To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 153
- compare with another revision
- download diff
- download tarball
- view history from revision 153
- Committer: Teddy Hogeborn
- Date: 2008-09-04 07:30:58 UTC
- mfrom: (24.1.87 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080904073058-h21spydersnh8jml
* README: Improved wording.
- files added:
- plugins.d/usplash
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugins.d/mandos-client.c => plugins.d/password-request.c
- plugins.d/mandos-client.xml => plugins.d/password-request.xml
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import division, with_statement, absolute_import
33
from __future__ import division
35
34
36
35
import SocketServer
37
36
import socket
38
import optparse
37
import select
38
from optparse import OptionParser
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
55
55
import stat
56
56
import logging
57
57
import logging.handlers
58
import pwd
59
from contextlib import closing
60
58
61
59
import dbus
62
import dbus.service
63
60
import gobject
64
61
import avahi
65
62
from dbus.mainloop.glib import DBusGMainLoop
66
63
import ctypes
67
import ctypes.util
68
69
try:
70
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
71
except AttributeError:
72
try:
73
from IN import SO_BINDTODEVICE
74
except ImportError:
75
# From /usr/include/asm/socket.h
76
SO_BINDTODEVICE = 25
77
78
79
version = "1.0.8"
64
65
version = "1.0"
80
66
81
67
logger = logging.Logger('mandos')
82
syslogger = (logging.handlers.SysLogHandler
83
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
84
address = "/dev/log"))
85
syslogger.setFormatter(logging.Formatter
86
('Mandos [%(process)d]: %(levelname)s:'
87
' %(message)s'))
68
syslogger = logging.handlers.SysLogHandler\
69
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
70
address = "/dev/log")
71
syslogger.setFormatter(logging.Formatter\
72
('Mandos: %(levelname)s: %(message)s'))
88
73
logger.addHandler(syslogger)
89
74
90
75
console = logging.StreamHandler()
91
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
92
' %(levelname)s: %(message)s'))
76
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
77
' %(message)s'))
93
78
logger.addHandler(console)
94
79
95
80
class AvahiError(Exception):
96
def __init__(self, value, *args, **kwargs):
81
def __init__(self, value):
97
82
self.value = value
98
super(AvahiError, self).__init__(value, *args, **kwargs)
99
def __unicode__(self):
100
return unicode(repr(self.value))
83
def __str__(self):
84
return repr(self.value)
101
85
102
86
class AvahiServiceError(AvahiError):
103
87
pass
108
92
109
93
class AvahiService(object):
110
94
"""An Avahi (Zeroconf) service.
111
112
95
Attributes:
113
96
interface: integer; avahi.IF_UNSPEC or an interface index.
114
97
Used to optionally bind to the specified interface.
124
107
a sensible number of times
125
108
"""
126
109
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
127
servicetype = None, port = None, TXT = None,
128
domain = "", host = "", max_renames = 32768,
129
protocol = avahi.PROTO_UNSPEC):
110
type = None, port = None, TXT = None, domain = "",
111
host = "", max_renames = 32768):
130
112
self.interface = interface
131
113
self.name = name
132
self.type = servicetype
114
self.type = type
133
115
self.port = port
134
self.TXT = TXT if TXT is not None else []
116
if TXT is None:
117
self.TXT = []
118
else:
119
self.TXT = TXT
135
120
self.domain = domain
136
121
self.host = host
137
122
self.rename_count = 0
138
123
self.max_renames = max_renames
139
self.protocol = protocol
140
124
def rename(self):
141
125
"""Derived from the Avahi example code"""
142
126
if self.rename_count >= self.max_renames:
143
127
logger.critical(u"No suitable Zeroconf service name found"
144
128
u" after %i retries, exiting.",
145
self.rename_count)
146
raise AvahiServiceError(u"Too many renames")
129
rename_count)
130
raise AvahiServiceError("Too many renames")
147
131
self.name = server.GetAlternativeServiceName(self.name)
148
132
logger.info(u"Changing Zeroconf service name to %r ...",
149
133
str(self.name))
150
syslogger.setFormatter(logging.Formatter
151
('Mandos (%s) [%%(process)d]:'
152
' %%(levelname)s: %%(message)s'
153
% self.name))
134
syslogger.setFormatter(logging.Formatter\
135
('Mandos (%s): %%(levelname)s:'
136
' %%(message)s' % self.name))
154
137
self.remove()
155
138
self.add()
156
139
self.rename_count += 1
162
145
"""Derived from the Avahi example code"""
163
146
global group
164
147
if group is None:
165
group = dbus.Interface(bus.get_object
166
(avahi.DBUS_NAME,
148
group = dbus.Interface\
149
(bus.get_object(avahi.DBUS_NAME,
167
150
server.EntryGroupNew()),
168
avahi.DBUS_INTERFACE_ENTRY_GROUP)
151
avahi.DBUS_INTERFACE_ENTRY_GROUP)
169
152
group.connect_to_signal('StateChanged',
170
153
entry_group_state_changed)
171
154
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
172
155
service.name, service.type)
173
156
group.AddService(
174
157
self.interface, # interface
175
self.protocol, # protocol
158
avahi.PROTO_INET6, # protocol
176
159
dbus.UInt32(0), # flags
177
160
self.name, self.type,
178
161
self.domain, self.host,
185
168
# End of Avahi example code
186
169
187
170
188
def _datetime_to_dbus(dt, variant_level=0):
189
"""Convert a UTC datetime.datetime() to a D-Bus type."""
190
return dbus.String(dt.isoformat(), variant_level=variant_level)
191
192
193
171
class Client(object):
194
172
"""A representation of a client host served by this server.
195
196
173
Attributes:
197
name: string; from the config file, used in log messages and
198
D-Bus identifiers
174
name: string; from the config file, used in log messages
199
175
fingerprint: string (40 or 32 hexadecimal digits); used to
200
176
uniquely identify the client
201
secret: bytestring; sent verbatim (over TLS) to client
202
host: string; available for use by the checker command
203
created: datetime.datetime(); (UTC) object creation
204
last_enabled: datetime.datetime(); (UTC)
205
enabled: bool()
206
last_checked_ok: datetime.datetime(); (UTC) or None
207
timeout: datetime.timedelta(); How long from last_checked_ok
208
until this client is invalid
209
interval: datetime.timedelta(); How often to start a new checker
210
disable_hook: If set, called by disable() as disable_hook(self)
211
checker: subprocess.Popen(); a running checker process used
212
to see if the client lives.
213
'None' if no process is running.
177
secret: bytestring; sent verbatim (over TLS) to client
178
host: string; available for use by the checker command
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
181
timeout: datetime.timedelta(); How long from last_checked_ok
182
until this client is invalid
183
interval: datetime.timedelta(); How often to start a new checker
184
stop_hook: If set, called by stop() as stop_hook(self)
185
checker: subprocess.Popen(); a running checker process used
186
to see if the client lives.
187
'None' if no process is running.
214
188
checker_initiator_tag: a gobject event source tag, or None
215
disable_initiator_tag: - '' -
189
stop_initiator_tag: - '' -
216
190
checker_callback_tag: - '' -
217
191
checker_command: string; External command which is run to check if
218
192
client lives. %() expansions are done at
219
193
runtime with vars(self) as dict, so that for
220
194
instance %(name)s can be used in the command.
221
current_checker_command: string; current running checker_command
195
Private attibutes:
196
_timeout: Real variable for 'timeout'
197
_interval: Real variable for 'interval'
198
_timeout_milliseconds: Used when calling gobject.timeout_add()
199
_interval_milliseconds: - '' -
222
200
"""
223
def timeout_milliseconds(self):
224
"Return the 'timeout' attribute in milliseconds"
225
return ((self.timeout.days * 24 * 60 * 60 * 1000)
226
+ (self.timeout.seconds * 1000)
227
+ (self.timeout.microseconds // 1000))
228
229
def interval_milliseconds(self):
230
"Return the 'interval' attribute in milliseconds"
231
return ((self.interval.days * 24 * 60 * 60 * 1000)
232
+ (self.interval.seconds * 1000)
233
+ (self.interval.microseconds // 1000))
234
235
def __init__(self, name = None, disable_hook=None, config=None):
201
def _set_timeout(self, timeout):
202
"Setter function for 'timeout' attribute"
203
self._timeout = timeout
204
self._timeout_milliseconds = ((self.timeout.days
205
* 24 * 60 * 60 * 1000)
206
+ (self.timeout.seconds * 1000)
207
+ (self.timeout.microseconds
208
// 1000))
209
timeout = property(lambda self: self._timeout,
210
_set_timeout)
211
del _set_timeout
212
def _set_interval(self, interval):
213
"Setter function for 'interval' attribute"
214
self._interval = interval
215
self._interval_milliseconds = ((self.interval.days
216
* 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds
218
* 1000)
219
+ (self.interval.microseconds
220
// 1000))
221
interval = property(lambda self: self._interval,
222
_set_interval)
223
del _set_interval
224
def __init__(self, name = None, stop_hook=None, config={}):
236
225
"""Note: the 'checker' key in 'config' sets the
237
226
'checker_command' attribute and *not* the 'checker'
238
227
attribute."""
239
228
self.name = name
240
if config is None:
241
config = {}
242
229
logger.debug(u"Creating client %r", self.name)
243
230
# Uppercase and remove spaces from fingerprint for later
244
231
# comparison purposes with return value from the fingerprint()
245
232
# function
246
self.fingerprint = (config["fingerprint"].upper()
247
.replace(u" ", u""))
233
self.fingerprint = config["fingerprint"].upper()\
234
.replace(u" ", u"")
248
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
249
236
if "secret" in config:
250
237
self.secret = config["secret"].decode(u"base64")
251
238
elif "secfile" in config:
252
with closing(open(os.path.expanduser
253
(os.path.expandvars
254
(config["secfile"])))) as secfile:
255
self.secret = secfile.read()
239
sf = open(config["secfile"])
240
self.secret = sf.read()
241
sf.close()
256
242
else:
257
243
raise TypeError(u"No secret or secfile for client %s"
258
244
% self.name)
259
245
self.host = config.get("host", "")
260
self.created = datetime.datetime.utcnow()
261
self.enabled = False
262
self.last_enabled = None
246
self.created = datetime.datetime.now()
263
247
self.last_checked_ok = None
264
248
self.timeout = string_to_delta(config["timeout"])
265
249
self.interval = string_to_delta(config["interval"])
266
self.disable_hook = disable_hook
250
self.stop_hook = stop_hook
267
251
self.checker = None
268
252
self.checker_initiator_tag = None
269
self.disable_initiator_tag = None
253
self.stop_initiator_tag = None
270
254
self.checker_callback_tag = None
271
self.checker_command = config["checker"]
272
self.current_checker_command = None
273
self.last_connect = None
274
275
def enable(self):
255
self.check_command = config["checker"]
256
def start(self):
276
257
"""Start this client's checker and timeout hooks"""
277
self.last_enabled = datetime.datetime.utcnow()
278
258
# Schedule a new checker to be started an 'interval' from now,
279
259
# and every interval from then on.
280
self.checker_initiator_tag = (gobject.timeout_add
281
(self.interval_milliseconds(),
282
self.start_checker))
260
self.checker_initiator_tag = gobject.timeout_add\
261
(self._interval_milliseconds,
262
self.start_checker)
283
263
# Also start a new checker *right now*.
284
264
self.start_checker()
285
# Schedule a disable() when 'timeout' has passed
286
self.disable_initiator_tag = (gobject.timeout_add
287
(self.timeout_milliseconds(),
288
self.disable))
289
self.enabled = True
290
291
def disable(self):
292
"""Disable this client."""
293
if not getattr(self, "enabled", False):
265
# Schedule a stop() when 'timeout' has passed
266
self.stop_initiator_tag = gobject.timeout_add\
267
(self._timeout_milliseconds,
268
self.stop)
269
def stop(self):
270
"""Stop this client.
271
The possibility that a client might be restarted is left open,
272
but not currently used."""
273
# If this client doesn't have a secret, it is already stopped.
274
if hasattr(self, "secret") and self.secret:
275
logger.info(u"Stopping client %s", self.name)
276
self.secret = None
277
else:
294
278
return False
295
logger.info(u"Disabling client %s", self.name)
296
if getattr(self, "disable_initiator_tag", False):
297
gobject.source_remove(self.disable_initiator_tag)
298
self.disable_initiator_tag = None
279
if getattr(self, "stop_initiator_tag", False):
280
gobject.source_remove(self.stop_initiator_tag)
281
self.stop_initiator_tag = None
299
282
if getattr(self, "checker_initiator_tag", False):
300
283
gobject.source_remove(self.checker_initiator_tag)
301
284
self.checker_initiator_tag = None
302
285
self.stop_checker()
303
if self.disable_hook:
304
self.disable_hook(self)
305
self.enabled = False
286
if self.stop_hook:
287
self.stop_hook(self)
306
288
# Do not run this again if called by a gobject.timeout_add
307
289
return False
308
309
290
def __del__(self):
310
self.disable_hook = None
311
self.disable()
312
313
def checker_callback(self, pid, condition, command):
291
self.stop_hook = None
292
self.stop()
293
def checker_callback(self, pid, condition):
314
294
"""The checker has completed, so take appropriate actions."""
295
now = datetime.datetime.now()
315
296
self.checker_callback_tag = None
316
297
self.checker = None
317
if os.WIFEXITED(condition):
318
exitstatus = os.WEXITSTATUS(condition)
319
if exitstatus == 0:
320
logger.info(u"Checker for %(name)s succeeded",
321
vars(self))
322
self.checked_ok()
323
else:
324
logger.info(u"Checker for %(name)s failed",
325
vars(self))
326
else:
298
if os.WIFEXITED(condition) \
299
and (os.WEXITSTATUS(condition) == 0):
300
logger.info(u"Checker for %(name)s succeeded",
301
vars(self))
302
self.last_checked_ok = now
303
gobject.source_remove(self.stop_initiator_tag)
304
self.stop_initiator_tag = gobject.timeout_add\
305
(self._timeout_milliseconds,
306
self.stop)
307
elif not os.WIFEXITED(condition):
327
308
logger.warning(u"Checker for %(name)s crashed?",
328
309
vars(self))
329
330
def checked_ok(self):
331
"""Bump up the timeout for this client.
332
333
This should only be called when the client has been seen,
334
alive and well.
335
"""
336
self.last_checked_ok = datetime.datetime.utcnow()
337
gobject.source_remove(self.disable_initiator_tag)
338
self.disable_initiator_tag = (gobject.timeout_add
339
(self.timeout_milliseconds(),
340
self.disable))
341
310
else:
311
logger.info(u"Checker for %(name)s failed",
312
vars(self))
342
313
def start_checker(self):
343
314
"""Start a new checker subprocess if one is not running.
344
345
315
If a checker already exists, leave it running and do
346
316
nothing."""
347
317
# The reason for not killing a running checker is that if we
352
322
# checkers alone, the checker would have to take more time
353
323
# than 'timeout' for the client to be declared invalid, which
354
324
# is as it should be.
355
356
# If a checker exists, make sure it is not a zombie
357
if self.checker is not None:
358
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
359
if pid:
360
logger.warning("Checker was a zombie")
361
gobject.source_remove(self.checker_callback_tag)
362
self.checker_callback(pid, status,
363
self.current_checker_command)
364
# Start a new checker if needed
365
325
if self.checker is None:
366
326
try:
367
# In case checker_command has exactly one % operator
368
command = self.checker_command % self.host
327
# In case check_command has exactly one % operator
328
command = self.check_command % self.host
369
329
except TypeError:
370
330
# Escape attributes for the shell
371
331
escaped_attrs = dict((key, re.escape(str(val)))
372
332
for key, val in
373
333
vars(self).iteritems())
374
334
try:
375
command = self.checker_command % escaped_attrs
335
command = self.check_command % escaped_attrs
376
336
except TypeError, error:
377
337
logger.error(u'Could not format string "%s":'
378
u' %s', self.checker_command, error)
338
u' %s', self.check_command, error)
379
339
return True # Try again later
380
self.current_checker_command = command
381
340
try:
382
341
logger.info(u"Starting checker %r for %s",
383
342
command, self.name)
388
347
self.checker = subprocess.Popen(command,
389
348
close_fds=True,
390
349
shell=True, cwd="/")
391
self.checker_callback_tag = (gobject.child_watch_add
392
(self.checker.pid,
393
self.checker_callback,
394
data=command))
395
# The checker may have completed before the gobject
396
# watch was added. Check for this.
397
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
398
if pid:
399
gobject.source_remove(self.checker_callback_tag)
400
self.checker_callback(pid, status, command)
350
self.checker_callback_tag = gobject.child_watch_add\
351
(self.checker.pid,
352
self.checker_callback)
401
353
except OSError, error:
402
354
logger.error(u"Failed to start subprocess: %s",
403
355
error)
404
356
# Re-run this periodically if run by gobject.timeout_add
405
357
return True
406
407
358
def stop_checker(self):
408
359
"""Force the checker process, if any, to stop."""
409
360
if self.checker_callback_tag:
421
372
if error.errno != errno.ESRCH: # No such process
422
373
raise
423
374
self.checker = None
424
425
375
def still_valid(self):
426
376
"""Has the timeout not yet passed for this client?"""
427
if not getattr(self, "enabled", False):
428
return False
429
now = datetime.datetime.utcnow()
377
now = datetime.datetime.now()
430
378
if self.last_checked_ok is None:
431
379
return now < (self.created + self.timeout)
432
380
else:
433
381
return now < (self.last_checked_ok + self.timeout)
434
382
435
383
436
class ClientDBus(Client, dbus.service.Object):
437
"""A Client class using D-Bus
438
439
Attributes:
440
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
441
"""
442
# dbus.service.Object doesn't use super(), so we can't either.
443
444
def __init__(self, *args, **kwargs):
445
Client.__init__(self, *args, **kwargs)
446
# Only now, when this client is initialized, can it show up on
447
# the D-Bus
448
self.dbus_object_path = (dbus.ObjectPath
449
("/clients/"
450
+ self.name.replace(".", "_")))
451
dbus.service.Object.__init__(self, bus,
452
self.dbus_object_path)
453
def enable(self):
454
oldstate = getattr(self, "enabled", False)
455
r = Client.enable(self)
456
if oldstate != self.enabled:
457
# Emit D-Bus signals
458
self.PropertyChanged(dbus.String(u"enabled"),
459
dbus.Boolean(True, variant_level=1))
460
self.PropertyChanged(dbus.String(u"last_enabled"),
461
(_datetime_to_dbus(self.last_enabled,
462
variant_level=1)))
463
return r
464
465
def disable(self, signal = True):
466
oldstate = getattr(self, "enabled", False)
467
r = Client.disable(self)
468
if signal and oldstate != self.enabled:
469
# Emit D-Bus signal
470
self.PropertyChanged(dbus.String(u"enabled"),
471
dbus.Boolean(False, variant_level=1))
472
return r
473
474
def __del__(self, *args, **kwargs):
475
try:
476
self.remove_from_connection()
477
except LookupError:
478
pass
479
if hasattr(dbus.service.Object, "__del__"):
480
dbus.service.Object.__del__(self, *args, **kwargs)
481
Client.__del__(self, *args, **kwargs)
482
483
def checker_callback(self, pid, condition, command,
484
*args, **kwargs):
485
self.checker_callback_tag = None
486
self.checker = None
487
# Emit D-Bus signal
488
self.PropertyChanged(dbus.String(u"checker_running"),
489
dbus.Boolean(False, variant_level=1))
490
if os.WIFEXITED(condition):
491
exitstatus = os.WEXITSTATUS(condition)
492
# Emit D-Bus signal
493
self.CheckerCompleted(dbus.Int16(exitstatus),
494
dbus.Int64(condition),
495
dbus.String(command))
496
else:
497
# Emit D-Bus signal
498
self.CheckerCompleted(dbus.Int16(-1),
499
dbus.Int64(condition),
500
dbus.String(command))
501
502
return Client.checker_callback(self, pid, condition, command,
503
*args, **kwargs)
504
505
def checked_ok(self, *args, **kwargs):
506
r = Client.checked_ok(self, *args, **kwargs)
507
# Emit D-Bus signal
508
self.PropertyChanged(
509
dbus.String(u"last_checked_ok"),
510
(_datetime_to_dbus(self.last_checked_ok,
511
variant_level=1)))
512
return r
513
514
def start_checker(self, *args, **kwargs):
515
old_checker = self.checker
516
if self.checker is not None:
517
old_checker_pid = self.checker.pid
518
else:
519
old_checker_pid = None
520
r = Client.start_checker(self, *args, **kwargs)
521
# Only if new checker process was started
522
if (self.checker is not None
523
and old_checker_pid != self.checker.pid):
524
# Emit D-Bus signal
525
self.CheckerStarted(self.current_checker_command)
526
self.PropertyChanged(
527
dbus.String("checker_running"),
528
dbus.Boolean(True, variant_level=1))
529
return r
530
531
def stop_checker(self, *args, **kwargs):
532
old_checker = getattr(self, "checker", None)
533
r = Client.stop_checker(self, *args, **kwargs)
534
if (old_checker is not None
535
and getattr(self, "checker", None) is None):
536
self.PropertyChanged(dbus.String(u"checker_running"),
537
dbus.Boolean(False, variant_level=1))
538
return r
539
540
## D-Bus methods & signals
541
_interface = u"se.bsnet.fukt.Mandos.Client"
542
543
# CheckedOK - method
544
CheckedOK = dbus.service.method(_interface)(checked_ok)
545
CheckedOK.__name__ = "CheckedOK"
546
547
# CheckerCompleted - signal
548
@dbus.service.signal(_interface, signature="nxs")
549
def CheckerCompleted(self, exitcode, waitstatus, command):
550
"D-Bus signal"
551
pass
552
553
# CheckerStarted - signal
554
@dbus.service.signal(_interface, signature="s")
555
def CheckerStarted(self, command):
556
"D-Bus signal"
557
pass
558
559
# GetAllProperties - method
560
@dbus.service.method(_interface, out_signature="a{sv}")
561
def GetAllProperties(self):
562
"D-Bus method"
563
return dbus.Dictionary({
564
dbus.String("name"):
565
dbus.String(self.name, variant_level=1),
566
dbus.String("fingerprint"):
567
dbus.String(self.fingerprint, variant_level=1),
568
dbus.String("host"):
569
dbus.String(self.host, variant_level=1),
570
dbus.String("created"):
571
_datetime_to_dbus(self.created, variant_level=1),
572
dbus.String("last_enabled"):
573
(_datetime_to_dbus(self.last_enabled,
574
variant_level=1)
575
if self.last_enabled is not None
576
else dbus.Boolean(False, variant_level=1)),
577
dbus.String("enabled"):
578
dbus.Boolean(self.enabled, variant_level=1),
579
dbus.String("last_checked_ok"):
580
(_datetime_to_dbus(self.last_checked_ok,
581
variant_level=1)
582
if self.last_checked_ok is not None
583
else dbus.Boolean (False, variant_level=1)),
584
dbus.String("timeout"):
585
dbus.UInt64(self.timeout_milliseconds(),
586
variant_level=1),
587
dbus.String("interval"):
588
dbus.UInt64(self.interval_milliseconds(),
589
variant_level=1),
590
dbus.String("checker"):
591
dbus.String(self.checker_command,
592
variant_level=1),
593
dbus.String("checker_running"):
594
dbus.Boolean(self.checker is not None,
595
variant_level=1),
596
dbus.String("object_path"):
597
dbus.ObjectPath(self.dbus_object_path,
598
variant_level=1)
599
}, signature="sv")
600
601
# IsStillValid - method
602
@dbus.service.method(_interface, out_signature="b")
603
def IsStillValid(self):
604
return self.still_valid()
605
606
# PropertyChanged - signal
607
@dbus.service.signal(_interface, signature="sv")
608
def PropertyChanged(self, property, value):
609
"D-Bus signal"
610
pass
611
612
# ReceivedSecret - signal
613
@dbus.service.signal(_interface)
614
def ReceivedSecret(self):
615
"D-Bus signal"
616
pass
617
618
# Rejected - signal
619
@dbus.service.signal(_interface)
620
def Rejected(self):
621
"D-Bus signal"
622
pass
623
624
# SetChecker - method
625
@dbus.service.method(_interface, in_signature="s")
626
def SetChecker(self, checker):
627
"D-Bus setter method"
628
self.checker_command = checker
629
# Emit D-Bus signal
630
self.PropertyChanged(dbus.String(u"checker"),
631
dbus.String(self.checker_command,
632
variant_level=1))
633
634
# SetHost - method
635
@dbus.service.method(_interface, in_signature="s")
636
def SetHost(self, host):
637
"D-Bus setter method"
638
self.host = host
639
# Emit D-Bus signal
640
self.PropertyChanged(dbus.String(u"host"),
641
dbus.String(self.host, variant_level=1))
642
643
# SetInterval - method
644
@dbus.service.method(_interface, in_signature="t")
645
def SetInterval(self, milliseconds):
646
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
647
# Emit D-Bus signal
648
self.PropertyChanged(dbus.String(u"interval"),
649
(dbus.UInt64(self.interval_milliseconds(),
650
variant_level=1)))
651
652
# SetSecret - method
653
@dbus.service.method(_interface, in_signature="ay",
654
byte_arrays=True)
655
def SetSecret(self, secret):
656
"D-Bus setter method"
657
self.secret = str(secret)
658
659
# SetTimeout - method
660
@dbus.service.method(_interface, in_signature="t")
661
def SetTimeout(self, milliseconds):
662
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
663
# Emit D-Bus signal
664
self.PropertyChanged(dbus.String(u"timeout"),
665
(dbus.UInt64(self.timeout_milliseconds(),
666
variant_level=1)))
667
668
# Enable - method
669
Enable = dbus.service.method(_interface)(enable)
670
Enable.__name__ = "Enable"
671
672
# StartChecker - method
673
@dbus.service.method(_interface)
674
def StartChecker(self):
675
"D-Bus method"
676
self.start_checker()
677
678
# Disable - method
679
@dbus.service.method(_interface)
680
def Disable(self):
681
"D-Bus method"
682
self.disable()
683
684
# StopChecker - method
685
StopChecker = dbus.service.method(_interface)(stop_checker)
686
StopChecker.__name__ = "StopChecker"
687
688
del _interface
689
690
691
class ClientHandler(SocketServer.BaseRequestHandler, object):
692
"""A class to handle client connections.
693
694
Instantiated once for each connection to handle it.
384
def peer_certificate(session):
385
"Return the peer's OpenPGP certificate as a bytestring"
386
# If not an OpenPGP certificate...
387
if gnutls.library.functions.gnutls_certificate_type_get\
388
(session._c_object) \
389
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
390
# ...do the normal thing
391
return session.peer_certificate
392
list_size = ctypes.c_uint()
393
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
394
(session._c_object, ctypes.byref(list_size))
395
if list_size.value == 0:
396
return None
397
cert = cert_list[0]
398
return ctypes.string_at(cert.data, cert.size)
399
400
401
def fingerprint(openpgp):
402
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
403
# New GnuTLS "datum" with the OpenPGP public key
404
datum = gnutls.library.types.gnutls_datum_t\
405
(ctypes.cast(ctypes.c_char_p(openpgp),
406
ctypes.POINTER(ctypes.c_ubyte)),
407
ctypes.c_uint(len(openpgp)))
408
# New empty GnuTLS certificate
409
crt = gnutls.library.types.gnutls_openpgp_crt_t()
410
gnutls.library.functions.gnutls_openpgp_crt_init\
411
(ctypes.byref(crt))
412
# Import the OpenPGP public key into the certificate
413
gnutls.library.functions.gnutls_openpgp_crt_import\
414
(crt, ctypes.byref(datum),
415
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
416
# Verify the self signature in the key
417
crtverify = ctypes.c_uint();
418
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
419
(crt, 0, ctypes.byref(crtverify))
420
if crtverify.value != 0:
421
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
422
raise gnutls.errors.CertificateSecurityError("Verify failed")
423
# New buffer for the fingerprint
424
buffer = ctypes.create_string_buffer(20)
425
buffer_length = ctypes.c_size_t()
426
# Get the fingerprint from the certificate into the buffer
427
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
428
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
429
# Deinit the certificate
430
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
431
# Convert the buffer to a Python bytestring
432
fpr = ctypes.string_at(buffer, buffer_length.value)
433
# Convert the bytestring to hexadecimal notation
434
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
435
return hex_fpr
436
437
438
class tcp_handler(SocketServer.BaseRequestHandler, object):
439
"""A TCP request handler class.
440
Instantiated by IPv6_TCPServer for each request to handle it.
695
441
Note: This will run in its own forked process."""
696
442
697
443
def handle(self):
698
444
logger.info(u"TCP connection from: %s",
699
unicode(self.client_address))
700
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
701
# Open IPC pipe to parent process
702
with closing(os.fdopen(self.server.pipe[1], "w", 1)) as ipc:
703
session = (gnutls.connection
704
.ClientSession(self.request,
705
gnutls.connection
706
.X509Credentials()))
707
708
line = self.request.makefile().readline()
709
logger.debug(u"Protocol version: %r", line)
710
try:
711
if int(line.strip().split()[0]) > 1:
712
raise RuntimeError
713
except (ValueError, IndexError, RuntimeError), error:
714
logger.error(u"Unknown protocol version: %s", error)
715
return
716
717
# Note: gnutls.connection.X509Credentials is really a
718
# generic GnuTLS certificate credentials object so long as
719
# no X.509 keys are added to it. Therefore, we can use it
720
# here despite using OpenPGP certificates.
721
722
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
723
# "+AES-256-CBC", "+SHA1",
724
# "+COMP-NULL", "+CTYPE-OPENPGP",
725
# "+DHE-DSS"))
726
# Use a fallback default, since this MUST be set.
727
priority = self.server.gnutls_priority
728
if priority is None:
729
priority = "NORMAL"
730
(gnutls.library.functions
731
.gnutls_priority_set_direct(session._c_object,
732
priority, None))
733
734
try:
735
session.handshake()
736
except gnutls.errors.GNUTLSError, error:
737
logger.warning(u"Handshake failed: %s", error)
738
# Do not run session.bye() here: the session is not
739
# established. Just abandon the request.
740
return
741
logger.debug(u"Handshake succeeded")
742
try:
743
fpr = self.fingerprint(self.peer_certificate(session))
744
except (TypeError, gnutls.errors.GNUTLSError), error:
745
logger.warning(u"Bad certificate: %s", error)
746
session.bye()
747
return
748
logger.debug(u"Fingerprint: %s", fpr)
749
750
for c in self.server.clients:
751
if c.fingerprint == fpr:
752
client = c
753
break
754
else:
755
ipc.write("NOTFOUND %s\n" % fpr)
756
session.bye()
757
return
758
# Have to check if client.still_valid(), since it is
759
# possible that the client timed out while establishing
760
# the GnuTLS session.
761
if not client.still_valid():
762
ipc.write("INVALID %s\n" % client.name)
763
session.bye()
764
return
765
ipc.write("SENDING %s\n" % client.name)
766
sent_size = 0
767
while sent_size < len(client.secret):
768
sent = session.send(client.secret[sent_size:])
769
logger.debug(u"Sent: %d, remaining: %d",
770
sent, len(client.secret)
771
- (sent_size + sent))
772
sent_size += sent
773
session.bye()
774
775
@staticmethod
776
def peer_certificate(session):
777
"Return the peer's OpenPGP certificate as a bytestring"
778
# If not an OpenPGP certificate...
779
if (gnutls.library.functions
780
.gnutls_certificate_type_get(session._c_object)
781
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
782
# ...do the normal thing
783
return session.peer_certificate
784
list_size = ctypes.c_uint(1)
785
cert_list = (gnutls.library.functions
786
.gnutls_certificate_get_peers
787
(session._c_object, ctypes.byref(list_size)))
788
if not bool(cert_list) and list_size.value != 0:
789
raise gnutls.errors.GNUTLSError("error getting peer"
790
" certificate")
791
if list_size.value == 0:
792
return None
793
cert = cert_list[0]
794
return ctypes.string_at(cert.data, cert.size)
795
796
@staticmethod
797
def fingerprint(openpgp):
798
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
799
# New GnuTLS "datum" with the OpenPGP public key
800
datum = (gnutls.library.types
801
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
802
ctypes.POINTER
803
(ctypes.c_ubyte)),
804
ctypes.c_uint(len(openpgp))))
805
# New empty GnuTLS certificate
806
crt = gnutls.library.types.gnutls_openpgp_crt_t()
807
(gnutls.library.functions
808
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
809
# Import the OpenPGP public key into the certificate
810
(gnutls.library.functions
811
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
812
gnutls.library.constants
813
.GNUTLS_OPENPGP_FMT_RAW))
814
# Verify the self signature in the key
815
crtverify = ctypes.c_uint()
816
(gnutls.library.functions
817
.gnutls_openpgp_crt_verify_self(crt, 0,
818
ctypes.byref(crtverify)))
819
if crtverify.value != 0:
820
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
821
raise (gnutls.errors.CertificateSecurityError
822
("Verify failed"))
823
# New buffer for the fingerprint
824
buf = ctypes.create_string_buffer(20)
825
buf_len = ctypes.c_size_t()
826
# Get the fingerprint from the certificate into the buffer
827
(gnutls.library.functions
828
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
829
ctypes.byref(buf_len)))
830
# Deinit the certificate
831
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
832
# Convert the buffer to a Python bytestring
833
fpr = ctypes.string_at(buf, buf_len.value)
834
# Convert the bytestring to hexadecimal notation
835
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
836
return hex_fpr
837
838
839
class ForkingMixInWithPipe(SocketServer.ForkingMixIn, object):
840
"""Like SocketServer.ForkingMixIn, but also pass a pipe.
841
842
Assumes a gobject.MainLoop event loop.
843
"""
844
def process_request(self, request, client_address):
845
"""Overrides and wraps the original process_request().
846
847
This function creates a new pipe in self.pipe
848
"""
849
self.pipe = os.pipe()
850
super(ForkingMixInWithPipe,
851
self).process_request(request, client_address)
852
os.close(self.pipe[1]) # close write end
853
# Call "handle_ipc" for both data and EOF events
854
gobject.io_add_watch(self.pipe[0],
855
gobject.IO_IN | gobject.IO_HUP,
856
self.handle_ipc)
857
def handle_ipc(source, condition):
858
"""Dummy function; override as necessary"""
859
os.close(source)
860
return False
861
862
863
class IPv6_TCPServer(ForkingMixInWithPipe,
864
SocketServer.TCPServer, object):
865
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
866
445
unicode(self.client_address))
446
session = gnutls.connection.ClientSession\
447
(self.request, gnutls.connection.X509Credentials())
448
449
line = self.request.makefile().readline()
450
logger.debug(u"Protocol version: %r", line)
451
try:
452
if int(line.strip().split()[0]) > 1:
453
raise RuntimeError
454
except (ValueError, IndexError, RuntimeError), error:
455
logger.error(u"Unknown protocol version: %s", error)
456
return
457
458
# Note: gnutls.connection.X509Credentials is really a generic
459
# GnuTLS certificate credentials object so long as no X.509
460
# keys are added to it. Therefore, we can use it here despite
461
# using OpenPGP certificates.
462
463
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
464
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
465
# "+DHE-DSS"))
466
priority = "NORMAL" # Fallback default, since this
467
# MUST be set.
468
if self.server.settings["priority"]:
469
priority = self.server.settings["priority"]
470
gnutls.library.functions.gnutls_priority_set_direct\
471
(session._c_object, priority, None);
472
473
try:
474
session.handshake()
475
except gnutls.errors.GNUTLSError, error:
476
logger.warning(u"Handshake failed: %s", error)
477
# Do not run session.bye() here: the session is not
478
# established. Just abandon the request.
479
return
480
try:
481
fpr = fingerprint(peer_certificate(session))
482
except (TypeError, gnutls.errors.GNUTLSError), error:
483
logger.warning(u"Bad certificate: %s", error)
484
session.bye()
485
return
486
logger.debug(u"Fingerprint: %s", fpr)
487
client = None
488
for c in self.server.clients:
489
if c.fingerprint == fpr:
490
client = c
491
break
492
if not client:
493
logger.warning(u"Client not found for fingerprint: %s",
494
fpr)
495
session.bye()
496
return
497
# Have to check if client.still_valid(), since it is possible
498
# that the client timed out while establishing the GnuTLS
499
# session.
500
if not client.still_valid():
501
logger.warning(u"Client %(name)s is invalid",
502
vars(client))
503
session.bye()
504
return
505
sent_size = 0
506
while sent_size < len(client.secret):
507
sent = session.send(client.secret[sent_size:])
508
logger.debug(u"Sent: %d, remaining: %d",
509
sent, len(client.secret)
510
- (sent_size + sent))
511
sent_size += sent
512
session.bye()
513
514
515
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
516
"""IPv6 TCP server. Accepts 'None' as address and/or port.
867
517
Attributes:
868
enabled: Boolean; whether this server is activated yet
869
interface: None or a network interface name (string)
870
use_ipv6: Boolean; to use IPv6 or not
871
----
518
settings: Server settings
872
519
clients: Set() of Client objects
873
gnutls_priority GnuTLS priority string
874
use_dbus: Boolean; to emit D-Bus signals or not
875
520
"""
876
def __init__(self, server_address, RequestHandlerClass,
877
interface=None, use_ipv6=True, clients=None,
878
gnutls_priority=None, use_dbus=True):
879
self.enabled = False
880
self.interface = interface
881
if use_ipv6:
882
self.address_family = socket.AF_INET6
883
self.clients = clients
884
self.use_dbus = use_dbus
885
self.gnutls_priority = gnutls_priority
886
SocketServer.TCPServer.__init__(self, server_address,
887
RequestHandlerClass)
521
address_family = socket.AF_INET6
522
def __init__(self, *args, **kwargs):
523
if "settings" in kwargs:
524
self.settings = kwargs["settings"]
525
del kwargs["settings"]
526
if "clients" in kwargs:
527
self.clients = kwargs["clients"]
528
del kwargs["clients"]
529
return super(type(self), self).__init__(*args, **kwargs)
888
530
def server_bind(self):
889
531
"""This overrides the normal server_bind() function
890
532
to bind to an interface if one was specified, and also NOT to
891
533
bind to an address or port if they were not specified."""
892
if self.interface is not None:
534
if self.settings["interface"]:
535
# 25 is from /usr/include/asm-i486/socket.h
536
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
893
537
try:
894
538
self.socket.setsockopt(socket.SOL_SOCKET,
895
539
SO_BINDTODEVICE,
896
self.interface + '\0')
540
self.settings["interface"])
897
541
except socket.error, error:
898
542
if error[0] == errno.EPERM:
899
543
logger.error(u"No permission to"
900
544
u" bind to interface %s",
901
self.interface)
545
self.settings["interface"])
902
546
else:
903
raise
547
raise error
904
548
# Only bind(2) the socket if we really need to.
905
549
if self.server_address[0] or self.server_address[1]:
906
550
if not self.server_address[0]:
907
if self.address_family == socket.AF_INET6:
908
any_address = "::" # in6addr_any
909
else:
910
any_address = socket.INADDR_ANY
911
self.server_address = (any_address,
551
in6addr_any = "::"
552
self.server_address = (in6addr_any,
912
553
self.server_address[1])
913
554
elif not self.server_address[1]:
914
555
self.server_address = (self.server_address[0],
915
556
0)
916
# if self.interface:
557
# if self.settings["interface"]:
917
558
# self.server_address = (self.server_address[0],
918
559
# 0, # port
919
560
# 0, # flowinfo
920
561
# if_nametoindex
921
# (self.interface))
922
return SocketServer.TCPServer.server_bind(self)
923
def server_activate(self):
924
if self.enabled:
925
return SocketServer.TCPServer.server_activate(self)
926
def enable(self):
927
self.enabled = True
928
def handle_ipc(self, source, condition, file_objects={}):
929
condition_names = {
930
gobject.IO_IN: "IN", # There is data to read.
931
gobject.IO_OUT: "OUT", # Data can be written (without
932
# blocking).
933
gobject.IO_PRI: "PRI", # There is urgent data to read.
934
gobject.IO_ERR: "ERR", # Error condition.
935
gobject.IO_HUP: "HUP" # Hung up (the connection has been
936
# broken, usually for pipes and
937
# sockets).
938
}
939
conditions_string = ' | '.join(name
940
for cond, name in
941
condition_names.iteritems()
942
if cond & condition)
943
logger.debug("Handling IPC: FD = %d, condition = %s", source,
944
conditions_string)
945
946
# Turn the pipe file descriptor into a Python file object
947
if source not in file_objects:
948
file_objects[source] = os.fdopen(source, "r", 1)
949
950
# Read a line from the file object
951
cmdline = file_objects[source].readline()
952
if not cmdline: # Empty line means end of file
953
# close the IPC pipe
954
file_objects[source].close()
955
del file_objects[source]
956
957
# Stop calling this function
958
return False
959
960
logger.debug("IPC command: %r", cmdline)
961
962
# Parse and act on command
963
cmd, args = cmdline.rstrip("\r\n").split(None, 1)
964
965
if cmd == "NOTFOUND":
966
logger.warning(u"Client not found for fingerprint: %s",
967
args)
968
if self.use_dbus:
969
# Emit D-Bus signal
970
mandos_dbus_service.ClientNotFound(args)
971
elif cmd == "INVALID":
972
for client in self.clients:
973
if client.name == args:
974
logger.warning(u"Client %s is invalid", args)
975
if self.use_dbus:
976
# Emit D-Bus signal
977
client.Rejected()
978
break
979
else:
980
logger.error(u"Unknown client %s is invalid", args)
981
elif cmd == "SENDING":
982
for client in self.clients:
983
if client.name == args:
984
logger.info(u"Sending secret to %s", client.name)
985
client.checked_ok()
986
if self.use_dbus:
987
# Emit D-Bus signal
988
client.ReceivedSecret()
989
break
990
else:
991
logger.error(u"Sending secret to unknown client %s",
992
args)
993
else:
994
logger.error("Unknown IPC command: %r", cmdline)
995
996
# Keep calling this function
997
return True
562
# (self.settings
563
# ["interface"]))
564
return super(type(self), self).server_bind()
998
565
999
566
1000
567
def string_to_delta(interval):
1001
568
"""Parse a string and return a datetime.timedelta
1002
569
1003
570
>>> string_to_delta('7d')
1004
571
datetime.timedelta(7)
1005
572
>>> string_to_delta('60s')
1016
583
timevalue = datetime.timedelta(0)
1017
584
for s in interval.split():
1018
585
try:
1019
suffix = unicode(s[-1])
1020
value = int(s[:-1])
586
suffix=unicode(s[-1])
587
value=int(s[:-1])
1021
588
if suffix == u"d":
1022
589
delta = datetime.timedelta(value)
1023
590
elif suffix == u"s":
1057
624
elif state == avahi.ENTRY_GROUP_FAILURE:
1058
625
logger.critical(u"Avahi: Error in group state changed %s",
1059
626
unicode(error))
1060
raise AvahiGroupError(u"State changed: %s" % unicode(error))
627
raise AvahiGroupError("State changed: %s", str(error))
1061
628
1062
629
def if_nametoindex(interface):
1063
630
"""Call the C function if_nametoindex(), or equivalent"""
1064
631
global if_nametoindex
1065
632
try:
1066
if_nametoindex = (ctypes.cdll.LoadLibrary
1067
(ctypes.util.find_library("c"))
1068
.if_nametoindex)
633
if "ctypes.util" not in sys.modules:
634
import ctypes.util
635
if_nametoindex = ctypes.cdll.LoadLibrary\
636
(ctypes.util.find_library("c")).if_nametoindex
1069
637
except (OSError, AttributeError):
1070
638
if "struct" not in sys.modules:
1071
639
import struct
1074
642
def if_nametoindex(interface):
1075
643
"Get an interface index the hard way, i.e. using fcntl()"
1076
644
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1077
with closing(socket.socket()) as s:
1078
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1079
struct.pack("16s16x", interface))
645
s = socket.socket()
646
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
647
struct.pack("16s16x", interface))
648
s.close()
1080
649
interface_index = struct.unpack("I", ifreq[16:20])[0]
1081
650
return interface_index
1082
651
return if_nametoindex(interface)
1084
653
1085
654
def daemon(nochdir = False, noclose = False):
1086
655
"""See daemon(3). Standard BSD Unix function.
1087
1088
656
This should really exist as os.daemon, but it doesn't (yet)."""
1089
657
if os.fork():
1090
658
sys.exit()
1107
675
1108
676
1109
677
def main():
1110
1111
######################################################################
1112
# Parsing of options, both command line and config file
1113
1114
parser = optparse.OptionParser(version = "%%prog %s" % version)
678
global main_loop_started
679
main_loop_started = False
680
681
parser = OptionParser(version = "%%prog %s" % version)
1115
682
parser.add_option("-i", "--interface", type="string",
1116
683
metavar="IF", help="Bind to interface IF")
1117
684
parser.add_option("-a", "--address", type="string",
1118
685
help="Address to listen for requests on")
1119
686
parser.add_option("-p", "--port", type="int",
1120
687
help="Port number to receive requests on")
1121
parser.add_option("--check", action="store_true",
688
parser.add_option("--check", action="store_true", default=False,
1122
689
help="Run self-test")
1123
690
parser.add_option("--debug", action="store_true",
1124
691
help="Debug mode; run in foreground and log to"
1131
698
default="/etc/mandos", metavar="DIR",
1132
699
help="Directory to search for configuration"
1133
700
" files")
1134
parser.add_option("--no-dbus", action="store_false",
1135
dest="use_dbus",
1136
help="Do not provide D-Bus system bus"
1137
" interface")
1138
parser.add_option("--no-ipv6", action="store_false",
1139
dest="use_ipv6", help="Do not use IPv6")
1140
options = parser.parse_args()[0]
701
(options, args) = parser.parse_args()
1141
702
1142
703
if options.check:
1143
704
import doctest
1152
713
"priority":
1153
714
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1154
715
"servicename": "Mandos",
1155
"use_dbus": "True",
1156
"use_ipv6": "True",
1157
716
}
1158
717
1159
718
# Parse config file for server-global settings
1162
721
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1163
722
# Convert the SafeConfigParser object to a dict
1164
723
server_settings = server_config.defaults()
1165
# Use the appropriate methods on the non-string config options
1166
server_settings["debug"] = server_config.getboolean("DEFAULT",
1167
"debug")
1168
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
1169
"use_dbus")
1170
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
1171
"use_ipv6")
1172
if server_settings["port"]:
1173
server_settings["port"] = server_config.getint("DEFAULT",
1174
"port")
724
# Use getboolean on the boolean config option
725
server_settings["debug"] = server_config.getboolean\
726
("DEFAULT", "debug")
1175
727
del server_config
1176
728
1177
729
# Override the settings from the config file with command line
1178
730
# options, if set.
1179
731
for option in ("interface", "address", "port", "debug",
1180
"priority", "servicename", "configdir",
1181
"use_dbus", "use_ipv6"):
732
"priority", "servicename", "configdir"):
1182
733
value = getattr(options, option)
1183
734
if value is not None:
1184
735
server_settings[option] = value
1185
736
del options
1186
737
# Now we have our good server settings in "server_settings"
1187
738
1188
##################################################################
1189
1190
# For convenience
1191
739
debug = server_settings["debug"]
1192
use_dbus = server_settings["use_dbus"]
1193
use_ipv6 = server_settings["use_ipv6"]
1194
740
1195
741
if not debug:
1196
742
syslogger.setLevel(logging.WARNING)
1197
743
console.setLevel(logging.WARNING)
1198
744
1199
745
if server_settings["servicename"] != "Mandos":
1200
syslogger.setFormatter(logging.Formatter
1201
('Mandos (%s) [%%(process)d]:'
1202
' %%(levelname)s: %%(message)s'
746
syslogger.setFormatter(logging.Formatter\
747
('Mandos (%s): %%(levelname)s:'
748
' %%(message)s'
1203
749
% server_settings["servicename"]))
1204
750
1205
751
# Parse config file with clients
1206
752
client_defaults = { "timeout": "1h",
1207
753
"interval": "5m",
1208
"checker": "fping -q -- %%(host)s",
754
"checker": "fping -q -- %(host)s",
1209
755
"host": "",
1210
756
}
1211
757
client_config = ConfigParser.SafeConfigParser(client_defaults)
1212
758
client_config.read(os.path.join(server_settings["configdir"],
1213
759
"clients.conf"))
1214
1215
global mandos_dbus_service
1216
mandos_dbus_service = None
1217
1218
clients = Set()
1219
tcp_server = IPv6_TCPServer((server_settings["address"],
1220
server_settings["port"]),
1221
ClientHandler,
1222
interface=
1223
server_settings["interface"],
1224
use_ipv6=use_ipv6,
1225
clients=clients,
1226
gnutls_priority=
1227
server_settings["priority"],
1228
use_dbus=use_dbus)
1229
pidfilename = "/var/run/mandos.pid"
1230
try:
1231
pidfile = open(pidfilename, "w")
1232
except IOError:
1233
logger.error("Could not open file %r", pidfilename)
1234
1235
try:
1236
uid = pwd.getpwnam("_mandos").pw_uid
1237
gid = pwd.getpwnam("_mandos").pw_gid
1238
except KeyError:
1239
try:
1240
uid = pwd.getpwnam("mandos").pw_uid
1241
gid = pwd.getpwnam("mandos").pw_gid
1242
except KeyError:
1243
try:
1244
uid = pwd.getpwnam("nobody").pw_uid
1245
gid = pwd.getpwnam("nogroup").pw_gid
1246
except KeyError:
1247
uid = 65534
1248
gid = 65534
1249
try:
1250
os.setgid(gid)
1251
os.setuid(uid)
1252
except OSError, error:
1253
if error[0] != errno.EPERM:
1254
raise error
1255
1256
# Enable all possible GnuTLS debugging
1257
if debug:
1258
# "Use a log level over 10 to enable all debugging options."
1259
# - GnuTLS manual
1260
gnutls.library.functions.gnutls_global_set_log_level(11)
1261
1262
@gnutls.library.types.gnutls_log_func
1263
def debug_gnutls(level, string):
1264
logger.debug("GnuTLS: %s", string[:-1])
1265
1266
(gnutls.library.functions
1267
.gnutls_global_set_log_function(debug_gnutls))
1268
760
1269
761
global service
1270
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1271
762
service = AvahiService(name = server_settings["servicename"],
1272
servicetype = "_mandos._tcp",
1273
protocol = protocol)
763
type = "_mandos._tcp", );
1274
764
if server_settings["interface"]:
1275
service.interface = (if_nametoindex
1276
(server_settings["interface"]))
765
service.interface = if_nametoindex\
766
(server_settings["interface"])
1277
767
1278
768
global main_loop
1279
769
global bus
1286
776
avahi.DBUS_PATH_SERVER),
1287
777
avahi.DBUS_INTERFACE_SERVER)
1288
778
# End of Avahi example code
1289
if use_dbus:
1290
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1291
1292
client_class = Client
1293
if use_dbus:
1294
client_class = ClientDBus
1295
clients.update(Set(
1296
client_class(name = section,
1297
config= dict(client_config.items(section)))
1298
for section in client_config.sections()))
779
780
clients = Set()
781
def remove_from_clients(client):
782
clients.remove(client)
783
if not clients:
784
logger.critical(u"No clients left, exiting")
785
sys.exit()
786
787
clients.update(Set(Client(name = section,
788
stop_hook = remove_from_clients,
789
config
790
= dict(client_config.items(section)))
791
for section in client_config.sections()))
1299
792
if not clients:
1300
logger.warning(u"No clients defined")
793
logger.critical(u"No clients defined")
794
sys.exit(1)
1301
795
1302
796
if debug:
1303
797
# Redirect stdin so all checkers get /dev/null
1311
805
# Close all input and output, do double fork, etc.
1312
806
daemon()
1313
807
808
pidfilename = "/var/run/mandos/mandos.pid"
809
pid = os.getpid()
1314
810
try:
1315
with closing(pidfile):
1316
pid = os.getpid()
1317
pidfile.write(str(pid) + "\n")
811
pidfile = open(pidfilename, "w")
812
pidfile.write(str(pid) + "\n")
813
pidfile.close()
1318
814
del pidfile
1319
except IOError:
1320
logger.error(u"Could not write to file %r with PID %d",
1321
pidfilename, pid)
1322
except NameError:
1323
# "pidfile" was never created
1324
pass
1325
del pidfilename
815
except IOError, err:
816
logger.error(u"Could not write %s file with PID %d",
817
pidfilename, os.getpid())
1326
818
1327
819
def cleanup():
1328
820
"Cleanup function; run on exit"
1335
827
1336
828
while clients:
1337
829
client = clients.pop()
1338
client.disable_hook = None
1339
client.disable()
830
client.stop_hook = None
831
client.stop()
1340
832
1341
833
atexit.register(cleanup)
1342
834
1345
837
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1346
838
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1347
839
1348
if use_dbus:
1349
class MandosDBusService(dbus.service.Object):
1350
"""A D-Bus proxy object"""
1351
def __init__(self):
1352
dbus.service.Object.__init__(self, bus, "/")
1353
_interface = u"se.bsnet.fukt.Mandos"
1354
1355
@dbus.service.signal(_interface, signature="oa{sv}")
1356
def ClientAdded(self, objpath, properties):
1357
"D-Bus signal"
1358
pass
1359
1360
@dbus.service.signal(_interface, signature="s")
1361
def ClientNotFound(self, fingerprint):
1362
"D-Bus signal"
1363
pass
1364
1365
@dbus.service.signal(_interface, signature="os")
1366
def ClientRemoved(self, objpath, name):
1367
"D-Bus signal"
1368
pass
1369
1370
@dbus.service.method(_interface, out_signature="ao")
1371
def GetAllClients(self):
1372
"D-Bus method"
1373
return dbus.Array(c.dbus_object_path for c in clients)
1374
1375
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1376
def GetAllClientsWithProperties(self):
1377
"D-Bus method"
1378
return dbus.Dictionary(
1379
((c.dbus_object_path, c.GetAllProperties())
1380
for c in clients),
1381
signature="oa{sv}")
1382
1383
@dbus.service.method(_interface, in_signature="o")
1384
def RemoveClient(self, object_path):
1385
"D-Bus method"
1386
for c in clients:
1387
if c.dbus_object_path == object_path:
1388
clients.remove(c)
1389
c.remove_from_connection()
1390
# Don't signal anything except ClientRemoved
1391
c.disable(signal=False)
1392
# Emit D-Bus signal
1393
self.ClientRemoved(object_path, c.name)
1394
return
1395
raise KeyError
1396
1397
del _interface
1398
1399
mandos_dbus_service = MandosDBusService()
1400
1401
840
for client in clients:
1402
if use_dbus:
1403
# Emit D-Bus signal
1404
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1405
client.GetAllProperties())
1406
client.enable()
1407
1408
tcp_server.enable()
1409
tcp_server.server_activate()
1410
841
client.start()
842
843
tcp_server = IPv6_TCPServer((server_settings["address"],
844
server_settings["port"]),
845
tcp_handler,
846
settings=server_settings,
847
clients=clients)
1411
848
# Find out what port we got
1412
849
service.port = tcp_server.socket.getsockname()[1]
1413
if use_ipv6:
1414
logger.info(u"Now listening on address %r, port %d,"
1415
" flowinfo %d, scope_id %d"
1416
% tcp_server.socket.getsockname())
1417
else: # IPv4
1418
logger.info(u"Now listening on address %r, port %d"
1419
% tcp_server.socket.getsockname())
850
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
851
u" scope_id %d" % tcp_server.socket.getsockname())
1420
852
1421
853
#service.interface = tcp_server.socket.getsockname()[3]
1422
854
1432
864
1433
865
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1434
866
lambda *args, **kwargs:
1435
(tcp_server.handle_request
1436
(*args[2:], **kwargs) or True))
867
tcp_server.handle_request\
868
(*args[2:], **kwargs) or True)
1437
869
1438
870
logger.debug(u"Starting main loop")
871
main_loop_started = True
1439
872
main_loop.run()
1440
873
except AvahiError, error:
1441
logger.critical(u"AvahiError: %s", error)
874
logger.critical(u"AvahiError: %s" + unicode(error))
1442
875
sys.exit(1)
1443
876
except KeyboardInterrupt:
1444
877
if debug:
1445
print >> sys.stderr
1446
logger.debug("Server received KeyboardInterrupt")
1447
logger.debug("Server exiting")
878
print
1448
879
1449
880
if __name__ == '__main__':
1450
881
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0