465
441
if error.errno != errno.ESRCH: # No such process
467
443
self.checker = None
445
self.PropertyChanged(dbus.String(u"checker_running"),
446
dbus.Boolean(False, variant_level=1))
469
448
def still_valid(self):
470
449
"""Has the timeout not yet passed for this client?"""
471
if not getattr(self, u"enabled", False):
450
if not getattr(self, "enabled", False):
473
452
now = datetime.datetime.utcnow()
474
453
if self.last_checked_ok is None:
475
454
return now < (self.created + self.timeout)
477
456
return now < (self.last_checked_ok + self.timeout)
480
class ClientDBus(Client, dbus.service.Object):
481
"""A Client class using D-Bus
484
dbus_object_path: dbus.ObjectPath
485
bus: dbus.SystemBus()
487
# dbus.service.Object doesn't use super(), so we can't either.
489
def __init__(self, bus = None, *args, **kwargs):
491
Client.__init__(self, *args, **kwargs)
492
# Only now, when this client is initialized, can it show up on
494
self.dbus_object_path = (dbus.ObjectPath
496
+ self.name.replace(u".", u"_")))
497
dbus.service.Object.__init__(self, self.bus,
498
self.dbus_object_path)
501
def _datetime_to_dbus(dt, variant_level=0):
502
"""Convert a UTC datetime.datetime() to a D-Bus type."""
503
return dbus.String(dt.isoformat(),
504
variant_level=variant_level)
507
oldstate = getattr(self, u"enabled", False)
508
r = Client.enable(self)
509
if oldstate != self.enabled:
511
self.PropertyChanged(dbus.String(u"enabled"),
512
dbus.Boolean(True, variant_level=1))
513
self.PropertyChanged(
514
dbus.String(u"last_enabled"),
515
self._datetime_to_dbus(self.last_enabled,
519
def disable(self, signal = True):
520
oldstate = getattr(self, u"enabled", False)
521
r = Client.disable(self)
522
if signal and oldstate != self.enabled:
524
self.PropertyChanged(dbus.String(u"enabled"),
525
dbus.Boolean(False, variant_level=1))
528
def __del__(self, *args, **kwargs):
530
self.remove_from_connection()
533
if hasattr(dbus.service.Object, u"__del__"):
534
dbus.service.Object.__del__(self, *args, **kwargs)
535
Client.__del__(self, *args, **kwargs)
537
def checker_callback(self, pid, condition, command,
539
self.checker_callback_tag = None
542
self.PropertyChanged(dbus.String(u"checker_running"),
543
dbus.Boolean(False, variant_level=1))
544
if os.WIFEXITED(condition):
545
exitstatus = os.WEXITSTATUS(condition)
547
self.CheckerCompleted(dbus.Int16(exitstatus),
548
dbus.Int64(condition),
549
dbus.String(command))
552
self.CheckerCompleted(dbus.Int16(-1),
553
dbus.Int64(condition),
554
dbus.String(command))
556
return Client.checker_callback(self, pid, condition, command,
559
def checked_ok(self, *args, **kwargs):
560
r = Client.checked_ok(self, *args, **kwargs)
562
self.PropertyChanged(
563
dbus.String(u"last_checked_ok"),
564
(self._datetime_to_dbus(self.last_checked_ok,
568
def start_checker(self, *args, **kwargs):
569
old_checker = self.checker
570
if self.checker is not None:
571
old_checker_pid = self.checker.pid
573
old_checker_pid = None
574
r = Client.start_checker(self, *args, **kwargs)
575
# Only if new checker process was started
576
if (self.checker is not None
577
and old_checker_pid != self.checker.pid):
579
self.CheckerStarted(self.current_checker_command)
580
self.PropertyChanged(
581
dbus.String(u"checker_running"),
582
dbus.Boolean(True, variant_level=1))
585
def stop_checker(self, *args, **kwargs):
586
old_checker = getattr(self, u"checker", None)
587
r = Client.stop_checker(self, *args, **kwargs)
588
if (old_checker is not None
589
and getattr(self, u"checker", None) is None):
590
self.PropertyChanged(dbus.String(u"checker_running"),
591
dbus.Boolean(False, variant_level=1))
594
458
## D-Bus methods & signals
595
459
_interface = u"se.bsnet.fukt.Mandos.Client"
597
461
# CheckedOK - method
598
@dbus.service.method(_interface)
600
return self.checked_ok()
462
CheckedOK = dbus.service.method(_interface)(checked_ok)
463
CheckedOK.__name__ = "CheckedOK"
602
465
# CheckerCompleted - signal
603
@dbus.service.signal(_interface, signature=u"nxs")
466
@dbus.service.signal(_interface, signature="nxs")
604
467
def CheckerCompleted(self, exitcode, waitstatus, command):
608
471
# CheckerStarted - signal
609
@dbus.service.signal(_interface, signature=u"s")
472
@dbus.service.signal(_interface, signature="s")
610
473
def CheckerStarted(self, command):
614
477
# GetAllProperties - method
615
@dbus.service.method(_interface, out_signature=u"a{sv}")
478
@dbus.service.method(_interface, out_signature="a{sv}")
616
479
def GetAllProperties(self):
618
481
return dbus.Dictionary({
619
dbus.String(u"name"):
620
483
dbus.String(self.name, variant_level=1),
621
dbus.String(u"fingerprint"):
484
dbus.String("fingerprint"):
622
485
dbus.String(self.fingerprint, variant_level=1),
623
dbus.String(u"host"):
624
487
dbus.String(self.host, variant_level=1),
625
dbus.String(u"created"):
626
self._datetime_to_dbus(self.created,
628
dbus.String(u"last_enabled"):
629
(self._datetime_to_dbus(self.last_enabled,
488
dbus.String("created"):
489
_datetime_to_dbus(self.created, variant_level=1),
490
dbus.String("last_enabled"):
491
(_datetime_to_dbus(self.last_enabled,
631
493
if self.last_enabled is not None
632
494
else dbus.Boolean(False, variant_level=1)),
633
dbus.String(u"enabled"):
495
dbus.String("enabled"):
634
496
dbus.Boolean(self.enabled, variant_level=1),
635
dbus.String(u"last_checked_ok"):
636
(self._datetime_to_dbus(self.last_checked_ok,
497
dbus.String("last_checked_ok"):
498
(_datetime_to_dbus(self.last_checked_ok,
638
500
if self.last_checked_ok is not None
639
501
else dbus.Boolean (False, variant_level=1)),
640
dbus.String(u"timeout"):
502
dbus.String("timeout"):
641
503
dbus.UInt64(self.timeout_milliseconds(),
642
504
variant_level=1),
643
dbus.String(u"interval"):
505
dbus.String("interval"):
644
506
dbus.UInt64(self.interval_milliseconds(),
645
507
variant_level=1),
646
dbus.String(u"checker"):
508
dbus.String("checker"):
647
509
dbus.String(self.checker_command,
648
510
variant_level=1),
649
dbus.String(u"checker_running"):
511
dbus.String("checker_running"):
650
512
dbus.Boolean(self.checker is not None,
651
513
variant_level=1),
652
dbus.String(u"object_path"):
514
dbus.String("object_path"):
653
515
dbus.ObjectPath(self.dbus_object_path,
657
519
# IsStillValid - method
658
@dbus.service.method(_interface, out_signature=u"b")
659
def IsStillValid(self):
660
return self.still_valid()
520
IsStillValid = (dbus.service.method(_interface, out_signature="b")
522
IsStillValid.__name__ = "IsStillValid"
662
524
# PropertyChanged - signal
663
@dbus.service.signal(_interface, signature=u"sv")
525
@dbus.service.signal(_interface, signature="sv")
664
526
def PropertyChanged(self, property, value):
668
# ReceivedSecret - signal
669
@dbus.service.signal(_interface)
670
def ReceivedSecret(self):
675
@dbus.service.signal(_interface)
680
530
# SetChecker - method
681
@dbus.service.method(_interface, in_signature=u"s")
531
@dbus.service.method(_interface, in_signature="s")
682
532
def SetChecker(self, checker):
683
533
"D-Bus setter method"
684
534
self.checker_command = checker
742
590
# StopChecker - method
743
@dbus.service.method(_interface)
744
def StopChecker(self):
591
StopChecker = dbus.service.method(_interface)(stop_checker)
592
StopChecker.__name__ = "StopChecker"
750
class ClientHandler(socketserver.BaseRequestHandler, object):
751
"""A class to handle client connections.
753
Instantiated once for each connection to handle it.
597
def peer_certificate(session):
598
"Return the peer's OpenPGP certificate as a bytestring"
599
# If not an OpenPGP certificate...
600
if (gnutls.library.functions
601
.gnutls_certificate_type_get(session._c_object)
602
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
603
# ...do the normal thing
604
return session.peer_certificate
605
list_size = ctypes.c_uint(1)
606
cert_list = (gnutls.library.functions
607
.gnutls_certificate_get_peers
608
(session._c_object, ctypes.byref(list_size)))
609
if not bool(cert_list) and list_size.value != 0:
610
raise gnutls.errors.GNUTLSError("error getting peer"
612
if list_size.value == 0:
615
return ctypes.string_at(cert.data, cert.size)
618
def fingerprint(openpgp):
619
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
620
# New GnuTLS "datum" with the OpenPGP public key
621
datum = (gnutls.library.types
622
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
625
ctypes.c_uint(len(openpgp))))
626
# New empty GnuTLS certificate
627
crt = gnutls.library.types.gnutls_openpgp_crt_t()
628
(gnutls.library.functions
629
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
630
# Import the OpenPGP public key into the certificate
631
(gnutls.library.functions
632
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
633
gnutls.library.constants
634
.GNUTLS_OPENPGP_FMT_RAW))
635
# Verify the self signature in the key
636
crtverify = ctypes.c_uint()
637
(gnutls.library.functions
638
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
639
if crtverify.value != 0:
640
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
641
raise gnutls.errors.CertificateSecurityError("Verify failed")
642
# New buffer for the fingerprint
643
buf = ctypes.create_string_buffer(20)
644
buf_len = ctypes.c_size_t()
645
# Get the fingerprint from the certificate into the buffer
646
(gnutls.library.functions
647
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
648
ctypes.byref(buf_len)))
649
# Deinit the certificate
650
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
651
# Convert the buffer to a Python bytestring
652
fpr = ctypes.string_at(buf, buf_len.value)
653
# Convert the bytestring to hexadecimal notation
654
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
658
class TCP_handler(SocketServer.BaseRequestHandler, object):
659
"""A TCP request handler class.
660
Instantiated by IPv6_TCPServer for each request to handle it.
754
661
Note: This will run in its own forked process."""
756
663
def handle(self):
757
664
logger.info(u"TCP connection from: %s",
758
665
unicode(self.client_address))
759
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
# Open IPC pipe to parent process
761
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
762
session = (gnutls.connection
763
.ClientSession(self.request,
767
line = self.request.makefile().readline()
768
logger.debug(u"Protocol version: %r", line)
770
if int(line.strip().split()[0]) > 1:
772
except (ValueError, IndexError, RuntimeError), error:
773
logger.error(u"Unknown protocol version: %s", error)
776
# Note: gnutls.connection.X509Credentials is really a
777
# generic GnuTLS certificate credentials object so long as
778
# no X.509 keys are added to it. Therefore, we can use it
779
# here despite using OpenPGP certificates.
781
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
# u"+AES-256-CBC", u"+SHA1",
783
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
785
# Use a fallback default, since this MUST be set.
786
priority = self.server.gnutls_priority
789
(gnutls.library.functions
790
.gnutls_priority_set_direct(session._c_object,
795
except gnutls.errors.GNUTLSError, error:
796
logger.warning(u"Handshake failed: %s", error)
797
# Do not run session.bye() here: the session is not
798
# established. Just abandon the request.
800
logger.debug(u"Handshake succeeded")
802
fpr = self.fingerprint(self.peer_certificate(session))
803
except (TypeError, gnutls.errors.GNUTLSError), error:
804
logger.warning(u"Bad certificate: %s", error)
807
logger.debug(u"Fingerprint: %s", fpr)
809
for c in self.server.clients:
810
if c.fingerprint == fpr:
814
ipc.write(u"NOTFOUND %s %s\n"
815
% (fpr, unicode(self.client_address)))
818
# Have to check if client.still_valid(), since it is
819
# possible that the client timed out while establishing
820
# the GnuTLS session.
821
if not client.still_valid():
822
ipc.write(u"INVALID %s\n" % client.name)
825
ipc.write(u"SENDING %s\n" % client.name)
827
while sent_size < len(client.secret):
828
sent = session.send(client.secret[sent_size:])
829
logger.debug(u"Sent: %d, remaining: %d",
830
sent, len(client.secret)
831
- (sent_size + sent))
836
def peer_certificate(session):
837
"Return the peer's OpenPGP certificate as a bytestring"
838
# If not an OpenPGP certificate...
839
if (gnutls.library.functions
840
.gnutls_certificate_type_get(session._c_object)
841
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
842
# ...do the normal thing
843
return session.peer_certificate
844
list_size = ctypes.c_uint(1)
845
cert_list = (gnutls.library.functions
846
.gnutls_certificate_get_peers
847
(session._c_object, ctypes.byref(list_size)))
848
if not bool(cert_list) and list_size.value != 0:
849
raise gnutls.errors.GNUTLSError(u"error getting peer"
851
if list_size.value == 0:
854
return ctypes.string_at(cert.data, cert.size)
857
def fingerprint(openpgp):
858
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
859
# New GnuTLS "datum" with the OpenPGP public key
860
datum = (gnutls.library.types
861
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
864
ctypes.c_uint(len(openpgp))))
865
# New empty GnuTLS certificate
866
crt = gnutls.library.types.gnutls_openpgp_crt_t()
867
(gnutls.library.functions
868
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
869
# Import the OpenPGP public key into the certificate
870
(gnutls.library.functions
871
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
872
gnutls.library.constants
873
.GNUTLS_OPENPGP_FMT_RAW))
874
# Verify the self signature in the key
875
crtverify = ctypes.c_uint()
876
(gnutls.library.functions
877
.gnutls_openpgp_crt_verify_self(crt, 0,
878
ctypes.byref(crtverify)))
879
if crtverify.value != 0:
880
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
881
raise (gnutls.errors.CertificateSecurityError
883
# New buffer for the fingerprint
884
buf = ctypes.create_string_buffer(20)
885
buf_len = ctypes.c_size_t()
886
# Get the fingerprint from the certificate into the buffer
887
(gnutls.library.functions
888
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
889
ctypes.byref(buf_len)))
890
# Deinit the certificate
891
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
892
# Convert the buffer to a Python bytestring
893
fpr = ctypes.string_at(buf, buf_len.value)
894
# Convert the bytestring to hexadecimal notation
895
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
899
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
900
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
901
def process_request(self, request, client_address):
902
"""Overrides and wraps the original process_request().
904
This function creates a new pipe in self.pipe
906
self.pipe = os.pipe()
907
super(ForkingMixInWithPipe,
908
self).process_request(request, client_address)
909
os.close(self.pipe[1]) # close write end
910
self.add_pipe(self.pipe[0])
911
def add_pipe(self, pipe):
912
"""Dummy function; override as necessary"""
916
class IPv6_TCPServer(ForkingMixInWithPipe,
917
socketserver.TCPServer, object):
918
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
666
session = (gnutls.connection
667
.ClientSession(self.request,
671
line = self.request.makefile().readline()
672
logger.debug(u"Protocol version: %r", line)
674
if int(line.strip().split()[0]) > 1:
676
except (ValueError, IndexError, RuntimeError), error:
677
logger.error(u"Unknown protocol version: %s", error)
680
# Note: gnutls.connection.X509Credentials is really a generic
681
# GnuTLS certificate credentials object so long as no X.509
682
# keys are added to it. Therefore, we can use it here despite
683
# using OpenPGP certificates.
685
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
686
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
688
# Use a fallback default, since this MUST be set.
689
priority = self.server.settings.get("priority", "NORMAL")
690
(gnutls.library.functions
691
.gnutls_priority_set_direct(session._c_object,
696
except gnutls.errors.GNUTLSError, error:
697
logger.warning(u"Handshake failed: %s", error)
698
# Do not run session.bye() here: the session is not
699
# established. Just abandon the request.
701
logger.debug(u"Handshake succeeded")
703
fpr = fingerprint(peer_certificate(session))
704
except (TypeError, gnutls.errors.GNUTLSError), error:
705
logger.warning(u"Bad certificate: %s", error)
708
logger.debug(u"Fingerprint: %s", fpr)
710
for c in self.server.clients:
711
if c.fingerprint == fpr:
715
logger.warning(u"Client not found for fingerprint: %s",
719
# Have to check if client.still_valid(), since it is possible
720
# that the client timed out while establishing the GnuTLS
722
if not client.still_valid():
723
logger.warning(u"Client %(name)s is invalid",
727
## This won't work here, since we're in a fork.
728
# client.checked_ok()
730
while sent_size < len(client.secret):
731
sent = session.send(client.secret[sent_size:])
732
logger.debug(u"Sent: %d, remaining: %d",
733
sent, len(client.secret)
734
- (sent_size + sent))
739
class IPv6_TCPServer(SocketServer.ForkingMixIn,
740
SocketServer.TCPServer, object):
741
"""IPv6 TCP server. Accepts 'None' as address and/or port.
743
settings: Server settings
744
clients: Set() of Client objects
921
745
enabled: Boolean; whether this server is activated yet
922
interface: None or a network interface name (string)
923
use_ipv6: Boolean; to use IPv6 or not
925
def __init__(self, server_address, RequestHandlerClass,
926
interface=None, use_ipv6=True):
927
self.interface = interface
929
self.address_family = socket.AF_INET6
930
socketserver.TCPServer.__init__(self, server_address,
747
address_family = socket.AF_INET6
748
def __init__(self, *args, **kwargs):
749
if "settings" in kwargs:
750
self.settings = kwargs["settings"]
751
del kwargs["settings"]
752
if "clients" in kwargs:
753
self.clients = kwargs["clients"]
754
del kwargs["clients"]
756
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
932
757
def server_bind(self):
933
758
"""This overrides the normal server_bind() function
934
759
to bind to an interface if one was specified, and also NOT to
935
760
bind to an address or port if they were not specified."""
936
if self.interface is not None:
937
if SO_BINDTODEVICE is None:
938
logger.error(u"SO_BINDTODEVICE does not exist;"
939
u" cannot bind to interface %s",
943
self.socket.setsockopt(socket.SOL_SOCKET,
947
except socket.error, error:
948
if error[0] == errno.EPERM:
949
logger.error(u"No permission to"
950
u" bind to interface %s",
952
elif error[0] == errno.ENOPROTOOPT:
953
logger.error(u"SO_BINDTODEVICE not available;"
954
u" cannot bind to interface %s",
761
if self.settings["interface"]:
762
# 25 is from /usr/include/asm-i486/socket.h
763
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
765
self.socket.setsockopt(socket.SOL_SOCKET,
767
self.settings["interface"])
768
except socket.error, error:
769
if error[0] == errno.EPERM:
770
logger.error(u"No permission to"
771
u" bind to interface %s",
772
self.settings["interface"])
958
775
# Only bind(2) the socket if we really need to.
959
776
if self.server_address[0] or self.server_address[1]:
960
777
if not self.server_address[0]:
961
if self.address_family == socket.AF_INET6:
962
any_address = u"::" # in6addr_any
964
any_address = socket.INADDR_ANY
965
self.server_address = (any_address,
779
self.server_address = (in6addr_any,
966
780
self.server_address[1])
967
781
elif not self.server_address[1]:
968
782
self.server_address = (self.server_address[0],
784
# if self.settings["interface"]:
971
785
# self.server_address = (self.server_address[0],
976
return socketserver.TCPServer.server_bind(self)
979
class MandosServer(IPv6_TCPServer):
983
clients: set of Client objects
984
gnutls_priority GnuTLS priority string
985
use_dbus: Boolean; to emit D-Bus signals or not
986
clients: set of Client objects
987
gnutls_priority GnuTLS priority string
988
use_dbus: Boolean; to emit D-Bus signals or not
990
Assumes a gobject.MainLoop event loop.
992
def __init__(self, server_address, RequestHandlerClass,
993
interface=None, use_ipv6=True, clients=None,
994
gnutls_priority=None, use_dbus=True):
996
self.clients = clients
997
if self.clients is None:
999
self.use_dbus = use_dbus
1000
self.gnutls_priority = gnutls_priority
1001
IPv6_TCPServer.__init__(self, server_address,
1002
RequestHandlerClass,
1003
interface = interface,
1004
use_ipv6 = use_ipv6)
791
return super(IPv6_TCPServer, self).server_bind()
1005
792
def server_activate(self):
1006
793
if self.enabled:
1007
return socketserver.TCPServer.server_activate(self)
794
return super(IPv6_TCPServer, self).server_activate()
1008
795
def enable(self):
1009
796
self.enabled = True
1010
def add_pipe(self, pipe):
1011
# Call "handle_ipc" for both data and EOF events
1012
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1014
def handle_ipc(self, source, condition, file_objects={}):
1016
gobject.IO_IN: u"IN", # There is data to read.
1017
gobject.IO_OUT: u"OUT", # Data can be written (without
1019
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1020
gobject.IO_ERR: u"ERR", # Error condition.
1021
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1022
# broken, usually for pipes and
1025
conditions_string = ' | '.join(name
1027
condition_names.iteritems()
1028
if cond & condition)
1029
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1032
# Turn the pipe file descriptor into a Python file object
1033
if source not in file_objects:
1034
file_objects[source] = os.fdopen(source, u"r", 1)
1036
# Read a line from the file object
1037
cmdline = file_objects[source].readline()
1038
if not cmdline: # Empty line means end of file
1039
# close the IPC pipe
1040
file_objects[source].close()
1041
del file_objects[source]
1043
# Stop calling this function
1046
logger.debug(u"IPC command: %r", cmdline)
1048
# Parse and act on command
1049
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1051
if cmd == u"NOTFOUND":
1052
logger.warning(u"Client not found for fingerprint: %s",
1056
mandos_dbus_service.ClientNotFound(args)
1057
elif cmd == u"INVALID":
1058
for client in self.clients:
1059
if client.name == args:
1060
logger.warning(u"Client %s is invalid", args)
1066
logger.error(u"Unknown client %s is invalid", args)
1067
elif cmd == u"SENDING":
1068
for client in self.clients:
1069
if client.name == args:
1070
logger.info(u"Sending secret to %s", client.name)
1074
client.ReceivedSecret()
1077
logger.error(u"Sending secret to unknown client %s",
1080
logger.error(u"Unknown IPC command: %r", cmdline)
1082
# Keep calling this function
1086
799
def string_to_delta(interval):
1087
800
"""Parse a string and return a datetime.timedelta
1089
>>> string_to_delta(u'7d')
802
>>> string_to_delta('7d')
1090
803
datetime.timedelta(7)
1091
>>> string_to_delta(u'60s')
804
>>> string_to_delta('60s')
1092
805
datetime.timedelta(0, 60)
1093
>>> string_to_delta(u'60m')
806
>>> string_to_delta('60m')
1094
807
datetime.timedelta(0, 3600)
1095
>>> string_to_delta(u'24h')
808
>>> string_to_delta('24h')
1096
809
datetime.timedelta(1)
1097
810
>>> string_to_delta(u'1w')
1098
811
datetime.timedelta(7)
1099
>>> string_to_delta(u'5m 30s')
812
>>> string_to_delta('5m 30s')
1100
813
datetime.timedelta(0, 330)
1102
815
timevalue = datetime.timedelta(0)
1210
939
# Default values for config file for server-global settings
1211
server_defaults = { u"interface": u"",
1216
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1217
u"servicename": u"Mandos",
1218
u"use_dbus": u"True",
1219
u"use_ipv6": u"True",
940
server_defaults = { "interface": "",
945
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
946
"servicename": "Mandos",
1222
950
# Parse config file for server-global settings
1223
server_config = configparser.SafeConfigParser(server_defaults)
951
server_config = ConfigParser.SafeConfigParser(server_defaults)
1224
952
del server_defaults
1225
server_config.read(os.path.join(options.configdir,
953
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1227
954
# Convert the SafeConfigParser object to a dict
1228
955
server_settings = server_config.defaults()
1229
956
# Use the appropriate methods on the non-string config options
1230
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1231
server_settings[option] = server_config.getboolean(u"DEFAULT",
957
server_settings["debug"] = server_config.getboolean("DEFAULT",
959
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
1233
961
if server_settings["port"]:
1234
server_settings["port"] = server_config.getint(u"DEFAULT",
962
server_settings["port"] = server_config.getint("DEFAULT",
1236
964
del server_config
1238
966
# Override the settings from the config file with command line
1239
967
# options, if set.
1240
for option in (u"interface", u"address", u"port", u"debug",
1241
u"priority", u"servicename", u"configdir",
1242
u"use_dbus", u"use_ipv6"):
968
for option in ("interface", "address", "port", "debug",
969
"priority", "servicename", "configdir",
1243
971
value = getattr(options, option)
1244
972
if value is not None:
1245
973
server_settings[option] = value
1247
# Force all strings to be unicode
1248
for option in server_settings.keys():
1249
if type(server_settings[option]) is str:
1250
server_settings[option] = unicode(server_settings[option])
1251
975
# Now we have our good server settings in "server_settings"
1253
##################################################################
1255
977
# For convenience
1256
debug = server_settings[u"debug"]
1257
use_dbus = server_settings[u"use_dbus"]
1258
use_ipv6 = server_settings[u"use_ipv6"]
978
debug = server_settings["debug"]
979
use_dbus = server_settings["use_dbus"]
1261
982
syslogger.setLevel(logging.WARNING)
1262
983
console.setLevel(logging.WARNING)
1264
if server_settings[u"servicename"] != u"Mandos":
985
if server_settings["servicename"] != "Mandos":
1265
986
syslogger.setFormatter(logging.Formatter
1266
(u'Mandos (%s) [%%(process)d]:'
1267
u' %%(levelname)s: %%(message)s'
1268
% server_settings[u"servicename"]))
987
('Mandos (%s): %%(levelname)s:'
989
% server_settings["servicename"]))
1270
991
# Parse config file with clients
1271
client_defaults = { u"timeout": u"1h",
1273
u"checker": u"fping -q -- %%(host)s",
992
client_defaults = { "timeout": "1h",
994
"checker": "fping -q -- %%(host)s",
1276
client_config = configparser.SafeConfigParser(client_defaults)
1277
client_config.read(os.path.join(server_settings[u"configdir"],
1280
global mandos_dbus_service
1281
mandos_dbus_service = None
1283
tcp_server = MandosServer((server_settings[u"address"],
1284
server_settings[u"port"]),
1286
interface=server_settings[u"interface"],
1289
server_settings[u"priority"],
1291
pidfilename = u"/var/run/mandos.pid"
997
client_config = ConfigParser.SafeConfigParser(client_defaults)
998
client_config.read(os.path.join(server_settings["configdir"],
1002
tcp_server = IPv6_TCPServer((server_settings["address"],
1003
server_settings["port"]),
1005
settings=server_settings,
1007
pidfilename = "/var/run/mandos.pid"
1293
pidfile = open(pidfilename, u"w")
1009
pidfile = open(pidfilename, "w")
1294
1010
except IOError:
1295
logger.error(u"Could not open file %r", pidfilename)
1011
logger.error("Could not open file %r", pidfilename)
1298
uid = pwd.getpwnam(u"_mandos").pw_uid
1299
gid = pwd.getpwnam(u"_mandos").pw_gid
1014
uid = pwd.getpwnam("_mandos").pw_uid
1015
gid = pwd.getpwnam("_mandos").pw_gid
1300
1016
except KeyError:
1302
uid = pwd.getpwnam(u"mandos").pw_uid
1303
gid = pwd.getpwnam(u"mandos").pw_gid
1018
uid = pwd.getpwnam("mandos").pw_uid
1019
gid = pwd.getpwnam("mandos").pw_gid
1304
1020
except KeyError:
1306
uid = pwd.getpwnam(u"nobody").pw_uid
1307
gid = pwd.getpwnam(u"nobody").pw_gid
1022
uid = pwd.getpwnam("nobody").pw_uid
1023
gid = pwd.getpwnam("nogroup").pw_gid
1308
1024
except KeyError: