To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 183
- compare with another revision
- download diff
- download tarball
- view history from revision 183
- Committer: Teddy Hogeborn
- Date: 2008-09-13 15:36:18 UTC
- Revision ID: teddy@fukt.bsnet.se-20080913153618-atp386q2bqj0ku99
* Makefile (install-client-nokey): Do "&&" instead of ";" to catch
errors.
* README: Kill the straight quotes. Add copyright notice.
* overview.xml: Improved wording.
errors.
* README: Kill the straight quotes. Add copyright notice.
* overview.xml: Improved wording.
- files added:
- etc-plugins.d-README
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import division, with_statement, absolute_import
33
from __future__ import division
35
34
36
35
import SocketServer
37
36
import socket
38
import optparse
37
import select
38
from optparse import OptionParser
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
56
56
import logging
57
57
import logging.handlers
58
58
import pwd
59
from contextlib import closing
60
59
61
60
import dbus
62
import dbus.service
63
61
import gobject
64
62
import avahi
65
63
from dbus.mainloop.glib import DBusGMainLoop
66
64
import ctypes
67
import ctypes.util
68
65
69
version = "1.0.8"
66
version = "1.0"
70
67
71
68
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
78
74
logger.addHandler(syslogger)
79
75
80
76
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
' %(message)s'))
83
79
logger.addHandler(console)
84
80
85
81
class AvahiError(Exception):
86
def __init__(self, value, *args, **kwargs):
82
def __init__(self, value):
87
83
self.value = value
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
84
def __str__(self):
85
return repr(self.value)
91
86
92
87
class AvahiServiceError(AvahiError):
93
88
pass
113
108
a sensible number of times
114
109
"""
115
110
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768,
118
protocol = avahi.PROTO_UNSPEC):
111
type = None, port = None, TXT = None, domain = "",
112
host = "", max_renames = 32768):
119
113
self.interface = interface
120
114
self.name = name
121
self.type = servicetype
115
self.type = type
122
116
self.port = port
123
self.TXT = TXT if TXT is not None else []
117
if TXT is None:
118
self.TXT = []
119
else:
120
self.TXT = TXT
124
121
self.domain = domain
125
122
self.host = host
126
123
self.rename_count = 0
127
124
self.max_renames = max_renames
128
self.protocol = protocol
129
125
def rename(self):
130
126
"""Derived from the Avahi example code"""
131
127
if self.rename_count >= self.max_renames:
132
128
logger.critical(u"No suitable Zeroconf service name found"
133
129
u" after %i retries, exiting.",
134
self.rename_count)
135
raise AvahiServiceError(u"Too many renames")
130
rename_count)
131
raise AvahiServiceError("Too many renames")
136
132
self.name = server.GetAlternativeServiceName(self.name)
137
133
logger.info(u"Changing Zeroconf service name to %r ...",
138
134
str(self.name))
139
syslogger.setFormatter(logging.Formatter
135
syslogger.setFormatter(logging.Formatter\
140
136
('Mandos (%s): %%(levelname)s:'
141
' %%(message)s' % self.name))
137
' %%(message)s' % self.name))
142
138
self.remove()
143
139
self.add()
144
140
self.rename_count += 1
150
146
"""Derived from the Avahi example code"""
151
147
global group
152
148
if group is None:
153
group = dbus.Interface(bus.get_object
154
(avahi.DBUS_NAME,
149
group = dbus.Interface\
150
(bus.get_object(avahi.DBUS_NAME,
155
151
server.EntryGroupNew()),
156
avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
avahi.DBUS_INTERFACE_ENTRY_GROUP)
157
153
group.connect_to_signal('StateChanged',
158
154
entry_group_state_changed)
159
155
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
160
156
service.name, service.type)
161
157
group.AddService(
162
158
self.interface, # interface
163
self.protocol, # protocol
159
avahi.PROTO_INET6, # protocol
164
160
dbus.UInt32(0), # flags
165
161
self.name, self.type,
166
162
self.domain, self.host,
173
169
# End of Avahi example code
174
170
175
171
176
def _datetime_to_dbus(dt, variant_level=0):
177
"""Convert a UTC datetime.datetime() to a D-Bus type."""
178
return dbus.String(dt.isoformat(), variant_level=variant_level)
179
180
181
class Client(dbus.service.Object):
172
class Client(object):
182
173
"""A representation of a client host served by this server.
183
174
Attributes:
184
name: string; from the config file, used in log messages and
185
D-Bus identifiers
175
name: string; from the config file, used in log messages
186
176
fingerprint: string (40 or 32 hexadecimal digits); used to
187
177
uniquely identify the client
188
secret: bytestring; sent verbatim (over TLS) to client
189
host: string; available for use by the checker command
190
created: datetime.datetime(); (UTC) object creation
191
last_enabled: datetime.datetime(); (UTC)
192
enabled: bool()
193
last_checked_ok: datetime.datetime(); (UTC) or None
194
timeout: datetime.timedelta(); How long from last_checked_ok
195
until this client is invalid
196
interval: datetime.timedelta(); How often to start a new checker
197
disable_hook: If set, called by disable() as disable_hook(self)
198
checker: subprocess.Popen(); a running checker process used
199
to see if the client lives.
200
'None' if no process is running.
178
secret: bytestring; sent verbatim (over TLS) to client
179
host: string; available for use by the checker command
180
created: datetime.datetime(); object creation, not client host
181
last_checked_ok: datetime.datetime() or None if not yet checked OK
182
timeout: datetime.timedelta(); How long from last_checked_ok
183
until this client is invalid
184
interval: datetime.timedelta(); How often to start a new checker
185
stop_hook: If set, called by stop() as stop_hook(self)
186
checker: subprocess.Popen(); a running checker process used
187
to see if the client lives.
188
'None' if no process is running.
201
189
checker_initiator_tag: a gobject event source tag, or None
202
disable_initiator_tag: - '' -
190
stop_initiator_tag: - '' -
203
191
checker_callback_tag: - '' -
204
192
checker_command: string; External command which is run to check if
205
193
client lives. %() expansions are done at
206
194
runtime with vars(self) as dict, so that for
207
195
instance %(name)s can be used in the command.
208
current_checker_command: string; current running checker_command
209
use_dbus: bool(); Whether to provide D-Bus interface and signals
210
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
196
Private attibutes:
197
_timeout: Real variable for 'timeout'
198
_interval: Real variable for 'interval'
199
_timeout_milliseconds: Used when calling gobject.timeout_add()
200
_interval_milliseconds: - '' -
211
201
"""
212
def timeout_milliseconds(self):
213
"Return the 'timeout' attribute in milliseconds"
214
return ((self.timeout.days * 24 * 60 * 60 * 1000)
215
+ (self.timeout.seconds * 1000)
216
+ (self.timeout.microseconds // 1000))
217
218
def interval_milliseconds(self):
219
"Return the 'interval' attribute in milliseconds"
220
return ((self.interval.days * 24 * 60 * 60 * 1000)
221
+ (self.interval.seconds * 1000)
222
+ (self.interval.microseconds // 1000))
223
224
def __init__(self, name = None, disable_hook=None, config=None,
225
use_dbus=True):
202
def _set_timeout(self, timeout):
203
"Setter function for 'timeout' attribute"
204
self._timeout = timeout
205
self._timeout_milliseconds = ((self.timeout.days
206
* 24 * 60 * 60 * 1000)
207
+ (self.timeout.seconds * 1000)
208
+ (self.timeout.microseconds
209
// 1000))
210
timeout = property(lambda self: self._timeout,
211
_set_timeout)
212
del _set_timeout
213
def _set_interval(self, interval):
214
"Setter function for 'interval' attribute"
215
self._interval = interval
216
self._interval_milliseconds = ((self.interval.days
217
* 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds
219
* 1000)
220
+ (self.interval.microseconds
221
// 1000))
222
interval = property(lambda self: self._interval,
223
_set_interval)
224
del _set_interval
225
def __init__(self, name = None, stop_hook=None, config={}):
226
226
"""Note: the 'checker' key in 'config' sets the
227
227
'checker_command' attribute and *not* the 'checker'
228
228
attribute."""
229
229
self.name = name
230
if config is None:
231
config = {}
232
230
logger.debug(u"Creating client %r", self.name)
233
self.use_dbus = False # During __init__
234
231
# Uppercase and remove spaces from fingerprint for later
235
232
# comparison purposes with return value from the fingerprint()
236
233
# function
237
self.fingerprint = (config["fingerprint"].upper()
238
.replace(u" ", u""))
234
self.fingerprint = config["fingerprint"].upper()\
235
.replace(u" ", u"")
239
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
240
237
if "secret" in config:
241
238
self.secret = config["secret"].decode(u"base64")
242
239
elif "secfile" in config:
243
with closing(open(os.path.expanduser
244
(os.path.expandvars
245
(config["secfile"])))) as secfile:
246
self.secret = secfile.read()
240
sf = open(config["secfile"])
241
self.secret = sf.read()
242
sf.close()
247
243
else:
248
244
raise TypeError(u"No secret or secfile for client %s"
249
245
% self.name)
250
246
self.host = config.get("host", "")
251
self.created = datetime.datetime.utcnow()
252
self.enabled = False
253
self.last_enabled = None
247
self.created = datetime.datetime.now()
254
248
self.last_checked_ok = None
255
249
self.timeout = string_to_delta(config["timeout"])
256
250
self.interval = string_to_delta(config["interval"])
257
self.disable_hook = disable_hook
251
self.stop_hook = stop_hook
258
252
self.checker = None
259
253
self.checker_initiator_tag = None
260
self.disable_initiator_tag = None
254
self.stop_initiator_tag = None
261
255
self.checker_callback_tag = None
262
self.checker_command = config["checker"]
263
self.current_checker_command = None
264
self.last_connect = None
265
# Only now, when this client is initialized, can it show up on
266
# the D-Bus
267
self.use_dbus = use_dbus
268
if self.use_dbus:
269
self.dbus_object_path = (dbus.ObjectPath
270
("/clients/"
271
+ self.name.replace(".", "_")))
272
dbus.service.Object.__init__(self, bus,
273
self.dbus_object_path)
274
275
def enable(self):
256
self.check_command = config["checker"]
257
def start(self):
276
258
"""Start this client's checker and timeout hooks"""
277
self.last_enabled = datetime.datetime.utcnow()
278
259
# Schedule a new checker to be started an 'interval' from now,
279
260
# and every interval from then on.
280
self.checker_initiator_tag = (gobject.timeout_add
281
(self.interval_milliseconds(),
282
self.start_checker))
261
self.checker_initiator_tag = gobject.timeout_add\
262
(self._interval_milliseconds,
263
self.start_checker)
283
264
# Also start a new checker *right now*.
284
265
self.start_checker()
285
# Schedule a disable() when 'timeout' has passed
286
self.disable_initiator_tag = (gobject.timeout_add
287
(self.timeout_milliseconds(),
288
self.disable))
289
self.enabled = True
290
if self.use_dbus:
291
# Emit D-Bus signals
292
self.PropertyChanged(dbus.String(u"enabled"),
293
dbus.Boolean(True, variant_level=1))
294
self.PropertyChanged(dbus.String(u"last_enabled"),
295
(_datetime_to_dbus(self.last_enabled,
296
variant_level=1)))
297
298
def disable(self):
299
"""Disable this client."""
300
if not getattr(self, "enabled", False):
266
# Schedule a stop() when 'timeout' has passed
267
self.stop_initiator_tag = gobject.timeout_add\
268
(self._timeout_milliseconds,
269
self.stop)
270
def stop(self):
271
"""Stop this client.
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
274
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
276
logger.info(u"Stopping client %s", self.name)
277
self.secret = None
278
else:
301
279
return False
302
logger.info(u"Disabling client %s", self.name)
303
if getattr(self, "disable_initiator_tag", False):
304
gobject.source_remove(self.disable_initiator_tag)
305
self.disable_initiator_tag = None
280
if getattr(self, "stop_initiator_tag", False):
281
gobject.source_remove(self.stop_initiator_tag)
282
self.stop_initiator_tag = None
306
283
if getattr(self, "checker_initiator_tag", False):
307
284
gobject.source_remove(self.checker_initiator_tag)
308
285
self.checker_initiator_tag = None
309
286
self.stop_checker()
310
if self.disable_hook:
311
self.disable_hook(self)
312
self.enabled = False
313
if self.use_dbus:
314
# Emit D-Bus signal
315
self.PropertyChanged(dbus.String(u"enabled"),
316
dbus.Boolean(False, variant_level=1))
287
if self.stop_hook:
288
self.stop_hook(self)
317
289
# Do not run this again if called by a gobject.timeout_add
318
290
return False
319
320
291
def __del__(self):
321
self.disable_hook = None
322
self.disable()
323
324
def checker_callback(self, pid, condition, command):
292
self.stop_hook = None
293
self.stop()
294
def checker_callback(self, pid, condition):
325
295
"""The checker has completed, so take appropriate actions."""
296
now = datetime.datetime.now()
326
297
self.checker_callback_tag = None
327
298
self.checker = None
328
if self.use_dbus:
329
# Emit D-Bus signal
330
self.PropertyChanged(dbus.String(u"checker_running"),
331
dbus.Boolean(False, variant_level=1))
332
if os.WIFEXITED(condition):
333
exitstatus = os.WEXITSTATUS(condition)
334
if exitstatus == 0:
335
logger.info(u"Checker for %(name)s succeeded",
336
vars(self))
337
self.checked_ok()
338
else:
339
logger.info(u"Checker for %(name)s failed",
340
vars(self))
341
if self.use_dbus:
342
# Emit D-Bus signal
343
self.CheckerCompleted(dbus.Int16(exitstatus),
344
dbus.Int64(condition),
345
dbus.String(command))
346
else:
299
if os.WIFEXITED(condition) \
300
and (os.WEXITSTATUS(condition) == 0):
301
logger.info(u"Checker for %(name)s succeeded",
302
vars(self))
303
self.last_checked_ok = now
304
gobject.source_remove(self.stop_initiator_tag)
305
self.stop_initiator_tag = gobject.timeout_add\
306
(self._timeout_milliseconds,
307
self.stop)
308
elif not os.WIFEXITED(condition):
347
309
logger.warning(u"Checker for %(name)s crashed?",
348
310
vars(self))
349
if self.use_dbus:
350
# Emit D-Bus signal
351
self.CheckerCompleted(dbus.Int16(-1),
352
dbus.Int64(condition),
353
dbus.String(command))
354
355
def checked_ok(self):
356
"""Bump up the timeout for this client.
357
This should only be called when the client has been seen,
358
alive and well.
359
"""
360
self.last_checked_ok = datetime.datetime.utcnow()
361
gobject.source_remove(self.disable_initiator_tag)
362
self.disable_initiator_tag = (gobject.timeout_add
363
(self.timeout_milliseconds(),
364
self.disable))
365
if self.use_dbus:
366
# Emit D-Bus signal
367
self.PropertyChanged(
368
dbus.String(u"last_checked_ok"),
369
(_datetime_to_dbus(self.last_checked_ok,
370
variant_level=1)))
371
311
else:
312
logger.info(u"Checker for %(name)s failed",
313
vars(self))
372
314
def start_checker(self):
373
315
"""Start a new checker subprocess if one is not running.
374
316
If a checker already exists, leave it running and do
381
323
# checkers alone, the checker would have to take more time
382
324
# than 'timeout' for the client to be declared invalid, which
383
325
# is as it should be.
384
385
# If a checker exists, make sure it is not a zombie
386
if self.checker is not None:
387
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
388
if pid:
389
logger.warning("Checker was a zombie")
390
gobject.source_remove(self.checker_callback_tag)
391
self.checker_callback(pid, status,
392
self.current_checker_command)
393
# Start a new checker if needed
394
326
if self.checker is None:
395
327
try:
396
# In case checker_command has exactly one % operator
397
command = self.checker_command % self.host
328
# In case check_command has exactly one % operator
329
command = self.check_command % self.host
398
330
except TypeError:
399
331
# Escape attributes for the shell
400
332
escaped_attrs = dict((key, re.escape(str(val)))
401
333
for key, val in
402
334
vars(self).iteritems())
403
335
try:
404
command = self.checker_command % escaped_attrs
336
command = self.check_command % escaped_attrs
405
337
except TypeError, error:
406
338
logger.error(u'Could not format string "%s":'
407
u' %s', self.checker_command, error)
339
u' %s', self.check_command, error)
408
340
return True # Try again later
409
self.current_checker_command = command
410
341
try:
411
342
logger.info(u"Starting checker %r for %s",
412
343
command, self.name)
417
348
self.checker = subprocess.Popen(command,
418
349
close_fds=True,
419
350
shell=True, cwd="/")
420
if self.use_dbus:
421
# Emit D-Bus signal
422
self.CheckerStarted(command)
423
self.PropertyChanged(
424
dbus.String("checker_running"),
425
dbus.Boolean(True, variant_level=1))
426
self.checker_callback_tag = (gobject.child_watch_add
427
(self.checker.pid,
428
self.checker_callback,
429
data=command))
430
# The checker may have completed before the gobject
431
# watch was added. Check for this.
432
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
433
if pid:
434
gobject.source_remove(self.checker_callback_tag)
435
self.checker_callback(pid, status, command)
351
self.checker_callback_tag = gobject.child_watch_add\
352
(self.checker.pid,
353
self.checker_callback)
436
354
except OSError, error:
437
355
logger.error(u"Failed to start subprocess: %s",
438
356
error)
439
357
# Re-run this periodically if run by gobject.timeout_add
440
358
return True
441
442
359
def stop_checker(self):
443
360
"""Force the checker process, if any, to stop."""
444
361
if self.checker_callback_tag:
456
373
if error.errno != errno.ESRCH: # No such process
457
374
raise
458
375
self.checker = None
459
if self.use_dbus:
460
self.PropertyChanged(dbus.String(u"checker_running"),
461
dbus.Boolean(False, variant_level=1))
462
463
376
def still_valid(self):
464
377
"""Has the timeout not yet passed for this client?"""
465
if not getattr(self, "enabled", False):
466
return False
467
now = datetime.datetime.utcnow()
378
now = datetime.datetime.now()
468
379
if self.last_checked_ok is None:
469
380
return now < (self.created + self.timeout)
470
381
else:
471
382
return now < (self.last_checked_ok + self.timeout)
472
473
## D-Bus methods & signals
474
_interface = u"se.bsnet.fukt.Mandos.Client"
475
476
# CheckedOK - method
477
CheckedOK = dbus.service.method(_interface)(checked_ok)
478
CheckedOK.__name__ = "CheckedOK"
479
480
# CheckerCompleted - signal
481
@dbus.service.signal(_interface, signature="nxs")
482
def CheckerCompleted(self, exitcode, waitstatus, command):
483
"D-Bus signal"
484
pass
485
486
# CheckerStarted - signal
487
@dbus.service.signal(_interface, signature="s")
488
def CheckerStarted(self, command):
489
"D-Bus signal"
490
pass
491
492
# GetAllProperties - method
493
@dbus.service.method(_interface, out_signature="a{sv}")
494
def GetAllProperties(self):
495
"D-Bus method"
496
return dbus.Dictionary({
497
dbus.String("name"):
498
dbus.String(self.name, variant_level=1),
499
dbus.String("fingerprint"):
500
dbus.String(self.fingerprint, variant_level=1),
501
dbus.String("host"):
502
dbus.String(self.host, variant_level=1),
503
dbus.String("created"):
504
_datetime_to_dbus(self.created, variant_level=1),
505
dbus.String("last_enabled"):
506
(_datetime_to_dbus(self.last_enabled,
507
variant_level=1)
508
if self.last_enabled is not None
509
else dbus.Boolean(False, variant_level=1)),
510
dbus.String("enabled"):
511
dbus.Boolean(self.enabled, variant_level=1),
512
dbus.String("last_checked_ok"):
513
(_datetime_to_dbus(self.last_checked_ok,
514
variant_level=1)
515
if self.last_checked_ok is not None
516
else dbus.Boolean (False, variant_level=1)),
517
dbus.String("timeout"):
518
dbus.UInt64(self.timeout_milliseconds(),
519
variant_level=1),
520
dbus.String("interval"):
521
dbus.UInt64(self.interval_milliseconds(),
522
variant_level=1),
523
dbus.String("checker"):
524
dbus.String(self.checker_command,
525
variant_level=1),
526
dbus.String("checker_running"):
527
dbus.Boolean(self.checker is not None,
528
variant_level=1),
529
dbus.String("object_path"):
530
dbus.ObjectPath(self.dbus_object_path,
531
variant_level=1)
532
}, signature="sv")
533
534
# IsStillValid - method
535
IsStillValid = (dbus.service.method(_interface, out_signature="b")
536
(still_valid))
537
IsStillValid.__name__ = "IsStillValid"
538
539
# PropertyChanged - signal
540
@dbus.service.signal(_interface, signature="sv")
541
def PropertyChanged(self, property, value):
542
"D-Bus signal"
543
pass
544
545
# SetChecker - method
546
@dbus.service.method(_interface, in_signature="s")
547
def SetChecker(self, checker):
548
"D-Bus setter method"
549
self.checker_command = checker
550
# Emit D-Bus signal
551
self.PropertyChanged(dbus.String(u"checker"),
552
dbus.String(self.checker_command,
553
variant_level=1))
554
555
# SetHost - method
556
@dbus.service.method(_interface, in_signature="s")
557
def SetHost(self, host):
558
"D-Bus setter method"
559
self.host = host
560
# Emit D-Bus signal
561
self.PropertyChanged(dbus.String(u"host"),
562
dbus.String(self.host, variant_level=1))
563
564
# SetInterval - method
565
@dbus.service.method(_interface, in_signature="t")
566
def SetInterval(self, milliseconds):
567
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
568
# Emit D-Bus signal
569
self.PropertyChanged(dbus.String(u"interval"),
570
(dbus.UInt64(self.interval_milliseconds(),
571
variant_level=1)))
572
573
# SetSecret - method
574
@dbus.service.method(_interface, in_signature="ay",
575
byte_arrays=True)
576
def SetSecret(self, secret):
577
"D-Bus setter method"
578
self.secret = str(secret)
579
580
# SetTimeout - method
581
@dbus.service.method(_interface, in_signature="t")
582
def SetTimeout(self, milliseconds):
583
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
584
# Emit D-Bus signal
585
self.PropertyChanged(dbus.String(u"timeout"),
586
(dbus.UInt64(self.timeout_milliseconds(),
587
variant_level=1)))
588
589
# Enable - method
590
Enable = dbus.service.method(_interface)(enable)
591
Enable.__name__ = "Enable"
592
593
# StartChecker - method
594
@dbus.service.method(_interface)
595
def StartChecker(self):
596
"D-Bus method"
597
self.start_checker()
598
599
# Disable - method
600
@dbus.service.method(_interface)
601
def Disable(self):
602
"D-Bus method"
603
self.disable()
604
605
# StopChecker - method
606
StopChecker = dbus.service.method(_interface)(stop_checker)
607
StopChecker.__name__ = "StopChecker"
608
609
del _interface
610
383
611
384
612
385
def peer_certificate(session):
613
386
"Return the peer's OpenPGP certificate as a bytestring"
614
387
# If not an OpenPGP certificate...
615
if (gnutls.library.functions
616
.gnutls_certificate_type_get(session._c_object)
617
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
388
if gnutls.library.functions.gnutls_certificate_type_get\
389
(session._c_object) \
390
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
618
391
# ...do the normal thing
619
392
return session.peer_certificate
620
list_size = ctypes.c_uint(1)
621
cert_list = (gnutls.library.functions
622
.gnutls_certificate_get_peers
623
(session._c_object, ctypes.byref(list_size)))
624
if not bool(cert_list) and list_size.value != 0:
625
raise gnutls.errors.GNUTLSError("error getting peer"
626
" certificate")
393
list_size = ctypes.c_uint()
394
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
(session._c_object, ctypes.byref(list_size))
627
396
if list_size.value == 0:
628
397
return None
629
398
cert = cert_list[0]
633
402
def fingerprint(openpgp):
634
403
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
635
404
# New GnuTLS "datum" with the OpenPGP public key
636
datum = (gnutls.library.types
637
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
638
ctypes.POINTER
639
(ctypes.c_ubyte)),
640
ctypes.c_uint(len(openpgp))))
405
datum = gnutls.library.types.gnutls_datum_t\
406
(ctypes.cast(ctypes.c_char_p(openpgp),
407
ctypes.POINTER(ctypes.c_ubyte)),
408
ctypes.c_uint(len(openpgp)))
641
409
# New empty GnuTLS certificate
642
410
crt = gnutls.library.types.gnutls_openpgp_crt_t()
643
(gnutls.library.functions
644
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
411
gnutls.library.functions.gnutls_openpgp_crt_init\
412
(ctypes.byref(crt))
645
413
# Import the OpenPGP public key into the certificate
646
(gnutls.library.functions
647
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
648
gnutls.library.constants
649
.GNUTLS_OPENPGP_FMT_RAW))
414
gnutls.library.functions.gnutls_openpgp_crt_import\
415
(crt, ctypes.byref(datum),
416
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
650
417
# Verify the self signature in the key
651
crtverify = ctypes.c_uint()
652
(gnutls.library.functions
653
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
418
crtverify = ctypes.c_uint();
419
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
(crt, 0, ctypes.byref(crtverify))
654
421
if crtverify.value != 0:
655
422
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
656
423
raise gnutls.errors.CertificateSecurityError("Verify failed")
657
424
# New buffer for the fingerprint
658
buf = ctypes.create_string_buffer(20)
659
buf_len = ctypes.c_size_t()
425
buffer = ctypes.create_string_buffer(20)
426
buffer_length = ctypes.c_size_t()
660
427
# Get the fingerprint from the certificate into the buffer
661
(gnutls.library.functions
662
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
663
ctypes.byref(buf_len)))
428
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
664
430
# Deinit the certificate
665
431
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
666
432
# Convert the buffer to a Python bytestring
667
fpr = ctypes.string_at(buf, buf_len.value)
433
fpr = ctypes.string_at(buffer, buffer_length.value)
668
434
# Convert the bytestring to hexadecimal notation
669
435
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
670
436
return hex_fpr
671
437
672
438
673
class TCP_handler(SocketServer.BaseRequestHandler, object):
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
674
440
"""A TCP request handler class.
675
441
Instantiated by IPv6_TCPServer for each request to handle it.
676
442
Note: This will run in its own forked process."""
677
443
678
444
def handle(self):
679
445
logger.info(u"TCP connection from: %s",
680
unicode(self.client_address))
681
logger.debug(u"Pipe: %d", self.server.pipe[1])
682
# Open IPC pipe to parent process
683
with closing(os.fdopen(self.server.pipe[1], "w", 1)) as ipc:
684
session = (gnutls.connection
685
.ClientSession(self.request,
686
gnutls.connection
687
.X509Credentials()))
688
689
line = self.request.makefile().readline()
690
logger.debug(u"Protocol version: %r", line)
691
try:
692
if int(line.strip().split()[0]) > 1:
693
raise RuntimeError
694
except (ValueError, IndexError, RuntimeError), error:
695
logger.error(u"Unknown protocol version: %s", error)
696
return
697
698
# Note: gnutls.connection.X509Credentials is really a
699
# generic GnuTLS certificate credentials object so long as
700
# no X.509 keys are added to it. Therefore, we can use it
701
# here despite using OpenPGP certificates.
702
703
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
704
# "+AES-256-CBC", "+SHA1",
705
# "+COMP-NULL", "+CTYPE-OPENPGP",
706
# "+DHE-DSS"))
707
# Use a fallback default, since this MUST be set.
708
priority = self.server.settings.get("priority", "NORMAL")
709
(gnutls.library.functions
710
.gnutls_priority_set_direct(session._c_object,
711
priority, None))
712
713
try:
714
session.handshake()
715
except gnutls.errors.GNUTLSError, error:
716
logger.warning(u"Handshake failed: %s", error)
717
# Do not run session.bye() here: the session is not
718
# established. Just abandon the request.
719
return
720
logger.debug(u"Handshake succeeded")
721
try:
722
fpr = fingerprint(peer_certificate(session))
723
except (TypeError, gnutls.errors.GNUTLSError), error:
724
logger.warning(u"Bad certificate: %s", error)
725
session.bye()
726
return
727
logger.debug(u"Fingerprint: %s", fpr)
728
729
for c in self.server.clients:
730
if c.fingerprint == fpr:
731
client = c
732
break
733
else:
734
logger.warning(u"Client not found for fingerprint: %s",
735
fpr)
736
ipc.write("NOTFOUND %s\n" % fpr)
737
session.bye()
738
return
739
# Have to check if client.still_valid(), since it is
740
# possible that the client timed out while establishing
741
# the GnuTLS session.
742
if not client.still_valid():
743
logger.warning(u"Client %(name)s is invalid",
744
vars(client))
745
ipc.write("INVALID %s\n" % client.name)
746
session.bye()
747
return
748
ipc.write("SENDING %s\n" % client.name)
749
sent_size = 0
750
while sent_size < len(client.secret):
751
sent = session.send(client.secret[sent_size:])
752
logger.debug(u"Sent: %d, remaining: %d",
753
sent, len(client.secret)
754
- (sent_size + sent))
755
sent_size += sent
756
session.bye()
757
758
759
class ForkingMixInWithPipe(SocketServer.ForkingMixIn, object):
760
"""Like SocketServer.ForkingMixIn, but also pass a pipe.
761
Assumes a gobject.MainLoop event loop.
762
"""
763
def process_request(self, request, client_address):
764
"""This overrides and wraps the original process_request().
765
This function creates a new pipe in self.pipe
766
"""
767
self.pipe = os.pipe()
768
super(ForkingMixInWithPipe,
769
self).process_request(request, client_address)
770
os.close(self.pipe[1]) # close write end
771
# Call "handle_ipc" for both data and EOF events
772
gobject.io_add_watch(self.pipe[0],
773
gobject.IO_IN | gobject.IO_HUP,
774
self.handle_ipc)
775
def handle_ipc(source, condition):
776
"""Dummy function; override as necessary"""
777
os.close(source)
778
return False
779
780
781
class IPv6_TCPServer(ForkingMixInWithPipe,
782
SocketServer.TCPServer, object):
783
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
446
unicode(self.client_address))
447
session = gnutls.connection.ClientSession\
448
(self.request, gnutls.connection.X509Credentials())
449
450
line = self.request.makefile().readline()
451
logger.debug(u"Protocol version: %r", line)
452
try:
453
if int(line.strip().split()[0]) > 1:
454
raise RuntimeError
455
except (ValueError, IndexError, RuntimeError), error:
456
logger.error(u"Unknown protocol version: %s", error)
457
return
458
459
# Note: gnutls.connection.X509Credentials is really a generic
460
# GnuTLS certificate credentials object so long as no X.509
461
# keys are added to it. Therefore, we can use it here despite
462
# using OpenPGP certificates.
463
464
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
465
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
466
# "+DHE-DSS"))
467
priority = "NORMAL" # Fallback default, since this
468
# MUST be set.
469
if self.server.settings["priority"]:
470
priority = self.server.settings["priority"]
471
gnutls.library.functions.gnutls_priority_set_direct\
472
(session._c_object, priority, None);
473
474
try:
475
session.handshake()
476
except gnutls.errors.GNUTLSError, error:
477
logger.warning(u"Handshake failed: %s", error)
478
# Do not run session.bye() here: the session is not
479
# established. Just abandon the request.
480
return
481
try:
482
fpr = fingerprint(peer_certificate(session))
483
except (TypeError, gnutls.errors.GNUTLSError), error:
484
logger.warning(u"Bad certificate: %s", error)
485
session.bye()
486
return
487
logger.debug(u"Fingerprint: %s", fpr)
488
client = None
489
for c in self.server.clients:
490
if c.fingerprint == fpr:
491
client = c
492
break
493
if not client:
494
logger.warning(u"Client not found for fingerprint: %s",
495
fpr)
496
session.bye()
497
return
498
# Have to check if client.still_valid(), since it is possible
499
# that the client timed out while establishing the GnuTLS
500
# session.
501
if not client.still_valid():
502
logger.warning(u"Client %(name)s is invalid",
503
vars(client))
504
session.bye()
505
return
506
sent_size = 0
507
while sent_size < len(client.secret):
508
sent = session.send(client.secret[sent_size:])
509
logger.debug(u"Sent: %d, remaining: %d",
510
sent, len(client.secret)
511
- (sent_size + sent))
512
sent_size += sent
513
session.bye()
514
515
516
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
517
"""IPv6 TCP server. Accepts 'None' as address and/or port.
784
518
Attributes:
785
519
settings: Server settings
786
520
clients: Set() of Client objects
794
528
if "clients" in kwargs:
795
529
self.clients = kwargs["clients"]
796
530
del kwargs["clients"]
797
if "use_ipv6" in kwargs:
798
if not kwargs["use_ipv6"]:
799
self.address_family = socket.AF_INET
800
del kwargs["use_ipv6"]
801
531
self.enabled = False
802
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
532
return super(type(self), self).__init__(*args, **kwargs)
803
533
def server_bind(self):
804
534
"""This overrides the normal server_bind() function
805
535
to bind to an interface if one was specified, and also NOT to
817
547
u" bind to interface %s",
818
548
self.settings["interface"])
819
549
else:
820
raise
550
raise error
821
551
# Only bind(2) the socket if we really need to.
822
552
if self.server_address[0] or self.server_address[1]:
823
553
if not self.server_address[0]:
824
if self.address_family == socket.AF_INET6:
825
any_address = "::" # in6addr_any
826
else:
827
any_address = socket.INADDR_ANY
828
self.server_address = (any_address,
554
in6addr_any = "::"
555
self.server_address = (in6addr_any,
829
556
self.server_address[1])
830
557
elif not self.server_address[1]:
831
558
self.server_address = (self.server_address[0],
837
564
# if_nametoindex
838
565
# (self.settings
839
566
# ["interface"]))
840
return super(IPv6_TCPServer, self).server_bind()
567
return super(type(self), self).server_bind()
841
568
def server_activate(self):
842
569
if self.enabled:
843
return super(IPv6_TCPServer, self).server_activate()
570
return super(type(self), self).server_activate()
844
571
def enable(self):
845
572
self.enabled = True
846
def handle_ipc(self, source, condition, file_objects={}):
847
logger.debug("Handling IPC: %r : %r", source, condition)
848
849
# Turn a file descriptor into a Python file object
850
if source not in file_objects:
851
file_objects[source] = os.fdopen(source, "r", 1)
852
853
# Read a line from the file object
854
cmdline = file_objects[source].readline()
855
if not cmdline: # Empty line means end of file
856
# close the IPC pipe
857
logger.debug("Closing: %r", source)
858
file_objects[source].close()
859
del file_objects[source]
860
861
# Stop calling this function
862
return False
863
864
logger.debug("IPC command: %r\n" % cmdline)
865
866
# Parse and act on command
867
cmd, args = cmdline.split(None, 1)
868
if cmd == "NOTFOUND":
869
pass # xxx
870
elif cmd == "INVALID":
871
pass # xxx
872
elif cmd == "SENDING":
873
pass # xxx
874
# client.checked_ok()
875
else:
876
logger.error("Unknown IPC command: %r", cmdline)
877
878
# Keep calling this function
879
return True
880
573
881
574
882
575
def string_to_delta(interval):
883
576
"""Parse a string and return a datetime.timedelta
884
577
885
578
>>> string_to_delta('7d')
886
579
datetime.timedelta(7)
887
580
>>> string_to_delta('60s')
898
591
timevalue = datetime.timedelta(0)
899
592
for s in interval.split():
900
593
try:
901
suffix = unicode(s[-1])
902
value = int(s[:-1])
594
suffix=unicode(s[-1])
595
value=int(s[:-1])
903
596
if suffix == u"d":
904
597
delta = datetime.timedelta(value)
905
598
elif suffix == u"s":
939
632
elif state == avahi.ENTRY_GROUP_FAILURE:
940
633
logger.critical(u"Avahi: Error in group state changed %s",
941
634
unicode(error))
942
raise AvahiGroupError(u"State changed: %s" % unicode(error))
635
raise AvahiGroupError("State changed: %s", str(error))
943
636
944
637
def if_nametoindex(interface):
945
638
"""Call the C function if_nametoindex(), or equivalent"""
946
639
global if_nametoindex
947
640
try:
948
if_nametoindex = (ctypes.cdll.LoadLibrary
949
(ctypes.util.find_library("c"))
950
.if_nametoindex)
641
if "ctypes.util" not in sys.modules:
642
import ctypes.util
643
if_nametoindex = ctypes.cdll.LoadLibrary\
644
(ctypes.util.find_library("c")).if_nametoindex
951
645
except (OSError, AttributeError):
952
646
if "struct" not in sys.modules:
953
647
import struct
956
650
def if_nametoindex(interface):
957
651
"Get an interface index the hard way, i.e. using fcntl()"
958
652
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
959
with closing(socket.socket()) as s:
960
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
961
struct.pack("16s16x", interface))
653
s = socket.socket()
654
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
655
struct.pack("16s16x", interface))
656
s.close()
962
657
interface_index = struct.unpack("I", ifreq[16:20])[0]
963
658
return interface_index
964
659
return if_nametoindex(interface)
988
683
989
684
990
685
def main():
991
parser = optparse.OptionParser(version = "%%prog %s" % version)
686
global main_loop_started
687
main_loop_started = False
688
689
parser = OptionParser(version = "%%prog %s" % version)
992
690
parser.add_option("-i", "--interface", type="string",
993
691
metavar="IF", help="Bind to interface IF")
994
692
parser.add_option("-a", "--address", type="string",
995
693
help="Address to listen for requests on")
996
694
parser.add_option("-p", "--port", type="int",
997
695
help="Port number to receive requests on")
998
parser.add_option("--check", action="store_true",
696
parser.add_option("--check", action="store_true", default=False,
999
697
help="Run self-test")
1000
698
parser.add_option("--debug", action="store_true",
1001
699
help="Debug mode; run in foreground and log to"
1008
706
default="/etc/mandos", metavar="DIR",
1009
707
help="Directory to search for configuration"
1010
708
" files")
1011
parser.add_option("--no-dbus", action="store_false",
1012
dest="use_dbus",
1013
help="Do not provide D-Bus system bus"
1014
" interface")
1015
parser.add_option("--no-ipv6", action="store_false",
1016
dest="use_ipv6", help="Do not use IPv6")
1017
options = parser.parse_args()[0]
709
(options, args) = parser.parse_args()
1018
710
1019
711
if options.check:
1020
712
import doctest
1029
721
"priority":
1030
722
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1031
723
"servicename": "Mandos",
1032
"use_dbus": "True",
1033
"use_ipv6": "True",
1034
724
}
1035
725
1036
726
# Parse config file for server-global settings
1039
729
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1040
730
# Convert the SafeConfigParser object to a dict
1041
731
server_settings = server_config.defaults()
1042
# Use the appropriate methods on the non-string config options
1043
server_settings["debug"] = server_config.getboolean("DEFAULT",
1044
"debug")
1045
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
1046
"use_dbus")
1047
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
1048
"use_ipv6")
1049
if server_settings["port"]:
1050
server_settings["port"] = server_config.getint("DEFAULT",
1051
"port")
732
# Use getboolean on the boolean config option
733
server_settings["debug"] = server_config.getboolean\
734
("DEFAULT", "debug")
1052
735
del server_config
1053
736
1054
737
# Override the settings from the config file with command line
1055
738
# options, if set.
1056
739
for option in ("interface", "address", "port", "debug",
1057
"priority", "servicename", "configdir",
1058
"use_dbus", "use_ipv6"):
740
"priority", "servicename", "configdir"):
1059
741
value = getattr(options, option)
1060
742
if value is not None:
1061
743
server_settings[option] = value
1062
744
del options
1063
745
# Now we have our good server settings in "server_settings"
1064
746
1065
# For convenience
1066
747
debug = server_settings["debug"]
1067
use_dbus = server_settings["use_dbus"]
1068
use_ipv6 = server_settings["use_ipv6"]
1069
748
1070
749
if not debug:
1071
750
syslogger.setLevel(logging.WARNING)
1072
751
console.setLevel(logging.WARNING)
1073
752
1074
753
if server_settings["servicename"] != "Mandos":
1075
syslogger.setFormatter(logging.Formatter
754
syslogger.setFormatter(logging.Formatter\
1076
755
('Mandos (%s): %%(levelname)s:'
1077
756
' %%(message)s'
1078
757
% server_settings["servicename"]))
1080
759
# Parse config file with clients
1081
760
client_defaults = { "timeout": "1h",
1082
761
"interval": "5m",
1083
"checker": "fping -q -- %%(host)s",
762
"checker": "fping -q -- %(host)s",
1084
763
"host": "",
1085
764
}
1086
765
client_config = ConfigParser.SafeConfigParser(client_defaults)
1090
769
clients = Set()
1091
770
tcp_server = IPv6_TCPServer((server_settings["address"],
1092
771
server_settings["port"]),
1093
TCP_handler,
772
tcp_handler,
1094
773
settings=server_settings,
1095
clients=clients, use_ipv6=use_ipv6)
774
clients=clients)
1096
775
pidfilename = "/var/run/mandos.pid"
1097
776
try:
1098
777
pidfile = open(pidfilename, "w")
1099
except IOError:
778
except IOError, error:
1100
779
logger.error("Could not open file %r", pidfilename)
1101
780
1102
try:
1103
uid = pwd.getpwnam("_mandos").pw_uid
1104
gid = pwd.getpwnam("_mandos").pw_gid
1105
except KeyError:
1106
try:
1107
uid = pwd.getpwnam("mandos").pw_uid
1108
gid = pwd.getpwnam("mandos").pw_gid
1109
except KeyError:
1110
try:
1111
uid = pwd.getpwnam("nobody").pw_uid
1112
gid = pwd.getpwnam("nogroup").pw_gid
1113
except KeyError:
1114
uid = 65534
1115
gid = 65534
1116
try:
781
uid = 65534
782
gid = 65534
783
try:
784
uid = pwd.getpwnam("mandos").pw_uid
785
except KeyError:
786
try:
787
uid = pwd.getpwnam("nobody").pw_uid
788
except KeyError:
789
pass
790
try:
791
gid = pwd.getpwnam("mandos").pw_gid
792
except KeyError:
793
try:
794
gid = pwd.getpwnam("nogroup").pw_gid
795
except KeyError:
796
pass
797
try:
798
os.setuid(uid)
1117
799
os.setgid(gid)
1118
os.setuid(uid)
1119
800
except OSError, error:
1120
801
if error[0] != errno.EPERM:
1121
802
raise error
1122
803
1123
# Enable all possible GnuTLS debugging
1124
if debug:
1125
# "Use a log level over 10 to enable all debugging options."
1126
# - GnuTLS manual
1127
gnutls.library.functions.gnutls_global_set_log_level(11)
1128
1129
@gnutls.library.types.gnutls_log_func
1130
def debug_gnutls(level, string):
1131
logger.debug("GnuTLS: %s", string[:-1])
1132
1133
(gnutls.library.functions
1134
.gnutls_global_set_log_function(debug_gnutls))
1135
1136
804
global service
1137
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1138
805
service = AvahiService(name = server_settings["servicename"],
1139
servicetype = "_mandos._tcp",
1140
protocol = protocol)
806
type = "_mandos._tcp", );
1141
807
if server_settings["interface"]:
1142
service.interface = (if_nametoindex
1143
(server_settings["interface"]))
808
service.interface = if_nametoindex\
809
(server_settings["interface"])
1144
810
1145
811
global main_loop
1146
812
global bus
1153
819
avahi.DBUS_PATH_SERVER),
1154
820
avahi.DBUS_INTERFACE_SERVER)
1155
821
# End of Avahi example code
1156
if use_dbus:
1157
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
822
823
def remove_from_clients(client):
824
clients.remove(client)
825
if not clients:
826
logger.critical(u"No clients left, exiting")
827
sys.exit()
1158
828
1159
829
clients.update(Set(Client(name = section,
830
stop_hook = remove_from_clients,
1160
831
config
1161
= dict(client_config.items(section)),
1162
use_dbus = use_dbus)
832
= dict(client_config.items(section)))
1163
833
for section in client_config.sections()))
1164
834
if not clients:
1165
logger.warning(u"No clients defined")
835
logger.critical(u"No clients defined")
836
sys.exit(1)
1166
837
1167
838
if debug:
1168
839
# Redirect stdin so all checkers get /dev/null
1181
852
pidfile.write(str(pid) + "\n")
1182
853
pidfile.close()
1183
854
del pidfile
1184
except IOError:
855
except IOError, err:
1185
856
logger.error(u"Could not write to file %r with PID %d",
1186
857
pidfilename, pid)
1187
858
except NameError:
1200
871
1201
872
while clients:
1202
873
client = clients.pop()
1203
client.disable_hook = None
1204
client.disable()
874
client.stop_hook = None
875
client.stop()
1205
876
1206
877
atexit.register(cleanup)
1207
878
1210
881
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1211
882
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1212
883
1213
if use_dbus:
1214
class MandosServer(dbus.service.Object):
1215
"""A D-Bus proxy object"""
1216
def __init__(self):
1217
dbus.service.Object.__init__(self, bus, "/")
1218
_interface = u"se.bsnet.fukt.Mandos"
1219
1220
@dbus.service.signal(_interface, signature="oa{sv}")
1221
def ClientAdded(self, objpath, properties):
1222
"D-Bus signal"
1223
pass
1224
1225
@dbus.service.signal(_interface, signature="os")
1226
def ClientRemoved(self, objpath, name):
1227
"D-Bus signal"
1228
pass
1229
1230
@dbus.service.method(_interface, out_signature="ao")
1231
def GetAllClients(self):
1232
"D-Bus method"
1233
return dbus.Array(c.dbus_object_path for c in clients)
1234
1235
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1236
def GetAllClientsWithProperties(self):
1237
"D-Bus method"
1238
return dbus.Dictionary(
1239
((c.dbus_object_path, c.GetAllProperties())
1240
for c in clients),
1241
signature="oa{sv}")
1242
1243
@dbus.service.method(_interface, in_signature="o")
1244
def RemoveClient(self, object_path):
1245
"D-Bus method"
1246
for c in clients:
1247
if c.dbus_object_path == object_path:
1248
clients.remove(c)
1249
# Don't signal anything except ClientRemoved
1250
c.use_dbus = False
1251
c.disable()
1252
# Emit D-Bus signal
1253
self.ClientRemoved(object_path, c.name)
1254
return
1255
raise KeyError
1256
1257
del _interface
1258
1259
mandos_server = MandosServer()
1260
1261
884
for client in clients:
1262
if use_dbus:
1263
# Emit D-Bus signal
1264
mandos_server.ClientAdded(client.dbus_object_path,
1265
client.GetAllProperties())
1266
client.enable()
885
client.start()
1267
886
1268
887
tcp_server.enable()
1269
888
tcp_server.server_activate()
1270
889
1271
890
# Find out what port we got
1272
891
service.port = tcp_server.socket.getsockname()[1]
1273
if use_ipv6:
1274
logger.info(u"Now listening on address %r, port %d,"
1275
" flowinfo %d, scope_id %d"
1276
% tcp_server.socket.getsockname())
1277
else: # IPv4
1278
logger.info(u"Now listening on address %r, port %d"
1279
% tcp_server.socket.getsockname())
892
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
893
u" scope_id %d" % tcp_server.socket.getsockname())
1280
894
1281
895
#service.interface = tcp_server.socket.getsockname()[3]
1282
896
1292
906
1293
907
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1294
908
lambda *args, **kwargs:
1295
(tcp_server.handle_request
1296
(*args[2:], **kwargs) or True))
909
tcp_server.handle_request\
910
(*args[2:], **kwargs) or True)
1297
911
1298
912
logger.debug(u"Starting main loop")
913
main_loop_started = True
1299
914
main_loop.run()
1300
915
except AvahiError, error:
1301
logger.critical(u"AvahiError: %s", error)
916
logger.critical(u"AvahiError: %s" + unicode(error))
1302
917
sys.exit(1)
1303
918
except KeyboardInterrupt:
1304
919
if debug:
1305
print >> sys.stderr
1306
logger.debug("Server received KeyboardInterrupt")
1307
logger.debug("Server exiting")
920
print
1308
921
1309
922
if __name__ == '__main__':
1310
923
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0