40 or 32 hexadecimal digits); used to
187
178
                 uniquely identify the client
188
 
    secret:     bytestring; sent verbatim (over TLS) to client
189
 
    host:       string; available for use by the checker command
190
 
    created:    datetime.datetime(); (UTC) object creation
191
 
    last_enabled: datetime.datetime(); (UTC)
192
 
    enabled:    bool()
193
 
    last_checked_ok: datetime.datetime(); (UTC) or None
194
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
195
 
                                      until this client is invalid
196
 
    interval:   datetime.timedelta(); How often to start a new checker
197
 
    disable_hook:  If set, called by disable() as disable_hook(self)
198
 
    checker:    subprocess.Popen(); a running checker process used
199
 
                                    to see if the client lives.
200
 
                                    'None' if no process is running.
 
179
    secret:    bytestring; sent verbatim (over TLS) to client
 
180
    host:      string; available for use by the checker command
 
181
    created:   datetime.datetime(); object creation, not client host
 
182
    last_checked_ok: datetime.datetime() or None if not yet checked OK
 
183
    timeout:   datetime.timedelta(); How long from last_checked_ok
 
184
                                     until this client is invalid
 
185
    interval:  datetime.timedelta(); How often to start a new checker
 
186
    stop_hook: If set, called by stop() as stop_hook(self)
 
187
    checker:   subprocess.Popen(); a running checker process used
 
188
                                   to see if the client lives.
 
189
                                   'None' if no process is running.
201
190
    checker_initiator_tag: a gobject event source tag, or None
202
 
    disable_initiator_tag:    - '' -
 
191
    stop_initiator_tag:    - '' -
203
192
    checker_callback_tag:  - '' -
204
193
    checker_command: string; External command which is run to check if
205
194
                     client lives.  %() expansions are done at
206
195
                     runtime with vars(self) as dict, so that for
207
196
                     instance %(name)s can be used in the command.
208
 
    current_checker_command: string; current running checker_command
209
 
    use_dbus: bool(); Whether to provide D-Bus interface and signals
210
 
    dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
 
197
    Private attibutes:
 
198
    _timeout: Real variable for 'timeout'
 
199
    _interval: Real variable for 'interval'
 
200
    _timeout_milliseconds: Used when calling gobject.timeout_add()
 
201
    _interval_milliseconds: - '' -
211
202
    """
212
 
    def timeout_milliseconds(self):
213
 
        "Return the 'timeout' attribute in milliseconds"
214
 
        return ((self.timeout.days * 24 * 60 * 60 * 1000)
215
 
                + (self.timeout.seconds * 1000)
216
 
                + (self.timeout.microseconds // 1000))
217
 
    
218
 
    def interval_milliseconds(self):
219
 
        "Return the 'interval' attribute in milliseconds"
220
 
        return ((self.interval.days * 24 * 60 * 60 * 1000)
221
 
                + (self.interval.seconds * 1000)
222
 
                + (self.interval.microseconds // 1000))
223
 
    
224
 
    def __init__(self, name = None, disable_hook=None, config=None,
225
 
                 use_dbus=True):
 
203
    def _set_timeout(self, timeout):
 
204
        "Setter function for 'timeout' attribute"
 
205
        self._timeout = timeout
 
206
        self._timeout_milliseconds = ((self.timeout.days
 
207
                                       * 24 * 60 * 60 * 1000)
 
208
                                      + (self.timeout.seconds * 1000)
 
209
                                      + (self.timeout.microseconds
 
210
                                         // 1000))
 
211
    timeout = property(lambda self: self._timeout,
 
212
                       _set_timeout)
 
213
    del _set_timeout
 
214
    def _set_interval(self, interval):
 
215
        "Setter function for 'interval' attribute"
 
216
        self._interval = interval
 
217
        self._interval_milliseconds = ((self.interval.days
 
218
                                        * 24 * 60 * 60 * 1000)
 
219
                                       + (self.interval.seconds
 
220
                                          * 1000)
 
221
                                       + (self.interval.microseconds
 
222
                                          // 1000))
 
223
    interval = property(lambda self: self._interval,
 
224
                        _set_interval)
 
225
    del _set_interval
 
226
    def __init__(self, name = None, stop_hook=None, config=None):
226
227
        """Note: the 'checker' key in 'config' sets the
227
228
        'checker_command' attribute and *not* the 'checker'
228
229
        attribute."""
229
 
        self.name = name
230
230
        if config is None:
231
231
            config = {}
 
232
        self.name = name
232
233
        logger.debug(u"Creating client %r", self.name)
233
 
        self.use_dbus = False   # During __init__
234
234
        # Uppercase and remove spaces from fingerprint for later
235
235
        # comparison purposes with return value from the fingerprint()
236
236
        # function
237
 
        self.fingerprint = (config["fingerprint"].upper()
238
 
                            .replace(u" ", u""))
 
237
        self.fingerprint = config["fingerprint"].upper()\
 
238
                           .replace(u" ", u"")
239
239
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
240
240
        if "secret" in config:
241
241
            self.secret = config["secret"].decode(u"base64")
242
242
        elif "secfile" in config:
243
 
            with closing(open(os.path.expanduser
244
 
                              (os.path.expandvars
245
 
                               (config["secfile"])))) as secfile:
246
 
                self.secret = secfile.read()
 
243
            secfile = open(os.path.expanduser(os.path.expandvars
 
244
                                              (config["secfile"])))
 
245
            self.secret = secfile.read()
 
246
            secfile.close()
247
247
        else:
248
248
            raise TypeError(u"No secret or secfile for client %s"
249
249
                            % self.name)
250
250
        self.host = config.get("host", "")
251
 
        self.created = datetime.datetime.utcnow()
252
 
        self.enabled = False
253
 
        self.last_enabled = None
 
251
        self.created = datetime.datetime.now()
254
252
        self.last_checked_ok = None
255
253
        self.timeout = string_to_delta(config["timeout"])
256
254
        self.interval = string_to_delta(config["interval"])
257
 
        self.disable_hook = disable_hook
 
255
        self.stop_hook = stop_hook
258
256
        self.checker = None
259
257
        self.checker_initiator_tag = None
260
 
        self.disable_initiator_tag = None
 
258
        self.stop_initiator_tag = None
261
259
        self.checker_callback_tag = None
262
 
        self.checker_command = config["checker"]
263
 
        self.current_checker_command = None
264
 
        self.last_connect = None
265
 
        # Only now, when this client is initialized, can it show up on
266
 
        # the D-Bus
267
 
        self.use_dbus = use_dbus
268
 
        if self.use_dbus:
269
 
            self.dbus_object_path = (dbus.ObjectPath
270
 
                                     ("/clients/"
271
 
                                      + self.name.replace(".", "_")))
272
 
            dbus.service.Object.__init__(self, bus,
273
 
                                         self.dbus_object_path)
274
 
    
275
 
    def enable(self):
 
260
        self.check_command = config["checker"]
 
261
    def start(self):
276
262
        """Start this client's checker and timeout hooks"""
277
 
        self.last_enabled = datetime.datetime.utcnow()
278
263
        # Schedule a new checker to be started an 'interval' from now,
279
264
        # and every interval from then on.
280
 
        self.checker_initiator_tag = (gobject.timeout_add
281
 
                                      (self.interval_milliseconds(),
282
 
                                       self.start_checker))
 
265
        self.checker_initiator_tag = gobject.timeout_add\
 
266
                                     (self._interval_milliseconds,
 
267
                                      self.start_checker)
283
268
        # Also start a new checker *right now*.
284
269
        self.start_checker()
285
 
        # Schedule a disable() when 'timeout' has passed
286
 
        self.disable_initiator_tag = (gobject.timeout_add
287
 
                                   (self.timeout_milliseconds(),
288
 
                                    self.disable))
289
 
        self.enabled = True
290
 
        if self.use_dbus:
291
 
            # Emit D-Bus signals
292
 
            self.PropertyChanged(dbus.String(u"enabled"),
293
 
                                 dbus.Boolean(True, variant_level=1))
294
 
            self.PropertyChanged(dbus.String(u"last_enabled"),
295
 
                                 (_datetime_to_dbus(self.last_enabled,
296
 
                                                    variant_level=1)))
297
 
    
298
 
    def disable(self):
299
 
        """Disable this client."""
300
 
        if not getattr(self, "enabled", False):
 
270
        # Schedule a stop() when 'timeout' has passed
 
271
        self.stop_initiator_tag = gobject.timeout_add\
 
272
                                  (self._timeout_milliseconds,
 
273
                                   self.stop)
 
274
    def stop(self):
 
275
        """Stop this client.
 
276
        The possibility that a client might be restarted is left open,
 
277
        but not currently used."""
 
278
        # If this client doesn't have a secret, it is already stopped.
 
279
        if hasattr(self, "secret") and self.secret:
 
280
            logger.info(u"Stopping client %s", self.name)
 
281
            self.secret = None
 
282
        else:
301
283
            return False
302
 
        logger.info(u"Disabling client %s", self.name)
303
 
        if getattr(self, "disable_initiator_tag", False):
304
 
            gobject.source_remove(self.disable_initiator_tag)
305
 
            self.disable_initiator_tag = None
 
284
        if getattr(self, "stop_initiator_tag", False):
 
285
            gobject.source_remove(self.stop_initiator_tag)
 
286
            self.stop_initiator_tag = None
306
287
        if getattr(self, "checker_initiator_tag", False):
307
288
            gobject.source_remove(self.checker_initiator_tag)
308
289
            self.checker_initiator_tag = None
309
290
        self.stop_checker()
310
 
        if self.disable_hook:
311
 
            self.disable_hook(self)
312
 
        self.enabled = False
313
 
        if self.use_dbus:
314
 
            # Emit D-Bus signal
315
 
            self.PropertyChanged(dbus.String(u"enabled"),
316
 
                                 dbus.Boolean(False, variant_level=1))
 
291
        if self.stop_hook:
 
292
            self.stop_hook(self)
317
293
        # Do not run this again if called by a gobject.timeout_add
318
294
        return False
319
 
    
320
295
    def __del__(self):
321
 
        self.disable_hook = None
322
 
        self.disable()
323
 
    
324
 
    def checker_callback(self, pid, condition, command):
 
296
        self.stop_hook = None
 
297
        self.stop()
 
298
    def checker_callback(self, pid, condition):
325
299
        """The checker has completed, so take appropriate actions."""
 
300
        now = datetime.datetime.now()
326
301
        self.checker_callback_tag = None
327
302
        self.checker = None
328
 
        if self.use_dbus:
329
 
            # Emit D-Bus signal
330
 
            self.PropertyChanged(dbus.String(u"checker_running"),
331
 
                                 dbus.Boolean(False, variant_level=1))
332
 
        if os.WIFEXITED(condition):
333
 
            exitstatus = os.WEXITSTATUS(condition)
334
 
            if exitstatus == 0:
335
 
                logger.info(u"Checker for %(name)s succeeded",
336
 
                            vars(self))
337
 
                self.checked_ok()
338
 
            else:
339
 
                logger.info(u"Checker for %(name)s failed",
340
 
                            vars(self))
341
 
            if self.use_dbus:
342
 
                # Emit D-Bus signal
343
 
                self.CheckerCompleted(dbus.Int16(exitstatus),
344
 
                                      dbus.Int64(condition),
345
 
                                      dbus.String(command))
346
 
        else:
 
303
        if os.WIFEXITED(condition) \
 
304
               and (os.WEXITSTATUS(condition) == 0):
 
305
            logger.info(u"Checker for %(name)s succeeded",
 
306
                        vars(self))
 
307
            self.last_checked_ok = now
 
308
            gobject.source_remove(self.stop_initiator_tag)
 
309
            self.stop_initiator_tag = gobject.timeout_add\
 
310
                                      (self._timeout_milliseconds,
 
311
                                       self.stop)
 
312
        elif not os.WIFEXITED(condition):
347
313
            logger.warning(u"Checker for %(name)s crashed?",
348
314
                           vars(self))
349
 
            if self.use_dbus:
350
 
                # Emit D-Bus signal
351
 
                self.CheckerCompleted(dbus.Int16(-1),
352
 
                                      dbus.Int64(condition),
353
 
                                      dbus.String(command))
354
 
    
355
 
    def checked_ok(self):
356
 
        """Bump up the timeout for this client.
357
 
        This should only be called when the client has been seen,
358
 
        alive and well.
359
 
        """
360
 
        self.last_checked_ok = datetime.datetime.utcnow()
361
 
        gobject.source_remove(self.disable_initiator_tag)
362
 
        self.disable_initiator_tag = (gobject.timeout_add
363
 
                                      (self.timeout_milliseconds(),
364
 
                                       self.disable))
365
 
        if self.use_dbus:
366
 
            # Emit D-Bus signal
367
 
            self.PropertyChanged(
368
 
                dbus.String(u"last_checked_ok"),
369
 
                (_datetime_to_dbus(self.last_checked_ok,
370
 
                                   variant_level=1)))
371
 
    
 
315
        else:
 
316
            logger.info(u"Checker for %(name)s failed",
 
317
                        vars(self))
372
318
    def start_checker(self):
373
319
        """Start a new checker subprocess if one is not running.
374
320
        If a checker already exists, leave it running and do
381
327
        # checkers alone, the checker would have to take more time
382
328
        # than 'timeout' for the client to be declared invalid, which
383
329
        # is as it should be.
384
 
        
385
 
        # If a checker exists, make sure it is not a zombie
386
 
        if self.checker is not None:
387
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
388
 
            if pid:
389
 
                logger.warning("Checker was a zombie")
390
 
                gobject.source_remove(self.checker_callback_tag)
391
 
                self.checker_callback(pid, status,
392
 
                                      self.current_checker_command)
393
 
        # Start a new checker if needed
394
330
        if self.checker is None:
395
331
            try:
396
 
                # In case checker_command has exactly one % operator
397
 
                command = self.checker_command % self.host
 
332
                # In case check_command has exactly one % operator
 
333
                command = self.check_command % self.host
398
334
            except TypeError:
399
335
                # Escape attributes for the shell
400
336
                escaped_attrs = dict((key, re.escape(str(val)))
401
337
                                     for key, val in
402
338
                                     vars(self).iteritems())
403
339
                try:
404
 
                    command = self.checker_command % escaped_attrs
 
340
                    command = self.check_command % escaped_attrs
405
341
                except TypeError, error:
406
342
                    logger.error(u'Could not format string "%s":'
407
 
                                 u' %s', self.checker_command, error)
 
343
                                 u' %s', self.check_command, error)
408
344
                    return True # Try again later
409
 
                self.current_checker_command = command
410
345
            try:
411
346
                logger.info(u"Starting checker %r for %s",
412
347
                            command, self.name)
417
352
                self.checker = subprocess.Popen(command,
418
353
                                                close_fds=True,
419
354
                                                shell=True, cwd="/")
420
 
                if self.use_dbus:
421
 
                    # Emit D-Bus signal
422
 
                    self.CheckerStarted(command)
423
 
                    self.PropertyChanged(
424
 
                        dbus.String("checker_running"),
425
 
                        dbus.Boolean(True, variant_level=1))
426
 
                self.checker_callback_tag = (gobject.child_watch_add
427
 
                                             (self.checker.pid,
428
 
                                              self.checker_callback,
429
 
                                              data=command))
430
 
                # The checker may have completed before the gobject
431
 
                # watch was added.  Check for this.
432
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
433
 
                if pid:
434
 
                    gobject.source_remove(self.checker_callback_tag)
435
 
                    self.checker_callback(pid, status, command)
 
355
                self.checker_callback_tag = gobject.child_watch_add\
 
356
                                            (self.checker.pid,
 
357
                                             self.checker_callback)
436
358
            except OSError, error:
437
359
                logger.error(u"Failed to start subprocess: %s",
438
360
                             error)
439
361
        # Re-run this periodically if run by gobject.timeout_add
440
362
        return True
441
 
    
442
363
    def stop_checker(self):
443
364
        """Force the checker process, if any, to stop."""
444
365
        if self.checker_callback_tag:
456
377
            if error.errno != errno.ESRCH: # No such process
457
378
                raise
458
379
        self.checker = None
459
 
        if self.use_dbus:
460
 
            self.PropertyChanged(dbus.String(u"checker_running"),
461
 
                                 dbus.Boolean(False, variant_level=1))
462
 
    
463
380
    def still_valid(self):
464
381
        """Has the timeout not yet passed for this client?"""
465
 
        if not getattr(self, "enabled", False):
466
 
            return False
467
 
        now = datetime.datetime.utcnow()
 
382
        now = datetime.datetime.now()
468
383
        if self.last_checked_ok is None:
469
384
            return now < (self.created + self.timeout)
470
385
        else:
471
386
            return now < (self.last_checked_ok + self.timeout)
472
 
    
473
 
    ## D-Bus methods & signals
474
 
    _interface = u"se.bsnet.fukt.Mandos.Client"
475
 
    
476
 
    # CheckedOK - method
477
 
    CheckedOK = dbus.service.method(_interface)(checked_ok)
478
 
    CheckedOK.__name__ = "CheckedOK"
479
 
    
480
 
    # CheckerCompleted - signal
481
 
    @dbus.service.signal(_interface, signature="nxs")
482
 
    def CheckerCompleted(self, exitcode, waitstatus, command):
483
 
        "D-Bus signal"
484
 
        pass
485
 
    
486
 
    # CheckerStarted - signal
487
 
    @dbus.service.signal(_interface, signature="s")
488
 
    def CheckerStarted(self, command):
489
 
        "D-Bus signal"
490
 
        pass
491
 
    
492
 
    # GetAllProperties - method
493
 
    @dbus.service.method(_interface, out_signature="a{sv}")
494
 
    def GetAllProperties(self):
495
 
        "D-Bus method"
496
 
        return dbus.Dictionary({
497
 
                dbus.String("name"):
498
 
                    dbus.String(self.name, variant_level=1),
499
 
                dbus.String("fingerprint"):
500
 
                    dbus.String(self.fingerprint, variant_level=1),
501
 
                dbus.String("host"):
502
 
                    dbus.String(self.host, variant_level=1),
503
 
                dbus.String("created"):
504
 
                    _datetime_to_dbus(self.created, variant_level=1),
505
 
                dbus.String("last_enabled"):
506
 
                    (_datetime_to_dbus(self.last_enabled,
507
 
                                       variant_level=1)
508
 
                     if self.last_enabled is not None
509
 
                     else dbus.Boolean(False, variant_level=1)),
510
 
                dbus.String("enabled"):
511
 
                    dbus.Boolean(self.enabled, variant_level=1),
512
 
                dbus.String("last_checked_ok"):
513
 
                    (_datetime_to_dbus(self.last_checked_ok,
514
 
                                       variant_level=1)
515
 
                     if self.last_checked_ok is not None
516
 
                     else dbus.Boolean (False, variant_level=1)),
517
 
                dbus.String("timeout"):
518
 
                    dbus.UInt64(self.timeout_milliseconds(),
519
 
                                variant_level=1),
520
 
                dbus.String("interval"):
521
 
                    dbus.UInt64(self.interval_milliseconds(),
522
 
                                variant_level=1),
523
 
                dbus.String("checker"):
524
 
                    dbus.String(self.checker_command,
525
 
                                variant_level=1),
526
 
                dbus.String("checker_running"):
527
 
                    dbus.Boolean(self.checker is not None,
528
 
                                 variant_level=1),
529
 
                dbus.String("object_path"):
530
 
                    dbus.ObjectPath(self.dbus_object_path,
531
 
                                    variant_level=1)
532
 
                }, signature="sv")
533
 
    
534
 
    # IsStillValid - method
535
 
    IsStillValid = (dbus.service.method(_interface, out_signature="b")
536
 
                    (still_valid))
537
 
    IsStillValid.__name__ = "IsStillValid"
538
 
    
539
 
    # PropertyChanged - signal
540
 
    @dbus.service.signal(_interface, signature="sv")
541
 
    def PropertyChanged(self, property, value):
542
 
        "D-Bus signal"
543
 
        pass
544
 
    
545
 
    # SetChecker - method
546
 
    @dbus.service.method(_interface, in_signature="s")
547
 
    def SetChecker(self, checker):
548
 
        "D-Bus setter method"
549
 
        self.checker_command = checker
550
 
        # Emit D-Bus signal
551
 
        self.PropertyChanged(dbus.String(u"checker"),
552
 
                             dbus.String(self.checker_command,
553
 
                                         variant_level=1))
554
 
    
555
 
    # SetHost - method
556
 
    @dbus.service.method(_interface, in_signature="s")
557
 
    def SetHost(self, host):
558
 
        "D-Bus setter method"
559
 
        self.host = host
560
 
        # Emit D-Bus signal
561
 
        self.PropertyChanged(dbus.String(u"host"),
562
 
                             dbus.String(self.host, variant_level=1))
563
 
    
564
 
    # SetInterval - method
565
 
    @dbus.service.method(_interface, in_signature="t")
566
 
    def SetInterval(self, milliseconds):
567
 
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
568
 
        # Emit D-Bus signal
569
 
        self.PropertyChanged(dbus.String(u"interval"),
570
 
                             (dbus.UInt64(self.interval_milliseconds(),
571
 
                                          variant_level=1)))
572
 
    
573
 
    # SetSecret - method
574
 
    @dbus.service.method(_interface, in_signature="ay",
575
 
                         byte_arrays=True)
576
 
    def SetSecret(self, secret):
577
 
        "D-Bus setter method"
578
 
        self.secret = str(secret)
579
 
    
580
 
    # SetTimeout - method
581
 
    @dbus.service.method(_interface, in_signature="t")
582
 
    def SetTimeout(self, milliseconds):
583
 
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
584
 
        # Emit D-Bus signal
585
 
        self.PropertyChanged(dbus.String(u"timeout"),
586
 
                             (dbus.UInt64(self.timeout_milliseconds(),
587
 
                                          variant_level=1)))
588
 
    
589
 
    # Enable - method
590
 
    Enable = dbus.service.method(_interface)(enable)
591
 
    Enable.__name__ = "Enable"
592
 
    
593
 
    # StartChecker - method
594
 
    @dbus.service.method(_interface)
595
 
    def StartChecker(self):
596
 
        "D-Bus method"
597
 
        self.start_checker()
598
 
    
599
 
    # Disable - method
600
 
    @dbus.service.method(_interface)
601
 
    def Disable(self):
602
 
        "D-Bus method"
603
 
        self.disable()
604
 
    
605
 
    # StopChecker - method
606
 
    StopChecker = dbus.service.method(_interface)(stop_checker)
607
 
    StopChecker.__name__ = "StopChecker"
608
 
    
609
 
    del _interface
610
387
 
611
388
 
612
389
def peer_certificate(session):
613
390
    "Return the peer's OpenPGP certificate as a bytestring"
614
391
    # If not an OpenPGP certificate...
615
 
    if (gnutls.library.functions
616
 
        .gnutls_certificate_type_get(session._c_object)
617
 
        != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
392
    if gnutls.library.functions.gnutls_certificate_type_get\
 
393
            (session._c_object) \
 
394
           != gnutls.library.constants.GNUTLS_CRT_OPENPGP:
618
395
        # ...do the normal thing
619
396
        return session.peer_certificate
620
 
    list_size = ctypes.c_uint(1)
621
 
    cert_list = (gnutls.library.functions
622
 
                 .gnutls_certificate_get_peers
623
 
                 (session._c_object, ctypes.byref(list_size)))
624
 
    if not bool(cert_list) and list_size.value != 0:
625
 
        raise gnutls.errors.GNUTLSError("error getting peer"
626
 
                                        " certificate")
 
397
    list_size = ctypes.c_uint()
 
398
    cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
 
399
        (session._c_object, ctypes.byref(list_size))
627
400
    if list_size.value == 0:
628
401
        return None
629
402
    cert = cert_list[0]
633
406
def fingerprint(openpgp):
634
407
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
635
408
    # New GnuTLS "datum" with the OpenPGP public key
636
 
    datum = (gnutls.library.types
637
 
             .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
638
 
                                         ctypes.POINTER
639
 
                                         (ctypes.c_ubyte)),
640
 
                             ctypes.c_uint(len(openpgp))))
 
409
    datum = gnutls.library.types.gnutls_datum_t\
 
410
        (ctypes.cast(ctypes.c_char_p(openpgp),
 
411
                     ctypes.POINTER(ctypes.c_ubyte)),
 
412
         ctypes.c_uint(len(openpgp)))
641
413
    # New empty GnuTLS certificate
642
414
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
643
 
    (gnutls.library.functions
644
 
     .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
415
    gnutls.library.functions.gnutls_openpgp_crt_init\
 
416
        (ctypes.byref(crt))
645
417
    # Import the OpenPGP public key into the certificate
646
 
    (gnutls.library.functions
647
 
     .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
648
 
                                gnutls.library.constants
649
 
                                .GNUTLS_OPENPGP_FMT_RAW))
 
418
    gnutls.library.functions.gnutls_openpgp_crt_import\
 
419
                    (crt, ctypes.byref(datum),
 
420
                     gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
650
421
    # Verify the self signature in the key
651
422
    crtverify = ctypes.c_uint()
652
 
    (gnutls.library.functions
653
 
     .gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
 
423
    gnutls.library.functions.gnutls_openpgp_crt_verify_self\
 
424
        (crt, 0, ctypes.byref(crtverify))
654
425
    if crtverify.value != 0:
655
426
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
656
427
        raise gnutls.errors.CertificateSecurityError("Verify failed")
658
429
    buf = ctypes.create_string_buffer(20)
659
430
    buf_len = ctypes.c_size_t()
660
431
    # Get the fingerprint from the certificate into the buffer
661
 
    (gnutls.library.functions
662
 
     .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
663
 
                                         ctypes.byref(buf_len)))
 
432
    gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
 
433
        (crt, ctypes.byref(buf), ctypes.byref(buf_len))
664
434
    # Deinit the certificate
665
435
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
666
436
    # Convert the buffer to a Python bytestring
677
447
    
678
448
    def handle(self):
679
449
        logger.info(u"TCP connection from: %s",
680
 
                    unicode(self.client_address))
681
 
        logger.debug(u"Pipe: %d", self.server.pipe[1])
682
 
        # Open IPC pipe to parent process
683
 
        with closing(os.fdopen(self.server.pipe[1], "w", 1)) as ipc:
684
 
            session = (gnutls.connection
685
 
                       .ClientSession(self.request,
686
 
                                      gnutls.connection
687
 
                                      .X509Credentials()))
688
 
            
689
 
            line = self.request.makefile().readline()
690
 
            logger.debug(u"Protocol version: %r", line)
691
 
            try:
692
 
                if int(line.strip().split()[0]) > 1:
693
 
                    raise RuntimeError
694
 
            except (ValueError, IndexError, RuntimeError), error:
695
 
                logger.error(u"Unknown protocol version: %s", error)
696
 
                return
697
 
            
698
 
            # Note: gnutls.connection.X509Credentials is really a
699
 
            # generic GnuTLS certificate credentials object so long as
700
 
            # no X.509 keys are added to it.  Therefore, we can use it
701
 
            # here despite using OpenPGP certificates.
702
 
            
703
 
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
704
 
            #                     "+AES-256-CBC", "+SHA1",
705
 
            #                     "+COMP-NULL", "+CTYPE-OPENPGP",
706
 
            #                     "+DHE-DSS"))
707
 
            # Use a fallback default, since this MUST be set.
708
 
            priority = self.server.settings.get("priority", "NORMAL")
709
 
            (gnutls.library.functions
710
 
             .gnutls_priority_set_direct(session._c_object,
711
 
                                         priority, None))
712
 
            
713
 
            try:
714
 
                session.handshake()
715
 
            except gnutls.errors.GNUTLSError, error:
716
 
                logger.warning(u"Handshake failed: %s", error)
717
 
                # Do not run session.bye() here: the session is not
718
 
                # established.  Just abandon the request.
719
 
                return
720
 
            logger.debug(u"Handshake succeeded")
721
 
            try:
722
 
                fpr = fingerprint(peer_certificate(session))
723
 
            except (TypeError, gnutls.errors.GNUTLSError), error:
724
 
                logger.warning(u"Bad certificate: %s", error)
725
 
                session.bye()
726
 
                return
727
 
            logger.debug(u"Fingerprint: %s", fpr)
728
 
            
729
 
            for c in self.server.clients:
730
 
                if c.fingerprint == fpr:
731
 
                    client = c
732
 
                    break
733
 
            else:
734
 
                logger.warning(u"Client not found for fingerprint: %s",
735
 
                               fpr)
736
 
                ipc.write("NOTFOUND %s\n" % fpr)
737
 
                session.bye()
738
 
                return
739
 
            # Have to check if client.still_valid(), since it is
740
 
            # possible that the client timed out while establishing
741
 
            # the GnuTLS session.
742
 
            if not client.still_valid():
743
 
                logger.warning(u"Client %(name)s is invalid",
744
 
                               vars(client))
745
 
                ipc.write("INVALID %s\n" % client.name)
746
 
                session.bye()
747
 
                return
748
 
            ipc.write("SENDING %s\n" % client.name)
749
 
            sent_size = 0
750
 
            while sent_size < len(client.secret):
751
 
                sent = session.send(client.secret[sent_size:])
752
 
                logger.debug(u"Sent: %d, remaining: %d",
753
 
                             sent, len(client.secret)
754
 
                             - (sent_size + sent))
755
 
                sent_size += sent
756
 
            session.bye()
757
 
 
758
 
 
759
 
class ForkingMixInWithPipe(SocketServer.ForkingMixIn, object):
760
 
    """Like SocketServer.ForkingMixIn, but also pass a pipe.
761
 
    Assumes a gobject.MainLoop event loop.
762
 
    """
763
 
    def process_request(self, request, client_address):
764
 
        """This overrides and wraps the original process_request().
765
 
        This function creates a new pipe in self.pipe 
766
 
        """
767
 
        self.pipe = os.pipe()
768
 
        super(ForkingMixInWithPipe,
769
 
              self).process_request(request, client_address)
770
 
        os.close(self.pipe[1])  # close write end
771
 
        # Call "handle_ipc" for both data and EOF events
772
 
        gobject.io_add_watch(self.pipe[0],
773
 
                             gobject.IO_IN | gobject.IO_HUP,
774
 
                             self.handle_ipc)
775
 
    def handle_ipc(source, condition):
776
 
        """Dummy function; override as necessary"""
777
 
        os.close(source)
778
 
        return False
779
 
 
780
 
 
781
 
class IPv6_TCPServer(ForkingMixInWithPipe,
782
 
                     SocketServer.TCPServer, object):
783
 
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
450
                     unicode(self.client_address))
 
451
        session = gnutls.connection.ClientSession\
 
452
                  (self.request, gnutls.connection.X509Credentials())
 
453
        
 
454
        line = self.request.makefile().readline()
 
455
        logger.debug(u"Protocol version: %r", line)
 
456
        try:
 
457
            if int(line.strip().split()[0]) > 1:
 
458
                raise RuntimeError
 
459
        except (ValueError, IndexError, RuntimeError), error:
 
460
            logger.error(u"Unknown protocol version: %s", error)
 
461
            return
 
462
        
 
463
        # Note: gnutls.connection.X509Credentials is really a generic
 
464
        # GnuTLS certificate credentials object so long as no X.509
 
465
        # keys are added to it.  Therefore, we can use it here despite
 
466
        # using OpenPGP certificates.
 
467
        
 
468
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
 
469
        #                "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
 
470
        #                "+DHE-DSS"))
 
471
        priority = "NORMAL"             # Fallback default, since this
 
472
                                        # MUST be set.
 
473
        if self.server.settings["priority"]:
 
474
            priority = self.server.settings["priority"]
 
475
        gnutls.library.functions.gnutls_priority_set_direct\
 
476
            (session._c_object, priority, None)
 
477
        
 
478
        try:
 
479
            session.handshake()
 
480
        except gnutls.errors.GNUTLSError, error:
 
481
            logger.warning(u"Handshake failed: %s", error)
 
482
            # Do not run session.bye() here: the session is not
 
483
            # established.  Just abandon the request.
 
484
            return
 
485
        try:
 
486
            fpr = fingerprint(peer_certificate(session))
 
487
        except (TypeError, gnutls.errors.GNUTLSError), error:
 
488
            logger.warning(u"Bad certificate: %s", error)
 
489
            session.bye()
 
490
            return
 
491
        logger.debug(u"Fingerprint: %s", fpr)
 
492
        client = None
 
493
        for c in self.server.clients:
 
494
            if c.fingerprint == fpr:
 
495
                client = c
 
496
                break
 
497
        if not client:
 
498
            logger.warning(u"Client not found for fingerprint: %s",
 
499
                           fpr)
 
500
            session.bye()
 
501
            return
 
502
        # Have to check if client.still_valid(), since it is possible
 
503
        # that the client timed out while establishing the GnuTLS
 
504
        # session.
 
505
        if not client.still_valid():
 
506
            logger.warning(u"Client %(name)s is invalid",
 
507
                           vars(client))
 
508
            session.bye()
 
509
            return
 
510
        sent_size = 0
 
511
        while sent_size < len(client.secret):
 
512
            sent = session.send(client.secret[sent_size:])
 
513
            logger.debug(u"Sent: %d, remaining: %d",
 
514
                         sent, len(client.secret)
 
515
                         - (sent_size + sent))
 
516
            sent_size += sent
 
517
        session.bye()
 
518
 
 
519
 
 
520
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
 
521
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
784
522
    Attributes:
785
523
        settings:       Server settings
786
524
        clients:        Set() of Client objects
794
532
        if "clients" in kwargs:
795
533
            self.clients = kwargs["clients"]
796
534
            del kwargs["clients"]
797
 
        if "use_ipv6" in kwargs:
798
 
            if not kwargs["use_ipv6"]:
799
 
                self.address_family = socket.AF_INET
800
 
            del kwargs["use_ipv6"]
801
535
        self.enabled = False
802
536
        super(IPv6_TCPServer, self).__init__(*args, **kwargs)
803
537
    def server_bind(self):
817
551
                                 u" bind to interface %s",
818
552
                                 self.settings["interface"])
819
553
                else:
820
 
                    raise
 
554
                    raise error
821
555
        # Only bind(2) the socket if we really need to.
822
556
        if self.server_address[0] or self.server_address[1]:
823
557
            if not self.server_address[0]:
824
 
                if self.address_family == socket.AF_INET6:
825
 
                    any_address = "::" # in6addr_any
826
 
                else:
827
 
                    any_address = socket.INADDR_ANY
828
 
                self.server_address = (any_address,
 
558
                in6addr_any = "::"
 
559
                self.server_address = (in6addr_any,
829
560
                                       self.server_address[1])
830
561
            elif not self.server_address[1]:
831
562
                self.server_address = (self.server_address[0],
843
574
            return super(IPv6_TCPServer, self).server_activate()
844
575
    def enable(self):
845
576
        self.enabled = True
846
 
    def handle_ipc(self, source, condition, file_objects={}):
847
 
        logger.debug("Handling IPC: %r : %r", source, condition)
848
 
        
849
 
        # Turn a file descriptor into a Python file object
850
 
        if source not in file_objects:
851
 
            file_objects[source] = os.fdopen(source, "r", 1)
852
 
        
853
 
        # Read a line from the file object
854
 
        cmdline = file_objects[source].readline()
855
 
        if not cmdline:             # Empty line means end of file
856
 
            # close the IPC pipe
857
 
            logger.debug("Closing: %r", source)
858
 
            file_objects[source].close()
859
 
            del file_objects[source]
860
 
 
861
 
            # Stop calling this function
862
 
            return False
863
 
        
864
 
        logger.debug("IPC command: %r\n" % cmdline)
865
 
        
866
 
        # Parse and act on command
867
 
        cmd, args = cmdline.split(None, 1)
868
 
        if cmd == "NOTFOUND":
869
 
            pass                # xxx
870
 
        elif cmd == "INVALID":
871
 
            pass                # xxx
872
 
        elif cmd == "SENDING":
873
 
            pass                # xxx
874
 
            # client.checked_ok()
875
 
        else:
876
 
            logger.error("Unknown IPC command: %r", cmdline)
877
 
        
878
 
        # Keep calling this function
879
 
        return True
880
577
 
881
578
 
882
579
def string_to_delta(interval):
883
580
    """Parse a string and return a datetime.timedelta
884
 
    
 
581
 
885
582
    >>> string_to_delta('7d')
886
583
    datetime.timedelta(7)
887
584
    >>> string_to_delta('60s')
939
636
    elif state == avahi.ENTRY_GROUP_FAILURE:
940
637
        logger.critical(u"Avahi: Error in group state changed %s",
941
638
                        unicode(error))
942
 
        raise AvahiGroupError(u"State changed: %s" % unicode(error))
 
639
        raise AvahiGroupError("State changed: %s", str(error))
943
640
 
944
641
def if_nametoindex(interface):
945
642
    """Call the C function if_nametoindex(), or equivalent"""
946
643
    global if_nametoindex
947
644
    try:
948
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
949
 
                          (ctypes.util.find_library("c"))
950
 
                          .if_nametoindex)
 
645
        if_nametoindex = ctypes.cdll.LoadLibrary\
 
646
            (ctypes.util.find_library("c")).if_nametoindex
951
647
    except (OSError, AttributeError):
952
648
        if "struct" not in sys.modules:
953
649
            import struct
956
652
        def if_nametoindex(interface):
957
653
            "Get an interface index the hard way, i.e. using fcntl()"
958
654
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
959
 
            with closing(socket.socket()) as s:
960
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
961
 
                                    struct.pack("16s16x", interface))
 
655
            s = socket.socket()
 
656
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
657
                                struct.pack("16s16x", interface))
 
658
            s.close()
962
659
            interface_index = struct.unpack("I", ifreq[16:20])[0]
963
660
            return interface_index
964
661
    return if_nametoindex(interface)
988
685
 
989
686
 
990
687
def main():
991
 
    parser = optparse.OptionParser(version = "%%prog %s" % version)
 
688
    parser = OptionParser(version = "%%prog %s" % version)
992
689
    parser.add_option("-i", "--interface", type="string",
993
690
                      metavar="IF", help="Bind to interface IF")
994
691
    parser.add_option("-a", "--address", type="string",
995
692
                      help="Address to listen for requests on")
996
693
    parser.add_option("-p", "--port", type="int",
997
694
                      help="Port number to receive requests on")
998
 
    parser.add_option("--check", action="store_true",
 
695
    parser.add_option("--check", action="store_true", default=False,
999
696
                      help="Run self-test")
1000
697
    parser.add_option("--debug", action="store_true",
1001
698
                      help="Debug mode; run in foreground and log to"
1008
705
                      default="/etc/mandos", metavar="DIR",
1009
706
                      help="Directory to search for configuration"
1010
707
                      " files")
1011
 
    parser.add_option("--no-dbus", action="store_false",
1012
 
                      dest="use_dbus",
1013
 
                      help="Do not provide D-Bus system bus"
1014
 
                      " interface")
1015
 
    parser.add_option("--no-ipv6", action="store_false",
1016
 
                      dest="use_ipv6", help="Do not use IPv6")
1017
708
    options = parser.parse_args()[0]
1018
709
    
1019
710
    if options.check:
1029
720
                        "priority":
1030
721
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1031
722
                        "servicename": "Mandos",
1032
 
                        "use_dbus": "True",
1033
 
                        "use_ipv6": "True",
1034
723
                        }
1035
724
    
1036
725
    # Parse config file for server-global settings
1039
728
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
1040
729
    # Convert the SafeConfigParser object to a dict
1041
730
    server_settings = server_config.defaults()
1042
 
    # Use the appropriate methods on the non-string config options
1043
 
    server_settings["debug"] = server_config.getboolean("DEFAULT",
1044
 
                                                        "debug")
1045
 
    server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
1046
 
                                                           "use_dbus")
1047
 
    server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
1048
 
                                                           "use_ipv6")
1049
 
    if server_settings["port"]:
1050
 
        server_settings["port"] = server_config.getint("DEFAULT",
1051
 
                                                       "port")
 
731
    # Use getboolean on the boolean config option
 
732
    server_settings["debug"] = server_config.getboolean\
 
733
                               ("DEFAULT", "debug")
1052
734
    del server_config
1053
735
    
1054
736
    # Override the settings from the config file with command line
1055
737
    # options, if set.
1056
738
    for option in ("interface", "address", "port", "debug",
1057
 
                   "priority", "servicename", "configdir",
1058
 
                   "use_dbus", "use_ipv6"):
 
739
                   "priority", "servicename", "configdir"):
1059
740
        value = getattr(options, option)
1060
741
        if value is not None:
1061
742
            server_settings[option] = value
1062
743
    del options
1063
744
    # Now we have our good server settings in "server_settings"
1064
745
    
1065
 
    # For convenience
1066
746
    debug = server_settings["debug"]
1067
 
    use_dbus = server_settings["use_dbus"]
1068
 
    use_ipv6 = server_settings["use_ipv6"]
1069
747
    
1070
748
    if not debug:
1071
749
        syslogger.setLevel(logging.WARNING)
1072
750
        console.setLevel(logging.WARNING)
1073
751
    
1074
752
    if server_settings["servicename"] != "Mandos":
1075
 
        syslogger.setFormatter(logging.Formatter
 
753
        syslogger.setFormatter(logging.Formatter\
1076
754
                               ('Mandos (%s): %%(levelname)s:'
1077
755
                                ' %%(message)s'
1078
756
                                % server_settings["servicename"]))
1080
758
    # Parse config file with clients
1081
759
    client_defaults = { "timeout": "1h",
1082
760
                        "interval": "5m",
1083
 
                        "checker": "fping -q -- %%(host)s",
 
761
                        "checker": "fping -q -- %(host)s",
1084
762
                        "host": "",
1085
763
                        }
1086
764
    client_config = ConfigParser.SafeConfigParser(client_defaults)
1092
770
                                 server_settings["port"]),
1093
771
                                TCP_handler,
1094
772
                                settings=server_settings,
1095
 
                                clients=clients, use_ipv6=use_ipv6)
 
773
                                clients=clients)
1096
774
    pidfilename = "/var/run/mandos.pid"
1097
775
    try:
1098
776
        pidfile = open(pidfilename, "w")
1099
 
    except IOError:
 
777
    except IOError, error:
1100
778
        logger.error("Could not open file %r", pidfilename)
1101
779
    
1102
 
    try:
1103
 
        uid = pwd.getpwnam("_mandos").pw_uid
1104
 
        gid = pwd.getpwnam("_mandos").pw_gid
1105
 
    except KeyError:
1106
 
        try:
1107
 
            uid = pwd.getpwnam("mandos").pw_uid
1108
 
            gid = pwd.getpwnam("mandos").pw_gid
1109
 
        except KeyError:
1110
 
            try:
1111
 
                uid = pwd.getpwnam("nobody").pw_uid
1112
 
                gid = pwd.getpwnam("nogroup").pw_gid
1113
 
            except KeyError:
1114
 
                uid = 65534
1115
 
                gid = 65534
1116
 
    try:
 
780
    uid = 65534
 
781
    gid = 65534
 
782
    try:
 
783
        uid = pwd.getpwnam("mandos").pw_uid
 
784
    except KeyError:
 
785
        try:
 
786
            uid = pwd.getpwnam("nobody").pw_uid
 
787
        except KeyError:
 
788
            pass
 
789
    try:
 
790
        gid = pwd.getpwnam("mandos").pw_gid
 
791
    except KeyError:
 
792
        try:
 
793
            gid = pwd.getpwnam("nogroup").pw_gid
 
794
        except KeyError:
 
795
            pass
 
796
    try:
 
797
        os.setuid(uid)
1117
798
        os.setgid(gid)
1118
 
        os.setuid(uid)
1119
799
    except OSError, error:
1120
800
        if error[0] != errno.EPERM:
1121
801
            raise error
1122
802
    
1123
 
    # Enable all possible GnuTLS debugging
1124
 
    if debug:
1125
 
        # "Use a log level over 10 to enable all debugging options."
1126
 
        # - GnuTLS manual
1127
 
        gnutls.library.functions.gnutls_global_set_log_level(11)
1128
 
        
1129
 
        @gnutls.library.types.gnutls_log_func
1130
 
        def debug_gnutls(level, string):
1131
 
            logger.debug("GnuTLS: %s", string[:-1])
1132
 
        
1133
 
        (gnutls.library.functions
1134
 
         .gnutls_global_set_log_function(debug_gnutls))
1135
 
    
1136
803
    global service
1137
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1138
804
    service = AvahiService(name = server_settings["servicename"],
1139
 
                           servicetype = "_mandos._tcp",
1140
 
                           protocol = protocol)
 
805
                           servicetype = "_mandos._tcp", )
1141
806
    if server_settings["interface"]:
1142
 
        service.interface = (if_nametoindex
1143
 
                             (server_settings["interface"]))
 
807
        service.interface = if_nametoindex\
 
808
                            (server_settings["interface"])
1144
809
    
1145
810
    global main_loop
1146
811
    global bus
1153
818
                                           avahi.DBUS_PATH_SERVER),
1154
819
                            avahi.DBUS_INTERFACE_SERVER)
1155
820
    # End of Avahi example code
1156
 
    if use_dbus:
1157
 
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
 
821
    
 
822
    def remove_from_clients(client):
 
823
        clients.remove(client)
 
824
        if not clients:
 
825
            logger.critical(u"No clients left, exiting")
 
826
            sys.exit()
1158
827
    
1159
828
    clients.update(Set(Client(name = section,
 
829
                              stop_hook = remove_from_clients,
1160
830
                              config
1161
 
                              = dict(client_config.items(section)),
1162
 
                              use_dbus = use_dbus)
 
831
                              = dict(client_config.items(section)))
1163
832
                       for section in client_config.sections()))
1164
833
    if not clients:
1165
 
        logger.warning(u"No clients defined")
 
834
        logger.critical(u"No clients defined")
 
835
        sys.exit(1)
1166
836
    
1167
837
    if debug:
1168
838
        # Redirect stdin so all checkers get /dev/null
1200
870
        
1201
871
        while clients:
1202
872
            client = clients.pop()
1203
 
            client.disable_hook = None
1204
 
            client.disable()
 
873
            client.stop_hook = None
 
874
            client.stop()
1205
875
    
1206
876
    atexit.register(cleanup)
1207
877
    
1210
880
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1211
881
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1212
882
    
1213
 
    if use_dbus:
1214
 
        class MandosServer(dbus.service.Object):
1215
 
            """A D-Bus proxy object"""
1216
 
            def __init__(self):
1217
 
                dbus.service.Object.__init__(self, bus, "/")
1218
 
            _interface = u"se.bsnet.fukt.Mandos"
1219
 
            
1220
 
            @dbus.service.signal(_interface, signature="oa{sv}")
1221
 
            def ClientAdded(self, objpath, properties):
1222
 
                "D-Bus signal"
1223
 
                pass
1224
 
            
1225
 
            @dbus.service.signal(_interface, signature="os")
1226
 
            def ClientRemoved(self, objpath, name):
1227
 
                "D-Bus signal"
1228
 
                pass
1229
 
            
1230
 
            @dbus.service.method(_interface, out_signature="ao")
1231
 
            def GetAllClients(self):
1232
 
                "D-Bus method"
1233
 
                return dbus.Array(c.dbus_object_path for c in clients)
1234
 
            
1235
 
            @dbus.service.method(_interface, out_signature="a{oa{sv}}")
1236
 
            def GetAllClientsWithProperties(self):
1237
 
                "D-Bus method"
1238
 
                return dbus.Dictionary(
1239
 
                    ((c.dbus_object_path, c.GetAllProperties())
1240
 
                     for c in clients),
1241
 
                    signature="oa{sv}")
1242
 
            
1243
 
            @dbus.service.method(_interface, in_signature="o")
1244
 
            def RemoveClient(self, object_path):
1245
 
                "D-Bus method"
1246
 
                for c in clients:
1247
 
                    if c.dbus_object_path == object_path:
1248
 
                        clients.remove(c)
1249
 
                        # Don't signal anything except ClientRemoved
1250
 
                        c.use_dbus = False
1251
 
                        c.disable()
1252
 
                        # Emit D-Bus signal
1253
 
                        self.ClientRemoved(object_path, c.name)
1254
 
                        return
1255
 
                raise KeyError
1256
 
            
1257
 
            del _interface
1258
 
        
1259
 
        mandos_server = MandosServer()
1260
 
    
1261
883
    for client in clients:
1262
 
        if use_dbus:
1263
 
            # Emit D-Bus signal
1264
 
            mandos_server.ClientAdded(client.dbus_object_path,
1265
 
                                      client.GetAllProperties())
1266
 
        client.enable()
 
884
        client.start()
1267
885
    
1268
886
    tcp_server.enable()
1269
887
    tcp_server.server_activate()
1270
888
    
1271
889
    # Find out what port we got
1272
890
    service.port = tcp_server.socket.getsockname()[1]
1273
 
    if use_ipv6:
1274
 
        logger.info(u"Now listening on address %r, port %d,"
1275
 
                    " flowinfo %d, scope_id %d"
1276
 
                    % tcp_server.socket.getsockname())
1277
 
    else:                       # IPv4
1278
 
        logger.info(u"Now listening on address %r, port %d"
1279
 
                    % tcp_server.socket.getsockname())
 
891
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
 
892
                u" scope_id %d" % tcp_server.socket.getsockname())
1280
893
    
1281
894
    #service.interface = tcp_server.socket.getsockname()[3]
1282
895
    
1292
905
        
1293
906
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1294
907
                             lambda *args, **kwargs:
1295
 
                             (tcp_server.handle_request
1296
 
                              (*args[2:], **kwargs) or True))
 
908
                             tcp_server.handle_request\
 
909
                             (*args[2:], **kwargs) or True)
1297
910
        
1298
911
        logger.debug(u"Starting main loop")
1299
912
        main_loop.run()
1300
913
    except AvahiError, error:
1301
 
        logger.critical(u"AvahiError: %s", error)
 
914
        logger.critical(u"AvahiError: %s" + unicode(error))
1302
915
        sys.exit(1)
1303
916
    except KeyboardInterrupt:
1304
917
        if debug:
1305
 
            print >> sys.stderr
1306
 
        logger.debug("Server received KeyboardInterrupt")
1307
 
    logger.debug("Server exiting")
 
918
            print
1308
919
 
1309
920
if __name__ == '__main__':
1310
921
    main()