To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 157
- compare with another revision
- download diff
- download tarball
- view history from revision 157
- Committer: Teddy Hogeborn
- Date: 2008-09-04 14:04:09 UTC
- Revision ID: teddy@fukt.bsnet.se-20080904140409-anr3hckg8ew7q60e
* plugin-runner.xml (BUGS): Document the non-recursiveness of the
"--config-file" option.
"--config-file" option.
- files added:
- .bzrignore
- plugins.d
- files removed:
- bad-ca.pem
- files renamed:
- mandos-clients.conf => clients.conf
- server.py => mandos
- files modified:
- Makefile
added
removed
mandos
1
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
# Mandos server - give out binary blobs to connecting clients.
5
#
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
#
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
15
#
16
# This program is free software: you can redistribute it and/or modify
17
# it under the terms of the GNU General Public License as published by
18
# the Free Software Foundation, either version 3 of the License, or
19
# (at your option) any later version.
20
#
21
# This program is distributed in the hope that it will be useful,
22
# but WITHOUT ANY WARRANTY; without even the implied warranty of
23
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24
# GNU General Public License for more details.
25
#
26
# You should have received a copy of the GNU General Public License
27
# along with this program. If not, see
28
# <http://www.gnu.org/licenses/>.
29
#
30
# Contact the authors at <mandos@fukt.bsnet.se>.
31
#
32
33
from __future__ import division
2
34
3
35
import SocketServer
4
36
import socket
9
41
import gnutls.crypto
10
42
import gnutls.connection
11
43
import gnutls.errors
44
import gnutls.library.functions
45
import gnutls.library.constants
46
import gnutls.library.types
12
47
import ConfigParser
13
48
import sys
49
import re
50
import os
51
import signal
52
from sets import Set
53
import subprocess
54
import atexit
55
import stat
56
import logging
57
import logging.handlers
58
59
import dbus
60
import gobject
61
import avahi
62
from dbus.mainloop.glib import DBusGMainLoop
63
import ctypes
64
65
version = "1.0"
66
67
logger = logging.Logger('mandos')
68
syslogger = logging.handlers.SysLogHandler\
69
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
70
address = "/dev/log")
71
syslogger.setFormatter(logging.Formatter\
72
('Mandos: %(levelname)s: %(message)s'))
73
logger.addHandler(syslogger)
74
75
console = logging.StreamHandler()
76
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
77
' %(message)s'))
78
logger.addHandler(console)
79
80
class AvahiError(Exception):
81
def __init__(self, value):
82
self.value = value
83
def __str__(self):
84
return repr(self.value)
85
86
class AvahiServiceError(AvahiError):
87
pass
88
89
class AvahiGroupError(AvahiError):
90
pass
91
92
93
class AvahiService(object):
94
"""An Avahi (Zeroconf) service.
95
Attributes:
96
interface: integer; avahi.IF_UNSPEC or an interface index.
97
Used to optionally bind to the specified interface.
98
name: string; Example: 'Mandos'
99
type: string; Example: '_mandos._tcp'.
100
See <http://www.dns-sd.org/ServiceTypes.html>
101
port: integer; what port to announce
102
TXT: list of strings; TXT record for the service
103
domain: string; Domain to publish on, default to .local if empty.
104
host: string; Host to publish records for, default is localhost
105
max_renames: integer; maximum number of renames
106
rename_count: integer; counter so we only rename after collisions
107
a sensible number of times
108
"""
109
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
110
type = None, port = None, TXT = None, domain = "",
111
host = "", max_renames = 32768):
112
self.interface = interface
113
self.name = name
114
self.type = type
115
self.port = port
116
if TXT is None:
117
self.TXT = []
118
else:
119
self.TXT = TXT
120
self.domain = domain
121
self.host = host
122
self.rename_count = 0
123
self.max_renames = max_renames
124
def rename(self):
125
"""Derived from the Avahi example code"""
126
if self.rename_count >= self.max_renames:
127
logger.critical(u"No suitable Zeroconf service name found"
128
u" after %i retries, exiting.",
129
rename_count)
130
raise AvahiServiceError("Too many renames")
131
self.name = server.GetAlternativeServiceName(self.name)
132
logger.info(u"Changing Zeroconf service name to %r ...",
133
str(self.name))
134
syslogger.setFormatter(logging.Formatter\
135
('Mandos (%s): %%(levelname)s:'
136
' %%(message)s' % self.name))
137
self.remove()
138
self.add()
139
self.rename_count += 1
140
def remove(self):
141
"""Derived from the Avahi example code"""
142
if group is not None:
143
group.Reset()
144
def add(self):
145
"""Derived from the Avahi example code"""
146
global group
147
if group is None:
148
group = dbus.Interface\
149
(bus.get_object(avahi.DBUS_NAME,
150
server.EntryGroupNew()),
151
avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
group.connect_to_signal('StateChanged',
153
entry_group_state_changed)
154
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
155
service.name, service.type)
156
group.AddService(
157
self.interface, # interface
158
avahi.PROTO_INET6, # protocol
159
dbus.UInt32(0), # flags
160
self.name, self.type,
161
self.domain, self.host,
162
dbus.UInt16(self.port),
163
avahi.string_array_to_txt_array(self.TXT))
164
group.Commit()
165
166
# From the Avahi example code:
167
group = None # our entry group
168
# End of Avahi example code
14
169
15
170
16
171
class Client(object):
17
def __init__(self, name=None, options=None, dn=None,
18
password=None, passfile=None, fqdn=None,
19
timeout=None, interval=-1):
172
"""A representation of a client host served by this server.
173
Attributes:
174
name: string; from the config file, used in log messages
175
fingerprint: string (40 or 32 hexadecimal digits); used to
176
uniquely identify the client
177
secret: bytestring; sent verbatim (over TLS) to client
178
host: string; available for use by the checker command
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
181
timeout: datetime.timedelta(); How long from last_checked_ok
182
until this client is invalid
183
interval: datetime.timedelta(); How often to start a new checker
184
stop_hook: If set, called by stop() as stop_hook(self)
185
checker: subprocess.Popen(); a running checker process used
186
to see if the client lives.
187
'None' if no process is running.
188
checker_initiator_tag: a gobject event source tag, or None
189
stop_initiator_tag: - '' -
190
checker_callback_tag: - '' -
191
checker_command: string; External command which is run to check if
192
client lives. %() expansions are done at
193
runtime with vars(self) as dict, so that for
194
instance %(name)s can be used in the command.
195
Private attibutes:
196
_timeout: Real variable for 'timeout'
197
_interval: Real variable for 'interval'
198
_timeout_milliseconds: Used when calling gobject.timeout_add()
199
_interval_milliseconds: - '' -
200
"""
201
def _set_timeout(self, timeout):
202
"Setter function for 'timeout' attribute"
203
self._timeout = timeout
204
self._timeout_milliseconds = ((self.timeout.days
205
* 24 * 60 * 60 * 1000)
206
+ (self.timeout.seconds * 1000)
207
+ (self.timeout.microseconds
208
// 1000))
209
timeout = property(lambda self: self._timeout,
210
_set_timeout)
211
del _set_timeout
212
def _set_interval(self, interval):
213
"Setter function for 'interval' attribute"
214
self._interval = interval
215
self._interval_milliseconds = ((self.interval.days
216
* 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds
218
* 1000)
219
+ (self.interval.microseconds
220
// 1000))
221
interval = property(lambda self: self._interval,
222
_set_interval)
223
del _set_interval
224
def __init__(self, name = None, stop_hook=None, config={}):
225
"""Note: the 'checker' key in 'config' sets the
226
'checker_command' attribute and *not* the 'checker'
227
attribute."""
20
228
self.name = name
21
self.dn = dn
22
if password:
23
self.password = password
24
elif passfile:
25
self.password = open(passfile).readall()
229
logger.debug(u"Creating client %r", self.name)
230
# Uppercase and remove spaces from fingerprint for later
231
# comparison purposes with return value from the fingerprint()
232
# function
233
self.fingerprint = config["fingerprint"].upper()\
234
.replace(u" ", u"")
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
236
if "secret" in config:
237
self.secret = config["secret"].decode(u"base64")
238
elif "secfile" in config:
239
sf = open(config["secfile"])
240
self.secret = sf.read()
241
sf.close()
26
242
else:
27
print "No Password or Passfile in client config file"
28
# raise RuntimeError XXX
29
self.password = "gazonk"
30
self.fqdn = fqdn
243
raise TypeError(u"No secret or secfile for client %s"
244
% self.name)
245
self.host = config.get("host", "")
31
246
self.created = datetime.datetime.now()
32
self.last_seen = None
33
if timeout is None:
34
timeout = options.timeout
35
self.timeout = timeout
36
if interval == -1:
37
interval = options.interval
38
self.interval = interval
39
self.next_check = datetime.datetime.now()
40
41
42
class server_metaclass(type):
43
"Common behavior for the UDP and TCP server classes"
44
def __new__(cls, name, bases, attrs):
45
attrs["address_family"] = socket.AF_INET6
46
attrs["allow_reuse_address"] = True
47
def server_bind(self):
48
if self.options.interface:
49
if not hasattr(socket, "SO_BINDTODEVICE"):
50
# From /usr/include/asm-i486/socket.h
51
socket.SO_BINDTODEVICE = 25
247
self.last_checked_ok = None
248
self.timeout = string_to_delta(config["timeout"])
249
self.interval = string_to_delta(config["interval"])
250
self.stop_hook = stop_hook
251
self.checker = None
252
self.checker_initiator_tag = None
253
self.stop_initiator_tag = None
254
self.checker_callback_tag = None
255
self.check_command = config["checker"]
256
def start(self):
257
"""Start this client's checker and timeout hooks"""
258
# Schedule a new checker to be started an 'interval' from now,
259
# and every interval from then on.
260
self.checker_initiator_tag = gobject.timeout_add\
261
(self._interval_milliseconds,
262
self.start_checker)
263
# Also start a new checker *right now*.
264
self.start_checker()
265
# Schedule a stop() when 'timeout' has passed
266
self.stop_initiator_tag = gobject.timeout_add\
267
(self._timeout_milliseconds,
268
self.stop)
269
def stop(self):
270
"""Stop this client.
271
The possibility that a client might be restarted is left open,
272
but not currently used."""
273
# If this client doesn't have a secret, it is already stopped.
274
if hasattr(self, "secret") and self.secret:
275
logger.info(u"Stopping client %s", self.name)
276
self.secret = None
277
else:
278
return False
279
if getattr(self, "stop_initiator_tag", False):
280
gobject.source_remove(self.stop_initiator_tag)
281
self.stop_initiator_tag = None
282
if getattr(self, "checker_initiator_tag", False):
283
gobject.source_remove(self.checker_initiator_tag)
284
self.checker_initiator_tag = None
285
self.stop_checker()
286
if self.stop_hook:
287
self.stop_hook(self)
288
# Do not run this again if called by a gobject.timeout_add
289
return False
290
def __del__(self):
291
self.stop_hook = None
292
self.stop()
293
def checker_callback(self, pid, condition):
294
"""The checker has completed, so take appropriate actions."""
295
now = datetime.datetime.now()
296
self.checker_callback_tag = None
297
self.checker = None
298
if os.WIFEXITED(condition) \
299
and (os.WEXITSTATUS(condition) == 0):
300
logger.info(u"Checker for %(name)s succeeded",
301
vars(self))
302
self.last_checked_ok = now
303
gobject.source_remove(self.stop_initiator_tag)
304
self.stop_initiator_tag = gobject.timeout_add\
305
(self._timeout_milliseconds,
306
self.stop)
307
elif not os.WIFEXITED(condition):
308
logger.warning(u"Checker for %(name)s crashed?",
309
vars(self))
310
else:
311
logger.info(u"Checker for %(name)s failed",
312
vars(self))
313
def start_checker(self):
314
"""Start a new checker subprocess if one is not running.
315
If a checker already exists, leave it running and do
316
nothing."""
317
# The reason for not killing a running checker is that if we
318
# did that, then if a checker (for some reason) started
319
# running slowly and taking more than 'interval' time, the
320
# client would inevitably timeout, since no checker would get
321
# a chance to run to completion. If we instead leave running
322
# checkers alone, the checker would have to take more time
323
# than 'timeout' for the client to be declared invalid, which
324
# is as it should be.
325
if self.checker is None:
326
try:
327
# In case check_command has exactly one % operator
328
command = self.check_command % self.host
329
except TypeError:
330
# Escape attributes for the shell
331
escaped_attrs = dict((key, re.escape(str(val)))
332
for key, val in
333
vars(self).iteritems())
52
334
try:
53
self.socket.setsockopt(socket.SOL_SOCKET,
54
socket.SO_BINDTODEVICE,
55
self.options.interface)
56
except socket.error, error:
57
if error[0] == errno.EPERM:
58
print "Warning: No permission to bind to interface", \
59
self.options.interface
60
else:
61
raise error
62
return super(type(self), self).server_bind()
63
attrs["server_bind"] = server_bind
64
def init(self, *args, **kwargs):
65
if "options" in kwargs:
66
self.options = kwargs["options"]
67
del kwargs["options"]
68
if "clients" in kwargs:
69
self.clients = kwargs["clients"]
70
del kwargs["clients"]
71
if "credentials" in kwargs:
72
self.credentials = kwargs["credentials"]
73
del kwargs["credentials"]
74
return super(type(self), self).__init__(*args, **kwargs)
75
attrs["__init__"] = init
76
return type.__new__(cls, name, bases, attrs)
77
78
79
class udp_handler(SocketServer.DatagramRequestHandler, object):
80
def handle(self):
81
self.wfile.write("Polo")
82
print "UDP request answered"
83
84
85
class IPv6_UDPServer(SocketServer.UDPServer, object):
86
__metaclass__ = server_metaclass
87
def verify_request(self, request, client_address):
88
print "UDP request came"
89
return request[0] == "Marco"
335
command = self.check_command % escaped_attrs
336
except TypeError, error:
337
logger.error(u'Could not format string "%s":'
338
u' %s', self.check_command, error)
339
return True # Try again later
340
try:
341
logger.info(u"Starting checker %r for %s",
342
command, self.name)
343
# We don't need to redirect stdout and stderr, since
344
# in normal mode, that is already done by daemon(),
345
# and in debug mode we don't want to. (Stdin is
346
# always replaced by /dev/null.)
347
self.checker = subprocess.Popen(command,
348
close_fds=True,
349
shell=True, cwd="/")
350
self.checker_callback_tag = gobject.child_watch_add\
351
(self.checker.pid,
352
self.checker_callback)
353
except OSError, error:
354
logger.error(u"Failed to start subprocess: %s",
355
error)
356
# Re-run this periodically if run by gobject.timeout_add
357
return True
358
def stop_checker(self):
359
"""Force the checker process, if any, to stop."""
360
if self.checker_callback_tag:
361
gobject.source_remove(self.checker_callback_tag)
362
self.checker_callback_tag = None
363
if getattr(self, "checker", None) is None:
364
return
365
logger.debug(u"Stopping checker for %(name)s", vars(self))
366
try:
367
os.kill(self.checker.pid, signal.SIGTERM)
368
#os.sleep(0.5)
369
#if self.checker.poll() is None:
370
# os.kill(self.checker.pid, signal.SIGKILL)
371
except OSError, error:
372
if error.errno != errno.ESRCH: # No such process
373
raise
374
self.checker = None
375
def still_valid(self):
376
"""Has the timeout not yet passed for this client?"""
377
now = datetime.datetime.now()
378
if self.last_checked_ok is None:
379
return now < (self.created + self.timeout)
380
else:
381
return now < (self.last_checked_ok + self.timeout)
382
383
384
def peer_certificate(session):
385
"Return the peer's OpenPGP certificate as a bytestring"
386
# If not an OpenPGP certificate...
387
if gnutls.library.functions.gnutls_certificate_type_get\
388
(session._c_object) \
389
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
390
# ...do the normal thing
391
return session.peer_certificate
392
list_size = ctypes.c_uint()
393
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
394
(session._c_object, ctypes.byref(list_size))
395
if list_size.value == 0:
396
return None
397
cert = cert_list[0]
398
return ctypes.string_at(cert.data, cert.size)
399
400
401
def fingerprint(openpgp):
402
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
403
# New GnuTLS "datum" with the OpenPGP public key
404
datum = gnutls.library.types.gnutls_datum_t\
405
(ctypes.cast(ctypes.c_char_p(openpgp),
406
ctypes.POINTER(ctypes.c_ubyte)),
407
ctypes.c_uint(len(openpgp)))
408
# New empty GnuTLS certificate
409
crt = gnutls.library.types.gnutls_openpgp_crt_t()
410
gnutls.library.functions.gnutls_openpgp_crt_init\
411
(ctypes.byref(crt))
412
# Import the OpenPGP public key into the certificate
413
gnutls.library.functions.gnutls_openpgp_crt_import\
414
(crt, ctypes.byref(datum),
415
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
416
# Verify the self signature in the key
417
crtverify = ctypes.c_uint();
418
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
419
(crt, 0, ctypes.byref(crtverify))
420
if crtverify.value != 0:
421
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
422
raise gnutls.errors.CertificateSecurityError("Verify failed")
423
# New buffer for the fingerprint
424
buffer = ctypes.create_string_buffer(20)
425
buffer_length = ctypes.c_size_t()
426
# Get the fingerprint from the certificate into the buffer
427
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
428
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
429
# Deinit the certificate
430
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
431
# Convert the buffer to a Python bytestring
432
fpr = ctypes.string_at(buffer, buffer_length.value)
433
# Convert the bytestring to hexadecimal notation
434
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
435
return hex_fpr
90
436
91
437
92
438
class tcp_handler(SocketServer.BaseRequestHandler, object):
439
"""A TCP request handler class.
440
Instantiated by IPv6_TCPServer for each request to handle it.
441
Note: This will run in its own forked process."""
442
93
443
def handle(self):
94
print "TCP request came"
95
print "Request:", self.request
96
print "Client Address:", self.client_address
97
print "Server:", self.server
98
session = gnutls.connection.ServerSession(self.request,
99
self.server.credentials)
100
session.handshake()
101
if session.peer_certificate:
102
print "DN:", session.peer_certificate.subject
103
try:
104
session.verify_peer()
105
except gnutls.errors.CertificateError, error:
106
print "Verify failed", error
107
session.bye()
108
return
109
try:
110
session.send(dict((client.dn, client.password)
111
for client in self.server.clients)
112
[session.peer_certificate.subject])
113
except KeyError:
114
session.send("gazonk")
115
# Log maybe? XXX
444
logger.info(u"TCP connection from: %s",
445
unicode(self.client_address))
446
session = gnutls.connection.ClientSession\
447
(self.request, gnutls.connection.X509Credentials())
448
449
line = self.request.makefile().readline()
450
logger.debug(u"Protocol version: %r", line)
451
try:
452
if int(line.strip().split()[0]) > 1:
453
raise RuntimeError
454
except (ValueError, IndexError, RuntimeError), error:
455
logger.error(u"Unknown protocol version: %s", error)
456
return
457
458
# Note: gnutls.connection.X509Credentials is really a generic
459
# GnuTLS certificate credentials object so long as no X.509
460
# keys are added to it. Therefore, we can use it here despite
461
# using OpenPGP certificates.
462
463
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
464
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
465
# "+DHE-DSS"))
466
priority = "NORMAL" # Fallback default, since this
467
# MUST be set.
468
if self.server.settings["priority"]:
469
priority = self.server.settings["priority"]
470
gnutls.library.functions.gnutls_priority_set_direct\
471
(session._c_object, priority, None);
472
473
try:
474
session.handshake()
475
except gnutls.errors.GNUTLSError, error:
476
logger.warning(u"Handshake failed: %s", error)
477
# Do not run session.bye() here: the session is not
478
# established. Just abandon the request.
479
return
480
try:
481
fpr = fingerprint(peer_certificate(session))
482
except (TypeError, gnutls.errors.GNUTLSError), error:
483
logger.warning(u"Bad certificate: %s", error)
484
session.bye()
485
return
486
logger.debug(u"Fingerprint: %s", fpr)
487
client = None
488
for c in self.server.clients:
489
if c.fingerprint == fpr:
490
client = c
491
break
492
if not client:
493
logger.warning(u"Client not found for fingerprint: %s",
494
fpr)
495
session.bye()
496
return
497
# Have to check if client.still_valid(), since it is possible
498
# that the client timed out while establishing the GnuTLS
499
# session.
500
if not client.still_valid():
501
logger.warning(u"Client %(name)s is invalid",
502
vars(client))
503
session.bye()
504
return
505
sent_size = 0
506
while sent_size < len(client.secret):
507
sent = session.send(client.secret[sent_size:])
508
logger.debug(u"Sent: %d, remaining: %d",
509
sent, len(client.secret)
510
- (sent_size + sent))
511
sent_size += sent
116
512
session.bye()
117
513
118
514
119
515
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
120
__metaclass__ = server_metaclass
121
request_queue_size = 1024
122
123
124
in6addr_any = "::"
125
126
cred = None
516
"""IPv6 TCP server. Accepts 'None' as address and/or port.
517
Attributes:
518
settings: Server settings
519
clients: Set() of Client objects
520
"""
521
address_family = socket.AF_INET6
522
def __init__(self, *args, **kwargs):
523
if "settings" in kwargs:
524
self.settings = kwargs["settings"]
525
del kwargs["settings"]
526
if "clients" in kwargs:
527
self.clients = kwargs["clients"]
528
del kwargs["clients"]
529
return super(type(self), self).__init__(*args, **kwargs)
530
def server_bind(self):
531
"""This overrides the normal server_bind() function
532
to bind to an interface if one was specified, and also NOT to
533
bind to an address or port if they were not specified."""
534
if self.settings["interface"]:
535
# 25 is from /usr/include/asm-i486/socket.h
536
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
537
try:
538
self.socket.setsockopt(socket.SOL_SOCKET,
539
SO_BINDTODEVICE,
540
self.settings["interface"])
541
except socket.error, error:
542
if error[0] == errno.EPERM:
543
logger.error(u"No permission to"
544
u" bind to interface %s",
545
self.settings["interface"])
546
else:
547
raise error
548
# Only bind(2) the socket if we really need to.
549
if self.server_address[0] or self.server_address[1]:
550
if not self.server_address[0]:
551
in6addr_any = "::"
552
self.server_address = (in6addr_any,
553
self.server_address[1])
554
elif not self.server_address[1]:
555
self.server_address = (self.server_address[0],
556
0)
557
# if self.settings["interface"]:
558
# self.server_address = (self.server_address[0],
559
# 0, # port
560
# 0, # flowinfo
561
# if_nametoindex
562
# (self.settings
563
# ["interface"]))
564
return super(type(self), self).server_bind()
565
127
566
128
567
def string_to_delta(interval):
129
568
"""Parse a string and return a datetime.timedelta
138
577
datetime.timedelta(1)
139
578
>>> string_to_delta(u'1w')
140
579
datetime.timedelta(7)
580
>>> string_to_delta('5m 30s')
581
datetime.timedelta(0, 330)
141
582
"""
142
try:
143
suffix=unicode(interval[-1])
144
value=int(interval[:-1])
145
if suffix == u"d":
146
delta = datetime.timedelta(value)
147
elif suffix == u"s":
148
delta = datetime.timedelta(0, value)
149
elif suffix == u"m":
150
delta = datetime.timedelta(0, 0, 0, 0, value)
151
elif suffix == u"h":
152
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
153
elif suffix == u"w":
154
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
155
else:
583
timevalue = datetime.timedelta(0)
584
for s in interval.split():
585
try:
586
suffix=unicode(s[-1])
587
value=int(s[:-1])
588
if suffix == u"d":
589
delta = datetime.timedelta(value)
590
elif suffix == u"s":
591
delta = datetime.timedelta(0, value)
592
elif suffix == u"m":
593
delta = datetime.timedelta(0, 0, 0, 0, value)
594
elif suffix == u"h":
595
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
596
elif suffix == u"w":
597
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
598
else:
599
raise ValueError
600
except (ValueError, IndexError):
156
601
raise ValueError
157
except (ValueError, IndexError):
158
raise ValueError
159
return delta
602
timevalue += delta
603
return timevalue
604
605
606
def server_state_changed(state):
607
"""Derived from the Avahi example code"""
608
if state == avahi.SERVER_COLLISION:
609
logger.error(u"Zeroconf server name collision")
610
service.remove()
611
elif state == avahi.SERVER_RUNNING:
612
service.add()
613
614
615
def entry_group_state_changed(state, error):
616
"""Derived from the Avahi example code"""
617
logger.debug(u"Avahi state change: %i", state)
618
619
if state == avahi.ENTRY_GROUP_ESTABLISHED:
620
logger.debug(u"Zeroconf service established.")
621
elif state == avahi.ENTRY_GROUP_COLLISION:
622
logger.warning(u"Zeroconf service name collision.")
623
service.rename()
624
elif state == avahi.ENTRY_GROUP_FAILURE:
625
logger.critical(u"Avahi: Error in group state changed %s",
626
unicode(error))
627
raise AvahiGroupError("State changed: %s", str(error))
628
629
def if_nametoindex(interface):
630
"""Call the C function if_nametoindex(), or equivalent"""
631
global if_nametoindex
632
try:
633
if "ctypes.util" not in sys.modules:
634
import ctypes.util
635
if_nametoindex = ctypes.cdll.LoadLibrary\
636
(ctypes.util.find_library("c")).if_nametoindex
637
except (OSError, AttributeError):
638
if "struct" not in sys.modules:
639
import struct
640
if "fcntl" not in sys.modules:
641
import fcntl
642
def if_nametoindex(interface):
643
"Get an interface index the hard way, i.e. using fcntl()"
644
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
645
s = socket.socket()
646
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
647
struct.pack("16s16x", interface))
648
s.close()
649
interface_index = struct.unpack("I", ifreq[16:20])[0]
650
return interface_index
651
return if_nametoindex(interface)
652
653
654
def daemon(nochdir = False, noclose = False):
655
"""See daemon(3). Standard BSD Unix function.
656
This should really exist as os.daemon, but it doesn't (yet)."""
657
if os.fork():
658
sys.exit()
659
os.setsid()
660
if not nochdir:
661
os.chdir("/")
662
if os.fork():
663
sys.exit()
664
if not noclose:
665
# Close all standard open file descriptors
666
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
667
if not stat.S_ISCHR(os.fstat(null).st_mode):
668
raise OSError(errno.ENODEV,
669
"/dev/null not a character device")
670
os.dup2(null, sys.stdin.fileno())
671
os.dup2(null, sys.stdout.fileno())
672
os.dup2(null, sys.stderr.fileno())
673
if null > 2:
674
os.close(null)
675
160
676
161
677
def main():
162
parser = OptionParser()
678
global main_loop_started
679
main_loop_started = False
680
681
parser = OptionParser(version = "%%prog %s" % version)
163
682
parser.add_option("-i", "--interface", type="string",
164
default="eth0", metavar="IF",
165
help="Interface to bind to")
166
parser.add_option("--cert", type="string", default="cert.pem",
167
metavar="FILE",
168
help="Public key certificate to use")
169
parser.add_option("--key", type="string", default="key.pem",
170
metavar="FILE",
171
help="Private key to use")
172
parser.add_option("--ca", type="string", default="ca.pem",
173
metavar="FILE",
174
help="Certificate Authority certificate to use")
175
parser.add_option("--crl", type="string", default="crl.pem",
176
metavar="FILE",
177
help="Certificate Revokation List to use")
178
parser.add_option("-p", "--port", type="int", default=49001,
683
metavar="IF", help="Bind to interface IF")
684
parser.add_option("-a", "--address", type="string",
685
help="Address to listen for requests on")
686
parser.add_option("-p", "--port", type="int",
179
687
help="Port number to receive requests on")
180
parser.add_option("--dh", type="int", metavar="BITS",
181
help="DH group to use")
182
parser.add_option("-t", "--timeout", type="string", # Parsed later
183
default="15m",
184
help="Amount of downtime allowed for clients")
185
parser.add_option("--interval", type="string", # Parsed later
186
default="5m",
187
help="How often to check that a client is up")
188
688
parser.add_option("--check", action="store_true", default=False,
189
689
help="Run self-test")
690
parser.add_option("--debug", action="store_true",
691
help="Debug mode; run in foreground and log to"
692
" terminal")
693
parser.add_option("--priority", type="string", help="GnuTLS"
694
" priority string (see GnuTLS documentation)")
695
parser.add_option("--servicename", type="string", metavar="NAME",
696
help="Zeroconf service name")
697
parser.add_option("--configdir", type="string",
698
default="/etc/mandos", metavar="DIR",
699
help="Directory to search for configuration"
700
" files")
190
701
(options, args) = parser.parse_args()
191
702
192
703
if options.check:
193
704
import doctest
194
705
doctest.testmod()
195
706
sys.exit()
196
707
197
# Parse the time arguments
198
try:
199
options.timeout = string_to_delta(options.timeout)
200
except ValueError:
201
parser.error("option --timeout: Unparseable time")
202
203
try:
204
options.interval = string_to_delta(options.interval)
205
except ValueError:
206
parser.error("option --interval: Unparseable time")
207
208
cert = gnutls.crypto.X509Certificate(open(options.cert).read())
209
key = gnutls.crypto.X509PrivateKey(open(options.key).read())
210
ca = gnutls.crypto.X509Certificate(open(options.ca).read())
211
crl = gnutls.crypto.X509CRL(open(options.crl).read())
212
cred = gnutls.connection.X509Credentials(cert, key, [ca], [crl])
213
214
# Parse config file
215
defaults = {}
216
client_config_object = ConfigParser.SafeConfigParser(defaults)
217
client_config_object.read("mandos-clients.conf")
218
clients = [Client(name=section, options=options,
219
**(dict(client_config_object.items(section))))
220
for section in client_config_object.sections()]
221
222
udp_server = IPv6_UDPServer((in6addr_any, options.port),
223
udp_handler,
224
options=options)
225
226
tcp_server = IPv6_TCPServer((in6addr_any, options.port),
708
# Default values for config file for server-global settings
709
server_defaults = { "interface": "",
710
"address": "",
711
"port": "",
712
"debug": "False",
713
"priority":
714
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
715
"servicename": "Mandos",
716
}
717
718
# Parse config file for server-global settings
719
server_config = ConfigParser.SafeConfigParser(server_defaults)
720
del server_defaults
721
server_config.read(os.path.join(options.configdir, "mandos.conf"))
722
# Convert the SafeConfigParser object to a dict
723
server_settings = server_config.defaults()
724
# Use getboolean on the boolean config option
725
server_settings["debug"] = server_config.getboolean\
726
("DEFAULT", "debug")
727
del server_config
728
729
# Override the settings from the config file with command line
730
# options, if set.
731
for option in ("interface", "address", "port", "debug",
732
"priority", "servicename", "configdir"):
733
value = getattr(options, option)
734
if value is not None:
735
server_settings[option] = value
736
del options
737
# Now we have our good server settings in "server_settings"
738
739
debug = server_settings["debug"]
740
741
if not debug:
742
syslogger.setLevel(logging.WARNING)
743
console.setLevel(logging.WARNING)
744
745
if server_settings["servicename"] != "Mandos":
746
syslogger.setFormatter(logging.Formatter\
747
('Mandos (%s): %%(levelname)s:'
748
' %%(message)s'
749
% server_settings["servicename"]))
750
751
# Parse config file with clients
752
client_defaults = { "timeout": "1h",
753
"interval": "5m",
754
"checker": "fping -q -- %(host)s",
755
"host": "",
756
}
757
client_config = ConfigParser.SafeConfigParser(client_defaults)
758
client_config.read(os.path.join(server_settings["configdir"],
759
"clients.conf"))
760
761
global service
762
service = AvahiService(name = server_settings["servicename"],
763
type = "_mandos._tcp", );
764
if server_settings["interface"]:
765
service.interface = if_nametoindex\
766
(server_settings["interface"])
767
768
global main_loop
769
global bus
770
global server
771
# From the Avahi example code
772
DBusGMainLoop(set_as_default=True )
773
main_loop = gobject.MainLoop()
774
bus = dbus.SystemBus()
775
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
776
avahi.DBUS_PATH_SERVER),
777
avahi.DBUS_INTERFACE_SERVER)
778
# End of Avahi example code
779
780
clients = Set()
781
def remove_from_clients(client):
782
clients.remove(client)
783
if not clients:
784
logger.critical(u"No clients left, exiting")
785
sys.exit()
786
787
clients.update(Set(Client(name = section,
788
stop_hook = remove_from_clients,
789
config
790
= dict(client_config.items(section)))
791
for section in client_config.sections()))
792
if not clients:
793
logger.critical(u"No clients defined")
794
sys.exit(1)
795
796
if debug:
797
# Redirect stdin so all checkers get /dev/null
798
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
799
os.dup2(null, sys.stdin.fileno())
800
if null > 2:
801
os.close(null)
802
else:
803
# No console logging
804
logger.removeHandler(console)
805
# Close all input and output, do double fork, etc.
806
daemon()
807
808
pidfilename = "/var/run/mandos/mandos.pid"
809
pid = os.getpid()
810
try:
811
pidfile = open(pidfilename, "w")
812
pidfile.write(str(pid) + "\n")
813
pidfile.close()
814
del pidfile
815
except IOError, err:
816
logger.error(u"Could not write %s file with PID %d",
817
pidfilename, os.getpid())
818
819
def cleanup():
820
"Cleanup function; run on exit"
821
global group
822
# From the Avahi example code
823
if not group is None:
824
group.Free()
825
group = None
826
# End of Avahi example code
827
828
while clients:
829
client = clients.pop()
830
client.stop_hook = None
831
client.stop()
832
833
atexit.register(cleanup)
834
835
if not debug:
836
signal.signal(signal.SIGINT, signal.SIG_IGN)
837
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
838
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
839
840
for client in clients:
841
client.start()
842
843
tcp_server = IPv6_TCPServer((server_settings["address"],
844
server_settings["port"]),
227
845
tcp_handler,
228
options=options,
229
clients=clients,
230
credentials=cred)
231
232
while True:
233
in_, out, err = select.select((udp_server,
234
tcp_server), (), ())
235
for server in in_:
236
server.handle_request()
237
238
239
if __name__ == "__main__":
846
settings=server_settings,
847
clients=clients)
848
# Find out what port we got
849
service.port = tcp_server.socket.getsockname()[1]
850
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
851
u" scope_id %d" % tcp_server.socket.getsockname())
852
853
#service.interface = tcp_server.socket.getsockname()[3]
854
855
try:
856
# From the Avahi example code
857
server.connect_to_signal("StateChanged", server_state_changed)
858
try:
859
server_state_changed(server.GetState())
860
except dbus.exceptions.DBusException, error:
861
logger.critical(u"DBusException: %s", error)
862
sys.exit(1)
863
# End of Avahi example code
864
865
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
866
lambda *args, **kwargs:
867
tcp_server.handle_request\
868
(*args[2:], **kwargs) or True)
869
870
logger.debug(u"Starting main loop")
871
main_loop_started = True
872
main_loop.run()
873
except AvahiError, error:
874
logger.critical(u"AvahiError: %s" + unicode(error))
875
sys.exit(1)
876
except KeyboardInterrupt:
877
if debug:
878
print
879
880
if __name__ == '__main__':
240
881
main()
241
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0