To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 202
- compare with another revision
- download diff
- download tarball
- view history from revision 202
- Committer: Teddy Hogeborn
- Date: 2008-09-21 13:42:34 UTC
- Revision ID: teddy@fukt.bsnet.se-20080921134234-jo8p4rwtm50yb4xj
* clients.conf ([bar]/secfile): Do not imply armored format.
* debian/control: Build-Depend on pkg-config.
* debian/mandos.prerm (remove): Bug fix; check for
"/etc/init.d/mandos", not
"/etc/init.d/ssh".
* debian/control: Build-Depend on pkg-config.
* debian/mandos.prerm (remove): Bug fix; check for
"/etc/init.d/mandos", not
"/etc/init.d/ssh".
- files added:
- debian/mandos-client.config
- files removed:
- NEWS
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import division, with_statement, absolute_import
33
from __future__ import division
35
34
36
35
import SocketServer
37
36
import socket
38
import optparse
37
import select
38
from optparse import OptionParser
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
56
56
import logging
57
57
import logging.handlers
58
58
import pwd
59
from contextlib import closing
60
59
61
60
import dbus
62
import dbus.service
63
61
import gobject
64
62
import avahi
65
63
from dbus.mainloop.glib import DBusGMainLoop
66
64
import ctypes
67
import ctypes.util
68
65
69
version = "1.0.8"
66
version = "1.0"
70
67
71
68
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
78
74
logger.addHandler(syslogger)
79
75
80
76
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
' %(message)s'))
83
79
logger.addHandler(console)
84
80
85
81
class AvahiError(Exception):
86
def __init__(self, value, *args, **kwargs):
82
def __init__(self, value):
87
83
self.value = value
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
84
def __str__(self):
85
return repr(self.value)
91
86
92
87
class AvahiServiceError(AvahiError):
93
88
pass
113
108
a sensible number of times
114
109
"""
115
110
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768,
118
protocol = avahi.PROTO_UNSPEC):
111
type = None, port = None, TXT = None, domain = "",
112
host = "", max_renames = 32768):
119
113
self.interface = interface
120
114
self.name = name
121
self.type = servicetype
115
self.type = type
122
116
self.port = port
123
self.TXT = TXT if TXT is not None else []
117
if TXT is None:
118
self.TXT = []
119
else:
120
self.TXT = TXT
124
121
self.domain = domain
125
122
self.host = host
126
123
self.rename_count = 0
127
124
self.max_renames = max_renames
128
self.protocol = protocol
129
125
def rename(self):
130
126
"""Derived from the Avahi example code"""
131
127
if self.rename_count >= self.max_renames:
132
128
logger.critical(u"No suitable Zeroconf service name found"
133
129
u" after %i retries, exiting.",
134
self.rename_count)
135
raise AvahiServiceError(u"Too many renames")
130
rename_count)
131
raise AvahiServiceError("Too many renames")
136
132
self.name = server.GetAlternativeServiceName(self.name)
137
133
logger.info(u"Changing Zeroconf service name to %r ...",
138
134
str(self.name))
139
syslogger.setFormatter(logging.Formatter
140
('Mandos (%s) [%%(process)d]:'
141
' %%(levelname)s: %%(message)s'
142
% self.name))
135
syslogger.setFormatter(logging.Formatter\
136
('Mandos (%s): %%(levelname)s:'
137
' %%(message)s' % self.name))
143
138
self.remove()
144
139
self.add()
145
140
self.rename_count += 1
151
146
"""Derived from the Avahi example code"""
152
147
global group
153
148
if group is None:
154
group = dbus.Interface(bus.get_object
155
(avahi.DBUS_NAME,
149
group = dbus.Interface\
150
(bus.get_object(avahi.DBUS_NAME,
156
151
server.EntryGroupNew()),
157
avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
avahi.DBUS_INTERFACE_ENTRY_GROUP)
158
153
group.connect_to_signal('StateChanged',
159
154
entry_group_state_changed)
160
155
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
161
156
service.name, service.type)
162
157
group.AddService(
163
158
self.interface, # interface
164
self.protocol, # protocol
159
avahi.PROTO_INET6, # protocol
165
160
dbus.UInt32(0), # flags
166
161
self.name, self.type,
167
162
self.domain, self.host,
174
169
# End of Avahi example code
175
170
176
171
177
def _datetime_to_dbus(dt, variant_level=0):
178
"""Convert a UTC datetime.datetime() to a D-Bus type."""
179
return dbus.String(dt.isoformat(), variant_level=variant_level)
180
181
182
class Client(dbus.service.Object):
172
class Client(object):
183
173
"""A representation of a client host served by this server.
184
174
Attributes:
185
name: string; from the config file, used in log messages and
186
D-Bus identifiers
175
name: string; from the config file, used in log messages
187
176
fingerprint: string (40 or 32 hexadecimal digits); used to
188
177
uniquely identify the client
189
secret: bytestring; sent verbatim (over TLS) to client
190
host: string; available for use by the checker command
191
created: datetime.datetime(); (UTC) object creation
192
last_enabled: datetime.datetime(); (UTC)
193
enabled: bool()
194
last_checked_ok: datetime.datetime(); (UTC) or None
195
timeout: datetime.timedelta(); How long from last_checked_ok
196
until this client is invalid
197
interval: datetime.timedelta(); How often to start a new checker
198
disable_hook: If set, called by disable() as disable_hook(self)
199
checker: subprocess.Popen(); a running checker process used
200
to see if the client lives.
201
'None' if no process is running.
178
secret: bytestring; sent verbatim (over TLS) to client
179
host: string; available for use by the checker command
180
created: datetime.datetime(); object creation, not client host
181
last_checked_ok: datetime.datetime() or None if not yet checked OK
182
timeout: datetime.timedelta(); How long from last_checked_ok
183
until this client is invalid
184
interval: datetime.timedelta(); How often to start a new checker
185
stop_hook: If set, called by stop() as stop_hook(self)
186
checker: subprocess.Popen(); a running checker process used
187
to see if the client lives.
188
'None' if no process is running.
202
189
checker_initiator_tag: a gobject event source tag, or None
203
disable_initiator_tag: - '' -
190
stop_initiator_tag: - '' -
204
191
checker_callback_tag: - '' -
205
192
checker_command: string; External command which is run to check if
206
193
client lives. %() expansions are done at
207
194
runtime with vars(self) as dict, so that for
208
195
instance %(name)s can be used in the command.
209
current_checker_command: string; current running checker_command
210
use_dbus: bool(); Whether to provide D-Bus interface and signals
211
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
196
Private attibutes:
197
_timeout: Real variable for 'timeout'
198
_interval: Real variable for 'interval'
199
_timeout_milliseconds: Used when calling gobject.timeout_add()
200
_interval_milliseconds: - '' -
212
201
"""
213
def timeout_milliseconds(self):
214
"Return the 'timeout' attribute in milliseconds"
215
return ((self.timeout.days * 24 * 60 * 60 * 1000)
216
+ (self.timeout.seconds * 1000)
217
+ (self.timeout.microseconds // 1000))
218
219
def interval_milliseconds(self):
220
"Return the 'interval' attribute in milliseconds"
221
return ((self.interval.days * 24 * 60 * 60 * 1000)
222
+ (self.interval.seconds * 1000)
223
+ (self.interval.microseconds // 1000))
224
225
def __init__(self, name = None, disable_hook=None, config=None,
226
use_dbus=True):
202
def _set_timeout(self, timeout):
203
"Setter function for 'timeout' attribute"
204
self._timeout = timeout
205
self._timeout_milliseconds = ((self.timeout.days
206
* 24 * 60 * 60 * 1000)
207
+ (self.timeout.seconds * 1000)
208
+ (self.timeout.microseconds
209
// 1000))
210
timeout = property(lambda self: self._timeout,
211
_set_timeout)
212
del _set_timeout
213
def _set_interval(self, interval):
214
"Setter function for 'interval' attribute"
215
self._interval = interval
216
self._interval_milliseconds = ((self.interval.days
217
* 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds
219
* 1000)
220
+ (self.interval.microseconds
221
// 1000))
222
interval = property(lambda self: self._interval,
223
_set_interval)
224
del _set_interval
225
def __init__(self, name = None, stop_hook=None, config={}):
227
226
"""Note: the 'checker' key in 'config' sets the
228
227
'checker_command' attribute and *not* the 'checker'
229
228
attribute."""
230
229
self.name = name
231
if config is None:
232
config = {}
233
230
logger.debug(u"Creating client %r", self.name)
234
self.use_dbus = False # During __init__
235
231
# Uppercase and remove spaces from fingerprint for later
236
232
# comparison purposes with return value from the fingerprint()
237
233
# function
238
self.fingerprint = (config["fingerprint"].upper()
239
.replace(u" ", u""))
234
self.fingerprint = config["fingerprint"].upper()\
235
.replace(u" ", u"")
240
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
241
237
if "secret" in config:
242
238
self.secret = config["secret"].decode(u"base64")
243
239
elif "secfile" in config:
244
with closing(open(os.path.expanduser
245
(os.path.expandvars
246
(config["secfile"])))) as secfile:
247
self.secret = secfile.read()
240
sf = open(config["secfile"])
241
self.secret = sf.read()
242
sf.close()
248
243
else:
249
244
raise TypeError(u"No secret or secfile for client %s"
250
245
% self.name)
251
246
self.host = config.get("host", "")
252
self.created = datetime.datetime.utcnow()
253
self.enabled = False
254
self.last_enabled = None
247
self.created = datetime.datetime.now()
255
248
self.last_checked_ok = None
256
249
self.timeout = string_to_delta(config["timeout"])
257
250
self.interval = string_to_delta(config["interval"])
258
self.disable_hook = disable_hook
251
self.stop_hook = stop_hook
259
252
self.checker = None
260
253
self.checker_initiator_tag = None
261
self.disable_initiator_tag = None
254
self.stop_initiator_tag = None
262
255
self.checker_callback_tag = None
263
self.checker_command = config["checker"]
264
self.current_checker_command = None
265
self.last_connect = None
266
# Only now, when this client is initialized, can it show up on
267
# the D-Bus
268
self.use_dbus = use_dbus
269
if self.use_dbus:
270
self.dbus_object_path = (dbus.ObjectPath
271
("/clients/"
272
+ self.name.replace(".", "_")))
273
dbus.service.Object.__init__(self, bus,
274
self.dbus_object_path)
275
276
def enable(self):
256
self.check_command = config["checker"]
257
def start(self):
277
258
"""Start this client's checker and timeout hooks"""
278
self.last_enabled = datetime.datetime.utcnow()
279
259
# Schedule a new checker to be started an 'interval' from now,
280
260
# and every interval from then on.
281
self.checker_initiator_tag = (gobject.timeout_add
282
(self.interval_milliseconds(),
283
self.start_checker))
261
self.checker_initiator_tag = gobject.timeout_add\
262
(self._interval_milliseconds,
263
self.start_checker)
284
264
# Also start a new checker *right now*.
285
265
self.start_checker()
286
# Schedule a disable() when 'timeout' has passed
287
self.disable_initiator_tag = (gobject.timeout_add
288
(self.timeout_milliseconds(),
289
self.disable))
290
self.enabled = True
291
if self.use_dbus:
292
# Emit D-Bus signals
293
self.PropertyChanged(dbus.String(u"enabled"),
294
dbus.Boolean(True, variant_level=1))
295
self.PropertyChanged(dbus.String(u"last_enabled"),
296
(_datetime_to_dbus(self.last_enabled,
297
variant_level=1)))
298
299
def disable(self):
300
"""Disable this client."""
301
if not getattr(self, "enabled", False):
266
# Schedule a stop() when 'timeout' has passed
267
self.stop_initiator_tag = gobject.timeout_add\
268
(self._timeout_milliseconds,
269
self.stop)
270
def stop(self):
271
"""Stop this client.
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
274
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
276
logger.info(u"Stopping client %s", self.name)
277
self.secret = None
278
else:
302
279
return False
303
logger.info(u"Disabling client %s", self.name)
304
if getattr(self, "disable_initiator_tag", False):
305
gobject.source_remove(self.disable_initiator_tag)
306
self.disable_initiator_tag = None
280
if getattr(self, "stop_initiator_tag", False):
281
gobject.source_remove(self.stop_initiator_tag)
282
self.stop_initiator_tag = None
307
283
if getattr(self, "checker_initiator_tag", False):
308
284
gobject.source_remove(self.checker_initiator_tag)
309
285
self.checker_initiator_tag = None
310
286
self.stop_checker()
311
if self.disable_hook:
312
self.disable_hook(self)
313
self.enabled = False
314
if self.use_dbus:
315
# Emit D-Bus signal
316
self.PropertyChanged(dbus.String(u"enabled"),
317
dbus.Boolean(False, variant_level=1))
287
if self.stop_hook:
288
self.stop_hook(self)
318
289
# Do not run this again if called by a gobject.timeout_add
319
290
return False
320
321
291
def __del__(self):
322
self.disable_hook = None
323
self.disable()
324
325
def checker_callback(self, pid, condition, command):
292
self.stop_hook = None
293
self.stop()
294
def checker_callback(self, pid, condition):
326
295
"""The checker has completed, so take appropriate actions."""
296
now = datetime.datetime.now()
327
297
self.checker_callback_tag = None
328
298
self.checker = None
329
if self.use_dbus:
330
# Emit D-Bus signal
331
self.PropertyChanged(dbus.String(u"checker_running"),
332
dbus.Boolean(False, variant_level=1))
333
if os.WIFEXITED(condition):
334
exitstatus = os.WEXITSTATUS(condition)
335
if exitstatus == 0:
336
logger.info(u"Checker for %(name)s succeeded",
337
vars(self))
338
self.checked_ok()
339
else:
340
logger.info(u"Checker for %(name)s failed",
341
vars(self))
342
if self.use_dbus:
343
# Emit D-Bus signal
344
self.CheckerCompleted(dbus.Int16(exitstatus),
345
dbus.Int64(condition),
346
dbus.String(command))
347
else:
299
if os.WIFEXITED(condition) \
300
and (os.WEXITSTATUS(condition) == 0):
301
logger.info(u"Checker for %(name)s succeeded",
302
vars(self))
303
self.last_checked_ok = now
304
gobject.source_remove(self.stop_initiator_tag)
305
self.stop_initiator_tag = gobject.timeout_add\
306
(self._timeout_milliseconds,
307
self.stop)
308
elif not os.WIFEXITED(condition):
348
309
logger.warning(u"Checker for %(name)s crashed?",
349
310
vars(self))
350
if self.use_dbus:
351
# Emit D-Bus signal
352
self.CheckerCompleted(dbus.Int16(-1),
353
dbus.Int64(condition),
354
dbus.String(command))
355
356
def checked_ok(self):
357
"""Bump up the timeout for this client.
358
This should only be called when the client has been seen,
359
alive and well.
360
"""
361
self.last_checked_ok = datetime.datetime.utcnow()
362
gobject.source_remove(self.disable_initiator_tag)
363
self.disable_initiator_tag = (gobject.timeout_add
364
(self.timeout_milliseconds(),
365
self.disable))
366
if self.use_dbus:
367
# Emit D-Bus signal
368
self.PropertyChanged(
369
dbus.String(u"last_checked_ok"),
370
(_datetime_to_dbus(self.last_checked_ok,
371
variant_level=1)))
372
311
else:
312
logger.info(u"Checker for %(name)s failed",
313
vars(self))
373
314
def start_checker(self):
374
315
"""Start a new checker subprocess if one is not running.
375
316
If a checker already exists, leave it running and do
382
323
# checkers alone, the checker would have to take more time
383
324
# than 'timeout' for the client to be declared invalid, which
384
325
# is as it should be.
385
386
# If a checker exists, make sure it is not a zombie
387
if self.checker is not None:
388
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
389
if pid:
390
logger.warning("Checker was a zombie")
391
gobject.source_remove(self.checker_callback_tag)
392
self.checker_callback(pid, status,
393
self.current_checker_command)
394
# Start a new checker if needed
395
326
if self.checker is None:
396
327
try:
397
# In case checker_command has exactly one % operator
398
command = self.checker_command % self.host
328
# In case check_command has exactly one % operator
329
command = self.check_command % self.host
399
330
except TypeError:
400
331
# Escape attributes for the shell
401
332
escaped_attrs = dict((key, re.escape(str(val)))
402
333
for key, val in
403
334
vars(self).iteritems())
404
335
try:
405
command = self.checker_command % escaped_attrs
336
command = self.check_command % escaped_attrs
406
337
except TypeError, error:
407
338
logger.error(u'Could not format string "%s":'
408
u' %s', self.checker_command, error)
339
u' %s', self.check_command, error)
409
340
return True # Try again later
410
self.current_checker_command = command
411
341
try:
412
342
logger.info(u"Starting checker %r for %s",
413
343
command, self.name)
418
348
self.checker = subprocess.Popen(command,
419
349
close_fds=True,
420
350
shell=True, cwd="/")
421
if self.use_dbus:
422
# Emit D-Bus signal
423
self.CheckerStarted(command)
424
self.PropertyChanged(
425
dbus.String("checker_running"),
426
dbus.Boolean(True, variant_level=1))
427
self.checker_callback_tag = (gobject.child_watch_add
428
(self.checker.pid,
429
self.checker_callback,
430
data=command))
431
# The checker may have completed before the gobject
432
# watch was added. Check for this.
433
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
434
if pid:
435
gobject.source_remove(self.checker_callback_tag)
436
self.checker_callback(pid, status, command)
351
self.checker_callback_tag = gobject.child_watch_add\
352
(self.checker.pid,
353
self.checker_callback)
437
354
except OSError, error:
438
355
logger.error(u"Failed to start subprocess: %s",
439
356
error)
440
357
# Re-run this periodically if run by gobject.timeout_add
441
358
return True
442
443
359
def stop_checker(self):
444
360
"""Force the checker process, if any, to stop."""
445
361
if self.checker_callback_tag:
457
373
if error.errno != errno.ESRCH: # No such process
458
374
raise
459
375
self.checker = None
460
if self.use_dbus:
461
self.PropertyChanged(dbus.String(u"checker_running"),
462
dbus.Boolean(False, variant_level=1))
463
464
376
def still_valid(self):
465
377
"""Has the timeout not yet passed for this client?"""
466
if not getattr(self, "enabled", False):
467
return False
468
now = datetime.datetime.utcnow()
378
now = datetime.datetime.now()
469
379
if self.last_checked_ok is None:
470
380
return now < (self.created + self.timeout)
471
381
else:
472
382
return now < (self.last_checked_ok + self.timeout)
473
474
## D-Bus methods & signals
475
_interface = u"se.bsnet.fukt.Mandos.Client"
476
477
# CheckedOK - method
478
CheckedOK = dbus.service.method(_interface)(checked_ok)
479
CheckedOK.__name__ = "CheckedOK"
480
481
# CheckerCompleted - signal
482
@dbus.service.signal(_interface, signature="nxs")
483
def CheckerCompleted(self, exitcode, waitstatus, command):
484
"D-Bus signal"
485
pass
486
487
# CheckerStarted - signal
488
@dbus.service.signal(_interface, signature="s")
489
def CheckerStarted(self, command):
490
"D-Bus signal"
491
pass
492
493
# GetAllProperties - method
494
@dbus.service.method(_interface, out_signature="a{sv}")
495
def GetAllProperties(self):
496
"D-Bus method"
497
return dbus.Dictionary({
498
dbus.String("name"):
499
dbus.String(self.name, variant_level=1),
500
dbus.String("fingerprint"):
501
dbus.String(self.fingerprint, variant_level=1),
502
dbus.String("host"):
503
dbus.String(self.host, variant_level=1),
504
dbus.String("created"):
505
_datetime_to_dbus(self.created, variant_level=1),
506
dbus.String("last_enabled"):
507
(_datetime_to_dbus(self.last_enabled,
508
variant_level=1)
509
if self.last_enabled is not None
510
else dbus.Boolean(False, variant_level=1)),
511
dbus.String("enabled"):
512
dbus.Boolean(self.enabled, variant_level=1),
513
dbus.String("last_checked_ok"):
514
(_datetime_to_dbus(self.last_checked_ok,
515
variant_level=1)
516
if self.last_checked_ok is not None
517
else dbus.Boolean (False, variant_level=1)),
518
dbus.String("timeout"):
519
dbus.UInt64(self.timeout_milliseconds(),
520
variant_level=1),
521
dbus.String("interval"):
522
dbus.UInt64(self.interval_milliseconds(),
523
variant_level=1),
524
dbus.String("checker"):
525
dbus.String(self.checker_command,
526
variant_level=1),
527
dbus.String("checker_running"):
528
dbus.Boolean(self.checker is not None,
529
variant_level=1),
530
dbus.String("object_path"):
531
dbus.ObjectPath(self.dbus_object_path,
532
variant_level=1)
533
}, signature="sv")
534
535
# IsStillValid - method
536
IsStillValid = (dbus.service.method(_interface, out_signature="b")
537
(still_valid))
538
IsStillValid.__name__ = "IsStillValid"
539
540
# PropertyChanged - signal
541
@dbus.service.signal(_interface, signature="sv")
542
def PropertyChanged(self, property, value):
543
"D-Bus signal"
544
pass
545
546
# ReceivedSecret - signal
547
@dbus.service.signal(_interface)
548
def ReceivedSecret(self):
549
"D-Bus signal"
550
pass
551
552
# Rejected - signal
553
@dbus.service.signal(_interface)
554
def Rejected(self):
555
"D-Bus signal"
556
pass
557
558
# SetChecker - method
559
@dbus.service.method(_interface, in_signature="s")
560
def SetChecker(self, checker):
561
"D-Bus setter method"
562
self.checker_command = checker
563
# Emit D-Bus signal
564
self.PropertyChanged(dbus.String(u"checker"),
565
dbus.String(self.checker_command,
566
variant_level=1))
567
568
# SetHost - method
569
@dbus.service.method(_interface, in_signature="s")
570
def SetHost(self, host):
571
"D-Bus setter method"
572
self.host = host
573
# Emit D-Bus signal
574
self.PropertyChanged(dbus.String(u"host"),
575
dbus.String(self.host, variant_level=1))
576
577
# SetInterval - method
578
@dbus.service.method(_interface, in_signature="t")
579
def SetInterval(self, milliseconds):
580
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
581
# Emit D-Bus signal
582
self.PropertyChanged(dbus.String(u"interval"),
583
(dbus.UInt64(self.interval_milliseconds(),
584
variant_level=1)))
585
586
# SetSecret - method
587
@dbus.service.method(_interface, in_signature="ay",
588
byte_arrays=True)
589
def SetSecret(self, secret):
590
"D-Bus setter method"
591
self.secret = str(secret)
592
593
# SetTimeout - method
594
@dbus.service.method(_interface, in_signature="t")
595
def SetTimeout(self, milliseconds):
596
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
597
# Emit D-Bus signal
598
self.PropertyChanged(dbus.String(u"timeout"),
599
(dbus.UInt64(self.timeout_milliseconds(),
600
variant_level=1)))
601
602
# Enable - method
603
Enable = dbus.service.method(_interface)(enable)
604
Enable.__name__ = "Enable"
605
606
# StartChecker - method
607
@dbus.service.method(_interface)
608
def StartChecker(self):
609
"D-Bus method"
610
self.start_checker()
611
612
# Disable - method
613
@dbus.service.method(_interface)
614
def Disable(self):
615
"D-Bus method"
616
self.disable()
617
618
# StopChecker - method
619
StopChecker = dbus.service.method(_interface)(stop_checker)
620
StopChecker.__name__ = "StopChecker"
621
622
del _interface
623
383
624
384
625
385
def peer_certificate(session):
626
386
"Return the peer's OpenPGP certificate as a bytestring"
627
387
# If not an OpenPGP certificate...
628
if (gnutls.library.functions
629
.gnutls_certificate_type_get(session._c_object)
630
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
388
if gnutls.library.functions.gnutls_certificate_type_get\
389
(session._c_object) \
390
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
631
391
# ...do the normal thing
632
392
return session.peer_certificate
633
list_size = ctypes.c_uint(1)
634
cert_list = (gnutls.library.functions
635
.gnutls_certificate_get_peers
636
(session._c_object, ctypes.byref(list_size)))
637
if not bool(cert_list) and list_size.value != 0:
638
raise gnutls.errors.GNUTLSError("error getting peer"
639
" certificate")
393
list_size = ctypes.c_uint()
394
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
(session._c_object, ctypes.byref(list_size))
640
396
if list_size.value == 0:
641
397
return None
642
398
cert = cert_list[0]
646
402
def fingerprint(openpgp):
647
403
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
648
404
# New GnuTLS "datum" with the OpenPGP public key
649
datum = (gnutls.library.types
650
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
651
ctypes.POINTER
652
(ctypes.c_ubyte)),
653
ctypes.c_uint(len(openpgp))))
405
datum = gnutls.library.types.gnutls_datum_t\
406
(ctypes.cast(ctypes.c_char_p(openpgp),
407
ctypes.POINTER(ctypes.c_ubyte)),
408
ctypes.c_uint(len(openpgp)))
654
409
# New empty GnuTLS certificate
655
410
crt = gnutls.library.types.gnutls_openpgp_crt_t()
656
(gnutls.library.functions
657
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
411
gnutls.library.functions.gnutls_openpgp_crt_init\
412
(ctypes.byref(crt))
658
413
# Import the OpenPGP public key into the certificate
659
(gnutls.library.functions
660
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
661
gnutls.library.constants
662
.GNUTLS_OPENPGP_FMT_RAW))
414
gnutls.library.functions.gnutls_openpgp_crt_import\
415
(crt, ctypes.byref(datum),
416
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
663
417
# Verify the self signature in the key
664
crtverify = ctypes.c_uint()
665
(gnutls.library.functions
666
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
418
crtverify = ctypes.c_uint();
419
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
(crt, 0, ctypes.byref(crtverify))
667
421
if crtverify.value != 0:
668
422
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
669
423
raise gnutls.errors.CertificateSecurityError("Verify failed")
670
424
# New buffer for the fingerprint
671
buf = ctypes.create_string_buffer(20)
672
buf_len = ctypes.c_size_t()
425
buffer = ctypes.create_string_buffer(20)
426
buffer_length = ctypes.c_size_t()
673
427
# Get the fingerprint from the certificate into the buffer
674
(gnutls.library.functions
675
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
676
ctypes.byref(buf_len)))
428
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
677
430
# Deinit the certificate
678
431
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
679
432
# Convert the buffer to a Python bytestring
680
fpr = ctypes.string_at(buf, buf_len.value)
433
fpr = ctypes.string_at(buffer, buffer_length.value)
681
434
# Convert the bytestring to hexadecimal notation
682
435
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
683
436
return hex_fpr
684
437
685
438
686
class TCP_handler(SocketServer.BaseRequestHandler, object):
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
687
440
"""A TCP request handler class.
688
441
Instantiated by IPv6_TCPServer for each request to handle it.
689
442
Note: This will run in its own forked process."""
690
443
691
444
def handle(self):
692
445
logger.info(u"TCP connection from: %s",
693
unicode(self.client_address))
694
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
695
# Open IPC pipe to parent process
696
with closing(os.fdopen(self.server.pipe[1], "w", 1)) as ipc:
697
session = (gnutls.connection
698
.ClientSession(self.request,
699
gnutls.connection
700
.X509Credentials()))
701
702
line = self.request.makefile().readline()
703
logger.debug(u"Protocol version: %r", line)
704
try:
705
if int(line.strip().split()[0]) > 1:
706
raise RuntimeError
707
except (ValueError, IndexError, RuntimeError), error:
708
logger.error(u"Unknown protocol version: %s", error)
709
return
710
711
# Note: gnutls.connection.X509Credentials is really a
712
# generic GnuTLS certificate credentials object so long as
713
# no X.509 keys are added to it. Therefore, we can use it
714
# here despite using OpenPGP certificates.
715
716
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
717
# "+AES-256-CBC", "+SHA1",
718
# "+COMP-NULL", "+CTYPE-OPENPGP",
719
# "+DHE-DSS"))
720
# Use a fallback default, since this MUST be set.
721
priority = self.server.settings.get("priority", "NORMAL")
722
(gnutls.library.functions
723
.gnutls_priority_set_direct(session._c_object,
724
priority, None))
725
726
try:
727
session.handshake()
728
except gnutls.errors.GNUTLSError, error:
729
logger.warning(u"Handshake failed: %s", error)
730
# Do not run session.bye() here: the session is not
731
# established. Just abandon the request.
732
return
733
logger.debug(u"Handshake succeeded")
734
try:
735
fpr = fingerprint(peer_certificate(session))
736
except (TypeError, gnutls.errors.GNUTLSError), error:
737
logger.warning(u"Bad certificate: %s", error)
738
session.bye()
739
return
740
logger.debug(u"Fingerprint: %s", fpr)
741
742
for c in self.server.clients:
743
if c.fingerprint == fpr:
744
client = c
745
break
746
else:
747
logger.warning(u"Client not found for fingerprint: %s",
748
fpr)
749
ipc.write("NOTFOUND %s\n" % fpr)
750
session.bye()
751
return
752
# Have to check if client.still_valid(), since it is
753
# possible that the client timed out while establishing
754
# the GnuTLS session.
755
if not client.still_valid():
756
logger.warning(u"Client %(name)s is invalid",
757
vars(client))
758
ipc.write("INVALID %s\n" % client.name)
759
session.bye()
760
return
761
ipc.write("SENDING %s\n" % client.name)
762
sent_size = 0
763
while sent_size < len(client.secret):
764
sent = session.send(client.secret[sent_size:])
765
logger.debug(u"Sent: %d, remaining: %d",
766
sent, len(client.secret)
767
- (sent_size + sent))
768
sent_size += sent
769
session.bye()
770
771
772
class ForkingMixInWithPipe(SocketServer.ForkingMixIn, object):
773
"""Like SocketServer.ForkingMixIn, but also pass a pipe.
774
Assumes a gobject.MainLoop event loop.
775
"""
776
def process_request(self, request, client_address):
777
"""This overrides and wraps the original process_request().
778
This function creates a new pipe in self.pipe
779
"""
780
self.pipe = os.pipe()
781
super(ForkingMixInWithPipe,
782
self).process_request(request, client_address)
783
os.close(self.pipe[1]) # close write end
784
# Call "handle_ipc" for both data and EOF events
785
gobject.io_add_watch(self.pipe[0],
786
gobject.IO_IN | gobject.IO_HUP,
787
self.handle_ipc)
788
def handle_ipc(source, condition):
789
"""Dummy function; override as necessary"""
790
os.close(source)
791
return False
792
793
794
class IPv6_TCPServer(ForkingMixInWithPipe,
795
SocketServer.TCPServer, object):
796
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
446
unicode(self.client_address))
447
session = gnutls.connection.ClientSession\
448
(self.request, gnutls.connection.X509Credentials())
449
450
line = self.request.makefile().readline()
451
logger.debug(u"Protocol version: %r", line)
452
try:
453
if int(line.strip().split()[0]) > 1:
454
raise RuntimeError
455
except (ValueError, IndexError, RuntimeError), error:
456
logger.error(u"Unknown protocol version: %s", error)
457
return
458
459
# Note: gnutls.connection.X509Credentials is really a generic
460
# GnuTLS certificate credentials object so long as no X.509
461
# keys are added to it. Therefore, we can use it here despite
462
# using OpenPGP certificates.
463
464
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
465
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
466
# "+DHE-DSS"))
467
priority = "NORMAL" # Fallback default, since this
468
# MUST be set.
469
if self.server.settings["priority"]:
470
priority = self.server.settings["priority"]
471
gnutls.library.functions.gnutls_priority_set_direct\
472
(session._c_object, priority, None);
473
474
try:
475
session.handshake()
476
except gnutls.errors.GNUTLSError, error:
477
logger.warning(u"Handshake failed: %s", error)
478
# Do not run session.bye() here: the session is not
479
# established. Just abandon the request.
480
return
481
try:
482
fpr = fingerprint(peer_certificate(session))
483
except (TypeError, gnutls.errors.GNUTLSError), error:
484
logger.warning(u"Bad certificate: %s", error)
485
session.bye()
486
return
487
logger.debug(u"Fingerprint: %s", fpr)
488
client = None
489
for c in self.server.clients:
490
if c.fingerprint == fpr:
491
client = c
492
break
493
if not client:
494
logger.warning(u"Client not found for fingerprint: %s",
495
fpr)
496
session.bye()
497
return
498
# Have to check if client.still_valid(), since it is possible
499
# that the client timed out while establishing the GnuTLS
500
# session.
501
if not client.still_valid():
502
logger.warning(u"Client %(name)s is invalid",
503
vars(client))
504
session.bye()
505
return
506
sent_size = 0
507
while sent_size < len(client.secret):
508
sent = session.send(client.secret[sent_size:])
509
logger.debug(u"Sent: %d, remaining: %d",
510
sent, len(client.secret)
511
- (sent_size + sent))
512
sent_size += sent
513
session.bye()
514
515
516
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
517
"""IPv6 TCP server. Accepts 'None' as address and/or port.
797
518
Attributes:
798
519
settings: Server settings
799
520
clients: Set() of Client objects
807
528
if "clients" in kwargs:
808
529
self.clients = kwargs["clients"]
809
530
del kwargs["clients"]
810
if "use_ipv6" in kwargs:
811
if not kwargs["use_ipv6"]:
812
self.address_family = socket.AF_INET
813
del kwargs["use_ipv6"]
814
531
self.enabled = False
815
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
532
return super(type(self), self).__init__(*args, **kwargs)
816
533
def server_bind(self):
817
534
"""This overrides the normal server_bind() function
818
535
to bind to an interface if one was specified, and also NOT to
830
547
u" bind to interface %s",
831
548
self.settings["interface"])
832
549
else:
833
raise
550
raise error
834
551
# Only bind(2) the socket if we really need to.
835
552
if self.server_address[0] or self.server_address[1]:
836
553
if not self.server_address[0]:
837
if self.address_family == socket.AF_INET6:
838
any_address = "::" # in6addr_any
839
else:
840
any_address = socket.INADDR_ANY
841
self.server_address = (any_address,
554
in6addr_any = "::"
555
self.server_address = (in6addr_any,
842
556
self.server_address[1])
843
557
elif not self.server_address[1]:
844
558
self.server_address = (self.server_address[0],
850
564
# if_nametoindex
851
565
# (self.settings
852
566
# ["interface"]))
853
return super(IPv6_TCPServer, self).server_bind()
567
return super(type(self), self).server_bind()
854
568
def server_activate(self):
855
569
if self.enabled:
856
return super(IPv6_TCPServer, self).server_activate()
570
return super(type(self), self).server_activate()
857
571
def enable(self):
858
572
self.enabled = True
859
def handle_ipc(self, source, condition, file_objects={}):
860
condition_names = {
861
gobject.IO_IN: "IN", # There is data to read.
862
gobject.IO_OUT: "OUT", # Data can be written (without
863
# blocking).
864
gobject.IO_PRI: "PRI", # There is urgent data to read.
865
gobject.IO_ERR: "ERR", # Error condition.
866
gobject.IO_HUP: "HUP" # Hung up (the connection has been
867
# broken, usually for pipes and
868
# sockets).
869
}
870
conditions_string = ' | '.join(name
871
for cond, name in
872
condition_names.iteritems()
873
if cond & condition)
874
logger.debug("Handling IPC: FD = %d, condition = %s", source,
875
conditions_string)
876
877
# Turn the pipe file descriptor into a Python file object
878
if source not in file_objects:
879
file_objects[source] = os.fdopen(source, "r", 1)
880
881
# Read a line from the file object
882
cmdline = file_objects[source].readline()
883
if not cmdline: # Empty line means end of file
884
# close the IPC pipe
885
file_objects[source].close()
886
del file_objects[source]
887
888
# Stop calling this function
889
return False
890
891
logger.debug("IPC command: %r\n" % cmdline)
892
893
# Parse and act on command
894
cmd, args = cmdline.split(None, 1)
895
if cmd == "NOTFOUND":
896
if self.settings["use_dbus"]:
897
# Emit D-Bus signal
898
mandos_dbus_service.ClientNotFound(args)
899
elif cmd == "INVALID":
900
if self.settings["use_dbus"]:
901
for client in self.clients:
902
if client.name == args:
903
# Emit D-Bus signal
904
client.Rejected()
905
break
906
elif cmd == "SENDING":
907
for client in self.clients:
908
if client.name == args:
909
client.checked_ok()
910
if self.settings["use_dbus"]:
911
# Emit D-Bus signal
912
client.ReceivedSecret()
913
break
914
else:
915
logger.error("Unknown IPC command: %r", cmdline)
916
917
# Keep calling this function
918
return True
919
573
920
574
921
575
def string_to_delta(interval):
922
576
"""Parse a string and return a datetime.timedelta
923
577
924
578
>>> string_to_delta('7d')
925
579
datetime.timedelta(7)
926
580
>>> string_to_delta('60s')
937
591
timevalue = datetime.timedelta(0)
938
592
for s in interval.split():
939
593
try:
940
suffix = unicode(s[-1])
941
value = int(s[:-1])
594
suffix=unicode(s[-1])
595
value=int(s[:-1])
942
596
if suffix == u"d":
943
597
delta = datetime.timedelta(value)
944
598
elif suffix == u"s":
978
632
elif state == avahi.ENTRY_GROUP_FAILURE:
979
633
logger.critical(u"Avahi: Error in group state changed %s",
980
634
unicode(error))
981
raise AvahiGroupError(u"State changed: %s" % unicode(error))
635
raise AvahiGroupError("State changed: %s", str(error))
982
636
983
637
def if_nametoindex(interface):
984
638
"""Call the C function if_nametoindex(), or equivalent"""
985
639
global if_nametoindex
986
640
try:
987
if_nametoindex = (ctypes.cdll.LoadLibrary
988
(ctypes.util.find_library("c"))
989
.if_nametoindex)
641
if "ctypes.util" not in sys.modules:
642
import ctypes.util
643
if_nametoindex = ctypes.cdll.LoadLibrary\
644
(ctypes.util.find_library("c")).if_nametoindex
990
645
except (OSError, AttributeError):
991
646
if "struct" not in sys.modules:
992
647
import struct
995
650
def if_nametoindex(interface):
996
651
"Get an interface index the hard way, i.e. using fcntl()"
997
652
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
998
with closing(socket.socket()) as s:
999
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1000
struct.pack("16s16x", interface))
653
s = socket.socket()
654
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
655
struct.pack("16s16x", interface))
656
s.close()
1001
657
interface_index = struct.unpack("I", ifreq[16:20])[0]
1002
658
return interface_index
1003
659
return if_nametoindex(interface)
1027
683
1028
684
1029
685
def main():
1030
1031
######################################################################
1032
# Parsing of options, both command line and config file
1033
1034
parser = optparse.OptionParser(version = "%%prog %s" % version)
686
global main_loop_started
687
main_loop_started = False
688
689
parser = OptionParser(version = "%%prog %s" % version)
1035
690
parser.add_option("-i", "--interface", type="string",
1036
691
metavar="IF", help="Bind to interface IF")
1037
692
parser.add_option("-a", "--address", type="string",
1038
693
help="Address to listen for requests on")
1039
694
parser.add_option("-p", "--port", type="int",
1040
695
help="Port number to receive requests on")
1041
parser.add_option("--check", action="store_true",
696
parser.add_option("--check", action="store_true", default=False,
1042
697
help="Run self-test")
1043
698
parser.add_option("--debug", action="store_true",
1044
699
help="Debug mode; run in foreground and log to"
1051
706
default="/etc/mandos", metavar="DIR",
1052
707
help="Directory to search for configuration"
1053
708
" files")
1054
parser.add_option("--no-dbus", action="store_false",
1055
dest="use_dbus",
1056
help="Do not provide D-Bus system bus"
1057
" interface")
1058
parser.add_option("--no-ipv6", action="store_false",
1059
dest="use_ipv6", help="Do not use IPv6")
1060
options = parser.parse_args()[0]
709
(options, args) = parser.parse_args()
1061
710
1062
711
if options.check:
1063
712
import doctest
1072
721
"priority":
1073
722
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1074
723
"servicename": "Mandos",
1075
"use_dbus": "True",
1076
"use_ipv6": "True",
1077
724
}
1078
725
1079
726
# Parse config file for server-global settings
1082
729
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1083
730
# Convert the SafeConfigParser object to a dict
1084
731
server_settings = server_config.defaults()
1085
# Use the appropriate methods on the non-string config options
1086
server_settings["debug"] = server_config.getboolean("DEFAULT",
1087
"debug")
1088
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
1089
"use_dbus")
1090
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
1091
"use_ipv6")
1092
if server_settings["port"]:
1093
server_settings["port"] = server_config.getint("DEFAULT",
1094
"port")
732
# Use getboolean on the boolean config option
733
server_settings["debug"] = server_config.getboolean\
734
("DEFAULT", "debug")
1095
735
del server_config
1096
736
1097
737
# Override the settings from the config file with command line
1098
738
# options, if set.
1099
739
for option in ("interface", "address", "port", "debug",
1100
"priority", "servicename", "configdir",
1101
"use_dbus", "use_ipv6"):
740
"priority", "servicename", "configdir"):
1102
741
value = getattr(options, option)
1103
742
if value is not None:
1104
743
server_settings[option] = value
1105
744
del options
1106
745
# Now we have our good server settings in "server_settings"
1107
746
1108
##################################################################
1109
1110
# For convenience
1111
747
debug = server_settings["debug"]
1112
use_dbus = server_settings["use_dbus"]
1113
use_ipv6 = server_settings["use_ipv6"]
1114
748
1115
749
if not debug:
1116
750
syslogger.setLevel(logging.WARNING)
1117
751
console.setLevel(logging.WARNING)
1118
752
1119
753
if server_settings["servicename"] != "Mandos":
1120
syslogger.setFormatter(logging.Formatter
1121
('Mandos (%s) [%%(process)d]:'
1122
' %%(levelname)s: %%(message)s'
754
syslogger.setFormatter(logging.Formatter\
755
('Mandos (%s): %%(levelname)s:'
756
' %%(message)s'
1123
757
% server_settings["servicename"]))
1124
758
1125
759
# Parse config file with clients
1126
760
client_defaults = { "timeout": "1h",
1127
761
"interval": "5m",
1128
"checker": "fping -q -- %%(host)s",
762
"checker": "fping -q -- %(host)s",
1129
763
"host": "",
1130
764
}
1131
765
client_config = ConfigParser.SafeConfigParser(client_defaults)
1132
766
client_config.read(os.path.join(server_settings["configdir"],
1133
767
"clients.conf"))
1134
1135
global mandos_dbus_service
1136
mandos_dbus_service = None
1137
768
1138
769
clients = Set()
1139
770
tcp_server = IPv6_TCPServer((server_settings["address"],
1140
771
server_settings["port"]),
1141
TCP_handler,
772
tcp_handler,
1142
773
settings=server_settings,
1143
clients=clients, use_ipv6=use_ipv6)
774
clients=clients)
1144
775
pidfilename = "/var/run/mandos.pid"
1145
776
try:
1146
777
pidfile = open(pidfilename, "w")
1147
except IOError:
778
except IOError, error:
1148
779
logger.error("Could not open file %r", pidfilename)
1149
780
1150
try:
1151
uid = pwd.getpwnam("_mandos").pw_uid
1152
gid = pwd.getpwnam("_mandos").pw_gid
1153
except KeyError:
1154
try:
1155
uid = pwd.getpwnam("mandos").pw_uid
1156
gid = pwd.getpwnam("mandos").pw_gid
1157
except KeyError:
1158
try:
1159
uid = pwd.getpwnam("nobody").pw_uid
1160
gid = pwd.getpwnam("nogroup").pw_gid
1161
except KeyError:
1162
uid = 65534
1163
gid = 65534
1164
try:
781
uid = 65534
782
gid = 65534
783
try:
784
uid = pwd.getpwnam("mandos").pw_uid
785
except KeyError:
786
try:
787
uid = pwd.getpwnam("nobody").pw_uid
788
except KeyError:
789
pass
790
try:
791
gid = pwd.getpwnam("mandos").pw_gid
792
except KeyError:
793
try:
794
gid = pwd.getpwnam("nogroup").pw_gid
795
except KeyError:
796
pass
797
try:
798
os.setuid(uid)
1165
799
os.setgid(gid)
1166
os.setuid(uid)
1167
800
except OSError, error:
1168
801
if error[0] != errno.EPERM:
1169
802
raise error
1170
803
1171
# Enable all possible GnuTLS debugging
1172
if debug:
1173
# "Use a log level over 10 to enable all debugging options."
1174
# - GnuTLS manual
1175
gnutls.library.functions.gnutls_global_set_log_level(11)
1176
1177
@gnutls.library.types.gnutls_log_func
1178
def debug_gnutls(level, string):
1179
logger.debug("GnuTLS: %s", string[:-1])
1180
1181
(gnutls.library.functions
1182
.gnutls_global_set_log_function(debug_gnutls))
1183
1184
804
global service
1185
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1186
805
service = AvahiService(name = server_settings["servicename"],
1187
servicetype = "_mandos._tcp",
1188
protocol = protocol)
806
type = "_mandos._tcp", );
1189
807
if server_settings["interface"]:
1190
service.interface = (if_nametoindex
1191
(server_settings["interface"]))
808
service.interface = if_nametoindex\
809
(server_settings["interface"])
1192
810
1193
811
global main_loop
1194
812
global bus
1201
819
avahi.DBUS_PATH_SERVER),
1202
820
avahi.DBUS_INTERFACE_SERVER)
1203
821
# End of Avahi example code
1204
if use_dbus:
1205
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
822
823
def remove_from_clients(client):
824
clients.remove(client)
825
if not clients:
826
logger.critical(u"No clients left, exiting")
827
sys.exit()
1206
828
1207
829
clients.update(Set(Client(name = section,
830
stop_hook = remove_from_clients,
1208
831
config
1209
= dict(client_config.items(section)),
1210
use_dbus = use_dbus)
832
= dict(client_config.items(section)))
1211
833
for section in client_config.sections()))
1212
834
if not clients:
1213
logger.warning(u"No clients defined")
835
logger.critical(u"No clients defined")
836
sys.exit(1)
1214
837
1215
838
if debug:
1216
839
# Redirect stdin so all checkers get /dev/null
1225
848
daemon()
1226
849
1227
850
try:
1228
with closing(pidfile):
1229
pid = os.getpid()
1230
pidfile.write(str(pid) + "\n")
851
pid = os.getpid()
852
pidfile.write(str(pid) + "\n")
853
pidfile.close()
1231
854
del pidfile
1232
except IOError:
855
except IOError, err:
1233
856
logger.error(u"Could not write to file %r with PID %d",
1234
857
pidfilename, pid)
1235
858
except NameError:
1248
871
1249
872
while clients:
1250
873
client = clients.pop()
1251
client.disable_hook = None
1252
client.disable()
874
client.stop_hook = None
875
client.stop()
1253
876
1254
877
atexit.register(cleanup)
1255
878
1258
881
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1259
882
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1260
883
1261
if use_dbus:
1262
class MandosDBusService(dbus.service.Object):
1263
"""A D-Bus proxy object"""
1264
def __init__(self):
1265
dbus.service.Object.__init__(self, bus, "/")
1266
_interface = u"se.bsnet.fukt.Mandos"
1267
1268
@dbus.service.signal(_interface, signature="oa{sv}")
1269
def ClientAdded(self, objpath, properties):
1270
"D-Bus signal"
1271
pass
1272
1273
@dbus.service.signal(_interface, signature="s")
1274
def ClientNotFound(self, fingerprint):
1275
"D-Bus signal"
1276
pass
1277
1278
@dbus.service.signal(_interface, signature="os")
1279
def ClientRemoved(self, objpath, name):
1280
"D-Bus signal"
1281
pass
1282
1283
@dbus.service.method(_interface, out_signature="ao")
1284
def GetAllClients(self):
1285
"D-Bus method"
1286
return dbus.Array(c.dbus_object_path for c in clients)
1287
1288
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1289
def GetAllClientsWithProperties(self):
1290
"D-Bus method"
1291
return dbus.Dictionary(
1292
((c.dbus_object_path, c.GetAllProperties())
1293
for c in clients),
1294
signature="oa{sv}")
1295
1296
@dbus.service.method(_interface, in_signature="o")
1297
def RemoveClient(self, object_path):
1298
"D-Bus method"
1299
for c in clients:
1300
if c.dbus_object_path == object_path:
1301
clients.remove(c)
1302
# Don't signal anything except ClientRemoved
1303
c.use_dbus = False
1304
c.disable()
1305
# Emit D-Bus signal
1306
self.ClientRemoved(object_path, c.name)
1307
return
1308
raise KeyError
1309
1310
del _interface
1311
1312
mandos_dbus_service = MandosDBusService()
1313
1314
884
for client in clients:
1315
if use_dbus:
1316
# Emit D-Bus signal
1317
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1318
client.GetAllProperties())
1319
client.enable()
885
client.start()
1320
886
1321
887
tcp_server.enable()
1322
888
tcp_server.server_activate()
1323
889
1324
890
# Find out what port we got
1325
891
service.port = tcp_server.socket.getsockname()[1]
1326
if use_ipv6:
1327
logger.info(u"Now listening on address %r, port %d,"
1328
" flowinfo %d, scope_id %d"
1329
% tcp_server.socket.getsockname())
1330
else: # IPv4
1331
logger.info(u"Now listening on address %r, port %d"
1332
% tcp_server.socket.getsockname())
892
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
893
u" scope_id %d" % tcp_server.socket.getsockname())
1333
894
1334
895
#service.interface = tcp_server.socket.getsockname()[3]
1335
896
1345
906
1346
907
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1347
908
lambda *args, **kwargs:
1348
(tcp_server.handle_request
1349
(*args[2:], **kwargs) or True))
909
tcp_server.handle_request\
910
(*args[2:], **kwargs) or True)
1350
911
1351
912
logger.debug(u"Starting main loop")
913
main_loop_started = True
1352
914
main_loop.run()
1353
915
except AvahiError, error:
1354
logger.critical(u"AvahiError: %s", error)
916
logger.critical(u"AvahiError: %s" + unicode(error))
1355
917
sys.exit(1)
1356
918
except KeyboardInterrupt:
1357
919
if debug:
1358
print >> sys.stderr
1359
logger.debug("Server received KeyboardInterrupt")
1360
logger.debug("Server exiting")
920
print
1361
921
1362
922
if __name__ == '__main__':
1363
923
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0