To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 30
- compare with another revision
- download diff
- download tarball
- view history from revision 30
- Committer: Teddy Hogeborn
- Date: 2008-07-31 19:51:44 UTC
- mfrom: (24.1.5 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080731195144-yb37wz2sr1e6b3m4
Merge.
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos.conf => server.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
server.py
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
9
# following functions: "AvahiService.add", "AvahiService.remove",
10
# "server_state_changed", "entry_group_state_changed", and some lines
11
# in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
# GNU General Public License for more details.
26
25
#
27
26
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
30
28
#
31
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
30
#
33
31
34
from __future__ import division, with_statement, absolute_import
32
from __future__ import division
35
33
36
34
import SocketServer
37
35
import socket
36
import select
38
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
import pwd
59
from contextlib import closing
60
57
61
58
import dbus
62
import dbus.service
63
59
import gobject
64
60
import avahi
65
61
from dbus.mainloop.glib import DBusGMainLoop
66
62
import ctypes
67
import ctypes.util
68
69
version = "1.0.2"
63
64
# Brief description of the operation of this program:
65
#
66
# This server announces itself as a Zeroconf service. Connecting
67
# clients use the TLS protocol, with the unusual quirk that this
68
# server program acts as a TLS "client" while a connecting client acts
69
# as a TLS "server". The client (acting as a TLS "server") must
70
# supply an OpenPGP certificate, and the fingerprint of this
71
# certificate is used by this server to look up (in a list read from a
72
# file at start time) which binary blob to give the client. No other
73
# authentication or authorization is done by this server.
74
70
75
71
76
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
77
syslogger = logging.handlers.SysLogHandler\
78
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
79
syslogger.setFormatter(logging.Formatter\
80
('%(levelname)s: %(message)s'))
77
81
logger.addHandler(syslogger)
82
del syslogger
78
83
79
console = logging.StreamHandler()
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
82
logger.addHandler(console)
83
84
84
85
class AvahiError(Exception):
85
def __init__(self, value, *args, **kwargs):
86
def __init__(self, value):
86
87
self.value = value
87
super(AvahiError, self).__init__(value, *args, **kwargs)
88
def __unicode__(self):
89
return unicode(repr(self.value))
88
def __str__(self):
89
return repr(self.value)
90
90
91
91
class AvahiServiceError(AvahiError):
92
92
pass
96
96
97
97
98
98
class AvahiService(object):
99
"""An Avahi (Zeroconf) service.
100
Attributes:
99
"""
101
100
interface: integer; avahi.IF_UNSPEC or an interface index.
102
101
Used to optionally bind to the specified interface.
103
name: string; Example: 'Mandos'
104
type: string; Example: '_mandos._tcp'.
105
See <http://www.dns-sd.org/ServiceTypes.html>
106
port: integer; what port to announce
107
TXT: list of strings; TXT record for the service
108
domain: string; Domain to publish on, default to .local if empty.
109
host: string; Host to publish records for, default is localhost
110
max_renames: integer; maximum number of renames
111
rename_count: integer; counter so we only rename after collisions
112
a sensible number of times
102
name = string; Example: "Mandos"
103
type = string; Example: "_mandos._tcp".
104
See <http://www.dns-sd.org/ServiceTypes.html>
105
port = integer; what port to announce
106
TXT = list of strings; TXT record for the service
107
domain = string; Domain to publish on, default to .local if empty.
108
host = string; Host to publish records for, default to localhost
109
if empty.
110
max_renames = integer; maximum number of renames
111
rename_count = integer; counter so we only rename after collisions
112
a sensible number of times
113
113
"""
114
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
115
type = None, port = None, TXT = None, domain = "",
116
host = "", max_renames = 12):
117
"""An Avahi (Zeroconf) service. """
117
118
self.interface = interface
118
119
self.name = name
119
self.type = servicetype
120
self.type = type
120
121
self.port = port
121
self.TXT = TXT if TXT is not None else []
122
if TXT is None:
123
self.TXT = []
124
else:
125
self.TXT = TXT
122
126
self.domain = domain
123
127
self.host = host
124
128
self.rename_count = 0
125
self.max_renames = max_renames
126
129
def rename(self):
127
130
"""Derived from the Avahi example code"""
128
131
if self.rename_count >= self.max_renames:
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
132
raise AvahiServiceError(u"Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
132
logger.critical(u"No suitable service name found after %i"
133
u" retries, exiting.", rename_count)
134
raise AvahiServiceError("Too many renames")
135
name = server.GetAlternativeServiceName(name)
136
logger.notice(u"Changing name to %r ...", name)
139
137
self.remove()
140
138
self.add()
141
139
self.rename_count += 1
147
145
"""Derived from the Avahi example code"""
148
146
global group
149
147
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
148
group = dbus.Interface\
149
(bus.get_object(avahi.DBUS_NAME,
152
150
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
151
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
152
group.connect_to_signal('StateChanged',
155
153
entry_group_state_changed)
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
154
logger.debug(u"Adding service '%s' of type '%s' ...",
157
155
service.name, service.type)
158
156
group.AddService(
159
157
self.interface, # interface
170
168
# End of Avahi example code
171
169
172
170
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
176
177
178
class Client(dbus.service.Object):
171
class Client(object):
179
172
"""A representation of a client host served by this server.
180
173
Attributes:
181
name: string; from the config file, used in log messages
174
name: string; from the config file, used in log messages
182
175
fingerprint: string (40 or 32 hexadecimal digits); used to
183
176
uniquely identify the client
184
secret: bytestring; sent verbatim (over TLS) to client
185
host: string; available for use by the checker command
186
created: datetime.datetime(); (UTC) object creation
187
last_enabled: datetime.datetime(); (UTC)
188
enabled: bool()
189
last_checked_ok: datetime.datetime(); (UTC) or None
190
timeout: datetime.timedelta(); How long from last_checked_ok
191
until this client is invalid
192
interval: datetime.timedelta(); How often to start a new checker
193
disable_hook: If set, called by disable() as disable_hook(self)
194
checker: subprocess.Popen(); a running checker process used
195
to see if the client lives.
196
'None' if no process is running.
177
secret: bytestring; sent verbatim (over TLS) to client
178
fqdn: string (FQDN); available for use by the checker command
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
181
timeout: datetime.timedelta(); How long from last_checked_ok
182
until this client is invalid
183
interval: datetime.timedelta(); How often to start a new checker
184
stop_hook: If set, called by stop() as stop_hook(self)
185
checker: subprocess.Popen(); a running checker process used
186
to see if the client lives.
187
'None' if no process is running.
197
188
checker_initiator_tag: a gobject event source tag, or None
198
disable_initiator_tag: - '' -
189
stop_initiator_tag: - '' -
199
190
checker_callback_tag: - '' -
200
191
checker_command: string; External command which is run to check if
201
192
client lives. %() expansions are done at
202
193
runtime with vars(self) as dict, so that for
203
194
instance %(name)s can be used in the command.
204
use_dbus: bool(); Whether to provide D-Bus interface and signals
205
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
195
Private attibutes:
196
_timeout: Real variable for 'timeout'
197
_interval: Real variable for 'interval'
198
_timeout_milliseconds: Used when calling gobject.timeout_add()
199
_interval_milliseconds: - '' -
206
200
"""
207
def timeout_milliseconds(self):
208
"Return the 'timeout' attribute in milliseconds"
209
return ((self.timeout.days * 24 * 60 * 60 * 1000)
210
+ (self.timeout.seconds * 1000)
211
+ (self.timeout.microseconds // 1000))
212
213
def interval_milliseconds(self):
214
"Return the 'interval' attribute in milliseconds"
215
return ((self.interval.days * 24 * 60 * 60 * 1000)
216
+ (self.interval.seconds * 1000)
217
+ (self.interval.microseconds // 1000))
218
219
def __init__(self, name = None, disable_hook=None, config=None,
220
use_dbus=True):
221
"""Note: the 'checker' key in 'config' sets the
222
'checker_command' attribute and *not* the 'checker'
223
attribute."""
201
def _set_timeout(self, timeout):
202
"Setter function for 'timeout' attribute"
203
self._timeout = timeout
204
self._timeout_milliseconds = ((self.timeout.days
205
* 24 * 60 * 60 * 1000)
206
+ (self.timeout.seconds * 1000)
207
+ (self.timeout.microseconds
208
// 1000))
209
timeout = property(lambda self: self._timeout,
210
_set_timeout)
211
del _set_timeout
212
def _set_interval(self, interval):
213
"Setter function for 'interval' attribute"
214
self._interval = interval
215
self._interval_milliseconds = ((self.interval.days
216
* 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds
218
* 1000)
219
+ (self.interval.microseconds
220
// 1000))
221
interval = property(lambda self: self._interval,
222
_set_interval)
223
del _set_interval
224
def __init__(self, name=None, stop_hook=None, fingerprint=None,
225
secret=None, secfile=None, fqdn=None, timeout=None,
226
interval=-1, checker=None):
227
"""Note: the 'checker' argument sets the 'checker_command'
228
attribute and not the 'checker' attribute.."""
224
229
self.name = name
225
if config is None:
226
config = {}
227
230
logger.debug(u"Creating client %r", self.name)
228
self.use_dbus = use_dbus
229
if self.use_dbus:
230
self.dbus_object_path = (dbus.ObjectPath
231
("/Mandos/clients/"
232
+ self.name.replace(".", "_")))
233
dbus.service.Object.__init__(self, bus,
234
self.dbus_object_path)
235
# Uppercase and remove spaces from fingerprint for later
236
# comparison purposes with return value from the fingerprint()
237
# function
238
self.fingerprint = (config["fingerprint"].upper()
239
.replace(u" ", u""))
231
# Uppercase and remove spaces from fingerprint
232
# for later comparison purposes with return value of
233
# the fingerprint() function
234
self.fingerprint = fingerprint.upper().replace(u" ", u"")
240
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
241
if "secret" in config:
242
self.secret = config["secret"].decode(u"base64")
243
elif "secfile" in config:
244
with closing(open(os.path.expanduser
245
(os.path.expandvars
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
236
if secret:
237
self.secret = secret.decode(u"base64")
238
elif secfile:
239
sf = open(secfile)
240
self.secret = sf.read()
241
sf.close()
248
242
else:
249
243
raise TypeError(u"No secret or secfile for client %s"
250
244
% self.name)
251
self.host = config.get("host", "")
252
self.created = datetime.datetime.utcnow()
253
self.enabled = False
254
self.last_enabled = None
245
self.fqdn = fqdn
246
self.created = datetime.datetime.now()
255
247
self.last_checked_ok = None
256
self.timeout = string_to_delta(config["timeout"])
257
self.interval = string_to_delta(config["interval"])
258
self.disable_hook = disable_hook
248
self.timeout = string_to_delta(timeout)
249
self.interval = string_to_delta(interval)
250
self.stop_hook = stop_hook
259
251
self.checker = None
260
252
self.checker_initiator_tag = None
261
self.disable_initiator_tag = None
253
self.stop_initiator_tag = None
262
254
self.checker_callback_tag = None
263
self.checker_command = config["checker"]
264
265
def enable(self):
255
self.check_command = checker
256
def start(self):
266
257
"""Start this client's checker and timeout hooks"""
267
self.last_enabled = datetime.datetime.utcnow()
268
258
# Schedule a new checker to be started an 'interval' from now,
269
259
# and every interval from then on.
270
self.checker_initiator_tag = (gobject.timeout_add
271
(self.interval_milliseconds(),
272
self.start_checker))
260
self.checker_initiator_tag = gobject.timeout_add\
261
(self._interval_milliseconds,
262
self.start_checker)
273
263
# Also start a new checker *right now*.
274
264
self.start_checker()
275
# Schedule a disable() when 'timeout' has passed
276
self.disable_initiator_tag = (gobject.timeout_add
277
(self.timeout_milliseconds(),
278
self.disable))
279
self.enabled = True
280
if self.use_dbus:
281
# Emit D-Bus signals
282
self.PropertyChanged(dbus.String(u"enabled"),
283
dbus.Boolean(True, variant_level=1))
284
self.PropertyChanged(dbus.String(u"last_enabled"),
285
(_datetime_to_dbus(self.last_enabled,
286
variant_level=1)))
287
288
def disable(self):
289
"""Disable this client."""
290
if not getattr(self, "enabled", False):
265
# Schedule a stop() when 'timeout' has passed
266
self.stop_initiator_tag = gobject.timeout_add\
267
(self._timeout_milliseconds,
268
self.stop)
269
def stop(self):
270
"""Stop this client.
271
The possibility that a client might be restarted is left open,
272
but not currently used."""
273
# If this client doesn't have a secret, it is already stopped.
274
if self.secret:
275
logger.debug(u"Stopping client %s", self.name)
276
self.secret = None
277
else:
291
278
return False
292
logger.info(u"Disabling client %s", self.name)
293
if getattr(self, "disable_initiator_tag", False):
294
gobject.source_remove(self.disable_initiator_tag)
295
self.disable_initiator_tag = None
279
if getattr(self, "stop_initiator_tag", False):
280
gobject.source_remove(self.stop_initiator_tag)
281
self.stop_initiator_tag = None
296
282
if getattr(self, "checker_initiator_tag", False):
297
283
gobject.source_remove(self.checker_initiator_tag)
298
284
self.checker_initiator_tag = None
299
285
self.stop_checker()
300
if self.disable_hook:
301
self.disable_hook(self)
302
self.enabled = False
303
if self.use_dbus:
304
# Emit D-Bus signal
305
self.PropertyChanged(dbus.String(u"enabled"),
306
dbus.Boolean(False, variant_level=1))
286
if self.stop_hook:
287
self.stop_hook(self)
307
288
# Do not run this again if called by a gobject.timeout_add
308
289
return False
309
310
290
def __del__(self):
311
self.disable_hook = None
312
self.disable()
313
314
def checker_callback(self, pid, condition, command):
291
self.stop_hook = None
292
self.stop()
293
def checker_callback(self, pid, condition):
315
294
"""The checker has completed, so take appropriate actions."""
295
now = datetime.datetime.now()
316
296
self.checker_callback_tag = None
317
297
self.checker = None
318
if self.use_dbus:
319
# Emit D-Bus signal
320
self.PropertyChanged(dbus.String(u"checker_running"),
321
dbus.Boolean(False, variant_level=1))
322
if (os.WIFEXITED(condition)
323
and (os.WEXITSTATUS(condition) == 0)):
324
logger.info(u"Checker for %(name)s succeeded",
325
vars(self))
326
if self.use_dbus:
327
# Emit D-Bus signal
328
self.CheckerCompleted(dbus.Boolean(True),
329
dbus.UInt16(condition),
330
dbus.String(command))
331
self.bump_timeout()
298
if os.WIFEXITED(condition) \
299
and (os.WEXITSTATUS(condition) == 0):
300
logger.debug(u"Checker for %(name)s succeeded",
301
vars(self))
302
self.last_checked_ok = now
303
gobject.source_remove(self.stop_initiator_tag)
304
self.stop_initiator_tag = gobject.timeout_add\
305
(self._timeout_milliseconds,
306
self.stop)
332
307
elif not os.WIFEXITED(condition):
333
308
logger.warning(u"Checker for %(name)s crashed?",
334
309
vars(self))
335
if self.use_dbus:
336
# Emit D-Bus signal
337
self.CheckerCompleted(dbus.Boolean(False),
338
dbus.UInt16(condition),
339
dbus.String(command))
340
310
else:
341
logger.info(u"Checker for %(name)s failed",
342
vars(self))
343
if self.use_dbus:
344
# Emit D-Bus signal
345
self.CheckerCompleted(dbus.Boolean(False),
346
dbus.UInt16(condition),
347
dbus.String(command))
348
349
def bump_timeout(self):
350
"""Bump up the timeout for this client.
351
This should only be called when the client has been seen,
352
alive and well.
353
"""
354
self.last_checked_ok = datetime.datetime.utcnow()
355
gobject.source_remove(self.disable_initiator_tag)
356
self.disable_initiator_tag = (gobject.timeout_add
357
(self.timeout_milliseconds(),
358
self.disable))
359
if self.use_dbus:
360
# Emit D-Bus signal
361
self.PropertyChanged(
362
dbus.String(u"last_checked_ok"),
363
(_datetime_to_dbus(self.last_checked_ok,
364
variant_level=1)))
365
311
logger.debug(u"Checker for %(name)s failed",
312
vars(self))
366
313
def start_checker(self):
367
314
"""Start a new checker subprocess if one is not running.
368
315
If a checker already exists, leave it running and do
377
324
# is as it should be.
378
325
if self.checker is None:
379
326
try:
380
# In case checker_command has exactly one % operator
381
command = self.checker_command % self.host
327
# In case check_command has exactly one % operator
328
command = self.check_command % self.fqdn
382
329
except TypeError:
383
330
# Escape attributes for the shell
384
331
escaped_attrs = dict((key, re.escape(str(val)))
385
332
for key, val in
386
333
vars(self).iteritems())
387
334
try:
388
command = self.checker_command % escaped_attrs
335
command = self.check_command % escaped_attrs
389
336
except TypeError, error:
390
337
logger.error(u'Could not format string "%s":'
391
u' %s', self.checker_command, error)
338
u' %s', self.check_command, error)
392
339
return True # Try again later
393
340
try:
394
logger.info(u"Starting checker %r for %s",
395
command, self.name)
396
# We don't need to redirect stdout and stderr, since
397
# in normal mode, that is already done by daemon(),
398
# and in debug mode we don't want to. (Stdin is
399
# always replaced by /dev/null.)
341
logger.debug(u"Starting checker %r for %s",
342
command, self.name)
400
343
self.checker = subprocess.Popen(command,
401
344
close_fds=True,
402
345
shell=True, cwd="/")
403
if self.use_dbus:
404
# Emit D-Bus signal
405
self.CheckerStarted(command)
406
self.PropertyChanged(
407
dbus.String("checker_running"),
408
dbus.Boolean(True, variant_level=1))
409
self.checker_callback_tag = (gobject.child_watch_add
410
(self.checker.pid,
411
self.checker_callback,
412
data=command))
413
except OSError, error:
346
self.checker_callback_tag = gobject.child_watch_add\
347
(self.checker.pid,
348
self.checker_callback)
349
except subprocess.OSError, error:
414
350
logger.error(u"Failed to start subprocess: %s",
415
351
error)
416
352
# Re-run this periodically if run by gobject.timeout_add
417
353
return True
418
419
354
def stop_checker(self):
420
355
"""Force the checker process, if any, to stop."""
421
356
if self.checker_callback_tag:
423
358
self.checker_callback_tag = None
424
359
if getattr(self, "checker", None) is None:
425
360
return
426
logger.debug(u"Stopping checker for %(name)s", vars(self))
361
logger.debug("Stopping checker for %(name)s", vars(self))
427
362
try:
428
363
os.kill(self.checker.pid, signal.SIGTERM)
429
364
#os.sleep(0.5)
433
368
if error.errno != errno.ESRCH: # No such process
434
369
raise
435
370
self.checker = None
436
if self.use_dbus:
437
self.PropertyChanged(dbus.String(u"checker_running"),
438
dbus.Boolean(False, variant_level=1))
439
440
371
def still_valid(self):
441
372
"""Has the timeout not yet passed for this client?"""
442
if not getattr(self, "enabled", False):
443
return False
444
now = datetime.datetime.utcnow()
373
now = datetime.datetime.now()
445
374
if self.last_checked_ok is None:
446
375
return now < (self.created + self.timeout)
447
376
else:
448
377
return now < (self.last_checked_ok + self.timeout)
449
450
## D-Bus methods & signals
451
_interface = u"org.mandos_system.Mandos.Client"
452
453
# BumpTimeout - method
454
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
455
BumpTimeout.__name__ = "BumpTimeout"
456
457
# CheckerCompleted - signal
458
@dbus.service.signal(_interface, signature="bqs")
459
def CheckerCompleted(self, success, condition, command):
460
"D-Bus signal"
461
pass
462
463
# CheckerStarted - signal
464
@dbus.service.signal(_interface, signature="s")
465
def CheckerStarted(self, command):
466
"D-Bus signal"
467
pass
468
469
# GetAllProperties - method
470
@dbus.service.method(_interface, out_signature="a{sv}")
471
def GetAllProperties(self):
472
"D-Bus method"
473
return dbus.Dictionary({
474
dbus.String("name"):
475
dbus.String(self.name, variant_level=1),
476
dbus.String("fingerprint"):
477
dbus.String(self.fingerprint, variant_level=1),
478
dbus.String("host"):
479
dbus.String(self.host, variant_level=1),
480
dbus.String("created"):
481
_datetime_to_dbus(self.created, variant_level=1),
482
dbus.String("last_enabled"):
483
(_datetime_to_dbus(self.last_enabled,
484
variant_level=1)
485
if self.last_enabled is not None
486
else dbus.Boolean(False, variant_level=1)),
487
dbus.String("enabled"):
488
dbus.Boolean(self.enabled, variant_level=1),
489
dbus.String("last_checked_ok"):
490
(_datetime_to_dbus(self.last_checked_ok,
491
variant_level=1)
492
if self.last_checked_ok is not None
493
else dbus.Boolean (False, variant_level=1)),
494
dbus.String("timeout"):
495
dbus.UInt64(self.timeout_milliseconds(),
496
variant_level=1),
497
dbus.String("interval"):
498
dbus.UInt64(self.interval_milliseconds(),
499
variant_level=1),
500
dbus.String("checker"):
501
dbus.String(self.checker_command,
502
variant_level=1),
503
dbus.String("checker_running"):
504
dbus.Boolean(self.checker is not None,
505
variant_level=1),
506
}, signature="sv")
507
508
# IsStillValid - method
509
IsStillValid = (dbus.service.method(_interface, out_signature="b")
510
(still_valid))
511
IsStillValid.__name__ = "IsStillValid"
512
513
# PropertyChanged - signal
514
@dbus.service.signal(_interface, signature="sv")
515
def PropertyChanged(self, property, value):
516
"D-Bus signal"
517
pass
518
519
# SetChecker - method
520
@dbus.service.method(_interface, in_signature="s")
521
def SetChecker(self, checker):
522
"D-Bus setter method"
523
self.checker_command = checker
524
# Emit D-Bus signal
525
self.PropertyChanged(dbus.String(u"checker"),
526
dbus.String(self.checker_command,
527
variant_level=1))
528
529
# SetHost - method
530
@dbus.service.method(_interface, in_signature="s")
531
def SetHost(self, host):
532
"D-Bus setter method"
533
self.host = host
534
# Emit D-Bus signal
535
self.PropertyChanged(dbus.String(u"host"),
536
dbus.String(self.host, variant_level=1))
537
538
# SetInterval - method
539
@dbus.service.method(_interface, in_signature="t")
540
def SetInterval(self, milliseconds):
541
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
542
# Emit D-Bus signal
543
self.PropertyChanged(dbus.String(u"interval"),
544
(dbus.UInt64(self.interval_milliseconds(),
545
variant_level=1)))
546
547
# SetSecret - method
548
@dbus.service.method(_interface, in_signature="ay",
549
byte_arrays=True)
550
def SetSecret(self, secret):
551
"D-Bus setter method"
552
self.secret = str(secret)
553
554
# SetTimeout - method
555
@dbus.service.method(_interface, in_signature="t")
556
def SetTimeout(self, milliseconds):
557
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
558
# Emit D-Bus signal
559
self.PropertyChanged(dbus.String(u"timeout"),
560
(dbus.UInt64(self.timeout_milliseconds(),
561
variant_level=1)))
562
563
# Enable - method
564
Enable = dbus.service.method(_interface)(enable)
565
Enable.__name__ = "Enable"
566
567
# StartChecker - method
568
@dbus.service.method(_interface)
569
def StartChecker(self):
570
"D-Bus method"
571
self.start_checker()
572
573
# Disable - method
574
@dbus.service.method(_interface)
575
def Disable(self):
576
"D-Bus method"
577
self.disable()
578
579
# StopChecker - method
580
StopChecker = dbus.service.method(_interface)(stop_checker)
581
StopChecker.__name__ = "StopChecker"
582
583
del _interface
584
378
585
379
586
380
def peer_certificate(session):
587
381
"Return the peer's OpenPGP certificate as a bytestring"
588
382
# If not an OpenPGP certificate...
589
if (gnutls.library.functions
590
.gnutls_certificate_type_get(session._c_object)
591
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
383
if gnutls.library.functions.gnutls_certificate_type_get\
384
(session._c_object) \
385
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
592
386
# ...do the normal thing
593
387
return session.peer_certificate
594
388
list_size = ctypes.c_uint()
595
cert_list = (gnutls.library.functions
596
.gnutls_certificate_get_peers
597
(session._c_object, ctypes.byref(list_size)))
389
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
390
(session._c_object, ctypes.byref(list_size))
598
391
if list_size.value == 0:
599
392
return None
600
393
cert = cert_list[0]
603
396
604
397
def fingerprint(openpgp):
605
398
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
606
# New GnuTLS "datum" with the OpenPGP public key
607
datum = (gnutls.library.types
608
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
609
ctypes.POINTER
610
(ctypes.c_ubyte)),
611
ctypes.c_uint(len(openpgp))))
612
399
# New empty GnuTLS certificate
613
400
crt = gnutls.library.types.gnutls_openpgp_crt_t()
614
(gnutls.library.functions
615
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
401
gnutls.library.functions.gnutls_openpgp_crt_init\
402
(ctypes.byref(crt))
403
# New GnuTLS "datum" with the OpenPGP public key
404
datum = gnutls.library.types.gnutls_datum_t\
405
(ctypes.cast(ctypes.c_char_p(openpgp),
406
ctypes.POINTER(ctypes.c_ubyte)),
407
ctypes.c_uint(len(openpgp)))
616
408
# Import the OpenPGP public key into the certificate
617
(gnutls.library.functions
618
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
619
gnutls.library.constants
620
.GNUTLS_OPENPGP_FMT_RAW))
621
# Verify the self signature in the key
622
crtverify = ctypes.c_uint()
623
(gnutls.library.functions
624
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
625
if crtverify.value != 0:
626
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
raise gnutls.errors.CertificateSecurityError("Verify failed")
409
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
410
(crt,
411
ctypes.byref(datum),
412
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
628
413
# New buffer for the fingerprint
629
buf = ctypes.create_string_buffer(20)
630
buf_len = ctypes.c_size_t()
414
buffer = ctypes.create_string_buffer(20)
415
buffer_length = ctypes.c_size_t()
631
416
# Get the fingerprint from the certificate into the buffer
632
(gnutls.library.functions
633
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
634
ctypes.byref(buf_len)))
417
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
418
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
635
419
# Deinit the certificate
636
420
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
637
421
# Convert the buffer to a Python bytestring
638
fpr = ctypes.string_at(buf, buf_len.value)
422
fpr = ctypes.string_at(buffer, buffer_length.value)
639
423
# Convert the bytestring to hexadecimal notation
640
424
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
641
425
return hex_fpr
642
426
643
427
644
class TCP_handler(SocketServer.BaseRequestHandler, object):
428
class tcp_handler(SocketServer.BaseRequestHandler, object):
645
429
"""A TCP request handler class.
646
430
Instantiated by IPv6_TCPServer for each request to handle it.
647
431
Note: This will run in its own forked process."""
648
432
649
433
def handle(self):
650
logger.info(u"TCP connection from: %s",
651
unicode(self.client_address))
652
session = (gnutls.connection
653
.ClientSession(self.request,
654
gnutls.connection
655
.X509Credentials()))
656
657
line = self.request.makefile().readline()
658
logger.debug(u"Protocol version: %r", line)
659
try:
660
if int(line.strip().split()[0]) > 1:
661
raise RuntimeError
662
except (ValueError, IndexError, RuntimeError), error:
663
logger.error(u"Unknown protocol version: %s", error)
664
return
665
434
logger.debug(u"TCP connection from: %s",
435
unicode(self.client_address))
436
session = gnutls.connection.ClientSession\
437
(self.request, gnutls.connection.X509Credentials())
666
438
# Note: gnutls.connection.X509Credentials is really a generic
667
439
# GnuTLS certificate credentials object so long as no X.509
668
440
# keys are added to it. Therefore, we can use it here despite
671
443
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
672
444
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
673
445
# "+DHE-DSS"))
674
# Use a fallback default, since this MUST be set.
675
priority = self.server.settings.get("priority", "NORMAL")
676
(gnutls.library.functions
677
.gnutls_priority_set_direct(session._c_object,
678
priority, None))
446
priority = "NORMAL" # Fallback default, since this
447
# MUST be set.
448
if self.server.settings["priority"]:
449
priority = self.server.settings["priority"]
450
gnutls.library.functions.gnutls_priority_set_direct\
451
(session._c_object, priority, None);
679
452
680
453
try:
681
454
session.handshake()
682
455
except gnutls.errors.GNUTLSError, error:
683
logger.warning(u"Handshake failed: %s", error)
456
logger.debug(u"Handshake failed: %s", error)
684
457
# Do not run session.bye() here: the session is not
685
458
# established. Just abandon the request.
686
459
return
687
460
try:
688
461
fpr = fingerprint(peer_certificate(session))
689
462
except (TypeError, gnutls.errors.GNUTLSError), error:
690
logger.warning(u"Bad certificate: %s", error)
463
logger.debug(u"Bad certificate: %s", error)
691
464
session.bye()
692
465
return
693
466
logger.debug(u"Fingerprint: %s", fpr)
467
client = None
694
468
for c in self.server.clients:
695
469
if c.fingerprint == fpr:
696
470
client = c
697
471
break
698
else:
699
logger.warning(u"Client not found for fingerprint: %s",
700
fpr)
472
if not client:
473
logger.debug(u"Client not found for fingerprint: %s", fpr)
701
474
session.bye()
702
475
return
703
476
# Have to check if client.still_valid(), since it is possible
704
477
# that the client timed out while establishing the GnuTLS
705
478
# session.
706
479
if not client.still_valid():
707
logger.warning(u"Client %(name)s is invalid",
708
vars(client))
480
logger.debug(u"Client %(name)s is invalid", vars(client))
709
481
session.bye()
710
482
return
711
## This won't work here, since we're in a fork.
712
# client.bump_timeout()
713
483
sent_size = 0
714
484
while sent_size < len(client.secret):
715
485
sent = session.send(client.secret[sent_size:])
720
490
session.bye()
721
491
722
492
723
class IPv6_TCPServer(SocketServer.ForkingMixIn,
724
SocketServer.TCPServer, object):
493
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
725
494
"""IPv6 TCP server. Accepts 'None' as address and/or port.
726
495
Attributes:
727
496
settings: Server settings
728
497
clients: Set() of Client objects
729
enabled: Boolean; whether this server is activated yet
730
498
"""
731
499
address_family = socket.AF_INET6
732
500
def __init__(self, *args, **kwargs):
736
504
if "clients" in kwargs:
737
505
self.clients = kwargs["clients"]
738
506
del kwargs["clients"]
739
self.enabled = False
740
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
507
return super(type(self), self).__init__(*args, **kwargs)
741
508
def server_bind(self):
742
509
"""This overrides the normal server_bind() function
743
510
to bind to an interface if one was specified, and also NOT to
751
518
self.settings["interface"])
752
519
except socket.error, error:
753
520
if error[0] == errno.EPERM:
754
logger.error(u"No permission to"
755
u" bind to interface %s",
756
self.settings["interface"])
521
logger.warning(u"No permission to"
522
u" bind to interface %s",
523
self.settings["interface"])
757
524
else:
758
525
raise error
759
526
# Only bind(2) the socket if we really need to.
762
529
in6addr_any = "::"
763
530
self.server_address = (in6addr_any,
764
531
self.server_address[1])
765
elif not self.server_address[1]:
532
elif self.server_address[1] is None:
766
533
self.server_address = (self.server_address[0],
767
534
0)
768
# if self.settings["interface"]:
769
# self.server_address = (self.server_address[0],
770
# 0, # port
771
# 0, # flowinfo
772
# if_nametoindex
773
# (self.settings
774
# ["interface"]))
775
return super(IPv6_TCPServer, self).server_bind()
776
def server_activate(self):
777
if self.enabled:
778
return super(IPv6_TCPServer, self).server_activate()
779
def enable(self):
780
self.enabled = True
535
return super(type(self), self).server_bind()
781
536
782
537
783
538
def string_to_delta(interval):
793
548
datetime.timedelta(1)
794
549
>>> string_to_delta(u'1w')
795
550
datetime.timedelta(7)
796
>>> string_to_delta('5m 30s')
797
datetime.timedelta(0, 330)
798
551
"""
799
timevalue = datetime.timedelta(0)
800
for s in interval.split():
801
try:
802
suffix = unicode(s[-1])
803
value = int(s[:-1])
804
if suffix == u"d":
805
delta = datetime.timedelta(value)
806
elif suffix == u"s":
807
delta = datetime.timedelta(0, value)
808
elif suffix == u"m":
809
delta = datetime.timedelta(0, 0, 0, 0, value)
810
elif suffix == u"h":
811
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
812
elif suffix == u"w":
813
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
814
else:
815
raise ValueError
816
except (ValueError, IndexError):
552
try:
553
suffix=unicode(interval[-1])
554
value=int(interval[:-1])
555
if suffix == u"d":
556
delta = datetime.timedelta(value)
557
elif suffix == u"s":
558
delta = datetime.timedelta(0, value)
559
elif suffix == u"m":
560
delta = datetime.timedelta(0, 0, 0, 0, value)
561
elif suffix == u"h":
562
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
563
elif suffix == u"w":
564
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
565
else:
817
566
raise ValueError
818
timevalue += delta
819
return timevalue
567
except (ValueError, IndexError):
568
raise ValueError
569
return delta
820
570
821
571
822
572
def server_state_changed(state):
823
573
"""Derived from the Avahi example code"""
824
574
if state == avahi.SERVER_COLLISION:
825
logger.error(u"Zeroconf server name collision")
575
logger.warning(u"Server name collision")
826
576
service.remove()
827
577
elif state == avahi.SERVER_RUNNING:
828
578
service.add()
830
580
831
581
def entry_group_state_changed(state, error):
832
582
"""Derived from the Avahi example code"""
833
logger.debug(u"Avahi state change: %i", state)
583
logger.debug(u"state change: %i", state)
834
584
835
585
if state == avahi.ENTRY_GROUP_ESTABLISHED:
836
logger.debug(u"Zeroconf service established.")
586
logger.debug(u"Service established.")
837
587
elif state == avahi.ENTRY_GROUP_COLLISION:
838
logger.warning(u"Zeroconf service name collision.")
588
logger.warning(u"Service name collision.")
839
589
service.rename()
840
590
elif state == avahi.ENTRY_GROUP_FAILURE:
841
logger.critical(u"Avahi: Error in group state changed %s",
591
logger.critical(u"Error in group state changed %s",
842
592
unicode(error))
843
raise AvahiGroupError(u"State changed: %s" % unicode(error))
593
raise AvahiGroupError("State changed: %s", str(error))
844
594
845
def if_nametoindex(interface):
595
def if_nametoindex(interface, _func=[None]):
846
596
"""Call the C function if_nametoindex(), or equivalent"""
847
global if_nametoindex
597
if _func[0] is not None:
598
return _func[0](interface)
848
599
try:
849
if_nametoindex = (ctypes.cdll.LoadLibrary
850
(ctypes.util.find_library("c"))
851
.if_nametoindex)
600
if "ctypes.util" not in sys.modules:
601
import ctypes.util
602
while True:
603
try:
604
libc = ctypes.cdll.LoadLibrary\
605
(ctypes.util.find_library("c"))
606
_func[0] = libc.if_nametoindex
607
return _func[0](interface)
608
except IOError, e:
609
if e != errno.EINTR:
610
raise
852
611
except (OSError, AttributeError):
853
612
if "struct" not in sys.modules:
854
613
import struct
855
614
if "fcntl" not in sys.modules:
856
615
import fcntl
857
def if_nametoindex(interface):
616
def the_hard_way(interface):
858
617
"Get an interface index the hard way, i.e. using fcntl()"
859
618
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
860
with closing(socket.socket()) as s:
861
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
862
struct.pack("16s16x", interface))
619
s = socket.socket()
620
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
621
struct.pack("16s16x", interface))
622
s.close()
863
623
interface_index = struct.unpack("I", ifreq[16:20])[0]
864
624
return interface_index
865
return if_nametoindex(interface)
866
867
868
def daemon(nochdir = False, noclose = False):
625
_func[0] = the_hard_way
626
return _func[0](interface)
627
628
629
def daemon(nochdir, noclose):
869
630
"""See daemon(3). Standard BSD Unix function.
870
631
This should really exist as os.daemon, but it doesn't (yet)."""
871
632
if os.fork():
873
634
os.setsid()
874
635
if not nochdir:
875
636
os.chdir("/")
876
if os.fork():
877
sys.exit()
878
637
if not noclose:
879
638
# Close all standard open file descriptors
880
639
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
889
648
890
649
891
650
def main():
892
parser = OptionParser(version = "%%prog %s" % version)
651
global main_loop_started
652
main_loop_started = False
653
654
parser = OptionParser()
893
655
parser.add_option("-i", "--interface", type="string",
894
656
metavar="IF", help="Bind to interface IF")
895
657
parser.add_option("-a", "--address", type="string",
896
658
help="Address to listen for requests on")
897
659
parser.add_option("-p", "--port", type="int",
898
660
help="Port number to receive requests on")
899
parser.add_option("--check", action="store_true",
661
parser.add_option("--check", action="store_true", default=False,
900
662
help="Run self-test")
901
parser.add_option("--debug", action="store_true",
663
parser.add_option("--debug", action="store_true", default=False,
902
664
help="Debug mode; run in foreground and log to"
903
665
" terminal")
904
666
parser.add_option("--priority", type="string", help="GnuTLS"
909
671
default="/etc/mandos", metavar="DIR",
910
672
help="Directory to search for configuration"
911
673
" files")
912
parser.add_option("--no-dbus", action="store_false",
913
dest="use_dbus",
914
help="Do not provide D-Bus system bus"
915
" interface")
916
options = parser.parse_args()[0]
674
(options, args) = parser.parse_args()
917
675
918
676
if options.check:
919
677
import doctest
928
686
"priority":
929
687
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
930
688
"servicename": "Mandos",
931
"use_dbus": "True",
932
689
}
933
690
934
691
# Parse config file for server-global settings
935
692
server_config = ConfigParser.SafeConfigParser(server_defaults)
936
693
del server_defaults
937
server_config.read(os.path.join(options.configdir, "mandos.conf"))
694
server_config.read(os.path.join(options.configdir, "server.conf"))
695
server_section = "server"
938
696
# Convert the SafeConfigParser object to a dict
939
server_settings = server_config.defaults()
940
# Use getboolean on the boolean config options
941
server_settings["debug"] = (server_config.getboolean
942
("DEFAULT", "debug"))
943
server_settings["use_dbus"] = (server_config.getboolean
944
("DEFAULT", "use_dbus"))
697
server_settings = dict(server_config.items(server_section))
698
# Use getboolean on the boolean config option
699
server_settings["debug"] = server_config.getboolean\
700
(server_section, "debug")
945
701
del server_config
946
702
947
703
# Override the settings from the config file with command line
948
704
# options, if set.
949
705
for option in ("interface", "address", "port", "debug",
950
"priority", "servicename", "configdir",
951
"use_dbus"):
706
"priority", "servicename", "configdir"):
952
707
value = getattr(options, option)
953
708
if value is not None:
954
709
server_settings[option] = value
955
710
del options
956
711
# Now we have our good server settings in "server_settings"
957
712
958
# For convenience
959
debug = server_settings["debug"]
960
use_dbus = server_settings["use_dbus"]
961
962
if not debug:
963
syslogger.setLevel(logging.WARNING)
964
console.setLevel(logging.WARNING)
965
966
if server_settings["servicename"] != "Mandos":
967
syslogger.setFormatter(logging.Formatter
968
('Mandos (%s): %%(levelname)s:'
969
' %%(message)s'
970
% server_settings["servicename"]))
971
972
713
# Parse config file with clients
973
714
client_defaults = { "timeout": "1h",
974
715
"interval": "5m",
975
"checker": "fping -q -- %(host)s",
976
"host": "",
716
"checker": "fping -q -- %%(fqdn)s",
977
717
}
978
718
client_config = ConfigParser.SafeConfigParser(client_defaults)
979
719
client_config.read(os.path.join(server_settings["configdir"],
980
720
"clients.conf"))
981
721
982
clients = Set()
983
tcp_server = IPv6_TCPServer((server_settings["address"],
984
server_settings["port"]),
985
TCP_handler,
986
settings=server_settings,
987
clients=clients)
988
pidfilename = "/var/run/mandos.pid"
989
try:
990
pidfile = open(pidfilename, "w")
991
except IOError, error:
992
logger.error("Could not open file %r", pidfilename)
993
994
try:
995
uid = pwd.getpwnam("_mandos").pw_uid
996
except KeyError:
997
try:
998
uid = pwd.getpwnam("mandos").pw_uid
999
except KeyError:
1000
try:
1001
uid = pwd.getpwnam("nobody").pw_uid
1002
except KeyError:
1003
uid = 65534
1004
try:
1005
gid = pwd.getpwnam("_mandos").pw_gid
1006
except KeyError:
1007
try:
1008
gid = pwd.getpwnam("mandos").pw_gid
1009
except KeyError:
1010
try:
1011
gid = pwd.getpwnam("nogroup").pw_gid
1012
except KeyError:
1013
gid = 65534
1014
try:
1015
os.setuid(uid)
1016
os.setgid(gid)
1017
except OSError, error:
1018
if error[0] != errno.EPERM:
1019
raise error
1020
1021
722
global service
1022
723
service = AvahiService(name = server_settings["servicename"],
1023
servicetype = "_mandos._tcp", )
724
type = "_mandos._tcp", );
1024
725
if server_settings["interface"]:
1025
service.interface = (if_nametoindex
1026
(server_settings["interface"]))
726
service.interface = if_nametoindex(server_settings["interface"])
1027
727
1028
728
global main_loop
1029
729
global bus
1032
732
DBusGMainLoop(set_as_default=True )
1033
733
main_loop = gobject.MainLoop()
1034
734
bus = dbus.SystemBus()
1035
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1036
avahi.DBUS_PATH_SERVER),
1037
avahi.DBUS_INTERFACE_SERVER)
735
server = dbus.Interface(
736
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
737
avahi.DBUS_INTERFACE_SERVER )
1038
738
# End of Avahi example code
1039
if use_dbus:
1040
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos",
1041
bus)
1042
1043
clients.update(Set(Client(name = section,
1044
config
1045
= dict(client_config.items(section)),
1046
use_dbus = use_dbus)
739
740
debug = server_settings["debug"]
741
742
if debug:
743
console = logging.StreamHandler()
744
# console.setLevel(logging.DEBUG)
745
console.setFormatter(logging.Formatter\
746
('%(levelname)s: %(message)s'))
747
logger.addHandler(console)
748
del console
749
750
clients = Set()
751
def remove_from_clients(client):
752
clients.remove(client)
753
if not clients:
754
logger.debug(u"No clients left, exiting")
755
sys.exit()
756
757
clients.update(Set(Client(name=section,
758
stop_hook = remove_from_clients,
759
**(dict(client_config\
760
.items(section))))
1047
761
for section in client_config.sections()))
1048
if not clients:
1049
logger.warning(u"No clients defined")
1050
1051
if debug:
1052
# Redirect stdin so all checkers get /dev/null
1053
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1054
os.dup2(null, sys.stdin.fileno())
1055
if null > 2:
1056
os.close(null)
1057
else:
1058
# No console logging
1059
logger.removeHandler(console)
1060
# Close all input and output, do double fork, etc.
1061
daemon()
1062
1063
try:
1064
pid = os.getpid()
1065
pidfile.write(str(pid) + "\n")
1066
pidfile.close()
1067
del pidfile
1068
except IOError:
1069
logger.error(u"Could not write to file %r with PID %d",
1070
pidfilename, pid)
1071
except NameError:
1072
# "pidfile" was never created
1073
pass
1074
del pidfilename
762
763
if not debug:
764
daemon(False, False)
1075
765
1076
766
def cleanup():
1077
767
"Cleanup function; run on exit"
1084
774
1085
775
while clients:
1086
776
client = clients.pop()
1087
client.disable_hook = None
1088
client.disable()
777
client.stop_hook = None
778
client.stop()
1089
779
1090
780
atexit.register(cleanup)
1091
781
1094
784
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1095
785
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1096
786
1097
if use_dbus:
1098
class MandosServer(dbus.service.Object):
1099
"""A D-Bus proxy object"""
1100
def __init__(self):
1101
dbus.service.Object.__init__(self, bus,
1102
"/Mandos")
1103
_interface = u"org.mandos_system.Mandos"
1104
1105
@dbus.service.signal(_interface, signature="oa{sv}")
1106
def ClientAdded(self, objpath, properties):
1107
"D-Bus signal"
1108
pass
1109
1110
@dbus.service.signal(_interface, signature="o")
1111
def ClientRemoved(self, objpath):
1112
"D-Bus signal"
1113
pass
1114
1115
@dbus.service.method(_interface, out_signature="ao")
1116
def GetAllClients(self):
1117
return dbus.Array(c.dbus_object_path for c in clients)
1118
1119
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1120
def GetAllClientsWithProperties(self):
1121
return dbus.Dictionary(
1122
((c.dbus_object_path, c.GetAllProperties())
1123
for c in clients),
1124
signature="oa{sv}")
1125
1126
@dbus.service.method(_interface, in_signature="o")
1127
def RemoveClient(self, object_path):
1128
for c in clients:
1129
if c.dbus_object_path == object_path:
1130
clients.remove(c)
1131
# Don't signal anything except ClientRemoved
1132
c.use_dbus = False
1133
c.disable()
1134
# Emit D-Bus signal
1135
self.ClientRemoved(object_path)
1136
return
1137
raise KeyError
1138
@dbus.service.method(_interface)
1139
def Quit(self):
1140
main_loop.quit()
1141
1142
del _interface
1143
1144
mandos_server = MandosServer()
1145
1146
787
for client in clients:
1147
if use_dbus:
1148
# Emit D-Bus signal
1149
mandos_server.ClientAdded(client.dbus_object_path,
1150
client.GetAllProperties())
1151
client.enable()
1152
1153
tcp_server.enable()
1154
tcp_server.server_activate()
1155
788
client.start()
789
790
tcp_server = IPv6_TCPServer((server_settings["address"],
791
server_settings["port"]),
792
tcp_handler,
793
settings=server_settings,
794
clients=clients)
1156
795
# Find out what port we got
1157
796
service.port = tcp_server.socket.getsockname()[1]
1158
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1159
u" scope_id %d" % tcp_server.socket.getsockname())
797
logger.debug(u"Now listening on address %r, port %d, flowinfo %d,"
798
u" scope_id %d" % tcp_server.socket.getsockname())
1160
799
1161
800
#service.interface = tcp_server.socket.getsockname()[3]
1162
801
1172
811
1173
812
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1174
813
lambda *args, **kwargs:
1175
(tcp_server.handle_request
1176
(*args[2:], **kwargs) or True))
814
tcp_server.handle_request\
815
(*args[2:], **kwargs) or True)
1177
816
1178
logger.debug(u"Starting main loop")
817
logger.debug("Starting main loop")
818
main_loop_started = True
1179
819
main_loop.run()
1180
820
except AvahiError, error:
1181
logger.critical(u"AvahiError: %s", error)
821
logger.critical(u"AvahiError: %s" + unicode(error))
1182
822
sys.exit(1)
1183
823
except KeyboardInterrupt:
1184
824
if debug:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0