/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2008-09-21 13:42:34 UTC
  • Revision ID: teddy@fukt.bsnet.se-20080921134234-jo8p4rwtm50yb4xj
* clients.conf ([bar]/secfile): Do not imply armored format.

* debian/control: Build-Depend on pkg-config.

* debian/mandos.prerm (remove): Bug fix; check for
                                "/etc/init.d/mandos", not
                                "/etc/init.d/ssh".

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
 
# following functions: "AvahiService.add", "AvahiService.remove",
10
 
# "server_state_changed", "entry_group_state_changed", and some lines
11
 
# in "main".
 
9
# methods "add" and "remove" in the "AvahiService" class, the
 
10
# "server_state_changed" and "entry_group_state_changed" functions,
 
11
# and some lines in "main".
12
12
# 
13
13
# Everything else is
14
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
24
24
#     GNU General Public License for more details.
25
25
# 
26
26
# You should have received a copy of the GNU General Public License
27
 
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
27
# along with this program.  If not, see
 
28
# <http://www.gnu.org/licenses/>.
28
29
# 
29
30
# Contact the authors at <mandos@fukt.bsnet.se>.
30
31
# 
54
55
import stat
55
56
import logging
56
57
import logging.handlers
 
58
import pwd
57
59
 
58
60
import dbus
59
61
import gobject
61
63
from dbus.mainloop.glib import DBusGMainLoop
62
64
import ctypes
63
65
 
64
 
# Brief description of the operation of this program:
65
 
# 
66
 
# This server announces itself as a Zeroconf service.  Connecting
67
 
# clients use the TLS protocol, with the unusual quirk that this
68
 
# server program acts as a TLS "client" while a connecting client acts
69
 
# as a TLS "server".  The client (acting as a TLS "server") must
70
 
# supply an OpenPGP certificate, and the fingerprint of this
71
 
# certificate is used by this server to look up (in a list read from a
72
 
# file at start time) which binary blob to give the client.  No other
73
 
# authentication or authorization is done by this server.
74
 
 
 
66
version = "1.0"
75
67
 
76
68
logger = logging.Logger('mandos')
77
69
syslogger = logging.handlers.SysLogHandler\
78
 
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON)
 
70
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
71
             address = "/dev/log")
79
72
syslogger.setFormatter(logging.Formatter\
80
 
                        ('%(levelname)s: %(message)s'))
 
73
                        ('Mandos: %(levelname)s: %(message)s'))
81
74
logger.addHandler(syslogger)
82
 
del syslogger
83
75
 
 
76
console = logging.StreamHandler()
 
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
 
78
                                       ' %(message)s'))
 
79
logger.addHandler(console)
84
80
 
85
81
class AvahiError(Exception):
86
82
    def __init__(self, value):
96
92
 
97
93
 
98
94
class AvahiService(object):
99
 
    """
 
95
    """An Avahi (Zeroconf) service.
 
96
    Attributes:
100
97
    interface: integer; avahi.IF_UNSPEC or an interface index.
101
98
               Used to optionally bind to the specified interface.
102
 
    name = string; Example: "Mandos"
103
 
    type = string; Example: "_mandos._tcp".
104
 
                   See <http://www.dns-sd.org/ServiceTypes.html>
105
 
    port = integer; what port to announce
106
 
    TXT = list of strings; TXT record for the service
107
 
    domain = string; Domain to publish on, default to .local if empty.
108
 
    host = string; Host to publish records for, default to localhost
109
 
                   if empty.
110
 
    max_renames = integer; maximum number of renames
111
 
    rename_count = integer; counter so we only rename after collisions
112
 
                   a sensible number of times
 
99
    name: string; Example: 'Mandos'
 
100
    type: string; Example: '_mandos._tcp'.
 
101
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
102
    port: integer; what port to announce
 
103
    TXT: list of strings; TXT record for the service
 
104
    domain: string; Domain to publish on, default to .local if empty.
 
105
    host: string; Host to publish records for, default is localhost
 
106
    max_renames: integer; maximum number of renames
 
107
    rename_count: integer; counter so we only rename after collisions
 
108
                  a sensible number of times
113
109
    """
114
110
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
111
                 type = None, port = None, TXT = None, domain = "",
116
 
                 host = "", max_renames = 12):
117
 
        """An Avahi (Zeroconf) service. """
 
112
                 host = "", max_renames = 32768):
118
113
        self.interface = interface
119
114
        self.name = name
120
115
        self.type = type
126
121
        self.domain = domain
127
122
        self.host = host
128
123
        self.rename_count = 0
 
124
        self.max_renames = max_renames
129
125
    def rename(self):
130
126
        """Derived from the Avahi example code"""
131
127
        if self.rename_count >= self.max_renames:
132
 
            logger.critical(u"No suitable service name found after %i"
133
 
                            u" retries, exiting.", rename_count)
 
128
            logger.critical(u"No suitable Zeroconf service name found"
 
129
                            u" after %i retries, exiting.",
 
130
                            rename_count)
134
131
            raise AvahiServiceError("Too many renames")
135
 
        name = server.GetAlternativeServiceName(name)
136
 
        logger.notice(u"Changing name to %r ...", name)
 
132
        self.name = server.GetAlternativeServiceName(self.name)
 
133
        logger.info(u"Changing Zeroconf service name to %r ...",
 
134
                    str(self.name))
 
135
        syslogger.setFormatter(logging.Formatter\
 
136
                               ('Mandos (%s): %%(levelname)s:'
 
137
                               ' %%(message)s' % self.name))
137
138
        self.remove()
138
139
        self.add()
139
140
        self.rename_count += 1
151
152
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
153
            group.connect_to_signal('StateChanged',
153
154
                                    entry_group_state_changed)
154
 
        logger.debug(u"Adding service '%s' of type '%s' ...",
 
155
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
155
156
                     service.name, service.type)
156
157
        group.AddService(
157
158
                self.interface,         # interface
175
176
    fingerprint: string (40 or 32 hexadecimal digits); used to
176
177
                 uniquely identify the client
177
178
    secret:    bytestring; sent verbatim (over TLS) to client
178
 
    fqdn:      string (FQDN); available for use by the checker command
 
179
    host:      string; available for use by the checker command
179
180
    created:   datetime.datetime(); object creation, not client host
180
181
    last_checked_ok: datetime.datetime() or None if not yet checked OK
181
182
    timeout:   datetime.timedelta(); How long from last_checked_ok
221
222
    interval = property(lambda self: self._interval,
222
223
                        _set_interval)
223
224
    del _set_interval
224
 
    def __init__(self, name=None, stop_hook=None, fingerprint=None,
225
 
                 secret=None, secfile=None, fqdn=None, timeout=None,
226
 
                 interval=-1, checker=None):
227
 
        """Note: the 'checker' argument sets the 'checker_command'
228
 
        attribute and not the 'checker' attribute.."""
 
225
    def __init__(self, name = None, stop_hook=None, config={}):
 
226
        """Note: the 'checker' key in 'config' sets the
 
227
        'checker_command' attribute and *not* the 'checker'
 
228
        attribute."""
229
229
        self.name = name
230
230
        logger.debug(u"Creating client %r", self.name)
231
 
        # Uppercase and remove spaces from fingerprint
232
 
        # for later comparison purposes with return value of
233
 
        # the fingerprint() function
234
 
        self.fingerprint = fingerprint.upper().replace(u" ", u"")
 
231
        # Uppercase and remove spaces from fingerprint for later
 
232
        # comparison purposes with return value from the fingerprint()
 
233
        # function
 
234
        self.fingerprint = config["fingerprint"].upper()\
 
235
                           .replace(u" ", u"")
235
236
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
236
 
        if secret:
237
 
            self.secret = secret.decode(u"base64")
238
 
        elif secfile:
239
 
            sf = open(secfile)
 
237
        if "secret" in config:
 
238
            self.secret = config["secret"].decode(u"base64")
 
239
        elif "secfile" in config:
 
240
            sf = open(config["secfile"])
240
241
            self.secret = sf.read()
241
242
            sf.close()
242
243
        else:
243
244
            raise TypeError(u"No secret or secfile for client %s"
244
245
                            % self.name)
245
 
        self.fqdn = fqdn
 
246
        self.host = config.get("host", "")
246
247
        self.created = datetime.datetime.now()
247
248
        self.last_checked_ok = None
248
 
        self.timeout = string_to_delta(timeout)
249
 
        self.interval = string_to_delta(interval)
 
249
        self.timeout = string_to_delta(config["timeout"])
 
250
        self.interval = string_to_delta(config["interval"])
250
251
        self.stop_hook = stop_hook
251
252
        self.checker = None
252
253
        self.checker_initiator_tag = None
253
254
        self.stop_initiator_tag = None
254
255
        self.checker_callback_tag = None
255
 
        self.check_command = checker
 
256
        self.check_command = config["checker"]
256
257
    def start(self):
257
258
        """Start this client's checker and timeout hooks"""
258
259
        # Schedule a new checker to be started an 'interval' from now,
271
272
        The possibility that a client might be restarted is left open,
272
273
        but not currently used."""
273
274
        # If this client doesn't have a secret, it is already stopped.
274
 
        if self.secret:
275
 
            logger.debug(u"Stopping client %s", self.name)
 
275
        if hasattr(self, "secret") and self.secret:
 
276
            logger.info(u"Stopping client %s", self.name)
276
277
            self.secret = None
277
278
        else:
278
279
            return False
297
298
        self.checker = None
298
299
        if os.WIFEXITED(condition) \
299
300
               and (os.WEXITSTATUS(condition) == 0):
300
 
            logger.debug(u"Checker for %(name)s succeeded",
301
 
                         vars(self))
 
301
            logger.info(u"Checker for %(name)s succeeded",
 
302
                        vars(self))
302
303
            self.last_checked_ok = now
303
304
            gobject.source_remove(self.stop_initiator_tag)
304
305
            self.stop_initiator_tag = gobject.timeout_add\
308
309
            logger.warning(u"Checker for %(name)s crashed?",
309
310
                           vars(self))
310
311
        else:
311
 
            logger.debug(u"Checker for %(name)s failed",
312
 
                         vars(self))
 
312
            logger.info(u"Checker for %(name)s failed",
 
313
                        vars(self))
313
314
    def start_checker(self):
314
315
        """Start a new checker subprocess if one is not running.
315
316
        If a checker already exists, leave it running and do
325
326
        if self.checker is None:
326
327
            try:
327
328
                # In case check_command has exactly one % operator
328
 
                command = self.check_command % self.fqdn
 
329
                command = self.check_command % self.host
329
330
            except TypeError:
330
331
                # Escape attributes for the shell
331
332
                escaped_attrs = dict((key, re.escape(str(val)))
338
339
                                 u' %s', self.check_command, error)
339
340
                    return True # Try again later
340
341
            try:
341
 
                logger.debug(u"Starting checker %r for %s",
342
 
                             command, self.name)
 
342
                logger.info(u"Starting checker %r for %s",
 
343
                            command, self.name)
 
344
                # We don't need to redirect stdout and stderr, since
 
345
                # in normal mode, that is already done by daemon(),
 
346
                # and in debug mode we don't want to.  (Stdin is
 
347
                # always replaced by /dev/null.)
343
348
                self.checker = subprocess.Popen(command,
344
349
                                                close_fds=True,
345
350
                                                shell=True, cwd="/")
346
351
                self.checker_callback_tag = gobject.child_watch_add\
347
352
                                            (self.checker.pid,
348
353
                                             self.checker_callback)
349
 
            except subprocess.OSError, error:
 
354
            except OSError, error:
350
355
                logger.error(u"Failed to start subprocess: %s",
351
356
                             error)
352
357
        # Re-run this periodically if run by gobject.timeout_add
358
363
            self.checker_callback_tag = None
359
364
        if getattr(self, "checker", None) is None:
360
365
            return
361
 
        logger.debug("Stopping checker for %(name)s", vars(self))
 
366
        logger.debug(u"Stopping checker for %(name)s", vars(self))
362
367
        try:
363
368
            os.kill(self.checker.pid, signal.SIGTERM)
364
369
            #os.sleep(0.5)
396
401
 
397
402
def fingerprint(openpgp):
398
403
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
399
 
    # New empty GnuTLS certificate
400
 
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
401
 
    gnutls.library.functions.gnutls_openpgp_crt_init\
402
 
        (ctypes.byref(crt))
403
404
    # New GnuTLS "datum" with the OpenPGP public key
404
405
    datum = gnutls.library.types.gnutls_datum_t\
405
406
        (ctypes.cast(ctypes.c_char_p(openpgp),
406
407
                     ctypes.POINTER(ctypes.c_ubyte)),
407
408
         ctypes.c_uint(len(openpgp)))
 
409
    # New empty GnuTLS certificate
 
410
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
411
    gnutls.library.functions.gnutls_openpgp_crt_init\
 
412
        (ctypes.byref(crt))
408
413
    # Import the OpenPGP public key into the certificate
409
 
    ret = gnutls.library.functions.gnutls_openpgp_crt_import\
410
 
        (crt,
411
 
         ctypes.byref(datum),
412
 
         gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
414
    gnutls.library.functions.gnutls_openpgp_crt_import\
 
415
                    (crt, ctypes.byref(datum),
 
416
                     gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
417
    # Verify the self signature in the key
 
418
    crtverify = ctypes.c_uint();
 
419
    gnutls.library.functions.gnutls_openpgp_crt_verify_self\
 
420
        (crt, 0, ctypes.byref(crtverify))
 
421
    if crtverify.value != 0:
 
422
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
423
        raise gnutls.errors.CertificateSecurityError("Verify failed")
413
424
    # New buffer for the fingerprint
414
425
    buffer = ctypes.create_string_buffer(20)
415
426
    buffer_length = ctypes.c_size_t()
431
442
    Note: This will run in its own forked process."""
432
443
    
433
444
    def handle(self):
434
 
        logger.debug(u"TCP connection from: %s",
 
445
        logger.info(u"TCP connection from: %s",
435
446
                     unicode(self.client_address))
436
447
        session = gnutls.connection.ClientSession\
437
448
                  (self.request, gnutls.connection.X509Credentials())
 
449
        
 
450
        line = self.request.makefile().readline()
 
451
        logger.debug(u"Protocol version: %r", line)
 
452
        try:
 
453
            if int(line.strip().split()[0]) > 1:
 
454
                raise RuntimeError
 
455
        except (ValueError, IndexError, RuntimeError), error:
 
456
            logger.error(u"Unknown protocol version: %s", error)
 
457
            return
 
458
        
438
459
        # Note: gnutls.connection.X509Credentials is really a generic
439
460
        # GnuTLS certificate credentials object so long as no X.509
440
461
        # keys are added to it.  Therefore, we can use it here despite
453
474
        try:
454
475
            session.handshake()
455
476
        except gnutls.errors.GNUTLSError, error:
456
 
            logger.debug(u"Handshake failed: %s", error)
 
477
            logger.warning(u"Handshake failed: %s", error)
457
478
            # Do not run session.bye() here: the session is not
458
479
            # established.  Just abandon the request.
459
480
            return
460
481
        try:
461
482
            fpr = fingerprint(peer_certificate(session))
462
483
        except (TypeError, gnutls.errors.GNUTLSError), error:
463
 
            logger.debug(u"Bad certificate: %s", error)
 
484
            logger.warning(u"Bad certificate: %s", error)
464
485
            session.bye()
465
486
            return
466
487
        logger.debug(u"Fingerprint: %s", fpr)
470
491
                client = c
471
492
                break
472
493
        if not client:
473
 
            logger.debug(u"Client not found for fingerprint: %s", fpr)
 
494
            logger.warning(u"Client not found for fingerprint: %s",
 
495
                           fpr)
474
496
            session.bye()
475
497
            return
476
498
        # Have to check if client.still_valid(), since it is possible
477
499
        # that the client timed out while establishing the GnuTLS
478
500
        # session.
479
501
        if not client.still_valid():
480
 
            logger.debug(u"Client %(name)s is invalid", vars(client))
 
502
            logger.warning(u"Client %(name)s is invalid",
 
503
                           vars(client))
481
504
            session.bye()
482
505
            return
483
506
        sent_size = 0
495
518
    Attributes:
496
519
        settings:       Server settings
497
520
        clients:        Set() of Client objects
 
521
        enabled:        Boolean; whether this server is activated yet
498
522
    """
499
523
    address_family = socket.AF_INET6
500
524
    def __init__(self, *args, **kwargs):
504
528
        if "clients" in kwargs:
505
529
            self.clients = kwargs["clients"]
506
530
            del kwargs["clients"]
 
531
        self.enabled = False
507
532
        return super(type(self), self).__init__(*args, **kwargs)
508
533
    def server_bind(self):
509
534
        """This overrides the normal server_bind() function
518
543
                                       self.settings["interface"])
519
544
            except socket.error, error:
520
545
                if error[0] == errno.EPERM:
521
 
                    logger.warning(u"No permission to"
522
 
                                   u" bind to interface %s",
523
 
                                   self.settings["interface"])
 
546
                    logger.error(u"No permission to"
 
547
                                 u" bind to interface %s",
 
548
                                 self.settings["interface"])
524
549
                else:
525
550
                    raise error
526
551
        # Only bind(2) the socket if we really need to.
529
554
                in6addr_any = "::"
530
555
                self.server_address = (in6addr_any,
531
556
                                       self.server_address[1])
532
 
            elif self.server_address[1] is None:
 
557
            elif not self.server_address[1]:
533
558
                self.server_address = (self.server_address[0],
534
559
                                       0)
 
560
#                 if self.settings["interface"]:
 
561
#                     self.server_address = (self.server_address[0],
 
562
#                                            0, # port
 
563
#                                            0, # flowinfo
 
564
#                                            if_nametoindex
 
565
#                                            (self.settings
 
566
#                                             ["interface"]))
535
567
            return super(type(self), self).server_bind()
 
568
    def server_activate(self):
 
569
        if self.enabled:
 
570
            return super(type(self), self).server_activate()
 
571
    def enable(self):
 
572
        self.enabled = True
536
573
 
537
574
 
538
575
def string_to_delta(interval):
548
585
    datetime.timedelta(1)
549
586
    >>> string_to_delta(u'1w')
550
587
    datetime.timedelta(7)
 
588
    >>> string_to_delta('5m 30s')
 
589
    datetime.timedelta(0, 330)
551
590
    """
552
 
    try:
553
 
        suffix=unicode(interval[-1])
554
 
        value=int(interval[:-1])
555
 
        if suffix == u"d":
556
 
            delta = datetime.timedelta(value)
557
 
        elif suffix == u"s":
558
 
            delta = datetime.timedelta(0, value)
559
 
        elif suffix == u"m":
560
 
            delta = datetime.timedelta(0, 0, 0, 0, value)
561
 
        elif suffix == u"h":
562
 
            delta = datetime.timedelta(0, 0, 0, 0, 0, value)
563
 
        elif suffix == u"w":
564
 
            delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
565
 
        else:
 
591
    timevalue = datetime.timedelta(0)
 
592
    for s in interval.split():
 
593
        try:
 
594
            suffix=unicode(s[-1])
 
595
            value=int(s[:-1])
 
596
            if suffix == u"d":
 
597
                delta = datetime.timedelta(value)
 
598
            elif suffix == u"s":
 
599
                delta = datetime.timedelta(0, value)
 
600
            elif suffix == u"m":
 
601
                delta = datetime.timedelta(0, 0, 0, 0, value)
 
602
            elif suffix == u"h":
 
603
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
 
604
            elif suffix == u"w":
 
605
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
 
606
            else:
 
607
                raise ValueError
 
608
        except (ValueError, IndexError):
566
609
            raise ValueError
567
 
    except (ValueError, IndexError):
568
 
        raise ValueError
569
 
    return delta
 
610
        timevalue += delta
 
611
    return timevalue
570
612
 
571
613
 
572
614
def server_state_changed(state):
573
615
    """Derived from the Avahi example code"""
574
616
    if state == avahi.SERVER_COLLISION:
575
 
        logger.warning(u"Server name collision")
 
617
        logger.error(u"Zeroconf server name collision")
576
618
        service.remove()
577
619
    elif state == avahi.SERVER_RUNNING:
578
620
        service.add()
580
622
 
581
623
def entry_group_state_changed(state, error):
582
624
    """Derived from the Avahi example code"""
583
 
    logger.debug(u"state change: %i", state)
 
625
    logger.debug(u"Avahi state change: %i", state)
584
626
    
585
627
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
586
 
        logger.debug(u"Service established.")
 
628
        logger.debug(u"Zeroconf service established.")
587
629
    elif state == avahi.ENTRY_GROUP_COLLISION:
588
 
        logger.warning(u"Service name collision.")
 
630
        logger.warning(u"Zeroconf service name collision.")
589
631
        service.rename()
590
632
    elif state == avahi.ENTRY_GROUP_FAILURE:
591
 
        logger.critical(u"Error in group state changed %s",
 
633
        logger.critical(u"Avahi: Error in group state changed %s",
592
634
                        unicode(error))
593
635
        raise AvahiGroupError("State changed: %s", str(error))
594
636
 
595
 
def if_nametoindex(interface, _func=[None]):
 
637
def if_nametoindex(interface):
596
638
    """Call the C function if_nametoindex(), or equivalent"""
597
 
    if _func[0] is not None:
598
 
        return _func[0](interface)
 
639
    global if_nametoindex
599
640
    try:
600
641
        if "ctypes.util" not in sys.modules:
601
642
            import ctypes.util
602
 
        while True:
603
 
            try:
604
 
                libc = ctypes.cdll.LoadLibrary\
605
 
                       (ctypes.util.find_library("c"))
606
 
                _func[0] = libc.if_nametoindex
607
 
                return _func[0](interface)
608
 
            except IOError, e:
609
 
                if e != errno.EINTR:
610
 
                    raise
 
643
        if_nametoindex = ctypes.cdll.LoadLibrary\
 
644
            (ctypes.util.find_library("c")).if_nametoindex
611
645
    except (OSError, AttributeError):
612
646
        if "struct" not in sys.modules:
613
647
            import struct
614
648
        if "fcntl" not in sys.modules:
615
649
            import fcntl
616
 
        def the_hard_way(interface):
 
650
        def if_nametoindex(interface):
617
651
            "Get an interface index the hard way, i.e. using fcntl()"
618
652
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
619
653
            s = socket.socket()
622
656
            s.close()
623
657
            interface_index = struct.unpack("I", ifreq[16:20])[0]
624
658
            return interface_index
625
 
        _func[0] = the_hard_way
626
 
        return _func[0](interface)
627
 
 
628
 
 
629
 
def daemon(nochdir, noclose):
 
659
    return if_nametoindex(interface)
 
660
 
 
661
 
 
662
def daemon(nochdir = False, noclose = False):
630
663
    """See daemon(3).  Standard BSD Unix function.
631
664
    This should really exist as os.daemon, but it doesn't (yet)."""
632
665
    if os.fork():
634
667
    os.setsid()
635
668
    if not nochdir:
636
669
        os.chdir("/")
 
670
    if os.fork():
 
671
        sys.exit()
637
672
    if not noclose:
638
673
        # Close all standard open file descriptors
639
674
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
651
686
    global main_loop_started
652
687
    main_loop_started = False
653
688
    
654
 
    parser = OptionParser()
 
689
    parser = OptionParser(version = "%%prog %s" % version)
655
690
    parser.add_option("-i", "--interface", type="string",
656
691
                      metavar="IF", help="Bind to interface IF")
657
692
    parser.add_option("-a", "--address", type="string",
660
695
                      help="Port number to receive requests on")
661
696
    parser.add_option("--check", action="store_true", default=False,
662
697
                      help="Run self-test")
663
 
    parser.add_option("--debug", action="store_true", default=False,
 
698
    parser.add_option("--debug", action="store_true",
664
699
                      help="Debug mode; run in foreground and log to"
665
700
                      " terminal")
666
701
    parser.add_option("--priority", type="string", help="GnuTLS"
691
726
    # Parse config file for server-global settings
692
727
    server_config = ConfigParser.SafeConfigParser(server_defaults)
693
728
    del server_defaults
694
 
    server_config.read(os.path.join(options.configdir, "server.conf"))
695
 
    server_section = "server"
 
729
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
696
730
    # Convert the SafeConfigParser object to a dict
697
 
    server_settings = dict(server_config.items(server_section))
 
731
    server_settings = server_config.defaults()
698
732
    # Use getboolean on the boolean config option
699
733
    server_settings["debug"] = server_config.getboolean\
700
 
                               (server_section, "debug")
 
734
                               ("DEFAULT", "debug")
701
735
    del server_config
702
736
    
703
737
    # Override the settings from the config file with command line
710
744
    del options
711
745
    # Now we have our good server settings in "server_settings"
712
746
    
 
747
    debug = server_settings["debug"]
 
748
    
 
749
    if not debug:
 
750
        syslogger.setLevel(logging.WARNING)
 
751
        console.setLevel(logging.WARNING)
 
752
    
 
753
    if server_settings["servicename"] != "Mandos":
 
754
        syslogger.setFormatter(logging.Formatter\
 
755
                               ('Mandos (%s): %%(levelname)s:'
 
756
                                ' %%(message)s'
 
757
                                % server_settings["servicename"]))
 
758
    
713
759
    # Parse config file with clients
714
760
    client_defaults = { "timeout": "1h",
715
761
                        "interval": "5m",
716
 
                        "checker": "fping -q -- %%(fqdn)s",
 
762
                        "checker": "fping -q -- %(host)s",
 
763
                        "host": "",
717
764
                        }
718
765
    client_config = ConfigParser.SafeConfigParser(client_defaults)
719
766
    client_config.read(os.path.join(server_settings["configdir"],
720
767
                                    "clients.conf"))
721
768
    
 
769
    clients = Set()
 
770
    tcp_server = IPv6_TCPServer((server_settings["address"],
 
771
                                 server_settings["port"]),
 
772
                                tcp_handler,
 
773
                                settings=server_settings,
 
774
                                clients=clients)
 
775
    pidfilename = "/var/run/mandos.pid"
 
776
    try:
 
777
        pidfile = open(pidfilename, "w")
 
778
    except IOError, error:
 
779
        logger.error("Could not open file %r", pidfilename)
 
780
    
 
781
    uid = 65534
 
782
    gid = 65534
 
783
    try:
 
784
        uid = pwd.getpwnam("mandos").pw_uid
 
785
    except KeyError:
 
786
        try:
 
787
            uid = pwd.getpwnam("nobody").pw_uid
 
788
        except KeyError:
 
789
            pass
 
790
    try:
 
791
        gid = pwd.getpwnam("mandos").pw_gid
 
792
    except KeyError:
 
793
        try:
 
794
            gid = pwd.getpwnam("nogroup").pw_gid
 
795
        except KeyError:
 
796
            pass
 
797
    try:
 
798
        os.setuid(uid)
 
799
        os.setgid(gid)
 
800
    except OSError, error:
 
801
        if error[0] != errno.EPERM:
 
802
            raise error
 
803
    
722
804
    global service
723
805
    service = AvahiService(name = server_settings["servicename"],
724
806
                           type = "_mandos._tcp", );
725
807
    if server_settings["interface"]:
726
 
        service.interface = if_nametoindex(server_settings["interface"])
 
808
        service.interface = if_nametoindex\
 
809
                            (server_settings["interface"])
727
810
    
728
811
    global main_loop
729
812
    global bus
732
815
    DBusGMainLoop(set_as_default=True )
733
816
    main_loop = gobject.MainLoop()
734
817
    bus = dbus.SystemBus()
735
 
    server = dbus.Interface(
736
 
            bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
737
 
            avahi.DBUS_INTERFACE_SERVER )
 
818
    server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
 
819
                                           avahi.DBUS_PATH_SERVER),
 
820
                            avahi.DBUS_INTERFACE_SERVER)
738
821
    # End of Avahi example code
739
822
    
740
 
    debug = server_settings["debug"]
741
 
    
742
 
    if debug:
743
 
        console = logging.StreamHandler()
744
 
        # console.setLevel(logging.DEBUG)
745
 
        console.setFormatter(logging.Formatter\
746
 
                             ('%(levelname)s: %(message)s'))
747
 
        logger.addHandler(console)
748
 
        del console
749
 
    
750
 
    clients = Set()
751
823
    def remove_from_clients(client):
752
824
        clients.remove(client)
753
825
        if not clients:
754
 
            logger.debug(u"No clients left, exiting")
 
826
            logger.critical(u"No clients left, exiting")
755
827
            sys.exit()
756
828
    
757
 
    clients.update(Set(Client(name=section,
 
829
    clients.update(Set(Client(name = section,
758
830
                              stop_hook = remove_from_clients,
759
 
                              **(dict(client_config\
760
 
                                      .items(section))))
 
831
                              config
 
832
                              = dict(client_config.items(section)))
761
833
                       for section in client_config.sections()))
762
 
    
763
 
    if not debug:
764
 
        daemon(False, False)
 
834
    if not clients:
 
835
        logger.critical(u"No clients defined")
 
836
        sys.exit(1)
 
837
    
 
838
    if debug:
 
839
        # Redirect stdin so all checkers get /dev/null
 
840
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
841
        os.dup2(null, sys.stdin.fileno())
 
842
        if null > 2:
 
843
            os.close(null)
 
844
    else:
 
845
        # No console logging
 
846
        logger.removeHandler(console)
 
847
        # Close all input and output, do double fork, etc.
 
848
        daemon()
 
849
    
 
850
    try:
 
851
        pid = os.getpid()
 
852
        pidfile.write(str(pid) + "\n")
 
853
        pidfile.close()
 
854
        del pidfile
 
855
    except IOError, err:
 
856
        logger.error(u"Could not write to file %r with PID %d",
 
857
                     pidfilename, pid)
 
858
    except NameError:
 
859
        # "pidfile" was never created
 
860
        pass
 
861
    del pidfilename
765
862
    
766
863
    def cleanup():
767
864
        "Cleanup function; run on exit"
787
884
    for client in clients:
788
885
        client.start()
789
886
    
790
 
    tcp_server = IPv6_TCPServer((server_settings["address"],
791
 
                                 server_settings["port"]),
792
 
                                tcp_handler,
793
 
                                settings=server_settings,
794
 
                                clients=clients)
 
887
    tcp_server.enable()
 
888
    tcp_server.server_activate()
 
889
    
795
890
    # Find out what port we got
796
891
    service.port = tcp_server.socket.getsockname()[1]
797
 
    logger.debug(u"Now listening on address %r, port %d, flowinfo %d,"
798
 
                 u" scope_id %d" % tcp_server.socket.getsockname())
 
892
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
 
893
                u" scope_id %d" % tcp_server.socket.getsockname())
799
894
    
800
895
    #service.interface = tcp_server.socket.getsockname()[3]
801
896
    
814
909
                             tcp_server.handle_request\
815
910
                             (*args[2:], **kwargs) or True)
816
911
        
817
 
        logger.debug("Starting main loop")
 
912
        logger.debug(u"Starting main loop")
818
913
        main_loop_started = True
819
914
        main_loop.run()
820
915
    except AvahiError, error: