To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 46
- compare with another revision
- download diff
- download tarball
- view history from revision 46
- Committer: Teddy Hogeborn
- Date: 2008-08-04 23:38:26 UTC
- mfrom: (24.1.20 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080804233826-idy7v8x36llseue0
* network-protocol.txt: New.
* server.py (daemon): Do the double fork thing.
* server.py (daemon): Do the double fork thing.
- files added:
- network-protocol.txt
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos.conf => server.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
server.py
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008 Teddy Hogeborn
15
# Copyright © 2008 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
# GNU General Public License for more details.
26
25
#
27
26
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
30
28
#
31
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
30
#
33
31
34
from __future__ import division, with_statement, absolute_import
32
from __future__ import division
35
33
36
34
import SocketServer
37
35
import socket
36
import select
38
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
import pwd
59
from contextlib import closing
60
57
61
58
import dbus
62
import dbus.service
63
59
import gobject
64
60
import avahi
65
61
from dbus.mainloop.glib import DBusGMainLoop
66
62
import ctypes
67
import ctypes.util
68
63
69
version = "1.0.2"
70
64
71
65
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
66
syslogger = logging.handlers.SysLogHandler\
67
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
68
syslogger.setFormatter(logging.Formatter\
69
('%(levelname)s: %(message)s'))
77
70
logger.addHandler(syslogger)
71
del syslogger
78
72
79
console = logging.StreamHandler()
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
82
logger.addHandler(console)
83
73
84
74
class AvahiError(Exception):
85
75
def __init__(self, value):
86
76
self.value = value
87
super(AvahiError, self).__init__()
88
77
def __str__(self):
89
78
return repr(self.value)
90
79
112
101
a sensible number of times
113
102
"""
114
103
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
104
type = None, port = None, TXT = None, domain = "",
105
host = "", max_renames = 12):
117
106
self.interface = interface
118
107
self.name = name
119
self.type = servicetype
108
self.type = type
120
109
self.port = port
121
self.TXT = TXT if TXT is not None else []
110
if TXT is None:
111
self.TXT = []
112
else:
113
self.TXT = TXT
122
114
self.domain = domain
123
115
self.host = host
124
116
self.rename_count = 0
125
self.max_renames = max_renames
126
117
def rename(self):
127
118
"""Derived from the Avahi example code"""
128
119
if self.rename_count >= self.max_renames:
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
120
logger.critical(u"No suitable service name found after %i"
121
u" retries, exiting.", rename_count)
132
122
raise AvahiServiceError("Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
123
name = server.GetAlternativeServiceName(name)
124
logger.error(u"Changing name to %r ...", name)
139
125
self.remove()
140
126
self.add()
141
127
self.rename_count += 1
147
133
"""Derived from the Avahi example code"""
148
134
global group
149
135
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
136
group = dbus.Interface\
137
(bus.get_object(avahi.DBUS_NAME,
152
138
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
139
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
140
group.connect_to_signal('StateChanged',
155
141
entry_group_state_changed)
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
142
logger.debug(u"Adding service '%s' of type '%s' ...",
157
143
service.name, service.type)
158
144
group.AddService(
159
145
self.interface, # interface
170
156
# End of Avahi example code
171
157
172
158
173
class Client(dbus.service.Object):
159
class Client(object):
174
160
"""A representation of a client host served by this server.
175
161
Attributes:
176
162
name: string; from the config file, used in log messages
177
163
fingerprint: string (40 or 32 hexadecimal digits); used to
178
164
uniquely identify the client
179
165
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); (UTC) object creation
182
started: datetime.datetime(); (UTC) last started
183
last_checked_ok: datetime.datetime(); (UTC) or None
166
fqdn: string (FQDN); available for use by the checker command
167
created: datetime.datetime(); object creation, not client host
168
last_checked_ok: datetime.datetime() or None if not yet checked OK
184
169
timeout: datetime.timedelta(); How long from last_checked_ok
185
170
until this client is invalid
186
171
interval: datetime.timedelta(); How often to start a new checker
202
187
_interval_milliseconds: - '' -
203
188
"""
204
189
def _set_timeout(self, timeout):
205
"Setter function for the 'timeout' attribute"
190
"Setter function for 'timeout' attribute"
206
191
self._timeout = timeout
207
192
self._timeout_milliseconds = ((self.timeout.days
208
193
* 24 * 60 * 60 * 1000)
209
194
+ (self.timeout.seconds * 1000)
210
195
+ (self.timeout.microseconds
211
196
// 1000))
212
# Emit D-Bus signal
213
self.TimeoutChanged(self._timeout_milliseconds)
214
timeout = property(lambda self: self._timeout, _set_timeout)
197
timeout = property(lambda self: self._timeout,
198
_set_timeout)
215
199
del _set_timeout
216
217
200
def _set_interval(self, interval):
218
"Setter function for the 'interval' attribute"
201
"Setter function for 'interval' attribute"
219
202
self._interval = interval
220
203
self._interval_milliseconds = ((self.interval.days
221
204
* 24 * 60 * 60 * 1000)
223
206
* 1000)
224
207
+ (self.interval.microseconds
225
208
// 1000))
226
# Emit D-Bus signal
227
self.IntervalChanged(self._interval_milliseconds)
228
interval = property(lambda self: self._interval, _set_interval)
209
interval = property(lambda self: self._interval,
210
_set_interval)
229
211
del _set_interval
230
231
def __init__(self, name = None, stop_hook=None, config=None):
212
def __init__(self, name = None, stop_hook=None, config={}):
232
213
"""Note: the 'checker' key in 'config' sets the
233
214
'checker_command' attribute and *not* the 'checker'
234
215
attribute."""
235
dbus.service.Object.__init__(self, bus,
236
"/Mandos/clients/%s"
237
% name.replace(".", "_"))
238
if config is None:
239
config = {}
240
216
self.name = name
241
217
logger.debug(u"Creating client %r", self.name)
242
218
# Uppercase and remove spaces from fingerprint for later
243
219
# comparison purposes with return value from the fingerprint()
244
220
# function
245
self.fingerprint = (config["fingerprint"].upper()
246
.replace(u" ", u""))
221
self.fingerprint = config["fingerprint"].upper()\
222
.replace(u" ", u"")
247
223
logger.debug(u" Fingerprint: %s", self.fingerprint)
248
224
if "secret" in config:
249
225
self.secret = config["secret"].decode(u"base64")
250
226
elif "secfile" in config:
251
with closing(open(os.path.expanduser
252
(os.path.expandvars
253
(config["secfile"])))) as secfile:
254
self.secret = secfile.read()
227
sf = open(config["secfile"])
228
self.secret = sf.read()
229
sf.close()
255
230
else:
256
231
raise TypeError(u"No secret or secfile for client %s"
257
232
% self.name)
258
self.host = config.get("host", "")
259
self.created = datetime.datetime.utcnow()
260
self.started = None
233
self.fqdn = config.get("fqdn", "")
234
self.created = datetime.datetime.now()
261
235
self.last_checked_ok = None
262
236
self.timeout = string_to_delta(config["timeout"])
263
237
self.interval = string_to_delta(config["interval"])
267
241
self.stop_initiator_tag = None
268
242
self.checker_callback_tag = None
269
243
self.check_command = config["checker"]
270
271
244
def start(self):
272
245
"""Start this client's checker and timeout hooks"""
273
self.started = datetime.datetime.utcnow()
274
246
# Schedule a new checker to be started an 'interval' from now,
275
247
# and every interval from then on.
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self._interval_milliseconds,
278
self.start_checker))
248
self.checker_initiator_tag = gobject.timeout_add\
249
(self._interval_milliseconds,
250
self.start_checker)
279
251
# Also start a new checker *right now*.
280
252
self.start_checker()
281
253
# Schedule a stop() when 'timeout' has passed
282
self.stop_initiator_tag = (gobject.timeout_add
283
(self._timeout_milliseconds,
284
self.stop))
285
# Emit D-Bus signal
286
self.StateChanged(True)
287
254
self.stop_initiator_tag = gobject.timeout_add\
255
(self._timeout_milliseconds,
256
self.stop)
288
257
def stop(self):
289
"""Stop this client."""
290
if getattr(self, "started", None) is not None:
258
"""Stop this client.
259
The possibility that a client might be restarted is left open,
260
but not currently used."""
261
# If this client doesn't have a secret, it is already stopped.
262
if self.secret:
291
263
logger.info(u"Stopping client %s", self.name)
264
self.secret = None
292
265
else:
293
266
return False
294
267
if getattr(self, "stop_initiator_tag", False):
300
273
self.stop_checker()
301
274
if self.stop_hook:
302
275
self.stop_hook(self)
303
self.started = None
304
# Emit D-Bus signal
305
self.StateChanged(False)
306
276
# Do not run this again if called by a gobject.timeout_add
307
277
return False
308
309
278
def __del__(self):
310
279
self.stop_hook = None
311
280
self.stop()
312
313
281
def checker_callback(self, pid, condition):
314
282
"""The checker has completed, so take appropriate actions."""
283
now = datetime.datetime.now()
315
284
self.checker_callback_tag = None
316
285
self.checker = None
317
if (os.WIFEXITED(condition)
318
and (os.WEXITSTATUS(condition) == 0)):
286
if os.WIFEXITED(condition) \
287
and (os.WEXITSTATUS(condition) == 0):
319
288
logger.info(u"Checker for %(name)s succeeded",
320
289
vars(self))
321
# Emit D-Bus signal
322
self.CheckerCompleted(True)
323
self.bump_timeout()
290
self.last_checked_ok = now
291
gobject.source_remove(self.stop_initiator_tag)
292
self.stop_initiator_tag = gobject.timeout_add\
293
(self._timeout_milliseconds,
294
self.stop)
324
295
elif not os.WIFEXITED(condition):
325
296
logger.warning(u"Checker for %(name)s crashed?",
326
297
vars(self))
327
# Emit D-Bus signal
328
self.CheckerCompleted(False)
329
298
else:
330
299
logger.info(u"Checker for %(name)s failed",
331
300
vars(self))
332
# Emit D-Bus signal
333
self.CheckerCompleted(False)
334
335
def bump_timeout(self):
336
"""Bump up the timeout for this client.
337
This should only be called when the client has been seen,
338
alive and well.
339
"""
340
self.last_checked_ok = datetime.datetime.utcnow()
341
gobject.source_remove(self.stop_initiator_tag)
342
self.stop_initiator_tag = (gobject.timeout_add
343
(self._timeout_milliseconds,
344
self.stop))
345
346
301
def start_checker(self):
347
302
"""Start a new checker subprocess if one is not running.
348
303
If a checker already exists, leave it running and do
358
313
if self.checker is None:
359
314
try:
360
315
# In case check_command has exactly one % operator
361
command = self.check_command % self.host
316
command = self.check_command % self.fqdn
362
317
except TypeError:
363
318
# Escape attributes for the shell
364
319
escaped_attrs = dict((key, re.escape(str(val)))
373
328
try:
374
329
logger.info(u"Starting checker %r for %s",
375
330
command, self.name)
376
# We don't need to redirect stdout and stderr, since
377
# in normal mode, that is already done by daemon(),
378
# and in debug mode we don't want to. (Stdin is
379
# always replaced by /dev/null.)
380
331
self.checker = subprocess.Popen(command,
381
332
close_fds=True,
382
333
shell=True, cwd="/")
383
self.checker_callback_tag = (gobject.child_watch_add
384
(self.checker.pid,
385
self.checker_callback))
386
# Emit D-Bus signal
387
self.CheckerStarted(command)
388
except OSError, error:
334
self.checker_callback_tag = gobject.child_watch_add\
335
(self.checker.pid,
336
self.checker_callback)
337
except subprocess.OSError, error:
389
338
logger.error(u"Failed to start subprocess: %s",
390
339
error)
391
340
# Re-run this periodically if run by gobject.timeout_add
392
341
return True
393
394
342
def stop_checker(self):
395
343
"""Force the checker process, if any, to stop."""
396
344
if self.checker_callback_tag:
398
346
self.checker_callback_tag = None
399
347
if getattr(self, "checker", None) is None:
400
348
return
401
logger.debug(u"Stopping checker for %(name)s", vars(self))
349
logger.debug("Stopping checker for %(name)s", vars(self))
402
350
try:
403
351
os.kill(self.checker.pid, signal.SIGTERM)
404
352
#os.sleep(0.5)
408
356
if error.errno != errno.ESRCH: # No such process
409
357
raise
410
358
self.checker = None
411
412
359
def still_valid(self):
413
360
"""Has the timeout not yet passed for this client?"""
414
if not self.started:
415
return False
416
now = datetime.datetime.utcnow()
361
now = datetime.datetime.now()
417
362
if self.last_checked_ok is None:
418
363
return now < (self.created + self.timeout)
419
364
else:
420
365
return now < (self.last_checked_ok + self.timeout)
421
422
## D-Bus methods & signals
423
_interface = u"org.mandos_system.Mandos.Client"
424
425
def _datetime_to_dbus_struct(dt):
426
return dbus.Struct(dt.year, dt.month, dt.day, dt.hour,
427
dt.minute, dt.second, dt.microsecond,
428
signature="nyyyyyu")
429
430
# BumpTimeout - method
431
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
432
BumpTimeout.__name__ = "BumpTimeout"
433
434
# IntervalChanged - signal
435
@dbus.service.signal(_interface, signature="t")
436
def IntervalChanged(self, t):
437
"D-Bus signal"
438
pass
439
440
# CheckerCompleted - signal
441
@dbus.service.signal(_interface, signature="b")
442
def CheckerCompleted(self, success):
443
"D-Bus signal"
444
pass
445
446
# CheckerIsRunning - method
447
@dbus.service.method(_interface, out_signature="b")
448
def CheckerIsRunning(self):
449
"D-Bus getter method"
450
return self.checker is not None
451
452
# CheckerStarted - signal
453
@dbus.service.signal(_interface, signature="s")
454
def CheckerStarted(self, command):
455
"D-Bus signal"
456
pass
457
458
# GetChecker - method
459
@dbus.service.method(_interface, out_signature="s")
460
def GetChecker(self):
461
"D-Bus getter method"
462
return self.checker_command
463
464
# GetCreated - method
465
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
466
def GetCreated(self):
467
"D-Bus getter method"
468
return datetime_to_dbus_struct(self.created)
469
470
# GetFingerprint - method
471
@dbus.service.method(_interface, out_signature="s")
472
def GetFingerprint(self):
473
"D-Bus getter method"
474
return self.fingerprint
475
476
# GetHost - method
477
@dbus.service.method(_interface, out_signature="s")
478
def GetHost(self):
479
"D-Bus getter method"
480
return self.host
481
482
# GetInterval - method
483
@dbus.service.method(_interface, out_signature="t")
484
def GetInterval(self):
485
"D-Bus getter method"
486
return self._interval_milliseconds
487
488
# GetName - method
489
@dbus.service.method(_interface, out_signature="s")
490
def GetName(self):
491
"D-Bus getter method"
492
return self.name
493
494
# GetStarted - method
495
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
496
def GetStarted(self):
497
"D-Bus getter method"
498
if self.started is not None:
499
return datetime_to_dbus_struct(self.started)
500
else:
501
return dbus.Struct(0, 0, 0, 0, 0, 0, 0,
502
signature="nyyyyyu")
503
504
# GetTimeout - method
505
@dbus.service.method(_interface, out_signature="t")
506
def GetTimeout(self):
507
"D-Bus getter method"
508
return self._timeout_milliseconds
509
510
# SetChecker - method
511
@dbus.service.method(_interface, in_signature="s")
512
def SetChecker(self, checker):
513
"D-Bus setter method"
514
self.checker_command = checker
515
516
# SetHost - method
517
@dbus.service.method(_interface, in_signature="s")
518
def SetHost(self, host):
519
"D-Bus setter method"
520
self.host = host
521
522
# SetInterval - method
523
@dbus.service.method(_interface, in_signature="t")
524
def SetInterval(self, milliseconds):
525
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
526
527
# SetTimeout - method
528
@dbus.service.method(_interface, in_signature="t")
529
def SetTimeout(self, milliseconds):
530
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
531
532
# SetSecret - method
533
@dbus.service.method(_interface, in_signature="ay",
534
byte_arrays=True)
535
def SetSecret(self, secret):
536
"D-Bus setter method"
537
self.secret = str(secret)
538
539
# Start - method
540
Start = dbus.service.method(_interface)(start)
541
Start.__name__ = "Start"
542
543
# StartChecker - method
544
StartChecker = dbus.service.method(_interface)(start_checker)
545
StartChecker.__name__ = "StartChecker"
546
547
# StateChanged - signal
548
@dbus.service.signal(_interface, signature="b")
549
def StateChanged(self, started):
550
"D-Bus signal"
551
pass
552
553
# StillValid - method
554
StillValid = (dbus.service.method(_interface, out_signature="b")
555
(still_valid))
556
StillValid.__name__ = "StillValid"
557
558
# Stop - method
559
Stop = dbus.service.method(_interface)(stop)
560
Stop.__name__ = "Stop"
561
562
# StopChecker - method
563
StopChecker = dbus.service.method(_interface)(stop_checker)
564
StopChecker.__name__ = "StopChecker"
565
566
# TimeoutChanged - signal
567
@dbus.service.signal(_interface, signature="t")
568
def TimeoutChanged(self, t):
569
"D-Bus signal"
570
pass
571
572
del _datetime_to_dbus_struct
573
del _interface
574
366
575
367
576
368
def peer_certificate(session):
577
369
"Return the peer's OpenPGP certificate as a bytestring"
578
370
# If not an OpenPGP certificate...
579
if (gnutls.library.functions
580
.gnutls_certificate_type_get(session._c_object)
581
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
371
if gnutls.library.functions.gnutls_certificate_type_get\
372
(session._c_object) \
373
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
582
374
# ...do the normal thing
583
375
return session.peer_certificate
584
376
list_size = ctypes.c_uint()
585
cert_list = (gnutls.library.functions
586
.gnutls_certificate_get_peers
587
(session._c_object, ctypes.byref(list_size)))
377
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
378
(session._c_object, ctypes.byref(list_size))
588
379
if list_size.value == 0:
589
380
return None
590
381
cert = cert_list[0]
594
385
def fingerprint(openpgp):
595
386
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
596
387
# New GnuTLS "datum" with the OpenPGP public key
597
datum = (gnutls.library.types
598
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
599
ctypes.POINTER
600
(ctypes.c_ubyte)),
601
ctypes.c_uint(len(openpgp))))
388
datum = gnutls.library.types.gnutls_datum_t\
389
(ctypes.cast(ctypes.c_char_p(openpgp),
390
ctypes.POINTER(ctypes.c_ubyte)),
391
ctypes.c_uint(len(openpgp)))
602
392
# New empty GnuTLS certificate
603
393
crt = gnutls.library.types.gnutls_openpgp_crt_t()
604
(gnutls.library.functions
605
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
394
gnutls.library.functions.gnutls_openpgp_crt_init\
395
(ctypes.byref(crt))
606
396
# Import the OpenPGP public key into the certificate
607
(gnutls.library.functions
608
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
609
gnutls.library.constants
610
.GNUTLS_OPENPGP_FMT_RAW))
611
# Verify the self signature in the key
612
crtverify = ctypes.c_uint()
613
(gnutls.library.functions
614
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
615
if crtverify.value != 0:
616
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
617
raise gnutls.errors.CertificateSecurityError("Verify failed")
397
gnutls.library.functions.gnutls_openpgp_crt_import\
398
(crt, ctypes.byref(datum),
399
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
618
400
# New buffer for the fingerprint
619
buf = ctypes.create_string_buffer(20)
620
buf_len = ctypes.c_size_t()
401
buffer = ctypes.create_string_buffer(20)
402
buffer_length = ctypes.c_size_t()
621
403
# Get the fingerprint from the certificate into the buffer
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
624
ctypes.byref(buf_len)))
404
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
405
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
625
406
# Deinit the certificate
626
407
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
408
# Convert the buffer to a Python bytestring
628
fpr = ctypes.string_at(buf, buf_len.value)
409
fpr = ctypes.string_at(buffer, buffer_length.value)
629
410
# Convert the bytestring to hexadecimal notation
630
411
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
631
412
return hex_fpr
632
413
633
414
634
class TCP_handler(SocketServer.BaseRequestHandler, object):
415
class tcp_handler(SocketServer.BaseRequestHandler, object):
635
416
"""A TCP request handler class.
636
417
Instantiated by IPv6_TCPServer for each request to handle it.
637
418
Note: This will run in its own forked process."""
638
419
639
420
def handle(self):
640
421
logger.info(u"TCP connection from: %s",
641
unicode(self.client_address))
642
session = (gnutls.connection
643
.ClientSession(self.request,
644
gnutls.connection
645
.X509Credentials()))
422
unicode(self.client_address))
423
session = gnutls.connection.ClientSession\
424
(self.request, gnutls.connection.X509Credentials())
646
425
647
426
line = self.request.makefile().readline()
648
427
logger.debug(u"Protocol version: %r", line)
661
440
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
662
441
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
663
442
# "+DHE-DSS"))
664
# Use a fallback default, since this MUST be set.
665
priority = self.server.settings.get("priority", "NORMAL")
666
(gnutls.library.functions
667
.gnutls_priority_set_direct(session._c_object,
668
priority, None))
443
priority = "NORMAL" # Fallback default, since this
444
# MUST be set.
445
if self.server.settings["priority"]:
446
priority = self.server.settings["priority"]
447
gnutls.library.functions.gnutls_priority_set_direct\
448
(session._c_object, priority, None);
669
449
670
450
try:
671
451
session.handshake()
681
461
session.bye()
682
462
return
683
463
logger.debug(u"Fingerprint: %s", fpr)
464
client = None
684
465
for c in self.server.clients:
685
466
if c.fingerprint == fpr:
686
467
client = c
687
468
break
688
else:
469
if not client:
689
470
logger.warning(u"Client not found for fingerprint: %s",
690
471
fpr)
691
472
session.bye()
698
479
vars(client))
699
480
session.bye()
700
481
return
701
## This won't work here, since we're in a fork.
702
# client.bump_timeout()
703
482
sent_size = 0
704
483
while sent_size < len(client.secret):
705
484
sent = session.send(client.secret[sent_size:])
710
489
session.bye()
711
490
712
491
713
class IPv6_TCPServer(SocketServer.ForkingMixIn,
714
SocketServer.TCPServer, object):
492
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
715
493
"""IPv6 TCP server. Accepts 'None' as address and/or port.
716
494
Attributes:
717
495
settings: Server settings
718
496
clients: Set() of Client objects
719
enabled: Boolean; whether this server is activated yet
720
497
"""
721
498
address_family = socket.AF_INET6
722
499
def __init__(self, *args, **kwargs):
726
503
if "clients" in kwargs:
727
504
self.clients = kwargs["clients"]
728
505
del kwargs["clients"]
729
self.enabled = False
730
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
506
return super(type(self), self).__init__(*args, **kwargs)
731
507
def server_bind(self):
732
508
"""This overrides the normal server_bind() function
733
509
to bind to an interface if one was specified, and also NOT to
752
528
in6addr_any = "::"
753
529
self.server_address = (in6addr_any,
754
530
self.server_address[1])
755
elif not self.server_address[1]:
531
elif self.server_address[1] is None:
756
532
self.server_address = (self.server_address[0],
757
533
0)
758
# if self.settings["interface"]:
759
# self.server_address = (self.server_address[0],
760
# 0, # port
761
# 0, # flowinfo
762
# if_nametoindex
763
# (self.settings
764
# ["interface"]))
765
return super(IPv6_TCPServer, self).server_bind()
766
def server_activate(self):
767
if self.enabled:
768
return super(IPv6_TCPServer, self).server_activate()
769
def enable(self):
770
self.enabled = True
534
return super(type(self), self).server_bind()
771
535
772
536
773
537
def string_to_delta(interval):
783
547
datetime.timedelta(1)
784
548
>>> string_to_delta(u'1w')
785
549
datetime.timedelta(7)
786
>>> string_to_delta('5m 30s')
787
datetime.timedelta(0, 330)
788
550
"""
789
timevalue = datetime.timedelta(0)
790
for s in interval.split():
791
try:
792
suffix = unicode(s[-1])
793
value = int(s[:-1])
794
if suffix == u"d":
795
delta = datetime.timedelta(value)
796
elif suffix == u"s":
797
delta = datetime.timedelta(0, value)
798
elif suffix == u"m":
799
delta = datetime.timedelta(0, 0, 0, 0, value)
800
elif suffix == u"h":
801
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
802
elif suffix == u"w":
803
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
804
else:
805
raise ValueError
806
except (ValueError, IndexError):
551
try:
552
suffix=unicode(interval[-1])
553
value=int(interval[:-1])
554
if suffix == u"d":
555
delta = datetime.timedelta(value)
556
elif suffix == u"s":
557
delta = datetime.timedelta(0, value)
558
elif suffix == u"m":
559
delta = datetime.timedelta(0, 0, 0, 0, value)
560
elif suffix == u"h":
561
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
562
elif suffix == u"w":
563
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
564
else:
807
565
raise ValueError
808
timevalue += delta
809
return timevalue
566
except (ValueError, IndexError):
567
raise ValueError
568
return delta
810
569
811
570
812
571
def server_state_changed(state):
813
572
"""Derived from the Avahi example code"""
814
573
if state == avahi.SERVER_COLLISION:
815
logger.error(u"Zeroconf server name collision")
574
logger.error(u"Server name collision")
816
575
service.remove()
817
576
elif state == avahi.SERVER_RUNNING:
818
577
service.add()
820
579
821
580
def entry_group_state_changed(state, error):
822
581
"""Derived from the Avahi example code"""
823
logger.debug(u"Avahi state change: %i", state)
582
logger.debug(u"state change: %i", state)
824
583
825
584
if state == avahi.ENTRY_GROUP_ESTABLISHED:
826
logger.debug(u"Zeroconf service established.")
585
logger.debug(u"Service established.")
827
586
elif state == avahi.ENTRY_GROUP_COLLISION:
828
logger.warning(u"Zeroconf service name collision.")
587
logger.warning(u"Service name collision.")
829
588
service.rename()
830
589
elif state == avahi.ENTRY_GROUP_FAILURE:
831
logger.critical(u"Avahi: Error in group state changed %s",
590
logger.critical(u"Error in group state changed %s",
832
591
unicode(error))
833
592
raise AvahiGroupError("State changed: %s", str(error))
834
593
836
595
"""Call the C function if_nametoindex(), or equivalent"""
837
596
global if_nametoindex
838
597
try:
839
if_nametoindex = (ctypes.cdll.LoadLibrary
840
(ctypes.util.find_library("c"))
841
.if_nametoindex)
598
if "ctypes.util" not in sys.modules:
599
import ctypes.util
600
if_nametoindex = ctypes.cdll.LoadLibrary\
601
(ctypes.util.find_library("c")).if_nametoindex
842
602
except (OSError, AttributeError):
843
603
if "struct" not in sys.modules:
844
604
import struct
847
607
def if_nametoindex(interface):
848
608
"Get an interface index the hard way, i.e. using fcntl()"
849
609
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
850
with closing(socket.socket()) as s:
851
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
852
struct.pack("16s16x", interface))
610
s = socket.socket()
611
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
612
struct.pack("16s16x", interface))
613
s.close()
853
614
interface_index = struct.unpack("I", ifreq[16:20])[0]
854
615
return interface_index
855
616
return if_nametoindex(interface)
856
617
857
618
858
def daemon(nochdir = False, noclose = False):
619
def daemon(nochdir, noclose):
859
620
"""See daemon(3). Standard BSD Unix function.
860
621
This should really exist as os.daemon, but it doesn't (yet)."""
861
622
if os.fork():
879
640
880
641
881
642
def main():
882
parser = OptionParser(version = "%%prog %s" % version)
643
global main_loop_started
644
main_loop_started = False
645
646
parser = OptionParser()
883
647
parser.add_option("-i", "--interface", type="string",
884
648
metavar="IF", help="Bind to interface IF")
885
649
parser.add_option("-a", "--address", type="string",
888
652
help="Port number to receive requests on")
889
653
parser.add_option("--check", action="store_true", default=False,
890
654
help="Run self-test")
891
parser.add_option("--debug", action="store_true",
655
parser.add_option("--debug", action="store_true", default=False,
892
656
help="Debug mode; run in foreground and log to"
893
657
" terminal")
894
658
parser.add_option("--priority", type="string", help="GnuTLS"
899
663
default="/etc/mandos", metavar="DIR",
900
664
help="Directory to search for configuration"
901
665
" files")
902
options = parser.parse_args()[0]
666
(options, args) = parser.parse_args()
903
667
904
668
if options.check:
905
669
import doctest
919
683
# Parse config file for server-global settings
920
684
server_config = ConfigParser.SafeConfigParser(server_defaults)
921
685
del server_defaults
922
server_config.read(os.path.join(options.configdir, "mandos.conf"))
686
server_config.read(os.path.join(options.configdir, "server.conf"))
687
server_section = "server"
923
688
# Convert the SafeConfigParser object to a dict
924
server_settings = server_config.defaults()
689
server_settings = dict(server_config.items(server_section))
925
690
# Use getboolean on the boolean config option
926
server_settings["debug"] = (server_config.getboolean
927
("DEFAULT", "debug"))
691
server_settings["debug"] = server_config.getboolean\
692
(server_section, "debug")
928
693
del server_config
929
694
930
695
# Override the settings from the config file with command line
937
702
del options
938
703
# Now we have our good server settings in "server_settings"
939
704
940
debug = server_settings["debug"]
941
942
if not debug:
943
syslogger.setLevel(logging.WARNING)
944
console.setLevel(logging.WARNING)
945
946
if server_settings["servicename"] != "Mandos":
947
syslogger.setFormatter(logging.Formatter
948
('Mandos (%s): %%(levelname)s:'
949
' %%(message)s'
950
% server_settings["servicename"]))
951
952
705
# Parse config file with clients
953
706
client_defaults = { "timeout": "1h",
954
707
"interval": "5m",
955
"checker": "fping -q -- %(host)s",
956
"host": "",
708
"checker": "fping -q -- %%(fqdn)s",
957
709
}
958
710
client_config = ConfigParser.SafeConfigParser(client_defaults)
959
711
client_config.read(os.path.join(server_settings["configdir"],
960
712
"clients.conf"))
961
713
962
clients = Set()
963
tcp_server = IPv6_TCPServer((server_settings["address"],
964
server_settings["port"]),
965
TCP_handler,
966
settings=server_settings,
967
clients=clients)
968
pidfilename = "/var/run/mandos.pid"
969
try:
970
pidfile = open(pidfilename, "w")
971
except IOError, error:
972
logger.error("Could not open file %r", pidfilename)
973
974
uid = 65534
975
gid = 65534
976
try:
977
uid = pwd.getpwnam("mandos").pw_uid
978
except KeyError:
979
try:
980
uid = pwd.getpwnam("nobody").pw_uid
981
except KeyError:
982
pass
983
try:
984
gid = pwd.getpwnam("mandos").pw_gid
985
except KeyError:
986
try:
987
gid = pwd.getpwnam("nogroup").pw_gid
988
except KeyError:
989
pass
990
try:
991
os.setuid(uid)
992
os.setgid(gid)
993
except OSError, error:
994
if error[0] != errno.EPERM:
995
raise error
996
997
714
global service
998
715
service = AvahiService(name = server_settings["servicename"],
999
servicetype = "_mandos._tcp", )
716
type = "_mandos._tcp", );
1000
717
if server_settings["interface"]:
1001
service.interface = (if_nametoindex
1002
(server_settings["interface"]))
718
service.interface = if_nametoindex(server_settings["interface"])
1003
719
1004
720
global main_loop
1005
721
global bus
1008
724
DBusGMainLoop(set_as_default=True )
1009
725
main_loop = gobject.MainLoop()
1010
726
bus = dbus.SystemBus()
1011
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1012
avahi.DBUS_PATH_SERVER),
1013
avahi.DBUS_INTERFACE_SERVER)
727
server = dbus.Interface(
728
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
729
avahi.DBUS_INTERFACE_SERVER )
1014
730
# End of Avahi example code
1015
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
1016
731
732
debug = server_settings["debug"]
733
734
if debug:
735
console = logging.StreamHandler()
736
# console.setLevel(logging.DEBUG)
737
console.setFormatter(logging.Formatter\
738
('%(levelname)s: %(message)s'))
739
logger.addHandler(console)
740
del console
741
742
clients = Set()
1017
743
def remove_from_clients(client):
1018
744
clients.remove(client)
1019
745
if not clients:
1025
751
config
1026
752
= dict(client_config.items(section)))
1027
753
for section in client_config.sections()))
1028
if not clients:
1029
logger.critical(u"No clients defined")
1030
sys.exit(1)
1031
1032
if debug:
1033
# Redirect stdin so all checkers get /dev/null
1034
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1035
os.dup2(null, sys.stdin.fileno())
1036
if null > 2:
1037
os.close(null)
1038
else:
1039
# No console logging
1040
logger.removeHandler(console)
1041
# Close all input and output, do double fork, etc.
1042
daemon()
1043
1044
try:
1045
pid = os.getpid()
1046
pidfile.write(str(pid) + "\n")
1047
pidfile.close()
1048
del pidfile
1049
except IOError:
1050
logger.error(u"Could not write to file %r with PID %d",
1051
pidfilename, pid)
1052
except NameError:
1053
# "pidfile" was never created
1054
pass
1055
del pidfilename
754
755
if not debug:
756
daemon(False, False)
1056
757
1057
758
def cleanup():
1058
759
"Cleanup function; run on exit"
1078
779
for client in clients:
1079
780
client.start()
1080
781
1081
tcp_server.enable()
1082
tcp_server.server_activate()
1083
782
tcp_server = IPv6_TCPServer((server_settings["address"],
783
server_settings["port"]),
784
tcp_handler,
785
settings=server_settings,
786
clients=clients)
1084
787
# Find out what port we got
1085
788
service.port = tcp_server.socket.getsockname()[1]
1086
789
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1100
803
1101
804
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1102
805
lambda *args, **kwargs:
1103
(tcp_server.handle_request
1104
(*args[2:], **kwargs) or True))
806
tcp_server.handle_request\
807
(*args[2:], **kwargs) or True)
1105
808
1106
logger.debug(u"Starting main loop")
809
logger.debug("Starting main loop")
810
main_loop_started = True
1107
811
main_loop.run()
1108
812
except AvahiError, error:
1109
813
logger.critical(u"AvahiError: %s" + unicode(error))
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0