/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2008-09-12 19:12:40 UTC
  • Revision ID: teddy@fukt.bsnet.se-20080912191240-edjlcll43eoijkx0
* Makefile (install): Use "install-client-nokey".
  (install-server): Create "/etc/default" and "/usr/sbin", too.
  (install-client): Do not depend on "$(INITRAMFSTOOLS)/hooks/.".
                    Renamed to "install-client-nokey".  Split out
                    post-installation-stuff to new "install-client"
                    target.

* mandos-clients.conf.xml: White space adjustments.
* mandos-keygen.xml: - '' -
* mandos.conf.xml: - '' -
* mandos.xml: - '' -
* plugin-runner.xml: - '' -
* plugins.d/mandos-client.xml: - '' -

* overview.xml: Improved grammar.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
24
24
#     GNU General Public License for more details.
25
25
# 
26
26
# You should have received a copy of the GNU General Public License
27
 
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
27
# along with this program.  If not, see
 
28
# <http://www.gnu.org/licenses/>.
28
29
# 
29
30
# Contact the authors at <mandos@fukt.bsnet.se>.
30
31
# 
54
55
import stat
55
56
import logging
56
57
import logging.handlers
 
58
import pwd
57
59
 
58
60
import dbus
59
61
import gobject
61
63
from dbus.mainloop.glib import DBusGMainLoop
62
64
import ctypes
63
65
 
 
66
version = "1.0"
64
67
 
65
68
logger = logging.Logger('mandos')
66
69
syslogger = logging.handlers.SysLogHandler\
67
 
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON)
 
70
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
71
             address = "/dev/log")
68
72
syslogger.setFormatter(logging.Formatter\
69
 
                        ('%(levelname)s: %(message)s'))
 
73
                        ('Mandos: %(levelname)s: %(message)s'))
70
74
logger.addHandler(syslogger)
71
 
del syslogger
72
75
 
 
76
console = logging.StreamHandler()
 
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
 
78
                                       ' %(message)s'))
 
79
logger.addHandler(console)
73
80
 
74
81
class AvahiError(Exception):
75
82
    def __init__(self, value):
102
109
    """
103
110
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
104
111
                 type = None, port = None, TXT = None, domain = "",
105
 
                 host = "", max_renames = 12):
 
112
                 host = "", max_renames = 32768):
106
113
        self.interface = interface
107
114
        self.name = name
108
115
        self.type = type
114
121
        self.domain = domain
115
122
        self.host = host
116
123
        self.rename_count = 0
 
124
        self.max_renames = max_renames
117
125
    def rename(self):
118
126
        """Derived from the Avahi example code"""
119
127
        if self.rename_count >= self.max_renames:
120
 
            logger.critical(u"No suitable service name found after %i"
121
 
                            u" retries, exiting.", rename_count)
 
128
            logger.critical(u"No suitable Zeroconf service name found"
 
129
                            u" after %i retries, exiting.",
 
130
                            rename_count)
122
131
            raise AvahiServiceError("Too many renames")
123
 
        name = server.GetAlternativeServiceName(name)
124
 
        logger.error(u"Changing name to %r ...", name)
 
132
        self.name = server.GetAlternativeServiceName(self.name)
 
133
        logger.info(u"Changing Zeroconf service name to %r ...",
 
134
                    str(self.name))
 
135
        syslogger.setFormatter(logging.Formatter\
 
136
                               ('Mandos (%s): %%(levelname)s:'
 
137
                               ' %%(message)s' % self.name))
125
138
        self.remove()
126
139
        self.add()
127
140
        self.rename_count += 1
139
152
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
140
153
            group.connect_to_signal('StateChanged',
141
154
                                    entry_group_state_changed)
142
 
        logger.debug(u"Adding service '%s' of type '%s' ...",
 
155
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
143
156
                     service.name, service.type)
144
157
        group.AddService(
145
158
                self.interface,         # interface
163
176
    fingerprint: string (40 or 32 hexadecimal digits); used to
164
177
                 uniquely identify the client
165
178
    secret:    bytestring; sent verbatim (over TLS) to client
166
 
    fqdn:      string (FQDN); available for use by the checker command
 
179
    host:      string; available for use by the checker command
167
180
    created:   datetime.datetime(); object creation, not client host
168
181
    last_checked_ok: datetime.datetime() or None if not yet checked OK
169
182
    timeout:   datetime.timedelta(); How long from last_checked_ok
230
243
        else:
231
244
            raise TypeError(u"No secret or secfile for client %s"
232
245
                            % self.name)
233
 
        self.fqdn = config.get("fqdn", "")
 
246
        self.host = config.get("host", "")
234
247
        self.created = datetime.datetime.now()
235
248
        self.last_checked_ok = None
236
249
        self.timeout = string_to_delta(config["timeout"])
259
272
        The possibility that a client might be restarted is left open,
260
273
        but not currently used."""
261
274
        # If this client doesn't have a secret, it is already stopped.
262
 
        if self.secret:
 
275
        if hasattr(self, "secret") and self.secret:
263
276
            logger.info(u"Stopping client %s", self.name)
264
277
            self.secret = None
265
278
        else:
313
326
        if self.checker is None:
314
327
            try:
315
328
                # In case check_command has exactly one % operator
316
 
                command = self.check_command % self.fqdn
 
329
                command = self.check_command % self.host
317
330
            except TypeError:
318
331
                # Escape attributes for the shell
319
332
                escaped_attrs = dict((key, re.escape(str(val)))
328
341
            try:
329
342
                logger.info(u"Starting checker %r for %s",
330
343
                            command, self.name)
 
344
                # We don't need to redirect stdout and stderr, since
 
345
                # in normal mode, that is already done by daemon(),
 
346
                # and in debug mode we don't want to.  (Stdin is
 
347
                # always replaced by /dev/null.)
331
348
                self.checker = subprocess.Popen(command,
332
349
                                                close_fds=True,
333
350
                                                shell=True, cwd="/")
334
351
                self.checker_callback_tag = gobject.child_watch_add\
335
352
                                            (self.checker.pid,
336
353
                                             self.checker_callback)
337
 
            except subprocess.OSError, error:
 
354
            except OSError, error:
338
355
                logger.error(u"Failed to start subprocess: %s",
339
356
                             error)
340
357
        # Re-run this periodically if run by gobject.timeout_add
346
363
            self.checker_callback_tag = None
347
364
        if getattr(self, "checker", None) is None:
348
365
            return
349
 
        logger.debug("Stopping checker for %(name)s", vars(self))
 
366
        logger.debug(u"Stopping checker for %(name)s", vars(self))
350
367
        try:
351
368
            os.kill(self.checker.pid, signal.SIGTERM)
352
369
            #os.sleep(0.5)
397
414
    gnutls.library.functions.gnutls_openpgp_crt_import\
398
415
                    (crt, ctypes.byref(datum),
399
416
                     gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
417
    # Verify the self signature in the key
 
418
    crtverify = ctypes.c_uint();
 
419
    gnutls.library.functions.gnutls_openpgp_crt_verify_self\
 
420
        (crt, 0, ctypes.byref(crtverify))
 
421
    if crtverify.value != 0:
 
422
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
423
        raise gnutls.errors.CertificateSecurityError("Verify failed")
400
424
    # New buffer for the fingerprint
401
425
    buffer = ctypes.create_string_buffer(20)
402
426
    buffer_length = ctypes.c_size_t()
494
518
    Attributes:
495
519
        settings:       Server settings
496
520
        clients:        Set() of Client objects
 
521
        enabled:        Boolean; whether this server is activated yet
497
522
    """
498
523
    address_family = socket.AF_INET6
499
524
    def __init__(self, *args, **kwargs):
503
528
        if "clients" in kwargs:
504
529
            self.clients = kwargs["clients"]
505
530
            del kwargs["clients"]
 
531
        self.enabled = False
506
532
        return super(type(self), self).__init__(*args, **kwargs)
507
533
    def server_bind(self):
508
534
        """This overrides the normal server_bind() function
539
565
#                                            (self.settings
540
566
#                                             ["interface"]))
541
567
            return super(type(self), self).server_bind()
 
568
    def server_activate(self):
 
569
        if self.enabled:
 
570
            return super(type(self), self).server_activate()
 
571
    def enable(self):
 
572
        self.enabled = True
542
573
 
543
574
 
544
575
def string_to_delta(interval):
554
585
    datetime.timedelta(1)
555
586
    >>> string_to_delta(u'1w')
556
587
    datetime.timedelta(7)
 
588
    >>> string_to_delta('5m 30s')
 
589
    datetime.timedelta(0, 330)
557
590
    """
558
 
    try:
559
 
        suffix=unicode(interval[-1])
560
 
        value=int(interval[:-1])
561
 
        if suffix == u"d":
562
 
            delta = datetime.timedelta(value)
563
 
        elif suffix == u"s":
564
 
            delta = datetime.timedelta(0, value)
565
 
        elif suffix == u"m":
566
 
            delta = datetime.timedelta(0, 0, 0, 0, value)
567
 
        elif suffix == u"h":
568
 
            delta = datetime.timedelta(0, 0, 0, 0, 0, value)
569
 
        elif suffix == u"w":
570
 
            delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
571
 
        else:
 
591
    timevalue = datetime.timedelta(0)
 
592
    for s in interval.split():
 
593
        try:
 
594
            suffix=unicode(s[-1])
 
595
            value=int(s[:-1])
 
596
            if suffix == u"d":
 
597
                delta = datetime.timedelta(value)
 
598
            elif suffix == u"s":
 
599
                delta = datetime.timedelta(0, value)
 
600
            elif suffix == u"m":
 
601
                delta = datetime.timedelta(0, 0, 0, 0, value)
 
602
            elif suffix == u"h":
 
603
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
 
604
            elif suffix == u"w":
 
605
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
 
606
            else:
 
607
                raise ValueError
 
608
        except (ValueError, IndexError):
572
609
            raise ValueError
573
 
    except (ValueError, IndexError):
574
 
        raise ValueError
575
 
    return delta
 
610
        timevalue += delta
 
611
    return timevalue
576
612
 
577
613
 
578
614
def server_state_changed(state):
579
615
    """Derived from the Avahi example code"""
580
616
    if state == avahi.SERVER_COLLISION:
581
 
        logger.error(u"Server name collision")
 
617
        logger.error(u"Zeroconf server name collision")
582
618
        service.remove()
583
619
    elif state == avahi.SERVER_RUNNING:
584
620
        service.add()
586
622
 
587
623
def entry_group_state_changed(state, error):
588
624
    """Derived from the Avahi example code"""
589
 
    logger.debug(u"state change: %i", state)
 
625
    logger.debug(u"Avahi state change: %i", state)
590
626
    
591
627
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
592
 
        logger.debug(u"Service established.")
 
628
        logger.debug(u"Zeroconf service established.")
593
629
    elif state == avahi.ENTRY_GROUP_COLLISION:
594
 
        logger.warning(u"Service name collision.")
 
630
        logger.warning(u"Zeroconf service name collision.")
595
631
        service.rename()
596
632
    elif state == avahi.ENTRY_GROUP_FAILURE:
597
 
        logger.critical(u"Error in group state changed %s",
 
633
        logger.critical(u"Avahi: Error in group state changed %s",
598
634
                        unicode(error))
599
635
        raise AvahiGroupError("State changed: %s", str(error))
600
636
 
650
686
    global main_loop_started
651
687
    main_loop_started = False
652
688
    
653
 
    parser = OptionParser()
 
689
    parser = OptionParser(version = "%%prog %s" % version)
654
690
    parser.add_option("-i", "--interface", type="string",
655
691
                      metavar="IF", help="Bind to interface IF")
656
692
    parser.add_option("-a", "--address", type="string",
691
727
    server_config = ConfigParser.SafeConfigParser(server_defaults)
692
728
    del server_defaults
693
729
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
694
 
    server_section = "server"
695
730
    # Convert the SafeConfigParser object to a dict
696
 
    server_settings = dict(server_config.items(server_section))
 
731
    server_settings = server_config.defaults()
697
732
    # Use getboolean on the boolean config option
698
733
    server_settings["debug"] = server_config.getboolean\
699
 
                               (server_section, "debug")
 
734
                               ("DEFAULT", "debug")
700
735
    del server_config
701
736
    
702
737
    # Override the settings from the config file with command line
709
744
    del options
710
745
    # Now we have our good server settings in "server_settings"
711
746
    
 
747
    debug = server_settings["debug"]
 
748
    
 
749
    if not debug:
 
750
        syslogger.setLevel(logging.WARNING)
 
751
        console.setLevel(logging.WARNING)
 
752
    
 
753
    if server_settings["servicename"] != "Mandos":
 
754
        syslogger.setFormatter(logging.Formatter\
 
755
                               ('Mandos (%s): %%(levelname)s:'
 
756
                                ' %%(message)s'
 
757
                                % server_settings["servicename"]))
 
758
    
712
759
    # Parse config file with clients
713
760
    client_defaults = { "timeout": "1h",
714
761
                        "interval": "5m",
715
 
                        "checker": "fping -q -- %%(fqdn)s",
 
762
                        "checker": "fping -q -- %(host)s",
 
763
                        "host": "",
716
764
                        }
717
765
    client_config = ConfigParser.SafeConfigParser(client_defaults)
718
766
    client_config.read(os.path.join(server_settings["configdir"],
719
767
                                    "clients.conf"))
720
768
    
 
769
    clients = Set()
 
770
    tcp_server = IPv6_TCPServer((server_settings["address"],
 
771
                                 server_settings["port"]),
 
772
                                tcp_handler,
 
773
                                settings=server_settings,
 
774
                                clients=clients)
 
775
    pidfilename = "/var/run/mandos.pid"
 
776
    try:
 
777
        pidfile = open(pidfilename, "w")
 
778
    except IOError, error:
 
779
        logger.error("Could not open file %r", pidfilename)
 
780
    
 
781
    uid = 65534
 
782
    gid = 65534
 
783
    try:
 
784
        uid = pwd.getpwnam("mandos").pw_uid
 
785
    except KeyError:
 
786
        try:
 
787
            uid = pwd.getpwnam("nobody").pw_uid
 
788
        except KeyError:
 
789
            pass
 
790
    try:
 
791
        gid = pwd.getpwnam("mandos").pw_gid
 
792
    except KeyError:
 
793
        try:
 
794
            gid = pwd.getpwnam("nogroup").pw_gid
 
795
        except KeyError:
 
796
            pass
 
797
    try:
 
798
        os.setuid(uid)
 
799
        os.setgid(gid)
 
800
    except OSError, error:
 
801
        if error[0] != errno.EPERM:
 
802
            raise error
 
803
    
721
804
    global service
722
805
    service = AvahiService(name = server_settings["servicename"],
723
806
                           type = "_mandos._tcp", );
724
807
    if server_settings["interface"]:
725
 
        service.interface = if_nametoindex(server_settings["interface"])
 
808
        service.interface = if_nametoindex\
 
809
                            (server_settings["interface"])
726
810
    
727
811
    global main_loop
728
812
    global bus
731
815
    DBusGMainLoop(set_as_default=True )
732
816
    main_loop = gobject.MainLoop()
733
817
    bus = dbus.SystemBus()
734
 
    server = dbus.Interface(
735
 
            bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
736
 
            avahi.DBUS_INTERFACE_SERVER )
 
818
    server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
 
819
                                           avahi.DBUS_PATH_SERVER),
 
820
                            avahi.DBUS_INTERFACE_SERVER)
737
821
    # End of Avahi example code
738
822
    
739
 
    debug = server_settings["debug"]
740
 
    
741
 
    if debug:
742
 
        console = logging.StreamHandler()
743
 
        # console.setLevel(logging.DEBUG)
744
 
        console.setFormatter(logging.Formatter\
745
 
                             ('%(levelname)s: %(message)s'))
746
 
        logger.addHandler(console)
747
 
        del console
748
 
    
749
 
    clients = Set()
750
823
    def remove_from_clients(client):
751
824
        clients.remove(client)
752
825
        if not clients:
758
831
                              config
759
832
                              = dict(client_config.items(section)))
760
833
                       for section in client_config.sections()))
 
834
    if not clients:
 
835
        logger.critical(u"No clients defined")
 
836
        sys.exit(1)
761
837
    
762
 
    if not debug:
 
838
    if debug:
 
839
        # Redirect stdin so all checkers get /dev/null
 
840
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
841
        os.dup2(null, sys.stdin.fileno())
 
842
        if null > 2:
 
843
            os.close(null)
 
844
    else:
 
845
        # No console logging
 
846
        logger.removeHandler(console)
 
847
        # Close all input and output, do double fork, etc.
763
848
        daemon()
764
849
    
 
850
    try:
 
851
        pid = os.getpid()
 
852
        pidfile.write(str(pid) + "\n")
 
853
        pidfile.close()
 
854
        del pidfile
 
855
    except IOError, err:
 
856
        logger.error(u"Could not write to file %r with PID %d",
 
857
                     pidfilename, pid)
 
858
    except NameError:
 
859
        # "pidfile" was never created
 
860
        pass
 
861
    del pidfilename
 
862
    
765
863
    def cleanup():
766
864
        "Cleanup function; run on exit"
767
865
        global group
786
884
    for client in clients:
787
885
        client.start()
788
886
    
789
 
    tcp_server = IPv6_TCPServer((server_settings["address"],
790
 
                                 server_settings["port"]),
791
 
                                tcp_handler,
792
 
                                settings=server_settings,
793
 
                                clients=clients)
 
887
    tcp_server.enable()
 
888
    tcp_server.server_activate()
 
889
    
794
890
    # Find out what port we got
795
891
    service.port = tcp_server.socket.getsockname()[1]
796
892
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
813
909
                             tcp_server.handle_request\
814
910
                             (*args[2:], **kwargs) or True)
815
911
        
816
 
        logger.debug("Starting main loop")
 
912
        logger.debug(u"Starting main loop")
817
913
        main_loop_started = True
818
914
        main_loop.run()
819
915
    except AvahiError, error: