To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 30
- compare with another revision
- download diff
- download tarball
- view history from revision 30
- Committer: Teddy Hogeborn
- Date: 2008-07-31 19:51:44 UTC
- mfrom: (24.1.5 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080731195144-yb37wz2sr1e6b3m4
Merge.
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos.conf => server.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
server.py
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
9
# following functions: "AvahiService.add", "AvahiService.remove",
10
# "server_state_changed", "entry_group_state_changed", and some lines
11
# in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
# GNU General Public License for more details.
26
25
#
27
26
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
30
28
#
31
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
30
#
33
31
34
from __future__ import division, with_statement, absolute_import
32
from __future__ import division
35
33
36
34
import SocketServer
37
35
import socket
38
import optparse
36
import select
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
import pwd
59
from contextlib import closing
60
57
61
58
import dbus
62
import dbus.service
63
59
import gobject
64
60
import avahi
65
61
from dbus.mainloop.glib import DBusGMainLoop
66
62
import ctypes
67
import ctypes.util
68
69
version = "1.0.5"
63
64
# Brief description of the operation of this program:
65
#
66
# This server announces itself as a Zeroconf service. Connecting
67
# clients use the TLS protocol, with the unusual quirk that this
68
# server program acts as a TLS "client" while a connecting client acts
69
# as a TLS "server". The client (acting as a TLS "server") must
70
# supply an OpenPGP certificate, and the fingerprint of this
71
# certificate is used by this server to look up (in a list read from a
72
# file at start time) which binary blob to give the client. No other
73
# authentication or authorization is done by this server.
74
70
75
71
76
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
77
syslogger = logging.handlers.SysLogHandler\
78
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
79
syslogger.setFormatter(logging.Formatter\
80
('%(levelname)s: %(message)s'))
78
81
logger.addHandler(syslogger)
82
del syslogger
79
83
80
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
83
logger.addHandler(console)
84
84
85
85
class AvahiError(Exception):
86
def __init__(self, value, *args, **kwargs):
86
def __init__(self, value):
87
87
self.value = value
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
88
def __str__(self):
89
return repr(self.value)
91
90
92
91
class AvahiServiceError(AvahiError):
93
92
pass
97
96
98
97
99
98
class AvahiService(object):
100
"""An Avahi (Zeroconf) service.
101
Attributes:
99
"""
102
100
interface: integer; avahi.IF_UNSPEC or an interface index.
103
101
Used to optionally bind to the specified interface.
104
name: string; Example: 'Mandos'
105
type: string; Example: '_mandos._tcp'.
106
See <http://www.dns-sd.org/ServiceTypes.html>
107
port: integer; what port to announce
108
TXT: list of strings; TXT record for the service
109
domain: string; Domain to publish on, default to .local if empty.
110
host: string; Host to publish records for, default is localhost
111
max_renames: integer; maximum number of renames
112
rename_count: integer; counter so we only rename after collisions
113
a sensible number of times
102
name = string; Example: "Mandos"
103
type = string; Example: "_mandos._tcp".
104
See <http://www.dns-sd.org/ServiceTypes.html>
105
port = integer; what port to announce
106
TXT = list of strings; TXT record for the service
107
domain = string; Domain to publish on, default to .local if empty.
108
host = string; Host to publish records for, default to localhost
109
if empty.
110
max_renames = integer; maximum number of renames
111
rename_count = integer; counter so we only rename after collisions
112
a sensible number of times
114
113
"""
115
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768,
118
protocol = avahi.PROTO_UNSPEC):
115
type = None, port = None, TXT = None, domain = "",
116
host = "", max_renames = 12):
117
"""An Avahi (Zeroconf) service. """
119
118
self.interface = interface
120
119
self.name = name
121
self.type = servicetype
120
self.type = type
122
121
self.port = port
123
self.TXT = TXT if TXT is not None else []
122
if TXT is None:
123
self.TXT = []
124
else:
125
self.TXT = TXT
124
126
self.domain = domain
125
127
self.host = host
126
128
self.rename_count = 0
127
self.max_renames = max_renames
128
self.protocol = protocol
129
129
def rename(self):
130
130
"""Derived from the Avahi example code"""
131
131
if self.rename_count >= self.max_renames:
132
logger.critical(u"No suitable Zeroconf service name found"
133
u" after %i retries, exiting.",
134
self.rename_count)
135
raise AvahiServiceError(u"Too many renames")
136
self.name = server.GetAlternativeServiceName(self.name)
137
logger.info(u"Changing Zeroconf service name to %r ...",
138
str(self.name))
139
syslogger.setFormatter(logging.Formatter
140
('Mandos (%s): %%(levelname)s:'
141
' %%(message)s' % self.name))
132
logger.critical(u"No suitable service name found after %i"
133
u" retries, exiting.", rename_count)
134
raise AvahiServiceError("Too many renames")
135
name = server.GetAlternativeServiceName(name)
136
logger.notice(u"Changing name to %r ...", name)
142
137
self.remove()
143
138
self.add()
144
139
self.rename_count += 1
150
145
"""Derived from the Avahi example code"""
151
146
global group
152
147
if group is None:
153
group = dbus.Interface(bus.get_object
154
(avahi.DBUS_NAME,
148
group = dbus.Interface\
149
(bus.get_object(avahi.DBUS_NAME,
155
150
server.EntryGroupNew()),
156
avahi.DBUS_INTERFACE_ENTRY_GROUP)
151
avahi.DBUS_INTERFACE_ENTRY_GROUP)
157
152
group.connect_to_signal('StateChanged',
158
153
entry_group_state_changed)
159
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
154
logger.debug(u"Adding service '%s' of type '%s' ...",
160
155
service.name, service.type)
161
156
group.AddService(
162
157
self.interface, # interface
163
self.protocol, # protocol
158
avahi.PROTO_INET6, # protocol
164
159
dbus.UInt32(0), # flags
165
160
self.name, self.type,
166
161
self.domain, self.host,
173
168
# End of Avahi example code
174
169
175
170
176
def _datetime_to_dbus(dt, variant_level=0):
177
"""Convert a UTC datetime.datetime() to a D-Bus type."""
178
return dbus.String(dt.isoformat(), variant_level=variant_level)
179
180
181
class Client(dbus.service.Object):
171
class Client(object):
182
172
"""A representation of a client host served by this server.
183
173
Attributes:
184
name: string; from the config file, used in log messages and
185
D-Bus identifiers
174
name: string; from the config file, used in log messages
186
175
fingerprint: string (40 or 32 hexadecimal digits); used to
187
176
uniquely identify the client
188
secret: bytestring; sent verbatim (over TLS) to client
189
host: string; available for use by the checker command
190
created: datetime.datetime(); (UTC) object creation
191
last_enabled: datetime.datetime(); (UTC)
192
enabled: bool()
193
last_checked_ok: datetime.datetime(); (UTC) or None
194
timeout: datetime.timedelta(); How long from last_checked_ok
195
until this client is invalid
196
interval: datetime.timedelta(); How often to start a new checker
197
disable_hook: If set, called by disable() as disable_hook(self)
198
checker: subprocess.Popen(); a running checker process used
199
to see if the client lives.
200
'None' if no process is running.
177
secret: bytestring; sent verbatim (over TLS) to client
178
fqdn: string (FQDN); available for use by the checker command
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
181
timeout: datetime.timedelta(); How long from last_checked_ok
182
until this client is invalid
183
interval: datetime.timedelta(); How often to start a new checker
184
stop_hook: If set, called by stop() as stop_hook(self)
185
checker: subprocess.Popen(); a running checker process used
186
to see if the client lives.
187
'None' if no process is running.
201
188
checker_initiator_tag: a gobject event source tag, or None
202
disable_initiator_tag: - '' -
189
stop_initiator_tag: - '' -
203
190
checker_callback_tag: - '' -
204
191
checker_command: string; External command which is run to check if
205
192
client lives. %() expansions are done at
206
193
runtime with vars(self) as dict, so that for
207
194
instance %(name)s can be used in the command.
208
use_dbus: bool(); Whether to provide D-Bus interface and signals
209
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
195
Private attibutes:
196
_timeout: Real variable for 'timeout'
197
_interval: Real variable for 'interval'
198
_timeout_milliseconds: Used when calling gobject.timeout_add()
199
_interval_milliseconds: - '' -
210
200
"""
211
def timeout_milliseconds(self):
212
"Return the 'timeout' attribute in milliseconds"
213
return ((self.timeout.days * 24 * 60 * 60 * 1000)
214
+ (self.timeout.seconds * 1000)
215
+ (self.timeout.microseconds // 1000))
216
217
def interval_milliseconds(self):
218
"Return the 'interval' attribute in milliseconds"
219
return ((self.interval.days * 24 * 60 * 60 * 1000)
220
+ (self.interval.seconds * 1000)
221
+ (self.interval.microseconds // 1000))
222
223
def __init__(self, name = None, disable_hook=None, config=None,
224
use_dbus=True):
225
"""Note: the 'checker' key in 'config' sets the
226
'checker_command' attribute and *not* the 'checker'
227
attribute."""
201
def _set_timeout(self, timeout):
202
"Setter function for 'timeout' attribute"
203
self._timeout = timeout
204
self._timeout_milliseconds = ((self.timeout.days
205
* 24 * 60 * 60 * 1000)
206
+ (self.timeout.seconds * 1000)
207
+ (self.timeout.microseconds
208
// 1000))
209
timeout = property(lambda self: self._timeout,
210
_set_timeout)
211
del _set_timeout
212
def _set_interval(self, interval):
213
"Setter function for 'interval' attribute"
214
self._interval = interval
215
self._interval_milliseconds = ((self.interval.days
216
* 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds
218
* 1000)
219
+ (self.interval.microseconds
220
// 1000))
221
interval = property(lambda self: self._interval,
222
_set_interval)
223
del _set_interval
224
def __init__(self, name=None, stop_hook=None, fingerprint=None,
225
secret=None, secfile=None, fqdn=None, timeout=None,
226
interval=-1, checker=None):
227
"""Note: the 'checker' argument sets the 'checker_command'
228
attribute and not the 'checker' attribute.."""
228
229
self.name = name
229
if config is None:
230
config = {}
231
230
logger.debug(u"Creating client %r", self.name)
232
self.use_dbus = False # During __init__
233
# Uppercase and remove spaces from fingerprint for later
234
# comparison purposes with return value from the fingerprint()
235
# function
236
self.fingerprint = (config["fingerprint"].upper()
237
.replace(u" ", u""))
231
# Uppercase and remove spaces from fingerprint
232
# for later comparison purposes with return value of
233
# the fingerprint() function
234
self.fingerprint = fingerprint.upper().replace(u" ", u"")
238
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
239
if "secret" in config:
240
self.secret = config["secret"].decode(u"base64")
241
elif "secfile" in config:
242
with closing(open(os.path.expanduser
243
(os.path.expandvars
244
(config["secfile"])))) as secfile:
245
self.secret = secfile.read()
236
if secret:
237
self.secret = secret.decode(u"base64")
238
elif secfile:
239
sf = open(secfile)
240
self.secret = sf.read()
241
sf.close()
246
242
else:
247
243
raise TypeError(u"No secret or secfile for client %s"
248
244
% self.name)
249
self.host = config.get("host", "")
250
self.created = datetime.datetime.utcnow()
251
self.enabled = False
252
self.last_enabled = None
245
self.fqdn = fqdn
246
self.created = datetime.datetime.now()
253
247
self.last_checked_ok = None
254
self.timeout = string_to_delta(config["timeout"])
255
self.interval = string_to_delta(config["interval"])
256
self.disable_hook = disable_hook
248
self.timeout = string_to_delta(timeout)
249
self.interval = string_to_delta(interval)
250
self.stop_hook = stop_hook
257
251
self.checker = None
258
252
self.checker_initiator_tag = None
259
self.disable_initiator_tag = None
253
self.stop_initiator_tag = None
260
254
self.checker_callback_tag = None
261
self.checker_command = config["checker"]
262
self.last_connect = None
263
# Only now, when this client is initialized, can it show up on
264
# the D-Bus
265
self.use_dbus = use_dbus
266
if self.use_dbus:
267
self.dbus_object_path = (dbus.ObjectPath
268
("/clients/"
269
+ self.name.replace(".", "_")))
270
dbus.service.Object.__init__(self, bus,
271
self.dbus_object_path)
272
273
def enable(self):
255
self.check_command = checker
256
def start(self):
274
257
"""Start this client's checker and timeout hooks"""
275
self.last_enabled = datetime.datetime.utcnow()
276
258
# Schedule a new checker to be started an 'interval' from now,
277
259
# and every interval from then on.
278
self.checker_initiator_tag = (gobject.timeout_add
279
(self.interval_milliseconds(),
280
self.start_checker))
260
self.checker_initiator_tag = gobject.timeout_add\
261
(self._interval_milliseconds,
262
self.start_checker)
281
263
# Also start a new checker *right now*.
282
264
self.start_checker()
283
# Schedule a disable() when 'timeout' has passed
284
self.disable_initiator_tag = (gobject.timeout_add
285
(self.timeout_milliseconds(),
286
self.disable))
287
self.enabled = True
288
if self.use_dbus:
289
# Emit D-Bus signals
290
self.PropertyChanged(dbus.String(u"enabled"),
291
dbus.Boolean(True, variant_level=1))
292
self.PropertyChanged(dbus.String(u"last_enabled"),
293
(_datetime_to_dbus(self.last_enabled,
294
variant_level=1)))
295
296
def disable(self):
297
"""Disable this client."""
298
if not getattr(self, "enabled", False):
265
# Schedule a stop() when 'timeout' has passed
266
self.stop_initiator_tag = gobject.timeout_add\
267
(self._timeout_milliseconds,
268
self.stop)
269
def stop(self):
270
"""Stop this client.
271
The possibility that a client might be restarted is left open,
272
but not currently used."""
273
# If this client doesn't have a secret, it is already stopped.
274
if self.secret:
275
logger.debug(u"Stopping client %s", self.name)
276
self.secret = None
277
else:
299
278
return False
300
logger.info(u"Disabling client %s", self.name)
301
if getattr(self, "disable_initiator_tag", False):
302
gobject.source_remove(self.disable_initiator_tag)
303
self.disable_initiator_tag = None
279
if getattr(self, "stop_initiator_tag", False):
280
gobject.source_remove(self.stop_initiator_tag)
281
self.stop_initiator_tag = None
304
282
if getattr(self, "checker_initiator_tag", False):
305
283
gobject.source_remove(self.checker_initiator_tag)
306
284
self.checker_initiator_tag = None
307
285
self.stop_checker()
308
if self.disable_hook:
309
self.disable_hook(self)
310
self.enabled = False
311
if self.use_dbus:
312
# Emit D-Bus signal
313
self.PropertyChanged(dbus.String(u"enabled"),
314
dbus.Boolean(False, variant_level=1))
286
if self.stop_hook:
287
self.stop_hook(self)
315
288
# Do not run this again if called by a gobject.timeout_add
316
289
return False
317
318
290
def __del__(self):
319
self.disable_hook = None
320
self.disable()
321
322
def checker_callback(self, pid, condition, command):
291
self.stop_hook = None
292
self.stop()
293
def checker_callback(self, pid, condition):
323
294
"""The checker has completed, so take appropriate actions."""
295
now = datetime.datetime.now()
324
296
self.checker_callback_tag = None
325
297
self.checker = None
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.PropertyChanged(dbus.String(u"checker_running"),
329
dbus.Boolean(False, variant_level=1))
330
if os.WIFEXITED(condition):
331
exitstatus = os.WEXITSTATUS(condition)
332
if exitstatus == 0:
333
logger.info(u"Checker for %(name)s succeeded",
334
vars(self))
335
self.checked_ok()
336
else:
337
logger.info(u"Checker for %(name)s failed",
338
vars(self))
339
if self.use_dbus:
340
# Emit D-Bus signal
341
self.CheckerCompleted(dbus.Int16(exitstatus),
342
dbus.Int64(condition),
343
dbus.String(command))
344
else:
298
if os.WIFEXITED(condition) \
299
and (os.WEXITSTATUS(condition) == 0):
300
logger.debug(u"Checker for %(name)s succeeded",
301
vars(self))
302
self.last_checked_ok = now
303
gobject.source_remove(self.stop_initiator_tag)
304
self.stop_initiator_tag = gobject.timeout_add\
305
(self._timeout_milliseconds,
306
self.stop)
307
elif not os.WIFEXITED(condition):
345
308
logger.warning(u"Checker for %(name)s crashed?",
346
309
vars(self))
347
if self.use_dbus:
348
# Emit D-Bus signal
349
self.CheckerCompleted(dbus.Int16(-1),
350
dbus.Int64(condition),
351
dbus.String(command))
352
353
def checked_ok(self):
354
"""Bump up the timeout for this client.
355
This should only be called when the client has been seen,
356
alive and well.
357
"""
358
self.last_checked_ok = datetime.datetime.utcnow()
359
gobject.source_remove(self.disable_initiator_tag)
360
self.disable_initiator_tag = (gobject.timeout_add
361
(self.timeout_milliseconds(),
362
self.disable))
363
if self.use_dbus:
364
# Emit D-Bus signal
365
self.PropertyChanged(
366
dbus.String(u"last_checked_ok"),
367
(_datetime_to_dbus(self.last_checked_ok,
368
variant_level=1)))
369
310
else:
311
logger.debug(u"Checker for %(name)s failed",
312
vars(self))
370
313
def start_checker(self):
371
314
"""Start a new checker subprocess if one is not running.
372
315
If a checker already exists, leave it running and do
381
324
# is as it should be.
382
325
if self.checker is None:
383
326
try:
384
# In case checker_command has exactly one % operator
385
command = self.checker_command % self.host
327
# In case check_command has exactly one % operator
328
command = self.check_command % self.fqdn
386
329
except TypeError:
387
330
# Escape attributes for the shell
388
331
escaped_attrs = dict((key, re.escape(str(val)))
389
332
for key, val in
390
333
vars(self).iteritems())
391
334
try:
392
command = self.checker_command % escaped_attrs
335
command = self.check_command % escaped_attrs
393
336
except TypeError, error:
394
337
logger.error(u'Could not format string "%s":'
395
u' %s', self.checker_command, error)
338
u' %s', self.check_command, error)
396
339
return True # Try again later
397
340
try:
398
logger.info(u"Starting checker %r for %s",
399
command, self.name)
400
# We don't need to redirect stdout and stderr, since
401
# in normal mode, that is already done by daemon(),
402
# and in debug mode we don't want to. (Stdin is
403
# always replaced by /dev/null.)
341
logger.debug(u"Starting checker %r for %s",
342
command, self.name)
404
343
self.checker = subprocess.Popen(command,
405
344
close_fds=True,
406
345
shell=True, cwd="/")
407
if self.use_dbus:
408
# Emit D-Bus signal
409
self.CheckerStarted(command)
410
self.PropertyChanged(
411
dbus.String("checker_running"),
412
dbus.Boolean(True, variant_level=1))
413
self.checker_callback_tag = (gobject.child_watch_add
414
(self.checker.pid,
415
self.checker_callback,
416
data=command))
417
# The checker may have completed before the gobject
418
# watch was added. Check for this.
419
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
420
if pid:
421
gobject.source_remove(self.checker_callback_tag)
422
self.checker_callback(pid, status, command)
423
except OSError, error:
346
self.checker_callback_tag = gobject.child_watch_add\
347
(self.checker.pid,
348
self.checker_callback)
349
except subprocess.OSError, error:
424
350
logger.error(u"Failed to start subprocess: %s",
425
351
error)
426
352
# Re-run this periodically if run by gobject.timeout_add
427
353
return True
428
429
354
def stop_checker(self):
430
355
"""Force the checker process, if any, to stop."""
431
356
if self.checker_callback_tag:
433
358
self.checker_callback_tag = None
434
359
if getattr(self, "checker", None) is None:
435
360
return
436
logger.debug(u"Stopping checker for %(name)s", vars(self))
361
logger.debug("Stopping checker for %(name)s", vars(self))
437
362
try:
438
363
os.kill(self.checker.pid, signal.SIGTERM)
439
364
#os.sleep(0.5)
443
368
if error.errno != errno.ESRCH: # No such process
444
369
raise
445
370
self.checker = None
446
if self.use_dbus:
447
self.PropertyChanged(dbus.String(u"checker_running"),
448
dbus.Boolean(False, variant_level=1))
449
450
371
def still_valid(self):
451
372
"""Has the timeout not yet passed for this client?"""
452
if not getattr(self, "enabled", False):
453
return False
454
now = datetime.datetime.utcnow()
373
now = datetime.datetime.now()
455
374
if self.last_checked_ok is None:
456
375
return now < (self.created + self.timeout)
457
376
else:
458
377
return now < (self.last_checked_ok + self.timeout)
459
460
## D-Bus methods & signals
461
_interface = u"se.bsnet.fukt.Mandos.Client"
462
463
# CheckedOK - method
464
CheckedOK = dbus.service.method(_interface)(checked_ok)
465
CheckedOK.__name__ = "CheckedOK"
466
467
# CheckerCompleted - signal
468
@dbus.service.signal(_interface, signature="nxs")
469
def CheckerCompleted(self, exitcode, waitstatus, command):
470
"D-Bus signal"
471
pass
472
473
# CheckerStarted - signal
474
@dbus.service.signal(_interface, signature="s")
475
def CheckerStarted(self, command):
476
"D-Bus signal"
477
pass
478
479
# GetAllProperties - method
480
@dbus.service.method(_interface, out_signature="a{sv}")
481
def GetAllProperties(self):
482
"D-Bus method"
483
return dbus.Dictionary({
484
dbus.String("name"):
485
dbus.String(self.name, variant_level=1),
486
dbus.String("fingerprint"):
487
dbus.String(self.fingerprint, variant_level=1),
488
dbus.String("host"):
489
dbus.String(self.host, variant_level=1),
490
dbus.String("created"):
491
_datetime_to_dbus(self.created, variant_level=1),
492
dbus.String("last_enabled"):
493
(_datetime_to_dbus(self.last_enabled,
494
variant_level=1)
495
if self.last_enabled is not None
496
else dbus.Boolean(False, variant_level=1)),
497
dbus.String("enabled"):
498
dbus.Boolean(self.enabled, variant_level=1),
499
dbus.String("last_checked_ok"):
500
(_datetime_to_dbus(self.last_checked_ok,
501
variant_level=1)
502
if self.last_checked_ok is not None
503
else dbus.Boolean (False, variant_level=1)),
504
dbus.String("timeout"):
505
dbus.UInt64(self.timeout_milliseconds(),
506
variant_level=1),
507
dbus.String("interval"):
508
dbus.UInt64(self.interval_milliseconds(),
509
variant_level=1),
510
dbus.String("checker"):
511
dbus.String(self.checker_command,
512
variant_level=1),
513
dbus.String("checker_running"):
514
dbus.Boolean(self.checker is not None,
515
variant_level=1),
516
dbus.String("object_path"):
517
dbus.ObjectPath(self.dbus_object_path,
518
variant_level=1)
519
}, signature="sv")
520
521
# IsStillValid - method
522
IsStillValid = (dbus.service.method(_interface, out_signature="b")
523
(still_valid))
524
IsStillValid.__name__ = "IsStillValid"
525
526
# PropertyChanged - signal
527
@dbus.service.signal(_interface, signature="sv")
528
def PropertyChanged(self, property, value):
529
"D-Bus signal"
530
pass
531
532
# SetChecker - method
533
@dbus.service.method(_interface, in_signature="s")
534
def SetChecker(self, checker):
535
"D-Bus setter method"
536
self.checker_command = checker
537
# Emit D-Bus signal
538
self.PropertyChanged(dbus.String(u"checker"),
539
dbus.String(self.checker_command,
540
variant_level=1))
541
542
# SetHost - method
543
@dbus.service.method(_interface, in_signature="s")
544
def SetHost(self, host):
545
"D-Bus setter method"
546
self.host = host
547
# Emit D-Bus signal
548
self.PropertyChanged(dbus.String(u"host"),
549
dbus.String(self.host, variant_level=1))
550
551
# SetInterval - method
552
@dbus.service.method(_interface, in_signature="t")
553
def SetInterval(self, milliseconds):
554
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
555
# Emit D-Bus signal
556
self.PropertyChanged(dbus.String(u"interval"),
557
(dbus.UInt64(self.interval_milliseconds(),
558
variant_level=1)))
559
560
# SetSecret - method
561
@dbus.service.method(_interface, in_signature="ay",
562
byte_arrays=True)
563
def SetSecret(self, secret):
564
"D-Bus setter method"
565
self.secret = str(secret)
566
567
# SetTimeout - method
568
@dbus.service.method(_interface, in_signature="t")
569
def SetTimeout(self, milliseconds):
570
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
571
# Emit D-Bus signal
572
self.PropertyChanged(dbus.String(u"timeout"),
573
(dbus.UInt64(self.timeout_milliseconds(),
574
variant_level=1)))
575
576
# Enable - method
577
Enable = dbus.service.method(_interface)(enable)
578
Enable.__name__ = "Enable"
579
580
# StartChecker - method
581
@dbus.service.method(_interface)
582
def StartChecker(self):
583
"D-Bus method"
584
self.start_checker()
585
586
# Disable - method
587
@dbus.service.method(_interface)
588
def Disable(self):
589
"D-Bus method"
590
self.disable()
591
592
# StopChecker - method
593
StopChecker = dbus.service.method(_interface)(stop_checker)
594
StopChecker.__name__ = "StopChecker"
595
596
del _interface
597
378
598
379
599
380
def peer_certificate(session):
600
381
"Return the peer's OpenPGP certificate as a bytestring"
601
382
# If not an OpenPGP certificate...
602
if (gnutls.library.functions
603
.gnutls_certificate_type_get(session._c_object)
604
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
383
if gnutls.library.functions.gnutls_certificate_type_get\
384
(session._c_object) \
385
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
605
386
# ...do the normal thing
606
387
return session.peer_certificate
607
list_size = ctypes.c_uint(1)
608
cert_list = (gnutls.library.functions
609
.gnutls_certificate_get_peers
610
(session._c_object, ctypes.byref(list_size)))
611
if not bool(cert_list) and list_size.value != 0:
612
raise gnutls.errors.GNUTLSError("error getting peer"
613
" certificate")
388
list_size = ctypes.c_uint()
389
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
390
(session._c_object, ctypes.byref(list_size))
614
391
if list_size.value == 0:
615
392
return None
616
393
cert = cert_list[0]
619
396
620
397
def fingerprint(openpgp):
621
398
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
622
# New GnuTLS "datum" with the OpenPGP public key
623
datum = (gnutls.library.types
624
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
625
ctypes.POINTER
626
(ctypes.c_ubyte)),
627
ctypes.c_uint(len(openpgp))))
628
399
# New empty GnuTLS certificate
629
400
crt = gnutls.library.types.gnutls_openpgp_crt_t()
630
(gnutls.library.functions
631
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
401
gnutls.library.functions.gnutls_openpgp_crt_init\
402
(ctypes.byref(crt))
403
# New GnuTLS "datum" with the OpenPGP public key
404
datum = gnutls.library.types.gnutls_datum_t\
405
(ctypes.cast(ctypes.c_char_p(openpgp),
406
ctypes.POINTER(ctypes.c_ubyte)),
407
ctypes.c_uint(len(openpgp)))
632
408
# Import the OpenPGP public key into the certificate
633
(gnutls.library.functions
634
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
635
gnutls.library.constants
636
.GNUTLS_OPENPGP_FMT_RAW))
637
# Verify the self signature in the key
638
crtverify = ctypes.c_uint()
639
(gnutls.library.functions
640
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
641
if crtverify.value != 0:
642
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
643
raise gnutls.errors.CertificateSecurityError("Verify failed")
409
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
410
(crt,
411
ctypes.byref(datum),
412
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
644
413
# New buffer for the fingerprint
645
buf = ctypes.create_string_buffer(20)
646
buf_len = ctypes.c_size_t()
414
buffer = ctypes.create_string_buffer(20)
415
buffer_length = ctypes.c_size_t()
647
416
# Get the fingerprint from the certificate into the buffer
648
(gnutls.library.functions
649
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
650
ctypes.byref(buf_len)))
417
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
418
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
651
419
# Deinit the certificate
652
420
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
653
421
# Convert the buffer to a Python bytestring
654
fpr = ctypes.string_at(buf, buf_len.value)
422
fpr = ctypes.string_at(buffer, buffer_length.value)
655
423
# Convert the bytestring to hexadecimal notation
656
424
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
657
425
return hex_fpr
658
426
659
427
660
class TCP_handler(SocketServer.BaseRequestHandler, object):
428
class tcp_handler(SocketServer.BaseRequestHandler, object):
661
429
"""A TCP request handler class.
662
430
Instantiated by IPv6_TCPServer for each request to handle it.
663
431
Note: This will run in its own forked process."""
664
432
665
433
def handle(self):
666
logger.info(u"TCP connection from: %s",
667
unicode(self.client_address))
668
session = (gnutls.connection
669
.ClientSession(self.request,
670
gnutls.connection
671
.X509Credentials()))
672
673
line = self.request.makefile().readline()
674
logger.debug(u"Protocol version: %r", line)
675
try:
676
if int(line.strip().split()[0]) > 1:
677
raise RuntimeError
678
except (ValueError, IndexError, RuntimeError), error:
679
logger.error(u"Unknown protocol version: %s", error)
680
return
681
434
logger.debug(u"TCP connection from: %s",
435
unicode(self.client_address))
436
session = gnutls.connection.ClientSession\
437
(self.request, gnutls.connection.X509Credentials())
682
438
# Note: gnutls.connection.X509Credentials is really a generic
683
439
# GnuTLS certificate credentials object so long as no X.509
684
440
# keys are added to it. Therefore, we can use it here despite
685
441
# using OpenPGP certificates.
686
442
687
443
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
688
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
689
# "+DHE-DSS"))
690
# Use a fallback default, since this MUST be set.
691
priority = self.server.settings.get("priority", "NORMAL")
692
(gnutls.library.functions
693
.gnutls_priority_set_direct(session._c_object,
694
priority, None))
444
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
445
# "+DHE-DSS"))
446
priority = "NORMAL" # Fallback default, since this
447
# MUST be set.
448
if self.server.settings["priority"]:
449
priority = self.server.settings["priority"]
450
gnutls.library.functions.gnutls_priority_set_direct\
451
(session._c_object, priority, None);
695
452
696
453
try:
697
454
session.handshake()
698
455
except gnutls.errors.GNUTLSError, error:
699
logger.warning(u"Handshake failed: %s", error)
456
logger.debug(u"Handshake failed: %s", error)
700
457
# Do not run session.bye() here: the session is not
701
458
# established. Just abandon the request.
702
459
return
703
logger.debug(u"Handshake succeeded")
704
460
try:
705
461
fpr = fingerprint(peer_certificate(session))
706
462
except (TypeError, gnutls.errors.GNUTLSError), error:
707
logger.warning(u"Bad certificate: %s", error)
463
logger.debug(u"Bad certificate: %s", error)
708
464
session.bye()
709
465
return
710
466
logger.debug(u"Fingerprint: %s", fpr)
711
467
client = None
712
468
for c in self.server.clients:
713
469
if c.fingerprint == fpr:
714
470
client = c
715
471
break
716
else:
717
logger.warning(u"Client not found for fingerprint: %s",
718
fpr)
472
if not client:
473
logger.debug(u"Client not found for fingerprint: %s", fpr)
719
474
session.bye()
720
475
return
721
476
# Have to check if client.still_valid(), since it is possible
722
477
# that the client timed out while establishing the GnuTLS
723
478
# session.
724
479
if not client.still_valid():
725
logger.warning(u"Client %(name)s is invalid",
726
vars(client))
480
logger.debug(u"Client %(name)s is invalid", vars(client))
727
481
session.bye()
728
482
return
729
## This won't work here, since we're in a fork.
730
# client.checked_ok()
731
483
sent_size = 0
732
484
while sent_size < len(client.secret):
733
485
sent = session.send(client.secret[sent_size:])
738
490
session.bye()
739
491
740
492
741
class IPv6_TCPServer(SocketServer.ForkingMixIn,
742
SocketServer.TCPServer, object):
743
"""IPv6-capable TCP server. Accepts 'None' as address and/or port.
493
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
494
"""IPv6 TCP server. Accepts 'None' as address and/or port.
744
495
Attributes:
745
496
settings: Server settings
746
497
clients: Set() of Client objects
747
enabled: Boolean; whether this server is activated yet
748
498
"""
749
499
address_family = socket.AF_INET6
750
500
def __init__(self, *args, **kwargs):
754
504
if "clients" in kwargs:
755
505
self.clients = kwargs["clients"]
756
506
del kwargs["clients"]
757
if "use_ipv6" in kwargs:
758
if not kwargs["use_ipv6"]:
759
self.address_family = socket.AF_INET
760
del kwargs["use_ipv6"]
761
self.enabled = False
762
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
507
return super(type(self), self).__init__(*args, **kwargs)
763
508
def server_bind(self):
764
509
"""This overrides the normal server_bind() function
765
510
to bind to an interface if one was specified, and also NOT to
773
518
self.settings["interface"])
774
519
except socket.error, error:
775
520
if error[0] == errno.EPERM:
776
logger.error(u"No permission to"
777
u" bind to interface %s",
778
self.settings["interface"])
521
logger.warning(u"No permission to"
522
u" bind to interface %s",
523
self.settings["interface"])
779
524
else:
780
raise
525
raise error
781
526
# Only bind(2) the socket if we really need to.
782
527
if self.server_address[0] or self.server_address[1]:
783
528
if not self.server_address[0]:
784
if self.address_family == socket.AF_INET6:
785
any_address = "::" # in6addr_any
786
else:
787
any_address = socket.INADDR_ANY
788
self.server_address = (any_address,
529
in6addr_any = "::"
530
self.server_address = (in6addr_any,
789
531
self.server_address[1])
790
elif not self.server_address[1]:
532
elif self.server_address[1] is None:
791
533
self.server_address = (self.server_address[0],
792
534
0)
793
# if self.settings["interface"]:
794
# self.server_address = (self.server_address[0],
795
# 0, # port
796
# 0, # flowinfo
797
# if_nametoindex
798
# (self.settings
799
# ["interface"]))
800
return super(IPv6_TCPServer, self).server_bind()
801
def server_activate(self):
802
if self.enabled:
803
return super(IPv6_TCPServer, self).server_activate()
804
def enable(self):
805
self.enabled = True
535
return super(type(self), self).server_bind()
806
536
807
537
808
538
def string_to_delta(interval):
809
539
"""Parse a string and return a datetime.timedelta
810
540
811
541
>>> string_to_delta('7d')
812
542
datetime.timedelta(7)
813
543
>>> string_to_delta('60s')
818
548
datetime.timedelta(1)
819
549
>>> string_to_delta(u'1w')
820
550
datetime.timedelta(7)
821
>>> string_to_delta('5m 30s')
822
datetime.timedelta(0, 330)
823
551
"""
824
timevalue = datetime.timedelta(0)
825
for s in interval.split():
826
try:
827
suffix = unicode(s[-1])
828
value = int(s[:-1])
829
if suffix == u"d":
830
delta = datetime.timedelta(value)
831
elif suffix == u"s":
832
delta = datetime.timedelta(0, value)
833
elif suffix == u"m":
834
delta = datetime.timedelta(0, 0, 0, 0, value)
835
elif suffix == u"h":
836
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
837
elif suffix == u"w":
838
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
839
else:
840
raise ValueError
841
except (ValueError, IndexError):
552
try:
553
suffix=unicode(interval[-1])
554
value=int(interval[:-1])
555
if suffix == u"d":
556
delta = datetime.timedelta(value)
557
elif suffix == u"s":
558
delta = datetime.timedelta(0, value)
559
elif suffix == u"m":
560
delta = datetime.timedelta(0, 0, 0, 0, value)
561
elif suffix == u"h":
562
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
563
elif suffix == u"w":
564
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
565
else:
842
566
raise ValueError
843
timevalue += delta
844
return timevalue
567
except (ValueError, IndexError):
568
raise ValueError
569
return delta
845
570
846
571
847
572
def server_state_changed(state):
848
573
"""Derived from the Avahi example code"""
849
574
if state == avahi.SERVER_COLLISION:
850
logger.error(u"Zeroconf server name collision")
575
logger.warning(u"Server name collision")
851
576
service.remove()
852
577
elif state == avahi.SERVER_RUNNING:
853
578
service.add()
855
580
856
581
def entry_group_state_changed(state, error):
857
582
"""Derived from the Avahi example code"""
858
logger.debug(u"Avahi state change: %i", state)
583
logger.debug(u"state change: %i", state)
859
584
860
585
if state == avahi.ENTRY_GROUP_ESTABLISHED:
861
logger.debug(u"Zeroconf service established.")
586
logger.debug(u"Service established.")
862
587
elif state == avahi.ENTRY_GROUP_COLLISION:
863
logger.warning(u"Zeroconf service name collision.")
588
logger.warning(u"Service name collision.")
864
589
service.rename()
865
590
elif state == avahi.ENTRY_GROUP_FAILURE:
866
logger.critical(u"Avahi: Error in group state changed %s",
591
logger.critical(u"Error in group state changed %s",
867
592
unicode(error))
868
raise AvahiGroupError(u"State changed: %s" % unicode(error))
593
raise AvahiGroupError("State changed: %s", str(error))
869
594
870
def if_nametoindex(interface):
595
def if_nametoindex(interface, _func=[None]):
871
596
"""Call the C function if_nametoindex(), or equivalent"""
872
global if_nametoindex
597
if _func[0] is not None:
598
return _func[0](interface)
873
599
try:
874
if_nametoindex = (ctypes.cdll.LoadLibrary
875
(ctypes.util.find_library("c"))
876
.if_nametoindex)
600
if "ctypes.util" not in sys.modules:
601
import ctypes.util
602
while True:
603
try:
604
libc = ctypes.cdll.LoadLibrary\
605
(ctypes.util.find_library("c"))
606
_func[0] = libc.if_nametoindex
607
return _func[0](interface)
608
except IOError, e:
609
if e != errno.EINTR:
610
raise
877
611
except (OSError, AttributeError):
878
612
if "struct" not in sys.modules:
879
613
import struct
880
614
if "fcntl" not in sys.modules:
881
615
import fcntl
882
def if_nametoindex(interface):
616
def the_hard_way(interface):
883
617
"Get an interface index the hard way, i.e. using fcntl()"
884
618
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
885
with closing(socket.socket()) as s:
886
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
887
struct.pack("16s16x", interface))
619
s = socket.socket()
620
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
621
struct.pack("16s16x", interface))
622
s.close()
888
623
interface_index = struct.unpack("I", ifreq[16:20])[0]
889
624
return interface_index
890
return if_nametoindex(interface)
891
892
893
def daemon(nochdir = False, noclose = False):
625
_func[0] = the_hard_way
626
return _func[0](interface)
627
628
629
def daemon(nochdir, noclose):
894
630
"""See daemon(3). Standard BSD Unix function.
895
631
This should really exist as os.daemon, but it doesn't (yet)."""
896
632
if os.fork():
898
634
os.setsid()
899
635
if not nochdir:
900
636
os.chdir("/")
901
if os.fork():
902
sys.exit()
903
637
if not noclose:
904
638
# Close all standard open file descriptors
905
639
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
914
648
915
649
916
650
def main():
917
parser = optparse.OptionParser(version = "%%prog %s" % version)
651
global main_loop_started
652
main_loop_started = False
653
654
parser = OptionParser()
918
655
parser.add_option("-i", "--interface", type="string",
919
656
metavar="IF", help="Bind to interface IF")
920
657
parser.add_option("-a", "--address", type="string",
921
658
help="Address to listen for requests on")
922
659
parser.add_option("-p", "--port", type="int",
923
660
help="Port number to receive requests on")
924
parser.add_option("--check", action="store_true",
661
parser.add_option("--check", action="store_true", default=False,
925
662
help="Run self-test")
926
parser.add_option("--debug", action="store_true",
663
parser.add_option("--debug", action="store_true", default=False,
927
664
help="Debug mode; run in foreground and log to"
928
665
" terminal")
929
666
parser.add_option("--priority", type="string", help="GnuTLS"
934
671
default="/etc/mandos", metavar="DIR",
935
672
help="Directory to search for configuration"
936
673
" files")
937
parser.add_option("--no-dbus", action="store_false",
938
dest="use_dbus",
939
help="Do not provide D-Bus system bus"
940
" interface")
941
parser.add_option("--no-ipv6", action="store_false",
942
dest="use_ipv6", help="Do not use IPv6")
943
options = parser.parse_args()[0]
674
(options, args) = parser.parse_args()
944
675
945
676
if options.check:
946
677
import doctest
955
686
"priority":
956
687
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
957
688
"servicename": "Mandos",
958
"use_dbus": "True",
959
"use_ipv6": "True",
960
689
}
961
690
962
691
# Parse config file for server-global settings
963
692
server_config = ConfigParser.SafeConfigParser(server_defaults)
964
693
del server_defaults
965
server_config.read(os.path.join(options.configdir, "mandos.conf"))
694
server_config.read(os.path.join(options.configdir, "server.conf"))
695
server_section = "server"
966
696
# Convert the SafeConfigParser object to a dict
967
server_settings = server_config.defaults()
968
# Use the appropriate methods on the non-string config options
969
server_settings["debug"] = server_config.getboolean("DEFAULT",
970
"debug")
971
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
972
"use_dbus")
973
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
974
"use_ipv6")
975
if server_settings["port"]:
976
server_settings["port"] = server_config.getint("DEFAULT",
977
"port")
697
server_settings = dict(server_config.items(server_section))
698
# Use getboolean on the boolean config option
699
server_settings["debug"] = server_config.getboolean\
700
(server_section, "debug")
978
701
del server_config
979
702
980
703
# Override the settings from the config file with command line
981
704
# options, if set.
982
705
for option in ("interface", "address", "port", "debug",
983
"priority", "servicename", "configdir",
984
"use_dbus", "use_ipv6"):
706
"priority", "servicename", "configdir"):
985
707
value = getattr(options, option)
986
708
if value is not None:
987
709
server_settings[option] = value
988
710
del options
989
711
# Now we have our good server settings in "server_settings"
990
712
991
# For convenience
992
debug = server_settings["debug"]
993
use_dbus = server_settings["use_dbus"]
994
use_ipv6 = server_settings["use_ipv6"]
995
996
if not debug:
997
syslogger.setLevel(logging.WARNING)
998
console.setLevel(logging.WARNING)
999
1000
if server_settings["servicename"] != "Mandos":
1001
syslogger.setFormatter(logging.Formatter
1002
('Mandos (%s): %%(levelname)s:'
1003
' %%(message)s'
1004
% server_settings["servicename"]))
1005
1006
713
# Parse config file with clients
1007
714
client_defaults = { "timeout": "1h",
1008
715
"interval": "5m",
1009
"checker": "fping -q -- %%(host)s",
1010
"host": "",
716
"checker": "fping -q -- %%(fqdn)s",
1011
717
}
1012
718
client_config = ConfigParser.SafeConfigParser(client_defaults)
1013
719
client_config.read(os.path.join(server_settings["configdir"],
1014
720
"clients.conf"))
1015
721
1016
clients = Set()
1017
tcp_server = IPv6_TCPServer((server_settings["address"],
1018
server_settings["port"]),
1019
TCP_handler,
1020
settings=server_settings,
1021
clients=clients, use_ipv6=use_ipv6)
1022
pidfilename = "/var/run/mandos.pid"
1023
try:
1024
pidfile = open(pidfilename, "w")
1025
except IOError:
1026
logger.error("Could not open file %r", pidfilename)
1027
1028
try:
1029
uid = pwd.getpwnam("_mandos").pw_uid
1030
gid = pwd.getpwnam("_mandos").pw_gid
1031
except KeyError:
1032
try:
1033
uid = pwd.getpwnam("mandos").pw_uid
1034
gid = pwd.getpwnam("mandos").pw_gid
1035
except KeyError:
1036
try:
1037
uid = pwd.getpwnam("nobody").pw_uid
1038
gid = pwd.getpwnam("nogroup").pw_gid
1039
except KeyError:
1040
uid = 65534
1041
gid = 65534
1042
try:
1043
os.setgid(gid)
1044
os.setuid(uid)
1045
except OSError, error:
1046
if error[0] != errno.EPERM:
1047
raise error
1048
1049
# Enable all possible GnuTLS debugging
1050
if debug:
1051
# "Use a log level over 10 to enable all debugging options."
1052
# - GnuTLS manual
1053
gnutls.library.functions.gnutls_global_set_log_level(11)
1054
1055
@gnutls.library.types.gnutls_log_func
1056
def debug_gnutls(level, string):
1057
logger.debug("GnuTLS: %s", string[:-1])
1058
1059
(gnutls.library.functions
1060
.gnutls_global_set_log_function(debug_gnutls))
1061
1062
722
global service
1063
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1064
723
service = AvahiService(name = server_settings["servicename"],
1065
servicetype = "_mandos._tcp",
1066
protocol = protocol)
724
type = "_mandos._tcp", );
1067
725
if server_settings["interface"]:
1068
service.interface = (if_nametoindex
1069
(server_settings["interface"]))
726
service.interface = if_nametoindex(server_settings["interface"])
1070
727
1071
728
global main_loop
1072
729
global bus
1075
732
DBusGMainLoop(set_as_default=True )
1076
733
main_loop = gobject.MainLoop()
1077
734
bus = dbus.SystemBus()
1078
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1079
avahi.DBUS_PATH_SERVER),
1080
avahi.DBUS_INTERFACE_SERVER)
735
server = dbus.Interface(
736
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
737
avahi.DBUS_INTERFACE_SERVER )
1081
738
# End of Avahi example code
1082
if use_dbus:
1083
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1084
1085
clients.update(Set(Client(name = section,
1086
config
1087
= dict(client_config.items(section)),
1088
use_dbus = use_dbus)
739
740
debug = server_settings["debug"]
741
742
if debug:
743
console = logging.StreamHandler()
744
# console.setLevel(logging.DEBUG)
745
console.setFormatter(logging.Formatter\
746
('%(levelname)s: %(message)s'))
747
logger.addHandler(console)
748
del console
749
750
clients = Set()
751
def remove_from_clients(client):
752
clients.remove(client)
753
if not clients:
754
logger.debug(u"No clients left, exiting")
755
sys.exit()
756
757
clients.update(Set(Client(name=section,
758
stop_hook = remove_from_clients,
759
**(dict(client_config\
760
.items(section))))
1089
761
for section in client_config.sections()))
1090
if not clients:
1091
logger.warning(u"No clients defined")
1092
1093
if debug:
1094
# Redirect stdin so all checkers get /dev/null
1095
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1096
os.dup2(null, sys.stdin.fileno())
1097
if null > 2:
1098
os.close(null)
1099
else:
1100
# No console logging
1101
logger.removeHandler(console)
1102
# Close all input and output, do double fork, etc.
1103
daemon()
1104
1105
try:
1106
pid = os.getpid()
1107
pidfile.write(str(pid) + "\n")
1108
pidfile.close()
1109
del pidfile
1110
except IOError:
1111
logger.error(u"Could not write to file %r with PID %d",
1112
pidfilename, pid)
1113
except NameError:
1114
# "pidfile" was never created
1115
pass
1116
del pidfilename
762
763
if not debug:
764
daemon(False, False)
1117
765
1118
766
def cleanup():
1119
767
"Cleanup function; run on exit"
1126
774
1127
775
while clients:
1128
776
client = clients.pop()
1129
client.disable_hook = None
1130
client.disable()
777
client.stop_hook = None
778
client.stop()
1131
779
1132
780
atexit.register(cleanup)
1133
781
1136
784
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1137
785
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1138
786
1139
if use_dbus:
1140
class MandosServer(dbus.service.Object):
1141
"""A D-Bus proxy object"""
1142
def __init__(self):
1143
dbus.service.Object.__init__(self, bus, "/")
1144
_interface = u"se.bsnet.fukt.Mandos"
1145
1146
@dbus.service.signal(_interface, signature="oa{sv}")
1147
def ClientAdded(self, objpath, properties):
1148
"D-Bus signal"
1149
pass
1150
1151
@dbus.service.signal(_interface, signature="os")
1152
def ClientRemoved(self, objpath, name):
1153
"D-Bus signal"
1154
pass
1155
1156
@dbus.service.method(_interface, out_signature="ao")
1157
def GetAllClients(self):
1158
"D-Bus method"
1159
return dbus.Array(c.dbus_object_path for c in clients)
1160
1161
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1162
def GetAllClientsWithProperties(self):
1163
"D-Bus method"
1164
return dbus.Dictionary(
1165
((c.dbus_object_path, c.GetAllProperties())
1166
for c in clients),
1167
signature="oa{sv}")
1168
1169
@dbus.service.method(_interface, in_signature="o")
1170
def RemoveClient(self, object_path):
1171
"D-Bus method"
1172
for c in clients:
1173
if c.dbus_object_path == object_path:
1174
clients.remove(c)
1175
# Don't signal anything except ClientRemoved
1176
c.use_dbus = False
1177
c.disable()
1178
# Emit D-Bus signal
1179
self.ClientRemoved(object_path, c.name)
1180
return
1181
raise KeyError
1182
1183
del _interface
1184
1185
mandos_server = MandosServer()
1186
1187
787
for client in clients:
1188
if use_dbus:
1189
# Emit D-Bus signal
1190
mandos_server.ClientAdded(client.dbus_object_path,
1191
client.GetAllProperties())
1192
client.enable()
1193
1194
tcp_server.enable()
1195
tcp_server.server_activate()
1196
788
client.start()
789
790
tcp_server = IPv6_TCPServer((server_settings["address"],
791
server_settings["port"]),
792
tcp_handler,
793
settings=server_settings,
794
clients=clients)
1197
795
# Find out what port we got
1198
796
service.port = tcp_server.socket.getsockname()[1]
1199
if use_ipv6:
1200
logger.info(u"Now listening on address %r, port %d,"
1201
" flowinfo %d, scope_id %d"
1202
% tcp_server.socket.getsockname())
1203
else: # IPv4
1204
logger.info(u"Now listening on address %r, port %d"
1205
% tcp_server.socket.getsockname())
797
logger.debug(u"Now listening on address %r, port %d, flowinfo %d,"
798
u" scope_id %d" % tcp_server.socket.getsockname())
1206
799
1207
800
#service.interface = tcp_server.socket.getsockname()[3]
1208
801
1218
811
1219
812
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1220
813
lambda *args, **kwargs:
1221
(tcp_server.handle_request
1222
(*args[2:], **kwargs) or True))
814
tcp_server.handle_request\
815
(*args[2:], **kwargs) or True)
1223
816
1224
logger.debug(u"Starting main loop")
817
logger.debug("Starting main loop")
818
main_loop_started = True
1225
819
main_loop.run()
1226
820
except AvahiError, error:
1227
logger.critical(u"AvahiError: %s", error)
821
logger.critical(u"AvahiError: %s" + unicode(error))
1228
822
sys.exit(1)
1229
823
except KeyboardInterrupt:
1230
824
if debug:
1231
print >> sys.stderr
1232
logger.debug("Server received KeyboardInterrupt")
1233
logger.debug("Server exiting")
825
print
1234
826
1235
827
if __name__ == '__main__':
1236
828
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0