71
71
logger = logging.Logger('mandos')
72
72
syslogger = (logging.handlers.SysLogHandler
73
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
74
address = "/dev/log"))
75
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
76
('Mandos: %(levelname)s: %(message)s'))
78
77
logger.addHandler(syslogger)
80
79
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
83
82
logger.addHandler(console)
85
84
class AvahiError(Exception):
115
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
115
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768,
118
protocol = avahi.PROTO_UNSPEC):
116
domain = "", host = "", max_renames = 32768):
119
117
self.interface = interface
121
119
self.type = servicetype
160
157
service.name, service.type)
161
158
group.AddService(
162
159
self.interface, # interface
163
self.protocol, # protocol
160
avahi.PROTO_INET6, # protocol
164
161
dbus.UInt32(0), # flags
165
162
self.name, self.type,
166
163
self.domain, self.host,
181
178
class Client(dbus.service.Object):
182
179
"""A representation of a client host served by this server.
184
name: string; from the config file, used in log messages and
181
name: string; from the config file, used in log messages
186
182
fingerprint: string (40 or 32 hexadecimal digits); used to
187
183
uniquely identify the client
188
184
secret: bytestring; sent verbatim (over TLS) to client
205
201
client lives. %() expansions are done at
206
202
runtime with vars(self) as dict, so that for
207
203
instance %(name)s can be used in the command.
208
current_checker_command: string; current running checker_command
209
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
210
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
230
225
if config is None:
232
227
logger.debug(u"Creating client %r", self.name)
233
self.use_dbus = False # During __init__
228
self.use_dbus = use_dbus
230
self.dbus_object_path = (dbus.ObjectPath
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
234
235
# Uppercase and remove spaces from fingerprint for later
235
236
# comparison purposes with return value from the fingerprint()
260
261
self.disable_initiator_tag = None
261
262
self.checker_callback_tag = None
262
263
self.checker_command = config["checker"]
263
self.current_checker_command = None
264
self.last_connect = None
265
# Only now, when this client is initialized, can it show up on
267
self.use_dbus = use_dbus
269
self.dbus_object_path = (dbus.ObjectPath
271
+ self.name.replace(".", "_")))
272
dbus.service.Object.__init__(self, bus,
273
self.dbus_object_path)
275
265
def enable(self):
276
266
"""Start this client's checker and timeout hooks"""
329
319
# Emit D-Bus signal
330
320
self.PropertyChanged(dbus.String(u"checker_running"),
331
321
dbus.Boolean(False, variant_level=1))
332
if os.WIFEXITED(condition):
333
exitstatus = os.WEXITSTATUS(condition)
335
logger.info(u"Checker for %(name)s succeeded",
339
logger.info(u"Checker for %(name)s failed",
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
324
logger.info(u"Checker for %(name)s succeeded",
341
326
if self.use_dbus:
342
327
# Emit D-Bus signal
343
self.CheckerCompleted(dbus.Int16(exitstatus),
344
dbus.Int64(condition),
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
345
330
dbus.String(command))
332
elif not os.WIFEXITED(condition):
347
333
logger.warning(u"Checker for %(name)s crashed?",
349
335
if self.use_dbus:
350
336
# Emit D-Bus signal
351
self.CheckerCompleted(dbus.Int16(-1),
352
dbus.Int64(condition),
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
341
logger.info(u"Checker for %(name)s failed",
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
353
347
dbus.String(command))
355
def checked_ok(self):
349
def bump_timeout(self):
356
350
"""Bump up the timeout for this client.
357
351
This should only be called when the client has been seen,
381
375
# checkers alone, the checker would have to take more time
382
376
# than 'timeout' for the client to be declared invalid, which
383
377
# is as it should be.
385
# If a checker exists, make sure it is not a zombie
386
if self.checker is not None:
387
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
389
logger.warning("Checker was a zombie")
390
gobject.source_remove(self.checker_callback_tag)
391
self.checker_callback(pid, status,
392
self.current_checker_command)
393
# Start a new checker if needed
394
378
if self.checker is None:
396
380
# In case checker_command has exactly one % operator
406
390
logger.error(u'Could not format string "%s":'
407
391
u' %s', self.checker_command, error)
408
392
return True # Try again later
409
self.current_checker_command = command
411
394
logger.info(u"Starting checker %r for %s",
412
395
command, self.name)
427
410
(self.checker.pid,
428
411
self.checker_callback,
430
# The checker may have completed before the gobject
431
# watch was added. Check for this.
432
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
434
gobject.source_remove(self.checker_callback_tag)
435
self.checker_callback(pid, status, command)
436
413
except OSError, error:
437
414
logger.error(u"Failed to start subprocess: %s",
471
448
return now < (self.last_checked_ok + self.timeout)
473
450
## D-Bus methods & signals
474
_interface = u"se.bsnet.fukt.Mandos.Client"
451
_interface = u"org.mandos_system.Mandos.Client"
477
CheckedOK = dbus.service.method(_interface)(checked_ok)
478
CheckedOK.__name__ = "CheckedOK"
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
480
457
# CheckerCompleted - signal
481
@dbus.service.signal(_interface, signature="nxs")
482
def CheckerCompleted(self, exitcode, waitstatus, command):
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
526
503
dbus.String("checker_running"):
527
504
dbus.Boolean(self.checker is not None,
528
505
variant_level=1),
529
dbus.String("object_path"):
530
dbus.ObjectPath(self.dbus_object_path,
532
506
}, signature="sv")
534
508
# IsStillValid - method
617
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
618
592
# ...do the normal thing
619
593
return session.peer_certificate
620
list_size = ctypes.c_uint(1)
594
list_size = ctypes.c_uint()
621
595
cert_list = (gnutls.library.functions
622
596
.gnutls_certificate_get_peers
623
597
(session._c_object, ctypes.byref(list_size)))
624
if not bool(cert_list) and list_size.value != 0:
625
raise gnutls.errors.GNUTLSError("error getting peer"
627
598
if list_size.value == 0:
629
600
cert = cert_list[0]
698
669
# using OpenPGP certificates.
700
671
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
701
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
672
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
703
674
# Use a fallback default, since this MUST be set.
704
675
priority = self.server.settings.get("priority", "NORMAL")
705
676
(gnutls.library.functions
713
684
# Do not run session.bye() here: the session is not
714
685
# established. Just abandon the request.
716
logger.debug(u"Handshake succeeded")
718
688
fpr = fingerprint(peer_certificate(session))
719
689
except (TypeError, gnutls.errors.GNUTLSError), error:
754
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
755
724
SocketServer.TCPServer, object):
756
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
725
"""IPv6 TCP server. Accepts 'None' as address and/or port.
758
727
settings: Server settings
759
728
clients: Set() of Client objects
767
736
if "clients" in kwargs:
768
737
self.clients = kwargs["clients"]
769
738
del kwargs["clients"]
770
if "use_ipv6" in kwargs:
771
if not kwargs["use_ipv6"]:
772
self.address_family = socket.AF_INET
773
del kwargs["use_ipv6"]
774
739
self.enabled = False
775
740
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
776
741
def server_bind(self):
790
755
u" bind to interface %s",
791
756
self.settings["interface"])
794
759
# Only bind(2) the socket if we really need to.
795
760
if self.server_address[0] or self.server_address[1]:
796
761
if not self.server_address[0]:
797
if self.address_family == socket.AF_INET6:
798
any_address = "::" # in6addr_any
800
any_address = socket.INADDR_ANY
801
self.server_address = (any_address,
763
self.server_address = (in6addr_any,
802
764
self.server_address[1])
803
765
elif not self.server_address[1]:
804
766
self.server_address = (self.server_address[0],
930
parser = optparse.OptionParser(version = "%%prog %s" % version)
892
parser = OptionParser(version = "%%prog %s" % version)
931
893
parser.add_option("-i", "--interface", type="string",
932
894
metavar="IF", help="Bind to interface IF")
933
895
parser.add_option("-a", "--address", type="string",
950
912
parser.add_option("--no-dbus", action="store_false",
952
help=optparse.SUPPRESS_HELP) # XXX: Not done yet
953
parser.add_option("--no-ipv6", action="store_false",
954
dest="use_ipv6", help="Do not use IPv6")
914
help="Do not provide D-Bus system bus"
955
916
options = parser.parse_args()[0]
957
918
if options.check:
977
937
server_config.read(os.path.join(options.configdir, "mandos.conf"))
978
938
# Convert the SafeConfigParser object to a dict
979
939
server_settings = server_config.defaults()
980
# Use the appropriate methods on the non-string config options
981
server_settings["debug"] = server_config.getboolean("DEFAULT",
983
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
985
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
987
if server_settings["port"]:
988
server_settings["port"] = server_config.getint("DEFAULT",
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
990
945
del server_config
992
947
# Override the settings from the config file with command line
993
948
# options, if set.
994
949
for option in ("interface", "address", "port", "debug",
995
950
"priority", "servicename", "configdir",
996
"use_dbus", "use_ipv6"):
997
952
value = getattr(options, option)
998
953
if value is not None:
999
954
server_settings[option] = value
1003
958
# For convenience
1004
959
debug = server_settings["debug"]
1005
960
use_dbus = server_settings["use_dbus"]
1006
use_dbus = False # XXX: Not done yet
1007
use_ipv6 = server_settings["use_ipv6"]
1010
963
syslogger.setLevel(logging.WARNING)
1019
972
# Parse config file with clients
1020
973
client_defaults = { "timeout": "1h",
1021
974
"interval": "5m",
1022
"checker": "fping -q -- %%(host)s",
975
"checker": "fping -q -- %(host)s",
1025
978
client_config = ConfigParser.SafeConfigParser(client_defaults)
1031
984
server_settings["port"]),
1033
986
settings=server_settings,
1034
clients=clients, use_ipv6=use_ipv6)
1035
988
pidfilename = "/var/run/mandos.pid"
1037
990
pidfile = open(pidfilename, "w")
991
except IOError, error:
1039
992
logger.error("Could not open file %r", pidfilename)
1042
995
uid = pwd.getpwnam("_mandos").pw_uid
998
uid = pwd.getpwnam("mandos").pw_uid
1001
uid = pwd.getpwnam("nobody").pw_uid
1043
1005
gid = pwd.getpwnam("_mandos").pw_gid
1044
1006
except KeyError:
1046
uid = pwd.getpwnam("mandos").pw_uid
1047
1008
gid = pwd.getpwnam("mandos").pw_gid
1048
1009
except KeyError:
1050
uid = pwd.getpwnam("nobody").pw_uid
1051
1011
gid = pwd.getpwnam("nogroup").pw_gid
1052
1012
except KeyError:
1058
1017
except OSError, error:
1059
1018
if error[0] != errno.EPERM:
1062
# Enable all possible GnuTLS debugging
1064
# "Use a log level over 10 to enable all debugging options."
1066
gnutls.library.functions.gnutls_global_set_log_level(11)
1068
@gnutls.library.types.gnutls_log_func
1069
def debug_gnutls(level, string):
1070
logger.debug("GnuTLS: %s", string[:-1])
1072
(gnutls.library.functions
1073
.gnutls_global_set_log_function(debug_gnutls))
1076
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1077
1022
service = AvahiService(name = server_settings["servicename"],
1078
servicetype = "_mandos._tcp",
1079
protocol = protocol)
1023
servicetype = "_mandos._tcp", )
1080
1024
if server_settings["interface"]:
1081
1025
service.interface = (if_nametoindex
1082
1026
(server_settings["interface"]))
1093
1037
avahi.DBUS_INTERFACE_SERVER)
1094
1038
# End of Avahi example code
1096
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1040
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1098
1043
clients.update(Set(Client(name = section,
1153
1098
class MandosServer(dbus.service.Object):
1154
1099
"""A D-Bus proxy object"""
1155
1100
def __init__(self):
1156
dbus.service.Object.__init__(self, bus, "/")
1157
_interface = u"se.bsnet.fukt.Mandos"
1101
dbus.service.Object.__init__(self, bus,
1103
_interface = u"org.mandos_system.Mandos"
1159
1105
@dbus.service.signal(_interface, signature="oa{sv}")
1160
1106
def ClientAdded(self, objpath, properties):
1164
@dbus.service.signal(_interface, signature="os")
1165
def ClientRemoved(self, objpath, name):
1110
@dbus.service.signal(_interface, signature="o")
1111
def ClientRemoved(self, objpath):
1169
1115
@dbus.service.method(_interface, out_signature="ao")
1170
1116
def GetAllClients(self):
1172
1117
return dbus.Array(c.dbus_object_path for c in clients)
1174
1119
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1175
1120
def GetAllClientsWithProperties(self):
1177
1121
return dbus.Dictionary(
1178
1122
((c.dbus_object_path, c.GetAllProperties())
1179
1123
for c in clients),
1180
1124
signature="oa{sv}")
1182
1126
@dbus.service.method(_interface, in_signature="o")
1183
1127
def RemoveClient(self, object_path):
1185
1128
for c in clients:
1186
1129
if c.dbus_object_path == object_path:
1187
1130
clients.remove(c)
1189
1132
c.use_dbus = False
1191
1134
# Emit D-Bus signal
1192
self.ClientRemoved(object_path, c.name)
1135
self.ClientRemoved(object_path)
1138
@dbus.service.method(_interface)
1198
1144
mandos_server = MandosServer()
1200
1146
for client in clients:
1210
1156
# Find out what port we got
1211
1157
service.port = tcp_server.socket.getsockname()[1]
1213
logger.info(u"Now listening on address %r, port %d,"
1214
" flowinfo %d, scope_id %d"
1215
% tcp_server.socket.getsockname())
1217
logger.info(u"Now listening on address %r, port %d"
1218
% tcp_server.socket.getsockname())
1158
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1159
u" scope_id %d" % tcp_server.socket.getsockname())
1220
1161
#service.interface = tcp_server.socket.getsockname()[3]