/mandos/trunk : revision 165

24

# GNU General Public License for more details.

25

#

26

# You should have received a copy of the GNU General Public License

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

27

# along with this program. If not, see

28

# <http://www.gnu.org/licenses/>.

28

29

#

29

30

# Contact the authors at <mandos@fukt.bsnet.se>.

30

31

#

54

55

import stat

55

56

import logging

56

57

import logging.handlers

58

import pwd

57

59

58

60

import dbus

59

61

import gobject

119

121

self.domain = domain

120

122

self.host = host

121

123

self.rename_count = 0

124

self.max_renames = max_renames

122

125

def rename(self):

123

126

"""Derived from the Avahi example code"""

124

127

if self.rename_count >= self.max_renames:

125

logger.critical(u"No suitable service name found after %i"

126

u" retries, exiting.", rename_count)

128

logger.critical(u"No suitable Zeroconf service name found"

129

u" after %i retries, exiting.",

130

rename_count)

127

131

raise AvahiServiceError("Too many renames")

128

name = server.GetAlternativeServiceName(name)

129

logger.error(u"Changing name to %r ...", name)

132

self.name = server.GetAlternativeServiceName(self.name)

133

logger.info(u"Changing Zeroconf service name to %r ...",

134

str(self.name))

130

135

syslogger.setFormatter(logging.Formatter\

131

136

('Mandos (%s): %%(levelname)s:'

132

' %%(message)s' % name))

137

' %%(message)s' % self.name))

133

138

self.remove()

134

139

self.add()

135

140

self.rename_count += 1

147

152

avahi.DBUS_INTERFACE_ENTRY_GROUP)

148

153

group.connect_to_signal('StateChanged',

149

154

entry_group_state_changed)

150

logger.debug(u"Adding service '%s' of type '%s' ...",

155

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

151

156

service.name, service.type)

152

157

group.AddService(

153

158

self.interface, # interface

336

341

try:

337

342

logger.info(u"Starting checker %r for %s",

338

343

command, self.name)

344

# We don't need to redirect stdout and stderr, since

345

# in normal mode, that is already done by daemon(),

346

# and in debug mode we don't want to. (Stdin is

347

# always replaced by /dev/null.)

339

348

self.checker = subprocess.Popen(command,

340

349

close_fds=True,

341

350

shell=True, cwd="/")

342

351

self.checker_callback_tag = gobject.child_watch_add\

343

352

(self.checker.pid,

344

353

self.checker_callback)

345

except subprocess.OSError, error:

354

except OSError, error:

346

355

logger.error(u"Failed to start subprocess: %s",

347

356

error)

348

357

# Re-run this periodically if run by gobject.timeout_add

405

414

gnutls.library.functions.gnutls_openpgp_crt_import\

406

415

(crt, ctypes.byref(datum),

407

416

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

417

# Verify the self signature in the key

418

crtverify = ctypes.c_uint();

419

gnutls.library.functions.gnutls_openpgp_crt_verify_self\

420

(crt, 0, ctypes.byref(crtverify))

421

if crtverify.value != 0:

422

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

423

raise gnutls.errors.CertificateSecurityError("Verify failed")

408

424

# New buffer for the fingerprint

409

425

buffer = ctypes.create_string_buffer(20)

410

426

buffer_length = ctypes.c_size_t()

502

518

Attributes:

503

519

settings: Server settings

504

520

clients: Set() of Client objects

521

enabled: Boolean; whether this server is activated yet

505

522

"""

506

523

address_family = socket.AF_INET6

507

524

def __init__(self, *args, **kwargs):

511

528

if "clients" in kwargs:

512

529

self.clients = kwargs["clients"]

513

530

del kwargs["clients"]

531

self.enabled = False

514

532

return super(type(self), self).__init__(*args, **kwargs)

515

533

def server_bind(self):

516

534

"""This overrides the normal server_bind() function

547

565

# (self.settings

548

566

# ["interface"]))

549

567

return super(type(self), self).server_bind()

568

def server_activate(self):

569

if self.enabled:

570

return super(type(self), self).server_activate()

571

def enable(self):

572

self.enabled = True

550

573

551

574

552

575

def string_to_delta(interval):

562

585

datetime.timedelta(1)

563

586

>>> string_to_delta(u'1w')

564

587

datetime.timedelta(7)

588

>>> string_to_delta('5m 30s')

589

datetime.timedelta(0, 330)

565

590

"""

566

try:

567

suffix=unicode(interval[-1])

568

value=int(interval[:-1])

569

if suffix == u"d":

570

delta = datetime.timedelta(value)

571

elif suffix == u"s":

572

delta = datetime.timedelta(0, value)

573

elif suffix == u"m":

574

delta = datetime.timedelta(0, 0, 0, 0, value)

575

elif suffix == u"h":

576

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

577

elif suffix == u"w":

578

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

579

else:

591

timevalue = datetime.timedelta(0)

592

for s in interval.split():

593

try:

594

suffix=unicode(s[-1])

595

value=int(s[:-1])

596

if suffix == u"d":

597

delta = datetime.timedelta(value)

598

elif suffix == u"s":

599

delta = datetime.timedelta(0, value)

600

elif suffix == u"m":

601

delta = datetime.timedelta(0, 0, 0, 0, value)

602

elif suffix == u"h":

603

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

604

elif suffix == u"w":

605

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

606

else:

607

raise ValueError

608

except (ValueError, IndexError):

580

609

raise ValueError

581

except (ValueError, IndexError):

582

raise ValueError

583

return delta

610

timevalue += delta

611

return timevalue

584

612

585

613

586

614

def server_state_changed(state):

587

615

"""Derived from the Avahi example code"""

588

616

if state == avahi.SERVER_COLLISION:

589

logger.error(u"Server name collision")

617

logger.error(u"Zeroconf server name collision")

590

618

service.remove()

591

619

elif state == avahi.SERVER_RUNNING:

592

620

service.add()

594

622

595

623

def entry_group_state_changed(state, error):

596

624

"""Derived from the Avahi example code"""

597

logger.debug(u"state change: %i", state)

625

logger.debug(u"Avahi state change: %i", state)

598

626

599

627

if state == avahi.ENTRY_GROUP_ESTABLISHED:

600

logger.debug(u"Service established.")

628

logger.debug(u"Zeroconf service established.")

601

629

elif state == avahi.ENTRY_GROUP_COLLISION:

602

logger.warning(u"Service name collision.")

630

logger.warning(u"Zeroconf service name collision.")

603

631

service.rename()

604

632

elif state == avahi.ENTRY_GROUP_FAILURE:

605

logger.critical(u"Error in group state changed %s",

633

logger.critical(u"Avahi: Error in group state changed %s",

606

634

unicode(error))

607

635

raise AvahiGroupError("State changed: %s", str(error))

608

636

699

727

server_config = ConfigParser.SafeConfigParser(server_defaults)

700

728

del server_defaults

701

729

server_config.read(os.path.join(options.configdir, "mandos.conf"))

702

server_section = "server"

703

730

# Convert the SafeConfigParser object to a dict

704

server_settings = dict(server_config.items(server_section))

731

server_settings = server_config.defaults()

705

732

# Use getboolean on the boolean config option

706

733

server_settings["debug"] = server_config.getboolean\

707

(server_section, "debug")

734

("DEFAULT", "debug")

708

735

del server_config

709

736

710

737

# Override the settings from the config file with command line

732

759

# Parse config file with clients

733

760

client_defaults = { "timeout": "1h",

734

761

"interval": "5m",

735

"checker": "fping -q -- %%(host)s",

762

"checker": "fping -q -- %(host)s",

763

"host": "",

736

764

}

737

765

client_config = ConfigParser.SafeConfigParser(client_defaults)

738

766

client_config.read(os.path.join(server_settings["configdir"],

739

767

"clients.conf"))

740

768

769

clients = Set()

770

tcp_server = IPv6_TCPServer((server_settings["address"],

771

server_settings["port"]),

772

tcp_handler,

773

settings=server_settings,

774

clients=clients)

775

pidfilename = "/var/run/mandos.pid"

776

try:

777

pidfile = open(pidfilename, "w")

778

except IOError, error:

779

logger.error("Could not open file %r", pidfilename)

780

781

uid = 65534

782

gid = 65534

783

try:

784

uid = pwd.getpwnam("mandos").pw_uid

785

except KeyError:

786

try:

787

uid = pwd.getpwnam("nobody").pw_uid

788

except KeyError:

789

pass

790

try:

791

gid = pwd.getpwnam("mandos").pw_gid

792

except KeyError:

793

try:

794

gid = pwd.getpwnam("nogroup").pw_gid

795

except KeyError:

796

pass

797

try:

798

os.setuid(uid)

799

os.setgid(gid)

800

except OSError, error:

801

if error[0] != errno.EPERM:

802

raise error

803

741

804

global service

742

805

service = AvahiService(name = server_settings["servicename"],

743

806

type = "_mandos._tcp", );

744

807

if server_settings["interface"]:

745

service.interface = if_nametoindex(server_settings["interface"])

808

service.interface = if_nametoindex\

809

(server_settings["interface"])

746

810

747

811

global main_loop

748

812

global bus

751

815

DBusGMainLoop(set_as_default=True )

752

816

main_loop = gobject.MainLoop()

753

817

bus = dbus.SystemBus()

754

server = dbus.Interface(

755

bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),

756

avahi.DBUS_INTERFACE_SERVER )

818

server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,

819

avahi.DBUS_PATH_SERVER),

820

avahi.DBUS_INTERFACE_SERVER)

757

821

# End of Avahi example code

758

822

759

clients = Set()

760

823

def remove_from_clients(client):

761

824

clients.remove(client)

762

825

if not clients:

772

835

logger.critical(u"No clients defined")

773

836

sys.exit(1)

774

837

775

if not debug:

838

if debug:

839

# Redirect stdin so all checkers get /dev/null

840

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

841

os.dup2(null, sys.stdin.fileno())

842

if null > 2:

843

os.close(null)

844

else:

845

# No console logging

776

846

logger.removeHandler(console)

847

# Close all input and output, do double fork, etc.

777

848

daemon()

778

849

779

pidfilename = "/var/run/mandos/mandos.pid"

780

pid = os.getpid()

781

850

try:

782

pidfile = open(pidfilename, "w")

851

pid = os.getpid()

783

852

pidfile.write(str(pid) + "\n")

784

853

pidfile.close()

785

854

del pidfile

786

855

except IOError, err:

787

logger.error(u"Could not write %s file with PID %d",

788

pidfilename, os.getpid())

856

logger.error(u"Could not write to file %r with PID %d",

857

pidfilename, pid)

858

except NameError:

859

# "pidfile" was never created

860

pass

861

del pidfilename

789

862

790

863

def cleanup():

791

864

"Cleanup function; run on exit"

811

884

for client in clients:

812

885

client.start()

813

886

814

tcp_server = IPv6_TCPServer((server_settings["address"],

815

server_settings["port"]),

816

tcp_handler,

817

settings=server_settings,

818

clients=clients)

887

tcp_server.enable()

888

tcp_server.server_activate()

889

819

890

# Find out what port we got

820

891

service.port = tcp_server.socket.getsockname()[1]

821

892

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"