71
71
logger = logging.Logger('mandos')
72
72
syslogger = (logging.handlers.SysLogHandler
73
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
74
address = "/dev/log"))
75
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
76
('Mandos [%(process)d]: %(levelname)s:'
77
78
logger.addHandler(syslogger)
79
80
console = logging.StreamHandler()
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
82
83
logger.addHandler(console)
84
85
class AvahiError(Exception):
85
def __init__(self, value):
86
def __init__(self, value, *args, **kwargs):
87
super(AvahiError, self).__init__()
89
return repr(self.value)
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
91
92
class AvahiServiceError(AvahiError):
114
115
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
116
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
117
domain = "", host = "", max_renames = 32768,
118
protocol = avahi.PROTO_UNSPEC):
117
119
self.interface = interface
119
121
self.type = servicetype
124
126
self.rename_count = 0
125
127
self.max_renames = max_renames
128
self.protocol = protocol
126
129
def rename(self):
127
130
"""Derived from the Avahi example code"""
128
131
if self.rename_count >= self.max_renames:
129
132
logger.critical(u"No suitable Zeroconf service name found"
130
133
u" after %i retries, exiting.",
131
134
self.rename_count)
132
raise AvahiServiceError("Too many renames")
135
raise AvahiServiceError(u"Too many renames")
133
136
self.name = server.GetAlternativeServiceName(self.name)
134
137
logger.info(u"Changing Zeroconf service name to %r ...",
178
181
class Client(dbus.service.Object):
179
182
"""A representation of a client host served by this server.
181
name: string; from the config file, used in log messages
184
name: string; from the config file, used in log messages and
182
186
fingerprint: string (40 or 32 hexadecimal digits); used to
183
187
uniquely identify the client
184
188
secret: bytestring; sent verbatim (over TLS) to client
201
205
client lives. %() expansions are done at
202
206
runtime with vars(self) as dict, so that for
203
207
instance %(name)s can be used in the command.
204
dbus_object_path: dbus.ObjectPath
206
_timeout: Real variable for 'timeout'
207
_interval: Real variable for 'interval'
208
_timeout_milliseconds: Used when calling gobject.timeout_add()
209
_interval_milliseconds: - '' -
208
current_checker_command: string; current running checker_command
209
use_dbus: bool(); Whether to provide D-Bus interface and signals
210
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
211
def _set_timeout(self, timeout):
212
"Setter function for the 'timeout' attribute"
213
self._timeout = timeout
214
self._timeout_milliseconds = ((self.timeout.days
215
* 24 * 60 * 60 * 1000)
216
+ (self.timeout.seconds * 1000)
217
+ (self.timeout.microseconds
220
self.PropertyChanged(dbus.String(u"timeout"),
221
(dbus.UInt64(self._timeout_milliseconds,
223
timeout = property(lambda self: self._timeout, _set_timeout)
226
def _set_interval(self, interval):
227
"Setter function for the 'interval' attribute"
228
self._interval = interval
229
self._interval_milliseconds = ((self.interval.days
230
* 24 * 60 * 60 * 1000)
231
+ (self.interval.seconds
233
+ (self.interval.microseconds
236
self.PropertyChanged(dbus.String(u"interval"),
237
(dbus.UInt64(self._interval_milliseconds,
239
interval = property(lambda self: self._interval, _set_interval)
242
def __init__(self, name = None, disable_hook=None, config=None):
212
def timeout_milliseconds(self):
213
"Return the 'timeout' attribute in milliseconds"
214
return ((self.timeout.days * 24 * 60 * 60 * 1000)
215
+ (self.timeout.seconds * 1000)
216
+ (self.timeout.microseconds // 1000))
218
def interval_milliseconds(self):
219
"Return the 'interval' attribute in milliseconds"
220
return ((self.interval.days * 24 * 60 * 60 * 1000)
221
+ (self.interval.seconds * 1000)
222
+ (self.interval.microseconds // 1000))
224
def __init__(self, name = None, disable_hook=None, config=None,
243
226
"""Note: the 'checker' key in 'config' sets the
244
227
'checker_command' attribute and *not* the 'checker'
246
self.dbus_object_path = (dbus.ObjectPath
248
+ name.replace(".", "_")))
249
dbus.service.Object.__init__(self, bus,
250
self.dbus_object_path)
251
230
if config is None:
254
232
logger.debug(u"Creating client %r", self.name)
233
self.use_dbus = False # During __init__
255
234
# Uppercase and remove spaces from fingerprint for later
256
235
# comparison purposes with return value from the fingerprint()
281
260
self.disable_initiator_tag = None
282
261
self.checker_callback_tag = None
283
262
self.checker_command = config["checker"]
263
self.current_checker_command = None
264
self.last_connect = None
265
# Only now, when this client is initialized, can it show up on
267
self.use_dbus = use_dbus
269
self.dbus_object_path = (dbus.ObjectPath
271
+ self.name.replace(".", "_")))
272
dbus.service.Object.__init__(self, bus,
273
self.dbus_object_path)
285
275
def enable(self):
286
276
"""Start this client's checker and timeout hooks"""
288
278
# Schedule a new checker to be started an 'interval' from now,
289
279
# and every interval from then on.
290
280
self.checker_initiator_tag = (gobject.timeout_add
291
(self._interval_milliseconds,
281
(self.interval_milliseconds(),
292
282
self.start_checker))
293
283
# Also start a new checker *right now*.
294
284
self.start_checker()
295
285
# Schedule a disable() when 'timeout' has passed
296
286
self.disable_initiator_tag = (gobject.timeout_add
297
(self._timeout_milliseconds,
287
(self.timeout_milliseconds(),
299
289
self.enabled = True
301
self.PropertyChanged(dbus.String(u"enabled"),
302
dbus.Boolean(True, variant_level=1))
303
self.PropertyChanged(dbus.String(u"last_enabled"),
304
(_datetime_to_dbus(self.last_enabled,
292
self.PropertyChanged(dbus.String(u"enabled"),
293
dbus.Boolean(True, variant_level=1))
294
self.PropertyChanged(dbus.String(u"last_enabled"),
295
(_datetime_to_dbus(self.last_enabled,
307
298
def disable(self):
308
299
"""Disable this client."""
333
325
"""The checker has completed, so take appropriate actions."""
334
326
self.checker_callback_tag = None
335
327
self.checker = None
337
self.PropertyChanged(dbus.String(u"checker_running"),
338
dbus.Boolean(False, variant_level=1))
339
if (os.WIFEXITED(condition)
340
and (os.WEXITSTATUS(condition) == 0)):
341
logger.info(u"Checker for %(name)s succeeded",
343
329
# Emit D-Bus signal
344
self.CheckerCompleted(dbus.Boolean(True),
345
dbus.UInt16(condition),
346
dbus.String(command))
348
elif not os.WIFEXITED(condition):
330
self.PropertyChanged(dbus.String(u"checker_running"),
331
dbus.Boolean(False, variant_level=1))
332
if os.WIFEXITED(condition):
333
exitstatus = os.WEXITSTATUS(condition)
335
logger.info(u"Checker for %(name)s succeeded",
339
logger.info(u"Checker for %(name)s failed",
343
self.CheckerCompleted(dbus.Int16(exitstatus),
344
dbus.Int64(condition),
345
dbus.String(command))
349
347
logger.warning(u"Checker for %(name)s crashed?",
352
self.CheckerCompleted(dbus.Boolean(False),
353
dbus.UInt16(condition),
354
dbus.String(command))
356
logger.info(u"Checker for %(name)s failed",
359
self.CheckerCompleted(dbus.Boolean(False),
360
dbus.UInt16(condition),
361
dbus.String(command))
351
self.CheckerCompleted(dbus.Int16(-1),
352
dbus.Int64(condition),
353
dbus.String(command))
363
def bump_timeout(self):
355
def checked_ok(self):
364
356
"""Bump up the timeout for this client.
365
357
This should only be called when the client has been seen,
368
360
self.last_checked_ok = datetime.datetime.utcnow()
369
361
gobject.source_remove(self.disable_initiator_tag)
370
362
self.disable_initiator_tag = (gobject.timeout_add
371
(self._timeout_milliseconds,
363
(self.timeout_milliseconds(),
373
self.PropertyChanged(dbus.String(u"last_checked_ok"),
374
(_datetime_to_dbus(self.last_checked_ok,
367
self.PropertyChanged(
368
dbus.String(u"last_checked_ok"),
369
(_datetime_to_dbus(self.last_checked_ok,
377
372
def start_checker(self):
378
373
"""Start a new checker subprocess if one is not running.
386
381
# checkers alone, the checker would have to take more time
387
382
# than 'timeout' for the client to be declared invalid, which
388
383
# is as it should be.
385
# If a checker exists, make sure it is not a zombie
386
if self.checker is not None:
387
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
389
logger.warning("Checker was a zombie")
390
gobject.source_remove(self.checker_callback_tag)
391
self.checker_callback(pid, status,
392
self.current_checker_command)
393
# Start a new checker if needed
389
394
if self.checker is None:
391
396
# In case checker_command has exactly one % operator
411
417
self.checker = subprocess.Popen(command,
413
419
shell=True, cwd="/")
415
self.CheckerStarted(command)
416
self.PropertyChanged(dbus.String("checker_running"),
417
dbus.Boolean(True, variant_level=1))
422
self.CheckerStarted(command)
423
self.PropertyChanged(
424
dbus.String("checker_running"),
425
dbus.Boolean(True, variant_level=1))
418
426
self.checker_callback_tag = (gobject.child_watch_add
419
427
(self.checker.pid,
420
428
self.checker_callback,
430
# The checker may have completed before the gobject
431
# watch was added. Check for this.
432
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
434
gobject.source_remove(self.checker_callback_tag)
435
self.checker_callback(pid, status, command)
422
436
except OSError, error:
423
437
logger.error(u"Failed to start subprocess: %s",
456
471
return now < (self.last_checked_ok + self.timeout)
458
473
## D-Bus methods & signals
459
_interface = u"org.mandos_system.Mandos.Client"
474
_interface = u"se.bsnet.fukt.Mandos.Client"
461
# BumpTimeout - method
462
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
463
BumpTimeout.__name__ = "BumpTimeout"
477
CheckedOK = dbus.service.method(_interface)(checked_ok)
478
CheckedOK.__name__ = "CheckedOK"
465
480
# CheckerCompleted - signal
466
@dbus.service.signal(_interface, signature="bqs")
467
def CheckerCompleted(self, success, condition, command):
481
@dbus.service.signal(_interface, signature="nxs")
482
def CheckerCompleted(self, exitcode, waitstatus, command):
500
515
if self.last_checked_ok is not None
501
516
else dbus.Boolean (False, variant_level=1)),
502
517
dbus.String("timeout"):
503
dbus.UInt64(self._timeout_milliseconds,
518
dbus.UInt64(self.timeout_milliseconds(),
504
519
variant_level=1),
505
520
dbus.String("interval"):
506
dbus.UInt64(self._interval_milliseconds,
521
dbus.UInt64(self.interval_milliseconds(),
507
522
variant_level=1),
508
523
dbus.String("checker"):
509
524
dbus.String(self.checker_command,
529
547
def SetChecker(self, checker):
530
548
"D-Bus setter method"
531
549
self.checker_command = checker
551
self.PropertyChanged(dbus.String(u"checker"),
552
dbus.String(self.checker_command,
533
555
# SetHost - method
534
556
@dbus.service.method(_interface, in_signature="s")
535
557
def SetHost(self, host):
536
558
"D-Bus setter method"
561
self.PropertyChanged(dbus.String(u"host"),
562
dbus.String(self.host, variant_level=1))
539
564
# SetInterval - method
540
565
@dbus.service.method(_interface, in_signature="t")
541
566
def SetInterval(self, milliseconds):
542
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
567
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
569
self.PropertyChanged(dbus.String(u"interval"),
570
(dbus.UInt64(self.interval_milliseconds(),
544
573
# SetSecret - method
545
574
@dbus.service.method(_interface, in_signature="ay",
552
581
@dbus.service.method(_interface, in_signature="t")
553
582
def SetTimeout(self, milliseconds):
554
583
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
585
self.PropertyChanged(dbus.String(u"timeout"),
586
(dbus.UInt64(self.timeout_milliseconds(),
556
589
# Enable - method
557
590
Enable = dbus.service.method(_interface)(enable)
584
617
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
585
618
# ...do the normal thing
586
619
return session.peer_certificate
587
list_size = ctypes.c_uint()
620
list_size = ctypes.c_uint(1)
588
621
cert_list = (gnutls.library.functions
589
622
.gnutls_certificate_get_peers
590
623
(session._c_object, ctypes.byref(list_size)))
624
if not bool(cert_list) and list_size.value != 0:
625
raise gnutls.errors.GNUTLSError("error getting peer"
591
627
if list_size.value == 0:
593
629
cert = cert_list[0]
662
698
# using OpenPGP certificates.
664
700
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
665
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
701
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
667
703
# Use a fallback default, since this MUST be set.
668
704
priority = self.server.settings.get("priority", "NORMAL")
669
705
(gnutls.library.functions
748
790
u" bind to interface %s",
749
791
self.settings["interface"])
752
794
# Only bind(2) the socket if we really need to.
753
795
if self.server_address[0] or self.server_address[1]:
754
796
if not self.server_address[0]:
756
self.server_address = (in6addr_any,
797
if self.address_family == socket.AF_INET6:
798
any_address = "::" # in6addr_any
800
any_address = socket.INADDR_ANY
801
self.server_address = (any_address,
757
802
self.server_address[1])
758
803
elif not self.server_address[1]:
759
804
self.server_address = (self.server_address[0],
885
parser = OptionParser(version = "%%prog %s" % version)
930
parser = optparse.OptionParser(version = "%%prog %s" % version)
886
931
parser.add_option("-i", "--interface", type="string",
887
932
metavar="IF", help="Bind to interface IF")
888
933
parser.add_option("-a", "--address", type="string",
889
934
help="Address to listen for requests on")
890
935
parser.add_option("-p", "--port", type="int",
891
936
help="Port number to receive requests on")
892
parser.add_option("--check", action="store_true", default=False,
937
parser.add_option("--check", action="store_true",
893
938
help="Run self-test")
894
939
parser.add_option("--debug", action="store_true",
895
940
help="Debug mode; run in foreground and log to"
902
947
default="/etc/mandos", metavar="DIR",
903
948
help="Directory to search for configuration"
950
parser.add_option("--no-dbus", action="store_false",
952
help="Do not provide D-Bus system bus"
954
parser.add_option("--no-ipv6", action="store_false",
955
dest="use_ipv6", help="Do not use IPv6")
905
956
options = parser.parse_args()[0]
907
958
if options.check:
925
978
server_config.read(os.path.join(options.configdir, "mandos.conf"))
926
979
# Convert the SafeConfigParser object to a dict
927
980
server_settings = server_config.defaults()
928
# Use getboolean on the boolean config option
929
server_settings["debug"] = (server_config.getboolean
930
("DEFAULT", "debug"))
981
# Use the appropriate methods on the non-string config options
982
server_settings["debug"] = server_config.getboolean("DEFAULT",
984
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
986
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
988
if server_settings["port"]:
989
server_settings["port"] = server_config.getint("DEFAULT",
931
991
del server_config
933
993
# Override the settings from the config file with command line
934
994
# options, if set.
935
995
for option in ("interface", "address", "port", "debug",
936
"priority", "servicename", "configdir"):
996
"priority", "servicename", "configdir",
997
"use_dbus", "use_ipv6"):
937
998
value = getattr(options, option)
938
999
if value is not None:
939
1000
server_settings[option] = value
941
1002
# Now we have our good server settings in "server_settings"
943
1005
debug = server_settings["debug"]
1006
use_dbus = server_settings["use_dbus"]
1007
use_ipv6 = server_settings["use_ipv6"]
946
1010
syslogger.setLevel(logging.WARNING)
967
1031
server_settings["port"]),
969
1033
settings=server_settings,
1034
clients=clients, use_ipv6=use_ipv6)
971
1035
pidfilename = "/var/run/mandos.pid"
973
1037
pidfile = open(pidfilename, "w")
974
except IOError, error:
975
1039
logger.error("Could not open file %r", pidfilename)
978
1042
uid = pwd.getpwnam("_mandos").pw_uid
1043
gid = pwd.getpwnam("_mandos").pw_gid
979
1044
except KeyError:
981
1046
uid = pwd.getpwnam("mandos").pw_uid
1047
gid = pwd.getpwnam("mandos").pw_gid
982
1048
except KeyError:
984
1050
uid = pwd.getpwnam("nobody").pw_uid
1051
gid = pwd.getpwnam("nogroup").pw_gid
985
1052
except KeyError:
988
gid = pwd.getpwnam("_mandos").pw_gid
991
gid = pwd.getpwnam("mandos").pw_gid
994
gid = pwd.getpwnam("nogroup").pw_gid
1000
1058
except OSError, error:
1001
1059
if error[0] != errno.EPERM:
1062
# Enable all possible GnuTLS debugging
1064
# "Use a log level over 10 to enable all debugging options."
1066
gnutls.library.functions.gnutls_global_set_log_level(11)
1068
@gnutls.library.types.gnutls_log_func
1069
def debug_gnutls(level, string):
1070
logger.debug("GnuTLS: %s", string[:-1])
1072
(gnutls.library.functions
1073
.gnutls_global_set_log_function(debug_gnutls))
1076
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1005
1077
service = AvahiService(name = server_settings["servicename"],
1006
servicetype = "_mandos._tcp", )
1078
servicetype = "_mandos._tcp",
1079
protocol = protocol)
1007
1080
if server_settings["interface"]:
1008
1081
service.interface = (if_nametoindex
1009
1082
(server_settings["interface"]))
1019
1092
avahi.DBUS_PATH_SERVER),
1020
1093
avahi.DBUS_INTERFACE_SERVER)
1021
1094
# End of Avahi example code
1022
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
1096
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1024
1098
clients.update(Set(Client(name = section,
1026
= dict(client_config.items(section)))
1100
= dict(client_config.items(section)),
1101
use_dbus = use_dbus)
1027
1102
for section in client_config.sections()))
1028
1103
if not clients:
1029
logger.critical(u"No clients defined")
1104
logger.warning(u"No clients defined")
1033
1107
# Redirect stdin so all checkers get /dev/null
1075
1149
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1076
1150
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1078
class MandosServer(dbus.service.Object):
1079
"""A D-Bus proxy object"""
1081
dbus.service.Object.__init__(self, bus,
1083
_interface = u"org.mandos_system.Mandos"
1085
@dbus.service.signal(_interface, signature="oa{sv}")
1086
def ClientAdded(self, objpath, properties):
1090
@dbus.service.signal(_interface, signature="o")
1091
def ClientRemoved(self, objpath):
1095
@dbus.service.method(_interface, out_signature="ao")
1096
def GetAllClients(self):
1097
return dbus.Array(c.dbus_object_path for c in clients)
1099
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1100
def GetAllClientsWithProperties(self):
1101
return dbus.Dictionary(
1102
((c.dbus_object_path, c.GetAllProperties())
1106
@dbus.service.method(_interface, in_signature="o")
1107
def RemoveClient(self, object_path):
1109
if c.dbus_object_path == object_path:
1117
mandos_server = MandosServer()
1153
class MandosServer(dbus.service.Object):
1154
"""A D-Bus proxy object"""
1156
dbus.service.Object.__init__(self, bus, "/")
1157
_interface = u"se.bsnet.fukt.Mandos"
1159
@dbus.service.signal(_interface, signature="oa{sv}")
1160
def ClientAdded(self, objpath, properties):
1164
@dbus.service.signal(_interface, signature="os")
1165
def ClientRemoved(self, objpath, name):
1169
@dbus.service.method(_interface, out_signature="ao")
1170
def GetAllClients(self):
1172
return dbus.Array(c.dbus_object_path for c in clients)
1174
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1175
def GetAllClientsWithProperties(self):
1177
return dbus.Dictionary(
1178
((c.dbus_object_path, c.GetAllProperties())
1182
@dbus.service.method(_interface, in_signature="o")
1183
def RemoveClient(self, object_path):
1186
if c.dbus_object_path == object_path:
1188
# Don't signal anything except ClientRemoved
1192
self.ClientRemoved(object_path, c.name)
1198
mandos_server = MandosServer()
1119
1200
for client in clients:
1121
mandos_server.ClientAdded(client.dbus_object_path,
1122
client.GetAllProperties())
1203
mandos_server.ClientAdded(client.dbus_object_path,
1204
client.GetAllProperties())
1123
1205
client.enable()
1125
1207
tcp_server.enable()
1128
1210
# Find out what port we got
1129
1211
service.port = tcp_server.socket.getsockname()[1]
1130
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1131
u" scope_id %d" % tcp_server.socket.getsockname())
1213
logger.info(u"Now listening on address %r, port %d,"
1214
" flowinfo %d, scope_id %d"
1215
% tcp_server.socket.getsockname())
1217
logger.info(u"Now listening on address %r, port %d"
1218
% tcp_server.socket.getsockname())
1133
1220
#service.interface = tcp_server.socket.getsockname()[3]
1150
1237
logger.debug(u"Starting main loop")
1151
1238
main_loop.run()
1152
1239
except AvahiError, error:
1153
logger.critical(u"AvahiError: %s" + unicode(error))
1240
logger.critical(u"AvahiError: %s", error)
1155
1242
except KeyboardInterrupt:
1245
logger.debug("Server received KeyboardInterrupt")
1246
logger.debug("Server exiting")
1159
1248
if __name__ == '__main__':