/mandos/release : revision 237.2.81

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

35

36

import SocketServer

37

import socket

38

from optparse import OptionParser

38

import optparse

39

import datetime

40

import errno

41

import gnutls.crypto

66

import ctypes

67

import ctypes.util

68

69

version = "1.0.2"

69

version = "1.0.6"

70

71

logger = logging.Logger('mandos')

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos: %(levelname)s: %(message)s'))

76

('Mandos [%(process)d]: %(levelname)s:'

77

' %(message)s'))

77

78

logger.addHandler(syslogger)

78

79

80

console = logging.StreamHandler()

80

console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'

81

' %(message)s'))

81

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

82

' %(levelname)s: %(message)s'))

82

83

logger.addHandler(console)

83

84

85

class AvahiError(Exception):

85

def __init__(self, value):

86

def __init__(self, value, *args, **kwargs):

86

87

self.value = value

87

super(AvahiError, self).__init__()

88

def __str__(self):

89

return repr(self.value)

88

super(AvahiError, self).__init__(value, *args, **kwargs)

89

def __unicode__(self):

90

return unicode(repr(self.value))

90

91

92

class AvahiServiceError(AvahiError):

92

93

pass

113

114

"""

114

115

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

115

116

servicetype = None, port = None, TXT = None,

116

domain = "", host = "", max_renames = 32768):

117

domain = "", host = "", max_renames = 32768,

118

protocol = avahi.PROTO_UNSPEC):

117

119

self.interface = interface

118

120

self.name = name

119

121

self.type = servicetype

123

125

self.host = host

124

126

self.rename_count = 0

125

127

self.max_renames = max_renames

128

self.protocol = protocol

126

129

def rename(self):

127

130

"""Derived from the Avahi example code"""

128

131

if self.rename_count >= self.max_renames:

129

132

logger.critical(u"No suitable Zeroconf service name found"

130

133

u" after %i retries, exiting.",

131

134

self.rename_count)

132

raise AvahiServiceError("Too many renames")

135

raise AvahiServiceError(u"Too many renames")

133

136

self.name = server.GetAlternativeServiceName(self.name)

134

137

logger.info(u"Changing Zeroconf service name to %r ...",

135

138

str(self.name))

157

160

service.name, service.type)

158

161

group.AddService(

159

162

self.interface, # interface

160

avahi.PROTO_INET6, # protocol

163

self.protocol, # protocol

161

164

dbus.UInt32(0), # flags

162

165

self.name, self.type,

163

166

self.domain, self.host,

178

181

class Client(dbus.service.Object):

179

182

"""A representation of a client host served by this server.

180

183

Attributes:

181

name: string; from the config file, used in log messages

184

name: string; from the config file, used in log messages and

185

D-Bus identifiers

182

186

fingerprint: string (40 or 32 hexadecimal digits); used to

183

187

uniquely identify the client

184

188

secret: bytestring; sent verbatim (over TLS) to client

201

205

client lives. %() expansions are done at

202

206

runtime with vars(self) as dict, so that for

203

207

instance %(name)s can be used in the command.

204

dbus_object_path: dbus.ObjectPath

205

Private attibutes:

206

_timeout: Real variable for 'timeout'

207

_interval: Real variable for 'interval'

208

_timeout_milliseconds: Used when calling gobject.timeout_add()

209

_interval_milliseconds: - '' -

208

current_checker_command: string; current running checker_command

209

use_dbus: bool(); Whether to provide D-Bus interface and signals

210

dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus

210

211

"""

211

def _set_timeout(self, timeout):

212

"Setter function for the 'timeout' attribute"

213

self._timeout = timeout

214

self._timeout_milliseconds = ((self.timeout.days

215

* 24 * 60 * 60 * 1000)

216

+ (self.timeout.seconds * 1000)

217

+ (self.timeout.microseconds

218

// 1000))

219

# Emit D-Bus signal

220

self.PropertyChanged(dbus.String(u"timeout"),

221

(dbus.UInt64(self._timeout_milliseconds,

222

variant_level=1)))

223

timeout = property(lambda self: self._timeout, _set_timeout)

224

del _set_timeout

225

226

def _set_interval(self, interval):

227

"Setter function for the 'interval' attribute"

228

self._interval = interval

229

self._interval_milliseconds = ((self.interval.days

230

* 24 * 60 * 60 * 1000)

231

+ (self.interval.seconds

232

* 1000)

233

+ (self.interval.microseconds

234

// 1000))

235

# Emit D-Bus signal

236

self.PropertyChanged(dbus.String(u"interval"),

237

(dbus.UInt64(self._interval_milliseconds,

238

variant_level=1)))

239

interval = property(lambda self: self._interval, _set_interval)

240

del _set_interval

241

242

def __init__(self, name = None, disable_hook=None, config=None):

212

def timeout_milliseconds(self):

213

"Return the 'timeout' attribute in milliseconds"

214

return ((self.timeout.days * 24 * 60 * 60 * 1000)

215

+ (self.timeout.seconds * 1000)

216

+ (self.timeout.microseconds // 1000))

217

218

def interval_milliseconds(self):

219

"Return the 'interval' attribute in milliseconds"

220

return ((self.interval.days * 24 * 60 * 60 * 1000)

221

+ (self.interval.seconds * 1000)

222

+ (self.interval.microseconds // 1000))

223

224

def __init__(self, name = None, disable_hook=None, config=None,

225

use_dbus=True):

243

226

"""Note: the 'checker' key in 'config' sets the

244

227

'checker_command' attribute and *not* the 'checker'

245

228

attribute."""

246

self.dbus_object_path = (dbus.ObjectPath

247

("/Mandos/clients/"

248

+ name.replace(".", "_")))

249

dbus.service.Object.__init__(self, bus,

250

self.dbus_object_path)

229

self.name = name

251

230

if config is None:

252

231

config = {}

253

self.name = name

254

232

logger.debug(u"Creating client %r", self.name)

233

self.use_dbus = False # During __init__

255

234

# Uppercase and remove spaces from fingerprint for later

256

235

# comparison purposes with return value from the fingerprint()

257

236

# function

281

260

self.disable_initiator_tag = None

282

261

self.checker_callback_tag = None

283

262

self.checker_command = config["checker"]

263

self.current_checker_command = None

264

self.last_connect = None

265

# Only now, when this client is initialized, can it show up on

266

# the D-Bus

267

self.use_dbus = use_dbus

268

if self.use_dbus:

269

self.dbus_object_path = (dbus.ObjectPath

270

("/clients/"

271

+ self.name.replace(".", "_")))

272

dbus.service.Object.__init__(self, bus,

273

self.dbus_object_path)

284

274

285

275

def enable(self):

286

276

"""Start this client's checker and timeout hooks"""

288

278

# Schedule a new checker to be started an 'interval' from now,

289

279

# and every interval from then on.

290

280

self.checker_initiator_tag = (gobject.timeout_add

291

(self._interval_milliseconds,

281

(self.interval_milliseconds(),

292

282

self.start_checker))

293

283

# Also start a new checker *right now*.

294

284

self.start_checker()

295

285

# Schedule a disable() when 'timeout' has passed

296

286

self.disable_initiator_tag = (gobject.timeout_add

297

(self._timeout_milliseconds,

287

(self.timeout_milliseconds(),

298

288

self.disable))

299

289

self.enabled = True

300

# Emit D-Bus signal

301

self.PropertyChanged(dbus.String(u"enabled"),

302

dbus.Boolean(True, variant_level=1))

303

self.PropertyChanged(dbus.String(u"last_enabled"),

304

(_datetime_to_dbus(self.last_enabled,

305

variant_level=1)))

290

if self.use_dbus:

291

# Emit D-Bus signals

292

self.PropertyChanged(dbus.String(u"enabled"),

293

dbus.Boolean(True, variant_level=1))

294

self.PropertyChanged(dbus.String(u"last_enabled"),

295

(_datetime_to_dbus(self.last_enabled,

296

variant_level=1)))

306

297

307

298

def disable(self):

308

299

"""Disable this client."""

319

310

if self.disable_hook:

320

311

self.disable_hook(self)

321

312

self.enabled = False

322

# Emit D-Bus signal

323

self.PropertyChanged(dbus.String(u"enabled"),

324

dbus.Boolean(False, variant_level=1))

313

if self.use_dbus:

314

# Emit D-Bus signal

315

self.PropertyChanged(dbus.String(u"enabled"),

316

dbus.Boolean(False, variant_level=1))

325

317

# Do not run this again if called by a gobject.timeout_add

326

318

return False

327

319

333

325

"""The checker has completed, so take appropriate actions."""

334

326

self.checker_callback_tag = None

335

327

self.checker = None

336

# Emit D-Bus signal

337

self.PropertyChanged(dbus.String(u"checker_running"),

338

dbus.Boolean(False, variant_level=1))

339

if (os.WIFEXITED(condition)

340

and (os.WEXITSTATUS(condition) == 0)):

341

logger.info(u"Checker for %(name)s succeeded",

342

vars(self))

328

if self.use_dbus:

343

329

# Emit D-Bus signal

344

self.CheckerCompleted(dbus.Boolean(True),

345

dbus.UInt16(condition),

346

dbus.String(command))

347

self.bump_timeout()

348

elif not os.WIFEXITED(condition):

330

self.PropertyChanged(dbus.String(u"checker_running"),

331

dbus.Boolean(False, variant_level=1))

332

if os.WIFEXITED(condition):

333

exitstatus = os.WEXITSTATUS(condition)

334

if exitstatus == 0:

335

logger.info(u"Checker for %(name)s succeeded",

336

vars(self))

337

self.checked_ok()

338

else:

339

logger.info(u"Checker for %(name)s failed",

340

vars(self))

341

if self.use_dbus:

342

# Emit D-Bus signal

343

self.CheckerCompleted(dbus.Int16(exitstatus),

344

dbus.Int64(condition),

345

dbus.String(command))

346

else:

349

347

logger.warning(u"Checker for %(name)s crashed?",

350

348

vars(self))

351

# Emit D-Bus signal

352

self.CheckerCompleted(dbus.Boolean(False),

353

dbus.UInt16(condition),

354

dbus.String(command))

355

else:

356

logger.info(u"Checker for %(name)s failed",

357

vars(self))

358

# Emit D-Bus signal

359

self.CheckerCompleted(dbus.Boolean(False),

360

dbus.UInt16(condition),

361

dbus.String(command))

349

if self.use_dbus:

350

# Emit D-Bus signal

351

self.CheckerCompleted(dbus.Int16(-1),

352

dbus.Int64(condition),

353

dbus.String(command))

362

354

363

def bump_timeout(self):

355

def checked_ok(self):

364

356

"""Bump up the timeout for this client.

365

357

This should only be called when the client has been seen,

366

358

alive and well.

368

360

self.last_checked_ok = datetime.datetime.utcnow()

369

361

gobject.source_remove(self.disable_initiator_tag)

370

362

self.disable_initiator_tag = (gobject.timeout_add

371

(self._timeout_milliseconds,

363

(self.timeout_milliseconds(),

372

364

self.disable))

373

self.PropertyChanged(dbus.String(u"last_checked_ok"),

374

(_datetime_to_dbus(self.last_checked_ok,

375

variant_level=1)))

365

if self.use_dbus:

366

# Emit D-Bus signal

367

self.PropertyChanged(

368

dbus.String(u"last_checked_ok"),

369

(_datetime_to_dbus(self.last_checked_ok,

370

variant_level=1)))

376

371

377

372

def start_checker(self):

378

373

"""Start a new checker subprocess if one is not running.

386

381

# checkers alone, the checker would have to take more time

387

382

# than 'timeout' for the client to be declared invalid, which

388

383

# is as it should be.

384

385

# If a checker exists, make sure it is not a zombie

386

if self.checker is not None:

387

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

388

if pid:

389

logger.warning("Checker was a zombie")

390

gobject.source_remove(self.checker_callback_tag)

391

self.checker_callback(pid, status,

392

self.current_checker_command)

393

# Start a new checker if needed

389

394

if self.checker is None:

390

395

try:

391

396

# In case checker_command has exactly one % operator

401

406

logger.error(u'Could not format string "%s":'

402

407

u' %s', self.checker_command, error)

403

408

return True # Try again later

409

self.current_checker_command = command

404

410

try:

405

411

logger.info(u"Starting checker %r for %s",

406

412

command, self.name)

411

417

self.checker = subprocess.Popen(command,

412

418

close_fds=True,

413

419

shell=True, cwd="/")

414

# Emit D-Bus signal

415

self.CheckerStarted(command)

416

self.PropertyChanged(dbus.String("checker_running"),

417

dbus.Boolean(True, variant_level=1))

420

if self.use_dbus:

421

# Emit D-Bus signal

422

self.CheckerStarted(command)

423

self.PropertyChanged(

424

dbus.String("checker_running"),

425

dbus.Boolean(True, variant_level=1))

418

426

self.checker_callback_tag = (gobject.child_watch_add

419

427

(self.checker.pid,

420

428

self.checker_callback,

421

429

data=command))

430

# The checker may have completed before the gobject

431

# watch was added. Check for this.

432

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

433

if pid:

434

gobject.source_remove(self.checker_callback_tag)

435

self.checker_callback(pid, status, command)

422

436

except OSError, error:

423

437

logger.error(u"Failed to start subprocess: %s",

424

438

error)

442

456

if error.errno != errno.ESRCH: # No such process

443

457

raise

444

458

self.checker = None

445

self.PropertyChanged(dbus.String(u"checker_running"),

446

dbus.Boolean(False, variant_level=1))

459

if self.use_dbus:

460

self.PropertyChanged(dbus.String(u"checker_running"),

461

dbus.Boolean(False, variant_level=1))

447

462

448

463

def still_valid(self):

449

464

"""Has the timeout not yet passed for this client?"""

456

471

return now < (self.last_checked_ok + self.timeout)

457

472

458

473

## D-Bus methods & signals

459

_interface = u"org.mandos_system.Mandos.Client"

474

_interface = u"se.bsnet.fukt.Mandos.Client"

460

475

461

# BumpTimeout - method

462

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

463

BumpTimeout.__name__ = "BumpTimeout"

476

# CheckedOK - method

477

CheckedOK = dbus.service.method(_interface)(checked_ok)

478

CheckedOK.__name__ = "CheckedOK"

464

479

465

480

# CheckerCompleted - signal

466

@dbus.service.signal(_interface, signature="bqs")

467

def CheckerCompleted(self, success, condition, command):

481

@dbus.service.signal(_interface, signature="nxs")

482

def CheckerCompleted(self, exitcode, waitstatus, command):

468

483

"D-Bus signal"

469

484

pass

470

485

500

515

if self.last_checked_ok is not None

501

516

else dbus.Boolean (False, variant_level=1)),

502

517

dbus.String("timeout"):

503

dbus.UInt64(self._timeout_milliseconds,

518

dbus.UInt64(self.timeout_milliseconds(),

504

519

variant_level=1),

505

520

dbus.String("interval"):

506

dbus.UInt64(self._interval_milliseconds,

521

dbus.UInt64(self.interval_milliseconds(),

507

522

variant_level=1),

508

523

dbus.String("checker"):

509

524

dbus.String(self.checker_command,

511

526

dbus.String("checker_running"):

512

527

dbus.Boolean(self.checker is not None,

513

528

variant_level=1),

529

dbus.String("object_path"):

530

dbus.ObjectPath(self.dbus_object_path,

531

variant_level=1)

514

532

}, signature="sv")

515

533

516

534

# IsStillValid - method

529

547

def SetChecker(self, checker):

530

548

"D-Bus setter method"

531

549

self.checker_command = checker

550

# Emit D-Bus signal

551

self.PropertyChanged(dbus.String(u"checker"),

552

dbus.String(self.checker_command,

553

variant_level=1))

532

554

533

555

# SetHost - method

534

556

@dbus.service.method(_interface, in_signature="s")

535

557

def SetHost(self, host):

536

558

"D-Bus setter method"

537

559

self.host = host

560

# Emit D-Bus signal

561

self.PropertyChanged(dbus.String(u"host"),

562

dbus.String(self.host, variant_level=1))

538

563

539

564

# SetInterval - method

540

565

@dbus.service.method(_interface, in_signature="t")

541

566

def SetInterval(self, milliseconds):

542

self.interval = datetime.timdeelta(0, 0, 0, milliseconds)

567

self.interval = datetime.timedelta(0, 0, 0, milliseconds)

568

# Emit D-Bus signal

569

self.PropertyChanged(dbus.String(u"interval"),

570

(dbus.UInt64(self.interval_milliseconds(),

571

variant_level=1)))

543

572

544

573

# SetSecret - method

545

574

@dbus.service.method(_interface, in_signature="ay",

552

581

@dbus.service.method(_interface, in_signature="t")

553

582

def SetTimeout(self, milliseconds):

554

583

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

584

# Emit D-Bus signal

585

self.PropertyChanged(dbus.String(u"timeout"),

586

(dbus.UInt64(self.timeout_milliseconds(),

587

variant_level=1)))

555

588

556

589

# Enable - method

557

590

Enable = dbus.service.method(_interface)(enable)

584

617

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

585

618

# ...do the normal thing

586

619

return session.peer_certificate

587

list_size = ctypes.c_uint()

620

list_size = ctypes.c_uint(1)

588

621

cert_list = (gnutls.library.functions

589

622

.gnutls_certificate_get_peers

590

623

(session._c_object, ctypes.byref(list_size)))

624

if not bool(cert_list) and list_size.value != 0:

625

raise gnutls.errors.GNUTLSError("error getting peer"

626

" certificate")

591

627

if list_size.value == 0:

592

628

return None

593

629

cert = cert_list[0]

662

698

# using OpenPGP certificates.

663

699

664

700

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

665

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

666

# "+DHE-DSS"))

701

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

702

# "+DHE-DSS"))

667

703

# Use a fallback default, since this MUST be set.

668

704

priority = self.server.settings.get("priority", "NORMAL")

669

705

(gnutls.library.functions

677

713

# Do not run session.bye() here: the session is not

678

714

# established. Just abandon the request.

679

715

return

716

logger.debug(u"Handshake succeeded")

680

717

try:

681

718

fpr = fingerprint(peer_certificate(session))

682

719

except (TypeError, gnutls.errors.GNUTLSError), error:

684

721

session.bye()

685

722

return

686

723

logger.debug(u"Fingerprint: %s", fpr)

724

687

725

for c in self.server.clients:

688

726

if c.fingerprint == fpr:

689

727

client = c

702

740

session.bye()

703

741

return

704

742

## This won't work here, since we're in a fork.

705

# client.bump_timeout()

743

# client.checked_ok()

706

744

sent_size = 0

707

745

while sent_size < len(client.secret):

708

746

sent = session.send(client.secret[sent_size:])

715

753

716

754

class IPv6_TCPServer(SocketServer.ForkingMixIn,

717

755

SocketServer.TCPServer, object):

718

"""IPv6 TCP server. Accepts 'None' as address and/or port.

756

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

719

757

Attributes:

720

758

settings: Server settings

721

759

clients: Set() of Client objects

729

767

if "clients" in kwargs:

730

768

self.clients = kwargs["clients"]

731

769

del kwargs["clients"]

770

if "use_ipv6" in kwargs:

771

if not kwargs["use_ipv6"]:

772

self.address_family = socket.AF_INET

773

del kwargs["use_ipv6"]

732

774

self.enabled = False

733

775

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

734

776

def server_bind(self):

748

790

u" bind to interface %s",

749

791

self.settings["interface"])

750

792

else:

751

raise error

793

raise

752

794

# Only bind(2) the socket if we really need to.

753

795

if self.server_address[0] or self.server_address[1]:

754

796

if not self.server_address[0]:

755

in6addr_any = "::"

756

self.server_address = (in6addr_any,

797

if self.address_family == socket.AF_INET6:

798

any_address = "::" # in6addr_any

799

else:

800

any_address = socket.INADDR_ANY

801

self.server_address = (any_address,

757

802

self.server_address[1])

758

803

elif not self.server_address[1]:

759

804

self.server_address = (self.server_address[0],

775

820

776

821

def string_to_delta(interval):

777

822

"""Parse a string and return a datetime.timedelta

778

823

779

824

>>> string_to_delta('7d')

780

825

datetime.timedelta(7)

781

826

>>> string_to_delta('60s')

833

878

elif state == avahi.ENTRY_GROUP_FAILURE:

834

879

logger.critical(u"Avahi: Error in group state changed %s",

835

880

unicode(error))

836

raise AvahiGroupError("State changed: %s", str(error))

881

raise AvahiGroupError(u"State changed: %s" % unicode(error))

837

882

838

883

def if_nametoindex(interface):

839

884

"""Call the C function if_nametoindex(), or equivalent"""

882

927

883

928

884

929

def main():

885

parser = OptionParser(version = "%%prog %s" % version)

930

parser = optparse.OptionParser(version = "%%prog %s" % version)

886

931

parser.add_option("-i", "--interface", type="string",

887

932

metavar="IF", help="Bind to interface IF")

888

933

parser.add_option("-a", "--address", type="string",

889

934

help="Address to listen for requests on")

890

935

parser.add_option("-p", "--port", type="int",

891

936

help="Port number to receive requests on")

892

parser.add_option("--check", action="store_true", default=False,

937

parser.add_option("--check", action="store_true",

893

938

help="Run self-test")

894

939

parser.add_option("--debug", action="store_true",

895

940

help="Debug mode; run in foreground and log to"

902

947

default="/etc/mandos", metavar="DIR",

903

948

help="Directory to search for configuration"

904

949

" files")

950

parser.add_option("--no-dbus", action="store_false",

951

dest="use_dbus",

952

help="Do not provide D-Bus system bus"

953

" interface")

954

parser.add_option("--no-ipv6", action="store_false",

955

dest="use_ipv6", help="Do not use IPv6")

905

956

options = parser.parse_args()[0]

906

957

907

958

if options.check:

917

968

"priority":

918

969

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

919

970

"servicename": "Mandos",

971

"use_dbus": "True",

972

"use_ipv6": "True",

920

973

}

921

974

922

975

# Parse config file for server-global settings

925

978

server_config.read(os.path.join(options.configdir, "mandos.conf"))

926

979

# Convert the SafeConfigParser object to a dict

927

980

server_settings = server_config.defaults()

928

# Use getboolean on the boolean config option

929

server_settings["debug"] = (server_config.getboolean

930

("DEFAULT", "debug"))

981

# Use the appropriate methods on the non-string config options

982

server_settings["debug"] = server_config.getboolean("DEFAULT",

983

"debug")

984

server_settings["use_dbus"] = server_config.getboolean("DEFAULT",

985

"use_dbus")

986

server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",

987

"use_ipv6")

988

if server_settings["port"]:

989

server_settings["port"] = server_config.getint("DEFAULT",

990

"port")

931

991

del server_config

932

992

933

993

# Override the settings from the config file with command line

934

994

# options, if set.

935

995

for option in ("interface", "address", "port", "debug",

936

"priority", "servicename", "configdir"):

996

"priority", "servicename", "configdir",

997

"use_dbus", "use_ipv6"):

937

998

value = getattr(options, option)

938

999

if value is not None:

939

1000

server_settings[option] = value

940

1001

del options

941

1002

# Now we have our good server settings in "server_settings"

942

1003

1004

# For convenience

943

1005

debug = server_settings["debug"]

1006

use_dbus = server_settings["use_dbus"]

1007

use_ipv6 = server_settings["use_ipv6"]

944

1008

945

1009

if not debug:

946

1010

syslogger.setLevel(logging.WARNING)

955

1019

# Parse config file with clients

956

1020

client_defaults = { "timeout": "1h",

957

1021

"interval": "5m",

958

"checker": "fping -q -- %(host)s",

1022

"checker": "fping -q -- %%(host)s",

959

1023

"host": "",

960

1024

}

961

1025

client_config = ConfigParser.SafeConfigParser(client_defaults)

967

1031

server_settings["port"]),

968

1032

TCP_handler,

969

1033

settings=server_settings,

970

clients=clients)

1034

clients=clients, use_ipv6=use_ipv6)

971

1035

pidfilename = "/var/run/mandos.pid"

972

1036

try:

973

1037

pidfile = open(pidfilename, "w")

974

except IOError, error:

1038

except IOError:

975

1039

logger.error("Could not open file %r", pidfilename)

976

1040

977

1041

try:

978

1042

uid = pwd.getpwnam("_mandos").pw_uid

1043

gid = pwd.getpwnam("_mandos").pw_gid

979

1044

except KeyError:

980

1045

try:

981

1046

uid = pwd.getpwnam("mandos").pw_uid

1047

gid = pwd.getpwnam("mandos").pw_gid

982

1048

except KeyError:

983

1049

try:

984

1050

uid = pwd.getpwnam("nobody").pw_uid

1051

gid = pwd.getpwnam("nogroup").pw_gid

985

1052

except KeyError:

986

1053

uid = 65534

987

try:

988

gid = pwd.getpwnam("_mandos").pw_gid

989

except KeyError:

990

try:

991

gid = pwd.getpwnam("mandos").pw_gid

992

except KeyError:

993

try:

994

gid = pwd.getpwnam("nogroup").pw_gid

995

except KeyError:

996

1054

gid = 65534

997

1055

try:

1056

os.setgid(gid)

998

1057

os.setuid(uid)

999

os.setgid(gid)

1000

1058

except OSError, error:

1001

1059

if error[0] != errno.EPERM:

1002

1060

raise error

1003

1061

1062

# Enable all possible GnuTLS debugging

1063

if debug:

1064

# "Use a log level over 10 to enable all debugging options."

1065

# - GnuTLS manual

1066

gnutls.library.functions.gnutls_global_set_log_level(11)

1067

1068

@gnutls.library.types.gnutls_log_func

1069

def debug_gnutls(level, string):

1070

logger.debug("GnuTLS: %s", string[:-1])

1071

1072

(gnutls.library.functions

1073

.gnutls_global_set_log_function(debug_gnutls))

1074

1004

1075

global service

1076

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1005

1077

service = AvahiService(name = server_settings["servicename"],

1006

servicetype = "_mandos._tcp", )

1078

servicetype = "_mandos._tcp",

1079

protocol = protocol)

1007

1080

if server_settings["interface"]:

1008

1081

service.interface = (if_nametoindex

1009

1082

(server_settings["interface"]))

1019

1092

avahi.DBUS_PATH_SERVER),

1020

1093

avahi.DBUS_INTERFACE_SERVER)

1021

1094

# End of Avahi example code

1022

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)

1095

if use_dbus:

1096

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1023

1097

1024

1098

clients.update(Set(Client(name = section,

1025

1099

config

1026

= dict(client_config.items(section)))

1100

= dict(client_config.items(section)),

1101

use_dbus = use_dbus)

1027

1102

for section in client_config.sections()))

1028

1103

if not clients:

1029

logger.critical(u"No clients defined")

1030

sys.exit(1)

1104

logger.warning(u"No clients defined")

1031

1105

1032

1106

if debug:

1033

1107

# Redirect stdin so all checkers get /dev/null

1075

1149

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1076

1150

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1077

1151

1078

class MandosServer(dbus.service.Object):

1079

"""A D-Bus proxy object"""

1080

def __init__(self):

1081

dbus.service.Object.__init__(self, bus,

1082

"/Mandos")

1083

_interface = u"org.mandos_system.Mandos"

1084

1085

@dbus.service.signal(_interface, signature="oa{sv}")

1086

def ClientAdded(self, objpath, properties):

1087

"D-Bus signal"

1088

pass

1089

1090

@dbus.service.signal(_interface, signature="o")

1091

def ClientRemoved(self, objpath):

1092

"D-Bus signal"

1093

pass

1094

1095

@dbus.service.method(_interface, out_signature="ao")

1096

def GetAllClients(self):

1097

return dbus.Array(c.dbus_object_path for c in clients)

1098

1099

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1100

def GetAllClientsWithProperties(self):

1101

return dbus.Dictionary(

1102

((c.dbus_object_path, c.GetAllProperties())

1103

for c in clients),

1104

signature="oa{sv}")

1105

1106

@dbus.service.method(_interface, in_signature="o")

1107

def RemoveClient(self, object_path):

1108

for c in clients:

1109

if c.dbus_object_path == object_path:

1110

c.disable()

1111

clients.remove(c)

1112

return

1113

raise KeyError

1114

1115

del _interface

1116

1117

mandos_server = MandosServer()

1152

if use_dbus:

1153

class MandosServer(dbus.service.Object):

1154

"""A D-Bus proxy object"""

1155

def __init__(self):

1156

dbus.service.Object.__init__(self, bus, "/")

1157

_interface = u"se.bsnet.fukt.Mandos"

1158

1159

@dbus.service.signal(_interface, signature="oa{sv}")

1160

def ClientAdded(self, objpath, properties):

1161

"D-Bus signal"

1162

pass

1163

1164

@dbus.service.signal(_interface, signature="os")

1165

def ClientRemoved(self, objpath, name):

1166

"D-Bus signal"

1167

pass

1168

1169

@dbus.service.method(_interface, out_signature="ao")

1170

def GetAllClients(self):

1171

"D-Bus method"

1172

return dbus.Array(c.dbus_object_path for c in clients)

1173

1174

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1175

def GetAllClientsWithProperties(self):

1176

"D-Bus method"

1177

return dbus.Dictionary(

1178

((c.dbus_object_path, c.GetAllProperties())

1179

for c in clients),

1180

signature="oa{sv}")

1181

1182

@dbus.service.method(_interface, in_signature="o")

1183

def RemoveClient(self, object_path):

1184

"D-Bus method"

1185

for c in clients:

1186

if c.dbus_object_path == object_path:

1187

clients.remove(c)

1188

# Don't signal anything except ClientRemoved

1189

c.use_dbus = False

1190

c.disable()

1191

# Emit D-Bus signal

1192

self.ClientRemoved(object_path, c.name)

1193

return

1194

raise KeyError

1195

1196

del _interface

1197

1198

mandos_server = MandosServer()

1118

1199

1119

1200

for client in clients:

1120

# Emit D-Bus signal

1121

mandos_server.ClientAdded(client.dbus_object_path,

1122

client.GetAllProperties())

1201

if use_dbus:

1202

# Emit D-Bus signal

1203

mandos_server.ClientAdded(client.dbus_object_path,

1204

client.GetAllProperties())

1123

1205

client.enable()

1124

1206

1125

1207

tcp_server.enable()

1127

1209

1128

1210

# Find out what port we got

1129

1211

service.port = tcp_server.socket.getsockname()[1]

1130

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

1131

u" scope_id %d" % tcp_server.socket.getsockname())

1212

if use_ipv6:

1213

logger.info(u"Now listening on address %r, port %d,"

1214

" flowinfo %d, scope_id %d"

1215

% tcp_server.socket.getsockname())

1216

else: # IPv4

1217

logger.info(u"Now listening on address %r, port %d"

1218

% tcp_server.socket.getsockname())

1132

1219

1133

1220

#service.interface = tcp_server.socket.getsockname()[3]

1134

1221

1150

1237

logger.debug(u"Starting main loop")

1151

1238

main_loop.run()

1152

1239

except AvahiError, error:

1153

logger.critical(u"AvahiError: %s" + unicode(error))

1240

logger.critical(u"AvahiError: %s", error)

1154

1241

sys.exit(1)

1155

1242

except KeyboardInterrupt:

1156

1243

if debug:

1157

print

1244

print >> sys.stderr

1245

logger.debug("Server received KeyboardInterrupt")

1246

logger.debug("Server exiting")

1158

1247

1159

1248

if __name__ == '__main__':

1160

1249

main()