To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 24.1.20
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.20
- Committer: Björn Påhlsson
- Date: 2008-08-04 22:46:32 UTC
- mto: (237.7.1 mandos) (24.1.154 mandos)
- mto: This revision was merged to the branch mainline in revision 46.
- Revision ID: belorn@braxen-20080804224632-k1v16lxkiryurd0n
mandosclient
segmentation fault bug fixed
segmentation fault bug fixed
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos.conf => server.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
server.py
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
9
# following functions: "AvahiService.add", "AvahiService.remove",
10
# "server_state_changed", "entry_group_state_changed", and some lines
11
# in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
# GNU General Public License for more details.
26
25
#
27
26
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
30
28
#
31
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
30
#
33
31
34
from __future__ import division, with_statement, absolute_import
32
from __future__ import division
35
33
36
34
import SocketServer
37
35
import socket
38
import optparse
36
import select
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
import pwd
59
from contextlib import closing
60
57
61
58
import dbus
62
import dbus.service
63
59
import gobject
64
60
import avahi
65
61
from dbus.mainloop.glib import DBusGMainLoop
66
62
import ctypes
67
import ctypes.util
68
69
version = "1.0.8"
63
64
# Brief description of the operation of this program:
65
#
66
# This server announces itself as a Zeroconf service. Connecting
67
# clients use the TLS protocol, with the unusual quirk that this
68
# server program acts as a TLS "client" while a connecting client acts
69
# as a TLS "server". The client (acting as a TLS "server") must
70
# supply an OpenPGP certificate, and the fingerprint of this
71
# certificate is used by this server to look up (in a list read from a
72
# file at start time) which binary blob to give the client. No other
73
# authentication or authorization is done by this server.
74
70
75
71
76
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
77
syslogger = logging.handlers.SysLogHandler\
78
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
79
syslogger.setFormatter(logging.Formatter\
80
('%(levelname)s: %(message)s'))
78
81
logger.addHandler(syslogger)
82
del syslogger
79
83
80
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
83
logger.addHandler(console)
84
84
85
85
class AvahiError(Exception):
86
def __init__(self, value, *args, **kwargs):
86
def __init__(self, value):
87
87
self.value = value
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
88
def __str__(self):
89
return repr(self.value)
91
90
92
91
class AvahiServiceError(AvahiError):
93
92
pass
113
112
a sensible number of times
114
113
"""
115
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768,
118
protocol = avahi.PROTO_UNSPEC):
115
type = None, port = None, TXT = None, domain = "",
116
host = "", max_renames = 12):
119
117
self.interface = interface
120
118
self.name = name
121
self.type = servicetype
119
self.type = type
122
120
self.port = port
123
self.TXT = TXT if TXT is not None else []
121
if TXT is None:
122
self.TXT = []
123
else:
124
self.TXT = TXT
124
125
self.domain = domain
125
126
self.host = host
126
127
self.rename_count = 0
127
self.max_renames = max_renames
128
self.protocol = protocol
129
128
def rename(self):
130
129
"""Derived from the Avahi example code"""
131
130
if self.rename_count >= self.max_renames:
132
logger.critical(u"No suitable Zeroconf service name found"
133
u" after %i retries, exiting.",
134
self.rename_count)
135
raise AvahiServiceError(u"Too many renames")
136
self.name = server.GetAlternativeServiceName(self.name)
137
logger.info(u"Changing Zeroconf service name to %r ...",
138
str(self.name))
139
syslogger.setFormatter(logging.Formatter
140
('Mandos (%s): %%(levelname)s:'
141
' %%(message)s' % self.name))
131
logger.critical(u"No suitable service name found after %i"
132
u" retries, exiting.", rename_count)
133
raise AvahiServiceError("Too many renames")
134
name = server.GetAlternativeServiceName(name)
135
logger.error(u"Changing name to %r ...", name)
142
136
self.remove()
143
137
self.add()
144
138
self.rename_count += 1
150
144
"""Derived from the Avahi example code"""
151
145
global group
152
146
if group is None:
153
group = dbus.Interface(bus.get_object
154
(avahi.DBUS_NAME,
147
group = dbus.Interface\
148
(bus.get_object(avahi.DBUS_NAME,
155
149
server.EntryGroupNew()),
156
avahi.DBUS_INTERFACE_ENTRY_GROUP)
150
avahi.DBUS_INTERFACE_ENTRY_GROUP)
157
151
group.connect_to_signal('StateChanged',
158
152
entry_group_state_changed)
159
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
153
logger.debug(u"Adding service '%s' of type '%s' ...",
160
154
service.name, service.type)
161
155
group.AddService(
162
156
self.interface, # interface
163
self.protocol, # protocol
157
avahi.PROTO_INET6, # protocol
164
158
dbus.UInt32(0), # flags
165
159
self.name, self.type,
166
160
self.domain, self.host,
173
167
# End of Avahi example code
174
168
175
169
176
def _datetime_to_dbus(dt, variant_level=0):
177
"""Convert a UTC datetime.datetime() to a D-Bus type."""
178
return dbus.String(dt.isoformat(), variant_level=variant_level)
179
180
181
class Client(dbus.service.Object):
170
class Client(object):
182
171
"""A representation of a client host served by this server.
183
172
Attributes:
184
name: string; from the config file, used in log messages and
185
D-Bus identifiers
173
name: string; from the config file, used in log messages
186
174
fingerprint: string (40 or 32 hexadecimal digits); used to
187
175
uniquely identify the client
188
secret: bytestring; sent verbatim (over TLS) to client
189
host: string; available for use by the checker command
190
created: datetime.datetime(); (UTC) object creation
191
last_enabled: datetime.datetime(); (UTC)
192
enabled: bool()
193
last_checked_ok: datetime.datetime(); (UTC) or None
194
timeout: datetime.timedelta(); How long from last_checked_ok
195
until this client is invalid
196
interval: datetime.timedelta(); How often to start a new checker
197
disable_hook: If set, called by disable() as disable_hook(self)
198
checker: subprocess.Popen(); a running checker process used
199
to see if the client lives.
200
'None' if no process is running.
176
secret: bytestring; sent verbatim (over TLS) to client
177
fqdn: string (FQDN); available for use by the checker command
178
created: datetime.datetime(); object creation, not client host
179
last_checked_ok: datetime.datetime() or None if not yet checked OK
180
timeout: datetime.timedelta(); How long from last_checked_ok
181
until this client is invalid
182
interval: datetime.timedelta(); How often to start a new checker
183
stop_hook: If set, called by stop() as stop_hook(self)
184
checker: subprocess.Popen(); a running checker process used
185
to see if the client lives.
186
'None' if no process is running.
201
187
checker_initiator_tag: a gobject event source tag, or None
202
disable_initiator_tag: - '' -
188
stop_initiator_tag: - '' -
203
189
checker_callback_tag: - '' -
204
190
checker_command: string; External command which is run to check if
205
191
client lives. %() expansions are done at
206
192
runtime with vars(self) as dict, so that for
207
193
instance %(name)s can be used in the command.
208
current_checker_command: string; current running checker_command
209
use_dbus: bool(); Whether to provide D-Bus interface and signals
210
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
194
Private attibutes:
195
_timeout: Real variable for 'timeout'
196
_interval: Real variable for 'interval'
197
_timeout_milliseconds: Used when calling gobject.timeout_add()
198
_interval_milliseconds: - '' -
211
199
"""
212
def timeout_milliseconds(self):
213
"Return the 'timeout' attribute in milliseconds"
214
return ((self.timeout.days * 24 * 60 * 60 * 1000)
215
+ (self.timeout.seconds * 1000)
216
+ (self.timeout.microseconds // 1000))
217
218
def interval_milliseconds(self):
219
"Return the 'interval' attribute in milliseconds"
220
return ((self.interval.days * 24 * 60 * 60 * 1000)
221
+ (self.interval.seconds * 1000)
222
+ (self.interval.microseconds // 1000))
223
224
def __init__(self, name = None, disable_hook=None, config=None,
225
use_dbus=True):
200
def _set_timeout(self, timeout):
201
"Setter function for 'timeout' attribute"
202
self._timeout = timeout
203
self._timeout_milliseconds = ((self.timeout.days
204
* 24 * 60 * 60 * 1000)
205
+ (self.timeout.seconds * 1000)
206
+ (self.timeout.microseconds
207
// 1000))
208
timeout = property(lambda self: self._timeout,
209
_set_timeout)
210
del _set_timeout
211
def _set_interval(self, interval):
212
"Setter function for 'interval' attribute"
213
self._interval = interval
214
self._interval_milliseconds = ((self.interval.days
215
* 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds
217
* 1000)
218
+ (self.interval.microseconds
219
// 1000))
220
interval = property(lambda self: self._interval,
221
_set_interval)
222
del _set_interval
223
def __init__(self, name = None, stop_hook=None, config={}):
226
224
"""Note: the 'checker' key in 'config' sets the
227
225
'checker_command' attribute and *not* the 'checker'
228
226
attribute."""
229
227
self.name = name
230
if config is None:
231
config = {}
232
228
logger.debug(u"Creating client %r", self.name)
233
self.use_dbus = False # During __init__
234
229
# Uppercase and remove spaces from fingerprint for later
235
230
# comparison purposes with return value from the fingerprint()
236
231
# function
237
self.fingerprint = (config["fingerprint"].upper()
238
.replace(u" ", u""))
232
self.fingerprint = config["fingerprint"].upper()\
233
.replace(u" ", u"")
239
234
logger.debug(u" Fingerprint: %s", self.fingerprint)
240
235
if "secret" in config:
241
236
self.secret = config["secret"].decode(u"base64")
242
237
elif "secfile" in config:
243
with closing(open(os.path.expanduser
244
(os.path.expandvars
245
(config["secfile"])))) as secfile:
246
self.secret = secfile.read()
238
sf = open(config["secfile"])
239
self.secret = sf.read()
240
sf.close()
247
241
else:
248
242
raise TypeError(u"No secret or secfile for client %s"
249
243
% self.name)
250
self.host = config.get("host", "")
251
self.created = datetime.datetime.utcnow()
252
self.enabled = False
253
self.last_enabled = None
244
self.fqdn = config.get("fqdn", "")
245
self.created = datetime.datetime.now()
254
246
self.last_checked_ok = None
255
247
self.timeout = string_to_delta(config["timeout"])
256
248
self.interval = string_to_delta(config["interval"])
257
self.disable_hook = disable_hook
249
self.stop_hook = stop_hook
258
250
self.checker = None
259
251
self.checker_initiator_tag = None
260
self.disable_initiator_tag = None
252
self.stop_initiator_tag = None
261
253
self.checker_callback_tag = None
262
self.checker_command = config["checker"]
263
self.current_checker_command = None
264
self.last_connect = None
265
# Only now, when this client is initialized, can it show up on
266
# the D-Bus
267
self.use_dbus = use_dbus
268
if self.use_dbus:
269
self.dbus_object_path = (dbus.ObjectPath
270
("/clients/"
271
+ self.name.replace(".", "_")))
272
dbus.service.Object.__init__(self, bus,
273
self.dbus_object_path)
274
275
def enable(self):
254
self.check_command = config["checker"]
255
def start(self):
276
256
"""Start this client's checker and timeout hooks"""
277
self.last_enabled = datetime.datetime.utcnow()
278
257
# Schedule a new checker to be started an 'interval' from now,
279
258
# and every interval from then on.
280
self.checker_initiator_tag = (gobject.timeout_add
281
(self.interval_milliseconds(),
282
self.start_checker))
259
self.checker_initiator_tag = gobject.timeout_add\
260
(self._interval_milliseconds,
261
self.start_checker)
283
262
# Also start a new checker *right now*.
284
263
self.start_checker()
285
# Schedule a disable() when 'timeout' has passed
286
self.disable_initiator_tag = (gobject.timeout_add
287
(self.timeout_milliseconds(),
288
self.disable))
289
self.enabled = True
290
if self.use_dbus:
291
# Emit D-Bus signals
292
self.PropertyChanged(dbus.String(u"enabled"),
293
dbus.Boolean(True, variant_level=1))
294
self.PropertyChanged(dbus.String(u"last_enabled"),
295
(_datetime_to_dbus(self.last_enabled,
296
variant_level=1)))
297
298
def disable(self):
299
"""Disable this client."""
300
if not getattr(self, "enabled", False):
264
# Schedule a stop() when 'timeout' has passed
265
self.stop_initiator_tag = gobject.timeout_add\
266
(self._timeout_milliseconds,
267
self.stop)
268
def stop(self):
269
"""Stop this client.
270
The possibility that a client might be restarted is left open,
271
but not currently used."""
272
# If this client doesn't have a secret, it is already stopped.
273
if self.secret:
274
logger.info(u"Stopping client %s", self.name)
275
self.secret = None
276
else:
301
277
return False
302
logger.info(u"Disabling client %s", self.name)
303
if getattr(self, "disable_initiator_tag", False):
304
gobject.source_remove(self.disable_initiator_tag)
305
self.disable_initiator_tag = None
278
if getattr(self, "stop_initiator_tag", False):
279
gobject.source_remove(self.stop_initiator_tag)
280
self.stop_initiator_tag = None
306
281
if getattr(self, "checker_initiator_tag", False):
307
282
gobject.source_remove(self.checker_initiator_tag)
308
283
self.checker_initiator_tag = None
309
284
self.stop_checker()
310
if self.disable_hook:
311
self.disable_hook(self)
312
self.enabled = False
313
if self.use_dbus:
314
# Emit D-Bus signal
315
self.PropertyChanged(dbus.String(u"enabled"),
316
dbus.Boolean(False, variant_level=1))
285
if self.stop_hook:
286
self.stop_hook(self)
317
287
# Do not run this again if called by a gobject.timeout_add
318
288
return False
319
320
289
def __del__(self):
321
self.disable_hook = None
322
self.disable()
323
324
def checker_callback(self, pid, condition, command):
290
self.stop_hook = None
291
self.stop()
292
def checker_callback(self, pid, condition):
325
293
"""The checker has completed, so take appropriate actions."""
294
now = datetime.datetime.now()
326
295
self.checker_callback_tag = None
327
296
self.checker = None
328
if self.use_dbus:
329
# Emit D-Bus signal
330
self.PropertyChanged(dbus.String(u"checker_running"),
331
dbus.Boolean(False, variant_level=1))
332
if os.WIFEXITED(condition):
333
exitstatus = os.WEXITSTATUS(condition)
334
if exitstatus == 0:
335
logger.info(u"Checker for %(name)s succeeded",
336
vars(self))
337
self.checked_ok()
338
else:
339
logger.info(u"Checker for %(name)s failed",
340
vars(self))
341
if self.use_dbus:
342
# Emit D-Bus signal
343
self.CheckerCompleted(dbus.Int16(exitstatus),
344
dbus.Int64(condition),
345
dbus.String(command))
346
else:
297
if os.WIFEXITED(condition) \
298
and (os.WEXITSTATUS(condition) == 0):
299
logger.info(u"Checker for %(name)s succeeded",
300
vars(self))
301
self.last_checked_ok = now
302
gobject.source_remove(self.stop_initiator_tag)
303
self.stop_initiator_tag = gobject.timeout_add\
304
(self._timeout_milliseconds,
305
self.stop)
306
elif not os.WIFEXITED(condition):
347
307
logger.warning(u"Checker for %(name)s crashed?",
348
308
vars(self))
349
if self.use_dbus:
350
# Emit D-Bus signal
351
self.CheckerCompleted(dbus.Int16(-1),
352
dbus.Int64(condition),
353
dbus.String(command))
354
355
def checked_ok(self):
356
"""Bump up the timeout for this client.
357
This should only be called when the client has been seen,
358
alive and well.
359
"""
360
self.last_checked_ok = datetime.datetime.utcnow()
361
gobject.source_remove(self.disable_initiator_tag)
362
self.disable_initiator_tag = (gobject.timeout_add
363
(self.timeout_milliseconds(),
364
self.disable))
365
if self.use_dbus:
366
# Emit D-Bus signal
367
self.PropertyChanged(
368
dbus.String(u"last_checked_ok"),
369
(_datetime_to_dbus(self.last_checked_ok,
370
variant_level=1)))
371
309
else:
310
logger.info(u"Checker for %(name)s failed",
311
vars(self))
372
312
def start_checker(self):
373
313
"""Start a new checker subprocess if one is not running.
374
314
If a checker already exists, leave it running and do
381
321
# checkers alone, the checker would have to take more time
382
322
# than 'timeout' for the client to be declared invalid, which
383
323
# is as it should be.
384
385
# If a checker exists, make sure it is not a zombie
386
if self.checker is not None:
387
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
388
if pid:
389
logger.warning("Checker was a zombie")
390
gobject.source_remove(self.checker_callback_tag)
391
self.checker_callback(pid, status,
392
self.current_checker_command)
393
# Start a new checker if needed
394
324
if self.checker is None:
395
325
try:
396
# In case checker_command has exactly one % operator
397
command = self.checker_command % self.host
326
# In case check_command has exactly one % operator
327
command = self.check_command % self.fqdn
398
328
except TypeError:
399
329
# Escape attributes for the shell
400
330
escaped_attrs = dict((key, re.escape(str(val)))
401
331
for key, val in
402
332
vars(self).iteritems())
403
333
try:
404
command = self.checker_command % escaped_attrs
334
command = self.check_command % escaped_attrs
405
335
except TypeError, error:
406
336
logger.error(u'Could not format string "%s":'
407
u' %s', self.checker_command, error)
337
u' %s', self.check_command, error)
408
338
return True # Try again later
409
self.current_checker_command = command
410
339
try:
411
340
logger.info(u"Starting checker %r for %s",
412
341
command, self.name)
413
# We don't need to redirect stdout and stderr, since
414
# in normal mode, that is already done by daemon(),
415
# and in debug mode we don't want to. (Stdin is
416
# always replaced by /dev/null.)
417
342
self.checker = subprocess.Popen(command,
418
343
close_fds=True,
419
344
shell=True, cwd="/")
420
if self.use_dbus:
421
# Emit D-Bus signal
422
self.CheckerStarted(command)
423
self.PropertyChanged(
424
dbus.String("checker_running"),
425
dbus.Boolean(True, variant_level=1))
426
self.checker_callback_tag = (gobject.child_watch_add
427
(self.checker.pid,
428
self.checker_callback,
429
data=command))
430
# The checker may have completed before the gobject
431
# watch was added. Check for this.
432
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
433
if pid:
434
gobject.source_remove(self.checker_callback_tag)
435
self.checker_callback(pid, status, command)
436
except OSError, error:
345
self.checker_callback_tag = gobject.child_watch_add\
346
(self.checker.pid,
347
self.checker_callback)
348
except subprocess.OSError, error:
437
349
logger.error(u"Failed to start subprocess: %s",
438
350
error)
439
351
# Re-run this periodically if run by gobject.timeout_add
440
352
return True
441
442
353
def stop_checker(self):
443
354
"""Force the checker process, if any, to stop."""
444
355
if self.checker_callback_tag:
446
357
self.checker_callback_tag = None
447
358
if getattr(self, "checker", None) is None:
448
359
return
449
logger.debug(u"Stopping checker for %(name)s", vars(self))
360
logger.debug("Stopping checker for %(name)s", vars(self))
450
361
try:
451
362
os.kill(self.checker.pid, signal.SIGTERM)
452
363
#os.sleep(0.5)
456
367
if error.errno != errno.ESRCH: # No such process
457
368
raise
458
369
self.checker = None
459
if self.use_dbus:
460
self.PropertyChanged(dbus.String(u"checker_running"),
461
dbus.Boolean(False, variant_level=1))
462
463
370
def still_valid(self):
464
371
"""Has the timeout not yet passed for this client?"""
465
if not getattr(self, "enabled", False):
466
return False
467
now = datetime.datetime.utcnow()
372
now = datetime.datetime.now()
468
373
if self.last_checked_ok is None:
469
374
return now < (self.created + self.timeout)
470
375
else:
471
376
return now < (self.last_checked_ok + self.timeout)
472
473
## D-Bus methods & signals
474
_interface = u"se.bsnet.fukt.Mandos.Client"
475
476
# CheckedOK - method
477
CheckedOK = dbus.service.method(_interface)(checked_ok)
478
CheckedOK.__name__ = "CheckedOK"
479
480
# CheckerCompleted - signal
481
@dbus.service.signal(_interface, signature="nxs")
482
def CheckerCompleted(self, exitcode, waitstatus, command):
483
"D-Bus signal"
484
pass
485
486
# CheckerStarted - signal
487
@dbus.service.signal(_interface, signature="s")
488
def CheckerStarted(self, command):
489
"D-Bus signal"
490
pass
491
492
# GetAllProperties - method
493
@dbus.service.method(_interface, out_signature="a{sv}")
494
def GetAllProperties(self):
495
"D-Bus method"
496
return dbus.Dictionary({
497
dbus.String("name"):
498
dbus.String(self.name, variant_level=1),
499
dbus.String("fingerprint"):
500
dbus.String(self.fingerprint, variant_level=1),
501
dbus.String("host"):
502
dbus.String(self.host, variant_level=1),
503
dbus.String("created"):
504
_datetime_to_dbus(self.created, variant_level=1),
505
dbus.String("last_enabled"):
506
(_datetime_to_dbus(self.last_enabled,
507
variant_level=1)
508
if self.last_enabled is not None
509
else dbus.Boolean(False, variant_level=1)),
510
dbus.String("enabled"):
511
dbus.Boolean(self.enabled, variant_level=1),
512
dbus.String("last_checked_ok"):
513
(_datetime_to_dbus(self.last_checked_ok,
514
variant_level=1)
515
if self.last_checked_ok is not None
516
else dbus.Boolean (False, variant_level=1)),
517
dbus.String("timeout"):
518
dbus.UInt64(self.timeout_milliseconds(),
519
variant_level=1),
520
dbus.String("interval"):
521
dbus.UInt64(self.interval_milliseconds(),
522
variant_level=1),
523
dbus.String("checker"):
524
dbus.String(self.checker_command,
525
variant_level=1),
526
dbus.String("checker_running"):
527
dbus.Boolean(self.checker is not None,
528
variant_level=1),
529
dbus.String("object_path"):
530
dbus.ObjectPath(self.dbus_object_path,
531
variant_level=1)
532
}, signature="sv")
533
534
# IsStillValid - method
535
IsStillValid = (dbus.service.method(_interface, out_signature="b")
536
(still_valid))
537
IsStillValid.__name__ = "IsStillValid"
538
539
# PropertyChanged - signal
540
@dbus.service.signal(_interface, signature="sv")
541
def PropertyChanged(self, property, value):
542
"D-Bus signal"
543
pass
544
545
# SetChecker - method
546
@dbus.service.method(_interface, in_signature="s")
547
def SetChecker(self, checker):
548
"D-Bus setter method"
549
self.checker_command = checker
550
# Emit D-Bus signal
551
self.PropertyChanged(dbus.String(u"checker"),
552
dbus.String(self.checker_command,
553
variant_level=1))
554
555
# SetHost - method
556
@dbus.service.method(_interface, in_signature="s")
557
def SetHost(self, host):
558
"D-Bus setter method"
559
self.host = host
560
# Emit D-Bus signal
561
self.PropertyChanged(dbus.String(u"host"),
562
dbus.String(self.host, variant_level=1))
563
564
# SetInterval - method
565
@dbus.service.method(_interface, in_signature="t")
566
def SetInterval(self, milliseconds):
567
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
568
# Emit D-Bus signal
569
self.PropertyChanged(dbus.String(u"interval"),
570
(dbus.UInt64(self.interval_milliseconds(),
571
variant_level=1)))
572
573
# SetSecret - method
574
@dbus.service.method(_interface, in_signature="ay",
575
byte_arrays=True)
576
def SetSecret(self, secret):
577
"D-Bus setter method"
578
self.secret = str(secret)
579
580
# SetTimeout - method
581
@dbus.service.method(_interface, in_signature="t")
582
def SetTimeout(self, milliseconds):
583
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
584
# Emit D-Bus signal
585
self.PropertyChanged(dbus.String(u"timeout"),
586
(dbus.UInt64(self.timeout_milliseconds(),
587
variant_level=1)))
588
589
# Enable - method
590
Enable = dbus.service.method(_interface)(enable)
591
Enable.__name__ = "Enable"
592
593
# StartChecker - method
594
@dbus.service.method(_interface)
595
def StartChecker(self):
596
"D-Bus method"
597
self.start_checker()
598
599
# Disable - method
600
@dbus.service.method(_interface)
601
def Disable(self):
602
"D-Bus method"
603
self.disable()
604
605
# StopChecker - method
606
StopChecker = dbus.service.method(_interface)(stop_checker)
607
StopChecker.__name__ = "StopChecker"
608
609
del _interface
610
377
611
378
612
379
def peer_certificate(session):
613
380
"Return the peer's OpenPGP certificate as a bytestring"
614
381
# If not an OpenPGP certificate...
615
if (gnutls.library.functions
616
.gnutls_certificate_type_get(session._c_object)
617
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
382
if gnutls.library.functions.gnutls_certificate_type_get\
383
(session._c_object) \
384
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
618
385
# ...do the normal thing
619
386
return session.peer_certificate
620
list_size = ctypes.c_uint(1)
621
cert_list = (gnutls.library.functions
622
.gnutls_certificate_get_peers
623
(session._c_object, ctypes.byref(list_size)))
624
if not bool(cert_list) and list_size.value != 0:
625
raise gnutls.errors.GNUTLSError("error getting peer"
626
" certificate")
387
list_size = ctypes.c_uint()
388
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
389
(session._c_object, ctypes.byref(list_size))
627
390
if list_size.value == 0:
628
391
return None
629
392
cert = cert_list[0]
633
396
def fingerprint(openpgp):
634
397
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
635
398
# New GnuTLS "datum" with the OpenPGP public key
636
datum = (gnutls.library.types
637
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
638
ctypes.POINTER
639
(ctypes.c_ubyte)),
640
ctypes.c_uint(len(openpgp))))
399
datum = gnutls.library.types.gnutls_datum_t\
400
(ctypes.cast(ctypes.c_char_p(openpgp),
401
ctypes.POINTER(ctypes.c_ubyte)),
402
ctypes.c_uint(len(openpgp)))
641
403
# New empty GnuTLS certificate
642
404
crt = gnutls.library.types.gnutls_openpgp_crt_t()
643
(gnutls.library.functions
644
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
405
gnutls.library.functions.gnutls_openpgp_crt_init\
406
(ctypes.byref(crt))
645
407
# Import the OpenPGP public key into the certificate
646
(gnutls.library.functions
647
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
648
gnutls.library.constants
649
.GNUTLS_OPENPGP_FMT_RAW))
650
# Verify the self signature in the key
651
crtverify = ctypes.c_uint()
652
(gnutls.library.functions
653
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
654
if crtverify.value != 0:
655
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
656
raise gnutls.errors.CertificateSecurityError("Verify failed")
408
gnutls.library.functions.gnutls_openpgp_crt_import\
409
(crt, ctypes.byref(datum),
410
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
657
411
# New buffer for the fingerprint
658
buf = ctypes.create_string_buffer(20)
659
buf_len = ctypes.c_size_t()
412
buffer = ctypes.create_string_buffer(20)
413
buffer_length = ctypes.c_size_t()
660
414
# Get the fingerprint from the certificate into the buffer
661
(gnutls.library.functions
662
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
663
ctypes.byref(buf_len)))
415
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
416
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
664
417
# Deinit the certificate
665
418
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
666
419
# Convert the buffer to a Python bytestring
667
fpr = ctypes.string_at(buf, buf_len.value)
420
fpr = ctypes.string_at(buffer, buffer_length.value)
668
421
# Convert the bytestring to hexadecimal notation
669
422
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
670
423
return hex_fpr
671
424
672
425
673
class TCP_handler(SocketServer.BaseRequestHandler, object):
426
class tcp_handler(SocketServer.BaseRequestHandler, object):
674
427
"""A TCP request handler class.
675
428
Instantiated by IPv6_TCPServer for each request to handle it.
676
429
Note: This will run in its own forked process."""
677
430
678
431
def handle(self):
679
432
logger.info(u"TCP connection from: %s",
680
unicode(self.client_address))
681
session = (gnutls.connection
682
.ClientSession(self.request,
683
gnutls.connection
684
.X509Credentials()))
433
unicode(self.client_address))
434
session = gnutls.connection.ClientSession\
435
(self.request, gnutls.connection.X509Credentials())
685
436
686
437
line = self.request.makefile().readline()
687
438
logger.debug(u"Protocol version: %r", line)
698
449
# using OpenPGP certificates.
699
450
700
451
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
701
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
702
# "+DHE-DSS"))
703
# Use a fallback default, since this MUST be set.
704
priority = self.server.settings.get("priority", "NORMAL")
705
(gnutls.library.functions
706
.gnutls_priority_set_direct(session._c_object,
707
priority, None))
452
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
453
# "+DHE-DSS"))
454
priority = "NORMAL" # Fallback default, since this
455
# MUST be set.
456
if self.server.settings["priority"]:
457
priority = self.server.settings["priority"]
458
gnutls.library.functions.gnutls_priority_set_direct\
459
(session._c_object, priority, None);
708
460
709
461
try:
710
462
session.handshake()
713
465
# Do not run session.bye() here: the session is not
714
466
# established. Just abandon the request.
715
467
return
716
logger.debug(u"Handshake succeeded")
717
468
try:
718
469
fpr = fingerprint(peer_certificate(session))
719
470
except (TypeError, gnutls.errors.GNUTLSError), error:
721
472
session.bye()
722
473
return
723
474
logger.debug(u"Fingerprint: %s", fpr)
724
475
client = None
725
476
for c in self.server.clients:
726
477
if c.fingerprint == fpr:
727
478
client = c
728
479
break
729
else:
480
if not client:
730
481
logger.warning(u"Client not found for fingerprint: %s",
731
482
fpr)
732
483
session.bye()
739
490
vars(client))
740
491
session.bye()
741
492
return
742
## This won't work here, since we're in a fork.
743
# client.checked_ok()
744
493
sent_size = 0
745
494
while sent_size < len(client.secret):
746
495
sent = session.send(client.secret[sent_size:])
751
500
session.bye()
752
501
753
502
754
class IPv6_TCPServer(SocketServer.ForkingMixIn,
755
SocketServer.TCPServer, object):
756
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
503
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
504
"""IPv6 TCP server. Accepts 'None' as address and/or port.
757
505
Attributes:
758
506
settings: Server settings
759
507
clients: Set() of Client objects
760
enabled: Boolean; whether this server is activated yet
761
508
"""
762
509
address_family = socket.AF_INET6
763
510
def __init__(self, *args, **kwargs):
767
514
if "clients" in kwargs:
768
515
self.clients = kwargs["clients"]
769
516
del kwargs["clients"]
770
if "use_ipv6" in kwargs:
771
if not kwargs["use_ipv6"]:
772
self.address_family = socket.AF_INET
773
del kwargs["use_ipv6"]
774
self.enabled = False
775
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
517
return super(type(self), self).__init__(*args, **kwargs)
776
518
def server_bind(self):
777
519
"""This overrides the normal server_bind() function
778
520
to bind to an interface if one was specified, and also NOT to
790
532
u" bind to interface %s",
791
533
self.settings["interface"])
792
534
else:
793
raise
535
raise error
794
536
# Only bind(2) the socket if we really need to.
795
537
if self.server_address[0] or self.server_address[1]:
796
538
if not self.server_address[0]:
797
if self.address_family == socket.AF_INET6:
798
any_address = "::" # in6addr_any
799
else:
800
any_address = socket.INADDR_ANY
801
self.server_address = (any_address,
539
in6addr_any = "::"
540
self.server_address = (in6addr_any,
802
541
self.server_address[1])
803
elif not self.server_address[1]:
542
elif self.server_address[1] is None:
804
543
self.server_address = (self.server_address[0],
805
544
0)
806
# if self.settings["interface"]:
807
# self.server_address = (self.server_address[0],
808
# 0, # port
809
# 0, # flowinfo
810
# if_nametoindex
811
# (self.settings
812
# ["interface"]))
813
return super(IPv6_TCPServer, self).server_bind()
814
def server_activate(self):
815
if self.enabled:
816
return super(IPv6_TCPServer, self).server_activate()
817
def enable(self):
818
self.enabled = True
545
return super(type(self), self).server_bind()
819
546
820
547
821
548
def string_to_delta(interval):
822
549
"""Parse a string and return a datetime.timedelta
823
550
824
551
>>> string_to_delta('7d')
825
552
datetime.timedelta(7)
826
553
>>> string_to_delta('60s')
831
558
datetime.timedelta(1)
832
559
>>> string_to_delta(u'1w')
833
560
datetime.timedelta(7)
834
>>> string_to_delta('5m 30s')
835
datetime.timedelta(0, 330)
836
561
"""
837
timevalue = datetime.timedelta(0)
838
for s in interval.split():
839
try:
840
suffix = unicode(s[-1])
841
value = int(s[:-1])
842
if suffix == u"d":
843
delta = datetime.timedelta(value)
844
elif suffix == u"s":
845
delta = datetime.timedelta(0, value)
846
elif suffix == u"m":
847
delta = datetime.timedelta(0, 0, 0, 0, value)
848
elif suffix == u"h":
849
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
850
elif suffix == u"w":
851
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
852
else:
853
raise ValueError
854
except (ValueError, IndexError):
562
try:
563
suffix=unicode(interval[-1])
564
value=int(interval[:-1])
565
if suffix == u"d":
566
delta = datetime.timedelta(value)
567
elif suffix == u"s":
568
delta = datetime.timedelta(0, value)
569
elif suffix == u"m":
570
delta = datetime.timedelta(0, 0, 0, 0, value)
571
elif suffix == u"h":
572
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
573
elif suffix == u"w":
574
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
575
else:
855
576
raise ValueError
856
timevalue += delta
857
return timevalue
577
except (ValueError, IndexError):
578
raise ValueError
579
return delta
858
580
859
581
860
582
def server_state_changed(state):
861
583
"""Derived from the Avahi example code"""
862
584
if state == avahi.SERVER_COLLISION:
863
logger.error(u"Zeroconf server name collision")
585
logger.error(u"Server name collision")
864
586
service.remove()
865
587
elif state == avahi.SERVER_RUNNING:
866
588
service.add()
868
590
869
591
def entry_group_state_changed(state, error):
870
592
"""Derived from the Avahi example code"""
871
logger.debug(u"Avahi state change: %i", state)
593
logger.debug(u"state change: %i", state)
872
594
873
595
if state == avahi.ENTRY_GROUP_ESTABLISHED:
874
logger.debug(u"Zeroconf service established.")
596
logger.debug(u"Service established.")
875
597
elif state == avahi.ENTRY_GROUP_COLLISION:
876
logger.warning(u"Zeroconf service name collision.")
598
logger.warning(u"Service name collision.")
877
599
service.rename()
878
600
elif state == avahi.ENTRY_GROUP_FAILURE:
879
logger.critical(u"Avahi: Error in group state changed %s",
601
logger.critical(u"Error in group state changed %s",
880
602
unicode(error))
881
raise AvahiGroupError(u"State changed: %s" % unicode(error))
603
raise AvahiGroupError("State changed: %s", str(error))
882
604
883
605
def if_nametoindex(interface):
884
606
"""Call the C function if_nametoindex(), or equivalent"""
885
607
global if_nametoindex
886
608
try:
887
if_nametoindex = (ctypes.cdll.LoadLibrary
888
(ctypes.util.find_library("c"))
889
.if_nametoindex)
609
if "ctypes.util" not in sys.modules:
610
import ctypes.util
611
if_nametoindex = ctypes.cdll.LoadLibrary\
612
(ctypes.util.find_library("c")).if_nametoindex
890
613
except (OSError, AttributeError):
891
614
if "struct" not in sys.modules:
892
615
import struct
895
618
def if_nametoindex(interface):
896
619
"Get an interface index the hard way, i.e. using fcntl()"
897
620
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
898
with closing(socket.socket()) as s:
899
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
900
struct.pack("16s16x", interface))
621
s = socket.socket()
622
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
623
struct.pack("16s16x", interface))
624
s.close()
901
625
interface_index = struct.unpack("I", ifreq[16:20])[0]
902
626
return interface_index
903
627
return if_nametoindex(interface)
904
628
905
629
906
def daemon(nochdir = False, noclose = False):
630
def daemon(nochdir, noclose):
907
631
"""See daemon(3). Standard BSD Unix function.
908
632
This should really exist as os.daemon, but it doesn't (yet)."""
909
633
if os.fork():
911
635
os.setsid()
912
636
if not nochdir:
913
637
os.chdir("/")
914
if os.fork():
915
sys.exit()
916
638
if not noclose:
917
639
# Close all standard open file descriptors
918
640
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
927
649
928
650
929
651
def main():
930
parser = optparse.OptionParser(version = "%%prog %s" % version)
652
global main_loop_started
653
main_loop_started = False
654
655
parser = OptionParser()
931
656
parser.add_option("-i", "--interface", type="string",
932
657
metavar="IF", help="Bind to interface IF")
933
658
parser.add_option("-a", "--address", type="string",
934
659
help="Address to listen for requests on")
935
660
parser.add_option("-p", "--port", type="int",
936
661
help="Port number to receive requests on")
937
parser.add_option("--check", action="store_true",
662
parser.add_option("--check", action="store_true", default=False,
938
663
help="Run self-test")
939
parser.add_option("--debug", action="store_true",
664
parser.add_option("--debug", action="store_true", default=False,
940
665
help="Debug mode; run in foreground and log to"
941
666
" terminal")
942
667
parser.add_option("--priority", type="string", help="GnuTLS"
947
672
default="/etc/mandos", metavar="DIR",
948
673
help="Directory to search for configuration"
949
674
" files")
950
parser.add_option("--no-dbus", action="store_false",
951
dest="use_dbus",
952
help=optparse.SUPPRESS_HELP) # XXX: Not done yet
953
parser.add_option("--no-ipv6", action="store_false",
954
dest="use_ipv6", help="Do not use IPv6")
955
options = parser.parse_args()[0]
675
(options, args) = parser.parse_args()
956
676
957
677
if options.check:
958
678
import doctest
967
687
"priority":
968
688
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
969
689
"servicename": "Mandos",
970
"use_dbus": "True",
971
"use_ipv6": "True",
972
690
}
973
691
974
692
# Parse config file for server-global settings
975
693
server_config = ConfigParser.SafeConfigParser(server_defaults)
976
694
del server_defaults
977
server_config.read(os.path.join(options.configdir, "mandos.conf"))
695
server_config.read(os.path.join(options.configdir, "server.conf"))
696
server_section = "server"
978
697
# Convert the SafeConfigParser object to a dict
979
server_settings = server_config.defaults()
980
# Use the appropriate methods on the non-string config options
981
server_settings["debug"] = server_config.getboolean("DEFAULT",
982
"debug")
983
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
984
"use_dbus")
985
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
986
"use_ipv6")
987
if server_settings["port"]:
988
server_settings["port"] = server_config.getint("DEFAULT",
989
"port")
698
server_settings = dict(server_config.items(server_section))
699
# Use getboolean on the boolean config option
700
server_settings["debug"] = server_config.getboolean\
701
(server_section, "debug")
990
702
del server_config
991
703
992
704
# Override the settings from the config file with command line
993
705
# options, if set.
994
706
for option in ("interface", "address", "port", "debug",
995
"priority", "servicename", "configdir",
996
"use_dbus", "use_ipv6"):
707
"priority", "servicename", "configdir"):
997
708
value = getattr(options, option)
998
709
if value is not None:
999
710
server_settings[option] = value
1000
711
del options
1001
712
# Now we have our good server settings in "server_settings"
1002
713
1003
# For convenience
1004
debug = server_settings["debug"]
1005
use_dbus = server_settings["use_dbus"]
1006
use_dbus = False # XXX: Not done yet
1007
use_ipv6 = server_settings["use_ipv6"]
1008
1009
if not debug:
1010
syslogger.setLevel(logging.WARNING)
1011
console.setLevel(logging.WARNING)
1012
1013
if server_settings["servicename"] != "Mandos":
1014
syslogger.setFormatter(logging.Formatter
1015
('Mandos (%s): %%(levelname)s:'
1016
' %%(message)s'
1017
% server_settings["servicename"]))
1018
1019
714
# Parse config file with clients
1020
715
client_defaults = { "timeout": "1h",
1021
716
"interval": "5m",
1022
"checker": "fping -q -- %%(host)s",
1023
"host": "",
717
"checker": "fping -q -- %%(fqdn)s",
1024
718
}
1025
719
client_config = ConfigParser.SafeConfigParser(client_defaults)
1026
720
client_config.read(os.path.join(server_settings["configdir"],
1027
721
"clients.conf"))
1028
722
1029
clients = Set()
1030
tcp_server = IPv6_TCPServer((server_settings["address"],
1031
server_settings["port"]),
1032
TCP_handler,
1033
settings=server_settings,
1034
clients=clients, use_ipv6=use_ipv6)
1035
pidfilename = "/var/run/mandos.pid"
1036
try:
1037
pidfile = open(pidfilename, "w")
1038
except IOError:
1039
logger.error("Could not open file %r", pidfilename)
1040
1041
try:
1042
uid = pwd.getpwnam("_mandos").pw_uid
1043
gid = pwd.getpwnam("_mandos").pw_gid
1044
except KeyError:
1045
try:
1046
uid = pwd.getpwnam("mandos").pw_uid
1047
gid = pwd.getpwnam("mandos").pw_gid
1048
except KeyError:
1049
try:
1050
uid = pwd.getpwnam("nobody").pw_uid
1051
gid = pwd.getpwnam("nogroup").pw_gid
1052
except KeyError:
1053
uid = 65534
1054
gid = 65534
1055
try:
1056
os.setgid(gid)
1057
os.setuid(uid)
1058
except OSError, error:
1059
if error[0] != errno.EPERM:
1060
raise error
1061
1062
# Enable all possible GnuTLS debugging
1063
if debug:
1064
# "Use a log level over 10 to enable all debugging options."
1065
# - GnuTLS manual
1066
gnutls.library.functions.gnutls_global_set_log_level(11)
1067
1068
@gnutls.library.types.gnutls_log_func
1069
def debug_gnutls(level, string):
1070
logger.debug("GnuTLS: %s", string[:-1])
1071
1072
(gnutls.library.functions
1073
.gnutls_global_set_log_function(debug_gnutls))
1074
1075
723
global service
1076
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1077
724
service = AvahiService(name = server_settings["servicename"],
1078
servicetype = "_mandos._tcp",
1079
protocol = protocol)
725
type = "_mandos._tcp", );
1080
726
if server_settings["interface"]:
1081
service.interface = (if_nametoindex
1082
(server_settings["interface"]))
727
service.interface = if_nametoindex(server_settings["interface"])
1083
728
1084
729
global main_loop
1085
730
global bus
1088
733
DBusGMainLoop(set_as_default=True )
1089
734
main_loop = gobject.MainLoop()
1090
735
bus = dbus.SystemBus()
1091
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1092
avahi.DBUS_PATH_SERVER),
1093
avahi.DBUS_INTERFACE_SERVER)
736
server = dbus.Interface(
737
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
738
avahi.DBUS_INTERFACE_SERVER )
1094
739
# End of Avahi example code
1095
if use_dbus:
1096
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
740
741
debug = server_settings["debug"]
742
743
if debug:
744
console = logging.StreamHandler()
745
# console.setLevel(logging.DEBUG)
746
console.setFormatter(logging.Formatter\
747
('%(levelname)s: %(message)s'))
748
logger.addHandler(console)
749
del console
750
751
clients = Set()
752
def remove_from_clients(client):
753
clients.remove(client)
754
if not clients:
755
logger.critical(u"No clients left, exiting")
756
sys.exit()
1097
757
1098
758
clients.update(Set(Client(name = section,
759
stop_hook = remove_from_clients,
1099
760
config
1100
= dict(client_config.items(section)),
1101
use_dbus = use_dbus)
761
= dict(client_config.items(section)))
1102
762
for section in client_config.sections()))
1103
if not clients:
1104
logger.warning(u"No clients defined")
1105
1106
if debug:
1107
# Redirect stdin so all checkers get /dev/null
1108
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1109
os.dup2(null, sys.stdin.fileno())
1110
if null > 2:
1111
os.close(null)
1112
else:
1113
# No console logging
1114
logger.removeHandler(console)
1115
# Close all input and output, do double fork, etc.
1116
daemon()
1117
1118
try:
1119
pid = os.getpid()
1120
pidfile.write(str(pid) + "\n")
1121
pidfile.close()
1122
del pidfile
1123
except IOError:
1124
logger.error(u"Could not write to file %r with PID %d",
1125
pidfilename, pid)
1126
except NameError:
1127
# "pidfile" was never created
1128
pass
1129
del pidfilename
763
764
if not debug:
765
daemon(False, False)
1130
766
1131
767
def cleanup():
1132
768
"Cleanup function; run on exit"
1139
775
1140
776
while clients:
1141
777
client = clients.pop()
1142
client.disable_hook = None
1143
client.disable()
778
client.stop_hook = None
779
client.stop()
1144
780
1145
781
atexit.register(cleanup)
1146
782
1149
785
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1150
786
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1151
787
1152
if use_dbus:
1153
class MandosServer(dbus.service.Object):
1154
"""A D-Bus proxy object"""
1155
def __init__(self):
1156
dbus.service.Object.__init__(self, bus, "/")
1157
_interface = u"se.bsnet.fukt.Mandos"
1158
1159
@dbus.service.signal(_interface, signature="oa{sv}")
1160
def ClientAdded(self, objpath, properties):
1161
"D-Bus signal"
1162
pass
1163
1164
@dbus.service.signal(_interface, signature="os")
1165
def ClientRemoved(self, objpath, name):
1166
"D-Bus signal"
1167
pass
1168
1169
@dbus.service.method(_interface, out_signature="ao")
1170
def GetAllClients(self):
1171
"D-Bus method"
1172
return dbus.Array(c.dbus_object_path for c in clients)
1173
1174
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1175
def GetAllClientsWithProperties(self):
1176
"D-Bus method"
1177
return dbus.Dictionary(
1178
((c.dbus_object_path, c.GetAllProperties())
1179
for c in clients),
1180
signature="oa{sv}")
1181
1182
@dbus.service.method(_interface, in_signature="o")
1183
def RemoveClient(self, object_path):
1184
"D-Bus method"
1185
for c in clients:
1186
if c.dbus_object_path == object_path:
1187
clients.remove(c)
1188
# Don't signal anything except ClientRemoved
1189
c.use_dbus = False
1190
c.disable()
1191
# Emit D-Bus signal
1192
self.ClientRemoved(object_path, c.name)
1193
return
1194
raise KeyError
1195
1196
del _interface
1197
1198
mandos_server = MandosServer()
1199
1200
788
for client in clients:
1201
if use_dbus:
1202
# Emit D-Bus signal
1203
mandos_server.ClientAdded(client.dbus_object_path,
1204
client.GetAllProperties())
1205
client.enable()
1206
1207
tcp_server.enable()
1208
tcp_server.server_activate()
1209
789
client.start()
790
791
tcp_server = IPv6_TCPServer((server_settings["address"],
792
server_settings["port"]),
793
tcp_handler,
794
settings=server_settings,
795
clients=clients)
1210
796
# Find out what port we got
1211
797
service.port = tcp_server.socket.getsockname()[1]
1212
if use_ipv6:
1213
logger.info(u"Now listening on address %r, port %d,"
1214
" flowinfo %d, scope_id %d"
1215
% tcp_server.socket.getsockname())
1216
else: # IPv4
1217
logger.info(u"Now listening on address %r, port %d"
1218
% tcp_server.socket.getsockname())
798
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
799
u" scope_id %d" % tcp_server.socket.getsockname())
1219
800
1220
801
#service.interface = tcp_server.socket.getsockname()[3]
1221
802
1231
812
1232
813
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1233
814
lambda *args, **kwargs:
1234
(tcp_server.handle_request
1235
(*args[2:], **kwargs) or True))
815
tcp_server.handle_request\
816
(*args[2:], **kwargs) or True)
1236
817
1237
logger.debug(u"Starting main loop")
818
logger.debug("Starting main loop")
819
main_loop_started = True
1238
820
main_loop.run()
1239
821
except AvahiError, error:
1240
logger.critical(u"AvahiError: %s", error)
822
logger.critical(u"AvahiError: %s" + unicode(error))
1241
823
sys.exit(1)
1242
824
except KeyboardInterrupt:
1243
825
if debug:
1244
print >> sys.stderr
1245
logger.debug("Server received KeyboardInterrupt")
1246
logger.debug("Server exiting")
826
print
1247
827
1248
828
if __name__ == '__main__':
1249
829
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0