To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 27
- compare with another revision
- download diff
- download tarball
- view history from revision 27
- Committer: Teddy Hogeborn
- Date: 2008-07-22 06:25:35 UTC
- mfrom: (24.1.2 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080722062535-whz5do0b3dzw6m08
Merge.
- files added:
- ca.pem
- files removed:
- mandos-client.xml
- files renamed:
- clients.conf => mandos-clients.conf
- mandos-client.c => plugbasedclient.c
- plugins.d/password-request.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
server.py
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
9
# following functions: "add_service", "remove_service",
10
# "server_state_changed", "entry_group_state_changed", and some lines
11
# in "main".
12
12
#
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
13
# Everything else is Copyright © 2007-2008 Teddy Hogeborn and Björn
14
# Påhlsson.
15
15
#
16
16
# This program is free software: you can redistribute it and/or modify
17
17
# it under the terms of the GNU General Public License as published by
26
26
# You should have received a copy of the GNU General Public License
27
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
28
28
#
29
# Contact the authors at <mandos@fukt.bsnet.se>.
29
# Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
30
# <https://www.fukt.bsnet.se/~teddy/>.
30
31
#
31
32
32
33
from __future__ import division
61
62
from dbus.mainloop.glib import DBusGMainLoop
62
63
import ctypes
63
64
64
version = "1.0"
65
# Brief description of the operation of this program:
66
#
67
# This server announces itself as a Zeroconf service. Connecting
68
# clients use the TLS protocol, with the unusual quirk that this
69
# server program acts as a TLS "client" while the connecting clients
70
# acts as a TLS "server". The clients (acting as a TLS "server") must
71
# supply an OpenPGP certificate, and the fingerprint of this
72
# certificate is used by this server to look up (in a list read from a
73
# file at start time) which binary blob to give the client. No other
74
# authentication or authorization is done by this server.
75
65
76
66
77
logger = logging.Logger('mandos')
67
78
syslogger = logging.handlers.SysLogHandler\
68
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
69
address = "/dev/log")
79
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
70
80
syslogger.setFormatter(logging.Formatter\
71
('Mandos: %(levelname)s: %(message)s'))
81
('%(levelname)s: %(message)s'))
72
82
logger.addHandler(syslogger)
73
74
75
class AvahiError(Exception):
76
def __init__(self, value):
77
self.value = value
78
def __str__(self):
79
return repr(self.value)
80
81
class AvahiServiceError(AvahiError):
82
pass
83
84
class AvahiGroupError(AvahiError):
85
pass
86
87
88
class AvahiService(object):
89
"""An Avahi (Zeroconf) service.
90
Attributes:
91
interface: integer; avahi.IF_UNSPEC or an interface index.
92
Used to optionally bind to the specified interface.
93
name: string; Example: 'Mandos'
94
type: string; Example: '_mandos._tcp'.
95
See <http://www.dns-sd.org/ServiceTypes.html>
96
port: integer; what port to announce
97
TXT: list of strings; TXT record for the service
98
domain: string; Domain to publish on, default to .local if empty.
99
host: string; Host to publish records for, default is localhost
100
max_renames: integer; maximum number of renames
101
rename_count: integer; counter so we only rename after collisions
102
a sensible number of times
103
"""
104
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
105
type = None, port = None, TXT = None, domain = "",
106
host = "", max_renames = 32768):
107
self.interface = interface
108
self.name = name
109
self.type = type
110
self.port = port
111
if TXT is None:
112
self.TXT = []
113
else:
114
self.TXT = TXT
115
self.domain = domain
116
self.host = host
117
self.rename_count = 0
118
def rename(self):
119
"""Derived from the Avahi example code"""
120
if self.rename_count >= self.max_renames:
121
logger.critical(u"No suitable service name found after %i"
122
u" retries, exiting.", rename_count)
123
raise AvahiServiceError("Too many renames")
124
name = server.GetAlternativeServiceName(name)
125
logger.error(u"Changing name to %r ...", name)
126
syslogger.setFormatter(logging.Formatter\
127
('Mandos (%s): %%(levelname)s:'
128
' %%(message)s' % name))
129
self.remove()
130
self.add()
131
self.rename_count += 1
132
def remove(self):
133
"""Derived from the Avahi example code"""
134
if group is not None:
135
group.Reset()
136
def add(self):
137
"""Derived from the Avahi example code"""
138
global group
139
if group is None:
140
group = dbus.Interface\
141
(bus.get_object(avahi.DBUS_NAME,
142
server.EntryGroupNew()),
143
avahi.DBUS_INTERFACE_ENTRY_GROUP)
144
group.connect_to_signal('StateChanged',
145
entry_group_state_changed)
146
logger.debug(u"Adding service '%s' of type '%s' ...",
147
service.name, service.type)
148
group.AddService(
149
self.interface, # interface
150
avahi.PROTO_INET6, # protocol
151
dbus.UInt32(0), # flags
152
self.name, self.type,
153
self.domain, self.host,
154
dbus.UInt16(self.port),
155
avahi.string_array_to_txt_array(self.TXT))
156
group.Commit()
157
83
del syslogger
84
85
# This variable is used to optionally bind to a specified interface.
86
# It is a global variable to fit in with the other variables from the
87
# Avahi example code.
88
serviceInterface = avahi.IF_UNSPEC
158
89
# From the Avahi example code:
159
group = None # our entry group
90
serviceName = None
91
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
92
servicePort = None # Not known at startup
93
serviceTXT = [] # TXT record for the service
94
domain = "" # Domain to publish on, default to .local
95
host = "" # Host to publish records for, default to localhost
96
group = None #our entry group
97
rename_count = 12 # Counter so we only rename after collisions a
98
# sensible number of times
160
99
# End of Avahi example code
161
100
162
101
167
106
fingerprint: string (40 or 32 hexadecimal digits); used to
168
107
uniquely identify the client
169
108
secret: bytestring; sent verbatim (over TLS) to client
170
host: string; available for use by the checker command
171
created: datetime.datetime(); object creation, not client host
172
last_checked_ok: datetime.datetime() or None if not yet checked OK
173
timeout: datetime.timedelta(); How long from last_checked_ok
174
until this client is invalid
109
fqdn: string (FQDN); available for use by the checker command
110
created: datetime.datetime()
111
last_seen: datetime.datetime() or None if not yet seen
112
timeout: datetime.timedelta(); How long from last_seen until
113
this client is invalid
175
114
interval: datetime.timedelta(); How often to start a new checker
176
115
stop_hook: If set, called by stop() as stop_hook(self)
177
116
checker: subprocess.Popen(); a running checker process used
178
117
to see if the client lives.
179
'None' if no process is running.
118
Is None if no process is running.
180
119
checker_initiator_tag: a gobject event source tag, or None
181
120
stop_initiator_tag: - '' -
182
121
checker_callback_tag: - '' -
183
122
checker_command: string; External command which is run to check if
184
client lives. %() expansions are done at
123
client lives. %()s expansions are done at
185
124
runtime with vars(self) as dict, so that for
186
125
instance %(name)s can be used in the command.
187
126
Private attibutes:
188
127
_timeout: Real variable for 'timeout'
189
128
_interval: Real variable for 'interval'
190
_timeout_milliseconds: Used when calling gobject.timeout_add()
129
_timeout_milliseconds: Used by gobject.timeout_add()
191
130
_interval_milliseconds: - '' -
192
131
"""
193
132
def _set_timeout(self, timeout):
213
152
interval = property(lambda self: self._interval,
214
153
_set_interval)
215
154
del _set_interval
216
def __init__(self, name = None, stop_hook=None, config={}):
217
"""Note: the 'checker' key in 'config' sets the
218
'checker_command' attribute and *not* the 'checker'
219
attribute."""
155
def __init__(self, name=None, stop_hook=None, fingerprint=None,
156
secret=None, secfile=None, fqdn=None, timeout=None,
157
interval=-1, checker=None):
158
"""Note: the 'checker' argument sets the 'checker_command'
159
attribute and not the 'checker' attribute.."""
220
160
self.name = name
221
161
logger.debug(u"Creating client %r", self.name)
222
# Uppercase and remove spaces from fingerprint for later
223
# comparison purposes with return value from the fingerprint()
224
# function
225
self.fingerprint = config["fingerprint"].upper()\
226
.replace(u" ", u"")
162
# Uppercase and remove spaces from fingerprint
163
# for later comparison purposes with return value of
164
# the fingerprint() function
165
self.fingerprint = fingerprint.upper().replace(u" ", u"")
227
166
logger.debug(u" Fingerprint: %s", self.fingerprint)
228
if "secret" in config:
229
self.secret = config["secret"].decode(u"base64")
230
elif "secfile" in config:
231
sf = open(config["secfile"])
167
if secret:
168
self.secret = secret.decode(u"base64")
169
elif secfile:
170
sf = open(secfile)
232
171
self.secret = sf.read()
233
172
sf.close()
234
173
else:
235
raise TypeError(u"No secret or secfile for client %s"
236
% self.name)
237
self.host = config.get("host", "")
174
raise RuntimeError(u"No secret or secfile for client %s"
175
% self.name)
176
self.fqdn = fqdn # string
238
177
self.created = datetime.datetime.now()
239
self.last_checked_ok = None
240
self.timeout = string_to_delta(config["timeout"])
241
self.interval = string_to_delta(config["interval"])
178
self.last_seen = None
179
self.timeout = string_to_delta(timeout)
180
self.interval = string_to_delta(interval)
242
181
self.stop_hook = stop_hook
243
182
self.checker = None
244
183
self.checker_initiator_tag = None
245
184
self.stop_initiator_tag = None
246
185
self.checker_callback_tag = None
247
self.check_command = config["checker"]
186
self.check_command = checker
248
187
def start(self):
249
188
"""Start this client's checker and timeout hooks"""
250
189
# Schedule a new checker to be started an 'interval' from now,
260
199
self.stop)
261
200
def stop(self):
262
201
"""Stop this client.
263
The possibility that a client might be restarted is left open,
264
but not currently used."""
202
The possibility that this client might be restarted is left
203
open, but not currently used."""
265
204
# If this client doesn't have a secret, it is already stopped.
266
if hasattr(self, "secret") and self.secret:
267
logger.info(u"Stopping client %s", self.name)
205
if self.secret:
206
logger.debug(u"Stopping client %s", self.name)
268
207
self.secret = None
269
208
else:
270
209
return False
271
if getattr(self, "stop_initiator_tag", False):
210
if hasattr(self, "stop_initiator_tag") \
211
and self.stop_initiator_tag:
272
212
gobject.source_remove(self.stop_initiator_tag)
273
213
self.stop_initiator_tag = None
274
if getattr(self, "checker_initiator_tag", False):
214
if hasattr(self, "checker_initiator_tag") \
215
and self.checker_initiator_tag:
275
216
gobject.source_remove(self.checker_initiator_tag)
276
217
self.checker_initiator_tag = None
277
218
self.stop_checker()
289
230
self.checker = None
290
231
if os.WIFEXITED(condition) \
291
232
and (os.WEXITSTATUS(condition) == 0):
292
logger.info(u"Checker for %(name)s succeeded",
293
vars(self))
294
self.last_checked_ok = now
233
logger.debug(u"Checker for %(name)s succeeded",
234
vars(self))
235
self.last_seen = now
295
236
gobject.source_remove(self.stop_initiator_tag)
296
237
self.stop_initiator_tag = gobject.timeout_add\
297
238
(self._timeout_milliseconds,
300
241
logger.warning(u"Checker for %(name)s crashed?",
301
242
vars(self))
302
243
else:
303
logger.info(u"Checker for %(name)s failed",
304
vars(self))
244
logger.debug(u"Checker for %(name)s failed",
245
vars(self))
305
246
def start_checker(self):
306
247
"""Start a new checker subprocess if one is not running.
307
248
If a checker already exists, leave it running and do
316
257
# is as it should be.
317
258
if self.checker is None:
318
259
try:
319
# In case check_command has exactly one % operator
320
command = self.check_command % self.host
260
command = self.check_command % self.fqdn
321
261
except TypeError:
322
# Escape attributes for the shell
323
262
escaped_attrs = dict((key, re.escape(str(val)))
324
263
for key, val in
325
264
vars(self).iteritems())
326
265
try:
327
266
command = self.check_command % escaped_attrs
328
267
except TypeError, error:
329
logger.error(u'Could not format string "%s":'
330
u' %s', self.check_command, error)
268
logger.critical(u'Could not format string "%s":'
269
u' %s', self.check_command, error)
331
270
return True # Try again later
332
271
try:
333
logger.info(u"Starting checker %r for %s",
334
command, self.name)
335
self.checker = subprocess.Popen(command,
336
close_fds=True,
337
shell=True, cwd="/")
272
logger.debug(u"Starting checker %r for %s",
273
command, self.name)
274
self.checker = subprocess.\
275
Popen(command,
276
close_fds=True, shell=True,
277
cwd="/")
338
278
self.checker_callback_tag = gobject.child_watch_add\
339
279
(self.checker.pid,
340
280
self.checker_callback)
348
288
if self.checker_callback_tag:
349
289
gobject.source_remove(self.checker_callback_tag)
350
290
self.checker_callback_tag = None
351
if getattr(self, "checker", None) is None:
291
if not hasattr(self, "checker") or self.checker is None:
352
292
return
353
logger.debug(u"Stopping checker for %(name)s", vars(self))
293
logger.debug("Stopping checker for %(name)s", vars(self))
354
294
try:
355
295
os.kill(self.checker.pid, signal.SIGTERM)
356
296
#os.sleep(0.5)
357
297
#if self.checker.poll() is None:
358
298
# os.kill(self.checker.pid, signal.SIGKILL)
359
299
except OSError, error:
360
if error.errno != errno.ESRCH: # No such process
300
if error.errno != errno.ESRCH:
361
301
raise
362
302
self.checker = None
363
def still_valid(self):
303
def still_valid(self, now=None):
364
304
"""Has the timeout not yet passed for this client?"""
365
now = datetime.datetime.now()
366
if self.last_checked_ok is None:
305
if now is None:
306
now = datetime.datetime.now()
307
if self.last_seen is None:
367
308
return now < (self.created + self.timeout)
368
309
else:
369
return now < (self.last_checked_ok + self.timeout)
310
return now < (self.last_seen + self.timeout)
370
311
371
312
372
313
def peer_certificate(session):
388
329
389
330
def fingerprint(openpgp):
390
331
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
332
# New empty GnuTLS certificate
333
crt = gnutls.library.types.gnutls_openpgp_crt_t()
334
gnutls.library.functions.gnutls_openpgp_crt_init\
335
(ctypes.byref(crt))
391
336
# New GnuTLS "datum" with the OpenPGP public key
392
337
datum = gnutls.library.types.gnutls_datum_t\
393
338
(ctypes.cast(ctypes.c_char_p(openpgp),
394
339
ctypes.POINTER(ctypes.c_ubyte)),
395
340
ctypes.c_uint(len(openpgp)))
396
# New empty GnuTLS certificate
397
crt = gnutls.library.types.gnutls_openpgp_crt_t()
398
gnutls.library.functions.gnutls_openpgp_crt_init\
399
(ctypes.byref(crt))
400
341
# Import the OpenPGP public key into the certificate
401
gnutls.library.functions.gnutls_openpgp_crt_import\
402
(crt, ctypes.byref(datum),
403
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
342
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
343
(crt,
344
ctypes.byref(datum),
345
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
404
346
# New buffer for the fingerprint
405
347
buffer = ctypes.create_string_buffer(20)
406
348
buffer_length = ctypes.c_size_t()
422
364
Note: This will run in its own forked process."""
423
365
424
366
def handle(self):
425
logger.info(u"TCP connection from: %s",
367
logger.debug(u"TCP connection from: %s",
426
368
unicode(self.client_address))
427
session = gnutls.connection.ClientSession\
428
(self.request, gnutls.connection.X509Credentials())
429
430
line = self.request.makefile().readline()
431
logger.debug(u"Protocol version: %r", line)
432
try:
433
if int(line.strip().split()[0]) > 1:
434
raise RuntimeError
435
except (ValueError, IndexError, RuntimeError), error:
436
logger.error(u"Unknown protocol version: %s", error)
437
return
438
439
# Note: gnutls.connection.X509Credentials is really a generic
440
# GnuTLS certificate credentials object so long as no X.509
441
# keys are added to it. Therefore, we can use it here despite
442
# using OpenPGP certificates.
369
session = gnutls.connection.ClientSession(self.request,
370
gnutls.connection.\
371
X509Credentials())
443
372
444
373
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
445
374
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
446
375
# "+DHE-DSS"))
447
priority = "NORMAL" # Fallback default, since this
448
# MUST be set.
449
if self.server.settings["priority"]:
450
priority = self.server.settings["priority"]
376
priority = "NORMAL"
377
if self.server.options.priority:
378
priority = self.server.options.priority
451
379
gnutls.library.functions.gnutls_priority_set_direct\
452
380
(session._c_object, priority, None);
453
381
454
382
try:
455
383
session.handshake()
456
384
except gnutls.errors.GNUTLSError, error:
457
logger.warning(u"Handshake failed: %s", error)
385
logger.debug(u"Handshake failed: %s", error)
458
386
# Do not run session.bye() here: the session is not
459
387
# established. Just abandon the request.
460
388
return
461
389
try:
462
390
fpr = fingerprint(peer_certificate(session))
463
391
except (TypeError, gnutls.errors.GNUTLSError), error:
464
logger.warning(u"Bad certificate: %s", error)
392
logger.debug(u"Bad certificate: %s", error)
465
393
session.bye()
466
394
return
467
395
logger.debug(u"Fingerprint: %s", fpr)
470
398
if c.fingerprint == fpr:
471
399
client = c
472
400
break
473
if not client:
474
logger.warning(u"Client not found for fingerprint: %s",
475
fpr)
476
session.bye()
477
return
478
401
# Have to check if client.still_valid(), since it is possible
479
402
# that the client timed out while establishing the GnuTLS
480
403
# session.
481
if not client.still_valid():
482
logger.warning(u"Client %(name)s is invalid",
483
vars(client))
404
if (not client) or (not client.still_valid()):
405
if client:
406
logger.debug(u"Client %(name)s is invalid",
407
vars(client))
408
else:
409
logger.debug(u"Client not found for fingerprint: %s",
410
fpr)
484
411
session.bye()
485
412
return
486
413
sent_size = 0
496
423
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
497
424
"""IPv6 TCP server. Accepts 'None' as address and/or port.
498
425
Attributes:
499
settings: Server settings
426
options: Command line options
500
427
clients: Set() of Client objects
501
428
"""
502
429
address_family = socket.AF_INET6
503
430
def __init__(self, *args, **kwargs):
504
if "settings" in kwargs:
505
self.settings = kwargs["settings"]
506
del kwargs["settings"]
431
if "options" in kwargs:
432
self.options = kwargs["options"]
433
del kwargs["options"]
507
434
if "clients" in kwargs:
508
435
self.clients = kwargs["clients"]
509
436
del kwargs["clients"]
512
439
"""This overrides the normal server_bind() function
513
440
to bind to an interface if one was specified, and also NOT to
514
441
bind to an address or port if they were not specified."""
515
if self.settings["interface"]:
516
# 25 is from /usr/include/asm-i486/socket.h
517
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
442
if self.options.interface:
443
if not hasattr(socket, "SO_BINDTODEVICE"):
444
# From /usr/include/asm-i486/socket.h
445
socket.SO_BINDTODEVICE = 25
518
446
try:
519
447
self.socket.setsockopt(socket.SOL_SOCKET,
520
SO_BINDTODEVICE,
521
self.settings["interface"])
448
socket.SO_BINDTODEVICE,
449
self.options.interface)
522
450
except socket.error, error:
523
451
if error[0] == errno.EPERM:
524
logger.error(u"No permission to"
525
u" bind to interface %s",
526
self.settings["interface"])
452
logger.warning(u"No permission to"
453
u" bind to interface %s",
454
self.options.interface)
527
455
else:
528
456
raise error
529
457
# Only bind(2) the socket if we really need to.
532
460
in6addr_any = "::"
533
461
self.server_address = (in6addr_any,
534
462
self.server_address[1])
535
elif not self.server_address[1]:
463
elif self.server_address[1] is None:
536
464
self.server_address = (self.server_address[0],
537
465
0)
538
# if self.settings["interface"]:
539
# self.server_address = (self.server_address[0],
540
# 0, # port
541
# 0, # flowinfo
542
# if_nametoindex
543
# (self.settings
544
# ["interface"]))
545
466
return super(type(self), self).server_bind()
546
467
547
468
579
500
return delta
580
501
581
502
503
def add_service():
504
"""Derived from the Avahi example code"""
505
global group, serviceName, serviceType, servicePort, serviceTXT, \
506
domain, host
507
if group is None:
508
group = dbus.Interface(
509
bus.get_object( avahi.DBUS_NAME,
510
server.EntryGroupNew()),
511
avahi.DBUS_INTERFACE_ENTRY_GROUP)
512
group.connect_to_signal('StateChanged',
513
entry_group_state_changed)
514
logger.debug(u"Adding service '%s' of type '%s' ...",
515
serviceName, serviceType)
516
517
group.AddService(
518
serviceInterface, # interface
519
avahi.PROTO_INET6, # protocol
520
dbus.UInt32(0), # flags
521
serviceName, serviceType,
522
domain, host,
523
dbus.UInt16(servicePort),
524
avahi.string_array_to_txt_array(serviceTXT))
525
group.Commit()
526
527
528
def remove_service():
529
"""From the Avahi example code"""
530
global group
531
532
if not group is None:
533
group.Reset()
534
535
582
536
def server_state_changed(state):
583
537
"""Derived from the Avahi example code"""
584
538
if state == avahi.SERVER_COLLISION:
585
logger.error(u"Server name collision")
586
service.remove()
539
logger.warning(u"Server name collision")
540
remove_service()
587
541
elif state == avahi.SERVER_RUNNING:
588
service.add()
542
add_service()
589
543
590
544
591
545
def entry_group_state_changed(state, error):
592
546
"""Derived from the Avahi example code"""
547
global serviceName, server, rename_count
548
593
549
logger.debug(u"state change: %i", state)
594
550
595
551
if state == avahi.ENTRY_GROUP_ESTABLISHED:
596
552
logger.debug(u"Service established.")
597
553
elif state == avahi.ENTRY_GROUP_COLLISION:
598
logger.warning(u"Service name collision.")
599
service.rename()
554
555
rename_count = rename_count - 1
556
if rename_count > 0:
557
name = server.GetAlternativeServiceName(name)
558
logger.warning(u"Service name collision, "
559
u"changing name to '%s' ...", name)
560
remove_service()
561
add_service()
562
563
else:
564
logger.error(u"No suitable service name found after %i"
565
u" retries, exiting.", n_rename)
566
killme(1)
600
567
elif state == avahi.ENTRY_GROUP_FAILURE:
601
logger.critical(u"Error in group state changed %s",
602
unicode(error))
603
raise AvahiGroupError("State changed: %s", str(error))
568
logger.error(u"Error in group state changed %s",
569
unicode(error))
570
killme(1)
571
604
572
605
573
def if_nametoindex(interface):
606
"""Call the C function if_nametoindex(), or equivalent"""
607
global if_nametoindex
574
"""Call the C function if_nametoindex()"""
608
575
try:
609
if "ctypes.util" not in sys.modules:
610
import ctypes.util
611
if_nametoindex = ctypes.cdll.LoadLibrary\
612
(ctypes.util.find_library("c")).if_nametoindex
576
libc = ctypes.cdll.LoadLibrary("libc.so.6")
577
return libc.if_nametoindex(interface)
613
578
except (OSError, AttributeError):
614
579
if "struct" not in sys.modules:
615
580
import struct
616
581
if "fcntl" not in sys.modules:
617
582
import fcntl
618
def if_nametoindex(interface):
619
"Get an interface index the hard way, i.e. using fcntl()"
620
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
621
s = socket.socket()
622
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
623
struct.pack("16s16x", interface))
624
s.close()
625
interface_index = struct.unpack("I", ifreq[16:20])[0]
626
return interface_index
627
return if_nametoindex(interface)
628
629
630
def daemon(nochdir = False, noclose = False):
583
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
584
s = socket.socket()
585
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
586
struct.pack("16s16x", interface))
587
s.close()
588
interface_index = struct.unpack("I", ifreq[16:20])[0]
589
return interface_index
590
591
592
def daemon(nochdir, noclose):
631
593
"""See daemon(3). Standard BSD Unix function.
632
594
This should really exist as os.daemon, but it doesn't (yet)."""
633
595
if os.fork():
635
597
os.setsid()
636
598
if not nochdir:
637
599
os.chdir("/")
638
if os.fork():
639
sys.exit()
640
600
if not noclose:
641
601
# Close all standard open file descriptors
642
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
602
null = os.open("/dev/null", os.O_NOCTTY | os.O_RDWR)
643
603
if not stat.S_ISCHR(os.fstat(null).st_mode):
644
604
raise OSError(errno.ENODEV,
645
605
"/dev/null not a character device")
650
610
os.close(null)
651
611
652
612
613
def killme(status = 0):
614
logger.debug("Stopping server with exit status %d", status)
615
exitstatus = status
616
if main_loop_started:
617
main_loop.quit()
618
else:
619
sys.exit(status)
620
621
653
622
def main():
623
global exitstatus
624
exitstatus = 0
654
625
global main_loop_started
655
626
main_loop_started = False
656
627
657
parser = OptionParser(version = "Mandos server %s" % version)
628
parser = OptionParser()
658
629
parser.add_option("-i", "--interface", type="string",
659
metavar="IF", help="Bind to interface IF")
660
parser.add_option("-a", "--address", type="string",
630
default=None, metavar="IF",
631
help="Bind to interface IF")
632
parser.add_option("-a", "--address", type="string", default=None,
661
633
help="Address to listen for requests on")
662
parser.add_option("-p", "--port", type="int",
634
parser.add_option("-p", "--port", type="int", default=None,
663
635
help="Port number to receive requests on")
664
636
parser.add_option("--check", action="store_true", default=False,
665
637
help="Run self-test")
666
parser.add_option("--debug", action="store_true",
667
help="Debug mode; run in foreground and log to"
668
" terminal")
669
parser.add_option("--priority", type="string", help="GnuTLS"
670
" priority string (see GnuTLS documentation)")
671
parser.add_option("--servicename", type="string", metavar="NAME",
672
help="Zeroconf service name")
673
parser.add_option("--configdir", type="string",
674
default="/etc/mandos", metavar="DIR",
675
help="Directory to search for configuration"
676
" files")
638
parser.add_option("--debug", action="store_true", default=False,
639
help="Debug mode")
640
parser.add_option("--priority", type="string",
641
default="SECURE256",
642
help="GnuTLS priority string"
643
" (see GnuTLS documentation)")
644
parser.add_option("--servicename", type="string",
645
default="Mandos", help="Zeroconf service name")
677
646
(options, args) = parser.parse_args()
678
647
679
648
if options.check:
681
650
doctest.testmod()
682
651
sys.exit()
683
652
684
# Default values for config file for server-global settings
685
server_defaults = { "interface": "",
686
"address": "",
687
"port": "",
688
"debug": "False",
689
"priority":
690
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
691
"servicename": "Mandos",
692
}
693
694
# Parse config file for server-global settings
695
server_config = ConfigParser.SafeConfigParser(server_defaults)
696
del server_defaults
697
server_config.read(os.path.join(options.configdir, "mandos.conf"))
698
server_section = "server"
699
# Convert the SafeConfigParser object to a dict
700
server_settings = dict(server_config.items(server_section))
701
# Use getboolean on the boolean config option
702
server_settings["debug"] = server_config.getboolean\
703
(server_section, "debug")
704
del server_config
705
706
# Override the settings from the config file with command line
707
# options, if set.
708
for option in ("interface", "address", "port", "debug",
709
"priority", "servicename", "configdir"):
710
value = getattr(options, option)
711
if value is not None:
712
server_settings[option] = value
713
del options
714
# Now we have our good server settings in "server_settings"
715
716
debug = server_settings["debug"]
717
718
if not debug:
719
syslogger.setLevel(logging.WARNING)
720
721
if server_settings["servicename"] != "Mandos":
722
syslogger.setFormatter(logging.Formatter\
723
('Mandos (%s): %%(levelname)s:'
724
' %%(message)s'
725
% server_settings["servicename"]))
726
727
# Parse config file with clients
728
client_defaults = { "timeout": "1h",
729
"interval": "5m",
730
"checker": "fping -q -- %%(host)s",
731
}
732
client_config = ConfigParser.SafeConfigParser(client_defaults)
733
client_config.read(os.path.join(server_settings["configdir"],
734
"clients.conf"))
735
736
global service
737
service = AvahiService(name = server_settings["servicename"],
738
type = "_mandos._tcp", );
739
if server_settings["interface"]:
740
service.interface = if_nametoindex(server_settings["interface"])
653
# Parse config file
654
defaults = { "timeout": "1h",
655
"interval": "5m",
656
"checker": "fping -q -- %%(fqdn)s",
657
}
658
client_config = ConfigParser.SafeConfigParser(defaults)
659
#client_config.readfp(open("global.conf"), "global.conf")
660
client_config.read("mandos-clients.conf")
661
662
global serviceName
663
serviceName = options.servicename;
741
664
742
665
global main_loop
743
666
global bus
751
674
avahi.DBUS_INTERFACE_SERVER )
752
675
# End of Avahi example code
753
676
677
debug = options.debug
678
754
679
if debug:
755
680
console = logging.StreamHandler()
756
681
# console.setLevel(logging.DEBUG)
763
688
def remove_from_clients(client):
764
689
clients.remove(client)
765
690
if not clients:
766
logger.critical(u"No clients left, exiting")
767
sys.exit()
691
logger.debug(u"No clients left, exiting")
692
killme()
768
693
769
clients.update(Set(Client(name = section,
694
clients.update(Set(Client(name=section,
770
695
stop_hook = remove_from_clients,
771
config
772
= dict(client_config.items(section)))
696
**(dict(client_config\
697
.items(section))))
773
698
for section in client_config.sections()))
774
if not clients:
775
logger.critical(u"No clients defined")
776
sys.exit(1)
777
699
778
700
if not debug:
779
daemon()
780
781
pidfilename = "/var/run/mandos/mandos.pid"
782
pid = os.getpid()
783
try:
784
pidfile = open(pidfilename, "w")
785
pidfile.write(str(pid) + "\n")
786
pidfile.close()
787
del pidfile
788
except IOError, err:
789
logger.error(u"Could not write %s file with PID %d",
790
pidfilename, os.getpid())
701
daemon(False, False)
791
702
792
703
def cleanup():
793
704
"Cleanup function; run on exit"
807
718
808
719
if not debug:
809
720
signal.signal(signal.SIGINT, signal.SIG_IGN)
810
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
811
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
721
signal.signal(signal.SIGHUP, lambda signum, frame: killme())
722
signal.signal(signal.SIGTERM, lambda signum, frame: killme())
812
723
813
724
for client in clients:
814
725
client.start()
815
726
816
tcp_server = IPv6_TCPServer((server_settings["address"],
817
server_settings["port"]),
727
tcp_server = IPv6_TCPServer((options.address, options.port),
818
728
tcp_handler,
819
settings=server_settings,
729
options=options,
820
730
clients=clients)
821
# Find out what port we got
822
service.port = tcp_server.socket.getsockname()[1]
823
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
824
u" scope_id %d" % tcp_server.socket.getsockname())
825
826
#service.interface = tcp_server.socket.getsockname()[3]
827
828
try:
829
# From the Avahi example code
830
server.connect_to_signal("StateChanged", server_state_changed)
831
try:
832
server_state_changed(server.GetState())
833
except dbus.exceptions.DBusException, error:
834
logger.critical(u"DBusException: %s", error)
835
sys.exit(1)
836
# End of Avahi example code
837
838
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
839
lambda *args, **kwargs:
840
tcp_server.handle_request\
841
(*args[2:], **kwargs) or True)
842
843
logger.debug(u"Starting main loop")
731
# Find out what random port we got
732
global servicePort
733
servicePort = tcp_server.socket.getsockname()[1]
734
logger.debug(u"Now listening on port %d", servicePort)
735
736
if options.interface is not None:
737
global serviceInterface
738
serviceInterface = if_nametoindex(options.interface)
739
740
# From the Avahi example code
741
server.connect_to_signal("StateChanged", server_state_changed)
742
try:
743
server_state_changed(server.GetState())
744
except dbus.exceptions.DBusException, error:
745
logger.critical(u"DBusException: %s", error)
746
killme(1)
747
# End of Avahi example code
748
749
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
750
lambda *args, **kwargs:
751
tcp_server.handle_request(*args[2:],
752
**kwargs) or True)
753
try:
754
logger.debug("Starting main loop")
844
755
main_loop_started = True
845
756
main_loop.run()
846
except AvahiError, error:
847
logger.critical(u"AvahiError: %s" + unicode(error))
848
sys.exit(1)
849
757
except KeyboardInterrupt:
850
758
if debug:
851
759
print
760
761
sys.exit(exitstatus)
852
762
853
763
if __name__ == '__main__':
854
764
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0